1 /******************************************************************************
2  *
3  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
4  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
5  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
6  * Copyright(c) 2018 Intel Corporation
7  *
8  * Portions of this file are derived from the ipw3945 project, as well
9  * as portions of the ieee80211 subsystem header files.
10  *
11  * This program is free software; you can redistribute it and/or modify it
12  * under the terms of version 2 of the GNU General Public License as
13  * published by the Free Software Foundation.
14  *
15  * This program is distributed in the hope that it will be useful, but WITHOUT
16  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
18  * more details.
19  *
20  * The full GNU General Public License is included in this distribution in the
21  * file called LICENSE.
22  *
23  * Contact Information:
24  *  Intel Linux Wireless <linuxwifi@intel.com>
25  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
26  *
27  *****************************************************************************/
28 #include <linux/etherdevice.h>
29 #include <linux/ieee80211.h>
30 #include <linux/slab.h>
31 #include <linux/sched.h>
32 #include <linux/pm_runtime.h>
33 #include <net/ip6_checksum.h>
34 #include <net/tso.h>
35 
36 #include "iwl-debug.h"
37 #include "iwl-csr.h"
38 #include "iwl-prph.h"
39 #include "iwl-io.h"
40 #include "iwl-scd.h"
41 #include "iwl-op-mode.h"
42 #include "internal.h"
43 #include "fw/api/tx.h"
44 
45 #define IWL_TX_CRC_SIZE 4
46 #define IWL_TX_DELIMITER_SIZE 4
47 
48 /*************** DMA-QUEUE-GENERAL-FUNCTIONS  *****
49  * DMA services
50  *
51  * Theory of operation
52  *
53  * A Tx or Rx queue resides in host DRAM, and is comprised of a circular buffer
54  * of buffer descriptors, each of which points to one or more data buffers for
55  * the device to read from or fill.  Driver and device exchange status of each
56  * queue via "read" and "write" pointers.  Driver keeps minimum of 2 empty
57  * entries in each circular buffer, to protect against confusing empty and full
58  * queue states.
59  *
60  * The device reads or writes the data in the queues via the device's several
61  * DMA/FIFO channels.  Each queue is mapped to a single DMA channel.
62  *
63  * For Tx queue, there are low mark and high mark limits. If, after queuing
64  * the packet for Tx, free space become < low mark, Tx queue stopped. When
65  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
66  * Tx queue resumed.
67  *
68  ***************************************************/
69 
70 int iwl_queue_space(struct iwl_trans *trans, const struct iwl_txq *q)
71 {
72 	unsigned int max;
73 	unsigned int used;
74 
75 	/*
76 	 * To avoid ambiguity between empty and completely full queues, there
77 	 * should always be less than max_tfd_queue_size elements in the queue.
78 	 * If q->n_window is smaller than max_tfd_queue_size, there is no need
79 	 * to reserve any queue entries for this purpose.
80 	 */
81 	if (q->n_window < trans->cfg->base_params->max_tfd_queue_size)
82 		max = q->n_window;
83 	else
84 		max = trans->cfg->base_params->max_tfd_queue_size - 1;
85 
86 	/*
87 	 * max_tfd_queue_size is a power of 2, so the following is equivalent to
88 	 * modulo by max_tfd_queue_size and is well defined.
89 	 */
90 	used = (q->write_ptr - q->read_ptr) &
91 		(trans->cfg->base_params->max_tfd_queue_size - 1);
92 
93 	if (WARN_ON(used > max))
94 		return 0;
95 
96 	return max - used;
97 }
98 
99 /*
100  * iwl_queue_init - Initialize queue's high/low-water and read/write indexes
101  */
102 static int iwl_queue_init(struct iwl_txq *q, int slots_num)
103 {
104 	q->n_window = slots_num;
105 
106 	/* slots_num must be power-of-two size, otherwise
107 	 * iwl_pcie_get_cmd_index is broken. */
108 	if (WARN_ON(!is_power_of_2(slots_num)))
109 		return -EINVAL;
110 
111 	q->low_mark = q->n_window / 4;
112 	if (q->low_mark < 4)
113 		q->low_mark = 4;
114 
115 	q->high_mark = q->n_window / 8;
116 	if (q->high_mark < 2)
117 		q->high_mark = 2;
118 
119 	q->write_ptr = 0;
120 	q->read_ptr = 0;
121 
122 	return 0;
123 }
124 
125 int iwl_pcie_alloc_dma_ptr(struct iwl_trans *trans,
126 			   struct iwl_dma_ptr *ptr, size_t size)
127 {
128 	if (WARN_ON(ptr->addr))
129 		return -EINVAL;
130 
131 	ptr->addr = dma_alloc_coherent(trans->dev, size,
132 				       &ptr->dma, GFP_KERNEL);
133 	if (!ptr->addr)
134 		return -ENOMEM;
135 	ptr->size = size;
136 	return 0;
137 }
138 
139 void iwl_pcie_free_dma_ptr(struct iwl_trans *trans, struct iwl_dma_ptr *ptr)
140 {
141 	if (unlikely(!ptr->addr))
142 		return;
143 
144 	dma_free_coherent(trans->dev, ptr->size, ptr->addr, ptr->dma);
145 	memset(ptr, 0, sizeof(*ptr));
146 }
147 
148 static void iwl_pcie_txq_stuck_timer(struct timer_list *t)
149 {
150 	struct iwl_txq *txq = from_timer(txq, t, stuck_timer);
151 	struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
152 	struct iwl_trans *trans = iwl_trans_pcie_get_trans(trans_pcie);
153 
154 	spin_lock(&txq->lock);
155 	/* check if triggered erroneously */
156 	if (txq->read_ptr == txq->write_ptr) {
157 		spin_unlock(&txq->lock);
158 		return;
159 	}
160 	spin_unlock(&txq->lock);
161 
162 	iwl_trans_pcie_log_scd_error(trans, txq);
163 
164 	iwl_force_nmi(trans);
165 }
166 
167 /*
168  * iwl_pcie_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
169  */
170 static void iwl_pcie_txq_update_byte_cnt_tbl(struct iwl_trans *trans,
171 					     struct iwl_txq *txq, u16 byte_cnt,
172 					     int num_tbs)
173 {
174 	struct iwlagn_scd_bc_tbl *scd_bc_tbl;
175 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
176 	int write_ptr = txq->write_ptr;
177 	int txq_id = txq->id;
178 	u8 sec_ctl = 0;
179 	u16 len = byte_cnt + IWL_TX_CRC_SIZE + IWL_TX_DELIMITER_SIZE;
180 	__le16 bc_ent;
181 	struct iwl_tx_cmd *tx_cmd =
182 		(void *)txq->entries[txq->write_ptr].cmd->payload;
183 	u8 sta_id = tx_cmd->sta_id;
184 
185 	scd_bc_tbl = trans_pcie->scd_bc_tbls.addr;
186 
187 	sec_ctl = tx_cmd->sec_ctl;
188 
189 	switch (sec_ctl & TX_CMD_SEC_MSK) {
190 	case TX_CMD_SEC_CCM:
191 		len += IEEE80211_CCMP_MIC_LEN;
192 		break;
193 	case TX_CMD_SEC_TKIP:
194 		len += IEEE80211_TKIP_ICV_LEN;
195 		break;
196 	case TX_CMD_SEC_WEP:
197 		len += IEEE80211_WEP_IV_LEN + IEEE80211_WEP_ICV_LEN;
198 		break;
199 	}
200 	if (trans_pcie->bc_table_dword)
201 		len = DIV_ROUND_UP(len, 4);
202 
203 	if (WARN_ON(len > 0xFFF || write_ptr >= TFD_QUEUE_SIZE_MAX))
204 		return;
205 
206 	bc_ent = cpu_to_le16(len | (sta_id << 12));
207 
208 	scd_bc_tbl[txq_id].tfd_offset[write_ptr] = bc_ent;
209 
210 	if (write_ptr < TFD_QUEUE_SIZE_BC_DUP)
211 		scd_bc_tbl[txq_id].
212 			tfd_offset[TFD_QUEUE_SIZE_MAX + write_ptr] = bc_ent;
213 }
214 
215 static void iwl_pcie_txq_inval_byte_cnt_tbl(struct iwl_trans *trans,
216 					    struct iwl_txq *txq)
217 {
218 	struct iwl_trans_pcie *trans_pcie =
219 		IWL_TRANS_GET_PCIE_TRANS(trans);
220 	struct iwlagn_scd_bc_tbl *scd_bc_tbl = trans_pcie->scd_bc_tbls.addr;
221 	int txq_id = txq->id;
222 	int read_ptr = txq->read_ptr;
223 	u8 sta_id = 0;
224 	__le16 bc_ent;
225 	struct iwl_tx_cmd *tx_cmd =
226 		(void *)txq->entries[read_ptr].cmd->payload;
227 
228 	WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);
229 
230 	if (txq_id != trans_pcie->cmd_queue)
231 		sta_id = tx_cmd->sta_id;
232 
233 	bc_ent = cpu_to_le16(1 | (sta_id << 12));
234 
235 	scd_bc_tbl[txq_id].tfd_offset[read_ptr] = bc_ent;
236 
237 	if (read_ptr < TFD_QUEUE_SIZE_BC_DUP)
238 		scd_bc_tbl[txq_id].
239 			tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] = bc_ent;
240 }
241 
242 /*
243  * iwl_pcie_txq_inc_wr_ptr - Send new write index to hardware
244  */
245 static void iwl_pcie_txq_inc_wr_ptr(struct iwl_trans *trans,
246 				    struct iwl_txq *txq)
247 {
248 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
249 	u32 reg = 0;
250 	int txq_id = txq->id;
251 
252 	lockdep_assert_held(&txq->lock);
253 
254 	/*
255 	 * explicitly wake up the NIC if:
256 	 * 1. shadow registers aren't enabled
257 	 * 2. NIC is woken up for CMD regardless of shadow outside this function
258 	 * 3. there is a chance that the NIC is asleep
259 	 */
260 	if (!trans->cfg->base_params->shadow_reg_enable &&
261 	    txq_id != trans_pcie->cmd_queue &&
262 	    test_bit(STATUS_TPOWER_PMI, &trans->status)) {
263 		/*
264 		 * wake up nic if it's powered down ...
265 		 * uCode will wake up, and interrupt us again, so next
266 		 * time we'll skip this part.
267 		 */
268 		reg = iwl_read32(trans, CSR_UCODE_DRV_GP1);
269 
270 		if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
271 			IWL_DEBUG_INFO(trans, "Tx queue %d requesting wakeup, GP1 = 0x%x\n",
272 				       txq_id, reg);
273 			iwl_set_bit(trans, CSR_GP_CNTRL,
274 				    BIT(trans->cfg->csr->flag_mac_access_req));
275 			txq->need_update = true;
276 			return;
277 		}
278 	}
279 
280 	/*
281 	 * if not in power-save mode, uCode will never sleep when we're
282 	 * trying to tx (during RFKILL, we're not trying to tx).
