dp_rx_defrag.c 60 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192
  1. /*
  2. * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
  3. * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  4. *
  5. * Permission to use, copy, modify, and/or distribute this software for
  6. * any purpose with or without fee is hereby granted, provided that the
  7. * above copyright notice and this permission notice appear in all
  8. * copies.
  9. *
  10. * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
  11. * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
  12. * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
  13. * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
  14. * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
  15. * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  16. * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  17. * PERFORMANCE OF THIS SOFTWARE.
  18. */
  19. #include "hal_hw_headers.h"
  20. #ifndef RX_DEFRAG_DO_NOT_REINJECT
  21. #ifndef DP_BE_WAR
  22. #include "li/hal_li_rx.h"
  23. #endif
  24. #endif
  25. #include "dp_types.h"
  26. #include "dp_rx.h"
  27. #include "dp_peer.h"
  28. #include "hal_api.h"
  29. #include "qdf_trace.h"
  30. #include "qdf_nbuf.h"
  31. #include "dp_internal.h"
  32. #include "dp_rx_defrag.h"
  33. #include <enet.h> /* LLC_SNAP_HDR_LEN */
  34. #include "dp_rx_defrag.h"
  35. #include "dp_ipa.h"
  36. #include "dp_rx_buffer_pool.h"
  37. const struct dp_rx_defrag_cipher dp_f_ccmp = {
  38. "AES-CCM",
  39. IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + IEEE80211_WEP_EXTIVLEN,
  40. IEEE80211_WEP_MICLEN,
  41. 0,
  42. };
  43. const struct dp_rx_defrag_cipher dp_f_tkip = {
  44. "TKIP",
  45. IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + IEEE80211_WEP_EXTIVLEN,
  46. IEEE80211_WEP_CRCLEN,
  47. IEEE80211_WEP_MICLEN,
  48. };
  49. const struct dp_rx_defrag_cipher dp_f_wep = {
  50. "WEP",
  51. IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN,
  52. IEEE80211_WEP_CRCLEN,
  53. 0,
  54. };
  55. /*
  56. * The header and mic length are same for both
  57. * GCMP-128 and GCMP-256.
  58. */
  59. const struct dp_rx_defrag_cipher dp_f_gcmp = {
  60. "AES-GCMP",
  61. WLAN_IEEE80211_GCMP_HEADERLEN,
  62. WLAN_IEEE80211_GCMP_MICLEN,
  63. WLAN_IEEE80211_GCMP_MICLEN,
  64. };
  65. /*
  66. * dp_rx_defrag_frames_free(): Free fragment chain
  67. * @frames: Fragment chain
  68. *
  69. * Iterates through the fragment chain and frees them
  70. * Returns: None
  71. */
  72. static void dp_rx_defrag_frames_free(qdf_nbuf_t frames)
  73. {
  74. qdf_nbuf_t next, frag = frames;
  75. while (frag) {
  76. next = qdf_nbuf_next(frag);
  77. dp_rx_nbuf_free(frag);
  78. frag = next;
  79. }
  80. }
  81. /*
  82. * dp_rx_clear_saved_desc_info(): Clears descriptor info
  83. * @txrx peer: Pointer to the peer data structure
  84. * @tid: Transmit ID (TID)
  85. *
  86. * Saves MPDU descriptor info and MSDU link pointer from REO
  87. * ring descriptor. The cache is created per peer, per TID
  88. *
  89. * Returns: None
  90. */
  91. static void dp_rx_clear_saved_desc_info(struct dp_txrx_peer *txrx_peer,
  92. unsigned int tid)
  93. {
  94. if (txrx_peer->rx_tid[tid].dst_ring_desc)
  95. qdf_mem_free(txrx_peer->rx_tid[tid].dst_ring_desc);
  96. txrx_peer->rx_tid[tid].dst_ring_desc = NULL;
  97. txrx_peer->rx_tid[tid].head_frag_desc = NULL;
  98. }
  99. static void dp_rx_return_head_frag_desc(struct dp_txrx_peer *txrx_peer,
  100. unsigned int tid)
  101. {
