drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
  11  * Copyright(c) 2018 Intel Corporation
  12  *
  13  * This program is free software; you can redistribute it and/or modify
  14  * it under the terms of version 2 of the GNU General Public License as
  15  * published by the Free Software Foundation.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  20  * General Public License for more details.
  21  *
  22  * The full GNU General Public License is included in this distribution
  23  * in the file called COPYING.
  24  *
  25  * Contact Information:
  26  *  Intel Linux Wireless <ilw@linux.intel.com>
  27  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  28  *
  29  * BSD LICENSE
  30  *
  31  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  32  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  33  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
  34  * Copyright(c) 2018 Intel Corporation
  35  * All rights reserved.
  36  *
  37  * Redistribution and use in source and binary forms, with or without
  38  * modification, are permitted provided that the following conditions
  39  * are met:
  40  *
  41  *  * Redistributions of source code must retain the above copyright
  42  *    notice, this list of conditions and the following disclaimer.
  43  *  * Redistributions in binary form must reproduce the above copyright
  44  *    notice, this list of conditions and the following disclaimer in
  45  *    the documentation and/or other materials provided with the
  46  *    distribution.
  47  *  * Neither the name Intel Corporation nor the names of its
  48  *    contributors may be used to endorse or promote products derived
  49  *    from this software without specific prior written permission.
  50  *
  51  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  52  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  53  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  54  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  55  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  56  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  57  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  61  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  62  *****************************************************************************/
  63 #include <linux/etherdevice.h>
  64 #include <linux/skbuff.h>
  65 #include "iwl-trans.h"
  66 #include "mvm.h"
  67 #include "fw-api.h"
  68
  69 static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
  70                                    int queue, struct ieee80211_sta *sta)
  71 {
  72         struct iwl_mvm_sta *mvmsta;
  73         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  74         struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
  75         struct iwl_mvm_key_pn *ptk_pn;
  76         int res;
  77         u8 tid, keyidx;
  78         u8 pn[IEEE80211_CCMP_PN_LEN];
  79         u8 *extiv;
  80
  81         /* do PN checking */
  82
  83         /* multicast and non-data only arrives on default queue */
  84         if (!ieee80211_is_data(hdr->frame_control) ||
  85             is_multicast_ether_addr(hdr->addr1))
  86                 return 0;
  87
  88         /* do not check PN for open AP */
  89         if (!(stats->flag & RX_FLAG_DECRYPTED))
  90                 return 0;
  91
  92         /*
  93          * avoid checking for default queue - we don't want to replicate
  94          * all the logic that's necessary for checking the PN on fragmented
  95          * frames, leave that to mac80211
  96          */
  97         if (queue == 0)
  98                 return 0;
  99
 100         /* if we are here - this for sure is either CCMP or GCMP */
 101         if (IS_ERR_OR_NULL(sta)) {
 102                 IWL_ERR(mvm,
 103                         "expected hw-decrypted unicast frame for station\n");
 104                 return -1;
 105         }
 106
 107         mvmsta = iwl_mvm_sta_from_mac80211(sta);
 108
 109         extiv = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
 110         keyidx = extiv[3] >> 6;
 111
 112         ptk_pn = rcu_dereference(mvmsta->ptk_pn[keyidx]);
 113         if (!ptk_pn)
 114                 return -1;
 115
 116         if (ieee80211_is_data_qos(hdr->frame_control))
 117                 tid = ieee80211_get_tid(hdr);
 118         else
 119                 tid = 0;
 120
 121         /* we don't use HCCA/802.11 QoS TSPECs, so drop such frames */
 122         if (tid >= IWL_MAX_TID_COUNT)
 123                 return -1;
 124
 125         /* load pn */
 126         pn[0] = extiv[7];
 127         pn[1] = extiv[6];
 128         pn[2] = extiv[5];
 129         pn[3] = extiv[4];
 130         pn[4] = extiv[1];
 131         pn[5] = extiv[0];
 132
 133         res = memcmp(pn, ptk_pn->q[queue].pn[tid], IEEE80211_CCMP_PN_LEN);
 134         if (res < 0)
 135                 return -1;
 136         if (!res && !(stats->flag & RX_FLAG_ALLOW_SAME_PN))
 137                 return -1;
 138
 139         memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
 140         stats->flag |= RX_FLAG_PN_VALIDATED;
 141
 142         return 0;
 143 }
 144
 145 /* iwl_mvm_create_skb Adds the rxb to a new skb */
 146 static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
 147                               struct ieee80211_hdr *hdr, u16 len, u8 crypt_len,
 148                               struct iwl_rx_cmd_buffer *rxb)
 149 {
 150         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 151         struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
 152         unsigned int headlen, fraglen, pad_len = 0;
 153         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 154
 155         if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) {
 156                 len -= 2;
 157                 pad_len = 2;
 158         }
 159
 160         /* If frame is small enough to fit in skb->head, pull it completely.
 161          * If not, only pull ieee80211_hdr (including crypto if present, and
 162          * an additional 8 bytes for SNAP/ethertype, see below) so that
 163          * splice() or TCP coalesce are more efficient.
 164          *
 165          * Since, in addition, ieee80211_data_to_8023() always pull in at
 166          * least 8 bytes (possibly more for mesh) we can do the same here
 167          * to save the cost of doing it later. That still doesn't pull in
 168          * the actual IP header since the typical case has a SNAP header.
 169          * If the latter changes (there are efforts in the standards group
 170          * to do so) we should revisit this and ieee80211_data_to_8023().
 171          */
 172         headlen = (len <= skb_tailroom(skb)) ? len :
 173                                                hdrlen + crypt_len + 8;
 174
 175         /* The firmware may align the packet to DWORD.
 176          * The padding is inserted after the IV.
 177          * After copying the header + IV skip the padding if
 178          * present before copying packet data.
 179          */
 180         hdrlen += crypt_len;
 181
 182         if (WARN_ONCE(headlen < hdrlen,
 183                       "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
 184                       hdrlen, len, crypt_len)) {
 185                 /*
 186                  * We warn and trace because we want to be able to see
 187                  * it in trace-cmd as well.
 188                  */
 189                 IWL_DEBUG_RX(mvm,
 190                              "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
 191                              hdrlen, len, crypt_len);
 192                 return -EINVAL;
 193         }
 194
 195         skb_put_data(skb, hdr, hdrlen);
 196         skb_put_data(skb, (u8 *)hdr + hdrlen + pad_len, headlen - hdrlen);
 197
 198         fraglen = len - headlen;
 199
 200         if (fraglen) {
 201                 int offset = (void *)hdr + headlen + pad_len -
 202                              rxb_addr(rxb) + rxb_offset(rxb);
 203
 204                 skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
 205                                 fraglen, rxb->truesize);
 206         }
 207
 208         return 0;
 209 }
 210
 211 /* iwl_mvm_pass_packet_to_mac80211 - passes the packet for mac80211 */
 212 static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
 213                                             struct napi_struct *napi,
 214                                             struct sk_buff *skb, int queue,
 215                                             struct ieee80211_sta *sta)
 216 {
 217         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
 218
 219         if (iwl_mvm_check_pn(mvm, skb, queue, sta)) {
 220                 kfree_skb(skb);
 221         } else {
 222                 unsigned int radiotap_len = 0;
 223
 224                 if (rx_status->flag & RX_FLAG_RADIOTAP_HE)
 225                         radiotap_len += sizeof(struct ieee80211_radiotap_he);
 226                 if (rx_status->flag & RX_FLAG_RADIOTAP_HE_MU)
 227                         radiotap_len += sizeof(struct ieee80211_radiotap_he_mu);
 228                 __skb_push(skb, radiotap_len);
 229                 ieee80211_rx_napi(mvm->hw, sta, skb, napi);
 230         }
 231 }
 232
 233 static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
 234                                         struct ieee80211_rx_status *rx_status,
 235                                         u32 rate_n_flags, int energy_a,
 236                                         int energy_b)
 237 {
 238         int max_energy;
 239         u32 rate_flags = rate_n_flags;
 240
 241         energy_a = energy_a ? -energy_a : S8_MIN;
 242         energy_b = energy_b ? -energy_b : S8_MIN;
 243         max_energy = max(energy_a, energy_b);
 244
 245         IWL_DEBUG_STATS(mvm, "energy In A %d B %d, and max %d\n",
 246                         energy_a, energy_b, max_energy);
 247
 248         rx_status->signal = max_energy;
 249         rx_status->chains =
 250                 (rate_flags & RATE_MCS_ANT_AB_MSK) >> RATE_MCS_ANT_POS;
 251         rx_status->chain_signal[0] = energy_a;
 252         rx_status->chain_signal[1] = energy_b;
 253         rx_status->chain_signal[2] = S8_MIN;
 254 }
 255
 256 static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
 257                              struct ieee80211_rx_status *stats, u16 phy_info,
 258                              struct iwl_rx_mpdu_desc *desc,
 259                              u32 pkt_flags, int queue, u8 *crypt_len)
 260 {
 261         u16 status = le16_to_cpu(desc->status);
 262
 263         /*
 264          * Drop UNKNOWN frames in aggregation, unless in monitor mode
 265          * (where we don't have the keys).
