1/* 2 * Atheros CARL9170 driver 3 * 4 * 802.11 & command trap routines 5 * 6 * Copyright 2008, Johannes Berg <johannes@sipsolutions.net> 7 * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com> 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License as published by 11 * the Free Software Foundation; either version 2 of the License, or 12 * (at your option) any later version. 13 * 14 * This program is distributed in the hope that it will be useful, 15 * but WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 * GNU General Public License for more details. 18 * 19 * You should have received a copy of the GNU General Public License 20 * along with this program; see the file COPYING. If not, see 21 * http://www.gnu.org/licenses/. 22 * 23 * This file incorporates work covered by the following copyright and 24 * permission notice: 25 * Copyright (c) 2007-2008 Atheros Communications, Inc. 26 * 27 * Permission to use, copy, modify, and/or distribute this software for any 28 * purpose with or without fee is hereby granted, provided that the above 29 * copyright notice and this permission notice appear in all copies. 30 * 31 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 32 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 33 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 34 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 35 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 36 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 37 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 38 */ 39 40#include <linux/slab.h> 41#include <linux/module.h> 42#include <linux/etherdevice.h> 43#include <linux/crc32.h> 44#include <net/mac80211.h> 45#include "carl9170.h" 46#include "hw.h" 47#include "cmd.h" 48 49static void carl9170_dbg_message(struct ar9170 *ar, const char *buf, u32 len) 50{ 51 bool restart = false; 52 enum carl9170_restart_reasons reason = CARL9170_RR_NO_REASON; 53 54 if (len > 3) { 55 if (memcmp(buf, CARL9170_ERR_MAGIC, 3) == 0) { 56 ar->fw.err_counter++; 57 if (ar->fw.err_counter > 3) { 58 restart = true; 59 reason = CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS; 60 } 61 } 62 63 if (memcmp(buf, CARL9170_BUG_MAGIC, 3) == 0) { 64 ar->fw.bug_counter++; 65 restart = true; 66 reason = CARL9170_RR_FATAL_FIRMWARE_ERROR; 67 } 68 } 69 70 wiphy_info(ar->hw->wiphy, "FW: %.*s\n", len, buf); 71 72 if (restart) 73 carl9170_restart(ar, reason); 74} 75 76static void carl9170_handle_ps(struct ar9170 *ar, struct carl9170_rsp *rsp) 77{ 78 u32 ps; 79 bool new_ps; 80 81 ps = le32_to_cpu(rsp->psm.state); 82 83 new_ps = (ps & CARL9170_PSM_COUNTER) != CARL9170_PSM_WAKE; 84 if (ar->ps.state != new_ps) { 85 if (!new_ps) { 86 ar->ps.sleep_ms = jiffies_to_msecs(jiffies - 87 ar->ps.last_action); 88 } 89 90 ar->ps.last_action = jiffies; 91 92 ar->ps.state = new_ps; 93 } 94} 95 96static int carl9170_check_sequence(struct ar9170 *ar, unsigned int seq) 97{ 98 if (ar->cmd_seq < -1) 99 return 0; 100 101 /* 102 * Initialize Counter 103 */ 104 if (ar->cmd_seq < 0) 105 ar->cmd_seq = seq; 106 107 /* 108 * The sequence is strictly monotonic increasing and it never skips! 