linux-hardened/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c

2532 lines
69 KiB
C
Raw Normal View History

/*
* Copyright (c) 2010 Broadcom Corporation
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include <linux/types.h>
#include <linux/module.h>
#include <linux/if_ether.h>
#include <linux/spinlock.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/err.h>
#include <linux/jiffies.h>
#include <net/cfg80211.h>
#include <brcmu_utils.h>
#include <brcmu_wifi.h>
#include "core.h"
#include "debug.h"
#include "bus.h"
#include "fwil.h"
#include "fwil_types.h"
#include "fweh.h"
#include "fwsignal.h"
#include "p2p.h"
#include "cfg80211.h"
#include "proto.h"
#include "bcdc.h"
#include "common.h"
/**
* DOC: Firmware Signalling
*
* Firmware can send signals to host and vice versa, which are passed in the
* data packets using TLV based header. This signalling layer is on top of the
* BDC bus protocol layer.
*/
/*
* single definition for firmware-driver flow control tlv's.
*
* each tlv is specified by BRCMF_FWS_TLV_DEF(name, ID, length).
* A length value 0 indicates variable length tlv.
*/
#define BRCMF_FWS_TLV_DEFLIST \
BRCMF_FWS_TLV_DEF(MAC_OPEN, 1, 1) \
BRCMF_FWS_TLV_DEF(MAC_CLOSE, 2, 1) \
BRCMF_FWS_TLV_DEF(MAC_REQUEST_CREDIT, 3, 2) \
BRCMF_FWS_TLV_DEF(TXSTATUS, 4, 4) \
BRCMF_FWS_TLV_DEF(PKTTAG, 5, 4) \
BRCMF_FWS_TLV_DEF(MACDESC_ADD, 6, 8) \
BRCMF_FWS_TLV_DEF(MACDESC_DEL, 7, 8) \
BRCMF_FWS_TLV_DEF(RSSI, 8, 1) \
BRCMF_FWS_TLV_DEF(INTERFACE_OPEN, 9, 1) \
BRCMF_FWS_TLV_DEF(INTERFACE_CLOSE, 10, 1) \
BRCMF_FWS_TLV_DEF(FIFO_CREDITBACK, 11, 6) \
BRCMF_FWS_TLV_DEF(PENDING_TRAFFIC_BMP, 12, 2) \
BRCMF_FWS_TLV_DEF(MAC_REQUEST_PACKET, 13, 3) \
BRCMF_FWS_TLV_DEF(HOST_REORDER_RXPKTS, 14, 10) \
BRCMF_FWS_TLV_DEF(TRANS_ID, 18, 6) \
BRCMF_FWS_TLV_DEF(COMP_TXSTATUS, 19, 1) \
BRCMF_FWS_TLV_DEF(FILLER, 255, 0)
/*
* enum brcmf_fws_tlv_type - definition of tlv identifiers.
*/
#define BRCMF_FWS_TLV_DEF(name, id, len) \
BRCMF_FWS_TYPE_ ## name = id,
enum brcmf_fws_tlv_type {
BRCMF_FWS_TLV_DEFLIST
BRCMF_FWS_TYPE_INVALID
};
#undef BRCMF_FWS_TLV_DEF
/*
* enum brcmf_fws_tlv_len - definition of tlv lengths.
*/
#define BRCMF_FWS_TLV_DEF(name, id, len) \
BRCMF_FWS_TYPE_ ## name ## _LEN = (len),
enum brcmf_fws_tlv_len {
BRCMF_FWS_TLV_DEFLIST
};
#undef BRCMF_FWS_TLV_DEF
/* AMPDU rx reordering definitions */
#define BRCMF_RXREORDER_FLOWID_OFFSET 0
#define BRCMF_RXREORDER_MAXIDX_OFFSET 2
#define BRCMF_RXREORDER_FLAGS_OFFSET 4
#define BRCMF_RXREORDER_CURIDX_OFFSET 6
#define BRCMF_RXREORDER_EXPIDX_OFFSET 8
#define BRCMF_RXREORDER_DEL_FLOW 0x01
#define BRCMF_RXREORDER_FLUSH_ALL 0x02
#define BRCMF_RXREORDER_CURIDX_VALID 0x04
#define BRCMF_RXREORDER_EXPIDX_VALID 0x08
#define BRCMF_RXREORDER_NEW_HOLE 0x10
#ifdef DEBUG
/*
* brcmf_fws_tlv_names - array of tlv names.
*/
#define BRCMF_FWS_TLV_DEF(name, id, len) \
{ id, #name },
static struct {
enum brcmf_fws_tlv_type id;
const char *name;
} brcmf_fws_tlv_names[] = {
BRCMF_FWS_TLV_DEFLIST
};
#undef BRCMF_FWS_TLV_DEF
static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
{
int i;
for (i = 0; i < ARRAY_SIZE(brcmf_fws_tlv_names); i++)
if (brcmf_fws_tlv_names[i].id == id)
return brcmf_fws_tlv_names[i].name;
return "INVALID";
}
#else
static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
{
return "NODEBUG";
}
#endif /* DEBUG */
/*
* The PKTTAG tlv has additional bytes when firmware-signalling
* mode has REUSESEQ flag set.
*/
#define BRCMF_FWS_TYPE_SEQ_LEN 2
/*
* flags used to enable tlv signalling from firmware.
*/
#define BRCMF_FWS_FLAGS_RSSI_SIGNALS 0x0001
#define BRCMF_FWS_FLAGS_XONXOFF_SIGNALS 0x0002
#define BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS 0x0004
#define BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE 0x0008
#define BRCMF_FWS_FLAGS_PSQ_GENERATIONFSM_ENABLE 0x0010
#define BRCMF_FWS_FLAGS_PSQ_ZERO_BUFFER_ENABLE 0x0020
#define BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE 0x0040
#define BRCMF_FWS_MAC_DESC_TABLE_SIZE 32
#define BRCMF_FWS_MAC_DESC_ID_INVALID 0xff
#define BRCMF_FWS_HOSTIF_FLOWSTATE_OFF 0
#define BRCMF_FWS_HOSTIF_FLOWSTATE_ON 1
#define BRCMF_FWS_FLOWCONTROL_HIWATER 128
#define BRCMF_FWS_FLOWCONTROL_LOWATER 64
#define BRCMF_FWS_PSQ_PREC_COUNT ((BRCMF_FWS_FIFO_COUNT + 1) * 2)
#define BRCMF_FWS_PSQ_LEN 256
#define BRCMF_FWS_HTOD_FLAG_PKTFROMHOST 0x01
#define BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED 0x02
#define BRCMF_FWS_RET_OK_NOSCHEDULE 0
#define BRCMF_FWS_RET_OK_SCHEDULE 1
#define BRCMF_FWS_MODE_REUSESEQ_SHIFT 3 /* seq reuse */
#define BRCMF_FWS_MODE_SET_REUSESEQ(x, val) ((x) = \
((x) & ~(1 << BRCMF_FWS_MODE_REUSESEQ_SHIFT)) | \
(((val) & 1) << BRCMF_FWS_MODE_REUSESEQ_SHIFT))
#define BRCMF_FWS_MODE_GET_REUSESEQ(x) \
(((x) >> BRCMF_FWS_MODE_REUSESEQ_SHIFT) & 1)
/**
* enum brcmf_fws_skb_state - indicates processing state of skb.
*
* @BRCMF_FWS_SKBSTATE_NEW: sk_buff is newly arrived in the driver.
* @BRCMF_FWS_SKBSTATE_DELAYED: sk_buff had to wait on queue.
* @BRCMF_FWS_SKBSTATE_SUPPRESSED: sk_buff has been suppressed by firmware.
* @BRCMF_FWS_SKBSTATE_TIM: allocated for TIM update info.
*/
enum brcmf_fws_skb_state {
BRCMF_FWS_SKBSTATE_NEW,
BRCMF_FWS_SKBSTATE_DELAYED,
BRCMF_FWS_SKBSTATE_SUPPRESSED,
BRCMF_FWS_SKBSTATE_TIM
};
/**
* struct brcmf_skbuff_cb - control buffer associated with skbuff.
*
* @bus_flags: 2 bytes reserved for bus specific parameters
* @if_flags: holds interface index and packet related flags.
* @htod: host to device packet identifier (used in PKTTAG tlv).
* @htod_seq: this 16-bit is original seq number for every suppress packet.
* @state: transmit state of the packet.
* @mac: descriptor related to destination for this packet.
*
* This information is stored in control buffer struct sk_buff::cb, which
* provides 48 bytes of storage so this structure should not exceed that.
*/
struct brcmf_skbuff_cb {
u16 bus_flags;
u16 if_flags;
u32 htod;
u16 htod_seq;
enum brcmf_fws_skb_state state;
struct brcmf_fws_mac_descriptor *mac;
};
/*
* macro casting skbuff control buffer to struct brcmf_skbuff_cb.
*/
#define brcmf_skbcb(skb) ((struct brcmf_skbuff_cb *)((skb)->cb))
/*
* sk_buff control if flags
*
* b[11] - packet sent upon firmware request.
* b[10] - packet only contains signalling data.
* b[9] - packet is a tx packet.
* b[8] - packet used requested credit
* b[7] - interface in AP mode.
* b[3:0] - interface index.
*/
#define BRCMF_SKB_IF_FLAGS_REQUESTED_MASK 0x0800
#define BRCMF_SKB_IF_FLAGS_REQUESTED_SHIFT 11
#define BRCMF_SKB_IF_FLAGS_SIGNAL_ONLY_MASK 0x0400
#define BRCMF_SKB_IF_FLAGS_SIGNAL_ONLY_SHIFT 10
#define BRCMF_SKB_IF_FLAGS_TRANSMIT_MASK 0x0200
#define BRCMF_SKB_IF_FLAGS_TRANSMIT_SHIFT 9
#define BRCMF_SKB_IF_FLAGS_REQ_CREDIT_MASK 0x0100
#define BRCMF_SKB_IF_FLAGS_REQ_CREDIT_SHIFT 8
#define BRCMF_SKB_IF_FLAGS_IF_AP_MASK 0x0080
#define BRCMF_SKB_IF_FLAGS_IF_AP_SHIFT 7
#define BRCMF_SKB_IF_FLAGS_INDEX_MASK 0x000f
#define BRCMF_SKB_IF_FLAGS_INDEX_SHIFT 0
#define brcmf_skb_if_flags_set_field(skb, field, value) \
brcmu_maskset16(&(brcmf_skbcb(skb)->if_flags), \
BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT, (value))
#define brcmf_skb_if_flags_get_field(skb, field) \
brcmu_maskget16(brcmf_skbcb(skb)->if_flags, \
BRCMF_SKB_IF_FLAGS_ ## field ## _MASK, \
BRCMF_SKB_IF_FLAGS_ ## field ## _SHIFT)
/*
* sk_buff control packet identifier
*
* 32-bit packet identifier used in PKTTAG tlv from host to dongle.
*
* - Generated at the host (e.g. dhd)
* - Seen as a generic sequence number by firmware except for the flags field.
*
* Generation : b[31] => generation number for this packet [host->fw]
* OR, current generation number [fw->host]
* Flags : b[30:27] => command, status flags
* FIFO-AC : b[26:24] => AC-FIFO id
* h-slot : b[23:8] => hanger-slot
* freerun : b[7:0] => A free running counter
*/
#define BRCMF_SKB_HTOD_TAG_GENERATION_MASK 0x80000000
#define BRCMF_SKB_HTOD_TAG_GENERATION_SHIFT 31
#define BRCMF_SKB_HTOD_TAG_FLAGS_MASK 0x78000000
#define BRCMF_SKB_HTOD_TAG_FLAGS_SHIFT 27
#define BRCMF_SKB_HTOD_TAG_FIFO_MASK 0x07000000
#define BRCMF_SKB_HTOD_TAG_FIFO_SHIFT 24
#define BRCMF_SKB_HTOD_TAG_HSLOT_MASK 0x00ffff00
#define BRCMF_SKB_HTOD_TAG_HSLOT_SHIFT 8
#define BRCMF_SKB_HTOD_TAG_FREERUN_MASK 0x000000ff
#define BRCMF_SKB_HTOD_TAG_FREERUN_SHIFT 0
#define brcmf_skb_htod_tag_set_field(skb, field, value) \
brcmu_maskset32(&(brcmf_skbcb(skb)->htod), \
BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT, (value))
#define brcmf_skb_htod_tag_get_field(skb, field) \
brcmu_maskget32(brcmf_skbcb(skb)->htod, \
BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT)
#define BRCMF_SKB_HTOD_SEQ_FROMFW_MASK 0x2000
#define BRCMF_SKB_HTOD_SEQ_FROMFW_SHIFT 13
#define BRCMF_SKB_HTOD_SEQ_FROMDRV_MASK 0x1000
#define BRCMF_SKB_HTOD_SEQ_FROMDRV_SHIFT 12
#define BRCMF_SKB_HTOD_SEQ_NR_MASK 0x0fff
#define BRCMF_SKB_HTOD_SEQ_NR_SHIFT 0
#define brcmf_skb_htod_seq_set_field(skb, field, value) \
brcmu_maskset16(&(brcmf_skbcb(skb)->htod_seq), \
BRCMF_SKB_HTOD_SEQ_ ## field ## _MASK, \
BRCMF_SKB_HTOD_SEQ_ ## field ## _SHIFT, (value))
#define brcmf_skb_htod_seq_get_field(skb, field) \
brcmu_maskget16(brcmf_skbcb(skb)->htod_seq, \
BRCMF_SKB_HTOD_SEQ_ ## field ## _MASK, \
BRCMF_SKB_HTOD_SEQ_ ## field ## _SHIFT)
#define BRCMF_FWS_TXSTAT_GENERATION_MASK 0x80000000
#define BRCMF_FWS_TXSTAT_GENERATION_SHIFT 31
#define BRCMF_FWS_TXSTAT_FLAGS_MASK 0x78000000
#define BRCMF_FWS_TXSTAT_FLAGS_SHIFT 27
#define BRCMF_FWS_TXSTAT_FIFO_MASK 0x07000000
#define BRCMF_FWS_TXSTAT_FIFO_SHIFT 24
#define BRCMF_FWS_TXSTAT_HSLOT_MASK 0x00FFFF00
#define BRCMF_FWS_TXSTAT_HSLOT_SHIFT 8
#define BRCMF_FWS_TXSTAT_FREERUN_MASK 0x000000FF
#define BRCMF_FWS_TXSTAT_FREERUN_SHIFT 0
#define brcmf_txstatus_get_field(txs, field) \
brcmu_maskget32(txs, BRCMF_FWS_TXSTAT_ ## field ## _MASK, \
BRCMF_FWS_TXSTAT_ ## field ## _SHIFT)
/* How long to defer borrowing in jiffies */
#define BRCMF_FWS_BORROW_DEFER_PERIOD (HZ / 10)
/**
* enum brcmf_fws_fifo - fifo indices used by dongle firmware.
