1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
11  *
12  * This program is free software; you can redistribute it and/or modify
13  * it under the terms of version 2 of the GNU General Public License as
14  * published by the Free Software Foundation.
15  *
16  * This program is distributed in the hope that it will be useful, but
17  * WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19  * General Public License for more details.
20  *
21  * The full GNU General Public License is included in this distribution
22  * in the file called COPYING.
23  *
24  * Contact Information:
25  *  Intel Linux Wireless <linuxwifi@intel.com>
26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
27  *
28  * BSD LICENSE
29  *
30  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
31  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
32  * All rights reserved.
33  *
34  * Redistribution and use in source and binary forms, with or without
35  * modification, are permitted provided that the following conditions
36  * are met:
37  *
38  *  * Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  *  * Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in
42  *    the documentation and/or other materials provided with the
43  *    distribution.
44  *  * Neither the name Intel Corporation nor the names of its
45  *    contributors may be used to endorse or promote products derived
46  *    from this software without specific prior written permission.
47  *
48  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
49  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
50  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
51  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
52  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
53  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
54  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
55  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
56  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
57  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
58  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
59  *****************************************************************************/
60 #include <linux/etherdevice.h>
61 #include <linux/skbuff.h>
62 #include "iwl-trans.h"
63 #include "mvm.h"
64 #include "fw-api.h"
65 
66 /*
67  * iwl_mvm_rx_rx_phy_cmd - REPLY_RX_PHY_CMD handler
68  *
69  * Copies the phy information in mvm->last_phy_info, it will be used when the
70  * actual data will come from the fw in the next packet.
71  */
72 void iwl_mvm_rx_rx_phy_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
73 {
74 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
75 
76 	memcpy(&mvm->last_phy_info, pkt->data, sizeof(mvm->last_phy_info));
77 	mvm->ampdu_ref++;
78 
79 #ifdef CONFIG_IWLWIFI_DEBUGFS
80 	if (mvm->last_phy_info.phy_flags & cpu_to_le16(RX_RES_PHY_FLAGS_AGG)) {
81 		spin_lock(&mvm->drv_stats_lock);
82 		mvm->drv_rx_stats.ampdu_count++;
83 		spin_unlock(&mvm->drv_stats_lock);
84 	}
85 #endif
86 }
87 
88 /*
89  * iwl_mvm_pass_packet_to_mac80211 - builds the packet for mac80211
90  *
91  * Adds the rxb to a new skb and give it to mac80211
92  */
93 static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
94 					    struct ieee80211_sta *sta,
95 					    struct napi_struct *napi,
96 					    struct sk_buff *skb,
97 					    struct ieee80211_hdr *hdr, u16 len,
98 					    u8 crypt_len,
99 					    struct iwl_rx_cmd_buffer *rxb)
100 {
101 	unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
102 	unsigned int fraglen;
103 
104 	/*
105 	 * The 'hdrlen' (plus the 8 bytes for the SNAP and the crypt_len,
106 	 * but those are all multiples of 4 long) all goes away, but we
107 	 * want the *end* of it, which is going to be the start of the IP
108 	 * header, to be aligned when it gets pulled in.
109 	 * The beginning of the skb->data is aligned on at least a 4-byte
110 	 * boundary after allocation. Everything here is aligned at least
111 	 * on a 2-byte boundary so we can just take hdrlen & 3 and pad by
112 	 * the result.
113 	 */
114 	skb_reserve(skb, hdrlen & 3);
115 
116 	/* If frame is small enough to fit in skb->head, pull it completely.
117 	 * If not, only pull ieee80211_hdr (including crypto if present, and
118 	 * an additional 8 bytes for SNAP/ethertype, see below) so that
119 	 * splice() or TCP coalesce are more efficient.
120 	 *
121 	 * Since, in addition, ieee80211_data_to_8023() always pull in at
122 	 * least 8 bytes (possibly more for mesh) we can do the same here
123 	 * to save the cost of doing it later. That still doesn't pull in
124 	 * the actual IP header since the typical case has a SNAP header.
125 	 * If the latter changes (there are efforts in the standards group
126 	 * to do so) we should revisit this and ieee80211_data_to_8023().
127 	 */
128 	hdrlen = (len <= skb_tailroom(skb)) ? len : hdrlen + crypt_len + 8;
129 
130 	skb_put_data(skb, hdr, hdrlen);
131 	fraglen = len - hdrlen;
132 
133 	if (fraglen) {
134 		int offset = (void *)hdr + hdrlen -
135 			     rxb_addr(rxb) + rxb_offset(rxb);
136 
137 		skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
138 				fraglen, rxb->truesize);
139 	}
140 
141 	ieee80211_rx_napi(mvm->hw, sta, skb, napi);
142 }
143 
144 /*
145  * iwl_mvm_get_signal_strength - use new rx PHY INFO API
146  * values are reported by the fw as positive values - need to negate
147  * to obtain their dBM.  Account for missing antennas by replacing 0
148  * values by -256dBm: practically 0 power and a non-feasible 8 bit value.
