1 /* 2 * Atheros CARL9170 driver 3 * 4 * 802.11 & command trap routines 5 * 6 * Copyright 2008, Johannes Berg <johannes@sipsolutions.net> 7 * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com> 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License as published by 11 * the Free Software Foundation; either version 2 of the License, or 12 * (at your option) any later version. 13 * 14 * This program is distributed in the hope that it will be useful, 15 * but WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 * GNU General Public License for more details. 18 * 19 * You should have received a copy of the GNU General Public License 20 * along with this program; see the file COPYING. If not, see 21 * http://www.gnu.org/licenses/. 22 * 23 * This file incorporates work covered by the following copyright and 24 * permission notice: 25 * Copyright (c) 2007-2008 Atheros Communications, Inc. 26 * 27 * Permission to use, copy, modify, and/or distribute this software for any 28 * purpose with or without fee is hereby granted, provided that the above 29 * copyright notice and this permission notice appear in all copies. 30 * 31 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 32 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 33 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 34 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 35 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 36 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 37 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 38 */ 39 40 #include <linux/slab.h> 41 #include <linux/module.h> 42 #include <linux/etherdevice.h> 43 #include <linux/crc32.h> 44 #include <net/mac80211.h> 45 #include "carl9170.h" 46 #include "hw.h" 47 #include "cmd.h" 48 49 static void carl9170_dbg_message(struct ar9170 *ar, const char *buf, u32 len) 50 { 51 bool restart = false; 52 enum carl9170_restart_reasons reason = CARL9170_RR_NO_REASON; 53 54 if (len > 3) { 55 if (memcmp(buf, CARL9170_ERR_MAGIC, 3) == 0) { 56 ar->fw.err_counter++; 57 if (ar->fw.err_counter > 3) { 58 restart = true; 59 reason = CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS; 60 } 61 } 62 63 if (memcmp(buf, CARL9170_BUG_MAGIC, 3) == 0) { 64 ar->fw.bug_counter++; 65 restart = true; 66 reason = CARL9170_RR_FATAL_FIRMWARE_ERROR; 67 } 68 } 69 70 wiphy_info(ar->hw->wiphy, "FW: %.*s\n", len, buf); 71 72 if (restart) 73 carl9170_restart(ar, reason); 74 } 75 76 static void carl9170_handle_ps(struct ar9170 *ar, struct carl9170_rsp *rsp) 77 { 78 u32 ps; 79 bool new_ps; 80 81 ps = le32_to_cpu(rsp->psm.state); 82 83 new_ps = (ps & CARL9170_PSM_COUNTER) != CARL9170_PSM_WAKE; 84 if (ar->ps.state != new_ps) { 85 if (!new_ps) { 86 ar->ps.sleep_ms = jiffies_to_msecs(jiffies - 87 ar->ps.last_action); 88 } 89 90 ar->ps.last_action = jiffies; 91 92 ar->ps.state = new_ps; 93 } 94 } 95 96 static int carl9170_check_sequence(struct ar9170 *ar, unsigned int seq) 97 { 98 if (ar->cmd_seq < -1) 99 return 0; 100 101 /* 102 * Initialize Counter 103 */ 104 if (ar->cmd_seq < 0) 105 ar->cmd_seq = seq; 106 107 /* 108 * The sequence is strictly monotonic increasing and it never skips! 