 266          * We limit this to aggregation because in TKIP this is a valid
 267          * scenario, since we may not have the (correct) TTAK (phase 1
 268          * key) in the firmware.
 269          */
 270         if (phy_info & IWL_RX_MPDU_PHY_AMPDU &&
 271             (status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
 272             IWL_RX_MPDU_STATUS_SEC_UNKNOWN && !mvm->monitor_on)
 273                 return -1;
 274
 275         if (!ieee80211_has_protected(hdr->frame_control) ||
 276             (status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
 277             IWL_RX_MPDU_STATUS_SEC_NONE)
 278                 return 0;
 279
 280         /* TODO: handle packets encrypted with unknown alg */
 281
 282         switch (status & IWL_RX_MPDU_STATUS_SEC_MASK) {
 283         case IWL_RX_MPDU_STATUS_SEC_CCM:
 284         case IWL_RX_MPDU_STATUS_SEC_GCM:
 285                 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != IEEE80211_GCMP_PN_LEN);
 286                 /* alg is CCM: check MIC only */
 287                 if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
 288                         return -1;
 289
 290                 stats->flag |= RX_FLAG_DECRYPTED;
 291                 if (pkt_flags & FH_RSCSR_RADA_EN)
 292                         stats->flag |= RX_FLAG_MIC_STRIPPED;
 293                 *crypt_len = IEEE80211_CCMP_HDR_LEN;
 294                 return 0;
 295         case IWL_RX_MPDU_STATUS_SEC_TKIP:
 296                 /* Don't drop the frame and decrypt it in SW */
 297                 if (!fw_has_api(&mvm->fw->ucode_capa,
 298                                 IWL_UCODE_TLV_API_DEPRECATE_TTAK) &&
 299                     !(status & IWL_RX_MPDU_RES_STATUS_TTAK_OK))
 300                         return 0;
 301
 302                 *crypt_len = IEEE80211_TKIP_IV_LEN;
 303                 /* fall through if TTAK OK */
 304         case IWL_RX_MPDU_STATUS_SEC_WEP:
 305                 if (!(status & IWL_RX_MPDU_STATUS_ICV_OK))
 306                         return -1;
 307
 308                 stats->flag |= RX_FLAG_DECRYPTED;
 309                 if ((status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
 310                                 IWL_RX_MPDU_STATUS_SEC_WEP)
 311                         *crypt_len = IEEE80211_WEP_IV_LEN;
 312
 313                 if (pkt_flags & FH_RSCSR_RADA_EN)
 314                         stats->flag |= RX_FLAG_ICV_STRIPPED;
 315
 316                 return 0;
 317         case IWL_RX_MPDU_STATUS_SEC_EXT_ENC:
 318                 if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
 319                         return -1;
 320                 stats->flag |= RX_FLAG_DECRYPTED;
 321                 return 0;
 322         default:
 323                 /* Expected in monitor (not having the keys) */
 324                 if (!mvm->monitor_on)
 325                         IWL_ERR(mvm, "Unhandled alg: 0x%x\n", status);
 326         }
 327
 328         return 0;
 329 }
 330
 331 static void iwl_mvm_rx_csum(struct ieee80211_sta *sta,
 332                             struct sk_buff *skb,
 333                             struct iwl_rx_mpdu_desc *desc)
 334 {
 335         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 336         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
 337         u16 flags = le16_to_cpu(desc->l3l4_flags);
 338         u8 l3_prot = (u8)((flags & IWL_RX_L3L4_L3_PROTO_MASK) >>
 339                           IWL_RX_L3_PROTO_POS);
 340
 341         if (mvmvif->features & NETIF_F_RXCSUM &&
 342             flags & IWL_RX_L3L4_TCP_UDP_CSUM_OK &&
 343             (flags & IWL_RX_L3L4_IP_HDR_CSUM_OK ||
 344              l3_prot == IWL_RX_L3_TYPE_IPV6 ||
 345              l3_prot == IWL_RX_L3_TYPE_IPV6_FRAG))
 346                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 347 }
 348
 349 /*
 350  * returns true if a packet is a duplicate and should be dropped.
 351  * Updates AMSDU PN tracking info
 352  */
 353 static bool iwl_mvm_is_dup(struct ieee80211_sta *sta, int queue,
 354                            struct ieee80211_rx_status *rx_status,
 355                            struct ieee80211_hdr *hdr,
 356                            struct iwl_rx_mpdu_desc *desc)
 357 {
 358         struct iwl_mvm_sta *mvm_sta;
 359         struct iwl_mvm_rxq_dup_data *dup_data;
 360         u8 tid, sub_frame_idx;
 361
 362         if (WARN_ON(IS_ERR_OR_NULL(sta)))
 363                 return false;
 364
 365         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 366         dup_data = &mvm_sta->dup_data[queue];
 367
 368         /*
 369          * Drop duplicate 802.11 retransmissions
 370          * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
 371          */
 372         if (ieee80211_is_ctl(hdr->frame_control) ||
 373             ieee80211_is_qos_nullfunc(hdr->frame_control) ||
 374             is_multicast_ether_addr(hdr->addr1)) {
 375                 rx_status->flag |= RX_FLAG_DUP_VALIDATED;
 376                 return false;
 377         }
 378
 379         if (ieee80211_is_data_qos(hdr->frame_control))
 380                 /* frame has qos control */
 381                 tid = ieee80211_get_tid(hdr);
 382         else
 383                 tid = IWL_MAX_TID_COUNT;
 384
 385         /* If this wasn't a part of an A-MSDU the sub-frame index will be 0 */
 386         sub_frame_idx = desc->amsdu_info &
 387                 IWL_RX_MPDU_AMSDU_SUBFRAME_IDX_MASK;
 388
 389         if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
 390                      dup_data->last_seq[tid] == hdr->seq_ctrl &&
 391                      dup_data->last_sub_frame[tid] >= sub_frame_idx))
 392                 return true;
 393
 394         /* Allow same PN as the first subframe for following sub frames */
 395         if (dup_data->last_seq[tid] == hdr->seq_ctrl &&
 396             sub_frame_idx > dup_data->last_sub_frame[tid] &&
 397             desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU)
 398                 rx_status->flag |= RX_FLAG_ALLOW_SAME_PN;
 399
 400         dup_data->last_seq[tid] = hdr->seq_ctrl;
 401         dup_data->last_sub_frame[tid] = sub_frame_idx;
 402
 403         rx_status->flag |= RX_FLAG_DUP_VALIDATED;
 404
 405         return false;
 406 }
 407
 408 int iwl_mvm_notify_rx_queue(struct iwl_mvm *mvm, u32 rxq_mask,
 409                             const u8 *data, u32 count)
 410 {
 411         struct iwl_rxq_sync_cmd *cmd;
 412         u32 data_size = sizeof(*cmd) + count;
 413         int ret;
 414
 415         /* should be DWORD aligned */
 416         if (WARN_ON(count & 3 || count > IWL_MULTI_QUEUE_SYNC_MSG_MAX_SIZE))
 417                 return -EINVAL;
 418
 419         cmd = kzalloc(data_size, GFP_KERNEL);
 420         if (!cmd)
 421                 return -ENOMEM;
 422
 423         cmd->rxq_mask = cpu_to_le32(rxq_mask);
 424         cmd->count =  cpu_to_le32(count);
 425         cmd->flags = 0;
 426         memcpy(cmd->payload, data, count);
 427
 428         ret = iwl_mvm_send_cmd_pdu(mvm,
 429                                    WIDE_ID(DATA_PATH_GROUP,
 430                                            TRIGGER_RX_QUEUES_NOTIF_CMD),
 431                                    0, data_size, cmd);
 432
 433         kfree(cmd);
 434         return ret;
 435 }
 436
 437 /*
 438  * Returns true if sn2 - buffer_size < sn1 < sn2.
