1 /*
2 * Atheros CARL9170 driver
3 *
4 * 802.11 & command trap routines
5 *
6 * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
7 * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; see the file COPYING. If not, see
21 * http://www.gnu.org/licenses/.
22 *
23 * This file incorporates work covered by the following copyright and
24 * permission notice:
25 * Copyright (c) 2007-2008 Atheros Communications, Inc.
26 *
27 * Permission to use, copy, modify, and/or distribute this software for any
28 * purpose with or without fee is hereby granted, provided that the above
29 * copyright notice and this permission notice appear in all copies.
30 *
31 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
32 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
33 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
34 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
35 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
36 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
37 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
38 */
39
40 #include <linux/slab.h>
41 #include <linux/module.h>
42 #include <linux/etherdevice.h>
43 #include <linux/crc32.h>
44 #include <net/mac80211.h>
45 #include "carl9170.h"
46 #include "hw.h"
47 #include "cmd.h"
48
carl9170_dbg_message(struct ar9170 * ar,const char * buf,u32 len)49 static void carl9170_dbg_message(struct ar9170 *ar, const char *buf, u32 len)
50 {
51 bool restart = false;
52 enum carl9170_restart_reasons reason = CARL9170_RR_NO_REASON;
53
54 if (len > 3) {
55 if (memcmp(buf, CARL9170_ERR_MAGIC, 3) == 0) {
56 ar->fw.err_counter++;
57 if (ar->fw.err_counter > 3) {
58 restart = true;
59 reason = CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS;
60 }
61 }
62
63 if (memcmp(buf, CARL9170_BUG_MAGIC, 3) == 0) {
64 ar->fw.bug_counter++;
65 restart = true;
66 reason = CARL9170_RR_FATAL_FIRMWARE_ERROR;
67 }
68 }
69
70 wiphy_info(ar->hw->wiphy, "FW: %.*s\n", len, buf);
71
72 if (restart)
73 carl9170_restart(ar, reason);
74 }
75
carl9170_handle_ps(struct ar9170 * ar,struct carl9170_rsp * rsp)76 static void carl9170_handle_ps(struct ar9170 *ar, struct carl9170_rsp *rsp)
77 {
78 u32 ps;
79 bool new_ps;
80
81 ps = le32_to_cpu(rsp->psm.state);
82
83 new_ps = (ps & CARL9170_PSM_COUNTER) != CARL9170_PSM_WAKE;
84 if (ar->ps.state != new_ps) {
85 if (!new_ps) {
86 ar->ps.sleep_ms = jiffies_to_msecs(jiffies -
87 ar->ps.last_action);
88 }
89
90 ar->ps.last_action = jiffies;
91
92 ar->ps.state = new_ps;
93 }
94 }
95
carl9170_check_sequence(struct ar9170 * ar,unsigned int seq)96 static int carl9170_check_sequence(struct ar9170 *ar, unsigned int seq)
97 {
98 if (ar->cmd_seq < -1)
99 return 0;
100
101 /*
102 * Initialize Counter
103 */
104 if (ar->cmd_seq < 0)
105 ar->cmd_seq = seq;
106
107 /*
108 * The sequence is strictly monotonic increasing and it never skips!
109 *
110 * Therefore we can safely assume that whenever we received an
111 * unexpected sequence we have lost some valuable data.
112 */
113 if (seq != ar->cmd_seq) {
114 int count;
115
116 count = (seq - ar->cmd_seq) % ar->fw.cmd_bufs;
117
118 wiphy_err(ar->hw->wiphy, "lost %d command responses/traps! "
119 "w:%d g:%d\n", count, ar->cmd_seq, seq);
120
121 carl9170_restart(ar, CARL9170_RR_LOST_RSP);
122 return -EIO;
123 }
124
125 ar->cmd_seq = (ar->cmd_seq + 1) % ar->fw.cmd_bufs;
126 return 0;
127 }
128
carl9170_cmd_callback(struct ar9170 * ar,u32 len,void * buffer)129 static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)
130 {
131 /*
132 * Some commands may have a variable response length
133 * and we cannot predict the correct length in advance.
134 * So we only check if we provided enough space for the data.
