1
2
3
4
5
6
7#include <linux/etherdevice.h>
8#include <linux/skbuff.h>
9#include "iwl-trans.h"
10#include "mvm.h"
11#include "fw-api.h"
12
13static void *iwl_mvm_skb_get_hdr(struct sk_buff *skb)
14{
15 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
16 u8 *data = skb->data;
17
18
19 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) % 4);
20 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) % 4);
21 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) % 4);
22 BUILD_BUG_ON(sizeof(struct ieee80211_vendor_radiotap) % 4);
23
24 if (rx_status->flag & RX_FLAG_RADIOTAP_HE)
25 data += sizeof(struct ieee80211_radiotap_he);
26 if (rx_status->flag & RX_FLAG_RADIOTAP_HE_MU)
27 data += sizeof(struct ieee80211_radiotap_he_mu);
28 if (rx_status->flag & RX_FLAG_RADIOTAP_LSIG)
29 data += sizeof(struct ieee80211_radiotap_lsig);
30 if (rx_status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
31 struct ieee80211_vendor_radiotap *radiotap = (void *)data;
32
33 data += sizeof(*radiotap) + radiotap->len + radiotap->pad;
34 }
35
36 return data;
37}
38
39static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
40 int queue, struct ieee80211_sta *sta)
41{
42 struct iwl_mvm_sta *mvmsta;
43 struct ieee80211_hdr *hdr = iwl_mvm_skb_get_hdr(skb);
44 struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
45 struct iwl_mvm_key_pn *ptk_pn;
46 int res;
47 u8 tid, keyidx;
48 u8 pn[IEEE80211_CCMP_PN_LEN];
49 u8 *extiv;
50
51
52
53
54 if (!ieee80211_is_data(hdr->frame_control) ||
55 is_multicast_ether_addr(hdr->addr1))
56 return 0;
57
58
59 if (!(stats->flag & RX_FLAG_DECRYPTED))
60 return 0;
61
62
63
64
65
66
67 if (queue == 0)
68 return 0;
69
70
71 if (IS_ERR_OR_NULL(sta)) {
72 IWL_DEBUG_DROP(mvm,
73 "expected hw-decrypted unicast frame for station\n");
74 return -1;
75 }
76
77 mvmsta = iwl_mvm_sta_from_mac80211(sta);
78
79 extiv = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
80 keyidx = extiv[3] >> 6;
81
82 ptk_pn = rcu_dereference(mvmsta->ptk_pn[keyidx]);
83 if (!ptk_pn)
84 return -1;
85
86 if (ieee80211_is_data_qos(hdr->frame_control))
87 tid = ieee80211_get_tid(hdr);
88 else
89 tid = 0;
90
91
92 if (tid >= IWL_MAX_TID_COUNT)
93 return -1;
94
95
96 pn[0] = extiv[7];
97 pn[1] = extiv[6];
98 pn[2] = extiv[5];
99 pn[3] = extiv[4];
100 pn[4] = extiv[1];
101 pn[5] = extiv[0];
102
103 res = memcmp(pn, ptk_pn->q[queue].pn[tid], IEEE80211_CCMP_PN_LEN);
104 if (res < 0)
105 return -1;
106 if (!res && !(stats->flag & RX_FLAG_ALLOW_SAME_PN))
107 return -1;
108
109 memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
110 stats->flag |= RX_FLAG_PN_VALIDATED;
111
112 return 0;
113}
114
115
116static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
117 struct ieee80211_hdr *hdr, u16 len, u8 crypt_len,
118 struct iwl_rx_cmd_buffer *rxb)
119{
120 struct iwl_rx_packet *pkt = rxb_addr(rxb);
121 struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
122 unsigned int headlen, fraglen, pad_len = 0;
123 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
124
125 if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) {
126 len -= 2;
127 pad_len = 2;
128 }
129
130
131
132
133
134
135
136
137
138
139
140
141
142 headlen = (len <= skb_tailroom(skb)) ? len :
143 hdrlen + crypt_len + 8;
144
145
146
147
148
149
150 hdrlen += crypt_len;
151
152 if (WARN_ONCE(headlen < hdrlen,
153 "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
154 hdrlen, len, crypt_len)) {
155
156
157
158
159 IWL_DEBUG_RX(mvm,
160 "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
161 hdrlen, len, crypt_len);
162 return -EINVAL;
163 }
164
165 skb_put_data(skb, hdr, hdrlen);
166 skb_put_data(skb, (u8 *)hdr + hdrlen + pad_len, headlen - hdrlen);
167
168
169
170
171
172
173
174
175
176 if (skb->ip_summed == CHECKSUM_COMPLETE) {
177 struct {
178 u8 hdr[6];
179 __be16 type;
180 } __packed *shdr = (void *)((u8 *)hdr + hdrlen + pad_len);
181
182 if (unlikely(headlen - hdrlen < sizeof(*shdr) ||
183 !ether_addr_equal(shdr->hdr, rfc1042_header) ||
184 (shdr->type != htons(ETH_P_IP) &&
185 shdr->type != htons(ETH_P_ARP) &&
186 shdr->type != htons(ETH_P_IPV6) &&
187 shdr->type != htons(ETH_P_8021Q) &&
188 shdr->type != htons(ETH_P_PAE) &&
189 shdr->type != htons(ETH_P_TDLS))))
190 skb->ip_summed = CHECKSUM_NONE;
191 }
192
193 fraglen = len - headlen;
194
195 if (fraglen) {
196 int offset = (void *)hdr + headlen + pad_len -
197 rxb_addr(rxb) + rxb_offset(rxb);
198
199 skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
200 fraglen, rxb->truesize);
201 }
202
203 return 0;
204}
205
206static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
207 struct sk_buff *skb)
208{
209 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
210 struct ieee80211_vendor_radiotap *radiotap;
211 const int size = sizeof(*radiotap) + sizeof(__le16);
212
213 if (!mvm->cur_aid)
214 return;
215
216
217 BUILD_BUG_ON((size + 2) % 4);
218
219 radiotap = skb_put(skb, size + 2);
220 radiotap->align = 1;
221
222 radiotap->oui[0] = 0xf6;
223 radiotap->oui[1] = 0x54;
224 radiotap->oui[2] = 0x25;
225
226 radiotap->subns = 1;
227 radiotap->present = 0x1;
228 radiotap->len = size - sizeof(*radiotap);
229 radiotap->pad = 2;
230
231
232 memcpy(radiotap->data, &mvm->cur_aid, sizeof(mvm->cur_aid));
233
234 memset(radiotap->data + sizeof(__le16), 0, radiotap->pad);
235
236 rx_status->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
237}
238
239
240static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
241 struct napi_struct *napi,
242 struct sk_buff *skb, int queue,
243 struct ieee80211_sta *sta)
244{
245 if (iwl_mvm_check_pn(mvm, skb, queue, sta))
246 kfree_skb(skb);
247 else
248 ieee80211_rx_napi(mvm->hw, sta, skb, napi);
249}
250
251static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
252 struct ieee80211_rx_status *rx_status,
253 u32 rate_n_flags, int energy_a,
254 int energy_b)
255{
256 int max_energy;
257 u32 rate_flags = rate_n_flags;
258
259 energy_a = energy_a ? -energy_a : S8_MIN;
260 energy_b = energy_b ? -energy_b : S8_MIN;
261 max_energy = max(energy_a, energy_b);
262
263 IWL_DEBUG_STATS(mvm, "energy In A %d B %d, and max %d\n",
264 energy_a, energy_b, max_energy);
265
266 rx_status->signal = max_energy;
267 rx_status->chains =
268 (rate_flags & RATE_MCS_ANT_AB_MSK) >> RATE_MCS_ANT_POS;
269 rx_status->chain_signal[0] = energy_a;
270 rx_status->chain_signal[1] = energy_b;
271}
272
273static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
274 struct ieee80211_hdr *hdr,
275 struct iwl_rx_mpdu_desc *desc,
276 u32 status)
277{
278 struct iwl_mvm_sta *mvmsta;
279 struct iwl_mvm_vif *mvmvif;
280 u8 keyid;
281 struct ieee80211_key_conf *key;
282 u32 len = le16_to_cpu(desc->mpdu_len);
283 const u8 *frame = (void *)hdr;
284
285 if ((status & IWL_RX_MPDU_STATUS_SEC_MASK) == IWL_RX_MPDU_STATUS_SEC_NONE)
286 return 0;
287
288
289
290
291
292
293
294
295
296 if (!ieee80211_is_beacon(hdr->frame_control))
297 return 0;
298
299
300 if (!(status & IWL_RX_MPDU_STATUS_KEY_VALID))
301 return -1;
302
303
304 if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK &&
305 !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR)))
306 return 0;
307
308 if (!sta)
309 return -1;
310
311 mvmsta = iwl_mvm_sta_from_mac80211(sta);
312
313 mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
314
315
316
317
318
319 key = rcu_dereference(mvmvif->bcn_prot.keys[0]);
320 if (!key) {
321 key = rcu_dereference(mvmvif->bcn_prot.keys[1]);
322 if (!key)
323 return -1;
324 }
325
326 if (len < key->icv_len + IEEE80211_GMAC_PN_LEN + 2)
327 return -1;
328
329
330 keyid = frame[len - key->icv_len - IEEE80211_GMAC_PN_LEN - 2];
331
332 if (keyid != key->keyidx) {
333
334
335
336
337 if (keyid != 6 && keyid != 7)
338 return -1;
339 key = rcu_dereference(mvmvif->bcn_prot.keys[keyid - 6]);
340 if (!key)
341 return -1;
342 }
343
344
345 if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
346 ieee80211_key_mic_failure(key);
