git.itanic.dy.fi Git - linux-stable/blob

1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause

2 /*

6 */

7 #include <linux/ieee80211.h>

8 #include <linux/etherdevice.h>

9 #include <linux/tcp.h>

10 #include <net/ip.h>

11 #include <net/ipv6.h>

12

13 #include "iwl-trans.h"

14 #include "iwl-eeprom-parse.h"

15 #include "mvm.h"

16 #include "sta.h"

17

18 static void

19 iwl_mvm_bar_check_trigger(struct iwl_mvm *mvm, const u8 *addr,

20 u16 tid, u16 ssn)

21 {

22 struct iwl_fw_dbg_trigger_tlv *trig;

23 struct iwl_fw_dbg_trigger_ba *ba_trig;

24

25 trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, NULL, FW_DBG_TRIGGER_BA);

26 if (!trig)

27 return;

28

29 ba_trig = (void *)trig->data;

30

31 if (!(le16_to_cpu(ba_trig->tx_bar) & BIT(tid)))

32 return;

33

34 iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,

35 "BAR sent to %pM, tid %d, ssn %d",

36 addr, tid, ssn);

37 }

38

39 #define OPT_HDR(type, skb, off) \

40 (type *)(skb_network_header(skb) + (off))

41

42 static u16 iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,

43 struct ieee80211_hdr *hdr,

44 struct ieee80211_tx_info *info,

45 u16 offload_assist)

46 {

47 #if IS_ENABLED(CONFIG_INET)

48 u16 mh_len = ieee80211_hdrlen(hdr->frame_control);

49 u8 protocol = 0;

50

51 /* Do not compute checksum if already computed */

52 if (skb->ip_summed != CHECKSUM_PARTIAL)

53 goto out;

54

55 /* We do not expect to be requested to csum stuff we do not support */

56 if (WARN_ONCE(!(mvm->hw->netdev_features & IWL_TX_CSUM_NETIF_FLAGS) ||

57 (skb->protocol != htons(ETH_P_IP) &&

58 skb->protocol != htons(ETH_P_IPV6)),

59 "No support for requested checksum\n")) {

60 skb_checksum_help(skb);

61 goto out;

62 }

63

64 if (skb->protocol == htons(ETH_P_IP)) {

65 protocol = ip_hdr(skb)->protocol;

66 } else {

67 #if IS_ENABLED(CONFIG_IPV6)

68 struct ipv6hdr *ipv6h =

69 (struct ipv6hdr *)skb_network_header(skb);

70 unsigned int off = sizeof(*ipv6h);

71

72 protocol = ipv6h->nexthdr;

73 while (protocol != NEXTHDR_NONE && ipv6_ext_hdr(protocol)) {

74 struct ipv6_opt_hdr *hp;

75

76 /* only supported extension headers */

77 if (protocol != NEXTHDR_ROUTING &&

78 protocol != NEXTHDR_HOP &&

79 protocol != NEXTHDR_DEST) {

80 skb_checksum_help(skb);

81 goto out;

82 }

83

84 hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);

85 protocol = hp->nexthdr;

86 off += ipv6_optlen(hp);

87 }

88 /* if we get here - protocol now should be TCP/UDP */

89 #endif

90 }

91

92 if (protocol != IPPROTO_TCP && protocol != IPPROTO_UDP) {

93 WARN_ON_ONCE(1);

94 skb_checksum_help(skb);

95 goto out;

96 }

97

98 /* enable L4 csum */

99 offload_assist |= BIT(TX_CMD_OFFLD_L4_EN);

100

101 /*

102 * Set offset to IP header (snap).

103 * We don't support tunneling so no need to take care of inner header.

104 * Size is in words.

105 */

106 offload_assist |= (4 << TX_CMD_OFFLD_IP_HDR);

107

108 /* Do IPv4 csum for AMSDU only (no IP csum for Ipv6) */

109 if (skb->protocol == htons(ETH_P_IP) &&

110 (offload_assist & BIT(TX_CMD_OFFLD_AMSDU))) {

111 ip_hdr(skb)->check = 0;

112 offload_assist |= BIT(TX_CMD_OFFLD_L3_EN);

113 }

114

115 /* reset UDP/TCP header csum */

116 if (protocol == IPPROTO_TCP)

117 tcp_hdr(skb)->check = 0;

118 else

119 udp_hdr(skb)->check = 0;

120

121 /*

122 * mac header len should include IV, size is in words unless

123 * the IV is added by the firmware like in WEP.

124 * In new Tx API, the IV is always added by the firmware.

125 */

126 if (!iwl_mvm_has_new_tx_api(mvm) && info->control.hw_key &&

127 info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP40 &&

128 info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP104)

129 mh_len += info->control.hw_key->iv_len;

130 mh_len /= 2;

131 offload_assist |= mh_len << TX_CMD_OFFLD_MH_SIZE;

132

133 out:

134 #endif

135 return offload_assist;

136 }

137

138 /*

139 * Sets most of the Tx cmd's fields

140 */

141 void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,

142 struct iwl_tx_cmd *tx_cmd,

143 struct ieee80211_tx_info *info, u8 sta_id)

144 {

145 struct ieee80211_hdr *hdr = (void *)skb->data;

146 __le16 fc = hdr->frame_control;

147 u32 tx_flags = le32_to_cpu(tx_cmd->tx_flags);

148 u32 len = skb->len + FCS_LEN;

149 u16 offload_assist = 0;

150 u8 ac;

151

152 if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) ||

153 (ieee80211_is_probe_resp(fc) &&

154 !is_multicast_ether_addr(hdr->addr1)))

155 tx_flags |= TX_CMD_FLG_ACK;

156 else

157 tx_flags &= ~TX_CMD_FLG_ACK;

158

159 if (ieee80211_is_probe_resp(fc))

160 tx_flags |= TX_CMD_FLG_TSF;

161

162 if (ieee80211_has_morefrags(fc))

163 tx_flags |= TX_CMD_FLG_MORE_FRAG;

164

165 if (ieee80211_is_data_qos(fc)) {

166 u8 *qc = ieee80211_get_qos_ctl(hdr);

167 tx_cmd->tid_tspec = qc[0] & 0xf;

168 tx_flags &= ~TX_CMD_FLG_SEQ_CTL;

169 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)

170 offload_assist |= BIT(TX_CMD_OFFLD_AMSDU);

171 } else if (ieee80211_is_back_req(fc)) {

172 struct ieee80211_bar *bar = (void *)skb->data;

173 u16 control = le16_to_cpu(bar->control);

174 u16 ssn = le16_to_cpu(bar->start_seq_num);

175

176 tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;

177 tx_cmd->tid_tspec = (control &

178 IEEE80211_BAR_CTRL_TID_INFO_MASK) >>

179 IEEE80211_BAR_CTRL_TID_INFO_SHIFT;

180 WARN_ON_ONCE(tx_cmd->tid_tspec >= IWL_MAX_TID_COUNT);

181 iwl_mvm_bar_check_trigger(mvm, bar->ra, tx_cmd->tid_tspec,

182 ssn);

183 } else {

184 if (ieee80211_is_data(fc))

185 tx_cmd->tid_tspec = IWL_TID_NON_QOS;

186 else

187 tx_cmd->tid_tspec = IWL_MAX_TID_COUNT;

188

189 if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)

190 tx_flags |= TX_CMD_FLG_SEQ_CTL;

191 else

192 tx_flags &= ~TX_CMD_FLG_SEQ_CTL;

193 }

194

195 /* Default to 0 (BE) when tid_spec is set to IWL_MAX_TID_COUNT */

196 if (tx_cmd->tid_tspec < IWL_MAX_TID_COUNT)

197 ac = tid_to_mac80211_ac[tx_cmd->tid_tspec];

198 else

199 ac = tid_to_mac80211_ac[0];

200

201 tx_flags |= iwl_mvm_bt_coex_tx_prio(mvm, hdr, info, ac) <<

202 TX_CMD_FLG_BT_PRIO_POS;

203

204 if (ieee80211_is_mgmt(fc)) {

205 if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))

206 tx_cmd->pm_frame_timeout = cpu_to_le16(PM_FRAME_ASSOC);

207 else if (ieee80211_is_action(fc))

208 tx_cmd->pm_frame_timeout = cpu_to_le16(PM_FRAME_NONE);

209 else

210 tx_cmd->pm_frame_timeout = cpu_to_le16(PM_FRAME_MGMT);

211

212 /* The spec allows Action frames in A-MPDU, we don't support

213 * it

214 */

215 WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_AMPDU);

216 } else if (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO) {

217 tx_cmd->pm_frame_timeout = cpu_to_le16(PM_FRAME_MGMT);

218 } else {

219 tx_cmd->pm_frame_timeout = cpu_to_le16(PM_FRAME_NONE);

220 }

221

222 if (ieee80211_is_data(fc) && len > mvm->rts_threshold &&

223 !is_multicast_ether_addr(hdr->addr1))

224 tx_flags |= TX_CMD_FLG_PROT_REQUIRE;

225

226 if (fw_has_capa(&mvm->fw->ucode_capa,

227 IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT) &&

228 ieee80211_action_contains_tpc(skb))

229 tx_flags |= TX_CMD_FLG_WRITE_TX_POWER;

230

231 tx_cmd->tx_flags = cpu_to_le32(tx_flags);

232 /* Total # bytes to be transmitted - PCIe code will adjust for A-MSDU */

233 tx_cmd->len = cpu_to_le16((u16)skb->len);

234 tx_cmd->life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);

235 tx_cmd->sta_id = sta_id;

236

237 /* padding is inserted later in transport */

238 if (ieee80211_hdrlen(fc) % 4 &&

239 !(offload_assist & BIT(TX_CMD_OFFLD_AMSDU)))

240 offload_assist |= BIT(TX_CMD_OFFLD_PAD);

241

242 tx_cmd->offload_assist |=

243 cpu_to_le16(iwl_mvm_tx_csum(mvm, skb, hdr, info,

244 offload_assist));

245 }

246

247 static u32 iwl_mvm_get_tx_ant(struct iwl_mvm *mvm,

248 struct ieee80211_tx_info *info,

249 struct ieee80211_sta *sta, __le16 fc)

250 {

251 if (info->band == NL80211_BAND_2GHZ &&

252 !iwl_mvm_bt_coex_is_shared_ant_avail(mvm))

253 return mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS;

254

255 if (sta && ieee80211_is_data(fc)) {

256 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

257

258 return BIT(mvmsta->tx_ant) << RATE_MCS_ANT_POS;

259 }

260

261 return BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;

262 }

263

264 static u32 iwl_mvm_get_tx_rate(struct iwl_mvm *mvm,

265 struct ieee80211_tx_info *info,

266 struct ieee80211_sta *sta, __le16 fc)

267 {

268 int rate_idx = -1;

269 u8 rate_plcp;

270 u32 rate_flags = 0;

271 bool is_cck;

272 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

273

274 /* info->control is only relevant for non HW rate control */

275 if (!ieee80211_hw_check(mvm->hw, HAS_RATE_CONTROL)) {

276 /* HT rate doesn't make sense for a non data frame */

277 WARN_ONCE(info->control.rates[0].flags & IEEE80211_TX_RC_MCS &&

278 !ieee80211_is_data(fc),

279 "Got a HT rate (flags:0x%x/mcs:%d/fc:0x%x/state:%d) for a non data frame\n",

280 info->control.rates[0].flags,

281 info->control.rates[0].idx,

282 le16_to_cpu(fc), mvmsta->sta_state);

283

284 rate_idx = info->control.rates[0].idx;

