1/*
2 * ============================================================================
3 *  Copyright (c) 1996-2002 Winbond Electronic Corporation
4 *
5 *  Module Name:
6 *    Wb35Rx.c
7 *
8 *  Abstract:
9 *    Processing the Rx message from down layer
10 *
11 * ============================================================================
12 */
13#include <linux/usb.h>
14#include <linux/slab.h>
15
16#include "core.h"
17#include "wb35rx_f.h"
18
19static void packet_came(struct ieee80211_hw *hw, char *pRxBufferAddress, int PacketSize)
20{
21	struct wbsoft_priv *priv = hw->priv;
22	struct sk_buff *skb;
23	struct ieee80211_rx_status rx_status = {0};
24
25	if (!priv->enabled)
26		return;
27
28	skb = dev_alloc_skb(PacketSize);
29	if (!skb) {
30		printk("Not enough memory for packet, FIXME\n");
31		return;
32	}
33
34	memcpy(skb_put(skb, PacketSize), pRxBufferAddress, PacketSize);
35
36	memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
37	ieee80211_rx_irqsafe(hw, skb);
38}
39
40static void Wb35Rx_adjust(struct wb35_descriptor *pRxDes)
41{
42	u32	*pRxBufferAddress;
43	u32	DecryptionMethod;
44	u32	i;
45	u16	BufferSize;
46
47	DecryptionMethod = pRxDes->R01.R01_decryption_method;
48	pRxBufferAddress = pRxDes->buffer_address[0];
49	BufferSize = pRxDes->buffer_size[0];
50
51	/* Adjust the last part of data. Only data left */
52	BufferSize -= 4; /* For CRC-32 */
53	if (DecryptionMethod)
54		BufferSize -= 4;
55	if (DecryptionMethod == 3) /* For CCMP */
56		BufferSize -= 4;
57
58	/* Adjust the IV field which after 802.11 header and ICV field. */
59	if (DecryptionMethod == 1) { /* For WEP */
60		for (i = 6; i > 0; i--)
61			pRxBufferAddress[i] = pRxBufferAddress[i - 1];
62		pRxDes->buffer_address[0] = pRxBufferAddress + 1;
63		BufferSize -= 4; /* 4 byte for IV */
64	} else if (DecryptionMethod) { /* For TKIP and CCMP */
65		for (i = 7; i > 1; i--)
66			pRxBufferAddress[i] = pRxBufferAddress[i - 2];
67		pRxDes->buffer_address[0] = pRxBufferAddress + 2; /* Update the descriptor, shift 8 byte */
68		BufferSize -= 8; /* 8 byte for IV + ICV */
69	}
70	pRxDes->buffer_size[0] = BufferSize;
71}
72
73static u16 Wb35Rx_indicate(struct ieee80211_hw *hw)
74{
75	struct wbsoft_priv	*priv = hw->priv;
76	struct hw_data		*pHwData = &priv->sHwData;
77	struct wb35_descriptor	RxDes;
78	struct wb35_rx		*pWb35Rx = &pHwData->Wb35Rx;
79	u8			*pRxBufferAddress;
80	u16			PacketSize;
81	u16			stmp, BufferSize, stmp2 = 0;
82	u32			RxBufferId;
83
84	/* Only one thread be allowed to run into the following */
85	do {
86		RxBufferId = pWb35Rx->RxProcessIndex;
87		if (pWb35Rx->RxOwner[RxBufferId]) /* Owner by VM */
88			break;
89
90		pWb35Rx->RxProcessIndex++;
91		pWb35Rx->RxProcessIndex %= MAX_USB_RX_BUFFER_NUMBER;
92
93		pRxBufferAddress = pWb35Rx->pDRx;
94		BufferSize = pWb35Rx->RxBufferSize[RxBufferId];
95
96		/* Parse the bulkin buffer */
97		while (BufferSize >= 4) {
98			if ((cpu_to_le32(*(u32 *)pRxBufferAddress) & 0x0fffffff) == RX_END_TAG) /* Is ending? */
99				break;
100
101			/* Get the R00 R01 first */
102			RxDes.R00.value = le32_to_cpu(*(u32 *)pRxBufferAddress);
103			PacketSize = (u16)RxDes.R00.R00_receive_byte_count;
104			RxDes.R01.value = le32_to_cpu(*((u32 *)(pRxBufferAddress + 4)));
105			/* For new DMA 4k */
106			if ((PacketSize & 0x03) > 0)
107				PacketSize -= 4;
108
109			/* Basic check for Rx length. Is length valid? */
110			if (PacketSize > MAX_PACKET_SIZE) {