 439  * To be used only in order to compare reorder buffer head with NSSN.
 440  * We fully trust NSSN unless it is behind us due to reorder timeout.
 441  * Reorder timeout can only bring us up to buffer_size SNs ahead of NSSN.
 442  */
 443 static bool iwl_mvm_is_sn_less(u16 sn1, u16 sn2, u16 buffer_size)
 444 {
 445         return ieee80211_sn_less(sn1, sn2) &&
 446                !ieee80211_sn_less(sn1, sn2 - buffer_size);
 447 }
 448
 449 #define RX_REORDER_BUF_TIMEOUT_MQ (HZ / 10)
 450
 451 static void iwl_mvm_release_frames(struct iwl_mvm *mvm,
 452                                    struct ieee80211_sta *sta,
 453                                    struct napi_struct *napi,
 454                                    struct iwl_mvm_baid_data *baid_data,
 455                                    struct iwl_mvm_reorder_buffer *reorder_buf,
 456                                    u16 nssn)
 457 {
 458         struct iwl_mvm_reorder_buf_entry *entries =
 459                 &baid_data->entries[reorder_buf->queue *
 460                                     baid_data->entries_per_queue];
 461         u16 ssn = reorder_buf->head_sn;
 462
 463         lockdep_assert_held(&reorder_buf->lock);
 464
 465         /* ignore nssn smaller than head sn - this can happen due to timeout */
 466         if (iwl_mvm_is_sn_less(nssn, ssn, reorder_buf->buf_size))
 467                 goto set_timer;
 468
 469         while (iwl_mvm_is_sn_less(ssn, nssn, reorder_buf->buf_size)) {
 470                 int index = ssn % reorder_buf->buf_size;
 471                 struct sk_buff_head *skb_list = &entries[index].e.frames;
 472                 struct sk_buff *skb;
 473
 474                 ssn = ieee80211_sn_inc(ssn);
 475
 476                 /*
 477                  * Empty the list. Will have more than one frame for A-MSDU.
 478                  * Empty list is valid as well since nssn indicates frames were
 479                  * received.
 480                  */
 481                 while ((skb = __skb_dequeue(skb_list))) {
 482                         iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb,
 483                                                         reorder_buf->queue,
 484                                                         sta);
 485                         reorder_buf->num_stored--;
 486                 }
 487         }
 488         reorder_buf->head_sn = nssn;
 489
 490 set_timer:
 491         if (reorder_buf->num_stored && !reorder_buf->removed) {
 492                 u16 index = reorder_buf->head_sn % reorder_buf->buf_size;
 493
 494                 while (skb_queue_empty(&entries[index].e.frames))
 495                         index = (index + 1) % reorder_buf->buf_size;
 496                 /* modify timer to match next frame's expiration time */
 497                 mod_timer(&reorder_buf->reorder_timer,
 498                           entries[index].e.reorder_time + 1 +
 499                           RX_REORDER_BUF_TIMEOUT_MQ);
 500         } else {
 501                 del_timer(&reorder_buf->reorder_timer);
 502         }
 503 }
 504
 505 void iwl_mvm_reorder_timer_expired(struct timer_list *t)
 506 {
 507         struct iwl_mvm_reorder_buffer *buf = from_timer(buf, t, reorder_timer);
 508         struct iwl_mvm_baid_data *baid_data =
 509                 iwl_mvm_baid_data_from_reorder_buf(buf);
 510         struct iwl_mvm_reorder_buf_entry *entries =
 511                 &baid_data->entries[buf->queue * baid_data->entries_per_queue];
 512         int i;
 513         u16 sn = 0, index = 0;
 514         bool expired = false;
 515         bool cont = false;
 516
 517         spin_lock(&buf->lock);
 518
 519         if (!buf->num_stored || buf->removed) {
 520                 spin_unlock(&buf->lock);
 521                 return;
 522         }
 523
 524         for (i = 0; i < buf->buf_size ; i++) {
 525                 index = (buf->head_sn + i) % buf->buf_size;
 526
 527                 if (skb_queue_empty(&entries[index].e.frames)) {
 528                         /*
 529                          * If there is a hole and the next frame didn't expire
 530                          * we want to break and not advance SN
 531                          */
 532                         cont = false;
 533                         continue;
 534                 }
 535                 if (!cont &&
 536                     !time_after(jiffies, entries[index].e.reorder_time +
 537                                          RX_REORDER_BUF_TIMEOUT_MQ))
 538                         break;
 539
 540                 expired = true;
 541                 /* continue until next hole after this expired frames */
 542                 cont = true;
 543                 sn = ieee80211_sn_add(buf->head_sn, i + 1);
 544         }
 545
 546         if (expired) {
 547                 struct ieee80211_sta *sta;
 548                 struct iwl_mvm_sta *mvmsta;
 549                 u8 sta_id = baid_data->sta_id;
 550
 551                 rcu_read_lock();
 552                 sta = rcu_dereference(buf->mvm->fw_id_to_mac_id[sta_id]);
 553                 mvmsta = iwl_mvm_sta_from_mac80211(sta);
 554
 555                 /* SN is set to the last expired frame + 1 */
 556                 IWL_DEBUG_HT(buf->mvm,
 557                              "Releasing expired frames for sta %u, sn %d\n",
 558                              sta_id, sn);
 559                 iwl_mvm_event_frame_timeout_callback(buf->mvm, mvmsta->vif,
 560                                                      sta, baid_data->tid);
 561                 iwl_mvm_release_frames(buf->mvm, sta, NULL, baid_data, buf, sn);
 562                 rcu_read_unlock();
 563         } else {
 564                 /*
 565                  * If no frame expired and there are stored frames, index is now
 566                  * pointing to the first unexpired frame - modify timer
 567                  * accordingly to this frame.