109 * 110 * Therefore we can safely assume that whenever we received an 111 * unexpected sequence we have lost some valuable data. 112 */ 113 if (seq != ar->cmd_seq) { 114 int count; 115 116 count = (seq - ar->cmd_seq) % ar->fw.cmd_bufs; 117 118 wiphy_err(ar->hw->wiphy, "lost %d command responses/traps! " 119 "w:%d g:%d\n", count, ar->cmd_seq, seq); 120 121 carl9170_restart(ar, CARL9170_RR_LOST_RSP); 122 return -EIO; 123 } 124 125 ar->cmd_seq = (ar->cmd_seq + 1) % ar->fw.cmd_bufs; 126 return 0; 127 } 128 129 static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer) 130 { 131 /* 132 * Some commands may have a variable response length 133 * and we cannot predict the correct length in advance. 134 * So we only check if we provided enough space for the data. 135 */ 136 if (unlikely(ar->readlen != (len - 4))) { 137 dev_warn(&ar->udev->dev, "received invalid command response:" 138 "got %d, instead of %d\n", len - 4, ar->readlen); 139 print_hex_dump_bytes("carl9170 cmd:", DUMP_PREFIX_OFFSET, 140 ar->cmd_buf, (ar->cmd.hdr.len + 4) & 0x3f); 141 print_hex_dump_bytes("carl9170 rsp:", DUMP_PREFIX_OFFSET, 142 buffer, len); 143 /* 144 * Do not complete. The command times out, 145 * and we get a stack trace from there. 146 */ 147 carl9170_restart(ar, CARL9170_RR_INVALID_RSP); 148 } 149 150 spin_lock(&ar->cmd_lock); 151 if (ar->readbuf) { 152 if (len >= 4) 153 memcpy(ar->readbuf, buffer + 4, 154 min_t(u32, len - 4, ar->readlen)); 155 156 ar->readbuf = NULL; 157 } 158 complete(&ar->cmd_wait); 159 spin_unlock(&ar->cmd_lock); 160 } 161 162 void carl9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len) 163 { 164 struct carl9170_rsp *cmd = buf; 165 struct ieee80211_vif *vif; 166 167 if ((cmd->hdr.cmd & CARL9170_RSP_FLAG) != CARL9170_RSP_FLAG) { 168 if (!(cmd->hdr.cmd & CARL9170_CMD_ASYNC_FLAG)) 169 carl9170_cmd_callback(ar, len, buf); 170 171 return; 172 } 173 174 if (unlikely(cmd->hdr.len != (len - 4))) { 175 if (net_ratelimit()) { 176 wiphy_err(ar->hw->wiphy, "FW: received over-/under" 177 "sized event %x (%d, but should be %d).\n", 178 cmd->hdr.cmd, cmd->hdr.len, len - 4); 179 180 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, 181 buf, len); 182 } 183 184 return; 185 } 186 187 /* hardware event handlers */ 188 switch (cmd->hdr.cmd) { 189 case CARL9170_RSP_PRETBTT: 190 /* pre-TBTT event */ 191 rcu_read_lock(); 192 vif = carl9170_get_main_vif(ar); 193 194 if (!vif) { 195 rcu_read_unlock(); 196 break; 197 } 198 199 switch (vif->type) { 200 case NL80211_IFTYPE_STATION: 201 carl9170_handle_ps(ar, cmd); 202 break; 203 204 case NL80211_IFTYPE_AP: 205 case NL80211_IFTYPE_ADHOC: 206 case NL80211_IFTYPE_MESH_POINT: 207 carl9170_update_beacon(ar, true); 208 break; 209 210 default: 211 break; 212 } 213 rcu_read_unlock(); 214 215 break; 216 217 218 case CARL9170_RSP_TXCOMP: 219 /* TX status notification */ 220 carl9170_tx_process_status(ar, cmd); 221 break; 222 223 case CARL9170_RSP_BEACON_CONFIG: 224 /* 225 * (IBSS) beacon send notification 226 * bytes: 04 c2 XX YY B4 B3 B2 B1 227 * 228 * XX always 80 229 * YY always 00 230 * B1-B4 "should" be the number of send out beacons. 231 */ 232 break; 233 234 case CARL9170_RSP_ATIM: 235 /* End of Atim Window */ 236 break; 237 238 case CARL9170_RSP_WATCHDOG: 239 /* Watchdog Interrupt */ 240 carl9170_restart(ar, CARL9170_RR_WATCHDOG); 241 break; 242 243 case CARL9170_RSP_TEXT: 244 /* firmware debug */ 245 carl9170_dbg_message(ar, (char *)buf + 4, len - 4); 246 break; 247 248 case CARL9170_RSP_HEXDUMP: 249 wiphy_dbg(ar->hw->wiphy, "FW: HD %d\n", len - 4); 250 print_hex_dump_bytes("FW:", DUMP_PREFIX_NONE, 251 (char *)buf + 4, len - 4); 252 break; 253 254 case CARL9170_RSP_RADAR: 255 if (!net_ratelimit()) 256 break; 257 258 wiphy_info(ar->hw->wiphy, "FW: RADAR! Please report this " 259 "incident to linux-wireless@vger.kernel.org !