  102. struct dp_soc *soc;
  103. struct dp_pdev *pdev;
  104. struct dp_srng *dp_rxdma_srng;
  105. struct rx_desc_pool *rx_desc_pool;
  106. union dp_rx_desc_list_elem_t *head = NULL;
  107. union dp_rx_desc_list_elem_t *tail = NULL;
  108. uint8_t pool_id;
  109. pdev = txrx_peer->vdev->pdev;
  110. soc = pdev->soc;
  111. if (txrx_peer->rx_tid[tid].head_frag_desc) {
  112. pool_id = txrx_peer->rx_tid[tid].head_frag_desc->pool_id;
  113. dp_rxdma_srng = &soc->rx_refill_buf_ring[pool_id];
  114. rx_desc_pool = &soc->rx_desc_buf[pool_id];
  115. dp_rx_add_to_free_desc_list(&head, &tail,
  116. txrx_peer->rx_tid[tid].head_frag_desc);
  117. dp_rx_buffers_replenish(soc, 0, dp_rxdma_srng, rx_desc_pool,
  118. 1, &head, &tail, false);
  119. }
  120. if (txrx_peer->rx_tid[tid].dst_ring_desc) {
  121. if (dp_rx_link_desc_return(soc,
  122. txrx_peer->rx_tid[tid].dst_ring_desc,
  123. HAL_BM_ACTION_PUT_IN_IDLE_LIST) !=
  124. QDF_STATUS_SUCCESS)
  125. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  126. "%s: Failed to return link desc", __func__);
  127. }
  128. }
  129. /*
  130. * dp_rx_reorder_flush_frag(): Flush the frag list
  131. * @txrx_peer: Pointer to the peer data structure
  132. * @tid: Transmit ID (TID)
  133. *
  134. * Flush the per-TID frag list
  135. *
  136. * Returns: None
  137. */
  138. void dp_rx_reorder_flush_frag(struct dp_txrx_peer *txrx_peer,
  139. unsigned int tid)
  140. {
  141. dp_info_rl("Flushing TID %d", tid);
  142. if (!txrx_peer) {
  143. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  144. "%s: NULL peer", __func__);
  145. return;
  146. }
  147. dp_rx_return_head_frag_desc(txrx_peer, tid);
  148. dp_rx_defrag_cleanup(txrx_peer, tid);
  149. }
  150. /*
  151. * dp_rx_defrag_waitlist_flush(): Flush SOC defrag wait list
  152. * @soc: DP SOC
  153. *
  154. * Flush fragments of all waitlisted TID's
  155. *
  156. * Returns: None
  157. */
  158. void dp_rx_defrag_waitlist_flush(struct dp_soc *soc)
  159. {
  160. struct dp_rx_tid_defrag *waitlist_elem = NULL;
  161. struct dp_rx_tid_defrag *tmp;
  162. uint32_t now_ms = qdf_system_ticks_to_msecs(qdf_system_ticks());
  163. TAILQ_HEAD(, dp_rx_tid_defrag) temp_list;
  164. dp_txrx_ref_handle txrx_ref_handle = NULL;
  165. TAILQ_INIT(&temp_list);
  166. dp_debug("Current time %u", now_ms);
  167. qdf_spin_lock_bh(&soc->rx.defrag.defrag_lock);
  168. TAILQ_FOREACH_SAFE(waitlist_elem, &soc->rx.defrag.waitlist,
  169. defrag_waitlist_elem, tmp) {
  170. uint32_t tid;
  171. if (waitlist_elem->defrag_timeout_ms > now_ms)
  172. break;
  173. tid = waitlist_elem->tid;
  174. if (tid >= DP_MAX_TIDS) {
  175. qdf_assert(0);
  176. continue;
  177. }
  178. TAILQ_REMOVE(&soc->rx.defrag.waitlist, waitlist_elem,
  179. defrag_waitlist_elem);
  180. DP_STATS_DEC(soc, rx.rx_frag_wait, 1);
  181. /* Move to temp list and clean-up later */
  182. TAILQ_INSERT_TAIL(&temp_list, waitlist_elem,
  183. defrag_waitlist_elem);
  184. }
  185. if (waitlist_elem) {
  186. soc->rx.defrag.next_flush_ms =
  187. waitlist_elem->defrag_timeout_ms;
  188. } else {
  189. soc->rx.defrag.next_flush_ms =
  190. now_ms + soc->rx.defrag.timeout_ms;
  191. }
  192. qdf_spin_unlock_bh(&soc->rx.defrag.defrag_lock);
  193. TAILQ_FOREACH_SAFE(waitlist_elem, &temp_list,
  194. defrag_waitlist_elem, tmp) {
  195. struct dp_txrx_peer *txrx_peer, *temp_peer = NULL;
  196. qdf_spin_lock_bh(&waitlist_elem->defrag_tid_lock);
  197. TAILQ_REMOVE(&temp_list, waitlist_elem,
  198. defrag_waitlist_elem);
  199. /* get address of current peer */