109 * 110 * Therefore we can safely assume that whenever we received an 111 * unexpected sequence we have lost some valuable data. 112 */ 113 if (seq != ar->cmd_seq) { 114 int count; 115 116 count = (seq - ar->cmd_seq) % ar->fw.cmd_bufs; 117 118 wiphy_err(ar->hw->wiphy, "lost %d command responses/traps! " 119 "w:%d g:%d\n", count, ar->cmd_seq, seq); 120 121 carl9170_restart(ar, CARL9170_RR_LOST_RSP); 122 return -EIO; 123 } 124 125 ar->cmd_seq = (ar->cmd_seq + 1) % ar->fw.cmd_bufs; 126 return 0; 127} 128 129static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer) 130{ 131 /* 132 * Some commands may have a variable response length 133 * and we cannot predict the correct length in advance. 134 * So we only check if we provided enough space for the data. 135 */ 136 if (unlikely(ar->readlen != (len - 4))) { 137 dev_warn(&ar->udev->dev, "received invalid command response:" 138 "got %d, instead of %d\n", len - 4, ar->readlen); 139 print_hex_dump_bytes("carl9170 cmd:", DUMP_PREFIX_OFFSET, 140 ar->cmd_buf, (ar->cmd.hdr.len + 4) & 0x3f); 141 print_hex_dump_bytes("carl9170 rsp:", DUMP_PREFIX_OFFSET, 142 buffer, len); 143 /* 144 * Do not complete. The command times out, 145 * and we get a stack trace from there. 146 */ 147 carl9170_restart(ar, CARL9170_RR_INVALID_RSP); 148 } 149 150 spin_lock(&ar->cmd_lock); 151 if (ar->readbuf) { 152 if (len >= 4) 153 memcpy(ar->readbuf, buffer + 4, len - 4); 154 155 ar->readbuf = NULL; 156 } 157 complete(&ar->cmd_wait); 158 spin_unlock(&ar->cmd_lock); 159} 160 161void carl9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len) 162{ 163 struct carl9170_rsp *cmd = buf; 164 struct ieee80211_vif *vif; 165 166 if ((cmd->hdr.cmd & CARL9170_RSP_FLAG) != CARL9170_RSP_FLAG) { 167 if (!(cmd->hdr.cmd & CARL9170_CMD_ASYNC_FLAG)) 168 carl9170_cmd_callback(ar, len, buf); 169 170 return; 171 } 172 173 if (unlikely(cmd->hdr.len != (len - 4))) { 174 if (net_ratelimit()) { 175 wiphy_err(ar->hw->wiphy, "FW: received over-/under" 176 "sized event %x (%d, but should be %d).\n", 177 cmd->hdr.cmd, cmd->hdr.len, len - 4); 178 179 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, 180 buf, len); 181 } 182 183 return; 184 } 185 186 /* hardware event handlers */ 187 switch (cmd->hdr.cmd) { 188 case CARL9170_RSP_PRETBTT: 189 /* pre-TBTT event */ 190 rcu_read_lock(); 191 vif = carl9170_get_main_vif(ar); 192 193 if (!vif) { 194 rcu_read_unlock(); 195 break; 196 } 197 198 switch (vif->type) { 199 case NL80211_IFTYPE_STATION: 200 carl9170_handle_ps(ar, cmd); 201 break; 202 203 case NL80211_IFTYPE_AP: 204 case NL80211_IFTYPE_ADHOC: 205 case NL80211_IFTYPE_MESH_POINT: 206 carl9170_update_beacon(ar, true); 207 break; 208 209 default: 210 break; 211 } 212 rcu_read_unlock(); 213 214 break; 215 216 217 case CARL9170_RSP_TXCOMP: 218 /* TX status notification */ 219 carl9170_tx_process_status(ar, cmd); 220 break; 221 222 case CARL9170_RSP_BEACON_CONFIG: 223 /* 224 * (IBSS) beacon send notification 225 * bytes: 04 c2 XX YY B4 B3 B2 B1 226 * 227 * XX always 80 228 * YY always 00 229 * B1-B4 "should" be the number of send out beacons. 230 */ 231 break; 232 233 case CARL9170_RSP_ATIM: 234 /* End of Atim Window */ 235 break; 236 237 case CARL9170_RSP_WATCHDOG: 238 /* Watchdog Interrupt */ 239 carl9170_restart(ar, CARL9170_RR_WATCHDOG); 240 break; 241 242 case CARL9170_RSP_TEXT: 243 /* firmware debug */ 244 carl9170_dbg_message(ar, (char *)buf + 4, len - 4); 245 break; 246 247 case CARL9170_RSP_HEXDUMP: 248 wiphy_dbg(ar->hw->wiphy, "FW: HD %d\n", len - 4); 249 print_hex_dump_bytes("FW:", DUMP_PREFIX_NONE, 250 (char *)buf + 4, len - 4); 251 break; 252 253 case CARL9170_RSP_RADAR: 254 if (!net_ratelimit()) 255 break; 256 257 wiphy_info(ar->hw->wiphy, "FW: RADAR! Please report this " 258 "incident to linux-wireless@vger.kernel.org !