projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ASoC: cs4265: Convert to params_width()
[deliverable/linux.git] / drivers / net / wireless / ath / ath10k / htt_rx.c
1 /*
2 * Copyright (c) 2005-2011 Atheros Communications Inc.
3 * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 #include "core.h"
19 #include "htc.h"
20 #include "htt.h"
21 #include "txrx.h"
22 #include "debug.h"
23 #include "trace.h"
24
25 #include <linux/log2.h>
26
27 /* slightly larger than one large A-MPDU */
28 #define HTT_RX_RING_SIZE_MIN 128
29
30 /* roughly 20 ms @ 1 Gbps of 1500B MSDUs */
31 #define HTT_RX_RING_SIZE_MAX 2048
32
33 #define HTT_RX_AVG_FRM_BYTES 1000
34
35 /* ms, very conservative */
36 #define HTT_RX_HOST_LATENCY_MAX_MS 20
37
38 /* ms, conservative */
39 #define HTT_RX_HOST_LATENCY_WORST_LIKELY_MS 10
40
41 /* when under memory pressure rx ring refill may fail and needs a retry */
42 #define HTT_RX_RING_REFILL_RETRY_MS 50
43
44
45 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb);
46 static void ath10k_htt_txrx_compl_task(unsigned long ptr);
47
48 static int ath10k_htt_rx_ring_size(struct ath10k_htt *htt)
49 {
50 int size;
51
52 /*
53 * It is expected that the host CPU will typically be able to
54 * service the rx indication from one A-MPDU before the rx
55 * indication from the subsequent A-MPDU happens, roughly 1-2 ms
56 * later. However, the rx ring should be sized very conservatively,
57 * to accomodate the worst reasonable delay before the host CPU
58 * services a rx indication interrupt.
59 *
60 * The rx ring need not be kept full of empty buffers. In theory,
61 * the htt host SW can dynamically track the low-water mark in the
62 * rx ring, and dynamically adjust the level to which the rx ring
63 * is filled with empty buffers, to dynamically meet the desired
64 * low-water mark.
65 *
66 * In contrast, it's difficult to resize the rx ring itself, once
67 * it's in use. Thus, the ring itself should be sized very
68 * conservatively, while the degree to which the ring is filled
69 * with empty buffers should be sized moderately conservatively.
70 */
71
72 /* 1e6 bps/mbps / 1e3 ms per sec = 1000 */
73 size =
74 htt->max_throughput_mbps +
75 1000 /
76 (8 * HTT_RX_AVG_FRM_BYTES) * HTT_RX_HOST_LATENCY_MAX_MS;
77
78 if (size < HTT_RX_RING_SIZE_MIN)
79 size = HTT_RX_RING_SIZE_MIN;
80
81 if (size > HTT_RX_RING_SIZE_MAX)
82 size = HTT_RX_RING_SIZE_MAX;
83
84 size = roundup_pow_of_two(size);
85
86 return size;
87 }
88
89 static int ath10k_htt_rx_ring_fill_level(struct ath10k_htt *htt)
90 {
91 int size;
92
93 /* 1e6 bps/mbps / 1e3 ms per sec = 1000 */
94 size =
95 htt->max_throughput_mbps *
96 1000 /
97 (8 * HTT_RX_AVG_FRM_BYTES) * HTT_RX_HOST_LATENCY_WORST_LIKELY_MS;
98
99 /*
100 * Make sure the fill level is at least 1 less than the ring size.
101 * Leaving 1 element empty allows the SW to easily distinguish
102 * between a full ring vs. an empty ring.
103 */
104 if (size >= htt->rx_ring.size)
105 size = htt->rx_ring.size - 1;
106
107 return size;
108 }
109
110 static void ath10k_htt_rx_ring_free(struct ath10k_htt *htt)
111 {
112 struct sk_buff *skb;
113 struct ath10k_skb_cb *cb;
114 int i;
115
116 for (i = 0; i < htt->rx_ring.fill_cnt; i++) {
117 skb = htt->rx_ring.netbufs_ring[i];
118 cb = ATH10K_SKB_CB(skb);
119 dma_unmap_single(htt->ar->dev, cb->paddr,
120 skb->len + skb_tailroom(skb),
121 DMA_FROM_DEVICE);
122 dev_kfree_skb_any(skb);
123 }
124
125 htt->rx_ring.fill_cnt = 0;
126 }
127
128 static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
129 {
130 struct htt_rx_desc *rx_desc;
131 struct sk_buff *skb;
132 dma_addr_t paddr;
133 int ret = 0, idx;
134
135 idx = __le32_to_cpu(*(htt->rx_ring.alloc_idx.vaddr));
136 while (num > 0) {
137 skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
138 if (!skb) {
139 ret = -ENOMEM;
140 goto fail;
141 }
142
143 if (!IS_ALIGNED((unsigned long)skb->data, HTT_RX_DESC_ALIGN))
144 skb_pull(skb,
145 PTR_ALIGN(skb->data, HTT_RX_DESC_ALIGN) -
146 skb->data);
147
148 /* Clear rx_desc attention word before posting to Rx ring */
149 rx_desc = (struct htt_rx_desc *)skb->data;
150 rx_desc->attention.flags = __cpu_to_le32(0);
151
152 paddr = dma_map_single(htt->ar->dev, skb->data,
153 skb->len + skb_tailroom(skb),
154 DMA_FROM_DEVICE);
155
156 if (unlikely(dma_mapping_error(htt->ar->dev, paddr))) {
157 dev_kfree_skb_any(skb);
158 ret = -ENOMEM;
159 goto fail;
160 }
161
162 ATH10K_SKB_CB(skb)->paddr = paddr;
163 htt->rx_ring.netbufs_ring[idx] = skb;
164 htt->rx_ring.paddrs_ring[idx] = __cpu_to_le32(paddr);
165 htt->rx_ring.fill_cnt++;
166
167 num--;
168 idx++;
169 idx &= htt->rx_ring.size_mask;
170 }
171
172 fail:
173 *(htt->rx_ring.alloc_idx.vaddr) = __cpu_to_le32(idx);
174 return ret;
175 }
176
177 static int ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
178 {
179 lockdep_assert_held(&htt->rx_ring.lock);
180 return __ath10k_htt_rx_ring_fill_n(htt, num);
181 }
182
183 static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt *htt)
184 {
185 int ret, num_deficit, num_to_fill;
186
187 /* Refilling the whole RX ring buffer proves to be a bad idea. The
188 * reason is RX may take up significant amount of CPU cycles and starve
189 * other tasks, e.g. TX on an ethernet device while acting as a bridge
190 * with ath10k wlan interface. This ended up with very poor performance
191 * once CPU the host system was overwhelmed with RX on ath10k.
192 *
193 * By limiting the number of refills the replenishing occurs
194 * progressively. This in turns makes use of the fact tasklets are
195 * processed in FIFO order. This means actual RX processing can starve
196 * out refilling. If there's not enough buffers on RX ring FW will not
197 * report RX until it is refilled with enough buffers. This
198 * automatically balances load wrt to CPU power.
199 *
200 * This probably comes at a cost of lower maximum throughput but
201 * improves the avarage and stability. */
202 spin_lock_bh(&htt->rx_ring.lock);
203 num_deficit = htt->rx_ring.fill_level - htt->rx_ring.fill_cnt;
204 num_to_fill = min(ATH10K_HTT_MAX_NUM_REFILL, num_deficit);
205 num_deficit -= num_to_fill;
206 ret = ath10k_htt_rx_ring_fill_n(htt, num_to_fill);
207 if (ret == -ENOMEM) {
208 /*
209 * Failed to fill it to the desired level -
210 * we'll start a timer and try again next time.
211 * As long as enough buffers are left in the ring for
212 * another A-MPDU rx, no special recovery is needed.
