1 /* 2 * Copyright (c) 2005-2011 Atheros Communications Inc. 3 * Copyright (c) 2011-2013 Qualcomm Atheros, Inc. 4 * 5 * Permission to use, copy, modify, and/or distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include "core.h" 19 #include "htc.h" 20 #include "htt.h" 21 #include "txrx.h" 22 #include "debug.h" 23 #include "trace.h" 24 25 #include <linux/log2.h> 26 27 /* slightly larger than one large A-MPDU */ 28 #define HTT_RX_RING_SIZE_MIN 128 29 30 /* roughly 20 ms @ 1 Gbps of 1500B MSDUs */ 31 #define HTT_RX_RING_SIZE_MAX 2048 32 33 #define HTT_RX_AVG_FRM_BYTES 1000 34 35 /* ms, very conservative */ 36 #define HTT_RX_HOST_LATENCY_MAX_MS 20 37 38 /* ms, conservative */ 39 #define HTT_RX_HOST_LATENCY_WORST_LIKELY_MS 10 40 41 /* when under memory pressure rx ring refill may fail and needs a retry */ 42 #define HTT_RX_RING_REFILL_RETRY_MS 50 43 44 45 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb); 46 static void ath10k_htt_txrx_compl_task(unsigned long ptr); 47 48 static int ath10k_htt_rx_ring_size(struct ath10k_htt *htt) 49 { 50 int size; 51 52 /* 53 * It is expected that the host CPU will typically be able to 54 * service the rx indication from one A-MPDU before the rx 55 * indication from the subsequent A-MPDU happens, roughly 1-2 ms 56 * later. However, the rx ring should be sized very conservatively, 57 * to accomodate the worst reasonable delay before the host CPU 58 * services a rx indication interrupt. 59 * 60 * The rx ring need not be kept full of empty buffers. In theory, 61 * the htt host SW can dynamically track the low-water mark in the 62 * rx ring, and dynamically adjust the level to which the rx ring 63 * is filled with empty buffers, to dynamically meet the desired 64 * low-water mark. 65 * 66 * In contrast, it's difficult to resize the rx ring itself, once 67 * it's in use. Thus, the ring itself should be sized very 68 * conservatively, while the degree to which the ring is filled 69 * with empty buffers should be sized moderately conservatively. 70 */ 71 72 /* 1e6 bps/mbps / 1e3 ms per sec = 1000 */ 73 size = 74 htt->max_throughput_mbps + 75 1000 / 76 (8 * HTT_RX_AVG_FRM_BYTES) * HTT_RX_HOST_LATENCY_MAX_MS; 77 78 if (size < HTT_RX_RING_SIZE_MIN) 79 size = HTT_RX_RING_SIZE_MIN; 80 81 if (size > HTT_RX_RING_SIZE_MAX) 82 size = HTT_RX_RING_SIZE_MAX; 83 84 size = roundup_pow_of_two(size); 85 86 return size; 87 } 88 89 static int ath10k_htt_rx_ring_fill_level(struct ath10k_htt *htt) 90 { 91 int size; 92 93 /* 1e6 bps/mbps / 1e3 ms per sec = 1000 */ 94 size = 95 htt->max_throughput_mbps * 96 1000 / 97 (8 * HTT_RX_AVG_FRM_BYTES) * HTT_RX_HOST_LATENCY_WORST_LIKELY_MS; 98 99 /* 100 * Make sure the fill level is at least 1 less than the ring size. 101 * Leaving 1 element empty allows the SW to easily distinguish 102 * between a full ring vs. an empty ring. 103 */ 104 if (size >= htt->rx_ring.size) 105 size = htt->rx_ring.size - 1; 106 107 return size; 108 } 109 110 static void ath10k_htt_rx_ring_free(struct ath10k_htt *htt) 111 { 112 struct sk_buff *skb; 113 struct ath10k_skb_cb *cb; 114 int i; 115 116 for (i = 0; i < htt->rx_ring.fill_cnt; i++) { 117 skb = htt->rx_ring.netbufs_ring[i]; 118 cb = ATH10K_SKB_CB(skb); 119 dma_unmap_single(htt->ar->dev, cb->paddr, 120 skb->len + skb_tailroom(skb), 121 DMA_FROM_DEVICE); 122 dev_kfree_skb_any(skb); 123 } 124 125 htt->rx_ring.fill_cnt = 0; 126 } 127 128 static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num) 129 { 130 struct htt_rx_desc *rx_desc; 131 struct sk_buff *skb; 132 dma_addr_t paddr; 133 int ret = 0, idx; 134 135 idx = __le32_to_cpu(*(htt->rx_ring.alloc_idx.vaddr)); 136 while (num > 0) { 137 skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN); 138 if (!skb) { 139 ret = -ENOMEM; 140 goto fail; 141 } 142 143 if (!IS_ALIGNED((unsigned long)skb->data, HTT_RX_DESC_ALIGN)) 144 skb_pull(skb, 145 PTR_ALIGN(skb->data, HTT_RX_DESC_ALIGN) - 146 skb->data); 147 148 /* Clear rx_desc attention word before posting to Rx ring */ 149 rx_desc = (struct htt_rx_desc *)skb->data; 150 rx_desc->attention.flags = __cpu_to_le32(0); 151 152 paddr = dma_map_single(htt->ar->dev, skb->data, 153 skb->len + skb_tailroom(skb), 154 DMA_FROM_DEVICE); 155 156 if (unlikely(dma_mapping_error(htt->ar->dev, paddr))) { 157 dev_kfree_skb_any(skb); 158 ret = -ENOMEM; 159 goto fail; 160 } 161 162 ATH10K_SKB_CB(skb)->paddr = paddr; 163 htt->rx_ring.netbufs_ring[idx] = skb; 164 htt->rx_ring.paddrs_ring[idx] = __cpu_to_le32(paddr); 165 htt->rx_ring.fill_cnt++; 166 167 num--; 168 idx++; 169 idx &= htt->rx_ring.size_mask; 170 } 171 172 fail: 173 *(htt->rx_ring.alloc_idx.vaddr) = __cpu_to_le32(idx); 174 return ret; 175 } 176 177 static int ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num) 178 { 179 lockdep_assert_held(&htt->rx_ring.lock); 180 return __ath10k_htt_rx_ring_fill_n(htt, num); 181 } 182 183 static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt *htt) 184 { 185 int ret, num_deficit, num_to_fill; 186 187 /* Refilling the whole RX ring buffer proves to be a bad idea. The 188 * reason is RX may take up significant amount of CPU cycles and starve 189 * other tasks, e.g. TX on an ethernet device while acting as a bridge 190 * with ath10k wlan interface. This ended up with very poor performance 191 * once CPU the host system was overwhelmed with RX on ath10k. 192 * 193 * By limiting the number of refills the replenishing occurs 194 * progressively. This in turns makes use of the fact tasklets are 195 * processed in FIFO order. This means actual RX processing can starve 196 * out refilling. If there's not enough buffers on RX ring FW will not 197 * report RX until it is refilled with enough buffers. This 198 * automatically balances load wrt to CPU power. 