\n"); 260 break; 261 262 case CARL9170_RSP_GPIO: 263 #ifdef CONFIG_CARL9170_WPC 264 if (ar->wps.pbc) { 265 bool state = !!(cmd->gpio.gpio & cpu_to_le32( 266 AR9170_GPIO_PORT_WPS_BUTTON_PRESSED)); 267 268 if (state != ar->wps.pbc_state) { 269 ar->wps.pbc_state = state; 270 input_report_key(ar->wps.pbc, KEY_WPS_BUTTON, 271 state); 272 input_sync(ar->wps.pbc); 273 } 274 } 275 #endif /* CONFIG_CARL9170_WPC */ 276 break; 277 278 case CARL9170_RSP_BOOT: 279 complete(&ar->fw_boot_wait); 280 break; 281 282 default: 283 wiphy_err(ar->hw->wiphy, "FW: received unhandled event %x\n", 284 cmd->hdr.cmd); 285 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len); 286 break; 287 } 288 } 289 290 static int carl9170_rx_mac_status(struct ar9170 *ar, 291 struct ar9170_rx_head *head, struct ar9170_rx_macstatus *mac, 292 struct ieee80211_rx_status *status) 293 { 294 struct ieee80211_channel *chan; 295 u8 error, decrypt; 296 297 BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12); 298 BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4); 299 300 error = mac->error; 301 302 if (error & AR9170_RX_ERROR_WRONG_RA) { 303 if (!ar->sniffer_enabled) 304 return -EINVAL; 305 } 306 307 if (error & AR9170_RX_ERROR_PLCP) { 308 if (!(ar->filter_state & FIF_PLCPFAIL)) 309 return -EINVAL; 310 311 status->flag |= RX_FLAG_FAILED_PLCP_CRC; 312 } 313 314 if (error & AR9170_RX_ERROR_FCS) { 315 ar->tx_fcs_errors++; 316 317 if (!(ar->filter_state & FIF_FCSFAIL)) 318 return -EINVAL; 319 320 status->flag |= RX_FLAG_FAILED_FCS_CRC; 321 } 322 323 decrypt = ar9170_get_decrypt_type(mac); 324 if (!(decrypt & AR9170_RX_ENC_SOFTWARE) && 325 decrypt != AR9170_ENC_ALG_NONE) { 326 if ((decrypt == AR9170_ENC_ALG_TKIP) && 327 (error & AR9170_RX_ERROR_MMIC)) 328 status->flag |= RX_FLAG_MMIC_ERROR; 329 330 status->flag |= RX_FLAG_DECRYPTED; 331 } 332 333 if (error & AR9170_RX_ERROR_DECRYPT && !ar->sniffer_enabled) 334 return -ENODATA; 335 336 error &= ~(AR9170_RX_ERROR_MMIC | 337 AR9170_RX_ERROR_FCS | 338 AR9170_RX_ERROR_WRONG_RA | 339 AR9170_RX_ERROR_DECRYPT | 340 AR9170_RX_ERROR_PLCP); 341 342 /* drop any other error frames */ 343 if (unlikely(error)) { 344 /* TODO: update netdevice's RX dropped/errors statistics */ 345 346 if (net_ratelimit()) 347 wiphy_dbg(ar->hw->wiphy, "received frame with " 348 "suspicious error code (%#x).\n", error); 349 350 return -EINVAL; 351 } 352 353 chan = ar->channel; 354 if (chan) { 355 status->band = chan->band; 356 status->freq = chan->center_freq; 357 } 358 359 switch (mac->status & AR9170_RX_STATUS_MODULATION) { 360 case AR9170_RX_STATUS_MODULATION_CCK: 361 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE) 362 status->enc_flags |= RX_ENC_FLAG_SHORTPRE; 363 switch (head->plcp[0]) { 364 case AR9170_RX_PHY_RATE_CCK_1M: 365 status->rate_idx = 0; 366 break; 367 case AR9170_RX_PHY_RATE_CCK_2M: 368 status->rate_idx = 1; 369 break; 370 case AR9170_RX_PHY_RATE_CCK_5M: 371 status->rate_idx = 2; 372 break; 373 case AR9170_RX_PHY_RATE_CCK_11M: 374 status->rate_idx = 3; 375 break; 376 default: 377 if (net_ratelimit()) { 378 wiphy_err(ar->hw->wiphy, "invalid plcp cck " 379 "rate (%x).