1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * Copyright (C) 2021-2023 Intel Corporation 4 */ 5 6#include <linux/etherdevice.h> 7#include <linux/netdevice.h> 8#include <linux/ieee80211.h> 9#include <linux/rtnetlink.h> 10#include <linux/module.h> 11#include <linux/moduleparam.h> 12#include <linux/mei_cl_bus.h> 13#include <linux/rcupdate.h> 14#include <linux/debugfs.h> 15#include <linux/skbuff.h> 16#include <linux/wait.h> 17#include <linux/slab.h> 18#include <linux/mm.h> 19 20#include <net/cfg80211.h> 21 22#include "internal.h" 23#include "iwl-mei.h" 24#include "trace.h" 25#include "trace-data.h" 26#include "sap.h" 27 28MODULE_DESCRIPTION("The Intel(R) wireless / CSME firmware interface"); 29MODULE_LICENSE("GPL"); 30 31#define MEI_WLAN_UUID UUID_LE(0x13280904, 0x7792, 0x4fcb, \ 32 0xa1, 0xaa, 0x5e, 0x70, 0xcb, 0xb1, 0xe8, 0x65) 33 34/* After CSME takes ownership, it won't release it for 60 seconds to avoid 35 * frequent ownership transitions. 36 */ 37#define MEI_OWNERSHIP_RETAKE_TIMEOUT_MS msecs_to_jiffies(60000) 38 39/* 40 * Since iwlwifi calls iwlmei without any context, hold a pointer to the 41 * mei_cl_device structure here. 42 * Define a mutex that will synchronize all the flows between iwlwifi and 43 * iwlmei. 44 * Note that iwlmei can't have several instances, so it ok to have static 45 * variables here. 46 */ 47static struct mei_cl_device *iwl_mei_global_cldev; 48static DEFINE_MUTEX(iwl_mei_mutex); 49static unsigned long iwl_mei_status; 50 51enum iwl_mei_status_bits { 52 IWL_MEI_STATUS_SAP_CONNECTED, 53}; 54 55bool iwl_mei_is_connected(void) 56{ 57 return test_bit(IWL_MEI_STATUS_SAP_CONNECTED, &iwl_mei_status); 58} 59EXPORT_SYMBOL_GPL(iwl_mei_is_connected); 60 61#define SAP_VERSION 3 62#define SAP_CONTROL_BLOCK_ID 0x21504153 /* SAP! in ASCII */ 63 64struct iwl_sap_q_ctrl_blk { 65 __le32 wr_ptr; 66 __le32 rd_ptr; 67 __le32 size; 68}; 69 70enum iwl_sap_q_idx { 71 SAP_QUEUE_IDX_NOTIF = 0, 72 SAP_QUEUE_IDX_DATA, 73 SAP_QUEUE_IDX_MAX, 74}; 75 76struct iwl_sap_dir { 77 __le32 reserved; 78 struct iwl_sap_q_ctrl_blk q_ctrl_blk[SAP_QUEUE_IDX_MAX]; 79}; 80 81enum iwl_sap_dir_idx { 82 SAP_DIRECTION_HOST_TO_ME = 0, 83 SAP_DIRECTION_ME_TO_HOST, 84 SAP_DIRECTION_MAX, 85}; 86 87struct iwl_sap_shared_mem_ctrl_blk { 88 __le32 sap_id; 89 __le32 size; 90 struct iwl_sap_dir dir[SAP_DIRECTION_MAX]; 91}; 92 93/* 94 * The shared area has the following layout: 95 * 96 * +-----------------------------------+ 97 * |struct iwl_sap_shared_mem_ctrl_blk | 98 * +-----------------------------------+ 99 * |Host -> ME data queue | 100 * +-----------------------------------+ 101 * |Host -> ME notif queue | 102 * +-----------------------------------+ 103 * |ME -> Host data queue | 104 * +-----------------------------------+ 105 * |ME -> host notif queue | 106 * +-----------------------------------+ 107 * |SAP control block id (SAP!) | 108 * +-----------------------------------+ 109 */ 110 111#define SAP_H2M_DATA_Q_SZ 48256 112#define SAP_M2H_DATA_Q_SZ 24128 113#define SAP_H2M_NOTIF_Q_SZ 2240 114#define SAP_M2H_NOTIF_Q_SZ 62720 115 116#define _IWL_MEI_SAP_SHARED_MEM_SZ \ 117 (sizeof(struct iwl_sap_shared_mem_ctrl_blk) + \ 118 SAP_H2M_DATA_Q_SZ + SAP_H2M_NOTIF_Q_SZ + \ 119 SAP_M2H_DATA_Q_SZ + SAP_M2H_NOTIF_Q_SZ + 4) 120 121#define IWL_MEI_SAP_SHARED_MEM_SZ \ 122 (roundup(_IWL_MEI_SAP_SHARED_MEM_SZ, PAGE_SIZE)) 123 124struct iwl_mei_shared_mem_ptrs { 125 struct iwl_sap_shared_mem_ctrl_blk *ctrl; 126 void *q_head[SAP_DIRECTION_MAX][SAP_QUEUE_IDX_MAX]; 127 size_t q_size[SAP_DIRECTION_MAX][SAP_QUEUE_IDX_MAX]; 128}; 129 130struct iwl_mei_filters { 131 struct rcu_head rcu_head; 132 struct iwl_sap_oob_filters filters; 133}; 134 135/** 136 * struct iwl_mei - holds the private date for iwl_mei 137 * 138 * @get_nvm_wq: the wait queue for the get_nvm flow 139 * @send_csa_msg_wk: used to defer the transmission of the CHECK_SHARED_AREA 140 * message. Used so that we can send CHECK_SHARED_AREA from atomic 141 * contexts. 142 * @get_ownership_wq: the wait queue for the get_ownership_flow 143 * @shared_mem: the memory that is shared between CSME and the host 144 * @cldev: the pointer to the MEI client device 145 * @nvm: the data returned by the CSME for the NVM 146 * @filters: the filters sent by CSME 147 * @got_ownership: true if we own the device 148 * @amt_enabled: true if CSME has wireless enabled 149 * @csa_throttled: when true, we can't send CHECK_SHARED_AREA over the MEI 150 * bus, but rather need to wait until send_csa_msg_wk runs 151 * @csme_taking_ownership: true when CSME is taking ownership. Used to remember 152 * to send CSME_OWNERSHIP_CONFIRMED when the driver completes its down 153 * flow. 154 * @link_prot_state: true when we are in link protection PASSIVE 155 * @device_down: true if the device is down. Used to remember to send 156 * CSME_OWNERSHIP_CONFIRMED when the driver is already down. 157 * @csa_throttle_end_wk: used when &csa_throttled is true 158 * @pldr_wq: the wait queue for PLDR flow 159 * @pldr_active: PLDR flow is in progress 160 * @data_q_lock: protects the access to the data queues which are 161 * accessed without the mutex. 162 * @netdev_work: used to defer registering and unregistering of the netdev to 163 * avoid taking the rtnl lock in the SAP messages handlers. 164 * @ownership_dwork: used to re-ask for NIC ownership after ownership was taken 165 * by CSME or when a previous ownership request failed. 166 * @sap_seq_no: the sequence number for the SAP messages 167 * @seq_no: the sequence number for the SAP messages 168 * @dbgfs_dir: the debugfs dir entry 169 */ 170struct iwl_mei { 171 wait_queue_head_t get_nvm_wq; 172 struct work_struct send_csa_msg_wk; 173 wait_queue_head_t get_ownership_wq; 174 struct iwl_mei_shared_mem_ptrs shared_mem; 175 struct mei_cl_device *cldev; 176 struct iwl_mei_nvm *nvm; 177 struct iwl_mei_filters __rcu *filters; 178 bool got_ownership; 179 bool amt_enabled; 180 bool csa_throttled; 181 bool csme_taking_ownership; 182 bool link_prot_state; 183 bool device_down; 184 struct delayed_work csa_throttle_end_wk; 185 wait_queue_head_t pldr_wq; 186 bool pldr_active; 187 spinlock_t data_q_lock; 188 struct work_struct netdev_work; 189 struct delayed_work ownership_dwork; 190 191 atomic_t sap_seq_no; 192 atomic_t seq_no; 193 194 struct dentry *dbgfs_dir; 195}; 196 197/** 198 * struct iwl_mei_cache - cache for the parameters from iwlwifi 199 * @ops: Callbacks to iwlwifi. 200 * @netdev: The netdev that will be used to transmit / receive packets. 201 * @conn_info: The connection info message triggered by iwlwifi's association. 202 * @power_limit: pointer to an array of 10 elements (le16) represents the power 203 * restrictions per chain. 204 * @rf_kill: rf kill state. 205 * @mcc: MCC info 206 * @mac_address: interface MAC address. 207 * @nvm_address: NVM MAC address. 208 * @priv: A pointer to iwlwifi. 209 * 210 * This used to cache the configurations coming from iwlwifi's way. The data 211 * is cached here so that we can buffer the configuration even if we don't have 212 * a bind from the mei bus and hence, on iwl_mei structure. 