283 	 */
284 	IWL_DEBUG_TX(trans, "Q:%d WR: 0x%x\n", txq_id, txq->write_ptr);
285 	if (!txq->block)
286 		iwl_write32(trans, HBUS_TARG_WRPTR,
287 			    txq->write_ptr | (txq_id << 8));
288 }
289 
290 void iwl_pcie_txq_check_wrptrs(struct iwl_trans *trans)
291 {
292 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
293 	int i;
294 
295 	for (i = 0; i < trans->cfg->base_params->num_of_queues; i++) {
296 		struct iwl_txq *txq = trans_pcie->txq[i];
297 
298 		if (!test_bit(i, trans_pcie->queue_used))
299 			continue;
300 
301 		spin_lock_bh(&txq->lock);
302 		if (txq->need_update) {
303 			iwl_pcie_txq_inc_wr_ptr(trans, txq);
304 			txq->need_update = false;
305 		}
306 		spin_unlock_bh(&txq->lock);
307 	}
308 }
309 
310 static inline dma_addr_t iwl_pcie_tfd_tb_get_addr(struct iwl_trans *trans,
311 						  void *_tfd, u8 idx)
312 {
313 
314 	if (trans->cfg->use_tfh) {
315 		struct iwl_tfh_tfd *tfd = _tfd;
316 		struct iwl_tfh_tb *tb = &tfd->tbs[idx];
317 
318 		return (dma_addr_t)(le64_to_cpu(tb->addr));
319 	} else {
320 		struct iwl_tfd *tfd = _tfd;
321 		struct iwl_tfd_tb *tb = &tfd->tbs[idx];
322 		dma_addr_t addr = get_unaligned_le32(&tb->lo);
323 		dma_addr_t hi_len;
324 
325 		if (sizeof(dma_addr_t) <= sizeof(u32))
326 			return addr;
327 
328 		hi_len = le16_to_cpu(tb->hi_n_len) & 0xF;
329 
330 		/*
331 		 * shift by 16 twice to avoid warnings on 32-bit
332 		 * (where this code never runs anyway due to the
333 		 * if statement above)
334 		 */
335 		return addr | ((hi_len << 16) << 16);
336 	}
337 }
338 
339 static inline void iwl_pcie_tfd_set_tb(struct iwl_trans *trans, void *tfd,
340 				       u8 idx, dma_addr_t addr, u16 len)
341 {
342 	struct iwl_tfd *tfd_fh = (void *)tfd;
343 	struct iwl_tfd_tb *tb = &tfd_fh->tbs[idx];
344 
345 	u16 hi_n_len = len << 4;
346 
347 	put_unaligned_le32(addr, &tb->lo);
348 	hi_n_len |= iwl_get_dma_hi_addr(addr);
349 
350 	tb->hi_n_len = cpu_to_le16(hi_n_len);
351 
352 	tfd_fh->num_tbs = idx + 1;
353 }
354 
355 static inline u8 iwl_pcie_tfd_get_num_tbs(struct iwl_trans *trans, void *_tfd)
356 {
357 	if (trans->cfg->use_tfh) {
358 		struct iwl_tfh_tfd *tfd = _tfd;
359 
360 		return le16_to_cpu(tfd->num_tbs) & 0x1f;
361 	} else {
362 		struct iwl_tfd *tfd = _tfd;
363 
364 		return tfd->num_tbs & 0x1f;
365 	}
366 }
367 
368 static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
369 			       struct iwl_cmd_meta *meta,
370 			       struct iwl_txq *txq, int index)
371 {
372 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
373 	int i, num_tbs;
374 	void *tfd = iwl_pcie_get_tfd(trans, txq, index);
375 
376 	/* Sanity check on number of chunks */
377 	num_tbs = iwl_pcie_tfd_get_num_tbs(trans, tfd);
378 
379 	if (num_tbs > trans_pcie->max_tbs) {
380 		IWL_ERR(trans, "Too many chunks: %i\n", num_tbs);
381 		/* @todo issue fatal error, it is quite serious situation */
382 		return;
383 	}
384 
385 	/* first TB is never freed - it's the bidirectional DMA data */
386 
387 	for (i = 1; i < num_tbs; i++) {
388 		if (meta->tbs & BIT(i))
389 			dma_unmap_page(trans->dev,
390 				       iwl_pcie_tfd_tb_get_addr(trans, tfd, i),
391 				       iwl_pcie_tfd_tb_get_len(trans, tfd, i),
392 				       DMA_TO_DEVICE);
393 		else
394 			dma_unmap_single(trans->dev,
395 					 iwl_pcie_tfd_tb_get_addr(trans, tfd,
396 								  i),
397 					 iwl_pcie_tfd_tb_get_len(trans, tfd,
398 								 i),
399 					 DMA_TO_DEVICE);
400 	}
401 
402 	if (trans->cfg->use_tfh) {
403 		struct iwl_tfh_tfd *tfd_fh = (void *)tfd;
404 
405 		tfd_fh->num_tbs = 0;
406 	} else {
407 		struct iwl_tfd *tfd_fh = (void *)tfd;
408 
409 		tfd_fh->num_tbs = 0;
410 	}
411 
412 }
413 
414 /*
415  * iwl_pcie_txq_free_tfd - Free all chunks referenced by TFD [txq->q.read_ptr]
416  * @trans - transport private data
417  * @txq - tx queue
418  * @dma_dir - the direction of the DMA mapping
419  *
420  * Does NOT advance any TFD circular buffer read/write indexes
421  * Does NOT free the TFD itself (which is within circular buffer)
422  */
423 void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
424 {
425 	/* rd_ptr is bounded by TFD_QUEUE_SIZE_MAX and
426 	 * idx is bounded by n_window
427 	 */
428 	int rd_ptr = txq->read_ptr;
429 	int idx = iwl_pcie_get_cmd_index(txq, rd_ptr);
430 
431 	lockdep_assert_held(&txq->lock);
432 
433 	/* We have only q->n_window txq->entries, but we use
434 	 * TFD_QUEUE_SIZE_MAX tfds
435 	 */
436 	iwl_pcie_tfd_unmap(trans, &txq->entries[idx].meta, txq, rd_ptr);
437 
438 	/* free SKB */
439 	if (txq->entries) {
440 		struct sk_buff *skb;
441 
442 		skb = txq->entries[idx].skb;
443 
444 		/* Can be called from irqs-disabled context
445 		 * If skb is not NULL, it means that the whole queue is being
446 		 * freed and that the queue is not empty - free the skb
447 		 */
448 		if (skb) {
449 			iwl_op_mode_free_skb(trans->op_mode, skb);
450 			txq->entries[idx].skb = NULL;
451 		}
452 	}
453 }
454 
455 static int iwl_pcie_txq_build_tfd(struct iwl_trans *trans, struct iwl_txq *txq,
456 				  dma_addr_t addr, u16 len, bool reset)
457 {
458 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
459 	void *tfd;
460 	u32 num_tbs;
461 
462 	tfd = txq->tfds + trans_pcie->tfd_size * txq->write_ptr;
463 
464 	if (reset)
465 		memset(tfd, 0, trans_pcie->tfd_size);
466 
467 	num_tbs = iwl_pcie_tfd_get_num_tbs(trans, tfd);
468 
469 	/* Each TFD can point to a maximum max_tbs Tx buffers */
470 	if (num_tbs >= trans_pcie->max_tbs) {
471 		IWL_ERR(trans, "Error can not send more than %d chunks\n",
472 			trans_pcie->max_tbs);
473 		return -EINVAL;
474 	}
475 
476 	if (WARN(addr & ~IWL_TX_DMA_MASK,
477 		 "Unaligned address = %llx\n", (unsigned long long)addr))
478 		return -EINVAL;
479 
480 	iwl_pcie_tfd_set_tb(trans, tfd, num_tbs, addr, len);
481 
482 	return num_tbs;
483 }
484 
485 int iwl_pcie_txq_alloc(struct iwl_trans *trans, struct iwl_txq *txq,
486 		       int slots_num, bool cmd_queue)
487 {
488 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
489 	size_t tfd_sz = trans_pcie->tfd_size *
490 		trans->cfg->base_params->max_tfd_queue_size;
491 	size_t tb0_buf_sz;
492 	int i;
493 
494 	if (WARN_ON(txq->entries || txq->tfds))
495 		return -EINVAL;
496 
497 	if (trans->cfg->use_tfh)
498 		tfd_sz = trans_pcie->tfd_size * slots_num;
499 
500 	timer_setup(&txq->stuck_timer, iwl_pcie_txq_stuck_timer, 0);
501 	txq->trans_pcie = trans_pcie;
502 
503 	txq->n_window = slots_num;
504 
505 	txq->entries = kcalloc(slots_num,
506 			       sizeof(struct iwl_pcie_txq_entry),
507 			       GFP_KERNEL);
508 
509 	if (!txq->entries)
510 		goto error;
511 
512 	if (cmd_queue)
513 		for (i = 0; i < slots_num; i++) {
514 			txq->entries[i].cmd =
515 				kmalloc(sizeof(struct iwl_device_cmd),
516 					GFP_KERNEL);
517 			if (!txq->entries[i].cmd)
518 				goto error;
519 		}
520 
521 	/* Circular buffer of transmit frame descriptors (TFDs),
522 	 * shared with device */
523 	txq->tfds = dma_alloc_coherent(trans->dev, tfd_sz,
524 				       &txq->dma_addr, GFP_KERNEL);
525 	if (!txq->tfds)
526 		goto error;
527 
528 	BUILD_BUG_ON(IWL_FIRST_TB_SIZE_ALIGN != sizeof(*txq->first_tb_bufs));
529 
530 	tb0_buf_sz = sizeof(*txq->first_tb_bufs) * slots_num;
531 
532 	txq->first_tb_bufs = dma_alloc_coherent(trans->dev, tb0_buf_sz,
533 					      &txq->first_tb_dma,
534 					      GFP_KERNEL);
535 	if (!txq->first_tb_bufs)
536 		goto err_free_tfds;
537 
538 	return 0;
539 err_free_tfds:
540 	dma_free_coherent(trans->dev, tfd_sz, txq->tfds, txq->dma_addr);
541 error:
542 	if (txq->entries && cmd_queue)
543 		for (i = 0; i < slots_num; i++)
544 			kfree(txq->entries[i].cmd);
545 	kfree(txq->entries);
546 	txq->entries = NULL;
547 
548 	return -ENOMEM;
549 
550 }
551 
552 int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
553 		      int slots_num, bool cmd_queue)
554 {
555 	int ret;
556 	u32 tfd_queue_max_size = trans->cfg->base_params->max_tfd_queue_size;
557 
558 	txq->need_update = false;
559 
560 	/* max_tfd_queue_size must be power-of-two size, otherwise
561 	 * iwl_queue_inc_wrap and iwl_queue_dec_wrap are broken. */
562 	if (WARN_ONCE(tfd_queue_max_size & (tfd_queue_max_size - 1),
563 		      "Max tfd queue size must be a power of two, but is %d",
564 		      tfd_queue_max_size))
565 		return -EINVAL;
566 
567 	/* Initialize queue's high/low-water marks, and head/tail indexes */
568 	ret = iwl_queue_init(txq, slots_num);
569 	if (ret)
570 		return ret;
571 
572 	spin_lock_init(&txq->lock);
573 
574 	if (cmd_queue) {
575 		static struct lock_class_key iwl_pcie_cmd_queue_lock_class;
576 
577 		lockdep_set_class(&txq->lock, &iwl_pcie_cmd_queue_lock_class);
578 	}
579 
580 	__skb_queue_head_init(&txq->overflow_q);
581 
582 	return 0;
583 }
584 
585 void iwl_pcie_free_tso_page(struct iwl_trans_pcie *trans_pcie,
586 			    struct sk_buff *skb)
587 {
588 	struct page **page_ptr;
589 
590 	page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs);
591 
592 	if (*page_ptr) {
593 		__free_page(*page_ptr);
594 		*page_ptr = NULL;
595 	}
596 }
597 
598 static void iwl_pcie_clear_cmd_in_flight(struct iwl_trans *trans)
599 {
600 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
601 
602 	lockdep_assert_held(&trans_pcie->reg_lock);
603 
604 	if (trans_pcie->ref_cmd_in_flight) {
605 		trans_pcie->ref_cmd_in_flight = false;
606 		IWL_DEBUG_RPM(trans, "clear ref_cmd_in_flight - unref\n");
607 		iwl_trans_unref(trans);
608 	}
609 
610 	if (!trans->cfg->base_params->apmg_wake_up_wa)
611 		return;
612 	if (WARN_ON(!trans_pcie->cmd_hold_nic_awake))
613 		return;
614 
615 	trans_pcie->cmd_hold_nic_awake = false;
616 	__iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
617 				   BIT(trans->cfg->csr->flag_mac_access_req));
618 }
619 
620 /*
621  * iwl_pcie_txq_unmap -  Unmap any remaining DMA mappings and free skb's
622  */
623 static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
624 {
625 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
626 	struct iwl_txq *txq = trans_pcie->txq[txq_id];
627 
628 	spin_lock_bh(&txq->lock);
629 	while (txq->write_ptr != txq->read_ptr) {
630 		IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",
631 				   txq_id, txq->read_ptr);
632 
633 		if (txq_id != trans_pcie->cmd_queue) {
634 			struct sk_buff *skb = txq->entries[txq->read_ptr].skb;
635 
636 			if (WARN_ON_ONCE(!skb))
637 				continue;
638 
639 			iwl_pcie_free_tso_page(trans_pcie, skb);
640 		}
641 		iwl_pcie_txq_free_tfd(trans, txq);
642 		txq->read_ptr = iwl_queue_inc_wrap(trans, txq->read_ptr);
643 
644 		if (txq->read_ptr == txq->write_ptr) {
645 			unsigned long flags;
646 
647 			spin_lock_irqsave(&trans_pcie->reg_lock, flags);
648 			if (txq_id != trans_pcie->cmd_queue) {
649 				IWL_DEBUG_RPM(trans, "Q %d - last tx freed\n",
650 					      txq->id);
651 				iwl_trans_unref(trans);
652 			} else {
653 				iwl_pcie_clear_cmd_in_flight(trans);
654 			}
655 			spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
656 		}
657 	}
658 
659 	while (!skb_queue_empty(&txq->overflow_q)) {
660 		struct sk_buff *skb = __skb_dequeue(&txq->overflow_q);
661 
662 		iwl_op_mode_free_skb(trans->op_mode, skb);
663 	}
664 
665 	spin_unlock_bh(&txq->lock);
666 
667 	/* just in case - this queue may have been stopped */
668 	iwl_wake_queue(trans, txq);
669 }
670 
671 /*
672  * iwl_pcie_txq_free - Deallocate DMA queue.
673  * @txq: Transmit queue to deallocate.
674  *
675  * Empty queue by removing and destroying all BD's.
676  * Free all buffers.
677  * 0-fill, but do not free "txq" descriptor structure.