149  */
150 static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
151 					struct iwl_rx_phy_info *phy_info,
152 					struct ieee80211_rx_status *rx_status)
153 {
154 	int energy_a, energy_b, energy_c, max_energy;
155 	u32 val;
156 
157 	val =
158 	    le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_ENERGY_ANT_ABC_IDX]);
159 	energy_a = (val & IWL_RX_INFO_ENERGY_ANT_A_MSK) >>
160 						IWL_RX_INFO_ENERGY_ANT_A_POS;
161 	energy_a = energy_a ? -energy_a : S8_MIN;
162 	energy_b = (val & IWL_RX_INFO_ENERGY_ANT_B_MSK) >>
163 						IWL_RX_INFO_ENERGY_ANT_B_POS;
164 	energy_b = energy_b ? -energy_b : S8_MIN;
165 	energy_c = (val & IWL_RX_INFO_ENERGY_ANT_C_MSK) >>
166 						IWL_RX_INFO_ENERGY_ANT_C_POS;
167 	energy_c = energy_c ? -energy_c : S8_MIN;
168 	max_energy = max(energy_a, energy_b);
169 	max_energy = max(max_energy, energy_c);
170 
171 	IWL_DEBUG_STATS(mvm, "energy In A %d B %d C %d , and max %d\n",
172 			energy_a, energy_b, energy_c, max_energy);
173 
174 	rx_status->signal = max_energy;
175 	rx_status->chains = (le16_to_cpu(phy_info->phy_flags) &
176 				RX_RES_PHY_FLAGS_ANTENNA)
177 					>> RX_RES_PHY_FLAGS_ANTENNA_POS;
178 	rx_status->chain_signal[0] = energy_a;
179 	rx_status->chain_signal[1] = energy_b;
180 	rx_status->chain_signal[2] = energy_c;
181 }
182 
183 /*
184  * iwl_mvm_set_mac80211_rx_flag - translate fw status to mac80211 format
185  * @mvm: the mvm object
186  * @hdr: 80211 header
187  * @stats: status in mac80211's format
188  * @rx_pkt_status: status coming from fw
189  *
190  * returns non 0 value if the packet should be dropped
191  */
192 static u32 iwl_mvm_set_mac80211_rx_flag(struct iwl_mvm *mvm,
193 					struct ieee80211_hdr *hdr,
194 					struct ieee80211_rx_status *stats,
195 					u32 rx_pkt_status,
196 					u8 *crypt_len)
197 {
198 	if (!ieee80211_has_protected(hdr->frame_control) ||
199 	    (rx_pkt_status & RX_MPDU_RES_STATUS_SEC_ENC_MSK) ==
200 			     RX_MPDU_RES_STATUS_SEC_NO_ENC)
201 		return 0;
202 
203 	/* packet was encrypted with unknown alg */
204 	if ((rx_pkt_status & RX_MPDU_RES_STATUS_SEC_ENC_MSK) ==
205 					RX_MPDU_RES_STATUS_SEC_ENC_ERR)
206 		return 0;
207 
208 	switch (rx_pkt_status & RX_MPDU_RES_STATUS_SEC_ENC_MSK) {
209 	case RX_MPDU_RES_STATUS_SEC_CCM_ENC:
210 		/* alg is CCM: check MIC only */
211 		if (!(rx_pkt_status & RX_MPDU_RES_STATUS_MIC_OK))
212 			return -1;
213 
214 		stats->flag |= RX_FLAG_DECRYPTED;
215 		*crypt_len = IEEE80211_CCMP_HDR_LEN;
216 		return 0;
217 
218 	case RX_MPDU_RES_STATUS_SEC_TKIP_ENC:
219 		/* Don't drop the frame and decrypt it in SW */
220 		if (!fw_has_api(&mvm->fw->ucode_capa,
221 				IWL_UCODE_TLV_API_DEPRECATE_TTAK) &&
222 		    !(rx_pkt_status & RX_MPDU_RES_STATUS_TTAK_OK))
223 			return 0;
224 		*crypt_len = IEEE80211_TKIP_IV_LEN;
225 		/* fall through */
226 
227 	case RX_MPDU_RES_STATUS_SEC_WEP_ENC:
228 		if (!(rx_pkt_status & RX_MPDU_RES_STATUS_ICV_OK))
229 			return -1;
230 
231 		stats->flag |= RX_FLAG_DECRYPTED;
232 		if ((rx_pkt_status & RX_MPDU_RES_STATUS_SEC_ENC_MSK) ==
233 				RX_MPDU_RES_STATUS_SEC_WEP_ENC)
234 			*crypt_len = IEEE80211_WEP_IV_LEN;
235 		return 0;
236 
237 	case RX_MPDU_RES_STATUS_SEC_EXT_ENC:
238 		if (!(rx_pkt_status & RX_MPDU_RES_STATUS_MIC_OK))
239 			return -1;
240 		stats->flag |= RX_FLAG_DECRYPTED;
241 		return 0;
242 
243 	default:
244 		/* Expected in monitor (not having the keys) */
245 		if (!mvm->monitor_on)
246 			IWL_ERR(mvm, "Unhandled alg: 0x%x\n", rx_pkt_status);
247 	}
248 
249 	return 0;
250 }
251 
252 static void iwl_mvm_rx_handle_tcm(struct iwl_mvm *mvm,
253 				  struct ieee80211_sta *sta,
254 				  struct ieee80211_hdr *hdr, u32 len,
255 				  struct iwl_rx_phy_info *phy_info,
256 				  u32 rate_n_flags)
