1 /******************************************************************************
2  *
3  * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
4  *
5  * Portions of this file are derived from the ipw3945 project, as well
6  * as portions of the ieee80211 subsystem header files.
7  *
8  * This program is free software; you can redistribute it and/or modify it
9  * under the terms of version 2 of the GNU General Public License as
10  * published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful, but WITHOUT
13  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
14  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
15  * more details.
16  *
17  * You should have received a copy of the GNU General Public License along with
18  * this program; if not, write to the Free Software Foundation, Inc.,
19  * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
20  *
21  * The full GNU General Public License is included in this distribution in the
22  * file called LICENSE.
23  *
24  * Contact Information:
25  *  Intel Linux Wireless <ilw@linux.intel.com>
26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
27  *
28  *****************************************************************************/
29 
30 #include <linux/etherdevice.h>
31 #include <linux/sched.h>
32 #include <linux/slab.h>
33 #include <net/mac80211.h>
34 #include "iwl-eeprom.h"
35 #include "iwl-dev.h"
36 #include "iwl-core.h"
37 #include "iwl-sta.h"
38 #include "iwl-io.h"
39 #include "iwl-helpers.h"
40 
41 /**
42  * iwl_txq_update_write_ptr - Send new write index to hardware
43  */
iwl_txq_update_write_ptr(struct iwl_priv * priv,struct iwl_tx_queue * txq)44 void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
45 {
46 	u32 reg = 0;
47 	int txq_id = txq->q.id;
48 
49 	if (txq->need_update == 0)
50 		return;
51 
52 	if (priv->cfg->base_params->shadow_reg_enable) {
53 		/* shadow register enabled */
54 		iwl_write32(priv, HBUS_TARG_WRPTR,
55 			    txq->q.write_ptr | (txq_id << 8));
56 	} else {
57 		/* if we're trying to save power */
58 		if (test_bit(STATUS_POWER_PMI, &priv->status)) {
59 			/* wake up nic if it's powered down ...
60 			 * uCode will wake up, and interrupt us again, so next
61 			 * time we'll skip this part. */
62 			reg = iwl_read32(priv, CSR_UCODE_DRV_GP1);
63 
64 			if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
65 				IWL_DEBUG_INFO(priv,
66 					"Tx queue %d requesting wakeup,"
67 					" GP1 = 0x%x\n", txq_id, reg);
68 				iwl_set_bit(priv, CSR_GP_CNTRL,
69 					CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
70 				return;
71 			}
72 
73 			iwl_write_direct32(priv, HBUS_TARG_WRPTR,
74 				     txq->q.write_ptr | (txq_id << 8));
75 
76 		/*
77 		 * else not in power-save mode,
78 		 * uCode will never sleep when we're
79 		 * trying to tx (during RFKILL, we're not trying to tx).
80 		 */
81 		} else
82 			iwl_write32(priv, HBUS_TARG_WRPTR,
83 				    txq->q.write_ptr | (txq_id << 8));
84 	}
85 	txq->need_update = 0;
86 }
87 
88 /**
89  * iwl_tx_queue_unmap -  Unmap any remaining DMA mappings and free skb's
90  */
iwl_tx_queue_unmap(struct iwl_priv * priv,int txq_id)91 void iwl_tx_queue_unmap(struct iwl_priv *priv, int txq_id)
92 {
93 	struct iwl_tx_queue *txq = &priv->txq[txq_id];
94 	struct iwl_queue *q = &txq->q;
95 
96 	if (q->n_bd == 0)
97 		return;
98 
99 	 while (q->write_ptr != q->read_ptr) {
100 		priv->cfg->ops->lib->txq_free_tfd(priv, txq);
101 		q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
102 	}
103 }
104 
105 /**
106  * iwl_tx_queue_free - Deallocate DMA queue.
107  * @txq: Transmit queue to deallocate.
108  *
109  * Empty queue by removing and destroying all BD's.