285 }

286

287 /* if the rate isn't a well known legacy rate, take the lowest one */

288 if (rate_idx < 0 || rate_idx >= IWL_RATE_COUNT_LEGACY)

289 rate_idx = rate_lowest_index(

290 &mvm->nvm_data->bands[info->band], sta);

291

292 /*

293 * For non 2 GHZ band, remap mac80211 rate

294 * indices into driver indices

295 */

296 if (info->band != NL80211_BAND_2GHZ)

297 rate_idx += IWL_FIRST_OFDM_RATE;

298

299 /* For 2.4 GHZ band, check that there is no need to remap */

300 BUILD_BUG_ON(IWL_FIRST_CCK_RATE != 0);

301

302 /* Get PLCP rate for tx_cmd->rate_n_flags */

303 rate_plcp = iwl_mvm_mac80211_idx_to_hwrate(mvm->fw, rate_idx);

304 is_cck = (rate_idx >= IWL_FIRST_CCK_RATE) && (rate_idx <= IWL_LAST_CCK_RATE);

305

306 /* Set CCK or OFDM flag */

307 if (iwl_fw_lookup_cmd_ver(mvm->fw, LONG_GROUP, TX_CMD, 0) > 8) {

308 if (!is_cck)

309 rate_flags |= RATE_MCS_LEGACY_OFDM_MSK;

310 else

311 rate_flags |= RATE_MCS_CCK_MSK;

312 } else if (is_cck) {

313 rate_flags |= RATE_MCS_CCK_MSK_V1;

314 }

315

316 return (u32)rate_plcp | rate_flags;

317 }

318

319 static u32 iwl_mvm_get_tx_rate_n_flags(struct iwl_mvm *mvm,

320 struct ieee80211_tx_info *info,

321 struct ieee80211_sta *sta, __le16 fc)

322 {

323 return iwl_mvm_get_tx_rate(mvm, info, sta, fc) |

324 iwl_mvm_get_tx_ant(mvm, info, sta, fc);

325 }

326

327 /*

328 * Sets the fields in the Tx cmd that are rate related

329 */

330 void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,

331 struct ieee80211_tx_info *info,

332 struct ieee80211_sta *sta, __le16 fc)

333 {

334 /* Set retry limit on RTS packets */

335 tx_cmd->rts_retry_limit = IWL_RTS_DFAULT_RETRY_LIMIT;

336

337 /* Set retry limit on DATA packets and Probe Responses*/

338 if (ieee80211_is_probe_resp(fc)) {

339 tx_cmd->data_retry_limit = IWL_MGMT_DFAULT_RETRY_LIMIT;

340 tx_cmd->rts_retry_limit =

341 min(tx_cmd->data_retry_limit, tx_cmd->rts_retry_limit);

342 } else if (ieee80211_is_back_req(fc)) {

343 tx_cmd->data_retry_limit = IWL_BAR_DFAULT_RETRY_LIMIT;

344 } else {

345 tx_cmd->data_retry_limit = IWL_DEFAULT_TX_RETRY;

346 }

347

348 /*

349 * for data packets, rate info comes from the table inside the fw. This

350 * table is controlled by LINK_QUALITY commands

351 */

352

353 if (ieee80211_is_data(fc) && sta) {

354 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

355

356 if (mvmsta->sta_state >= IEEE80211_STA_AUTHORIZED) {

357 tx_cmd->initial_rate_index = 0;

358 tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE);

359 return;

360 }

361 } else if (ieee80211_is_back_req(fc)) {

362 tx_cmd->tx_flags |=

363 cpu_to_le32(TX_CMD_FLG_ACK | TX_CMD_FLG_BAR);

364 }

365

366 /* Set the rate in the TX cmd */

367 tx_cmd->rate_n_flags =

368 cpu_to_le32(iwl_mvm_get_tx_rate_n_flags(mvm, info, sta, fc));

369 }

370

371 static inline void iwl_mvm_set_tx_cmd_pn(struct ieee80211_tx_info *info,

372 u8 *crypto_hdr)

373 {

374 struct ieee80211_key_conf *keyconf = info->control.hw_key;

375 u64 pn;

376

377 pn = atomic64_inc_return(&keyconf->tx_pn);

378 crypto_hdr[0] = pn;

379 crypto_hdr[2] = 0;

380 crypto_hdr[3] = 0x20 | (keyconf->keyidx << 6);

381 crypto_hdr[1] = pn >> 8;

382 crypto_hdr[4] = pn >> 16;

383 crypto_hdr[5] = pn >> 24;

384 crypto_hdr[6] = pn >> 32;

385 crypto_hdr[7] = pn >> 40;

386 }

387

388 /*

389 * Sets the fields in the Tx cmd that are crypto related

390 */

391 static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,

392 struct ieee80211_tx_info *info,

393 struct iwl_tx_cmd *tx_cmd,

394 struct sk_buff *skb_frag,

395 int hdrlen)

396 {

397 struct ieee80211_key_conf *keyconf = info->control.hw_key;

398 u8 *crypto_hdr = skb_frag->data + hdrlen;

399 enum iwl_tx_cmd_sec_ctrl type = TX_CMD_SEC_CCM;

400 u64 pn;

401

402 switch (keyconf->cipher) {

403 case WLAN_CIPHER_SUITE_CCMP:

404 iwl_mvm_set_tx_cmd_ccmp(info, tx_cmd);

405 iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);

406 break;

407

408 case WLAN_CIPHER_SUITE_TKIP:

409 tx_cmd->sec_ctl = TX_CMD_SEC_TKIP;

410 pn = atomic64_inc_return(&keyconf->tx_pn);

411 ieee80211_tkip_add_iv(crypto_hdr, keyconf, pn);

412 ieee80211_get_tkip_p2k(keyconf, skb_frag, tx_cmd->key);

413 break;

414

415 case WLAN_CIPHER_SUITE_WEP104:

416 tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;

417 fallthrough;

418 case WLAN_CIPHER_SUITE_WEP40:

419 tx_cmd->sec_ctl |= TX_CMD_SEC_WEP |

420 ((keyconf->keyidx << TX_CMD_SEC_WEP_KEY_IDX_POS) &

421 TX_CMD_SEC_WEP_KEY_IDX_MSK);

422

423 memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);

424 break;

425 case WLAN_CIPHER_SUITE_GCMP:

426 case WLAN_CIPHER_SUITE_GCMP_256:

427 type = TX_CMD_SEC_GCMP;

428 fallthrough;

429 case WLAN_CIPHER_SUITE_CCMP_256:

430 /* TODO: Taking the key from the table might introduce a race

431 * when PTK rekeying is done, having an old packets with a PN

432 * based on the old key but the message encrypted with a new

433 * one.

434 * Need to handle this.

435 */

436 tx_cmd->sec_ctl |= type | TX_CMD_SEC_KEY_FROM_TABLE;

437 tx_cmd->key[0] = keyconf->hw_key_idx;

438 iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);

439 break;

440 default:

441 tx_cmd->sec_ctl |= TX_CMD_SEC_EXT;

442 }

443 }

444

445 /*

446 * Allocates and sets the Tx cmd the driver data pointers in the skb

447 */

448 static struct iwl_device_tx_cmd *

449 iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,

450 struct ieee80211_tx_info *info, int hdrlen,

451 struct ieee80211_sta *sta, u8 sta_id)

452 {

453 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;

454 struct iwl_device_tx_cmd *dev_cmd;

455 struct iwl_tx_cmd *tx_cmd;

456

457 dev_cmd = iwl_trans_alloc_tx_cmd(mvm->trans);

458

459 if (unlikely(!dev_cmd))

460 return NULL;

461

462 dev_cmd->hdr.cmd = TX_CMD;

463

464 if (iwl_mvm_has_new_tx_api(mvm)) {

465 u16 offload_assist = 0;

466 u32 rate_n_flags = 0;

467 u16 flags = 0;

468 struct iwl_mvm_sta *mvmsta = sta ?

469 iwl_mvm_sta_from_mac80211(sta) : NULL;

470

471 if (ieee80211_is_data_qos(hdr->frame_control)) {

472 u8 *qc = ieee80211_get_qos_ctl(hdr);

473

474 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)

475 offload_assist |= BIT(TX_CMD_OFFLD_AMSDU);

476 }

477

478 offload_assist = iwl_mvm_tx_csum(mvm, skb, hdr, info,

479 offload_assist);

480

481 /* padding is inserted later in transport */

482 if (ieee80211_hdrlen(hdr->frame_control) % 4 &&

483 !(offload_assist & BIT(TX_CMD_OFFLD_AMSDU)))

484 offload_assist |= BIT(TX_CMD_OFFLD_PAD);

485

486 if (!info->control.hw_key)

487 flags |= IWL_TX_FLAGS_ENCRYPT_DIS;

488

489 /*

490 * For data packets rate info comes from the fw. Only

491 * set rate/antenna during connection establishment or in case

492 * no station is given.

493 */

494 if (!sta || !ieee80211_is_data(hdr->frame_control) ||

495 mvmsta->sta_state < IEEE80211_STA_AUTHORIZED) {

496 flags |= IWL_TX_FLAGS_CMD_RATE;

497 rate_n_flags =

498 iwl_mvm_get_tx_rate_n_flags(mvm, info, sta,

499 hdr->frame_control);

500 }

501

502 if (mvm->trans->trans_cfg->device_family >=

503 IWL_DEVICE_FAMILY_AX210) {

504 struct iwl_tx_cmd_gen3 *cmd = (void *)dev_cmd->payload;

505

506 cmd->offload_assist |= cpu_to_le32(offload_assist);

507

508 /* Total # bytes to be transmitted */

509 cmd->len = cpu_to_le16((u16)skb->len);

510

511 /* Copy MAC header from skb into command buffer */

512 memcpy(cmd->hdr, hdr, hdrlen);

513

514 cmd->flags = cpu_to_le16(flags);

515 cmd->rate_n_flags = cpu_to_le32(rate_n_flags);

516 } else {

517 struct iwl_tx_cmd_gen2 *cmd = (void *)dev_cmd->payload;

518

519 cmd->offload_assist |= cpu_to_le16(offload_assist);

520

521 /* Total # bytes to be transmitted */

522 cmd->len = cpu_to_le16((u16)skb->len);

523

524 /* Copy MAC header from skb into command buffer */

525 memcpy(cmd->hdr, hdr, hdrlen);

526

527 cmd->flags = cpu_to_le32(flags);

528 cmd->rate_n_flags = cpu_to_le32(rate_n_flags);

529 }

530 goto out;

531 }

532

533 tx_cmd = (struct iwl_tx_cmd *)dev_cmd->payload;

534

535 if (info->control.hw_key)

536 iwl_mvm_set_tx_cmd_crypto(mvm, info, tx_cmd, skb, hdrlen);

537

538 iwl_mvm_set_tx_cmd(mvm, skb, tx_cmd, info, sta_id);

539

540 iwl_mvm_set_tx_cmd_rate(mvm, tx_cmd, info, sta, hdr->frame_control);

541

542 /* Copy MAC header from skb into command buffer */

543 memcpy(tx_cmd->hdr, hdr, hdrlen);

544

545 out:

546 return dev_cmd;

547 }

548

549 static void iwl_mvm_skb_prepare_status(struct sk_buff *skb,

550 struct iwl_device_tx_cmd *cmd)

551 {

552 struct ieee80211_tx_info *skb_info = IEEE80211_SKB_CB(skb);

553

554 memset(&skb_info->status, 0, sizeof(skb_info->status));

555 memset(skb_info->driver_data, 0, sizeof(skb_info->driver_data));

556

557 skb_info->driver_data[1] = cmd;

558 }

559

560 static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,

561 struct ieee80211_tx_info *info,

562 struct ieee80211_hdr *hdr)

563 {

564 struct iwl_mvm_vif *mvmvif =

565 iwl_mvm_vif_from_mac80211(info->control.vif);

566 __le16 fc = hdr->frame_control;

567

568 switch (info->control.vif->type) {

569 case NL80211_IFTYPE_AP:

570 case NL80211_IFTYPE_ADHOC:

571 /*

572 * Non-bufferable frames use the broadcast station, thus they

573 * use the probe queue.