135 */
136 if (unlikely(ar->readlen != (len - 4))) {
137 dev_warn(&ar->udev->dev, "received invalid command response:"
138 "got %d, instead of %d\n", len - 4, ar->readlen);
139 print_hex_dump_bytes("carl9170 cmd:", DUMP_PREFIX_OFFSET,
140 ar->cmd_buf, (ar->cmd.hdr.len + 4) & 0x3f);
141 print_hex_dump_bytes("carl9170 rsp:", DUMP_PREFIX_OFFSET,
142 buffer, len);
143 /*
144 * Do not complete. The command times out,
145 * and we get a stack trace from there.
146 */
147 carl9170_restart(ar, CARL9170_RR_INVALID_RSP);
148 }
149
150 spin_lock(&ar->cmd_lock);
151 if (ar->readbuf) {
152 if (len >= 4)
153 memcpy(ar->readbuf, buffer + 4,
154 min_t(u32, len - 4, ar->readlen));
155
156 ar->readbuf = NULL;
157 }
158 complete(&ar->cmd_wait);
159 spin_unlock(&ar->cmd_lock);
160 }
161
carl9170_handle_command_response(struct ar9170 * ar,void * buf,u32 len)162 void carl9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
163 {
164 struct carl9170_rsp *cmd = buf;
165 struct ieee80211_vif *vif;
166
167 if ((cmd->hdr.cmd & CARL9170_RSP_FLAG) != CARL9170_RSP_FLAG) {
168 if (!(cmd->hdr.cmd & CARL9170_CMD_ASYNC_FLAG))
169 carl9170_cmd_callback(ar, len, buf);
170
171 return;
172 }
173
174 if (unlikely(cmd->hdr.len != (len - 4))) {
175 if (net_ratelimit()) {
176 wiphy_err(ar->hw->wiphy, "FW: received over-/under"
177 "sized event %x (%d, but should be %d).\n",
178 cmd->hdr.cmd, cmd->hdr.len, len - 4);
179
180 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE,
181 buf, len);
182 }
183
184 return;
185 }
186
187 /* hardware event handlers */
188 switch (cmd->hdr.cmd) {
189 case CARL9170_RSP_PRETBTT:
190 /* pre-TBTT event */
191 rcu_read_lock();
192 vif = carl9170_get_main_vif(ar);
193
194 if (!vif) {
195 rcu_read_unlock();
196 break;
197 }
198
199 switch (vif->type) {
200 case NL80211_IFTYPE_STATION:
201 carl9170_handle_ps(ar, cmd);
202 break;
203
204 case NL80211_IFTYPE_AP:
205 case NL80211_IFTYPE_ADHOC:
206 case NL80211_IFTYPE_MESH_POINT:
207 carl9170_update_beacon(ar, true);
208 break;
209
210 default:
211 break;
212 }
213 rcu_read_unlock();
214
215 break;
216
217
218 case CARL9170_RSP_TXCOMP:
219 /* TX status notification */
220 carl9170_tx_process_status(ar, cmd);
221 break;
222
223 case CARL9170_RSP_BEACON_CONFIG:
224 /*
225 * (IBSS) beacon send notification
226 * bytes: 04 c2 XX YY B4 B3 B2 B1
227 *
228 * XX always 80
229 * YY always 00
230 * B1-B4 "should" be the number of send out beacons.