*
* @BRCMF_FWS_FIFO_FIRST: first fifo, ie. background.
* @BRCMF_FWS_FIFO_AC_BK: fifo for background traffic.
* @BRCMF_FWS_FIFO_AC_BE: fifo for best-effort traffic.
* @BRCMF_FWS_FIFO_AC_VI: fifo for video traffic.
* @BRCMF_FWS_FIFO_AC_VO: fifo for voice traffic.
* @BRCMF_FWS_FIFO_BCMC: fifo for broadcast/multicast (AP only).
* @BRCMF_FWS_FIFO_ATIM: fifo for ATIM (AP only).
* @BRCMF_FWS_FIFO_COUNT: number of fifos.
*/
enum brcmf_fws_fifo {
BRCMF_FWS_FIFO_FIRST,
BRCMF_FWS_FIFO_AC_BK = BRCMF_FWS_FIFO_FIRST,
BRCMF_FWS_FIFO_AC_BE,
BRCMF_FWS_FIFO_AC_VI,
BRCMF_FWS_FIFO_AC_VO,
BRCMF_FWS_FIFO_BCMC,
BRCMF_FWS_FIFO_ATIM,
BRCMF_FWS_FIFO_COUNT
};
/**
* enum brcmf_fws_txstatus - txstatus flag values.
*
* @BRCMF_FWS_TXSTATUS_DISCARD:
* host is free to discard the packet.
* @BRCMF_FWS_TXSTATUS_CORE_SUPPRESS:
* 802.11 core suppressed the packet.
* @BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS:
* firmware suppress the packet as device is already in PS mode.
* @BRCMF_FWS_TXSTATUS_FW_TOSSED:
* firmware tossed the packet.
* @BRCMF_FWS_TXSTATUS_HOST_TOSSED:
* host tossed the packet.
*/
enum brcmf_fws_txstatus {
BRCMF_FWS_TXSTATUS_DISCARD,
BRCMF_FWS_TXSTATUS_CORE_SUPPRESS,
BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS,
BRCMF_FWS_TXSTATUS_FW_TOSSED,
BRCMF_FWS_TXSTATUS_HOST_TOSSED
};
enum brcmf_fws_fcmode {
BRCMF_FWS_FCMODE_NONE,
BRCMF_FWS_FCMODE_IMPLIED_CREDIT,
BRCMF_FWS_FCMODE_EXPLICIT_CREDIT
};
enum brcmf_fws_mac_desc_state {
BRCMF_FWS_STATE_OPEN = 1,
BRCMF_FWS_STATE_CLOSE
};
/**
* struct brcmf_fws_mac_descriptor - firmware signalling data per node/interface
*
* @occupied: slot is in use.
* @mac_handle: handle for mac entry determined by firmware.
* @interface_id: interface index.
* @state: current state.
* @suppressed: mac entry is suppressed.
* @generation: generation bit.
* @ac_bitmap: ac queue bitmap.
* @requested_credit: credits requested by firmware.
* @ea: ethernet address.
* @seq: per-node free-running sequence.
* @psq: power-save queue.
* @transit_count: packet in transit to firmware.
*/
struct brcmf_fws_mac_descriptor {
char name[16];
u8 occupied;
u8 mac_handle;
u8 interface_id;
u8 state;
bool suppressed;
u8 generation;
u8 ac_bitmap;
u8 requested_credit;
u8 requested_packet;
u8 ea[ETH_ALEN];
u8 seq[BRCMF_FWS_FIFO_COUNT];
struct pktq psq;
int transit_count;
int suppr_transit_count;
bool send_tim_signal;
u8 traffic_pending_bmp;
u8 traffic_lastreported_bmp;
};
#define BRCMF_FWS_HANGER_MAXITEMS 1024
/**
* enum brcmf_fws_hanger_item_state - state of hanger item.
*
* @BRCMF_FWS_HANGER_ITEM_STATE_FREE: item is free for use.
* @BRCMF_FWS_HANGER_ITEM_STATE_INUSE: item is in use.
* @BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED: item was suppressed.
*/
enum brcmf_fws_hanger_item_state {
BRCMF_FWS_HANGER_ITEM_STATE_FREE = 1,
BRCMF_FWS_HANGER_ITEM_STATE_INUSE,
BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED
};
/**
* struct brcmf_fws_hanger_item - single entry for tx pending packet.
*
* @state: entry is either free or occupied.
* @pkt: packet itself.
*/
struct brcmf_fws_hanger_item {
enum brcmf_fws_hanger_item_state state;
struct sk_buff *pkt;
};
/**
* struct brcmf_fws_hanger - holds packets awaiting firmware txstatus.
*
* @pushed: packets pushed to await txstatus.
* @popped: packets popped upon handling txstatus.
* @failed_to_push: packets that could not be pushed.
* @failed_to_pop: packets that could not be popped.
* @failed_slotfind: packets for which failed to find an entry.
* @slot_pos: last returned item index for a free entry.
* @items: array of hanger items.
*/
struct brcmf_fws_hanger {
u32 pushed;
u32 popped;
u32 failed_to_push;
u32 failed_to_pop;
u32 failed_slotfind;
u32 slot_pos;
struct brcmf_fws_hanger_item items[BRCMF_FWS_HANGER_MAXITEMS];
};
struct brcmf_fws_macdesc_table {
struct brcmf_fws_mac_descriptor nodes[BRCMF_FWS_MAC_DESC_TABLE_SIZE];
struct brcmf_fws_mac_descriptor iface[BRCMF_MAX_IFS];
struct brcmf_fws_mac_descriptor other;
};
struct brcmf_fws_stats {
u32 tlv_parse_failed;
u32 tlv_invalid_type;
u32 header_only_pkt;
u32 header_pulls;
u32 pkt2bus;
u32 send_pkts[5];
u32 requested_sent[5];
u32 generic_error;
u32 mac_update_failed;
u32 mac_ps_update_failed;
u32 if_update_failed;
u32 packet_request_failed;
u32 credit_request_failed;
u32 rollback_success;
u32 rollback_failed;
u32 delayq_full_error;
u32 supprq_full_error;
u32 txs_indicate;
u32 txs_discard;
u32 txs_supp_core;
u32 txs_supp_ps;
u32 txs_tossed;
u32 txs_host_tossed;
u32 bus_flow_block;
u32 fws_flow_block;
};
struct brcmf_fws_info {
struct brcmf_pub *drvr;
spinlock_t spinlock;
ulong flags;
struct brcmf_fws_stats stats;
struct brcmf_fws_hanger hanger;
enum brcmf_fws_fcmode fcmode;
bool fw_signals;
bool bcmc_credit_check;
struct brcmf_fws_macdesc_table desc;
struct workqueue_struct *fws_wq;
struct work_struct fws_dequeue_work;
u32 fifo_enqpkt[BRCMF_FWS_FIFO_COUNT];
int fifo_credit[BRCMF_FWS_FIFO_COUNT];
int init_fifo_credit[BRCMF_FWS_FIFO_COUNT];
int credits_borrowed[BRCMF_FWS_FIFO_AC_VO + 1];
int deq_node_pos[BRCMF_FWS_FIFO_COUNT];
u32 fifo_credit_map;
u32 fifo_delay_map;
unsigned long borrow_defer_timestamp;
bool bus_flow_blocked;
bool creditmap_received;
u8 mode;
bool avoid_queueing;
};
/*
* brcmf_fws_prio2fifo - mapping from 802.1d priority to firmware fifo index.
*/
static const int brcmf_fws_prio2fifo[] = {
BRCMF_FWS_FIFO_AC_BE,
BRCMF_FWS_FIFO_AC_BK,
BRCMF_FWS_FIFO_AC_BK,
BRCMF_FWS_FIFO_AC_BE,
BRCMF_FWS_FIFO_AC_VI,
BRCMF_FWS_FIFO_AC_VI,
BRCMF_FWS_FIFO_AC_VO,
BRCMF_FWS_FIFO_AC_VO
};
#define BRCMF_FWS_TLV_DEF(name, id, len) \
case BRCMF_FWS_TYPE_ ## name: \
return len;
/**
* brcmf_fws_get_tlv_len() - returns defined length for given tlv id.
*
* @fws: firmware-signalling information.
* @id: identifier of the TLV.
*
* Return: the specified length for the given TLV; Otherwise -EINVAL.