574 * Also take care of the case where we send a deauth to a

575 * station that we don't have, or similarly an association

576 * response (with non-success status) for a station we can't

577 * accept.

578 * Also, disassociate frames might happen, particular with

579 * reason 7 ("Class 3 frame received from nonassociated STA").

580 */

581 if (ieee80211_is_mgmt(fc) &&

582 (!ieee80211_is_bufferable_mmpdu(fc) ||

583 ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))

584 return mvm->probe_queue;

585

586 if (!ieee80211_has_order(fc) && !ieee80211_is_probe_req(fc) &&

587 is_multicast_ether_addr(hdr->addr1))

588 return mvmvif->cab_queue;

589

590 WARN_ONCE(info->control.vif->type != NL80211_IFTYPE_ADHOC,

591 "fc=0x%02x", le16_to_cpu(fc));

592 return mvm->probe_queue;

593 case NL80211_IFTYPE_P2P_DEVICE:

594 if (ieee80211_is_mgmt(fc))

595 return mvm->p2p_dev_queue;

596

597 WARN_ON_ONCE(1);

598 return mvm->p2p_dev_queue;

599 default:

600 WARN_ONCE(1, "Not a ctrl vif, no available queue\n");

601 return -1;

602 }

603 }

604

605 static void iwl_mvm_probe_resp_set_noa(struct iwl_mvm *mvm,

606 struct sk_buff *skb)

607 {

608 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

609 struct iwl_mvm_vif *mvmvif =

610 iwl_mvm_vif_from_mac80211(info->control.vif);

611 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;

612 int base_len = (u8 *)mgmt->u.probe_resp.variable - (u8 *)mgmt;

613 struct iwl_probe_resp_data *resp_data;

614 u8 *ie, *pos;

615 u8 match[] = {

616 (WLAN_OUI_WFA >> 16) & 0xff,

617 (WLAN_OUI_WFA >> 8) & 0xff,

618 WLAN_OUI_WFA & 0xff,

619 WLAN_OUI_TYPE_WFA_P2P,

620 };

621

622 rcu_read_lock();

623

624 resp_data = rcu_dereference(mvmvif->probe_resp_data);

625 if (!resp_data)

626 goto out;

627

628 if (!resp_data->notif.noa_active)

629 goto out;

630

631 ie = (u8 *)cfg80211_find_ie_match(WLAN_EID_VENDOR_SPECIFIC,

632 mgmt->u.probe_resp.variable,

633 skb->len - base_len,

634 match, 4, 2);

635 if (!ie) {

636 IWL_DEBUG_TX(mvm, "probe resp doesn't have P2P IE\n");

637 goto out;

638 }

639

640 if (skb_tailroom(skb) < resp_data->noa_len) {

641 if (pskb_expand_head(skb, 0, resp_data->noa_len, GFP_ATOMIC)) {

642 IWL_ERR(mvm,

643 "Failed to reallocate probe resp\n");

644 goto out;

645 }

646 }

647

648 pos = skb_put(skb, resp_data->noa_len);

649

650 *pos++ = WLAN_EID_VENDOR_SPECIFIC;

651 /* Set length of IE body (not including ID and length itself) */

652 *pos++ = resp_data->noa_len - 2;

653 *pos++ = (WLAN_OUI_WFA >> 16) & 0xff;

654 *pos++ = (WLAN_OUI_WFA >> 8) & 0xff;

655 *pos++ = WLAN_OUI_WFA & 0xff;

656 *pos++ = WLAN_OUI_TYPE_WFA_P2P;

657

658 memcpy(pos, &resp_data->notif.noa_attr,

659 resp_data->noa_len - sizeof(struct ieee80211_vendor_ie));

660

661 out:

662 rcu_read_unlock();

663 }

664

665 int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)

666 {

667 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;

668 struct ieee80211_tx_info info;

669 struct iwl_device_tx_cmd *dev_cmd;

670 u8 sta_id;

671 int hdrlen = ieee80211_hdrlen(hdr->frame_control);

672 __le16 fc = hdr->frame_control;

673 bool offchannel = IEEE80211_SKB_CB(skb)->flags &

674 IEEE80211_TX_CTL_TX_OFFCHAN;

675 int queue = -1;

676

677 if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))

678 return -1;

679

680 memcpy(&info, skb->cb, sizeof(info));

681

682 if (WARN_ON_ONCE(skb->len > IEEE80211_MAX_DATA_LEN + hdrlen))

683 return -1;

684

685 if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))

686 return -1;

687

688 if (info.control.vif) {

689 struct iwl_mvm_vif *mvmvif =

690 iwl_mvm_vif_from_mac80211(info.control.vif);

691

692 if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE ||

693 info.control.vif->type == NL80211_IFTYPE_AP ||

694 info.control.vif->type == NL80211_IFTYPE_ADHOC) {

695 if (!ieee80211_is_data(hdr->frame_control))

696 sta_id = mvmvif->bcast_sta.sta_id;

697 else

698 sta_id = mvmvif->mcast_sta.sta_id;

699

700 queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, hdr);

701 } else if (info.control.vif->type == NL80211_IFTYPE_MONITOR) {

702 queue = mvm->snif_queue;

703 sta_id = mvm->snif_sta.sta_id;

704 } else if (info.control.vif->type == NL80211_IFTYPE_STATION &&

705 offchannel) {

706 /*

707 * IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets

708 * that can be used in 2 different types of vifs, P2P &

709 * STATION.

710 * P2P uses the offchannel queue.

711 * STATION (HS2.0) uses the auxiliary context of the FW,

712 * and hence needs to be sent on the aux queue.

713 */

714 sta_id = mvm->aux_sta.sta_id;

715 queue = mvm->aux_queue;

716 }

717 }

718

719 if (queue < 0) {

720 IWL_ERR(mvm, "No queue was found. Dropping TX\n");

721 return -1;

722 }

723

724 if (unlikely(ieee80211_is_probe_resp(fc)))

725 iwl_mvm_probe_resp_set_noa(mvm, skb);

726

727 IWL_DEBUG_TX(mvm, "station Id %d, queue=%d\n", sta_id, queue);

728

729 dev_cmd = iwl_mvm_set_tx_params(mvm, skb, &info, hdrlen, NULL, sta_id);

730 if (!dev_cmd)

731 return -1;

732

733 /* From now on, we cannot access info->control */

734 iwl_mvm_skb_prepare_status(skb, dev_cmd);

735

736 if (iwl_trans_tx(mvm->trans, skb, dev_cmd, queue)) {

737 iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);

738 return -1;

739 }

740

741 return 0;

742 }

743

744 unsigned int iwl_mvm_max_amsdu_size(struct iwl_mvm *mvm,

745 struct ieee80211_sta *sta, unsigned int tid)

746 {

747 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

748 enum nl80211_band band = mvmsta->vif->bss_conf.chandef.chan->band;

749 u8 ac = tid_to_mac80211_ac[tid];

750 unsigned int txf;

751 int lmac = iwl_mvm_get_lmac_id(mvm->fw, band);

752

753 /* For HE redirect to trigger based fifos */

754 if (sta->he_cap.has_he && !WARN_ON(!iwl_mvm_has_new_tx_api(mvm)))

755 ac += 4;

756

757 txf = iwl_mvm_mac_ac_to_tx_fifo(mvm, ac);

758

759 /*

760 * Don't send an AMSDU that will be longer than the TXF.

761 * Add a security margin of 256 for the TX command + headers.

762 * We also want to have the start of the next packet inside the

763 * fifo to be able to send bursts.

764 */

765 return min_t(unsigned int, mvmsta->max_amsdu_len,

766 mvm->fwrt.smem_cfg.lmac[lmac].txfifo_size[txf] - 256);

767 }

768

769 #ifdef CONFIG_INET

770

771 static int

772 iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes,

773 netdev_features_t netdev_flags,

774 struct sk_buff_head *mpdus_skb)

775 {

776 struct sk_buff *tmp, *next;

777 struct ieee80211_hdr *hdr = (void *)skb->data;

778 char cb[sizeof(skb->cb)];

779 u16 i = 0;

780 unsigned int tcp_payload_len;

781 unsigned int mss = skb_shinfo(skb)->gso_size;

782 bool ipv4 = (skb->protocol == htons(ETH_P_IP));

783 bool qos = ieee80211_is_data_qos(hdr->frame_control);

784 u16 ip_base_id = ipv4 ? ntohs(ip_hdr(skb)->id) : 0;

785

786 skb_shinfo(skb)->gso_size = num_subframes * mss;

787 memcpy(cb, skb->cb, sizeof(cb));

788

789 next = skb_gso_segment(skb, netdev_flags);

790 skb_shinfo(skb)->gso_size = mss;

791 skb_shinfo(skb)->gso_type = ipv4 ? SKB_GSO_TCPV4 : SKB_GSO_TCPV6;

792 if (WARN_ON_ONCE(IS_ERR(next)))

793 return -EINVAL;

794 else if (next)

795 consume_skb(skb);

796

797 skb_list_walk_safe(next, tmp, next) {

798 memcpy(tmp->cb, cb, sizeof(tmp->cb));

799 /*

800 * Compute the length of all the data added for the A-MSDU.

801 * This will be used to compute the length to write in the TX

802 * command. We have: SNAP + IP + TCP for n -1 subframes and

803 * ETH header for n subframes.

804 */

805 tcp_payload_len = skb_tail_pointer(tmp) -

806 skb_transport_header(tmp) -

807 tcp_hdrlen(tmp) + tmp->data_len;

808

809 if (ipv4)

810 ip_hdr(tmp)->id = htons(ip_base_id + i * num_subframes);

811

812 if (tcp_payload_len > mss) {

813 skb_shinfo(tmp)->gso_size = mss;

814 skb_shinfo(tmp)->gso_type = ipv4 ? SKB_GSO_TCPV4 :

815 SKB_GSO_TCPV6;

816 } else {

817 if (qos) {

818 u8 *qc;

819

820 if (ipv4)

821 ip_send_check(ip_hdr(tmp));

822

823 qc = ieee80211_get_qos_ctl((void *)tmp->data);

824 *qc &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;

825 }

826 skb_shinfo(tmp)->gso_size = 0;

827 }

828

829 skb_mark_not_on_list(tmp);

830 __skb_queue_tail(mpdus_skb, tmp);

831 i++;

832 }

833

834 return 0;

835 }

836

837 static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,

838 struct ieee80211_tx_info *info,

839 struct ieee80211_sta *sta,

840 struct sk_buff_head *mpdus_skb)

841 {

842 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

843 struct ieee80211_hdr *hdr = (void *)skb->data;

844 unsigned int mss = skb_shinfo(skb)->gso_size;

845 unsigned int num_subframes, tcp_payload_len, subf_len, max_amsdu_len;

846 u16 snap_ip_tcp, pad;

847 netdev_features_t netdev_flags = NETIF_F_CSUM_MASK | NETIF_F_SG;

848 u8 tid;

849

850 snap_ip_tcp = 8 + skb_transport_header(skb) - skb_network_header(skb) +

851 tcp_hdrlen(skb);

852

853 if (!mvmsta->max_amsdu_len ||

854 !ieee80211_is_data_qos(hdr->frame_control) ||

855 !mvmsta->amsdu_enabled)

856 return iwl_mvm_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);

857

858 /*

859 * Do not build AMSDU for IPv6 with extension headers.