  200. txrx_peer = waitlist_elem->defrag_peer;
  201. qdf_spin_unlock_bh(&waitlist_elem->defrag_tid_lock);
  202. temp_peer = dp_txrx_peer_get_ref_by_id(soc, txrx_peer->peer_id,
  203. &txrx_ref_handle,
  204. DP_MOD_ID_RX_ERR);
  205. if (temp_peer == txrx_peer) {
  206. qdf_spin_lock_bh(&waitlist_elem->defrag_tid_lock);
  207. dp_rx_reorder_flush_frag(txrx_peer, waitlist_elem->tid);
  208. qdf_spin_unlock_bh(&waitlist_elem->defrag_tid_lock);
  209. }
  210. if (temp_peer)
  211. dp_txrx_peer_unref_delete(txrx_ref_handle,
  212. DP_MOD_ID_RX_ERR);
  213. }
  214. }
  215. /*
  216. * dp_rx_defrag_waitlist_add(): Update per-PDEV defrag wait list
  217. * @txrx_peer: Pointer to the peer data structure
  218. * @tid: Transmit ID (TID)
  219. *
  220. * Appends per-tid fragments to global fragment wait list
  221. *
  222. * Returns: None
  223. */
  224. static void dp_rx_defrag_waitlist_add(struct dp_txrx_peer *txrx_peer,
  225. unsigned int tid)
  226. {
  227. struct dp_soc *psoc = txrx_peer->vdev->pdev->soc;
  228. struct dp_rx_tid_defrag *waitlist_elem = &txrx_peer->rx_tid[tid];
  229. dp_debug("Adding TID %u to waitlist for peer %pK with peer_id = %d ",
  230. tid, txrx_peer, txrx_peer->peer_id);
  231. /* TODO: use LIST macros instead of TAIL macros */
  232. qdf_spin_lock_bh(&psoc->rx.defrag.defrag_lock);
  233. if (TAILQ_EMPTY(&psoc->rx.defrag.waitlist))
  234. psoc->rx.defrag.next_flush_ms =
  235. waitlist_elem->defrag_timeout_ms;
  236. TAILQ_INSERT_TAIL(&psoc->rx.defrag.waitlist, waitlist_elem,
  237. defrag_waitlist_elem);
  238. DP_STATS_INC(psoc, rx.rx_frag_wait, 1);
  239. qdf_spin_unlock_bh(&psoc->rx.defrag.defrag_lock);
  240. }
  241. /*
  242. * dp_rx_defrag_waitlist_remove(): Remove fragments from waitlist
  243. * @txrx peer: Pointer to the peer data structure
  244. * @tid: Transmit ID (TID)
  245. *
  246. * Remove fragments from waitlist
  247. *
  248. * Returns: None
  249. */
  250. void dp_rx_defrag_waitlist_remove(struct dp_txrx_peer *txrx_peer,
  251. unsigned int tid)
  252. {
  253. struct dp_pdev *pdev = txrx_peer->vdev->pdev;
  254. struct dp_soc *soc = pdev->soc;
  255. struct dp_rx_tid_defrag *waitlist_elm;
  256. struct dp_rx_tid_defrag *tmp;
  257. dp_debug("Removing TID %u to waitlist for peer %pK peer_id = %d ",
  258. tid, txrx_peer, txrx_peer->peer_id);
  259. if (tid >= DP_MAX_TIDS) {
  260. dp_err("TID out of bounds: %d", tid);
  261. qdf_assert_always(0);
  262. }
  263. qdf_spin_lock_bh(&soc->rx.defrag.defrag_lock);
  264. TAILQ_FOREACH_SAFE(waitlist_elm, &soc->rx.defrag.waitlist,
  265. defrag_waitlist_elem, tmp) {
  266. struct dp_txrx_peer *peer_on_waitlist;
  267. /* get address of current peer */
  268. peer_on_waitlist = waitlist_elm->defrag_peer;
  269. /* Ensure it is TID for same peer */
  270. if (peer_on_waitlist == txrx_peer && waitlist_elm->tid == tid) {
  271. TAILQ_REMOVE(&soc->rx.defrag.waitlist,
  272. waitlist_elm, defrag_waitlist_elem);
  273. DP_STATS_DEC(soc, rx.rx_frag_wait, 1);
  274. }
  275. }
  276. qdf_spin_unlock_bh(&soc->rx.defrag.defrag_lock);
  277. }
  278. /*
  279. * dp_rx_defrag_fraglist_insert(): Create a per-sequence fragment list
  280. * @txrx_peer: Pointer to the peer data structure
  281. * @tid: Transmit ID (TID)
  282. * @head_addr: Pointer to head list
  283. * @tail_addr: Pointer to tail list
  284. * @frag: Incoming fragment
  285. * @all_frag_present: Flag to indicate whether all fragments are received
  286. *
  287. * Build a per-tid, per-sequence fragment list.
