1022 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/******************************************************************************3 *4 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.5 * Copyright(c) 2015 Intel Deutschland GmbH6 * Copyright(c) 2018, 2020-2021 Intel Corporation7 *8 * Portions of this file are derived from the ipw3945 project, as well9 * as portionhelp of the ieee80211 subsystem header files.10 *****************************************************************************/11 12#include <linux/etherdevice.h>13#include <linux/slab.h>14#include <linux/sched.h>15#include <net/mac80211.h>16#include <linux/unaligned.h>17 18#include "iwl-trans.h"19#include "iwl-io.h"20#include "dev.h"21#include "calib.h"22#include "agn.h"23 24/******************************************************************************25 *26 * Generic RX handler implementations27 *28 ******************************************************************************/29 30static void iwlagn_rx_reply_error(struct iwl_priv *priv,31 struct iwl_rx_cmd_buffer *rxb)32{33 struct iwl_rx_packet *pkt = rxb_addr(rxb);34 struct iwl_error_resp *err_resp = (void *)pkt->data;35 36 IWL_ERR(priv, "Error Reply type 0x%08X cmd REPLY_ERROR (0x%02X) "37 "seq 0x%04X ser 0x%08X\n",38 le32_to_cpu(err_resp->error_type),39 err_resp->cmd_id,40 le16_to_cpu(err_resp->bad_cmd_seq_num),41 le32_to_cpu(err_resp->error_info));42}43 44static void iwlagn_rx_csa(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)45{46 struct iwl_rx_packet *pkt = rxb_addr(rxb);47 struct iwl_csa_notification *csa = (void *)pkt->data;48 /*49 * MULTI-FIXME50 * See iwlagn_mac_channel_switch.51 */52 struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];53 struct iwl_rxon_cmd *rxon = (void *)&ctx->active;54 55 if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))56 return;57 58 if (!le32_to_cpu(csa->status) && csa->channel == priv->switch_channel) {59 rxon->channel = csa->channel;60 ctx->staging.channel = csa->channel;61 IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",62 le16_to_cpu(csa->channel));63 iwl_chswitch_done(priv, true);64 } else {65 IWL_ERR(priv, "CSA notif (fail) : channel %d\n",66 le16_to_cpu(csa->channel));67 iwl_chswitch_done(priv, false);68 }69}70 71 72static void iwlagn_rx_spectrum_measure_notif(struct iwl_priv *priv,73 struct iwl_rx_cmd_buffer *rxb)74{75 struct iwl_rx_packet *pkt = rxb_addr(rxb);76 struct iwl_spectrum_notification *report = (void *)pkt->data;77 78 if (!report->state) {79 IWL_DEBUG_11H(priv,80 "Spectrum Measure Notification: Start\n");81 return;82 }83 84 memcpy(&priv->measure_report, report, sizeof(*report));85 priv->measurement_status |= MEASUREMENT_READY;86}87 88static void iwlagn_rx_pm_sleep_notif(struct iwl_priv *priv,89 struct iwl_rx_cmd_buffer *rxb)90{91#ifdef CONFIG_IWLWIFI_DEBUG92 struct iwl_rx_packet *pkt = rxb_addr(rxb);93 struct iwl_sleep_notification *sleep = (void *)pkt->data;94 IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",95 sleep->pm_sleep_mode, sleep->pm_wakeup_src);96#endif97}98 99static void iwlagn_rx_pm_debug_statistics_notif(struct iwl_priv *priv,100 struct iwl_rx_cmd_buffer *rxb)101{102 struct iwl_rx_packet *pkt = rxb_addr(rxb);103 u32 __maybe_unused len = iwl_rx_packet_len(pkt);104 IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "105 "notification for PM_DEBUG_STATISTIC_NOTIFIC:\n", len);106 iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->data, len);107}108 109static void iwlagn_rx_beacon_notif(struct iwl_priv *priv,110 struct iwl_rx_cmd_buffer *rxb)111{112 struct iwl_rx_packet *pkt = rxb_addr(rxb);113 struct iwlagn_beacon_notif *beacon = (void *)pkt->data;114#ifdef CONFIG_IWLWIFI_DEBUG115 u16 status = le16_to_cpu(beacon->beacon_notify_hdr.status.status);116 u8 rate = iwl_hw_get_rate(beacon->beacon_notify_hdr.rate_n_flags);117 118 IWL_DEBUG_RX(priv, "beacon status %#x, retries:%d ibssmgr:%d "119 "tsf:0x%.8x%.8x rate:%d\n",120 status & TX_STATUS_MSK,121 beacon->beacon_notify_hdr.failure_frame,122 le32_to_cpu(beacon->ibss_mgr_status),123 le32_to_cpu(beacon->high_tsf),124 le32_to_cpu(beacon->low_tsf), rate);125#endif126 127 