860 * ask stack to segment and checkum the generated MPDUs for us.

861 */

862 if (skb->protocol == htons(ETH_P_IPV6) &&

863 ((struct ipv6hdr *)skb_network_header(skb))->nexthdr !=

864 IPPROTO_TCP) {

865 netdev_flags &= ~NETIF_F_CSUM_MASK;

866 return iwl_mvm_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);

867 }

868

869 tid = ieee80211_get_tid(hdr);

870 if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))

871 return -EINVAL;

872

873 /*

874 * No need to lock amsdu_in_ampdu_allowed since it can't be modified

875 * during an BA session.

876 */

877 if ((info->flags & IEEE80211_TX_CTL_AMPDU &&

878 !mvmsta->tid_data[tid].amsdu_in_ampdu_allowed) ||

879 !(mvmsta->amsdu_enabled & BIT(tid)))

880 return iwl_mvm_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);

881

882 /*

883 * Take the min of ieee80211 station and mvm station

884 */

885 max_amsdu_len =

886 min_t(unsigned int, sta->max_amsdu_len,

887 iwl_mvm_max_amsdu_size(mvm, sta, tid));

888

889 /*

890 * Limit A-MSDU in A-MPDU to 4095 bytes when VHT is not

891 * supported. This is a spec requirement (IEEE 802.11-2015

892 * section 8.7.3 NOTE 3).

893 */

894 if (info->flags & IEEE80211_TX_CTL_AMPDU &&

895 !sta->vht_cap.vht_supported)

896 max_amsdu_len = min_t(unsigned int, max_amsdu_len, 4095);

897

898 /* Sub frame header + SNAP + IP header + TCP header + MSS */

899 subf_len = sizeof(struct ethhdr) + snap_ip_tcp + mss;

900 pad = (4 - subf_len) & 0x3;

901

902 /*

903 * If we have N subframes in the A-MSDU, then the A-MSDU's size is

904 * N * subf_len + (N - 1) * pad.

905 */

906 num_subframes = (max_amsdu_len + pad) / (subf_len + pad);

907

908 if (sta->max_amsdu_subframes &&

909 num_subframes > sta->max_amsdu_subframes)

910 num_subframes = sta->max_amsdu_subframes;

911

912 tcp_payload_len = skb_tail_pointer(skb) - skb_transport_header(skb) -

913 tcp_hdrlen(skb) + skb->data_len;

914

915 /*

916 * Make sure we have enough TBs for the A-MSDU:

917 * 2 for each subframe

918 * 1 more for each fragment

919 * 1 more for the potential data in the header

920 */

921 if ((num_subframes * 2 + skb_shinfo(skb)->nr_frags + 1) >

922 mvm->trans->max_skb_frags)

923 num_subframes = 1;

924

925 if (num_subframes > 1)

926 *ieee80211_get_qos_ctl(hdr) |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;

927

928 /* This skb fits in one single A-MSDU */

929 if (num_subframes * mss >= tcp_payload_len) {

930 __skb_queue_tail(mpdus_skb, skb);

931 return 0;

932 }

933

934 /*

935 * Trick the segmentation function to make it

936 * create SKBs that can fit into one A-MSDU.

937 */

938 return iwl_mvm_tx_tso_segment(skb, num_subframes, netdev_flags,

939 mpdus_skb);

940 }

941 #else /* CONFIG_INET */

942 static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,

943 struct ieee80211_tx_info *info,

944 struct ieee80211_sta *sta,

945 struct sk_buff_head *mpdus_skb)

946 {

947 /* Impossible to get TSO with CONFIG_INET */

948 WARN_ON(1);

949

950 return -1;

951 }

952 #endif

953

954 /* Check if there are any timed-out TIDs on a given shared TXQ */

955 static bool iwl_mvm_txq_should_update(struct iwl_mvm *mvm, int txq_id)

956 {

957 unsigned long queue_tid_bitmap = mvm->queue_info[txq_id].tid_bitmap;

958 unsigned long now = jiffies;

959 int tid;

960

961 if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))

962 return false;

963

964 for_each_set_bit(tid, &queue_tid_bitmap, IWL_MAX_TID_COUNT + 1) {

965 if (time_before(mvm->queue_info[txq_id].last_frame_time[tid] +

966 IWL_MVM_DQA_QUEUE_TIMEOUT, now))

967 return true;

968 }

969

970 return false;

971 }

972

973 static void iwl_mvm_tx_airtime(struct iwl_mvm *mvm,

974 struct iwl_mvm_sta *mvmsta,

975 int airtime)

976 {

977 int mac = mvmsta->mac_id_n_color & FW_CTXT_ID_MSK;

978 struct iwl_mvm_tcm_mac *mdata;

979

980 if (mac >= NUM_MAC_INDEX_DRIVER)

981 return;

982

983 mdata = &mvm->tcm.data[mac];

984

985 if (mvm->tcm.paused)

986 return;

987

988 if (time_after(jiffies, mvm->tcm.ts + MVM_TCM_PERIOD))

989 schedule_delayed_work(&mvm->tcm.work, 0);

990

991 mdata->tx.airtime += airtime;

992 }

993

994 static int iwl_mvm_tx_pkt_queued(struct iwl_mvm *mvm,

995 struct iwl_mvm_sta *mvmsta, int tid)

996 {

997 u32 ac = tid_to_mac80211_ac[tid];

998 int mac = mvmsta->mac_id_n_color & FW_CTXT_ID_MSK;

999 struct iwl_mvm_tcm_mac *mdata;

1000

1001 if (mac >= NUM_MAC_INDEX_DRIVER)

1002 return -EINVAL;

1003

1004 mdata = &mvm->tcm.data[mac];

1005

1006 mdata->tx.pkts[ac]++;

1007

1008 return 0;

1009 }

1010

1011 /*

1012 * Sets the fields in the Tx cmd that are crypto related.

1013 *

1014 * This function must be called with BHs disabled.

1015 */

1016 static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,

1017 struct ieee80211_tx_info *info,

1018 struct ieee80211_sta *sta)

1019 {

1020 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;

1021 struct iwl_mvm_sta *mvmsta;

1022 struct iwl_device_tx_cmd *dev_cmd;

1023 __le16 fc;

1024 u16 seq_number = 0;

1025 u8 tid = IWL_MAX_TID_COUNT;

1026 u16 txq_id;

1027 bool is_ampdu = false;

1028 int hdrlen;

1029

1030 mvmsta = iwl_mvm_sta_from_mac80211(sta);

1031 fc = hdr->frame_control;

1032 hdrlen = ieee80211_hdrlen(fc);

1033

1034 if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))

1035 return -1;

1036

1037 if (WARN_ON_ONCE(!mvmsta))

1038 return -1;

1039

1040 if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA))

1041 return -1;

1042

1043 if (unlikely(ieee80211_is_any_nullfunc(fc)) && sta->he_cap.has_he)

1044 return -1;

1045

1046 if (unlikely(ieee80211_is_probe_resp(fc)))

1047 iwl_mvm_probe_resp_set_noa(mvm, skb);

1048

1049 dev_cmd = iwl_mvm_set_tx_params(mvm, skb, info, hdrlen,

1050 sta, mvmsta->sta_id);

1051 if (!dev_cmd)

1052 goto drop;

1053

1054 /*

1055 * we handle that entirely ourselves -- for uAPSD the firmware

1056 * will always send a notification, and for PS-Poll responses

1057 * we'll notify mac80211 when getting frame status

1058 */

1059 info->flags &= ~IEEE80211_TX_STATUS_EOSP;

1060

1061 spin_lock(&mvmsta->lock);

1062

1063 /* nullfunc frames should go to the MGMT queue regardless of QOS,

1064 * the condition of !ieee80211_is_qos_nullfunc(fc) keeps the default

1065 * assignment of MGMT TID

1066 */

1067 if (ieee80211_is_data_qos(fc) && !ieee80211_is_qos_nullfunc(fc)) {

1068 tid = ieee80211_get_tid(hdr);

1069 if (WARN_ONCE(tid >= IWL_MAX_TID_COUNT, "Invalid TID %d", tid))

1070 goto drop_unlock_sta;

1071

1072 is_ampdu = info->flags & IEEE80211_TX_CTL_AMPDU;

1073 if (WARN_ONCE(is_ampdu &&

1074 mvmsta->tid_data[tid].state != IWL_AGG_ON,

1075 "Invalid internal agg state %d for TID %d",

1076 mvmsta->tid_data[tid].state, tid))

1077 goto drop_unlock_sta;

1078

1079 seq_number = mvmsta->tid_data[tid].seq_number;

1080 seq_number &= IEEE80211_SCTL_SEQ;

1081

1082 if (!iwl_mvm_has_new_tx_api(mvm)) {

1083 struct iwl_tx_cmd *tx_cmd = (void *)dev_cmd->payload;

1084

1085 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);

1086 hdr->seq_ctrl |= cpu_to_le16(seq_number);

1087 /* update the tx_cmd hdr as it was already copied */

1088 tx_cmd->hdr->seq_ctrl = hdr->seq_ctrl;

1089 }

1090 } else if (ieee80211_is_data(fc) && !ieee80211_is_data_qos(fc)) {

1091 tid = IWL_TID_NON_QOS;

1092 }

1093

1094 txq_id = mvmsta->tid_data[tid].txq_id;

1095

1096 WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM);

1097

1098 if (WARN_ONCE(txq_id == IWL_MVM_INVALID_QUEUE, "Invalid TXQ id")) {

1099 iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);

1100 spin_unlock(&mvmsta->lock);

1101 return -1;

1102 }

1103

1104 if (!iwl_mvm_has_new_tx_api(mvm)) {

1105 /* Keep track of the time of the last frame for this RA/TID */

1106 mvm->queue_info[txq_id].last_frame_time[tid] = jiffies;

1107

1108 /*

1109 * If we have timed-out TIDs - schedule the worker that will

1110 * reconfig the queues and update them

1111 *

1112 * Note that the no lock is taken here in order to not serialize

1113 * the TX flow. This isn't dangerous because scheduling

1114 * mvm->add_stream_wk can't ruin the state, and if we DON'T

1115 * schedule it due to some race condition then next TX we get

1116 * here we will.