\n"); 259 break; 260 261 case CARL9170_RSP_GPIO: 262#ifdef CONFIG_CARL9170_WPC 263 if (ar->wps.pbc) { 264 bool state = !!(cmd->gpio.gpio & cpu_to_le32( 265 AR9170_GPIO_PORT_WPS_BUTTON_PRESSED)); 266 267 if (state != ar->wps.pbc_state) { 268 ar->wps.pbc_state = state; 269 input_report_key(ar->wps.pbc, KEY_WPS_BUTTON, 270 state); 271 input_sync(ar->wps.pbc); 272 } 273 } 274#endif /* CONFIG_CARL9170_WPC */ 275 break; 276 277 case CARL9170_RSP_BOOT: 278 complete(&ar->fw_boot_wait); 279 break; 280 281 default: 282 wiphy_err(ar->hw->wiphy, "FW: received unhandled event %x\n", 283 cmd->hdr.cmd); 284 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len); 285 break; 286 } 287} 288 289static int carl9170_rx_mac_status(struct ar9170 *ar, 290 struct ar9170_rx_head *head, struct ar9170_rx_macstatus *mac, 291 struct ieee80211_rx_status *status) 292{ 293 struct ieee80211_channel *chan; 294 u8 error, decrypt; 295 296 BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12); 297 BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4); 298 299 error = mac->error; 300 301 if (error & AR9170_RX_ERROR_WRONG_RA) { 302 if (!ar->sniffer_enabled) 303 return -EINVAL; 304 } 305 306 if (error & AR9170_RX_ERROR_PLCP) { 307 if (!(ar->filter_state & FIF_PLCPFAIL)) 308 return -EINVAL; 309 310 status->flag |= RX_FLAG_FAILED_PLCP_CRC; 311 } 312 313 if (error & AR9170_RX_ERROR_FCS) { 314 ar->tx_fcs_errors++; 315 316 if (!(ar->filter_state & FIF_FCSFAIL)) 317 return -EINVAL; 318 319 status->flag |= RX_FLAG_FAILED_FCS_CRC; 320 } 321 322 decrypt = ar9170_get_decrypt_type(mac); 323 if (!(decrypt & AR9170_RX_ENC_SOFTWARE) && 324 decrypt != AR9170_ENC_ALG_NONE) { 325 if ((decrypt == AR9170_ENC_ALG_TKIP) && 326 (error & AR9170_RX_ERROR_MMIC)) 327 status->flag |= RX_FLAG_MMIC_ERROR; 328 329 status->flag |= RX_FLAG_DECRYPTED; 330 } 331 332 if (error & AR9170_RX_ERROR_DECRYPT && !ar->sniffer_enabled) 333 return -ENODATA; 334 335 error &= ~(AR9170_RX_ERROR_MMIC | 336 AR9170_RX_ERROR_FCS | 337 AR9170_RX_ERROR_WRONG_RA | 338 AR9170_RX_ERROR_DECRYPT | 339 AR9170_RX_ERROR_PLCP); 340 341 /* drop any other error frames */ 342 if (unlikely(error)) { 343 /* TODO: update netdevice's RX dropped/errors statistics */ 344 345 if (net_ratelimit()) 346 wiphy_dbg(ar->hw->wiphy, "received frame with " 347 "suspicious error code (%#x).\n", error); 348 349 return -EINVAL; 350 } 351 352 chan = ar->channel; 353 if (chan) { 354 status->band = chan->band; 355 status->freq = chan->center_freq; 356 } 357 358 switch (mac->status & AR9170_RX_STATUS_MODULATION) { 359 case AR9170_RX_STATUS_MODULATION_CCK: 360 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE) 361 status->enc_flags |= RX_ENC_FLAG_SHORTPRE; 362 switch (head->plcp[0]) { 363 case AR9170_RX_PHY_RATE_CCK_1M: 364 status->rate_idx = 0; 365 break; 366 case AR9170_RX_PHY_RATE_CCK_2M: 367 status->rate_idx = 1; 368 break; 369 case AR9170_RX_PHY_RATE_CCK_5M: 370 status->rate_idx = 2; 371 break; 372 case AR9170_RX_PHY_RATE_CCK_11M: 373 status->rate_idx = 3; 374 break; 375 default: 376 if (net_ratelimit()) { 377 wiphy_err(ar->hw->wiphy, "invalid plcp cck " 378 "rate (%x).