213 */
214 mod_timer(&htt->rx_ring.refill_retry_timer, jiffies +
215 msecs_to_jiffies(HTT_RX_RING_REFILL_RETRY_MS));
216 } else if (num_deficit > 0) {
217 tasklet_schedule(&htt->rx_replenish_task);
218 }
219 spin_unlock_bh(&htt->rx_ring.lock);
220 }
221
222 static void ath10k_htt_rx_ring_refill_retry(unsigned long arg)
223 {
224 struct ath10k_htt *htt = (struct ath10k_htt *)arg;
225 ath10k_htt_rx_msdu_buff_replenish(htt);
226 }
227
228 static void ath10k_htt_rx_ring_clean_up(struct ath10k_htt *htt)
229 {
230 struct sk_buff *skb;
231 int i;
232
233 for (i = 0; i < htt->rx_ring.size; i++) {
234 skb = htt->rx_ring.netbufs_ring[i];
235 if (!skb)
236 continue;
237
238 dma_unmap_single(htt->ar->dev, ATH10K_SKB_CB(skb)->paddr,
239 skb->len + skb_tailroom(skb),
240 DMA_FROM_DEVICE);
241 dev_kfree_skb_any(skb);
242 htt->rx_ring.netbufs_ring[i] = NULL;
243 }
244 }
245
246 void ath10k_htt_rx_free(struct ath10k_htt *htt)
247 {
248 del_timer_sync(&htt->rx_ring.refill_retry_timer);
249 tasklet_kill(&htt->rx_replenish_task);
250 tasklet_kill(&htt->txrx_compl_task);
251
252 skb_queue_purge(&htt->tx_compl_q);
253 skb_queue_purge(&htt->rx_compl_q);
254
255 ath10k_htt_rx_ring_clean_up(htt);
256
257 dma_free_coherent(htt->ar->dev,
258 (htt->rx_ring.size *
259 sizeof(htt->rx_ring.paddrs_ring)),
260 htt->rx_ring.paddrs_ring,
261 htt->rx_ring.base_paddr);
262
263 dma_free_coherent(htt->ar->dev,
264 sizeof(*htt->rx_ring.alloc_idx.vaddr),
265 htt->rx_ring.alloc_idx.vaddr,
266 htt->rx_ring.alloc_idx.paddr);
267
268 kfree(htt->rx_ring.netbufs_ring);
269 }
270
271 static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
272 {
273 int idx;
274 struct sk_buff *msdu;
275
276 lockdep_assert_held(&htt->rx_ring.lock);
277
278 if (htt->rx_ring.fill_cnt == 0) {
279 ath10k_warn("tried to pop sk_buff from an empty rx ring\n");
280 return NULL;
281 }
282
283 idx = htt->rx_ring.sw_rd_idx.msdu_payld;
284 msdu = htt->rx_ring.netbufs_ring[idx];
285 htt->rx_ring.netbufs_ring[idx] = NULL;
286
287 idx++;
288 idx &= htt->rx_ring.size_mask;
289 htt->rx_ring.sw_rd_idx.msdu_payld = idx;
290 htt->rx_ring.fill_cnt--;
291
292 return msdu;
293 }
294
295 static void ath10k_htt_rx_free_msdu_chain(struct sk_buff *skb)
296 {
297 struct sk_buff *next;
298
299 while (skb) {
300 next = skb->next;
301 dev_kfree_skb_any(skb);
302 skb = next;
303 }
304 }
305
306 /* return: < 0 fatal error, 0 - non chained msdu, 1 chained msdu */
307 static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
308 u8 **fw_desc, int *fw_desc_len,
309 struct sk_buff **head_msdu,
310 struct sk_buff **tail_msdu)
311 {
312 int msdu_len, msdu_chaining = 0;
313 struct sk_buff *msdu;
314 struct htt_rx_desc *rx_desc;
315 bool corrupted = false;
316
317 lockdep_assert_held(&htt->rx_ring.lock);
318
319 if (htt->rx_confused) {
320 ath10k_warn("htt is confused. refusing rx\n");
321 return -1;
322 }
323
324 msdu = *head_msdu = ath10k_htt_rx_netbuf_pop(htt);
325 while (msdu) {
326 int last_msdu, msdu_len_invalid, msdu_chained;
327
328 dma_unmap_single(htt->ar->dev,
329 ATH10K_SKB_CB(msdu)->paddr,
330 msdu->len + skb_tailroom(msdu),
331 DMA_FROM_DEVICE);
332
333 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx pop: ",
334 msdu->data, msdu->len + skb_tailroom(msdu));
335
336 rx_desc = (struct htt_rx_desc *)msdu->data;
337
338 /* FIXME: we must report msdu payload since this is what caller
339 * expects now */
340 skb_put(msdu, offsetof(struct htt_rx_desc, msdu_payload));
341 skb_pull(msdu, offsetof(struct htt_rx_desc, msdu_payload));
342
343 /*
344 * Sanity check - confirm the HW is finished filling in the
345 * rx data.
346 * If the HW and SW are working correctly, then it's guaranteed
347 * that the HW's MAC DMA is done before this point in the SW.
348 * To prevent the case that we handle a stale Rx descriptor,
349 * just assert for now until we have a way to recover.
350 */
351 if (!(__le32_to_cpu(rx_desc->attention.flags)
352 & RX_ATTENTION_FLAGS_MSDU_DONE)) {
353 ath10k_htt_rx_free_msdu_chain(*head_msdu);
354 *head_msdu = NULL;
355 msdu = NULL;
356 ath10k_err("htt rx stopped. cannot recover\n");
357 htt->rx_confused = true;
358 break;
359 }
360
361 /*
362 * Copy the FW rx descriptor for this MSDU from the rx
363 * indication message into the MSDU's netbuf. HL uses the
364 * same rx indication message definition as LL, and simply
365 * appends new info (fields from the HW rx desc, and the
366 * MSDU payload itself). So, the offset into the rx
367 * indication message only has to account for the standard
368 * offset of the per-MSDU FW rx desc info within the
369 * message, and how many bytes of the per-MSDU FW rx desc
370 * info have already been consumed. (And the endianness of
371 * the host, since for a big-endian host, the rx ind
372 * message contents, including the per-MSDU rx desc bytes,
373 * were byteswapped during upload.)
374 */
375 if (*fw_desc_len > 0) {
376 rx_desc->fw_desc.info0 = **fw_desc;
377 /*
378 * The target is expected to only provide the basic
379 * per-MSDU rx descriptors. Just to be sure, verify
380 * that the target has not attached extension data
381 * (e.g. LRO flow ID).
382 */
383
384 /* or more, if there's extension data */
385 (*fw_desc)++;
386 (*fw_desc_len)--;
387 } else {
388 /*
389 * When an oversized AMSDU happened, FW will lost
390 * some of MSDU status - in this case, the FW
391 * descriptors provided will be less than the
392 * actual MSDUs inside this MPDU. Mark the FW
393 * descriptors so that it will still deliver to
394 * upper stack, if no CRC error for this MPDU.
395 *
396 * FIX THIS - the FW descriptors are actually for
397 * MSDUs in the end of this A-MSDU instead of the
398 * beginning.