1117 */

1118 if (unlikely(mvm->queue_info[txq_id].status ==

1119 IWL_MVM_QUEUE_SHARED &&

1120 iwl_mvm_txq_should_update(mvm, txq_id)))

1121 schedule_work(&mvm->add_stream_wk);

1122 }

1123

1124 IWL_DEBUG_TX(mvm, "TX to [%d|%d] Q:%d - seq: 0x%x len %d\n",

1125 mvmsta->sta_id, tid, txq_id,

1126 IEEE80211_SEQ_TO_SN(seq_number), skb->len);

1127

1128 /* From now on, we cannot access info->control */

1129 iwl_mvm_skb_prepare_status(skb, dev_cmd);

1130

1131 if (iwl_trans_tx(mvm->trans, skb, dev_cmd, txq_id))

1132 goto drop_unlock_sta;

1133

1134 if (tid < IWL_MAX_TID_COUNT && !ieee80211_has_morefrags(fc))

1135 mvmsta->tid_data[tid].seq_number = seq_number + 0x10;

1136

1137 spin_unlock(&mvmsta->lock);

1138

1139 if (iwl_mvm_tx_pkt_queued(mvm, mvmsta,

1140 tid == IWL_MAX_TID_COUNT ? 0 : tid))

1141 goto drop;

1142

1143 return 0;

1144

1145 drop_unlock_sta:

1146 iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);

1147 spin_unlock(&mvmsta->lock);

1148 drop:

1149 IWL_DEBUG_TX(mvm, "TX to [%d|%d] dropped\n", mvmsta->sta_id, tid);

1150 return -1;

1151 }

1152

1153 int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,

1154 struct ieee80211_sta *sta)

1155 {

1156 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

1157 struct ieee80211_tx_info info;

1158 struct sk_buff_head mpdus_skbs;

1159 unsigned int payload_len;

1160 int ret;

1161

1162 if (WARN_ON_ONCE(!mvmsta))

1163 return -1;

1164

1165 if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA))

1166 return -1;

1167

1168 memcpy(&info, skb->cb, sizeof(info));

1169

1170 if (!skb_is_gso(skb))

1171 return iwl_mvm_tx_mpdu(mvm, skb, &info, sta);

1172

1173 payload_len = skb_tail_pointer(skb) - skb_transport_header(skb) -

1174 tcp_hdrlen(skb) + skb->data_len;

1175

1176 if (payload_len <= skb_shinfo(skb)->gso_size)

1177 return iwl_mvm_tx_mpdu(mvm, skb, &info, sta);

1178

1179 __skb_queue_head_init(&mpdus_skbs);

1180

1181 ret = iwl_mvm_tx_tso(mvm, skb, &info, sta, &mpdus_skbs);

1182 if (ret)

1183 return ret;

1184

1185 if (WARN_ON(skb_queue_empty(&mpdus_skbs)))

1186 return ret;

1187

1188 while (!skb_queue_empty(&mpdus_skbs)) {

1189 skb = __skb_dequeue(&mpdus_skbs);

1190

1191 ret = iwl_mvm_tx_mpdu(mvm, skb, &info, sta);

1192 if (ret) {

1193 __skb_queue_purge(&mpdus_skbs);

1194 return ret;

1195 }

1196 }

1197

1198 return 0;

1199 }

1200

1201 static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,

1202 struct ieee80211_sta *sta, u8 tid)

1203 {

1204 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

1205 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];

1206 struct ieee80211_vif *vif = mvmsta->vif;

1207 u16 normalized_ssn;

1208

1209 lockdep_assert_held(&mvmsta->lock);

1210

1211 if ((tid_data->state == IWL_AGG_ON ||

1212 tid_data->state == IWL_EMPTYING_HW_QUEUE_DELBA) &&

1213 iwl_mvm_tid_queued(mvm, tid_data) == 0) {

1214 /*

1215 * Now that this aggregation or DQA queue is empty tell

1216 * mac80211 so it knows we no longer have frames buffered for

1217 * the station on this TID (for the TIM bitmap calculation.)

1218 */

1219 ieee80211_sta_set_buffered(sta, tid, false);

1220 }

1221

1222 /*

1223 * In 22000 HW, the next_reclaimed index is only 8 bit, so we'll need

1224 * to align the wrap around of ssn so we compare relevant values.

1225 */

1226 normalized_ssn = tid_data->ssn;

1227 if (mvm->trans->trans_cfg->gen2)

1228 normalized_ssn &= 0xff;

1229

1230 if (normalized_ssn != tid_data->next_reclaimed)

1231 return;

1232

1233 switch (tid_data->state) {

1234 case IWL_EMPTYING_HW_QUEUE_ADDBA:

1235 IWL_DEBUG_TX_QUEUES(mvm,

1236 "Can continue addBA flow ssn = next_recl = %d\n",

1237 tid_data->next_reclaimed);

1238 tid_data->state = IWL_AGG_STARTING;

1239 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);

1240 break;

1241

1242 case IWL_EMPTYING_HW_QUEUE_DELBA:

1243 IWL_DEBUG_TX_QUEUES(mvm,

1244 "Can continue DELBA flow ssn = next_recl = %d\n",

1245 tid_data->next_reclaimed);

1246 tid_data->state = IWL_AGG_OFF;

1247 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);

1248 break;

1249

1250 default:

1251 break;

1252 }

1253 }

1254

1255 #ifdef CONFIG_IWLWIFI_DEBUG

1256 const char *iwl_mvm_get_tx_fail_reason(u32 status)

1257 {

1258 #define TX_STATUS_FAIL(x) case TX_STATUS_FAIL_ ## x: return #x

1259 #define TX_STATUS_POSTPONE(x) case TX_STATUS_POSTPONE_ ## x: return #x

1260

1261 switch (status & TX_STATUS_MSK) {

1262 case TX_STATUS_SUCCESS:

1263 return "SUCCESS";

1264 TX_STATUS_POSTPONE(DELAY);

1265 TX_STATUS_POSTPONE(FEW_BYTES);

1266 TX_STATUS_POSTPONE(BT_PRIO);

1267 TX_STATUS_POSTPONE(QUIET_PERIOD);

1268 TX_STATUS_POSTPONE(CALC_TTAK);

1269 TX_STATUS_FAIL(INTERNAL_CROSSED_RETRY);

1270 TX_STATUS_FAIL(SHORT_LIMIT);

1271 TX_STATUS_FAIL(LONG_LIMIT);

1272 TX_STATUS_FAIL(UNDERRUN);

1273 TX_STATUS_FAIL(DRAIN_FLOW);

1274 TX_STATUS_FAIL(RFKILL_FLUSH);

1275 TX_STATUS_FAIL(LIFE_EXPIRE);

1276 TX_STATUS_FAIL(DEST_PS);

1277 TX_STATUS_FAIL(HOST_ABORTED);

1278 TX_STATUS_FAIL(BT_RETRY);

1279 TX_STATUS_FAIL(STA_INVALID);

1280 TX_STATUS_FAIL(FRAG_DROPPED);

1281 TX_STATUS_FAIL(TID_DISABLE);

1282 TX_STATUS_FAIL(FIFO_FLUSHED);

1283 TX_STATUS_FAIL(SMALL_CF_POLL);

1284 TX_STATUS_FAIL(FW_DROP);

1285 TX_STATUS_FAIL(STA_COLOR_MISMATCH);

1286 }

1287

1288 return "UNKNOWN";

1289

1290 #undef TX_STATUS_FAIL

1291 #undef TX_STATUS_POSTPONE

1292 }

1293 #endif /* CONFIG_IWLWIFI_DEBUG */

1294

1295 static int iwl_mvm_get_hwrate_chan_width(u32 chan_width)

1296 {

1297 switch (chan_width) {

1298 case RATE_MCS_CHAN_WIDTH_20:

1299 return 0;

1300 case RATE_MCS_CHAN_WIDTH_40:

1301 return IEEE80211_TX_RC_40_MHZ_WIDTH;

1302 case RATE_MCS_CHAN_WIDTH_80:

1303 return IEEE80211_TX_RC_80_MHZ_WIDTH;

1304 case RATE_MCS_CHAN_WIDTH_160:

1305 return IEEE80211_TX_RC_160_MHZ_WIDTH;

1306 default:

1307 return 0;

1308 }

1309 }

1310

1311 void iwl_mvm_hwrate_to_tx_rate(u32 rate_n_flags,

1312 enum nl80211_band band,

1313 struct ieee80211_tx_rate *r)

1314 {

1315 u32 format = rate_n_flags & RATE_MCS_MOD_TYPE_MSK;

1316 u32 rate = format == RATE_MCS_HT_MSK ?

1317 RATE_HT_MCS_INDEX(rate_n_flags) :

1318 rate_n_flags & RATE_MCS_CODE_MSK;

1319

1320 r->flags |=

1321 iwl_mvm_get_hwrate_chan_width(rate_n_flags &

1322 RATE_MCS_CHAN_WIDTH_MSK);

1323

1324 if (rate_n_flags & RATE_MCS_SGI_MSK)

1325 r->flags |= IEEE80211_TX_RC_SHORT_GI;

1326 if (format == RATE_MCS_HT_MSK) {

1327 r->flags |= IEEE80211_TX_RC_MCS;

1328 r->idx = rate;

1329 } else if (format == RATE_MCS_VHT_MSK) {

1330 ieee80211_rate_set_vht(r, rate,

1331 ((rate_n_flags & RATE_MCS_NSS_MSK) >>

1332 RATE_MCS_NSS_POS) + 1);

1333 r->flags |= IEEE80211_TX_RC_VHT_MCS;

1334 } else if (format == RATE_MCS_HE_MSK) {

1335 /* mac80211 cannot do this without ieee80211_tx_status_ext()

1336 * but it only matters for radiotap */

1337 r->idx = 0;

1338 } else {

1339 r->idx = iwl_mvm_legacy_hw_idx_to_mac80211_idx(rate_n_flags,

1340 band);

1341 }

1342 }

1343

1344 void iwl_mvm_hwrate_to_tx_rate_v1(u32 rate_n_flags,

1345 enum nl80211_band band,

1346 struct ieee80211_tx_rate *r)

1347 {

1348 if (rate_n_flags & RATE_HT_MCS_GF_MSK)

1349 r->flags |= IEEE80211_TX_RC_GREEN_FIELD;

1350

1351 r->flags |=

1352 iwl_mvm_get_hwrate_chan_width(rate_n_flags &

1353 RATE_MCS_CHAN_WIDTH_MSK_V1);

1354

1355 if (rate_n_flags & RATE_MCS_SGI_MSK_V1)

1356 r->flags |= IEEE80211_TX_RC_SHORT_GI;

1357 if (rate_n_flags & RATE_MCS_HT_MSK_V1) {

1358 r->flags |= IEEE80211_TX_RC_MCS;

1359 r->idx = rate_n_flags & RATE_HT_MCS_INDEX_MSK_V1;

1360 } else if (rate_n_flags & RATE_MCS_VHT_MSK_V1) {

1361 ieee80211_rate_set_vht(

1362 r, rate_n_flags & RATE_VHT_MCS_RATE_CODE_MSK,

1363 ((rate_n_flags & RATE_VHT_MCS_NSS_MSK) >>

1364 RATE_VHT_MCS_NSS_POS) + 1);

1365 r->flags |= IEEE80211_TX_RC_VHT_MCS;

1366 } else {

1367 r->idx = iwl_mvm_legacy_rate_to_mac80211_idx(rate_n_flags,

1368 band);

1369 }

1370 }

1371

1372 /*

1373 * translate ucode response to mac80211 tx status control values

1374 */

1375 static void iwl_mvm_hwrate_to_tx_status(const struct iwl_fw *fw,

1376 u32 rate_n_flags,

1377 struct ieee80211_tx_info *info)

1378 {

1379 struct ieee80211_tx_rate *r = &info->status.rates[0];

1380

1381 if (iwl_fw_lookup_notif_ver(fw, LONG_GROUP,

1382 TX_CMD, 0) > 6)

1383 rate_n_flags = iwl_new_rate_from_v1(rate_n_flags);

1384

1385 info->status.antenna =

1386 ((rate_n_flags & RATE_MCS_ANT_AB_MSK) >> RATE_MCS_ANT_POS);

1387 iwl_mvm_hwrate_to_tx_rate(rate_n_flags,

1388 info->band, r);

1389 }

1390

1391 static void iwl_mvm_tx_status_check_trigger(struct iwl_mvm *mvm,

1392 u32 status, __le16 frame_control)