213 */ 214struct iwl_mei_cache { 215 const struct iwl_mei_ops *ops; 216 struct net_device __rcu *netdev; 217 const struct iwl_sap_notif_connection_info *conn_info; 218 const __le16 *power_limit; 219 u32 rf_kill; 220 u16 mcc; 221 u8 mac_address[6]; 222 u8 nvm_address[6]; 223 void *priv; 224}; 225 226static struct iwl_mei_cache iwl_mei_cache = { 227 .rf_kill = SAP_HW_RFKILL_DEASSERTED | SAP_SW_RFKILL_DEASSERTED 228}; 229 230static void iwl_mei_free_shared_mem(struct mei_cl_device *cldev) 231{ 232 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 233 234 if (mei_cldev_dma_unmap(cldev)) 235 dev_err(&cldev->dev, "Couldn't unmap the shared mem properly\n"); 236 memset(&mei->shared_mem, 0, sizeof(mei->shared_mem)); 237} 238 239#define HBM_DMA_BUF_ID_WLAN 1 240 241static int iwl_mei_alloc_shared_mem(struct mei_cl_device *cldev) 242{ 243 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 244 struct iwl_mei_shared_mem_ptrs *mem = &mei->shared_mem; 245 246 mem->ctrl = mei_cldev_dma_map(cldev, HBM_DMA_BUF_ID_WLAN, 247 IWL_MEI_SAP_SHARED_MEM_SZ); 248 249 if (IS_ERR(mem->ctrl)) { 250 int ret = PTR_ERR(mem->ctrl); 251 252 mem->ctrl = NULL; 253 254 return ret; 255 } 256 257 memset(mem->ctrl, 0, IWL_MEI_SAP_SHARED_MEM_SZ); 258 259 return 0; 260} 261 262static void iwl_mei_init_shared_mem(struct iwl_mei *mei) 263{ 264 struct iwl_mei_shared_mem_ptrs *mem = &mei->shared_mem; 265 struct iwl_sap_dir *h2m; 266 struct iwl_sap_dir *m2h; 267 int dir, queue; 268 u8 *q_head; 269 270 mem->ctrl->sap_id = cpu_to_le32(SAP_CONTROL_BLOCK_ID); 271 272 mem->ctrl->size = cpu_to_le32(sizeof(*mem->ctrl)); 273 274 h2m = &mem->ctrl->dir[SAP_DIRECTION_HOST_TO_ME]; 275 m2h = &mem->ctrl->dir[SAP_DIRECTION_ME_TO_HOST]; 276 277 h2m->q_ctrl_blk[SAP_QUEUE_IDX_DATA].size = 278 cpu_to_le32(SAP_H2M_DATA_Q_SZ); 279 h2m->q_ctrl_blk[SAP_QUEUE_IDX_NOTIF].size = 280 cpu_to_le32(SAP_H2M_NOTIF_Q_SZ); 281 m2h->q_ctrl_blk[SAP_QUEUE_IDX_DATA].size = 282 cpu_to_le32(SAP_M2H_DATA_Q_SZ); 283 m2h->q_ctrl_blk[SAP_QUEUE_IDX_NOTIF].size = 284 cpu_to_le32(SAP_M2H_NOTIF_Q_SZ); 285 286 /* q_head points to the start of the first queue */ 287 q_head = (void *)(mem->ctrl + 1); 288 289 /* Initialize the queue heads */ 290 for (dir = 0; dir < SAP_DIRECTION_MAX; dir++) { 291 for (queue = 0; queue < SAP_QUEUE_IDX_MAX; queue++) { 292 mem->q_head[dir][queue] = q_head; 293 q_head += 294 le32_to_cpu(mem->ctrl->dir[dir].q_ctrl_blk[queue].size); 295 mem->q_size[dir][queue] = 296 le32_to_cpu(mem->ctrl->dir[dir].q_ctrl_blk[queue].size); 297 } 298 } 299 300 *(__le32 *)q_head = cpu_to_le32(SAP_CONTROL_BLOCK_ID); 301} 302 303static ssize_t iwl_mei_write_cyclic_buf(struct mei_cl_device *cldev, 304 struct iwl_sap_q_ctrl_blk *notif_q, 305 u8 *q_head, 306 const struct iwl_sap_hdr *hdr, 307 u32 q_sz) 308{ 309 u32 rd = le32_to_cpu(READ_ONCE(notif_q->rd_ptr)); 310 u32 wr = le32_to_cpu(READ_ONCE(notif_q->wr_ptr)); 311 size_t room_in_buf; 312 size_t tx_sz = sizeof(*hdr) + le16_to_cpu(hdr->len); 313 314 if (rd > q_sz || wr > q_sz) { 315 dev_err(&cldev->dev, 316 "Pointers are past the end of the buffer\n"); 317 return -EINVAL; 318 } 319 320 room_in_buf = wr >= rd ? q_sz - wr + rd : rd - wr; 321 322 /* we don't have enough room for the data to write */ 323 if (room_in_buf < tx_sz) { 324 dev_err(&cldev->dev, 325 "Not enough room in the buffer\n"); 326 return -ENOSPC; 327 } 328 329 if (wr + tx_sz <= q_sz) { 330 memcpy(q_head + wr, hdr, tx_sz); 331 } else { 332 memcpy(q_head + wr, hdr, q_sz - wr); 333 memcpy(q_head, (const u8 *)hdr + q_sz - wr, tx_sz - (q_sz - wr)); 334 } 335 336 WRITE_ONCE(notif_q->wr_ptr, cpu_to_le32((wr + tx_sz) % q_sz)); 337 return 0; 338} 339 340static bool iwl_mei_host_to_me_data_pending(const struct iwl_mei *mei) 341{ 342 struct iwl_sap_q_ctrl_blk *notif_q; 343 struct iwl_sap_dir *dir; 344 345 dir = &mei->shared_mem.ctrl->dir[SAP_DIRECTION_HOST_TO_ME]; 346 notif_q = &dir->q_ctrl_blk[SAP_QUEUE_IDX_DATA]; 347 348 if (READ_ONCE(notif_q->wr_ptr) != READ_ONCE(notif_q->rd_ptr)) 349 return true; 350 351 notif_q = &dir->q_ctrl_blk[SAP_QUEUE_IDX_NOTIF]; 352 return READ_ONCE(notif_q->wr_ptr) != READ_ONCE(notif_q->rd_ptr); 353} 354 355static int iwl_mei_send_check_shared_area(struct mei_cl_device *cldev) 356{ 357 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 358 struct iwl_sap_me_msg_start msg = { 359 .hdr.type = cpu_to_le32(SAP_ME_MSG_CHECK_SHARED_AREA), 360 .hdr.seq_num = cpu_to_le32(atomic_inc_return(&mei->seq_no)), 361 }; 362 int ret; 363 364 lockdep_assert_held(&iwl_mei_mutex); 365 366 if (mei->csa_throttled) 367 return 0; 368 369 trace_iwlmei_me_msg(&msg.hdr, true); 370 ret = mei_cldev_send(cldev, (void *)&msg, sizeof(msg)); 371 if (ret != sizeof(msg)) { 372 dev_err(&cldev->dev, 373 "failed to send the SAP_ME_MSG_CHECK_SHARED_AREA message %d\n", 374 ret); 375 return ret; 376 } 377 378 mei->csa_throttled = true; 379 380 schedule_delayed_work(&mei->csa_throttle_end_wk, 381 msecs_to_jiffies(100)); 382 383 return 0; 384} 385 386static void iwl_mei_csa_throttle_end_wk(struct work_struct *wk) 387{ 388 struct iwl_mei *mei = 389 container_of(wk, struct iwl_mei, csa_throttle_end_wk.work); 390 391 mutex_lock(&iwl_mei_mutex); 392 393 mei->csa_throttled = false; 394 395 if (iwl_mei_host_to_me_data_pending(mei)) 396 iwl_mei_send_check_shared_area(mei->cldev); 397 398 mutex_unlock(&iwl_mei_mutex); 399} 400 401static int iwl_mei_send_sap_msg_payload(struct mei_cl_device *cldev, 402 struct iwl_sap_hdr *hdr) 403{ 404 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 405 struct iwl_sap_q_ctrl_blk *notif_q; 406 struct iwl_sap_dir *dir; 407 void *q_head; 408 u32 q_sz; 409 int ret; 410 411 lockdep_assert_held(&iwl_mei_mutex); 412 413 if (!mei->shared_mem.ctrl) { 414 dev_err(&cldev->dev, 415 "No shared memory, can't send any SAP message\n"); 416 return -EINVAL; 417 } 418 419 if (!iwl_mei_is_connected()) { 420 dev_err(&cldev->dev, 421 "Can't send a SAP message if we're not connected\n"); 422 return -ENODEV; 423 } 424 425 hdr->seq_num = cpu_to_le32(atomic_inc_return(&mei->sap_seq_no)); 426 dev_dbg(&cldev->dev, "Sending %d\n", hdr->type); 427 428 dir = &mei->shared_mem.ctrl->dir[SAP_DIRECTION_HOST_TO_ME]; 429 notif_q = &dir->q_ctrl_blk[SAP_QUEUE_IDX_NOTIF]; 430 q_head = mei->shared_mem.q_head[SAP_DIRECTION_HOST_TO_ME][SAP_QUEUE_IDX_NOTIF]; 431 q_sz = mei->shared_mem.q_size[SAP_DIRECTION_HOST_TO_ME][SAP_QUEUE_IDX_NOTIF]; 432 ret = iwl_mei_write_cyclic_buf(q_head, notif_q, q_head, hdr, q_sz); 433 434 if (ret < 0) 435 return ret; 436 437 trace_iwlmei_sap_cmd(hdr, true); 438 439 return iwl_mei_send_check_shared_area(cldev); 440} 441 442void iwl_mei_add_data_to_ring(struct sk_buff *skb, bool cb_tx) 443{ 444 struct iwl_sap_q_ctrl_blk *notif_q; 445 struct iwl_sap_dir *dir; 446 struct iwl_mei *mei; 447 size_t room_in_buf; 448 size_t tx_sz; 449 size_t hdr_sz; 450 u32 q_sz; 451 u32 rd; 452 u32 wr; 453 u8 *q_head; 454 455 if (!iwl_mei_global_cldev) 456 return; 457 458 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 459 460 /* 461 * We access this path for Rx packets (the more common case) 462 * and from Tx path when we send DHCP packets, the latter is 463 * very unlikely. 464 * Take the lock already here to make sure we see that remove() 465 * might have cleared the IWL_MEI_STATUS_SAP_CONNECTED bit. 466 */ 467 spin_lock_bh(&mei->data_q_lock); 468 469 if (!iwl_mei_is_connected()) { 470 spin_unlock_bh(&mei->data_q_lock); 471 return; 472 } 473 474 /* 475 * We are in a RCU critical section and the remove from the CSME bus 476 * which would free this memory waits for the readers to complete (this 477 * is done in netdev_rx_handler_unregister). 