drivers/net/wireless/ath/ath10k/htt_rx.c

   1 /*
   2  * Copyright (c) 2005-2011 Atheros Communications Inc.
   3  * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
   4  *
   5  * Permission to use, copy, modify, and/or distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 #include "core.h"
  19 #include "htc.h"
  20 #include "htt.h"
  21 #include "txrx.h"
  22 #include "debug.h"
  23 #include "trace.h"
  24 #include "mac.h"
  25
  26 #include <linux/log2.h>
  27
  28 #define HTT_RX_RING_SIZE HTT_RX_RING_SIZE_MAX
  29 #define HTT_RX_RING_FILL_LEVEL (((HTT_RX_RING_SIZE) / 2) - 1)
  30
  31 /* when under memory pressure rx ring refill may fail and needs a retry */
  32 #define HTT_RX_RING_REFILL_RETRY_MS 50
  33
  34 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb);
  35 static void ath10k_htt_txrx_compl_task(unsigned long ptr);
  36
  37 static struct sk_buff *
  38 ath10k_htt_rx_find_skb_paddr(struct ath10k *ar, u32 paddr)
  39 {
  40         struct ath10k_skb_rxcb *rxcb;
  41
  42         hash_for_each_possible(ar->htt.rx_ring.skb_table, rxcb, hlist, paddr)
  43                 if (rxcb->paddr == paddr)
  44                         return ATH10K_RXCB_SKB(rxcb);
  45
  46         WARN_ON_ONCE(1);
  47         return NULL;
  48 }
  49
  50 static void ath10k_htt_rx_ring_free(struct ath10k_htt *htt)
  51 {
  52         struct sk_buff *skb;
  53         struct ath10k_skb_rxcb *rxcb;
  54         struct hlist_node *n;
  55         int i;
  56
  57         if (htt->rx_ring.in_ord_rx) {
  58                 hash_for_each_safe(htt->rx_ring.skb_table, i, n, rxcb, hlist) {
  59                         skb = ATH10K_RXCB_SKB(rxcb);
  60                         dma_unmap_single(htt->ar->dev, rxcb->paddr,
  61                                          skb->len + skb_tailroom(skb),
  62                                          DMA_FROM_DEVICE);
  63                         hash_del(&rxcb->hlist);
  64                         dev_kfree_skb_any(skb);
  65                 }
  66         } else {
  67                 for (i = 0; i < htt->rx_ring.size; i++) {
  68                         skb = htt->rx_ring.netbufs_ring[i];
  69                         if (!skb)
  70                                 continue;
  71
  72                         rxcb = ATH10K_SKB_RXCB(skb);
  73                         dma_unmap_single(htt->ar->dev, rxcb->paddr,
  74                                          skb->len + skb_tailroom(skb),
  75                                          DMA_FROM_DEVICE);
  76                         dev_kfree_skb_any(skb);
  77                 }
  78         }
  79
  80         htt->rx_ring.fill_cnt = 0;
  81         hash_init(htt->rx_ring.skb_table);
  82         memset(htt->rx_ring.netbufs_ring, 0,
  83                htt->rx_ring.size * sizeof(htt->rx_ring.netbufs_ring[0]));
  84 }
  85
  86 static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
  87 {
  88         struct htt_rx_desc *rx_desc;
  89         struct ath10k_skb_rxcb *rxcb;
  90         struct sk_buff *skb;
  91         dma_addr_t paddr;
  92         int ret = 0, idx;
  93
  94         /* The Full Rx Reorder firmware has no way of telling the host
  95          * implicitly when it copied HTT Rx Ring buffers to MAC Rx Ring.
  96          * To keep things simple make sure ring is always half empty. This
  97          * guarantees there'll be no replenishment overruns possible.
  98          */
  99         BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2);
 100
 101         idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr);
 102         while (num > 0) {
 103                 skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
 104                 if (!skb) {
 105                         ret = -ENOMEM;
 106                         goto fail;
 107                 }
 108
 109                 if (!IS_ALIGNED((unsigned long)skb->data, HTT_RX_DESC_ALIGN))
 110                         skb_pull(skb,
 111                                  PTR_ALIGN(skb->data, HTT_RX_DESC_ALIGN) -
 112                                  skb->data);
 113
 114                 /* Clear rx_desc attention word before posting to Rx ring */
 115                 rx_desc = (struct htt_rx_desc *)skb->data;
 116                 rx_desc->attention.flags = __cpu_to_le32(0);
 117
 118                 paddr = dma_map_single(htt->ar->dev, skb->data,
 119                                        skb->len + skb_tailroom(skb),
 120                                        DMA_FROM_DEVICE);
 121
 122                 if (unlikely(dma_mapping_error(htt->ar->dev, paddr))) {
 123                         dev_kfree_skb_any(skb);
 124                         ret = -ENOMEM;
 125                         goto fail;
 126                 }
 127
 128                 rxcb = ATH10K_SKB_RXCB(skb);
 129                 rxcb->paddr = paddr;
 130                 htt->rx_ring.netbufs_ring[idx] = skb;
 131                 htt->rx_ring.paddrs_ring[idx] = __cpu_to_le32(paddr);
 132                 htt->rx_ring.fill_cnt++;
 133
 134                 if (htt->rx_ring.in_ord_rx) {
 135                         hash_add(htt->rx_ring.skb_table,
 136                                  &ATH10K_SKB_RXCB(skb)->hlist,
 137                                  (u32)paddr);
 138                 }
 139
 140                 num--;
 141                 idx++;
 142                 idx &= htt->rx_ring.size_mask;
 143         }
 144
 145 fail:
 146         /*
 147          * Make sure the rx buffer is updated before available buffer
 148          * index to avoid any potential rx ring corruption.
 149          */
 150         mb();
 151         *htt->rx_ring.alloc_idx.vaddr = __cpu_to_le32(idx);
 152         return ret;
 153 }
 154
 155 static int ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
 156 {
 157         lockdep_assert_held(&htt->rx_ring.lock);
 158         return __ath10k_htt_rx_ring_fill_n(htt, num);
 159 }
 160
 161 static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt *htt)
 162 {
 163         int ret, num_deficit, num_to_fill;
 164
 165         /* Refilling the whole RX ring buffer proves to be a bad idea. The
 166          * reason is RX may take up significant amount of CPU cycles and starve
 167          * other tasks, e.g. TX on an ethernet device while acting as a bridge
 168          * with ath10k wlan interface. This ended up with very poor performance
 169          * once CPU the host system was overwhelmed with RX on ath10k.
 170          *
 171          * By limiting the number of refills the replenishing occurs
 172          * progressively. This in turns makes use of the fact tasklets are
 173          * processed in FIFO order. This means actual RX processing can starve
 174          * out refilling. If there's not enough buffers on RX ring FW will not
 175          * report RX until it is refilled with enough buffers. This
 176          * automatically balances load wrt to CPU power.
 177          *
 178          * This probably comes at a cost of lower maximum throughput but
 179          * improves the average and stability. */
 180         spin_lock_bh(&htt->rx_ring.lock);
 181         num_deficit = htt->rx_ring.fill_level - htt->rx_ring.fill_cnt;
 182         num_to_fill = min(ATH10K_HTT_MAX_NUM_REFILL, num_deficit);
 183         num_deficit -= num_to_fill;
 184         ret = ath10k_htt_rx_ring_fill_n(htt, num_to_fill);
 185         if (ret == -ENOMEM) {
 186                 /*
 187                  * Failed to fill it to the desired level -
 188                  * we'll start a timer and try again next time.
 189                  * As long as enough buffers are left in the ring for
 190                  * another A-MPDU rx, no special recovery is needed.
 191                  */
 192                 mod_timer(&htt->rx_ring.refill_retry_timer, jiffies +
 193                           msecs_to_jiffies(HTT_RX_RING_REFILL_RETRY_MS));
 194         } else if (num_deficit > 0) {
 195                 tasklet_schedule(&htt->rx_replenish_task);
 196         }
 197         spin_unlock_bh(&htt->rx_ring.lock);
 198 }
 199
 200 static void ath10k_htt_rx_ring_refill_retry(unsigned long arg)
 201 {
 202         struct ath10k_htt *htt = (struct ath10k_htt *)arg;
 203
 204         ath10k_htt_rx_msdu_buff_replenish(htt);
 205 }
 206
 207 int ath10k_htt_rx_ring_refill(struct ath10k *ar)
 208 {
 209         struct ath10k_htt *htt = &ar->htt;
 210         int ret;
 211
 212         spin_lock_bh(&htt->rx_ring.lock);
 213         ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
 214                                               htt->rx_ring.fill_cnt));
 215         spin_unlock_bh(&htt->rx_ring.lock);
 216
 217         if (ret)
 218                 ath10k_htt_rx_ring_free(htt);
 219
 220         return ret;
 221 }
 222
 223 void ath10k_htt_rx_free(struct ath10k_htt *htt)
 224 {
 225         del_timer_sync(&htt->rx_ring.refill_retry_timer);
 226         tasklet_kill(&htt->rx_replenish_task);
 227         tasklet_kill(&htt->txrx_compl_task);
 228
 229         skb_queue_purge(&htt->rx_compl_q);
 230         skb_queue_purge(&htt->rx_in_ord_compl_q);
 231         skb_queue_purge(&htt->tx_fetch_ind_q);
 232
 233         ath10k_htt_rx_ring_free(htt);
 234
 235         dma_free_coherent(htt->ar->dev,
 236                           (htt->rx_ring.size *
 237                            sizeof(htt->rx_ring.paddrs_ring)),
 238                           htt->rx_ring.paddrs_ring,
 239                           htt->rx_ring.base_paddr);
 240
 241         dma_free_coherent(htt->ar->dev,
 242                           sizeof(*htt->rx_ring.alloc_idx.vaddr),
 243                           htt->rx_ring.alloc_idx.vaddr,
 244                           htt->rx_ring.alloc_idx.paddr);
 245
 246         kfree(htt->rx_ring.netbufs_ring);
 247 }
 248
 249 static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
 250 {
 251         struct ath10k *ar = htt->ar;
 252         int idx;
 253         struct sk_buff *msdu;
 254
 255         lockdep_assert_held(&htt->rx_ring.lock);
 256
 257         if (htt->rx_ring.fill_cnt == 0) {
 258                 ath10k_warn(ar, "tried to pop sk_buff from an empty rx ring\n");
 259                 return NULL;
 260         }
 261
 262         idx = htt->rx_ring.sw_rd_idx.msdu_payld;
 263         msdu = htt->rx_ring.netbufs_ring[idx];
 264         htt->rx_ring.netbufs_ring[idx] = NULL;
 265         htt->rx_ring.paddrs_ring[idx] = 0;
 266
 267         idx++;
 268         idx &= htt->rx_ring.size_mask;
 269         htt->rx_ring.sw_rd_idx.msdu_payld = idx;
 270         htt->rx_ring.fill_cnt--;
 271
 272         dma_unmap_single(htt->ar->dev,
 273                          ATH10K_SKB_RXCB(msdu)->paddr,
 274                          msdu->len + skb_tailroom(msdu),
 275                          DMA_FROM_DEVICE);
 276         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx netbuf pop: ",
 277                         msdu->data, msdu->len + skb_tailroom(msdu));
 278
 279         return msdu;
 280 }
 281
 282 /* return: < 0 fatal error, 0 - non chained msdu, 1 chained msdu */
 283 static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
 284                                    struct sk_buff_head *amsdu)
 285 {
 286         struct ath10k *ar = htt->ar;
 287         int msdu_len, msdu_chaining = 0;
 288         struct sk_buff *msdu;
 289         struct htt_rx_desc *rx_desc;
 290
 291         lockdep_assert_held(&htt->rx_ring.lock);
 292
 293         for (;;) {
 294                 int last_msdu, msdu_len_invalid, msdu_chained;
 295
 296                 msdu = ath10k_htt_rx_netbuf_pop(htt);
 297                 if (!msdu) {
 298                         __skb_queue_purge(amsdu);
 299                         return -ENOENT;
 300                 }
 301
 302                 __skb_queue_tail(amsdu, msdu);
 303
 304                 rx_desc = (struct htt_rx_desc *)msdu->data;
 305
 306                 /* FIXME: we must report msdu payload since this is what caller
 307                  *        expects now */
 308                 skb_put(msdu, offsetof(struct htt_rx_desc, msdu_payload));
 309                 skb_pull(msdu, offsetof(struct htt_rx_desc, msdu_payload));
 310
 311                 /*
 312                  * Sanity check - confirm the HW is finished filling in the
 313                  * rx data.
 314                  * If the HW and SW are working correctly, then it's guaranteed
 315                  * that the HW's MAC DMA is done before this point in the SW.
 316                  * To prevent the case that we handle a stale Rx descriptor,
 317                  * just assert for now until we have a way to recover.