  288. *
  289. * Returns: Success, if inserted
  290. */
  291. static QDF_STATUS
  292. dp_rx_defrag_fraglist_insert(struct dp_txrx_peer *txrx_peer, unsigned int tid,
  293. qdf_nbuf_t *head_addr, qdf_nbuf_t *tail_addr,
  294. qdf_nbuf_t frag, uint8_t *all_frag_present)
  295. {
  296. struct dp_soc *soc = txrx_peer->vdev->pdev->soc;
  297. qdf_nbuf_t next;
  298. qdf_nbuf_t prev = NULL;
  299. qdf_nbuf_t cur;
  300. uint16_t head_fragno, cur_fragno, next_fragno;
  301. uint8_t last_morefrag = 1, count = 0;
  302. struct dp_rx_tid_defrag *rx_tid = &txrx_peer->rx_tid[tid];
  303. uint8_t *rx_desc_info;
  304. qdf_assert(frag);
  305. qdf_assert(head_addr);
  306. qdf_assert(tail_addr);
  307. *all_frag_present = 0;
  308. rx_desc_info = qdf_nbuf_data(frag);
  309. cur_fragno = dp_rx_frag_get_mpdu_frag_number(soc, rx_desc_info);
  310. dp_debug("cur_fragno %d\n", cur_fragno);
  311. /* If this is the first fragment */
  312. if (!(*head_addr)) {
  313. *head_addr = *tail_addr = frag;
  314. qdf_nbuf_set_next(*tail_addr, NULL);
  315. rx_tid->curr_frag_num = cur_fragno;
  316. goto insert_done;
  317. }
  318. /* In sequence fragment */
  319. if (cur_fragno > rx_tid->curr_frag_num) {
  320. qdf_nbuf_set_next(*tail_addr, frag);
  321. *tail_addr = frag;
  322. qdf_nbuf_set_next(*tail_addr, NULL);
  323. rx_tid->curr_frag_num = cur_fragno;
  324. } else {
  325. /* Out of sequence fragment */
  326. cur = *head_addr;
  327. rx_desc_info = qdf_nbuf_data(cur);
  328. head_fragno = dp_rx_frag_get_mpdu_frag_number(soc,
  329. rx_desc_info);
  330. if (cur_fragno == head_fragno) {
  331. dp_rx_nbuf_free(frag);
  332. goto insert_fail;
  333. } else if (head_fragno > cur_fragno) {
  334. qdf_nbuf_set_next(frag, cur);
  335. cur = frag;
  336. *head_addr = frag; /* head pointer to be updated */
  337. } else {
  338. while ((cur_fragno > head_fragno) && cur) {
  339. prev = cur;
  340. cur = qdf_nbuf_next(cur);
  341. if (cur) {
  342. rx_desc_info = qdf_nbuf_data(cur);
  343. head_fragno =
  344. dp_rx_frag_get_mpdu_frag_number(
  345. soc,
  346. rx_desc_info);
  347. }
  348. }
  349. if (cur_fragno == head_fragno) {
  350. dp_rx_nbuf_free(frag);
  351. goto insert_fail;
  352. }
  353. qdf_nbuf_set_next(prev, frag);
  354. qdf_nbuf_set_next(frag, cur);
  355. }
  356. }
  357. next = qdf_nbuf_next(*head_addr);
  358. rx_desc_info = qdf_nbuf_data(*tail_addr);
  359. last_morefrag = dp_rx_frag_get_more_frag_bit(soc, rx_desc_info);
  360. /* TODO: optimize the loop */
  361. if (!last_morefrag) {
  362. /* Check if all fragments are present */
  363. do {
  364. rx_desc_info = qdf_nbuf_data(next);
  365. next_fragno =
  366. dp_rx_frag_get_mpdu_frag_number(soc,
  367. rx_desc_info);
  368. count++;
  369. if (next_fragno != count)
  370. break;
  371. next = qdf_nbuf_next(next);
  372. } while (next);
  373. if (!next) {
  374. *all_frag_present = 1;
  375. return QDF_STATUS_SUCCESS;
  376. } else {
  377. /* revisit */
  378. }
  379. }
  380. insert_done:
  381. return QDF_STATUS_SUCCESS;
  382. insert_fail:
  383. return QDF_STATUS_E_FAILURE;