478 */ 479 dir = &mei->shared_mem.ctrl->dir[SAP_DIRECTION_HOST_TO_ME]; 480 notif_q = &dir->q_ctrl_blk[SAP_QUEUE_IDX_DATA]; 481 q_head = mei->shared_mem.q_head[SAP_DIRECTION_HOST_TO_ME][SAP_QUEUE_IDX_DATA]; 482 q_sz = mei->shared_mem.q_size[SAP_DIRECTION_HOST_TO_ME][SAP_QUEUE_IDX_DATA]; 483 484 rd = le32_to_cpu(READ_ONCE(notif_q->rd_ptr)); 485 wr = le32_to_cpu(READ_ONCE(notif_q->wr_ptr)); 486 hdr_sz = cb_tx ? sizeof(struct iwl_sap_cb_data) : 487 sizeof(struct iwl_sap_hdr); 488 tx_sz = skb->len + hdr_sz; 489 490 if (rd > q_sz || wr > q_sz) { 491 dev_err(&mei->cldev->dev, 492 "can't write the data: pointers are past the end of the buffer\n"); 493 goto out; 494 } 495 496 room_in_buf = wr >= rd ? q_sz - wr + rd : rd - wr; 497 498 /* we don't have enough room for the data to write */ 499 if (room_in_buf < tx_sz) { 500 dev_err(&mei->cldev->dev, 501 "Not enough room in the buffer for this data\n"); 502 goto out; 503 } 504 505 if (skb_headroom(skb) < hdr_sz) { 506 dev_err(&mei->cldev->dev, 507 "Not enough headroom in the skb to write the SAP header\n"); 508 goto out; 509 } 510 511 if (cb_tx) { 512 struct iwl_sap_cb_data *cb_hdr = skb_push(skb, sizeof(*cb_hdr)); 513 514 memset(cb_hdr, 0, sizeof(*cb_hdr)); 515 cb_hdr->hdr.type = cpu_to_le16(SAP_MSG_CB_DATA_PACKET); 516 cb_hdr->hdr.len = cpu_to_le16(skb->len - sizeof(cb_hdr->hdr)); 517 cb_hdr->hdr.seq_num = cpu_to_le32(atomic_inc_return(&mei->sap_seq_no)); 518 cb_hdr->to_me_filt_status = cpu_to_le32(BIT(CB_TX_DHCP_FILT_IDX)); 519 cb_hdr->data_len = cpu_to_le32(skb->len - sizeof(*cb_hdr)); 520 trace_iwlmei_sap_data(skb, IWL_SAP_TX_DHCP); 521 } else { 522 struct iwl_sap_hdr *hdr = skb_push(skb, sizeof(*hdr)); 523 524 hdr->type = cpu_to_le16(SAP_MSG_DATA_PACKET); 525 hdr->len = cpu_to_le16(skb->len - sizeof(*hdr)); 526 hdr->seq_num = cpu_to_le32(atomic_inc_return(&mei->sap_seq_no)); 527 trace_iwlmei_sap_data(skb, IWL_SAP_TX_DATA_FROM_AIR); 528 } 529 530 if (wr + tx_sz <= q_sz) { 531 skb_copy_bits(skb, 0, q_head + wr, tx_sz); 532 } else { 533 skb_copy_bits(skb, 0, q_head + wr, q_sz - wr); 534 skb_copy_bits(skb, q_sz - wr, q_head, tx_sz - (q_sz - wr)); 535 } 536 537 WRITE_ONCE(notif_q->wr_ptr, cpu_to_le32((wr + tx_sz) % q_sz)); 538 539out: 540 spin_unlock_bh(&mei->data_q_lock); 541} 542 543static int 544iwl_mei_send_sap_msg(struct mei_cl_device *cldev, u16 type) 545{ 546 struct iwl_sap_hdr msg = { 547 .type = cpu_to_le16(type), 548 }; 549 550 return iwl_mei_send_sap_msg_payload(cldev, &msg); 551} 552 553static void iwl_mei_send_csa_msg_wk(struct work_struct *wk) 554{ 555 struct iwl_mei *mei = 556 container_of(wk, struct iwl_mei, send_csa_msg_wk); 557 558 if (!iwl_mei_is_connected()) 559 return; 560 561 mutex_lock(&iwl_mei_mutex); 562 563 iwl_mei_send_check_shared_area(mei->cldev); 564 565 mutex_unlock(&iwl_mei_mutex); 566} 567 568/* Called in a RCU read critical section from netif_receive_skb */ 569static rx_handler_result_t iwl_mei_rx_handler(struct sk_buff **pskb) 570{ 571 struct sk_buff *skb = *pskb; 572 struct iwl_mei *mei = 573 rcu_dereference(skb->dev->rx_handler_data); 574 struct iwl_mei_filters *filters = rcu_dereference(mei->filters); 575 bool rx_for_csme = false; 576 rx_handler_result_t res; 577 578 /* 579 * remove() unregisters this handler and synchronize_net, so this 580 * should never happen. 581 */ 582 if (!iwl_mei_is_connected()) { 583 dev_err(&mei->cldev->dev, 584 "Got an Rx packet, but we're not connected to SAP?\n"); 585 return RX_HANDLER_PASS; 586 } 587 588 if (filters) 589 res = iwl_mei_rx_filter(skb, &filters->filters, &rx_for_csme); 590 else 591 res = RX_HANDLER_PASS; 592 593 /* 594 * The data is already on the ring of the shared area, all we 595 * need to do is to tell the CSME firmware to check what we have 596 * there. 597 */ 598 if (rx_for_csme) 599 schedule_work(&mei->send_csa_msg_wk); 600 601 if (res != RX_HANDLER_PASS) { 602 trace_iwlmei_sap_data(skb, IWL_SAP_RX_DATA_DROPPED_FROM_AIR); 603 dev_kfree_skb(skb); 604 } 605 606 return res; 607} 608 609static void iwl_mei_netdev_work(struct work_struct *wk) 610{ 611 struct iwl_mei *mei = 612 container_of(wk, struct iwl_mei, netdev_work); 613 struct net_device *netdev; 614 615 /* 616 * First take rtnl and only then the mutex to avoid an ABBA 617 * with iwl_mei_set_netdev() 618 */ 619 rtnl_lock(); 620 mutex_lock(&iwl_mei_mutex); 621 622 netdev = rcu_dereference_protected(iwl_mei_cache.netdev, 623 lockdep_is_held(&iwl_mei_mutex)); 624 if (netdev) { 625 if (mei->amt_enabled) 626 netdev_rx_handler_register(netdev, iwl_mei_rx_handler, 627 mei); 628 else 629 netdev_rx_handler_unregister(netdev); 630 } 631 632 mutex_unlock(&iwl_mei_mutex); 633 rtnl_unlock(); 634} 635 636static void 637iwl_mei_handle_rx_start_ok(struct mei_cl_device *cldev, 638 const struct iwl_sap_me_msg_start_ok *rsp, 639 ssize_t len) 640{ 641 if (len != sizeof(*rsp)) { 642 dev_err(&cldev->dev, 643 "got invalid SAP_ME_MSG_START_OK from CSME firmware\n"); 644 dev_err(&cldev->dev, 645 "size is incorrect: %zd instead of %zu\n", 646 len, sizeof(*rsp)); 647 return; 648 } 649 650 if (rsp->supported_version != SAP_VERSION) { 651 dev_err(&cldev->dev, 652 "didn't get the expected version: got %d\n", 653 rsp->supported_version); 654 return; 655 } 656 657 mutex_lock(&iwl_mei_mutex); 658 set_bit(IWL_MEI_STATUS_SAP_CONNECTED, &iwl_mei_status); 659 /* 660 * We'll receive AMT_STATE SAP message in a bit and 661 * that will continue the flow 662 */ 663 mutex_unlock(&iwl_mei_mutex); 664} 665 666static void iwl_mei_handle_csme_filters(struct mei_cl_device *cldev, 667 const struct iwl_sap_csme_filters *filters) 668{ 669 struct iwl_mei *mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 670 struct iwl_mei_filters *new_filters; 671 struct iwl_mei_filters *old_filters; 672 673 old_filters = 674 rcu_dereference_protected(mei->filters, 675 lockdep_is_held(&iwl_mei_mutex)); 676 677 new_filters = kzalloc(sizeof(*new_filters), GFP_KERNEL); 678 if (!new_filters) 679 return; 680 681 /* Copy the OOB filters */ 682 new_filters->filters = filters->filters; 683 684 rcu_assign_pointer(mei->filters, new_filters); 685 686 if (old_filters) 687 kfree_rcu(old_filters, rcu_head); 688} 689 690static void 691iwl_mei_handle_conn_status(struct mei_cl_device *cldev, 692 const struct iwl_sap_notif_conn_status *status) 693{ 694 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 695 struct iwl_mei_conn_info conn_info = { 696 .lp_state = le32_to_cpu(status->link_prot_state), 697 .ssid_len = le32_to_cpu(status->conn_info.ssid_len), 698 .channel = status->conn_info.channel, 699 .band = status->conn_info.band, 700 .auth_mode = le32_to_cpu(status->conn_info.auth_mode), 701 .pairwise_cipher = le32_to_cpu(status->conn_info.pairwise_cipher), 702 }; 703 704 if (!iwl_mei_cache.ops || 705 conn_info.ssid_len > ARRAY_SIZE(conn_info.ssid)) 706 return; 707 708 memcpy(conn_info.ssid, status->conn_info.ssid, conn_info.ssid_len); 709 ether_addr_copy(conn_info.bssid, status->conn_info.bssid); 710 711 iwl_mei_cache.ops->me_conn_status(iwl_mei_cache.priv, &conn_info); 712 713 mei->link_prot_state = status->link_prot_state; 714 715 /* 716 * Update the Rfkill state in case the host does not own the device: 717 * if we are in Link Protection, ask to not touch the device, else, 718 * unblock rfkill. 719 * If the host owns the device, inform the user space whether it can 720 * roam. 721 */ 722 if (mei->got_ownership) 723 iwl_mei_cache.ops->roaming_forbidden(iwl_mei_cache.priv, 724 status->link_prot_state); 725 else 726 iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, 727 status->link_prot_state, false); 728} 729 730static void iwl_mei_set_init_conf(struct iwl_mei *mei) 731{ 732 struct iwl_sap_notif_host_link_up link_msg = { 733 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_HOST_LINK_UP), 734 .hdr.len = cpu_to_le16(sizeof(link_msg) - sizeof(link_msg.hdr)), 735 }; 736 struct iwl_sap_notif_country_code mcc_msg = { 737 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_COUNTRY_CODE), 738 .hdr.len = cpu_to_le16(sizeof(mcc_msg) - sizeof(mcc_msg.hdr)), 739 .mcc = cpu_to_le16(iwl_mei_cache.mcc), 740 }; 741 struct iwl_sap_notif_sar_limits sar_msg = { 742 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_SAR_LIMITS), 743 .hdr.len = cpu_to_le16(sizeof(sar_msg) - sizeof(sar_msg.hdr)), 744 }; 745 struct iwl_sap_notif_host_nic_info nic_info_msg = { 746 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_NIC_INFO), 747 .hdr.len = cpu_to_le16(sizeof(nic_info_msg) - sizeof(nic_info_msg.hdr)), 748 }; 749 struct iwl_sap_msg_dw rfkill_msg = { 750 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_RADIO_STATE), 751 .hdr.len = cpu_to_le16(sizeof(rfkill_msg) - sizeof(rfkill_msg.hdr)), 752 .val = cpu_to_le32(iwl_mei_cache.rf_kill), 753 }; 754 755 /* wifi driver has registered already */ 756 if (iwl_mei_cache.ops) { 757 iwl_mei_send_sap_msg(mei->cldev, 758 SAP_MSG_NOTIF_WIFIDR_UP); 759 iwl_mei_cache.ops->sap_connected(iwl_mei_cache.priv); 760 } 761 762 iwl_mei_send_sap_msg(mei->cldev, SAP_MSG_NOTIF_WHO_OWNS_NIC); 763 764 if (iwl_mei_cache.conn_info) { 765 link_msg.conn_info = *iwl_mei_cache.conn_info; 766 iwl_mei_send_sap_msg_payload(mei->cldev, &link_msg.hdr); 767 } 768 769 iwl_mei_send_sap_msg_payload(mei->cldev, &mcc_msg.hdr); 770 771 if (iwl_mei_cache.power_limit) { 772 memcpy(sar_msg.sar_chain_info_table, iwl_mei_cache.power_limit, 773 sizeof(sar_msg.sar_chain_info_table)); 774 iwl_mei_send_sap_msg_payload(mei->cldev, &sar_msg.hdr); 775 } 776 777 if (is_valid_ether_addr(iwl_mei_cache.mac_address)) { 778 ether_addr_copy(nic_info_msg.mac_address, 779 iwl_mei_cache.mac_address); 780 ether_addr_copy(nic_info_msg.nvm_address, 781 iwl_mei_cache.nvm_address); 782 iwl_mei_send_sap_msg_payload(mei->cldev, &nic_info_msg.hdr); 783 } 784 785 iwl_mei_send_sap_msg_payload(mei->cldev, &rfkill_msg.hdr); 786} 787 788static void iwl_mei_handle_amt_state(struct mei_cl_device *cldev, 789 const struct iwl_sap_msg_dw *dw) 790{ 791 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 792 793 mutex_lock(&iwl_mei_mutex); 794 795 if (mei->amt_enabled == !!le32_to_cpu(dw->val)) 796 goto out; 797 798 mei->amt_enabled = dw->val; 799 800 if (mei->amt_enabled) 801 iwl_mei_set_init_conf(mei); 802 else if (iwl_mei_cache.ops) 803 iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false, false); 804 805 schedule_work(&mei->netdev_work); 806 807out: 808 mutex_unlock(&iwl_mei_mutex); 809} 810 811static void iwl_mei_handle_nic_owner(struct mei_cl_device *cldev, 812 const struct iwl_sap_msg_dw *dw) 813{ 814 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 815 816 mei->got_ownership = dw->val != cpu_to_le32(SAP_NIC_OWNER_ME); 817} 818 819static void iwl_mei_handle_can_release_ownership(struct mei_cl_device *cldev, 820 const void *payload) 821{ 822 /* We can get ownership and driver is registered, go ahead */ 823 if (iwl_mei_cache.ops) 824 iwl_mei_send_sap_msg(cldev, 825 SAP_MSG_NOTIF_HOST_ASKS_FOR_NIC_OWNERSHIP); 826} 827 828static void iwl_mei_handle_csme_taking_ownership(struct mei_cl_device *cldev, 829 const void *payload) 830{ 831 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 832 833 dev_info(&cldev->dev, "CSME takes ownership\n"); 834 835 mei->got_ownership = false; 836 837 if (iwl_mei_cache.ops && !mei->device_down) { 838 /* 839 * Remember to send CSME_OWNERSHIP_CONFIRMED when the wifi 840 * driver is finished taking the device down. 841 */ 842 mei->csme_taking_ownership = true; 843 844 iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, true, true); 845 } else { 846 iwl_mei_send_sap_msg(cldev, 847 SAP_MSG_NOTIF_CSME_OWNERSHIP_CONFIRMED); 848 schedule_delayed_work(&mei->ownership_dwork, 849 MEI_OWNERSHIP_RETAKE_TIMEOUT_MS); 850 } 851} 852 853static void iwl_mei_handle_nvm(struct mei_cl_device *cldev, 854 const struct iwl_sap_nvm *sap_nvm) 855{ 856 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 857 const struct iwl_mei_nvm *mei_nvm = (const void *)sap_nvm; 858 int i; 859 860 kfree(mei->nvm); 861 mei->nvm = kzalloc(sizeof(*mei_nvm), GFP_KERNEL); 862 if (!mei->nvm) 863 return; 864 865 ether_addr_copy(mei->nvm->hw_addr, sap_nvm->hw_addr); 866 mei->nvm->n_hw_addrs = sap_nvm->n_hw_addrs; 867 mei->nvm->radio_cfg = le32_to_cpu(sap_nvm->radio_cfg); 868 mei->nvm->caps = le32_to_cpu(sap_nvm->caps); 869 mei->nvm->nvm_version = le32_to_cpu(sap_nvm->nvm_version); 870 871 for (i = 0; i < ARRAY_SIZE(mei->nvm->channels); i++) 872 mei->nvm->channels[i] = le32_to_cpu(sap_nvm->channels[i]); 873 874 wake_up_all(&mei->get_nvm_wq); 875} 876 877static void iwl_mei_handle_rx_host_own_req(struct mei_cl_device *cldev, 878 const struct iwl_sap_msg_dw *dw) 879{ 880 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 881 882 /* 883 * This means that we can't use the wifi device right now, CSME is not 884 * ready to let us use it. 885 */ 886 if (!dw->val) { 887 dev_info(&cldev->dev, "Ownership req denied\n"); 888 return; 889 } 890 891 mei->got_ownership = true; 892 wake_up_all(&mei->get_ownership_wq); 893 894 iwl_mei_send_sap_msg(cldev, 895 SAP_MSG_NOTIF_HOST_OWNERSHIP_CONFIRMED); 896 897 /* We can now start the connection, unblock rfkill */ 898 if (iwl_mei_cache.ops) 899 iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false, false); 900} 901 902static void iwl_mei_handle_pldr_ack(struct mei_cl_device *cldev, 903 const struct iwl_sap_pldr_ack_data *ack) 904{ 905 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 906 907 mei->pldr_active = le32_to_cpu(ack->status) == SAP_PLDR_STATUS_SUCCESS; 908 wake_up_all(&mei->pldr_wq); 909} 910 911static void iwl_mei_handle_ping(struct mei_cl_device *cldev, 912 const struct iwl_sap_hdr *hdr) 913{ 914 iwl_mei_send_sap_msg(cldev, SAP_MSG_NOTIF_PONG); 915} 916 917static void iwl_mei_handle_sap_msg(struct mei_cl_device *cldev, 918 const struct iwl_sap_hdr *hdr) 919{ 920 u16 len = le16_to_cpu(hdr->len) + sizeof(*hdr); 921 u16 type = le16_to_cpu(hdr->type); 922 923 dev_dbg(&cldev->dev, 924 "Got a new SAP message: type %d, len %d, seq %d\n", 925 le16_to_cpu(hdr->type), len, 926 le32_to_cpu(hdr->seq_num)); 927 928#define SAP_MSG_HANDLER(_cmd, _handler, _sz) \ 929 case SAP_MSG_NOTIF_ ## _cmd: \ 930 if (len < _sz) { \ 931 dev_err(&cldev->dev, \ 932 "Bad size for %d: %u < %u\n", \ 933 le16_to_cpu(hdr->type), \ 934 (unsigned int)len, \ 935 (unsigned int)_sz); \ 936 break; \ 937 } \ 938 mutex_lock(&iwl_mei_mutex); \ 939 _handler(cldev, (const void *)hdr); \ 940 mutex_unlock(&iwl_mei_mutex); \ 941 break 942 943#define SAP_MSG_HANDLER_NO_LOCK(_cmd, _handler, _sz) \ 944 case SAP_MSG_NOTIF_ ## _cmd: \ 945 if (len < _sz) { \ 946 dev_err(&cldev->dev, \ 947 "Bad size for %d: %u < %u\n", \ 948 le16_to_cpu(hdr->type), \ 949 (unsigned int)len, \ 950 (unsigned int)_sz); \ 951 break; \ 952 } \ 953 _handler(cldev, (const void *)hdr); \ 954 break 955 956#define SAP_MSG_HANDLER_NO_HANDLER(_cmd, _sz) \ 957 case SAP_MSG_NOTIF_ ## _cmd: \ 958 if (len < _sz) { \ 959 dev_err(&cldev->dev, \ 960 "Bad size for %d: %u < %u\n", \ 961 le16_to_cpu(hdr->type), \ 962 (unsigned int)len, \ 963 (unsigned int)_sz); \ 964 break; \ 965 } \ 966 break 967 968 switch (type) { 969 SAP_MSG_HANDLER(PING, iwl_mei_handle_ping, 0); 970 SAP_MSG_HANDLER(CSME_FILTERS, 971 iwl_mei_handle_csme_filters, 972 sizeof(struct iwl_sap_csme_filters)); 973 SAP_MSG_HANDLER(CSME_CONN_STATUS, 974 iwl_mei_handle_conn_status, 975 sizeof(struct iwl_sap_notif_conn_status)); 976 SAP_MSG_HANDLER_NO_LOCK(AMT_STATE, 977 iwl_mei_handle_amt_state, 978 sizeof(struct iwl_sap_msg_dw)); 979 SAP_MSG_HANDLER_NO_HANDLER(PONG, 0); 980 SAP_MSG_HANDLER(NVM, iwl_mei_handle_nvm, 981 sizeof(struct iwl_sap_nvm)); 982 SAP_MSG_HANDLER(CSME_REPLY_TO_HOST_OWNERSHIP_REQ, 983 iwl_mei_handle_rx_host_own_req, 984 sizeof(struct iwl_sap_msg_dw)); 985 SAP_MSG_HANDLER(NIC_OWNER, iwl_mei_handle_nic_owner, 986 sizeof(struct iwl_sap_msg_dw)); 987 SAP_MSG_HANDLER(CSME_CAN_RELEASE_OWNERSHIP, 988 iwl_mei_handle_can_release_ownership, 0); 989 SAP_MSG_HANDLER(CSME_TAKING_OWNERSHIP, 990 iwl_mei_handle_csme_taking_ownership, 0); 991 SAP_MSG_HANDLER(PLDR_ACK, iwl_mei_handle_pldr_ack, 992 sizeof(struct iwl_sap_pldr_ack_data)); 993 default: 994 /* 995 * This is not really an error, there are message that we decided 996 * to ignore, yet, it is useful to be able to leave a note if debug 997 * is enabled. 