399 */
400 rx_desc->fw_desc.info0 = 0;
401 }
402
403 msdu_len_invalid = !!(__le32_to_cpu(rx_desc->attention.flags)
404 & (RX_ATTENTION_FLAGS_MPDU_LENGTH_ERR |
405 RX_ATTENTION_FLAGS_MSDU_LENGTH_ERR));
406 msdu_len = MS(__le32_to_cpu(rx_desc->msdu_start.info0),
407 RX_MSDU_START_INFO0_MSDU_LENGTH);
408 msdu_chained = rx_desc->frag_info.ring2_more_count;
409
410 if (msdu_len_invalid)
411 msdu_len = 0;
412
413 skb_trim(msdu, 0);
414 skb_put(msdu, min(msdu_len, HTT_RX_MSDU_SIZE));
415 msdu_len -= msdu->len;
416
417 /* FIXME: Do chained buffers include htt_rx_desc or not? */
418 while (msdu_chained--) {
419 struct sk_buff *next = ath10k_htt_rx_netbuf_pop(htt);
420
421 dma_unmap_single(htt->ar->dev,
422 ATH10K_SKB_CB(next)->paddr,
423 next->len + skb_tailroom(next),
424 DMA_FROM_DEVICE);
425
426 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL,
427 "htt rx chained: ", next->data,
428 next->len + skb_tailroom(next));
429
430 skb_trim(next, 0);
431 skb_put(next, min(msdu_len, HTT_RX_BUF_SIZE));
432 msdu_len -= next->len;
433
434 msdu->next = next;
435 msdu = next;
436 msdu_chaining = 1;
437 }
438
439 last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) &
440 RX_MSDU_END_INFO0_LAST_MSDU;
441
442 if (msdu_chaining && !last_msdu)
443 corrupted = true;
444
445 if (last_msdu) {
446 msdu->next = NULL;
447 break;
448 } else {
449 struct sk_buff *next = ath10k_htt_rx_netbuf_pop(htt);
450 msdu->next = next;
451 msdu = next;
452 }
453 }
454 *tail_msdu = msdu;
455
456 if (*head_msdu == NULL)
457 msdu_chaining = -1;
458
459 /*
460 * Apparently FW sometimes reports weird chained MSDU sequences with
461 * more than one rx descriptor. This seems like a bug but needs more
462 * analyzing. For the time being fix it by dropping such sequences to
463 * avoid blowing up the host system.
464 */
465 if (corrupted) {
466 ath10k_warn("failed to pop chained msdus, dropping\n");
467 ath10k_htt_rx_free_msdu_chain(*head_msdu);
468 *head_msdu = NULL;
469 *tail_msdu = NULL;
470 msdu_chaining = -EINVAL;
471 }
472
473 /*
474 * Don't refill the ring yet.
475 *
476 * First, the elements popped here are still in use - it is not
477 * safe to overwrite them until the matching call to
478 * mpdu_desc_list_next. Second, for efficiency it is preferable to
479 * refill the rx ring with 1 PPDU's worth of rx buffers (something
480 * like 32 x 3 buffers), rather than one MPDU's worth of rx buffers
481 * (something like 3 buffers). Consequently, we'll rely on the txrx
482 * SW to tell us when it is done pulling all the PPDU's rx buffers
483 * out of the rx ring, and then refill it just once.
484 */
485
486 return msdu_chaining;
487 }
488
489 static void ath10k_htt_rx_replenish_task(unsigned long ptr)
490 {
491 struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
492 ath10k_htt_rx_msdu_buff_replenish(htt);
493 }
494
495 int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
496 {
497 dma_addr_t paddr;
498 void *vaddr;
499 struct timer_list *timer = &htt->rx_ring.refill_retry_timer;
500
501 htt->rx_ring.size = ath10k_htt_rx_ring_size(htt);
502 if (!is_power_of_2(htt->rx_ring.size)) {
503 ath10k_warn("htt rx ring size is not power of 2\n");
504 return -EINVAL;
505 }
506
507 htt->rx_ring.size_mask = htt->rx_ring.size - 1;
508
509 /*
510 * Set the initial value for the level to which the rx ring
511 * should be filled, based on the max throughput and the
512 * worst likely latency for the host to fill the rx ring
513 * with new buffers. In theory, this fill level can be
514 * dynamically adjusted from the initial value set here, to
515 * reflect the actual host latency rather than a
516 * conservative assumption about the host latency.
517 */
518 htt->rx_ring.fill_level = ath10k_htt_rx_ring_fill_level(htt);
519
520 htt->rx_ring.netbufs_ring =
521 kzalloc(htt->rx_ring.size * sizeof(struct sk_buff *),
522 GFP_KERNEL);
523 if (!htt->rx_ring.netbufs_ring)
524 goto err_netbuf;
525
526 vaddr = dma_alloc_coherent(htt->ar->dev,
527 (htt->rx_ring.size * sizeof(htt->rx_ring.paddrs_ring)),
528 &paddr, GFP_DMA);
529 if (!vaddr)
530 goto err_dma_ring;
531
532 htt->rx_ring.paddrs_ring = vaddr;
533 htt->rx_ring.base_paddr = paddr;
534
535 vaddr = dma_alloc_coherent(htt->ar->dev,
536 sizeof(*htt->rx_ring.alloc_idx.vaddr),
537 &paddr, GFP_DMA);
538 if (!vaddr)
539 goto err_dma_idx;
540
541 htt->rx_ring.alloc_idx.vaddr = vaddr;
542 htt->rx_ring.alloc_idx.paddr = paddr;
543 htt->rx_ring.sw_rd_idx.msdu_payld = 0;
544 *htt->rx_ring.alloc_idx.vaddr = 0;
545
546 /* Initialize the Rx refill retry timer */
547 setup_timer(timer, ath10k_htt_rx_ring_refill_retry, (unsigned long)htt);
548
549 spin_lock_init(&htt->rx_ring.lock);
550
551 htt->rx_ring.fill_cnt = 0;
552 if (__ath10k_htt_rx_ring_fill_n(htt, htt->rx_ring.fill_level))
553 goto err_fill_ring;
554
555 tasklet_init(&htt->rx_replenish_task, ath10k_htt_rx_replenish_task,
556 (unsigned long)htt);
557
558 skb_queue_head_init(&htt->tx_compl_q);
559 skb_queue_head_init(&htt->rx_compl_q);
560
561 tasklet_init(&htt->txrx_compl_task, ath10k_htt_txrx_compl_task,
562 (unsigned long)htt);
563
564 ath10k_dbg(ATH10K_DBG_BOOT, "htt rx ring size %d fill_level %d\n",
565 htt->rx_ring.size, htt->rx_ring.fill_level);
566 return 0;
567
568 err_fill_ring:
569 ath10k_htt_rx_ring_free(htt);
570 dma_free_coherent(htt->ar->dev,
571 sizeof(*htt->rx_ring.alloc_idx.vaddr),
572 htt->rx_ring.alloc_idx.vaddr,
573 htt->rx_ring.alloc_idx.paddr);
574 err_dma_idx:
575 dma_free_coherent(htt->ar->dev,
576 (htt->rx_ring.size *
577 sizeof(htt->rx_ring.paddrs_ring)),
578 htt->rx_ring.paddrs_ring,
579 htt->rx_ring.base_paddr);
580 err_dma_ring:
581 kfree(htt->rx_ring.netbufs_ring);
582 err_netbuf:
583 return -ENOMEM;
584 }
585