priv->ibss_manager = le32_to_cpu(beacon->ibss_mgr_status);128}129 130/*131 * iwl_good_plcp_health - checks for plcp error.132 *133 * When the plcp error is exceeding the thresholds, reset the radio134 * to improve the throughput.135 */136static bool iwlagn_good_plcp_health(struct iwl_priv *priv,137 struct statistics_rx_phy *cur_ofdm,138 struct statistics_rx_ht_phy *cur_ofdm_ht,139 unsigned int msecs)140{141 int delta;142 int threshold = priv->plcp_delta_threshold;143 144 if (threshold == IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE) {145 IWL_DEBUG_RADIO(priv, "plcp_err check disabled\n");146 return true;147 }148 149 delta = le32_to_cpu(cur_ofdm->plcp_err) -150 le32_to_cpu(priv->statistics.rx_ofdm.plcp_err) +151 le32_to_cpu(cur_ofdm_ht->plcp_err) -152 le32_to_cpu(priv->statistics.rx_ofdm_ht.plcp_err);153 154 /* Can be negative if firmware reset statistics */155 if (delta <= 0)156 return true;157 158 if ((delta * 100 / msecs) > threshold) {159 IWL_DEBUG_RADIO(priv,160 "plcp health threshold %u delta %d msecs %u\n",161 threshold, delta, msecs);162 return false;163 }164 165 return true;166}167 168int iwl_force_rf_reset(struct iwl_priv *priv, bool external)169{170 struct iwl_rf_reset *rf_reset;171 172 if (test_bit(STATUS_EXIT_PENDING, &priv->status))173 return -EAGAIN;174 175 if (!iwl_is_any_associated(priv)) {176 IWL_DEBUG_SCAN(priv, "force reset rejected: not associated\n");177 return -ENOLINK;178 }179 180 rf_reset = &priv->rf_reset;181 rf_reset->reset_request_count++;182 if (!external && rf_reset->last_reset_jiffies &&183 time_after(rf_reset->last_reset_jiffies +184 IWL_DELAY_NEXT_FORCE_RF_RESET, jiffies)) {185 IWL_DEBUG_INFO(priv, "RF reset rejected\n");186 rf_reset->reset_reject_count++;187 return -EAGAIN;188 }189 rf_reset->reset_success_count++;190 rf_reset->last_reset_jiffies = jiffies;191 192 /*193 * There is no easy and better way to force reset the radio,194 * the only known method is switching channel which will force to195 * reset and tune the radio.196 * Use internal short scan (single channel) operation to should197 * achieve this objective.198 * Driver should reset the radio when number of consecutive missed199 * beacon, or any other uCode error condition detected.200 */201 IWL_DEBUG_INFO(priv, "perform radio reset.\n");202 iwl_internal_short_hw_scan(priv);203 return 0;204}205 206 207static void iwlagn_recover_from_statistics(struct iwl_priv *priv,208 struct statistics_rx_phy *cur_ofdm,209 struct statistics_rx_ht_phy *cur_ofdm_ht,210 struct statistics_tx *tx,211 unsigned long stamp)212{213 unsigned int msecs;214 215 if (test_bit(STATUS_EXIT_PENDING, &priv->status))216 return;217 218 msecs = jiffies_to_msecs(stamp - priv->rx_statistics_jiffies);219 220 /* Only gather statistics and update time stamp when not associated */221 if (!iwl_is_any_associated(priv))222 return;223 224 /* Do not check/recover when do not have enough statistics data */225 if (msecs < 99)226 return;227 228 if (!iwlagn_good_plcp_health(priv, cur_ofdm, cur_ofdm_ht, msecs))229 iwl_force_rf_reset(priv, false);230}231 232/* Calculate noise level, based on measurements during network silence just233 * before arriving beacon. This measurement can be done only if we know234 * exactly when to expect beacons, therefore only when we're associated. */235static void iwlagn_rx_calc_noise(struct iwl_priv *priv)236{237 struct statistics_rx_non_phy *rx_info;238 int num_active_rx = 0;239 int total_silence = 0;240 int bcn_silence_a, bcn_silence_b, bcn_silence_c;241 int last_rx_noise;242 243 rx_info = &priv->statistics.rx_non_phy;244 245 bcn_silence_a =246 le32_to_cpu(rx_info->beacon_silence_rssi_a) & IN_BAND_FILTER;247 bcn_silence_b =248 le32_to_cpu(rx_info->beacon_silence_rssi_b) & IN_BAND_FILTER;249 bcn_silence_c =250 le32_to_cpu(rx_info->beacon_silence_rssi_c) & IN_BAND_FILTER;251 252 if (bcn_silence_a) {253 total_silence += bcn_silence_a;254 num_active_rx++;255 }256 if (bcn_silence_b) {257 total_silence += bcn_silence_b;258 num_active_rx++;259 }260 if (bcn_silence_c) {261 total_silence += bcn_silence_c;262 num_active_rx++;263 }264 265 /* Average among active