2 * Copyright (c) 2005-2011 Atheros Communications Inc.
3 * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
25 #include <linux/log2.h>
27 /* slightly larger than one large A-MPDU */
28 #define HTT_RX_RING_SIZE_MIN 128
30 /* roughly 20 ms @ 1 Gbps of 1500B MSDUs */
31 #define HTT_RX_RING_SIZE_MAX 2048
33 #define HTT_RX_AVG_FRM_BYTES 1000
35 /* ms, very conservative */
36 #define HTT_RX_HOST_LATENCY_MAX_MS 20
38 /* ms, conservative */
39 #define HTT_RX_HOST_LATENCY_WORST_LIKELY_MS 10
41 /* when under memory pressure rx ring refill may fail and needs a retry */
42 #define HTT_RX_RING_REFILL_RETRY_MS 50
45 static int ath10k_htt_rx_get_csum_state(struct sk_buff
*skb
);
46 static void ath10k_htt_txrx_compl_task(unsigned long ptr
);
48 static int ath10k_htt_rx_ring_size(struct ath10k_htt
*htt
)
53 * It is expected that the host CPU will typically be able to
54 * service the rx indication from one A-MPDU before the rx
55 * indication from the subsequent A-MPDU happens, roughly 1-2 ms
56 * later. However, the rx ring should be sized very conservatively,
57 * to accomodate the worst reasonable delay before the host CPU
58 * services a rx indication interrupt.
60 * The rx ring need not be kept full of empty buffers. In theory,
61 * the htt host SW can dynamically track the low-water mark in the
62 * rx ring, and dynamically adjust the level to which the rx ring
63 * is filled with empty buffers, to dynamically meet the desired
66 * In contrast, it's difficult to resize the rx ring itself, once
67 * it's in use. Thus, the ring itself should be sized very
68 * conservatively, while the degree to which the ring is filled
69 * with empty buffers should be sized moderately conservatively.
72 /* 1e6 bps/mbps / 1e3 ms per sec = 1000 */
74 htt
->max_throughput_mbps
+
76 (8 * HTT_RX_AVG_FRM_BYTES
) * HTT_RX_HOST_LATENCY_MAX_MS
;
78 if (size
< HTT_RX_RING_SIZE_MIN
)
79 size
= HTT_RX_RING_SIZE_MIN
;
81 if (size
> HTT_RX_RING_SIZE_MAX
)
82 size
= HTT_RX_RING_SIZE_MAX
;
84 size
= roundup_pow_of_two(size
);
89 static int ath10k_htt_rx_ring_fill_level(struct ath10k_htt
*htt
)
93 /* 1e6 bps/mbps / 1e3 ms per sec = 1000 */
95 htt
->max_throughput_mbps
*
97 (8 * HTT_RX_AVG_FRM_BYTES
) * HTT_RX_HOST_LATENCY_WORST_LIKELY_MS
;
100 * Make sure the fill level is at least 1 less than the ring size.
101 * Leaving 1 element empty allows the SW to easily distinguish
102 * between a full ring vs. an empty ring.
104 if (size
>= htt
->rx_ring
.size
)
105 size
= htt
->rx_ring
.size
- 1;
110 static void ath10k_htt_rx_ring_free(struct ath10k_htt
*htt
)
113 struct ath10k_skb_cb
*cb
;
116 for (i
= 0; i
< htt
->rx_ring
.fill_cnt
; i
++) {
117 skb
= htt
->rx_ring
.netbufs_ring
[i
];
118 cb
= ATH10K_SKB_CB(skb
);
119 dma_unmap_single(htt
->ar
->dev
, cb
->paddr
,
120 skb
->len
+ skb_tailroom(skb
),
122 dev_kfree_skb_any(skb
);
125 htt
->rx_ring
.fill_cnt
= 0;
128 static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt
*htt
, int num
)
130 struct htt_rx_desc
*rx_desc
;
135 idx
= __le32_to_cpu(*(htt
->rx_ring
.alloc_idx
.vaddr
));
137 skb
= dev_alloc_skb(HTT_RX_BUF_SIZE
+ HTT_RX_DESC_ALIGN
);
143 if (!IS_ALIGNED((unsigned long)skb
->data
, HTT_RX_DESC_ALIGN
))
145 PTR_ALIGN(skb
->data
, HTT_RX_DESC_ALIGN
) -
148 /* Clear rx_desc attention word before posting to Rx ring */
149 rx_desc
= (struct htt_rx_desc
*)skb
->data
;
150 rx_desc
->attention
.flags
= __cpu_to_le32(0);
152 paddr
= dma_map_single(htt
->ar
->dev
, skb
->data
,
153 skb
->len
+ skb_tailroom(skb
),
156 if (unlikely(dma_mapping_error(htt
->ar
->dev
, paddr
))) {
157 dev_kfree_skb_any(skb
);
162 ATH10K_SKB_CB(skb
)->paddr
= paddr
;
163 htt
->rx_ring
.netbufs_ring
[idx
] = skb
;
164 htt
->rx_ring
.paddrs_ring
[idx
] = __cpu_to_le32(paddr
);
165 htt
->rx_ring
.fill_cnt
++;
169 idx
&= htt
->rx_ring
.size_mask
;
173 *(htt
->rx_ring
.alloc_idx
.vaddr
) = __cpu_to_le32(idx
);
177 static int ath10k_htt_rx_ring_fill_n(struct ath10k_htt
*htt
, int num
)
179 lockdep_assert_held(&htt
->rx_ring
.lock
);
180 return __ath10k_htt_rx_ring_fill_n(htt
, num
);
183 static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt
*htt
)
185 int ret
, num_deficit
, num_to_fill
;
187 /* Refilling the whole RX ring buffer proves to be a bad idea. The
188 * reason is RX may take up significant amount of CPU cycles and starve
189 * other tasks, e.g. TX on an ethernet device while acting as a bridge
190 * with ath10k wlan interface. This ended up with very poor performance
191 * once CPU the host system was overwhelmed with RX on ath10k.
193 * By limiting the number of refills the replenishing occurs
194 * progressively. This in turns makes use of the fact tasklets are
195 * processed in FIFO order. This means actual RX processing can starve
196 * out refilling. If there's not enough buffers on RX ring FW will not
197 * report RX until it is refilled with enough buffers. This
198 * automatically balances load wrt to CPU power.
200 * This probably comes at a cost of lower maximum throughput but
201 * improves the avarage and stability. */
202 spin_lock_bh(&htt
->rx_ring
.lock
);
203 num_deficit
= htt
->rx_ring
.fill_level
- htt
->rx_ring
.fill_cnt
;
204 num_to_fill
= min(ATH10K_HTT_MAX_NUM_REFILL
, num_deficit
);
205 num_deficit
-= num_to_fill
;
206 ret
= ath10k_htt_rx_ring_fill_n(htt
, num_to_fill
);
207 if (ret
== -ENOMEM
) {
209 * Failed to fill it to the desired level -
210 * we'll start a timer and try again next time.
211 * As long as enough buffers are left in the ring for
212 * another A-MPDU rx, no special recovery is needed.