231 */
232 break;
233
234 case CARL9170_RSP_ATIM:
235 /* End of Atim Window */
236 break;
237
238 case CARL9170_RSP_WATCHDOG:
239 /* Watchdog Interrupt */
240 carl9170_restart(ar, CARL9170_RR_WATCHDOG);
241 break;
242
243 case CARL9170_RSP_TEXT:
244 /* firmware debug */
245 carl9170_dbg_message(ar, (char *)buf + 4, len - 4);
246 break;
247
248 case CARL9170_RSP_HEXDUMP:
249 wiphy_dbg(ar->hw->wiphy, "FW: HD %d\n", len - 4);
250 print_hex_dump_bytes("FW:", DUMP_PREFIX_NONE,
251 (char *)buf + 4, len - 4);
252 break;
253
254 case CARL9170_RSP_RADAR:
255 if (!net_ratelimit())
256 break;
257
258 wiphy_info(ar->hw->wiphy, "FW: RADAR! Please report this "
259 "incident to linux-wireless@vger.kernel.org !\n");
260 break;
261
262 case CARL9170_RSP_GPIO:
263 #ifdef CONFIG_CARL9170_WPC
264 if (ar->wps.pbc) {
265 bool state = !!(cmd->gpio.gpio & cpu_to_le32(
266 AR9170_GPIO_PORT_WPS_BUTTON_PRESSED));
267
268 if (state != ar->wps.pbc_state) {
269 ar->wps.pbc_state = state;
270 input_report_key(ar->wps.pbc, KEY_WPS_BUTTON,
271 state);
272 input_sync(ar->wps.pbc);
273 }
274 }
275 #endif /* CONFIG_CARL9170_WPC */
276 break;
277
278 case CARL9170_RSP_BOOT:
279 complete(&ar->fw_boot_wait);
280 break;
281
282 default:
283 wiphy_err(ar->hw->wiphy, "FW: received unhandled event %x\n",
284 cmd->hdr.cmd);
285 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
286 break;
287 }
288 }
289
carl9170_rx_mac_status(struct ar9170 * ar,struct ar9170_rx_head * head,struct ar9170_rx_macstatus * mac,struct ieee80211_rx_status * status)290 static int carl9170_rx_mac_status(struct ar9170 *ar,
291 struct ar9170_rx_head *head, struct ar9170_rx_macstatus *mac,
292 struct ieee80211_rx_status *status)
293 {
294 struct ieee80211_channel *chan;
295 u8 error, decrypt;
296
297 BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
298 BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
299
300 error = mac->error;
301
302 if (error & AR9170_RX_ERROR_WRONG_RA) {
303 if (!ar->sniffer_enabled)
304 return -EINVAL;
305 }
306
307 if (error & AR9170_RX_ERROR_PLCP) {
308 if (!(ar->filter_state & FIF_PLCPFAIL))
309 return -EINVAL;
310
311 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
312 }
313
314 if (error & AR9170_RX_ERROR_FCS) {
315 ar->tx_fcs_errors++;
316
317 if (!(ar->filter_state & FIF_FCSFAIL))
318 return -EINVAL;
319
320 status->flag |= RX_FLAG_FAILED_FCS_CRC;
321 }
322
323 decrypt = ar9170_get_decrypt_type(mac);
324 if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
325 decrypt != AR9170_ENC_ALG_NONE) {
326 if ((decrypt == AR9170_ENC_ALG_TKIP) &&
327 (error & AR9170_RX_ERROR_MMIC))
328 status->flag |= RX_FLAG_MMIC_ERROR;
329
330 status->flag |= RX_FLAG_DECRYPTED;
331 }
332
333 if (error & AR9170_RX_ERROR_DECRYPT && !ar->sniffer_enabled)
334 return -ENODATA;
335
336 error &= ~(AR9170_RX_ERROR_MMIC |
337 AR9170_RX_ERROR_FCS |
338 AR9170_RX_ERROR_WRONG_RA |
339 AR9170_RX_ERROR_DECRYPT |
340 AR9170_RX_ERROR_PLCP);
341
342 /* drop any other error frames */
343 if (unlikely(error)) {
344 /* TODO: update netdevice's RX dropped/errors statistics */
345
346 if (net_ratelimit())
347 wiphy_dbg(ar->hw->wiphy, "received frame with "
348 "suspicious error code (%#x).\n", error);
349
350 return -EINVAL;
351 }
352
353 chan = ar->channel;
354 if (chan) {
355 status->band = chan->band;
356 status->freq = chan->center_freq;
357 }
358
359 switch (mac->status & AR9170_RX_STATUS_MODULATION) {
360 case AR9170_RX_STATUS_MODULATION_CCK:
361 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
362 status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
363 switch (head->plcp[0]) {
364 case AR9170_RX_PHY_RATE_CCK_1M:
365 status->rate_idx = 0;
366 break;
367 case AR9170_RX_PHY_RATE_CCK_2M:
368 status->rate_idx = 1;
369 break;
370 case AR9170_RX_PHY_RATE_CCK_5M:
371 status->rate_idx = 2;
372 break;
373 case AR9170_RX_PHY_RATE_CCK_11M:
374 status->rate_idx = 3;
375 break;
376 default:
377 if (net_ratelimit()) {
378 wiphy_err(ar->hw->wiphy, "invalid plcp cck "
379 "rate (%x).\n", head->plcp[0]);
380 }
381
382 return -EINVAL;
383 }
384 break;
385
386 case AR9170_RX_STATUS_MODULATION_DUPOFDM:
387 case AR9170_RX_STATUS_MODULATION_OFDM:
388 switch (head->plcp[0] & 0xf) {
389 case AR9170_TXRX_PHY_RATE_OFDM_6M:
390 status->rate_idx = 0;
391 break;
392 case AR9170_TXRX_PHY_RATE_OFDM_9M:
393 status->rate_idx = 1;
394 break;
395 case AR9170_TXRX_PHY_RATE_OFDM_12M:
396 status->rate_idx = 2;
397 break;
398 case AR9170_TXRX_PHY_RATE_OFDM_18M:
399 status->rate_idx = 3;
400 break;
401 case AR9170_TXRX_PHY_RATE_OFDM_24M:
402 status->rate_idx = 4;
403 break;
404 case AR9170_TXRX_PHY_RATE_OFDM_36M:
405 status->rate_idx = 5;
406 break;
407 case AR9170_TXRX_PHY_RATE_OFDM_48M:
408 status->rate_idx = 6;
409 break;
410 case AR9170_TXRX_PHY_RATE_OFDM_54M:
411 status->rate_idx = 7;
412 break;
413 default:
414 if (net_ratelimit()) {
415 wiphy_err(ar->hw->wiphy, "invalid plcp ofdm "
416 "rate (%x).\n", head->plcp[0]);
417 }
418
419 return -EINVAL;
420 }
421 if (status->band == NL80211_BAND_2GHZ)
422 status->rate_idx += 4;
423 break;
424
425 case AR9170_RX_STATUS_MODULATION_HT:
426 if (head->plcp[3] & 0x80)
427 status->bw = RATE_INFO_BW_40;
428 if (head->plcp[6] & 0x80)
429 status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
430
431 status->rate_idx = clamp(head->plcp[3] & 0x7f, 0, 75);
432 status->encoding = RX_ENC_HT;
433 break;
434
435 default:
436 BUG();
437 return -ENOSYS;
438 }
439
440 return 0;
441 }
442
carl9170_rx_phy_status(struct ar9170 * ar,struct ar9170_rx_phystatus * phy,struct ieee80211_rx_status * status)443 static void carl9170_rx_phy_status(struct ar9170 *ar,
444 struct ar9170_rx_phystatus *phy, struct ieee80211_rx_status *status)
445 {
446 int i;
447
448 BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
449
450 for (i = 0; i < 3; i++)
451 if (phy->rssi[i] != 0x80)
452 status->antenna |= BIT(i);
453
454 /* post-process RSSI */
455 for (i = 0; i < 7; i++)
456 if (phy->rssi[i] & 0x80)
457 phy->rssi[i] = ((~phy->rssi[i] & 0x7f) + 1) & 0x7f;
458
459 if (phy->phy_err)
460 ar->rx_phy_errors++;
461
462 status->signal = ar->noise[0] + phy->rssi_combined;
463 }
464
carl9170_rx_copy_data(u8 * buf,int len)465 static struct sk_buff *carl9170_rx_copy_data(u8 *buf, int len)
466 {
467 struct sk_buff *skb;
468 int reserved = 0;
469 struct ieee80211_hdr *hdr = (void *) buf;
470
471 if (ieee80211_is_data_qos(hdr->frame_control)) {
472 u8 *qc = ieee80211_get_qos_ctl(hdr);
473 reserved += NET_IP_ALIGN;
474
475 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
476 reserved += NET_IP_ALIGN;
477 }
478
479 if (ieee80211_has_a4(hdr->frame_control))
480 reserved += NET_IP_ALIGN;
481
482 reserved = 32 + (reserved & NET_IP_ALIGN);
483
484 skb = dev_alloc_skb(len + reserved);
485 if (likely(skb)) {
486 skb_reserve(skb, reserved);
487 skb_put_data(skb, buf, len);
488 }
489
490 return skb;
491 }
492
carl9170_find_ie(u8 * data,unsigned int len,u8 ie)493 static u8 *carl9170_find_ie(u8 *data, unsigned int len, u8 ie)
494 {
495 struct ieee80211_mgmt *mgmt = (void *)data;
496 u8 *pos, *end;
497
498 pos = (u8 *)mgmt->u.beacon.variable;
499 end = data + len;
500 while (pos < end) {
501 if (pos + 2 + pos[1] > end)
502 return NULL;
503
504 if (pos[0] == ie)
505 return pos;
506
507 pos += 2 + pos[1];
508 }
509 return NULL;
510 }
511
512 /*
513 * NOTE:
514 *
515 * The firmware is in charge of waking up the device just before
516 * the AP is expected to transmit the next beacon.