\n", head->plcp[0]); 380 } 381 382 return -EINVAL; 383 } 384 break; 385 386 case AR9170_RX_STATUS_MODULATION_DUPOFDM: 387 case AR9170_RX_STATUS_MODULATION_OFDM: 388 switch (head->plcp[0] & 0xf) { 389 case AR9170_TXRX_PHY_RATE_OFDM_6M: 390 status->rate_idx = 0; 391 break; 392 case AR9170_TXRX_PHY_RATE_OFDM_9M: 393 status->rate_idx = 1; 394 break; 395 case AR9170_TXRX_PHY_RATE_OFDM_12M: 396 status->rate_idx = 2; 397 break; 398 case AR9170_TXRX_PHY_RATE_OFDM_18M: 399 status->rate_idx = 3; 400 break; 401 case AR9170_TXRX_PHY_RATE_OFDM_24M: 402 status->rate_idx = 4; 403 break; 404 case AR9170_TXRX_PHY_RATE_OFDM_36M: 405 status->rate_idx = 5; 406 break; 407 case AR9170_TXRX_PHY_RATE_OFDM_48M: 408 status->rate_idx = 6; 409 break; 410 case AR9170_TXRX_PHY_RATE_OFDM_54M: 411 status->rate_idx = 7; 412 break; 413 default: 414 if (net_ratelimit()) { 415 wiphy_err(ar->hw->wiphy, "invalid plcp ofdm " 416 "rate (%x).\n", head->plcp[0]); 417 } 418 419 return -EINVAL; 420 } 421 if (status->band == NL80211_BAND_2GHZ) 422 status->rate_idx += 4; 423 break; 424 425 case AR9170_RX_STATUS_MODULATION_HT: 426 if (head->plcp[3] & 0x80) 427 status->bw = RATE_INFO_BW_40; 428 if (head->plcp[6] & 0x80) 429 status->enc_flags |= RX_ENC_FLAG_SHORT_GI; 430 431 status->rate_idx = clamp(head->plcp[3] & 0x7f, 0, 75); 432 status->encoding = RX_ENC_HT; 433 break; 434 435 default: 436 BUG(); 437 return -ENOSYS; 438 } 439 440 return 0; 441 } 442 443 static void carl9170_rx_phy_status(struct ar9170 *ar, 444 struct ar9170_rx_phystatus *phy, struct ieee80211_rx_status *status) 445 { 446 int i; 447 448 BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20); 449 450 for (i = 0; i < 3; i++) 451 if (phy->rssi[i] != 0x80) 452 status->antenna |= BIT(i); 453 454 /* post-process RSSI */ 455 for (i = 0; i < 7; i++) 456 if (phy->rssi[i] & 0x80) 457 phy->rssi[i] = ((~phy->rssi[i] & 0x7f) + 1) & 0x7f; 458 459 if (phy->phy_err) 460 ar->rx_phy_errors++; 461 462 status->signal = ar->noise[0] + phy->rssi_combined; 463 } 464 465 static struct sk_buff *carl9170_rx_copy_data(u8 *buf, int len) 466 { 467 struct sk_buff *skb; 468 int reserved = 0; 469 struct ieee80211_hdr *hdr = (void *) buf; 470 471 if (ieee80211_is_data_qos(hdr->frame_control)) { 472 u8 *qc = ieee80211_get_qos_ctl(hdr); 473 reserved += NET_IP_ALIGN; 474 475 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 476 reserved += NET_IP_ALIGN; 477 } 478 479 if (ieee80211_has_a4(hdr->frame_control)) 480 reserved += NET_IP_ALIGN; 481 482 reserved = 32 + (reserved & NET_IP_ALIGN); 483 484 skb = dev_alloc_skb(len + reserved); 485 if (likely(skb)) { 486 skb_reserve(skb, reserved); 487 skb_put_data(skb, buf, len); 488 } 489 490 return skb; 491 } 492 493 static u8 *carl9170_find_ie(u8 *data, unsigned int len, u8 ie) 494 { 495 struct ieee80211_mgmt *mgmt = (void *)data; 496 u8 *pos, *end; 497 498 pos = (u8 *)mgmt->u.beacon.variable; 499 end = data + len; 500 while (pos < end) { 501 if (pos + 2 + pos[1] > end) 502 return NULL; 503 504 if (pos[0] == ie) 505 return pos; 506 507 pos += 2 + pos[1]; 508 } 509 return NULL; 510 } 511 512 /* 513 * NOTE: 514 * 515 * The firmware is in charge of waking up the device just before 516 * the AP is expected to transmit the next beacon. 