678  */
679 static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
680 {
681 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
682 	struct iwl_txq *txq = trans_pcie->txq[txq_id];
683 	struct device *dev = trans->dev;
684 	int i;
685 
686 	if (WARN_ON(!txq))
687 		return;
688 
689 	iwl_pcie_txq_unmap(trans, txq_id);
690 
691 	/* De-alloc array of command/tx buffers */
692 	if (txq_id == trans_pcie->cmd_queue)
693 		for (i = 0; i < txq->n_window; i++) {
694 			kzfree(txq->entries[i].cmd);
695 			kzfree(txq->entries[i].free_buf);
696 		}
697 
698 	/* De-alloc circular buffer of TFDs */
699 	if (txq->tfds) {
700 		dma_free_coherent(dev,
701 				  trans_pcie->tfd_size *
702 				  trans->cfg->base_params->max_tfd_queue_size,
703 				  txq->tfds, txq->dma_addr);
704 		txq->dma_addr = 0;
705 		txq->tfds = NULL;
706 
707 		dma_free_coherent(dev,
708 				  sizeof(*txq->first_tb_bufs) * txq->n_window,
709 				  txq->first_tb_bufs, txq->first_tb_dma);
710 	}
711 
712 	kfree(txq->entries);
713 	txq->entries = NULL;
714 
715 	del_timer_sync(&txq->stuck_timer);
716 
717 	/* 0-fill queue descriptor structure */
718 	memset(txq, 0, sizeof(*txq));
719 }
720 
721 void iwl_pcie_tx_start(struct iwl_trans *trans, u32 scd_base_addr)
722 {
723 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
724 	int nq = trans->cfg->base_params->num_of_queues;
725 	int chan;
726 	u32 reg_val;
727 	int clear_dwords = (SCD_TRANS_TBL_OFFSET_QUEUE(nq) -
728 				SCD_CONTEXT_MEM_LOWER_BOUND) / sizeof(u32);
729 
730 	/* make sure all queue are not stopped/used */
731 	memset(trans_pcie->queue_stopped, 0, sizeof(trans_pcie->queue_stopped));
732 	memset(trans_pcie->queue_used, 0, sizeof(trans_pcie->queue_used));
733 
734 	trans_pcie->scd_base_addr =
735 		iwl_read_prph(trans, SCD_SRAM_BASE_ADDR);
736 
737 	WARN_ON(scd_base_addr != 0 &&
738 		scd_base_addr != trans_pcie->scd_base_addr);
739 
740 	/* reset context data, TX status and translation data */
741 	iwl_trans_write_mem(trans, trans_pcie->scd_base_addr +
742 				   SCD_CONTEXT_MEM_LOWER_BOUND,
743 			    NULL, clear_dwords);
744 
745 	iwl_write_prph(trans, SCD_DRAM_BASE_ADDR,
746 		       trans_pcie->scd_bc_tbls.dma >> 10);
747 
748 	/* The chain extension of the SCD doesn't work well. This feature is
749 	 * enabled by default by the HW, so we need to disable it manually.
750 	 */
751 	if (trans->cfg->base_params->scd_chain_ext_wa)
752 		iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
753 
754 	iwl_trans_ac_txq_enable(trans, trans_pcie->cmd_queue,
755 				trans_pcie->cmd_fifo,
756 				trans_pcie->cmd_q_wdg_timeout);
757 
758 	/* Activate all Tx DMA/FIFO channels */
759 	iwl_scd_activate_fifos(trans);
760 
761 	/* Enable DMA channel */
762 	for (chan = 0; chan < FH_TCSR_CHNL_NUM; chan++)
763 		iwl_write_direct32(trans, FH_TCSR_CHNL_TX_CONFIG_REG(chan),
764 				   FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
765 				   FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
766 
767 	/* Update FH chicken bits */
768 	reg_val = iwl_read_direct32(trans, FH_TX_CHICKEN_BITS_REG);
769 	iwl_write_direct32(trans, FH_TX_CHICKEN_BITS_REG,
770 			   reg_val | FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
771 
772 	/* Enable L1-Active */
773 	if (trans->cfg->device_family < IWL_DEVICE_FAMILY_8000)
774 		iwl_clear_bits_prph(trans, APMG_PCIDEV_STT_REG,
775 				    APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
776 }
777 
778 void iwl_trans_pcie_tx_reset(struct iwl_trans *trans)
779 {
780 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
781 	int txq_id;
782 
783 	/*
784 	 * we should never get here in gen2 trans mode return early to avoid
785 	 * having invalid accesses
786 	 */
787 	if (WARN_ON_ONCE(trans->cfg->gen2))
788 		return;
789 
790 	for (txq_id = 0; txq_id < trans->cfg->base_params->num_of_queues;
791 	     txq_id++) {
792 		struct iwl_txq *txq = trans_pcie->txq[txq_id];
793 		if (trans->cfg->use_tfh)
794 			iwl_write_direct64(trans,
795 					   FH_MEM_CBBC_QUEUE(trans, txq_id),
796 					   txq->dma_addr);
797 		else
798 			iwl_write_direct32(trans,
799 					   FH_MEM_CBBC_QUEUE(trans, txq_id),
800 					   txq->dma_addr >> 8);
801 		iwl_pcie_txq_unmap(trans, txq_id);
802 		txq->read_ptr = 0;
803 		txq->write_ptr = 0;
804 	}
805 
806 	/* Tell NIC where to find the "keep warm" buffer */
807 	iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
808 			   trans_pcie->kw.dma >> 4);
809 
810 	/*
811 	 * Send 0 as the scd_base_addr since the device may have be reset
812 	 * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will
813 	 * contain garbage.
814 	 */
815 	iwl_pcie_tx_start(trans, 0);
816 }
817 
818 static void iwl_pcie_tx_stop_fh(struct iwl_trans *trans)
819 {
820 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
821 	unsigned long flags;
822 	int ch, ret;
823 	u32 mask = 0;
824 
825 	spin_lock(&trans_pcie->irq_lock);
826 
827 	if (!iwl_trans_grab_nic_access(trans, &flags))
828 		goto out;
829 
830 	/* Stop each Tx DMA channel */
831 	for (ch = 0; ch < FH_TCSR_CHNL_NUM; ch++) {
832 		iwl_write32(trans, FH_TCSR_CHNL_TX_CONFIG_REG(ch), 0x0);
833 		mask |= FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch);
834 	}
835 
836 	/* Wait for DMA channels to be idle */
837 	ret = iwl_poll_bit(trans, FH_TSSR_TX_STATUS_REG, mask, mask, 5000);
838 	if (ret < 0)
839 		IWL_ERR(trans,
840 			"Failing on timeout while stopping DMA channel %d [0x%08x]\n",
841 			ch, iwl_read32(trans, FH_TSSR_TX_STATUS_REG));
842 
843 	iwl_trans_release_nic_access(trans, &flags);
844 
845 out:
846 	spin_unlock(&trans_pcie->irq_lock);
847 }
848 
849 /*
850  * iwl_pcie_tx_stop - Stop all Tx DMA channels
851  */
852 int iwl_pcie_tx_stop(struct iwl_trans *trans)
853 {
854 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
855 	int txq_id;
856 
857 	/* Turn off all Tx DMA fifos */
858 	iwl_scd_deactivate_fifos(trans);
859 
860 	/* Turn off all Tx DMA channels */
861 	iwl_pcie_tx_stop_fh(trans);
862 
863 	/*
864 	 * This function can be called before the op_mode disabled the
865 	 * queues. This happens when we have an rfkill interrupt.
866 	 * Since we stop Tx altogether - mark the queues as stopped.
867 	 */
868 	memset(trans_pcie->queue_stopped, 0, sizeof(trans_pcie->queue_stopped));
869 	memset(trans_pcie->queue_used, 0, sizeof(trans_pcie->queue_used));
870 
871 	/* This can happen: start_hw, stop_device */
872 	if (!trans_pcie->txq_memory)
873 		return 0;
874 
875 	/* Unmap DMA from host system and free skb's */
876 	for (txq_id = 0; txq_id < trans->cfg->base_params->num_of_queues;
877 	     txq_id++)
878 		iwl_pcie_txq_unmap(trans, txq_id);
879 
880 	return 0;
881 }
882 
883 /*
884  * iwl_trans_tx_free - Free TXQ Context
885  *
886  * Destroy all TX DMA queues and structures
887  */
888 void iwl_pcie_tx_free(struct iwl_trans *trans)
889 {
890 	int txq_id;
891 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
892 
893 	memset(trans_pcie->queue_used, 0, sizeof(trans_pcie->queue_used));
894 
895 	/* Tx queues */
896 	if (trans_pcie->txq_memory) {
897 		for (txq_id = 0;
898 		     txq_id < trans->cfg->base_params->num_of_queues;
899 		     txq_id++) {
900 			iwl_pcie_txq_free(trans, txq_id);
901 			trans_pcie->txq[txq_id] = NULL;
902 		}
903 	}
904 
905 	kfree(trans_pcie->txq_memory);
906 	trans_pcie->txq_memory = NULL;
907 
908 	iwl_pcie_free_dma_ptr(trans, &trans_pcie->kw);
909 
910 	iwl_pcie_free_dma_ptr(trans, &trans_pcie->scd_bc_tbls);
911 }
912 
913 /*
914  * iwl_pcie_tx_alloc - allocate TX context
915  * Allocate all Tx DMA structures and initialize them
916  */
917 static int iwl_pcie_tx_alloc(struct iwl_trans *trans)
918 {
919 	int ret;
920 	int txq_id, slots_num;
921 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
922 	u16 bc_tbls_size = trans->cfg->base_params->num_of_queues;
923 
924 	bc_tbls_size *= (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) ?
925 		sizeof(struct iwl_gen3_bc_tbl) :
926 		sizeof(struct iwlagn_scd_bc_tbl);
927 
928 	/*It is not allowed to alloc twice, so warn when this happens.
929 	 * We cannot rely on the previous allocation, so free and fail */
930 	if (WARN_ON(trans_pcie->txq_memory)) {
931 		ret = -EINVAL;
932 		goto error;
933 	}
934 
935 	ret = iwl_pcie_alloc_dma_ptr(trans, &trans_pcie->scd_bc_tbls,
936 				     bc_tbls_size);
937 	if (ret) {
938 		IWL_ERR(trans, "Scheduler BC Table allocation failed\n");
939 		goto error;
940 	}
941 
942 	/* Alloc keep-warm buffer */
943 	ret = iwl_pcie_alloc_dma_ptr(trans, &trans_pcie->kw, IWL_KW_SIZE);
944 	if (ret) {
945 		IWL_ERR(trans, "Keep Warm allocation failed\n");
946 		goto error;
947 	}
948 
949 	trans_pcie->txq_memory = kcalloc(trans->cfg->base_params->num_of_queues,
950 					 sizeof(struct iwl_txq), GFP_KERNEL);
951 	if (!trans_pcie->txq_memory) {
952 		IWL_ERR(trans, "Not enough memory for txq\n");
953 		ret = -ENOMEM;
954 		goto error;
955 	}
956 
957 	/* Alloc and init all Tx queues, including the command queue (#4/#9) */
958 	for (txq_id = 0; txq_id < trans->cfg->base_params->num_of_queues;
959 	     txq_id++) {
960 		bool cmd_queue = (txq_id == trans_pcie->cmd_queue);
961 
962 		slots_num = cmd_queue ? TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
963 		trans_pcie->txq[txq_id] = &trans_pcie->txq_memory[txq_id];
964 		ret = iwl_pcie_txq_alloc(trans, trans_pcie->txq[txq_id],
965 					 slots_num, cmd_queue);
966 		if (ret) {
967 			IWL_ERR(trans, "Tx %d queue alloc failed\n", txq_id);
968 			goto error;
969 		}
970 		trans_pcie->txq[txq_id]->id = txq_id;
971 	}
972 
973 	return 0;
974 
975 error:
976 	iwl_pcie_tx_free(trans);
977 
978 	return ret;
979 }
980 
981 int iwl_pcie_tx_init(struct iwl_trans *trans)
982 {
983 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
984 	int ret;
985 	int txq_id, slots_num;
986 	bool alloc = false;
987 
988 	if (!trans_pcie->txq_memory) {
989 		ret = iwl_pcie_tx_alloc(trans);
990 		if (ret)
991 			goto error;
992 		alloc = true;
993 	}
994 
995 	spin_lock(&trans_pcie->irq_lock);
996 
997 	/* Turn off all Tx DMA fifos */
998 	iwl_scd_deactivate_fifos(trans);
999 
1000 	/* Tell NIC where to find the "keep warm" buffer */
1001 	iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
1002 			   trans_pcie->kw.dma >> 4);
1003 
1004 	spin_unlock(&trans_pcie->irq_lock);
1005 
1006 	/* Alloc and init all Tx queues, including the command queue (#4/#9) */
1007 	for (txq_id = 0; txq_id < trans->cfg->base_params->num_of_queues;
1008 	     txq_id++) {
1009 		bool cmd_queue = (txq_id == trans_pcie->cmd_queue);
1010 
1011 		slots_num = cmd_queue ? TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
1012 		ret = iwl_pcie_txq_init(trans, trans_pcie->txq[txq_id],
1013 					slots_num, cmd_queue);
1014 		if (ret) {
1015 			IWL_ERR(trans, "Tx %d queue init failed\n", txq_id);
1016 			goto error;
1017 		}
1018 
1019 		/*
1020 		 * Tell nic where to find circular buffer of TFDs for a
1021 		 * given Tx queue, and enable the DMA channel used for that
1022 		 * queue.