517 *
518 * This leaves the driver with the important task of deciding when
519 * to set the PHY back to bed again.
520 */
carl9170_ps_beacon(struct ar9170 * ar,void * data,unsigned int len)521 static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
522 {
523 struct ieee80211_hdr *hdr = data;
524 struct ieee80211_tim_ie *tim_ie;
525 struct ath_common *common = &ar->common;
526 u8 *tim;
527 u8 tim_len;
528 bool cam;
529
530 if (likely(!(ar->hw->conf.flags & IEEE80211_CONF_PS)))
531 return;
532
533 /* min. beacon length + FCS_LEN */
534 if (len <= 40 + FCS_LEN)
535 return;
536
537 /* check if this really is a beacon */
538 /* and only beacons from the associated BSSID, please */
539 if (!ath_is_mybeacon(common, hdr) || !common->curaid)
540 return;
541
542 ar->ps.last_beacon = jiffies;
543
544 tim = carl9170_find_ie(data, len - FCS_LEN, WLAN_EID_TIM);
545 if (!tim)
546 return;
547
548 if (tim[1] < sizeof(*tim_ie))
549 return;
550
551 tim_len = tim[1];
552 tim_ie = (struct ieee80211_tim_ie *) &tim[2];
553
554 if (!WARN_ON_ONCE(!ar->hw->conf.ps_dtim_period))
555 ar->ps.dtim_counter = (tim_ie->dtim_count - 1) %
556 ar->hw->conf.ps_dtim_period;
557
558 /* Check whenever the PHY can be turned off again. */
559
560 /* 1. What about buffered unicast traffic for our AID? */
561 cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid, false);
562
563 /* 2. Maybe the AP wants to send multicast/broadcast data? */
564 cam |= !!(tim_ie->bitmap_ctrl & 0x01);
565
566 if (!cam) {
567 /* back to low-power land. */
568 ar->ps.off_override &= ~PS_OFF_BCN;
569 carl9170_ps_check(ar);
570 } else {
571 /* force CAM */
572 ar->ps.off_override |= PS_OFF_BCN;
573 }
574 }
575
carl9170_ba_check(struct ar9170 * ar,void * data,unsigned int len)576 static void carl9170_ba_check(struct ar9170 *ar, void *data, unsigned int len)
577 {
578 struct ieee80211_bar *bar = data;
579 struct carl9170_bar_list_entry *entry;
580 unsigned int queue;
581
582 if (likely(!ieee80211_is_back(bar->frame_control)))
583 return;
584
585 if (len <= sizeof(*bar) + FCS_LEN)
586 return;
587
588 queue = TID_TO_WME_AC(((le16_to_cpu(bar->control) &
589 IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
590 IEEE80211_BAR_CTRL_TID_INFO_SHIFT) & 7);
591
592 rcu_read_lock();
593 list_for_each_entry_rcu(entry, &ar->bar_list[queue], list) {
594 struct sk_buff *entry_skb = entry->skb;
595 struct _carl9170_tx_superframe *super = (void *)entry_skb->data;
596 struct ieee80211_bar *entry_bar = (void *)super->frame_data;
597
598 #define TID_CHECK(a, b) ( \
599 ((a) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK)) == \
600 ((b) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK))) \
601
602 if (bar->start_seq_num == entry_bar->start_seq_num &&
603 TID_CHECK(bar->control, entry_bar->control) &&
604 ether_addr_equal_64bits(bar->ra, entry_bar->ta) &&
605 ether_addr_equal_64bits(bar->ta, entry_bar->ra)) {
606 struct ieee80211_tx_info *tx_info;
607
608 tx_info = IEEE80211_SKB_CB(entry_skb);
609 tx_info->flags |= IEEE80211_TX_STAT_ACK;
610
611 spin_lock_bh(&ar->bar_list_lock[queue]);
612 list_del_rcu(&entry->list);
613 spin_unlock_bh(&ar->bar_list_lock[queue]);
614 kfree_rcu(entry, head);
615 break;
616 }
617 }
618 rcu_read_unlock();
619
620 #undef TID_CHECK
621 }
622
carl9170_ampdu_check(struct ar9170 * ar,u8 * buf,u8 ms,struct ieee80211_rx_status * rx_status)623 static bool carl9170_ampdu_check(struct ar9170 *ar, u8 *buf, u8 ms,
624 struct ieee80211_rx_status *rx_status)
625 {
626 __le16 fc;
627
628 if ((ms & AR9170_RX_STATUS_MPDU) == AR9170_RX_STATUS_MPDU_SINGLE) {
629 /*
630 * This frame is not part of an aMPDU.