\n", head->plcp[0]); 379 } 380 381 return -EINVAL; 382 } 383 break; 384 385 case AR9170_RX_STATUS_MODULATION_DUPOFDM: 386 case AR9170_RX_STATUS_MODULATION_OFDM: 387 switch (head->plcp[0] & 0xf) { 388 case AR9170_TXRX_PHY_RATE_OFDM_6M: 389 status->rate_idx = 0; 390 break; 391 case AR9170_TXRX_PHY_RATE_OFDM_9M: 392 status->rate_idx = 1; 393 break; 394 case AR9170_TXRX_PHY_RATE_OFDM_12M: 395 status->rate_idx = 2; 396 break; 397 case AR9170_TXRX_PHY_RATE_OFDM_18M: 398 status->rate_idx = 3; 399 break; 400 case AR9170_TXRX_PHY_RATE_OFDM_24M: 401 status->rate_idx = 4; 402 break; 403 case AR9170_TXRX_PHY_RATE_OFDM_36M: 404 status->rate_idx = 5; 405 break; 406 case AR9170_TXRX_PHY_RATE_OFDM_48M: 407 status->rate_idx = 6; 408 break; 409 case AR9170_TXRX_PHY_RATE_OFDM_54M: 410 status->rate_idx = 7; 411 break; 412 default: 413 if (net_ratelimit()) { 414 wiphy_err(ar->hw->wiphy, "invalid plcp ofdm " 415 "rate (%x).\n", head->plcp[0]); 416 } 417 418 return -EINVAL; 419 } 420 if (status->band == NL80211_BAND_2GHZ) 421 status->rate_idx += 4; 422 break; 423 424 case AR9170_RX_STATUS_MODULATION_HT: 425 if (head->plcp[3] & 0x80) 426 status->bw = RATE_INFO_BW_40; 427 if (head->plcp[6] & 0x80) 428 status->enc_flags |= RX_ENC_FLAG_SHORT_GI; 429 430 status->rate_idx = clamp(head->plcp[3] & 0x7f, 0, 75); 431 status->encoding = RX_ENC_HT; 432 break; 433 434 default: 435 BUG(); 436 return -ENOSYS; 437 } 438 439 return 0; 440} 441 442static void carl9170_rx_phy_status(struct ar9170 *ar, 443 struct ar9170_rx_phystatus *phy, struct ieee80211_rx_status *status) 444{ 445 int i; 446 447 BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20); 448 449 for (i = 0; i < 3; i++) 450 if (phy->rssi[i] != 0x80) 451 status->antenna |= BIT(i); 452 453 /* post-process RSSI */ 454 for (i = 0; i < 7; i++) 455 if (phy->rssi[i] & 0x80) 456 phy->rssi[i] = ((~phy->rssi[i] & 0x7f) + 1) & 0x7f; 457 458 /* TODO: we could do something with phy_errors */ 459 status->signal = ar->noise[0] + phy->rssi_combined; 460} 461 462static struct sk_buff *carl9170_rx_copy_data(u8 *buf, int len) 463{ 464 struct sk_buff *skb; 465 int reserved = 0; 466 struct ieee80211_hdr *hdr = (void *) buf; 467 468 if (ieee80211_is_data_qos(hdr->frame_control)) { 469 u8 *qc = ieee80211_get_qos_ctl(hdr); 470 reserved += NET_IP_ALIGN; 471 472 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 473 reserved += NET_IP_ALIGN; 474 } 475 476 if (ieee80211_has_a4(hdr->frame_control)) 477 reserved += NET_IP_ALIGN; 478 479 reserved = 32 + (reserved & NET_IP_ALIGN); 480 481 skb = dev_alloc_skb(len + reserved); 482 if (likely(skb)) { 483 skb_reserve(skb, reserved); 484 skb_put_data(skb, buf, len); 485 } 486 487 return skb; 488} 489 490static u8 *carl9170_find_ie(u8 *data, unsigned int len, u8 ie) 491{ 492 struct ieee80211_mgmt *mgmt = (void *)data; 493 u8 *pos, *end; 494 495 pos = (u8 *)mgmt->u.beacon.variable; 496 end = data + len; 497 while (pos < end) { 498 if (pos + 2 + pos[1] > end) 499 return NULL; 500 501 if (pos[0] == ie) 502 return pos; 503 504 pos += 2 + pos[1]; 505 } 506 return NULL; 507} 508 509/* 510 * NOTE: 511 * 512 * The firmware is in charge of waking up the device just before 513 * the AP is expected to transmit the next beacon. 