586 static int ath10k_htt_rx_crypto_param_len(enum htt_rx_mpdu_encrypt_type type)
587 {
588 switch (type) {
589 case HTT_RX_MPDU_ENCRYPT_WEP40:
590 case HTT_RX_MPDU_ENCRYPT_WEP104:
591 return 4;
592 case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC:
593 case HTT_RX_MPDU_ENCRYPT_WEP128: /* not tested */
594 case HTT_RX_MPDU_ENCRYPT_TKIP_WPA:
595 case HTT_RX_MPDU_ENCRYPT_WAPI: /* not tested */
596 case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
597 return 8;
598 case HTT_RX_MPDU_ENCRYPT_NONE:
599 return 0;
600 }
601
602 ath10k_warn("unknown encryption type %d\n", type);
603 return 0;
604 }
605
606 static int ath10k_htt_rx_crypto_tail_len(enum htt_rx_mpdu_encrypt_type type)
607 {
608 switch (type) {
609 case HTT_RX_MPDU_ENCRYPT_NONE:
610 case HTT_RX_MPDU_ENCRYPT_WEP40:
611 case HTT_RX_MPDU_ENCRYPT_WEP104:
612 case HTT_RX_MPDU_ENCRYPT_WEP128:
613 case HTT_RX_MPDU_ENCRYPT_WAPI:
614 return 0;
615 case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC:
616 case HTT_RX_MPDU_ENCRYPT_TKIP_WPA:
617 return 4;
618 case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
619 return 8;
620 }
621
622 ath10k_warn("unknown encryption type %d\n", type);
623 return 0;
624 }
625
626 /* Applies for first msdu in chain, before altering it. */
627 static struct ieee80211_hdr *ath10k_htt_rx_skb_get_hdr(struct sk_buff *skb)
628 {
629 struct htt_rx_desc *rxd;
630 enum rx_msdu_decap_format fmt;
631
632 rxd = (void *)skb->data - sizeof(*rxd);
633 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
634 RX_MSDU_START_INFO1_DECAP_FORMAT);
635
636 if (fmt == RX_MSDU_DECAP_RAW)
637 return (void *)skb->data;
638 else
639 return (void *)skb->data - RX_HTT_HDR_STATUS_LEN;
640 }
641
642 /* This function only applies for first msdu in an msdu chain */
643 static bool ath10k_htt_rx_hdr_is_amsdu(struct ieee80211_hdr *hdr)
644 {
645 if (ieee80211_is_data_qos(hdr->frame_control)) {
646 u8 *qc = ieee80211_get_qos_ctl(hdr);
647 if (qc[0] & 0x80)
648 return true;
649 }
650 return false;
651 }
652
653 struct rfc1042_hdr {
654 u8 llc_dsap;
655 u8 llc_ssap;
656 u8 llc_ctrl;
657 u8 snap_oui[3];
658 __be16 snap_type;
659 } __packed;
660
661 struct amsdu_subframe_hdr {
662 u8 dst[ETH_ALEN];
663 u8 src[ETH_ALEN];
664 __be16 len;
665 } __packed;
666
667 static const u8 rx_legacy_rate_idx[] = {
668 3, /* 0x00 - 11Mbps */
669 2, /* 0x01 - 5.5Mbps */
670 1, /* 0x02 - 2Mbps */
671 0, /* 0x03 - 1Mbps */
672 3, /* 0x04 - 11Mbps */
673 2, /* 0x05 - 5.5Mbps */
674 1, /* 0x06 - 2Mbps */
675 0, /* 0x07 - 1Mbps */
676 10, /* 0x08 - 48Mbps */
677 8, /* 0x09 - 24Mbps */
678 6, /* 0x0A - 12Mbps */
679 4, /* 0x0B - 6Mbps */
680 11, /* 0x0C - 54Mbps */
681 9, /* 0x0D - 36Mbps */
682 7, /* 0x0E - 18Mbps */
683 5, /* 0x0F - 9Mbps */
684 };
685
686 static void ath10k_htt_rx_h_rates(struct ath10k *ar,
687 enum ieee80211_band band,
688 u8 info0, u32 info1, u32 info2,
689 struct ieee80211_rx_status *status)
690 {
691 u8 cck, rate, rate_idx, bw, sgi, mcs, nss;
692 u8 preamble = 0;
693
694 /* Check if valid fields */
695 if (!(info0 & HTT_RX_INDICATION_INFO0_START_VALID))
696 return;
697
698 preamble = MS(info1, HTT_RX_INDICATION_INFO1_PREAMBLE_TYPE);
699
700 switch (preamble) {
701 case HTT_RX_LEGACY:
702 cck = info0 & HTT_RX_INDICATION_INFO0_LEGACY_RATE_CCK;
703 rate = MS(info0, HTT_RX_INDICATION_INFO0_LEGACY_RATE);
704 rate_idx = 0;
705
706 if (rate < 0x08 || rate > 0x0F)
707 break;
708
709 switch (band) {
710 case IEEE80211_BAND_2GHZ:
711 if (cck)
712 rate &= ~BIT(3);
713 rate_idx = rx_legacy_rate_idx[rate];
714 break;
715 case IEEE80211_BAND_5GHZ:
716 rate_idx = rx_legacy_rate_idx[rate];
717 /* We are using same rate table registering
718 HW - ath10k_rates[]. In case of 5GHz skip
719 CCK rates, so -4 here */
720 rate_idx -= 4;
721 break;
722 default:
723 break;
724 }
725
726 status->rate_idx = rate_idx;
727 break;
728 case HTT_RX_HT:
729 case HTT_RX_HT_WITH_TXBF:
730 /* HT-SIG - Table 20-11 in info1 and info2 */
731 mcs = info1 & 0x1F;
732 nss = mcs >> 3;
733 bw = (info1 >> 7) & 1;
734 sgi = (info2 >> 7) & 1;
735
736 status->rate_idx = mcs;
737 status->flag |= RX_FLAG_HT;
738 if (sgi)
739 status->flag |= RX_FLAG_SHORT_GI;
740 if (bw)
741 status->flag |= RX_FLAG_40MHZ;
742 break;
743 case HTT_RX_VHT:
744 case HTT_RX_VHT_WITH_TXBF:
745 /* VHT-SIG-A1 in info 1, VHT-SIG-A2 in info2
746 TODO check this */
747 mcs = (info2 >> 4) & 0x0F;
748 nss = ((info1 >> 10) & 0x07) + 1;
749 bw = info1 & 3;
750 sgi = info2 & 1;
751
752 status->rate_idx = mcs;
753 status->vht_nss = nss;
754
755 if (sgi)
756 status->flag |= RX_FLAG_SHORT_GI;
757
758 switch (bw) {
759 /* 20MHZ */
760 case 0:
761 break;
762 /* 40MHZ */
763 case 1:
764 status->flag |= RX_FLAG_40MHZ;
765 break;
766 /* 80MHZ */
767 case 2:
768 status->vht_flag |= RX_VHT_FLAG_80MHZ;
769 }
770
771 status->flag |= RX_FLAG_VHT;
772 break;
773 default:
774 break;
775 }
776 }
777
778 static void ath10k_htt_rx_h_protected(struct ath10k_htt *htt,
779 struct ieee80211_rx_status *rx_status,
780 struct sk_buff *skb,
781 enum htt_rx_mpdu_encrypt_type enctype,
782 enum rx_msdu_decap_format fmt,
783 bool dot11frag)
784 {
785 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
786
787 rx_status->flag &= ~(RX_FLAG_DECRYPTED |
788 RX_FLAG_IV_STRIPPED |
789 RX_FLAG_MMIC_STRIPPED);
790
791 if (enctype == HTT_RX_MPDU_ENCRYPT_NONE)
792 return;
793
794 /*
795 * There's no explicit rx descriptor flag to indicate whether a given
796 * frame has been decrypted or not. We're forced to use the decap
797 * format as an implicit indication. However fragmentation rx is always
798 * raw and it probably never reports undecrypted raws.
799 *
800 * This makes sure sniffed frames are reported as-is without stripping
801 * the protected flag.