199 * 200 * This probably comes at a cost of lower maximum throughput but 201 * improves the avarage and stability. */ 202 spin_lock_bh(&htt->rx_ring.lock); 203 num_deficit = htt->rx_ring.fill_level - htt->rx_ring.fill_cnt; 204 num_to_fill = min(ATH10K_HTT_MAX_NUM_REFILL, num_deficit); 205 num_deficit -= num_to_fill; 206 ret = ath10k_htt_rx_ring_fill_n(htt, num_to_fill); 207 if (ret == -ENOMEM) { 208 /* 209 * Failed to fill it to the desired level - 210 * we'll start a timer and try again next time. 211 * As long as enough buffers are left in the ring for 212 * another A-MPDU rx, no special recovery is needed. 213 */ 214 mod_timer(&htt->rx_ring.refill_retry_timer, jiffies + 215 msecs_to_jiffies(HTT_RX_RING_REFILL_RETRY_MS)); 216 } else if (num_deficit > 0) { 217 tasklet_schedule(&htt->rx_replenish_task); 218 } 219 spin_unlock_bh(&htt->rx_ring.lock); 220 } 221 222 static void ath10k_htt_rx_ring_refill_retry(unsigned long arg) 223 { 224 struct ath10k_htt *htt = (struct ath10k_htt *)arg; 225 ath10k_htt_rx_msdu_buff_replenish(htt); 226 } 227 228 static void ath10k_htt_rx_ring_clean_up(struct ath10k_htt *htt) 229 { 230 struct sk_buff *skb; 231 int i; 232 233 for (i = 0; i < htt->rx_ring.size; i++) { 234 skb = htt->rx_ring.netbufs_ring[i]; 235 if (!skb) 236 continue; 237 238 dma_unmap_single(htt->ar->dev, ATH10K_SKB_CB(skb)->paddr, 239 skb->len + skb_tailroom(skb), 240 DMA_FROM_DEVICE); 241 dev_kfree_skb_any(skb); 242 htt->rx_ring.netbufs_ring[i] = NULL; 243 } 244 } 245 246 void ath10k_htt_rx_free(struct ath10k_htt *htt) 247 { 248 del_timer_sync(&htt->rx_ring.refill_retry_timer); 249 tasklet_kill(&htt->rx_replenish_task); 250 tasklet_kill(&htt->txrx_compl_task); 251 252 skb_queue_purge(&htt->tx_compl_q); 253 skb_queue_purge(&htt->rx_compl_q); 254 255 ath10k_htt_rx_ring_clean_up(htt); 256 257 dma_free_coherent(htt->ar->dev, 258 (htt->rx_ring.size * 259 sizeof(htt->rx_ring.paddrs_ring)), 260 htt->rx_ring.paddrs_ring, 261 htt->rx_ring.base_paddr); 262 263 dma_free_coherent(htt->ar->dev, 264 sizeof(*htt->rx_ring.alloc_idx.vaddr), 265 htt->rx_ring.alloc_idx.vaddr, 266 htt->rx_ring.alloc_idx.paddr); 267 268 kfree(htt->rx_ring.netbufs_ring); 269 } 270 271 static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt) 272 { 273 int idx; 274 struct sk_buff *msdu; 275 276 lockdep_assert_held(&htt->rx_ring.lock); 277 278 if (htt->rx_ring.fill_cnt == 0) { 279 ath10k_warn("tried to pop sk_buff from an empty rx ring\n"); 280 return NULL; 281 } 282 283 idx = htt->rx_ring.sw_rd_idx.msdu_payld; 284 msdu = htt->rx_ring.netbufs_ring[idx]; 285 htt->rx_ring.netbufs_ring[idx] = NULL; 286 287 idx++; 288 idx &= htt->rx_ring.size_mask; 289 htt->rx_ring.sw_rd_idx.msdu_payld = idx; 290 htt->rx_ring.fill_cnt--; 291 292 return msdu; 293 } 294 295 static void ath10k_htt_rx_free_msdu_chain(struct sk_buff *skb) 296 { 297 struct sk_buff *next; 298 299 while (skb) { 300 next = skb->next; 301 dev_kfree_skb_any(skb); 302 skb = next; 303 } 304 } 305 306 /* return: < 0 fatal error, 0 - non chained msdu, 1 chained msdu */ 307 static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt, 308 u8 **fw_desc, int *fw_desc_len, 309 struct sk_buff **head_msdu, 310 struct sk_buff **tail_msdu) 311 { 312 int msdu_len, msdu_chaining = 0; 313 struct sk_buff *msdu; 314 struct htt_rx_desc *rx_desc; 315 316 lockdep_assert_held(&htt->rx_ring.lock); 317 318 if (htt->rx_confused) { 319 ath10k_warn("htt is confused. refusing rx\n"); 320 return -1; 321 } 322 323 msdu = *head_msdu = ath10k_htt_rx_netbuf_pop(htt); 324 while (msdu) { 325 int last_msdu, msdu_len_invalid, msdu_chained; 326 327 dma_unmap_single(htt->ar->dev, 328 ATH10K_SKB_CB(msdu)->paddr, 329 msdu->len + skb_tailroom(msdu), 330 DMA_FROM_DEVICE); 331 332 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx pop: ", 333 msdu->data, msdu->len + skb_tailroom(msdu)); 334 335 rx_desc = (struct htt_rx_desc *)msdu->data; 336 337 /* FIXME: we must report msdu payload since this is what caller 338 * expects now */ 339 skb_put(msdu, offsetof(struct htt_rx_desc, msdu_payload)); 340 skb_pull(msdu, offsetof(struct htt_rx_desc, msdu_payload)); 341 342 /* 343 * Sanity check - confirm the HW is finished filling in the 344 * rx data. 345 * If the HW and SW are working correctly, then it's guaranteed 346 * that the HW's MAC DMA is done before this point in the SW. 347 * To prevent the case that we handle a stale Rx descriptor, 348 * just assert for now until we have a way to recover. 349 */ 350 if (!(__le32_to_cpu(rx_desc->attention.flags) 351 & RX_ATTENTION_FLAGS_MSDU_DONE)) { 352 ath10k_htt_rx_free_msdu_chain(*head_msdu); 353 *head_msdu = NULL; 354 msdu = NULL; 355 ath10k_err("htt rx stopped. cannot recover\n"); 356 htt->rx_confused = true; 357 break; 358 } 359 360 /* 361 * Copy the FW rx descriptor for this MSDU from the rx 362 * indication message into the MSDU's netbuf. HL uses the 363 * same rx indication message definition as LL, and simply 364 * appends new info (fields from the HW rx desc, and the 365 * MSDU payload itself). So, the offset into the rx 366 * indication message only has to account for the standard 367 * offset of the per-MSDU FW rx desc info within the 368 * message, and how many bytes of the per-MSDU FW rx desc 369 * info have already been consumed. (And the endianness of 370 * the host, since for a big-endian host, the rx ind 371 * message contents, including the per-MSDU rx desc bytes, 372 * were byteswapped during upload.) 373 */ 374 if (*fw_desc_len > 0) { 375 rx_desc->fw_desc.info0 = **fw_desc; 376 /* 377 * The target is expected to only provide the basic 378 * per-MSDU rx descriptors. Just to be sure, verify 379 * that the target has not attached extension data 380 * (e.g. LRO flow ID). 