514 * 515 * This leaves the driver with the important task of deciding when 516 * to set the PHY back to bed again. 517 */ 518static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len) 519{ 520 struct ieee80211_hdr *hdr = data; 521 struct ieee80211_tim_ie *tim_ie; 522 struct ath_common *common = &ar->common; 523 u8 *tim; 524 u8 tim_len; 525 bool cam; 526 527 if (likely(!(ar->hw->conf.flags & IEEE80211_CONF_PS))) 528 return; 529 530 /* min. beacon length + FCS_LEN */ 531 if (len <= 40 + FCS_LEN) 532 return; 533 534 /* check if this really is a beacon */ 535 /* and only beacons from the associated BSSID, please */ 536 if (!ath_is_mybeacon(common, hdr) || !common->curaid) 537 return; 538 539 ar->ps.last_beacon = jiffies; 540 541 tim = carl9170_find_ie(data, len - FCS_LEN, WLAN_EID_TIM); 542 if (!tim) 543 return; 544 545 if (tim[1] < sizeof(*tim_ie)) 546 return; 547 548 tim_len = tim[1]; 549 tim_ie = (struct ieee80211_tim_ie *) &tim[2]; 550 551 if (!WARN_ON_ONCE(!ar->hw->conf.ps_dtim_period)) 552 ar->ps.dtim_counter = (tim_ie->dtim_count - 1) % 553 ar->hw->conf.ps_dtim_period; 554 555 /* Check whenever the PHY can be turned off again. */ 556 557 /* 1. What about buffered unicast traffic for our AID? */ 558 cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid); 559 560 /* 2. Maybe the AP wants to send multicast/broadcast data? */ 561 cam |= !!(tim_ie->bitmap_ctrl & 0x01); 562 563 if (!cam) { 564 /* back to low-power land. */ 565 ar->ps.off_override &= ~PS_OFF_BCN; 566 carl9170_ps_check(ar); 567 } else { 568 /* force CAM */ 569 ar->ps.off_override |= PS_OFF_BCN; 570 } 571} 572 573static void carl9170_ba_check(struct ar9170 *ar, void *data, unsigned int len) 574{ 575 struct ieee80211_bar *bar = data; 576 struct carl9170_bar_list_entry *entry; 577 unsigned int queue; 578 579 if (likely(!ieee80211_is_back(bar->frame_control))) 580 return; 581 582 if (len <= sizeof(*bar) + FCS_LEN) 583 return; 584 585 queue = TID_TO_WME_AC(((le16_to_cpu(bar->control) & 586 IEEE80211_BAR_CTRL_TID_INFO_MASK) >> 587 IEEE80211_BAR_CTRL_TID_INFO_SHIFT) & 7); 588 589 rcu_read_lock(); 590 list_for_each_entry_rcu(entry, &ar->bar_list[queue], list) { 591 struct sk_buff *entry_skb = entry->skb; 592 struct _carl9170_tx_superframe *super = (void *)entry_skb->data; 593 struct ieee80211_bar *entry_bar = (void *)super->frame_data; 594 595#define TID_CHECK(a, b) ( \ 596 ((a) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK)) == \ 597 ((b) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK))) \ 598 599 if (bar->start_seq_num == entry_bar->start_seq_num && 600 TID_CHECK(bar->control, entry_bar->control) && 601 ether_addr_equal_64bits(bar->ra, entry_bar->ta) && 602 ether_addr_equal_64bits(bar->ta, entry_bar->ra)) { 603 struct ieee80211_tx_info *tx_info; 604 605 tx_info = IEEE80211_SKB_CB(entry_skb); 606 tx_info->flags |= IEEE80211_TX_STAT_ACK; 607 608 spin_lock_bh(&ar->bar_list_lock[queue]); 609 list_del_rcu(&entry->list); 610 spin_unlock_bh(&ar->bar_list_lock[queue]); 611 kfree_rcu(entry, head); 612 break; 613 } 614 } 615 rcu_read_unlock(); 616 617#undef TID_CHECK 618} 619 620static bool carl9170_ampdu_check(struct ar9170 *ar, u8 *buf, u8 ms, 621 struct ieee80211_rx_status *rx_status) 622{ 623 __le16 fc; 624 625 if ((ms & AR9170_RX_STATUS_MPDU) == AR9170_RX_STATUS_MPDU_SINGLE) { 626 /* 627 * This frame is not part of an aMPDU. 