998 */ 999 dev_dbg(&cldev->dev, "Unsupported message: type %d, len %d\n", 1000 le16_to_cpu(hdr->type), len); 1001 } 1002 1003#undef SAP_MSG_HANDLER 1004#undef SAP_MSG_HANDLER_NO_LOCK 1005} 1006 1007static void iwl_mei_read_from_q(const u8 *q_head, u32 q_sz, 1008 u32 *_rd, u32 wr, 1009 void *_buf, u32 len) 1010{ 1011 u8 *buf = _buf; 1012 u32 rd = *_rd; 1013 1014 if (rd + len <= q_sz) { 1015 memcpy(buf, q_head + rd, len); 1016 rd += len; 1017 } else { 1018 memcpy(buf, q_head + rd, q_sz - rd); 1019 memcpy(buf + q_sz - rd, q_head, len - (q_sz - rd)); 1020 rd = len - (q_sz - rd); 1021 } 1022 1023 *_rd = rd; 1024} 1025 1026#define QOS_HDR_IV_SNAP_LEN (sizeof(struct ieee80211_qos_hdr) + \ 1027 IEEE80211_TKIP_IV_LEN + \ 1028 sizeof(rfc1042_header) + ETH_TLEN) 1029 1030static void iwl_mei_handle_sap_data(struct mei_cl_device *cldev, 1031 const u8 *q_head, u32 q_sz, 1032 u32 rd, u32 wr, ssize_t valid_rx_sz, 1033 struct sk_buff_head *tx_skbs) 1034{ 1035 struct iwl_sap_hdr hdr; 1036 struct net_device *netdev = 1037 rcu_dereference_protected(iwl_mei_cache.netdev, 1038 lockdep_is_held(&iwl_mei_mutex)); 1039 1040 if (!netdev) 1041 return; 1042 1043 while (valid_rx_sz >= sizeof(hdr)) { 1044 struct ethhdr *ethhdr; 1045 unsigned char *data; 1046 struct sk_buff *skb; 1047 u16 len; 1048 1049 iwl_mei_read_from_q(q_head, q_sz, &rd, wr, &hdr, sizeof(hdr)); 1050 valid_rx_sz -= sizeof(hdr); 1051 len = le16_to_cpu(hdr.len); 1052 1053 if (valid_rx_sz < len) { 1054 dev_err(&cldev->dev, 1055 "Data queue is corrupted: valid data len %zd, len %d\n", 1056 valid_rx_sz, len); 1057 break; 1058 } 1059 1060 if (len < sizeof(*ethhdr)) { 1061 dev_err(&cldev->dev, 1062 "Data len is smaller than an ethernet header? len = %d\n", 1063 len); 1064 } 1065 1066 valid_rx_sz -= len; 1067 1068 if (le16_to_cpu(hdr.type) != SAP_MSG_DATA_PACKET) { 1069 dev_err(&cldev->dev, "Unsupported Rx data: type %d, len %d\n", 1070 le16_to_cpu(hdr.type), len); 1071 continue; 1072 } 1073 1074 /* We need enough room for the WiFi header + SNAP + IV */ 1075 skb = netdev_alloc_skb(netdev, len + QOS_HDR_IV_SNAP_LEN); 1076 if (!skb) 1077 continue; 1078 1079 skb_reserve(skb, QOS_HDR_IV_SNAP_LEN); 1080 ethhdr = skb_push(skb, sizeof(*ethhdr)); 1081 1082 iwl_mei_read_from_q(q_head, q_sz, &rd, wr, 1083 ethhdr, sizeof(*ethhdr)); 1084 len -= sizeof(*ethhdr); 1085 1086 skb_reset_mac_header(skb); 1087 skb_reset_network_header(skb); 1088 skb->protocol = ethhdr->h_proto; 1089 1090 data = skb_put(skb, len); 1091 iwl_mei_read_from_q(q_head, q_sz, &rd, wr, data, len); 1092 1093 /* 1094 * Enqueue the skb here so that it can be sent later when we 1095 * do not hold the mutex. TX'ing a packet with a mutex held is 1096 * possible, but it wouldn't be nice to forbid the TX path to 1097 * call any of iwlmei's functions, since every API from iwlmei 1098 * needs the mutex. 1099 */ 1100 __skb_queue_tail(tx_skbs, skb); 1101 } 1102} 1103 1104static void iwl_mei_handle_sap_rx_cmd(struct mei_cl_device *cldev, 1105 const u8 *q_head, u32 q_sz, 1106 u32 rd, u32 wr, ssize_t valid_rx_sz) 1107{ 1108 struct page *p = alloc_page(GFP_KERNEL); 1109 struct iwl_sap_hdr *hdr; 1110 1111 if (!p) 1112 return; 1113 1114 hdr = page_address(p); 1115 1116 while (valid_rx_sz >= sizeof(*hdr)) { 1117 u16 len; 1118 1119 iwl_mei_read_from_q(q_head, q_sz, &rd, wr, hdr, sizeof(*hdr)); 1120 valid_rx_sz -= sizeof(*hdr); 1121 len = le16_to_cpu(hdr->len); 1122 1123 if (valid_rx_sz < len) 1124 break; 1125 1126 iwl_mei_read_from_q(q_head, q_sz, &rd, wr, hdr + 1, len); 1127 1128 trace_iwlmei_sap_cmd(hdr, false); 1129 iwl_mei_handle_sap_msg(cldev, hdr); 1130 valid_rx_sz -= len; 1131 } 1132 1133 /* valid_rx_sz must be 0 now... */ 1134 if (valid_rx_sz) 1135 dev_err(&cldev->dev, 1136 "More data in the buffer although we read it all\n"); 1137 1138 __free_page(p); 1139} 1140 1141static void iwl_mei_handle_sap_rx(struct mei_cl_device *cldev, 1142 struct iwl_sap_q_ctrl_blk *notif_q, 1143 const u8 *q_head, 1144 struct sk_buff_head *skbs, 1145 u32 q_sz) 1146{ 1147 u32 rd = le32_to_cpu(READ_ONCE(notif_q->rd_ptr)); 1148 u32 wr = le32_to_cpu(READ_ONCE(notif_q->wr_ptr)); 1149 ssize_t valid_rx_sz; 1150 1151 if (rd > q_sz || wr > q_sz) { 1152 dev_err(&cldev->dev, 1153 "Pointers are past the buffer limit\n"); 1154 return; 1155 } 1156 1157 if (rd == wr) 1158 return; 1159 1160 valid_rx_sz = wr > rd ? wr - rd : q_sz - rd + wr; 1161 1162 if (skbs) 1163 iwl_mei_handle_sap_data(cldev, q_head, q_sz, rd, wr, 1164 valid_rx_sz, skbs); 1165 else 1166 iwl_mei_handle_sap_rx_cmd(cldev, q_head, q_sz, rd, wr, 1167 valid_rx_sz); 1168 1169 /* Increment the read pointer to point to the write pointer */ 1170 WRITE_ONCE(notif_q->rd_ptr, cpu_to_le32(wr)); 1171} 1172 1173static void iwl_mei_handle_check_shared_area(struct mei_cl_device *cldev) 1174{ 1175 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 1176 struct iwl_sap_q_ctrl_blk *notif_q; 1177 struct sk_buff_head tx_skbs; 1178 struct iwl_sap_dir *dir; 1179 void *q_head; 1180 u32 q_sz; 1181 1182 if (!mei->shared_mem.ctrl) 1183 return; 1184 1185 dir = &mei->shared_mem.ctrl->dir[SAP_DIRECTION_ME_TO_HOST]; 1186 notif_q = &dir->q_ctrl_blk[SAP_QUEUE_IDX_NOTIF]; 1187 q_head = mei->shared_mem.q_head[SAP_DIRECTION_ME_TO_HOST][SAP_QUEUE_IDX_NOTIF]; 1188 q_sz = mei->shared_mem.q_size[SAP_DIRECTION_ME_TO_HOST][SAP_QUEUE_IDX_NOTIF]; 1189 1190 /* 1191 * Do not hold the mutex here, but rather each and every message 1192 * handler takes it. 1193 * This allows message handlers to take it at a certain time. 1194 */ 1195 iwl_mei_handle_sap_rx(cldev, notif_q, q_head, NULL, q_sz); 1196 1197 mutex_lock(&iwl_mei_mutex); 1198 dir = &mei->shared_mem.ctrl->dir[SAP_DIRECTION_ME_TO_HOST]; 1199 notif_q = &dir->q_ctrl_blk[SAP_QUEUE_IDX_DATA]; 1200 q_head = mei->shared_mem.q_head[SAP_DIRECTION_ME_TO_HOST][SAP_QUEUE_IDX_DATA]; 1201 q_sz = mei->shared_mem.q_size[SAP_DIRECTION_ME_TO_HOST][SAP_QUEUE_IDX_DATA]; 1202 1203 __skb_queue_head_init(&tx_skbs); 1204 1205 iwl_mei_handle_sap_rx(cldev, notif_q, q_head, &tx_skbs, q_sz); 1206 1207 if (skb_queue_empty(&tx_skbs)) { 1208 mutex_unlock(&iwl_mei_mutex); 1209 return; 1210 } 1211 1212 /* 1213 * Take the RCU read lock before we unlock the mutex to make sure that 1214 * even if the netdev is replaced by another non-NULL netdev right after 1215 * we unlock the mutex, the old netdev will still be valid when we 1216 * transmit the frames. We can't allow to replace the netdev here because 1217 * the skbs hold a pointer to the netdev. 1218 */ 1219 rcu_read_lock(); 1220 1221 mutex_unlock(&iwl_mei_mutex); 1222 1223 if (!rcu_access_pointer(iwl_mei_cache.netdev)) { 1224 dev_err(&cldev->dev, "Can't Tx without a netdev\n"); 1225 skb_queue_purge(&tx_skbs); 1226 goto out; 1227 } 1228 1229 while (!skb_queue_empty(&tx_skbs)) { 1230 struct sk_buff *skb = __skb_dequeue(&tx_skbs); 1231 1232 trace_iwlmei_sap_data(skb, IWL_SAP_RX_DATA_TO_AIR); 1233 dev_queue_xmit(skb); 1234 } 1235 1236out: 1237 rcu_read_unlock(); 1238} 1239 1240static void iwl_mei_rx(struct mei_cl_device *cldev) 1241{ 1242 struct iwl_sap_me_msg_hdr *hdr; 1243 u8 msg[100]; 1244 ssize_t ret; 1245 1246 ret = mei_cldev_recv(cldev, (u8 *)&msg, sizeof(msg)); 1247 if (ret < 0) { 1248 dev_err(&cldev->dev, "failed to receive data: %zd\n", ret); 1249 return; 1250 } 1251 1252 if (ret == 0) { 1253 dev_err(&cldev->dev, "got an empty response\n"); 1254 return; 1255 } 1256 1257 hdr = (void *)msg; 1258 trace_iwlmei_me_msg(hdr, false); 1259 1260 switch (le32_to_cpu(hdr->type)) { 1261 case SAP_ME_MSG_START_OK: 1262 BUILD_BUG_ON(sizeof(struct iwl_sap_me_msg_start_ok) > 1263 sizeof(msg)); 1264 1265 iwl_mei_handle_rx_start_ok(cldev, (void *)msg, ret); 1266 break; 1267 case SAP_ME_MSG_CHECK_SHARED_AREA: 1268 iwl_mei_handle_check_shared_area(cldev); 1269 break; 1270 default: 1271 dev_err(&cldev->dev, "got a RX notification: %d\n", 1272 le32_to_cpu(hdr->type)); 1273 break; 1274 } 1275} 1276 1277static int iwl_mei_send_start(struct mei_cl_device *cldev) 1278{ 1279 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 1280 struct iwl_sap_me_msg_start msg = { 1281 .hdr.type = cpu_to_le32(SAP_ME_MSG_START), 1282 .hdr.seq_num = cpu_to_le32(atomic_inc_return(&mei->seq_no)), 1283 .hdr.len = cpu_to_le32(sizeof(msg)), 1284 .supported_versions[0] = SAP_VERSION, 1285 .init_data_seq_num = cpu_to_le16(0x100), 1286 .init_notif_seq_num = cpu_to_le16(0x800), 1287 }; 1288 int ret; 1289 1290 trace_iwlmei_me_msg(&msg.hdr, true); 1291 ret = mei_cldev_send(cldev, (void *)&msg, sizeof(msg)); 1292 if (ret != sizeof(msg)) { 1293 dev_err(&cldev->dev, 1294 "failed to send the SAP_ME_MSG_START message %d\n", 1295 ret); 1296 return ret; 1297 } 1298 1299 return 0; 1300} 1301 