 318                  */
 319                 if (!(__le32_to_cpu(rx_desc->attention.flags)
 320                                 & RX_ATTENTION_FLAGS_MSDU_DONE)) {
 321                         __skb_queue_purge(amsdu);
 322                         return -EIO;
 323                 }
 324
 325                 msdu_len_invalid = !!(__le32_to_cpu(rx_desc->attention.flags)
 326                                         & (RX_ATTENTION_FLAGS_MPDU_LENGTH_ERR |
 327                                            RX_ATTENTION_FLAGS_MSDU_LENGTH_ERR));
 328                 msdu_len = MS(__le32_to_cpu(rx_desc->msdu_start.common.info0),
 329                               RX_MSDU_START_INFO0_MSDU_LENGTH);
 330                 msdu_chained = rx_desc->frag_info.ring2_more_count;
 331
 332                 if (msdu_len_invalid)
 333                         msdu_len = 0;
 334
 335                 skb_trim(msdu, 0);
 336                 skb_put(msdu, min(msdu_len, HTT_RX_MSDU_SIZE));
 337                 msdu_len -= msdu->len;
 338
 339                 /* Note: Chained buffers do not contain rx descriptor */
 340                 while (msdu_chained--) {
 341                         msdu = ath10k_htt_rx_netbuf_pop(htt);
 342                         if (!msdu) {
 343                                 __skb_queue_purge(amsdu);
 344                                 return -ENOENT;
 345                         }
 346
 347                         __skb_queue_tail(amsdu, msdu);
 348                         skb_trim(msdu, 0);
 349                         skb_put(msdu, min(msdu_len, HTT_RX_BUF_SIZE));
 350                         msdu_len -= msdu->len;
 351                         msdu_chaining = 1;
 352                 }
 353
 354                 last_msdu = __le32_to_cpu(rx_desc->msdu_end.common.info0) &
 355                                 RX_MSDU_END_INFO0_LAST_MSDU;
 356
 357                 trace_ath10k_htt_rx_desc(ar, &rx_desc->attention,
 358                                          sizeof(*rx_desc) - sizeof(u32));
 359
 360                 if (last_msdu)
 361                         break;
 362         }
 363
 364         if (skb_queue_empty(amsdu))
 365                 msdu_chaining = -1;
 366
 367         /*
 368          * Don't refill the ring yet.
 369          *
 370          * First, the elements popped here are still in use - it is not
 371          * safe to overwrite them until the matching call to
 372          * mpdu_desc_list_next. Second, for efficiency it is preferable to
 373          * refill the rx ring with 1 PPDU's worth of rx buffers (something
 374          * like 32 x 3 buffers), rather than one MPDU's worth of rx buffers
 375          * (something like 3 buffers). Consequently, we'll rely on the txrx
 376          * SW to tell us when it is done pulling all the PPDU's rx buffers
 377          * out of the rx ring, and then refill it just once.
 378          */
 379
 380         return msdu_chaining;
 381 }
 382
 383 static void ath10k_htt_rx_replenish_task(unsigned long ptr)
 384 {
 385         struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
 386
 387         ath10k_htt_rx_msdu_buff_replenish(htt);
 388 }
 389
 390 static struct sk_buff *ath10k_htt_rx_pop_paddr(struct ath10k_htt *htt,
 391                                                u32 paddr)
 392 {
 393         struct ath10k *ar = htt->ar;
 394         struct ath10k_skb_rxcb *rxcb;
 395         struct sk_buff *msdu;
 396
 397         lockdep_assert_held(&htt->rx_ring.lock);
 398
 399         msdu = ath10k_htt_rx_find_skb_paddr(ar, paddr);
 400         if (!msdu)
 401                 return NULL;
 402
 403         rxcb = ATH10K_SKB_RXCB(msdu);
 404         hash_del(&rxcb->hlist);
 405         htt->rx_ring.fill_cnt--;
 406
 407         dma_unmap_single(htt->ar->dev, rxcb->paddr,
 408                          msdu->len + skb_tailroom(msdu),
 409                          DMA_FROM_DEVICE);
 410         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx netbuf pop: ",
 411                         msdu->data, msdu->len + skb_tailroom(msdu));
 412
 413         return msdu;
 414 }
 415
 416 static int ath10k_htt_rx_pop_paddr_list(struct ath10k_htt *htt,
 417                                         struct htt_rx_in_ord_ind *ev,
 418                                         struct sk_buff_head *list)
 419 {
 420         struct ath10k *ar = htt->ar;
 421         struct htt_rx_in_ord_msdu_desc *msdu_desc = ev->msdu_descs;
 422         struct htt_rx_desc *rxd;
 423         struct sk_buff *msdu;
 424         int msdu_count;
 425         bool is_offload;
 426         u32 paddr;
 427
 428         lockdep_assert_held(&htt->rx_ring.lock);
 429
 430         msdu_count = __le16_to_cpu(ev->msdu_count);
 431         is_offload = !!(ev->info & HTT_RX_IN_ORD_IND_INFO_OFFLOAD_MASK);
 432
 433         while (msdu_count--) {
 434                 paddr = __le32_to_cpu(msdu_desc->msdu_paddr);
 435
 436                 msdu = ath10k_htt_rx_pop_paddr(htt, paddr);
 437                 if (!msdu) {
 438                         __skb_queue_purge(list);
 439                         return -ENOENT;
 440                 }
 441
 442                 __skb_queue_tail(list, msdu);
 443
 444                 if (!is_offload) {
 445                         rxd = (void *)msdu->data;
 446
 447                         trace_ath10k_htt_rx_desc(ar, rxd, sizeof(*rxd));
 448
 449                         skb_put(msdu, sizeof(*rxd));
 450                         skb_pull(msdu, sizeof(*rxd));
 451                         skb_put(msdu, __le16_to_cpu(msdu_desc->msdu_len));
 452
 453                         if (!(__le32_to_cpu(rxd->attention.flags) &
 454                               RX_ATTENTION_FLAGS_MSDU_DONE)) {
 455                                 ath10k_warn(htt->ar, "tried to pop an incomplete frame, oops!\n");
 456                                 return -EIO;
 457                         }
 458                 }
 459
 460                 msdu_desc++;
 461         }
 462
 463         return 0;
 464 }
 465
 466 int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
 467 {
 468         struct ath10k *ar = htt->ar;
 469         dma_addr_t paddr;
 470         void *vaddr;
 471         size_t size;
 472         struct timer_list *timer = &htt->rx_ring.refill_retry_timer;
 473
 474         htt->rx_confused = false;
 475
 476         /* XXX: The fill level could be changed during runtime in response to
 477          * the host processing latency. Is this really worth it?
 478          */
 479         htt->rx_ring.size = HTT_RX_RING_SIZE;
 480         htt->rx_ring.size_mask = htt->rx_ring.size - 1;
 481         htt->rx_ring.fill_level = HTT_RX_RING_FILL_LEVEL;
 482
 483         if (!is_power_of_2(htt->rx_ring.size)) {
 484                 ath10k_warn(ar, "htt rx ring size is not power of 2\n");
 485                 return -EINVAL;
 486         }
 487
 488         htt->rx_ring.netbufs_ring =
 489                 kzalloc(htt->rx_ring.size * sizeof(struct sk_buff *),
 490                         GFP_KERNEL);
 491         if (!htt->rx_ring.netbufs_ring)
 492                 goto err_netbuf;
 493
 494         size = htt->rx_ring.size * sizeof(htt->rx_ring.paddrs_ring);
 495
 496         vaddr = dma_alloc_coherent(htt->ar->dev, size, &paddr, GFP_KERNEL);
 497         if (!vaddr)
 498                 goto err_dma_ring;
 499
 500         htt->rx_ring.paddrs_ring = vaddr;
 501         htt->rx_ring.base_paddr = paddr;
 502
 503         vaddr = dma_alloc_coherent(htt->ar->dev,
 504                                    sizeof(*htt->rx_ring.alloc_idx.vaddr),
 505                                    &paddr, GFP_KERNEL);
 506         if (!vaddr)
 507                 goto err_dma_idx;
 508
 509         htt->rx_ring.alloc_idx.vaddr = vaddr;
 510         htt->rx_ring.alloc_idx.paddr = paddr;
 511         htt->rx_ring.sw_rd_idx.msdu_payld = htt->rx_ring.size_mask;
 512         *htt->rx_ring.alloc_idx.vaddr = 0;
 513
 514         /* Initialize the Rx refill retry timer */
 515         setup_timer(timer, ath10k_htt_rx_ring_refill_retry, (unsigned long)htt);
 516
 517         spin_lock_init(&htt->rx_ring.lock);
 518
 519         htt->rx_ring.fill_cnt = 0;
 520         htt->rx_ring.sw_rd_idx.msdu_payld = 0;
 521         hash_init(htt->rx_ring.skb_table);
 522
 523         tasklet_init(&htt->rx_replenish_task, ath10k_htt_rx_replenish_task,
 524                      (unsigned long)htt);
 525
 526         skb_queue_head_init(&htt->rx_compl_q);
 527         skb_queue_head_init(&htt->rx_in_ord_compl_q);
 528         skb_queue_head_init(&htt->tx_fetch_ind_q);
 529
 530         tasklet_init(&htt->txrx_compl_task, ath10k_htt_txrx_compl_task,
 531                      (unsigned long)htt);
 532
 533         ath10k_dbg(ar, ATH10K_DBG_BOOT, "htt rx ring size %d fill_level %d\n",
 534                    htt->rx_ring.size, htt->rx_ring.fill_level);
 535         return 0;
 536
 537 err_dma_idx:
 538         dma_free_coherent(htt->ar->dev,
 539                           (htt->rx_ring.size *
 540                            sizeof(htt->rx_ring.paddrs_ring)),
 541                           htt->rx_ring.paddrs_ring,
 542                           htt->rx_ring.base_paddr);
 543 err_dma_ring:
 544         kfree(htt->rx_ring.netbufs_ring);
 545 err_netbuf:
 546         return -ENOMEM;
 547 }
 548
 549 static int ath10k_htt_rx_crypto_param_len(struct ath10k *ar,
 550                                           enum htt_rx_mpdu_encrypt_type type)
 551 {
 552         switch (type) {
 553         case HTT_RX_MPDU_ENCRYPT_NONE:
 554                 return 0;
 555         case HTT_RX_MPDU_ENCRYPT_WEP40:
 556         case HTT_RX_MPDU_ENCRYPT_WEP104:
 557                 return IEEE80211_WEP_IV_LEN;
 558         case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC:
 559         case HTT_RX_MPDU_ENCRYPT_TKIP_WPA:
 560                 return IEEE80211_TKIP_IV_LEN;
 561         case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
 562                 return IEEE80211_CCMP_HDR_LEN;
 563         case HTT_RX_MPDU_ENCRYPT_WEP128:
 564         case HTT_RX_MPDU_ENCRYPT_WAPI:
 565                 break;
 566         }
 567
 568         ath10k_warn(ar, "unsupported encryption type %d\n", type);
 569         return 0;
 570 }
 571
 572 #define MICHAEL_MIC_LEN 8
 573
 574 static int ath10k_htt_rx_crypto_tail_len(struct ath10k *ar,
 575                                          enum htt_rx_mpdu_encrypt_type type)
 576 {
 577         switch (type) {
 578         case HTT_RX_MPDU_ENCRYPT_NONE:
 579                 return 0;
 580         case HTT_RX_MPDU_ENCRYPT_WEP40:
 581         case HTT_RX_MPDU_ENCRYPT_WEP104:
 582                 return IEEE80211_WEP_ICV_LEN;
 583         case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC:
 584         case HTT_RX_MPDU_ENCRYPT_TKIP_WPA:
 585                 return IEEE80211_TKIP_ICV_LEN;
 586         case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
 587                 return IEEE80211_CCMP_MIC_LEN;
 588         case HTT_RX_MPDU_ENCRYPT_WEP128:
 589         case HTT_RX_MPDU_ENCRYPT_WAPI:
 590                 break;
 591         }
 592
 593         ath10k_warn(ar, "unsupported encryption type %d\n", type);
 594         return 0;
 595 }
 596
 597 struct amsdu_subframe_hdr {
 598         u8 dst[ETH_ALEN];
 599         u8 src[ETH_ALEN];
 600         __be16 len;
 601 } __packed;
 602
 603 #define GROUP_ID_IS_SU_MIMO(x) ((x) == 0 || (x) == 63)
 604
 605 static void ath10k_htt_rx_h_rates(struct ath10k *ar,
 606                                   struct ieee80211_rx_status *status,
 607                                   struct htt_rx_desc *rxd)
 608 {
 609         struct ieee80211_supported_band *sband;
 610         u8 cck, rate, bw, sgi, mcs, nss;
 611         u8 preamble = 0;
 612         u8 group_id;
 613         u32 info1, info2, info3;
 614
 615         info1 = __le32_to_cpu(rxd->ppdu_start.info1);
 616         info2 = __le32_to_cpu(rxd->ppdu_start.info2);
 617         info3 = __le32_to_cpu(rxd->ppdu_start.info3);
 618
 619         preamble = MS(info1, RX_PPDU_START_INFO1_PREAMBLE_TYPE);
 620
 621         switch (preamble) {
 622         case HTT_RX_LEGACY:
 623                 /* To get legacy rate index band is required. Since band can't
 624                  * be undefined check if freq is non-zero.