110  * Free all buffers.
111  * 0-fill, but do not free "txq" descriptor structure.
112  */
iwl_tx_queue_free(struct iwl_priv * priv,int txq_id)113 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
114 {
115 	struct iwl_tx_queue *txq = &priv->txq[txq_id];
116 	struct device *dev = &priv->pci_dev->dev;
117 	int i;
118 
119 	iwl_tx_queue_unmap(priv, txq_id);
120 
121 	/* De-alloc array of command/tx buffers */
122 	for (i = 0; i < TFD_TX_CMD_SLOTS; i++)
123 		kfree(txq->cmd[i]);
124 
125 	/* De-alloc circular buffer of TFDs */
126 	if (txq->q.n_bd)
127 		dma_free_coherent(dev, priv->hw_params.tfd_size *
128 				  txq->q.n_bd, txq->tfds, txq->q.dma_addr);
129 
130 	/* De-alloc array of per-TFD driver data */
131 	kfree(txq->txb);
132 	txq->txb = NULL;
133 
134 	/* deallocate arrays */
135 	kfree(txq->cmd);
136 	kfree(txq->meta);
137 	txq->cmd = NULL;
138 	txq->meta = NULL;
139 
140 	/* 0-fill queue descriptor structure */
141 	memset(txq, 0, sizeof(*txq));
142 }
143 
144 /**
145  * iwl_cmd_queue_unmap - Unmap any remaining DMA mappings from command queue
146  */
iwl_cmd_queue_unmap(struct iwl_priv * priv)147 void iwl_cmd_queue_unmap(struct iwl_priv *priv)
148 {
149 	struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
150 	struct iwl_queue *q = &txq->q;
151 	int i;
152 	bool huge = false;
153 
154 	if (q->n_bd == 0)
155 		return;
156 
157 	while (q->read_ptr != q->write_ptr) {
158 		/* we have no way to tell if it is a huge cmd ATM */
159 		i = get_cmd_index(q, q->read_ptr, 0);
160 
161 		if (txq->meta[i].flags & CMD_SIZE_HUGE)
162 			huge = true;
163 		else
164 			pci_unmap_single(priv->pci_dev,
165 					 dma_unmap_addr(&txq->meta[i], mapping),
166 					 dma_unmap_len(&txq->meta[i], len),
167 					 PCI_DMA_BIDIRECTIONAL);
168 
169 	     q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
170 	}
171 
172 	if (huge) {
173 		i = q->n_window;
174 		pci_unmap_single(priv->pci_dev,
175 				 dma_unmap_addr(&txq->meta[i], mapping),
176 				 dma_unmap_len(&txq->meta[i], len),
177 				 PCI_DMA_BIDIRECTIONAL);
178 	}
179 }
180 
181 /**
182  * iwl_cmd_queue_free - Deallocate DMA queue.
183  * @txq: Transmit queue to deallocate.
184  *
185  * Empty queue by removing and destroying all BD's.
186  * Free all buffers.
187  * 0-fill, but do not free "txq" descriptor structure.
188  */
iwl_cmd_queue_free(struct iwl_priv * priv)189 void iwl_cmd_queue_free(struct iwl_priv *priv)
190 {
191 	struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
192 	struct device *dev = &priv->pci_dev->dev;
193 	int i;
194 
195 	iwl_cmd_queue_unmap(priv);
196 
197 	/* De-alloc array of command/tx buffers */
198 	for (i = 0; i <= TFD_CMD_SLOTS; i++)
199 		kfree(txq->cmd[i]);
200 
201 	/* De-alloc circular buffer of TFDs */
202 	if (txq->q.n_bd)
203 		dma_free_coherent(dev, priv->hw_params.tfd_size * txq->q.n_bd,
204 				  txq->tfds, txq->q.dma_addr);
205 
206 	/* deallocate arrays */
207 	kfree(txq->cmd);
208 	kfree(txq->meta);
209 	txq->cmd = NULL;
210 	txq->meta = NULL;
211 
212 	/* 0-fill queue descriptor structure */
213 	memset(txq, 0, sizeof(*txq));
214 }
215 
216 /*************** DMA-QUEUE-GENERAL-FUNCTIONS  *****
217  * DMA services
218  *
219  * Theory of operation
220  *
221  * A Tx or Rx queue resides in host DRAM, and is comprised of a circular buffer
222  * of buffer descriptors, each of which points to one or more data buffers for
223  * the device to read from or fill.  Driver and device exchange status of each
224  * queue via "read" and "write" pointers.  Driver keeps minimum of 2 empty
225  * entries in each circular buffer, to protect against confusing empty and full
226  * queue states.