1302static int iwl_mei_enable(struct mei_cl_device *cldev) 1303{ 1304 int ret; 1305 1306 ret = mei_cldev_enable(cldev); 1307 if (ret < 0) { 1308 dev_err(&cldev->dev, "failed to enable the device: %d\n", ret); 1309 return ret; 1310 } 1311 1312 ret = mei_cldev_register_rx_cb(cldev, iwl_mei_rx); 1313 if (ret) { 1314 dev_err(&cldev->dev, 1315 "failed to register to the rx cb: %d\n", ret); 1316 mei_cldev_disable(cldev); 1317 return ret; 1318 } 1319 1320 return 0; 1321} 1322 1323struct iwl_mei_nvm *iwl_mei_get_nvm(void) 1324{ 1325 struct iwl_mei_nvm *nvm = NULL; 1326 struct iwl_mei *mei; 1327 int ret; 1328 1329 mutex_lock(&iwl_mei_mutex); 1330 1331 if (!iwl_mei_is_connected()) 1332 goto out; 1333 1334 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1335 1336 if (!mei) 1337 goto out; 1338 1339 ret = iwl_mei_send_sap_msg(iwl_mei_global_cldev, 1340 SAP_MSG_NOTIF_GET_NVM); 1341 if (ret) 1342 goto out; 1343 1344 mutex_unlock(&iwl_mei_mutex); 1345 1346 ret = wait_event_timeout(mei->get_nvm_wq, mei->nvm, 2 * HZ); 1347 if (!ret) 1348 return NULL; 1349 1350 mutex_lock(&iwl_mei_mutex); 1351 1352 if (!iwl_mei_is_connected()) 1353 goto out; 1354 1355 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1356 1357 if (!mei) 1358 goto out; 1359 1360 if (mei->nvm) 1361 nvm = kmemdup(mei->nvm, sizeof(*mei->nvm), GFP_KERNEL); 1362 1363out: 1364 mutex_unlock(&iwl_mei_mutex); 1365 return nvm; 1366} 1367EXPORT_SYMBOL_GPL(iwl_mei_get_nvm); 1368 1369#define IWL_MEI_PLDR_NUM_RETRIES 3 1370 1371int iwl_mei_pldr_req(void) 1372{ 1373 struct iwl_mei *mei; 1374 int ret; 1375 struct iwl_sap_pldr_data msg = { 1376 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_PLDR), 1377 .hdr.len = cpu_to_le16(sizeof(msg) - sizeof(msg.hdr)), 1378 }; 1379 int i; 1380 1381 mutex_lock(&iwl_mei_mutex); 1382 1383 /* In case we didn't have a bind */ 1384 if (!iwl_mei_is_connected()) { 1385 ret = 0; 1386 goto out; 1387 } 1388 1389 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1390 1391 if (!mei) { 1392 ret = -ENODEV; 1393 goto out; 1394 } 1395 1396 if (!mei->amt_enabled) { 1397 ret = 0; 1398 goto out; 1399 } 1400 1401 for (i = 0; i < IWL_MEI_PLDR_NUM_RETRIES; i++) { 1402 ret = iwl_mei_send_sap_msg_payload(mei->cldev, &msg.hdr); 1403 mutex_unlock(&iwl_mei_mutex); 1404 if (ret) 1405 return ret; 1406 1407 ret = wait_event_timeout(mei->pldr_wq, mei->pldr_active, HZ / 2); 1408 if (ret) 1409 break; 1410 1411 /* Take the mutex for the next iteration */ 1412 mutex_lock(&iwl_mei_mutex); 1413 } 1414 1415 if (ret) 1416 return 0; 1417 1418 ret = -ETIMEDOUT; 1419out: 1420 mutex_unlock(&iwl_mei_mutex); 1421 return ret; 1422} 1423EXPORT_SYMBOL_GPL(iwl_mei_pldr_req); 1424 1425int iwl_mei_get_ownership(void) 1426{ 1427 struct iwl_mei *mei; 1428 int ret; 1429 1430 mutex_lock(&iwl_mei_mutex); 1431 1432 /* In case we didn't have a bind */ 1433 if (!iwl_mei_is_connected()) { 1434 ret = 0; 1435 goto out; 1436 } 1437 1438 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1439 1440 if (!mei) { 1441 ret = -ENODEV; 1442 goto out; 1443 } 1444 1445 if (!mei->amt_enabled) { 1446 ret = 0; 1447 goto out; 1448 } 1449 1450 if (mei->got_ownership) { 1451 ret = 0; 1452 goto out; 1453 } 1454 1455 ret = iwl_mei_send_sap_msg(mei->cldev, 1456 SAP_MSG_NOTIF_HOST_ASKS_FOR_NIC_OWNERSHIP); 1457 if (ret) 1458 goto out; 1459 1460 mutex_unlock(&iwl_mei_mutex); 1461 1462 ret = wait_event_timeout(mei->get_ownership_wq, 1463 mei->got_ownership, HZ / 2); 1464 if (!ret) { 1465 schedule_delayed_work(&mei->ownership_dwork, 1466 MEI_OWNERSHIP_RETAKE_TIMEOUT_MS); 1467 return -ETIMEDOUT; 1468 } 1469 1470 return 0; 1471out: 1472 mutex_unlock(&iwl_mei_mutex); 1473 return ret; 1474} 1475EXPORT_SYMBOL_GPL(iwl_mei_get_ownership); 1476 1477void iwl_mei_alive_notif(bool success) 1478{ 1479 struct iwl_mei *mei; 1480 struct iwl_sap_pldr_end_data msg = { 1481 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_PLDR_END), 1482 .hdr.len = cpu_to_le16(sizeof(msg) - sizeof(msg.hdr)), 1483 .status = success ? cpu_to_le32(SAP_PLDR_STATUS_SUCCESS) : 1484 cpu_to_le32(SAP_PLDR_STATUS_FAILURE), 1485 }; 1486 1487 mutex_lock(&iwl_mei_mutex); 1488 1489 if (!iwl_mei_is_connected()) 1490 goto out; 1491 1492 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1493 if (!mei || !mei->pldr_active) 1494 goto out; 1495 1496 mei->pldr_active = false; 1497 1498 iwl_mei_send_sap_msg_payload(mei->cldev, &msg.hdr); 1499out: 1500 mutex_unlock(&iwl_mei_mutex); 1501} 1502EXPORT_SYMBOL_GPL(iwl_mei_alive_notif); 1503 1504void iwl_mei_host_associated(const struct iwl_mei_conn_info *conn_info, 1505 const struct iwl_mei_colloc_info *colloc_info) 1506{ 1507 struct iwl_sap_notif_host_link_up msg = { 1508 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_HOST_LINK_UP), 1509 .hdr.len = cpu_to_le16(sizeof(msg) - sizeof(msg.hdr)), 1510 .conn_info = { 1511 .ssid_len = cpu_to_le32(conn_info->ssid_len), 1512 .channel = conn_info->channel, 1513 .band = conn_info->band, 1514 .pairwise_cipher = cpu_to_le32(conn_info->pairwise_cipher), 1515 .auth_mode = cpu_to_le32(conn_info->auth_mode), 1516 }, 1517 }; 1518 struct iwl_mei *mei; 1519 1520 if (conn_info->ssid_len > ARRAY_SIZE(msg.conn_info.ssid)) 1521 return; 1522 1523 memcpy(msg.conn_info.ssid, conn_info->ssid, conn_info->ssid_len); 1524 memcpy(msg.conn_info.bssid, conn_info->bssid, ETH_ALEN); 1525 1526 if (colloc_info) { 1527 msg.colloc_channel = colloc_info->channel; 1528 msg.colloc_band = colloc_info->channel <= 14 ? 0 : 1; 1529 memcpy(msg.colloc_bssid, colloc_info->bssid, ETH_ALEN); 1530 } 1531 1532 mutex_lock(&iwl_mei_mutex); 1533 1534 if (!iwl_mei_is_connected()) 1535 goto out; 1536 1537 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1538 1539 if (!mei || !mei->amt_enabled) 1540 goto out; 1541 1542 iwl_mei_send_sap_msg_payload(mei->cldev, &msg.hdr); 1543 1544out: 1545 kfree(iwl_mei_cache.conn_info); 1546 iwl_mei_cache.conn_info = 1547 kmemdup(&msg.conn_info, sizeof(msg.conn_info), GFP_KERNEL); 1548 mutex_unlock(&iwl_mei_mutex); 1549} 1550EXPORT_SYMBOL_GPL(iwl_mei_host_associated); 1551 1552void iwl_mei_host_disassociated(void) 1553{ 1554 struct iwl_mei *mei; 1555 struct iwl_sap_notif_host_link_down msg = { 1556 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_HOST_LINK_DOWN), 1557 .hdr.len = cpu_to_le16(sizeof(msg) - sizeof(msg.hdr)), 1558 .type = HOST_LINK_DOWN_TYPE_TEMPORARY, 1559 }; 1560 1561 mutex_lock(&iwl_mei_mutex); 1562 1563 if (!iwl_mei_is_connected()) 1564 goto out; 1565 1566 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1567 1568 if (!mei || !mei->amt_enabled) 1569 goto out; 1570 1571 iwl_mei_send_sap_msg_payload(mei->cldev, &msg.hdr); 1572 1573out: 1574 kfree(iwl_mei_cache.conn_info); 1575 iwl_mei_cache.conn_info = NULL; 1576 mutex_unlock(&iwl_mei_mutex); 1577} 1578EXPORT_SYMBOL_GPL(iwl_mei_host_disassociated); 1579 1580void iwl_mei_set_rfkill_state(bool hw_rfkill, bool sw_rfkill) 1581{ 1582 struct iwl_mei *mei; 1583 u32 rfkill_state = 0; 1584 struct iwl_sap_msg_dw msg = { 1585 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_RADIO_STATE), 1586 .hdr.len = cpu_to_le16(sizeof(msg) - sizeof(msg.hdr)), 1587 }; 1588 1589 if (!sw_rfkill) 1590 rfkill_state |= SAP_SW_RFKILL_DEASSERTED; 1591 1592 if (!hw_rfkill) 1593 rfkill_state |= SAP_HW_RFKILL_DEASSERTED; 1594 1595 mutex_lock(&iwl_mei_mutex); 1596 1597 if (!iwl_mei_is_connected()) 1598 goto out; 1599 1600 msg.val = cpu_to_le32(rfkill_state); 1601 1602 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1603 1604 if (!mei || !mei->amt_enabled) 1605 goto out; 1606 1607 iwl_mei_send_sap_msg_payload(mei->cldev, &msg.hdr); 1608 1609out: 1610 iwl_mei_cache.rf_kill = rfkill_state; 1611 mutex_unlock(&iwl_mei_mutex); 1612} 1613EXPORT_SYMBOL_GPL(iwl_mei_set_rfkill_state); 1614 1615void iwl_mei_set_nic_info(const u8 *mac_address, const u8 *nvm_address) 1616{ 1617 struct iwl_mei *mei; 1618 struct iwl_sap_notif_host_nic_info msg = { 1619 