 625                  */
 626                 if (!status->freq)
 627                         return;
 628
 629                 cck = info1 & RX_PPDU_START_INFO1_L_SIG_RATE_SELECT;
 630                 rate = MS(info1, RX_PPDU_START_INFO1_L_SIG_RATE);
 631                 rate &= ~RX_PPDU_START_RATE_FLAG;
 632
 633                 sband = &ar->mac.sbands[status->band];
 634                 status->rate_idx = ath10k_mac_hw_rate_to_idx(sband, rate, cck);
 635                 break;
 636         case HTT_RX_HT:
 637         case HTT_RX_HT_WITH_TXBF:
 638                 /* HT-SIG - Table 20-11 in info2 and info3 */
 639                 mcs = info2 & 0x1F;
 640                 nss = mcs >> 3;
 641                 bw = (info2 >> 7) & 1;
 642                 sgi = (info3 >> 7) & 1;
 643
 644                 status->rate_idx = mcs;
 645                 status->flag |= RX_FLAG_HT;
 646                 if (sgi)
 647                         status->flag |= RX_FLAG_SHORT_GI;
 648                 if (bw)
 649                         status->flag |= RX_FLAG_40MHZ;
 650                 break;
 651         case HTT_RX_VHT:
 652         case HTT_RX_VHT_WITH_TXBF:
 653                 /* VHT-SIG-A1 in info2, VHT-SIG-A2 in info3
 654                    TODO check this */
 655                 bw = info2 & 3;
 656                 sgi = info3 & 1;
 657                 group_id = (info2 >> 4) & 0x3F;
 658
 659                 if (GROUP_ID_IS_SU_MIMO(group_id)) {
 660                         mcs = (info3 >> 4) & 0x0F;
 661                         nss = ((info2 >> 10) & 0x07) + 1;
 662                 } else {
 663                         /* Hardware doesn't decode VHT-SIG-B into Rx descriptor
 664                          * so it's impossible to decode MCS. Also since
 665                          * firmware consumes Group Id Management frames host
 666                          * has no knowledge regarding group/user position
 667                          * mapping so it's impossible to pick the correct Nsts
 668                          * from VHT-SIG-A1.
 669                          *
 670                          * Bandwidth and SGI are valid so report the rateinfo
 671                          * on best-effort basis.
 672                          */
 673                         mcs = 0;
 674                         nss = 1;
 675                 }
 676
 677                 if (mcs > 0x09) {
 678                         ath10k_warn(ar, "invalid MCS received %u\n", mcs);
 679                         ath10k_warn(ar, "rxd %08x mpdu start %08x %08x msdu start %08x %08x ppdu start %08x %08x %08x %08x %08x\n",
 680                                     __le32_to_cpu(rxd->attention.flags),
 681                                     __le32_to_cpu(rxd->mpdu_start.info0),
 682                                     __le32_to_cpu(rxd->mpdu_start.info1),
 683                                     __le32_to_cpu(rxd->msdu_start.common.info0),
 684                                     __le32_to_cpu(rxd->msdu_start.common.info1),
 685                                     rxd->ppdu_start.info0,
 686                                     __le32_to_cpu(rxd->ppdu_start.info1),
 687                                     __le32_to_cpu(rxd->ppdu_start.info2),
 688                                     __le32_to_cpu(rxd->ppdu_start.info3),
 689                                     __le32_to_cpu(rxd->ppdu_start.info4));
 690
 691                         ath10k_warn(ar, "msdu end %08x mpdu end %08x\n",
 692                                     __le32_to_cpu(rxd->msdu_end.common.info0),
 693                                     __le32_to_cpu(rxd->mpdu_end.info0));
 694
 695                         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL,
 696                                         "rx desc msdu payload: ",
 697                                         rxd->msdu_payload, 50);
 698                 }
 699
 700                 status->rate_idx = mcs;
 701                 status->vht_nss = nss;
 702
 703                 if (sgi)
 704                         status->flag |= RX_FLAG_SHORT_GI;
 705
 706                 switch (bw) {
 707                 /* 20MHZ */
 708                 case 0:
 709                         break;
 710                 /* 40MHZ */
 711                 case 1:
 712                         status->flag |= RX_FLAG_40MHZ;
 713                         break;
 714                 /* 80MHZ */
 715                 case 2:
 716                         status->vht_flag |= RX_VHT_FLAG_80MHZ;
 717                 }
 718
 719                 status->flag |= RX_FLAG_VHT;
 720                 break;
 721         default:
 722                 break;
 723         }
 724 }
 725
 726 static struct ieee80211_channel *
 727 ath10k_htt_rx_h_peer_channel(struct ath10k *ar, struct htt_rx_desc *rxd)
 728 {
 729         struct ath10k_peer *peer;
 730         struct ath10k_vif *arvif;
 731         struct cfg80211_chan_def def;
 732         u16 peer_id;
 733
 734         lockdep_assert_held(&ar->data_lock);
 735
 736         if (!rxd)
 737                 return NULL;
 738
 739         if (rxd->attention.flags &
 740             __cpu_to_le32(RX_ATTENTION_FLAGS_PEER_IDX_INVALID))
 741                 return NULL;
 742
 743         if (!(rxd->msdu_end.common.info0 &
 744               __cpu_to_le32(RX_MSDU_END_INFO0_FIRST_MSDU)))
 745                 return NULL;
 746
 747         peer_id = MS(__le32_to_cpu(rxd->mpdu_start.info0),
 748                      RX_MPDU_START_INFO0_PEER_IDX);
 749
 750         peer = ath10k_peer_find_by_id(ar, peer_id);
 751         if (!peer)
 752                 return NULL;
 753
 754         arvif = ath10k_get_arvif(ar, peer->vdev_id);
 755         if (WARN_ON_ONCE(!arvif))
 756                 return NULL;
 757
 758         if (WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def)))
 759                 return NULL;
 760
 761         return def.chan;
 762 }
 763
 764 static struct ieee80211_channel *
 765 ath10k_htt_rx_h_vdev_channel(struct ath10k *ar, u32 vdev_id)
 766 {
 767         struct ath10k_vif *arvif;
 768         struct cfg80211_chan_def def;
 769
 770         lockdep_assert_held(&ar->data_lock);
 771
 772         list_for_each_entry(arvif, &ar->arvifs, list) {
 773                 if (arvif->vdev_id == vdev_id &&
 774                     ath10k_mac_vif_chan(arvif->vif, &def) == 0)
 775                         return def.chan;
 776         }
 777
 778         return NULL;
 779 }
 780
 781 static void
 782 ath10k_htt_rx_h_any_chan_iter(struct ieee80211_hw *hw,
 783                               struct ieee80211_chanctx_conf *conf,
 784                               void *data)
 785 {
 786         struct cfg80211_chan_def *def = data;
 787
 788         *def = conf->def;
 789 }
 790
 791 static struct ieee80211_channel *
 792 ath10k_htt_rx_h_any_channel(struct ath10k *ar)
 793 {
 794         struct cfg80211_chan_def def = {};
 795
 796         ieee80211_iter_chan_contexts_atomic(ar->hw,
 797                                             ath10k_htt_rx_h_any_chan_iter,
 798                                             &def);
 799
 800         return def.chan;
 801 }
 802
 803 static bool ath10k_htt_rx_h_channel(struct ath10k *ar,
 804                                     struct ieee80211_rx_status *status,
 805                                     struct htt_rx_desc *rxd,
 806                                     u32 vdev_id)
 807 {
 808         struct ieee80211_channel *ch;
 809
 810         spin_lock_bh(&ar->data_lock);
 811         ch = ar->scan_channel;
 812         if (!ch)
 813                 ch = ar->rx_channel;
 814         if (!ch)
 815                 ch = ath10k_htt_rx_h_peer_channel(ar, rxd);
 816         if (!ch)
 817                 ch = ath10k_htt_rx_h_vdev_channel(ar, vdev_id);
 818         if (!ch)
 819                 ch = ath10k_htt_rx_h_any_channel(ar);
 820         if (!ch)
 821                 ch = ar->tgt_oper_chan;
 822         spin_unlock_bh(&ar->data_lock);
 823
 824         if (!ch)
 825                 return false;
 826
 827         status->band = ch->band;
 828         status->freq = ch->center_freq;
 829
 830         return true;
 831 }
 832
 833 static void ath10k_htt_rx_h_signal(struct ath10k *ar,
 834                                    struct ieee80211_rx_status *status,
 835                                    struct htt_rx_desc *rxd)
 836 {
 837         /* FIXME: Get real NF */
 838         status->signal = ATH10K_DEFAULT_NOISE_FLOOR +
 839                          rxd->ppdu_start.rssi_comb;
 840         status->flag &= ~RX_FLAG_NO_SIGNAL_VAL;
 841 }
 842
 843 static void ath10k_htt_rx_h_mactime(struct ath10k *ar,
 844                                     struct ieee80211_rx_status *status,
 845                                     struct htt_rx_desc *rxd)
 846 {
 847         /* FIXME: TSF is known only at the end of PPDU, in the last MPDU. This
 848          * means all prior MSDUs in a PPDU are reported to mac80211 without the
 849          * TSF. Is it worth holding frames until end of PPDU is known?
 850          *
 851          * FIXME: Can we get/compute 64bit TSF?
 852          */
 853         status->mactime = __le32_to_cpu(rxd->ppdu_end.common.tsf_timestamp);
 854         status->flag |= RX_FLAG_MACTIME_END;
 855 }
 856
 857 static void ath10k_htt_rx_h_ppdu(struct ath10k *ar,
 858                                  struct sk_buff_head *amsdu,
 859                                  struct ieee80211_rx_status *status,
 860                                  u32 vdev_id)
 861 {
 862         struct sk_buff *first;
 863         struct htt_rx_desc *rxd;
 864         bool is_first_ppdu;
 865         bool is_last_ppdu;
 866
 867         if (skb_queue_empty(amsdu))
 868                 return;
 869
 870         first = skb_peek(amsdu);
 871         rxd = (void *)first->data - sizeof(*rxd);
 872
 873         is_first_ppdu = !!(rxd->attention.flags &
 874                            __cpu_to_le32(RX_ATTENTION_FLAGS_FIRST_MPDU));
 875         is_last_ppdu = !!(rxd->attention.flags &
 876                           __cpu_to_le32(RX_ATTENTION_FLAGS_LAST_MPDU));
 877
 878         if (is_first_ppdu) {
 879                 /* New PPDU starts so clear out the old per-PPDU status. */
 880                 status->freq = 0;
 881                 status->rate_idx = 0;
 882                 status->vht_nss = 0;
 883                 status->vht_flag &= ~RX_VHT_FLAG_80MHZ;
 884                 status->flag &= ~(RX_FLAG_HT |
 885                                   RX_FLAG_VHT |
 886                                   RX_FLAG_SHORT_GI |
 887                                   RX_FLAG_40MHZ |
 888                                   RX_FLAG_MACTIME_END);
 889                 status->flag |= RX_FLAG_NO_SIGNAL_VAL;
 890
 891                 ath10k_htt_rx_h_signal(ar, status, rxd);
 892                 ath10k_htt_rx_h_channel(ar, status, rxd, vdev_id);
 893                 ath10k_htt_rx_h_rates(ar, status, rxd);
 894         }
 895
 896         if (is_last_ppdu)
 897                 ath10k_htt_rx_h_mactime(ar, status, rxd);
 898 }
 899
 900 static const char * const tid_to_ac[] = {
 901         "BE",
 902         "BK",
 903         "BK",
 904         "BE",
 905         "VI",
 906         "VI",
 907         "VO",
 908         "VO",
 909 };
 910
 911 static char *ath10k_get_tid(struct ieee80211_hdr *hdr, char *out, size_t size)
 912 {
 913         u8 *qc;
 914         int tid;
 915
 916         if (!ieee80211_is_data_qos(hdr->frame_control))
 917                 return "";
 918
 919         qc = ieee80211_get_qos_ctl(hdr);
 920         tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 921         if (tid < 8)
 922                 snprintf(out, size, "tid %d (%s)", tid, tid_to_ac[tid]);
 923         else
 924                 snprintf(out, size, "tid %d", tid);
 925
 926         return out;
 927 }
 928
 929 static void ath10k_process_rx(struct ath10k *ar,
 930                               struct ieee80211_rx_status *rx_status,
 931                               struct sk_buff *skb)
 932 {
 933         struct ieee80211_rx_status *status;
 934         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 935         char tid[32];
 936
 937         status = IEEE80211_SKB_RXCB(skb);
 938         *status = *rx_status;
 939
 940         ath10k_dbg(ar, ATH10K_DBG_DATA,
 941                    "rx skb %p len %u peer %pM %s %s sn %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n",
 942                    skb,
 943                    skb->len,
 944                    ieee80211_get_SA(hdr),
 945                    ath10k_get_tid(hdr, tid, sizeof(tid)),
 946                    is_multicast_ether_addr(ieee80211_get_DA(hdr)) ?