 568                  */
 569                 mod_timer(&buf->reorder_timer,
 570                           entries[index].e.reorder_time +
 571                           1 + RX_REORDER_BUF_TIMEOUT_MQ);
 572         }
 573         spin_unlock(&buf->lock);
 574 }
 575
 576 static void iwl_mvm_del_ba(struct iwl_mvm *mvm, int queue,
 577                            struct iwl_mvm_delba_data *data)
 578 {
 579         struct iwl_mvm_baid_data *ba_data;
 580         struct ieee80211_sta *sta;
 581         struct iwl_mvm_reorder_buffer *reorder_buf;
 582         u8 baid = data->baid;
 583
 584         if (WARN_ONCE(baid >= IWL_MAX_BAID, "invalid BAID: %x\n", baid))
 585                 return;
 586
 587         rcu_read_lock();
 588
 589         ba_data = rcu_dereference(mvm->baid_map[baid]);
 590         if (WARN_ON_ONCE(!ba_data))
 591                 goto out;
 592
 593         sta = rcu_dereference(mvm->fw_id_to_mac_id[ba_data->sta_id]);
 594         if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta)))
 595                 goto out;
 596
 597         reorder_buf = &ba_data->reorder_buf[queue];
 598
 599         /* release all frames that are in the reorder buffer to the stack */
 600         spin_lock_bh(&reorder_buf->lock);
 601         iwl_mvm_release_frames(mvm, sta, NULL, ba_data, reorder_buf,
 602                                ieee80211_sn_add(reorder_buf->head_sn,
 603                                                 reorder_buf->buf_size));
 604         spin_unlock_bh(&reorder_buf->lock);
 605         del_timer_sync(&reorder_buf->reorder_timer);
 606
 607 out:
 608         rcu_read_unlock();
 609 }
 610
 611 void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
 612                             int queue)
 613 {
 614         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 615         struct iwl_rxq_sync_notification *notif;
 616         struct iwl_mvm_internal_rxq_notif *internal_notif;
 617
 618         notif = (void *)pkt->data;
 619         internal_notif = (void *)notif->payload;
 620
 621         if (internal_notif->sync &&
 622             mvm->queue_sync_cookie != internal_notif->cookie) {
 623                 WARN_ONCE(1, "Received expired RX queue sync message\n");
 624                 return;
 625         }
 626
 627         switch (internal_notif->type) {
 628         case IWL_MVM_RXQ_EMPTY:
 629                 break;
 630         case IWL_MVM_RXQ_NOTIF_DEL_BA:
 631                 iwl_mvm_del_ba(mvm, queue, (void *)internal_notif->data);
 632                 break;
 633         default:
 634                 WARN_ONCE(1, "Invalid identifier %d", internal_notif->type);
 635         }
 636
 637         if (internal_notif->sync &&
 638             !atomic_dec_return(&mvm->queue_sync_counter))
 639                 wake_up(&mvm->rx_sync_waitq);
 640 }
 641
 642 /*
 643  * Returns true if the MPDU was buffered\dropped, false if it should be passed
 644  * to upper layer.
 645  */
 646 static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
 647                             struct napi_struct *napi,
 648                             int queue,
 649                             struct ieee80211_sta *sta,
 650                             struct sk_buff *skb,
 651                             struct iwl_rx_mpdu_desc *desc)
 652 {
 653         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 654         struct iwl_mvm_sta *mvm_sta;
 655         struct iwl_mvm_baid_data *baid_data;
 656         struct iwl_mvm_reorder_buffer *buffer;
 657         struct sk_buff *tail;
 658         u32 reorder = le32_to_cpu(desc->reorder_data);
 659         bool amsdu = desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU;
 660         bool last_subframe =
 661                 desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME;
 662         u8 tid = ieee80211_get_tid(hdr);
 663         u8 sub_frame_idx = desc->amsdu_info &
 664                            IWL_RX_MPDU_AMSDU_SUBFRAME_IDX_MASK;
 665         struct iwl_mvm_reorder_buf_entry *entries;
 666         int index;
 667         u16 nssn, sn;
 668         u8 baid;
 669
 670         baid = (reorder & IWL_RX_MPDU_REORDER_BAID_MASK) >>
 671                 IWL_RX_MPDU_REORDER_BAID_SHIFT;
 672
 673         /*
 674          * This also covers the case of receiving a Block Ack Request
 675          * outside a BA session; we'll pass it to mac80211 and that
 676          * then sends a delBA action frame.
 677          */
 678         if (baid == IWL_RX_REORDER_DATA_INVALID_BAID)
 679                 return false;
 680
 681         /* no sta yet */
 682         if (WARN_ONCE(IS_ERR_OR_NULL(sta),
 683                       "Got valid BAID without a valid station assigned\n"))
 684                 return false;
 685
 686         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 687
 688         /* not a data packet or a bar */
 689         if (!ieee80211_is_back_req(hdr->frame_control) &&
 690             (!ieee80211_is_data_qos(hdr->frame_control) ||
 691              is_multicast_ether_addr(hdr->addr1)))
 692                 return false;
 693
 694         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
 695                 return false;
 696
 697         baid_data = rcu_dereference(mvm->baid_map[baid]);
 698         if (!baid_data) {
 699                 IWL_DEBUG_RX(mvm,
 700                              "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
 701                               baid, reorder);
 702                 return false;
 703         }
 704
 705         if (WARN(tid != baid_data->tid || mvm_sta->sta_id != baid_data->sta_id,
 706                  "baid 0x%x is mapped to sta:%d tid:%d, but was received for sta:%d tid:%d\n",
 707                  baid, baid_data->sta_id, baid_data->tid, mvm_sta->sta_id,
 708                  tid))
 709                 return false;
 710
 711         nssn = reorder & IWL_RX_MPDU_REORDER_NSSN_MASK;
 712         sn = (reorder & IWL_RX_MPDU_REORDER_SN_MASK) >>
 713                 IWL_RX_MPDU_REORDER_SN_SHIFT;
 714
 715         buffer = &baid_data->reorder_buf[queue];
 716         entries = &baid_data->entries[queue * baid_data->entries_per_queue];
 717
 718         spin_lock_bh(&buffer->lock);
 719
 720         if (!buffer->valid) {
 721                 if (reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN) {
 722                         spin_unlock_bh(&buffer->lock);
 723                         return false;
 724                 }
 725                 buffer->valid = true;
 726         }
 727
 728         if (ieee80211_is_back_req(hdr->frame_control)) {
 729                 iwl_mvm_release_frames(mvm, sta, napi, baid_data, buffer, nssn);
 730                 goto drop;
 731         }
 732
 733         /*
 734          * If there was a significant jump in the nssn - adjust.
 735          * If the SN is smaller than the NSSN it might need to first go into
 736          * the reorder buffer, in which case we just release up to it and the
 737          * rest of the function will take care of storing it and releasing up to
 738          * the nssn
 739          */
 740         if (!iwl_mvm_is_sn_less(nssn, buffer->head_sn + buffer->buf_size,
 741                                 buffer->buf_size) ||
 742             !ieee80211_sn_less(sn, buffer->head_sn + buffer->buf_size)) {
 743                 u16 min_sn = ieee80211_sn_less(sn, nssn) ? sn : nssn;
 744
 745                 iwl_mvm_release_frames(mvm, sta, napi, baid_data, buffer,
 746                                        min_sn);
 747         }
 748
 749         /* drop any oudated packets */
 750         if (ieee80211_sn_less(sn, buffer->head_sn))
 751                 goto drop;
 752
 753         /* release immediately if allowed by nssn and no stored frames */
 754         if (!buffer->num_stored && ieee80211_sn_less(sn, nssn)) {
 755                 if (iwl_mvm_is_sn_less(buffer->head_sn, nssn,
 756                                        buffer->buf_size) &&
 757                    (!amsdu || last_subframe))
 758                         buffer->head_sn = nssn;
 759                 /* No need to update AMSDU last SN - we are moving the head */
 760                 spin_unlock_bh(&buffer->lock);
 761                 return false;
 762         }
 763
 764         /*
 765          * release immediately if there are no stored frames, and the sn is
 766          * equal to the head.
 767          * This can happen due to reorder timer, where NSSN is behind head_sn.
 768          * When we released everything, and we got the next frame in the
 769          * sequence, according to the NSSN we can't release immediately,
 770          * while technically there is no hole and we can move forward.