381 */ 382 383 /* or more, if there's extension data */ 384 (*fw_desc)++; 385 (*fw_desc_len)--; 386 } else { 387 /* 388 * When an oversized AMSDU happened, FW will lost 389 * some of MSDU status - in this case, the FW 390 * descriptors provided will be less than the 391 * actual MSDUs inside this MPDU. Mark the FW 392 * descriptors so that it will still deliver to 393 * upper stack, if no CRC error for this MPDU. 394 * 395 * FIX THIS - the FW descriptors are actually for 396 * MSDUs in the end of this A-MSDU instead of the 397 * beginning. 398 */ 399 rx_desc->fw_desc.info0 = 0; 400 } 401 402 msdu_len_invalid = !!(__le32_to_cpu(rx_desc->attention.flags) 403 & (RX_ATTENTION_FLAGS_MPDU_LENGTH_ERR | 404 RX_ATTENTION_FLAGS_MSDU_LENGTH_ERR)); 405 msdu_len = MS(__le32_to_cpu(rx_desc->msdu_start.info0), 406 RX_MSDU_START_INFO0_MSDU_LENGTH); 407 msdu_chained = rx_desc->frag_info.ring2_more_count; 408 409 if (msdu_len_invalid) 410 msdu_len = 0; 411 412 skb_trim(msdu, 0); 413 skb_put(msdu, min(msdu_len, HTT_RX_MSDU_SIZE)); 414 msdu_len -= msdu->len; 415 416 /* FIXME: Do chained buffers include htt_rx_desc or not? */ 417 while (msdu_chained--) { 418 struct sk_buff *next = ath10k_htt_rx_netbuf_pop(htt); 419 420 dma_unmap_single(htt->ar->dev, 421 ATH10K_SKB_CB(next)->paddr, 422 next->len + skb_tailroom(next), 423 DMA_FROM_DEVICE); 424 425 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, 426 "htt rx chained: ", next->data, 427 next->len + skb_tailroom(next)); 428 429 skb_trim(next, 0); 430 skb_put(next, min(msdu_len, HTT_RX_BUF_SIZE)); 431 msdu_len -= next->len; 432 433 msdu->next = next; 434 msdu = next; 435 msdu_chaining = 1; 436 } 437 438 last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) & 439 RX_MSDU_END_INFO0_LAST_MSDU; 440 441 if (last_msdu) { 442 msdu->next = NULL; 443 break; 444 } else { 445 struct sk_buff *next = ath10k_htt_rx_netbuf_pop(htt); 446 msdu->next = next; 447 msdu = next; 448 } 449 } 450 *tail_msdu = msdu; 451 452 if (*head_msdu == NULL) 453 msdu_chaining = -1; 454 455 /* 456 * Don't refill the ring yet. 457 * 458 * First, the elements popped here are still in use - it is not 459 * safe to overwrite them until the matching call to 460 * mpdu_desc_list_next. Second, for efficiency it is preferable to 461 * refill the rx ring with 1 PPDU's worth of rx buffers (something 462 * like 32 x 3 buffers), rather than one MPDU's worth of rx buffers 463 * (something like 3 buffers). Consequently, we'll rely on the txrx 464 * SW to tell us when it is done pulling all the PPDU's rx buffers 465 * out of the rx ring, and then refill it just once. 466 */ 467 468 return msdu_chaining; 469 } 470 471 static void ath10k_htt_rx_replenish_task(unsigned long ptr) 472 { 473 struct ath10k_htt *htt = (struct ath10k_htt *)ptr; 474 ath10k_htt_rx_msdu_buff_replenish(htt); 475 } 476 477 int ath10k_htt_rx_alloc(struct ath10k_htt *htt) 478 { 479 dma_addr_t paddr; 480 void *vaddr; 481 struct timer_list *timer = &htt->rx_ring.refill_retry_timer; 482 483 htt->rx_ring.size = ath10k_htt_rx_ring_size(htt); 484 if (!is_power_of_2(htt->rx_ring.size)) { 485 ath10k_warn("htt rx ring size is not power of 2\n"); 486 return -EINVAL; 487 } 488 489 htt->rx_ring.size_mask = htt->rx_ring.size - 1; 490 491 /* 492 * Set the initial value for the level to which the rx ring 493 * should be filled, based on the max throughput and the 494 * worst likely latency for the host to fill the rx ring 495 * with new buffers. In theory, this fill level can be 496 * dynamically adjusted from the initial value set here, to 497 * reflect the actual host latency rather than a 498 * conservative assumption about the host latency. 499 */ 500 htt->rx_ring.fill_level = ath10k_htt_rx_ring_fill_level(htt); 501 502 htt->rx_ring.netbufs_ring = 503 kzalloc(htt->rx_ring.size * sizeof(struct sk_buff *), 504 GFP_KERNEL); 505 if (!htt->rx_ring.netbufs_ring) 506 goto err_netbuf; 507 508 vaddr = dma_alloc_coherent(htt->ar->dev, 509 (htt->rx_ring.size * sizeof(htt->rx_ring.paddrs_ring)), 510 &paddr, GFP_DMA); 511 if (!vaddr) 512 goto err_dma_ring; 513 514 htt->rx_ring.paddrs_ring = vaddr; 515 htt->rx_ring.base_paddr = paddr; 516 517 vaddr = dma_alloc_coherent(htt->ar->dev, 518 sizeof(*htt->rx_ring.alloc_idx.vaddr), 519 &paddr, GFP_DMA); 520 if (!vaddr) 521 goto err_dma_idx; 522 523 htt->rx_ring.alloc_idx.vaddr = vaddr; 524 htt->rx_ring.alloc_idx.paddr = paddr; 525 htt->rx_ring.sw_rd_idx.msdu_payld = 0; 526 *htt->rx_ring.alloc_idx.vaddr = 0; 527 528 /* Initialize the Rx refill retry timer */ 529 setup_timer(timer, ath10k_htt_rx_ring_refill_retry, (unsigned long)htt); 530 531 spin_lock_init(&htt->rx_ring.lock); 532 533 htt->rx_ring.fill_cnt = 0; 534 if (__ath10k_htt_rx_ring_fill_n(htt, htt->rx_ring.fill_level)) 535 goto err_fill_ring; 536 537 tasklet_init(&htt->rx_replenish_task, ath10k_htt_rx_replenish_task, 538 (unsigned long)htt); 539 540 skb_queue_head_init(&htt->tx_compl_q); 541 skb_queue_head_init(&htt->rx_compl_q); 542 543 tasklet_init(&htt->txrx_compl_task, ath10k_htt_txrx_compl_task, 544 (unsigned long)htt); 545 546 ath10k_dbg(ATH10K_DBG_BOOT, "htt rx ring size %d fill_level %d\n", 547 htt->rx_ring.size, htt->rx_ring.fill_level); 548 return 0; 549 550 err_fill_ring: 551 ath10k_htt_rx_ring_free(htt); 552 dma_free_coherent(htt->ar->dev, 553 sizeof(*htt->rx_ring.alloc_idx.vaddr), 554 htt->rx_ring.alloc_idx.vaddr, 555 htt->rx_ring.alloc_idx.paddr); 556 err_dma_idx: 557 dma_free_coherent(htt->ar->dev, 558 (htt->rx_ring.size * 559 sizeof(htt->rx_ring.paddrs_ring)), 560 htt->rx_ring.paddrs_ring, 561 htt->rx_ring.base_paddr); 562 err_dma_ring: 563 kfree(htt->rx_ring.netbufs_ring); 564 err_netbuf: 565 return -ENOMEM; 566 } 567 568 static int ath10k_htt_rx_crypto_param_len(enum htt_rx_mpdu_encrypt_type type) 569 { 570 switch (type) { 571 case HTT_RX_MPDU_ENCRYPT_WEP40: 572 case HTT_RX_MPDU_ENCRYPT_WEP104: 573 return 4; 574 case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC: 575 case