 947                                                         "mcast" : "ucast",
 948                    (__le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4,
 949                    status->flag == 0 ? "legacy" : "",
 950                    status->flag & RX_FLAG_HT ? "ht" : "",
 951                    status->flag & RX_FLAG_VHT ? "vht" : "",
 952                    status->flag & RX_FLAG_40MHZ ? "40" : "",
 953                    status->vht_flag & RX_VHT_FLAG_80MHZ ? "80" : "",
 954                    status->flag & RX_FLAG_SHORT_GI ? "sgi " : "",
 955                    status->rate_idx,
 956                    status->vht_nss,
 957                    status->freq,
 958                    status->band, status->flag,
 959                    !!(status->flag & RX_FLAG_FAILED_FCS_CRC),
 960                    !!(status->flag & RX_FLAG_MMIC_ERROR),
 961                    !!(status->flag & RX_FLAG_AMSDU_MORE));
 962         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "rx skb: ",
 963                         skb->data, skb->len);
 964         trace_ath10k_rx_hdr(ar, skb->data, skb->len);
 965         trace_ath10k_rx_payload(ar, skb->data, skb->len);
 966
 967         ieee80211_rx(ar->hw, skb);
 968 }
 969
 970 static int ath10k_htt_rx_nwifi_hdrlen(struct ath10k *ar,
 971                                       struct ieee80211_hdr *hdr)
 972 {
 973         int len = ieee80211_hdrlen(hdr->frame_control);
 974
 975         if (!test_bit(ATH10K_FW_FEATURE_NO_NWIFI_DECAP_4ADDR_PADDING,
 976                       ar->fw_features))
 977                 len = round_up(len, 4);
 978
 979         return len;
 980 }
 981
 982 static void ath10k_htt_rx_h_undecap_raw(struct ath10k *ar,
 983                                         struct sk_buff *msdu,
 984                                         struct ieee80211_rx_status *status,
 985                                         enum htt_rx_mpdu_encrypt_type enctype,
 986                                         bool is_decrypted)
 987 {
 988         struct ieee80211_hdr *hdr;
 989         struct htt_rx_desc *rxd;
 990         size_t hdr_len;
 991         size_t crypto_len;
 992         bool is_first;
 993         bool is_last;
 994
 995         rxd = (void *)msdu->data - sizeof(*rxd);
 996         is_first = !!(rxd->msdu_end.common.info0 &
 997                       __cpu_to_le32(RX_MSDU_END_INFO0_FIRST_MSDU));
 998         is_last = !!(rxd->msdu_end.common.info0 &
 999                      __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU));
1000
1001         /* Delivered decapped frame:
1002          * [802.11 header]
1003          * [crypto param] <-- can be trimmed if !fcs_err &&
1004          *                    !decrypt_err && !peer_idx_invalid
1005          * [amsdu header] <-- only if A-MSDU
1006          * [rfc1042/llc]
1007          * [payload]
1008          * [FCS] <-- at end, needs to be trimmed
1009          */
1010
1011         /* This probably shouldn't happen but warn just in case */
1012         if (unlikely(WARN_ON_ONCE(!is_first)))
1013                 return;
1014
1015         /* This probably shouldn't happen but warn just in case */
1016         if (unlikely(WARN_ON_ONCE(!(is_first && is_last))))
1017                 return;
1018
1019         skb_trim(msdu, msdu->len - FCS_LEN);
1020
1021         /* In most cases this will be true for sniffed frames. It makes sense
1022          * to deliver them as-is without stripping the crypto param. This is
1023          * necessary for software based decryption.
1024          *
1025          * If there's no error then the frame is decrypted. At least that is
1026          * the case for frames that come in via fragmented rx indication.
1027          */
1028         if (!is_decrypted)
1029                 return;
1030
1031         /* The payload is decrypted so strip crypto params. Start from tail
1032          * since hdr is used to compute some stuff.
1033          */
1034
1035         hdr = (void *)msdu->data;
1036
1037         /* Tail */
1038         if (status->flag & RX_FLAG_IV_STRIPPED)
1039                 skb_trim(msdu, msdu->len -
1040                          ath10k_htt_rx_crypto_tail_len(ar, enctype));
1041
1042         /* MMIC */
1043         if ((status->flag & RX_FLAG_MMIC_STRIPPED) &&
1044             !ieee80211_has_morefrags(hdr->frame_control) &&
1045             enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA)
1046                 skb_trim(msdu, msdu->len - 8);
1047
1048         /* Head */
1049         if (status->flag & RX_FLAG_IV_STRIPPED) {
1050                 hdr_len = ieee80211_hdrlen(hdr->frame_control);
1051                 crypto_len = ath10k_htt_rx_crypto_param_len(ar, enctype);
1052
1053                 memmove((void *)msdu->data + crypto_len,
1054                         (void *)msdu->data, hdr_len);
1055                 skb_pull(msdu, crypto_len);
1056         }
1057 }
1058
1059 static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar,
1060                                           struct sk_buff *msdu,
1061                                           struct ieee80211_rx_status *status,
1062                                           const u8 first_hdr[64])
1063 {
1064         struct ieee80211_hdr *hdr;
1065         size_t hdr_len;
1066         u8 da[ETH_ALEN];
1067         u8 sa[ETH_ALEN];
1068
1069         /* Delivered decapped frame:
1070          * [nwifi 802.11 header] <-- replaced with 802.11 hdr
1071          * [rfc1042/llc]
1072          *
1073          * Note: The nwifi header doesn't have QoS Control and is
1074          * (always?) a 3addr frame.
1075          *
1076          * Note2: There's no A-MSDU subframe header. Even if it's part
1077          * of an A-MSDU.
1078          */
1079
1080         /* pull decapped header and copy SA & DA */
1081         if ((ar->hw_params.hw_4addr_pad == ATH10K_HW_4ADDR_PAD_BEFORE) &&
1082             ieee80211_has_a4(((struct ieee80211_hdr *)first_hdr)->frame_control)) {
1083                 /* The QCA99X0 4 address mode pad 2 bytes at the
1084                  * beginning of MSDU
1085                  */
1086                 hdr = (struct ieee80211_hdr *)(msdu->data + 2);
1087                 /* The skb length need be extended 2 as the 2 bytes at the tail
1088                  * be excluded due to the padding
1089                  */
1090                 skb_put(msdu, 2);
1091         } else {
1092                 hdr = (struct ieee80211_hdr *)(msdu->data);
1093         }
1094
1095         hdr_len = ath10k_htt_rx_nwifi_hdrlen(ar, hdr);
1096         ether_addr_copy(da, ieee80211_get_DA(hdr));
1097         ether_addr_copy(sa, ieee80211_get_SA(hdr));
1098         skb_pull(msdu, hdr_len);
1099
1100         /* push original 802.11 header */
1101         hdr = (struct ieee80211_hdr *)first_hdr;
1102         hdr_len = ieee80211_hdrlen(hdr->frame_control);
1103         memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
1104
1105         /* original 802.11 header has a different DA and in
1106          * case of 4addr it may also have different SA
1107          */
1108         hdr = (struct ieee80211_hdr *)msdu->data;
1109         ether_addr_copy(ieee80211_get_DA(hdr), da);
1110         ether_addr_copy(ieee80211_get_SA(hdr), sa);
1111 }
1112
1113 static void *ath10k_htt_rx_h_find_rfc1042(struct ath10k *ar,
1114                                           struct sk_buff *msdu,
1115                                           enum htt_rx_mpdu_encrypt_type enctype)
1116 {
1117         struct ieee80211_hdr *hdr;
1118         struct htt_rx_desc *rxd;
1119         size_t hdr_len, crypto_len;
1120         void *rfc1042;
1121         bool is_first, is_last, is_amsdu;
1122
1123         rxd = (void *)msdu->data - sizeof(*rxd);
1124         hdr = (void *)rxd->rx_hdr_status;
1125
1126         is_first = !!(rxd->msdu_end.common.info0 &
1127                       __cpu_to_le32(RX_MSDU_END_INFO0_FIRST_MSDU));
1128         is_last = !!(rxd->msdu_end.common.info0 &
1129                      __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU));
1130         is_amsdu = !(is_first && is_last);
1131
1132         rfc1042 = hdr;
1133
1134         if (is_first) {
1135                 hdr_len = ieee80211_hdrlen(hdr->frame_control);
1136                 crypto_len = ath10k_htt_rx_crypto_param_len(ar, enctype);
1137
1138                 rfc1042 += round_up(hdr_len, 4) +
1139                            round_up(crypto_len, 4);
1140         }
1141
1142         if (is_amsdu)
1143                 rfc1042 += sizeof(struct amsdu_subframe_hdr);
1144
1145         return rfc1042;
1146 }
1147
1148 static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar,
1149                                         struct sk_buff *msdu,
1150                                         struct ieee80211_rx_status *status,
1151                                         const u8 first_hdr[64],
1152                                         enum htt_rx_mpdu_encrypt_type enctype)
1153 {
1154         struct ieee80211_hdr *hdr;
1155         struct ethhdr *eth;
1156         size_t hdr_len;
1157         void *rfc1042;
1158         u8 da[ETH_ALEN];
1159         u8 sa[ETH_ALEN];
1160
1161         /* Delivered decapped frame:
1162          * [eth header] <-- replaced with 802.11 hdr & rfc1042/llc
1163          * [payload]
1164          */
1165
1166         rfc1042 = ath10k_htt_rx_h_find_rfc1042(ar, msdu, enctype);
1167         if (WARN_ON_ONCE(!rfc1042))
1168                 return;
1169
1170         /* pull decapped header and copy SA & DA */
1171         eth = (struct ethhdr *)msdu->data;
1172         ether_addr_copy(da, eth->h_dest);
1173         ether_addr_copy(sa, eth->h_source);
1174         skb_pull(msdu, sizeof(struct ethhdr));
1175
1176         /* push rfc1042/llc/snap */
1177         memcpy(skb_push(msdu, sizeof(struct rfc1042_hdr)), rfc1042,
1178                sizeof(struct rfc1042_hdr));
1179
1180         /* push original 802.11 header */
1181         hdr = (struct ieee80211_hdr *)first_hdr;
1182         hdr_len = ieee80211_hdrlen(hdr->frame_control);
1183         memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
1184
1185         /* original 802.11 header has a different DA and in
1186          * case of 4addr it may also have different SA
1187          */
1188         hdr = (struct ieee80211_hdr *)msdu->data;
1189         ether_addr_copy(ieee80211_get_DA(hdr), da);
1190         ether_addr_copy(ieee80211_get_SA(hdr), sa);
1191 }
1192
1193 static void ath10k_htt_rx_h_undecap_snap(struct ath10k *ar,
1194                                          struct sk_buff *msdu,
1195                                          struct ieee80211_rx_status *status,
1196                                          const u8 first_hdr[64])
1197 {
1198         struct ieee80211_hdr *hdr;
1199         size_t hdr_len;
1200
1201         /* Delivered decapped frame:
1202          * [amsdu header] <-- replaced with 802.11 hdr
1203          * [rfc1042/llc]
1204          * [payload]
1205          */
1206
1207         skb_pull(msdu, sizeof(struct amsdu_subframe_hdr));
1208
1209         hdr = (struct ieee80211_hdr *)first_hdr;
1210         hdr_len = ieee80211_hdrlen(hdr->frame_control);
1211         memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
1212 }
1213
1214 static void ath10k_htt_rx_h_undecap(struct ath10k *ar,
1215                                     struct sk_buff *msdu,
1216                                     struct ieee80211_rx_status *status,
1217                                     u8 first_hdr[64],
1218                                     enum htt_rx_mpdu_encrypt_type enctype,
1219                                     bool is_decrypted)
1220 {
1221         struct htt_rx_desc *rxd;
1222         enum rx_msdu_decap_format decap;
1223
1224         /* First msdu's decapped header:
1225          * [802.11 header] <-- padded to 4 bytes long
1226          * [crypto param] <-- padded to 4 bytes long
1227          * [amsdu header] <-- only if A-MSDU
1228          * [rfc1042/llc]
1229          *
1230          * Other (2nd, 3rd, ..) msdu's decapped header:
1231          * [amsdu header] <-- only if A-MSDU
1232          * [rfc1042/llc]
1233          */
1234
1235         rxd = (void *)msdu->data - sizeof(*rxd);
1236         decap = MS(__le32_to_cpu(rxd->msdu_start.common.info1),
1237                    RX_MSDU_START_INFO1_DECAP_FORMAT);
1238
1239         switch (decap) {
1240         case RX_MSDU_DECAP_RAW:
1241                 ath10k_htt_rx_h_undecap_raw(ar, msdu, status, enctype,
1242                                             is_decrypted);
1243                 break;
1244         case RX_MSDU_DECAP_NATIVE_WIFI:
1245                 ath10k_htt_rx_h_undecap_nwifi(ar, msdu, status, first_hdr);
1246                 break;
1247         case RX_MSDU_DECAP_ETHERNET2_DIX:
1248                 ath10k_htt_rx_h_undecap_eth(ar, msdu, status, first_hdr, enctype);
1249                 break;
1250         case RX_MSDU_DECAP_8023_SNAP_LLC:
1251                 ath10k_htt_rx_h_undecap_snap(ar, msdu, status, first_hdr);
1252                 break;
1253         }
1254 }
1255
1256 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb)
1257 {
1258         struct htt_rx_desc *rxd;
1259         u32 flags, info;
1260         bool is_ip4, is_ip6;
1261         bool is_tcp, is_udp;
1262         bool ip_csum_ok, tcpudp_csum_ok;
1263
1264         rxd = (void *)skb->data - sizeof(*rxd);
1265         flags = __le32_to_cpu(rxd->attention.flags);
1266         info = __le32_to_cpu(rxd->msdu_start.common.info1);
1267
1268         is_ip4 = !!(info & RX_MSDU_START_INFO1_IPV4_PROTO);
1269         is_ip6 = !!(info & RX_MSDU_START_INFO1_IPV6_PROTO);
1270         is_tcp = !!(info & RX_MSDU_START_INFO1_TCP_PROTO);
1271         is_udp = !!(info & RX_MSDU_START_INFO1_UDP_PROTO);
1272         ip_csum_ok = !(flags & RX_ATTENTION_FLAGS_IP_CHKSUM_FAIL);
1273         tcpudp_csum_ok = !(flags & RX_ATTENTION_FLAGS_TCP_UDP_CHKSUM_FAIL);
1274
1275         if (!is_ip4 && !is_ip6)
1276                 return CHECKSUM_NONE;
1277         if (!is_tcp && !is_udp)
1278                 return CHECKSUM_NONE;
1279         if (!ip_csum_ok)
1280                 return CHECKSUM_NONE;
1281         if (!tcpudp_csum_ok)
1282                 return CHECKSUM_NONE;
1283
1284         return CHECKSUM_UNNECESSARY;
1285 }
1286
1287 static void ath10k_htt_rx_h_csum_offload(struct sk_buff *msdu)
1288 {
1289         msdu->ip_summed = ath10k_htt_rx_get_csum_state(msdu);
1290 }
1291
1292 static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
1293                                  struct sk_buff_head *amsdu,
1294                                  struct ieee80211_rx_status *status)
1295 {
1296         struct sk_buff *first;
1297         struct sk_buff *last;
1298         struct sk_buff *msdu;
1299         struct htt_rx_desc *rxd;
1300         struct ieee80211_hdr *hdr;
1301         enum htt_rx_mpdu_encrypt_type enctype;
1302         u8 first_hdr[64];
1303         u8 *qos;
1304         size_t hdr_len;
1305         bool has_fcs_err;
1306         bool has_crypto_err;
1307         bool has_tkip_err;
1308         bool has_peer_idx_invalid;
1309         bool is_decrypted;
1310         bool is_mgmt;
1311         u32 attention;
1312
1313         if (skb_queue_empty(amsdu))
1314                 return;
1315
1316         first = skb_peek(amsdu);
1317         rxd = (void *)first->data - sizeof(*rxd);
1318
1319         is_mgmt = !!(rxd->attention.flags &
1320                      __cpu_to_le32(RX_ATTENTION_FLAGS_MGMT_TYPE));
1321
1322         enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
1323                      RX_MPDU_START_INFO0_ENCRYPT_TYPE);
1324
1325         /* First MSDU's Rx descriptor in an A-MSDU contains full 802.11
1326          * decapped header. It'll be used for undecapping of each MSDU.