347 else if (status & IWL_RX_MPDU_STATUS_REPLAY_ERROR)
348 ieee80211_key_replay(key);
349
350 return -1;
351}
352
353static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
354 struct ieee80211_hdr *hdr,
355 struct ieee80211_rx_status *stats, u16 phy_info,
356 struct iwl_rx_mpdu_desc *desc,
357 u32 pkt_flags, int queue, u8 *crypt_len)
358{
359 u32 status = le32_to_cpu(desc->status);
360
361
362
363
364
365
366
367
368 if (phy_info & IWL_RX_MPDU_PHY_AMPDU &&
369 (status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
370 IWL_RX_MPDU_STATUS_SEC_UNKNOWN && !mvm->monitor_on)
371 return -1;
372
373 if (unlikely(ieee80211_is_mgmt(hdr->frame_control) &&
374 !ieee80211_has_protected(hdr->frame_control)))
375 return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status);
376
377 if (!ieee80211_has_protected(hdr->frame_control) ||
378 (status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
379 IWL_RX_MPDU_STATUS_SEC_NONE)
380 return 0;
381
382
383
384 switch (status & IWL_RX_MPDU_STATUS_SEC_MASK) {
385 case IWL_RX_MPDU_STATUS_SEC_CCM:
386 case IWL_RX_MPDU_STATUS_SEC_GCM:
387 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != IEEE80211_GCMP_PN_LEN);
388
389 if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
390 return -1;
391
392 stats->flag |= RX_FLAG_DECRYPTED;
393 if (pkt_flags & FH_RSCSR_RADA_EN)
394 stats->flag |= RX_FLAG_MIC_STRIPPED;
395 *crypt_len = IEEE80211_CCMP_HDR_LEN;
396 return 0;
397 case IWL_RX_MPDU_STATUS_SEC_TKIP:
398
399 if (!fw_has_api(&mvm->fw->ucode_capa,
400 IWL_UCODE_TLV_API_DEPRECATE_TTAK) &&
401 !(status & IWL_RX_MPDU_RES_STATUS_TTAK_OK))
402 return 0;
403
404 if (mvm->trans->trans_cfg->gen2 &&
405 !(status & RX_MPDU_RES_STATUS_MIC_OK))
406 stats->flag |= RX_FLAG_MMIC_ERROR;
407
408 *crypt_len = IEEE80211_TKIP_IV_LEN;
409 fallthrough;
410 case IWL_RX_MPDU_STATUS_SEC_WEP:
411 if (!(status & IWL_RX_MPDU_STATUS_ICV_OK))
412 return -1;
413
414 stats->flag |= RX_FLAG_DECRYPTED;
415 if ((status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
416 IWL_RX_MPDU_STATUS_SEC_WEP)
417 *crypt_len = IEEE80211_WEP_IV_LEN;
418
419 if (pkt_flags & FH_RSCSR_RADA_EN) {
420 stats->flag |= RX_FLAG_ICV_STRIPPED;
421 if (mvm->trans->trans_cfg->gen2)
422 stats->flag |= RX_FLAG_MMIC_STRIPPED;
423 }
424
425 return 0;
426 case IWL_RX_MPDU_STATUS_SEC_EXT_ENC:
427 if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
428 return -1;
429 stats->flag |= RX_FLAG_DECRYPTED;
430 return 0;
431 case RX_MPDU_RES_STATUS_SEC_CMAC_GMAC_ENC:
432 break;
433 default:
434
435
436
437
438
439
440
441
442 if (!is_multicast_ether_addr(hdr->addr1) &&
443 !mvm->monitor_on && net_ratelimit())
444 IWL_ERR(mvm, "Unhandled alg: 0x%x\n", status);
445 }
446
447 return 0;
448}
449
450static void iwl_mvm_rx_csum(struct iwl_mvm *mvm,
451 struct ieee80211_sta *sta,
452 struct sk_buff *skb,
453 struct iwl_rx_packet *pkt)
454{
455 struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
456
457 if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210) {
458 if (pkt->len_n_flags & cpu_to_le32(FH_RSCSR_RPA_EN)) {
459 u16 hwsum = be16_to_cpu(desc->v3.raw_xsum);
460
461 skb->ip_summed = CHECKSUM_COMPLETE;
462 skb->csum = csum_unfold(~(__force __sum16)hwsum);
463 }
464 } else {
465 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
466 struct iwl_mvm_vif *mvmvif;
467 u16 flags = le16_to_cpu(desc->l3l4_flags);
468 u8 l3_prot = (u8)((flags & IWL_RX_L3L4_L3_PROTO_MASK) >>
469 IWL_RX_L3_PROTO_POS);
470
471 mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
472
473 if (mvmvif->features & NETIF_F_RXCSUM &&
474 flags & IWL_RX_L3L4_TCP_UDP_CSUM_OK &&
475 (flags & IWL_RX_L3L4_IP_HDR_CSUM_OK ||
476 l3_prot == IWL_RX_L3_TYPE_IPV6 ||
477 l3_prot == IWL_RX_L3_TYPE_IPV6_FRAG))
478 skb->ip_summed = CHECKSUM_UNNECESSARY;
479 }
480}
481
482
483
484
485
486static bool iwl_mvm_is_dup(struct ieee80211_sta *sta, int queue,
487 struct ieee80211_rx_status *rx_status,
488 struct ieee80211_hdr *hdr,
489 struct iwl_rx_mpdu_desc *desc)
490{
491 struct iwl_mvm_sta *mvm_sta;
492 struct iwl_mvm_rxq_dup_data *dup_data;
493 u8 tid, sub_frame_idx;
494
495 if (WARN_ON(IS_ERR_OR_NULL(sta)))
496 return false;
497
498 mvm_sta = iwl_mvm_sta_from_mac80211(sta);
499 dup_data = &mvm_sta->dup_data[queue];
500
501
502
503
504
505 if (ieee80211_is_ctl(hdr->frame_control) ||
506 ieee80211_is_qos_nullfunc(hdr->frame_control) ||
507 is_multicast_ether_addr(hdr->addr1)) {
508 rx_status->flag |= RX_FLAG_DUP_VALIDATED;
509 return false;
510 }
511
512 if (ieee80211_is_data_qos(hdr->frame_control))
513
514 tid = ieee80211_get_tid(hdr);
515 else
516 tid = IWL_MAX_TID_COUNT;
517
518
519 sub_frame_idx = desc->amsdu_info &
520 IWL_RX_MPDU_AMSDU_SUBFRAME_IDX_MASK;
521
522 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
523 dup_data->last_seq[tid] == hdr->seq_ctrl &&
524 dup_data->last_sub_frame[tid] >= sub_frame_idx))
525 return true;
526
527
528 if (dup_data->last_seq[tid] == hdr->seq_ctrl &&
529 sub_frame_idx > dup_data->last_sub_frame[tid] &&
530 desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU)
531 rx_status->flag |= RX_FLAG_ALLOW_SAME_PN;
532
533 dup_data->last_seq[tid] = hdr->seq_ctrl;
534 dup_data->last_sub_frame[tid] = sub_frame_idx;
535
536 rx_status->flag |= RX_FLAG_DUP_VALIDATED;
537
538 return false;
539}
540
541
542
543
544
545
546
547static bool iwl_mvm_is_sn_less(u16 sn1, u16 sn2, u16 buffer_size)
548{
549 return ieee80211_sn_less(sn1, sn2) &&
550 !ieee80211_sn_less(sn1, sn2 - buffer_size);
551}
552
553static void iwl_mvm_sync_nssn(struct iwl_mvm *mvm, u8 baid, u16 nssn)
554{
555 if (IWL_MVM_USE_NSSN_SYNC) {
556 struct iwl_mvm_nssn_sync_data notif = {
557 .baid = baid,
558 .nssn = nssn,
559 };
560
561 iwl_mvm_sync_rx_queues_internal(mvm, IWL_MVM_RXQ_NSSN_SYNC, false,
562 ¬if, sizeof(notif));
563 }
564}
565
566#define RX_REORDER_BUF_TIMEOUT_MQ (HZ / 10)
567
568enum iwl_mvm_release_flags {
569 IWL_MVM_RELEASE_SEND_RSS_SYNC = BIT(0),
570 IWL_MVM_RELEASE_FROM_RSS_SYNC = BIT(1),
571};
572
573static void iwl_mvm_release_frames(struct iwl_mvm *mvm,
574 struct ieee80211_sta *sta,
575 struct napi_struct *napi,
576 struct iwl_mvm_baid_data *baid_data,
577 struct iwl_mvm_reorder_buffer *reorder_buf,
578 u16 nssn, u32 flags)
579{
580 struct iwl_mvm_reorder_buf_entry *entries =
581 &baid_data->entries[reorder_buf->queue *
582 baid_data->entries_per_queue];
583 u16 ssn = reorder_buf->head_sn;
584
585 lockdep_assert_held(&reorder_buf->lock);
586
587
588
589
590
591
592
593
594
595 if ((flags & IWL_MVM_RELEASE_FROM_RSS_SYNC) &&
596 ieee80211_sn_less(nssn, ssn))
597 goto set_timer;
598
599
600 if (iwl_mvm_is_sn_less(nssn, ssn, reorder_buf->buf_size))
601 goto set_timer;
602
603 while (iwl_mvm_is_sn_less(ssn, nssn, reorder_buf->buf_size)) {
604 int index = ssn % reorder_buf->buf_size;
605 struct sk_buff_head *skb_list = &entries[index].e.frames;
606 struct sk_buff *skb;
607
608 ssn = ieee80211_sn_inc(ssn);
609 if ((flags & IWL_MVM_RELEASE_SEND_RSS_SYNC) &&
610 (ssn == 2048 || ssn == 0))
611 iwl_mvm_sync_nssn(mvm, baid_data->baid, ssn);
612
613
614
615
616
617
618 while ((skb = __skb_dequeue(skb_list))) {
619 iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb,
620 reorder_buf->queue,
621 sta);
622 reorder_buf->num_stored--;
623 }
624 }
625 reorder_buf->head_sn = nssn;
626
627set_timer:
628 if (reorder_buf->num_stored && !reorder_buf->removed) {
629 u16 index = reorder_buf->head_sn % reorder_buf->buf_size;
630
631 while (skb_queue_empty(&entries[index].e.frames))
632 index = (index + 1) % reorder_buf->buf_size;
633
634 mod_timer(&reorder_buf->reorder_timer,
635 entries[index].e.reorder_time + 1 +
636 RX_REORDER_BUF_TIMEOUT_MQ);
637 } else {
638 del_timer(&reorder_buf->reorder_timer);
639 }
640}
641
642void iwl_mvm_reorder_timer_expired(struct timer_list *t)
643{
644 struct iwl_mvm_reorder_buffer *buf = from_timer(buf, t, reorder_timer);
645 struct iwl_mvm_baid_data *baid_data =
646 iwl_mvm_baid_data_from_reorder_buf(buf);