257 {
258 	struct iwl_mvm_sta *mvmsta;
259 	struct iwl_mvm_tcm_mac *mdata;
260 	int mac;
261 	int ac = IEEE80211_AC_BE; /* treat non-QoS as BE */
262 	struct iwl_mvm_vif *mvmvif;
263 	/* expected throughput in 100Kbps, single stream, 20 MHz */
264 	static const u8 thresh_tpt[] = {
265 		9, 18, 30, 42, 60, 78, 90, 96, 120, 135,
266 	};
267 	u16 thr;
268 
269 	if (ieee80211_is_data_qos(hdr->frame_control))
270 		ac = tid_to_mac80211_ac[ieee80211_get_tid(hdr)];
271 
272 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
273 	mac = mvmsta->mac_id_n_color & FW_CTXT_ID_MSK;
274 
275 	if (time_after(jiffies, mvm->tcm.ts + MVM_TCM_PERIOD))
276 		schedule_delayed_work(&mvm->tcm.work, 0);
277 	mdata = &mvm->tcm.data[mac];
278 	mdata->rx.pkts[ac]++;
279 
280 	/* count the airtime only once for each ampdu */
281 	if (mdata->rx.last_ampdu_ref != mvm->ampdu_ref) {
282 		mdata->rx.last_ampdu_ref = mvm->ampdu_ref;
283 		mdata->rx.airtime += le16_to_cpu(phy_info->frame_time);
284 	}
285 
286 	if (!(rate_n_flags & (RATE_MCS_HT_MSK | RATE_MCS_VHT_MSK)))
287 		return;
288 
289 	mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
290 
291 	if (mdata->opened_rx_ba_sessions ||
292 	    mdata->uapsd_nonagg_detect.detected ||
293 	    (!mvmvif->queue_params[IEEE80211_AC_VO].uapsd &&
294 	     !mvmvif->queue_params[IEEE80211_AC_VI].uapsd &&
295 	     !mvmvif->queue_params[IEEE80211_AC_BE].uapsd &&
296 	     !mvmvif->queue_params[IEEE80211_AC_BK].uapsd) ||
297 	    mvmsta->sta_id != mvmvif->ap_sta_id)
298 		return;
299 
300 	if (rate_n_flags & RATE_MCS_HT_MSK) {
301 		thr = thresh_tpt[rate_n_flags & RATE_HT_MCS_RATE_CODE_MSK];
302 		thr *= 1 + ((rate_n_flags & RATE_HT_MCS_NSS_MSK) >>
303 					RATE_HT_MCS_NSS_POS);
304 	} else {
305 		if (WARN_ON((rate_n_flags & RATE_VHT_MCS_RATE_CODE_MSK) >=
306 				ARRAY_SIZE(thresh_tpt)))
307 			return;
308 		thr = thresh_tpt[rate_n_flags & RATE_VHT_MCS_RATE_CODE_MSK];
309 		thr *= 1 + ((rate_n_flags & RATE_VHT_MCS_NSS_MSK) >>
310 					RATE_VHT_MCS_NSS_POS);
311 	}
312 
313 	thr <<= ((rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK) >>
314 				RATE_MCS_CHAN_WIDTH_POS);
315 
316 	mdata->uapsd_nonagg_detect.rx_bytes += len;
317 	ewma_rate_add(&mdata->uapsd_nonagg_detect.rate, thr);
318 }
319 
320 static void iwl_mvm_rx_csum(struct ieee80211_sta *sta,
321 			    struct sk_buff *skb,
322 			    u32 status)
323 {
324 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
325 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
326 
327 	if (mvmvif->features & NETIF_F_RXCSUM &&
328 	    status & RX_MPDU_RES_STATUS_CSUM_DONE &&
329 	    status & RX_MPDU_RES_STATUS_CSUM_OK)
330 		skb->ip_summed = CHECKSUM_UNNECESSARY;
331 }
332 
333 /*
334  * iwl_mvm_rx_rx_mpdu - REPLY_RX_MPDU_CMD handler
335  *
336  * Handles the actual data of the Rx packet from the fw
337  */
338 void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
339 			struct iwl_rx_cmd_buffer *rxb)
340 {
341 	struct ieee80211_hdr *hdr;
342 	struct ieee80211_rx_status *rx_status;
343 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
344 	struct iwl_rx_phy_info *phy_info;
345 	struct iwl_rx_mpdu_res_start *rx_res;
346 	struct ieee80211_sta *sta = NULL;
347 	struct sk_buff *skb;
348 	u32 len;
349 	u32 rate_n_flags;
350 	u32 rx_pkt_status;
351 	u8 crypt_len = 0;
352 	bool take_ref;
353 
354 	phy_info = &mvm->last_phy_info;
355 	rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data;
356 	hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res));
357 	len = le16_to_cpu(rx_res->byte_count);
358 	rx_pkt_status = le32_to_cpup((__le32 *)
359 		(pkt->data + sizeof(*rx_res) + len));
360 
361 	/* Dont use dev_alloc_skb(), we'll have enough headroom once
362 	 * ieee80211_hdr pulled.