802 */
803 if (fmt == RX_MSDU_DECAP_RAW && !dot11frag)
804 return;
805
806 rx_status->flag |= RX_FLAG_DECRYPTED |
807 RX_FLAG_IV_STRIPPED |
808 RX_FLAG_MMIC_STRIPPED;
809 hdr->frame_control = __cpu_to_le16(__le16_to_cpu(hdr->frame_control) &
810 ~IEEE80211_FCTL_PROTECTED);
811 }
812
813 static bool ath10k_htt_rx_h_channel(struct ath10k *ar,
814 struct ieee80211_rx_status *status)
815 {
816 struct ieee80211_channel *ch;
817
818 spin_lock_bh(&ar->data_lock);
819 ch = ar->scan_channel;
820 if (!ch)
821 ch = ar->rx_channel;
822 spin_unlock_bh(&ar->data_lock);
823
824 if (!ch)
825 return false;
826
827 status->band = ch->band;
828 status->freq = ch->center_freq;
829
830 return true;
831 }
832
833 static void ath10k_process_rx(struct ath10k *ar,
834 struct ieee80211_rx_status *rx_status,
835 struct sk_buff *skb)
836 {
837 struct ieee80211_rx_status *status;
838
839 status = IEEE80211_SKB_RXCB(skb);
840 *status = *rx_status;
841
842 ath10k_dbg(ATH10K_DBG_DATA,
843 "rx skb %p len %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %imic-err %i\n",
844 skb,
845 skb->len,
846 status->flag == 0 ? "legacy" : "",
847 status->flag & RX_FLAG_HT ? "ht" : "",
848 status->flag & RX_FLAG_VHT ? "vht" : "",
849 status->flag & RX_FLAG_40MHZ ? "40" : "",
850 status->vht_flag & RX_VHT_FLAG_80MHZ ? "80" : "",
851 status->flag & RX_FLAG_SHORT_GI ? "sgi " : "",
852 status->rate_idx,
853 status->vht_nss,
854 status->freq,
855 status->band, status->flag,
856 !!(status->flag & RX_FLAG_FAILED_FCS_CRC),
857 !!(status->flag & RX_FLAG_MMIC_ERROR));
858 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "rx skb: ",
859 skb->data, skb->len);
860
861 ieee80211_rx(ar->hw, skb);
862 }
863
864 static int ath10k_htt_rx_nwifi_hdrlen(struct ieee80211_hdr *hdr)
865 {
866 /* nwifi header is padded to 4 bytes. this fixes 4addr rx */
867 return round_up(ieee80211_hdrlen(hdr->frame_control), 4);
868 }
869
870 static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
871 struct ieee80211_rx_status *rx_status,
872 struct sk_buff *skb_in)
873 {
874 struct htt_rx_desc *rxd;
875 struct sk_buff *skb = skb_in;
876 struct sk_buff *first;
877 enum rx_msdu_decap_format fmt;
878 enum htt_rx_mpdu_encrypt_type enctype;
879 struct ieee80211_hdr *hdr;
880 u8 hdr_buf[64], addr[ETH_ALEN], *qos;
881 unsigned int hdr_len;
882
883 rxd = (void *)skb->data - sizeof(*rxd);
884 enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
885 RX_MPDU_START_INFO0_ENCRYPT_TYPE);
886
887 hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
888 hdr_len = ieee80211_hdrlen(hdr->frame_control);
889 memcpy(hdr_buf, hdr, hdr_len);
890 hdr = (struct ieee80211_hdr *)hdr_buf;
891
892 first = skb;
893 while (skb) {
894 void *decap_hdr;
895 int len;
896
897 rxd = (void *)skb->data - sizeof(*rxd);
898 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
899 RX_MSDU_START_INFO1_DECAP_FORMAT);
900 decap_hdr = (void *)rxd->rx_hdr_status;
901
902 skb->ip_summed = ath10k_htt_rx_get_csum_state(skb);
903
904 /* First frame in an A-MSDU chain has more decapped data. */
905 if (skb == first) {
906 len = round_up(ieee80211_hdrlen(hdr->frame_control), 4);
907 len += round_up(ath10k_htt_rx_crypto_param_len(enctype),
908 4);
909 decap_hdr += len;
910 }
911
912 switch (fmt) {
913 case RX_MSDU_DECAP_RAW:
914 /* remove trailing FCS */
915 skb_trim(skb, skb->len - FCS_LEN);
916 break;
917 case RX_MSDU_DECAP_NATIVE_WIFI:
918 /* pull decapped header and copy DA */
919 hdr = (struct ieee80211_hdr *)skb->data;
920 hdr_len = ath10k_htt_rx_nwifi_hdrlen(hdr);
921 memcpy(addr, ieee80211_get_DA(hdr), ETH_ALEN);
922 skb_pull(skb, hdr_len);
923
924 /* push original 802.11 header */
925 hdr = (struct ieee80211_hdr *)hdr_buf;
926 hdr_len = ieee80211_hdrlen(hdr->frame_control);
927 memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
928
929 /* original A-MSDU header has the bit set but we're
930 * not including A-MSDU subframe header */
931 hdr = (struct ieee80211_hdr *)skb->data;
932 qos = ieee80211_get_qos_ctl(hdr);
933 qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
934
935 /* original 802.11 header has a different DA */
936 memcpy(ieee80211_get_DA(hdr), addr, ETH_ALEN);
937 break;
938 case RX_MSDU_DECAP_ETHERNET2_DIX:
939 /* strip ethernet header and insert decapped 802.11
940 * header, amsdu subframe header and rfc1042 header */
941
942 len = 0;
943 len += sizeof(struct rfc1042_hdr);
944 len += sizeof(struct amsdu_subframe_hdr);
945
946 skb_pull(skb, sizeof(struct ethhdr));
947 memcpy(skb_push(skb, len), decap_hdr, len);
948 memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
949 break;
950 case RX_MSDU_DECAP_8023_SNAP_LLC:
951 /* insert decapped 802.11 header making a singly
952 * A-MSDU */
953 memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
954 break;
955 }
956
957 skb_in = skb;
958 ath10k_htt_rx_h_protected(htt, rx_status, skb_in, enctype, fmt,
959 false);
960 skb = skb->next;
961 skb_in->next = NULL;
962
963 if (skb)
964 rx_status->flag |= RX_FLAG_AMSDU_MORE;
965 else
966 rx_status->flag &= ~RX_FLAG_AMSDU_MORE;
967
968 ath10k_process_rx(htt->ar, rx_status, skb_in);
969 }
970
971 /* FIXME: It might be nice to re-assemble the A-MSDU when there's a
972 * monitor interface active for sniffing purposes. */
973 }
974
975 static void ath10k_htt_rx_msdu(struct ath10k_htt *htt,
976 struct ieee80211_rx_status *rx_status,
977 struct sk_buff *skb)
978 {
979 struct htt_rx_desc *rxd;
980 struct ieee80211_hdr *hdr;
981 enum rx_msdu_decap_format fmt;
982 enum htt_rx_mpdu_encrypt_type enctype;
983 int hdr_len;
984 void *rfc1042;
985
986 /* This shouldn't happen. If it does than it may be a FW bug. */
987 if (skb->next) {
988 ath10k_warn("htt rx received chained non A-MSDU frame\n");
989 ath10k_htt_rx_free_msdu_chain(skb->next);
990 skb->next = NULL;
991 }
992
993 rxd = (void *)skb->data - sizeof(*rxd);
994 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
995 RX_MSDU_START_INFO1_DECAP_FORMAT);