214 mod_timer(&htt
->rx_ring
.refill_retry_timer
, jiffies
+
215 msecs_to_jiffies(HTT_RX_RING_REFILL_RETRY_MS
));
216 } else if (num_deficit
> 0) {
217 tasklet_schedule(&htt
->rx_replenish_task
);
219 spin_unlock_bh(&htt
->rx_ring
.lock
);
222 static void ath10k_htt_rx_ring_refill_retry(unsigned long arg
)
224 struct ath10k_htt
*htt
= (struct ath10k_htt
*)arg
;
225 ath10k_htt_rx_msdu_buff_replenish(htt
);
228 static void ath10k_htt_rx_ring_clean_up(struct ath10k_htt
*htt
)
233 for (i
= 0; i
< htt
->rx_ring
.size
; i
++) {
234 skb
= htt
->rx_ring
.netbufs_ring
[i
];
238 dma_unmap_single(htt
->ar
->dev
, ATH10K_SKB_CB(skb
)->paddr
,
239 skb
->len
+ skb_tailroom(skb
),
241 dev_kfree_skb_any(skb
);
242 htt
->rx_ring
.netbufs_ring
[i
] = NULL
;
246 void ath10k_htt_rx_free(struct ath10k_htt
*htt
)
248 del_timer_sync(&htt
->rx_ring
.refill_retry_timer
);
249 tasklet_kill(&htt
->rx_replenish_task
);
250 tasklet_kill(&htt
->txrx_compl_task
);
252 skb_queue_purge(&htt
->tx_compl_q
);
253 skb_queue_purge(&htt
->rx_compl_q
);
255 ath10k_htt_rx_ring_clean_up(htt
);
257 dma_free_coherent(htt
->ar
->dev
,
259 sizeof(htt
->rx_ring
.paddrs_ring
)),
260 htt
->rx_ring
.paddrs_ring
,
261 htt
->rx_ring
.base_paddr
);
263 dma_free_coherent(htt
->ar
->dev
,
264 sizeof(*htt
->rx_ring
.alloc_idx
.vaddr
),
265 htt
->rx_ring
.alloc_idx
.vaddr
,
266 htt
->rx_ring
.alloc_idx
.paddr
);
268 kfree(htt
->rx_ring
.netbufs_ring
);
271 static inline struct sk_buff
*ath10k_htt_rx_netbuf_pop(struct ath10k_htt
*htt
)
274 struct sk_buff
*msdu
;
276 lockdep_assert_held(&htt
->rx_ring
.lock
);
278 if (htt
->rx_ring
.fill_cnt
== 0) {
279 ath10k_warn("tried to pop sk_buff from an empty rx ring\n");
283 idx
= htt
->rx_ring
.sw_rd_idx
.msdu_payld
;
284 msdu
= htt
->rx_ring
.netbufs_ring
[idx
];
285 htt
->rx_ring
.netbufs_ring
[idx
] = NULL
;
288 idx
&= htt
->rx_ring
.size_mask
;
289 htt
->rx_ring
.sw_rd_idx
.msdu_payld
= idx
;
290 htt
->rx_ring
.fill_cnt
--;
295 static void ath10k_htt_rx_free_msdu_chain(struct sk_buff
*skb
)
297 struct sk_buff
*next
;
301 dev_kfree_skb_any(skb
);
306 /* return: < 0 fatal error, 0 - non chained msdu, 1 chained msdu */
307 static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt
*htt
,
308 u8
**fw_desc
, int *fw_desc_len
,
309 struct sk_buff
**head_msdu
,
310 struct sk_buff
**tail_msdu
)
312 int msdu_len
, msdu_chaining
= 0;
313 struct sk_buff
*msdu
;
314 struct htt_rx_desc
*rx_desc
;
316 lockdep_assert_held(&htt
->rx_ring
.lock
);
318 if (htt
->rx_confused
) {
319 ath10k_warn("htt is confused. refusing rx\n");
323 msdu
= *head_msdu
= ath10k_htt_rx_netbuf_pop(htt
);
325 int last_msdu
, msdu_len_invalid
, msdu_chained
;
327 dma_unmap_single(htt
->ar
->dev
,
328 ATH10K_SKB_CB(msdu
)->paddr
,
329 msdu
->len
+ skb_tailroom(msdu
),
332 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP
, NULL
, "htt rx pop: ",
333 msdu
->data
, msdu
->len
+ skb_tailroom(msdu
));
335 rx_desc
= (struct htt_rx_desc
*)msdu
->data
;
337 /* FIXME: we must report msdu payload since this is what caller
339 skb_put(msdu
, offsetof(struct htt_rx_desc
, msdu_payload
));
340 skb_pull(msdu
, offsetof(struct htt_rx_desc
, msdu_payload
));
343 * Sanity check - confirm the HW is finished filling in the
345 * If the HW and SW are working correctly, then it's guaranteed
346 * that the HW's MAC DMA is done before this point in the SW.
347 * To prevent the case that we handle a stale Rx descriptor,
348 * just assert for now until we have a way to recover.
350 if (!(__le32_to_cpu(rx_desc
->attention
.flags
)
351 & RX_ATTENTION_FLAGS_MSDU_DONE
)) {
352 ath10k_htt_rx_free_msdu_chain(*head_msdu
);
355 ath10k_err("htt rx stopped. cannot recover\n");
356 htt
->rx_confused
= true;
361 * Copy the FW rx descriptor for this MSDU from the rx
362 * indication message into the MSDU's netbuf. HL uses the
363 * same rx indication message definition as LL, and simply
364 * appends new info (fields from the HW rx desc, and the
365 * MSDU payload itself). So, the offset into the rx
366 * indication message only has to account for the standard
367 * offset of the per-MSDU FW rx desc info within the
368 * message, and how many bytes of the per-MSDU FW rx desc
369 * info have already been consumed. (And the endianness of
370 * the host, since for a big-endian host, the rx ind
371 * message contents, including the per-MSDU rx desc bytes,
372 * were byteswapped during upload.)
374 if (*fw_desc_len
> 0) {
375 rx_desc
->fw_desc
.info0
= **fw_desc
;
377 * The target is expected to only provide the basic
378 * per-MSDU rx descriptors. Just to be sure, verify
379 * that the target has not attached extension data
380 * (e.g. LRO flow ID).
383 /* or more, if there's extension data */
388 * When an oversized AMSDU happened, FW will lost
389 * some of MSDU status - in this case, the FW
390 * descriptors provided will be less than the
391 * actual MSDUs inside this MPDU. Mark the FW
392 * descriptors so that it will still deliver to
393 * upper stack, if no CRC error for this MPDU.