*/
static int brcmf_fws_get_tlv_len(struct brcmf_fws_info *fws,
enum brcmf_fws_tlv_type id)
{
switch (id) {
BRCMF_FWS_TLV_DEFLIST
default:
fws->stats.tlv_invalid_type++;
break;
}
return -EINVAL;
}
#undef BRCMF_FWS_TLV_DEF
static void brcmf_fws_lock(struct brcmf_fws_info *fws)
__acquires(&fws->spinlock)
{
spin_lock_irqsave(&fws->spinlock, fws->flags);
}
static void brcmf_fws_unlock(struct brcmf_fws_info *fws)
__releases(&fws->spinlock)
{
spin_unlock_irqrestore(&fws->spinlock, fws->flags);
}
static bool brcmf_fws_ifidx_match(struct sk_buff *skb, void *arg)
{
u32 ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
return ifidx == *(int *)arg;
}
static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
{
int i;
memset(hanger, 0, sizeof(*hanger));
for (i = 0; i < ARRAY_SIZE(hanger->items); i++)
hanger->items[i].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
}
static u32 brcmf_fws_hanger_get_free_slot(struct brcmf_fws_hanger *h)
{
u32 i;
i = (h->slot_pos + 1) % BRCMF_FWS_HANGER_MAXITEMS;
while (i != h->slot_pos) {
if (h->items[i].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
h->slot_pos = i;
goto done;
}
i++;
if (i == BRCMF_FWS_HANGER_MAXITEMS)
i = 0;
}
brcmf_err("all slots occupied\n");
h->failed_slotfind++;
i = BRCMF_FWS_HANGER_MAXITEMS;
done:
return i;
}
static int brcmf_fws_hanger_pushpkt(struct brcmf_fws_hanger *h,
struct sk_buff *pkt, u32 slot_id)
{
if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
return -ENOENT;
if (h->items[slot_id].state != BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
brcmf_err("slot is not free\n");
h->failed_to_push++;
return -EINVAL;
}
h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE;
h->items[slot_id].pkt = pkt;
h->pushed++;
return 0;
}
static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
u32 slot_id, struct sk_buff **pktout,
bool remove_item)
{
if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
return -ENOENT;
if (h->items[slot_id].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
brcmf_err("entry not in use\n");
h->failed_to_pop++;
return -EINVAL;
}
*pktout = h->items[slot_id].pkt;
if (remove_item) {
h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
h->items[slot_id].pkt = NULL;
h->popped++;
}
return 0;
}
brcmfmac: fix WARNING during USB disconnect in case of unempty psq brcmu_pkt_buf_free_skb emits WARNING when attempting to free a sk_buff which is part of any queue. After USB disconnect this may have happened when brcmf_fws_hanger_cleanup() is called as per-interface psq was never cleaned when removing the interface. Change brcmf_fws_macdesc_cleanup() in a way that it removes the corresponding packets from hanger table (to avoid double-free when brcmf_fws_hanger_cleanup() is called) and add a call to clean-up the interface specific packet queue. Below is a WARNING during USB disconnect with Raspberry Pi WiFi dongle running in AP mode. This was reproducible when the interface was transmitting during the disconnect and is fixed with this commit. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1171 at drivers/net/wireless/broadcom/brcm80211/brcmutil/utils.c:49 brcmu_pkt_buf_free_skb+0x3c/0x40 Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether cdc_acm smsc95xx usbnet ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base libcomposite configfs udc_core CPU: 0 PID: 1171 Comm: kworker/0:0 Not tainted 4.19.23-00075-gde33ed8 #99 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Workqueue: usb_hub_wq hub_event [<8010ff84>] (unwind_backtrace) from [<8010bb64>] (show_stack+0x10/0x14) [<8010bb64>] (show_stack) from [<80840278>] (dump_stack+0x88/0x9c) [<80840278>] (dump_stack) from [<8011f5ec>] (__warn+0xfc/0x114) [<8011f5ec>] (__warn) from [<8011f71c>] (warn_slowpath_null+0x40/0x48) [<8011f71c>] (warn_slowpath_null) from [<805a476c>] (brcmu_pkt_buf_free_skb+0x3c/0x40) [<805a476c>] (brcmu_pkt_buf_free_skb) from [<805bb6c4>] (brcmf_fws_cleanup+0x1e4/0x22c) [<805bb6c4>] (brcmf_fws_cleanup) from [<805bc854>] (brcmf_fws_del_interface+0x58/0x68) [<805bc854>] (brcmf_fws_del_interface) from [<805b66ac>] (brcmf_remove_interface+0x40/0x150) [<805b66ac>] (brcmf_remove_interface) from [<805b6870>] (brcmf_detach+0x6c/0xb0) [<805b6870>] (brcmf_detach) from [<805bdbb8>] (brcmf_usb_disconnect+0x30/0x4c) [<805bdbb8>] (brcmf_usb_disconnect) from [<805e5d64>] (usb_unbind_interface+0x5c/0x1e0) [<805e5d64>] (usb_unbind_interface) from [<804aab10>] (device_release_driver_internal+0x154/0x1ec) [<804aab10>] (device_release_driver_internal) from [<804a97f4>] (bus_remove_device+0xcc/0xf8) [<804a97f4>] (bus_remove_device) from [<804a6fc0>] (device_del+0x118/0x308) [<804a6fc0>] (device_del) from [<805e488c>] (usb_disable_device+0xa0/0x1c8) [<805e488c>] (usb_disable_device) from [<805dcf98>] (usb_disconnect+0x70/0x1d8) [<805dcf98>] (usb_disconnect) from [<805ddd84>] (hub_event+0x464/0xf50) [<805ddd84>] (hub_event) from [<80135a70>] (process_one_work+0x138/0x3f8) [<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554) [<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154) [<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c) Exception stack(0xecf8dfb0 to 0xecf8dff8) dfa0: 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 ---[ end trace 38d234018e9e2a90 ]--- ------------[ cut here ]------------ Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-03-04 16:42:49 +01:00
static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
int ifidx)
{
bool (*matchfn)(struct sk_buff *, void *) = NULL;
struct sk_buff *skb;
int prec;
u32 hslot;
if (ifidx != -1)
matchfn = brcmf_fws_ifidx_match;
for (prec = 0; prec < q->num_prec; prec++) {
skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
while (skb) {
hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
true);
brcmu_pkt_buf_free_skb(skb);
skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
}
}
}
static int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
u32 slot_id)
{
if (slot_id >= BRCMF_FWS_HANGER_MAXITEMS)
return -ENOENT;
if (h->items[slot_id].state == BRCMF_FWS_HANGER_ITEM_STATE_FREE) {
brcmf_err("entry not in use\n");
return -EINVAL;
}
h->items[slot_id].state = BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
return 0;
}
static void brcmf_fws_hanger_cleanup(struct brcmf_fws_info *fws,
bool (*fn)(struct sk_buff *, void *),
int ifidx)
{
struct brcmf_fws_hanger *h = &fws->hanger;
struct sk_buff *skb;
int i;
enum brcmf_fws_hanger_item_state s;
for (i = 0; i < ARRAY_SIZE(h->items); i++) {
s = h->items[i].state;
if (s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE ||
s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED) {
skb = h->items[i].pkt;
if (fn == NULL || fn(skb, &ifidx)) {
/* suppress packets freed from psq */
if (s == BRCMF_FWS_HANGER_ITEM_STATE_INUSE)
brcmu_pkt_buf_free_skb(skb);
h->items[i].state =
BRCMF_FWS_HANGER_ITEM_STATE_FREE;
}
}
}
}
static void brcmf_fws_macdesc_set_name(struct brcmf_fws_info *fws,
struct brcmf_fws_mac_descriptor *desc)
{
if (desc == &fws->desc.other)
strlcpy(desc->name, "MAC-OTHER", sizeof(desc->name));
else if (desc->mac_handle)
scnprintf(desc->name, sizeof(desc->name), "MAC-%d:%d",
desc->mac_handle, desc->interface_id);
else
scnprintf(desc->name, sizeof(desc->name), "MACIF:%d",
desc->interface_id);
}
static void brcmf_fws_macdesc_init(struct brcmf_fws_mac_descriptor *desc,
u8 *addr, u8 ifidx)
{
brcmf_dbg(TRACE,
"enter: desc %p ea=%pM, ifidx=%u\n", desc, addr, ifidx);
desc->occupied = 1;
desc->state = BRCMF_FWS_STATE_OPEN;
desc->requested_credit = 0;
desc->requested_packet = 0;
/* depending on use may need ifp->bsscfgidx instead */
desc->interface_id = ifidx;
desc->ac_bitmap = 0xff; /* update this when handling APSD */
if (addr)
memcpy(&desc->ea[0], addr, ETH_ALEN);
}
static
void brcmf_fws_macdesc_deinit(struct brcmf_fws_mac_descriptor *desc)
{
brcmf_dbg(TRACE,
"enter: ea=%pM, ifidx=%u\n", desc->ea, desc->interface_id);
desc->occupied = 0;
desc->state = BRCMF_FWS_STATE_CLOSE;
desc->requested_credit = 0;
desc->requested_packet = 0;
}
static struct brcmf_fws_mac_descriptor *
brcmf_fws_macdesc_lookup(struct brcmf_fws_info *fws, u8 *ea)
{
struct brcmf_fws_mac_descriptor *entry;
int i;
if (ea == NULL)
return ERR_PTR(-EINVAL);
entry = &fws->desc.nodes[0];
for (i = 0; i < ARRAY_SIZE(fws->desc.nodes); i++) {
if (entry->occupied && !memcmp(entry->ea, ea, ETH_ALEN))
return entry;
entry++;
}
return ERR_PTR(-ENOENT);
}
static struct brcmf_fws_mac_descriptor*
brcmf_fws_macdesc_find(struct brcmf_fws_info *fws, struct brcmf_if *ifp, u8 *da)
{
struct brcmf_fws_mac_descriptor *entry = &fws->desc.other;
bool multicast;
multicast = is_multicast_ether_addr(da);
/* Multicast destination, STA and P2P clients get the interface entry.
* STA/GC gets the Mac Entry for TDLS destinations, TDLS destinations
* have their own entry.
*/
if (multicast && ifp->fws_desc) {
entry = ifp->fws_desc;
goto done;
}
entry = brcmf_fws_macdesc_lookup(fws, da);
if (IS_ERR(entry))
entry = ifp->fws_desc;
done:
return entry;
}
static bool brcmf_fws_macdesc_closed(struct brcmf_fws_info *fws,
struct brcmf_fws_mac_descriptor *entry,
int fifo)
{
struct brcmf_fws_mac_descriptor *if_entry;
bool closed;
/* for unique destination entries the related interface
* may be closed.
*/
if (entry->mac_handle) {
if_entry = &fws->desc.iface[entry->interface_id];
if (if_entry->state == BRCMF_FWS_STATE_CLOSE)
return true;
}
/* an entry is closed when the state is closed and
* the firmware did not request anything.
*/
closed = entry->state == BRCMF_FWS_STATE_CLOSE &&
!entry->requested_credit && !entry->requested_packet;
/* Or firmware does not allow traffic for given fifo */
return closed || !(entry->ac_bitmap & BIT(fifo));
}
static void brcmf_fws_macdesc_cleanup(struct brcmf_fws_info *fws,
struct brcmf_fws_mac_descriptor *entry,
int ifidx)
{
if (entry->occupied && (ifidx == -1 || ifidx == entry->interface_id)) {
brcmf_fws_psq_flush(fws, &entry->psq, ifidx);
entry->occupied = !!(entry->psq.len);
}
}
static void brcmf_fws_bus_txq_cleanup(struct brcmf_fws_info *fws,
bool (*fn)(struct sk_buff *, void *),
int ifidx)
{
struct brcmf_fws_hanger_item *hi;
struct pktq *txq;
struct sk_buff *skb;
int prec;
u32 hslot;
txq = brcmf_bus_gettxq(fws->drvr->bus_if);
if (IS_ERR(txq)) {
brcmf_dbg(TRACE, "no txq to clean up\n");
return;
}
for (prec = 0; prec < txq->num_prec; prec++) {
skb = brcmu_pktq_pdeq_match(txq, prec, fn, &ifidx);
while (skb) {
hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
hi = &fws->hanger.items[hslot];
WARN_ON(skb != hi->pkt);
hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
brcmu_pkt_buf_free_skb(skb);
skb = brcmu_pktq_pdeq_match(txq, prec, fn, &ifidx);
}
}
}
static void brcmf_fws_cleanup(struct brcmf_fws_info *fws, int ifidx)
{
int i;
struct brcmf_fws_mac_descriptor *table;
bool (*matchfn)(struct sk_buff *, void *) = NULL;
if (fws == NULL)
return;
if (ifidx != -1)
matchfn = brcmf_fws_ifidx_match;
/* cleanup individual nodes */
table = &fws->desc.nodes[0];
for (i = 0; i < ARRAY_SIZE(fws->desc.nodes); i++)
brcmf_fws_macdesc_cleanup(fws, &table[i], ifidx);
brcmf_fws_macdesc_cleanup(fws, &fws->desc.other, ifidx);
brcmf_fws_bus_txq_cleanup(fws, matchfn, ifidx);
brcmf_fws_hanger_cleanup(fws, matchfn, ifidx);
}
static u8 brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
{
struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
u8 *wlh;
u16 data_offset = 0;
u8 fillers;
__le32 pkttag = cpu_to_le32(brcmf_skbcb(skb)->htod);
__le16 pktseq = cpu_to_le16(brcmf_skbcb(skb)->htod_seq);
brcmf_dbg(TRACE, "enter: %s, idx=%d hslot=%d htod %X seq %X\n",
entry->name, brcmf_skb_if_flags_get_field(skb, INDEX),
(le32_to_cpu(pkttag) >> 8) & 0xffff,
brcmf_skbcb(skb)->htod, brcmf_skbcb(skb)->htod_seq);
if (entry->send_tim_signal)
data_offset += 2 + BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode))
data_offset += BRCMF_FWS_TYPE_SEQ_LEN;
/* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
data_offset += 2 + BRCMF_FWS_TYPE_PKTTAG_LEN;
fillers = round_up(data_offset, 4) - data_offset;
data_offset += fillers;
skb_push(skb, data_offset);
wlh = skb->data;
wlh[0] = BRCMF_FWS_TYPE_PKTTAG;
wlh[1] = BRCMF_FWS_TYPE_PKTTAG_LEN;
memcpy(&wlh[2], &pkttag, sizeof(pkttag));
if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode)) {
wlh[1] += BRCMF_FWS_TYPE_SEQ_LEN;
memcpy(&wlh[2 + BRCMF_FWS_TYPE_PKTTAG_LEN], &pktseq,
sizeof(pktseq));
}
wlh += wlh[1] + 2;
if (entry->send_tim_signal) {