 771          */
 772         if (!buffer->num_stored && sn == buffer->head_sn) {
 773                 if (!amsdu || last_subframe)
 774                         buffer->head_sn = ieee80211_sn_inc(buffer->head_sn);
 775                 /* No need to update AMSDU last SN - we are moving the head */
 776                 spin_unlock_bh(&buffer->lock);
 777                 return false;
 778         }
 779
 780         index = sn % buffer->buf_size;
 781
 782         /*
 783          * Check if we already stored this frame
 784          * As AMSDU is either received or not as whole, logic is simple:
 785          * If we have frames in that position in the buffer and the last frame
 786          * originated from AMSDU had a different SN then it is a retransmission.
 787          * If it is the same SN then if the subframe index is incrementing it
 788          * is the same AMSDU - otherwise it is a retransmission.
 789          */
 790         tail = skb_peek_tail(&entries[index].e.frames);
 791         if (tail && !amsdu)
 792                 goto drop;
 793         else if (tail && (sn != buffer->last_amsdu ||
 794                           buffer->last_sub_index >= sub_frame_idx))
 795                 goto drop;
 796
 797         /* put in reorder buffer */
 798         __skb_queue_tail(&entries[index].e.frames, skb);
 799         buffer->num_stored++;
 800         entries[index].e.reorder_time = jiffies;
 801
 802         if (amsdu) {
 803                 buffer->last_amsdu = sn;
 804                 buffer->last_sub_index = sub_frame_idx;
 805         }
 806
 807         /*
 808          * We cannot trust NSSN for AMSDU sub-frames that are not the last.
 809          * The reason is that NSSN advances on the first sub-frame, and may
 810          * cause the reorder buffer to advance before all the sub-frames arrive.
 811          * Example: reorder buffer contains SN 0 & 2, and we receive AMSDU with
 812          * SN 1. NSSN for first sub frame will be 3 with the result of driver
 813          * releasing SN 0,1, 2. When sub-frame 1 arrives - reorder buffer is
 814          * already ahead and it will be dropped.
 815          * If the last sub-frame is not on this queue - we will get frame
 816          * release notification with up to date NSSN.
 817          */
 818         if (!amsdu || last_subframe)
 819                 iwl_mvm_release_frames(mvm, sta, napi, baid_data, buffer, nssn);
 820
 821         spin_unlock_bh(&buffer->lock);
 822         return true;
 823
 824 drop:
 825         kfree_skb(skb);
 826         spin_unlock_bh(&buffer->lock);
 827         return true;
 828 }
 829
 830 static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
 831                                     u32 reorder_data, u8 baid)
 832 {
 833         unsigned long now = jiffies;
 834         unsigned long timeout;
 835         struct iwl_mvm_baid_data *data;
 836
 837         rcu_read_lock();
 838
 839         data = rcu_dereference(mvm->baid_map[baid]);
 840         if (!data) {
 841                 IWL_DEBUG_RX(mvm,
 842                              "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
 843                               baid, reorder_data);
 844                 goto out;
 845         }
 846
 847         if (!data->timeout)
 848                 goto out;
 849
 850         timeout = data->timeout;
 851         /*
 852          * Do not update last rx all the time to avoid cache bouncing
 853          * between the rx queues.
 854          * Update it every timeout. Worst case is the session will
 855          * expire after ~ 2 * timeout, which doesn't matter that much.
 856          */
 857         if (time_before(data->last_rx + TU_TO_JIFFIES(timeout), now))
 858                 /* Update is atomic */
 859                 data->last_rx = now;
 860
 861 out:
 862         rcu_read_unlock();
 863 }
 864
 865 static void iwl_mvm_flip_address(u8 *addr)
 866 {
 867         int i;
 868         u8 mac_addr[ETH_ALEN];
 869
 870         for (i = 0; i < ETH_ALEN; i++)
 871                 mac_addr[i] = addr[ETH_ALEN - i - 1];
 872         ether_addr_copy(addr, mac_addr);
 873 }
 874
 875 void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 876                         struct iwl_rx_cmd_buffer *rxb, int queue)
 877 {
 878         struct ieee80211_rx_status *rx_status;
 879         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 880         struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
 881         struct ieee80211_hdr *hdr;
 882         u32 len = le16_to_cpu(desc->mpdu_len);
 883         u32 rate_n_flags, gp2_on_air_rise;
 884         u16 phy_info = le16_to_cpu(desc->phy_info);
 885         struct ieee80211_sta *sta = NULL;
 886         struct sk_buff *skb;
 887         u8 crypt_len = 0, channel, energy_a, energy_b;
 888         struct ieee80211_radiotap_he *he = NULL;
 889         struct ieee80211_radiotap_he_mu *he_mu = NULL;
 890         u32 he_type = 0xffffffff;
 891         /* this is invalid e.g. because puncture type doesn't allow 0b11 */
 892 #define HE_PHY_DATA_INVAL ((u64)-1)
 893         u64 he_phy_data = HE_PHY_DATA_INVAL;
 894         size_t desc_size;
 895
 896         if (unlikely(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)))
 897                 return;
 898
 899         if (mvm->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
 900                 rate_n_flags = le32_to_cpu(desc->v3.rate_n_flags);
 901                 channel = desc->v3.channel;
 902                 gp2_on_air_rise = le32_to_cpu(desc->v3.gp2_on_air_rise);
 903                 energy_a = desc->v3.energy_a;
 904                 energy_b = desc->v3.energy_b;
 905                 desc_size = sizeof(*desc);
 906         } else {
 907                 rate_n_flags = le32_to_cpu(desc->v1.rate_n_flags);
 908                 channel = desc->v1.channel;
 909                 gp2_on_air_rise = le32_to_cpu(desc->v1.gp2_on_air_rise);
 910                 energy_a = desc->v1.energy_a;
 911                 energy_b = desc->v1.energy_b;
 912                 desc_size = IWL_RX_DESC_SIZE_V1;
 913         }
 914
 915         hdr = (void *)(pkt->data + desc_size);
 916         /* Dont use dev_alloc_skb(), we'll have enough headroom once
 917          * ieee80211_hdr pulled.
 918          */
 919         skb = alloc_skb(128, GFP_ATOMIC);
 920         if (!skb) {
 921                 IWL_ERR(mvm, "alloc_skb failed\n");
 922                 return;
 923         }
 924
 925         if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) {
 926                 /*
 927                  * If the device inserted padding it means that (it thought)
 928                  * the 802.11 header wasn't a multiple of 4 bytes long. In
 929                  * this case, reserve two bytes at the start of the SKB to
 930                  * align the payload properly in case we end up copying it.