227  *
228  * The device reads or writes the data in the queues via the device's several
229  * DMA/FIFO channels.  Each queue is mapped to a single DMA channel.
230  *
231  * For Tx queue, there are low mark and high mark limits. If, after queuing
232  * the packet for Tx, free space become < low mark, Tx queue stopped. When
233  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
234  * Tx queue resumed.
235  *
236  * See more detailed info in iwl-4965-hw.h.
237  ***************************************************/
238 
iwl_queue_space(const struct iwl_queue * q)239 int iwl_queue_space(const struct iwl_queue *q)
240 {
241 	int s = q->read_ptr - q->write_ptr;
242 
243 	if (q->read_ptr > q->write_ptr)
244 		s -= q->n_bd;
245 
246 	if (s <= 0)
247 		s += q->n_window;
248 	/* keep some reserve to not confuse empty and full situations */
249 	s -= 2;
250 	if (s < 0)
251 		s = 0;
252 	return s;
253 }
254 
255 
256 /**
257  * iwl_queue_init - Initialize queue's high/low-water and read/write indexes
258  */
iwl_queue_init(struct iwl_priv * priv,struct iwl_queue * q,int count,int slots_num,u32 id)259 static int iwl_queue_init(struct iwl_priv *priv, struct iwl_queue *q,
260 			  int count, int slots_num, u32 id)
261 {
262 	q->n_bd = count;
263 	q->n_window = slots_num;
264 	q->id = id;
265 
266 	/* count must be power-of-two size, otherwise iwl_queue_inc_wrap
267 	 * and iwl_queue_dec_wrap are broken. */
268 	BUG_ON(!is_power_of_2(count));
269 
270 	/* slots_num must be power-of-two size, otherwise
271 	 * get_cmd_index is broken. */
272 	BUG_ON(!is_power_of_2(slots_num));
273 
274 	q->low_mark = q->n_window / 4;
275 	if (q->low_mark < 4)
276 		q->low_mark = 4;
277 
278 	q->high_mark = q->n_window / 8;
279 	if (q->high_mark < 2)
280 		q->high_mark = 2;
281 
282 	q->write_ptr = q->read_ptr = 0;
283 
284 	return 0;
285 }
286 
287 /**
288  * iwl_tx_queue_alloc - Alloc driver data and TFD CB for one Tx/cmd queue
289  */
iwl_tx_queue_alloc(struct iwl_priv * priv,struct iwl_tx_queue * txq,u32 id)290 static int iwl_tx_queue_alloc(struct iwl_priv *priv,
291 			      struct iwl_tx_queue *txq, u32 id)
292 {
293 	struct device *dev = &priv->pci_dev->dev;
294 	size_t tfd_sz = priv->hw_params.tfd_size * TFD_QUEUE_SIZE_MAX;
295 
296 	/* Driver private data, only for Tx (not command) queues,
297 	 * not shared with device. */
298 	if (id != priv->cmd_queue) {