1393 {

1394 struct iwl_fw_dbg_trigger_tlv *trig;

1395 struct iwl_fw_dbg_trigger_tx_status *status_trig;

1396 int i;

1397

1398 if ((status & TX_STATUS_MSK) != TX_STATUS_SUCCESS) {

1399 enum iwl_fw_ini_time_point tp =

1400 IWL_FW_INI_TIME_POINT_TX_FAILED;

1401

1402 if (ieee80211_is_action(frame_control))

1403 tp = IWL_FW_INI_TIME_POINT_TX_WFD_ACTION_FRAME_FAILED;

1404

1405 iwl_dbg_tlv_time_point(&mvm->fwrt,

1406 tp, NULL);

1407 return;

1408 }

1409

1410 trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, NULL,

1411 FW_DBG_TRIGGER_TX_STATUS);

1412 if (!trig)

1413 return;

1414

1415 status_trig = (void *)trig->data;

1416

1417 for (i = 0; i < ARRAY_SIZE(status_trig->statuses); i++) {

1418 /* don't collect on status 0 */

1419 if (!status_trig->statuses[i].status)

1420 break;

1421

1422 if (status_trig->statuses[i].status != (status & TX_STATUS_MSK))

1423 continue;

1424

1425 iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,

1426 "Tx status %d was received",

1427 status & TX_STATUS_MSK);

1428 break;

1429 }

1430 }

1431

1432 /*

1433 * iwl_mvm_get_scd_ssn - returns the SSN of the SCD

1434 * @tx_resp: the Tx response from the fw (agg or non-agg)

1435 *

1436 * When the fw sends an AMPDU, it fetches the MPDUs one after the other. Since

1437 * it can't know that everything will go well until the end of the AMPDU, it

1438 * can't know in advance the number of MPDUs that will be sent in the current

1439 * batch. This is why it writes the agg Tx response while it fetches the MPDUs.

1440 * Hence, it can't know in advance what the SSN of the SCD will be at the end

1441 * of the batch. This is why the SSN of the SCD is written at the end of the

1442 * whole struct at a variable offset. This function knows how to cope with the

1443 * variable offset and returns the SSN of the SCD.

1444 */

1445 static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm *mvm,

1446 struct iwl_mvm_tx_resp *tx_resp)

1447 {

1448 return le32_to_cpup((__le32 *)iwl_mvm_get_agg_status(mvm, tx_resp) +

1449 tx_resp->frame_count) & 0xfff;

1450 }

1451

1452 static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,

1453 struct iwl_rx_packet *pkt)

1454 {

1455 struct ieee80211_sta *sta;

1456 u16 sequence = le16_to_cpu(pkt->hdr.sequence);

1457 int txq_id = SEQ_TO_QUEUE(sequence);

1458 /* struct iwl_mvm_tx_resp_v3 is almost the same */

1459 struct iwl_mvm_tx_resp *tx_resp = (void *)pkt->data;

1460 int sta_id = IWL_MVM_TX_RES_GET_RA(tx_resp->ra_tid);

1461 int tid = IWL_MVM_TX_RES_GET_TID(tx_resp->ra_tid);

1462 struct agg_tx_status *agg_status =

1463 iwl_mvm_get_agg_status(mvm, tx_resp);

1464 u32 status = le16_to_cpu(agg_status->status);

1465 u16 ssn = iwl_mvm_get_scd_ssn(mvm, tx_resp);

1466 struct sk_buff_head skbs;

1467 u8 skb_freed = 0;

1468 u8 lq_color;

1469 u16 next_reclaimed, seq_ctl;

1470 bool is_ndp = false;

1471

1472 __skb_queue_head_init(&skbs);

1473

1474 if (iwl_mvm_has_new_tx_api(mvm))

1475 txq_id = le16_to_cpu(tx_resp->tx_queue);

1476

1477 seq_ctl = le16_to_cpu(tx_resp->seq_ctl);

1478

1479 /* we can free until ssn % q.n_bd not inclusive */

1480 iwl_trans_reclaim(mvm->trans, txq_id, ssn, &skbs);

1481

1482 while (!skb_queue_empty(&skbs)) {

1483 struct sk_buff *skb = __skb_dequeue(&skbs);

1484 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

1485 struct ieee80211_hdr *hdr = (void *)skb->data;

1486 bool flushed = false;

1487

1488 skb_freed++;

1489

1490 iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);

1491

1492 memset(&info->status, 0, sizeof(info->status));

1493

1494 /* inform mac80211 about what happened with the frame */

1495 switch (status & TX_STATUS_MSK) {

1496 case TX_STATUS_SUCCESS:

1497 case TX_STATUS_DIRECT_DONE:

1498 info->flags |= IEEE80211_TX_STAT_ACK;

1499 break;

1500 case TX_STATUS_FAIL_FIFO_FLUSHED:

1501 case TX_STATUS_FAIL_DRAIN_FLOW:

1502 flushed = true;

1503 break;

1504 case TX_STATUS_FAIL_DEST_PS:

1505 /* the FW should have stopped the queue and not

1506 * return this status

1507 */

1508 IWL_ERR_LIMIT(mvm,

1509 "FW reported TX filtered, status=0x%x, FC=0x%x\n",

1510 status, le16_to_cpu(hdr->frame_control));

1511 info->flags |= IEEE80211_TX_STAT_TX_FILTERED;

1512 break;

1513 default:

1514 break;

1515 }

1516

1517 if ((status & TX_STATUS_MSK) != TX_STATUS_SUCCESS &&

1518 ieee80211_is_mgmt(hdr->frame_control))

1519 iwl_mvm_toggle_tx_ant(mvm, &mvm->mgmt_last_antenna_idx);

1520

1521 /*

1522 * If we are freeing multiple frames, mark all the frames

1523 * but the first one as acked, since they were acknowledged

1524 * before

1525 * */

1526 if (skb_freed > 1)

1527 info->flags |= IEEE80211_TX_STAT_ACK;

1528

1529 iwl_mvm_tx_status_check_trigger(mvm, status, hdr->frame_control);

1530

1531 info->status.rates[0].count = tx_resp->failure_frame + 1;

1532

1533 iwl_mvm_hwrate_to_tx_status(mvm->fw,

1534 le32_to_cpu(tx_resp->initial_rate),

1535 info);

1536

1537 /* Don't assign the converted initial_rate, because driver

1538 * TLC uses this and doesn't support the new FW rate

1539 */

1540 info->status.status_driver_data[1] =

1541 (void *)(uintptr_t)le32_to_cpu(tx_resp->initial_rate);

1542

1543 /* Single frame failure in an AMPDU queue => send BAR */

1544 if (info->flags & IEEE80211_TX_CTL_AMPDU &&

1545 !(info->flags & IEEE80211_TX_STAT_ACK) &&

1546 !(info->flags & IEEE80211_TX_STAT_TX_FILTERED) && !flushed)

1547 info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;

1548 info->flags &= ~IEEE80211_TX_CTL_AMPDU;

1549

1550 /* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */

1551 if (ieee80211_is_back_req(hdr->frame_control))

1552 seq_ctl = 0;

1553 else if (status != TX_STATUS_SUCCESS)

1554 seq_ctl = le16_to_cpu(hdr->seq_ctrl);

1555

1556 if (unlikely(!seq_ctl)) {

1557 struct ieee80211_hdr *hdr = (void *)skb->data;

1558

1559 /*

1560 * If it is an NDP, we can't update next_reclaim since

1561 * its sequence control is 0. Note that for that same

1562 * reason, NDPs are never sent to A-MPDU'able queues

1563 * so that we can never have more than one freed frame

1564 * for a single Tx resonse (see WARN_ON below).

1565 */

1566 if (ieee80211_is_qos_nullfunc(hdr->frame_control))

1567 is_ndp = true;

1568 }

1569

1570 /*

1571 * TODO: this is not accurate if we are freeing more than one

1572 * packet.

1573 */

1574 info->status.tx_time =

1575 le16_to_cpu(tx_resp->wireless_media_time);

1576 BUILD_BUG_ON(ARRAY_SIZE(info->status.status_driver_data) < 1);

1577 lq_color = TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);

1578 info->status.status_driver_data[0] =

1579 RS_DRV_DATA_PACK(lq_color, tx_resp->reduced_tpc);

1580

1581 ieee80211_tx_status(mvm->hw, skb);

1582 }

1583

1584 /* This is an aggregation queue or might become one, so we use

1585 * the ssn since: ssn = wifi seq_num % 256.

1586 * The seq_ctl is the sequence control of the packet to which

1587 * this Tx response relates. But if there is a hole in the

1588 * bitmap of the BA we received, this Tx response may allow to

1589 * reclaim the hole and all the subsequent packets that were

1590 * already acked. In that case, seq_ctl != ssn, and the next

1591 * packet to be reclaimed will be ssn and not seq_ctl. In that

1592 * case, several packets will be reclaimed even if

1593 * frame_count = 1.

1594 *

1595 * The ssn is the index (% 256) of the latest packet that has

1596 * treated (acked / dropped) + 1.

1597 */

1598 next_reclaimed = ssn;

1599

1600 IWL_DEBUG_TX_REPLY(mvm,

1601 "TXQ %d status %s (0x%08x)\n",

1602 txq_id, iwl_mvm_get_tx_fail_reason(status), status);

1603

1604 IWL_DEBUG_TX_REPLY(mvm,

1605 "\t\t\t\tinitial_rate 0x%x retries %d, idx=%d ssn=%d next_reclaimed=0x%x seq_ctl=0x%x\n",

1606 le32_to_cpu(tx_resp->initial_rate),

1607 tx_resp->failure_frame, SEQ_TO_INDEX(sequence),

1608 ssn, next_reclaimed, seq_ctl);

1609

1610 rcu_read_lock();

1611

1612 sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);

1613 /*

1614 * sta can't be NULL otherwise it'd mean that the sta has been freed in

1615 * the firmware while we still have packets for it in the Tx queues.

1616 */

1617 if (WARN_ON_ONCE(!sta))

1618 goto out;

1619

1620 if (!IS_ERR(sta)) {

1621 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

1622

1623 iwl_mvm_tx_airtime(mvm, mvmsta,

1624 le16_to_cpu(tx_resp->wireless_media_time));

1625

1626 if ((status & TX_STATUS_MSK) != TX_STATUS_SUCCESS &&

1627 mvmsta->sta_state < IEEE80211_STA_AUTHORIZED)

1628 iwl_mvm_toggle_tx_ant(mvm, &mvmsta->tx_ant);

1629

1630 if (sta->wme && tid != IWL_MGMT_TID) {

1631 struct iwl_mvm_tid_data *tid_data =

1632 &mvmsta->tid_data[tid];

1633 bool send_eosp_ndp = false;

1634

1635 spin_lock_bh(&mvmsta->lock);

1636

1637 if (!is_ndp) {

1638 tid_data->next_reclaimed = next_reclaimed;

1639 IWL_DEBUG_TX_REPLY(mvm,

1640 "Next reclaimed packet:%d\n",

1641 next_reclaimed);

1642 } else {

1643 IWL_DEBUG_TX_REPLY(mvm,

1644 "NDP - don't update next_reclaimed\n");

1645 }

1646

1647 iwl_mvm_check_ratid_empty(mvm, sta, tid);

1648

1649 if (mvmsta->sleep_tx_count) {

1650 mvmsta->sleep_tx_count--;

1651 if (mvmsta->sleep_tx_count &&

1652 !iwl_mvm_tid_queued(mvm, tid_data)) {

1653 /*

1654 * The number of frames in the queue

1655 * dropped to 0 even if we sent less

1656 * frames than we thought we had on the

1657 * Tx queue.