363 	 */
364 	skb = alloc_skb(128, GFP_ATOMIC);
365 	if (!skb) {
366 		IWL_ERR(mvm, "alloc_skb failed\n");
367 		return;
368 	}
369 
370 	rx_status = IEEE80211_SKB_RXCB(skb);
371 
372 	/*
373 	 * drop the packet if it has failed being decrypted by HW
374 	 */
375 	if (iwl_mvm_set_mac80211_rx_flag(mvm, hdr, rx_status, rx_pkt_status,
376 					 &crypt_len)) {
377 		IWL_DEBUG_DROP(mvm, "Bad decryption results 0x%08x\n",
378 			       rx_pkt_status);
379 		kfree_skb(skb);
380 		return;
381 	}
382 
383 	/*
384 	 * Keep packets with CRC errors (and with overrun) for monitor mode
385 	 * (otherwise the firmware discards them) but mark them as bad.
386 	 */
387 	if (!(rx_pkt_status & RX_MPDU_RES_STATUS_CRC_OK) ||
388 	    !(rx_pkt_status & RX_MPDU_RES_STATUS_OVERRUN_OK)) {
389 		IWL_DEBUG_RX(mvm, "Bad CRC or FIFO: 0x%08X.\n", rx_pkt_status);
390 		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
391 	}
392 
393 	/* This will be used in several places later */
394 	rate_n_flags = le32_to_cpu(phy_info->rate_n_flags);
395 
396 	/* rx_status carries information about the packet to mac80211 */
397 	rx_status->mactime = le64_to_cpu(phy_info->timestamp);
398 	rx_status->device_timestamp = le32_to_cpu(phy_info->system_timestamp);
399 	rx_status->band =
400 		(phy_info->phy_flags & cpu_to_le16(RX_RES_PHY_FLAGS_BAND_24)) ?
401 				NL80211_BAND_2GHZ : NL80211_BAND_5GHZ;
402 	rx_status->freq =
403 		ieee80211_channel_to_frequency(le16_to_cpu(phy_info->channel),
404 					       rx_status->band);
405 
406 	/* TSF as indicated by the firmware  is at INA time */
407 	rx_status->flag |= RX_FLAG_MACTIME_PLCP_START;
408 
409 	iwl_mvm_get_signal_strength(mvm, phy_info, rx_status);
410 
411 	IWL_DEBUG_STATS_LIMIT(mvm, "Rssi %d, TSF %llu\n", rx_status->signal,
412 			      (unsigned long long)rx_status->mactime);
413 
414 	rcu_read_lock();
415 	if (rx_pkt_status & RX_MPDU_RES_STATUS_SRC_STA_FOUND) {
416 		u32 id = rx_pkt_status & RX_MPDU_RES_STATUS_STA_ID_MSK;
417 
418 		id >>= RX_MDPU_RES_STATUS_STA_ID_SHIFT;
419 
420 		if (!WARN_ON_ONCE(id >= ARRAY_SIZE(mvm->fw_id_to_mac_id))) {
421 			sta = rcu_dereference(mvm->fw_id_to_mac_id[id]);
422 			if (IS_ERR(sta))
423 				sta = NULL;
424 		}
425 	} else if (!is_multicast_ether_addr(hdr->addr2)) {
426 		/* This is fine since we prevent two stations with the same
427 		 * address from being added.
428 		 */
429 		sta = ieee80211_find_sta_by_ifaddr(mvm->hw, hdr->addr2, NULL);
430 	}
431 
432 	if (sta) {
433 		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
434 		struct ieee80211_vif *tx_blocked_vif =
435 			rcu_dereference(mvm->csa_tx_blocked_vif);
436 		struct iwl_fw_dbg_trigger_tlv *trig;
437 		struct ieee80211_vif *vif = mvmsta->vif;
438 
439 		/* We have tx blocked stations (with CS bit). If we heard
440 		 * frames from a blocked station on a new channel we can
441 		 * TX to it again.