299 		txq->txb = kzalloc(sizeof(txq->txb[0]) *
300 				   TFD_QUEUE_SIZE_MAX, GFP_KERNEL);
301 		if (!txq->txb) {
302 			IWL_ERR(priv, "kmalloc for auxiliary BD "
303 				  "structures failed\n");
304 			goto error;
305 		}
306 	} else {
307 		txq->txb = NULL;
308 	}
309 
310 	/* Circular buffer of transmit frame descriptors (TFDs),
311 	 * shared with device */
312 	txq->tfds = dma_alloc_coherent(dev, tfd_sz, &txq->q.dma_addr,
313 				       GFP_KERNEL);
314 	if (!txq->tfds) {
315 		IWL_ERR(priv, "pci_alloc_consistent(%zd) failed\n", tfd_sz);
316 		goto error;
317 	}
318 	txq->q.id = id;
319 
320 	return 0;
321 
322  error:
323 	kfree(txq->txb);
324 	txq->txb = NULL;
325 
326 	return -ENOMEM;
327 }
328 
329 /**
330  * iwl_tx_queue_init - Allocate and initialize one tx/cmd queue
331  */
iwl_tx_queue_init(struct iwl_priv * priv,struct iwl_tx_queue * txq,int slots_num,u32 txq_id)332 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
333 		      int slots_num, u32 txq_id)
334 {
335 	int i, len;
336 	int ret;
337 	int actual_slots = slots_num;
338 
339 	/*
340 	 * Alloc buffer array for commands (Tx or other types of commands).
341 	 * For the command queue (#4/#9), allocate command space + one big
342 	 * command for scan, since scan command is very huge; the system will
343 	 * not have two scans at the same time, so only one is needed.
344 	 * For normal Tx queues (all other queues), no super-size command
345 	 * space is needed.
346 	 */
347 	if (txq_id == priv->cmd_queue)
348 		actual_slots++;
349 
350 	txq->meta = kzalloc(sizeof(struct iwl_cmd_meta) * actual_slots,
351 			    GFP_KERNEL);
352 	txq->cmd = kzalloc(sizeof(struct iwl_device_cmd *) * actual_slots,
353 			   GFP_KERNEL);
354 
355 	if (!txq->meta || !txq->cmd)
356 		goto out_free_arrays;
357 
358 	len = sizeof(struct iwl_device_cmd);
359 	for (i = 0; i < actual_slots; i++) {
360 		/* only happens for cmd queue */
361 		if (i == slots_num)
362 			len = IWL_MAX_CMD_SIZE;
363 
364 		txq->cmd[i] = kmalloc(len, GFP_KERNEL);
365 		if (!txq->cmd[i])
366 			goto err;
367 	}
368 
369 	/* Alloc driver data array and TFD circular buffer */
370 	ret = iwl_tx_queue_alloc(priv, txq, txq_id);
371 	if (ret)
372 		goto err;
373 
374 	txq->need_update = 0;
375 
376 	/*
377 	 * For the default queues 0-3, set up the swq_id
378 	 * already -- all others need to get one later
379 	 * (if they need one at all).