1023 		 * Circular buffer (TFD queue in DRAM) physical base address
1024 		 */
1025 		iwl_write_direct32(trans, FH_MEM_CBBC_QUEUE(trans, txq_id),
1026 				   trans_pcie->txq[txq_id]->dma_addr >> 8);
1027 	}
1028 
1029 	iwl_set_bits_prph(trans, SCD_GP_CTRL, SCD_GP_CTRL_AUTO_ACTIVE_MODE);
1030 	if (trans->cfg->base_params->num_of_queues > 20)
1031 		iwl_set_bits_prph(trans, SCD_GP_CTRL,
1032 				  SCD_GP_CTRL_ENABLE_31_QUEUES);
1033 
1034 	return 0;
1035 error:
1036 	/*Upon error, free only if we allocated something */
1037 	if (alloc)
1038 		iwl_pcie_tx_free(trans);
1039 	return ret;
1040 }
1041 
1042 static inline void iwl_pcie_txq_progress(struct iwl_txq *txq)
1043 {
1044 	lockdep_assert_held(&txq->lock);
1045 
1046 	if (!txq->wd_timeout)
1047 		return;
1048 
1049 	/*
1050 	 * station is asleep and we send data - that must
1051 	 * be uAPSD or PS-Poll. Don't rearm the timer.
1052 	 */
1053 	if (txq->frozen)
1054 		return;
1055 
1056 	/*
1057 	 * if empty delete timer, otherwise move timer forward
1058 	 * since we're making progress on this queue
1059 	 */
1060 	if (txq->read_ptr == txq->write_ptr)
1061 		del_timer(&txq->stuck_timer);
1062 	else
1063 		mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
1064 }
1065 
1066 /* Frees buffers until index _not_ inclusive */
1067 void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
1068 			    struct sk_buff_head *skbs)
1069 {
1070 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1071 	struct iwl_txq *txq = trans_pcie->txq[txq_id];
1072 	int tfd_num = iwl_pcie_get_cmd_index(txq, ssn);
1073 	int read_ptr = iwl_pcie_get_cmd_index(txq, txq->read_ptr);
1074 	int last_to_free;
1075 
1076 	/* This function is not meant to release cmd queue*/
1077 	if (WARN_ON(txq_id == trans_pcie->cmd_queue))
1078 		return;
1079 
1080 	spin_lock_bh(&txq->lock);
1081 
1082 	if (!test_bit(txq_id, trans_pcie->queue_used)) {
1083 		IWL_DEBUG_TX_QUEUES(trans, "Q %d inactive - ignoring idx %d\n",
1084 				    txq_id, ssn);
1085 		goto out;
1086 	}
1087 
1088 	if (read_ptr == tfd_num)
1089 		goto out;
1090 
1091 	IWL_DEBUG_TX_REPLY(trans, "[Q %d] %d -> %d (%d)\n",
1092 			   txq_id, txq->read_ptr, tfd_num, ssn);
1093 
1094 	/*Since we free until index _not_ inclusive, the one before index is
1095 	 * the last we will free. This one must be used */
1096 	last_to_free = iwl_queue_dec_wrap(trans, tfd_num);
1097 
1098 	if (!iwl_queue_used(txq, last_to_free)) {
1099 		IWL_ERR(trans,
1100 			"%s: Read index for txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
1101 			__func__, txq_id, last_to_free,
1102 			trans->cfg->base_params->max_tfd_queue_size,
1103 			txq->write_ptr, txq->read_ptr);
1104 		goto out;
1105 	}
1106 
1107 	if (WARN_ON(!skb_queue_empty(skbs)))
1108 		goto out;
1109 
1110 	for (;
1111 	     read_ptr != tfd_num;
1112 	     txq->read_ptr = iwl_queue_inc_wrap(trans, txq->read_ptr),
1113 	     read_ptr = iwl_pcie_get_cmd_index(txq, txq->read_ptr)) {
1114 		struct sk_buff *skb = txq->entries[read_ptr].skb;
1115 
1116 		if (WARN_ON_ONCE(!skb))
1117 			continue;
1118 
1119 		iwl_pcie_free_tso_page(trans_pcie, skb);
1120 
1121 		__skb_queue_tail(skbs, skb);
1122 
1123 		txq->entries[read_ptr].skb = NULL;
1124 
1125 		if (!trans->cfg->use_tfh)
1126 			iwl_pcie_txq_inval_byte_cnt_tbl(trans, txq);
1127 
1128 		iwl_pcie_txq_free_tfd(trans, txq);
1129 	}
1130 
1131 	iwl_pcie_txq_progress(txq);
1132 
1133 	if (iwl_queue_space(trans, txq) > txq->low_mark &&
1134 	    test_bit(txq_id, trans_pcie->queue_stopped)) {
1135 		struct sk_buff_head overflow_skbs;
1136 
1137 		__skb_queue_head_init(&overflow_skbs);
1138 		skb_queue_splice_init(&txq->overflow_q, &overflow_skbs);
1139 
1140 		/*
1141 		 * This is tricky: we are in reclaim path which is non
1142 		 * re-entrant, so noone will try to take the access the
1143 		 * txq data from that path. We stopped tx, so we can't
1144 		 * have tx as well. Bottom line, we can unlock and re-lock
1145 		 * later.
1146 		 */
1147 		spin_unlock_bh(&txq->lock);
1148 
1149 		while (!skb_queue_empty(&overflow_skbs)) {
1150 			struct sk_buff *skb = __skb_dequeue(&overflow_skbs);
1151 			struct iwl_device_cmd *dev_cmd_ptr;
1152 
1153 			dev_cmd_ptr = *(void **)((u8 *)skb->cb +
1154 						 trans_pcie->dev_cmd_offs);
1155 
1156 			/*
1157 			 * Note that we can very well be overflowing again.
1158 			 * In that case, iwl_queue_space will be small again
1159 			 * and we won't wake mac80211's queue.
1160 			 */
1161 			iwl_trans_tx(trans, skb, dev_cmd_ptr, txq_id);
1162 		}
1163 		spin_lock_bh(&txq->lock);
1164 
1165 		if (iwl_queue_space(trans, txq) > txq->low_mark)
1166 			iwl_wake_queue(trans, txq);
1167 	}
1168 
1169 	if (txq->read_ptr == txq->write_ptr) {
1170 		IWL_DEBUG_RPM(trans, "Q %d - last tx reclaimed\n", txq->id);
1171 		iwl_trans_unref(trans);
1172 	}
1173 
1174 out:
1175 	spin_unlock_bh(&txq->lock);
1176 }
1177 
1178 static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
1179 				      const struct iwl_host_cmd *cmd)
1180 {
1181 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1182 	const struct iwl_cfg *cfg = trans->cfg;
1183 	int ret;
1184 
1185 	lockdep_assert_held(&trans_pcie->reg_lock);
1186 
1187 	/* Make sure the NIC is still alive in the bus */
1188 	if (test_bit(STATUS_TRANS_DEAD, &trans->status))
1189 		return -ENODEV;
1190 
1191 	if (!(cmd->flags & CMD_SEND_IN_IDLE) &&
1192 	    !trans_pcie->ref_cmd_in_flight) {
1193 		trans_pcie->ref_cmd_in_flight = true;
1194 		IWL_DEBUG_RPM(trans, "set ref_cmd_in_flight - ref\n");
1195 		iwl_trans_ref(trans);
1196 	}
1197 
1198 	/*
1199 	 * wake up the NIC to make sure that the firmware will see the host
1200 	 * command - we will let the NIC sleep once all the host commands
1201 	 * returned. This needs to be done only on NICs that have
1202 	 * apmg_wake_up_wa set.
1203 	 */
1204 	if (cfg->base_params->apmg_wake_up_wa &&
1205 	    !trans_pcie->cmd_hold_nic_awake) {
1206 		__iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
1207 					 BIT(cfg->csr->flag_mac_access_req));
1208 
1209 		ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
1210 				   BIT(cfg->csr->flag_val_mac_access_en),
1211 				   (BIT(cfg->csr->flag_mac_clock_ready) |
1212 				    CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP),
1213 				   15000);
1214 		if (ret < 0) {
1215 			__iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
1216 					BIT(cfg->csr->flag_mac_access_req));
1217 			IWL_ERR(trans, "Failed to wake NIC for hcmd\n");
1218 			return -EIO;
1219 		}
1220 		trans_pcie->cmd_hold_nic_awake = true;
1221 	}
1222 
1223 	return 0;
1224 }
1225 
1226 /*
1227  * iwl_pcie_cmdq_reclaim - Reclaim TX command queue entries already Tx'd
1228  *
1229  * When FW advances 'R' index, all entries between old and new 'R' index
1230  * need to be reclaimed. As result, some free space forms.  If there is
1231  * enough free space (> low mark), wake the stack that feeds us.
1232  */
1233 void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
1234 {
1235 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1236 	struct iwl_txq *txq = trans_pcie->txq[txq_id];
1237 	unsigned long flags;
1238 	int nfreed = 0;
1239 	u16 r;
1240 
1241 	lockdep_assert_held(&txq->lock);
1242 
1243 	idx = iwl_pcie_get_cmd_index(txq, idx);
1244 	r = iwl_pcie_get_cmd_index(txq, txq->read_ptr);
1245 
1246 	if (idx >= trans->cfg->base_params->max_tfd_queue_size ||
1247 	    (!iwl_queue_used(txq, idx))) {
1248 		IWL_ERR(trans,
1249 			"%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
1250 			__func__, txq_id, idx,
1251 			trans->cfg->base_params->max_tfd_queue_size,
1252 			txq->write_ptr, txq->read_ptr);
1253 		return;
1254 	}
1255 
1256 	for (idx = iwl_queue_inc_wrap(trans, idx); r != idx;
1257 	     r = iwl_queue_inc_wrap(trans, r)) {
1258 		txq->read_ptr = iwl_queue_inc_wrap(trans, txq->read_ptr);
1259 
1260 		if (nfreed++ > 0) {
1261 			IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
1262 				idx, txq->write_ptr, r);
1263 			iwl_force_nmi(trans);
1264 		}
1265 	}
1266 
1267 	if (txq->read_ptr == txq->write_ptr) {
1268 		spin_lock_irqsave(&trans_pcie->reg_lock, flags);
1269 		iwl_pcie_clear_cmd_in_flight(trans);
1270 		spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
1271 	}
1272 
1273 	iwl_pcie_txq_progress(txq);
1274 }
1275 
1276 static int iwl_pcie_txq_set_ratid_map(struct iwl_trans *trans, u16 ra_tid,
1277 				 u16 txq_id)
1278 {
1279 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1280 	u32 tbl_dw_addr;
1281 	u32 tbl_dw;
1282 	u16 scd_q2ratid;
1283 
1284 	scd_q2ratid = ra_tid & SCD_QUEUE_RA_TID_MAP_RATID_MSK;
1285 
1286 	tbl_dw_addr = trans_pcie->scd_base_addr +
1287 			SCD_TRANS_TBL_OFFSET_QUEUE(txq_id);
1288 
1289 	tbl_dw = iwl_trans_read_mem32(trans, tbl_dw_addr);
1290 
1291 	if (txq_id & 0x1)
1292 		tbl_dw = (scd_q2ratid << 16) | (tbl_dw & 0x0000FFFF);
1293 	else
1294 		tbl_dw = scd_q2ratid | (tbl_dw & 0xFFFF0000);
1295 
1296 	iwl_trans_write_mem32(trans, tbl_dw_addr, tbl_dw);
1297 
1298 	return 0;
1299 }
1300 
1301 /* Receiver address (actually, Rx station's index into station table),
1302  * combined with Traffic ID (QOS priority), in format used by Tx Scheduler */
1303 #define BUILD_RAxTID(sta_id, tid)	(((sta_id) << 4) + (tid))
1304 
1305 bool iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
1306 			       const struct iwl_trans_txq_scd_cfg *cfg,
1307 			       unsigned int wdg_timeout)
1308 {
1309 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1310 	struct iwl_txq *txq = trans_pcie->txq[txq_id];
1311 	int fifo = -1;
1312 	bool scd_bug = false;
1313 
1314 	if (test_and_set_bit(txq_id, trans_pcie->queue_used))
1315 		WARN_ONCE(1, "queue %d already used - expect issues", txq_id);
1316 
1317 	txq->wd_timeout = msecs_to_jiffies(wdg_timeout);
1318 
1319 	if (cfg) {
1320 		fifo = cfg->fifo;
1321 
1322 		/* Disable the scheduler prior configuring the cmd queue */
1323 		if (txq_id == trans_pcie->cmd_queue &&
1324 		    trans_pcie->scd_set_active)
1325 			iwl_scd_enable_set_active(trans, 0);
1326 
1327 		/* Stop this Tx queue before configuring it */
1328 		iwl_scd_txq_set_inactive(trans, txq_id);
1329 
1330 		/* Set this queue as a chain-building queue unless it is CMD */
1331 		if (txq_id != trans_pcie->cmd_queue)
1332 			iwl_scd_txq_set_chain(trans, txq_id);
1333 
1334 		if (cfg->aggregate) {
1335 			u16 ra_tid = BUILD_RAxTID(cfg->sta_id, cfg->tid);
1336 
1337 			/* Map receiver-address / traffic-ID to this queue */
1338 			iwl_pcie_txq_set_ratid_map(trans, ra_tid, txq_id);
1339 
1340 			/* enable aggregations for the queue */
1341 			iwl_scd_txq_enable_agg(trans, txq_id);
1342 			txq->ampdu = true;
1343 		} else {
1344 			/*
1345 			 * disable aggregations for the queue, this will also
1346 			 * make the ra_tid mapping configuration irrelevant
1347 			 * since it is now a non-AGG queue.