HTT_RX_MPDU_ENCRYPT_WEP128: /* not tested */ 576 case HTT_RX_MPDU_ENCRYPT_TKIP_WPA: 577 case HTT_RX_MPDU_ENCRYPT_WAPI: /* not tested */ 578 case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2: 579 return 8; 580 case HTT_RX_MPDU_ENCRYPT_NONE: 581 return 0; 582 } 583 584 ath10k_warn("unknown encryption type %d\n", type); 585 return 0; 586 } 587 588 static int ath10k_htt_rx_crypto_tail_len(enum htt_rx_mpdu_encrypt_type type) 589 { 590 switch (type) { 591 case HTT_RX_MPDU_ENCRYPT_NONE: 592 case HTT_RX_MPDU_ENCRYPT_WEP40: 593 case HTT_RX_MPDU_ENCRYPT_WEP104: 594 case HTT_RX_MPDU_ENCRYPT_WEP128: 595 case HTT_RX_MPDU_ENCRYPT_WAPI: 596 return 0; 597 case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC: 598 case HTT_RX_MPDU_ENCRYPT_TKIP_WPA: 599 return 4; 600 case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2: 601 return 8; 602 } 603 604 ath10k_warn("unknown encryption type %d\n", type); 605 return 0; 606 } 607 608 /* Applies for first msdu in chain, before altering it. */ 609 static struct ieee80211_hdr *ath10k_htt_rx_skb_get_hdr(struct sk_buff *skb) 610 { 611 struct htt_rx_desc *rxd; 612 enum rx_msdu_decap_format fmt; 613 614 rxd = (void *)skb->data - sizeof(*rxd); 615 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1), 616 RX_MSDU_START_INFO1_DECAP_FORMAT); 617 618 if (fmt == RX_MSDU_DECAP_RAW) 619 return (void *)skb->data; 620 else 621 return (void *)skb->data - RX_HTT_HDR_STATUS_LEN; 622 } 623 624 /* This function only applies for first msdu in an msdu chain */ 625 static bool ath10k_htt_rx_hdr_is_amsdu(struct ieee80211_hdr *hdr) 626 { 627 if (ieee80211_is_data_qos(hdr->frame_control)) { 628 u8 *qc = ieee80211_get_qos_ctl(hdr); 629 if (qc[0] & 0x80) 630 return true; 631 } 632 return false; 633 } 634 635 struct rfc1042_hdr { 636 u8 llc_dsap; 637 u8 llc_ssap; 638 u8 llc_ctrl; 639 u8 snap_oui[3]; 640 __be16 snap_type; 641 } __packed; 642 643 struct amsdu_subframe_hdr { 644 u8 dst[ETH_ALEN]; 645 u8 src[ETH_ALEN]; 646 __be16 len; 647 } __packed; 648 649 static const u8 rx_legacy_rate_idx[] = { 650 3, /* 0x00 - 11Mbps */ 651 2, /* 0x01 - 5.5Mbps */ 652 1, /* 0x02 - 2Mbps */ 653 0, /* 0x03 - 1Mbps */ 654 3, /* 0x04 - 11Mbps */ 655 2, /* 0x05 - 5.5Mbps */ 656 1, /* 0x06 - 2Mbps */ 657 0, /* 0x07 - 1Mbps */ 658 10, /* 0x08 - 48Mbps */ 659 8, /* 0x09 - 24Mbps */ 660 6, /* 0x0A - 12Mbps */ 661 4, /* 0x0B - 6Mbps */ 662 11, /* 0x0C - 54Mbps */ 663 9, /* 0x0D - 36Mbps */ 664 7, /* 0x0E - 18Mbps */ 665 5, /* 0x0F - 9Mbps */ 666 }; 667 668 static void ath10k_htt_rx_h_rates(struct ath10k *ar, 669 enum ieee80211_band band, 670 u8 info0, u32 info1, u32 info2, 671 struct ieee80211_rx_status *status) 672 { 673 u8 cck, rate, rate_idx, bw, sgi, mcs, nss; 674 u8 preamble = 0; 675 676 /* Check if valid fields */ 677 if (!(info0 & HTT_RX_INDICATION_INFO0_START_VALID)) 678 return; 679 680 preamble = MS(info1, HTT_RX_INDICATION_INFO1_PREAMBLE_TYPE); 681 682 switch (preamble) { 683 case HTT_RX_LEGACY: 684 cck = info0 & HTT_RX_INDICATION_INFO0_LEGACY_RATE_CCK; 685 rate = MS(info0, HTT_RX_INDICATION_INFO0_LEGACY_RATE); 686 rate_idx = 0; 687 688 if (rate < 0x08 || rate > 0x0F) 689 break; 690 691 switch (band) { 692 case IEEE80211_BAND_2GHZ: 693 if (cck) 694 rate &= ~BIT(3); 695 rate_idx = rx_legacy_rate_idx[rate]; 696 break; 697 case IEEE80211_BAND_5GHZ: 698 rate_idx = rx_legacy_rate_idx[rate]; 699 /* We are using same rate table registering 700 HW - ath10k_rates[]. In case of 5GHz skip 701 CCK rates, so -4 here */ 702 rate_idx -= 4; 703 break; 704 default: 705 break; 706 } 707 708 status->rate_idx = rate_idx; 709 break; 710 case HTT_RX_HT: 711 case HTT_RX_HT_WITH_TXBF: 712 /* HT-SIG - Table 20-11 in info1 and info2 */ 713 mcs = info1 & 0x1F; 714 nss = mcs >> 3; 715 bw = (info1 >> 7) & 1; 716 sgi = (info2 >> 7) & 1; 717 718 status->rate_idx = mcs; 719 status->flag |= RX_FLAG_HT; 720 if (sgi) 721 status->flag |= RX_FLAG_SHORT_GI; 722 if (bw) 723 status->flag |= RX_FLAG_40MHZ; 724 break; 725 case HTT_RX_VHT: 726 case HTT_RX_VHT_WITH_TXBF: 727 /* VHT-SIG-A1 in info 1, VHT-SIG-A2 in info2 728 TODO check this */ 729 mcs = (info2 >> 4) & 0x0F; 730 nss = ((info1 >> 10) & 0x07) + 1; 731 bw = info1 & 3; 732 sgi = info2 & 1; 733 734 status->rate_idx = mcs; 735 status->vht_nss = nss; 736 737 if (sgi) 738 status->flag |= RX_FLAG_SHORT_GI; 739 740 switch (bw) { 741 /* 20MHZ */ 742 case 0: 743 break; 744 /* 40MHZ */ 745 case 1: 746 status->flag |= RX_FLAG_40MHZ; 747 break; 748 /* 80MHZ */ 749 case 2: 750 status->vht_flag |= RX_VHT_FLAG_80MHZ; 751 } 752 753 status->flag |= RX_FLAG_VHT; 754 break; 755 default: 756 break; 757 } 758 } 759 760 static void ath10k_htt_rx_h_protected(struct ath10k_htt *htt, 761 struct ieee80211_rx_status *rx_status, 762 struct sk_buff *skb, 763 enum htt_rx_mpdu_encrypt_type enctype, 764 enum rx_msdu_decap_format fmt, 765 bool dot11frag) 766 { 767 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 768 769 rx_status->flag &= ~(RX_FLAG_DECRYPTED | 770 RX_FLAG_IV_STRIPPED | 771 RX_FLAG_MMIC_STRIPPED); 772 773 if (enctype == HTT_RX_MPDU_ENCRYPT_NONE) 774 return; 775 776 /* 777 * There's no explicit rx descriptor flag to indicate whether a given 778 * frame has been decrypted or not. We're forced to use the decap 779 * format as an implicit indication. However fragmentation rx is always 780 * raw and it probably never reports undecrypted raws. 781 * 782 * This makes sure sniffed frames are reported as-is without stripping 783 * the protected flag. 784 */ 785 if (fmt == RX_MSDU_DECAP_RAW && !dot11frag) 786 return; 787 788 rx_status->flag |= RX_FLAG_DECRYPTED | 789 RX_FLAG_IV_STRIPPED | 790 RX_FLAG_MMIC_STRIPPED; 791 hdr->frame_control = __cpu_to_le16(__le16_to_cpu(hdr->frame_control) & 792 ~IEEE80211_FCTL_PROTECTED); 793 } 794 795 static bool ath10k_htt_rx_h_channel(struct ath10k *ar, 