antennas */266 if (num_active_rx)267 last_rx_noise = (total_silence / num_active_rx) - 107;268 else269 last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;270 271 IWL_DEBUG_CALIB(priv, "inband silence a %u, b %u, c %u, dBm %d\n",272 bcn_silence_a, bcn_silence_b, bcn_silence_c,273 last_rx_noise);274}275 276#ifdef CONFIG_IWLWIFI_DEBUGFS277/*278 * based on the assumption of all statistics counter are in DWORD279 * FIXME: This function is for debugging, do not deal with280 * the case of counters roll-over.281 */282static void accum_stats(__le32 *prev, __le32 *cur, __le32 *delta,283 __le32 *max_delta, __le32 *accum, int size)284{285 int i;286 287 for (i = 0;288 i < size / sizeof(__le32);289 i++, prev++, cur++, delta++, max_delta++, accum++) {290 if (le32_to_cpu(*cur) > le32_to_cpu(*prev)) {291 *delta = cpu_to_le32(292 le32_to_cpu(*cur) - le32_to_cpu(*prev));293 le32_add_cpu(accum, le32_to_cpu(*delta));294 if (le32_to_cpu(*delta) > le32_to_cpu(*max_delta))295 *max_delta = *delta;296 }297 }298}299 300static void301iwlagn_accumulative_statistics(struct iwl_priv *priv,302 struct statistics_general_common *common,303 struct statistics_rx_non_phy *rx_non_phy,304 struct statistics_rx_phy *rx_ofdm,305 struct statistics_rx_ht_phy *rx_ofdm_ht,306 struct statistics_rx_phy *rx_cck,307 struct statistics_tx *tx,308 struct statistics_bt_activity *bt_activity)309{310#define ACCUM(_name) \311 accum_stats((__le32 *)&priv->statistics._name, \312 (__le32 *)_name, \313 (__le32 *)&priv->delta_stats._name, \314 (__le32 *)&priv->max_delta_stats._name, \315 (__le32 *)&priv->accum_stats._name, \316 sizeof(*_name))317 318 ACCUM(common);319 ACCUM(rx_non_phy);320 ACCUM(rx_ofdm);321 ACCUM(rx_ofdm_ht);322 ACCUM(rx_cck);323 ACCUM(tx);324 if (bt_activity)325 ACCUM(bt_activity);326#undef ACCUM327}328#else329static inline void330iwlagn_accumulative_statistics(struct iwl_priv *priv,331 struct statistics_general_common *common,332 struct statistics_rx_non_phy *rx_non_phy,333 struct statistics_rx_phy *rx_ofdm,334 struct statistics_rx_ht_phy *rx_ofdm_ht,335 struct statistics_rx_phy *rx_cck,336 struct statistics_tx *tx,337 struct statistics_bt_activity *bt_activity)338{339}340#endif341 342static void iwlagn_rx_statistics(struct iwl_priv *priv,343 struct iwl_rx_cmd_buffer *rxb)344{345 unsigned long stamp = jiffies;346 const int reg_recalib_period = 60;347 int change;348 struct iwl_rx_packet *pkt = rxb_addr(rxb);349 u32 len = iwl_rx_packet_payload_len(pkt);350 __le32 *flag;351 struct statistics_general_common *common;352 struct statistics_rx_non_phy *rx_non_phy;353 struct statistics_rx_phy *rx_ofdm;354 struct statistics_rx_ht_phy *rx_ofdm_ht;355 struct statistics_rx_phy *rx_cck;356 struct statistics_tx *tx;357 struct statistics_bt_activity *bt_activity;358 359 IWL_DEBUG_RX(priv, "Statistics notification received (%d bytes).\n",360 len);361 362 spin_lock(&priv->statistics.lock);363 364 if (len == sizeof(struct iwl_bt_notif_statistics)) {365 struct iwl_bt_notif_statistics *stats;366 stats = (void *)&pkt->data;367 flag = &stats->flag;368 common = &stats->general.common;369 rx_non_phy = &stats->rx.general.common;370 rx_ofdm = &stats->rx.ofdm;371 rx_ofdm_ht = &stats->rx.ofdm_ht;372 rx_cck = &stats->rx.cck;373 tx = &stats->tx;374 bt_activity = &stats->general.activity;375 376#ifdef CONFIG_IWLWIFI_DEBUGFS377 /* handle this exception directly */378 priv->statistics.num_bt_kills = stats->rx.general.num_bt_kills;379 le32_add_cpu(&priv->statistics.accum_num_bt_kills,380 le32_to_cpu(stats->rx.general.num_bt_kills));381#endif382 } else if (len == sizeof(struct iwl_notif_statistics)) {383 struct iwl_notif_statistics *stats;384 stats = (void *)&pkt->data;385 flag = &stats->flag;386 common = &stats->general.common;387 rx_non_phy = &stats->rx.general;388 rx_ofdm = &stats->rx.ofdm;389 rx_ofdm_ht = &stats->rx.ofdm_ht;390 rx_cck = &stats->rx.cck;391 tx = &stats->tx;392 bt_activity = NULL;393 } else {394 WARN_ONCE(1, "len %d doesn't match BT (%zu) or normal (%zu)\n",395 len, sizeof(struct iwl_bt_notif_statistics),396 sizeof(struct iwl_notif_statistics));397 spin_unlock(&priv->statistics.lock);398 return;399 }400 401 change = common->temperature != priv->statistics.common.temperature ||402 (*flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=403 (priv->statistics.