517 * 518 * This leaves the driver with the important task of deciding when 519 * to set the PHY back to bed again. 520 */ 521 static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len) 522 { 523 struct ieee80211_hdr *hdr = data; 524 struct ieee80211_tim_ie *tim_ie; 525 struct ath_common *common = &ar->common; 526 u8 *tim; 527 u8 tim_len; 528 bool cam; 529 530 if (likely(!(ar->hw->conf.flags & IEEE80211_CONF_PS))) 531 return; 532 533 /* min. beacon length + FCS_LEN */ 534 if (len <= 40 + FCS_LEN) 535 return; 536 537 /* check if this really is a beacon */ 538 /* and only beacons from the associated BSSID, please */ 539 if (!ath_is_mybeacon(common, hdr) || !common->curaid) 540 return; 541 542 ar->ps.last_beacon = jiffies; 543 544 tim = carl9170_find_ie(data, len - FCS_LEN, WLAN_EID_TIM); 545 if (!tim) 546 return; 547 548 if (tim[1] < sizeof(*tim_ie)) 549 return; 550 551 tim_len = tim[1]; 552 tim_ie = (struct ieee80211_tim_ie *) &tim[2]; 553 554 if (!WARN_ON_ONCE(!ar->hw->conf.ps_dtim_period)) 555 ar->ps.dtim_counter = (tim_ie->dtim_count - 1) % 556 ar->hw->conf.ps_dtim_period; 557 558 /* Check whenever the PHY can be turned off again. */ 559 560 /* 1. What about buffered unicast traffic for our AID? */ 561 cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid, false); 562 563 /* 2. Maybe the AP wants to send multicast/broadcast data? */ 564 cam |= !!(tim_ie->bitmap_ctrl & 0x01); 565 566 if (!cam) { 567 /* back to low-power land. */ 568 ar->ps.off_override &= ~PS_OFF_BCN; 569 carl9170_ps_check(ar); 570 } else { 571 /* force CAM */ 572 ar->ps.off_override |= PS_OFF_BCN; 573 } 574 } 575 576 static void carl9170_ba_check(struct ar9170 *ar, void *data, unsigned int len) 577 { 578 struct ieee80211_bar *bar = data; 579 struct carl9170_bar_list_entry *entry; 580 unsigned int queue; 581 582 if (likely(!ieee80211_is_back(bar->frame_control))) 583 return; 584 585 if (len <= sizeof(*bar) + FCS_LEN) 586 return; 587 588 queue = TID_TO_WME_AC(((le16_to_cpu(bar->control) & 589 IEEE80211_BAR_CTRL_TID_INFO_MASK) >> 590 IEEE80211_BAR_CTRL_TID_INFO_SHIFT) & 7); 591 592 rcu_read_lock(); 593 list_for_each_entry_rcu(entry, &ar->bar_list[queue], list) { 594 struct sk_buff *entry_skb = entry->skb; 595 struct _carl9170_tx_superframe *super = (void *)entry_skb->data; 596 struct ieee80211_bar *entry_bar = (void *)super->frame_data; 597 598 #define TID_CHECK(a, b) ( \ 599 ((a) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK)) == \ 600 ((b) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK))) \ 601 602 if (bar->start_seq_num == entry_bar->start_seq_num && 603 TID_CHECK(bar->control, entry_bar->control) && 604 ether_addr_equal_64bits(bar->ra, entry_bar->ta) && 605 ether_addr_equal_64bits(bar->ta, entry_bar->ra)) { 606 struct ieee80211_tx_info *tx_info; 607 608 tx_info = IEEE80211_SKB_CB(entry_skb); 609 tx_info->flags |= IEEE80211_TX_STAT_ACK; 610 611 spin_lock_bh(&ar->bar_list_lock[queue]); 612 list_del_rcu(&entry->list); 613 spin_unlock_bh(&ar->bar_list_lock[queue]); 614 kfree_rcu(entry, head); 615 break; 616 } 617 } 618 rcu_read_unlock(); 619 620 #undef TID_CHECK 621 } 622 623 static bool carl9170_ampdu_check(struct ar9170 *ar, u8 *buf, u8 ms, 624 struct ieee80211_rx_status *rx_status) 625 { 626 __le16 fc; 627 628 if ((ms & AR9170_RX_STATUS_MPDU) == AR9170_RX_STATUS_MPDU_SINGLE) { 629 /* 630 * This frame is not part of an aMPDU. 