1327          */
1328         hdr = (void *)rxd->rx_hdr_status;
1329         hdr_len = ieee80211_hdrlen(hdr->frame_control);
1330         memcpy(first_hdr, hdr, hdr_len);
1331
1332         /* Each A-MSDU subframe will use the original header as the base and be
1333          * reported as a separate MSDU so strip the A-MSDU bit from QoS Ctl.
1334          */
1335         hdr = (void *)first_hdr;
1336         qos = ieee80211_get_qos_ctl(hdr);
1337         qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
1338
1339         /* Some attention flags are valid only in the last MSDU. */
1340         last = skb_peek_tail(amsdu);
1341         rxd = (void *)last->data - sizeof(*rxd);
1342         attention = __le32_to_cpu(rxd->attention.flags);
1343
1344         has_fcs_err = !!(attention & RX_ATTENTION_FLAGS_FCS_ERR);
1345         has_crypto_err = !!(attention & RX_ATTENTION_FLAGS_DECRYPT_ERR);
1346         has_tkip_err = !!(attention & RX_ATTENTION_FLAGS_TKIP_MIC_ERR);
1347         has_peer_idx_invalid = !!(attention & RX_ATTENTION_FLAGS_PEER_IDX_INVALID);
1348
1349         /* Note: If hardware captures an encrypted frame that it can't decrypt,
1350          * e.g. due to fcs error, missing peer or invalid key data it will
1351          * report the frame as raw.
1352          */
1353         is_decrypted = (enctype != HTT_RX_MPDU_ENCRYPT_NONE &&
1354                         !has_fcs_err &&
1355                         !has_crypto_err &&
1356                         !has_peer_idx_invalid);
1357
1358         /* Clear per-MPDU flags while leaving per-PPDU flags intact. */
1359         status->flag &= ~(RX_FLAG_FAILED_FCS_CRC |
1360                           RX_FLAG_MMIC_ERROR |
1361                           RX_FLAG_DECRYPTED |
1362                           RX_FLAG_IV_STRIPPED |
1363                           RX_FLAG_ONLY_MONITOR |
1364                           RX_FLAG_MMIC_STRIPPED);
1365
1366         if (has_fcs_err)
1367                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
1368
1369         if (has_tkip_err)
1370                 status->flag |= RX_FLAG_MMIC_ERROR;
1371
1372         /* Firmware reports all necessary management frames via WMI already.
1373          * They are not reported to monitor interfaces at all so pass the ones
1374          * coming via HTT to monitor interfaces instead. This simplifies
1375          * matters a lot.
1376          */
1377         if (is_mgmt)
1378                 status->flag |= RX_FLAG_ONLY_MONITOR;
1379
1380         if (is_decrypted) {
1381                 status->flag |= RX_FLAG_DECRYPTED;
1382
1383                 if (likely(!is_mgmt))
1384                         status->flag |= RX_FLAG_IV_STRIPPED |
1385                                         RX_FLAG_MMIC_STRIPPED;
1386 }
1387
1388         skb_queue_walk(amsdu, msdu) {
1389                 ath10k_htt_rx_h_csum_offload(msdu);
1390                 ath10k_htt_rx_h_undecap(ar, msdu, status, first_hdr, enctype,
1391                                         is_decrypted);
1392
1393                 /* Undecapping involves copying the original 802.11 header back
1394                  * to sk_buff. If frame is protected and hardware has decrypted
1395                  * it then remove the protected bit.
1396                  */
1397                 if (!is_decrypted)
1398                         continue;
1399                 if (is_mgmt)
1400                         continue;
1401
1402                 hdr = (void *)msdu->data;
1403                 hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
1404         }
1405 }
1406
1407 static void ath10k_htt_rx_h_deliver(struct ath10k *ar,
1408                                     struct sk_buff_head *amsdu,
1409                                     struct ieee80211_rx_status *status)
1410 {
1411         struct sk_buff *msdu;
1412
1413         while ((msdu = __skb_dequeue(amsdu))) {
1414                 /* Setup per-MSDU flags */
1415                 if (skb_queue_empty(amsdu))
1416                         status->flag &= ~RX_FLAG_AMSDU_MORE;
1417                 else
1418                         status->flag |= RX_FLAG_AMSDU_MORE;
1419
1420                 ath10k_process_rx(ar, status, msdu);
1421         }
1422 }
1423
1424 static int ath10k_unchain_msdu(struct sk_buff_head *amsdu)
1425 {
1426         struct sk_buff *skb, *first;
1427         int space;
1428         int total_len = 0;
1429
1430         /* TODO:  Might could optimize this by using
1431          * skb_try_coalesce or similar method to
1432          * decrease copying, or maybe get mac80211 to
1433          * provide a way to just receive a list of
1434          * skb?
1435          */
1436
1437         first = __skb_dequeue(amsdu);
1438
1439         /* Allocate total length all at once. */
1440         skb_queue_walk(amsdu, skb)
1441                 total_len += skb->len;
1442
1443         space = total_len - skb_tailroom(first);
1444         if ((space > 0) &&
1445             (pskb_expand_head(first, 0, space, GFP_ATOMIC) < 0)) {
1446                 /* TODO:  bump some rx-oom error stat */
1447                 /* put it back together so we can free the
1448                  * whole list at once.
1449                  */
1450                 __skb_queue_head(amsdu, first);
1451                 return -1;
1452         }
1453
1454         /* Walk list again, copying contents into
1455          * msdu_head
1456          */
1457         while ((skb = __skb_dequeue(amsdu))) {
1458                 skb_copy_from_linear_data(skb, skb_put(first, skb->len),
1459                                           skb->len);
1460                 dev_kfree_skb_any(skb);
1461         }
1462
1463         __skb_queue_head(amsdu, first);
1464         return 0;
1465 }
1466
1467 static void ath10k_htt_rx_h_unchain(struct ath10k *ar,
1468                                     struct sk_buff_head *amsdu,
1469                                     bool chained)
1470 {
1471         struct sk_buff *first;
1472         struct htt_rx_desc *rxd;
1473         enum rx_msdu_decap_format decap;
1474
1475         first = skb_peek(amsdu);
1476         rxd = (void *)first->data - sizeof(*rxd);
1477         decap = MS(__le32_to_cpu(rxd->msdu_start.common.info1),
1478                    RX_MSDU_START_INFO1_DECAP_FORMAT);
1479
1480         if (!chained)
1481                 return;
1482
1483         /* FIXME: Current unchaining logic can only handle simple case of raw
1484          * msdu chaining. If decapping is other than raw the chaining may be
1485          * more complex and this isn't handled by the current code. Don't even
1486          * try re-constructing such frames - it'll be pretty much garbage.
1487          */
1488         if (decap != RX_MSDU_DECAP_RAW ||
1489             skb_queue_len(amsdu) != 1 + rxd->frag_info.ring2_more_count) {
1490                 __skb_queue_purge(amsdu);
1491                 return;
1492         }
1493
1494         ath10k_unchain_msdu(amsdu);
1495 }
1496
1497 static bool ath10k_htt_rx_amsdu_allowed(struct ath10k *ar,
1498                                         struct sk_buff_head *amsdu,
1499                                         struct ieee80211_rx_status *rx_status)
1500 {
1501         /* FIXME: It might be a good idea to do some fuzzy-testing to drop
1502          * invalid/dangerous frames.
1503          */
1504
1505         if (!rx_status->freq) {
1506                 ath10k_warn(ar, "no channel configured; ignoring frame(s)!\n");
1507                 return false;
1508         }
1509
1510         if (test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags)) {
1511                 ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx cac running\n");
1512                 return false;
1513         }
1514
1515         return true;
1516 }
1517
1518 static void ath10k_htt_rx_h_filter(struct ath10k *ar,
1519                                    struct sk_buff_head *amsdu,
1520                                    struct ieee80211_rx_status *rx_status)
1521 {
1522         if (skb_queue_empty(amsdu))
1523                 return;
1524
1525         if (ath10k_htt_rx_amsdu_allowed(ar, amsdu, rx_status))
1526                 return;
1527
1528         __skb_queue_purge(amsdu);
1529 }
1530
1531 static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
1532                                   struct htt_rx_indication *rx)
1533 {
1534         struct ath10k *ar = htt->ar;
1535         struct ieee80211_rx_status *rx_status = &htt->rx_status;
1536         struct htt_rx_indication_mpdu_range *mpdu_ranges;
1537         struct sk_buff_head amsdu;
1538         int num_mpdu_ranges;
1539         int i, ret, mpdu_count = 0;
1540
1541         lockdep_assert_held(&htt->rx_ring.lock);
1542
1543         if (htt->rx_confused)
1544                 return;
1545
1546         num_mpdu_ranges = MS(__le32_to_cpu(rx->hdr.info1),
1547                              HTT_RX_INDICATION_INFO1_NUM_MPDU_RANGES);
1548         mpdu_ranges = htt_rx_ind_get_mpdu_ranges(rx);
1549
1550         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx ind: ",
1551                         rx, sizeof(*rx) +
1552                         (sizeof(struct htt_rx_indication_mpdu_range) *
1553                                 num_mpdu_ranges));
1554
1555         for (i = 0; i < num_mpdu_ranges; i++)
1556                 mpdu_count += mpdu_ranges[i].mpdu_count;
1557
1558         while (mpdu_count--) {
1559                 __skb_queue_head_init(&amsdu);
1560                 ret = ath10k_htt_rx_amsdu_pop(htt, &amsdu);
1561                 if (ret < 0) {
1562                         ath10k_warn(ar, "rx ring became corrupted: %d\n", ret);
1563                         __skb_queue_purge(&amsdu);
1564                         /* FIXME: It's probably a good idea to reboot the
1565                          * device instead of leaving it inoperable.