631 * Therefore it is not subjected to any
632 * of the following content restrictions.
633 */
634 return true;
635 }
636
637 rx_status->flag |= RX_FLAG_AMPDU_DETAILS | RX_FLAG_AMPDU_LAST_KNOWN;
638 rx_status->ampdu_reference = ar->ampdu_ref;
639
640 /*
641 * "802.11n - 7.4a.3 A-MPDU contents" describes in which contexts
642 * certain frame types can be part of an aMPDU.
643 *
644 * In order to keep the processing cost down, I opted for a
645 * stateless filter solely based on the frame control field.
646 */
647
648 fc = ((struct ieee80211_hdr *)buf)->frame_control;
649 if (ieee80211_is_data_qos(fc) && ieee80211_is_data_present(fc))
650 return true;
651
652 if (ieee80211_is_ack(fc) || ieee80211_is_back(fc) ||
653 ieee80211_is_back_req(fc))
654 return true;
655
656 if (ieee80211_is_action(fc))
657 return true;
658
659 return false;
660 }
661
carl9170_handle_mpdu(struct ar9170 * ar,u8 * buf,int len,struct ieee80211_rx_status * status)662 static int carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len,
663 struct ieee80211_rx_status *status)
664 {
665 struct sk_buff *skb;
666
667 /* (driver) frame trap handler
668 *
669 * Because power-saving mode handing has to be implemented by
670 * the driver/firmware. We have to check each incoming beacon
671 * from the associated AP, if there's new data for us (either
672 * broadcast/multicast or unicast) we have to react quickly.
673 *
674 * So, if you have you want to add additional frame trap
675 * handlers, this would be the perfect place!
676 */
677
678 carl9170_ps_beacon(ar, buf, len);
679
680 carl9170_ba_check(ar, buf, len);
681
682 skb = carl9170_rx_copy_data(buf, len);
683 if (!skb)
684 return -ENOMEM;
685
686 memcpy(IEEE80211_SKB_RXCB(skb), status, sizeof(*status));
687 ieee80211_rx(ar->hw, skb);
688 return 0;
689 }
690
691 /*
692 * If the frame alignment is right (or the kernel has
693 * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
694 * is only a single MPDU in the USB frame, then we could
695 * submit to mac80211 the SKB directly. However, since
696 * there may be multiple packets in one SKB in stream
697 * mode, and we need to observe the proper ordering,
698 * this is non-trivial.
699 */
carl9170_rx_untie_data(struct ar9170 * ar,u8 * buf,int len)700 static void carl9170_rx_untie_data(struct ar9170 *ar, u8 *buf, int len)
701 {
702 struct ar9170_rx_head *head;
703 struct ar9170_rx_macstatus *mac;
704 struct ar9170_rx_phystatus *phy = NULL;
705 struct ieee80211_rx_status status;
706 int mpdu_len;
707 u8 mac_status;
708
709 if (!IS_STARTED(ar))
710 return;
711
712 if (unlikely(len < sizeof(*mac)))
713 goto drop;
714
715 memset(&status, 0, sizeof(status));
716
717 mpdu_len = len - sizeof(*mac);
718
719 mac = (void *)(buf + mpdu_len);
720 mac_status = mac->status;
721 switch (mac_status & AR9170_RX_STATUS_MPDU) {
722 case AR9170_RX_STATUS_MPDU_FIRST:
723 ar->ampdu_ref++;
724 /* Aggregated MPDUs start with an PLCP header */
725 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
726 head = (void *) buf;
727
728 /*
729 * The PLCP header needs to be cached for the
730 * following MIDDLE + LAST A-MPDU packets.
731 *
732 * So, if you are wondering why all frames seem
733 * to share a common RX status information,
734 * then you have the answer right here...