628 * Therefore it is not subjected to any 629 * of the following content restrictions. 630 */ 631 return true; 632 } 633 634 rx_status->flag |= RX_FLAG_AMPDU_DETAILS | RX_FLAG_AMPDU_LAST_KNOWN; 635 rx_status->ampdu_reference = ar->ampdu_ref; 636 637 /* 638 * "802.11n - 7.4a.3 A-MPDU contents" describes in which contexts 639 * certain frame types can be part of an aMPDU. 640 * 641 * In order to keep the processing cost down, I opted for a 642 * stateless filter solely based on the frame control field. 643 */ 644 645 fc = ((struct ieee80211_hdr *)buf)->frame_control; 646 if (ieee80211_is_data_qos(fc) && ieee80211_is_data_present(fc)) 647 return true; 648 649 if (ieee80211_is_ack(fc) || ieee80211_is_back(fc) || 650 ieee80211_is_back_req(fc)) 651 return true; 652 653 if (ieee80211_is_action(fc)) 654 return true; 655 656 return false; 657} 658 659static int carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len, 660 struct ieee80211_rx_status *status) 661{ 662 struct sk_buff *skb; 663 664 /* (driver) frame trap handler 665 * 666 * Because power-saving mode handing has to be implemented by 667 * the driver/firmware. We have to check each incoming beacon 668 * from the associated AP, if there's new data for us (either 669 * broadcast/multicast or unicast) we have to react quickly. 670 * 671 * So, if you have you want to add additional frame trap 672 * handlers, this would be the perfect place! 673 */ 674 675 carl9170_ps_beacon(ar, buf, len); 676 677 carl9170_ba_check(ar, buf, len); 678 679 skb = carl9170_rx_copy_data(buf, len); 680 if (!skb) 681 return -ENOMEM; 682 683 memcpy(IEEE80211_SKB_RXCB(skb), status, sizeof(*status)); 684 ieee80211_rx(ar->hw, skb); 685 return 0; 686} 687 688/* 689 * If the frame alignment is right (or the kernel has 690 * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there 691 * is only a single MPDU in the USB frame, then we could 692 * submit to mac80211 the SKB directly. However, since 693 * there may be multiple packets in one SKB in stream 694 * mode, and we need to observe the proper ordering, 695 * this is non-trivial. 696 */ 697static void carl9170_rx_untie_data(struct ar9170 *ar, u8 *buf, int len) 698{ 699 struct ar9170_rx_head *head; 700 struct ar9170_rx_macstatus *mac; 701 struct ar9170_rx_phystatus *phy = NULL; 702 struct ieee80211_rx_status status; 703 int mpdu_len; 704 u8 mac_status; 705 706 if (!IS_STARTED(ar)) 707 return; 708 709 if (unlikely(len < sizeof(*mac))) 710 goto drop; 711 712 memset(&status, 0, sizeof(status)); 713 714 mpdu_len = len - sizeof(*mac); 715 716 mac = (void *)(buf + mpdu_len); 717 mac_status = mac->status; 718 switch (mac_status & AR9170_RX_STATUS_MPDU) { 719 case AR9170_RX_STATUS_MPDU_FIRST: 720 ar->ampdu_ref++; 721 /* Aggregated MPDUs start with an PLCP header */ 722 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) { 723 head = (void *) buf; 724 725 /* 726 * The PLCP header needs to be cached for the 727 * following MIDDLE + LAST A-MPDU packets. 