1566                          */
1567                         htt->rx_confused = true;
1568                         break;
1569                 }
1570
1571                 ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
1572                 ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
1573                 ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
1574                 ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
1575                 ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
1576         }
1577
1578         tasklet_schedule(&htt->rx_replenish_task);
1579 }
1580
1581 static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
1582                                        struct htt_rx_fragment_indication *frag)
1583 {
1584         struct ath10k *ar = htt->ar;
1585         struct ieee80211_rx_status *rx_status = &htt->rx_status;
1586         struct sk_buff_head amsdu;
1587         int ret;
1588
1589         __skb_queue_head_init(&amsdu);
1590
1591         spin_lock_bh(&htt->rx_ring.lock);
1592         ret = ath10k_htt_rx_amsdu_pop(htt, &amsdu);
1593         spin_unlock_bh(&htt->rx_ring.lock);
1594
1595         tasklet_schedule(&htt->rx_replenish_task);
1596
1597         ath10k_dbg(ar, ATH10K_DBG_HTT_DUMP, "htt rx frag ahead\n");
1598
1599         if (ret) {
1600                 ath10k_warn(ar, "failed to pop amsdu from httr rx ring for fragmented rx %d\n",
1601                             ret);
1602                 __skb_queue_purge(&amsdu);
1603                 return;
1604         }
1605
1606         if (skb_queue_len(&amsdu) != 1) {
1607                 ath10k_warn(ar, "failed to pop frag amsdu: too many msdus\n");
1608                 __skb_queue_purge(&amsdu);
1609                 return;
1610         }
1611
1612         ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
1613         ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
1614         ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
1615         ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
1616 }
1617
1618 static void ath10k_htt_rx_tx_compl_ind(struct ath10k *ar,
1619                                        struct sk_buff *skb)
1620 {
1621         struct ath10k_htt *htt = &ar->htt;
1622         struct htt_resp *resp = (struct htt_resp *)skb->data;
1623         struct htt_tx_done tx_done = {};
1624         int status = MS(resp->data_tx_completion.flags, HTT_DATA_TX_STATUS);
1625         __le16 msdu_id;
1626         int i;
1627
1628         switch (status) {
1629         case HTT_DATA_TX_STATUS_NO_ACK:
1630                 tx_done.status = HTT_TX_COMPL_STATE_NOACK;
1631                 break;
1632         case HTT_DATA_TX_STATUS_OK:
1633                 tx_done.status = HTT_TX_COMPL_STATE_ACK;
1634                 break;
1635         case HTT_DATA_TX_STATUS_DISCARD:
1636         case HTT_DATA_TX_STATUS_POSTPONE:
1637         case HTT_DATA_TX_STATUS_DOWNLOAD_FAIL:
1638                 tx_done.status = HTT_TX_COMPL_STATE_DISCARD;
1639                 break;
1640         default:
1641                 ath10k_warn(ar, "unhandled tx completion status %d\n", status);
1642                 tx_done.status = HTT_TX_COMPL_STATE_DISCARD;
1643                 break;
1644         }
1645
1646         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx completion num_msdus %d\n",
1647                    resp->data_tx_completion.num_msdus);
1648
1649         for (i = 0; i < resp->data_tx_completion.num_msdus; i++) {
1650                 msdu_id = resp->data_tx_completion.msdus[i];
1651                 tx_done.msdu_id = __le16_to_cpu(msdu_id);
1652
1653                 /* kfifo_put: In practice firmware shouldn't fire off per-CE
1654                  * interrupt and main interrupt (MSI/-X range case) for the same
1655                  * HTC service so it should be safe to use kfifo_put w/o lock.
1656                  *
1657                  * From kfifo_put() documentation:
1658                  *  Note that with only one concurrent reader and one concurrent
1659                  *  writer, you don't need extra locking to use these macro.
1660                  */
1661                 if (!kfifo_put(&htt->txdone_fifo, tx_done)) {
1662                         ath10k_warn(ar, "txdone fifo overrun, msdu_id %d status %d\n",
1663                                     tx_done.msdu_id, tx_done.status);
1664                         ath10k_txrx_tx_unref(htt, &tx_done);
1665                 }
1666         }
1667 }
1668
1669 static void ath10k_htt_rx_addba(struct ath10k *ar, struct htt_resp *resp)
1670 {
1671         struct htt_rx_addba *ev = &resp->rx_addba;
1672         struct ath10k_peer *peer;
1673         struct ath10k_vif *arvif;
1674         u16 info0, tid, peer_id;
1675
1676         info0 = __le16_to_cpu(ev->info0);
1677         tid = MS(info0, HTT_RX_BA_INFO0_TID);
1678         peer_id = MS(info0, HTT_RX_BA_INFO0_PEER_ID);
1679
1680         ath10k_dbg(ar, ATH10K_DBG_HTT,
1681                    "htt rx addba tid %hu peer_id %hu size %hhu\n",
1682                    tid, peer_id, ev->window_size);
1683
1684         spin_lock_bh(&ar->data_lock);
1685         peer = ath10k_peer_find_by_id(ar, peer_id);
1686         if (!peer) {
1687                 ath10k_warn(ar, "received addba event for invalid peer_id: %hu\n",
1688                             peer_id);
1689                 spin_unlock_bh(&ar->data_lock);
1690                 return;
1691         }
1692
1693         arvif = ath10k_get_arvif(ar, peer->vdev_id);
1694         if (!arvif) {
1695                 ath10k_warn(ar, "received addba event for invalid vdev_id: %u\n",
1696                             peer->vdev_id);
1697                 spin_unlock_bh(&ar->data_lock);
1698                 return;
1699         }
1700
1701         ath10k_dbg(ar, ATH10K_DBG_HTT,
1702                    "htt rx start rx ba session sta %pM tid %hu size %hhu\n",
1703                    peer->addr, tid, ev->window_size);
1704
1705         ieee80211_start_rx_ba_session_offl(arvif->vif, peer->addr, tid);
1706         spin_unlock_bh(&ar->data_lock);
1707 }
1708
1709 static void ath10k_htt_rx_delba(struct ath10k *ar, struct htt_resp *resp)
1710 {
1711         struct htt_rx_delba *ev = &resp->rx_delba;
1712         struct ath10k_peer *peer;
1713         struct ath10k_vif *arvif;
1714         u16 info0, tid, peer_id;
1715
1716         info0 = __le16_to_cpu(ev->info0);
1717         tid = MS(info0, HTT_RX_BA_INFO0_TID);
1718         peer_id = MS(info0, HTT_RX_BA_INFO0_PEER_ID);
1719
1720         ath10k_dbg(ar, ATH10K_DBG_HTT,
1721                    "htt rx delba tid %hu peer_id %hu\n",
1722                    tid, peer_id);
1723
1724         spin_lock_bh(&ar->data_lock);
1725         peer = ath10k_peer_find_by_id(ar, peer_id);
1726         if (!peer) {
1727                 ath10k_warn(ar, "received addba event for invalid peer_id: %hu\n",
1728                             peer_id);
1729                 spin_unlock_bh(&ar->data_lock);
1730                 return;
1731         }
1732
1733         arvif = ath10k_get_arvif(ar, peer->vdev_id);
1734         if (!arvif) {
1735                 ath10k_warn(ar, "received addba event for invalid vdev_id: %u\n",
1736                             peer->vdev_id);
1737                 spin_unlock_bh(&ar->data_lock);
1738                 return;
1739         }
1740
1741         ath10k_dbg(ar, ATH10K_DBG_HTT,
1742                    "htt rx stop rx ba session sta %pM tid %hu\n",
1743                    peer->addr, tid);
1744
1745         ieee80211_stop_rx_ba_session_offl(arvif->vif, peer->addr, tid);
1746         spin_unlock_bh(&ar->data_lock);
1747 }
1748
1749 static int ath10k_htt_rx_extract_amsdu(struct sk_buff_head *list,
1750                                        struct sk_buff_head *amsdu)
1751 {
1752         struct sk_buff *msdu;
1753         struct htt_rx_desc *rxd;
1754
1755         if (skb_queue_empty(list))
1756                 return -ENOBUFS;
1757
1758         if (WARN_ON(!skb_queue_empty(amsdu)))
1759                 return -EINVAL;
1760
1761         while ((msdu = __skb_dequeue(list))) {
1762                 __skb_queue_tail(amsdu, msdu);
1763
1764                 rxd = (void *)msdu->data - sizeof(*rxd);
1765                 if (rxd->msdu_end.common.info0 &
1766                     __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU))
1767                         break;
1768         }
1769
1770         msdu = skb_peek_tail(amsdu);
1771         rxd = (void *)msdu->data - sizeof(*rxd);
1772         if (!(rxd->msdu_end.common.info0 &
1773               __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU))) {
1774                 skb_queue_splice_init(amsdu, list);
1775                 return -EAGAIN;
1776         }
1777
1778         return 0;
1779 }
1780
1781 static void ath10k_htt_rx_h_rx_offload_prot(struct ieee80211_rx_status *status,
1782                                             struct sk_buff *skb)
1783 {
1784         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1785
1786         if (!ieee80211_has_protected(hdr->frame_control))
1787                 return;
1788
1789         /* Offloaded frames are already decrypted but firmware insists they are
1790          * protected in the 802.11 header. Strip the flag.  Otherwise mac80211
1791          * will drop the frame.
1792          */
1793
1794         hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
1795         status->flag |= RX_FLAG_DECRYPTED |
1796                         RX_FLAG_IV_STRIPPED |
1797                         RX_FLAG_MMIC_STRIPPED;
1798 }
1799
1800 static void ath10k_htt_rx_h_rx_offload(struct ath10k *ar,
1801                                        struct sk_buff_head *list)
1802 {
1803         struct ath10k_htt *htt = &ar->htt;
1804         struct ieee80211_rx_status *status = &htt->rx_status;
1805         struct htt_rx_offload_msdu *rx;
1806         struct sk_buff *msdu;
1807         size_t offset;
1808
1809         while ((msdu = __skb_dequeue(list))) {
1810                 /* Offloaded frames don't have Rx descriptor. Instead they have
1811                  * a short meta information header.
1812                  */
1813
1814                 rx = (void *)msdu->data;
1815
1816                 skb_put(msdu, sizeof(*rx));
1817                 skb_pull(msdu, sizeof(*rx));
1818
1819                 if (skb_tailroom(msdu) < __le16_to_cpu(rx->msdu_len)) {
1820                         ath10k_warn(ar, "dropping frame: offloaded rx msdu is too long!\n");
1821                         dev_kfree_skb_any(msdu);
1822                         continue;
1823                 }
1824
1825                 skb_put(msdu, __le16_to_cpu(rx->msdu_len));
1826
1827                 /* Offloaded rx header length isn't multiple of 2 nor 4 so the
1828                  * actual payload is unaligned. Align the frame.  Otherwise
1829                  * mac80211 complains.  This shouldn't reduce performance much
1830                  * because these offloaded frames are rare.
1831                  */
1832                 offset = 4 - ((unsigned long)msdu->data & 3);
1833                 skb_put(msdu, offset);
1834                 memmove(msdu->data + offset, msdu->data, msdu->len);
1835                 skb_pull(msdu, offset);
1836
1837                 /* FIXME: The frame is NWifi. Re-construct QoS Control
1838                  * if possible later.
1839                  */
1840
1841                 memset(status, 0, sizeof(*status));
1842                 status->flag |= RX_FLAG_NO_SIGNAL_VAL;
1843
1844                 ath10k_htt_rx_h_rx_offload_prot(status, msdu);
1845                 ath10k_htt_rx_h_channel(ar, status, NULL, rx->vdev_id);
1846                 ath10k_process_rx(ar, status, msdu);
1847         }
1848 }
1849
1850 static void ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
1851 {
1852         struct ath10k_htt *htt = &ar->htt;
1853         struct htt_resp *resp = (void *)skb->data;
1854         struct ieee80211_rx_status *status = &htt->rx_status;
1855         struct sk_buff_head list;
1856         struct sk_buff_head amsdu;
1857         u16 peer_id;
1858         u16 msdu_count;
1859         u8 vdev_id;
1860         u8 tid;
1861         bool offload;
1862         bool frag;
1863         int ret;
1864
1865         lockdep_assert_held(&htt->rx_ring.lock);
1866
1867         if (htt->rx_confused)
1868                 return;
1869
1870         skb_pull(skb, sizeof(resp->hdr));
1871         skb_pull(skb, sizeof(resp->rx_in_ord_ind));
1872
1873         peer_id = __le16_to_cpu(resp->rx_in_ord_ind.peer_id);
1874         msdu_count = __le16_to_cpu(resp->rx_in_ord_ind.msdu_count);
1875         vdev_id = resp->rx_in_ord_ind.vdev_id;
1876         tid = SM(resp->rx_in_ord_ind.info, HTT_RX_IN_ORD_IND_INFO_TID);
1877         offload = !!(resp->rx_in_ord_ind.info &
1878                         HTT_RX_IN_ORD_IND_INFO_OFFLOAD_MASK);
1879         frag = !!(resp->rx_in_ord_ind.info & HTT_RX_IN_ORD_IND_INFO_FRAG_MASK);
1880
1881         ath10k_dbg(ar, ATH10K_DBG_HTT,
1882                    "htt rx in ord vdev %i peer %i tid %i offload %i frag %i msdu count %i\n",
1883                    vdev_id, peer_id, tid, offload, frag, msdu_count);
1884
1885         if (skb->len < msdu_count * sizeof(*resp->rx_in_ord_ind.msdu_descs)) {
1886                 ath10k_warn(ar, "dropping invalid in order rx indication\n");
1887                 return;
1888         }
1889
1890         /* The event can deliver more than 1 A-MSDU. Each A-MSDU is later
1891          * extracted and processed.
1892          */
1893         __skb_queue_head_init(&list);
1894         ret = ath10k_htt_rx_pop_paddr_list(htt, &resp->rx_in_ord_ind, &list);
1895         if (ret < 0) {
1896                 ath10k_warn(ar, "failed to pop paddr list: %d\n", ret);
1897                 htt->rx_confused = true;
1898                 return;
1899         }
1900
1901         /* Offloaded frames are very different and need to be handled
1902          * separately.