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK);404 405 iwlagn_accumulative_statistics(priv, common, rx_non_phy, rx_ofdm,406 rx_ofdm_ht, rx_cck, tx, bt_activity);407 408 iwlagn_recover_from_statistics(priv, rx_ofdm, rx_ofdm_ht, tx, stamp);409 410 priv->statistics.flag = *flag;411 memcpy(&priv->statistics.common, common, sizeof(*common));412 memcpy(&priv->statistics.rx_non_phy, rx_non_phy, sizeof(*rx_non_phy));413 memcpy(&priv->statistics.rx_ofdm, rx_ofdm, sizeof(*rx_ofdm));414 memcpy(&priv->statistics.rx_ofdm_ht, rx_ofdm_ht, sizeof(*rx_ofdm_ht));415 memcpy(&priv->statistics.rx_cck, rx_cck, sizeof(*rx_cck));416 memcpy(&priv->statistics.tx, tx, sizeof(*tx));417#ifdef CONFIG_IWLWIFI_DEBUGFS418 if (bt_activity)419 memcpy(&priv->statistics.bt_activity, bt_activity,420 sizeof(*bt_activity));421#endif422 423 priv->rx_statistics_jiffies = stamp;424 425 set_bit(STATUS_STATISTICS, &priv->status);426 427 /* Reschedule the statistics timer to occur in428 * reg_recalib_period seconds to ensure we get a429 * thermal update even if the uCode doesn't give430 * us one */431 mod_timer(&priv->statistics_periodic, jiffies +432 msecs_to_jiffies(reg_recalib_period * 1000));433 434 if (unlikely(!test_bit(STATUS_SCANNING, &priv->status)) &&435 (pkt->hdr.cmd == STATISTICS_NOTIFICATION)) {436 iwlagn_rx_calc_noise(priv);437 queue_work(priv->workqueue, &priv->run_time_calib_work);438 }439 if (priv->lib->temperature && change)440 priv->lib->temperature(priv);441 442 spin_unlock(&priv->statistics.lock);443}444 445static void iwlagn_rx_reply_statistics(struct iwl_priv *priv,446 struct iwl_rx_cmd_buffer *rxb)447{448 struct iwl_rx_packet *pkt = rxb_addr(rxb);449 struct iwl_notif_statistics *stats = (void *)pkt->data;450 451 if (le32_to_cpu(stats->flag) & UCODE_STATISTICS_CLEAR_MSK) {452#ifdef CONFIG_IWLWIFI_DEBUGFS453 memset(&priv->accum_stats, 0,454 sizeof(priv->accum_stats));455 memset(&priv->delta_stats, 0,456 sizeof(priv->delta_stats));457 memset(&priv->max_delta_stats, 0,458 sizeof(priv->max_delta_stats));459#endif460 IWL_DEBUG_RX(priv, "Statistics have been cleared\n");461 }462 463 iwlagn_rx_statistics(priv, rxb);464}465 466/* Handle notification from uCode that card's power state is changing467 * due to software, hardware, or critical temperature RFKILL */468static void iwlagn_rx_card_state_notif(struct iwl_priv *priv,469 struct iwl_rx_cmd_buffer *rxb)470{471 struct iwl_rx_packet *pkt = rxb_addr(rxb);472 struct iwl_card_state_notif *card_state_notif = (void *)pkt->data;473 u32 flags = le32_to_cpu(card_state_notif->flags);474 unsigned long status = priv->status;475 476 IWL_DEBUG_RF_KILL(priv, "Card state received: HW:%s SW:%s CT:%s\n",477 (flags & HW_CARD_DISABLED) ? "Kill" : "On",478 (flags & SW_CARD_DISABLED) ? "Kill" : "On",479 (flags & CT_CARD_DISABLED) ?480 "Reached" : "Not reached");481 482 if (flags & (SW_CARD_DISABLED | HW_CARD_DISABLED |483 CT_CARD_DISABLED)) {484 485 iwl_write32(priv->trans, CSR_UCODE_DRV_GP1_SET,486 CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);487 488 iwl_write_direct32(priv->trans, HBUS_TARG_MBX_C,489 HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);490 491 if (!(flags & RXON_CARD_DISABLED)) {492 iwl_write32(priv->trans, CSR_UCODE_DRV_GP1_CLR,493 CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);494 iwl_write_direct32(priv->trans, HBUS_TARG_MBX_C,495 HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);496 }497 if (flags & CT_CARD_DISABLED)498 iwl_tt_enter_ct_kill(priv);499 }500 if (!(flags & CT_CARD_DISABLED))501 iwl_tt_exit_ct_kill(priv);502 503 if (flags & HW_CARD_DISABLED)504 set_bit(STATUS_RF_KILL_HW, &priv->status);505 else506 clear_bit(STATUS_RF_KILL_HW, &priv->status);507 508 509 if (!(flags & RXON_CARD_DISABLED))510 iwl_scan_cancel(priv);511 512 if ((test_bit(STATUS_RF_KILL_HW, &status) !