1658 * This means we had holes in the BA

1659 * window that we just filled, ask

1660 * mac80211 to send EOSP since the

1661 * firmware won't know how to do that.

1662 * Send NDP and the firmware will send

1663 * EOSP notification that will trigger

1664 * a call to ieee80211_sta_eosp().

1665 */

1666 send_eosp_ndp = true;

1667 }

1668 }

1669

1670 spin_unlock_bh(&mvmsta->lock);

1671 if (send_eosp_ndp) {

1672 iwl_mvm_sta_modify_sleep_tx_count(mvm, sta,

1673 IEEE80211_FRAME_RELEASE_UAPSD,

1674 1, tid, false, false);

1675 mvmsta->sleep_tx_count = 0;

1676 ieee80211_send_eosp_nullfunc(sta, tid);

1677 }

1678 }

1679

1680 if (mvmsta->next_status_eosp) {

1681 mvmsta->next_status_eosp = false;

1682 ieee80211_sta_eosp(sta);

1683 }

1684 }

1685 out:

1686 rcu_read_unlock();

1687 }

1688

1689 #ifdef CONFIG_IWLWIFI_DEBUG

1690 #define AGG_TX_STATE_(x) case AGG_TX_STATE_ ## x: return #x

1691 static const char *iwl_get_agg_tx_status(u16 status)

1692 {

1693 switch (status & AGG_TX_STATE_STATUS_MSK) {

1694 AGG_TX_STATE_(TRANSMITTED);

1695 AGG_TX_STATE_(UNDERRUN);

1696 AGG_TX_STATE_(BT_PRIO);

1697 AGG_TX_STATE_(FEW_BYTES);

1698 AGG_TX_STATE_(ABORT);

1699 AGG_TX_STATE_(TX_ON_AIR_DROP);

1700 AGG_TX_STATE_(LAST_SENT_TRY_CNT);

1701 AGG_TX_STATE_(LAST_SENT_BT_KILL);

1702 AGG_TX_STATE_(SCD_QUERY);

1703 AGG_TX_STATE_(TEST_BAD_CRC32);

1704 AGG_TX_STATE_(RESPONSE);

1705 AGG_TX_STATE_(DUMP_TX);

1706 AGG_TX_STATE_(DELAY_TX);

1707 }

1708

1709 return "UNKNOWN";

1710 }

1711

1712 static void iwl_mvm_rx_tx_cmd_agg_dbg(struct iwl_mvm *mvm,

1713 struct iwl_rx_packet *pkt)

1714 {

1715 struct iwl_mvm_tx_resp *tx_resp = (void *)pkt->data;

1716 struct agg_tx_status *frame_status =

1717 iwl_mvm_get_agg_status(mvm, tx_resp);

1718 int i;

1719 bool tirgger_timepoint = false;

1720

1721 for (i = 0; i < tx_resp->frame_count; i++) {

1722 u16 fstatus = le16_to_cpu(frame_status[i].status);

1723 /* In case one frame wasn't transmitted trigger time point */

1724 tirgger_timepoint |= ((fstatus & AGG_TX_STATE_STATUS_MSK) !=

1725 AGG_TX_STATE_TRANSMITTED);

1726 IWL_DEBUG_TX_REPLY(mvm,

1727 "status %s (0x%04x), try-count (%d) seq (0x%x)\n",

1728 iwl_get_agg_tx_status(fstatus),

1729 fstatus & AGG_TX_STATE_STATUS_MSK,

1730 (fstatus & AGG_TX_STATE_TRY_CNT_MSK) >>

1731 AGG_TX_STATE_TRY_CNT_POS,

1732 le16_to_cpu(frame_status[i].sequence));

1733 }

1734

1735 if (tirgger_timepoint)

1736 iwl_dbg_tlv_time_point(&mvm->fwrt,

1737 IWL_FW_INI_TIME_POINT_TX_FAILED, NULL);

1738

1739 }

1740 #else

1741 static void iwl_mvm_rx_tx_cmd_agg_dbg(struct iwl_mvm *mvm,

1742 struct iwl_rx_packet *pkt)

1743 {}

1744 #endif /* CONFIG_IWLWIFI_DEBUG */

1745

1746 static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,

1747 struct iwl_rx_packet *pkt)

1748 {

1749 struct iwl_mvm_tx_resp *tx_resp = (void *)pkt->data;

1750 int sta_id = IWL_MVM_TX_RES_GET_RA(tx_resp->ra_tid);

1751 int tid = IWL_MVM_TX_RES_GET_TID(tx_resp->ra_tid);

1752 u16 sequence = le16_to_cpu(pkt->hdr.sequence);

1753 struct iwl_mvm_sta *mvmsta;

1754 int queue = SEQ_TO_QUEUE(sequence);

1755 struct ieee80211_sta *sta;

1756

1757 if (WARN_ON_ONCE(queue < IWL_MVM_DQA_MIN_DATA_QUEUE &&

1758 (queue != IWL_MVM_DQA_BSS_CLIENT_QUEUE)))

1759 return;

1760

1761 iwl_mvm_rx_tx_cmd_agg_dbg(mvm, pkt);

1762

1763 rcu_read_lock();

1764

1765 mvmsta = iwl_mvm_sta_from_staid_rcu(mvm, sta_id);

1766

1767 sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);

1768 if (WARN_ON_ONCE(!sta || !sta->wme)) {

1769 rcu_read_unlock();

1770 return;

1771 }

1772

1773 if (!WARN_ON_ONCE(!mvmsta)) {

1774 mvmsta->tid_data[tid].rate_n_flags =

1775 le32_to_cpu(tx_resp->initial_rate);

1776 mvmsta->tid_data[tid].tx_time =

1777 le16_to_cpu(tx_resp->wireless_media_time);

1778 mvmsta->tid_data[tid].lq_color =

1779 TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);

1780 iwl_mvm_tx_airtime(mvm, mvmsta,

1781 le16_to_cpu(tx_resp->wireless_media_time));

1782 }

1783

1784 rcu_read_unlock();

1785 }

1786

1787 void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)

1788 {

1789 struct iwl_rx_packet *pkt = rxb_addr(rxb);

1790 struct iwl_mvm_tx_resp *tx_resp = (void *)pkt->data;

1791

1792 if (tx_resp->frame_count == 1)

1793 iwl_mvm_rx_tx_cmd_single(mvm, pkt);

1794 else

1795 iwl_mvm_rx_tx_cmd_agg(mvm, pkt);

1796 }

1797

1798 static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,

1799 int txq, int index,

1800 struct ieee80211_tx_info *tx_info, u32 rate,

1801 bool is_flush)

1802 {

1803 struct sk_buff_head reclaimed_skbs;

1804 struct iwl_mvm_tid_data *tid_data = NULL;

1805 struct ieee80211_sta *sta;

1806 struct iwl_mvm_sta *mvmsta = NULL;

1807 struct sk_buff *skb;

1808 int freed;

1809

1810 if (WARN_ONCE(sta_id >= mvm->fw->ucode_capa.num_stations ||

1811 tid > IWL_MAX_TID_COUNT,

1812 "sta_id %d tid %d", sta_id, tid))

1813 return;

1814

1815 rcu_read_lock();

1816

1817 sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);

1818

1819 /* Reclaiming frames for a station that has been deleted ? */

1820 if (WARN_ON_ONCE(!sta)) {

1821 rcu_read_unlock();

1822 return;

1823 }

1824

1825 __skb_queue_head_init(&reclaimed_skbs);

1826

1827 /*

1828 * Release all TFDs before the SSN, i.e. all TFDs in front of

1829 * block-ack window (we assume that they've been successfully

1830 * transmitted ... if not, it's too late anyway).

1831 */

1832 iwl_trans_reclaim(mvm->trans, txq, index, &reclaimed_skbs);

1833

1834 skb_queue_walk(&reclaimed_skbs, skb) {

1835 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

1836

1837 iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);

1838

1839 memset(&info->status, 0, sizeof(info->status));

1840 /* Packet was transmitted successfully, failures come as single

1841 * frames because before failing a frame the firmware transmits

1842 * it without aggregation at least once.

1843 */

1844 if (!is_flush)

1845 info->flags |= IEEE80211_TX_STAT_ACK;

1846 }

1847

1848 /*

1849 * It's possible to get a BA response after invalidating the rcu (rcu is

1850 * invalidated in order to prevent new Tx from being sent, but there may

1851 * be some frames already in-flight).

1852 * In this case we just want to reclaim, and could skip all the

1853 * sta-dependent stuff since it's in the middle of being removed

1854 * anyways.

1855 */

1856 if (IS_ERR(sta))

1857 goto out;

1858

1859 mvmsta = iwl_mvm_sta_from_mac80211(sta);

1860 tid_data = &mvmsta->tid_data[tid];

1861

1862 if (tid_data->txq_id != txq) {

1863 IWL_ERR(mvm,

1864 "invalid reclaim request: Q %d, tid %d\n",

1865 tid_data->txq_id, tid);

1866 rcu_read_unlock();

1867 return;

1868 }

1869

1870 spin_lock_bh(&mvmsta->lock);

1871

1872 tid_data->next_reclaimed = index;

1873

1874 iwl_mvm_check_ratid_empty(mvm, sta, tid);

1875

1876 freed = 0;

1877

1878 /* pack lq color from tid_data along the reduced txp */

1879 tx_info->status.status_driver_data[0] =

1880 RS_DRV_DATA_PACK(tid_data->lq_color,

1881 tx_info->status.status_driver_data[0]);

1882 tx_info->status.status_driver_data[1] = (void *)(uintptr_t)rate;

1883

1884 skb_queue_walk(&reclaimed_skbs, skb) {

1885 struct ieee80211_hdr *hdr = (void *)skb->data;

1886 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

1887

1888 if (!is_flush) {

1889 if (ieee80211_is_data_qos(hdr->frame_control))

1890 freed++;

1891 else

1892 WARN_ON_ONCE(tid != IWL_MAX_TID_COUNT);

1893 }

1894

1895 /* this is the first skb we deliver in this batch */

1896 /* put the rate scaling data there */

1897 if (freed == 1) {

1898 info->flags |= IEEE80211_TX_STAT_AMPDU;

1899 memcpy(&info->status, &tx_info->status,

1900 sizeof(tx_info->status));

1901 iwl_mvm_hwrate_to_tx_status(mvm->fw, rate, info);

1902 }

1903 }

1904

1905 spin_unlock_bh(&mvmsta->lock);

1906

1907 /* We got a BA notif with 0 acked or scd_ssn didn't progress which is

1908 * possible (i.e. first MPDU in the aggregation wasn't acked)

1909 * Still it's important to update RS about sent vs. acked.