entry->send_tim_signal = 0;
wlh[0] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP;
wlh[1] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
wlh[2] = entry->mac_handle;
wlh[3] = entry->traffic_pending_bmp;
brcmf_dbg(TRACE, "adding TIM info: handle %d bmp 0x%X\n",
entry->mac_handle, entry->traffic_pending_bmp);
wlh += BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2;
entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
}
if (fillers)
memset(wlh, BRCMF_FWS_TYPE_FILLER, fillers);
return (u8)(data_offset >> 2);
}
static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
struct brcmf_fws_mac_descriptor *entry,
int fifo, bool send_immediately)
{
struct sk_buff *skb;
struct brcmf_skbuff_cb *skcb;
s32 err;
u32 len;
u8 data_offset;
int ifidx;
/* check delayedQ and suppressQ in one call using bitmap */
if (brcmu_pktq_mlen(&entry->psq, 3 << (fifo * 2)) == 0)
entry->traffic_pending_bmp &= ~NBITVAL(fifo);
else
entry->traffic_pending_bmp |= NBITVAL(fifo);
entry->send_tim_signal = false;
if (entry->traffic_lastreported_bmp != entry->traffic_pending_bmp)
entry->send_tim_signal = true;
if (send_immediately && entry->send_tim_signal &&
entry->state == BRCMF_FWS_STATE_CLOSE) {
/* create a dummy packet and sent that. The traffic */
/* bitmap info will automatically be attached to that packet */
len = BRCMF_FWS_TYPE_PKTTAG_LEN + 2 +
BRCMF_FWS_TYPE_SEQ_LEN +
BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2 +
4 + fws->drvr->hdrlen;
skb = brcmu_pkt_buf_get_skb(len);
if (skb == NULL)
return false;
skb_pull(skb, len);
skcb = brcmf_skbcb(skb);
skcb->mac = entry;
skcb->state = BRCMF_FWS_SKBSTATE_TIM;
skcb->htod = 0;
skcb->htod_seq = 0;
data_offset = brcmf_fws_hdrpush(fws, skb);
ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
brcmf_fws_unlock(fws);
err = brcmf_proto_txdata(fws->drvr, ifidx, data_offset, skb);
brcmf_fws_lock(fws);
if (err)
brcmu_pkt_buf_free_skb(skb);
return true;
}
return false;
}
static void
brcmf_fws_flow_control_check(struct brcmf_fws_info *fws, struct pktq *pq,
u8 if_id)
{
struct brcmf_if *ifp = brcmf_get_ifp(fws->drvr, if_id);
if (WARN_ON(!ifp))
return;
if ((ifp->netif_stop & BRCMF_NETIF_STOP_REASON_FWS_FC) &&
pq->len <= BRCMF_FWS_FLOWCONTROL_LOWATER)
brcmf_txflowblock_if(ifp,
BRCMF_NETIF_STOP_REASON_FWS_FC, false);
if (!(ifp->netif_stop & BRCMF_NETIF_STOP_REASON_FWS_FC) &&
pq->len >= BRCMF_FWS_FLOWCONTROL_HIWATER) {
fws->stats.fws_flow_block++;
brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FWS_FC, true);
}
return;
}
static int brcmf_fws_rssi_indicate(struct brcmf_fws_info *fws, s8 rssi)
{
brcmf_dbg(CTL, "rssi %d\n", rssi);
return 0;
}
static
int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
{
struct brcmf_fws_mac_descriptor *entry, *existing;
u8 mac_handle;
u8 ifidx;
u8 *addr;
mac_handle = *data++;
ifidx = *data++;
addr = data;
entry = &fws->desc.nodes[mac_handle & 0x1F];
if (type == BRCMF_FWS_TYPE_MACDESC_DEL) {
if (entry->occupied) {
brcmf_dbg(TRACE, "deleting %s mac %pM\n",
entry->name, addr);
brcmf_fws_lock(fws);
brcmf_fws_macdesc_cleanup(fws, entry, -1);
brcmf_fws_macdesc_deinit(entry);
brcmf_fws_unlock(fws);
} else
fws->stats.mac_update_failed++;
return 0;
}
existing = brcmf_fws_macdesc_lookup(fws, addr);
if (IS_ERR(existing)) {
if (!entry->occupied) {
brcmf_fws_lock(fws);
entry->mac_handle = mac_handle;
brcmf_fws_macdesc_init(entry, addr, ifidx);
brcmf_fws_macdesc_set_name(fws, entry);
brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
BRCMF_FWS_PSQ_LEN);
brcmf_fws_unlock(fws);
brcmf_dbg(TRACE, "add %s mac %pM\n", entry->name, addr);
} else {
fws->stats.mac_update_failed++;
}
} else {
if (entry != existing) {
brcmf_dbg(TRACE, "copy mac %s\n", existing->name);
brcmf_fws_lock(fws);
memcpy(entry, existing,
offsetof(struct brcmf_fws_mac_descriptor, psq));
entry->mac_handle = mac_handle;
brcmf_fws_macdesc_deinit(existing);
brcmf_fws_macdesc_set_name(fws, entry);
brcmf_fws_unlock(fws);
brcmf_dbg(TRACE, "relocate %s mac %pM\n", entry->name,
addr);
} else {
brcmf_dbg(TRACE, "use existing\n");
WARN_ON(entry->mac_handle != mac_handle);
/* TODO: what should we do here: continue, reinit, .. */
}
}
return 0;
}
static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
u8 type, u8 *data)
{
struct brcmf_fws_mac_descriptor *entry;
u8 mac_handle;
int ret;
mac_handle = data[0];
entry = &fws->desc.nodes[mac_handle & 0x1F];
if (!entry->occupied) {
fws->stats.mac_ps_update_failed++;
return -ESRCH;
}
brcmf_fws_lock(fws);
/* a state update should wipe old credits */
entry->requested_credit = 0;
entry->requested_packet = 0;
if (type == BRCMF_FWS_TYPE_MAC_OPEN) {
entry->state = BRCMF_FWS_STATE_OPEN;
ret = BRCMF_FWS_RET_OK_SCHEDULE;
} else {
entry->state = BRCMF_FWS_STATE_CLOSE;
brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_BK, false);
brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_BE, false);
brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_VI, false);
brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_VO, true);
ret = BRCMF_FWS_RET_OK_NOSCHEDULE;
}
brcmf_fws_unlock(fws);
return ret;
}
static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
u8 type, u8 *data)
{
struct brcmf_fws_mac_descriptor *entry;
u8 ifidx;
int ret;
ifidx = data[0];
if (ifidx >= BRCMF_MAX_IFS) {
ret = -ERANGE;
goto fail;
}
entry = &fws->desc.iface[ifidx];
if (!entry->occupied) {
ret = -ESRCH;
goto fail;
}
brcmf_dbg(TRACE, "%s (%d): %s\n", brcmf_fws_get_tlv_name(type), type,
entry->name);
brcmf_fws_lock(fws);
switch (type) {
case BRCMF_FWS_TYPE_INTERFACE_OPEN:
entry->state = BRCMF_FWS_STATE_OPEN;
ret = BRCMF_FWS_RET_OK_SCHEDULE;
break;
case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
entry->state = BRCMF_FWS_STATE_CLOSE;
ret = BRCMF_FWS_RET_OK_NOSCHEDULE;
break;
default:
ret = -EINVAL;
brcmf_fws_unlock(fws);
goto fail;
}
brcmf_fws_unlock(fws);
return ret;
fail:
fws->stats.if_update_failed++;
return ret;
}
static int brcmf_fws_request_indicate(struct brcmf_fws_info *fws, u8 type,
u8 *data)
{
struct brcmf_fws_mac_descriptor *entry;
entry = &fws->desc.nodes[data[1] & 0x1F];
if (!entry->occupied) {
if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
fws->stats.credit_request_failed++;
else
fws->stats.packet_request_failed++;
return -ESRCH;
}
brcmf_dbg(TRACE, "%s (%d): %s cnt %d bmp %d\n",
brcmf_fws_get_tlv_name(type), type, entry->name,
data[0], data[2]);
brcmf_fws_lock(fws);
if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
entry->requested_credit = data[0];
else
entry->requested_packet = data[0];
entry->ac_bitmap = data[2];
brcmf_fws_unlock(fws);
return BRCMF_FWS_RET_OK_SCHEDULE;
}
static void
brcmf_fws_macdesc_use_req_credit(struct brcmf_fws_mac_descriptor *entry,
struct sk_buff *skb)
{
if (entry->requested_credit > 0) {
entry->requested_credit--;
brcmf_skb_if_flags_set_field(skb, REQUESTED, 1);
brcmf_skb_if_flags_set_field(skb, REQ_CREDIT, 1);
if (entry->state != BRCMF_FWS_STATE_CLOSE)
brcmf_err("requested credit set while mac not closed!\n");
} else if (entry->requested_packet > 0) {
entry->requested_packet--;
brcmf_skb_if_flags_set_field(skb, REQUESTED, 1);
brcmf_skb_if_flags_set_field(skb, REQ_CREDIT, 0);
if (entry->state != BRCMF_FWS_STATE_CLOSE)
brcmf_err("requested packet set while mac not closed!\n");
} else {
brcmf_skb_if_flags_set_field(skb, REQUESTED, 0);
brcmf_skb_if_flags_set_field(skb, REQ_CREDIT, 0);
}
}
static void brcmf_fws_macdesc_return_req_credit(struct sk_buff *skb)
{
struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
if ((brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) &&
(entry->state == BRCMF_FWS_STATE_CLOSE))
entry->requested_credit++;
}
static void brcmf_fws_return_credits(struct brcmf_fws_info *fws,
u8 fifo, u8 credits)
{
int lender_ac;
int *borrowed;
int *fifo_credit;
if (!credits)
return;
fws->fifo_credit_map |= 1 << fifo;
if ((fifo == BRCMF_FWS_FIFO_AC_BE) &&
(fws->credits_borrowed[0])) {
for (lender_ac = BRCMF_FWS_FIFO_AC_VO; lender_ac >= 0;
lender_ac--) {
borrowed = &fws->credits_borrowed[lender_ac];
if (*borrowed) {
fws->fifo_credit_map |= (1 << lender_ac);
fifo_credit = &fws->fifo_credit[lender_ac];
if (*borrowed >= credits) {
*borrowed -= credits;
*fifo_credit += credits;
return;
} else {
credits -= *borrowed;
*fifo_credit += *borrowed;
*borrowed = 0;
}
}
}
}
fws->fifo_credit[fifo] += credits;
if (fws->fifo_credit[fifo] > fws->init_fifo_credit[fifo])
fws->fifo_credit[fifo] = fws->init_fifo_credit[fifo];
}
static void brcmf_fws_schedule_deq(struct brcmf_fws_info *fws)
{
/* only schedule dequeue when there are credits for delayed traffic */
if ((fws->fifo_credit_map & fws->fifo_delay_map) ||
(!brcmf_fws_fc_active(fws) && fws->fifo_delay_map))
queue_work(fws->fws_wq, &fws->fws_dequeue_work);
}
static int brcmf_fws_enq(struct brcmf_fws_info *fws,
enum brcmf_fws_skb_state state, int fifo,
struct sk_buff *p)
{
struct brcmf_pub *drvr = fws->drvr;
int prec = 2 * fifo;
u32 *qfull_stat = &fws->stats.delayq_full_error;
struct brcmf_fws_mac_descriptor *entry;
struct pktq *pq;
struct sk_buff_head *queue;
struct sk_buff *p_head;
struct sk_buff *p_tail;
u32 fr_new;
u32 fr_compare;
entry = brcmf_skbcb(p)->mac;
if (entry == NULL) {
bphy_err(drvr, "no mac descriptor found for skb %p\n", p);
return -ENOENT;
}
brcmf_dbg(DATA, "enter: fifo %d skb %p\n", fifo, p);
if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED) {
prec += 1;
qfull_stat = &fws->stats.supprq_full_error;
/* Fix out of order delivery of frames. Dont assume frame */
/* can be inserted at the end, but look for correct position */
pq = &entry->psq;
if (pktq_full(pq) || pktq_pfull(pq, prec)) {
*qfull_stat += 1;
return -ENFILE;
}
queue = &pq->q[prec].skblist;
p_head = skb_peek(queue);
p_tail = skb_peek_tail(queue);
fr_new = brcmf_skb_htod_tag_get_field(p, FREERUN);
while (p_head != p_tail) {
fr_compare = brcmf_skb_htod_tag_get_field(p_tail,
FREERUN);
/* be sure to handle wrap of 256 */
if (((fr_new > fr_compare) &&
((fr_new - fr_compare) < 128)) ||
((fr_new < fr_compare) &&
((fr_compare - fr_new) > 128)))
break;
p_tail = skb_queue_prev(queue, p_tail);
}
/* Position found. Determine what to do */
if (p_tail == NULL) {
/* empty list */
__skb_queue_tail(queue, p);
} else {
fr_compare = brcmf_skb_htod_tag_get_field(p_tail,
FREERUN);
if (((fr_new > fr_compare) &&
((fr_new - fr_compare) < 128)) ||
((fr_new < fr_compare) &&
((fr_compare - fr_new) > 128))) {
/* After tail */
__skb_queue_after(queue, p_tail, p);
} else {
/* Before tail */
__skb_insert(p, p_tail->prev, p_tail, queue);
}
}
/* Complete the counters and statistics */
pq->len++;
if (pq->hi_prec < prec)
pq->hi_prec = (u8) prec;
} else if (brcmu_pktq_penq(&entry->psq, prec, p) == NULL) {
*qfull_stat += 1;
return -ENFILE;
}
/* increment total enqueued packet count */
fws->fifo_delay_map |= 1 << fifo;
fws->fifo_enqpkt[fifo]++;
/* update the sk_buff state */
brcmf_skbcb(p)->state = state;
/*
* A packet has been pushed so update traffic
* availability bitmap, if applicable
*/
brcmf_fws_tim_update(fws, entry, fifo, true);
brcmf_fws_flow_control_check(fws, &entry->psq,
brcmf_skb_if_flags_get_field(p, INDEX));
return 0;
}
static struct sk_buff *brcmf_fws_deq(struct brcmf_fws_info *fws, int fifo)
{
struct brcmf_fws_mac_descriptor *table;
struct brcmf_fws_mac_descriptor *entry;
struct sk_buff *p;
int num_nodes;
int node_pos;
int prec_out;
int pmsk;
int i;
table = (struct brcmf_fws_mac_descriptor *)&fws->desc;
num_nodes = sizeof(fws->desc) / sizeof(struct brcmf_fws_mac_descriptor);
node_pos = fws->deq_node_pos[fifo];
for (i = 0; i < num_nodes; i++) {
entry = &table[(node_pos + i) % num_nodes];
if (!entry->occupied ||
brcmf_fws_macdesc_closed(fws, entry, fifo))
continue;
if (entry->suppressed)
pmsk = 2;
else
pmsk = 3;
p = brcmu_pktq_mdeq(&entry->psq, pmsk << (fifo * 2), &prec_out);
if (p == NULL) {
if (entry->suppressed) {
if (entry->suppr_transit_count)
continue;
entry->suppressed = false;
p = brcmu_pktq_mdeq(&entry->psq,
1 << (fifo * 2), &prec_out);
}
}
if (p == NULL)
continue;
brcmf_fws_macdesc_use_req_credit(entry, p);
/* move dequeue position to ensure fair round-robin */
fws->deq_node_pos[fifo] = (node_pos + i + 1) % num_nodes;
brcmf_fws_flow_control_check(fws, &entry->psq,
brcmf_skb_if_flags_get_field(p,
INDEX)
);
/*
* A packet has been picked up, update traffic
* availability bitmap, if applicable
*/
brcmf_fws_tim_update(fws, entry, fifo, false);
/*
* decrement total enqueued fifo packets and
* clear delay bitmap if done.