=513 test_bit(STATUS_RF_KILL_HW, &priv->status)))514 wiphy_rfkill_set_hw_state(priv->hw->wiphy,515 test_bit(STATUS_RF_KILL_HW, &priv->status));516}517 518static void iwlagn_rx_missed_beacon_notif(struct iwl_priv *priv,519 struct iwl_rx_cmd_buffer *rxb)520 521{522 struct iwl_rx_packet *pkt = rxb_addr(rxb);523 struct iwl_missed_beacon_notif *missed_beacon = (void *)pkt->data;524 525 if (le32_to_cpu(missed_beacon->consecutive_missed_beacons) >526 priv->missed_beacon_threshold) {527 IWL_DEBUG_CALIB(priv,528 "missed bcn cnsq %d totl %d rcd %d expctd %d\n",529 le32_to_cpu(missed_beacon->consecutive_missed_beacons),530 le32_to_cpu(missed_beacon->total_missed_becons),531 le32_to_cpu(missed_beacon->num_recvd_beacons),532 le32_to_cpu(missed_beacon->num_expected_beacons));533 if (!test_bit(STATUS_SCANNING, &priv->status))534 iwl_init_sensitivity(priv);535 }536}537 538/* Cache phy data (Rx signal strength, etc) for HT frame (REPLY_RX_PHY_CMD).539 * This will be used later in iwl_rx_reply_rx() for REPLY_RX_MPDU_CMD. */540static void iwlagn_rx_reply_rx_phy(struct iwl_priv *priv,541 struct iwl_rx_cmd_buffer *rxb)542{543 struct iwl_rx_packet *pkt = rxb_addr(rxb);544 545 priv->last_phy_res_valid = true;546 priv->ampdu_ref++;547 memcpy(&priv->last_phy_res, pkt->data,548 sizeof(struct iwl_rx_phy_res));549}550 551/*552 * returns non-zero if packet should be dropped553 */554static int iwlagn_set_decrypted_flag(struct iwl_priv *priv,555 struct ieee80211_hdr *hdr,556 u32 decrypt_res,557 struct ieee80211_rx_status *stats)558{559 u16 fc = le16_to_cpu(hdr->frame_control);560 561 /*562 * All contexts have the same setting here due to it being563 * a module parameter, so OK to check any context.564 */565 if (priv->contexts[IWL_RXON_CTX_BSS].active.filter_flags &566 RXON_FILTER_DIS_DECRYPT_MSK)567 return 0;568 569 if (!(fc & IEEE80211_FCTL_PROTECTED))570 return 0;571 572 IWL_DEBUG_RX(priv, "decrypt_res:0x%x\n", decrypt_res);573 switch (decrypt_res & RX_RES_STATUS_SEC_TYPE_MSK) {574 case RX_RES_STATUS_SEC_TYPE_TKIP:575 /* The uCode has got a bad phase 1 Key, pushes the packet.576 * Decryption will be done in SW. */577 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==578 RX_RES_STATUS_BAD_KEY_TTAK)579 break;580 fallthrough;581 case RX_RES_STATUS_SEC_TYPE_WEP:582 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==583 RX_RES_STATUS_BAD_ICV_MIC) {584 /* bad ICV, the packet is destroyed since the585 * decryption is inplace, drop it */586 IWL_DEBUG_RX(priv, "Packet destroyed\n");587 return -1;588 }589 fallthrough;590 case RX_RES_STATUS_SEC_TYPE_CCMP:591 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==592 RX_RES_STATUS_DECRYPT_OK) {593 IWL_DEBUG_RX(priv, "hw decrypt successfully!!!\n");594 stats->flag |= RX_FLAG_DECRYPTED;595 }596 break;597 598 default:599 break;600 }601 return 0;602}603 604static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,605 struct ieee80211_hdr *hdr,606 u16 len,607 u32 ampdu_status,608 struct iwl_rx_cmd_buffer *rxb,609 struct ieee80211_rx_status *stats)610{611 struct sk_buff *skb;612 __le16 fc = hdr->frame_control;613 struct iwl_rxon_context *ctx;614 unsigned int hdrlen, fraglen;615 616 /* We only process data packets if the interface is open */617 if (unlikely(!priv->is_open)) {618 IWL_DEBUG_DROP_LIMIT(priv,619 "Dropping packet while interface is not open.\n");620 return;621 }622 623 /* In case of HW accelerated crypto and bad decryption, drop */624 if (!iwlwifi_mod_params.swcrypto &&625 iwlagn_set_decrypted_flag(priv, hdr, ampdu_status, stats))626 return;627 628 /* Dont use dev_alloc_skb(), we'll have enough headroom once629 * ieee80211_hdr pulled.630 */631 skb = alloc_skb(128, GFP_ATOMIC);632 if (!skb) {633 IWL_ERR(priv, "alloc_skb failed\n");634 return;635 }636 /* If frame is small enough to fit in skb->head, pull it completely.637 * If not, only pull ieee80211_hdr so that splice() or TCP coalesce638 * are more efficient.639 */640 hdrlen = (len <= skb_tailroom(skb)) ? len : sizeof(*hdr);641 642 skb_put_data(skb, hdr, hdrlen);643 fraglen = len - hdrlen;644 645 if (fraglen) {646 int offset = (void *)hdr + hdrlen -647 rxb_addr(rxb) + rxb_offset(rxb);648 649 skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,650 fraglen, rxb->truesize);651 }652 653 /*654 * Wake any queues