395 * FIX THIS - the FW descriptors are actually for
396 * MSDUs in the end of this A-MSDU instead of the
399 rx_desc
->fw_desc
.info0
= 0;
402 msdu_len_invalid
= !!(__le32_to_cpu(rx_desc
->attention
.flags
)
403 & (RX_ATTENTION_FLAGS_MPDU_LENGTH_ERR
|
404 RX_ATTENTION_FLAGS_MSDU_LENGTH_ERR
));
405 msdu_len
= MS(__le32_to_cpu(rx_desc
->msdu_start
.info0
),
406 RX_MSDU_START_INFO0_MSDU_LENGTH
);
407 msdu_chained
= rx_desc
->frag_info
.ring2_more_count
;
409 if (msdu_len_invalid
)
413 skb_put(msdu
, min(msdu_len
, HTT_RX_MSDU_SIZE
));
414 msdu_len
-= msdu
->len
;
416 /* FIXME: Do chained buffers include htt_rx_desc or not? */
417 while (msdu_chained
--) {
418 struct sk_buff
*next
= ath10k_htt_rx_netbuf_pop(htt
);
420 dma_unmap_single(htt
->ar
->dev
,
421 ATH10K_SKB_CB(next
)->paddr
,
422 next
->len
+ skb_tailroom(next
),
425 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP
, NULL
,
426 "htt rx chained: ", next
->data
,
427 next
->len
+ skb_tailroom(next
));
430 skb_put(next
, min(msdu_len
, HTT_RX_BUF_SIZE
));
431 msdu_len
-= next
->len
;
438 last_msdu
= __le32_to_cpu(rx_desc
->msdu_end
.info0
) &
439 RX_MSDU_END_INFO0_LAST_MSDU
;
445 struct sk_buff
*next
= ath10k_htt_rx_netbuf_pop(htt
);
452 if (*head_msdu
== NULL
)
456 * Don't refill the ring yet.
458 * First, the elements popped here are still in use - it is not
459 * safe to overwrite them until the matching call to
460 * mpdu_desc_list_next. Second, for efficiency it is preferable to
461 * refill the rx ring with 1 PPDU's worth of rx buffers (something
462 * like 32 x 3 buffers), rather than one MPDU's worth of rx buffers
463 * (something like 3 buffers). Consequently, we'll rely on the txrx
464 * SW to tell us when it is done pulling all the PPDU's rx buffers
465 * out of the rx ring, and then refill it just once.
468 return msdu_chaining
;
471 static void ath10k_htt_rx_replenish_task(unsigned long ptr
)
473 struct ath10k_htt
*htt
= (struct ath10k_htt
*)ptr
;
474 ath10k_htt_rx_msdu_buff_replenish(htt
);
477 int ath10k_htt_rx_alloc(struct ath10k_htt
*htt
)
481 struct timer_list
*timer
= &htt
->rx_ring
.refill_retry_timer
;
483 htt
->rx_ring
.size
= ath10k_htt_rx_ring_size(htt
);
484 if (!is_power_of_2(htt
->rx_ring
.size
)) {
485 ath10k_warn("htt rx ring size is not power of 2\n");
489 htt
->rx_ring
.size_mask
= htt
->rx_ring
.size
- 1;
492 * Set the initial value for the level to which the rx ring
493 * should be filled, based on the max throughput and the
494 * worst likely latency for the host to fill the rx ring
495 * with new buffers. In theory, this fill level can be
496 * dynamically adjusted from the initial value set here, to
497 * reflect the actual host latency rather than a
498 * conservative assumption about the host latency.
500 htt
->rx_ring
.fill_level
= ath10k_htt_rx_ring_fill_level(htt
);
502 htt
->rx_ring
.netbufs_ring
=
503 kzalloc(htt
->rx_ring
.size
* sizeof(struct sk_buff
*),
505 if (!htt
->rx_ring
.netbufs_ring
)
508 vaddr
= dma_alloc_coherent(htt
->ar
->dev
,
509 (htt
->rx_ring
.size
* sizeof(htt
->rx_ring
.paddrs_ring
)),
514 htt
->rx_ring
.paddrs_ring
= vaddr
;
515 htt
->rx_ring
.base_paddr
= paddr
;
517 vaddr
= dma_alloc_coherent(htt
->ar
->dev
,
518 sizeof(*htt
->rx_ring
.alloc_idx
.vaddr
),
523 htt
->rx_ring
.alloc_idx
.vaddr
= vaddr
;
524 htt
->rx_ring
.alloc_idx
.paddr
= paddr
;
525 htt
->rx_ring
.sw_rd_idx
.msdu_payld
= 0;
526 *htt
->rx_ring
.alloc_idx
.vaddr
= 0;
528 /* Initialize the Rx refill retry timer */
529 setup_timer(timer
, ath10k_htt_rx_ring_refill_retry
, (unsigned long)htt
);
531 spin_lock_init(&htt
->rx_ring
.lock
);
533 htt
->rx_ring
.fill_cnt
= 0;
534 if (__ath10k_htt_rx_ring_fill_n(htt
, htt
->rx_ring
.fill_level
))
537 tasklet_init(&htt
->rx_replenish_task
, ath10k_htt_rx_replenish_task
,
540 skb_queue_head_init(&htt
->tx_compl_q
);
541 skb_queue_head_init(&htt
->rx_compl_q
);
543 tasklet_init(&htt
->txrx_compl_task
, ath10k_htt_txrx_compl_task
,
546 ath10k_dbg(ATH10K_DBG_BOOT
, "htt rx ring size %d fill_level %d\n",
547 htt
->rx_ring
.size
, htt
->rx_ring
.fill_level
);
551 ath10k_htt_rx_ring_free(htt
);
552 dma_free_coherent(htt
->ar
->dev
,
553 sizeof(*htt
->rx_ring
.alloc_idx
.vaddr
),
554 htt
->rx_ring
.alloc_idx
.vaddr
,
555 htt
->rx_ring
.alloc_idx
.paddr
);
557 dma_free_coherent(htt
->ar
->dev
,
559 sizeof(htt
->rx_ring
.paddrs_ring
)),
560 htt
->rx_ring
.paddrs_ring
,
561 htt
->rx_ring
.base_paddr
);
563 kfree(htt
->rx_ring
.netbufs_ring
);
568 static int ath10k_htt_rx_crypto_param_len(enum htt_rx_mpdu_encrypt_type type
)
571 case HTT_RX_MPDU_ENCRYPT_WEP40
:
572 case HTT_RX_MPDU_ENCRYPT_WEP104
:
574 case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC
:
575 case HTT_RX_MPDU_ENCRYPT_WEP128
: /* not tested */
576 case HTT_RX_MPDU_ENCRYPT_TKIP_WPA
:
577 case HTT_RX_MPDU_ENCRYPT_WAPI
: /* not tested */
578 case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2
:
580 case HTT_RX_MPDU_ENCRYPT_NONE
:
584 ath10k_warn("unknown encryption type %d\n", type