796 struct ieee80211_rx_status *status) 797 { 798 struct ieee80211_channel *ch; 799 800 spin_lock_bh(&ar->data_lock); 801 ch = ar->scan_channel; 802 if (!ch) 803 ch = ar->rx_channel; 804 spin_unlock_bh(&ar->data_lock); 805 806 if (!ch) 807 return false; 808 809 status->band = ch->band; 810 status->freq = ch->center_freq; 811 812 return true; 813 } 814 815 static void ath10k_process_rx(struct ath10k *ar, 816 struct ieee80211_rx_status *rx_status, 817 struct sk_buff *skb) 818 { 819 struct ieee80211_rx_status *status; 820 821 status = IEEE80211_SKB_RXCB(skb); 822 *status = *rx_status; 823 824 ath10k_dbg(ATH10K_DBG_DATA, 825 "rx skb %p len %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %imic-err %i\n", 826 skb, 827 skb->len, 828 status->flag == 0 ? "legacy" : "", 829 status->flag & RX_FLAG_HT ? "ht" : "", 830 status->flag & RX_FLAG_VHT ? "vht" : "", 831 status->flag & RX_FLAG_40MHZ ? "40" : "", 832 status->vht_flag & RX_VHT_FLAG_80MHZ ? "80" : "", 833 status->flag & RX_FLAG_SHORT_GI ? "sgi " : "", 834 status->rate_idx, 835 status->vht_nss, 836 status->freq, 837 status->band, status->flag, 838 !!(status->flag & RX_FLAG_FAILED_FCS_CRC), 839 !!(status->flag & RX_FLAG_MMIC_ERROR)); 840 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "rx skb: ", 841 skb->data, skb->len); 842 843 ieee80211_rx(ar->hw, skb); 844 } 845 846 static int ath10k_htt_rx_nwifi_hdrlen(struct ieee80211_hdr *hdr) 847 { 848 /* nwifi header is padded to 4 bytes. this fixes 4addr rx */ 849 return round_up(ieee80211_hdrlen(hdr->frame_control), 4); 850 } 851 852 static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt, 853 struct ieee80211_rx_status *rx_status, 854 struct sk_buff *skb_in) 855 { 856 struct htt_rx_desc *rxd; 857 struct sk_buff *skb = skb_in; 858 struct sk_buff *first; 859 enum rx_msdu_decap_format fmt; 860 enum htt_rx_mpdu_encrypt_type enctype; 861 struct ieee80211_hdr *hdr; 862 u8 hdr_buf[64], addr[ETH_ALEN], *qos; 863 unsigned int hdr_len; 864 865 rxd = (void *)skb->data - sizeof(*rxd); 866 enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0), 867 RX_MPDU_START_INFO0_ENCRYPT_TYPE); 868 869 hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status; 870 hdr_len = ieee80211_hdrlen(hdr->frame_control); 871 memcpy(hdr_buf, hdr, hdr_len); 872 hdr = (struct ieee80211_hdr *)hdr_buf; 873 874 first = skb; 875 while (skb) { 876 void *decap_hdr; 877 int len; 878 879 rxd = (void *)skb->data - sizeof(*rxd); 880 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1), 881 RX_MSDU_START_INFO1_DECAP_FORMAT); 882 decap_hdr = (void *)rxd->rx_hdr_status; 883 884 skb->ip_summed = ath10k_htt_rx_get_csum_state(skb); 885 886 /* First frame in an A-MSDU chain has more decapped data. */ 887 if (skb == first) { 888 len = round_up(ieee80211_hdrlen(hdr->frame_control), 4); 889 len += round_up(ath10k_htt_rx_crypto_param_len(enctype), 890 4); 891 decap_hdr += len; 892 } 893 894 switch (fmt) { 895 case RX_MSDU_DECAP_RAW: 896 /* remove trailing FCS */ 897 skb_trim(skb, skb->len - FCS_LEN); 898 break; 899 case RX_MSDU_DECAP_NATIVE_WIFI: 900 /* pull decapped header and copy DA */ 901 hdr = (struct ieee80211_hdr *)skb->data; 902 hdr_len = ath10k_htt_rx_nwifi_hdrlen(hdr); 903 memcpy(addr, ieee80211_get_DA(hdr), ETH_ALEN); 904 skb_pull(skb, hdr_len); 905 906 /* push original 802.11 header */ 907 hdr = (struct ieee80211_hdr *)hdr_buf; 908 hdr_len = ieee80211_hdrlen(hdr->frame_control); 909 memcpy(skb_push(skb, hdr_len), hdr, hdr_len); 910 911 /* original A-MSDU header has the bit set but we're 912 * not including A-MSDU subframe header */ 913 hdr = (struct ieee80211_hdr *)skb->data; 914 qos = ieee80211_get_qos_ctl(hdr); 915 qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT; 916 917 /* original 802.11 header has a different DA */ 918 memcpy(ieee80211_get_DA(hdr), addr, ETH_ALEN); 919 break; 920 case RX_MSDU_DECAP_ETHERNET2_DIX: 921 /* strip ethernet header and insert decapped 802.11 922 * header, amsdu subframe header and rfc1042 header */ 923 924 len = 0; 925 len += sizeof(struct rfc1042_hdr); 926 len += sizeof(struct amsdu_subframe_hdr); 927 928 skb_pull(skb, sizeof(struct ethhdr)); 929 memcpy(skb_push(skb, len), decap_hdr, len); 930 memcpy(skb_push(skb, hdr_len), hdr, hdr_len); 931 break; 932 case RX_MSDU_DECAP_8023_SNAP_LLC: 933 /* insert decapped 802.11 header making a singly 934 * A-MSDU */ 935 memcpy(skb_push(skb, hdr_len), hdr, hdr_len); 936 break; 937 } 938 939 skb_in = skb; 940 ath10k_htt_rx_h_protected(htt, rx_status, skb_in, enctype, fmt, 941 false); 942 skb = skb->next; 943 skb_in->next = NULL; 944 945 if (skb) 946 rx_status->flag |= RX_FLAG_AMSDU_MORE; 947 else 948 rx_status->flag &= ~RX_FLAG_AMSDU_MORE; 949 950 ath10k_process_rx(htt->ar, rx_status, skb_in); 951 } 952 953 /* FIXME: It might be nice to re-assemble the A-MSDU when there's a 954 * monitor interface active for sniffing purposes. */ 955 } 956 957 static void ath10k_htt_rx_msdu(struct ath10k_htt *htt, 958 struct ieee80211_rx_status *rx_status, 959 struct sk_buff *skb) 960 { 961 struct htt_rx_desc *rxd; 962 struct ieee80211_hdr *hdr; 963 enum rx_msdu_decap_format fmt; 964 enum htt_rx_mpdu_encrypt_type enctype; 965 int hdr_len; 966 void *rfc1042; 967 968 /* This shouldn't happen. If it does than it may be a FW bug. */ 969 if (skb->next) { 970 ath10k_warn("htt rx received chained non A-MSDU frame\n"); 971 ath10k_htt_rx_free_msdu_chain(skb->next); 972 skb->next = NULL; 973 } 974 975 rxd = (void *)skb->data - sizeof(*rxd); 976 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1), 977 RX_MSDU_START_INFO1_DECAP_FORMAT); 978 enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0), 979 RX_MPDU_START_INFO0_ENCRYPT_TYPE); 980 hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status; 981 hdr_len = ieee80211_hdrlen(hdr->frame_control); 982 983 