631 * Therefore it is not subjected to any 632 * of the following content restrictions. 633 */ 634 return true; 635 } 636 637 rx_status->flag |= RX_FLAG_AMPDU_DETAILS | RX_FLAG_AMPDU_LAST_KNOWN; 638 rx_status->ampdu_reference = ar->ampdu_ref; 639 640 /* 641 * "802.11n - 7.4a.3 A-MPDU contents" describes in which contexts 642 * certain frame types can be part of an aMPDU. 643 * 644 * In order to keep the processing cost down, I opted for a 645 * stateless filter solely based on the frame control field. 646 */ 647 648 fc = ((struct ieee80211_hdr *)buf)->frame_control; 649 if (ieee80211_is_data_qos(fc) && ieee80211_is_data_present(fc)) 650 return true; 651 652 if (ieee80211_is_ack(fc) || ieee80211_is_back(fc) || 653 ieee80211_is_back_req(fc)) 654 return true; 655 656 if (ieee80211_is_action(fc)) 657 return true; 658 659 return false; 660 } 661 662 static int carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len, 663 struct ieee80211_rx_status *status) 664 { 665 struct sk_buff *skb; 666 667 /* (driver) frame trap handler 668 * 669 * Because power-saving mode handing has to be implemented by 670 * the driver/firmware. We have to check each incoming beacon 671 * from the associated AP, if there's new data for us (either 672 * broadcast/multicast or unicast) we have to react quickly. 673 * 674 * So, if you have you want to add additional frame trap 675 * handlers, this would be the perfect place! 676 */ 677 678 carl9170_ps_beacon(ar, buf, len); 679 680 carl9170_ba_check(ar, buf, len); 681 682 skb = carl9170_rx_copy_data(buf, len); 683 if (!skb) 684 return -ENOMEM; 685 686 memcpy(IEEE80211_SKB_RXCB(skb), status, sizeof(*status)); 687 ieee80211_rx(ar->hw, skb); 688 return 0; 689 } 690 691 /* 692 * If the frame alignment is right (or the kernel has 693 * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there 694 * is only a single MPDU in the USB frame, then we could 695 * submit to mac80211 the SKB directly. However, since 696 * there may be multiple packets in one SKB in stream 697 * mode, and we need to observe the proper ordering, 698 * this is non-trivial. 699 */ 700 static void carl9170_rx_untie_data(struct ar9170 *ar, u8 *buf, int len) 701 { 702 struct ar9170_rx_head *head; 703 struct ar9170_rx_macstatus *mac; 704 struct ar9170_rx_phystatus *phy = NULL; 705 struct ieee80211_rx_status status; 706 int mpdu_len; 707 u8 mac_status; 708 709 if (!IS_STARTED(ar)) 710 return; 711 712 if (unlikely(len < sizeof(*mac))) 713 goto drop; 714 715 memset(&status, 0, sizeof(status)); 716 717 mpdu_len = len - sizeof(*mac); 718 719 mac = (void *)(buf + mpdu_len); 720 mac_status = mac->status; 721 switch (mac_status & AR9170_RX_STATUS_MPDU) { 722 case AR9170_RX_STATUS_MPDU_FIRST: 723 ar->ampdu_ref++; 724 /* Aggregated MPDUs start with an PLCP header */ 725 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) { 726 head = (void *) buf; 727 728 /* 729 * The PLCP header needs to be cached for the 730 * following MIDDLE + LAST A-MPDU packets. 731 * 732 * So, if you are wondering why all frames seem 733 * to share a common RX status information, 734 * then you have the answer right here... 735 */ 736 memcpy(&ar->rx_plcp, (void *) buf, 737 sizeof(struct ar9170_rx_head)); 738 739 mpdu_len -= sizeof(struct ar9170_rx_head); 740 buf += sizeof(struct ar9170_rx_head); 741 742 ar->rx_has_plcp = true; 743 } else { 744 if (net_ratelimit()) { 745 wiphy_err(ar->hw->wiphy, "plcp info " 746 "is clipped.