that were stopped due to a passive channel tx655 * failure. This can happen because the regulatory enforcement in656 * the device waits for a beacon before allowing transmission,657 * sometimes even after already having transmitted frames for the658 * association because the new RXON may reset the information.659 */660 if (unlikely(ieee80211_is_beacon(fc) && priv->passive_no_rx)) {661 for_each_context(priv, ctx) {662 if (!ether_addr_equal(hdr->addr3,663 ctx->active.bssid_addr))664 continue;665 iwlagn_lift_passive_no_rx(priv);666 }667 }668 669 memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));670 671 ieee80211_rx_napi(priv->hw, NULL, skb, priv->napi);672}673 674static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)675{676 u32 decrypt_out = 0;677 678 if ((decrypt_in & RX_RES_STATUS_STATION_FOUND) ==679 RX_RES_STATUS_STATION_FOUND)680 decrypt_out |= (RX_RES_STATUS_STATION_FOUND |681 RX_RES_STATUS_NO_STATION_INFO_MISMATCH);682 683 decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);684 685 /* packet was not encrypted */686 if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==687 RX_RES_STATUS_SEC_TYPE_NONE)688 return decrypt_out;689 690 /* packet was encrypted with unknown alg */691 if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==692 RX_RES_STATUS_SEC_TYPE_ERR)693 return decrypt_out;694 695 /* decryption was not done in HW */696 if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=697 RX_MPDU_RES_STATUS_DEC_DONE_MSK)698 return decrypt_out;699 700 switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {701 702 case RX_RES_STATUS_SEC_TYPE_CCMP:703 /* alg is CCM: check MIC only */704 if (!(decrypt_in & RX_MPDU_RES_STATUS_MIC_OK))705 /* Bad MIC */706 decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;707 else708 decrypt_out |= RX_RES_STATUS_DECRYPT_OK;709 710 break;711 712 case RX_RES_STATUS_SEC_TYPE_TKIP:713 if (!(decrypt_in & RX_MPDU_RES_STATUS_TTAK_OK)) {714 /* Bad TTAK */715 decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;716 break;717 }718 fallthrough;719 default:720 if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))721 decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;722 else723 decrypt_out |= RX_RES_STATUS_DECRYPT_OK;724 break;725 }726 727 IWL_DEBUG_RX(priv, "decrypt_in:0x%x decrypt_out = 0x%x\n",728 decrypt_in, decrypt_out);729 730 return decrypt_out;731}732 733/* Calc max signal level (dBm) among 3 possible receivers */734static int iwlagn_calc_rssi(struct iwl_priv *priv,735 struct iwl_rx_phy_res *rx_resp)736{737 /* data from PHY/DSP regarding signal strength, etc.,738 * contents are always there, not configurable by host739 */740 struct iwlagn_non_cfg_phy *ncphy =741 (struct iwlagn_non_cfg_phy *)rx_resp->non_cfg_phy_buf;742 u32 val, rssi_a, rssi_b, rssi_c, max_rssi;743 u8 agc;744 745 val = le32_to_cpu(ncphy->non_cfg_phy[IWLAGN_RX_RES_AGC_IDX]);746 agc = (val & IWLAGN_OFDM_AGC_MSK) >> IWLAGN_OFDM_AGC_BIT_POS;747 748 /* Find max rssi among 3 possible receivers.749 * These values are measured by the digital signal processor (DSP).750 * They should stay fairly constant even as the signal strength varies,751 * if the radio's automatic gain control (AGC) is working right.752 * AGC value (see below) will provide the "interesting" info.753 */754 val = le32_to_cpu(ncphy->non_cfg_phy[IWLAGN_RX_RES_RSSI_AB_IDX]);755 rssi_a = (val & IWLAGN_OFDM_RSSI_INBAND_A_BITMSK) >>756 IWLAGN_OFDM_RSSI_A_BIT_POS;757 rssi_b = (val & IWLAGN_OFDM_RSSI_INBAND_B_BITMSK) >>758 IWLAGN_OFDM_RSSI_B_BIT_POS;759 val = le32_to_cpu(ncphy->non_cfg_phy[IWLAGN_RX_RES_RSSI_C_IDX]);760 rssi_c = (val & IWLAGN_OFDM_RSSI_INBAND_C_BITMSK) >>761 IWLAGN_OFDM_RSSI_C_BIT_POS;762 763 max_rssi = max_t(u32, rssi_a, rssi_b);764 max_rssi = max_t(u32, max_rssi, rssi_c);765 766 IWL_DEBUG_STATS(priv, "Rssi In A %d B %d C %d Max %d AGC dB %d\n",767 rssi_a, rssi_b, rssi_c, max_rssi, agc);768 769 /* dBm = max_rssi dB - agc dB - constant.770 * Higher AGC (higher radio gain) means lower signal. */771 return max_rssi - agc - IWLAGN_RSSI_OFFSET;772}773 774/* Called for REPLY_RX_MPDU_CMD */775static void iwlagn_rx_reply_rx(struct iwl_priv *priv,776 struct iwl_rx_cmd_buffer *rxb)777{778 struct ieee80211_hdr *header;779 struct ieee80211_rx_status rx_status = {};780 struct iwl_rx_packet *pkt = rxb_addr(rxb);781 struct iwl_rx_phy_res *phy_res;782 __le32 rx_pkt_status;783 struct iwl_rx_mpdu_res_start *amsdu;784 u32 len, pkt_len = iwl_rx_packet_len(pkt);785 u32 ampdu_status;786 u32 rate_n_flags;787 788 if (!priv->last_phy_res_valid) {789 IWL_ERR(priv, "MPDU frame without cached PHY data\n");790 return;791 }792 793 if (unlikely(pkt_len < sizeof(*amsdu))) {794 IWL_DEBUG_DROP(priv, "Bad REPLY_RX_MPDU_CMD size\n");795 return;796 }797 798 phy_res = &priv->last_phy_res;799 amsdu = (struct iwl_rx_mpdu_res_start *)pkt->data;800 header = (struct ieee80211_hdr *)(pkt->data + sizeof(*amsdu));801 len = le16_to_cpu(amsdu->byte_count);802 803 if (unlikely(len + sizeof(*amsdu) + sizeof(__le32) > pkt_len)) {804 IWL_DEBUG_DROP(priv, "FW lied about packet len\n");805 return;806 }807 808 rx_pkt_status = *(__le32 *)(pkt->data + sizeof(*amsdu) + len);809 ampdu_status = iwlagn_translate_rx_status(priv,810 le32_to_cpu(rx_pkt_status));811 812 if ((unlikely(phy_res->cfg_phy_cnt > 20))) {813 IWL_DEBUG_DROP(priv, "dsp size out of range [0,20]: %d\n",814 phy_res->cfg_phy_cnt);815 return;816 }817 818 if (!(rx_pkt_status & RX_RES_STATUS_NO_CRC32_ERROR) ||819 !(rx_pkt_status & RX_RES_STATUS_NO_RXE_OVERFLOW)) {820 IWL_DEBUG_RX(priv, "Bad CRC or FIFO: 0x%08X.\n",821 le32_to_cpu(rx_pkt_status));822 return;823 }824 825 /* This will be used in several places later */826 rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);827 828 /* rx_status carries information about the packet to mac80211 */829 rx_status.mactime = le64_to_cpu(phy_res->timestamp);830 rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?831 NL80211_BAND_2GHZ : NL80211_BAND_5GHZ;832 rx_status.freq =833 ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel),834 rx_status.band);835 rx_status.rate_idx =836 iwlagn_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);837 rx_status.flag = 0;838 839 /* TSF isn't reliable. In order to allow smooth user experience,840 * this W/A doesn't propagate it to the mac80211 */841 /*rx_status.flag |= RX_FLAG_MACTIME_START;*/842 843 priv->ucode_beacon_time = le32_to_cpu(phy_res->beacon_time_stamp);844 845 /* Find max signal strength (dBm) among 3 antenna/receiver chains */846 rx_status.signal = iwlagn_calc_rssi(priv, phy_res);847 848 IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, TSF %llu\n",849 rx_status.signal, (unsigned long long)rx_status.mactime);850 851 /*852 * "antenna number"853 *854 * It seems that the antenna field in the phy flags value855 * is actually a bit field. This is undefined by radiotap,856 * it wants an actual antenna number but I always get "7"857 * for most legacy frames I receive indicating that the858 * same frame was received on all three RX chains.859 *860 * I think this field should be removed in favor of a861 * new 802.11n radiotap field "RX chains" that is defined862 * as a bitmask.863 */864 rx_status.antenna =865 (le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK)866 >> RX_RES_PHY_FLAGS_ANTENNA_POS;867 868 /* set the preamble flag if appropriate */869 if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)870 rx_status.enc_flags |= RX_ENC_FLAG_SHORTPRE;871 872 if (phy_res->phy_flags & RX_RES_PHY_FLAGS_AGG_MSK) {873 /*874 * We know which subframes of an A-MPDU belong875 * together since we get a single PHY response876 * from the firmware for all of them877 */878 rx_status.flag |= RX_FLAG_AMPDU_DETAILS;879 rx_status.ampdu_reference = priv->ampdu_ref;880 }881 882 /* Set up the HT phy flags */883 if (rate_n_flags & RATE_MCS_HT_MSK)884 rx_status.encoding = RX_ENC_HT;885 if (rate_n_flags & RATE_MCS_HT40_MSK)886 rx_status.bw = RATE_INFO_BW_40;887 else888 rx_status.bw = RATE_INFO_BW_20;889 if (rate_n_flags & RATE_MCS_SGI_MSK)890 rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;891 if (rate_n_flags & RATE_MCS_GF_MSK)892 rx_status.enc_flags |= RX_ENC_FLAG_HT_GF;893 894 iwlagn_pass_packet_to_mac80211(priv, header, len, ampdu_status,895 rxb, &rx_status);896}897 898static