);
588 static int ath10k_htt_rx_crypto_tail_len(enum htt_rx_mpdu_encrypt_type type
)
591 case HTT_RX_MPDU_ENCRYPT_NONE
:
592 case HTT_RX_MPDU_ENCRYPT_WEP40
:
593 case HTT_RX_MPDU_ENCRYPT_WEP104
:
594 case HTT_RX_MPDU_ENCRYPT_WEP128
:
595 case HTT_RX_MPDU_ENCRYPT_WAPI
:
597 case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC
:
598 case HTT_RX_MPDU_ENCRYPT_TKIP_WPA
:
600 case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2
:
604 ath10k_warn("unknown encryption type %d\n", type
);
608 /* Applies for first msdu in chain, before altering it. */
609 static struct ieee80211_hdr
*ath10k_htt_rx_skb_get_hdr(struct sk_buff
*skb
)
611 struct htt_rx_desc
*rxd
;
612 enum rx_msdu_decap_format fmt
;
614 rxd
= (void *)skb
->data
- sizeof(*rxd
);
615 fmt
= MS(__le32_to_cpu(rxd
->msdu_start
.info1
),
616 RX_MSDU_START_INFO1_DECAP_FORMAT
);
618 if (fmt
== RX_MSDU_DECAP_RAW
)
619 return (void *)skb
->data
;
621 return (void *)skb
->data
- RX_HTT_HDR_STATUS_LEN
;
624 /* This function only applies for first msdu in an msdu chain */
625 static bool ath10k_htt_rx_hdr_is_amsdu(struct ieee80211_hdr
*hdr
)
627 if (ieee80211_is_data_qos(hdr
->frame_control
)) {
628 u8
*qc
= ieee80211_get_qos_ctl(hdr
);
643 struct amsdu_subframe_hdr
{
649 static const u8 rx_legacy_rate_idx
[] = {
650 3, /* 0x00 - 11Mbps */
651 2, /* 0x01 - 5.5Mbps */
652 1, /* 0x02 - 2Mbps */
653 0, /* 0x03 - 1Mbps */
654 3, /* 0x04 - 11Mbps */
655 2, /* 0x05 - 5.5Mbps */
656 1, /* 0x06 - 2Mbps */
657 0, /* 0x07 - 1Mbps */
658 10, /* 0x08 - 48Mbps */
659 8, /* 0x09 - 24Mbps */
660 6, /* 0x0A - 12Mbps */
661 4, /* 0x0B - 6Mbps */
662 11, /* 0x0C - 54Mbps */
663 9, /* 0x0D - 36Mbps */
664 7, /* 0x0E - 18Mbps */
665 5, /* 0x0F - 9Mbps */
668 static void ath10k_htt_rx_h_rates(struct ath10k
*ar
,
669 enum ieee80211_band band
,
670 u8 info0
, u32 info1
, u32 info2
,
671 struct ieee80211_rx_status
*status
)
673 u8 cck
, rate
, rate_idx
, bw
, sgi
, mcs
, nss
;
676 /* Check if valid fields */
677 if (!(info0
& HTT_RX_INDICATION_INFO0_START_VALID
))
680 preamble
= MS(info1
, HTT_RX_INDICATION_INFO1_PREAMBLE_TYPE
);
684 cck
= info0
& HTT_RX_INDICATION_INFO0_LEGACY_RATE_CCK
;
685 rate
= MS(info0
, HTT_RX_INDICATION_INFO0_LEGACY_RATE
);
688 if (rate
< 0x08 || rate
> 0x0F)
692 case IEEE80211_BAND_2GHZ
:
695 rate_idx
= rx_legacy_rate_idx
[rate
];
697 case IEEE80211_BAND_5GHZ
:
698 rate_idx
= rx_legacy_rate_idx
[rate
];
699 /* We are using same rate table registering
700 HW - ath10k_rates[]. In case of 5GHz skip
701 CCK rates, so -4 here */
708 status
->rate_idx
= rate_idx
;
711 case HTT_RX_HT_WITH_TXBF
:
712 /* HT-SIG - Table 20-11 in info1 and info2 */
715 bw
= (info1
>> 7) & 1;
716 sgi
= (info2
>> 7) & 1;
718 status
->rate_idx
= mcs
;
719 status
->flag
|= RX_FLAG_HT
;
721 status
->flag
|= RX_FLAG_SHORT_GI
;
723 status
->flag
|= RX_FLAG_40MHZ
;
726 case HTT_RX_VHT_WITH_TXBF
:
727 /* VHT-SIG-A1 in info 1, VHT-SIG-A2 in info2
729 mcs
= (info2
>> 4) & 0x0F;
730 nss
= ((info1
>> 10) & 0x07) + 1;
734 status
->rate_idx
= mcs
;
735 status
->vht_nss
= nss
;
738 status
->flag
|= RX_FLAG_SHORT_GI
;
746 status
->flag
|= RX_FLAG_40MHZ
;
750 status
->vht_flag
|= RX_VHT_FLAG_80MHZ
;
753 status
->flag
|= RX_FLAG_VHT
;
760 static void ath10k_htt_rx_h_protected(struct ath10k_htt
*htt
,
761 struct ieee80211_rx_status
*rx_status
,
763 enum htt_rx_mpdu_encrypt_type enctype
,
764 enum rx_msdu_decap_format fmt
,
767 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*)skb
->data
;
769 rx_status
->flag
&= ~(RX_FLAG_DECRYPTED
|
770 RX_FLAG_IV_STRIPPED
|
771 RX_FLAG_MMIC_STRIPPED
);
773 if (enctype
== HTT_RX_MPDU_ENCRYPT_NONE
)
777 * There's no explicit rx descriptor flag to indicate whether a given
778 * frame has been decrypted or not. We're forced to use the decap
779 * format as an implicit indication. However fragmentation rx is always
780 * raw and it probably never reports undecrypted raws.
782 * This makes sure sniffed frames are reported as-is without stripping
783 * the protected flag.
785 if (fmt
== RX_MSDU_DECAP_RAW
&& !dot11frag
)
788 rx_status
->flag
|= RX_FLAG_DECRYPTED
|
789 RX_FLAG_IV_STRIPPED
|
790 RX_FLAG_MMIC_STRIPPED
;
791 hdr
->frame_control
= __cpu_to_le16(__le16_to_cpu(hdr
->frame_control
) &
792 ~IEEE80211_FCTL_PROTECTED
);
795 static bool ath10k_htt_rx_h_channel(struct ath10k
*ar
,
796 struct ieee80211_rx_status
*status
)
798 struct ieee80211_channel
*ch
;
800 spin_lock_bh(&ar
->data_lock
);
801 ch
= ar
->scan_channel
;
804 spin_unlock_bh(&ar
->data_lock
);
809 status
->band
= ch
->band
;
810 status
->freq
= ch
->center_freq
;
815 static void ath10k_process_rx(struct ath10k
*ar
,
816 struct ieee80211_rx_status
*rx_status
,
819 struct ieee80211_rx_status
*status
;
821 status
= IEEE80211_SKB_RXCB(skb
);
822 *status
= *rx_status
;
824 ath10k_dbg(ATH10K_DBG_DATA
,
825 "rx skb %p len %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %imic-err %i\n",
828 status
->flag
== 0 ? "legacy" : "",
829 status
->flag
& RX_FLAG_HT