442 		 */
443 		if (unlikely(tx_blocked_vif) && vif == tx_blocked_vif) {
444 			struct iwl_mvm_vif *mvmvif =
445 				iwl_mvm_vif_from_mac80211(tx_blocked_vif);
446 
447 			if (mvmvif->csa_target_freq == rx_status->freq)
448 				iwl_mvm_sta_modify_disable_tx_ap(mvm, sta,
449 								 false);
450 		}
451 
452 		rs_update_last_rssi(mvm, mvmsta, rx_status);
453 
454 		trig = iwl_fw_dbg_trigger_on(&mvm->fwrt,
455 					     ieee80211_vif_to_wdev(vif),
456 					     FW_DBG_TRIGGER_RSSI);
457 
458 		if (trig && ieee80211_is_beacon(hdr->frame_control)) {
459 			struct iwl_fw_dbg_trigger_low_rssi *rssi_trig;
460 			s32 rssi;
461 
462 			rssi_trig = (void *)trig->data;
463 			rssi = le32_to_cpu(rssi_trig->rssi);
464 
465 			if (rx_status->signal < rssi)
466 				iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
467 							NULL);
468 		}
469 
470 		if (!mvm->tcm.paused && len >= sizeof(*hdr) &&
471 		    !is_multicast_ether_addr(hdr->addr1) &&
472 		    ieee80211_is_data(hdr->frame_control))
473 			iwl_mvm_rx_handle_tcm(mvm, sta, hdr, len, phy_info,
474 					      rate_n_flags);
475 
476 		if (ieee80211_is_data(hdr->frame_control))
477 			iwl_mvm_rx_csum(sta, skb, rx_pkt_status);
478 	}
479 	rcu_read_unlock();
480 
481 	/* set the preamble flag if appropriate */
482 	if (phy_info->phy_flags & cpu_to_le16(RX_RES_PHY_FLAGS_SHORT_PREAMBLE))
483 		rx_status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
484 
485 	if (phy_info->phy_flags & cpu_to_le16(RX_RES_PHY_FLAGS_AGG)) {
486 		/*
487 		 * We know which subframes of an A-MPDU belong
488 		 * together since we get a single PHY response
489 		 * from the firmware for all of them
490 		 */
491 		rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
492 		rx_status->ampdu_reference = mvm->ampdu_ref;
493 	}
494 
495 	/* Set up the HT phy flags */
496 	switch (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK) {
497 	case RATE_MCS_CHAN_WIDTH_20:
498 		break;
499 	case RATE_MCS_CHAN_WIDTH_40:
500 		rx_status->bw = RATE_INFO_BW_40;
501 		break;
502 	case RATE_MCS_CHAN_WIDTH_80:
503 		rx_status->bw = RATE_INFO_BW_80;
504 		break;
505 	case RATE_MCS_CHAN_WIDTH_160:
506 		rx_status->bw = RATE_INFO_BW_160;
507 		break;
508 	}
509 	if (!(rate_n_flags & RATE_MCS_CCK_MSK) &&
510 	    rate_n_flags & RATE_MCS_SGI_MSK)
511 		rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
512 	if (rate_n_flags & RATE_HT_MCS_GF_MSK)
513 		rx_status->enc_flags |= RX_ENC_FLAG_HT_GF;
514 	if (rate_n_flags & RATE_MCS_LDPC_MSK)
515 		rx_status->enc_flags |= RX_ENC_FLAG_LDPC;
516 	if (rate_n_flags & RATE_MCS_HT_MSK) {
517 		u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
518 				RATE_MCS_STBC_POS;
519 		rx_status->encoding = RX_ENC_HT;
520 		rx_status->rate_idx = rate_n_flags & RATE_HT_MCS_INDEX_MSK;
521 		rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
522 	} else if (rate_n_flags & RATE_MCS_VHT_MSK) {
523 		u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
524 				RATE_MCS_STBC_POS;
525 		rx_status->nss =
526 			((rate_n_flags & RATE_VHT_MCS_NSS_MSK) >>
527 						RATE_VHT_MCS_NSS_POS) + 1;
528 		rx_status->rate_idx = rate_n_flags & RATE_VHT_MCS_RATE_CODE_MSK;
529 		rx_status->encoding = RX_ENC_VHT;
530 		rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
531 		if (rate_n_flags & RATE_MCS_BF_MSK)
532 			rx_status->enc_flags |= RX_ENC_FLAG_BF;
533 	} else {
534 		int rate = iwl_mvm_legacy_rate_to_mac80211_idx(rate_n_flags,
535 							       rx_status->band);
536 
537 		if (WARN(rate < 0 || rate > 0xFF,
538 			 "Invalid rate flags 0x%x, band %d,\n",
539 			 rate_n_flags, rx_status->band)) {
540 			kfree_skb(skb);
541 			return;
542 		}
543 		rx_status->rate_idx = rate;
544 	}
545 
546 #ifdef CONFIG_IWLWIFI_DEBUGFS
547 	iwl_mvm_update_frame_stats(mvm, rate_n_flags,