1348 			 */
1349 			iwl_scd_txq_disable_agg(trans, txq_id);
1350 
1351 			ssn = txq->read_ptr;
1352 		}
1353 	} else {
1354 		/*
1355 		 * If we need to move the SCD write pointer by steps of
1356 		 * 0x40, 0x80 or 0xc0, it gets stuck. Avoids this and let
1357 		 * the op_mode know by returning true later.
1358 		 * Do this only in case cfg is NULL since this trick can
1359 		 * be done only if we have DQA enabled which is true for mvm
1360 		 * only. And mvm never sets a cfg pointer.
1361 		 * This is really ugly, but this is the easiest way out for
1362 		 * this sad hardware issue.
1363 		 * This bug has been fixed on devices 9000 and up.
1364 		 */
1365 		scd_bug = !trans->cfg->mq_rx_supported &&
1366 			!((ssn - txq->write_ptr) & 0x3f) &&
1367 			(ssn != txq->write_ptr);
1368 		if (scd_bug)
1369 			ssn++;
1370 	}
1371 
1372 	/* Place first TFD at index corresponding to start sequence number.
1373 	 * Assumes that ssn_idx is valid (!= 0xFFF) */
1374 	txq->read_ptr = (ssn & 0xff);
1375 	txq->write_ptr = (ssn & 0xff);
1376 	iwl_write_direct32(trans, HBUS_TARG_WRPTR,
1377 			   (ssn & 0xff) | (txq_id << 8));
1378 
1379 	if (cfg) {
1380 		u8 frame_limit = cfg->frame_limit;
1381 
1382 		iwl_write_prph(trans, SCD_QUEUE_RDPTR(txq_id), ssn);
1383 
1384 		/* Set up Tx window size and frame limit for this queue */
1385 		iwl_trans_write_mem32(trans, trans_pcie->scd_base_addr +
1386 				SCD_CONTEXT_QUEUE_OFFSET(txq_id), 0);
1387 		iwl_trans_write_mem32(trans,
1388 			trans_pcie->scd_base_addr +
1389 			SCD_CONTEXT_QUEUE_OFFSET(txq_id) + sizeof(u32),
1390 			SCD_QUEUE_CTX_REG2_VAL(WIN_SIZE, frame_limit) |
1391 			SCD_QUEUE_CTX_REG2_VAL(FRAME_LIMIT, frame_limit));
1392 
1393 		/* Set up status area in SRAM, map to Tx DMA/FIFO, activate */
1394 		iwl_write_prph(trans, SCD_QUEUE_STATUS_BITS(txq_id),
1395 			       (1 << SCD_QUEUE_STTS_REG_POS_ACTIVE) |
1396 			       (cfg->fifo << SCD_QUEUE_STTS_REG_POS_TXF) |
1397 			       (1 << SCD_QUEUE_STTS_REG_POS_WSL) |
1398 			       SCD_QUEUE_STTS_REG_MSK);
1399 
1400 		/* enable the scheduler for this queue (only) */
1401 		if (txq_id == trans_pcie->cmd_queue &&
1402 		    trans_pcie->scd_set_active)
1403 			iwl_scd_enable_set_active(trans, BIT(txq_id));
1404 
1405 		IWL_DEBUG_TX_QUEUES(trans,
1406 				    "Activate queue %d on FIFO %d WrPtr: %d\n",
1407 				    txq_id, fifo, ssn & 0xff);
1408 	} else {
1409 		IWL_DEBUG_TX_QUEUES(trans,
1410 				    "Activate queue %d WrPtr: %d\n",
1411 				    txq_id, ssn & 0xff);
1412 	}
1413 
1414 	return scd_bug;
1415 }
1416 
1417 void iwl_trans_pcie_txq_set_shared_mode(struct iwl_trans *trans, u32 txq_id,
1418 					bool shared_mode)
1419 {
1420 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1421 	struct iwl_txq *txq = trans_pcie->txq[txq_id];
1422 
1423 	txq->ampdu = !shared_mode;
1424 }
1425 
1426 void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int txq_id,
1427 				bool configure_scd)
1428 {
1429 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1430 	u32 stts_addr = trans_pcie->scd_base_addr +
1431 			SCD_TX_STTS_QUEUE_OFFSET(txq_id);
1432 	static const u32 zero_val[4] = {};
1433 
1434 	trans_pcie->txq[txq_id]->frozen_expiry_remainder = 0;
1435 	trans_pcie->txq[txq_id]->frozen = false;
1436 
1437 	/*
1438 	 * Upon HW Rfkill - we stop the device, and then stop the queues
1439 	 * in the op_mode. Just for the sake of the simplicity of the op_mode,
1440 	 * allow the op_mode to call txq_disable after it already called
1441 	 * stop_device.
1442 	 */
1443 	if (!test_and_clear_bit(txq_id, trans_pcie->queue_used)) {
1444 		WARN_ONCE(test_bit(STATUS_DEVICE_ENABLED, &trans->status),
1445 			  "queue %d not used", txq_id);
1446 		return;
1447 	}
1448 
1449 	if (configure_scd) {
1450 		iwl_scd_txq_set_inactive(trans, txq_id);
1451 
1452 		iwl_trans_write_mem(trans, stts_addr, (void *)zero_val,
1453 				    ARRAY_SIZE(zero_val));
1454 	}
1455 
1456 	iwl_pcie_txq_unmap(trans, txq_id);
1457 	trans_pcie->txq[txq_id]->ampdu = false;
1458 
1459 	IWL_DEBUG_TX_QUEUES(trans, "Deactivate queue %d\n", txq_id);
1460 }
1461 
1462 /*************** HOST COMMAND QUEUE FUNCTIONS   *****/
1463 
1464 /*
1465  * iwl_pcie_enqueue_hcmd - enqueue a uCode command
1466  * @priv: device private data point
1467  * @cmd: a pointer to the ucode command structure
1468  *
1469  * The function returns < 0 values to indicate the operation
1470  * failed. On success, it returns the index (>= 0) of command in the
1471  * command queue.
1472  */
1473 static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
1474 				 struct iwl_host_cmd *cmd)
1475 {
1476 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1477 	struct iwl_txq *txq = trans_pcie->txq[trans_pcie->cmd_queue];
1478 	struct iwl_device_cmd *out_cmd;
1479 	struct iwl_cmd_meta *out_meta;
1480 	unsigned long flags;
1481 	void *dup_buf = NULL;
1482 	dma_addr_t phys_addr;
1483 	int idx;
1484 	u16 copy_size, cmd_size, tb0_size;
1485 	bool had_nocopy = false;
1486 	u8 group_id = iwl_cmd_groupid(cmd->id);
1487 	int i, ret;
1488 	u32 cmd_pos;
1489 	const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
1490 	u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
1491 
1492 	if (WARN(!trans->wide_cmd_header &&
1493 		 group_id > IWL_ALWAYS_LONG_GROUP,
1494 		 "unsupported wide command %#x\n", cmd->id))
1495 		return -EINVAL;
1496 
1497 	if (group_id != 0) {
1498 		copy_size = sizeof(struct iwl_cmd_header_wide);
1499 		cmd_size = sizeof(struct iwl_cmd_header_wide);
1500 	} else {
1501 		copy_size = sizeof(struct iwl_cmd_header);
1502 		cmd_size = sizeof(struct iwl_cmd_header);
1503 	}
1504 
1505 	/* need one for the header if the first is NOCOPY */
1506 	BUILD_BUG_ON(IWL_MAX_CMD_TBS_PER_TFD > IWL_NUM_OF_TBS - 1);
1507 
1508 	for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
1509 		cmddata[i] = cmd->data[i];
1510 		cmdlen[i] = cmd->len[i];
1511 
1512 		if (!cmd->len[i])
1513 			continue;
1514 
1515 		/* need at least IWL_FIRST_TB_SIZE copied */
1516 		if (copy_size < IWL_FIRST_TB_SIZE) {
1517 			int copy = IWL_FIRST_TB_SIZE - copy_size;
1518 
1519 			if (copy > cmdlen[i])
1520 				copy = cmdlen[i];
1521 			cmdlen[i] -= copy;
1522 			cmddata[i] += copy;
1523 			copy_size += copy;
1524 		}
1525 
1526 		if (cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY) {
1527 			had_nocopy = true;
1528 			if (WARN_ON(cmd->dataflags[i] & IWL_HCMD_DFL_DUP)) {
1529 				idx = -EINVAL;
1530 				goto free_dup_buf;
1531 			}
1532 		} else if (cmd->dataflags[i] & IWL_HCMD_DFL_DUP) {
1533 			/*
1534 			 * This is also a chunk that isn't copied
1535 			 * to the static buffer so set had_nocopy.
1536 			 */
1537 			had_nocopy = true;
1538 
1539 			/* only allowed once */
1540 			if (WARN_ON(dup_buf)) {
1541 				idx = -EINVAL;
1542 				goto free_dup_buf;
1543 			}
1544 
1545 			dup_buf = kmemdup(cmddata[i], cmdlen[i],
1546 					  GFP_ATOMIC);
1547 			if (!dup_buf)
1548 				return -ENOMEM;
1549 		} else {
1550 			/* NOCOPY must not be followed by normal! */
1551 			if (WARN_ON(had_nocopy)) {
1552 				idx = -EINVAL;
1553 				goto free_dup_buf;
1554 			}
1555 			copy_size += cmdlen[i];
1556 		}
1557 		cmd_size += cmd->len[i];
1558 	}
1559 
1560 	/*
1561 	 * If any of the command structures end up being larger than
1562 	 * the TFD_MAX_PAYLOAD_SIZE and they aren't dynamically
1563 	 * allocated into separate TFDs, then we will need to
1564 	 * increase the size of the buffers.
1565 	 */
1566 	if (WARN(copy_size > TFD_MAX_PAYLOAD_SIZE,
1567 		 "Command %s (%#x) is too large (%d bytes)\n",
1568 		 iwl_get_cmd_string(trans, cmd->id),
1569 		 cmd->id, copy_size)) {
1570 		idx = -EINVAL;
1571 		goto free_dup_buf;
1572 	}
1573 
1574 	spin_lock_bh(&txq->lock);
1575 
1576 	if (iwl_queue_space(trans, txq) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
1577 		spin_unlock_bh(&txq->lock);
1578 
1579 		IWL_ERR(trans, "No space in command queue\n");
1580 		iwl_op_mode_cmd_queue_full(trans->op_mode);
1581 		idx = -ENOSPC;
1582 		goto free_dup_buf;
1583 	}
1584 
1585 	idx = iwl_pcie_get_cmd_index(txq, txq->write_ptr);
1586 	out_cmd = txq->entries[idx].cmd;
1587 	out_meta = &txq->entries[idx].meta;
1588 
1589 	memset(out_meta, 0, sizeof(*out_meta));	/* re-initialize to NULL */
1590 	if (cmd->flags & CMD_WANT_SKB)
1591 		out_meta->source = cmd;
1592 
1593 	/* set up the header */
1594 	if (group_id != 0) {
1595 		out_cmd->hdr_wide.cmd = iwl_cmd_opcode(cmd->id);
1596 		out_cmd->hdr_wide.group_id = group_id;
1597 		out_cmd->hdr_wide.version = iwl_cmd_version(cmd->id);
1598 		out_cmd->hdr_wide.length =
1599 			cpu_to_le16(cmd_size -
1600 				    sizeof(struct iwl_cmd_header_wide));
1601 		out_cmd->hdr_wide.reserved = 0;
1602 		out_cmd->hdr_wide.sequence =
1603 			cpu_to_le16(QUEUE_TO_SEQ(trans_pcie->cmd_queue) |
1604 						 INDEX_TO_SEQ(txq->write_ptr));
1605 
1606 		cmd_pos = sizeof(struct iwl_cmd_header_wide);
1607 		copy_size = sizeof(struct iwl_cmd_header_wide);
1608 	} else {
1609 		out_cmd->hdr.cmd = iwl_cmd_opcode(cmd->id);
1610 		out_cmd->hdr.sequence =
1611 			cpu_to_le16(QUEUE_TO_SEQ(trans_pcie->cmd_queue) |
1612 						 INDEX_TO_SEQ(txq->write_ptr));
1613 		out_cmd->hdr.group_id = 0;
1614 
1615 		cmd_pos = sizeof(struct iwl_cmd_header);
1616 		copy_size = sizeof(struct iwl_cmd_header);
1617 	}
1618 
1619 	/* and copy the data that needs to be copied */
1620 	for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
1621 		int copy;
1622 
1623 		if (!cmd->len[i])
1624 			continue;
1625 
1626 		/* copy everything if not nocopy/dup */
1627 		if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
1628 					   IWL_HCMD_DFL_DUP))) {
1629 			copy = cmd->len[i];
1630 
1631 			memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
1632 			cmd_pos += copy;
1633 			copy_size += copy;
1634 			continue;
1635 		}
1636 
1637 		/*
1638 		 * Otherwise we need at least IWL_FIRST_TB_SIZE copied
1639 		 * in total (for bi-directional DMA), but copy up to what
1640 		 * we can fit into the payload for debug dump purposes.