? "ht" : "",
830 status
->flag
& RX_FLAG_VHT
? "vht" : "",
831 status
->flag
& RX_FLAG_40MHZ
? "40" : "",
832 status
->vht_flag
& RX_VHT_FLAG_80MHZ
? "80" : "",
833 status
->flag
& RX_FLAG_SHORT_GI
? "sgi " : "",
837 status
->band
, status
->flag
,
838 !!(status
->flag
& RX_FLAG_FAILED_FCS_CRC
),
839 !!(status
->flag
& RX_FLAG_MMIC_ERROR
));
840 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP
, NULL
, "rx skb: ",
841 skb
->data
, skb
->len
);
843 ieee80211_rx(ar
->hw
, skb
);
846 static int ath10k_htt_rx_nwifi_hdrlen(struct ieee80211_hdr
*hdr
)
848 /* nwifi header is padded to 4 bytes. this fixes 4addr rx */
849 return round_up(ieee80211_hdrlen(hdr
->frame_control
), 4);
852 static void ath10k_htt_rx_amsdu(struct ath10k_htt
*htt
,
853 struct ieee80211_rx_status
*rx_status
,
854 struct sk_buff
*skb_in
)
856 struct htt_rx_desc
*rxd
;
857 struct sk_buff
*skb
= skb_in
;
858 struct sk_buff
*first
;
859 enum rx_msdu_decap_format fmt
;
860 enum htt_rx_mpdu_encrypt_type enctype
;
861 struct ieee80211_hdr
*hdr
;
862 u8 hdr_buf
[64], addr
[ETH_ALEN
], *qos
;
863 unsigned int hdr_len
;
865 rxd
= (void *)skb
->data
- sizeof(*rxd
);
866 enctype
= MS(__le32_to_cpu(rxd
->mpdu_start
.info0
),
867 RX_MPDU_START_INFO0_ENCRYPT_TYPE
);
869 hdr
= (struct ieee80211_hdr
*)rxd
->rx_hdr_status
;
870 hdr_len
= ieee80211_hdrlen(hdr
->frame_control
);
871 memcpy(hdr_buf
, hdr
, hdr_len
);
872 hdr
= (struct ieee80211_hdr
*)hdr_buf
;
879 rxd
= (void *)skb
->data
- sizeof(*rxd
);
880 fmt
= MS(__le32_to_cpu(rxd
->msdu_start
.info1
),
881 RX_MSDU_START_INFO1_DECAP_FORMAT
);
882 decap_hdr
= (void *)rxd
->rx_hdr_status
;
884 skb
->ip_summed
= ath10k_htt_rx_get_csum_state(skb
);
886 /* First frame in an A-MSDU chain has more decapped data. */
888 len
= round_up(ieee80211_hdrlen(hdr
->frame_control
), 4);
889 len
+= round_up(ath10k_htt_rx_crypto_param_len(enctype
),
895 case RX_MSDU_DECAP_RAW
:
896 /* remove trailing FCS */
897 skb_trim(skb
, skb
->len
- FCS_LEN
);
899 case RX_MSDU_DECAP_NATIVE_WIFI
:
900 /* pull decapped header and copy DA */
901 hdr
= (struct ieee80211_hdr
*)skb
->data
;
902 hdr_len
= ath10k_htt_rx_nwifi_hdrlen(hdr
);
903 memcpy(addr
, ieee80211_get_DA(hdr
), ETH_ALEN
);
904 skb_pull(skb
, hdr_len
);
906 /* push original 802.11 header */
907 hdr
= (struct ieee80211_hdr
*)hdr_buf
;
908 hdr_len
= ieee80211_hdrlen(hdr
->frame_control
);
909 memcpy(skb_push(skb
, hdr_len
), hdr
, hdr_len
);
911 /* original A-MSDU header has the bit set but we're
912 * not including A-MSDU subframe header */
913 hdr
= (struct ieee80211_hdr
*)skb
->data
;
914 qos
= ieee80211_get_qos_ctl(hdr
);
915 qos
[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT
;
917 /* original 802.11 header has a different DA */
918 memcpy(ieee80211_get_DA(hdr
), addr
, ETH_ALEN
);
920 case RX_MSDU_DECAP_ETHERNET2_DIX
:
921 /* strip ethernet header and insert decapped 802.11
922 * header, amsdu subframe header and rfc1042 header */
925 len
+= sizeof(struct rfc1042_hdr
);
926 len
+= sizeof(struct amsdu_subframe_hdr
);
928 skb_pull(skb
, sizeof(struct ethhdr
));
929 memcpy(skb_push(skb
, len
), decap_hdr
, len
);
930 memcpy(skb_push(skb
, hdr_len
), hdr
, hdr_len
);
932 case RX_MSDU_DECAP_8023_SNAP_LLC
:
933 /* insert decapped 802.11 header making a singly
935 memcpy(skb_push(skb
, hdr_len
), hdr
, hdr_len
);
940 ath10k_htt_rx_h_protected(htt
, rx_status
, skb_in
, enctype
, fmt
,
946 rx_status
->flag
|= RX_FLAG_AMSDU_MORE
;
948 rx_status
->flag
&= ~RX_FLAG_AMSDU_MORE
;
950 ath10k_process_rx(htt
->ar
, rx_status
, skb_in
);
953 /* FIXME: It might be nice to re-assemble the A-MSDU when there's a
954 * monitor interface active for sniffing purposes. */
957 static void ath10k_htt_rx_msdu(struct ath10k_htt
*htt
,
958 struct ieee80211_rx_status
*rx_status
,
961 struct htt_rx_desc
*rxd
;
962 struct ieee80211_hdr
*hdr
;
963 enum rx_msdu_decap_format fmt
;
964 enum htt_rx_mpdu_encrypt_type enctype
;
968 /* This shouldn't happen. If it does than it may be a FW bug. */
970 ath10k_warn("htt rx received chained non A-MSDU frame\n");
971 ath10k_htt_rx_free_msdu_chain(skb
->next
);
975 rxd
= (void *)skb
->data
- sizeof(*rxd
);
976 fmt
= MS(__le32_to_cpu(rxd
->msdu_start
.info1
),
977 RX_MSDU_START_INFO1_DECAP_FORMAT
);
978 enctype
= MS(__le32_to_cpu(rxd
->mpdu_start
.info0
),
979 RX_MPDU_START_INFO0_ENCRYPT_TYPE
);
980 hdr
= (struct ieee80211_hdr
*)rxd
->rx_hdr_status
;
981 hdr_len
= ieee80211_hdrlen(hdr
->frame_control
);
983 skb
->ip_summed
= ath10k_htt_rx_get_csum_state(skb
);
986 case RX_MSDU_DECAP_RAW
:
987 /* remove trailing FCS */
988 skb_trim(skb
, skb
->len
- FCS_LEN
);
990 case RX_MSDU_DECAP_NATIVE_WIFI
:
991 /* Pull decapped header */
992 hdr
= (struct ieee80211_hdr
*)skb
->data
;
993 hdr_len
= ath10k_htt_rx_nwifi_hdrlen(hdr
);
994 skb_pull(skb
, hdr_len
);
996 /* Push original header */
997 hdr
= (struct ieee80211_hdr
*)rxd
->rx_hdr_status
;
998 hdr_len
= ieee80211_hdrlen(hdr
->frame_control
);
999 memcpy(skb_push(skb
, hdr_len