647 struct iwl_mvm_reorder_buf_entry *entries =
648 &baid_data->entries[buf->queue * baid_data->entries_per_queue];
649 int i;
650 u16 sn = 0, index = 0;
651 bool expired = false;
652 bool cont = false;
653
654 spin_lock(&buf->lock);
655
656 if (!buf->num_stored || buf->removed) {
657 spin_unlock(&buf->lock);
658 return;
659 }
660
661 for (i = 0; i < buf->buf_size ; i++) {
662 index = (buf->head_sn + i) % buf->buf_size;
663
664 if (skb_queue_empty(&entries[index].e.frames)) {
665
666
667
668
669 cont = false;
670 continue;
671 }
672 if (!cont &&
673 !time_after(jiffies, entries[index].e.reorder_time +
674 RX_REORDER_BUF_TIMEOUT_MQ))
675 break;
676
677 expired = true;
678
679 cont = true;
680 sn = ieee80211_sn_add(buf->head_sn, i + 1);
681 }
682
683 if (expired) {
684 struct ieee80211_sta *sta;
685 struct iwl_mvm_sta *mvmsta;
686 u8 sta_id = baid_data->sta_id;
687
688 rcu_read_lock();
689 sta = rcu_dereference(buf->mvm->fw_id_to_mac_id[sta_id]);
690 mvmsta = iwl_mvm_sta_from_mac80211(sta);
691
692
693 IWL_DEBUG_HT(buf->mvm,
694 "Releasing expired frames for sta %u, sn %d\n",
695 sta_id, sn);
696 iwl_mvm_event_frame_timeout_callback(buf->mvm, mvmsta->vif,
697 sta, baid_data->tid);
698 iwl_mvm_release_frames(buf->mvm, sta, NULL, baid_data,
699 buf, sn, IWL_MVM_RELEASE_SEND_RSS_SYNC);
700 rcu_read_unlock();
701 } else {
702
703
704
705
706
707 mod_timer(&buf->reorder_timer,
708 entries[index].e.reorder_time +
709 1 + RX_REORDER_BUF_TIMEOUT_MQ);
710 }
711 spin_unlock(&buf->lock);
712}
713
714static void iwl_mvm_del_ba(struct iwl_mvm *mvm, int queue,
715 struct iwl_mvm_delba_data *data)
716{
717 struct iwl_mvm_baid_data *ba_data;
718 struct ieee80211_sta *sta;
719 struct iwl_mvm_reorder_buffer *reorder_buf;
720 u8 baid = data->baid;
721
722 if (WARN_ONCE(baid >= IWL_MAX_BAID, "invalid BAID: %x\n", baid))
723 return;
724
725 rcu_read_lock();
726
727 ba_data = rcu_dereference(mvm->baid_map[baid]);
728 if (WARN_ON_ONCE(!ba_data))
729 goto out;
730
731 sta = rcu_dereference(mvm->fw_id_to_mac_id[ba_data->sta_id]);
732 if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta)))
733 goto out;
734
735 reorder_buf = &ba_data->reorder_buf[queue];
736
737
738 spin_lock_bh(&reorder_buf->lock);
739 iwl_mvm_release_frames(mvm, sta, NULL, ba_data, reorder_buf,
740 ieee80211_sn_add(reorder_buf->head_sn,
741 reorder_buf->buf_size),
742 0);
743 spin_unlock_bh(&reorder_buf->lock);
744 del_timer_sync(&reorder_buf->reorder_timer);
745
746out:
747 rcu_read_unlock();
748}
749
750static void iwl_mvm_release_frames_from_notif(struct iwl_mvm *mvm,
751 struct napi_struct *napi,
752 u8 baid, u16 nssn, int queue,
753 u32 flags)
754{
755 struct ieee80211_sta *sta;
756 struct iwl_mvm_reorder_buffer *reorder_buf;
757 struct iwl_mvm_baid_data *ba_data;
758
759 IWL_DEBUG_HT(mvm, "Frame release notification for BAID %u, NSSN %d\n",
760 baid, nssn);
761
762 if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID ||
763 baid >= ARRAY_SIZE(mvm->baid_map)))
764 return;
765
766 rcu_read_lock();
767
768 ba_data = rcu_dereference(mvm->baid_map[baid]);
769 if (WARN_ON_ONCE(!ba_data))
770 goto out;
771
772 sta = rcu_dereference(mvm->fw_id_to_mac_id[ba_data->sta_id]);
773 if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta)))
774 goto out;
775
776 reorder_buf = &ba_data->reorder_buf[queue];
777
778 spin_lock_bh(&reorder_buf->lock);
779 iwl_mvm_release_frames(mvm, sta, napi, ba_data,
780 reorder_buf, nssn, flags);
781 spin_unlock_bh(&reorder_buf->lock);
782
783out:
784 rcu_read_unlock();
785}
786
787static void iwl_mvm_nssn_sync(struct iwl_mvm *mvm,
788 struct napi_struct *napi, int queue,
789 const struct iwl_mvm_nssn_sync_data *data)
790{
791 iwl_mvm_release_frames_from_notif(mvm, napi, data->baid,
792 data->nssn, queue,
793 IWL_MVM_RELEASE_FROM_RSS_SYNC);
794}
795
796void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct napi_struct *napi,
797 struct iwl_rx_cmd_buffer *rxb, int queue)
798{
799 struct iwl_rx_packet *pkt = rxb_addr(rxb);
800 struct iwl_rxq_sync_notification *notif;
801 struct iwl_mvm_internal_rxq_notif *internal_notif;
802 u32 len = iwl_rx_packet_payload_len(pkt);
803
804 notif = (void *)pkt->data;
805 internal_notif = (void *)notif->payload;
806
807 if (WARN_ONCE(len < sizeof(*notif) + sizeof(*internal_notif),
808 "invalid notification size %d (%d)",
809 len, (int)(sizeof(*notif) + sizeof(*internal_notif))))
810 return;
811 len -= sizeof(*notif) + sizeof(*internal_notif);
812
813 if (internal_notif->sync &&
814 mvm->queue_sync_cookie != internal_notif->cookie) {
815 WARN_ONCE(1, "Received expired RX queue sync message\n");
816 return;
817 }
818
819 switch (internal_notif->type) {
820 case IWL_MVM_RXQ_EMPTY:
821 WARN_ONCE(len, "invalid empty notification size %d", len);
822 break;
823 case IWL_MVM_RXQ_NOTIF_DEL_BA:
824 if (WARN_ONCE(len != sizeof(struct iwl_mvm_delba_data),
825 "invalid delba notification size %d (%d)",
826 len, (int)sizeof(struct iwl_mvm_delba_data)))
827 break;
828 iwl_mvm_del_ba(mvm, queue, (void *)internal_notif->data);
829 break;
830 case IWL_MVM_RXQ_NSSN_SYNC:
831 if (WARN_ONCE(len != sizeof(struct iwl_mvm_nssn_sync_data),
832 "invalid nssn sync notification size %d (%d)",
833 len, (int)sizeof(struct iwl_mvm_nssn_sync_data)))
834 break;
835 iwl_mvm_nssn_sync(mvm, napi, queue,
836 (void *)internal_notif->data);
837 break;
838 default:
839 WARN_ONCE(1, "Invalid identifier %d", internal_notif->type);
840 }
841
842 if (internal_notif->sync) {
843 WARN_ONCE(!test_and_clear_bit(queue, &mvm->queue_sync_state),
844 "queue sync: queue %d responded a second time!\n",
845 queue);
846 if (READ_ONCE(mvm->queue_sync_state) == 0)
847 wake_up(&mvm->rx_sync_waitq);
848 }
849}
850
851static void iwl_mvm_oldsn_workaround(struct iwl_mvm *mvm,
852 struct ieee80211_sta *sta, int tid,
853 struct iwl_mvm_reorder_buffer *buffer,
854 u32 reorder, u32 gp2, int queue)
855{
856 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
857
858 if (gp2 != buffer->consec_oldsn_ampdu_gp2) {
859
860
861
862
863
864
865 if (!buffer->consec_oldsn_prev_drop)
866 buffer->consec_oldsn_drops = 0;
867
868
869 buffer->consec_oldsn_ampdu_gp2 = gp2;
870 } else if (buffer->consec_oldsn_prev_drop) {
871
872
873
874
875
876
877 return;
878 }
879
880
881 if (!(reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN))
882 return;
883
884
885 buffer->consec_oldsn_prev_drop = 1;
886 buffer->consec_oldsn_drops++;
887
888
889 if (buffer->consec_oldsn_drops == IWL_MVM_AMPDU_CONSEC_DROPS_DELBA) {
890 IWL_WARN(mvm,
891 "reached %d old SN frames from %pM on queue %d, stopping BA session on TID %d\n",
892 IWL_MVM_AMPDU_CONSEC_DROPS_DELBA,
893 sta->addr, queue, tid);
894 ieee80211_stop_rx_ba_session(mvmsta->vif, BIT(tid), sta->addr);
895 buffer->consec_oldsn_prev_drop = 0;
896 buffer->consec_oldsn_drops = 0;
897 }
898}
899
900
901
902
903
904static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
905 struct napi_struct *napi,
906 int queue,
907 struct ieee80211_sta *sta,
908 struct sk_buff *skb,
909 struct iwl_rx_mpdu_desc *desc)
910{
911 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
912 struct ieee80211_hdr *hdr = iwl_mvm_skb_get_hdr(skb);
913 struct iwl_mvm_sta *mvm_sta;
914 struct iwl_mvm_baid_data *baid_data;
915 struct iwl_mvm_reorder_buffer *buffer;
916 struct sk_buff *tail;
917 u32 reorder = le32_to_cpu(desc->reorder_data);
918 bool amsdu = desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU;
919 bool last_subframe =
920 desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME;
921 u8 tid = ieee80211_get_tid(hdr);
922 u8 sub_frame_idx = desc->amsdu_info &
923 IWL_RX_MPDU_AMSDU_SUBFRAME_IDX_MASK;
924 struct iwl_mvm_reorder_buf_entry *entries;
925 int index;
926 u16 nssn, sn;
927 u8 baid;
928
929 baid = (reorder & IWL_RX_MPDU_REORDER_BAID_MASK) >>
930 IWL_RX_MPDU_REORDER_BAID_SHIFT;
931
932
933
934
935
936
937
938
939 if (baid == IWL_RX_REORDER_DATA_INVALID_BAID)