996 enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
997 RX_MPDU_START_INFO0_ENCRYPT_TYPE);
998 hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
999 hdr_len = ieee80211_hdrlen(hdr->frame_control);
1000
1001 skb->ip_summed = ath10k_htt_rx_get_csum_state(skb);
1002
1003 switch (fmt) {
1004 case RX_MSDU_DECAP_RAW:
1005 /* remove trailing FCS */
1006 skb_trim(skb, skb->len - FCS_LEN);
1007 break;
1008 case RX_MSDU_DECAP_NATIVE_WIFI:
1009 /* Pull decapped header */
1010 hdr = (struct ieee80211_hdr *)skb->data;
1011 hdr_len = ath10k_htt_rx_nwifi_hdrlen(hdr);
1012 skb_pull(skb, hdr_len);
1013
1014 /* Push original header */
1015 hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
1016 hdr_len = ieee80211_hdrlen(hdr->frame_control);
1017 memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
1018 break;
1019 case RX_MSDU_DECAP_ETHERNET2_DIX:
1020 /* strip ethernet header and insert decapped 802.11 header and
1021 * rfc1042 header */
1022
1023 rfc1042 = hdr;
1024 rfc1042 += roundup(hdr_len, 4);
1025 rfc1042 += roundup(ath10k_htt_rx_crypto_param_len(enctype), 4);
1026
1027 skb_pull(skb, sizeof(struct ethhdr));
1028 memcpy(skb_push(skb, sizeof(struct rfc1042_hdr)),
1029 rfc1042, sizeof(struct rfc1042_hdr));
1030 memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
1031 break;
1032 case RX_MSDU_DECAP_8023_SNAP_LLC:
1033 /* remove A-MSDU subframe header and insert
1034 * decapped 802.11 header. rfc1042 header is already there */
1035
1036 skb_pull(skb, sizeof(struct amsdu_subframe_hdr));
1037 memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
1038 break;
1039 }
1040
1041 ath10k_htt_rx_h_protected(htt, rx_status, skb, enctype, fmt, false);
1042
1043 ath10k_process_rx(htt->ar, rx_status, skb);
1044 }
1045
1046 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb)
1047 {
1048 struct htt_rx_desc *rxd;
1049 u32 flags, info;
1050 bool is_ip4, is_ip6;
1051 bool is_tcp, is_udp;
1052 bool ip_csum_ok, tcpudp_csum_ok;
1053
1054 rxd = (void *)skb->data - sizeof(*rxd);
1055 flags = __le32_to_cpu(rxd->attention.flags);
1056 info = __le32_to_cpu(rxd->msdu_start.info1);
1057
1058 is_ip4 = !!(info & RX_MSDU_START_INFO1_IPV4_PROTO);
1059 is_ip6 = !!(info & RX_MSDU_START_INFO1_IPV6_PROTO);
1060 is_tcp = !!(info & RX_MSDU_START_INFO1_TCP_PROTO);
1061 is_udp = !!(info & RX_MSDU_START_INFO1_UDP_PROTO);
1062 ip_csum_ok = !(flags & RX_ATTENTION_FLAGS_IP_CHKSUM_FAIL);
1063 tcpudp_csum_ok = !(flags & RX_ATTENTION_FLAGS_TCP_UDP_CHKSUM_FAIL);
1064
1065 if (!is_ip4 && !is_ip6)
1066 return CHECKSUM_NONE;
1067 if (!is_tcp && !is_udp)
1068 return CHECKSUM_NONE;
1069 if (!ip_csum_ok)
1070 return CHECKSUM_NONE;
1071 if (!tcpudp_csum_ok)
1072 return CHECKSUM_NONE;
1073
1074 return CHECKSUM_UNNECESSARY;
1075 }
1076
1077 static int ath10k_unchain_msdu(struct sk_buff *msdu_head)
1078 {
1079 struct sk_buff *next = msdu_head->next;
1080 struct sk_buff *to_free = next;
1081 int space;
1082 int total_len = 0;
1083
1084 /* TODO: Might could optimize this by using
1085 * skb_try_coalesce or similar method to
1086 * decrease copying, or maybe get mac80211 to
1087 * provide a way to just receive a list of
1088 * skb?
1089 */
1090
1091 msdu_head->next = NULL;
1092
1093 /* Allocate total length all at once. */
1094 while (next) {
1095 total_len += next->len;
1096 next = next->next;
1097 }
1098
1099 space = total_len - skb_tailroom(msdu_head);
1100 if ((space > 0) &&
1101 (pskb_expand_head(msdu_head, 0, space, GFP_ATOMIC) < 0)) {
1102 /* TODO: bump some rx-oom error stat */
1103 /* put it back together so we can free the
1104 * whole list at once.
1105 */
1106 msdu_head->next = to_free;
1107 return -1;
1108 }
1109
1110 /* Walk list again, copying contents into
1111 * msdu_head
1112 */
1113 next = to_free;
1114 while (next) {
1115 skb_copy_from_linear_data(next, skb_put(msdu_head, next->len),
1116 next->len);
1117 next = next->next;
1118 }
1119
1120 /* If here, we have consolidated skb. Free the
1121 * fragments and pass the main skb on up the
1122 * stack.
1123 */
1124 ath10k_htt_rx_free_msdu_chain(to_free);
1125 return 0;
1126 }
1127
1128 static bool ath10k_htt_rx_amsdu_allowed(struct ath10k_htt *htt,
1129 struct sk_buff *head,
1130 enum htt_rx_mpdu_status status,
1131 bool channel_set,
1132 u32 attention)
1133 {
1134 if (head->len == 0) {
1135 ath10k_dbg(ATH10K_DBG_HTT,
1136 "htt rx dropping due to zero-len\n");
1137 return false;
1138 }
1139
1140 if (attention & RX_ATTENTION_FLAGS_DECRYPT_ERR) {
1141 ath10k_dbg(ATH10K_DBG_HTT,
1142 "htt rx dropping due to decrypt-err\n");
1143 return false;
1144 }
1145
1146 if (!channel_set) {
1147 ath10k_warn("no channel configured; ignoring frame!\n");
1148 return false;
1149 }
1150
1151 /* Skip mgmt frames while we handle this in WMI */
1152 if (status == HTT_RX_IND_MPDU_STATUS_MGMT_CTRL ||
1153 attention & RX_ATTENTION_FLAGS_MGMT_TYPE) {
1154 ath10k_dbg(ATH10K_DBG_HTT, "htt rx mgmt ctrl\n");
1155 return false;
1156 }
1157
1158 if (status != HTT_RX_IND_MPDU_STATUS_OK &&
1159 status != HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR &&
1160 status != HTT_RX_IND_MPDU_STATUS_ERR_INV_PEER &&
1161 !htt->ar->monitor_started) {
1162 ath10k_dbg(ATH10K_DBG_HTT,
1163 "htt rx ignoring frame w/ status %d\n",
1164 status);
1165 return false;
1166 }
1167
1168 if (test_bit(ATH10K_CAC_RUNNING, &htt->ar->dev_flags)) {
1169 ath10k_dbg(ATH10K_DBG_HTT,
1170 "htt rx CAC running\n");
1171 return false;
1172 }
1173
1174 return true;
1175 }
1176
1177 static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
1178 struct htt_rx_indication *rx)
1179 {
1180 struct ieee80211_rx_status *rx_status = &htt->rx_status;
1181 struct htt_rx_indication_mpdu_range *mpdu_ranges;
1182 struct htt_rx_desc *rxd;
1183 enum htt_rx_mpdu_status status;
1184 struct ieee80211_hdr *hdr;
1185 int num_mpdu_ranges;
1186 u32 attention;
1187 int fw_desc_len;
1188 u8 *fw_desc;
1189 bool channel_set;
1190 int i, j;
1191 int ret;