111				pr_debug("Serious ERROR : Rx data size too long, size =%d\n", PacketSize);
112				pWb35Rx->EP3vm_state = VM_STOP;
113				pWb35Rx->Ep3ErrorCount2++;
114				break;
115			}
116
117			/*
118			 * Wb35Rx_indicate() is called synchronously so it isn't
119			 * necessary to set "RxDes.Desctriptor_ID = RxBufferID;"
120			 */
121			BufferSize -= 8; /* subtract 8 byte for 35's USB header length */
122			pRxBufferAddress += 8;
123
124			RxDes.buffer_address[0] = pRxBufferAddress;
125			RxDes.buffer_size[0] = PacketSize;
126			RxDes.buffer_number = 1;
127			RxDes.buffer_start_index = 0;
128			RxDes.buffer_total_size = RxDes.buffer_size[0];
129			Wb35Rx_adjust(&RxDes);
130
131			packet_came(hw, pRxBufferAddress, PacketSize);
132
133			/* Move RxBuffer point to the next */
134			stmp = PacketSize + 3;
135			stmp &= ~0x03; /* 4n alignment */
136			pRxBufferAddress += stmp;
137			BufferSize -= stmp;
138			stmp2 += stmp;
139		}
140
141		/* Reclaim resource */
142		pWb35Rx->RxOwner[RxBufferId] = 1;
143	} while (true);
144	return stmp2;
145}
146
147static void Wb35Rx(struct ieee80211_hw *hw);
148
149static void Wb35Rx_Complete(struct urb *urb)
150{
151	struct ieee80211_hw	*hw = urb->context;
152	struct wbsoft_priv	*priv = hw->priv;
153	struct hw_data		*pHwData = &priv->sHwData;
154	struct wb35_rx		*pWb35Rx = &pHwData->Wb35Rx;
155	u8			*pRxBufferAddress;
156	u32			SizeCheck;
157	u16			BulkLength;
158	u32			RxBufferId;
159	struct R00_descriptor		R00;
160
161	/* Variable setting */
162	pWb35Rx->EP3vm_state = VM_COMPLETED;
163	pWb35Rx->EP3VM_status = urb->status; /* Store the last result of Irp */
164
165	RxBufferId = pWb35Rx->CurrentRxBufferId;
166
167	pRxBufferAddress = pWb35Rx->pDRx;
168	BulkLength = (u16)urb->actual_length;
169
170	/* The IRP is completed */
171	pWb35Rx->EP3vm_state = VM_COMPLETED;
172
173	if (pHwData->SurpriseRemove) /* Must be here, or RxBufferId is invalid */
174		goto error;
175
176	if (pWb35Rx->rx_halt)
177		goto error;
178
179	/* Start to process the data only in successful condition */
180	pWb35Rx->RxOwner[RxBufferId] = 0; /* Set the owner to driver */
181	R00.value = le32_to_cpu(*(u32 *)pRxBufferAddress);
182
183	/* The URB is completed, check the result */
184	if (pWb35Rx->EP3VM_status != 0) {
185		pr_debug("EP3 IoCompleteRoutine return error\n");
186		pWb35Rx->EP3vm_state = VM_STOP;
187		goto error;
188	}
189
190	/* For recovering. check if operating in single USB mode */
191	if (!HAL_USB_MODE_BURST(pHwData)) {
192		SizeCheck = R00.R00_receive_byte_count;
193		if ((SizeCheck & 0x03) > 0)
194			SizeCheck -= 4;
195		SizeCheck = (SizeCheck + 3) & ~0x03;
196		SizeCheck += 12; /* 8 + 4 badbeef */
197		if ((BulkLength > 1600) ||
198			(SizeCheck > 1600) ||
199			(BulkLength != SizeCheck) ||
200			(BulkLength == 0)) { /* Add for fail Urb */
201			pWb35Rx->EP3vm_state = VM_STOP;
202			pWb35Rx->Ep3ErrorCount2++;
203		}
204	}
205
206	/* Indicating the receiving data */
207	pWb35Rx->ByteReceived += BulkLength;
208	pWb35Rx->RxBufferSize[RxBufferId] = BulkLength;
209
210	if (!pWb35Rx->RxOwner[RxBufferId])
211		Wb35Rx_indicate(hw);
212
213	kfree(pWb35Rx->pDRx);
214	/* Do the next receive */
215	Wb35Rx(hw);
216	return;
217
218error:
219	pWb35Rx->RxOwner[RxBufferId] = 1; /* Set the owner to hardware */
220	atomic_dec(&pWb35Rx->RxFireCounter);
221	pWb35Rx->EP3vm_state = VM_STOP;
222}
223
224/* This function cannot reentrain */
225static void Wb35Rx(struct ieee80211_hw *hw)