940 return false;
941
942
943 if (WARN_ONCE(IS_ERR_OR_NULL(sta),
944 "Got valid BAID without a valid station assigned\n"))
945 return false;
946
947 mvm_sta = iwl_mvm_sta_from_mac80211(sta);
948
949
950 if (!ieee80211_is_back_req(hdr->frame_control) &&
951 (!ieee80211_is_data_qos(hdr->frame_control) ||
952 is_multicast_ether_addr(hdr->addr1)))
953 return false;
954
955 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
956 return false;
957
958 baid_data = rcu_dereference(mvm->baid_map[baid]);
959 if (!baid_data) {
960 IWL_DEBUG_RX(mvm,
961 "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
962 baid, reorder);
963 return false;
964 }
965
966 if (WARN(tid != baid_data->tid || mvm_sta->sta_id != baid_data->sta_id,
967 "baid 0x%x is mapped to sta:%d tid:%d, but was received for sta:%d tid:%d\n",
968 baid, baid_data->sta_id, baid_data->tid, mvm_sta->sta_id,
969 tid))
970 return false;
971
972 nssn = reorder & IWL_RX_MPDU_REORDER_NSSN_MASK;
973 sn = (reorder & IWL_RX_MPDU_REORDER_SN_MASK) >>
974 IWL_RX_MPDU_REORDER_SN_SHIFT;
975
976 buffer = &baid_data->reorder_buf[queue];
977 entries = &baid_data->entries[queue * baid_data->entries_per_queue];
978
979 spin_lock_bh(&buffer->lock);
980
981 if (!buffer->valid) {
982 if (reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN) {
983 spin_unlock_bh(&buffer->lock);
984 return false;
985 }
986 buffer->valid = true;
987 }
988
989 if (ieee80211_is_back_req(hdr->frame_control)) {
990 iwl_mvm_release_frames(mvm, sta, napi, baid_data,
991 buffer, nssn, 0);
992 goto drop;
993 }
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005 if (!iwl_mvm_is_sn_less(nssn, buffer->head_sn + buffer->buf_size,
1006 buffer->buf_size) ||
1007 !ieee80211_sn_less(sn, buffer->head_sn + buffer->buf_size)) {
1008 u16 min_sn = ieee80211_sn_less(sn, nssn) ? sn : nssn;
1009
1010 iwl_mvm_release_frames(mvm, sta, napi, baid_data, buffer,
1011 min_sn, IWL_MVM_RELEASE_SEND_RSS_SYNC);
1012 }
1013
1014 iwl_mvm_oldsn_workaround(mvm, sta, tid, buffer, reorder,
1015 rx_status->device_timestamp, queue);
1016
1017
1018 if (ieee80211_sn_less(sn, buffer->head_sn))
1019 goto drop;
1020
1021
1022 if (!buffer->num_stored && ieee80211_sn_less(sn, nssn)) {
1023 if (iwl_mvm_is_sn_less(buffer->head_sn, nssn,
1024 buffer->buf_size) &&
1025 (!amsdu || last_subframe)) {
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038 if (sn == 2048 || sn == 0)
1039 iwl_mvm_sync_nssn(mvm, baid, sn);
1040 buffer->head_sn = nssn;
1041 }
1042
1043 spin_unlock_bh(&buffer->lock);
1044 return false;
1045 }
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055 if (!buffer->num_stored && sn == buffer->head_sn) {
1056 if (!amsdu || last_subframe) {
1057 if (sn == 2048 || sn == 0)
1058 iwl_mvm_sync_nssn(mvm, baid, sn);
1059 buffer->head_sn = ieee80211_sn_inc(buffer->head_sn);
1060 }
1061
1062 spin_unlock_bh(&buffer->lock);
1063 return false;
1064 }
1065
1066 index = sn % buffer->buf_size;
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076 tail = skb_peek_tail(&entries[index].e.frames);
1077 if (tail && !amsdu)
1078 goto drop;
1079 else if (tail && (sn != buffer->last_amsdu ||
1080 buffer->last_sub_index >= sub_frame_idx))
1081 goto drop;
1082
1083
1084 __skb_queue_tail(&entries[index].e.frames, skb);
1085 buffer->num_stored++;
1086 entries[index].e.reorder_time = jiffies;
1087
1088 if (amsdu) {
1089 buffer->last_amsdu = sn;
1090 buffer->last_sub_index = sub_frame_idx;
1091 }
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104 if (!amsdu || last_subframe)
1105 iwl_mvm_release_frames(mvm, sta, napi, baid_data,
1106 buffer, nssn,
1107 IWL_MVM_RELEASE_SEND_RSS_SYNC);
1108
1109 spin_unlock_bh(&buffer->lock);
1110 return true;
1111
1112drop:
1113 kfree_skb(skb);
1114 spin_unlock_bh(&buffer->lock);
1115 return true;
1116}
1117
1118static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
1119 u32 reorder_data, u8 baid)
1120{
1121 unsigned long now = jiffies;
1122 unsigned long timeout;
1123 struct iwl_mvm_baid_data *data;
1124
1125 rcu_read_lock();
1126
1127 data = rcu_dereference(mvm->baid_map[baid]);
1128 if (!data) {
1129 IWL_DEBUG_RX(mvm,
1130 "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
1131 baid, reorder_data);
1132 goto out;
1133 }
1134
1135 if (!data->timeout)
1136 goto out;
1137
1138 timeout = data->timeout;
1139
1140
1141
1142
1143
1144
1145 if (time_before(data->last_rx + TU_TO_JIFFIES(timeout), now))
1146
1147 data->last_rx = now;
1148
1149out:
1150 rcu_read_unlock();
1151}
1152
1153static void iwl_mvm_flip_address(u8 *addr)
1154{
1155 int i;
1156 u8 mac_addr[ETH_ALEN];
1157
1158 for (i = 0; i < ETH_ALEN; i++)
1159 mac_addr[i] = addr[ETH_ALEN - i - 1];
1160 ether_addr_copy(addr, mac_addr);
1161}
1162
1163struct iwl_mvm_rx_phy_data {
1164 enum iwl_rx_phy_info_type info_type;
1165 __le32 d0, d1, d2, d3;
1166 __le16 d4;
1167};
1168
1169static void iwl_mvm_decode_he_mu_ext(struct iwl_mvm *mvm,
1170 struct iwl_mvm_rx_phy_data *phy_data,
1171 u32 rate_n_flags,
1172 struct ieee80211_radiotap_he_mu *he_mu)
1173{
1174 u32 phy_data2 = le32_to_cpu(phy_data->d2);
1175 u32 phy_data3 = le32_to_cpu(phy_data->d3);
1176 u16 phy_data4 = le16_to_cpu(phy_data->d4);
1177
1178 if (FIELD_GET(IWL_RX_PHY_DATA4_HE_MU_EXT_CH1_CRC_OK, phy_data4)) {
1179 he_mu->flags1 |=
1180 cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_RU_KNOWN |
1181 IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_CTR_26T_RU_KNOWN);
1182
1183 he_mu->flags1 |=
1184 le16_encode_bits(FIELD_GET(IWL_RX_PHY_DATA4_HE_MU_EXT_CH1_CTR_RU,
1185 phy_data4),
1186 IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_CTR_26T_RU);
1187
1188 he_mu->ru_ch1[0] = FIELD_GET(IWL_RX_PHY_DATA2_HE_MU_EXT_CH1_RU0,
1189 phy_data2);
1190 he_mu->ru_ch1[1] = FIELD_GET(IWL_RX_PHY_DATA3_HE_MU_EXT_CH1_RU1,
1191 phy_data3);
1192 he_mu->ru_ch1[2] = FIELD_GET(IWL_RX_PHY_DATA2_HE_MU_EXT_CH1_RU2,
1193 phy_data2);
1194 he_mu->ru_ch1[3] = FIELD_GET(IWL_RX_PHY_DATA3_HE_MU_EXT_CH1_RU3,
1195 phy_data3);
1196 }
1197
1198 if (FIELD_GET(IWL_RX_PHY_DATA4_HE_MU_EXT_CH2_CRC_OK, phy_data4) &&
1199 (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK_V1) != RATE_MCS_CHAN_WIDTH_20) {
1200 he_mu->flags1 |=
1201 cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH2_RU_KNOWN |
1202 IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH2_CTR_26T_RU_KNOWN);
1203
1204 he_mu->flags2 |=
1205 le16_encode_bits(FIELD_GET(IWL_RX_PHY_DATA4_HE_MU_EXT_CH2_CTR_RU,
1206 phy_data4),
1207 IEEE80211_RADIOTAP_HE_MU_FLAGS2_CH2_CTR_26T_RU);
1208
1209 he_mu->ru_ch2[0] = FIELD_GET(IWL_RX_PHY_DATA2_HE_MU_EXT_CH2_RU0,
1210 phy_data2);
1211 he_mu->ru_ch2[1] = FIELD_GET(IWL_RX_PHY_DATA3_HE_MU_EXT_CH2_RU1,
1212 phy_data3);
1213 he_mu->ru_ch2[2] = FIELD_GET(IWL_RX_PHY_DATA2_HE_MU_EXT_CH2_RU2,
1214 phy_data2);
1215 he_mu->ru_ch2[3] = FIELD_GET(IWL_RX_PHY_DATA3_HE_MU_EXT_CH2_RU3,
1216 phy_data3);
1217 }
1218}
1219
1220static void
1221iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data,
1222 u32 rate_n_flags,
1223 struct ieee80211_radiotap_he *he,
1224 struct ieee80211_radiotap_he_mu *he_mu,
1225 struct ieee80211_rx_status *rx_status)
1226{
1227
1228
1229
1230
1231
1232
1233
1234
1235 u8 ru = le32_get_bits(phy_data->d1, IWL_RX_PHY_DATA1_HE_RU_ALLOC_MASK);
1236 u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK_V1;
1237 u8 offs = 0;
1238
1239 rx_status->bw = RATE_INFO_BW_HE_RU;
1240
1241 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN);
1242
1243 switch (ru) {
1244 case 0 ... 36:
1245 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_26;
1246 offs = ru;
1247 break;
1248 case 37 ... 52:
1249 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_52;
1250 offs = ru - 37;
1251 break;
1252 case 53 ... 60:
1253 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_106;
1254 offs = ru - 53;
1255 break;
1256 case 61 ... 64:
1257 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_242;
1258 offs = ru - 61;
1259 break;
1260 case 65 ... 66:
1261 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_484;
1262 offs = ru - 65;
1263 break;
1264 case 67:
1265 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_996;
1266 break;
1267 case 68:
1268 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_2x996;
1269 break;
1270 }
1271 he->data2 |= le16_encode_bits(offs,
1272 IEEE80211_RADIOTAP_HE_DATA2_RU_OFFSET);
1273 he->data2 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_KNOWN |
1274 IEEE80211_RADIOTAP_HE_DATA2_RU_OFFSET_KNOWN);
1275 if (phy_data->d1 & cpu_to_le32(IWL_RX_PHY_DATA1_HE_RU_ALLOC_SEC80))
1276 he->data2 |=
1277 cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_SEC);
1278
1279#define CHECK_BW(bw) \
1280 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_ ## bw ## MHZ != \
1281 RATE_MCS_CHAN_WIDTH_##bw >> RATE_MCS_CHAN_WIDTH_POS); \
1282 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_ ## bw ## MHZ != \
1283 RATE_MCS_CHAN_WIDTH_##bw >> RATE_MCS_CHAN_WIDTH_POS)
1284 CHECK_BW(20);
1285 CHECK_BW(40);
1286 CHECK_BW(80);
1287 CHECK_BW(160);
1288
1289 if (he_mu)
1290 he_mu->flags2 |=
1291 le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK_V1,
1292 rate_n_flags),
1293 IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW);
1294 else if (he_type == RATE_MCS_HE_TYPE_TRIG_V1)
1295 he->data6 |=
1296 cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_KNOWN) |
1297 le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK_V1,
1298 rate_n_flags),
1299 IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW);
1300}
1301
1302static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
1303 struct iwl_mvm_rx_phy_data *phy_data,
1304 struct ieee80211_radiotap_he *he,
1305 struct ieee80211_radiotap_he_mu *he_mu,
1306 struct ieee80211_rx_status *rx_status,
1307 u32 rate_n_flags, int queue)
1308{
1309 switch (phy_data->info_type) {
1310 case IWL_RX_PHY_INFO_TYPE_NONE:
1311 case IWL_RX_PHY_INFO_TYPE_CCK:
1312 case IWL_RX_PHY_INFO_TYPE_OFDM_LGCY:
1313 case IWL_RX_PHY_INFO_TYPE_HT:
1314 case IWL_RX_PHY_INFO_TYPE_VHT_SU:
1315 case IWL_RX_PHY_INFO_TYPE_VHT_MU:
1316 return;
1317 case IWL_RX_PHY_INFO_TYPE_HE_TB_EXT:
1318 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN |
1319 IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE2_KNOWN |
1320 IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE3_KNOWN |
1321 IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE4_KNOWN);
1322 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
1323 IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE1),
1324 IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE1);
1325 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
1326 IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE2),
1327 IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE2);
1328 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
1329 IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE3),
1330 IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE3);
1331 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
1332 IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE4),
1333 IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE4);
1334 fallthrough;
1335 case IWL_RX_PHY_INFO_TYPE_HE_SU:
1336 case IWL_RX_PHY_INFO_TYPE_HE_MU:
1337 case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
1338 case IWL_RX_PHY_INFO_TYPE_HE_TB:
1339
1340 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_LDPC_XSYMSEG_KNOWN |
1341 IEEE80211_RADIOTAP_HE_DATA1_DOPPLER_KNOWN |
1342 IEEE80211_RADIOTAP_HE_DATA1_BSS_COLOR_KNOWN);
1343 he->data2 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRE_FEC_PAD_KNOWN |
1344 IEEE80211_RADIOTAP_HE_DATA2_PE_DISAMBIG_KNOWN |
1345 IEEE80211_RADIOTAP_HE_DATA2_TXOP_KNOWN |
1346 IEEE80211_RADIOTAP_HE_DATA2_NUM_LTF_SYMS_KNOWN);
1347 he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1348 IWL_RX_PHY_DATA0_HE_BSS_COLOR_MASK),
1349 IEEE80211_RADIOTAP_HE_DATA3_BSS_COLOR);
1350 if (phy_data->info_type != IWL_RX_PHY_INFO_TYPE_HE_TB &&
1351 phy_data->info_type != IWL_RX_PHY_INFO_TYPE_HE_TB_EXT) {
1352 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_UL_DL_KNOWN);
1353 he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1354 IWL_RX_PHY_DATA0_HE_UPLINK),
1355 IEEE80211_RADIOTAP_HE_DATA3_UL_DL);
1356 }
1357 he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1358 IWL_RX_PHY_DATA0_HE_LDPC_EXT_SYM),
1359 IEEE80211_RADIOTAP_HE_DATA3_LDPC_XSYMSEG);
1360 he->data5 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1361 IWL_RX_PHY_DATA0_HE_PRE_FEC_PAD_MASK),
1362 IEEE80211_RADIOTAP_HE_DATA5_PRE_FEC_PAD);
1363 he->data5 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1364 IWL_RX_PHY_DATA0_HE_PE_DISAMBIG),
1365 IEEE80211_RADIOTAP_HE_DATA5_PE_DISAMBIG);
1366 he->data5 |= le16_encode_bits(le32_get_bits(phy_data->d1,
1367 IWL_RX_PHY_DATA1_HE_LTF_NUM_MASK),
1368 IEEE80211_RADIOTAP_HE_DATA5_NUM_LTF_SYMS);
1369 he->data6 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1370 IWL_RX_PHY_DATA0_HE_TXOP_DUR_MASK),
1371 IEEE80211_RADIOTAP_HE_DATA6_TXOP);
1372 he->data6 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1373 IWL_RX_PHY_DATA0_HE_DOPPLER),
1374 IEEE80211_RADIOTAP_HE_DATA6_DOPPLER);
1375 break;
1376 }
1377
1378 switch (phy_data->info_type) {
1379 case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
1380 case IWL_RX_PHY_INFO_TYPE_HE_MU:
1381 case IWL_RX_PHY_INFO_TYPE_HE_SU:
1382 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN);
1383 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1384 IWL_RX_PHY_DATA0_HE_SPATIAL_REUSE_MASK),
1385 IEEE80211_RADIOTAP_HE_DATA4_SU_MU_SPTL_REUSE);
1386 break;
1387 default:
1388
1389 break;
1390 }
1391
1392 switch (phy_data->info_type) {
1393 case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
1394 he_mu->flags1 |=
1395 le16_encode_bits(le16_get_bits(phy_data->d4,
1396 IWL_RX_PHY_DATA4_HE_MU_EXT_SIGB_DCM),
1397 IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_DCM);
1398 he_mu->flags1 |=
1399 le16_encode_bits(le16_get_bits(phy_data->d4,
1400 IWL_RX_PHY_DATA4_HE_MU_EXT_SIGB_MCS_MASK),
1401 IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_MCS);
1402 he_mu->flags2 |=
1403 le16_encode_bits(le16_get_bits(phy_data->d4,
1404 IWL_RX_PHY_DATA4_HE_MU_EXT_PREAMBLE_PUNC_TYPE_MASK),
1405 IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW);
1406 iwl_mvm_decode_he_mu_ext(mvm, phy_data, rate_n_flags, he_mu);
1407 fallthrough;
1408 case IWL_RX_PHY_INFO_TYPE_HE_MU:
1409 he_mu->flags2 |=
1410 le16_encode_bits(le32_get_bits(phy_data->d1,
1411 IWL_RX_PHY_DATA1_HE_MU_SIBG_SYM_OR_USER_NUM_MASK),
1412 IEEE80211_RADIOTAP_HE_MU_FLAGS2_SIG_B_SYMS_USERS);
1413 he_mu->flags2 |=
1414 le16_encode_bits(le32_get_bits(phy_data->d1,
1415 IWL_RX_PHY_DATA1_HE_MU_SIGB_COMPRESSION),
1416 IEEE80211_RADIOTAP_HE_MU_FLAGS2_SIG_B_COMP);
1417 fallthrough;
1418 case IWL_RX_PHY_INFO_TYPE_HE_TB:
1419 case IWL_RX_PHY_INFO_TYPE_HE_TB_EXT:
1420 iwl_mvm_decode_he_phy_ru_alloc(phy_data, rate_n_flags,
1421 he, he_mu, rx_status);
1422 break;
1423 case IWL_RX_PHY_INFO_TYPE_HE_SU:
1424 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_BEAM_CHANGE_KNOWN);
1425 he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1426 IWL_RX_PHY_DATA0_HE_BEAM_CHNG),
1427 IEEE80211_RADIOTAP_HE_DATA3_BEAM_CHANGE);
1428 break;
1429 default:
1430
1431 break;
1432 }
1433}
1434
1435static void iwl_mvm_rx_he(struct iwl_mvm *mvm, struct sk_buff *skb,
1436 struct iwl_mvm_rx_phy_data *phy_data,
1437 u32 rate_n_flags, u16 phy_info, int queue)
1438{
1439 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
1440 struct ieee80211_radiotap_he *he = NULL;
1441 struct ieee80211_radiotap_he_mu *he_mu = NULL;
1442 u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK;
1443 u8 stbc, ltf;
1444 static const struct ieee80211_radiotap_he known = {
1445 .data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
1446 IEEE80211_RADIOTAP_HE_DATA1_DATA_DCM_KNOWN |
1447 IEEE80211_RADIOTAP_HE_DATA1_STBC_KNOWN |