1192
1193 lockdep_assert_held(&htt->rx_ring.lock);
1194
1195 fw_desc_len = __le16_to_cpu(rx->prefix.fw_rx_desc_bytes);
1196 fw_desc = (u8 *)&rx->fw_desc;
1197
1198 num_mpdu_ranges = MS(__le32_to_cpu(rx->hdr.info1),
1199 HTT_RX_INDICATION_INFO1_NUM_MPDU_RANGES);
1200 mpdu_ranges = htt_rx_ind_get_mpdu_ranges(rx);
1201
1202 /* Fill this once, while this is per-ppdu */
1203 if (rx->ppdu.info0 & HTT_RX_INDICATION_INFO0_START_VALID) {
1204 memset(rx_status, 0, sizeof(*rx_status));
1205 rx_status->signal = ATH10K_DEFAULT_NOISE_FLOOR +
1206 rx->ppdu.combined_rssi;
1207 }
1208
1209 if (rx->ppdu.info0 & HTT_RX_INDICATION_INFO0_END_VALID) {
1210 /* TSF available only in 32-bit */
1211 rx_status->mactime = __le32_to_cpu(rx->ppdu.tsf) & 0xffffffff;
1212 rx_status->flag |= RX_FLAG_MACTIME_END;
1213 }
1214
1215 channel_set = ath10k_htt_rx_h_channel(htt->ar, rx_status);
1216
1217 if (channel_set) {
1218 ath10k_htt_rx_h_rates(htt->ar, rx_status->band,
1219 rx->ppdu.info0,
1220 __le32_to_cpu(rx->ppdu.info1),
1221 __le32_to_cpu(rx->ppdu.info2),
1222 rx_status);
1223 }
1224
1225 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx ind: ",
1226 rx, sizeof(*rx) +
1227 (sizeof(struct htt_rx_indication_mpdu_range) *
1228 num_mpdu_ranges));
1229
1230 for (i = 0; i < num_mpdu_ranges; i++) {
1231 status = mpdu_ranges[i].mpdu_range_status;
1232
1233 for (j = 0; j < mpdu_ranges[i].mpdu_count; j++) {
1234 struct sk_buff *msdu_head, *msdu_tail;
1235
1236 msdu_head = NULL;
1237 msdu_tail = NULL;
1238 ret = ath10k_htt_rx_amsdu_pop(htt,
1239 &fw_desc,
1240 &fw_desc_len,
1241 &msdu_head,
1242 &msdu_tail);
1243
1244 if (ret < 0) {
1245 ath10k_warn("failed to pop amsdu from htt rx ring %d\n",
1246 ret);
1247 ath10k_htt_rx_free_msdu_chain(msdu_head);
1248 continue;
1249 }
1250
1251 rxd = container_of((void *)msdu_head->data,
1252 struct htt_rx_desc,
1253 msdu_payload);
1254 attention = __le32_to_cpu(rxd->attention.flags);
1255
1256 if (!ath10k_htt_rx_amsdu_allowed(htt, msdu_head,
1257 status,
1258 channel_set,
1259 attention)) {
1260 ath10k_htt_rx_free_msdu_chain(msdu_head);
1261 continue;
1262 }
1263
1264 if (ret > 0 &&
1265 ath10k_unchain_msdu(msdu_head) < 0) {
1266 ath10k_htt_rx_free_msdu_chain(msdu_head);
1267 continue;
1268 }
1269
1270 if (attention & RX_ATTENTION_FLAGS_FCS_ERR)
1271 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
1272 else
1273 rx_status->flag &= ~RX_FLAG_FAILED_FCS_CRC;
1274
1275 if (attention & RX_ATTENTION_FLAGS_TKIP_MIC_ERR)
1276 rx_status->flag |= RX_FLAG_MMIC_ERROR;
1277 else
1278 rx_status->flag &= ~RX_FLAG_MMIC_ERROR;
1279
1280 hdr = ath10k_htt_rx_skb_get_hdr(msdu_head);
1281
1282 if (ath10k_htt_rx_hdr_is_amsdu(hdr))
1283 ath10k_htt_rx_amsdu(htt, rx_status, msdu_head);
1284 else
1285 ath10k_htt_rx_msdu(htt, rx_status, msdu_head);
1286 }
1287 }
1288
1289 tasklet_schedule(&htt->rx_replenish_task);
1290 }
1291
1292 static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
1293 struct htt_rx_fragment_indication *frag)
1294 {
1295 struct sk_buff *msdu_head, *msdu_tail;
1296 enum htt_rx_mpdu_encrypt_type enctype;
1297 struct htt_rx_desc *rxd;
1298 enum rx_msdu_decap_format fmt;
1299 struct ieee80211_rx_status *rx_status = &htt->rx_status;
1300 struct ieee80211_hdr *hdr;
1301 int ret;
1302 bool tkip_mic_err;
1303 bool decrypt_err;
1304 u8 *fw_desc;
1305 int fw_desc_len, hdrlen, paramlen;
1306 int trim;
1307
1308 fw_desc_len = __le16_to_cpu(frag->fw_rx_desc_bytes);
1309 fw_desc = (u8 *)frag->fw_msdu_rx_desc;
1310
1311 msdu_head = NULL;
1312 msdu_tail = NULL;
1313
1314 spin_lock_bh(&htt->rx_ring.lock);
1315 ret = ath10k_htt_rx_amsdu_pop(htt, &fw_desc, &fw_desc_len,
1316 &msdu_head, &msdu_tail);
1317 spin_unlock_bh(&htt->rx_ring.lock);
1318
1319 ath10k_dbg(ATH10K_DBG_HTT_DUMP, "htt rx frag ahead\n");
1320
1321 if (ret) {
1322 ath10k_warn("failed to pop amsdu from httr rx ring for fragmented rx %d\n",
1323 ret);
1324 ath10k_htt_rx_free_msdu_chain(msdu_head);
1325 return;
1326 }
1327
1328 /* FIXME: implement signal strength */
1329 rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
1330
1331 hdr = (struct ieee80211_hdr *)msdu_head->data;
1332 rxd = (void *)msdu_head->data - sizeof(*rxd);
1333 tkip_mic_err = !!(__le32_to_cpu(rxd->attention.flags) &
1334 RX_ATTENTION_FLAGS_TKIP_MIC_ERR);
1335 decrypt_err = !!(__le32_to_cpu(rxd->attention.flags) &
1336 RX_ATTENTION_FLAGS_DECRYPT_ERR);
1337 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
1338 RX_MSDU_START_INFO1_DECAP_FORMAT);
1339
1340 if (fmt != RX_MSDU_DECAP_RAW) {
1341 ath10k_warn("we dont support non-raw fragmented rx yet\n");
1342 dev_kfree_skb_any(msdu_head);
1343 goto end;
1344 }
1345
1346 enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
1347 RX_MPDU_START_INFO0_ENCRYPT_TYPE);
1348 ath10k_htt_rx_h_protected(htt, rx_status, msdu_head, enctype, fmt,
1349 true);
1350 msdu_head->ip_summed = ath10k_htt_rx_get_csum_state(msdu_head);
1351
1352 if (tkip_mic_err)
1353 ath10k_warn("tkip mic error\n");
1354
1355 if (decrypt_err) {
1356 ath10k_warn("decryption err in fragmented rx\n");
1357 dev_kfree_skb_any(msdu_head);
1358 goto end;
1359 }
1360
1361 if (enctype != HTT_RX_MPDU_ENCRYPT_NONE) {
1362 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1363 paramlen = ath10k_htt_rx_crypto_param_len(enctype);
1364
1365 /* It is more efficient to move the header than the payload */
1366 memmove((void *)msdu_head->data + paramlen,
1367 (void *)msdu_head->data,
1368 hdrlen);
1369 skb_pull(msdu_head, paramlen);
1370 hdr = (struct ieee80211_hdr *)msdu_head->data;
1371 }
1372
1373 /* remove trailing FCS */
1374 trim = 4;
1375
1376 /* remove crypto trailer */
1377 trim += ath10k_htt_rx_crypto_tail_len(enctype);
1378
1379 /* last fragment of TKIP frags has MIC */
1380 if (!ieee80211_has_morefrags(hdr->frame_control) &&
1381 enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA)
1382 trim += 8;
1383
1384 if (trim > msdu_head->len) {