728 * 729 * So, if you are wondering why all frames seem 730 * to share a common RX status information, 731 * then you have the answer right here... 732 */ 733 memcpy(&ar->rx_plcp, (void *) buf, 734 sizeof(struct ar9170_rx_head)); 735 736 mpdu_len -= sizeof(struct ar9170_rx_head); 737 buf += sizeof(struct ar9170_rx_head); 738 739 ar->rx_has_plcp = true; 740 } else { 741 if (net_ratelimit()) { 742 wiphy_err(ar->hw->wiphy, "plcp info " 743 "is clipped.\n"); 744 } 745 746 goto drop; 747 } 748 break; 749 750 case AR9170_RX_STATUS_MPDU_LAST: 751 status.flag |= RX_FLAG_AMPDU_IS_LAST; 752 753 /* 754 * The last frame of an A-MPDU has an extra tail 755 * which does contain the phy status of the whole 756 * aggregate. 757 */ 758 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) { 759 mpdu_len -= sizeof(struct ar9170_rx_phystatus); 760 phy = (void *)(buf + mpdu_len); 761 } else { 762 if (net_ratelimit()) { 763 wiphy_err(ar->hw->wiphy, "frame tail " 764 "is clipped.\n"); 765 } 766 767 goto drop; 768 } 769 fallthrough; 770 771 case AR9170_RX_STATUS_MPDU_MIDDLE: 772 /* These are just data + mac status */ 773 if (unlikely(!ar->rx_has_plcp)) { 774 if (!net_ratelimit()) 775 return; 776 777 wiphy_err(ar->hw->wiphy, "rx stream does not start " 778 "with a first_mpdu frame tag.\n"); 779 780 goto drop; 781 } 782 783 head = &ar->rx_plcp; 784 break; 785 786 case AR9170_RX_STATUS_MPDU_SINGLE: 787 /* single mpdu has both: plcp (head) and phy status (tail) */ 788 head = (void *) buf; 789 790 mpdu_len -= sizeof(struct ar9170_rx_head); 791 mpdu_len -= sizeof(struct ar9170_rx_phystatus); 792 793 buf += sizeof(struct ar9170_rx_head); 794 phy = (void *)(buf + mpdu_len); 795 break; 796 797 default: 798 BUG(); 799 break; 800 } 801 802 /* FC + DU + RA + FCS */ 803 if (unlikely(mpdu_len < (2 + 2 + ETH_ALEN + FCS_LEN))) 804 goto drop; 805 806 if (unlikely(carl9170_rx_mac_status(ar, head, mac, &status))) 807 goto drop; 808 809 if (!carl9170_ampdu_check(ar, buf, mac_status, &status)) 810 goto drop; 811 812 if (phy) 813 carl9170_rx_phy_status(ar, phy, &status); 814 else 815 status.flag |= RX_FLAG_NO_SIGNAL_VAL; 816 817 if (carl9170_handle_mpdu(ar, buf, mpdu_len, &status)) 818 goto drop; 819 820 return; 821drop: 822 ar->rx_dropped++; 823} 824 825static void carl9170_rx_untie_cmds(struct ar9170 *ar, const u8 *respbuf, 826 const unsigned int resplen) 827{ 828 struct carl9170_rsp *cmd; 829 int i = 0; 830 831 while (i < resplen) { 832 cmd = (void *) &respbuf[i]; 833 834 i += cmd->hdr.len + 4; 835 if (unlikely(i > resplen)) 836 break; 837 838 if (carl9170_check_sequence(ar, cmd->hdr.seq)) 839 break; 840 841 carl9170_handle_command_response(ar, cmd, cmd->hdr.len + 4); 842 } 843 844 if (unlikely(i != resplen)) { 845 if (!net_ratelimit()) 846 return; 847 848 wiphy_err(ar->hw->wiphy, "malformed firmware trap:\n"); 849 print_hex_dump_bytes("rxcmd:", DUMP_PREFIX_OFFSET, 850 respbuf, resplen); 851 } 852} 853 854static void __carl9170_rx(struct ar9170 *ar, u8 *buf, unsigned int len) 855{ 856 unsigned int i = 0; 857 858 /* weird thing, but this is the same in the original driver */ 859 while (len > 2 && i < 12 && buf[0] == 0xff && buf[1] == 0xff) { 860 i += 2; 861 len -= 2; 862 buf += 2; 863 } 864 865 if (unlikely(len < 4)) 866 return; 867 868 /* found the 6 * 0xffff marker? */ 869 if (i == 12) 870 carl9170_rx_untie_cmds(ar, buf, len); 871 else 872 carl9170_rx_untie_data(ar, buf, len); 873} 874 875static void carl9170_rx_stream(struct ar9170 *ar, void *buf, unsigned int len) 876{ 877 unsigned int tlen, wlen = 0, clen = 0; 878 struct ar9170_stream *rx_stream; 879 u8 *tbuf; 880 881 tbuf = buf; 882 tlen = len; 883 884 while (tlen >= 4) { 885 rx_stream = (void *) tbuf; 886 clen = le16_to_cpu(rx_stream->length); 887 wlen = ALIGN(clen, 4); 888 889 /* check if this is stream has a valid tag.