skb->ip_summed = ath10k_htt_rx_get_csum_state(skb); 984 985 switch (fmt) { 986 case RX_MSDU_DECAP_RAW: 987 /* remove trailing FCS */ 988 skb_trim(skb, skb->len - FCS_LEN); 989 break; 990 case RX_MSDU_DECAP_NATIVE_WIFI: 991 /* Pull decapped header */ 992 hdr = (struct ieee80211_hdr *)skb->data; 993 hdr_len = ath10k_htt_rx_nwifi_hdrlen(hdr); 994 skb_pull(skb, hdr_len); 995 996 /* Push original header */ 997 hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status; 998 hdr_len = ieee80211_hdrlen(hdr->frame_control); 999 memcpy(skb_push(skb, hdr_len), hdr, hdr_len); 1000 break; 1001 case RX_MSDU_DECAP_ETHERNET2_DIX: 1002 /* strip ethernet header and insert decapped 802.11 header and 1003 * rfc1042 header */ 1004 1005 rfc1042 = hdr; 1006 rfc1042 += roundup(hdr_len, 4); 1007 rfc1042 += roundup(ath10k_htt_rx_crypto_param_len(enctype), 4); 1008 1009 skb_pull(skb, sizeof(struct ethhdr)); 1010 memcpy(skb_push(skb, sizeof(struct rfc1042_hdr)), 1011 rfc1042, sizeof(struct rfc1042_hdr)); 1012 memcpy(skb_push(skb, hdr_len), hdr, hdr_len); 1013 break; 1014 case RX_MSDU_DECAP_8023_SNAP_LLC: 1015 /* remove A-MSDU subframe header and insert 1016 * decapped 802.11 header. rfc1042 header is already there */ 1017 1018 skb_pull(skb, sizeof(struct amsdu_subframe_hdr)); 1019 memcpy(skb_push(skb, hdr_len), hdr, hdr_len); 1020 break; 1021 } 1022 1023 ath10k_htt_rx_h_protected(htt, rx_status, skb, enctype, fmt, false); 1024 1025 ath10k_process_rx(htt->ar, rx_status, skb); 1026 } 1027 1028 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb) 1029 { 1030 struct htt_rx_desc *rxd; 1031 u32 flags, info; 1032 bool is_ip4, is_ip6; 1033 bool is_tcp, is_udp; 1034 bool ip_csum_ok, tcpudp_csum_ok; 1035 1036 rxd = (void *)skb->data - sizeof(*rxd); 1037 flags = __le32_to_cpu(rxd->attention.flags); 1038 info = __le32_to_cpu(rxd->msdu_start.info1); 1039 1040 is_ip4 = !!(info & RX_MSDU_START_INFO1_IPV4_PROTO); 1041 is_ip6 = !!(info & RX_MSDU_START_INFO1_IPV6_PROTO); 1042 is_tcp = !!(info & RX_MSDU_START_INFO1_TCP_PROTO); 1043 is_udp = !!(info & RX_MSDU_START_INFO1_UDP_PROTO); 1044 ip_csum_ok = !(flags & RX_ATTENTION_FLAGS_IP_CHKSUM_FAIL); 1045 tcpudp_csum_ok = !(flags & RX_ATTENTION_FLAGS_TCP_UDP_CHKSUM_FAIL); 1046 1047 if (!is_ip4 && !is_ip6) 1048 return CHECKSUM_NONE; 1049 if (!is_tcp && !is_udp) 1050 return CHECKSUM_NONE; 1051 if (!ip_csum_ok) 1052 return CHECKSUM_NONE; 1053 if (!tcpudp_csum_ok) 1054 return CHECKSUM_NONE; 1055 1056 return CHECKSUM_UNNECESSARY; 1057 } 1058 1059 static int ath10k_unchain_msdu(struct sk_buff *msdu_head) 1060 { 1061 struct sk_buff *next = msdu_head->next; 1062 struct sk_buff *to_free = next; 1063 int space; 1064 int total_len = 0; 1065 1066 /* TODO: Might could optimize this by using 1067 * skb_try_coalesce or similar method to 1068 * decrease copying, or maybe get mac80211 to 1069 * provide a way to just receive a list of 1070 * skb? 1071 */ 1072 1073 msdu_head->next = NULL; 1074 1075 /* Allocate total length all at once. */ 1076 while (next) { 1077 total_len += next->len; 1078 next = next->next; 1079 } 1080 1081 space = total_len - skb_tailroom(msdu_head); 1082 if ((space > 0) && 1083 (pskb_expand_head(msdu_head, 0, space, GFP_ATOMIC) < 0)) { 1084 /* TODO: bump some rx-oom error stat */ 1085 /* put it back together so we can free the 1086 * whole list at once. 1087 */ 1088 msdu_head->next = to_free; 1089 return -1; 1090 } 1091 1092 /* Walk list again, copying contents into 1093 * msdu_head 1094 */ 1095 next = to_free; 1096 while (next) { 1097 skb_copy_from_linear_data(next, skb_put(msdu_head, next->len), 1098 next->len); 1099 next = next->next; 1100 } 1101 1102 /* If here, we have consolidated skb. Free the 1103 * fragments and pass the main skb on up the 1104 * stack. 1105 */ 1106 ath10k_htt_rx_free_msdu_chain(to_free); 1107 return 0; 1108 } 1109 1110 static bool ath10k_htt_rx_amsdu_allowed(struct ath10k_htt *htt, 1111 struct sk_buff *head, 1112 enum htt_rx_mpdu_status status, 1113 bool channel_set, 1114 u32 attention) 1115 { 1116 if (head->len == 0) { 1117 ath10k_dbg(ATH10K_DBG_HTT, 1118 "htt rx dropping due to zero-len\n"); 1119 return false; 1120 } 1121 1122 if (attention & RX_ATTENTION_FLAGS_DECRYPT_ERR) { 1123 ath10k_dbg(ATH10K_DBG_HTT, 1124 "htt rx dropping due to decrypt-err\n"); 1125 return false; 1126 } 1127 1128 if (!channel_set) { 1129 ath10k_warn("no channel configured; ignoring frame!\n"); 1130 return false; 1131 } 1132 1133 /* Skip mgmt frames while we handle this in WMI */ 1134 if (status == HTT_RX_IND_MPDU_STATUS_MGMT_CTRL || 1135 attention & RX_ATTENTION_FLAGS_MGMT_TYPE) { 1136 ath10k_dbg(ATH10K_DBG_HTT, "htt rx mgmt ctrl\n"); 1137 return false; 1138 } 1139 1140 if (status != HTT_RX_IND_MPDU_STATUS_OK && 1141 status != HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR && 1142 status != HTT_RX_IND_MPDU_STATUS_ERR_INV_PEER && 1143 !htt->ar->monitor_started) { 1144 ath10k_dbg(ATH10K_DBG_HTT, 1145 "htt rx ignoring frame w/ status %d\n", 1146 status); 1147 return false; 1148 } 1149 1150 if (test_bit(ATH10K_CAC_RUNNING, &htt->ar->dev_flags)) { 1151 ath10k_dbg(ATH10K_DBG_HTT, 1152 "htt rx CAC running\n"); 1153 return false; 1154 } 1155 1156 return true; 1157 } 1158 1159 static void ath10k_htt_rx_handler(struct ath10k_htt *htt, 1160 struct htt_rx_indication *rx) 1161 { 1162 struct ieee80211_rx_status *rx_status = &htt->rx_status; 1163 struct htt_rx_indication_mpdu_range *mpdu_ranges; 1164 struct htt_rx_desc *rxd; 1165 enum htt_rx_mpdu_status status; 1166 struct ieee80211_hdr *hdr; 1167 int num_mpdu_ranges; 1168 u32 attention; 1169 int fw_desc_len; 1170 u8 *fw_desc; 1171 bool channel_set; 1172 int i, j; 1173 int ret; 1174 1175 lockdep_assert_held(&htt->rx_ring.lock); 1176 1177 fw_desc_len = __le16_to_cpu(rx->prefix.fw_rx_desc_bytes); 1178 fw_desc = (u8 *)&rx->fw_desc; 