1448 IEEE80211_RADIOTAP_HE_DATA1_CODING_KNOWN),
1449 .data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN |
1450 IEEE80211_RADIOTAP_HE_DATA2_TXBF_KNOWN),
1451 };
1452 static const struct ieee80211_radiotap_he_mu mu_known = {
1453 .flags1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_MCS_KNOWN |
1454 IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_DCM_KNOWN |
1455 IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_SYMS_USERS_KNOWN |
1456 IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_COMP_KNOWN),
1457 .flags2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW_KNOWN |
1458 IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_KNOWN),
1459 };
1460
1461 he = skb_put_data(skb, &known, sizeof(known));
1462 rx_status->flag |= RX_FLAG_RADIOTAP_HE;
1463
1464 if (phy_data->info_type == IWL_RX_PHY_INFO_TYPE_HE_MU ||
1465 phy_data->info_type == IWL_RX_PHY_INFO_TYPE_HE_MU_EXT) {
1466 he_mu = skb_put_data(skb, &mu_known, sizeof(mu_known));
1467 rx_status->flag |= RX_FLAG_RADIOTAP_HE_MU;
1468 }
1469
1470
1471 if (!queue && !(phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
1472 rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
1473 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT_KNOWN;
1474 if (phy_data->d0 & cpu_to_le32(IWL_RX_PHY_DATA0_HE_DELIM_EOF))
1475 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT;
1476 }
1477
1478 if (phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD)
1479 iwl_mvm_decode_he_phy_data(mvm, phy_data, he, he_mu, rx_status,
1480 rate_n_flags, queue);
1481
1482
1483 if (!queue && (phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD) &&
1484 (phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
1485 bool toggle_bit = phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE;
1486
1487
1488 if (toggle_bit != mvm->ampdu_toggle) {
1489 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT_KNOWN;
1490 if (phy_data->d0 & cpu_to_le32(IWL_RX_PHY_DATA0_HE_DELIM_EOF))
1491 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT;
1492 }
1493 }
1494
1495 if (he_type == RATE_MCS_HE_TYPE_EXT_SU &&
1496 rate_n_flags & RATE_MCS_HE_106T_MSK) {
1497 rx_status->bw = RATE_INFO_BW_HE_RU;
1498 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_106;
1499 }
1500
1501
1502 if (he_type == RATE_MCS_HE_TYPE_SU ||
1503 he_type == RATE_MCS_HE_TYPE_EXT_SU)
1504 he->data1 |=
1505 cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN);
1506
1507 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >> RATE_MCS_STBC_POS;
1508 rx_status->nss =
1509 ((rate_n_flags & RATE_MCS_NSS_MSK) >>
1510 RATE_MCS_NSS_POS) + 1;
1511 rx_status->rate_idx = rate_n_flags & RATE_MCS_CODE_MSK;
1512 rx_status->encoding = RX_ENC_HE;
1513 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
1514 if (rate_n_flags & RATE_MCS_BF_MSK)
1515 rx_status->enc_flags |= RX_ENC_FLAG_BF;
1516
1517 rx_status->he_dcm =
1518 !!(rate_n_flags & RATE_HE_DUAL_CARRIER_MODE_MSK);
1519
1520#define CHECK_TYPE(F) \
1521 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA1_FORMAT_ ## F != \
1522 (RATE_MCS_HE_TYPE_ ## F >> RATE_MCS_HE_TYPE_POS))
1523
1524 CHECK_TYPE(SU);
1525 CHECK_TYPE(EXT_SU);
1526 CHECK_TYPE(MU);
1527 CHECK_TYPE(TRIG);
1528
1529 he->data1 |= cpu_to_le16(he_type >> RATE_MCS_HE_TYPE_POS);
1530
1531 if (rate_n_flags & RATE_MCS_BF_MSK)
1532 he->data5 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA5_TXBF);
1533
1534 switch ((rate_n_flags & RATE_MCS_HE_GI_LTF_MSK) >>
1535 RATE_MCS_HE_GI_LTF_POS) {
1536 case 0:
1537 if (he_type == RATE_MCS_HE_TYPE_TRIG)
1538 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
1539 else
1540 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1541 if (he_type == RATE_MCS_HE_TYPE_MU)
1542 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1543 else
1544 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_1X;
1545 break;
1546 case 1:
1547 if (he_type == RATE_MCS_HE_TYPE_TRIG)
1548 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
1549 else
1550 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1551 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_2X;
1552 break;
1553 case 2:
1554 if (he_type == RATE_MCS_HE_TYPE_TRIG) {
1555 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
1556 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1557 } else {
1558 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
1559 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_2X;
1560 }
1561 break;
1562 case 3:
1563 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
1564 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1565 break;
1566 case 4:
1567 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1568 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1569 break;
1570 default:
1571 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_UNKNOWN;
1572 }
1573
1574 he->data5 |= le16_encode_bits(ltf,
1575 IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE);
1576}
1577
1578static void iwl_mvm_decode_lsig(struct sk_buff *skb,
1579 struct iwl_mvm_rx_phy_data *phy_data)
1580{
1581 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
1582 struct ieee80211_radiotap_lsig *lsig;
1583
1584 switch (phy_data->info_type) {
1585 case IWL_RX_PHY_INFO_TYPE_HT:
1586 case IWL_RX_PHY_INFO_TYPE_VHT_SU:
1587 case IWL_RX_PHY_INFO_TYPE_VHT_MU:
1588 case IWL_RX_PHY_INFO_TYPE_HE_TB_EXT:
1589 case IWL_RX_PHY_INFO_TYPE_HE_SU:
1590 case IWL_RX_PHY_INFO_TYPE_HE_MU:
1591 case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
1592 case IWL_RX_PHY_INFO_TYPE_HE_TB:
1593 lsig = skb_put(skb, sizeof(*lsig));
1594 lsig->data1 = cpu_to_le16(IEEE80211_RADIOTAP_LSIG_DATA1_LENGTH_KNOWN);
1595 lsig->data2 = le16_encode_bits(le32_get_bits(phy_data->d1,
1596 IWL_RX_PHY_DATA1_LSIG_LEN_MASK),
1597 IEEE80211_RADIOTAP_LSIG_DATA2_LENGTH);
1598 rx_status->flag |= RX_FLAG_RADIOTAP_LSIG;
1599 break;
1600 default:
1601 break;
1602 }
1603}
1604
1605static inline u8 iwl_mvm_nl80211_band_from_rx_msdu(u8 phy_band)
1606{
1607 switch (phy_band) {
1608 case PHY_BAND_24:
1609 return NL80211_BAND_2GHZ;
1610 case PHY_BAND_5:
1611 return NL80211_BAND_5GHZ;
1612 case PHY_BAND_6:
1613 return NL80211_BAND_6GHZ;
1614 default:
1615 WARN_ONCE(1, "Unsupported phy band (%u)\n", phy_band);
1616 return NL80211_BAND_5GHZ;
1617 }
1618}
1619
1620struct iwl_rx_sta_csa {
1621 bool all_sta_unblocked;
1622 struct ieee80211_vif *vif;
1623};
1624
1625static void iwl_mvm_rx_get_sta_block_tx(void *data, struct ieee80211_sta *sta)
1626{
1627 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1628 struct iwl_rx_sta_csa *rx_sta_csa = data;
1629
1630 if (mvmsta->vif != rx_sta_csa->vif)
1631 return;
1632
1633 if (mvmsta->disable_tx)
1634 rx_sta_csa->all_sta_unblocked = false;
1635}
1636
1637void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
1638 struct iwl_rx_cmd_buffer *rxb, int queue)
1639{
1640 struct ieee80211_rx_status *rx_status;
1641 struct iwl_rx_packet *pkt = rxb_addr(rxb);
1642 struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
1643 struct ieee80211_hdr *hdr;
1644 u32 len;
1645 u32 pkt_len = iwl_rx_packet_payload_len(pkt);
1646 u32 rate_n_flags, gp2_on_air_rise;
1647 u16 phy_info;
1648 struct ieee80211_sta *sta = NULL;
1649 struct sk_buff *skb;
1650 u8 crypt_len = 0, channel, energy_a, energy_b;
1651 size_t desc_size;
1652 struct iwl_mvm_rx_phy_data phy_data = {
1653 .info_type = IWL_RX_PHY_INFO_TYPE_NONE,
1654 };
1655 u32 format;
1656 bool is_sgi;
1657
1658 if (unlikely(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)))
1659 return;
1660
1661 if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
1662 desc_size = sizeof(*desc);
1663 else
1664 desc_size = IWL_RX_DESC_SIZE_V1;
1665
1666 if (unlikely(pkt_len < desc_size)) {
1667 IWL_DEBUG_DROP(mvm, "Bad REPLY_RX_MPDU_CMD size\n");
1668 return;
1669 }
1670
1671 if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210) {
1672 rate_n_flags = le32_to_cpu(desc->v3.rate_n_flags);