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_NIC_INFO), 1620 .hdr.len = cpu_to_le16(sizeof(msg) - sizeof(msg.hdr)), 1621 }; 1622 1623 mutex_lock(&iwl_mei_mutex); 1624 1625 if (!iwl_mei_is_connected()) 1626 goto out; 1627 1628 ether_addr_copy(msg.mac_address, mac_address); 1629 ether_addr_copy(msg.nvm_address, nvm_address); 1630 1631 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1632 1633 if (!mei || !mei->amt_enabled) 1634 goto out; 1635 1636 iwl_mei_send_sap_msg_payload(mei->cldev, &msg.hdr); 1637 1638out: 1639 ether_addr_copy(iwl_mei_cache.mac_address, mac_address); 1640 ether_addr_copy(iwl_mei_cache.nvm_address, nvm_address); 1641 mutex_unlock(&iwl_mei_mutex); 1642} 1643EXPORT_SYMBOL_GPL(iwl_mei_set_nic_info); 1644 1645void iwl_mei_set_country_code(u16 mcc) 1646{ 1647 struct iwl_mei *mei; 1648 struct iwl_sap_notif_country_code msg = { 1649 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_COUNTRY_CODE), 1650 .hdr.len = cpu_to_le16(sizeof(msg) - sizeof(msg.hdr)), 1651 .mcc = cpu_to_le16(mcc), 1652 }; 1653 1654 mutex_lock(&iwl_mei_mutex); 1655 1656 if (!iwl_mei_is_connected()) 1657 goto out; 1658 1659 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1660 1661 if (!mei || !mei->amt_enabled) 1662 goto out; 1663 1664 iwl_mei_send_sap_msg_payload(mei->cldev, &msg.hdr); 1665 1666out: 1667 iwl_mei_cache.mcc = mcc; 1668 mutex_unlock(&iwl_mei_mutex); 1669} 1670EXPORT_SYMBOL_GPL(iwl_mei_set_country_code); 1671 1672void iwl_mei_set_power_limit(const __le16 *power_limit) 1673{ 1674 struct iwl_mei *mei; 1675 struct iwl_sap_notif_sar_limits msg = { 1676 .hdr.type = cpu_to_le16(SAP_MSG_NOTIF_SAR_LIMITS), 1677 .hdr.len = cpu_to_le16(sizeof(msg) - sizeof(msg.hdr)), 1678 }; 1679 1680 mutex_lock(&iwl_mei_mutex); 1681 1682 if (!iwl_mei_is_connected()) 1683 goto out; 1684 1685 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1686 1687 if (!mei || !mei->amt_enabled) 1688 goto out; 1689 1690 memcpy(msg.sar_chain_info_table, power_limit, sizeof(msg.sar_chain_info_table)); 1691 1692 iwl_mei_send_sap_msg_payload(mei->cldev, &msg.hdr); 1693 1694out: 1695 kfree(iwl_mei_cache.power_limit); 1696 iwl_mei_cache.power_limit = kmemdup(power_limit, 1697 sizeof(msg.sar_chain_info_table), GFP_KERNEL); 1698 mutex_unlock(&iwl_mei_mutex); 1699} 1700EXPORT_SYMBOL_GPL(iwl_mei_set_power_limit); 1701 1702void iwl_mei_set_netdev(struct net_device *netdev) 1703{ 1704 struct iwl_mei *mei; 1705 1706 mutex_lock(&iwl_mei_mutex); 1707 1708 if (!iwl_mei_is_connected()) { 1709 rcu_assign_pointer(iwl_mei_cache.netdev, netdev); 1710 goto out; 1711 } 1712 1713 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1714 1715 if (!mei) 1716 goto out; 1717 1718 if (!netdev) { 1719 struct net_device *dev = 1720 rcu_dereference_protected(iwl_mei_cache.netdev, 1721 lockdep_is_held(&iwl_mei_mutex)); 1722 1723 if (!dev) 1724 goto out; 1725 1726 netdev_rx_handler_unregister(dev); 1727 } 1728 1729 rcu_assign_pointer(iwl_mei_cache.netdev, netdev); 1730 1731 if (netdev && mei->amt_enabled) 1732 netdev_rx_handler_register(netdev, iwl_mei_rx_handler, mei); 1733 1734out: 1735 mutex_unlock(&iwl_mei_mutex); 1736} 1737EXPORT_SYMBOL_GPL(iwl_mei_set_netdev); 1738 1739void iwl_mei_device_state(bool up) 1740{ 1741 struct iwl_mei *mei; 1742 1743 mutex_lock(&iwl_mei_mutex); 1744 1745 if (!iwl_mei_is_connected()) 1746 goto out; 1747 1748 mei = mei_cldev_get_drvdata(iwl_mei_global_cldev); 1749 1750 if (!mei) 1751 goto out; 1752 1753 mei->device_down = !up; 1754 1755 if (up || !mei->csme_taking_ownership) 1756 goto out; 1757 1758 iwl_mei_send_sap_msg(mei->cldev, 1759 SAP_MSG_NOTIF_CSME_OWNERSHIP_CONFIRMED); 1760 mei->csme_taking_ownership = false; 1761 schedule_delayed_work(&mei->ownership_dwork, 1762 MEI_OWNERSHIP_RETAKE_TIMEOUT_MS); 1763out: 1764 mutex_unlock(&iwl_mei_mutex); 1765} 1766EXPORT_SYMBOL_GPL(iwl_mei_device_state); 1767 1768int iwl_mei_register(void *priv, const struct iwl_mei_ops *ops) 1769{ 1770 int ret; 1771 1772 /* 1773 * We must have a non-NULL priv pointer to not crash when there are 1774 * multiple WiFi devices. 1775 */ 1776 if (!priv) 1777 return -EINVAL; 1778 1779 mutex_lock(&iwl_mei_mutex); 1780 1781 /* do not allow registration if someone else already registered */ 1782 if (iwl_mei_cache.priv || iwl_mei_cache.ops) { 1783 ret = -EBUSY; 1784 goto out; 1785 } 1786 1787 iwl_mei_cache.priv = priv; 1788 iwl_mei_cache.ops = ops; 1789 1790 if (iwl_mei_global_cldev) { 1791 struct iwl_mei *mei = 1792 mei_cldev_get_drvdata(iwl_mei_global_cldev); 1793 1794 /* we have already a SAP connection */ 1795 if (iwl_mei_is_connected()) { 1796 if (mei->amt_enabled) 1797 iwl_mei_send_sap_msg(mei->cldev, 1798 SAP_MSG_NOTIF_WIFIDR_UP); 1799 ops->rfkill(priv, mei->link_prot_state, false); 1800 } 1801 } 1802 ret = 0; 1803 1804out: 1805 mutex_unlock(&iwl_mei_mutex); 1806 return ret; 1807} 1808EXPORT_SYMBOL_GPL(iwl_mei_register); 1809 1810void iwl_mei_start_unregister(void) 1811{ 1812 mutex_lock(&iwl_mei_mutex); 1813 1814 /* At this point, the wifi driver should have removed the netdev */ 1815 if (rcu_access_pointer(iwl_mei_cache.netdev)) 1816 pr_err("Still had a netdev pointer set upon unregister\n"); 1817 1818 kfree(iwl_mei_cache.conn_info); 1819 iwl_mei_cache.conn_info = NULL; 1820 kfree(iwl_mei_cache.power_limit); 1821 iwl_mei_cache.power_limit = NULL; 1822 iwl_mei_cache.ops = NULL; 1823 /* leave iwl_mei_cache.priv non-NULL to prevent any new registration */ 1824 1825 mutex_unlock(&iwl_mei_mutex); 1826} 1827EXPORT_SYMBOL_GPL(iwl_mei_start_unregister); 1828 1829void iwl_mei_unregister_complete(void) 1830{ 1831 mutex_lock(&iwl_mei_mutex); 1832 1833 iwl_mei_cache.priv = NULL; 1834 1835 if (iwl_mei_global_cldev) { 1836 struct iwl_mei *mei = 1837 mei_cldev_get_drvdata(iwl_mei_global_cldev); 1838 1839 if (mei->amt_enabled) 1840 iwl_mei_send_sap_msg(mei->cldev, 1841 SAP_MSG_NOTIF_WIFIDR_DOWN); 1842 mei->got_ownership = false; 1843 } 1844 1845 mutex_unlock(&iwl_mei_mutex); 1846} 1847EXPORT_SYMBOL_GPL(iwl_mei_unregister_complete); 1848 1849#if IS_ENABLED(CONFIG_DEBUG_FS) 1850 1851static ssize_t 1852iwl_mei_dbgfs_send_start_message_write(struct file *file, 1853 const char __user *user_buf, 1854 size_t count, loff_t *ppos) 1855{ 1856 int ret; 1857 1858 mutex_lock(&iwl_mei_mutex); 1859 1860 if (!iwl_mei_global_cldev) { 1861 ret = -ENODEV; 1862 goto out; 1863 } 1864 1865 ret = iwl_mei_send_start(iwl_mei_global_cldev); 1866 1867out: 1868 mutex_unlock(&iwl_mei_mutex); 1869 return ret ?: count; 1870} 1871 1872static const struct file_operations iwl_mei_dbgfs_send_start_message_ops = { 1873 .write = iwl_mei_dbgfs_send_start_message_write, 1874 .open = simple_open, 1875 .llseek = default_llseek, 1876}; 1877 1878static ssize_t iwl_mei_dbgfs_req_ownership_write(struct file *file, 1879 const char __user *user_buf, 1880 size_t count, loff_t *ppos) 1881{ 1882 iwl_mei_get_ownership(); 1883 1884 return count; 1885} 1886 1887static const struct file_operations iwl_mei_dbgfs_req_ownership_ops = { 1888 .write = iwl_mei_dbgfs_req_ownership_write, 1889 .open = simple_open, 1890 .llseek = default_llseek, 1891}; 1892 1893static void iwl_mei_dbgfs_register(struct iwl_mei *mei) 1894{ 1895 mei->dbgfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL); 1896 1897 if (!mei->dbgfs_dir) 1898 return; 1899 1900 debugfs_create_ulong("status", S_IRUSR, 1901 mei->dbgfs_dir, &iwl_mei_status); 1902 debugfs_create_file("send_start_message", S_IWUSR, mei->dbgfs_dir, 1903 mei, &iwl_mei_dbgfs_send_start_message_ops); 1904 debugfs_create_file("req_ownership", S_IWUSR, mei->dbgfs_dir, 1905 mei, &iwl_mei_dbgfs_req_ownership_ops); 1906} 1907 1908static void iwl_mei_dbgfs_unregister(struct iwl_mei *mei) 1909{ 1910 debugfs_remove_recursive(mei->dbgfs_dir); 1911 mei->dbgfs_dir = NULL; 1912} 1913 1914#else 1915 1916static void iwl_mei_dbgfs_register(struct iwl_mei *mei) {} 1917static void iwl_mei_dbgfs_unregister(struct iwl_mei *mei) {} 1918 1919#endif /* CONFIG_DEBUG_FS */ 1920 1921static void iwl_mei_ownership_dwork(struct work_struct *wk) 1922{ 1923 iwl_mei_get_ownership(); 1924} 1925 1926#define ALLOC_SHARED_MEM_RETRY_MAX_NUM 3 1927 1928/* 1929 * iwl_mei_probe - the probe function called by the mei bus enumeration 1930 * 1931 * This allocates the data needed by iwlmei and sets a pointer to this data 1932 * into the mei_cl_device's drvdata. 