548 				   rx_status->flag & RX_FLAG_AMPDU_DETAILS);
549 #endif
550 
551 	if (unlikely((ieee80211_is_beacon(hdr->frame_control) ||
552 		      ieee80211_is_probe_resp(hdr->frame_control)) &&
553 		     mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED))
554 		mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_FOUND;
555 
556 	if (unlikely(ieee80211_is_beacon(hdr->frame_control) ||
557 		     ieee80211_is_probe_resp(hdr->frame_control)))
558 		rx_status->boottime_ns = ktime_get_boot_ns();
559 
560 	/* Take a reference briefly to kick off a d0i3 entry delay so
561 	 * we can handle bursts of RX packets without toggling the
562 	 * state too often.  But don't do this for beacons if we are
563 	 * going to idle because the beacon filtering changes we make
564 	 * cause the firmware to send us collateral beacons. */
565 	take_ref = !(test_bit(STATUS_TRANS_GOING_IDLE, &mvm->trans->status) &&
566 		     ieee80211_is_beacon(hdr->frame_control));
567 
568 	if (take_ref)
569 		iwl_mvm_ref(mvm, IWL_MVM_REF_RX);
570 
571 	iwl_mvm_pass_packet_to_mac80211(mvm, sta, napi, skb, hdr, len,
572 					crypt_len, rxb);
573 
574 	if (take_ref)
575 		iwl_mvm_unref(mvm, IWL_MVM_REF_RX);
576 }
577 
578 struct iwl_mvm_stat_data {
579 	struct iwl_mvm *mvm;
580 	__le32 mac_id;
581 	u8 beacon_filter_average_energy;
582 	void *general;
583 };
584 
585 static void iwl_mvm_stat_iterator(void *_data, u8 *mac,
586 				  struct ieee80211_vif *vif)
587 {
588 	struct iwl_mvm_stat_data *data = _data;
589 	struct iwl_mvm *mvm = data->mvm;
590 	int sig = -data->beacon_filter_average_energy;
591 	int last_event;
592 	int thold = vif->bss_conf.cqm_rssi_thold;
593 	int hyst = vif->bss_conf.cqm_rssi_hyst;
594 	u16 id = le32_to_cpu(data->mac_id);
595 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
596 	u16 vif_id = mvmvif->id;
597 
598 	/* This doesn't need the MAC ID check since it's not taking the
599 	 * data copied into the "data" struct, but rather the data from
600 	 * the notification directly.
601 	 */
602 	if (iwl_mvm_has_new_rx_stats_api(mvm)) {
603 		struct mvm_statistics_general *general =
604 			data->general;
605 
606 		mvmvif->beacon_stats.num_beacons =
607 			le32_to_cpu(general->beacon_counter[vif_id]);
608 		mvmvif->beacon_stats.avg_signal =
609 			-general->beacon_average_energy[vif_id];
610 	} else {
611 		struct mvm_statistics_general_v8 *general =
612 			data->general;
613 
614 		mvmvif->beacon_stats.num_beacons =
615 			le32_to_cpu(general->beacon_counter[vif_id]);
616 		mvmvif->beacon_stats.avg_signal =
617 			-general->beacon_average_energy[vif_id];
618 	}
619 
620 	if (mvmvif->id != id)
621 		return;
622 
623 	if (vif->type != NL80211_IFTYPE_STATION)
624 		return;
625 
626 	if (sig == 0) {
627 		IWL_DEBUG_RX(mvm, "RSSI is 0 - skip signal based decision\n");
628 		return;
629 	}
630 
631 	mvmvif->bf_data.ave_beacon_signal = sig;
632 
633 	/* BT Coex */
634 	if (mvmvif->bf_data.bt_coex_min_thold !=
635 	    mvmvif->bf_data.bt_coex_max_thold) {
636 		last_event = mvmvif->bf_data.last_bt_coex_event;
637 		if (sig > mvmvif->bf_data.bt_coex_max_thold &&
638 		    (last_event <= mvmvif->bf_data.bt_coex_min_thold ||
639 		     last_event == 0)) {
640 			mvmvif->bf_data.last_bt_coex_event = sig;
641 			IWL_DEBUG_RX(mvm, "cqm_iterator bt coex high %d\n",
642 				     sig);
643 			iwl_mvm_bt_rssi_event(mvm, vif, RSSI_EVENT_HIGH);
644 		} else if (sig < mvmvif->bf_data.bt_coex_min_thold &&
645 			   (last_event >= mvmvif->bf_data.bt_coex_max_thold ||
646 			    last_event == 0)) {
647 			mvmvif->bf_data.last_bt_coex_event = sig;
648 			IWL_DEBUG_RX(mvm, "cqm_iterator bt coex low %d\n",
649 				     sig);
650 			iwl_mvm_bt_rssi_event(mvm, vif, RSSI_EVENT_LOW);
651 		}
652 	}
653 
654 	if (!(vif->driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI))