void iwlagn_rx_noa_notification(struct iwl_priv *priv,899 struct iwl_rx_cmd_buffer *rxb)900{901 struct iwl_wipan_noa_data *new_data, *old_data;902 struct iwl_rx_packet *pkt = rxb_addr(rxb);903 struct iwl_wipan_noa_notification *noa_notif = (void *)pkt->data;904 905 /* no condition -- we're in softirq */906 old_data = rcu_dereference_protected(priv->noa_data, true);907 908 if (noa_notif->noa_active) {909 u32 len = le16_to_cpu(noa_notif->noa_attribute.length);910 u32 copylen = len;911 912 /* EID, len, OUI, subtype */913 len += 1 + 1 + 3 + 1;914 /* P2P id, P2P length */915 len += 1 + 2;916 copylen += 1 + 2;917 918 new_data = kmalloc(struct_size(new_data, data, len), GFP_ATOMIC);919 if (new_data) {920 new_data->length = len;921 new_data->data[0] = WLAN_EID_VENDOR_SPECIFIC;922 new_data->data[1] = len - 2; /* not counting EID, len */923 new_data->data[2] = (WLAN_OUI_WFA >> 16) & 0xff;924 new_data->data[3] = (WLAN_OUI_WFA >> 8) & 0xff;925 new_data->data[4] = (WLAN_OUI_WFA >> 0) & 0xff;926 new_data->data[5] = WLAN_OUI_TYPE_WFA_P2P;927 memcpy(&new_data->data[6], &noa_notif->noa_attribute,928 copylen);929 }930 } else931 new_data = NULL;932 933 rcu_assign_pointer(priv->noa_data, new_data);934 935 if (old_data)936 kfree_rcu(old_data, rcu_head);937}938 939/*940 * iwl_setup_rx_handlers - Initialize Rx handler callbacks941 *942 * Setup the RX handlers for each of the reply types sent from the uCode943 * to the host.944 */945void iwl_setup_rx_handlers(struct iwl_priv *priv)946{947 void (**handlers)(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb);948 949 handlers = priv->rx_handlers;950 951 handlers[REPLY_ERROR] = iwlagn_rx_reply_error;952 handlers[CHANNEL_SWITCH_NOTIFICATION] = iwlagn_rx_csa;953 handlers[SPECTRUM_MEASURE_NOTIFICATION] =954 iwlagn_rx_spectrum_measure_notif;955 handlers[PM_SLEEP_NOTIFICATION] = iwlagn_rx_pm_sleep_notif;956 handlers[PM_DEBUG_STATISTIC_NOTIFIC] =957 iwlagn_rx_pm_debug_statistics_notif;958 handlers[BEACON_NOTIFICATION] = iwlagn_rx_beacon_notif;959 handlers[REPLY_ADD_STA] = iwl_add_sta_callback;960 961 handlers[REPLY_WIPAN_NOA_NOTIFICATION] = iwlagn_rx_noa_notification;962 963 /*964 * The same handler is used for both the REPLY to a discrete965 * statistics request from the host as well as for the periodic966 * statistics notifications (after received beacons) from the uCode.967 */968 handlers[REPLY_STATISTICS_CMD] = iwlagn_rx_reply_statistics;969 handlers[STATISTICS_NOTIFICATION] = iwlagn_rx_statistics;970 971 iwl_setup_rx_scan_handlers(priv);972 973 handlers[CARD_STATE_NOTIFICATION] = iwlagn_rx_card_state_notif;974 handlers[MISSED_BEACONS_NOTIFICATION] =975 iwlagn_rx_missed_beacon_notif;976 977 /* Rx handlers */978 handlers[REPLY_RX_PHY_CMD] = iwlagn_rx_reply_rx_phy;979 handlers[REPLY_RX_MPDU_CMD] = iwlagn_rx_reply_rx;980 981 /* block ack */982 handlers[REPLY_COMPRESSED_BA] =983 iwlagn_rx_reply_compressed_ba;984 985 priv->rx_handlers[REPLY_TX] = iwlagn_rx_reply_tx;986 987 /* set up notification wait support */988 iwl_notification_wait_init(&priv->notif_wait);989 990 /* Set up BT Rx handlers */991 if (priv->lib->bt_params)992 iwlagn_bt_rx_handler_setup(priv);993}994 995void iwl_rx_dispatch(struct iwl_op_mode *op_mode, struct napi_struct *napi,996 struct iwl_rx_cmd_buffer *rxb)997{998 struct iwl_rx_packet *pkt = rxb_addr(rxb);999 struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);1000 1001 /*1002 * Do the notification wait before RX handlers so1003 * even if the RX handler consumes the RXB we have1004 * access to it in the notification wait entry.1005 */1006 iwl_notification_wait_notify(&priv->notif_wait, pkt);1007 1008 /* Based on type of command response or notification,1009 * handle those that need handling via function in1010 * rx_handlers table. See iwl_setup_rx_handlers() */1011 if (priv->rx_handlers[pkt->hdr.cmd]) {1012 priv->rx_handlers_stats[pkt->hdr.cmd]++;1013 priv->rx_handlers[pkt->hdr.cmd](priv, rxb);1014 } else {1015 /* No handling needed */1016 IWL_DEBUG_RX(priv, "No handler needed for %s, 0x%02x\n",1017 iwl_get_cmd_string(priv->trans,1018 WIDE_ID(0, pkt->hdr.cmd)),1019 pkt->hdr.cmd);1020 }1021}1022