), hdr
, hdr_len
);
1001 case RX_MSDU_DECAP_ETHERNET2_DIX
:
1002 /* strip ethernet header and insert decapped 802.11 header and
1006 rfc1042
+= roundup(hdr_len
, 4);
1007 rfc1042
+= roundup(ath10k_htt_rx_crypto_param_len(enctype
), 4);
1009 skb_pull(skb
, sizeof(struct ethhdr
));
1010 memcpy(skb_push(skb
, sizeof(struct rfc1042_hdr
)),
1011 rfc1042
, sizeof(struct rfc1042_hdr
));
1012 memcpy(skb_push(skb
, hdr_len
), hdr
, hdr_len
);
1014 case RX_MSDU_DECAP_8023_SNAP_LLC
:
1015 /* remove A-MSDU subframe header and insert
1016 * decapped 802.11 header. rfc1042 header is already there */
1018 skb_pull(skb
, sizeof(struct amsdu_subframe_hdr
));
1019 memcpy(skb_push(skb
, hdr_len
), hdr
, hdr_len
);
1023 ath10k_htt_rx_h_protected(htt
, rx_status
, skb
, enctype
, fmt
, false);
1025 ath10k_process_rx(htt
->ar
, rx_status
, skb
);
1028 static int ath10k_htt_rx_get_csum_state(struct sk_buff
*skb
)
1030 struct htt_rx_desc
*rxd
;
1032 bool is_ip4
, is_ip6
;
1033 bool is_tcp
, is_udp
;
1034 bool ip_csum_ok
, tcpudp_csum_ok
;
1036 rxd
= (void *)skb
->data
- sizeof(*rxd
);
1037 flags
= __le32_to_cpu(rxd
->attention
.flags
);
1038 info
= __le32_to_cpu(rxd
->msdu_start
.info1
);
1040 is_ip4
= !!(info
& RX_MSDU_START_INFO1_IPV4_PROTO
);
1041 is_ip6
= !!(info
& RX_MSDU_START_INFO1_IPV6_PROTO
);
1042 is_tcp
= !!(info
& RX_MSDU_START_INFO1_TCP_PROTO
);
1043 is_udp
= !!(info
& RX_MSDU_START_INFO1_UDP_PROTO
);
1044 ip_csum_ok
= !(flags
& RX_ATTENTION_FLAGS_IP_CHKSUM_FAIL
);
1045 tcpudp_csum_ok
= !(flags
& RX_ATTENTION_FLAGS_TCP_UDP_CHKSUM_FAIL
);
1047 if (!is_ip4
&& !is_ip6
)
1048 return CHECKSUM_NONE
;
1049 if (!is_tcp
&& !is_udp
)
1050 return CHECKSUM_NONE
;
1052 return CHECKSUM_NONE
;
1053 if (!tcpudp_csum_ok
)
1054 return CHECKSUM_NONE
;
1056 return CHECKSUM_UNNECESSARY
;
1059 static int ath10k_unchain_msdu(struct sk_buff
*msdu_head
)
1061 struct sk_buff
*next
= msdu_head
->next
;
1062 struct sk_buff
*to_free
= next
;
1066 /* TODO: Might could optimize this by using
1067 * skb_try_coalesce or similar method to
1068 * decrease copying, or maybe get mac80211 to
1069 * provide a way to just receive a list of
1073 msdu_head
->next
= NULL
;
1075 /* Allocate total length all at once. */
1077 total_len
+= next
->len
;
1081 space
= total_len
- skb_tailroom(msdu_head
);
1083 (pskb_expand_head(msdu_head
, 0, space
, GFP_ATOMIC
) < 0)) {
1084 /* TODO: bump some rx-oom error stat */
1085 /* put it back together so we can free the
1086 * whole list at once.
1088 msdu_head
->next
= to_free
;
1092 /* Walk list again, copying contents into
1097 skb_copy_from_linear_data(next
, skb_put(msdu_head
, next
->len
),
1102 /* If here, we have consolidated skb. Free the
1103 * fragments and pass the main skb on up the
1106 ath10k_htt_rx_free_msdu_chain(to_free
);
1110 static bool ath10k_htt_rx_amsdu_allowed(struct ath10k_htt
*htt
,
1111 struct sk_buff
*head
,
1112 enum htt_rx_mpdu_status status
,
1116 if (head
->len
== 0) {
1117 ath10k_dbg(ATH10K_DBG_HTT
,
1118 "htt rx dropping due to zero-len\n");
1122 if (attention
& RX_ATTENTION_FLAGS_DECRYPT_ERR
) {
1123 ath10k_dbg(ATH10K_DBG_HTT
,
1124 "htt rx dropping due to decrypt-err\n");
1129 ath10k_warn("no channel configured; ignoring frame!\n");
1133 /* Skip mgmt frames while we handle this in WMI */
1134 if (status
== HTT_RX_IND_MPDU_STATUS_MGMT_CTRL
||
1135 attention
& RX_ATTENTION_FLAGS_MGMT_TYPE
) {
1136 ath10k_dbg(ATH10K_DBG_HTT
, "htt rx mgmt ctrl\n");
1140 if (status
!= HTT_RX_IND_MPDU_STATUS_OK
&&
1141 status
!= HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR
&&
1142 status
!= HTT_RX_IND_MPDU_STATUS_ERR_INV_PEER
&&
1143 !htt
->ar
->monitor_started
) {
1144 ath10k_dbg(ATH10K_DBG_HTT
,
1145 "htt rx ignoring frame w/ status %d\n",
1150 if (test_bit(ATH10K_CAC_RUNNING
, &htt
->ar
->dev_flags
)) {
1151 ath10k_dbg(ATH10K_DBG_HTT
,
1152 "htt rx CAC running\n");
1159 static void ath10k_htt_rx_handler(struct ath10k_htt
*htt
,
1160 struct htt_rx_indication
*rx
)
1162 struct ieee80211_rx_status
*rx_status
= &htt
->rx_status
;
1163 struct htt_rx_indication_mpdu_range
*mpdu_ranges
;
1164 struct htt_rx_desc
*rxd
;
1165 enum htt_rx_mpdu_status status
;
1166 struct ieee80211_hdr
*hdr
;
1167 int num_mpdu_ranges
;
1175 lockdep_assert_held(&htt
->rx_ring
.lock
);
1177 fw_desc_len
= __le16_to_cpu(rx
->prefix
.fw_rx_desc_bytes
);
1178 fw_desc
= (u8
*)&rx
->fw_desc
;
1180 num_mpdu_ranges
= MS(__le32_to_cpu(rx
->hdr
.info1
),
1181 HTT_RX_INDICATION_INFO1_NUM_MPDU_RANGES
);
1182 mpdu_ranges
= htt_rx_ind_get_mpdu_ranges(rx
);
1184 /* Fill this once, while this is per-ppdu */
1185 if (rx
->ppdu
.info0
& HTT_RX_INDICATION_INFO0_START_VALID
) {
1186 memset(rx_status
, 0, sizeof(*rx_status
));
1187 rx_status
->signal
= ATH10K_DEFAULT_NOISE_FLOOR
+
1188 rx
->ppdu
.combined_rssi
;
1191 if (rx
->ppdu
.info0
& HTT_RX_INDICATION_INFO0_END_VALID
) {
1192 /* TSF available only in 32-bit */
1193 rx_status
->mactime
= __le32_to_cpu(rx
->ppdu
.tsf
) & 0xffffffff;
1194 rx_status
->flag