1641 		 */
1642 		copy = min_t(int, TFD_MAX_PAYLOAD_SIZE - cmd_pos, cmd->len[i]);
1643 
1644 		memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
1645 		cmd_pos += copy;
1646 
1647 		/* However, treat copy_size the proper way, we need it below */
1648 		if (copy_size < IWL_FIRST_TB_SIZE) {
1649 			copy = IWL_FIRST_TB_SIZE - copy_size;
1650 
1651 			if (copy > cmd->len[i])
1652 				copy = cmd->len[i];
1653 			copy_size += copy;
1654 		}
1655 	}
1656 
1657 	IWL_DEBUG_HC(trans,
1658 		     "Sending command %s (%.2x.%.2x), seq: 0x%04X, %d bytes at %d[%d]:%d\n",
1659 		     iwl_get_cmd_string(trans, cmd->id),
1660 		     group_id, out_cmd->hdr.cmd,
1661 		     le16_to_cpu(out_cmd->hdr.sequence),
1662 		     cmd_size, txq->write_ptr, idx, trans_pcie->cmd_queue);
1663 
1664 	/* start the TFD with the minimum copy bytes */
1665 	tb0_size = min_t(int, copy_size, IWL_FIRST_TB_SIZE);
1666 	memcpy(&txq->first_tb_bufs[idx], &out_cmd->hdr, tb0_size);
1667 	iwl_pcie_txq_build_tfd(trans, txq,
1668 			       iwl_pcie_get_first_tb_dma(txq, idx),
1669 			       tb0_size, true);
1670 
1671 	/* map first command fragment, if any remains */
1672 	if (copy_size > tb0_size) {
1673 		phys_addr = dma_map_single(trans->dev,
1674 					   ((u8 *)&out_cmd->hdr) + tb0_size,
1675 					   copy_size - tb0_size,
1676 					   DMA_TO_DEVICE);
1677 		if (dma_mapping_error(trans->dev, phys_addr)) {
1678 			iwl_pcie_tfd_unmap(trans, out_meta, txq,
1679 					   txq->write_ptr);
1680 			idx = -ENOMEM;
1681 			goto out;
1682 		}
1683 
1684 		iwl_pcie_txq_build_tfd(trans, txq, phys_addr,
1685 				       copy_size - tb0_size, false);
1686 	}
1687 
1688 	/* map the remaining (adjusted) nocopy/dup fragments */
1689 	for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
1690 		const void *data = cmddata[i];
1691 
1692 		if (!cmdlen[i])
1693 			continue;
1694 		if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
1695 					   IWL_HCMD_DFL_DUP)))
1696 			continue;
1697 		if (cmd->dataflags[i] & IWL_HCMD_DFL_DUP)
1698 			data = dup_buf;
1699 		phys_addr = dma_map_single(trans->dev, (void *)data,
1700 					   cmdlen[i], DMA_TO_DEVICE);
1701 		if (dma_mapping_error(trans->dev, phys_addr)) {
1702 			iwl_pcie_tfd_unmap(trans, out_meta, txq,
1703 					   txq->write_ptr);
1704 			idx = -ENOMEM;
1705 			goto out;
1706 		}
1707 
1708 		iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], false);
1709 	}
1710 
1711 	BUILD_BUG_ON(IWL_TFH_NUM_TBS > sizeof(out_meta->tbs) * BITS_PER_BYTE);
1712 	out_meta->flags = cmd->flags;
1713 	if (WARN_ON_ONCE(txq->entries[idx].free_buf))
1714 		kzfree(txq->entries[idx].free_buf);
1715 	txq->entries[idx].free_buf = dup_buf;
1716 
1717 	trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr_wide);
1718 
1719 	/* start timer if queue currently empty */
1720 	if (txq->read_ptr == txq->write_ptr && txq->wd_timeout)
1721 		mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
1722 
1723 	spin_lock_irqsave(&trans_pcie->reg_lock, flags);
1724 	ret = iwl_pcie_set_cmd_in_flight(trans, cmd);
1725 	if (ret < 0) {
1726 		idx = ret;
1727 		spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
1728 		goto out;
1729 	}
1730 
1731 	/* Increment and update queue's write index */
1732 	txq->write_ptr = iwl_queue_inc_wrap(trans, txq->write_ptr);
1733 	iwl_pcie_txq_inc_wr_ptr(trans, txq);
1734 
1735 	spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
1736 
1737  out:
1738 	spin_unlock_bh(&txq->lock);
1739  free_dup_buf:
1740 	if (idx < 0)
1741 		kfree(dup_buf);
1742 	return idx;
1743 }
1744 
1745 /*
1746  * iwl_pcie_hcmd_complete - Pull unused buffers off the queue and reclaim them
1747  * @rxb: Rx buffer to reclaim
1748  */
1749 void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
1750 			    struct iwl_rx_cmd_buffer *rxb)
1751 {
1752 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1753 	u16 sequence = le16_to_cpu(pkt->hdr.sequence);
1754 	u8 group_id;
1755 	u32 cmd_id;
1756 	int txq_id = SEQ_TO_QUEUE(sequence);
1757 	int index = SEQ_TO_INDEX(sequence);
1758 	int cmd_index;
1759 	struct iwl_device_cmd *cmd;
1760 	struct iwl_cmd_meta *meta;
1761 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1762 	struct iwl_txq *txq = trans_pcie->txq[trans_pcie->cmd_queue];
1763 
1764 	/* If a Tx command is being handled and it isn't in the actual
1765 	 * command queue then there a command routing bug has been introduced
1766 	 * in the queue management code. */
1767 	if (WARN(txq_id != trans_pcie->cmd_queue,
1768 		 "wrong command queue %d (should be %d), sequence 0x%X readp=%d writep=%d\n",
1769 		 txq_id, trans_pcie->cmd_queue, sequence, txq->read_ptr,
1770 		 txq->write_ptr)) {
1771 		iwl_print_hex_error(trans, pkt, 32);
1772 		return;
1773 	}
1774 
1775 	spin_lock_bh(&txq->lock);
1776 
1777 	cmd_index = iwl_pcie_get_cmd_index(txq, index);
1778 	cmd = txq->entries[cmd_index].cmd;
1779 	meta = &txq->entries[cmd_index].meta;
1780 	group_id = cmd->hdr.group_id;
1781 	cmd_id = iwl_cmd_id(cmd->hdr.cmd, group_id, 0);
1782 
1783 	iwl_pcie_tfd_unmap(trans, meta, txq, index);
1784 
1785 	/* Input error checking is done when commands are added to queue. */
1786 	if (meta->flags & CMD_WANT_SKB) {
1787 		struct page *p = rxb_steal_page(rxb);
1788 
1789 		meta->source->resp_pkt = pkt;
1790 		meta->source->_rx_page_addr = (unsigned long)page_address(p);
1791 		meta->source->_rx_page_order = trans_pcie->rx_page_order;
1792 	}
1793 
1794 	if (meta->flags & CMD_WANT_ASYNC_CALLBACK)
1795 		iwl_op_mode_async_cb(trans->op_mode, cmd);
1796 
1797 	iwl_pcie_cmdq_reclaim(trans, txq_id, index);
1798 
1799 	if (!(meta->flags & CMD_ASYNC)) {
1800 		if (!test_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status)) {
1801 			IWL_WARN(trans,
1802 				 "HCMD_ACTIVE already clear for command %s\n",
1803 				 iwl_get_cmd_string(trans, cmd_id));
1804 		}
1805 		clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
1806 		IWL_DEBUG_INFO(trans, "Clearing HCMD_ACTIVE for command %s\n",
1807 			       iwl_get_cmd_string(trans, cmd_id));
1808 		wake_up(&trans_pcie->wait_command_queue);
1809 	}
1810 
1811 	if (meta->flags & CMD_MAKE_TRANS_IDLE) {
1812 		IWL_DEBUG_INFO(trans, "complete %s - mark trans as idle\n",
1813 			       iwl_get_cmd_string(trans, cmd->hdr.cmd));
1814 		set_bit(STATUS_TRANS_IDLE, &trans->status);
1815 		wake_up(&trans_pcie->d0i3_waitq);
1816 	}
1817 
1818 	if (meta->flags & CMD_WAKE_UP_TRANS) {
1819 		IWL_DEBUG_INFO(trans, "complete %s - clear trans idle flag\n",
1820 			       iwl_get_cmd_string(trans, cmd->hdr.cmd));
1821 		clear_bit(STATUS_TRANS_IDLE, &trans->status);
1822 		wake_up(&trans_pcie->d0i3_waitq);
1823 	}
1824 
1825 	meta->flags = 0;
1826 
1827 	spin_unlock_bh(&txq->lock);
1828 }
1829 
1830 #define HOST_COMPLETE_TIMEOUT	(2 * HZ)
1831 
1832 static int iwl_pcie_send_hcmd_async(struct iwl_trans *trans,
1833 				    struct iwl_host_cmd *cmd)
1834 {
1835 	int ret;
1836 
1837 	/* An asynchronous command can not expect an SKB to be set. */
1838 	if (WARN_ON(cmd->flags & CMD_WANT_SKB))
1839 		return -EINVAL;
1840 
1841 	ret = iwl_pcie_enqueue_hcmd(trans, cmd);
1842 	if (ret < 0) {
1843 		IWL_ERR(trans,
1844 			"Error sending %s: enqueue_hcmd failed: %d\n",
1845 			iwl_get_cmd_string(trans, cmd->id), ret);
1846 		return ret;
1847 	}
1848 	return 0;
1849 }
1850 
1851 static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
1852 				   struct iwl_host_cmd *cmd)
1853 {
1854 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1855 	struct iwl_txq *txq = trans_pcie->txq[trans_pcie->cmd_queue];
1856 	int cmd_idx;
1857 	int ret;
1858 
1859 	IWL_DEBUG_INFO(trans, "Attempting to send sync command %s\n",
1860 		       iwl_get_cmd_string(trans, cmd->id));
1861 
1862 	if (WARN(test_and_set_bit(STATUS_SYNC_HCMD_ACTIVE,
1863 				  &trans->status),
1864 		 "Command %s: a command is already active!\n",
1865 		 iwl_get_cmd_string(trans, cmd->id)))
1866 		return -EIO;
1867 
1868 	IWL_DEBUG_INFO(trans, "Setting HCMD_ACTIVE for command %s\n",
1869 		       iwl_get_cmd_string(trans, cmd->id));
1870 
1871 	if (pm_runtime_suspended(&trans_pcie->pci_dev->dev)) {
1872 		ret = wait_event_timeout(trans_pcie->d0i3_waitq,
1873 				 pm_runtime_active(&trans_pcie->pci_dev->dev),
1874 				 msecs_to_jiffies(IWL_TRANS_IDLE_TIMEOUT));
1875 		if (!ret) {
1876 			IWL_ERR(trans, "Timeout exiting D0i3 before hcmd\n");
1877 			return -ETIMEDOUT;
1878 		}
1879 	}
1880 
1881 	cmd_idx = iwl_pcie_enqueue_hcmd(trans, cmd);
1882 	if (cmd_idx < 0) {
1883 		ret = cmd_idx;
1884 		clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
1885 		IWL_ERR(trans,
1886 			"Error sending %s: enqueue_hcmd failed: %d\n",
1887 			iwl_get_cmd_string(trans, cmd->id), ret);
1888 		return ret;
1889 	}
1890 
1891 	ret = wait_event_timeout(trans_pcie->wait_command_queue,
1892 				 !test_bit(STATUS_SYNC_HCMD_ACTIVE,
1893 					   &trans->status),
1894 				 HOST_COMPLETE_TIMEOUT);
1895 	if (!ret) {
1896 		IWL_ERR(trans, "Error sending %s: time out after %dms.\n",
1897 			iwl_get_cmd_string(trans, cmd->id),
1898 			jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
1899 
1900 		IWL_ERR(trans, "Current CMD queue read_ptr %d write_ptr %d\n",
1901 			txq->read_ptr, txq->write_ptr);
1902 
1903 		clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
1904 		IWL_DEBUG_INFO(trans, "Clearing HCMD_ACTIVE for command %s\n",
1905 			       iwl_get_cmd_string(trans, cmd->id));
1906 		ret = -ETIMEDOUT;
1907 
1908 		iwl_force_nmi(trans);
1909 		iwl_trans_fw_error(trans);
1910 
1911 		goto cancel;
1912 	}
1913 
1914 	if (test_bit(STATUS_FW_ERROR, &trans->status)) {
1915 		iwl_trans_pcie_dump_regs(trans);
1916 		IWL_ERR(trans, "FW error in SYNC CMD %s\n",
1917 			iwl_get_cmd_string(trans, cmd->id));
1918 		dump_stack();
1919 		ret = -EIO;
1920 		goto cancel;
1921 	}
1922 
1923 	if (!(cmd->flags & CMD_SEND_IN_RFKILL) &&
1924 	    test_bit(STATUS_RFKILL_OPMODE, &trans->status)) {
1925 		IWL_DEBUG_RF_KILL(trans, "RFKILL in SYNC CMD... no rsp\n");
1926 		ret = -ERFKILL;
1927 		goto cancel;
1928 	}
1929 
1930 	if ((cmd->flags & CMD_WANT_SKB) && !cmd->resp_pkt) {
1931 		IWL_ERR(trans, "Error: Response NULL in '%s'\n",
1932 			iwl_get_cmd_string(trans, cmd->id));
1933 		ret = -EIO;
1934 		goto cancel;
1935 	}
1936 
1937 	return 0;
1938 
1939 cancel:
1940 	if (cmd->flags & CMD_WANT_SKB) {
1941 		/*
1942 		 * Cancel the CMD_WANT_SKB flag for the cmd in the
1943 		 * TX cmd queue. Otherwise in case the cmd comes
1944 		 * in later, it will possibly set an invalid
1945 		 * address (cmd->meta.source).