655 		return;
656 
657 	/* CQM Notification */
658 	last_event = mvmvif->bf_data.last_cqm_event;
659 	if (thold && sig < thold && (last_event == 0 ||
660 				     sig < last_event - hyst)) {
661 		mvmvif->bf_data.last_cqm_event = sig;
662 		IWL_DEBUG_RX(mvm, "cqm_iterator cqm low %d\n",
663 			     sig);
664 		ieee80211_cqm_rssi_notify(
665 			vif,
666 			NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
667 			sig,
668 			GFP_KERNEL);
669 	} else if (sig > thold &&
670 		   (last_event == 0 || sig > last_event + hyst)) {
671 		mvmvif->bf_data.last_cqm_event = sig;
672 		IWL_DEBUG_RX(mvm, "cqm_iterator cqm high %d\n",
673 			     sig);
674 		ieee80211_cqm_rssi_notify(
675 			vif,
676 			NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
677 			sig,
678 			GFP_KERNEL);
679 	}
680 }
681 
682 static inline void
683 iwl_mvm_rx_stats_check_trigger(struct iwl_mvm *mvm, struct iwl_rx_packet *pkt)
684 {
685 	struct iwl_fw_dbg_trigger_tlv *trig;
686 	struct iwl_fw_dbg_trigger_stats *trig_stats;
687 	u32 trig_offset, trig_thold;
688 
689 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, NULL, FW_DBG_TRIGGER_STATS);
690 	if (!trig)
691 		return;
692 
693 	trig_stats = (void *)trig->data;
694 
695 	trig_offset = le32_to_cpu(trig_stats->stop_offset);
696 	trig_thold = le32_to_cpu(trig_stats->stop_threshold);
697 
698 	if (WARN_ON_ONCE(trig_offset >= iwl_rx_packet_payload_len(pkt)))
699 		return;
700 
701 	if (le32_to_cpup((__le32 *) (pkt->data + trig_offset)) < trig_thold)
702 		return;
703 
704 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig, NULL);
705 }
706 
707 void iwl_mvm_handle_rx_statistics(struct iwl_mvm *mvm,
708 				  struct iwl_rx_packet *pkt)
709 {
710 	struct iwl_mvm_stat_data data = {
711 		.mvm = mvm,
712 	};
713 	int expected_size;
714 	int i;
715 	u8 *energy;
716 	__le32 *bytes;
717 	__le32 *air_time;
718 	__le32 flags;
719 
720 	if (!iwl_mvm_has_new_rx_stats_api(mvm)) {
721 		if (iwl_mvm_has_new_rx_api(mvm))
722 			expected_size = sizeof(struct iwl_notif_statistics_v11);
723 		else
724 			expected_size = sizeof(struct iwl_notif_statistics_v10);
725 	} else {
726 		expected_size = sizeof(struct iwl_notif_statistics);
727 	}
728 
729 	if (WARN_ONCE(iwl_rx_packet_payload_len(pkt) != expected_size,
730 		      "received invalid statistics size (%d)!\n",
731 		      iwl_rx_packet_payload_len(pkt)))
732 		return;
733 
734 	if (!iwl_mvm_has_new_rx_stats_api(mvm)) {
735 		struct iwl_notif_statistics_v11 *stats = (void *)&pkt->data;
736 
737 		data.mac_id = stats->rx.general.mac_id;
738 		data.beacon_filter_average_energy =
739 			stats->general.common.beacon_filter_average_energy;
740 
741 		mvm->rx_stats_v3 = stats->rx;
742 
743 		mvm->radio_stats.rx_time =
744 			le64_to_cpu(stats->general.common.rx_time);
745 		mvm->radio_stats.tx_time =
746 			le64_to_cpu(stats->general.common.tx_time);
747 		mvm->radio_stats.on_time_rf =
748 			le64_to_cpu(stats->general.common.on_time_rf);
749 		mvm->radio_stats.on_time_scan =
750 			le64_to_cpu(stats->general.common.on_time_scan);
751 
752 		data.general = &stats->general;
753 
754 		flags = stats->flag;
755 	} else {
756 		struct iwl_notif_statistics *stats = (void *)&pkt->data;
757 
758 		data.mac_id = stats->rx.general.mac_id;
759 		data.beacon_filter_average_energy =
760 			stats->general.common.beacon_filter_average_energy;
761 
762 		mvm->rx_stats = stats->rx;
763 
764 		mvm->radio_stats.rx_time =
765 			le64_to_cpu(stats->general.common.rx_time);
766 		mvm->radio_stats.tx_time =
767 			le64_to_cpu(stats->general.common.tx_time);
768 		mvm->radio_stats.on_time_rf =
769 			le64_to_cpu(stats->general.common.on_time_rf);
770 		mvm->radio_stats.on_time_scan =
771 			le64_to_cpu(stats->general.common.on_time_scan);
772 