1179 1180 num_mpdu_ranges = MS(__le32_to_cpu(rx->hdr.info1), 1181 HTT_RX_INDICATION_INFO1_NUM_MPDU_RANGES); 1182 mpdu_ranges = htt_rx_ind_get_mpdu_ranges(rx); 1183 1184 /* Fill this once, while this is per-ppdu */ 1185 if (rx->ppdu.info0 & HTT_RX_INDICATION_INFO0_START_VALID) { 1186 memset(rx_status, 0, sizeof(*rx_status)); 1187 rx_status->signal = ATH10K_DEFAULT_NOISE_FLOOR + 1188 rx->ppdu.combined_rssi; 1189 } 1190 1191 if (rx->ppdu.info0 & HTT_RX_INDICATION_INFO0_END_VALID) { 1192 /* TSF available only in 32-bit */ 1193 rx_status->mactime = __le32_to_cpu(rx->ppdu.tsf) & 0xffffffff; 1194 rx_status->flag |= RX_FLAG_MACTIME_END; 1195 } 1196 1197 channel_set = ath10k_htt_rx_h_channel(htt->ar, rx_status); 1198 1199 if (channel_set) { 1200 ath10k_htt_rx_h_rates(htt->ar, rx_status->band, 1201 rx->ppdu.info0, 1202 __le32_to_cpu(rx->ppdu.info1), 1203 __le32_to_cpu(rx->ppdu.info2), 1204 rx_status); 1205 } 1206 1207 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx ind: ", 1208 rx, sizeof(*rx) + 1209 (sizeof(struct htt_rx_indication_mpdu_range) * 1210 num_mpdu_ranges)); 1211 1212 for (i = 0; i < num_mpdu_ranges; i++) { 1213 status = mpdu_ranges[i].mpdu_range_status; 1214 1215 for (j = 0; j < mpdu_ranges[i].mpdu_count; j++) { 1216 struct sk_buff *msdu_head, *msdu_tail; 1217 1218 msdu_head = NULL; 1219 msdu_tail = NULL; 1220 ret = ath10k_htt_rx_amsdu_pop(htt, 1221 &fw_desc, 1222 &fw_desc_len, 1223 &msdu_head, 1224 &msdu_tail); 1225 1226 if (ret < 0) { 1227 ath10k_warn("failed to pop amsdu from htt rx ring %d\n", 1228 ret); 1229 ath10k_htt_rx_free_msdu_chain(msdu_head); 1230 continue; 1231 } 1232 1233 rxd = container_of((void *)msdu_head->data, 1234 struct htt_rx_desc, 1235 msdu_payload); 1236 attention = __le32_to_cpu(rxd->attention.flags); 1237 1238 if (!ath10k_htt_rx_amsdu_allowed(htt, msdu_head, 1239 status, 1240 channel_set, 1241 attention)) { 1242 ath10k_htt_rx_free_msdu_chain(msdu_head); 1243 continue; 1244 } 1245 1246 if (ret > 0 && 1247 ath10k_unchain_msdu(msdu_head) < 0) { 1248 ath10k_htt_rx_free_msdu_chain(msdu_head); 1249 continue; 1250 } 1251 1252 if (attention & RX_ATTENTION_FLAGS_FCS_ERR) 1253 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC; 1254 else 1255 rx_status->flag &= ~RX_FLAG_FAILED_FCS_CRC; 1256 1257 if (attention & RX_ATTENTION_FLAGS_TKIP_MIC_ERR) 1258 rx_status->flag |= RX_FLAG_MMIC_ERROR; 1259 else 1260 rx_status->flag &= ~RX_FLAG_MMIC_ERROR; 1261 1262 hdr = ath10k_htt_rx_skb_get_hdr(msdu_head); 1263 1264 if (ath10k_htt_rx_hdr_is_amsdu(hdr)) 1265 ath10k_htt_rx_amsdu(htt, rx_status, msdu_head); 1266 else 1267 ath10k_htt_rx_msdu(htt, rx_status, msdu_head); 1268 } 1269 } 1270 1271 tasklet_schedule(&htt->rx_replenish_task); 1272 } 1273 1274 static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt, 1275 struct htt_rx_fragment_indication *frag) 1276 { 1277 struct sk_buff *msdu_head, *msdu_tail; 1278 enum htt_rx_mpdu_encrypt_type enctype; 1279 struct htt_rx_desc *rxd; 1280 enum rx_msdu_decap_format fmt; 1281 struct ieee80211_rx_status *rx_status = &htt->rx_status; 1282 struct ieee80211_hdr *hdr; 1283 int ret; 1284 bool tkip_mic_err; 1285 bool decrypt_err; 1286 u8 *fw_desc; 1287 int fw_desc_len, hdrlen, paramlen; 1288 int trim; 1289 1290 fw_desc_len = __le16_to_cpu(frag->fw_rx_desc_bytes); 1291 fw_desc = (u8 *)frag->fw_msdu_rx_desc; 1292 1293 msdu_head = NULL; 1294 msdu_tail = NULL; 1295 1296 spin_lock_bh(&htt->rx_ring.lock); 1297 ret = ath10k_htt_rx_amsdu_pop(htt, &fw_desc, &fw_desc_len, 1298 &msdu_head, &msdu_tail); 1299 spin_unlock_bh(&htt->rx_ring.lock); 1300 1301 ath10k_dbg(ATH10K_DBG_HTT_DUMP, "htt rx frag ahead\n"); 1302 1303 if (ret) { 1304 ath10k_warn("failed to pop amsdu from httr rx ring for fragmented rx %d\n", 1305 ret); 1306 ath10k_htt_rx_free_msdu_chain(msdu_head); 1307 return; 1308 } 1309 1310 /* FIXME: implement signal strength */ 1311 rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL; 1312 1313 hdr = (struct ieee80211_hdr *)msdu_head->data; 1314 rxd = (void *)msdu_head->data - sizeof(*rxd); 1315 tkip_mic_err = !!(__le32_to_cpu(rxd->attention.flags) & 1316 RX_ATTENTION_FLAGS_TKIP_MIC_ERR); 1317 decrypt_err = !!(__le32_to_cpu(rxd->attention.flags) & 1318 RX_ATTENTION_FLAGS_DECRYPT_ERR); 1319 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1), 1320 RX_MSDU_START_INFO1_DECAP_FORMAT); 1321 1322 if (fmt != RX_MSDU_DECAP_RAW) { 1323 ath10k_warn("we dont support non-raw fragmented rx yet\n"); 1324 dev_kfree_skb_any(msdu_head); 1325 goto end; 1326 } 1327 1328 enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0), 1329 RX_MPDU_START_INFO0_ENCRYPT_TYPE); 1330 ath10k_htt_rx_h_protected(htt, rx_status, msdu_head, enctype, fmt, 1331 true); 1332 msdu_head->ip_summed = ath10k_htt_rx_get_csum_state(msdu_head); 1333 1334 if (tkip_mic_err) 1335 ath10k_warn("tkip mic error\n"); 1336 1337 if (decrypt_err) { 1338 ath10k_warn("decryption err in fragmented rx\n"); 1339 dev_kfree_skb_any(msdu_head); 1340 goto end; 1341 } 1342 1343 if (enctype != HTT_RX_MPDU_ENCRYPT_NONE) { 1344 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1345 paramlen = ath10k_htt_rx_crypto_param_len(enctype); 1346 1347 /* It is more efficient to move the header than the payload */ 1348 memmove((void *)msdu_head->data + paramlen, 1349 (void *)msdu_head->data, 1350 hdrlen); 1351 skb_pull(msdu_head, paramlen); 1352 hdr = (struct ieee80211_hdr *)msdu_head->data; 1353 } 1354 1355 /* remove trailing FCS */ 1356 trim = 4; 1357 1358 /* remove crypto trailer */ 1359 trim += ath10k_htt_rx_crypto_tail_len(enctype); 1360 1361 /* last fragment of TKIP frags has MIC */ 1362 if (!ieee80211_has_morefrags(hdr->frame_control) && 1363 enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA) 1364 trim += 8; 1365 1366 if (trim > msdu_head->len) { 1367 ath10k_warn("htt rx fragment: trailer