1673 channel = desc->v3.channel;
1674 gp2_on_air_rise = le32_to_cpu(desc->v3.gp2_on_air_rise);
1675 energy_a = desc->v3.energy_a;
1676 energy_b = desc->v3.energy_b;
1677
1678 phy_data.d0 = desc->v3.phy_data0;
1679 phy_data.d1 = desc->v3.phy_data1;
1680 phy_data.d2 = desc->v3.phy_data2;
1681 phy_data.d3 = desc->v3.phy_data3;
1682 } else {
1683 rate_n_flags = le32_to_cpu(desc->v1.rate_n_flags);
1684 channel = desc->v1.channel;
1685 gp2_on_air_rise = le32_to_cpu(desc->v1.gp2_on_air_rise);
1686 energy_a = desc->v1.energy_a;
1687 energy_b = desc->v1.energy_b;
1688
1689 phy_data.d0 = desc->v1.phy_data0;
1690 phy_data.d1 = desc->v1.phy_data1;
1691 phy_data.d2 = desc->v1.phy_data2;
1692 phy_data.d3 = desc->v1.phy_data3;
1693 }
1694 if (iwl_fw_lookup_notif_ver(mvm->fw, LEGACY_GROUP,
1695 REPLY_RX_MPDU_CMD, 0) < 4) {
1696 rate_n_flags = iwl_new_rate_from_v1(rate_n_flags);
1697 IWL_DEBUG_DROP(mvm, "Got old format rate, converting. New rate: 0x%x\n",
1698 rate_n_flags);
1699 }
1700 format = rate_n_flags & RATE_MCS_MOD_TYPE_MSK;
1701
1702 len = le16_to_cpu(desc->mpdu_len);
1703
1704 if (unlikely(len + desc_size > pkt_len)) {
1705 IWL_DEBUG_DROP(mvm, "FW lied about packet len\n");
1706 return;
1707 }
1708
1709 phy_info = le16_to_cpu(desc->phy_info);
1710 phy_data.d4 = desc->phy_data4;
1711
1712 if (phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD)
1713 phy_data.info_type =
1714 le32_get_bits(phy_data.d1,
1715 IWL_RX_PHY_DATA1_INFO_TYPE_MASK);
1716
1717 hdr = (void *)(pkt->data + desc_size);
1718
1719
1720
1721 skb = alloc_skb(128, GFP_ATOMIC);
1722 if (!skb) {
1723 IWL_ERR(mvm, "alloc_skb failed\n");
1724 return;
1725 }
1726
1727 if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) {
1728
1729
1730
1731
1732
1733
1734 skb_reserve(skb, 2);
1735 }
1736
1737 rx_status = IEEE80211_SKB_RXCB(skb);
1738
1739
1740 switch (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK) {
1741 case RATE_MCS_CHAN_WIDTH_20:
1742 break;
1743 case RATE_MCS_CHAN_WIDTH_40:
1744 rx_status->bw = RATE_INFO_BW_40;
1745 break;
1746 case RATE_MCS_CHAN_WIDTH_80:
1747 rx_status->bw = RATE_INFO_BW_80;
1748 break;
1749 case RATE_MCS_CHAN_WIDTH_160:
1750 rx_status->bw = RATE_INFO_BW_160;
1751 break;
1752 }
1753
1754 if (format == RATE_MCS_HE_MSK)
1755 iwl_mvm_rx_he(mvm, skb, &phy_data, rate_n_flags,
1756 phy_info, queue);
1757
1758 iwl_mvm_decode_lsig(skb, &phy_data);
1759
1760
1761
1762
1763
1764 if (!(desc->status & cpu_to_le32(IWL_RX_MPDU_STATUS_CRC_OK)) ||
1765 !(desc->status & cpu_to_le32(IWL_RX_MPDU_STATUS_OVERRUN_OK))) {
1766 IWL_DEBUG_RX(mvm, "Bad CRC or FIFO: 0x%08X.\n",
1767 le32_to_cpu(desc->status));
1768 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
1769 }
1770
1771 if (format == RATE_MCS_CCK_MSK &&
1772 phy_info & IWL_RX_MPDU_PHY_SHORT_PREAMBLE)
1773 rx_status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
1774
1775 if (likely(!(phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD))) {
1776 u64 tsf_on_air_rise;
1777
1778 if (mvm->trans->trans_cfg->device_family >=
1779 IWL_DEVICE_FAMILY_AX210)
1780 tsf_on_air_rise = le64_to_cpu(desc->v3.tsf_on_air_rise);
1781 else
1782 tsf_on_air_rise = le64_to_cpu(desc->v1.tsf_on_air_rise);
1783
1784 rx_status->mactime = tsf_on_air_rise;
1785
1786 rx_status->flag |= RX_FLAG_MACTIME_PLCP_START;
1787 }
1788
1789 rx_status->device_timestamp = gp2_on_air_rise;
1790 if (iwl_mvm_is_band_in_rx_supported(mvm)) {
1791 u8 band = BAND_IN_RX_STATUS(desc->mac_phy_idx);
1792
1793 rx_status->band = iwl_mvm_nl80211_band_from_rx_msdu(band);
1794 } else {
1795 rx_status->band = channel > 14 ? NL80211_BAND_5GHZ :
1796 NL80211_BAND_2GHZ;
1797 }
1798 rx_status->freq = ieee80211_channel_to_frequency(channel,
1799 rx_status->band);
1800 iwl_mvm_get_signal_strength(mvm, rx_status, rate_n_flags, energy_a,
1801 energy_b);
1802
1803
1804 if (!queue && (phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
1805 bool toggle_bit = phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE;
1806
1807 rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
1808
1809
1810
1811
1812
1813 if (toggle_bit != mvm->ampdu_toggle) {
1814 mvm->ampdu_ref++;
1815 if (mvm->ampdu_ref == 0)
1816 mvm->ampdu_ref++;
1817 mvm->ampdu_toggle = toggle_bit;
1818 }
1819 rx_status->ampdu_reference = mvm->ampdu_ref;
1820 }
1821
1822 if (unlikely(mvm->monitor_on))
1823 iwl_mvm_add_rtap_sniffer_config(mvm, skb);
1824
1825 rcu_read_lock();
1826
1827 if (desc->status & cpu_to_le32(IWL_RX_MPDU_STATUS_SRC_STA_FOUND)) {
1828 u8 id = le32_get_bits(desc->status, IWL_RX_MPDU_STATUS_STA_ID);
1829
1830 if (!WARN_ON_ONCE(id >= mvm->fw->ucode_capa.num_stations)) {
1831 sta = rcu_dereference(mvm->fw_id_to_mac_id[id]);
1832 if (IS_ERR(sta))
1833 sta = NULL;
1834 }
1835 } else if (!is_multicast_ether_addr(hdr->addr2)) {
1836
1837
1838
1839
1840 sta = ieee80211_find_sta_by_ifaddr(mvm->hw, hdr->addr2, NULL);
1841 }
1842
1843 if (iwl_mvm_rx_crypto(mvm, sta, hdr, rx_status, phy_info, desc,
1844 le32_to_cpu(pkt->len_n_flags), queue,
1845 &crypt_len)) {
1846 kfree_skb(skb);
1847 goto out;
1848 }
1849
1850 if (sta) {
1851 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1852 struct ieee80211_vif *tx_blocked_vif =
1853 rcu_dereference(mvm->csa_tx_blocked_vif);
1854 u8 baid = (u8)((le32_to_cpu(desc->reorder_data) &
1855 IWL_RX_MPDU_REORDER_BAID_MASK) >>
1856 IWL_RX_MPDU_REORDER_BAID_SHIFT);
1857 struct iwl_fw_dbg_trigger_tlv *trig;
1858 struct ieee80211_vif *vif = mvmsta->vif;
1859
1860 if (!mvm->tcm.paused && len >= sizeof(*hdr) &&
1861 !is_multicast_ether_addr(hdr->addr1) &&
1862 ieee80211_is_data(hdr->frame_control) &&
1863 time_after(jiffies, mvm->tcm.ts + MVM_TCM_PERIOD))
1864 schedule_delayed_work(&mvm->tcm.work, 0);
1865
1866
1867
1868
1869
1870
1871 if (unlikely(tx_blocked_vif) && tx_blocked_vif == vif) {
1872 struct iwl_mvm_vif *mvmvif =
1873 iwl_mvm_vif_from_mac80211(tx_blocked_vif);
1874 struct iwl_rx_sta_csa rx_sta_csa = {
1875 .all_sta_unblocked = true,
1876 .vif = tx_blocked_vif,
1877 };
1878
1879 if (mvmvif->csa_target_freq == rx_status->freq)
1880 iwl_mvm_sta_modify_disable_tx_ap(mvm, sta,
1881 false);
1882 ieee80211_iterate_stations_atomic(mvm->hw,
1883 iwl_mvm_rx_get_sta_block_tx,
1884 &rx_sta_csa);
1885
1886 if (rx_sta_csa.all_sta_unblocked) {
1887 RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
1888
1889 iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, false);
1890 cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1891 }
1892 }
1893
1894 rs_update_last_rssi(mvm, mvmsta, rx_status);
1895
1896 trig = iwl_fw_dbg_trigger_on(&mvm->fwrt,
1897 ieee80211_vif_to_wdev(vif),
1898 FW_DBG_TRIGGER_RSSI);
1899
1900 if (trig && ieee80211_is_beacon(hdr->frame_control)) {
1901 struct iwl_fw_dbg_trigger_low_rssi *rssi_trig;
1902 s32 rssi;
1903
1904 rssi_trig = (void *)trig->data;
1905 rssi = le32_to_cpu(rssi_trig->rssi);
1906
1907 if (rx_status->signal < rssi)
1908 iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
1909 NULL);
1910 }
1911
1912 if (ieee80211_is_data(hdr->frame_control))
1913 iwl_mvm_rx_csum(mvm, sta, skb, pkt);
1914
1915 if (iwl_mvm_is_dup(sta, queue, rx_status, hdr, desc)) {
1916 kfree_skb(skb);
1917 goto out;
1918 }
1919
1920
1921
1922
1923
1924
1925
1926 if ((desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU) &&
1927 !WARN_ON(!ieee80211_is_data_qos(hdr->frame_control))) {
1928 u8 *qc = ieee80211_get_qos_ctl(hdr);
1929
1930 *qc &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
1931
1932 if (mvm->trans->trans_cfg->device_family ==
1933 IWL_DEVICE_FAMILY_9000) {
1934 iwl_mvm_flip_address(hdr->addr3);
1935
1936 if (ieee80211_has_a4(hdr->frame_control))
1937 iwl_mvm_flip_address(hdr->addr4);
1938 }
1939 }
1940 if (baid != IWL_RX_REORDER_DATA_INVALID_BAID) {
1941 u32 reorder_data = le32_to_cpu(desc->reorder_data);
1942
1943 iwl_mvm_agg_rx_received(mvm, reorder_data, baid);
1944 }
1945 }
1946
1947 is_sgi = format == RATE_MCS_HE_MSK ?