380 	 */
381 	if (txq_id < 4)
382 		iwl_set_swq_id(txq, txq_id, txq_id);
383 
384 	/* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
385 	 * iwl_queue_inc_wrap and iwl_queue_dec_wrap are broken. */
386 	BUILD_BUG_ON(TFD_QUEUE_SIZE_MAX & (TFD_QUEUE_SIZE_MAX - 1));
387 
388 	/* Initialize queue's high/low-water marks, and head/tail indexes */
389 	iwl_queue_init(priv, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
390 
391 	/* Tell device where to find queue */
392 	priv->cfg->ops->lib->txq_init(priv, txq);
393 
394 	return 0;
395 err:
396 	for (i = 0; i < actual_slots; i++)
397 		kfree(txq->cmd[i]);
398 out_free_arrays:
399 	kfree(txq->meta);
400 	kfree(txq->cmd);
401 
402 	return -ENOMEM;
403 }
404 
iwl_tx_queue_reset(struct iwl_priv * priv,struct iwl_tx_queue * txq,int slots_num,u32 txq_id)405 void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
406 			int slots_num, u32 txq_id)
407 {
408 	int actual_slots = slots_num;
409 
410 	if (txq_id == priv->cmd_queue)
411 		actual_slots++;
412 
413 	memset(txq->meta, 0, sizeof(struct iwl_cmd_meta) * actual_slots);
414 
415 	txq->need_update = 0;
416 
417 	/* Initialize queue's high/low-water marks, and head/tail indexes */
418 	iwl_queue_init(priv, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
419 
420 	/* Tell device where to find queue */
421 	priv->cfg->ops->lib->txq_init(priv, txq);
422 }
423 
424 /*************** HOST COMMAND QUEUE FUNCTIONS   *****/
425 
426 /**
427  * iwl_enqueue_hcmd - enqueue a uCode command
428  * @priv: device private data point
429  * @cmd: a point to the ucode command structure
430  *
431  * The function returns < 0 values to indicate the operation is
432  * failed. On success, it turns the index (> 0) of command in the
433  * command queue.
434  */
iwl_enqueue_hcmd(struct iwl_priv * priv,struct iwl_host_cmd * cmd)435 int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
436 {
437 	struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
438 	struct iwl_queue *q = &txq->q;
439 	struct iwl_device_cmd *out_cmd;
440 	struct iwl_cmd_meta *out_meta;
441 	dma_addr_t phys_addr;
442 	unsigned long flags;
443 	int len;
444 	u32 idx;
445 	u16 fix_size;
446 	bool is_ct_kill = false;
447 
448 	cmd->len = priv->cfg->ops->utils->get_hcmd_size(cmd->id, cmd->len);
449 	fix_size = (u16)(cmd->len + sizeof(out_cmd->hdr));
450 
451 	/* If any of the command structures end up being larger than
452 	 * the TFD_MAX_PAYLOAD_SIZE, and it sent as a 'small' command then
453 	 * we will need to increase the size of the TFD entries
454 	 * Also, check to see if command buffer should not exceed the size
455 	 * of device_cmd and max_cmd_size. */
456 	BUG_ON((fix_size > TFD_MAX_PAYLOAD_SIZE) &&
457 	       !(cmd->flags & CMD_SIZE_HUGE));
458 	BUG_ON(fix_size > IWL_MAX_CMD_SIZE);
459 
460 	if (iwl_is_rfkill(priv) || iwl_is_ctkill(priv)) {
461 		IWL_WARN(priv, "Not sending command - %s KILL\n",
462 			 iwl_is_rfkill(priv) ? "RF" : "CT");
463 		return -EIO;
464 	}
465 
466 	if (iwl_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
467 		IWL_ERR(priv, "No space in command queue\n");
468 		if (priv->cfg->ops->lib->tt_ops.ct_kill_check) {
469 			is_ct_kill =
470 				priv->cfg->ops->lib->tt_ops.ct_kill_check(priv);
471 		}
472 		if (!is_ct_kill) {
473 			IWL_ERR(priv, "Restarting adapter due to queue full\n");
474 			queue_work(priv->workqueue, &priv->restart);
475 		}
476 		return -ENOSPC;
477 	}
478 
479 	spin_lock_irqsave(&priv->hcmd_lock, flags);
480 
481 	/* If this is a huge cmd, mark the huge flag also on the meta.flags
482 	 * of the _original_ cmd. This is used for DMA mapping clean up.