773 		data.general = &stats->general;
774 
775 		flags = stats->flag;
776 	}
777 
778 	iwl_mvm_rx_stats_check_trigger(mvm, pkt);
779 
780 	ieee80211_iterate_active_interfaces(mvm->hw,
781 					    IEEE80211_IFACE_ITER_NORMAL,
782 					    iwl_mvm_stat_iterator,
783 					    &data);
784 
785 	if (!iwl_mvm_has_new_rx_api(mvm))
786 		return;
787 
788 	if (!iwl_mvm_has_new_rx_stats_api(mvm)) {
789 		struct iwl_notif_statistics_v11 *v11 = (void *)&pkt->data;
790 
791 		energy = (void *)&v11->load_stats.avg_energy;
792 		bytes = (void *)&v11->load_stats.byte_count;
793 		air_time = (void *)&v11->load_stats.air_time;
794 	} else {
795 		struct iwl_notif_statistics *stats = (void *)&pkt->data;
796 
797 		energy = (void *)&stats->load_stats.avg_energy;
798 		bytes = (void *)&stats->load_stats.byte_count;
799 		air_time = (void *)&stats->load_stats.air_time;
800 	}
801 
802 	rcu_read_lock();
803 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
804 		struct iwl_mvm_sta *sta;
805 
806 		if (!energy[i])
807 			continue;
808 
809 		sta = iwl_mvm_sta_from_staid_rcu(mvm, i);
810 		if (!sta)
811 			continue;
812 		sta->avg_energy = energy[i];
813 	}
814 	rcu_read_unlock();
815 
816 	/*
817 	 * Don't update in case the statistics are not cleared, since
818 	 * we will end up counting twice the same airtime, once in TCM
819 	 * request and once in statistics notification.
820 	 */
821 	if (!(le32_to_cpu(flags) & IWL_STATISTICS_REPLY_FLG_CLEAR))
822 		return;
823 
824 	spin_lock(&mvm->tcm.lock);
825 	for (i = 0; i < NUM_MAC_INDEX_DRIVER; i++) {
826 		struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[i];
827 		u32 airtime = le32_to_cpu(air_time[i]);
828 		u32 rx_bytes = le32_to_cpu(bytes[i]);
829 
830 		mdata->uapsd_nonagg_detect.rx_bytes += rx_bytes;
831 		if (airtime) {
832 			/* re-init every time to store rate from FW */
833 			ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
834 			ewma_rate_add(&mdata->uapsd_nonagg_detect.rate,
835 				      rx_bytes * 8 / airtime);
836 		}
837 
838 		mdata->rx.airtime += airtime;
839 	}
840 	spin_unlock(&mvm->tcm.lock);
841 }
842 
843 void iwl_mvm_rx_statistics(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
844 {
845 	iwl_mvm_handle_rx_statistics(mvm, rxb_addr(rxb));
846 }
847 
848 void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
849 				 struct iwl_rx_cmd_buffer *rxb)
850 {
851 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
852 	struct iwl_ba_window_status_notif *notif = (void *)pkt->data;
853 	int i;
854 	u32 pkt_len = iwl_rx_packet_payload_len(pkt);
855 
856 	if (WARN_ONCE(pkt_len != sizeof(*notif),
857 		      "Received window status notification of wrong size (%u)\n",
858 		      pkt_len))
859 		return;
860 
861 	rcu_read_lock();
862 	for (i = 0; i < BA_WINDOW_STREAMS_MAX; i++) {
863 		struct ieee80211_sta *sta;
864 		u8 sta_id, tid;
865 		u64 bitmap;
866 		u32 ssn;
867 		u16 ratid;
868 		u16 received_mpdu;
869 
870 		ratid = le16_to_cpu(notif->ra_tid[i]);
871 		/* check that this TID is valid */
872 		if (!(ratid & BA_WINDOW_STATUS_VALID_MSK))
873 			continue;
874 
875 		received_mpdu = le16_to_cpu(notif->mpdu_rx_count[i]);
876 		if (received_mpdu == 0)
877 			continue;
878 
879 		tid = ratid & BA_WINDOW_STATUS_TID_MSK;
880 		/* get the station */
881 		sta_id = (ratid & BA_WINDOW_STATUS_STA_ID_MSK)
882 			 >> BA_WINDOW_STATUS_STA_ID_POS;
883 		sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
884 		if (IS_ERR_OR_NULL(sta))
885 			continue;
886 		bitmap = le64_to_cpu(notif->bitmap[i]);
887 		ssn = le32_to_cpu(notif->start_seq_num[i]);
888 
889 		/* update mac80211 with the bitmap for the reordering buffer */
890 		ieee80211_mark_rx_ba_filtered_frames(sta, tid, ssn, bitmap,
891 						     received_mpdu);
892 	}
893 	rcu_read_unlock();
894 }
895