1948 iwl_he_is_sgi(rate_n_flags) :
1949 rate_n_flags & RATE_MCS_SGI_MSK;
1950
1951 if (!(format == RATE_MCS_CCK_MSK) && is_sgi)
1952 rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
1953 if (rate_n_flags & RATE_MCS_LDPC_MSK)
1954 rx_status->enc_flags |= RX_ENC_FLAG_LDPC;
1955 if (format == RATE_MCS_HT_MSK) {
1956 u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
1957 RATE_MCS_STBC_POS;
1958 rx_status->encoding = RX_ENC_HT;
1959 rx_status->rate_idx = RATE_HT_MCS_INDEX(rate_n_flags);
1960 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
1961 } else if (format == RATE_MCS_VHT_MSK) {
1962 u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
1963 RATE_MCS_STBC_POS;
1964 rx_status->nss =
1965 ((rate_n_flags & RATE_MCS_NSS_MSK) >>
1966 RATE_MCS_NSS_POS) + 1;
1967 rx_status->rate_idx = rate_n_flags & RATE_MCS_CODE_MSK;
1968 rx_status->encoding = RX_ENC_VHT;
1969 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
1970 if (rate_n_flags & RATE_MCS_BF_MSK)
1971 rx_status->enc_flags |= RX_ENC_FLAG_BF;
1972 } else if (!(format == RATE_MCS_HE_MSK)) {
1973 int rate = iwl_mvm_legacy_hw_idx_to_mac80211_idx(rate_n_flags,
1974 rx_status->band);
1975
1976 if (WARN(rate < 0 || rate > 0xFF,
1977 "Invalid rate flags 0x%x, band %d,\n",
1978 rate_n_flags, rx_status->band)) {
1979 kfree_skb(skb);
1980 goto out;
1981 }
1982 rx_status->rate_idx = rate;
1983 }
1984
1985
1986 if (!queue) {
1987 if (unlikely((ieee80211_is_beacon(hdr->frame_control) ||
1988 ieee80211_is_probe_resp(hdr->frame_control)) &&
1989 mvm->sched_scan_pass_all ==
1990 SCHED_SCAN_PASS_ALL_ENABLED))
1991 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_FOUND;
1992
1993 if (unlikely(ieee80211_is_beacon(hdr->frame_control) ||
1994 ieee80211_is_probe_resp(hdr->frame_control)))
1995 rx_status->boottime_ns = ktime_get_boottime_ns();
1996 }
1997
1998 if (iwl_mvm_create_skb(mvm, skb, hdr, len, crypt_len, rxb)) {
1999 kfree_skb(skb);
2000 goto out;
2001 }
2002
2003 if (!iwl_mvm_reorder(mvm, napi, queue, sta, skb, desc))
2004 iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue,
2005 sta);
2006out:
2007 rcu_read_unlock();
2008}
2009
2010void iwl_mvm_rx_monitor_no_data(struct iwl_mvm *mvm, struct napi_struct *napi,
2011 struct iwl_rx_cmd_buffer *rxb, int queue)
2012{
2013 struct ieee80211_rx_status *rx_status;
2014 struct iwl_rx_packet *pkt = rxb_addr(rxb);
2015 struct iwl_rx_no_data *desc = (void *)pkt->data;
2016 u32 rate_n_flags = le32_to_cpu(desc->rate);
2017 u32 gp2_on_air_rise = le32_to_cpu(desc->on_air_rise_time);
2018 u32 rssi = le32_to_cpu(desc->rssi);
2019 u32 info_type = le32_to_cpu(desc->info) & RX_NO_DATA_INFO_TYPE_MSK;
2020 u16 phy_info = IWL_RX_MPDU_PHY_TSF_OVERLOAD;
2021 struct ieee80211_sta *sta = NULL;
2022 struct sk_buff *skb;
2023 u8 channel, energy_a, energy_b;
2024 u32 format;
2025 struct iwl_mvm_rx_phy_data phy_data = {
2026 .info_type = le32_get_bits(desc->phy_info[1],
2027 IWL_RX_PHY_DATA1_INFO_TYPE_MASK),
2028 .d0 = desc->phy_info[0],
2029 .d1 = desc->phy_info[1],
2030 };
2031 bool is_sgi;
2032
2033 if (iwl_fw_lookup_notif_ver(mvm->fw, DATA_PATH_GROUP,
2034 RX_NO_DATA_NOTIF, 0) < 2) {
2035 IWL_DEBUG_DROP(mvm, "Got an old rate format. Old rate: 0x%x\n",
2036 rate_n_flags);
2037 rate_n_flags = iwl_new_rate_from_v1(rate_n_flags);
2038 IWL_DEBUG_DROP(mvm, " Rate after conversion to the new format: 0x%x\n",
2039 rate_n_flags);
2040 }
2041 format = rate_n_flags & RATE_MCS_MOD_TYPE_MSK;
2042
2043 if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*desc)))
2044 return;
2045
2046 if (unlikely(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)))
2047 return;
2048
2049 energy_a = (rssi & RX_NO_DATA_CHAIN_A_MSK) >> RX_NO_DATA_CHAIN_A_POS;
2050 energy_b = (rssi & RX_NO_DATA_CHAIN_B_MSK) >> RX_NO_DATA_CHAIN_B_POS;
2051 channel = (rssi & RX_NO_DATA_CHANNEL_MSK) >> RX_NO_DATA_CHANNEL_POS;
2052
2053
2054
2055
2056 skb = alloc_skb(128, GFP_ATOMIC);
2057 if (!skb) {
2058 IWL_ERR(mvm, "alloc_skb failed\n");
2059 return;
2060 }
2061
2062 rx_status = IEEE80211_SKB_RXCB(skb);
2063
2064
2065 rx_status->flag |= RX_FLAG_NO_PSDU;
2066
2067 switch (info_type) {
2068 case RX_NO_DATA_INFO_TYPE_NDP:
2069 rx_status->zero_length_psdu_type =
2070 IEEE80211_RADIOTAP_ZERO_LEN_PSDU_SOUNDING;
2071 break;
2072 case RX_NO_DATA_INFO_TYPE_MU_UNMATCHED:
2073 case RX_NO_DATA_INFO_TYPE_HE_TB_UNMATCHED:
2074 rx_status->zero_length_psdu_type =
2075 IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED;
2076 break;
2077 default:
2078 rx_status->zero_length_psdu_type =
2079 IEEE80211_RADIOTAP_ZERO_LEN_PSDU_VENDOR;
2080 break;
2081 }
2082
2083
2084 switch (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK) {
2085 case RATE_MCS_CHAN_WIDTH_20:
2086 break;
2087 case RATE_MCS_CHAN_WIDTH_40:
2088 rx_status->bw = RATE_INFO_BW_40;
2089 break;
2090 case RATE_MCS_CHAN_WIDTH_80:
2091 rx_status->bw = RATE_INFO_BW_80;
2092 break;
2093 case RATE_MCS_CHAN_WIDTH_160:
2094 rx_status->bw = RATE_INFO_BW_160;
2095 break;
2096 }
2097
2098 if (format == RATE_MCS_HE_MSK)
2099 iwl_mvm_rx_he(mvm, skb, &phy_data, rate_n_flags,
2100 phy_info, queue);
2101
2102 iwl_mvm_decode_lsig(skb, &phy_data);
2103
2104 rx_status->device_timestamp = gp2_on_air_rise;
2105 rx_status->band = channel > 14 ? NL80211_BAND_5GHZ :
2106 NL80211_BAND_2GHZ;
2107 rx_status->freq = ieee80211_channel_to_frequency(channel,
2108 rx_status->band);
2109 iwl_mvm_get_signal_strength(mvm, rx_status, rate_n_flags, energy_a,
2110 energy_b);
2111
2112 rcu_read_lock();
2113
2114 is_sgi = format == RATE_MCS_HE_MSK ?
2115 iwl_he_is_sgi(rate_n_flags) :
2116 rate_n_flags & RATE_MCS_SGI_MSK;
2117
2118 if (!(format == RATE_MCS_CCK_MSK) && is_sgi)
2119 rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
2120 if (rate_n_flags & RATE_MCS_LDPC_MSK)
2121 rx_status->enc_flags |= RX_ENC_FLAG_LDPC;
2122 if (format == RATE_MCS_HT_MSK) {
2123 u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
2124 RATE_MCS_STBC_POS;
2125 rx_status->encoding = RX_ENC_HT;
2126 rx_status->rate_idx = RATE_HT_MCS_INDEX(rate_n_flags);
2127 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
2128 } else if (format == RATE_MCS_VHT_MSK) {
2129 u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
2130 RATE_MCS_STBC_POS;
2131 rx_status->rate_idx = rate_n_flags & RATE_MCS_CODE_MSK;
2132 rx_status->encoding = RX_ENC_VHT;
2133 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
2134 if (rate_n_flags & RATE_MCS_BF_MSK)
2135 rx_status->enc_flags |= RX_ENC_FLAG_BF;
2136
2137
2138
2139
2140
2141 rx_status->nss =
2142 le32_get_bits(desc->rx_vec[0],
2143 RX_NO_DATA_RX_VEC0_VHT_NSTS_MSK) + 1;
2144 } else if (format == RATE_MCS_HE_MSK) {
2145 rx_status->nss =
2146 le32_get_bits(desc->rx_vec[0],
2147 RX_NO_DATA_RX_VEC0_HE_NSTS_MSK) + 1;
2148 } else {
2149 int rate = iwl_mvm_legacy_hw_idx_to_mac80211_idx(rate_n_flags,
2150 rx_status->band);
2151
2152 if (WARN(rate < 0 || rate > 0xFF,
2153 "Invalid rate flags 0x%x, band %d,\n",
2154 rate_n_flags, rx_status->band)) {
2155 kfree_skb(skb);
2156 goto out;
2157 }
2158 rx_status->rate_idx = rate;
2159 }
2160
2161 ieee80211_rx_napi(mvm->hw, sta, skb, napi);
2162out:
2163 rcu_read_unlock();
2164}
2165
2166void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
2167 struct iwl_rx_cmd_buffer *rxb, int queue)
2168{
2169 struct iwl_rx_packet *pkt = rxb_addr(rxb);
2170 struct iwl_frame_release *release = (void *)pkt->data;
2171
2172 if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release)))
2173 return;
2174
2175 iwl_mvm_release_frames_from_notif(mvm, napi, release->baid,
2176 le16_to_cpu(release->nssn),
2177 queue, 0);
2178}
2179
2180void iwl_mvm_rx_bar_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
2181 struct iwl_rx_cmd_buffer *rxb, int queue)
2182{
2183 struct iwl_rx_packet *pkt = rxb_addr(rxb);
2184 struct iwl_bar_frame_release *release = (void *)pkt->data;
2185 unsigned int baid = le32_get_bits(release->ba_info,
2186 IWL_BAR_FRAME_RELEASE_BAID_MASK);
2187 unsigned int nssn = le32_get_bits(release->ba_info,
2188 IWL_BAR_FRAME_RELEASE_NSSN_MASK);
2189 unsigned int sta_id = le32_get_bits(release->sta_tid,
2190 IWL_BAR_FRAME_RELEASE_STA_MASK);
2191 unsigned int tid = le32_get_bits(release->sta_tid,
2192 IWL_BAR_FRAME_RELEASE_TID_MASK);
2193 struct iwl_mvm_baid_data *baid_data;
2194
2195 if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release)))
2196 return;
2197
2198 if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID ||
2199 baid >= ARRAY_SIZE(mvm->baid_map)))
2200 return;
2201
2202 rcu_read_lock();
2203 baid_data = rcu_dereference(mvm->baid_map[baid]);
2204 if (!baid_data) {
2205 IWL_DEBUG_RX(mvm,
2206 "Got valid BAID %d but not allocated, invalid BAR release!\n",
2207 baid);
2208 goto out;
2209 }
2210
2211 if (WARN(tid != baid_data->tid || sta_id != baid_data->sta_id,
2212 "baid 0x%x is mapped to sta:%d tid:%d, but BAR release received for sta:%d tid:%d\n",
2213 baid, baid_data->sta_id, baid_data->tid, sta_id,
2214 tid))
2215 goto out;
2216
2217 iwl_mvm_release_frames_from_notif(mvm, napi, baid, nssn, queue, 0);
2218out:
2219 rcu_read_unlock();
2220}
2221