226{
227	struct wbsoft_priv	*priv = hw->priv;
228	struct hw_data		*pHwData = &priv->sHwData;
229	struct wb35_rx		*pWb35Rx = &pHwData->Wb35Rx;
230	u8			*pRxBufferAddress;
231	struct urb		*urb = pWb35Rx->RxUrb;
232	int			retv;
233	u32			RxBufferId;
234
235	/* Issuing URB */
236	if (pHwData->SurpriseRemove)
237		goto error;
238
239	if (pWb35Rx->rx_halt)
240		goto error;
241
242	/* Get RxBuffer's ID */
243	RxBufferId = pWb35Rx->RxBufferId;
244	if (!pWb35Rx->RxOwner[RxBufferId]) {
245		/* It's impossible to run here. */
246		pr_debug("Rx driver fifo unavailable\n");
247		goto error;
248	}
249
250	/* Update buffer point, then start to bulkin the data from USB */
251	pWb35Rx->RxBufferId++;
252	pWb35Rx->RxBufferId %= MAX_USB_RX_BUFFER_NUMBER;
253
254	pWb35Rx->CurrentRxBufferId = RxBufferId;
255
256	pWb35Rx->pDRx = kzalloc(MAX_USB_RX_BUFFER, GFP_ATOMIC);
257	if (!pWb35Rx->pDRx) {
258		printk("w35und: Rx memory alloc failed\n");
259		goto error;
260	}
261	pRxBufferAddress = pWb35Rx->pDRx;
262
263	usb_fill_bulk_urb(urb, pHwData->udev,
264			  usb_rcvbulkpipe(pHwData->udev, 3),
265			  pRxBufferAddress, MAX_USB_RX_BUFFER,
266			  Wb35Rx_Complete, hw);
267
268	pWb35Rx->EP3vm_state = VM_RUNNING;
269
270	retv = usb_submit_urb(urb, GFP_ATOMIC);
271
272	if (retv != 0) {
273		printk("Rx URB sending error\n");
274		goto error;
275	}
276	return;
277
278error:
279	/* VM stop */
280	pWb35Rx->EP3vm_state = VM_STOP;
281	atomic_dec(&pWb35Rx->RxFireCounter);
282}
283
284void Wb35Rx_start(struct ieee80211_hw *hw)
285{
286	struct wbsoft_priv	*priv = hw->priv;
287	struct hw_data		*pHwData = &priv->sHwData;
288	struct wb35_rx		*pWb35Rx = &pHwData->Wb35Rx;
289
290	/* Allow only one thread to run into the Wb35Rx() function */
291	if (atomic_inc_return(&pWb35Rx->RxFireCounter) == 1) {
292		pWb35Rx->EP3vm_state = VM_RUNNING;
293		Wb35Rx(hw);
294	} else
295		atomic_dec(&pWb35Rx->RxFireCounter);
296}
297
298static void Wb35Rx_reset_descriptor(struct hw_data *pHwData)
299{
300	struct wb35_rx	*pWb35Rx = &pHwData->Wb35Rx;
301	u32		i;
302
303	pWb35Rx->ByteReceived = 0;
304	pWb35Rx->RxProcessIndex = 0;
305	pWb35Rx->RxBufferId = 0;
306	pWb35Rx->EP3vm_state = VM_STOP;
307	pWb35Rx->rx_halt = 0;
308
309	/* Initial the Queue. The last buffer is reserved for used if the Rx resource is unavailable. */
310	for (i = 0; i < MAX_USB_RX_BUFFER_NUMBER; i++)
311		pWb35Rx->RxOwner[i] = 1;
312}
313
314unsigned char Wb35Rx_initial(struct hw_data *pHwData)
315{
316	struct wb35_rx *pWb35Rx = &pHwData->Wb35Rx;
317
318	/* Initial the Buffer Queue */
319	Wb35Rx_reset_descriptor(pHwData);
320
321	pWb35Rx->RxUrb = usb_alloc_urb(0, GFP_ATOMIC);
322	return !!pWb35Rx->RxUrb;
323}
324
325void Wb35Rx_stop(struct hw_data *pHwData)
326{
327	struct wb35_rx *pWb35Rx = &pHwData->Wb35Rx;
328
329	/* Canceling the Irp if already sends it out. */
330	if (pWb35Rx->EP3vm_state == VM_RUNNING) {
331		usb_unlink_urb(pWb35Rx->RxUrb); /* Only use unlink, let Wb35Rx_destroy to free them */
332		pr_debug("EP3 Rx stop\n");
333	}
334}
335
336/* Needs process context */
337void Wb35Rx_destroy(struct hw_data *pHwData)
338{
339	struct wb35_rx *pWb35Rx = &pHwData->Wb35Rx;
340
341	do {
342		msleep(10); /* Delay for waiting function enter */
343	} while (pWb35Rx->EP3vm_state != VM_STOP);
344	msleep(10); /* Delay for waiting function exit */
345
346	if (pWb35Rx->RxUrb)
347		usb_free_urb(pWb35Rx->RxUrb);
348	pr_debug("Wb35Rx_destroy OK\n");
349}
350
351