483 	 */
484 	if (cmd->flags & CMD_SIZE_HUGE) {
485 		idx = get_cmd_index(q, q->write_ptr, 0);
486 		txq->meta[idx].flags = CMD_SIZE_HUGE;
487 	}
488 
489 	idx = get_cmd_index(q, q->write_ptr, cmd->flags & CMD_SIZE_HUGE);
490 	out_cmd = txq->cmd[idx];
491 	out_meta = &txq->meta[idx];
492 
493 	memset(out_meta, 0, sizeof(*out_meta));	/* re-initialize to NULL */
494 	out_meta->flags = cmd->flags;
495 	if (cmd->flags & CMD_WANT_SKB)
496 		out_meta->source = cmd;
497 	if (cmd->flags & CMD_ASYNC)
498 		out_meta->callback = cmd->callback;
499 
500 	out_cmd->hdr.cmd = cmd->id;
501 	memcpy(&out_cmd->cmd.payload, cmd->data, cmd->len);
502 
503 	/* At this point, the out_cmd now has all of the incoming cmd
504 	 * information */
505 
506 	out_cmd->hdr.flags = 0;
507 	out_cmd->hdr.sequence = cpu_to_le16(QUEUE_TO_SEQ(priv->cmd_queue) |
508 			INDEX_TO_SEQ(q->write_ptr));
509 	if (cmd->flags & CMD_SIZE_HUGE)
510 		out_cmd->hdr.sequence |= SEQ_HUGE_FRAME;
511 	len = sizeof(struct iwl_device_cmd);
512 	if (idx == TFD_CMD_SLOTS)
513 		len = IWL_MAX_CMD_SIZE;
514 
515 #ifdef CONFIG_IWLWIFI_DEBUG
516 	switch (out_cmd->hdr.cmd) {
517 	case REPLY_TX_LINK_QUALITY_CMD:
518 	case SENSITIVITY_CMD:
519 		IWL_DEBUG_HC_DUMP(priv, "Sending command %s (#%x), seq: 0x%04X, "
520 				"%d bytes at %d[%d]:%d\n",
521 				get_cmd_string(out_cmd->hdr.cmd),
522 				out_cmd->hdr.cmd,
523 				le16_to_cpu(out_cmd->hdr.sequence), fix_size,
524 				q->write_ptr, idx, priv->cmd_queue);
525 		break;
526 	default:
527 		IWL_DEBUG_HC(priv, "Sending command %s (#%x), seq: 0x%04X, "
528 				"%d bytes at %d[%d]:%d\n",
529 				get_cmd_string(out_cmd->hdr.cmd),
530 				out_cmd->hdr.cmd,
531 				le16_to_cpu(out_cmd->hdr.sequence), fix_size,
532 				q->write_ptr, idx, priv->cmd_queue);
533 	}
534 #endif
535 	txq->need_update = 1;
536 
537 	if (priv->cfg->ops->lib->txq_update_byte_cnt_tbl)
538 		/* Set up entry in queue's byte count circular buffer */
539 		priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq, 0);
540 
541 	phys_addr = pci_map_single(priv->pci_dev, &out_cmd->hdr,
542 				   fix_size, PCI_DMA_BIDIRECTIONAL);
543 	dma_unmap_addr_set(out_meta, mapping, phys_addr);
544 	dma_unmap_len_set(out_meta, len, fix_size);
545 
546 	trace_iwlwifi_dev_hcmd(priv, &out_cmd->hdr, fix_size, cmd->flags);
547 
548 	priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
549 						   phys_addr, fix_size, 1,
550 						   U32_PAD(cmd->len));
551 
552 	/* Increment and update queue's write index */
553 	q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
554 	iwl_txq_update_write_ptr(priv, txq);
555 
556 	spin_unlock_irqrestore(&priv->hcmd_lock, flags);
557 	return idx;
558 }
559 
560 /**
561  * iwl_hcmd_queue_reclaim - Reclaim TX command queue entries already Tx'd
562  *
563  * When FW advances 'R' index, all entries between old and new 'R' index
564  * need to be reclaimed. As result, some free space forms.  If there is
565  * enough free space (> low mark), wake the stack that feeds us.