*/ 890 if (rx_stream->tag != cpu_to_le16(AR9170_RX_STREAM_TAG)) { 891 /* 892 * TODO: handle the highly unlikely event that the 893 * corrupted stream has the TAG at the right position. 894 */ 895 896 /* check if the frame can be repaired. */ 897 if (!ar->rx_failover_missing) { 898 899 /* this is not "short read". */ 900 if (net_ratelimit()) { 901 wiphy_err(ar->hw->wiphy, 902 "missing tag!\n"); 903 } 904 905 __carl9170_rx(ar, tbuf, tlen); 906 return; 907 } 908 909 if (ar->rx_failover_missing > tlen) { 910 if (net_ratelimit()) { 911 wiphy_err(ar->hw->wiphy, 912 "possible multi " 913 "stream corruption!\n"); 914 goto err_telluser; 915 } else { 916 goto err_silent; 917 } 918 } 919 920 skb_put_data(ar->rx_failover, tbuf, tlen); 921 ar->rx_failover_missing -= tlen; 922 923 if (ar->rx_failover_missing <= 0) { 924 /* 925 * nested carl9170_rx_stream call! 926 * 927 * termination is guaranteed, even when the 928 * combined frame also have an element with 929 * a bad tag. 930 */ 931 932 ar->rx_failover_missing = 0; 933 carl9170_rx_stream(ar, ar->rx_failover->data, 934 ar->rx_failover->len); 935 936 skb_reset_tail_pointer(ar->rx_failover); 937 skb_trim(ar->rx_failover, 0); 938 } 939 940 return; 941 } 942 943 /* check if stream is clipped */ 944 if (wlen > tlen - 4) { 945 if (ar->rx_failover_missing) { 946 /* TODO: handle double stream corruption. */ 947 if (net_ratelimit()) { 948 wiphy_err(ar->hw->wiphy, "double rx " 949 "stream corruption!\n"); 950 goto err_telluser; 951 } else { 952 goto err_silent; 953 } 954 } 955 956 /* 957 * save incomplete data set. 958 * the firmware will resend the missing bits when 959 * the rx - descriptor comes round again. 960 */ 961 962 skb_put_data(ar->rx_failover, tbuf, tlen); 963 ar->rx_failover_missing = clen - tlen; 964 return; 965 } 966 __carl9170_rx(ar, rx_stream->payload, clen); 967 968 tbuf += wlen + 4; 969 tlen -= wlen + 4; 970 } 971 972 if (tlen) { 973 if (net_ratelimit()) { 974 wiphy_err(ar->hw->wiphy, "%d bytes of unprocessed " 975 "data left in rx stream!\n", tlen); 976 } 977 978 goto err_telluser; 979 } 980 981 return; 982 983err_telluser: 984 wiphy_err(ar->hw->wiphy, "damaged RX stream data [want:%d, " 985 "data:%d, rx:%d, pending:%d ]\n", clen, wlen, tlen, 986 ar->rx_failover_missing); 987 988 if (ar->rx_failover_missing) 989 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET, 990 ar->rx_failover->data, 991 ar->rx_failover->len); 992 993 print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET, 994 buf, len); 995 996 wiphy_err(ar->hw->wiphy, "please check your hardware and cables, if " 997 "you see this message frequently.\n"); 998 999err_silent: 1000 if (ar->rx_failover_missing) { 1001 skb_reset_tail_pointer(ar->rx_failover); 1002 skb_trim(ar->rx_failover, 0); 1003 ar->rx_failover_missing = 0; 1004 } 1005} 1006 1007void carl9170_rx(struct ar9170 *ar, void *buf, unsigned int len) 1008{ 1009 if (ar->fw.rx_stream) 1010 carl9170_rx_stream(ar, buf, len); 1011 else 1012 __carl9170_rx(ar, buf, len); 1013} 1014