*/
fws->fifo_enqpkt[fifo]--;
if (fws->fifo_enqpkt[fifo] == 0)
fws->fifo_delay_map &= ~(1 << fifo);
goto done;
}
p = NULL;
done:
brcmf_dbg(DATA, "exit: fifo %d skb %p\n", fifo, p);
return p;
}
static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
struct sk_buff *skb,
u32 genbit, u16 seq)
{
struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
u32 hslot;
int ret;
hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
/* this packet was suppressed */
if (!entry->suppressed) {
entry->suppressed = true;
entry->suppr_transit_count = entry->transit_count;
brcmf_dbg(DATA, "suppress %s: transit %d\n",
entry->name, entry->transit_count);
}
entry->generation = genbit;
brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
brcmf_skbcb(skb)->htod_seq = seq;
if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
} else {
brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
}
ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo, skb);
if (ret != 0) {
/* suppress q is full drop this packet */
brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, true);
} else {
/* Mark suppressed to avoid a double free during wlfc cleanup */
brcmf_fws_hanger_mark_suppressed(&fws->hanger, hslot);
}
return ret;
}
static int
brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
u32 genbit, u16 seq, u8 compcnt)
{
struct brcmf_pub *drvr = fws->drvr;
u32 fifo;
u8 cnt = 0;
int ret;
bool remove_from_hanger = true;
struct sk_buff *skb;
struct brcmf_skbuff_cb *skcb;
struct brcmf_fws_mac_descriptor *entry = NULL;
struct brcmf_if *ifp;
brcmf_dbg(DATA, "flags %d\n", flags);
if (flags == BRCMF_FWS_TXSTATUS_DISCARD)
fws->stats.txs_discard += compcnt;
else if (flags == BRCMF_FWS_TXSTATUS_CORE_SUPPRESS) {
fws->stats.txs_supp_core += compcnt;
remove_from_hanger = false;
} else if (flags == BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS) {
fws->stats.txs_supp_ps += compcnt;
remove_from_hanger = false;
} else if (flags == BRCMF_FWS_TXSTATUS_FW_TOSSED)
fws->stats.txs_tossed += compcnt;
else if (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)
fws->stats.txs_host_tossed += compcnt;
else
bphy_err(drvr, "unexpected txstatus\n");
while (cnt < compcnt) {
ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
remove_from_hanger);
if (ret != 0) {
bphy_err(drvr, "no packet in hanger slot: hslot=%d\n",
hslot);
goto cont;
}
skcb = brcmf_skbcb(skb);
entry = skcb->mac;
if (WARN_ON(!entry)) {
brcmu_pkt_buf_free_skb(skb);
goto cont;
}
entry->transit_count--;
if (entry->suppressed && entry->suppr_transit_count)
entry->suppr_transit_count--;
brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name,
flags, skcb->htod, seq);
/* pick up the implicit credit from this packet */
fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
if (fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT ||
(brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) ||
flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED) {
brcmf_fws_return_credits(fws, fifo, 1);
brcmf_fws_schedule_deq(fws);
}
brcmf_fws_macdesc_return_req_credit(skb);
ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
if (ret) {
brcmu_pkt_buf_free_skb(skb);
goto cont;
}
if (!remove_from_hanger)
ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb,
genbit, seq);
if (remove_from_hanger || ret)
brcmf_txfinalize(ifp, skb, true);
cont:
hslot = (hslot + 1) & (BRCMF_FWS_TXSTAT_HSLOT_MASK >>
BRCMF_FWS_TXSTAT_HSLOT_SHIFT);
if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode))
seq = (seq + 1) & BRCMF_SKB_HTOD_SEQ_NR_MASK;
cnt++;
}
return 0;
}
static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
u8 *data)
{
int i;
if (fws->fcmode != BRCMF_FWS_FCMODE_EXPLICIT_CREDIT) {
brcmf_dbg(INFO, "ignored\n");
return BRCMF_FWS_RET_OK_NOSCHEDULE;
}
brcmf_dbg(DATA, "enter: data %pM\n", data);
brcmf_fws_lock(fws);
for (i = 0; i < BRCMF_FWS_FIFO_COUNT; i++)
brcmf_fws_return_credits(fws, i, data[i]);
brcmf_dbg(DATA, "map: credit %x delay %x\n", fws->fifo_credit_map,
fws->fifo_delay_map);
brcmf_fws_unlock(fws);
return BRCMF_FWS_RET_OK_SCHEDULE;
}
static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 type,
u8 *data)
{
__le32 status_le;
__le16 seq_le;
u32 status;
u32 hslot;
u32 genbit;
u8 flags;
u16 seq;
u8 compcnt;
u8 compcnt_offset = BRCMF_FWS_TYPE_TXSTATUS_LEN;
memcpy(&status_le, data, sizeof(status_le));
status = le32_to_cpu(status_le);
flags = brcmf_txstatus_get_field(status, FLAGS);
hslot = brcmf_txstatus_get_field(status, HSLOT);
genbit = brcmf_txstatus_get_field(status, GENERATION);
if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode)) {
memcpy(&seq_le, &data[BRCMF_FWS_TYPE_TXSTATUS_LEN],
sizeof(seq_le));
seq = le16_to_cpu(seq_le);
compcnt_offset += BRCMF_FWS_TYPE_SEQ_LEN;
} else {
seq = 0;
}
if (type == BRCMF_FWS_TYPE_COMP_TXSTATUS)
compcnt = data[compcnt_offset];
else
compcnt = 1;
fws->stats.txs_indicate += compcnt;
brcmf_fws_lock(fws);
brcmf_fws_txs_process(fws, flags, hslot, genbit, seq, compcnt);
brcmf_fws_unlock(fws);
return BRCMF_FWS_RET_OK_NOSCHEDULE;
}
static int brcmf_fws_dbg_seqnum_check(struct brcmf_fws_info *fws, u8 *data)
{
__le32 timestamp;
memcpy(&timestamp, &data[2], sizeof(timestamp));
brcmf_dbg(CTL, "received: seq %d, timestamp %d\n", data[1],
le32_to_cpu(timestamp));
return 0;
}
static int brcmf_fws_notify_credit_map(struct brcmf_if *ifp,
const struct brcmf_event_msg *e,
void *data)
{
struct brcmf_pub *drvr = ifp->drvr;
struct brcmf_fws_info *fws = drvr_to_fws(drvr);
int i;
u8 *credits = data;
if (e->datalen < BRCMF_FWS_FIFO_COUNT) {
bphy_err(drvr, "event payload too small (%d)\n", e->datalen);
return -EINVAL;
}
fws->creditmap_received = true;
brcmf_dbg(TRACE, "enter: credits %pM\n", credits);
brcmf_fws_lock(fws);
for (i = 0; i < ARRAY_SIZE(fws->fifo_credit); i++) {
fws->fifo_credit[i] += credits[i] - fws->init_fifo_credit[i];
fws->init_fifo_credit[i] = credits[i];
if (fws->fifo_credit[i] > 0)
fws->fifo_credit_map |= 1 << i;
else
fws->fifo_credit_map &= ~(1 << i);
WARN_ONCE(fws->fifo_credit[i] < 0,
"fifo_credit[%d] is negative(%d)\n", i,
fws->fifo_credit[i]);
}
brcmf_fws_schedule_deq(fws);
brcmf_fws_unlock(fws);
return 0;
}
static int brcmf_fws_notify_bcmc_credit_support(struct brcmf_if *ifp,
const struct brcmf_event_msg *e,
void *data)
{
struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
if (fws) {
brcmf_fws_lock(fws);
fws->bcmc_credit_check = true;
brcmf_fws_unlock(fws);
}
return 0;
}
static void brcmf_rxreorder_get_skb_list(struct brcmf_ampdu_rx_reorder *rfi,
u8 start, u8 end,
struct sk_buff_head *skb_list)
{
/* initialize return list */
__skb_queue_head_init(skb_list);
if (rfi->pend_pkts == 0) {
brcmf_dbg(INFO, "no packets in reorder queue\n");
return;
}
do {
if (rfi->pktslots[start]) {
__skb_queue_tail(skb_list, rfi->pktslots[start]);
rfi->pktslots[start] = NULL;
}
start++;
if (start > rfi->max_idx)
start = 0;
} while (start != end);
rfi->pend_pkts -= skb_queue_len(skb_list);
}
void brcmf_fws_rxreorder(struct brcmf_if *ifp, struct sk_buff *pkt)
{
struct brcmf_pub *drvr = ifp->drvr;
u8 *reorder_data;
u8 flow_id, max_idx, cur_idx, exp_idx, end_idx;
struct brcmf_ampdu_rx_reorder *rfi;
struct sk_buff_head reorder_list;
struct sk_buff *pnext;
u8 flags;
u32 buf_size;
reorder_data = ((struct brcmf_skb_reorder_data *)pkt->cb)->reorder;
flow_id = reorder_data[BRCMF_RXREORDER_FLOWID_OFFSET];
flags = reorder_data[BRCMF_RXREORDER_FLAGS_OFFSET];
/* validate flags and flow id */
if (flags == 0xFF) {
bphy_err(drvr, "invalid flags...so ignore this packet\n");
brcmf_netif_rx(ifp, pkt);
return;
}
rfi = ifp->drvr->reorder_flows[flow_id];
if (flags & BRCMF_RXREORDER_DEL_FLOW) {
brcmf_dbg(INFO, "flow-%d: delete\n",
flow_id);
if (rfi == NULL) {
brcmf_dbg(INFO, "received flags to cleanup, but no flow (%d) yet\n",
flow_id);
brcmf_netif_rx(ifp, pkt);
return;
}
brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, rfi->exp_idx,
&reorder_list);
/* add the last packet */
__skb_queue_tail(&reorder_list, pkt);
kfree(rfi);
ifp->drvr->reorder_flows[flow_id] = NULL;
goto netif_rx;
}
/* from here on we need a flow reorder instance */
if (rfi == NULL) {
buf_size = sizeof(*rfi);
max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
buf_size += (max_idx + 1) * sizeof(pkt);
/* allocate space for flow reorder info */
brcmf_dbg(INFO, "flow-%d: start, maxidx %d\n",
flow_id, max_idx);
rfi = kzalloc(buf_size, GFP_ATOMIC);
if (rfi == NULL) {
bphy_err(drvr, "failed to alloc buffer\n");
brcmf_netif_rx(ifp, pkt);
return;
}
ifp->drvr->reorder_flows[flow_id] = rfi;
rfi->pktslots = (struct sk_buff **)(rfi + 1);
rfi->max_idx = max_idx;
}
if (flags & BRCMF_RXREORDER_NEW_HOLE) {
if (rfi->pend_pkts) {
brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx,
rfi->exp_idx,
&reorder_list);
WARN_ON(rfi->pend_pkts);
} else {
__skb_queue_head_init(&reorder_list);
}
rfi->cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
rfi->exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
rfi->max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
rfi->pktslots[rfi->cur_idx] = pkt;
rfi->pend_pkts++;
brcmf_dbg(DATA, "flow-%d: new hole %d (%d), pending %d\n",
flow_id, rfi->cur_idx, rfi->exp_idx, rfi->pend_pkts);
} else if (flags & BRCMF_RXREORDER_CURIDX_VALID) {
cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
if ((exp_idx == rfi->exp_idx) && (cur_idx != rfi->exp_idx)) {
/* still in the current hole */
/* enqueue the current on the buffer chain */
if (rfi->pktslots[cur_idx] != NULL) {
brcmf_dbg(INFO, "HOLE: ERROR buffer pending..free it\n");
brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
rfi->pktslots[cur_idx] = NULL;
}
rfi->pktslots[cur_idx] = pkt;
rfi->pend_pkts++;
rfi->cur_idx = cur_idx;
brcmf_dbg(DATA, "flow-%d: store pkt %d (%d), pending %d\n",
flow_id, cur_idx, exp_idx, rfi->pend_pkts);
/* can return now as there is no reorder
* list to process.