 931                  */
 932                 skb_reserve(skb, 2);
 933         }
 934
 935         rx_status = IEEE80211_SKB_RXCB(skb);
 936
 937         if (rate_n_flags & RATE_MCS_HE_MSK) {
 938                 static const struct ieee80211_radiotap_he known = {
 939                         .data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
 940                                              IEEE80211_RADIOTAP_HE_DATA1_DATA_DCM_KNOWN |
 941                                              IEEE80211_RADIOTAP_HE_DATA1_STBC_KNOWN |
 942                                              IEEE80211_RADIOTAP_HE_DATA1_CODING_KNOWN),
 943                         .data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN |
 944                                              IEEE80211_RADIOTAP_HE_DATA2_TXBF_KNOWN),
 945                 };
 946                 static const struct ieee80211_radiotap_he_mu mu_known = {
 947                         .flags1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_MCS_KNOWN |
 948                                               IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_DCM_KNOWN |
 949                                               IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_SYMS_USERS_KNOWN |
 950                                               IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_COMP_KNOWN),
 951                         .flags2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW_KNOWN),
 952                 };
 953                 unsigned int radiotap_len = 0;
 954
 955                 he = skb_put_data(skb, &known, sizeof(known));
 956                 radiotap_len += sizeof(known);
 957                 rx_status->flag |= RX_FLAG_RADIOTAP_HE;
 958
 959                 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK;
 960
 961                 if (phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD) {
 962                         if (mvm->trans->cfg->device_family >=
 963                             IWL_DEVICE_FAMILY_22560)
 964                                 he_phy_data = le64_to_cpu(desc->v3.he_phy_data);
 965                         else
 966                                 he_phy_data = le64_to_cpu(desc->v1.he_phy_data);
 967
 968                         if (he_type == RATE_MCS_HE_TYPE_MU) {
 969                                 he_mu = skb_put_data(skb, &mu_known,
 970                                                      sizeof(mu_known));
 971                                 radiotap_len += sizeof(mu_known);
 972                                 rx_status->flag |= RX_FLAG_RADIOTAP_HE_MU;
 973                         }
 974                 }
 975
 976                 /* temporarily hide the radiotap data */
 977                 __skb_pull(skb, radiotap_len);
 978         }
 979
 980         rx_status = IEEE80211_SKB_RXCB(skb);
 981
 982         if (iwl_mvm_rx_crypto(mvm, hdr, rx_status, phy_info, desc,
 983                               le32_to_cpu(pkt->len_n_flags), queue,
 984                               &crypt_len)) {
 985                 kfree_skb(skb);
 986                 return;
 987         }
 988
 989         /*
 990          * Keep packets with CRC errors (and with overrun) for monitor mode
 991          * (otherwise the firmware discards them) but mark them as bad.
 992          */
 993         if (!(desc->status & cpu_to_le16(IWL_RX_MPDU_STATUS_CRC_OK)) ||
 994             !(desc->status & cpu_to_le16(IWL_RX_MPDU_STATUS_OVERRUN_OK))) {
 995                 IWL_DEBUG_RX(mvm, "Bad CRC or FIFO: 0x%08X.\n",
 996                              le16_to_cpu(desc->status));
 997                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
 998         }
 999         /* set the preamble flag if appropriate */
1000         if (phy_info & IWL_RX_MPDU_PHY_SHORT_PREAMBLE)
1001                 rx_status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
1002
1003         if (likely(!(phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD))) {
1004                 u64 tsf_on_air_rise;
1005
1006                 if (mvm->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
1007                         tsf_on_air_rise = le64_to_cpu(desc->v3.tsf_on_air_rise);
1008                 else
1009                         tsf_on_air_rise = le64_to_cpu(desc->v1.tsf_on_air_rise);
1010
1011                 rx_status->mactime = tsf_on_air_rise;
1012                 /* TSF as indicated by the firmware is at INA time */
1013                 rx_status->flag |= RX_FLAG_MACTIME_PLCP_START;
1014         } else if (he_type == RATE_MCS_HE_TYPE_SU) {
1015                 u64 he_phy_data;
1016
1017                 if (mvm->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
1018                         he_phy_data = le64_to_cpu(desc->v3.he_phy_data);
1019                 else
1020                         he_phy_data = le64_to_cpu(desc->v1.he_phy_data);
1021
1022                 he->data1 |=
1023                         cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_UL_DL_KNOWN);
1024                 if (FIELD_GET(IWL_RX_HE_PHY_UPLINK,
1025                               he_phy_data))
1026                         he->data3 |=
1027                                 cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA3_UL_DL);
1028
1029                 if (!queue && !(phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
1030                         rx_status->ampdu_reference = mvm->ampdu_ref;
1031                         mvm->ampdu_ref++;
1032
1033                         rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
1034                         rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT_KNOWN;
1035                         if (FIELD_GET(IWL_RX_HE_PHY_DELIM_EOF,
1036                                       he_phy_data))
1037                                 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT;
1038                 }
1039         } else if (he_mu && he_phy_data != HE_PHY_DATA_INVAL) {
1040                 he_mu->flags1 |=
1041                         le16_encode_bits(FIELD_GET(IWL_RX_HE_PHY_SIBG_SYM_OR_USER_NUM_MASK,
1042                                                    he_phy_data),
1043                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_SIG_B_SYMS_USERS);
1044                 he_mu->flags1 |=
1045                         le16_encode_bits(FIELD_GET(IWL_RX_HE_PHY_SIGB_DCM,
1046                                                    he_phy_data),
1047                                          IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_DCM);
1048                 he_mu->flags1 |=
1049                         le16_encode_bits(FIELD_GET(IWL_RX_HE_PHY_SIGB_MCS_MASK,
1050                                                    he_phy_data),
1051                                          IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_MCS);
1052                 he_mu->flags2 |=
1053                         le16_encode_bits(FIELD_GET(IWL_RX_HE_PHY_SIGB_COMPRESSION,
1054                                                    he_phy_data),
1055                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_SIG_B_COMP);
1056                 he_mu->flags2 |=
1057                         le16_encode_bits(FIELD_GET(IWL_RX_HE_PHY_PREAMBLE_PUNC_TYPE_MASK,
1058                                                    he_phy_data),
1059                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW);
1060         }
1061         rx_status->device_timestamp = gp2_on_air_rise;
1062         rx_status->band = channel > 14 ? NL80211_BAND_5GHZ :
1063                 NL80211_BAND_2GHZ;
1064         rx_status->freq = ieee80211_channel_to_frequency(channel,
1065                                                          rx_status->band);
1066         iwl_mvm_get_signal_strength(mvm, rx_status, rate_n_flags, energy_a,
1067                                     energy_b);
1068
1069         /* update aggregation data for monitor sake on default queue */
1070         if (!queue && (phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
1071                 bool toggle_bit = phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE;
1072                 u64 he_phy_data;
1073
1074                 if (mvm->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
1075                         he_phy_data = le64_to_cpu(desc->v3.he_phy_data);
1076                 else
1077                         he_phy_data = le64_to_cpu(desc->v1.he_phy_data);
1078
1079                 rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
1080                 /* toggle is switched whenever new aggregation starts */
1081                 if (toggle_bit != mvm->ampdu_toggle) {
1082                         mvm->ampdu_ref++;
1083                         mvm->ampdu_toggle = toggle_bit;
1084
1085                         if (he_phy_data != HE_PHY_DATA_INVAL &&
1086                             he_type == RATE_MCS_HE_TYPE_MU) {
1087                                 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT_KNOWN;
1088                                 if (FIELD_GET(IWL_RX_HE_PHY_DELIM_EOF,
1089                                               he_phy_data))
1090                                         rx_status->flag |=
1091                                                 RX_FLAG_AMPDU_EOF_BIT;
1092                         }
1093                 }
1094                 rx_status->ampdu_reference = mvm->ampdu_ref;
1095         }
1096
1097         rcu_read_lock();
1098
1099         if (desc->status & cpu_to_le16(IWL_RX_MPDU_STATUS_SRC_STA_FOUND)) {
1100                 u8 id = desc->sta_id_flags & IWL_RX_MPDU_SIF_STA_ID_MASK;
1101
1102                 if (!WARN_ON_ONCE(id >= ARRAY_SIZE(mvm->fw_id_to_mac_id))) {
1103                         sta = rcu_dereference(mvm->fw_id_to_mac_id[id]);
1104                         if (IS_ERR(sta))
1105                                 sta = NULL;
1106                 }
1107         } else if (!is_multicast_ether_addr(hdr->addr2)) {
1108                 /*
1109                  * This is fine since we prevent two stations with the same
1110                  * address from being added.