|= RX_FLAG_MACTIME_END
;
1197 channel_set
= ath10k_htt_rx_h_channel(htt
->ar
, rx_status
);
1200 ath10k_htt_rx_h_rates(htt
->ar
, rx_status
->band
,
1202 __le32_to_cpu(rx
->ppdu
.info1
),
1203 __le32_to_cpu(rx
->ppdu
.info2
),
1207 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP
, NULL
, "htt rx ind: ",
1209 (sizeof(struct htt_rx_indication_mpdu_range
) *
1212 for (i
= 0; i
< num_mpdu_ranges
; i
++) {
1213 status
= mpdu_ranges
[i
].mpdu_range_status
;
1215 for (j
= 0; j
< mpdu_ranges
[i
].mpdu_count
; j
++) {
1216 struct sk_buff
*msdu_head
, *msdu_tail
;
1220 ret
= ath10k_htt_rx_amsdu_pop(htt
,
1227 ath10k_warn("failed to pop amsdu from htt rx ring %d\n",
1229 ath10k_htt_rx_free_msdu_chain(msdu_head
);
1233 rxd
= container_of((void *)msdu_head
->data
,
1236 attention
= __le32_to_cpu(rxd
->attention
.flags
);
1238 if (!ath10k_htt_rx_amsdu_allowed(htt
, msdu_head
,
1242 ath10k_htt_rx_free_msdu_chain(msdu_head
);
1247 ath10k_unchain_msdu(msdu_head
) < 0) {
1248 ath10k_htt_rx_free_msdu_chain(msdu_head
);
1252 if (attention
& RX_ATTENTION_FLAGS_FCS_ERR
)
1253 rx_status
->flag
|= RX_FLAG_FAILED_FCS_CRC
;
1255 rx_status
->flag
&= ~RX_FLAG_FAILED_FCS_CRC
;
1257 if (attention
& RX_ATTENTION_FLAGS_TKIP_MIC_ERR
)
1258 rx_status
->flag
|= RX_FLAG_MMIC_ERROR
;
1260 rx_status
->flag
&= ~RX_FLAG_MMIC_ERROR
;
1262 hdr
= ath10k_htt_rx_skb_get_hdr(msdu_head
);
1264 if (ath10k_htt_rx_hdr_is_amsdu(hdr
))
1265 ath10k_htt_rx_amsdu(htt
, rx_status
, msdu_head
);
1267 ath10k_htt_rx_msdu(htt
, rx_status
, msdu_head
);
1271 tasklet_schedule(&htt
->rx_replenish_task
);
1274 static void ath10k_htt_rx_frag_handler(struct ath10k_htt
*htt
,
1275 struct htt_rx_fragment_indication
*frag
)
1277 struct sk_buff
*msdu_head
, *msdu_tail
;
1278 enum htt_rx_mpdu_encrypt_type enctype
;
1279 struct htt_rx_desc
*rxd
;
1280 enum rx_msdu_decap_format fmt
;
1281 struct ieee80211_rx_status
*rx_status
= &htt
->rx_status
;
1282 struct ieee80211_hdr
*hdr
;
1287 int fw_desc_len
, hdrlen
, paramlen
;
1290 fw_desc_len
= __le16_to_cpu(frag
->fw_rx_desc_bytes
);
1291 fw_desc
= (u8
*)frag
->fw_msdu_rx_desc
;
1296 spin_lock_bh(&htt
->rx_ring
.lock
);
1297 ret
= ath10k_htt_rx_amsdu_pop(htt
, &fw_desc
, &fw_desc_len
,
1298 &msdu_head
, &msdu_tail
);
1299 spin_unlock_bh(&htt
->rx_ring
.lock
);
1301 ath10k_dbg(ATH10K_DBG_HTT_DUMP
, "htt rx frag ahead\n");
1304 ath10k_warn("failed to pop amsdu from httr rx ring for fragmented rx %d\n",
1306 ath10k_htt_rx_free_msdu_chain(msdu_head
);
1310 /* FIXME: implement signal strength */
1311 rx_status
->flag
|= RX_FLAG_NO_SIGNAL_VAL
;
1313 hdr
= (struct ieee80211_hdr
*)msdu_head
->data
;
1314 rxd
= (void *)msdu_head
->data
- sizeof(*rxd
);
1315 tkip_mic_err
= !!(__le32_to_cpu(rxd
->attention
.flags
) &
1316 RX_ATTENTION_FLAGS_TKIP_MIC_ERR
);
1317 decrypt_err
= !!(__le32_to_cpu(rxd
->attention
.flags
) &
1318 RX_ATTENTION_FLAGS_DECRYPT_ERR
);
1319 fmt
= MS(__le32_to_cpu(rxd
->msdu_start
.info1
),
1320 RX_MSDU_START_INFO1_DECAP_FORMAT
);
1322 if (fmt
!= RX_MSDU_DECAP_RAW
) {
1323 ath10k_warn("we dont support non-raw fragmented rx yet\n");
1324 dev_kfree_skb_any(msdu_head
);
1328 enctype
= MS(__le32_to_cpu(rxd
->mpdu_start
.info0
),
1329 RX_MPDU_START_INFO0_ENCRYPT_TYPE
);
1330 ath10k_htt_rx_h_protected(htt
, rx_status
, msdu_head
, enctype
, fmt
,
1332 msdu_head
->ip_summed
= ath10k_htt_rx_get_csum_state(msdu_head
);
1335 ath10k_warn("tkip mic error\n");
1338 ath10k_warn("decryption err in fragmented rx\n");
1339 dev_kfree_skb_any(msdu_head
);
1343 if (enctype
!= HTT_RX_MPDU_ENCRYPT_NONE
) {
1344 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
1345 paramlen
= ath10k_htt_rx_crypto_param_len(enctype
);
1347 /* It is more efficient to move the header than the payload */
1348 memmove((void *)msdu_head
->data
+ paramlen
,
1349 (void *)msdu_head
->data
,
1351 skb_pull(msdu_head
, paramlen
);
1352 hdr
= (struct ieee80211_hdr
*)msdu_head
->data
;
1355 /* remove trailing FCS */
1358 /* remove crypto trailer */
1359 trim
+= ath10k_htt_rx_crypto_tail_len(enctype
);
1361 /* last fragment of TKIP frags has MIC */
1362 if (!ieee80211_has_morefrags(hdr
->frame_control
) &&
1363 enctype
== HTT_RX_MPDU_ENCRYPT_TKIP_WPA
)
1366 if (trim
> msdu_head
->len
) {
1367 ath10k_warn("htt rx fragment: trailer longer than the frame itself? drop\n");
1368 dev_kfree_skb_any(msdu_head
);
1372 skb_trim(msdu_head
, msdu_head
->len
- trim
);
1374 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP
, NULL
, "htt rx frag mpdu: ",
1375 msdu_head
->data
, msdu_head
->len
);
1376 ath10k_process_rx(htt
->ar
, rx_status
, msdu_head
);
1379 if (fw_desc_len
> 0) {
1380 ath10k_dbg(ATH10K_DBG_HTT
,
1381 "expecting more fragmented rx in one indication %d\n",
1386 static void ath10k_htt_rx_frm_tx_compl(struct ath10k
*ar
,
1387 struct sk_buff
*skb
)
1389 struct ath10k_htt
*htt
= &ar
->htt
;
1390 struct htt_resp
*resp
= (struct htt_resp
*)skb
->data
;
1391 struct htt_tx_done tx_done
= {};
1392 int status
= MS(resp