*/
return;
}
if (rfi->exp_idx == cur_idx) {
if (rfi->pktslots[cur_idx] != NULL) {
brcmf_dbg(INFO, "error buffer pending..free it\n");
brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
rfi->pktslots[cur_idx] = NULL;
}
rfi->pktslots[cur_idx] = pkt;
rfi->pend_pkts++;
/* got the expected one. flush from current to expected
* and update expected
*/
brcmf_dbg(DATA, "flow-%d: expected %d (%d), pending %d\n",
flow_id, cur_idx, exp_idx, rfi->pend_pkts);
rfi->cur_idx = cur_idx;
rfi->exp_idx = exp_idx;
brcmf_rxreorder_get_skb_list(rfi, cur_idx, exp_idx,
&reorder_list);
brcmf_dbg(DATA, "flow-%d: freeing buffers %d, pending %d\n",
flow_id, skb_queue_len(&reorder_list),
rfi->pend_pkts);
} else {
u8 end_idx;
brcmf_dbg(DATA, "flow-%d (0x%x): both moved, old %d/%d, new %d/%d\n",
flow_id, flags, rfi->cur_idx, rfi->exp_idx,
cur_idx, exp_idx);
if (flags & BRCMF_RXREORDER_FLUSH_ALL)
end_idx = rfi->exp_idx;
else
end_idx = exp_idx;
/* flush pkts first */
brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
&reorder_list);
if (exp_idx == ((cur_idx + 1) % (rfi->max_idx + 1))) {
__skb_queue_tail(&reorder_list, pkt);
} else {
rfi->pktslots[cur_idx] = pkt;
rfi->pend_pkts++;
}
rfi->exp_idx = exp_idx;
rfi->cur_idx = cur_idx;
}
} else {
/* explicity window move updating the expected index */
exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
brcmf_dbg(DATA, "flow-%d (0x%x): change expected: %d -> %d\n",
flow_id, flags, rfi->exp_idx, exp_idx);
if (flags & BRCMF_RXREORDER_FLUSH_ALL)
end_idx = rfi->exp_idx;
else
end_idx = exp_idx;
brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
&reorder_list);
__skb_queue_tail(&reorder_list, pkt);
/* set the new expected idx */
rfi->exp_idx = exp_idx;
}
netif_rx:
skb_queue_walk_safe(&reorder_list, pkt, pnext) {
__skb_unlink(pkt, &reorder_list);
brcmf_netif_rx(ifp, pkt);
}
}
void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb)
{
struct brcmf_skb_reorder_data *rd;
struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
u8 *signal_data;
s16 data_len;
u8 type;
u8 len;
u8 *data;
s32 status;
s32 err;
brcmf_dbg(HDRS, "enter: ifidx %d, skblen %u, sig %d\n",
ifp->ifidx, skb->len, siglen);
WARN_ON(siglen > skb->len);
if (!siglen)
return;
/* if flow control disabled, skip to packet data and leave */
if ((!fws) || (!fws->fw_signals)) {
skb_pull(skb, siglen);
return;
}
fws->stats.header_pulls++;
data_len = siglen;
signal_data = skb->data;
status = BRCMF_FWS_RET_OK_NOSCHEDULE;
while (data_len > 0) {
/* extract tlv info */
type = signal_data[0];
/* FILLER type is actually not a TLV, but
* a single byte that can be skipped.
*/
if (type == BRCMF_FWS_TYPE_FILLER) {
signal_data += 1;
data_len -= 1;
continue;
}
len = signal_data[1];
data = signal_data + 2;
brcmf_dbg(HDRS, "tlv type=%s (%d), len=%d (%d)\n",
brcmf_fws_get_tlv_name(type), type, len,
brcmf_fws_get_tlv_len(fws, type));
/* abort parsing when length invalid */
if (data_len < len + 2)
break;
if (len < brcmf_fws_get_tlv_len(fws, type))
break;
err = BRCMF_FWS_RET_OK_NOSCHEDULE;
switch (type) {
case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
rd = (struct brcmf_skb_reorder_data *)skb->cb;
rd->reorder = data;
break;
case BRCMF_FWS_TYPE_MACDESC_ADD:
case BRCMF_FWS_TYPE_MACDESC_DEL:
brcmf_fws_macdesc_indicate(fws, type, data);
break;
case BRCMF_FWS_TYPE_MAC_OPEN:
case BRCMF_FWS_TYPE_MAC_CLOSE:
err = brcmf_fws_macdesc_state_indicate(fws, type, data);
break;
case BRCMF_FWS_TYPE_INTERFACE_OPEN:
case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
err = brcmf_fws_interface_state_indicate(fws, type,
data);
break;
case BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT:
case BRCMF_FWS_TYPE_MAC_REQUEST_PACKET:
err = brcmf_fws_request_indicate(fws, type, data);
break;
case BRCMF_FWS_TYPE_TXSTATUS:
case BRCMF_FWS_TYPE_COMP_TXSTATUS:
brcmf_fws_txstatus_indicate(fws, type, data);
break;
case BRCMF_FWS_TYPE_FIFO_CREDITBACK:
err = brcmf_fws_fifocreditback_indicate(fws, data);
break;
case BRCMF_FWS_TYPE_RSSI:
brcmf_fws_rssi_indicate(fws, *data);
break;
case BRCMF_FWS_TYPE_TRANS_ID:
brcmf_fws_dbg_seqnum_check(fws, data);
break;
case BRCMF_FWS_TYPE_PKTTAG:
case BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP:
default:
fws->stats.tlv_invalid_type++;
break;
}
if (err == BRCMF_FWS_RET_OK_SCHEDULE)
status = BRCMF_FWS_RET_OK_SCHEDULE;
signal_data += len + 2;
data_len -= len + 2;
}
if (data_len != 0)
fws->stats.tlv_parse_failed++;
if (status == BRCMF_FWS_RET_OK_SCHEDULE)
brcmf_fws_schedule_deq(fws);
/* signalling processing result does
* not affect the actual ethernet packet.
*/
skb_pull(skb, siglen);
/* this may be a signal-only packet
*/
if (skb->len == 0)
fws->stats.header_only_pkt++;
}
static u8 brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
struct sk_buff *p)
{
struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
struct brcmf_fws_mac_descriptor *entry = skcb->mac;
u8 flags;
if (skcb->state != BRCMF_FWS_SKBSTATE_SUPPRESSED)
brcmf_skb_htod_tag_set_field(p, GENERATION, entry->generation);
flags = BRCMF_FWS_HTOD_FLAG_PKTFROMHOST;
if (brcmf_skb_if_flags_get_field(p, REQUESTED)) {
/*
* Indicate that this packet is being sent in response to an
* explicit request from the firmware side.
*/
flags |= BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED;
}
brcmf_skb_htod_tag_set_field(p, FLAGS, flags);
return brcmf_fws_hdrpush(fws, p);
}
static void brcmf_fws_rollback_toq(struct brcmf_fws_info *fws,
struct sk_buff *skb, int fifo)
{
struct brcmf_pub *drvr = fws->drvr;
struct brcmf_fws_mac_descriptor *entry;
struct sk_buff *pktout;
int qidx, hslot;
int rc = 0;
entry = brcmf_skbcb(skb)->mac;
if (entry->occupied) {
qidx = 2 * fifo;
if (brcmf_skbcb(skb)->state == BRCMF_FWS_SKBSTATE_SUPPRESSED)
qidx++;
pktout = brcmu_pktq_penq_head(&entry->psq, qidx, skb);
if (pktout == NULL) {
bphy_err(drvr, "%s queue %d full\n", entry->name, qidx);
rc = -ENOSPC;
}
} else {
bphy_err(drvr, "%s entry removed\n", entry->name);
rc = -ENOENT;
}
if (rc) {
fws->stats.rollback_failed++;
hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED,
hslot, 0, 0, 1);
} else {
fws->stats.rollback_success++;
brcmf_fws_return_credits(fws, fifo, 1);
brcmf_fws_macdesc_return_req_credit(skb);
}
}
static int brcmf_fws_borrow_credit(struct brcmf_fws_info *fws)
{
int lender_ac;
if (time_after(fws->borrow_defer_timestamp, jiffies)) {
fws->fifo_credit_map &= ~(1 << BRCMF_FWS_FIFO_AC_BE);
return -ENAVAIL;
}
for (lender_ac = 0; lender_ac <= BRCMF_FWS_FIFO_AC_VO; lender_ac++) {
if (fws->fifo_credit[lender_ac] > 0) {
fws->credits_borrowed[lender_ac]++;
fws->fifo_credit[lender_ac]--;
if (fws->fifo_credit[lender_ac] == 0)
fws->fifo_credit_map &= ~(1 << lender_ac);
fws->fifo_credit_map |= (1 << BRCMF_FWS_FIFO_AC_BE);
brcmf_dbg(DATA, "borrow credit from: %d\n", lender_ac);
return 0;
}
}
fws->fifo_credit_map &= ~(1 << BRCMF_FWS_FIFO_AC_BE);
return -ENAVAIL;
}
static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
struct sk_buff *skb)
{
struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
struct brcmf_fws_mac_descriptor *entry;
int rc;
u8 ifidx;
u8 data_offset;
entry = skcb->mac;
if (IS_ERR(entry))
return PTR_ERR(entry);
data_offset = brcmf_fws_precommit_skb(fws, fifo, skb);
entry->transit_count++;
if (entry->suppressed)
entry->suppr_transit_count++;
ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
brcmf_fws_unlock(fws);
rc = brcmf_proto_txdata(fws->drvr, ifidx, data_offset, skb);
brcmf_fws_lock(fws);
brcmf_dbg(DATA, "%s flags %X htod %X bus_tx %d\n", entry->name,
skcb->if_flags, skcb->htod, rc);
if (rc < 0) {
entry->transit_count--;
if (entry->suppressed)
entry->suppr_transit_count--;
(void)brcmf_proto_hdrpull(fws->drvr, false, skb, NULL);
goto rollback;
}
fws->stats.pkt2bus++;
fws->stats.send_pkts[fifo]++;
if (brcmf_skb_if_flags_get_field(skb, REQUESTED))
fws->stats.requested_sent[fifo]++;
return rc;
rollback:
brcmf_fws_rollback_toq(fws, skb, fifo);
return rc;
}
static int brcmf_fws_assign_htod(struct brcmf_fws_info *fws, struct sk_buff *p,
int fifo)
{
struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
int rc, hslot;
skcb->htod = 0;
skcb->htod_seq = 0;
hslot = brcmf_fws_hanger_get_free_slot(&fws->hanger);
brcmf_skb_htod_tag_set_field(p, HSLOT, hslot);
brcmf_skb_htod_tag_set_field(p, FREERUN, skcb->mac->seq[fifo]);
brcmf_skb_htod_tag_set_field(p, FIFO, fifo);
rc = brcmf_fws_hanger_pushpkt(&fws->hanger, p, hslot);
if (!rc)
skcb->mac->seq[fifo]++;
else
fws->stats.generic_error++;
return rc;
}
int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
{
struct brcmf_pub *drvr = ifp->drvr;
struct brcmf_fws_info *fws = drvr_to_fws(drvr);
struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
struct ethhdr *eh = (struct ethhdr *)(skb->data);
int fifo = BRCMF_FWS_FIFO_BCMC;
bool multicast = is_multicast_ether_addr(eh->h_dest);
int rc = 0;
brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
/* set control buffer information */
skcb->if_flags = 0;
skcb->state = BRCMF_FWS_SKBSTATE_NEW;
brcmf_skb_if_flags_set_field(skb, INDEX, ifp->ifidx);
if (!multicast)
fifo = brcmf_fws_prio2fifo[skb->priority];
brcmf_fws_lock(fws);
if (fifo != BRCMF_FWS_FIFO_AC_BE && fifo < BRCMF_FWS_FIFO_BCMC)
fws->borrow_defer_timestamp = jiffies +
BRCMF_FWS_BORROW_DEFER_PERIOD;
skcb->mac = brcmf_fws_macdesc_find(fws, ifp, eh->h_dest);
brcmf_dbg(DATA, "%s mac %pM multi %d fifo %d\n", skcb->mac->name,
eh->h_dest, multicast, fifo);
if (!brcmf_fws_assign_htod(fws, skb, fifo)) {
brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_DELAYED, fifo, skb);
brcmf_fws_schedule_deq(fws);
} else {
bphy_err(drvr, "drop skb: no hanger slot\n");
brcmf_txfinalize(ifp, skb, false);
rc = -ENOMEM;
}
brcmf_fws_unlock(fws);
return rc;
}
void brcmf_fws_reset_interface(struct brcmf_if *ifp)
{
struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
brcmf_dbg(TRACE, "enter: bsscfgidx=%d\n", ifp->bsscfgidx);
if (!entry)
return;
brcmf_fws_macdesc_init(entry, ifp->mac_addr, ifp->ifidx);
}
void brcmf_fws_add_interface(struct brcmf_if *ifp)
{
struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
struct brcmf_fws_mac_descriptor *entry;
if (!ifp->ndev || !brcmf_fws_queue_skbs(fws))
return;
entry = &fws->desc.iface[ifp->ifidx];
ifp->fws_desc = entry;
brcmf_fws_macdesc_init(entry, ifp->mac_addr, ifp->ifidx);
brcmf_fws_macdesc_set_name(fws, entry);
brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
BRCMF_FWS_PSQ_LEN);
brcmf_dbg(TRACE, "added %s\n", entry->name);
}
void brcmf_fws_del_interface(struct brcmf_if *ifp)
{
struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
if (!entry)
return;
brcmf_fws_lock(fws);
ifp->fws_desc = NULL;
brcmf_dbg(TRACE, "deleting %s\n", entry->name);
brcmfmac: fix WARNING during USB disconnect in case of unempty psq brcmu_pkt_buf_free_skb emits WARNING when attempting to free a sk_buff which is part of any queue. After USB disconnect this may have happened when brcmf_fws_hanger_cleanup() is called as per-interface psq was never cleaned when removing the interface. Change brcmf_fws_macdesc_cleanup() in a way that it removes the corresponding packets from hanger table (to avoid double-free when brcmf_fws_hanger_cleanup() is called) and add a call to clean-up the interface specific packet queue. Below is a WARNING during USB disconnect with Raspberry Pi WiFi dongle running in AP mode. This was reproducible when the interface was transmitting during the disconnect and is fixed with this commit. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1171 at drivers/net/wireless/broadcom/brcm80211/brcmutil/utils.c:49 brcmu_pkt_buf_free_skb+0x3c/0x40 Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether cdc_acm smsc95xx usbnet ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base libcomposite configfs udc_core CPU: 0 PID: 1171 Comm: kworker/0:0 Not tainted 4.19.23-00075-gde33ed8 #99 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Workqueue: usb_hub_wq hub_event [<8010ff84>] (unwind_backtrace) from [<8010bb64>] (show_stack+0x10/0x14) [<8010bb64>] (show_stack) from [<80840278>] (dump_stack+0x88/0x9c) [<80840278>] (dump_stack) from [<8011f5ec>] (__warn+0xfc/0x114) [<8011f5ec>] (__warn) from [<8011f71c>] (warn_slowpath_null+0x40/0x48) [<8011f71c>] (warn_slowpath_null) from [<805a476c>] (brcmu_pkt_buf_free_skb+0x3c/0x40) [<805a476c>] (brcmu_pkt_buf_free_skb) from [<805bb6c4>] (brcmf_fws_cleanup+0x1e4/0x22c) [<805bb6c4>] (brcmf_fws_cleanup) from [<805bc854>] (brcmf_fws_del_interface+0x58/0x68) [<805bc854>] (brcmf_fws_del_interface) from [<805b66ac>] (brcmf_remove_interface+0x40/0x150) [<805b66ac>] (brcmf_remove_interface) from [<805b6870>] (brcmf_detach+0x6c/0xb0) [<805b6870>] (brcmf_detach) from [<805bdbb8>] (brcmf_usb_disconnect+0x30/0x4c) [<805bdbb8>] (brcmf_usb_disconnect) from [<805e5d64>] (usb_unbind_interface+0x5c/0x1e0) [<805e5d64>] (usb_unbind_interface) from [<804aab10>] (device_release_driver_internal+0x154/0x1ec) [<804aab10>] (device_release_driver_internal) from [<804a97f4>] (bus_remove_device+0xcc/0xf8) [<804a97f4>] (bus_remove_device) from [<804a6fc0>] (device_del+0x118/0x308) [<804a6fc0>] (device_del) from [<805e488c>] (usb_disable_device+0xa0/0x1c8) [<805e488c>] (usb_disable_device) from [<805dcf98>] (usb_disconnect+0x70/0x1d8) [<805dcf98>] (usb_disconnect) from [<805ddd84>] (hub_event+0x464/0xf50) [<805ddd84>] (hub_event) from [<80135a70>] (process_one_work+0x138/0x3f8) [<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554) [<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154) [<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c) Exception stack(0xecf8dfb0 to 0xecf8dff8) dfa0: 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 ---[ end trace 38d234018e9e2a90 ]--- ------------[ cut here ]------------ Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-03-04 16:42:49 +01:00
brcmf_fws_macdesc_cleanup(fws, &fws->desc.iface[ifp->ifidx],
ifp->ifidx);
brcmf_fws_macdesc_deinit(entry);
brcmf_fws_cleanup(fws, ifp->ifidx);
brcmf_fws_unlock(fws);
}
static void brcmf_fws_dequeue_worker(struct work_struct *worker)
{
struct brcmf_fws_info *fws;
struct brcmf_pub *drvr;
struct sk_buff *skb;
int fifo;
u32 hslot;
u32 ifidx;
int ret;
fws = container_of(worker, struct brcmf_fws_info, fws_dequeue_work);
drvr = fws->drvr;
brcmf_fws_lock(fws);
for (fifo = BRCMF_FWS_FIFO_BCMC; fifo >= 0 && !fws->bus_flow_blocked;
fifo--) {
if (!brcmf_fws_fc_active(fws)) {
while ((skb = brcmf_fws_deq(fws, fifo)) != NULL) {
hslot = brcmf_skb_htod_tag_get_field(skb,
HSLOT);
brcmf_fws_hanger_poppkt(&fws->hanger, hslot,
&skb, true);
ifidx = brcmf_skb_if_flags_get_field(skb,
INDEX);
/* Use proto layer to send data frame */
brcmf_fws_unlock(fws);
ret = brcmf_proto_txdata(drvr, ifidx, 0, skb);
brcmf_fws_lock(fws);
if (ret < 0)
brcmf_txfinalize(brcmf_get_ifp(drvr,
ifidx),
skb, false);
if (fws->bus_flow_blocked)
break;
}
continue;
}
while ((fws->fifo_credit[fifo] > 0) ||
((!fws->bcmc_credit_check) &&
(fifo == BRCMF_FWS_FIFO_BCMC))) {
skb = brcmf_fws_deq(fws, fifo);
if (!skb)
break;
fws->fifo_credit[fifo]--;
if (brcmf_fws_commit_skb(fws, fifo, skb))
break;
if (fws->bus_flow_blocked)
break;
}
if ((fifo == BRCMF_FWS_FIFO_AC_BE) &&
(fws->fifo_credit[fifo] <= 0) &&
(!fws->bus_flow_blocked)) {
while (brcmf_fws_borrow_credit(fws) == 0) {
skb = brcmf_fws_deq(fws, fifo);
if (!skb) {
brcmf_fws_return_credits(fws, fifo, 1);
break;
}
if (brcmf_fws_commit_skb(fws, fifo, skb))
break;
if (fws->bus_flow_blocked)
break;
}
}
}
brcmf_fws_unlock(fws);
}
#ifdef DEBUG
static int brcmf_debugfs_fws_stats_read(struct seq_file *seq, void *data)
{
struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
struct brcmf_fws_stats *fwstats = &(drvr_to_fws(bus_if->drvr)->stats);
seq_printf(seq,
"header_pulls: %u\n"
"header_only_pkt: %u\n"
"tlv_parse_failed: %u\n"
"tlv_invalid_type: %u\n"
"mac_update_fails: %u\n"
"ps_update_fails: %u\n"
"if_update_fails: %u\n"
"pkt2bus: %u\n"
"generic_error: %u\n"
"rollback_success: %u\n"
"rollback_failed: %u\n"
"delayq_full: %u\n"
"supprq_full: %u\n"
"txs_indicate: %u\n"
"txs_discard: %u\n"
"txs_suppr_core: %u\n"
"txs_suppr_ps: %u\n"
"txs_tossed: %u\n"
"txs_host_tossed: %u\n"
"bus_flow_block: %u\n"
"fws_flow_block: %u\n"
"send_pkts: BK:%u BE:%u VO:%u VI:%u BCMC:%u\n"
"requested_sent: BK:%u BE:%u VO:%u VI:%u BCMC:%u\n",
fwstats->header_pulls,
fwstats->header_only_pkt,
fwstats->tlv_parse_failed,
fwstats->tlv_invalid_type,
fwstats->mac_update_failed,
fwstats->mac_ps_update_failed,
fwstats->if_update_failed,
fwstats->pkt2bus,
fwstats->generic_error,
fwstats->rollback_success,
fwstats->rollback_failed,
fwstats->delayq_full_error,
fwstats->supprq_full_error,
fwstats->txs_indicate,
fwstats->txs_discard,
fwstats->txs_supp_core,
fwstats->txs_supp_ps,
fwstats->txs_tossed,
fwstats->txs_host_tossed,
fwstats->bus_flow_block,
fwstats->fws_flow_block,
fwstats->send_pkts[0], fwstats->send_pkts[1],
fwstats->send_pkts[2], fwstats->send_pkts[3],
fwstats->send_pkts[4],
fwstats->requested_sent[0],
fwstats->requested_sent[1],
fwstats->requested_sent[2],
fwstats->requested_sent[3],
fwstats->requested_sent[4]);
return 0;
}
#else
static int brcmf_debugfs_fws_stats_read(struct seq_file *seq, void *data)
{
return 0;
}
#endif
struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr)
{
struct brcmf_fws_info *fws;
struct brcmf_if *ifp;
u32 tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS;
int rc;
u32 mode;
fws = kzalloc(sizeof(*fws), GFP_KERNEL);
if (!fws) {
rc = -ENOMEM;
goto fail;
}
spin_lock_init(&fws->spinlock);
/* store drvr reference */
fws->drvr = drvr;
fws->fcmode = drvr->settings->fcmode;
if ((drvr->bus_if->always_use_fws_queue == false) &&
(fws->fcmode == BRCMF_FWS_FCMODE_NONE)) {
fws->avoid_queueing = true;
brcmf_dbg(INFO, "FWS queueing will be avoided\n");
return fws;
}
fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
if (fws->fws_wq == NULL) {
bphy_err(drvr, "workqueue creation failed\n");
rc = -EBADF;
goto fail;
}
INIT_WORK(&fws->fws_dequeue_work, brcmf_fws_dequeue_worker);
/* enable firmware signalling if fcmode active */
if (fws->fcmode != BRCMF_FWS_FCMODE_NONE)
tlv |= BRCMF_FWS_FLAGS_XONXOFF_SIGNALS |
BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS |
BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE |
BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE;
rc = brcmf_fweh_register(drvr, BRCMF_E_FIFO_CREDIT_MAP,
brcmf_fws_notify_credit_map);
if (rc < 0) {
bphy_err(drvr, "register credit map handler failed\n");
goto fail;
}
rc = brcmf_fweh_register(drvr, BRCMF_E_BCMC_CREDIT_SUPPORT,
brcmf_fws_notify_bcmc_credit_support);
if (rc < 0) {
bphy_err(drvr, "register bcmc credit handler failed\n");
brcmf_fweh_unregister(drvr, BRCMF_E_FIFO_CREDIT_MAP);
goto fail;
}
/* Setting the iovar may fail if feature is unsupported
* so leave the rc as is so driver initialization can
* continue. Set mode back to none indicating not enabled.