566  */
iwl_hcmd_queue_reclaim(struct iwl_priv * priv,int txq_id,int idx,int cmd_idx)567 static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
568 				   int idx, int cmd_idx)
569 {
570 	struct iwl_tx_queue *txq = &priv->txq[txq_id];
571 	struct iwl_queue *q = &txq->q;
572 	int nfreed = 0;
573 
574 	if ((idx >= q->n_bd) || (iwl_queue_used(q, idx) == 0)) {
575 		IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
576 			  "is out of range [0-%d] %d %d.\n", txq_id,
577 			  idx, q->n_bd, q->write_ptr, q->read_ptr);
578 		return;
579 	}
580 
581 	for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
582 	     q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
583 
584 		if (nfreed++ > 0) {
585 			IWL_ERR(priv, "HCMD skipped: index (%d) %d %d\n", idx,
586 					q->write_ptr, q->read_ptr);
587 			queue_work(priv->workqueue, &priv->restart);
588 		}
589 
590 	}
591 }
592 
593 /**
594  * iwl_tx_cmd_complete - Pull unused buffers off the queue and reclaim them
595  * @rxb: Rx buffer to reclaim
596  *
597  * If an Rx buffer has an async callback associated with it the callback
598  * will be executed.  The attached skb (if present) will only be freed
599  * if the callback returns 1
600  */
iwl_tx_cmd_complete(struct iwl_priv * priv,struct iwl_rx_mem_buffer * rxb)601 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
602 {
603 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
604 	u16 sequence = le16_to_cpu(pkt->hdr.sequence);
605 	int txq_id = SEQ_TO_QUEUE(sequence);
606 	int index = SEQ_TO_INDEX(sequence);
607 	int cmd_index;
608 	bool huge = !!(pkt->hdr.sequence & SEQ_HUGE_FRAME);
609 	struct iwl_device_cmd *cmd;
610 	struct iwl_cmd_meta *meta;
611 	struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
612 
613 	/* If a Tx command is being handled and it isn't in the actual
614 	 * command queue then there a command routing bug has been introduced
615 	 * in the queue management code. */
616 	if (WARN(txq_id != priv->cmd_queue,
617 		 "wrong command queue %d (should be %d), sequence 0x%X readp=%d writep=%d\n",
618 		  txq_id, priv->cmd_queue, sequence,
619 		  priv->txq[priv->cmd_queue].q.read_ptr,
620 		  priv->txq[priv->cmd_queue].q.write_ptr)) {
621 		iwl_print_hex_error(priv, pkt, 32);
622 		return;
623 	}
624 
625 	/* If this is a huge cmd, clear the huge flag on the meta.flags
626 	 * of the _original_ cmd. So that iwl_cmd_queue_free won't unmap
627 	 * the DMA buffer for the scan (huge) command.
628 	 */
629 	if (huge) {
630 		cmd_index = get_cmd_index(&txq->q, index, 0);
631 		txq->meta[cmd_index].flags = 0;
632 	}
633 	cmd_index = get_cmd_index(&txq->q, index, huge);
634 	cmd = txq->cmd[cmd_index];
635 	meta = &txq->meta[cmd_index];
636 
637 	pci_unmap_single(priv->pci_dev,
638 			 dma_unmap_addr(meta, mapping),
639 			 dma_unmap_len(meta, len),
640 			 PCI_DMA_BIDIRECTIONAL);
641 
642 	/* Input error checking is done when commands are added to queue. */
643 	if (meta->flags & CMD_WANT_SKB) {
644 		meta->source->reply_page = (unsigned long)rxb_addr(rxb);
645 		rxb->page = NULL;
646 	} else if (meta->callback)
647 		meta->callback(priv, cmd, pkt);
648 
649 	iwl_hcmd_queue_reclaim(priv, txq_id, index, cmd_index);
650 
651 	if (!(meta->flags & CMD_ASYNC)) {
652 		clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
653 		IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
654 			       get_cmd_string(cmd->hdr.cmd));
655 		wake_up_interruptible(&priv->wait_command_queue);
656 	}
657 	meta->flags = 0;
658 }
659