735 */
736 memcpy(&ar->rx_plcp, (void *) buf,
737 sizeof(struct ar9170_rx_head));
738
739 mpdu_len -= sizeof(struct ar9170_rx_head);
740 buf += sizeof(struct ar9170_rx_head);
741
742 ar->rx_has_plcp = true;
743 } else {
744 if (net_ratelimit()) {
745 wiphy_err(ar->hw->wiphy, "plcp info "
746 "is clipped.\n");
747 }
748
749 goto drop;
750 }
751 break;
752
753 case AR9170_RX_STATUS_MPDU_LAST:
754 status.flag |= RX_FLAG_AMPDU_IS_LAST;
755
756 /*
757 * The last frame of an A-MPDU has an extra tail
758 * which does contain the phy status of the whole
759 * aggregate.
760 */
761 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
762 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
763 phy = (void *)(buf + mpdu_len);
764 } else {
765 if (net_ratelimit()) {
766 wiphy_err(ar->hw->wiphy, "frame tail "
767 "is clipped.\n");
768 }
769
770 goto drop;
771 }
772 fallthrough;
773
774 case AR9170_RX_STATUS_MPDU_MIDDLE:
775 /* These are just data + mac status */
776 if (unlikely(!ar->rx_has_plcp)) {
777 if (!net_ratelimit())
778 return;
779
780 wiphy_err(ar->hw->wiphy, "rx stream does not start "
781 "with a first_mpdu frame tag.\n");
782
783 goto drop;
784 }
785
786 head = &ar->rx_plcp;
787 break;
788
789 case AR9170_RX_STATUS_MPDU_SINGLE:
790 /* single mpdu has both: plcp (head) and phy status (tail) */
791 head = (void *) buf;
792
793 mpdu_len -= sizeof(struct ar9170_rx_head);
794 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
795
796 buf += sizeof(struct ar9170_rx_head);
797 phy = (void *)(buf + mpdu_len);
798 break;
799
800 default:
801 BUG();
802 break;
803 }
804
805 /* FC + DU + RA + FCS */
806 if (unlikely(mpdu_len < (2 + 2 + ETH_ALEN + FCS_LEN)))
807 goto drop;
808
809 if (unlikely(carl9170_rx_mac_status(ar, head, mac, &status)))
810 goto drop;
811
812 if (!carl9170_ampdu_check(ar, buf, mac_status, &status))
813 goto drop;
814
815 if (phy)
816 carl9170_rx_phy_status(ar, phy, &status);
817 else
818 status.flag |= RX_FLAG_NO_SIGNAL_VAL;
819
820 if (carl9170_handle_mpdu(ar, buf, mpdu_len, &status))
821 goto drop;
822
823 return;
824 drop:
825 ar->rx_dropped++;
826 }
827
carl9170_rx_untie_cmds(struct ar9170 * ar,const u8 * respbuf,const unsigned int resplen)828 static void carl9170_rx_untie_cmds(struct ar9170 *ar, const u8 *respbuf,
829 const unsigned int resplen)
830 {
831 struct carl9170_rsp *cmd;
832 int i = 0;
833
834 while (i < resplen) {
835 cmd = (void *) &respbuf[i];
836
837 i += cmd->hdr.len + 4;
838 if (unlikely(i > resplen))
839 break;
840
841 if (carl9170_check_sequence(ar, cmd->hdr.seq))
842 break;
843
844 carl9170_handle_command_response(ar, cmd, cmd->hdr.len + 4);
845 }
846
847 if (unlikely(i != resplen)) {
848 if (!net_ratelimit())
849 return;
850
851 wiphy_err(ar->hw->wiphy, "malformed firmware trap:\n");
852 print_hex_dump_bytes("rxcmd:", DUMP_PREFIX_OFFSET,
853 respbuf, resplen);
854 }
855 }
856
__carl9170_rx(struct ar9170 * ar,u8 * buf,unsigned int len)857 static void __carl9170_rx(struct ar9170 *ar, u8 *buf, unsigned int len)
858 {
859 unsigned int i = 0;
860
861 /* weird thing, but this is the same in the original driver */
862 while (len > 2 && i < 12 && buf[0] == 0xff && buf[1] == 0xff) {
863 i += 2;
864 len -= 2;
865 buf += 2;
866 }
867
868 if (unlikely(len < 4))
869 return;
870
871 /* found the 6 * 0xffff marker? */
872 if (i == 12)
873 carl9170_rx_untie_cmds(ar, buf, len);
874 else
875 carl9170_rx_untie_data(ar, buf, len);
876 }
877
carl9170_rx_stream(struct ar9170 * ar,void * buf,unsigned int len)878 static void carl9170_rx_stream(struct ar9170 *ar, void *buf, unsigned int len)
879 {
880 unsigned int tlen, wlen = 0, clen = 0;
881 struct ar9170_stream *rx_stream;
882 u8 *tbuf;
883
884 tbuf = buf;
885 tlen = len;
886
887 while (tlen >= 4) {
888 rx_stream = (void *) tbuf;
889 clen = le16_to_cpu(rx_stream->length);
890 wlen = ALIGN(clen, 4);
891
892 /* check if this is stream has a valid tag.*/
893 if (rx_stream->tag != cpu_to_le16(AR9170_RX_STREAM_TAG)) {
894 /*
895 * TODO: handle the highly unlikely event that the
896 * corrupted stream has the TAG at the right position.