*/
fws->fw_signals = true;
ifp = brcmf_get_ifp(drvr, 0);
if (brcmf_fil_iovar_int_set(ifp, "tlv", tlv)) {
bphy_err(drvr, "failed to set bdcv2 tlv signaling\n");
fws->fcmode = BRCMF_FWS_FCMODE_NONE;
fws->fw_signals = false;
}
if (brcmf_fil_iovar_int_set(ifp, "ampdu_hostreorder", 1))
brcmf_dbg(INFO, "enabling AMPDU host-reorder failed\n");
/* Enable seq number reuse, if supported */
if (brcmf_fil_iovar_int_get(ifp, "wlfc_mode", &mode) == 0) {
if (BRCMF_FWS_MODE_GET_REUSESEQ(mode)) {
mode = 0;
BRCMF_FWS_MODE_SET_REUSESEQ(mode, 1);
if (brcmf_fil_iovar_int_set(ifp,
"wlfc_mode", mode) == 0) {
BRCMF_FWS_MODE_SET_REUSESEQ(fws->mode, 1);
}
}
}
brcmf_fws_hanger_init(&fws->hanger);
brcmf_fws_macdesc_init(&fws->desc.other, NULL, 0);
brcmf_fws_macdesc_set_name(fws, &fws->desc.other);
brcmf_dbg(INFO, "added %s\n", fws->desc.other.name);
brcmu_pktq_init(&fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
BRCMF_FWS_PSQ_LEN);
brcmf_dbg(INFO, "%s bdcv2 tlv signaling [%x]\n",
fws->fw_signals ? "enabled" : "disabled", tlv);
return fws;
fail:
brcmfmac: fix NULL pointer derefence during USB disconnect In case USB disconnect happens at the moment transmitting workqueue is in progress the underlying interface may be gone causing a NULL pointer dereference. Add synchronization of the workqueue destruction with the detach implementation in core so that the transmitting workqueue is stopped during detach before the interfaces are removed. Fix following Oops: Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = 9e6a802d [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether usb_serial_simple usbserial cdc_acm brcmfmac brcmutil smsc95xx usbnet ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base libcomposite configfs udc_core CPU: 0 PID: 7 Comm: kworker/u8:0 Not tainted 4.19.23-00076-g03740aa-dirty #102 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Workqueue: brcmf_fws_wq brcmf_fws_dequeue_worker [brcmfmac] PC is at brcmf_txfinalize+0x34/0x90 [brcmfmac] LR is at brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac] pc : [<7f0dee64>] lr : [<7f0e4140>] psr: 60010093 sp : ee8abef0 ip : 00000000 fp : edf38000 r10: ffffffed r9 : edf38970 r8 : edf38004 r7 : edf3e970 r6 : 00000000 r5 : ede69000 r4 : 00000000 r3 : 00000a97 r2 : 00000000 r1 : 0000888e r0 : ede69000 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 7d03c04a DAC: 00000051 Process kworker/u8:0 (pid: 7, stack limit = 0x24ec3e04) Stack: (0xee8abef0 to 0xee8ac000) bee0: ede69000 00000000 ed56c3e0 7f0e4140 bf00: 00000001 00000000 edf38004 edf3e99c ed56c3e0 80d03d00 edfea43a edf3e970 bf20: ee809880 ee804200 ee971100 00000000 edf3e974 00000000 ee804200 80135a70 bf40: 80d03d00 ee804218 ee809880 ee809894 ee804200 80d03d00 ee804218 ee8aa000 bf60: 00000088 80135d5c 00000000 ee829f00 ee829dc0 00000000 ee809880 80135d30 bf80: ee829f1c ee873eac 00000000 8013b1a0 ee829dc0 8013b07c 00000000 00000000 bfa0: 00000000 00000000 00000000 801010e8 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [<7f0dee64>] (brcmf_txfinalize [brcmfmac]) from [<7f0e4140>] (brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac]) [<7f0e4140>] (brcmf_fws_dequeue_worker [brcmfmac]) from [<80135a70>] (process_one_work+0x138/0x3f8) [<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554) [<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154) [<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c) Exception stack(0xee8abfb0 to 0xee8abff8) bfa0: 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 Code: e1530001 0a000007 e3560000 e1a00005 (05942008) ---[ end trace 079239dd31c86e90 ]--- Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-03-04 16:42:52 +01:00
brcmf_fws_detach_pre_delif(fws);
brcmf_fws_detach_post_delif(fws);
return ERR_PTR(rc);
}
brcmfmac: fix NULL pointer derefence during USB disconnect In case USB disconnect happens at the moment transmitting workqueue is in progress the underlying interface may be gone causing a NULL pointer dereference. Add synchronization of the workqueue destruction with the detach implementation in core so that the transmitting workqueue is stopped during detach before the interfaces are removed. Fix following Oops: Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = 9e6a802d [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether usb_serial_simple usbserial cdc_acm brcmfmac brcmutil smsc95xx usbnet ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base libcomposite configfs udc_core CPU: 0 PID: 7 Comm: kworker/u8:0 Not tainted 4.19.23-00076-g03740aa-dirty #102 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Workqueue: brcmf_fws_wq brcmf_fws_dequeue_worker [brcmfmac] PC is at brcmf_txfinalize+0x34/0x90 [brcmfmac] LR is at brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac] pc : [<7f0dee64>] lr : [<7f0e4140>] psr: 60010093 sp : ee8abef0 ip : 00000000 fp : edf38000 r10: ffffffed r9 : edf38970 r8 : edf38004 r7 : edf3e970 r6 : 00000000 r5 : ede69000 r4 : 00000000 r3 : 00000a97 r2 : 00000000 r1 : 0000888e r0 : ede69000 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 7d03c04a DAC: 00000051 Process kworker/u8:0 (pid: 7, stack limit = 0x24ec3e04) Stack: (0xee8abef0 to 0xee8ac000) bee0: ede69000 00000000 ed56c3e0 7f0e4140 bf00: 00000001 00000000 edf38004 edf3e99c ed56c3e0 80d03d00 edfea43a edf3e970 bf20: ee809880 ee804200 ee971100 00000000 edf3e974 00000000 ee804200 80135a70 bf40: 80d03d00 ee804218 ee809880 ee809894 ee804200 80d03d00 ee804218 ee8aa000 bf60: 00000088 80135d5c 00000000 ee829f00 ee829dc0 00000000 ee809880 80135d30 bf80: ee829f1c ee873eac 00000000 8013b1a0 ee829dc0 8013b07c 00000000 00000000 bfa0: 00000000 00000000 00000000 801010e8 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [<7f0dee64>] (brcmf_txfinalize [brcmfmac]) from [<7f0e4140>] (brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac]) [<7f0e4140>] (brcmf_fws_dequeue_worker [brcmfmac]) from [<80135a70>] (process_one_work+0x138/0x3f8) [<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554) [<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154) [<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c) Exception stack(0xee8abfb0 to 0xee8abff8) bfa0: 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 Code: e1530001 0a000007 e3560000 e1a00005 (05942008) ---[ end trace 079239dd31c86e90 ]--- Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-03-04 16:42:52 +01:00
void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
{
if (!fws)
return;
brcmfmac: fix NULL pointer derefence during USB disconnect In case USB disconnect happens at the moment transmitting workqueue is in progress the underlying interface may be gone causing a NULL pointer dereference. Add synchronization of the workqueue destruction with the detach implementation in core so that the transmitting workqueue is stopped during detach before the interfaces are removed. Fix following Oops: Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = 9e6a802d [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether usb_serial_simple usbserial cdc_acm brcmfmac brcmutil smsc95xx usbnet ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base libcomposite configfs udc_core CPU: 0 PID: 7 Comm: kworker/u8:0 Not tainted 4.19.23-00076-g03740aa-dirty #102 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Workqueue: brcmf_fws_wq brcmf_fws_dequeue_worker [brcmfmac] PC is at brcmf_txfinalize+0x34/0x90 [brcmfmac] LR is at brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac] pc : [<7f0dee64>] lr : [<7f0e4140>] psr: 60010093 sp : ee8abef0 ip : 00000000 fp : edf38000 r10: ffffffed r9 : edf38970 r8 : edf38004 r7 : edf3e970 r6 : 00000000 r5 : ede69000 r4 : 00000000 r3 : 00000a97 r2 : 00000000 r1 : 0000888e r0 : ede69000 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 7d03c04a DAC: 00000051 Process kworker/u8:0 (pid: 7, stack limit = 0x24ec3e04) Stack: (0xee8abef0 to 0xee8ac000) bee0: ede69000 00000000 ed56c3e0 7f0e4140 bf00: 00000001 00000000 edf38004 edf3e99c ed56c3e0 80d03d00 edfea43a edf3e970 bf20: ee809880 ee804200 ee971100 00000000 edf3e974 00000000 ee804200 80135a70 bf40: 80d03d00 ee804218 ee809880 ee809894 ee804200 80d03d00 ee804218 ee8aa000 bf60: 00000088 80135d5c 00000000 ee829f00 ee829dc0 00000000 ee809880 80135d30 bf80: ee829f1c ee873eac 00000000 8013b1a0 ee829dc0 8013b07c 00000000 00000000 bfa0: 00000000 00000000 00000000 801010e8 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [<7f0dee64>] (brcmf_txfinalize [brcmfmac]) from [<7f0e4140>] (brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac]) [<7f0e4140>] (brcmf_fws_dequeue_worker [brcmfmac]) from [<80135a70>] (process_one_work+0x138/0x3f8) [<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554) [<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154) [<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c) Exception stack(0xee8abfb0 to 0xee8abff8) bfa0: 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 Code: e1530001 0a000007 e3560000 e1a00005 (05942008) ---[ end trace 079239dd31c86e90 ]--- Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-03-04 16:42:52 +01:00
if (fws->fws_wq) {
destroy_workqueue(fws->fws_wq);
brcmfmac: fix NULL pointer derefence during USB disconnect In case USB disconnect happens at the moment transmitting workqueue is in progress the underlying interface may be gone causing a NULL pointer dereference. Add synchronization of the workqueue destruction with the detach implementation in core so that the transmitting workqueue is stopped during detach before the interfaces are removed. Fix following Oops: Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = 9e6a802d [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether usb_serial_simple usbserial cdc_acm brcmfmac brcmutil smsc95xx usbnet ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base libcomposite configfs udc_core CPU: 0 PID: 7 Comm: kworker/u8:0 Not tainted 4.19.23-00076-g03740aa-dirty #102 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Workqueue: brcmf_fws_wq brcmf_fws_dequeue_worker [brcmfmac] PC is at brcmf_txfinalize+0x34/0x90 [brcmfmac] LR is at brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac] pc : [<7f0dee64>] lr : [<7f0e4140>] psr: 60010093 sp : ee8abef0 ip : 00000000 fp : edf38000 r10: ffffffed r9 : edf38970 r8 : edf38004 r7 : edf3e970 r6 : 00000000 r5 : ede69000 r4 : 00000000 r3 : 00000a97 r2 : 00000000 r1 : 0000888e r0 : ede69000 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 7d03c04a DAC: 00000051 Process kworker/u8:0 (pid: 7, stack limit = 0x24ec3e04) Stack: (0xee8abef0 to 0xee8ac000) bee0: ede69000 00000000 ed56c3e0 7f0e4140 bf00: 00000001 00000000 edf38004 edf3e99c ed56c3e0 80d03d00 edfea43a edf3e970 bf20: ee809880 ee804200 ee971100 00000000 edf3e974 00000000 ee804200 80135a70 bf40: 80d03d00 ee804218 ee809880 ee809894 ee804200 80d03d00 ee804218 ee8aa000 bf60: 00000088 80135d5c 00000000 ee829f00 ee829dc0 00000000 ee809880 80135d30 bf80: ee829f1c ee873eac 00000000 8013b1a0 ee829dc0 8013b07c 00000000 00000000 bfa0: 00000000 00000000 00000000 801010e8 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [<7f0dee64>] (brcmf_txfinalize [brcmfmac]) from [<7f0e4140>] (brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac]) [<7f0e4140>] (brcmf_fws_dequeue_worker [brcmfmac]) from [<80135a70>] (process_one_work+0x138/0x3f8) [<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554) [<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154) [<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c) Exception stack(0xee8abfb0 to 0xee8abff8) bfa0: 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 Code: e1530001 0a000007 e3560000 e1a00005 (05942008) ---[ end trace 079239dd31c86e90 ]--- Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-03-04 16:42:52 +01:00
fws->fws_wq = NULL;
}
}
void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
{
if (!fws)
return;
/* cleanup */
brcmf_fws_lock(fws);
brcmf_fws_cleanup(fws, -1);
brcmf_fws_unlock(fws);
/* free top structure */
kfree(fws);
}
void brcmf_fws_debugfs_create(struct brcmf_pub *drvr)
{
/* create debugfs file for statistics */
brcmf_debugfs_add_entry(drvr, "fws_stats",
brcmf_debugfs_fws_stats_read);
}
bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws)
{
return !fws->avoid_queueing;
}
bool brcmf_fws_fc_active(struct brcmf_fws_info *fws)
{
if (!fws->creditmap_received)
return false;
return fws->fcmode != BRCMF_FWS_FCMODE_NONE;
}
void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
{
u32 hslot;
if (brcmf_skbcb(skb)->state == BRCMF_FWS_SKBSTATE_TIM) {
brcmu_pkt_buf_free_skb(skb);
return;
}
brcmf_fws_lock(fws);
hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0, 0,
1);
brcmf_fws_unlock(fws);
}
void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
{
struct brcmf_fws_info *fws = drvr_to_fws(drvr);
struct brcmf_if *ifp;
int i;
if (fws->avoid_queueing) {
for (i = 0; i < BRCMF_MAX_IFS; i++) {
ifp = drvr->iflist[i];
if (!ifp || !ifp->ndev)
continue;
brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW,
flow_blocked);
}
} else {
fws->bus_flow_blocked = flow_blocked;
if (!flow_blocked)
brcmf_fws_schedule_deq(fws);
else
fws->stats.bus_flow_block++;
}
}