\n"); 747 } 748 749 goto drop; 750 } 751 break; 752 753 case AR9170_RX_STATUS_MPDU_LAST: 754 status.flag |= RX_FLAG_AMPDU_IS_LAST; 755 756 /* 757 * The last frame of an A-MPDU has an extra tail 758 * which does contain the phy status of the whole 759 * aggregate. 760 */ 761 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) { 762 mpdu_len -= sizeof(struct ar9170_rx_phystatus); 763 phy = (void *)(buf + mpdu_len); 764 } else { 765 if (net_ratelimit()) { 766 wiphy_err(ar->hw->wiphy, "frame tail " 767 "is clipped.\n"); 768 } 769 770 goto drop; 771 } 772 fallthrough; 773 774 case AR9170_RX_STATUS_MPDU_MIDDLE: 775 /* These are just data + mac status */ 776 if (unlikely(!ar->rx_has_plcp)) { 777 if (!net_ratelimit()) 778 return; 779 780 wiphy_err(ar->hw->wiphy, "rx stream does not start " 781 "with a first_mpdu frame tag.\n"); 782 783 goto drop; 784 } 785 786 head = &ar->rx_plcp; 787 break; 788 789 case AR9170_RX_STATUS_MPDU_SINGLE: 790 /* single mpdu has both: plcp (head) and phy status (tail) */ 791 head = (void *) buf; 792 793 mpdu_len -= sizeof(struct ar9170_rx_head); 794 mpdu_len -= sizeof(struct ar9170_rx_phystatus); 795 796 buf += sizeof(struct ar9170_rx_head); 797 phy = (void *)(buf + mpdu_len); 798 break; 799 800 default: 801 BUG(); 802 break; 803 } 804 805 /* FC + DU + RA + FCS */ 806 if (unlikely(mpdu_len < (2 + 2 + ETH_ALEN + FCS_LEN))) 807 goto drop; 808 809 if (unlikely(carl9170_rx_mac_status(ar, head, mac, &status))) 810 goto drop; 811 812 if (!carl9170_ampdu_check(ar, buf, mac_status, &status)) 813 goto drop; 814 815 if (phy) 816 carl9170_rx_phy_status(ar, phy, &status); 817 else 818 status.flag |= RX_FLAG_NO_SIGNAL_VAL; 819 820 if (carl9170_handle_mpdu(ar, buf, mpdu_len, &status)) 821 goto drop; 822 823 return; 824 drop: 825 ar->rx_dropped++; 826 } 827 828 static void carl9170_rx_untie_cmds(struct ar9170 *ar, const u8 *respbuf, 829 const unsigned int resplen) 830 { 831 struct carl9170_rsp *cmd; 832 int i = 0; 833 834 while (i < resplen) { 835 cmd = (void *) &respbuf[i]; 836 837 i += cmd->hdr.len + 4; 838 if (unlikely(i > resplen)) 839 break; 840 841 if (carl9170_check_sequence(ar, cmd->hdr.seq)) 842 break; 843 844 carl9170_handle_command_response(ar, cmd, cmd->hdr.len + 4); 845 } 846 847 if (unlikely(i != resplen)) { 848 if (!net_ratelimit()) 849 return; 850 851 wiphy_err(ar->hw->wiphy, "malformed firmware trap:\n"); 852 print_hex_dump_bytes("rxcmd:", DUMP_PREFIX_OFFSET, 853 respbuf, resplen); 854 } 855 } 856 857 static void __carl9170_rx(struct ar9170 *ar, u8 *buf, unsigned int len) 858 { 859 unsigned int i = 0; 860 861 /* weird thing, but this is the same in the original driver */ 862 while (len > 2 && i < 12 && buf[0] == 0xff && buf[1] == 0xff) { 863 i += 2; 864 len -= 2; 865 buf += 2; 866 } 867 868 if (unlikely(len < 4)) 869 return; 870 871 /* found the 6 * 0xffff marker? */ 872 if (i == 12) 873 carl9170_rx_untie_cmds(ar, buf, len); 874 else 875 carl9170_rx_untie_data(ar, buf, len); 876 } 877 878 static void carl9170_rx_stream(struct ar9170 *ar, void *buf, unsigned int len) 879 { 880 unsigned int tlen, wlen = 0, clen = 0; 881 struct ar9170_stream *rx_stream; 882 u8 *tbuf; 883 884 tbuf = buf; 885 tlen = len; 886 887 while (tlen >= 4) { 888 rx_stream = (void *) tbuf; 889 clen = le16_to_cpu(rx_stream->length); 890 wlen = ALIGN(clen, 4); 891 892 /* check if this is stream has a valid tag.