1946 		 */
1947 		txq->entries[cmd_idx].meta.flags &= ~CMD_WANT_SKB;
1948 	}
1949 
1950 	if (cmd->resp_pkt) {
1951 		iwl_free_resp(cmd);
1952 		cmd->resp_pkt = NULL;
1953 	}
1954 
1955 	return ret;
1956 }
1957 
1958 int iwl_trans_pcie_send_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
1959 {
1960 	/* Make sure the NIC is still alive in the bus */
1961 	if (test_bit(STATUS_TRANS_DEAD, &trans->status))
1962 		return -ENODEV;
1963 
1964 	if (!(cmd->flags & CMD_SEND_IN_RFKILL) &&
1965 	    test_bit(STATUS_RFKILL_OPMODE, &trans->status)) {
1966 		IWL_DEBUG_RF_KILL(trans, "Dropping CMD 0x%x: RF KILL\n",
1967 				  cmd->id);
1968 		return -ERFKILL;
1969 	}
1970 
1971 	if (cmd->flags & CMD_ASYNC)
1972 		return iwl_pcie_send_hcmd_async(trans, cmd);
1973 
1974 	/* We still can fail on RFKILL that can be asserted while we wait */
1975 	return iwl_pcie_send_hcmd_sync(trans, cmd);
1976 }
1977 
1978 static int iwl_fill_data_tbs(struct iwl_trans *trans, struct sk_buff *skb,
1979 			     struct iwl_txq *txq, u8 hdr_len,
1980 			     struct iwl_cmd_meta *out_meta)
1981 {
1982 	u16 head_tb_len;
1983 	int i;
1984 
1985 	/*
1986 	 * Set up TFD's third entry to point directly to remainder
1987 	 * of skb's head, if any
1988 	 */
1989 	head_tb_len = skb_headlen(skb) - hdr_len;
1990 
1991 	if (head_tb_len > 0) {
1992 		dma_addr_t tb_phys = dma_map_single(trans->dev,
1993 						    skb->data + hdr_len,
1994 						    head_tb_len, DMA_TO_DEVICE);
1995 		if (unlikely(dma_mapping_error(trans->dev, tb_phys)))
1996 			return -EINVAL;
1997 		trace_iwlwifi_dev_tx_tb(trans->dev, skb,
1998 					skb->data + hdr_len,
1999 					head_tb_len);
2000 		iwl_pcie_txq_build_tfd(trans, txq, tb_phys, head_tb_len, false);
2001 	}
2002 
2003 	/* set up the remaining entries to point to the data */
2004 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
2005 		const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
2006 		dma_addr_t tb_phys;
2007 		int tb_idx;
2008 
2009 		if (!skb_frag_size(frag))
2010 			continue;
2011 
2012 		tb_phys = skb_frag_dma_map(trans->dev, frag, 0,
2013 					   skb_frag_size(frag), DMA_TO_DEVICE);
2014 
2015 		if (unlikely(dma_mapping_error(trans->dev, tb_phys)))
2016 			return -EINVAL;
2017 		trace_iwlwifi_dev_tx_tb(trans->dev, skb,
2018 					skb_frag_address(frag),
2019 					skb_frag_size(frag));
2020 		tb_idx = iwl_pcie_txq_build_tfd(trans, txq, tb_phys,
2021 						skb_frag_size(frag), false);
2022 		if (tb_idx < 0)
2023 			return tb_idx;
2024 
2025 		out_meta->tbs |= BIT(tb_idx);
2026 	}
2027 
2028 	return 0;
2029 }
2030 
2031 #ifdef CONFIG_INET
2032 struct iwl_tso_hdr_page *get_page_hdr(struct iwl_trans *trans, size_t len)
2033 {
2034 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
2035 	struct iwl_tso_hdr_page *p = this_cpu_ptr(trans_pcie->tso_hdr_page);
2036 
2037 	if (!p->page)
2038 		goto alloc;
2039 
2040 	/* enough room on this page */
2041 	if (p->pos + len < (u8 *)page_address(p->page) + PAGE_SIZE)
2042 		return p;
2043 
2044 	/* We don't have enough room on this page, get a new one. */
2045 	__free_page(p->page);
2046 
2047 alloc:
2048 	p->page = alloc_page(GFP_ATOMIC);
2049 	if (!p->page)
2050 		return NULL;
2051 	p->pos = page_address(p->page);
2052 	return p;
2053 }
2054 
2055 static void iwl_compute_pseudo_hdr_csum(void *iph, struct tcphdr *tcph,
2056 					bool ipv6, unsigned int len)
2057 {
2058 	if (ipv6) {
2059 		struct ipv6hdr *iphv6 = iph;
2060 
2061 		tcph->check = ~csum_ipv6_magic(&iphv6->saddr, &iphv6->daddr,
2062 					       len + tcph->doff * 4,
2063 					       IPPROTO_TCP, 0);
2064 	} else {
2065 		struct iphdr *iphv4 = iph;
2066 
2067 		ip_send_check(iphv4);
2068 		tcph->check = ~csum_tcpudp_magic(iphv4->saddr, iphv4->daddr,
2069 						 len + tcph->doff * 4,
2070 						 IPPROTO_TCP, 0);
2071 	}
2072 }
2073 
2074 static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,
2075 				   struct iwl_txq *txq, u8 hdr_len,
2076 				   struct iwl_cmd_meta *out_meta,
2077 				   struct iwl_device_cmd *dev_cmd, u16 tb1_len)
2078 {
2079 	struct iwl_tx_cmd *tx_cmd = (void *)dev_cmd->payload;
2080 	struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
2081 	struct ieee80211_hdr *hdr = (void *)skb->data;
2082 	unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room;
2083 	unsigned int mss = skb_shinfo(skb)->gso_size;
2084 	u16 length, iv_len, amsdu_pad;
2085 	u8 *start_hdr;
2086 	struct iwl_tso_hdr_page *hdr_page;
2087 	struct page **page_ptr;
2088 	struct tso_t tso;
2089 
2090 	/* if the packet is protected, then it must be CCMP or GCMP */
2091 	BUILD_BUG_ON(IEEE80211_CCMP_HDR_LEN != IEEE80211_GCMP_HDR_LEN);
2092 	iv_len = ieee80211_has_protected(hdr->frame_control) ?
2093 		IEEE80211_CCMP_HDR_LEN : 0;
2094 
2095 	trace_iwlwifi_dev_tx(trans->dev, skb,
2096 			     iwl_pcie_get_tfd(trans, txq, txq->write_ptr),
2097 			     trans_pcie->tfd_size,
2098 			     &dev_cmd->hdr, IWL_FIRST_TB_SIZE + tb1_len, 0);
2099 
2100 	ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb);
2101 	snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb);
2102 	total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len;
2103 	amsdu_pad = 0;
2104 
2105 	/* total amount of header we may need for this A-MSDU */
2106 	hdr_room = DIV_ROUND_UP(total_len, mss) *
2107 		(3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len;
2108 
2109 	/* Our device supports 9 segments at most, it will fit in 1 page */
2110 	hdr_page = get_page_hdr(trans, hdr_room);
2111 	if (!hdr_page)
2112 		return -ENOMEM;
2113 
2114 	get_page(hdr_page->page);
2115 	start_hdr = hdr_page->pos;
2116 	page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs);
2117 	*page_ptr = hdr_page->page;
2118 	memcpy(hdr_page->pos, skb->data + hdr_len, iv_len);
2119 	hdr_page->pos += iv_len;
2120 
2121 	/*
2122 	 * Pull the ieee80211 header + IV to be able to use TSO core,
2123 	 * we will restore it for the tx_status flow.
2124 	 */
2125 	skb_pull(skb, hdr_len + iv_len);
2126 
2127 	/*
2128 	 * Remove the length of all the headers that we don't actually
2129 	 * have in the MPDU by themselves, but that we duplicate into
2130 	 * all the different MSDUs inside the A-MSDU.
2131 	 */
2132 	le16_add_cpu(&tx_cmd->len, -snap_ip_tcp_hdrlen);
2133 
2134 	tso_start(skb, &tso);
2135 
2136 	while (total_len) {
2137 		/* this is the data left for this subframe */
2138 		unsigned int data_left =
2139 			min_t(unsigned int, mss, total_len);
2140 		struct sk_buff *csum_skb = NULL;
2141 		unsigned int hdr_tb_len;
2142 		dma_addr_t hdr_tb_phys;
2143 		struct tcphdr *tcph;
2144 		u8 *iph, *subf_hdrs_start = hdr_page->pos;
2145 
2146 		total_len -= data_left;
2147 
2148 		memset(hdr_page->pos, 0, amsdu_pad);
2149 		hdr_page->pos += amsdu_pad;
2150 		amsdu_pad = (4 - (sizeof(struct ethhdr) + snap_ip_tcp_hdrlen +
2151 				  data_left)) & 0x3;
2152 		ether_addr_copy(hdr_page->pos, ieee80211_get_DA(hdr));
2153 		hdr_page->pos += ETH_ALEN;
2154 		ether_addr_copy(hdr_page->pos, ieee80211_get_SA(hdr));
2155 		hdr_page->pos += ETH_ALEN;
2156 
2157 		length = snap_ip_tcp_hdrlen + data_left;
2158 		*((__be16 *)hdr_page->pos) = cpu_to_be16(length);
2159 		hdr_page->pos += sizeof(length);
2160 
2161 		/*
2162 		 * This will copy the SNAP as well which will be considered
2163 		 * as MAC header.