longer than the frame itself? drop\n"); 1368 dev_kfree_skb_any(msdu_head); 1369 goto end; 1370 } 1371 1372 skb_trim(msdu_head, msdu_head->len - trim); 1373 1374 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx frag mpdu: ", 1375 msdu_head->data, msdu_head->len); 1376 ath10k_process_rx(htt->ar, rx_status, msdu_head); 1377 1378 end: 1379 if (fw_desc_len > 0) { 1380 ath10k_dbg(ATH10K_DBG_HTT, 1381 "expecting more fragmented rx in one indication %d\n", 1382 fw_desc_len); 1383 } 1384 } 1385 1386 static void ath10k_htt_rx_frm_tx_compl(struct ath10k *ar, 1387 struct sk_buff *skb) 1388 { 1389 struct ath10k_htt *htt = &ar->htt; 1390 struct htt_resp *resp = (struct htt_resp *)skb->data; 1391 struct htt_tx_done tx_done = {}; 1392 int status = MS(resp->data_tx_completion.flags, HTT_DATA_TX_STATUS); 1393 __le16 msdu_id; 1394 int i; 1395 1396 lockdep_assert_held(&htt->tx_lock); 1397 1398 switch (status) { 1399 case HTT_DATA_TX_STATUS_NO_ACK: 1400 tx_done.no_ack = true; 1401 break; 1402 case HTT_DATA_TX_STATUS_OK: 1403 break; 1404 case HTT_DATA_TX_STATUS_DISCARD: 1405 case HTT_DATA_TX_STATUS_POSTPONE: 1406 case HTT_DATA_TX_STATUS_DOWNLOAD_FAIL: 1407 tx_done.discard = true; 1408 break; 1409 default: 1410 ath10k_warn("unhandled tx completion status %d\n", status); 1411 tx_done.discard = true; 1412 break; 1413 } 1414 1415 ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion num_msdus %d\n", 1416 resp->data_tx_completion.num_msdus); 1417 1418 for (i = 0; i < resp->data_tx_completion.num_msdus; i++) { 1419 msdu_id = resp->data_tx_completion.msdus[i]; 1420 tx_done.msdu_id = __le16_to_cpu(msdu_id); 1421 ath10k_txrx_tx_unref(htt, &tx_done); 1422 } 1423 } 1424 1425 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb) 1426 { 1427 struct ath10k_htt *htt = &ar->htt; 1428 struct htt_resp *resp = (struct htt_resp *)skb->data; 1429 1430 /* confirm alignment */ 1431 if (!IS_ALIGNED((unsigned long)skb->data, 4)) 1432 ath10k_warn("unaligned htt message, expect trouble\n"); 1433 1434 ath10k_dbg(ATH10K_DBG_HTT, "htt rx, msg_type: 0x%0X\n", 1435 resp->hdr.msg_type); 1436 switch (resp->hdr.msg_type) { 1437 case HTT_T2H_MSG_TYPE_VERSION_CONF: { 1438 htt->target_version_major = resp->ver_resp.major; 1439 htt->target_version_minor = resp->ver_resp.minor; 1440 complete(&htt->target_version_received); 1441 break; 1442 } 1443 case HTT_T2H_MSG_TYPE_RX_IND: 1444 spin_lock_bh(&htt->rx_ring.lock); 1445 __skb_queue_tail(&htt->rx_compl_q, skb); 1446 spin_unlock_bh(&htt->rx_ring.lock); 1447 tasklet_schedule(&htt->txrx_compl_task); 1448 return; 1449 case HTT_T2H_MSG_TYPE_PEER_MAP: { 1450 struct htt_peer_map_event ev = { 1451 .vdev_id = resp->peer_map.vdev_id, 1452 .peer_id = __le16_to_cpu(resp->peer_map.peer_id), 1453 }; 1454 memcpy(ev.addr, resp->peer_map.addr, sizeof(ev.addr)); 1455 ath10k_peer_map_event(htt, &ev); 1456 break; 1457 } 1458 case HTT_T2H_MSG_TYPE_PEER_UNMAP: { 1459 struct htt_peer_unmap_event ev = { 1460 .peer_id = __le16_to_cpu(resp->peer_unmap.peer_id), 1461 }; 1462 ath10k_peer_unmap_event(htt, &ev); 1463 break; 1464 } 1465 case HTT_T2H_MSG_TYPE_MGMT_TX_COMPLETION: { 1466 struct htt_tx_done tx_done = {}; 1467 int status = __le32_to_cpu(resp->mgmt_tx_completion.status); 1468 1469 tx_done.msdu_id = 1470 __le32_to_cpu(resp->mgmt_tx_completion.desc_id); 1471 1472 switch (status) { 1473 case HTT_MGMT_TX_STATUS_OK: 1474 break; 1475 case HTT_MGMT_TX_STATUS_RETRY: 1476 tx_done.no_ack = true; 1477 break; 1478 case HTT_MGMT_TX_STATUS_DROP: 1479 tx_done.discard = true; 1480 break; 1481 } 1482 1483 spin_lock_bh(&htt->tx_lock); 1484 ath10k_txrx_tx_unref(htt, &tx_done); 1485 spin_unlock_bh(&htt->tx_lock); 1486 break; 1487 } 1488 case HTT_T2H_MSG_TYPE_TX_COMPL_IND: 1489 spin_lock_bh(&htt->tx_lock); 1490 __skb_queue_tail(&htt->tx_compl_q, skb); 1491 spin_unlock_bh(&htt->tx_lock); 1492 tasklet_schedule(&htt->txrx_compl_task); 1493 return; 1494 case HTT_T2H_MSG_TYPE_SEC_IND: { 1495 struct ath10k *ar = htt->ar; 1496 struct htt_security_indication *ev = &resp->security_indication; 1497 1498 ath10k_dbg(ATH10K_DBG_HTT, 1499 "sec ind peer_id %d unicast %d type %d\n", 1500 __le16_to_cpu(ev->peer_id), 1501 !!(ev->flags & HTT_SECURITY_IS_UNICAST), 1502 MS(ev->flags, HTT_SECURITY_TYPE)); 1503 complete(&ar->install_key_done); 1504 break; 1505 } 1506 case HTT_T2H_MSG_TYPE_RX_FRAG_IND: { 1507 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt event: ", 1508 skb->data, skb->len); 1509 ath10k_htt_rx_frag_handler(htt, &resp->rx_frag_ind); 1510 break; 1511 } 1512 case HTT_T2H_MSG_TYPE_TEST: 1513 /* FIX THIS */ 1514 break; 1515 case HTT_T2H_MSG_TYPE_STATS_CONF: 1516 trace_ath10k_htt_stats(skb->data, skb->len); 1517 break; 1518 case HTT_T2H_MSG_TYPE_TX_INSPECT_IND: 1519 case HTT_T2H_MSG_TYPE_RX_ADDBA: 1520 case HTT_T2H_MSG_TYPE_RX_DELBA: 1521 case HTT_T2H_MSG_TYPE_RX_FLUSH: 1522 default: 1523 ath10k_dbg(ATH10K_DBG_HTT, "htt event (%d) not handled\n", 1524 resp->hdr.msg_type); 1525 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt event: ", 1526 skb->data, skb->len); 1527 break; 1528 }; 1529 1530 /* Free the indication buffer */ 1531 dev_kfree_skb_any(skb); 1532 } 1533 1534 static void ath10k_htt_txrx_compl_task(unsigned long ptr) 1535 { 1536 struct ath10k_htt *htt = (struct ath10k_htt *)ptr; 1537 struct htt_resp *resp; 1538 struct sk_buff *skb; 1539 1540 spin_lock_bh(&htt->tx_lock); 1541 while ((skb = __skb_dequeue(&htt->tx_compl_q))) { 1542 ath10k_htt_rx_frm_tx_compl(htt->ar, skb); 1543 dev_kfree_skb_any(skb); 1544 } 1545 spin_unlock_bh(&htt->tx_lock); 1546 1547 spin_lock_bh(&htt->rx_ring.lock); 1548 while ((skb = __skb_dequeue(&htt->rx_compl_q))) { 1549 resp = (struct htt_resp *)skb->data; 1550 ath10k_htt_rx_handler(htt, &resp->rx_ind); 1551 dev_kfree_skb_any(skb); 1552 } 1553 spin_unlock_bh(&htt->rx_ring.lock); 1554 } 1555