1385 ath10k_warn("htt rx fragment: trailer longer than the frame itself? drop\n");
1386 dev_kfree_skb_any(msdu_head);
1387 goto end;
1388 }
1389
1390 skb_trim(msdu_head, msdu_head->len - trim);
1391
1392 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx frag mpdu: ",
1393 msdu_head->data, msdu_head->len);
1394 ath10k_process_rx(htt->ar, rx_status, msdu_head);
1395
1396 end:
1397 if (fw_desc_len > 0) {
1398 ath10k_dbg(ATH10K_DBG_HTT,
1399 "expecting more fragmented rx in one indication %d\n",
1400 fw_desc_len);
1401 }
1402 }
1403
1404 static void ath10k_htt_rx_frm_tx_compl(struct ath10k *ar,
1405 struct sk_buff *skb)
1406 {
1407 struct ath10k_htt *htt = &ar->htt;
1408 struct htt_resp *resp = (struct htt_resp *)skb->data;
1409 struct htt_tx_done tx_done = {};
1410 int status = MS(resp->data_tx_completion.flags, HTT_DATA_TX_STATUS);
1411 __le16 msdu_id;
1412 int i;
1413
1414 lockdep_assert_held(&htt->tx_lock);
1415
1416 switch (status) {
1417 case HTT_DATA_TX_STATUS_NO_ACK:
1418 tx_done.no_ack = true;
1419 break;
1420 case HTT_DATA_TX_STATUS_OK:
1421 break;
1422 case HTT_DATA_TX_STATUS_DISCARD:
1423 case HTT_DATA_TX_STATUS_POSTPONE:
1424 case HTT_DATA_TX_STATUS_DOWNLOAD_FAIL:
1425 tx_done.discard = true;
1426 break;
1427 default:
1428 ath10k_warn("unhandled tx completion status %d\n", status);
1429 tx_done.discard = true;
1430 break;
1431 }
1432
1433 ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion num_msdus %d\n",
1434 resp->data_tx_completion.num_msdus);
1435
1436 for (i = 0; i < resp->data_tx_completion.num_msdus; i++) {
1437 msdu_id = resp->data_tx_completion.msdus[i];
1438 tx_done.msdu_id = __le16_to_cpu(msdu_id);
1439 ath10k_txrx_tx_unref(htt, &tx_done);
1440 }
1441 }
1442
1443 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
1444 {
1445 struct ath10k_htt *htt = &ar->htt;
1446 struct htt_resp *resp = (struct htt_resp *)skb->data;
1447
1448 /* confirm alignment */
1449 if (!IS_ALIGNED((unsigned long)skb->data, 4))
1450 ath10k_warn("unaligned htt message, expect trouble\n");
1451
1452 ath10k_dbg(ATH10K_DBG_HTT, "htt rx, msg_type: 0x%0X\n",
1453 resp->hdr.msg_type);
1454 switch (resp->hdr.msg_type) {
1455 case HTT_T2H_MSG_TYPE_VERSION_CONF: {
1456 htt->target_version_major = resp->ver_resp.major;
1457 htt->target_version_minor = resp->ver_resp.minor;
1458 complete(&htt->target_version_received);
1459 break;
1460 }
1461 case HTT_T2H_MSG_TYPE_RX_IND:
1462 spin_lock_bh(&htt->rx_ring.lock);
1463 __skb_queue_tail(&htt->rx_compl_q, skb);
1464 spin_unlock_bh(&htt->rx_ring.lock);
1465 tasklet_schedule(&htt->txrx_compl_task);
1466 return;
1467 case HTT_T2H_MSG_TYPE_PEER_MAP: {
1468 struct htt_peer_map_event ev = {
1469 .vdev_id = resp->peer_map.vdev_id,
1470 .peer_id = __le16_to_cpu(resp->peer_map.peer_id),
1471 };
1472 memcpy(ev.addr, resp->peer_map.addr, sizeof(ev.addr));
1473 ath10k_peer_map_event(htt, &ev);
1474 break;
1475 }
1476 case HTT_T2H_MSG_TYPE_PEER_UNMAP: {
1477 struct htt_peer_unmap_event ev = {
1478 .peer_id = __le16_to_cpu(resp->peer_unmap.peer_id),
1479 };
1480 ath10k_peer_unmap_event(htt, &ev);
1481 break;
1482 }
1483 case HTT_T2H_MSG_TYPE_MGMT_TX_COMPLETION: {
1484 struct htt_tx_done tx_done = {};
1485 int status = __le32_to_cpu(resp->mgmt_tx_completion.status);
1486
1487 tx_done.msdu_id =
1488 __le32_to_cpu(resp->mgmt_tx_completion.desc_id);
1489
1490 switch (status) {
1491 case HTT_MGMT_TX_STATUS_OK:
1492 break;
1493 case HTT_MGMT_TX_STATUS_RETRY:
1494 tx_done.no_ack = true;
1495 break;
1496 case HTT_MGMT_TX_STATUS_DROP:
1497 tx_done.discard = true;
1498 break;
1499 }
1500
1501 spin_lock_bh(&htt->tx_lock);
1502 ath10k_txrx_tx_unref(htt, &tx_done);
1503 spin_unlock_bh(&htt->tx_lock);
1504 break;
1505 }
1506 case HTT_T2H_MSG_TYPE_TX_COMPL_IND:
1507 spin_lock_bh(&htt->tx_lock);
1508 __skb_queue_tail(&htt->tx_compl_q, skb);
1509 spin_unlock_bh(&htt->tx_lock);
1510 tasklet_schedule(&htt->txrx_compl_task);
1511 return;
1512 case HTT_T2H_MSG_TYPE_SEC_IND: {
1513 struct ath10k *ar = htt->ar;
1514 struct htt_security_indication *ev = &resp->security_indication;
1515
1516 ath10k_dbg(ATH10K_DBG_HTT,
1517 "sec ind peer_id %d unicast %d type %d\n",
1518 __le16_to_cpu(ev->peer_id),
1519 !!(ev->flags & HTT_SECURITY_IS_UNICAST),
1520 MS(ev->flags, HTT_SECURITY_TYPE));
1521 complete(&ar->install_key_done);
1522 break;
1523 }
1524 case HTT_T2H_MSG_TYPE_RX_FRAG_IND: {
1525 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
1526 skb->data, skb->len);
1527 ath10k_htt_rx_frag_handler(htt, &resp->rx_frag_ind);
1528 break;
1529 }
1530 case HTT_T2H_MSG_TYPE_TEST:
1531 /* FIX THIS */
1532 break;
1533 case HTT_T2H_MSG_TYPE_STATS_CONF:
1534 trace_ath10k_htt_stats(skb->data, skb->len);
1535 break;
1536 case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
1537 case HTT_T2H_MSG_TYPE_RX_ADDBA:
1538 case HTT_T2H_MSG_TYPE_RX_DELBA:
1539 case HTT_T2H_MSG_TYPE_RX_FLUSH:
1540 default:
1541 ath10k_dbg(ATH10K_DBG_HTT, "htt event (%d) not handled\n",
1542 resp->hdr.msg_type);
1543 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
1544 skb->data, skb->len);
1545 break;
1546 };
1547
1548 /* Free the indication buffer */
1549 dev_kfree_skb_any(skb);
1550 }
1551
1552 static void ath10k_htt_txrx_compl_task(unsigned long ptr)
1553 {
1554 struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
1555 struct htt_resp *resp;
1556 struct sk_buff *skb;
1557
1558 spin_lock_bh(&htt->tx_lock);
1559 while ((skb = __skb_dequeue(&htt->tx_compl_q))) {
1560 ath10k_htt_rx_frm_tx_compl(htt->ar, skb);
1561 dev_kfree_skb_any(skb);
1562 }
1563 spin_unlock_bh(&htt->tx_lock);
1564
1565 spin_lock_bh(&htt->rx_ring.lock);
1566 while ((skb = __skb_dequeue(&htt->rx_compl_q))) {
1567 resp = (struct htt_resp *)skb->data;
1568 ath10k_htt_rx_handler(htt, &resp->rx_ind);
1569 dev_kfree_skb_any(skb);
1570 }
1571 spin_unlock_bh(&htt->rx_ring.lock);
1572 }
Linux kernel - Deliverables
This page took 0.16267 seconds and 5 git commands to generate.