->data_tx_completion
.flags
, HTT_DATA_TX_STATUS
);
1396 lockdep_assert_held(&htt
->tx_lock
);
1399 case HTT_DATA_TX_STATUS_NO_ACK
:
1400 tx_done
.no_ack
= true;
1402 case HTT_DATA_TX_STATUS_OK
:
1404 case HTT_DATA_TX_STATUS_DISCARD
:
1405 case HTT_DATA_TX_STATUS_POSTPONE
:
1406 case HTT_DATA_TX_STATUS_DOWNLOAD_FAIL
:
1407 tx_done
.discard
= true;
1410 ath10k_warn("unhandled tx completion status %d\n", status
);
1411 tx_done
.discard
= true;
1415 ath10k_dbg(ATH10K_DBG_HTT
, "htt tx completion num_msdus %d\n",
1416 resp
->data_tx_completion
.num_msdus
);
1418 for (i
= 0; i
< resp
->data_tx_completion
.num_msdus
; i
++) {
1419 msdu_id
= resp
->data_tx_completion
.msdus
[i
];
1420 tx_done
.msdu_id
= __le16_to_cpu(msdu_id
);
1421 ath10k_txrx_tx_unref(htt
, &tx_done
);
1425 void ath10k_htt_t2h_msg_handler(struct ath10k
*ar
, struct sk_buff
*skb
)
1427 struct ath10k_htt
*htt
= &ar
->htt
;
1428 struct htt_resp
*resp
= (struct htt_resp
*)skb
->data
;
1430 /* confirm alignment */
1431 if (!IS_ALIGNED((unsigned long)skb
->data
, 4))
1432 ath10k_warn("unaligned htt message, expect trouble\n");
1434 ath10k_dbg(ATH10K_DBG_HTT
, "htt rx, msg_type: 0x%0X\n",
1435 resp
->hdr
.msg_type
);
1436 switch (resp
->hdr
.msg_type
) {
1437 case HTT_T2H_MSG_TYPE_VERSION_CONF
: {
1438 htt
->target_version_major
= resp
->ver_resp
.major
;
1439 htt
->target_version_minor
= resp
->ver_resp
.minor
;
1440 complete(&htt
->target_version_received
);
1443 case HTT_T2H_MSG_TYPE_RX_IND
:
1444 spin_lock_bh(&htt
->rx_ring
.lock
);
1445 __skb_queue_tail(&htt
->rx_compl_q
, skb
);
1446 spin_unlock_bh(&htt
->rx_ring
.lock
);
1447 tasklet_schedule(&htt
->txrx_compl_task
);
1449 case HTT_T2H_MSG_TYPE_PEER_MAP
: {
1450 struct htt_peer_map_event ev
= {
1451 .vdev_id
= resp
->peer_map
.vdev_id
,
1452 .peer_id
= __le16_to_cpu(resp
->peer_map
.peer_id
),
1454 memcpy(ev
.addr
, resp
->peer_map
.addr
, sizeof(ev
.addr
));
1455 ath10k_peer_map_event(htt
, &ev
);
1458 case HTT_T2H_MSG_TYPE_PEER_UNMAP
: {
1459 struct htt_peer_unmap_event ev
= {
1460 .peer_id
= __le16_to_cpu(resp
->peer_unmap
.peer_id
),
1462 ath10k_peer_unmap_event(htt
, &ev
);
1465 case HTT_T2H_MSG_TYPE_MGMT_TX_COMPLETION
: {
1466 struct htt_tx_done tx_done
= {};
1467 int status
= __le32_to_cpu(resp
->mgmt_tx_completion
.status
);
1470 __le32_to_cpu(resp
->mgmt_tx_completion
.desc_id
);
1473 case HTT_MGMT_TX_STATUS_OK
:
1475 case HTT_MGMT_TX_STATUS_RETRY
:
1476 tx_done
.no_ack
= true;
1478 case HTT_MGMT_TX_STATUS_DROP
:
1479 tx_done
.discard
= true;
1483 spin_lock_bh(&htt
->tx_lock
);
1484 ath10k_txrx_tx_unref(htt
, &tx_done
);
1485 spin_unlock_bh(&htt
->tx_lock
);
1488 case HTT_T2H_MSG_TYPE_TX_COMPL_IND
:
1489 spin_lock_bh(&htt
->tx_lock
);
1490 __skb_queue_tail(&htt
->tx_compl_q
, skb
);
1491 spin_unlock_bh(&htt
->tx_lock
);
1492 tasklet_schedule(&htt
->txrx_compl_task
);
1494 case HTT_T2H_MSG_TYPE_SEC_IND
: {
1495 struct ath10k
*ar
= htt
->ar
;
1496 struct htt_security_indication
*ev
= &resp
->security_indication
;
1498 ath10k_dbg(ATH10K_DBG_HTT
,
1499 "sec ind peer_id %d unicast %d type %d\n",
1500 __le16_to_cpu(ev
->peer_id
),
1501 !!(ev
->flags
& HTT_SECURITY_IS_UNICAST
),
1502 MS(ev
->flags
, HTT_SECURITY_TYPE
));
1503 complete(&ar
->install_key_done
);
1506 case HTT_T2H_MSG_TYPE_RX_FRAG_IND
: {
1507 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP
, NULL
, "htt event: ",
1508 skb
->data
, skb
->len
);
1509 ath10k_htt_rx_frag_handler(htt
, &resp
->rx_frag_ind
);
1512 case HTT_T2H_MSG_TYPE_TEST
:
1515 case HTT_T2H_MSG_TYPE_STATS_CONF
:
1516 trace_ath10k_htt_stats(skb
->data
, skb
->len
);
1518 case HTT_T2H_MSG_TYPE_TX_INSPECT_IND
:
1519 /* Firmware can return tx frames if it's unable to fully
1520 * process them and suspects host may be able to fix it. ath10k
1521 * sends all tx frames as already inspected so this shouldn't
1522 * happen unless fw has a bug.
1524 ath10k_warn("received an unexpected htt tx inspect event\n");
1526 case HTT_T2H_MSG_TYPE_RX_ADDBA
:
1527 case HTT_T2H_MSG_TYPE_RX_DELBA
:
1528 case HTT_T2H_MSG_TYPE_RX_FLUSH
:
1530 ath10k_dbg(ATH10K_DBG_HTT
, "htt event (%d) not handled\n",
1531 resp
->hdr
.msg_type
);
1532 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP
, NULL
, "htt event: ",
1533 skb
->data
, skb
->len
);
1537 /* Free the indication buffer */
1538 dev_kfree_skb_any(skb
);
1541 static void ath10k_htt_txrx_compl_task(unsigned long ptr
)
1543 struct ath10k_htt
*htt
= (struct ath10k_htt
*)ptr
;
1544 struct htt_resp
*resp
;
1545 struct sk_buff
*skb
;
1547 spin_lock_bh(&htt
->tx_lock
);
1548 while ((skb
= __skb_dequeue(&htt
->tx_compl_q
))) {
1549 ath10k_htt_rx_frm_tx_compl(htt
->ar
, skb
);
1550 dev_kfree_skb_any(skb
);
1552 spin_unlock_bh(&htt
->tx_lock
);
1554 spin_lock_bh(&htt
->rx_ring
.lock
);
1555 while ((skb
= __skb_dequeue(&htt
->rx_compl_q
))) {
1556 resp
= (struct htt_resp
*)skb
->data
;
1557 ath10k_htt_rx_handler(htt
, &resp
->rx_ind
);
1558 dev_kfree_skb_any(skb
);
1560 spin_unlock_bh(&htt
->rx_ring
.lock
);