1111                  */
1112                 sta = ieee80211_find_sta_by_ifaddr(mvm->hw, hdr->addr2, NULL);
1113         }
1114
1115         if (sta) {
1116                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1117                 struct ieee80211_vif *tx_blocked_vif =
1118                         rcu_dereference(mvm->csa_tx_blocked_vif);
1119                 u8 baid = (u8)((le32_to_cpu(desc->reorder_data) &
1120                                IWL_RX_MPDU_REORDER_BAID_MASK) >>
1121                                IWL_RX_MPDU_REORDER_BAID_SHIFT);
1122
1123                 if (!mvm->tcm.paused && len >= sizeof(*hdr) &&
1124                     !is_multicast_ether_addr(hdr->addr1) &&
1125                     ieee80211_is_data(hdr->frame_control) &&
1126                     time_after(jiffies, mvm->tcm.ts + MVM_TCM_PERIOD))
1127                         schedule_delayed_work(&mvm->tcm.work, 0);
1128
1129                 /*
1130                  * We have tx blocked stations (with CS bit). If we heard
1131                  * frames from a blocked station on a new channel we can
1132                  * TX to it again.
1133                  */
1134                 if (unlikely(tx_blocked_vif) &&
1135                     tx_blocked_vif == mvmsta->vif) {
1136                         struct iwl_mvm_vif *mvmvif =
1137                                 iwl_mvm_vif_from_mac80211(tx_blocked_vif);
1138
1139                         if (mvmvif->csa_target_freq == rx_status->freq)
1140                                 iwl_mvm_sta_modify_disable_tx_ap(mvm, sta,
1141                                                                  false);
1142                 }
1143
1144                 rs_update_last_rssi(mvm, mvmsta, rx_status);
1145
1146                 if (iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_RSSI) &&
1147                     ieee80211_is_beacon(hdr->frame_control)) {
1148                         struct iwl_fw_dbg_trigger_tlv *trig;
1149                         struct iwl_fw_dbg_trigger_low_rssi *rssi_trig;
1150                         bool trig_check;
1151                         s32 rssi;
1152
1153                         trig = iwl_fw_dbg_get_trigger(mvm->fw,
1154                                                       FW_DBG_TRIGGER_RSSI);
1155                         rssi_trig = (void *)trig->data;
1156                         rssi = le32_to_cpu(rssi_trig->rssi);
1157
1158                         trig_check =
1159                                 iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
1160                                                               ieee80211_vif_to_wdev(mvmsta->vif),
1161                                                               trig);
1162                         if (trig_check && rx_status->signal < rssi)
1163                                 iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
1164                                                         NULL);
1165                 }
1166
1167                 if (ieee80211_is_data(hdr->frame_control))
1168                         iwl_mvm_rx_csum(sta, skb, desc);
1169
1170                 if (iwl_mvm_is_dup(sta, queue, rx_status, hdr, desc)) {
1171                         kfree_skb(skb);
1172                         goto out;
1173                 }
1174
1175                 /*
1176                  * Our hardware de-aggregates AMSDUs but copies the mac header
1177                  * as it to the de-aggregated MPDUs. We need to turn off the
1178                  * AMSDU bit in the QoS control ourselves.
1179                  * In addition, HW reverses addr3 and addr4 - reverse it back.
1180                  */
1181                 if ((desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU) &&
1182                     !WARN_ON(!ieee80211_is_data_qos(hdr->frame_control))) {
1183                         u8 *qc = ieee80211_get_qos_ctl(hdr);
1184
1185                         *qc &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
1186
1187                         if (mvm->trans->cfg->device_family ==
1188                             IWL_DEVICE_FAMILY_9000) {
1189                                 iwl_mvm_flip_address(hdr->addr3);
1190
1191                                 if (ieee80211_has_a4(hdr->frame_control))
1192                                         iwl_mvm_flip_address(hdr->addr4);
1193                         }
1194                 }
1195                 if (baid != IWL_RX_REORDER_DATA_INVALID_BAID) {
1196                         u32 reorder_data = le32_to_cpu(desc->reorder_data);
1197
1198                         iwl_mvm_agg_rx_received(mvm, reorder_data, baid);
1199                 }
1200         }
1201
1202         switch (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK) {
1203         case RATE_MCS_CHAN_WIDTH_20:
1204                 break;
1205         case RATE_MCS_CHAN_WIDTH_40:
1206                 rx_status->bw = RATE_INFO_BW_40;
1207                 break;
1208         case RATE_MCS_CHAN_WIDTH_80:
1209                 rx_status->bw = RATE_INFO_BW_80;
1210                 break;
1211         case RATE_MCS_CHAN_WIDTH_160:
1212                 rx_status->bw = RATE_INFO_BW_160;
1213                 break;
1214         }
1215
1216         if (he_type == RATE_MCS_HE_TYPE_EXT_SU &&
1217             rate_n_flags & RATE_MCS_HE_106T_MSK) {
1218                 rx_status->bw = RATE_INFO_BW_HE_RU;
1219                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_106;
1220         }
1221
1222         if (rate_n_flags & RATE_MCS_HE_MSK &&
1223             phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD &&
1224             he_type == RATE_MCS_HE_TYPE_MU) {
1225                 /*
1226                  * Unfortunately, we have to leave the mac80211 data
1227                  * incorrect for the case that we receive an HE-MU
1228                  * transmission and *don't* have the he_mu pointer,
1229                  * i.e. we don't have the phy data (due to the bits
1230                  * being used for TSF). This shouldn't happen though
1231                  * as management frames where we need the TSF/timers
1232                  * are not be transmitted in HE-MU, I think.
1233                  */
1234                 u8 ru = FIELD_GET(IWL_RX_HE_PHY_RU_ALLOC_MASK, he_phy_data);
1235                 u8 offs = 0;
1236
1237                 rx_status->bw = RATE_INFO_BW_HE_RU;
1238
1239                 switch (ru) {
1240                 case 0 ... 36:
1241                         rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_26;
1242                         offs = ru;
1243                         break;
1244                 case 37 ... 52:
1245                         rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_52;
1246                         offs = ru - 37;
1247                         break;
1248                 case 53 ... 60:
1249                         rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_106;
1250                         offs = ru - 53;
1251                         break;
1252                 case 61 ... 64:
1253                         rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_242;
1254                         offs = ru - 61;
1255                         break;
1256                 case 65 ... 66:
1257                         rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_484;
1258                         offs = ru - 65;
1259                         break;
1260                 case 67:
1261                         rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_996;
1262                         break;
1263                 case 68:
1264                         rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_2x996;
1265                         break;
1266                 }
1267                 he->data2 |=
1268                         le16_encode_bits(offs,
1269                                          IEEE80211_RADIOTAP_HE_DATA2_RU_OFFSET);
1270                 he->data2 |=
1271                         cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_KNOWN);
1272                 if (he_phy_data & IWL_RX_HE_PHY_RU_ALLOC_SEC80)
1273                         he->data2 |=
1274                                 cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_SEC);
1275         } else if (he) {
1276                 he->data1 |=
1277                         cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN);
1278         }
1279
1280         if (!(rate_n_flags & RATE_MCS_CCK_MSK) &&
1281             rate_n_flags & RATE_MCS_SGI_MSK)
1282                 rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
1283         if (rate_n_flags & RATE_HT_MCS_GF_MSK)
1284                 rx_status->enc_flags |= RX_ENC_FLAG_HT_GF;
1285         if (rate_n_flags & RATE_MCS_LDPC_MSK)
1286                 rx_status->enc_flags |= RX_ENC_FLAG_LDPC;
1287         if (rate_n_flags & RATE_MCS_HT_MSK) {
1288                 u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
1289                                 RATE_MCS_STBC_POS;
1290                 rx_status->encoding = RX_ENC_HT;
1291                 rx_status->rate_idx = rate_n_flags & RATE_HT_MCS_INDEX_MSK;
1292                 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