2164 		 */
2165 		tso_build_hdr(skb, hdr_page->pos, &tso, data_left, !total_len);
2166 		iph = hdr_page->pos + 8;
2167 		tcph = (void *)(iph + ip_hdrlen);
2168 
2169 		/* For testing on current hardware only */
2170 		if (trans_pcie->sw_csum_tx) {
2171 			csum_skb = alloc_skb(data_left + tcp_hdrlen(skb),
2172 					     GFP_ATOMIC);
2173 			if (!csum_skb)
2174 				return -ENOMEM;
2175 
2176 			iwl_compute_pseudo_hdr_csum(iph, tcph,
2177 						    skb->protocol ==
2178 							htons(ETH_P_IPV6),
2179 						    data_left);
2180 
2181 			skb_put_data(csum_skb, tcph, tcp_hdrlen(skb));
2182 			skb_reset_transport_header(csum_skb);
2183 			csum_skb->csum_start =
2184 				(unsigned char *)tcp_hdr(csum_skb) -
2185 						 csum_skb->head;
2186 		}
2187 
2188 		hdr_page->pos += snap_ip_tcp_hdrlen;
2189 
2190 		hdr_tb_len = hdr_page->pos - start_hdr;
2191 		hdr_tb_phys = dma_map_single(trans->dev, start_hdr,
2192 					     hdr_tb_len, DMA_TO_DEVICE);
2193 		if (unlikely(dma_mapping_error(trans->dev, hdr_tb_phys))) {
2194 			dev_kfree_skb(csum_skb);
2195 			return -EINVAL;
2196 		}
2197 		iwl_pcie_txq_build_tfd(trans, txq, hdr_tb_phys,
2198 				       hdr_tb_len, false);
2199 		trace_iwlwifi_dev_tx_tb(trans->dev, skb, start_hdr,
2200 					hdr_tb_len);
2201 		/* add this subframe's headers' length to the tx_cmd */
2202 		le16_add_cpu(&tx_cmd->len, hdr_page->pos - subf_hdrs_start);
2203 
2204 		/* prepare the start_hdr for the next subframe */
2205 		start_hdr = hdr_page->pos;
2206 
2207 		/* put the payload */
2208 		while (data_left) {
2209 			unsigned int size = min_t(unsigned int, tso.size,
2210 						  data_left);
2211 			dma_addr_t tb_phys;
2212 
2213 			if (trans_pcie->sw_csum_tx)
2214 				skb_put_data(csum_skb, tso.data, size);
2215 
2216 			tb_phys = dma_map_single(trans->dev, tso.data,
2217 						 size, DMA_TO_DEVICE);
2218 			if (unlikely(dma_mapping_error(trans->dev, tb_phys))) {
2219 				dev_kfree_skb(csum_skb);
2220 				return -EINVAL;
2221 			}
2222 
2223 			iwl_pcie_txq_build_tfd(trans, txq, tb_phys,
2224 					       size, false);
2225 			trace_iwlwifi_dev_tx_tb(trans->dev, skb, tso.data,
2226 						size);
2227 
2228 			data_left -= size;
2229 			tso_build_data(skb, &tso, size);
2230 		}
2231 
2232 		/* For testing on early hardware only */
2233 		if (trans_pcie->sw_csum_tx) {
2234 			__wsum csum;
2235 
2236 			csum = skb_checksum(csum_skb,
2237 					    skb_checksum_start_offset(csum_skb),
2238 					    csum_skb->len -
2239 					    skb_checksum_start_offset(csum_skb),
2240 					    0);
2241 			dev_kfree_skb(csum_skb);
2242 			dma_sync_single_for_cpu(trans->dev, hdr_tb_phys,
2243 						hdr_tb_len, DMA_TO_DEVICE);
2244 			tcph->check = csum_fold(csum);
2245 			dma_sync_single_for_device(trans->dev, hdr_tb_phys,
2246 						   hdr_tb_len, DMA_TO_DEVICE);
2247 		}
2248 	}
2249 
2250 	/* re -add the WiFi header and IV */
2251 	skb_push(skb, hdr_len + iv_len);
2252 
2253 	return 0;
2254 }
2255 #else /* CONFIG_INET */
2256 static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,
2257 				   struct iwl_txq *txq, u8 hdr_len,
2258 				   struct iwl_cmd_meta *out_meta,
2259 				   struct iwl_device_cmd *dev_cmd, u16 tb1_len)
2260 {
2261 	/* No A-MSDU without CONFIG_INET */
2262 	WARN_ON(1);
2263 
2264 	return -1;
2265 }
2266 #endif /* CONFIG_INET */
2267 
2268 int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
2269 		      struct iwl_device_cmd *dev_cmd, int txq_id)
2270 {
2271 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
2272 	struct ieee80211_hdr *hdr;
2273 	struct iwl_tx_cmd *tx_cmd = (struct iwl_tx_cmd *)dev_cmd->payload;
2274 	struct iwl_cmd_meta *out_meta;
2275 	struct iwl_txq *txq;
2276 	dma_addr_t tb0_phys, tb1_phys, scratch_phys;
2277 	void *tb1_addr;
2278 	void *tfd;
2279 	u16 len, tb1_len;
2280 	bool wait_write_ptr;
2281 	__le16 fc;
2282 	u8 hdr_len;
2283 	u16 wifi_seq;
2284 	bool amsdu;
2285 
2286 	txq = trans_pcie->txq[txq_id];
2287 
2288 	if (WARN_ONCE(!test_bit(txq_id, trans_pcie->queue_used),
2289 		      "TX on unused queue %d\n", txq_id))
2290 		return -EINVAL;
2291 
2292 	if (unlikely(trans_pcie->sw_csum_tx &&
2293 		     skb->ip_summed == CHECKSUM_PARTIAL)) {
2294 		int offs = skb_checksum_start_offset(skb);
2295 		int csum_offs = offs + skb->csum_offset;
2296 		__wsum csum;
2297 
2298 		if (skb_ensure_writable(skb, csum_offs + sizeof(__sum16)))
2299 			return -1;
2300 
2301 		csum = skb_checksum(skb, offs, skb->len - offs, 0);
2302 		*(__sum16 *)(skb->data + csum_offs) = csum_fold(csum);
2303 
2304 		skb->ip_summed = CHECKSUM_UNNECESSARY;
2305 	}
2306 
2307 	if (skb_is_nonlinear(skb) &&
2308 	    skb_shinfo(skb)->nr_frags > IWL_PCIE_MAX_FRAGS(trans_pcie) &&
2309 	    __skb_linearize(skb))
2310 		return -ENOMEM;
2311 
2312 	/* mac80211 always puts the full header into the SKB's head,
2313 	 * so there's no need to check if it's readable there
2314 	 */
2315 	hdr = (struct ieee80211_hdr *)skb->data;
2316 	fc = hdr->frame_control;
2317 	hdr_len = ieee80211_hdrlen(fc);
2318 
2319 	spin_lock(&txq->lock);
2320 
2321 	if (iwl_queue_space(trans, txq) < txq->high_mark) {
2322 		iwl_stop_queue(trans, txq);
2323 
2324 		/* don't put the packet on the ring, if there is no room */
2325 		if (unlikely(iwl_queue_space(trans, txq) < 3)) {
2326 			struct iwl_device_cmd **dev_cmd_ptr;
2327 
2328 			dev_cmd_ptr = (void *)((u8 *)skb->cb +
2329 					       trans_pcie->dev_cmd_offs);
2330 
2331 			*dev_cmd_ptr = dev_cmd;
2332 			__skb_queue_tail(&txq->overflow_q, skb);
2333 
2334 			spin_unlock(&txq->lock);
2335 			return 0;
2336 		}
2337 	}
2338 
2339 	/* In AGG mode, the index in the ring must correspond to the WiFi
2340 	 * sequence number. This is a HW requirements to help the SCD to parse
2341 	 * the BA.
2342 	 * Check here that the packets are in the right place on the ring.
2343 	 */
2344 	wifi_seq = IEEE80211_SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
2345 	WARN_ONCE(txq->ampdu &&
2346 		  (wifi_seq & 0xff) != txq->write_ptr,
2347 		  "Q: %d WiFi Seq %d tfdNum %d",
2348 		  txq_id, wifi_seq, txq->write_ptr);
2349 
2350 	/* Set up driver data for this TFD */
2351 	txq->entries[txq->write_ptr].skb = skb;
2352 	txq->entries[txq->write_ptr].cmd = dev_cmd;
2353 
2354 	dev_cmd->hdr.sequence =
2355 		cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
2356 			    INDEX_TO_SEQ(txq->write_ptr)));
2357 
2358 	tb0_phys = iwl_pcie_get_first_tb_dma(txq, txq->write_ptr);
2359 	scratch_phys = tb0_phys + sizeof(struct iwl_cmd_header) +
2360 		       offsetof(struct iwl_tx_cmd, scratch);
2361 
2362 	tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
2363 	tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
2364 
2365 	/* Set up first empty entry in queue's array of Tx/cmd buffers */
2366 	out_meta = &txq->entries[txq->write_ptr].meta;
2367 	out_meta->flags = 0;
2368 
2369 	/*
2370 	 * The second TB (tb1) points to the remainder of the TX command
2371 	 * and the 802.11 header - dword aligned size
2372 	 * (This calculation modifies the TX command, so do it before the
2373 	 * setup of the first TB)
2374 	 */
2375 	len = sizeof(struct iwl_tx_cmd) + sizeof(struct iwl_cmd_header) +
2376 	      hdr_len - IWL_FIRST_TB_SIZE;
2377 	/* do not align A-MSDU to dword as the subframe header aligns it */
2378 	amsdu = ieee80211_is_data_qos(fc) &&
2379 		(*ieee80211_get_qos_ctl(hdr) &
2380 		 IEEE80211_QOS_CTL_A_MSDU_PRESENT);
2381 	if (trans_pcie->sw_csum_tx || !amsdu) {
2382 		tb1_len = ALIGN(len, 4);
2383 		/* Tell NIC about any 2-byte padding after MAC header */
2384 		if (tb1_len != len)
2385 			tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_MH_PAD);
2386 	} else {
2387 		tb1_len = len;
2388 	}
2389 
2390 	/*
2391 	 * The first TB points to bi-directional DMA data, we'll
2392 	 * memcpy the data into it later.
2393 	 */
2394 	iwl_pcie_txq_build_tfd(trans, txq, tb0_phys,
2395 			       IWL_FIRST_TB_SIZE, true);
2396 
2397 	/* there must be data left over for TB1 or this code must be changed */
2398 	BUILD_BUG_ON(sizeof(struct iwl_tx_cmd) < IWL_FIRST_TB_SIZE);
2399 
2400 	/* map the data for TB1 */
2401 	tb1_addr = ((u8 *)&dev_cmd->hdr) + IWL_FIRST_TB_SIZE;
2402 	tb1_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);
2403 	if (unlikely(dma_mapping_error(trans->dev, tb1_phys)))
2404 		goto out_err;
2405 	iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, false);
2406 
2407 	trace_iwlwifi_dev_tx(trans->dev, skb,
2408 			     iwl_pcie_get_tfd(trans, txq,
2409 					      txq->write_ptr),
2410 			     trans_pcie->tfd_size,
2411 			     &dev_cmd->hdr, IWL_FIRST_TB_SIZE + tb1_len,
2412 			     hdr_len);
2413 
2414 	/*
2415 	 * If gso_size wasn't set, don't give the frame "amsdu treatment"
2416 	 * (adding subframes, etc.).
2417 	 * This can happen in some testing flows when the amsdu was already
2418 	 * pre-built, and we just need to send the resulting skb.
2419 	 */
2420 	if (amsdu && skb_shinfo(skb)->gso_size) {
2421 		if (unlikely(iwl_fill_data_tbs_amsdu(trans, skb, txq, hdr_len,
2422 						     out_meta, dev_cmd,
2423 						     tb1_len)))
2424 			goto out_err;
2425 	} else {
2426 		struct sk_buff *frag;
2427 
2428 		if (unlikely(iwl_fill_data_tbs(trans, skb, txq, hdr_len,
2429 					       out_meta)))
2430 			goto out_err;
2431 
2432 		skb_walk_frags(skb, frag) {
2433 			if (unlikely(iwl_fill_data_tbs(trans, frag, txq, 0,
2434 						       out_meta)))
2435 				goto out_err;
2436 		}
2437 	}
2438 
2439 	/* building the A-MSDU might have changed this data, so memcpy it now */
2440 	memcpy(&txq->first_tb_bufs[txq->write_ptr], &dev_cmd->hdr,
2441 	       IWL_FIRST_TB_SIZE);
2442 
2443 	tfd = iwl_pcie_get_tfd(trans, txq, txq->write_ptr);
2444 	/* Set up entry for this TFD in Tx byte-count array */
2445 	iwl_pcie_txq_update_byte_cnt_tbl(trans, txq, le16_to_cpu(tx_cmd->len),
2446 					 iwl_pcie_tfd_get_num_tbs(trans, tfd));
2447 
2448 	wait_write_ptr = ieee80211_has_morefrags(fc);
2449 
2450 	/* start timer if queue currently empty */
2451 	if (txq->read_ptr == txq->write_ptr) {
2452 		if (txq->wd_timeout) {
2453 			/*
2454 			 * If the TXQ is active, then set the timer, if not,
2455 			 * set the timer in remainder so that the timer will
2456 			 * be armed with the right value when the station will
2457 			 * wake up.
2458 			 */
2459 			if (!txq->frozen)
2460 				mod_timer(&txq->stuck_timer,
2461 					  jiffies + txq->wd_timeout);
2462 			else
2463 				txq->frozen_expiry_remainder = txq->wd_timeout;
2464 		}
2465 		IWL_DEBUG_RPM(trans, "Q: %d first tx - take ref\n", txq->id);
2466 		iwl_trans_ref(trans);
2467 	}
2468 
2469 	/* Tell device the write index *just past* this latest filled TFD */
2470 	txq->write_ptr = iwl_queue_inc_wrap(trans, txq->write_ptr);
2471 	if (!wait_write_ptr)
2472 		iwl_pcie_txq_inc_wr_ptr(trans, txq);
2473 
2474 	/*
2475 	 * At this point the frame is "transmitted" successfully
2476 	 * and we will get a TX status notification eventually.
2477 	 */
2478 	spin_unlock(&txq->lock);
2479 	return 0;
2480 out_err:
2481 	iwl_pcie_tfd_unmap(trans, out_meta, txq, txq->write_ptr);
2482 	spin_unlock(&txq->lock);
2483 	return -1;
2484 }
2485