*/ 893 if (rx_stream->tag != cpu_to_le16(AR9170_RX_STREAM_TAG)) { 894 /* 895 * TODO: handle the highly unlikely event that the 896 * corrupted stream has the TAG at the right position. 897 */ 898 899 /* check if the frame can be repaired. */ 900 if (!ar->rx_failover_missing) { 901 902 /* this is not "short read". */ 903 if (net_ratelimit()) { 904 wiphy_err(ar->hw->wiphy, 905 "missing tag!\n"); 906 } 907 908 __carl9170_rx(ar, tbuf, tlen); 909 return; 910 } 911 912 if (ar->rx_failover_missing > tlen) { 913 if (net_ratelimit()) { 914 wiphy_err(ar->hw->wiphy, 915 "possible multi " 916 "stream corruption!\n"); 917 goto err_telluser; 918 } else { 919 goto err_silent; 920 } 921 } 922 923 skb_put_data(ar->rx_failover, tbuf, 924 min_t(unsigned int, tlen, 925 ar->rx_failover_missing)); 926 ar->rx_failover_missing -= tlen; 927 928 if (ar->rx_failover_missing <= 0) { 929 /* 930 * nested carl9170_rx_stream call! 931 * 932 * termination is guaranteed, even when the 933 * combined frame also have an element with 934 * a bad tag. 935 */ 936 937 ar->rx_failover_missing = 0; 938 carl9170_rx_stream(ar, ar->rx_failover->data, 939 ar->rx_failover->len); 940 941 skb_reset_tail_pointer(ar->rx_failover); 942 skb_trim(ar->rx_failover, 0); 943 } 944 945 return; 946 } 947 948 /* check if stream is clipped */ 949 if (wlen > tlen - 4) { 950 if (ar->rx_failover_missing) { 951 /* TODO: handle double stream corruption. */ 952 if (net_ratelimit()) { 953 wiphy_err(ar->hw->wiphy, "double rx " 954 "stream corruption!\n"); 955 goto err_telluser; 956 } else { 957 goto err_silent; 958 } 959 } 960 961 /* 962 * save incomplete data set. 963 * the firmware will resend the missing bits when 964 * the rx - descriptor comes round again. 965 */ 966 967 skb_put_data(ar->rx_failover, tbuf, tlen); 968 ar->rx_failover_missing = clen - tlen; 969 return; 970 } 971 __carl9170_rx(ar, rx_stream->payload, clen); 972 973 tbuf += wlen + 4; 974 tlen -= wlen + 4; 975 } 976 977 if (tlen) { 978 if (net_ratelimit()) { 979 wiphy_err(ar->hw->wiphy, "%d bytes of unprocessed " 980 "data left in rx stream!\n", tlen); 981 } 982 983 goto err_telluser; 984 } 985 986 return; 987 988 err_telluser: 989 wiphy_err(ar->hw->wiphy, "damaged RX stream data [want:%d, " 990 "data:%d, rx:%d, pending:%d ]\n", clen, wlen, tlen, 991 ar->rx_failover_missing); 992 993 if (ar->rx_failover_missing) 994 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET, 995 ar->rx_failover->data, 996 ar->rx_failover->len); 997 998 print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET, 999 buf, len); 1000 1001 wiphy_err(ar->hw->wiphy, "please check your hardware and cables, if " 1002 "you see this message frequently.\n"); 1003 1004 err_silent: 1005 if (ar->rx_failover_missing) { 1006 skb_reset_tail_pointer(ar->rx_failover); 1007 skb_trim(ar->rx_failover, 0); 1008 ar->rx_failover_missing = 0; 1009 } 1010 } 1011 1012 void carl9170_rx(struct ar9170 *ar, void *buf, unsigned int len) 1013 { 1014 if (ar->fw.rx_stream) 1015 carl9170_rx_stream(ar, buf, len); 1016 else 1017 __carl9170_rx(ar, buf, len); 1018 } 1019