1293         } else if (rate_n_flags & RATE_MCS_VHT_MSK) {
1294                 u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
1295                                 RATE_MCS_STBC_POS;
1296                 rx_status->nss =
1297                         ((rate_n_flags & RATE_VHT_MCS_NSS_MSK) >>
1298                                                 RATE_VHT_MCS_NSS_POS) + 1;
1299                 rx_status->rate_idx = rate_n_flags & RATE_VHT_MCS_RATE_CODE_MSK;
1300                 rx_status->encoding = RX_ENC_VHT;
1301                 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
1302                 if (rate_n_flags & RATE_MCS_BF_MSK)
1303                         rx_status->enc_flags |= RX_ENC_FLAG_BF;
1304         } else if (he) {
1305                 u8 stbc = (rate_n_flags & RATE_MCS_STBC_MSK) >>
1306                                 RATE_MCS_STBC_POS;
1307                 rx_status->nss =
1308                         ((rate_n_flags & RATE_VHT_MCS_NSS_MSK) >>
1309                                                 RATE_VHT_MCS_NSS_POS) + 1;
1310                 rx_status->rate_idx = rate_n_flags & RATE_VHT_MCS_RATE_CODE_MSK;
1311                 rx_status->encoding = RX_ENC_HE;
1312                 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
1313                 if (rate_n_flags & RATE_MCS_BF_MSK)
1314                         rx_status->enc_flags |= RX_ENC_FLAG_BF;
1315
1316                 rx_status->he_dcm =
1317                         !!(rate_n_flags & RATE_HE_DUAL_CARRIER_MODE_MSK);
1318
1319 #define CHECK_TYPE(F)                                                   \
1320         BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA1_FORMAT_ ## F !=        \
1321                      (RATE_MCS_HE_TYPE_ ## F >> RATE_MCS_HE_TYPE_POS))
1322
1323                 CHECK_TYPE(SU);
1324                 CHECK_TYPE(EXT_SU);
1325                 CHECK_TYPE(MU);
1326                 CHECK_TYPE(TRIG);
1327
1328                 he->data1 |= cpu_to_le16(he_type >> RATE_MCS_HE_TYPE_POS);
1329
1330                 if (rate_n_flags & RATE_MCS_BF_POS)
1331                         he->data5 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA5_TXBF);
1332
1333                 switch ((rate_n_flags & RATE_MCS_HE_GI_LTF_MSK) >>
1334                         RATE_MCS_HE_GI_LTF_POS) {
1335                 case 0:
1336                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1337                         break;
1338                 case 1:
1339                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1340                         break;
1341                 case 2:
1342                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
1343                         break;
1344                 case 3:
1345                         if (rate_n_flags & RATE_MCS_SGI_MSK)
1346                                 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1347                         else
1348                                 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
1349                         break;
1350                 }
1351
1352                 switch (he_type) {
1353                 case RATE_MCS_HE_TYPE_SU: {
1354                         u16 val;
1355
1356                         /* LTF syms correspond to streams */
1357                         he->data2 |=
1358                                 cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_NUM_LTF_SYMS_KNOWN);
1359                         switch (rx_status->nss) {
1360                         case 1:
1361                                 val = 0;
1362                                 break;
1363                         case 2:
1364                                 val = 1;
1365                                 break;
1366                         case 3:
1367                         case 4:
1368                                 val = 2;
1369                                 break;
1370                         case 5:
1371                         case 6:
1372                                 val = 3;
1373                                 break;
1374                         case 7:
1375                         case 8:
1376                                 val = 4;
1377                                 break;
1378                         default:
1379                                 WARN_ONCE(1, "invalid nss: %d\n",
1380                                           rx_status->nss);
1381                                 val = 0;
1382                         }
1383                         he->data5 |=
1384                                 le16_encode_bits(val,
1385                                                  IEEE80211_RADIOTAP_HE_DATA5_NUM_LTF_SYMS);
1386                         }
1387                         break;
1388                 case RATE_MCS_HE_TYPE_MU: {
1389                         u16 val;
1390                         u64 he_phy_data;
1391
1392                         if (mvm->trans->cfg->device_family >=
1393                             IWL_DEVICE_FAMILY_22560)
1394                                 he_phy_data = le64_to_cpu(desc->v3.he_phy_data);
1395                         else
1396                                 he_phy_data = le64_to_cpu(desc->v1.he_phy_data);
1397
1398                         if (he_phy_data == HE_PHY_DATA_INVAL)
1399                                 break;
1400
1401                         val = FIELD_GET(IWL_RX_HE_PHY_HE_LTF_NUM_MASK,
1402                                         he_phy_data);
1403
1404                         he->data2 |=
1405                                 cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_NUM_LTF_SYMS_KNOWN);
1406                         he->data5 |=
1407                                 cpu_to_le16(FIELD_PREP(
1408                                         IEEE80211_RADIOTAP_HE_DATA5_NUM_LTF_SYMS,
1409                                         val));
1410                         }
1411                         break;
1412                 case RATE_MCS_HE_TYPE_EXT_SU:
1413                 case RATE_MCS_HE_TYPE_TRIG:
1414                         /* not supported yet */
1415                         break;
1416                 }
1417         } else {
1418                 int rate = iwl_mvm_legacy_rate_to_mac80211_idx(rate_n_flags,
1419                                                                rx_status->band);
1420
1421                 if (WARN(rate < 0 || rate > 0xFF,
1422                          "Invalid rate flags 0x%x, band %d,\n",
1423                          rate_n_flags, rx_status->band)) {
1424                         kfree_skb(skb);
1425                         goto out;
1426                 }
1427                 rx_status->rate_idx = rate;
1428
1429         }
1430
1431         /* management stuff on default queue */
1432         if (!queue) {
1433                 if (unlikely((ieee80211_is_beacon(hdr->frame_control) ||
1434                               ieee80211_is_probe_resp(hdr->frame_control)) &&
1435                              mvm->sched_scan_pass_all ==
1436                              SCHED_SCAN_PASS_ALL_ENABLED))
1437                         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_FOUND;
1438
1439                 if (unlikely(ieee80211_is_beacon(hdr->frame_control) ||
1440                              ieee80211_is_probe_resp(hdr->frame_control)))
1441                         rx_status->boottime_ns = ktime_get_boot_ns();
1442         }
1443
1444         if (iwl_mvm_create_skb(mvm, skb, hdr, len, crypt_len, rxb)) {
1445                 kfree_skb(skb);
1446                 goto out;
1447         }
1448
1449         if (!iwl_mvm_reorder(mvm, napi, queue, sta, skb, desc))
1450                 iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta);
1451 out:
1452         rcu_read_unlock();
1453 }
1454
1455 void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
1456                               struct iwl_rx_cmd_buffer *rxb, int queue)
1457 {
1458         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1459         struct iwl_frame_release *release = (void *)pkt->data;
1460         struct ieee80211_sta *sta;
1461         struct iwl_mvm_reorder_buffer *reorder_buf;
1462         struct iwl_mvm_baid_data *ba_data;
1463
1464         int baid = release->baid;
1465
1466         IWL_DEBUG_HT(mvm, "Frame release notification for BAID %u, NSSN %d\n",
1467                      release->baid, le16_to_cpu(release->nssn));
1468
1469         if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID))
1470                 return;
1471
1472         rcu_read_lock();
1473
1474         ba_data = rcu_dereference(mvm->baid_map[baid]);
1475         if (WARN_ON_ONCE(!ba_data))
1476                 goto out;
1477
1478         sta = rcu_dereference(mvm->fw_id_to_mac_id[ba_data->sta_id]);
1479         if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta)))
1480                 goto out;
1481
1482         reorder_buf = &ba_data->reorder_buf[queue];
1483
1484         spin_lock_bh(&reorder_buf->lock);
1485         iwl_mvm_release_frames(mvm, sta, napi, ba_data, reorder_buf,
1486                                le16_to_cpu(release->nssn));
1487         spin_unlock_bh(&reorder_buf->lock);
1488
1489 out:
1490         rcu_read_unlock();
1491 }