1910 */

1911 if (!is_flush && skb_queue_empty(&reclaimed_skbs)) {

1912 struct ieee80211_chanctx_conf *chanctx_conf = NULL;

1913

1914 if (mvmsta->vif)

1915 chanctx_conf =

1916 rcu_dereference(mvmsta->vif->chanctx_conf);

1917

1918 if (WARN_ON_ONCE(!chanctx_conf))

1919 goto out;

1920

1921 tx_info->band = chanctx_conf->def.chan->band;

1922 iwl_mvm_hwrate_to_tx_status(mvm->fw, rate, tx_info);

1923

1924 if (!iwl_mvm_has_tlc_offload(mvm)) {

1925 IWL_DEBUG_TX_REPLY(mvm,

1926 "No reclaim. Update rs directly\n");

1927 iwl_mvm_rs_tx_status(mvm, sta, tid, tx_info, false);

1928 }

1929 }

1930

1931 out:

1932 rcu_read_unlock();

1933

1934 while (!skb_queue_empty(&reclaimed_skbs)) {

1935 skb = __skb_dequeue(&reclaimed_skbs);

1936 ieee80211_tx_status(mvm->hw, skb);

1937 }

1938 }

1939

1940 void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)

1941 {

1942 struct iwl_rx_packet *pkt = rxb_addr(rxb);

1943 unsigned int pkt_len = iwl_rx_packet_payload_len(pkt);

1944 int sta_id, tid, txq, index;

1945 struct ieee80211_tx_info ba_info = {};

1946 struct iwl_mvm_ba_notif *ba_notif;

1947 struct iwl_mvm_tid_data *tid_data;

1948 struct iwl_mvm_sta *mvmsta;

1949

1950 ba_info.flags = IEEE80211_TX_STAT_AMPDU;

1951

1952 if (iwl_mvm_has_new_tx_api(mvm)) {

1953 struct iwl_mvm_compressed_ba_notif *ba_res =

1954 (void *)pkt->data;

1955 u8 lq_color = TX_RES_RATE_TABLE_COL_GET(ba_res->tlc_rate_info);

1956 u16 tfd_cnt;

1957 int i;

1958

1959 if (unlikely(sizeof(*ba_res) > pkt_len))

1960 return;

1961

1962 sta_id = ba_res->sta_id;

1963 ba_info.status.ampdu_ack_len = (u8)le16_to_cpu(ba_res->done);

1964 ba_info.status.ampdu_len = (u8)le16_to_cpu(ba_res->txed);

1965 ba_info.status.tx_time =

1966 (u16)le32_to_cpu(ba_res->wireless_time);

1967 ba_info.status.status_driver_data[0] =

1968 (void *)(uintptr_t)ba_res->reduced_txp;

1969

1970 tfd_cnt = le16_to_cpu(ba_res->tfd_cnt);

1971 if (!tfd_cnt || struct_size(ba_res, tfd, tfd_cnt) > pkt_len)

1972 return;

1973

1974 rcu_read_lock();

1975

1976 mvmsta = iwl_mvm_sta_from_staid_rcu(mvm, sta_id);

1977 /*

1978 * It's possible to get a BA response after invalidating the rcu

1979 * (rcu is invalidated in order to prevent new Tx from being

1980 * sent, but there may be some frames already in-flight).

1981 * In this case we just want to reclaim, and could skip all the

1982 * sta-dependent stuff since it's in the middle of being removed

1983 * anyways.

1984 */

1985

1986 /* Free per TID */

1987 for (i = 0; i < tfd_cnt; i++) {

1988 struct iwl_mvm_compressed_ba_tfd *ba_tfd =

1989 &ba_res->tfd[i];

1990

1991 tid = ba_tfd->tid;

1992 if (tid == IWL_MGMT_TID)

1993 tid = IWL_MAX_TID_COUNT;

1994

1995 if (mvmsta)

1996 mvmsta->tid_data[i].lq_color = lq_color;

1997

1998 iwl_mvm_tx_reclaim(mvm, sta_id, tid,

1999 (int)(le16_to_cpu(ba_tfd->q_num)),

2000 le16_to_cpu(ba_tfd->tfd_index),

2001 &ba_info,

2002 le32_to_cpu(ba_res->tx_rate), false);

2003 }

2004

2005 if (mvmsta)

2006 iwl_mvm_tx_airtime(mvm, mvmsta,

2007 le32_to_cpu(ba_res->wireless_time));

2008 rcu_read_unlock();

2009

2010 IWL_DEBUG_TX_REPLY(mvm,

2011 "BA_NOTIFICATION Received from sta_id = %d, flags %x, sent:%d, acked:%d\n",

2012 sta_id, le32_to_cpu(ba_res->flags),

2013 le16_to_cpu(ba_res->txed),

2014 le16_to_cpu(ba_res->done));

2015 return;

2016 }

2017

2018 ba_notif = (void *)pkt->data;

2019 sta_id = ba_notif->sta_id;

2020 tid = ba_notif->tid;

2021 /* "flow" corresponds to Tx queue */

2022 txq = le16_to_cpu(ba_notif->scd_flow);

2023 /* "ssn" is start of block-ack Tx window, corresponds to index

2024 * (in Tx queue's circular buffer) of first TFD/frame in window */

2025 index = le16_to_cpu(ba_notif->scd_ssn);

2026

2027 rcu_read_lock();

2028 mvmsta = iwl_mvm_sta_from_staid_rcu(mvm, sta_id);

2029 if (WARN_ON_ONCE(!mvmsta)) {

2030 rcu_read_unlock();

2031 return;

2032 }

2033

2034 tid_data = &mvmsta->tid_data[tid];

2035

2036 ba_info.status.ampdu_ack_len = ba_notif->txed_2_done;

2037 ba_info.status.ampdu_len = ba_notif->txed;

2038 ba_info.status.tx_time = tid_data->tx_time;

2039 ba_info.status.status_driver_data[0] =

2040 (void *)(uintptr_t)ba_notif->reduced_txp;

2041

2042 rcu_read_unlock();

2043

2044 iwl_mvm_tx_reclaim(mvm, sta_id, tid, txq, index, &ba_info,

2045 tid_data->rate_n_flags, false);

2046

2047 IWL_DEBUG_TX_REPLY(mvm,

2048 "BA_NOTIFICATION Received from %pM, sta_id = %d\n",

2049 ba_notif->sta_addr, ba_notif->sta_id);

2050

2051 IWL_DEBUG_TX_REPLY(mvm,

2052 "TID = %d, SeqCtl = %d, bitmap = 0x%llx, scd_flow = %d, scd_ssn = %d sent:%d, acked:%d\n",

2053 ba_notif->tid, le16_to_cpu(ba_notif->seq_ctl),

2054 le64_to_cpu(ba_notif->bitmap), txq, index,

2055 ba_notif->txed, ba_notif->txed_2_done);

2056

2057 IWL_DEBUG_TX_REPLY(mvm, "reduced txp from ba notif %d\n",

2058 ba_notif->reduced_txp);

2059 }

2060

2061 /*

2062 * Note that there are transports that buffer frames before they reach

2063 * the firmware. This means that after flush_tx_path is called, the

2064 * queue might not be empty. The race-free way to handle this is to:

2065 * 1) set the station as draining

2066 * 2) flush the Tx path

2067 * 3) wait for the transport queues to be empty

2068 */

2069 int iwl_mvm_flush_tx_path(struct iwl_mvm *mvm, u32 tfd_msk)

2070 {

2071 int ret;

2072 struct iwl_tx_path_flush_cmd_v1 flush_cmd = {

2073 .queues_ctl = cpu_to_le32(tfd_msk),

2074 .flush_ctl = cpu_to_le16(DUMP_TX_FIFO_FLUSH),

2075 };

2076

2077 WARN_ON(iwl_mvm_has_new_tx_api(mvm));

2078 ret = iwl_mvm_send_cmd_pdu(mvm, TXPATH_FLUSH, 0,

2079 sizeof(flush_cmd), &flush_cmd);

2080 if (ret)

2081 IWL_ERR(mvm, "Failed to send flush command (%d)\n", ret);

2082 return ret;

2083 }

2084

2085 int iwl_mvm_flush_sta_tids(struct iwl_mvm *mvm, u32 sta_id, u16 tids)

2086 {

2087 int ret;

2088 struct iwl_tx_path_flush_cmd_rsp *rsp;

2089 struct iwl_tx_path_flush_cmd flush_cmd = {

2090 .sta_id = cpu_to_le32(sta_id),

2091 .tid_mask = cpu_to_le16(tids),

2092 };

2093

2094 struct iwl_host_cmd cmd = {

2095 .id = TXPATH_FLUSH,

2096 .len = { sizeof(flush_cmd), },

2097 .data = { &flush_cmd, },

2098 };

2099

2100 WARN_ON(!iwl_mvm_has_new_tx_api(mvm));

2101

2102 if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, TXPATH_FLUSH, 0) > 0)

2103 cmd.flags |= CMD_WANT_SKB;

2104

2105 IWL_DEBUG_TX_QUEUES(mvm, "flush for sta id %d tid mask 0x%x\n",

2106 sta_id, tids);

2107

2108 ret = iwl_mvm_send_cmd(mvm, &cmd);

2109

2110 if (ret) {

2111 IWL_ERR(mvm, "Failed to send flush command (%d)\n", ret);

2112 return ret;

2113 }

2114

2115 if (cmd.flags & CMD_WANT_SKB) {

2116 int i;

2117 int num_flushed_queues;

2118

2119 if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != sizeof(*rsp))) {

2120 ret = -EIO;

2121 goto free_rsp;

2122 }

2123

2124 rsp = (void *)cmd.resp_pkt->data;

2125

2126 if (WARN_ONCE(le16_to_cpu(rsp->sta_id) != sta_id,

2127 "sta_id %d != rsp_sta_id %d",

2128 sta_id, le16_to_cpu(rsp->sta_id))) {

2129 ret = -EIO;

2130 goto free_rsp;

2131 }

2132

2133 num_flushed_queues = le16_to_cpu(rsp->num_flushed_queues);

2134 if (WARN_ONCE(num_flushed_queues > IWL_TX_FLUSH_QUEUE_RSP,

2135 "num_flushed_queues %d", num_flushed_queues)) {

2136 ret = -EIO;

2137 goto free_rsp;

2138 }

2139

2140 for (i = 0; i < num_flushed_queues; i++) {

2141 struct ieee80211_tx_info tx_info = {};

2142 struct iwl_flush_queue_info *queue_info = &rsp->queues[i];

2143 int tid = le16_to_cpu(queue_info->tid);

2144 int read_before = le16_to_cpu(queue_info->read_before_flush);

2145 int read_after = le16_to_cpu(queue_info->read_after_flush);

2146 int queue_num = le16_to_cpu(queue_info->queue_num);

2147

2148 if (tid == IWL_MGMT_TID)

2149 tid = IWL_MAX_TID_COUNT;

2150

2151 IWL_DEBUG_TX_QUEUES(mvm,

2152 "tid %d queue_id %d read-before %d read-after %d\n",

2153 tid, queue_num, read_before, read_after);

2154

2155 iwl_mvm_tx_reclaim(mvm, sta_id, tid, queue_num, read_after,

2156 &tx_info, 0, true);

2157 }

2158 free_rsp:

2159 iwl_free_resp(&cmd);

2160 }

2161 return ret;

2162 }

2163

2164 int iwl_mvm_flush_sta(struct iwl_mvm *mvm, void *sta, bool internal)

2165 {

2166 struct iwl_mvm_int_sta *int_sta = sta;

2167 struct iwl_mvm_sta *mvm_sta = sta;

2168

2169 BUILD_BUG_ON(offsetof(struct iwl_mvm_int_sta, sta_id) !=

2170 offsetof(struct iwl_mvm_sta, sta_id));

2171

2172 if (iwl_mvm_has_new_tx_api(mvm))

2173 return iwl_mvm_flush_sta_tids(mvm, mvm_sta->sta_id, 0xffff);

2174

2175 if (internal)

2176 return iwl_mvm_flush_tx_path(mvm, int_sta->tfd_queue_msk);

2177

2178 return iwl_mvm_flush_tx_path(mvm, mvm_sta->tfd_queue_msk);

2179 }