1933 * It starts the SAP protocol by sending the SAP_ME_MSG_START without 1934 * waiting for the answer. The answer will be caught later by the Rx callback. 1935 */ 1936static int iwl_mei_probe(struct mei_cl_device *cldev, 1937 const struct mei_cl_device_id *id) 1938{ 1939 int alloc_retry = ALLOC_SHARED_MEM_RETRY_MAX_NUM; 1940 struct iwl_mei *mei; 1941 int ret; 1942 1943 mei = devm_kzalloc(&cldev->dev, sizeof(*mei), GFP_KERNEL); 1944 if (!mei) 1945 return -ENOMEM; 1946 1947 init_waitqueue_head(&mei->get_nvm_wq); 1948 INIT_WORK(&mei->send_csa_msg_wk, iwl_mei_send_csa_msg_wk); 1949 INIT_DELAYED_WORK(&mei->csa_throttle_end_wk, 1950 iwl_mei_csa_throttle_end_wk); 1951 init_waitqueue_head(&mei->get_ownership_wq); 1952 init_waitqueue_head(&mei->pldr_wq); 1953 spin_lock_init(&mei->data_q_lock); 1954 INIT_WORK(&mei->netdev_work, iwl_mei_netdev_work); 1955 INIT_DELAYED_WORK(&mei->ownership_dwork, iwl_mei_ownership_dwork); 1956 1957 mei_cldev_set_drvdata(cldev, mei); 1958 mei->cldev = cldev; 1959 mei->device_down = true; 1960 1961 do { 1962 ret = iwl_mei_alloc_shared_mem(cldev); 1963 if (!ret) 1964 break; 1965 /* 1966 * The CSME firmware needs to boot the internal WLAN client. 1967 * This can take time in certain configurations (usually 1968 * upon resume and when the whole CSME firmware is shut down 1969 * during suspend). 1970 * 1971 * Wait a bit before retrying and hope we'll succeed next time. 1972 */ 1973 1974 dev_dbg(&cldev->dev, 1975 "Couldn't allocate the shared memory: %d, attempt %d / %d\n", 1976 ret, alloc_retry, ALLOC_SHARED_MEM_RETRY_MAX_NUM); 1977 msleep(100); 1978 alloc_retry--; 1979 } while (alloc_retry); 1980 1981 if (ret) { 1982 dev_err(&cldev->dev, "Couldn't allocate the shared memory: %d\n", 1983 ret); 1984 goto free; 1985 } 1986 1987 iwl_mei_init_shared_mem(mei); 1988 1989 ret = iwl_mei_enable(cldev); 1990 if (ret) 1991 goto free_shared_mem; 1992 1993 iwl_mei_dbgfs_register(mei); 1994 1995 /* 1996 * We now have a Rx function in place, start the SAP protocol 1997 * we expect to get the SAP_ME_MSG_START_OK response later on. 1998 */ 1999 mutex_lock(&iwl_mei_mutex); 2000 ret = iwl_mei_send_start(cldev); 2001 mutex_unlock(&iwl_mei_mutex); 2002 if (ret) 2003 goto debugfs_unregister; 2004 2005 /* must be last */ 2006 iwl_mei_global_cldev = cldev; 2007 2008 return 0; 2009 2010debugfs_unregister: 2011 iwl_mei_dbgfs_unregister(mei); 2012 mei_cldev_disable(cldev); 2013free_shared_mem: 2014 iwl_mei_free_shared_mem(cldev); 2015free: 2016 mei_cldev_set_drvdata(cldev, NULL); 2017 devm_kfree(&cldev->dev, mei); 2018 2019 return ret; 2020} 2021 2022#define SEND_SAP_MAX_WAIT_ITERATION 10 2023#define IWLMEI_DEVICE_DOWN_WAIT_ITERATION 50 2024 2025static void iwl_mei_remove(struct mei_cl_device *cldev) 2026{ 2027 struct iwl_mei *mei = mei_cldev_get_drvdata(cldev); 2028 int i; 2029 2030 /* 2031 * We are being removed while the bus is active, it means we are 2032 * going to suspend/ shutdown, so the NIC will disappear. 2033 */ 2034 if (mei_cldev_enabled(cldev) && iwl_mei_cache.ops) { 2035 unsigned int iter = IWLMEI_DEVICE_DOWN_WAIT_ITERATION; 2036 bool down = false; 2037 2038 /* 2039 * In case of suspend, wait for the mac to stop and don't remove 2040 * the interface. This will allow the interface to come back 2041 * on resume. 2042 */ 2043 while (!down && iter--) { 2044 mdelay(1); 2045 2046 mutex_lock(&iwl_mei_mutex); 2047 down = mei->device_down; 2048 mutex_unlock(&iwl_mei_mutex); 2049 } 2050 2051 if (!down) 2052 iwl_mei_cache.ops->nic_stolen(iwl_mei_cache.priv); 2053 } 2054 2055 if (rcu_access_pointer(iwl_mei_cache.netdev)) { 2056 struct net_device *dev; 2057 2058 /* 2059 * First take rtnl and only then the mutex to avoid an ABBA 2060 * with iwl_mei_set_netdev() 2061 */ 2062 rtnl_lock(); 2063 mutex_lock(&iwl_mei_mutex); 2064 2065 /* 2066 * If we are suspending and the wifi driver hasn't removed it's netdev 2067 * yet, do it now. In any case, don't change the cache.netdev pointer. 2068 */ 2069 dev = rcu_dereference_protected(iwl_mei_cache.netdev, 2070 lockdep_is_held(&iwl_mei_mutex)); 2071 2072 netdev_rx_handler_unregister(dev); 2073 mutex_unlock(&iwl_mei_mutex); 2074 rtnl_unlock(); 2075 } 2076 2077 mutex_lock(&iwl_mei_mutex); 2078 2079 /* Tell CSME that we are going down so that it won't access the 2080 * memory anymore, make sure this message goes through immediately. 2081 */ 2082 mei->csa_throttled = false; 2083 iwl_mei_send_sap_msg(mei->cldev, 2084 SAP_MSG_NOTIF_HOST_GOES_DOWN); 2085 2086 for (i = 0; i < SEND_SAP_MAX_WAIT_ITERATION; i++) { 2087 if (!iwl_mei_host_to_me_data_pending(mei)) 2088 break; 2089 2090 msleep(20); 2091 } 2092 2093 /* If we couldn't make sure that CSME saw the HOST_GOES_DOWN 2094 * message, it means that it will probably keep reading memory 2095 * that we are going to unmap and free, expect IOMMU error 2096 * messages. 2097 */ 2098 if (i == SEND_SAP_MAX_WAIT_ITERATION) 2099 dev_err(&mei->cldev->dev, 2100 "Couldn't get ACK from CSME on HOST_GOES_DOWN message\n"); 2101 2102 mutex_unlock(&iwl_mei_mutex); 2103 2104 /* 2105 * This looks strange, but this lock is taken here to make sure that 2106 * iwl_mei_add_data_to_ring called from the Tx path sees that we 2107 * clear the IWL_MEI_STATUS_SAP_CONNECTED bit. 2108 * Rx isn't a problem because the rx_handler can't be called after 2109 * having been unregistered. 2110 */ 2111 spin_lock_bh(&mei->data_q_lock); 2112 clear_bit(IWL_MEI_STATUS_SAP_CONNECTED, &iwl_mei_status); 2113 spin_unlock_bh(&mei->data_q_lock); 2114 2115 if (iwl_mei_cache.ops) 2116 iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false, false); 2117 2118 /* 2119 * mei_cldev_disable will return only after all the MEI Rx is done. 2120 * It must be called when iwl_mei_mutex is *not* held, since it waits 2121 * for our Rx handler to complete. 2122 * After it returns, no new Rx will start. 2123 */ 2124 mei_cldev_disable(cldev); 2125 2126 /* 2127 * Since the netdev was already removed and the netdev's removal 2128 * includes a call to synchronize_net() so that we know there won't be 2129 * any new Rx that will trigger the following workers. 2130 */ 2131 cancel_work_sync(&mei->send_csa_msg_wk); 2132 cancel_delayed_work_sync(&mei->csa_throttle_end_wk); 2133 cancel_work_sync(&mei->netdev_work); 2134 cancel_delayed_work_sync(&mei->ownership_dwork); 2135 2136 /* 2137 * If someone waits for the ownership, let him know that we are going 2138 * down and that we are not connected anymore. He'll be able to take 2139 * the device. 2140 */ 2141 wake_up_all(&mei->get_ownership_wq); 2142 wake_up_all(&mei->pldr_wq); 2143 2144 mutex_lock(&iwl_mei_mutex); 2145 2146 iwl_mei_global_cldev = NULL; 2147 2148 wake_up_all(&mei->get_nvm_wq); 2149 2150 iwl_mei_free_shared_mem(cldev); 2151 2152 iwl_mei_dbgfs_unregister(mei); 2153 2154 mei_cldev_set_drvdata(cldev, NULL); 2155 2156 kfree(mei->nvm); 2157 2158 kfree(rcu_access_pointer(mei->filters)); 2159 2160 devm_kfree(&cldev->dev, mei); 2161 2162 mutex_unlock(&iwl_mei_mutex); 2163} 2164 2165static const struct mei_cl_device_id iwl_mei_tbl[] = { 2166 { 2167 .name = KBUILD_MODNAME, 2168 .uuid = MEI_WLAN_UUID, 2169 .version = MEI_CL_VERSION_ANY, 2170 }, 2171 2172 /* required last entry */ 2173 { } 2174}; 2175 2176/* 2177 * Do not export the device table because this module is loaded by 2178 * iwlwifi's dependency. 2179 */ 2180 2181static struct mei_cl_driver iwl_mei_cl_driver = { 2182 .id_table = iwl_mei_tbl, 2183 .name = KBUILD_MODNAME, 2184 .probe = iwl_mei_probe, 2185 .remove = iwl_mei_remove, 2186}; 2187 2188module_mei_cl_driver(iwl_mei_cl_driver); 2189