1903          */
1904         if (offload)
1905                 ath10k_htt_rx_h_rx_offload(ar, &list);
1906
1907         while (!skb_queue_empty(&list)) {
1908                 __skb_queue_head_init(&amsdu);
1909                 ret = ath10k_htt_rx_extract_amsdu(&list, &amsdu);
1910                 switch (ret) {
1911                 case 0:
1912                         /* Note: The in-order indication may report interleaved
1913                          * frames from different PPDUs meaning reported rx rate
1914                          * to mac80211 isn't accurate/reliable. It's still
1915                          * better to report something than nothing though. This
1916                          * should still give an idea about rx rate to the user.
1917                          */
1918                         ath10k_htt_rx_h_ppdu(ar, &amsdu, status, vdev_id);
1919                         ath10k_htt_rx_h_filter(ar, &amsdu, status);
1920                         ath10k_htt_rx_h_mpdu(ar, &amsdu, status);
1921                         ath10k_htt_rx_h_deliver(ar, &amsdu, status);
1922                         break;
1923                 case -EAGAIN:
1924                         /* fall through */
1925                 default:
1926                         /* Should not happen. */
1927                         ath10k_warn(ar, "failed to extract amsdu: %d\n", ret);
1928                         htt->rx_confused = true;
1929                         __skb_queue_purge(&list);
1930                         return;
1931                 }
1932         }
1933
1934         tasklet_schedule(&htt->rx_replenish_task);
1935 }
1936
1937 static void ath10k_htt_rx_tx_fetch_resp_id_confirm(struct ath10k *ar,
1938                                                    const __le32 *resp_ids,
1939                                                    int num_resp_ids)
1940 {
1941         int i;
1942         u32 resp_id;
1943
1944         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx tx fetch confirm num_resp_ids %d\n",
1945                    num_resp_ids);
1946
1947         for (i = 0; i < num_resp_ids; i++) {
1948                 resp_id = le32_to_cpu(resp_ids[i]);
1949
1950                 ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx tx fetch confirm resp_id %u\n",
1951                            resp_id);
1952
1953                 /* TODO: free resp_id */
1954         }
1955 }
1956
1957 static void ath10k_htt_rx_tx_fetch_ind(struct ath10k *ar, struct sk_buff *skb)
1958 {
1959         struct ieee80211_hw *hw = ar->hw;
1960         struct ieee80211_txq *txq;
1961         struct htt_resp *resp = (struct htt_resp *)skb->data;
1962         struct htt_tx_fetch_record *record;
1963         size_t len;
1964         size_t max_num_bytes;
1965         size_t max_num_msdus;
1966         size_t num_bytes;
1967         size_t num_msdus;
1968         const __le32 *resp_ids;
1969         u16 num_records;
1970         u16 num_resp_ids;
1971         u16 peer_id;
1972         u8 tid;
1973         int ret;
1974         int i;
1975
1976         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx tx fetch ind\n");
1977
1978         len = sizeof(resp->hdr) + sizeof(resp->tx_fetch_ind);
1979         if (unlikely(skb->len < len)) {
1980                 ath10k_warn(ar, "received corrupted tx_fetch_ind event: buffer too short\n");
1981                 return;
1982         }
1983
1984         num_records = le16_to_cpu(resp->tx_fetch_ind.num_records);
1985         num_resp_ids = le16_to_cpu(resp->tx_fetch_ind.num_resp_ids);
1986
1987         len += sizeof(resp->tx_fetch_ind.records[0]) * num_records;
1988         len += sizeof(resp->tx_fetch_ind.resp_ids[0]) * num_resp_ids;
1989
1990         if (unlikely(skb->len < len)) {
1991                 ath10k_warn(ar, "received corrupted tx_fetch_ind event: too many records/resp_ids\n");
1992                 return;
1993         }
1994
1995         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx tx fetch ind num records %hu num resps %hu seq %hu\n",
1996                    num_records, num_resp_ids,
1997                    le16_to_cpu(resp->tx_fetch_ind.fetch_seq_num));
1998
1999         if (!ar->htt.tx_q_state.enabled) {
2000                 ath10k_warn(ar, "received unexpected tx_fetch_ind event: not enabled\n");
2001                 return;
2002         }
2003
2004         if (ar->htt.tx_q_state.mode == HTT_TX_MODE_SWITCH_PUSH) {
2005                 ath10k_warn(ar, "received unexpected tx_fetch_ind event: in push mode\n");
2006                 return;
2007         }
2008
2009         rcu_read_lock();
2010
2011         for (i = 0; i < num_records; i++) {
2012                 record = &resp->tx_fetch_ind.records[i];
2013                 peer_id = MS(le16_to_cpu(record->info),
2014                              HTT_TX_FETCH_RECORD_INFO_PEER_ID);
2015                 tid = MS(le16_to_cpu(record->info),
2016                          HTT_TX_FETCH_RECORD_INFO_TID);
2017                 max_num_msdus = le16_to_cpu(record->num_msdus);
2018                 max_num_bytes = le32_to_cpu(record->num_bytes);
2019
2020                 ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx tx fetch record %i peer_id %hu tid %hhu msdus %zu bytes %zu\n",
2021                            i, peer_id, tid, max_num_msdus, max_num_bytes);
2022
2023                 if (unlikely(peer_id >= ar->htt.tx_q_state.num_peers) ||
2024                     unlikely(tid >= ar->htt.tx_q_state.num_tids)) {
2025                         ath10k_warn(ar, "received out of range peer_id %hu tid %hhu\n",
2026                                     peer_id, tid);
2027                         continue;
2028                 }
2029
2030                 spin_lock_bh(&ar->data_lock);
2031                 txq = ath10k_mac_txq_lookup(ar, peer_id, tid);
2032                 spin_unlock_bh(&ar->data_lock);
2033
2034                 /* It is okay to release the lock and use txq because RCU read
2035                  * lock is held.
2036                  */
2037
2038                 if (unlikely(!txq)) {
2039                         ath10k_warn(ar, "failed to lookup txq for peer_id %hu tid %hhu\n",
2040                                     peer_id, tid);
2041                         continue;
2042                 }
2043
2044                 num_msdus = 0;
2045                 num_bytes = 0;
2046
2047                 while (num_msdus < max_num_msdus &&
2048                        num_bytes < max_num_bytes) {
2049                         ret = ath10k_mac_tx_push_txq(hw, txq);
2050                         if (ret < 0)
2051                                 break;
2052
2053                         num_msdus++;
2054                         num_bytes += ret;
2055                 }
2056
2057                 record->num_msdus = cpu_to_le16(num_msdus);
2058                 record->num_bytes = cpu_to_le32(num_bytes);
2059
2060                 ath10k_htt_tx_txq_recalc(hw, txq);
2061         }
2062
2063         rcu_read_unlock();
2064
2065         resp_ids = ath10k_htt_get_tx_fetch_ind_resp_ids(&resp->tx_fetch_ind);
2066         ath10k_htt_rx_tx_fetch_resp_id_confirm(ar, resp_ids, num_resp_ids);
2067
2068         ret = ath10k_htt_tx_fetch_resp(ar,
2069                                        resp->tx_fetch_ind.token,
2070                                        resp->tx_fetch_ind.fetch_seq_num,
2071                                        resp->tx_fetch_ind.records,
2072                                        num_records);
2073         if (unlikely(ret)) {
2074                 ath10k_warn(ar, "failed to submit tx fetch resp for token 0x%08x: %d\n",
2075                             le32_to_cpu(resp->tx_fetch_ind.token), ret);
2076                 /* FIXME: request fw restart */
2077         }
2078
2079         ath10k_htt_tx_txq_sync(ar);
2080 }
2081
2082 static void ath10k_htt_rx_tx_fetch_confirm(struct ath10k *ar,
2083                                            struct sk_buff *skb)
2084 {
2085         const struct htt_resp *resp = (void *)skb->data;
2086         size_t len;
2087         int num_resp_ids;
2088
2089         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx tx fetch confirm\n");
2090
2091         len = sizeof(resp->hdr) + sizeof(resp->tx_fetch_confirm);
2092         if (unlikely(skb->len < len)) {
2093                 ath10k_warn(ar, "received corrupted tx_fetch_confirm event: buffer too short\n");
2094                 return;
2095         }
2096
2097         num_resp_ids = le16_to_cpu(resp->tx_fetch_confirm.num_resp_ids);
2098         len += sizeof(resp->tx_fetch_confirm.resp_ids[0]) * num_resp_ids;
2099
2100         if (unlikely(skb->len < len)) {
2101                 ath10k_warn(ar, "received corrupted tx_fetch_confirm event: resp_ids buffer overflow\n");
2102                 return;
2103         }
2104
2105         ath10k_htt_rx_tx_fetch_resp_id_confirm(ar,
2106                                                resp->tx_fetch_confirm.resp_ids,
2107                                                num_resp_ids);
2108 }
2109
2110 static void ath10k_htt_rx_tx_mode_switch_ind(struct ath10k *ar,
2111                                              struct sk_buff *skb)
2112 {
2113         const struct htt_resp *resp = (void *)skb->data;
2114         const struct htt_tx_mode_switch_record *record;
2115         struct ieee80211_txq *txq;
2116         struct ath10k_txq *artxq;
2117         size_t len;
2118         size_t num_records;
2119         enum htt_tx_mode_switch_mode mode;
2120         bool enable;
2121         u16 info0;
2122         u16 info1;
2123         u16 threshold;
2124         u16 peer_id;
2125         u8 tid;
2126         int i;
2127
2128         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx tx mode switch ind\n");
2129
2130         len = sizeof(resp->hdr) + sizeof(resp->tx_mode_switch_ind);
2131         if (unlikely(skb->len < len)) {
2132                 ath10k_warn(ar, "received corrupted tx_mode_switch_ind event: buffer too short\n");
2133                 return;
2134         }
2135
2136         info0 = le16_to_cpu(resp->tx_mode_switch_ind.info0);
2137         info1 = le16_to_cpu(resp->tx_mode_switch_ind.info1);
2138
2139         enable = !!(info0 & HTT_TX_MODE_SWITCH_IND_INFO0_ENABLE);
2140         num_records = MS(info0, HTT_TX_MODE_SWITCH_IND_INFO1_THRESHOLD);
2141         mode = MS(info1, HTT_TX_MODE_SWITCH_IND_INFO1_MODE);
2142         threshold = MS(info1, HTT_TX_MODE_SWITCH_IND_INFO1_THRESHOLD);
2143
2144         ath10k_dbg(ar, ATH10K_DBG_HTT,
2145                    "htt rx tx mode switch ind info0 0x%04hx info1 0x%04hx enable %d num records %zd mode %d threshold %hu\n",
2146                    info0, info1, enable, num_records, mode, threshold);
2147
2148         len += sizeof(resp->tx_mode_switch_ind.records[0]) * num_records;
2149
2150         if (unlikely(skb->len < len)) {
2151                 ath10k_warn(ar, "received corrupted tx_mode_switch_mode_ind event: too many records\n");
2152                 return;
2153         }
2154
2155         switch (mode) {
2156         case HTT_TX_MODE_SWITCH_PUSH:
2157         case HTT_TX_MODE_SWITCH_PUSH_PULL:
2158                 break;
2159         default:
2160                 ath10k_warn(ar, "received invalid tx_mode_switch_mode_ind mode %d, ignoring\n",
2161                             mode);
2162                 return;
2163         }
2164
2165         if (!enable)
2166                 return;
2167
2168         ar->htt.tx_q_state.enabled = enable;
2169         ar->htt.tx_q_state.mode = mode;
2170         ar->htt.tx_q_state.num_push_allowed = threshold;
2171
2172         rcu_read_lock();
2173
2174         for (i = 0; i < num_records; i++) {
2175                 record = &resp->tx_mode_switch_ind.records[i];
2176                 info0 = le16_to_cpu(record->info0);
2177                 peer_id = MS(info0, HTT_TX_MODE_SWITCH_RECORD_INFO0_PEER_ID);
2178                 tid = MS(info0, HTT_TX_MODE_SWITCH_RECORD_INFO0_TID);
2179
2180                 if (unlikely(peer_id >= ar->htt.tx_q_state.num_peers) ||
2181                     unlikely(tid >= ar->htt.tx_q_state.num_tids)) {
2182                         ath10k_warn(ar, "received out of range peer_id %hu tid %hhu\n",
2183                                     peer_id, tid);
2184                         continue;
2185                 }
2186
2187                 spin_lock_bh(&ar->data_lock);
2188                 txq = ath10k_mac_txq_lookup(ar, peer_id, tid);
2189                 spin_unlock_bh(&ar->data_lock);
2190
2191                 /* It is okay to release the lock and use txq because RCU read
2192                  * lock is held.