897 */
898
899 /* check if the frame can be repaired. */
900 if (!ar->rx_failover_missing) {
901
902 /* this is not "short read". */
903 if (net_ratelimit()) {
904 wiphy_err(ar->hw->wiphy,
905 "missing tag!\n");
906 }
907
908 __carl9170_rx(ar, tbuf, tlen);
909 return;
910 }
911
912 if (ar->rx_failover_missing > tlen) {
913 if (net_ratelimit()) {
914 wiphy_err(ar->hw->wiphy,
915 "possible multi "
916 "stream corruption!\n");
917 goto err_telluser;
918 } else {
919 goto err_silent;
920 }
921 }
922
923 skb_put_data(ar->rx_failover, tbuf,
924 min_t(unsigned int, tlen,
925 ar->rx_failover_missing));
926 ar->rx_failover_missing -= tlen;
927
928 if (ar->rx_failover_missing <= 0) {
929 /*
930 * nested carl9170_rx_stream call!
931 *
932 * termination is guaranteed, even when the
933 * combined frame also have an element with
934 * a bad tag.
935 */
936
937 ar->rx_failover_missing = 0;
938 carl9170_rx_stream(ar, ar->rx_failover->data,
939 ar->rx_failover->len);
940
941 skb_reset_tail_pointer(ar->rx_failover);
942 skb_trim(ar->rx_failover, 0);
943 }
944
945 return;
946 }
947
948 /* check if stream is clipped */
949 if (wlen > tlen - 4) {
950 if (ar->rx_failover_missing) {
951 /* TODO: handle double stream corruption. */
952 if (net_ratelimit()) {
953 wiphy_err(ar->hw->wiphy, "double rx "
954 "stream corruption!\n");
955 goto err_telluser;
956 } else {
957 goto err_silent;
958 }
959 }
960
961 /*
962 * save incomplete data set.
963 * the firmware will resend the missing bits when
964 * the rx - descriptor comes round again.
965 */
966
967 skb_put_data(ar->rx_failover, tbuf, tlen);
968 ar->rx_failover_missing = clen - tlen;
969 return;
970 }
971 __carl9170_rx(ar, rx_stream->payload, clen);
972
973 tbuf += wlen + 4;
974 tlen -= wlen + 4;
975 }
976
977 if (tlen) {
978 if (net_ratelimit()) {
979 wiphy_err(ar->hw->wiphy, "%d bytes of unprocessed "
980 "data left in rx stream!\n", tlen);
981 }
982
983 goto err_telluser;
984 }
985
986 return;
987
988 err_telluser:
989 wiphy_err(ar->hw->wiphy, "damaged RX stream data [want:%d, "
990 "data:%d, rx:%d, pending:%d ]\n", clen, wlen, tlen,
991 ar->rx_failover_missing);
992
993 if (ar->rx_failover_missing)
994 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
995 ar->rx_failover->data,
996 ar->rx_failover->len);
997
998 print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
999 buf, len);
1000
1001 wiphy_err(ar->hw->wiphy, "please check your hardware and cables, if "
1002 "you see this message frequently.\n");
1003
1004 err_silent:
1005 if (ar->rx_failover_missing) {
1006 skb_reset_tail_pointer(ar->rx_failover);
1007 skb_trim(ar->rx_failover, 0);
1008 ar->rx_failover_missing = 0;
1009 }
1010 }
1011
carl9170_rx(struct ar9170 * ar,void * buf,unsigned int len)1012 void carl9170_rx(struct ar9170 *ar, void *buf, unsigned int len)
1013 {
1014 if (ar->fw.rx_stream)
1015 carl9170_rx_stream(ar, buf, len);
1016 else
1017 __carl9170_rx(ar, buf, len);
1018 }
1019