2193                  */
2194
2195                 if (unlikely(!txq)) {
2196                         ath10k_warn(ar, "failed to lookup txq for peer_id %hu tid %hhu\n",
2197                                     peer_id, tid);
2198                         continue;
2199                 }
2200
2201                 spin_lock_bh(&ar->htt.tx_lock);
2202                 artxq = (void *)txq->drv_priv;
2203                 artxq->num_push_allowed = le16_to_cpu(record->num_max_msdus);
2204                 spin_unlock_bh(&ar->htt.tx_lock);
2205         }
2206
2207         rcu_read_unlock();
2208
2209         ath10k_mac_tx_push_pending(ar);
2210 }
2211
2212 static inline enum ieee80211_band phy_mode_to_band(u32 phy_mode)
2213 {
2214         enum ieee80211_band band;
2215
2216         switch (phy_mode) {
2217         case MODE_11A:
2218         case MODE_11NA_HT20:
2219         case MODE_11NA_HT40:
2220         case MODE_11AC_VHT20:
2221         case MODE_11AC_VHT40:
2222         case MODE_11AC_VHT80:
2223                 band = IEEE80211_BAND_5GHZ;
2224                 break;
2225         case MODE_11G:
2226         case MODE_11B:
2227         case MODE_11GONLY:
2228         case MODE_11NG_HT20:
2229         case MODE_11NG_HT40:
2230         case MODE_11AC_VHT20_2G:
2231         case MODE_11AC_VHT40_2G:
2232         case MODE_11AC_VHT80_2G:
2233         default:
2234                 band = IEEE80211_BAND_2GHZ;
2235         }
2236
2237         return band;
2238 }
2239
2240 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
2241 {
2242         struct ath10k_htt *htt = &ar->htt;
2243         struct htt_resp *resp = (struct htt_resp *)skb->data;
2244         enum htt_t2h_msg_type type;
2245
2246         /* confirm alignment */
2247         if (!IS_ALIGNED((unsigned long)skb->data, 4))
2248                 ath10k_warn(ar, "unaligned htt message, expect trouble\n");
2249
2250         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx, msg_type: 0x%0X\n",
2251                    resp->hdr.msg_type);
2252
2253         if (resp->hdr.msg_type >= ar->htt.t2h_msg_types_max) {
2254                 ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx, unsupported msg_type: 0x%0X\n max: 0x%0X",
2255                            resp->hdr.msg_type, ar->htt.t2h_msg_types_max);
2256                 dev_kfree_skb_any(skb);
2257                 return;
2258         }
2259         type = ar->htt.t2h_msg_types[resp->hdr.msg_type];
2260
2261         switch (type) {
2262         case HTT_T2H_MSG_TYPE_VERSION_CONF: {
2263                 htt->target_version_major = resp->ver_resp.major;
2264                 htt->target_version_minor = resp->ver_resp.minor;
2265                 complete(&htt->target_version_received);
2266                 break;
2267         }
2268         case HTT_T2H_MSG_TYPE_RX_IND:
2269                 skb_queue_tail(&htt->rx_compl_q, skb);
2270                 tasklet_schedule(&htt->txrx_compl_task);
2271                 return;
2272         case HTT_T2H_MSG_TYPE_PEER_MAP: {
2273                 struct htt_peer_map_event ev = {
2274                         .vdev_id = resp->peer_map.vdev_id,
2275                         .peer_id = __le16_to_cpu(resp->peer_map.peer_id),
2276                 };
2277                 memcpy(ev.addr, resp->peer_map.addr, sizeof(ev.addr));
2278                 ath10k_peer_map_event(htt, &ev);
2279                 break;
2280         }
2281         case HTT_T2H_MSG_TYPE_PEER_UNMAP: {
2282                 struct htt_peer_unmap_event ev = {
2283                         .peer_id = __le16_to_cpu(resp->peer_unmap.peer_id),
2284                 };
2285                 ath10k_peer_unmap_event(htt, &ev);
2286                 break;
2287         }
2288         case HTT_T2H_MSG_TYPE_MGMT_TX_COMPLETION: {
2289                 struct htt_tx_done tx_done = {};
2290                 int status = __le32_to_cpu(resp->mgmt_tx_completion.status);
2291
2292                 tx_done.msdu_id = __le32_to_cpu(resp->mgmt_tx_completion.desc_id);
2293
2294                 switch (status) {
2295                 case HTT_MGMT_TX_STATUS_OK:
2296                         tx_done.status = HTT_TX_COMPL_STATE_ACK;
2297                         break;
2298                 case HTT_MGMT_TX_STATUS_RETRY:
2299                         tx_done.status = HTT_TX_COMPL_STATE_NOACK;
2300                         break;
2301                 case HTT_MGMT_TX_STATUS_DROP:
2302                         tx_done.status = HTT_TX_COMPL_STATE_DISCARD;
2303                         break;
2304                 }
2305
2306                 status = ath10k_txrx_tx_unref(htt, &tx_done);
2307                 if (!status) {
2308                         spin_lock_bh(&htt->tx_lock);
2309                         ath10k_htt_tx_mgmt_dec_pending(htt);
2310                         spin_unlock_bh(&htt->tx_lock);
2311                 }
2312                 ath10k_mac_tx_push_pending(ar);
2313                 break;
2314         }
2315         case HTT_T2H_MSG_TYPE_TX_COMPL_IND:
2316                 ath10k_htt_rx_tx_compl_ind(htt->ar, skb);
2317                 tasklet_schedule(&htt->txrx_compl_task);
2318                 break;
2319         case HTT_T2H_MSG_TYPE_SEC_IND: {
2320                 struct ath10k *ar = htt->ar;
2321                 struct htt_security_indication *ev = &resp->security_indication;
2322
2323                 ath10k_dbg(ar, ATH10K_DBG_HTT,
2324                            "sec ind peer_id %d unicast %d type %d\n",
2325                           __le16_to_cpu(ev->peer_id),
2326                           !!(ev->flags & HTT_SECURITY_IS_UNICAST),
2327                           MS(ev->flags, HTT_SECURITY_TYPE));
2328                 complete(&ar->install_key_done);
2329                 break;
2330         }
2331         case HTT_T2H_MSG_TYPE_RX_FRAG_IND: {
2332                 ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
2333                                 skb->data, skb->len);
2334                 ath10k_htt_rx_frag_handler(htt, &resp->rx_frag_ind);
2335                 break;
2336         }
2337         case HTT_T2H_MSG_TYPE_TEST:
2338                 break;
2339         case HTT_T2H_MSG_TYPE_STATS_CONF:
2340                 trace_ath10k_htt_stats(ar, skb->data, skb->len);
2341                 break;
2342         case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
2343                 /* Firmware can return tx frames if it's unable to fully
2344                  * process them and suspects host may be able to fix it. ath10k
2345                  * sends all tx frames as already inspected so this shouldn't
2346                  * happen unless fw has a bug.
2347                  */
2348                 ath10k_warn(ar, "received an unexpected htt tx inspect event\n");
2349                 break;
2350         case HTT_T2H_MSG_TYPE_RX_ADDBA:
2351                 ath10k_htt_rx_addba(ar, resp);
2352                 break;
2353         case HTT_T2H_MSG_TYPE_RX_DELBA:
2354                 ath10k_htt_rx_delba(ar, resp);
2355                 break;
2356         case HTT_T2H_MSG_TYPE_PKTLOG: {
2357                 struct ath10k_pktlog_hdr *hdr =
2358                         (struct ath10k_pktlog_hdr *)resp->pktlog_msg.payload;
2359
2360                 trace_ath10k_htt_pktlog(ar, resp->pktlog_msg.payload,
2361                                         sizeof(*hdr) +
2362                                         __le16_to_cpu(hdr->size));
2363                 break;
2364         }
2365         case HTT_T2H_MSG_TYPE_RX_FLUSH: {
2366                 /* Ignore this event because mac80211 takes care of Rx
2367                  * aggregation reordering.
2368                  */
2369                 break;
2370         }
2371         case HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND: {
2372                 skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
2373                 tasklet_schedule(&htt->txrx_compl_task);
2374                 return;
2375         }
2376         case HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND:
2377                 break;
2378         case HTT_T2H_MSG_TYPE_CHAN_CHANGE: {
2379                 u32 phymode = __le32_to_cpu(resp->chan_change.phymode);
2380                 u32 freq = __le32_to_cpu(resp->chan_change.freq);
2381
2382                 ar->tgt_oper_chan =
2383                         __ieee80211_get_channel(ar->hw->wiphy, freq);
2384                 ath10k_dbg(ar, ATH10K_DBG_HTT,
2385                            "htt chan change freq %u phymode %s\n",
2386                            freq, ath10k_wmi_phymode_str(phymode));
2387                 break;
2388         }
2389         case HTT_T2H_MSG_TYPE_AGGR_CONF:
2390                 break;
2391         case HTT_T2H_MSG_TYPE_TX_FETCH_IND: {
2392                 struct sk_buff *tx_fetch_ind = skb_copy(skb, GFP_ATOMIC);
2393
2394                 if (!tx_fetch_ind) {
2395                         ath10k_warn(ar, "failed to copy htt tx fetch ind\n");
2396                         break;
2397                 }
2398                 skb_queue_tail(&htt->tx_fetch_ind_q, tx_fetch_ind);
2399                 tasklet_schedule(&htt->txrx_compl_task);
2400                 break;
2401         }
2402         case HTT_T2H_MSG_TYPE_TX_FETCH_CONFIRM:
2403                 ath10k_htt_rx_tx_fetch_confirm(ar, skb);
2404                 break;
2405         case HTT_T2H_MSG_TYPE_TX_MODE_SWITCH_IND:
2406                 ath10k_htt_rx_tx_mode_switch_ind(ar, skb);
2407                 break;
2408         case HTT_T2H_MSG_TYPE_EN_STATS:
2409         default:
2410                 ath10k_warn(ar, "htt event (%d) not handled\n",
2411                             resp->hdr.msg_type);
2412                 ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
2413                                 skb->data, skb->len);
2414                 break;
2415         };
2416
2417         /* Free the indication buffer */
2418         dev_kfree_skb_any(skb);
2419 }
2420 EXPORT_SYMBOL(ath10k_htt_t2h_msg_handler);
2421
2422 void ath10k_htt_rx_pktlog_completion_handler(struct ath10k *ar,
2423                                              struct sk_buff *skb)
2424 {
2425         trace_ath10k_htt_pktlog(ar, skb->data, skb->len);
2426         dev_kfree_skb_any(skb);
2427 }
2428 EXPORT_SYMBOL(ath10k_htt_rx_pktlog_completion_handler);
2429
2430 static void ath10k_htt_txrx_compl_task(unsigned long ptr)
2431 {
2432         struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
2433         struct ath10k *ar = htt->ar;
2434         struct htt_tx_done tx_done = {};
2435         struct sk_buff_head rx_q;
2436         struct sk_buff_head rx_ind_q;
2437         struct sk_buff_head tx_ind_q;
2438         struct htt_resp *resp;
2439         struct sk_buff *skb;
2440         unsigned long flags;
2441
2442         __skb_queue_head_init(&rx_q);
2443         __skb_queue_head_init(&rx_ind_q);
2444         __skb_queue_head_init(&tx_ind_q);
2445
2446         spin_lock_irqsave(&htt->rx_compl_q.lock, flags);
2447         skb_queue_splice_init(&htt->rx_compl_q, &rx_q);
2448         spin_unlock_irqrestore(&htt->rx_compl_q.lock, flags);
2449
2450         spin_lock_irqsave(&htt->rx_in_ord_compl_q.lock, flags);
2451         skb_queue_splice_init(&htt->rx_in_ord_compl_q, &rx_ind_q);
2452         spin_unlock_irqrestore(&htt->rx_in_ord_compl_q.lock, flags);
2453
2454         spin_lock_irqsave(&htt->tx_fetch_ind_q.lock, flags);
2455         skb_queue_splice_init(&htt->tx_fetch_ind_q, &tx_ind_q);
2456         spin_unlock_irqrestore(&htt->tx_fetch_ind_q.lock, flags);
2457
2458         /* kfifo_get: called only within txrx_tasklet so it's neatly serialized.
2459          * From kfifo_get() documentation:
2460          *  Note that with only one concurrent reader and one concurrent writer,
2461          *  you don't need extra locking to use these macro.
2462          */
2463         while (kfifo_get(&htt->txdone_fifo, &tx_done))
2464                 ath10k_txrx_tx_unref(htt, &tx_done);
2465
2466         while ((skb = __skb_dequeue(&tx_ind_q))) {
2467                 ath10k_htt_rx_tx_fetch_ind(ar, skb);
2468                 dev_kfree_skb_any(skb);
2469         }
2470
2471         ath10k_mac_tx_push_pending(ar);
2472
2473         while ((skb = __skb_dequeue(&rx_q))) {
2474                 resp = (struct htt_resp *)skb->data;
2475                 spin_lock_bh(&htt->rx_ring.lock);
2476                 ath10k_htt_rx_handler(htt, &resp->rx_ind);
2477                 spin_unlock_bh(&htt->rx_ring.lock);
2478                 dev_kfree_skb_any(skb);
2479         }
2480
2481         while ((skb = __skb_dequeue(&rx_ind_q))) {
2482                 spin_lock_bh(&htt->rx_ring.lock);
2483                 ath10k_htt_rx_in_ord_ind(ar, skb);
2484                 spin_unlock_bh(&htt->rx_ring.lock);
2485                 dev_kfree_skb_any(skb);
2486         }
2487 }