  384. }
  385. /*
  386. * dp_rx_defrag_tkip_decap(): decap tkip encrypted fragment
  387. * @msdu: Pointer to the fragment
  388. * @hdrlen: 802.11 header length (mostly useful in 4 addr frames)
  389. *
  390. * decap tkip encrypted fragment
  391. *
  392. * Returns: QDF_STATUS
  393. */
  394. static QDF_STATUS
  395. dp_rx_defrag_tkip_decap(struct dp_soc *soc,
  396. qdf_nbuf_t msdu, uint16_t hdrlen)
  397. {
  398. uint8_t *ivp, *orig_hdr;
  399. int rx_desc_len = soc->rx_pkt_tlv_size;
  400. /* start of 802.11 header info */
  401. orig_hdr = (uint8_t *)(qdf_nbuf_data(msdu) + rx_desc_len);
  402. /* TKIP header is located post 802.11 header */
  403. ivp = orig_hdr + hdrlen;
  404. if (!(ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV)) {
  405. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  406. "IEEE80211_WEP_EXTIV is missing in TKIP fragment");
  407. return QDF_STATUS_E_DEFRAG_ERROR;
  408. }
  409. qdf_nbuf_trim_tail(msdu, dp_f_tkip.ic_trailer);
  410. return QDF_STATUS_SUCCESS;
  411. }
  412. /*
  413. * dp_rx_defrag_ccmp_demic(): Remove MIC information from CCMP fragment
  414. * @nbuf: Pointer to the fragment buffer
  415. * @hdrlen: 802.11 header length (mostly useful in 4 addr frames)
  416. *
  417. * Remove MIC information from CCMP fragment
  418. *
  419. * Returns: QDF_STATUS
  420. */
  421. static QDF_STATUS
  422. dp_rx_defrag_ccmp_demic(struct dp_soc *soc, qdf_nbuf_t nbuf, uint16_t hdrlen)
  423. {
  424. uint8_t *ivp, *orig_hdr;
  425. int rx_desc_len = soc->rx_pkt_tlv_size;
  426. /* start of the 802.11 header */
  427. orig_hdr = (uint8_t *)(qdf_nbuf_data(nbuf) + rx_desc_len);
  428. /* CCMP header is located after 802.11 header */
  429. ivp = orig_hdr + hdrlen;
  430. if (!(ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV))
  431. return QDF_STATUS_E_DEFRAG_ERROR;
  432. qdf_nbuf_trim_tail(nbuf, dp_f_ccmp.ic_trailer);
  433. return QDF_STATUS_SUCCESS;
  434. }
  435. /*
  436. * dp_rx_defrag_ccmp_decap(): decap CCMP encrypted fragment
  437. * @nbuf: Pointer to the fragment
  438. * @hdrlen: length of the header information
  439. *
  440. * decap CCMP encrypted fragment
  441. *
  442. * Returns: QDF_STATUS
  443. */
  444. static QDF_STATUS
  445. dp_rx_defrag_ccmp_decap(struct dp_soc *soc, qdf_nbuf_t nbuf, uint16_t hdrlen)
  446. {
  447. uint8_t *ivp, *origHdr;
  448. int rx_desc_len = soc->rx_pkt_tlv_size;
  449. origHdr = (uint8_t *) (qdf_nbuf_data(nbuf) + rx_desc_len);
  450. ivp = origHdr + hdrlen;
  451. if (!(ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV))
  452. return QDF_STATUS_E_DEFRAG_ERROR;
  453. return QDF_STATUS_SUCCESS;
  454. }
  455. /*
  456. * dp_rx_defrag_wep_decap(): decap WEP encrypted fragment
  457. * @msdu: Pointer to the fragment
  458. * @hdrlen: length of the header information
  459. *
  460. * decap WEP encrypted fragment
  461. *
  462. * Returns: QDF_STATUS
  463. */
  464. static QDF_STATUS
  465. dp_rx_defrag_wep_decap(struct dp_soc *soc, qdf_nbuf_t msdu, uint16_t hdrlen)
  466. {
  467. uint8_t *origHdr;
  468. int rx_desc_len = soc->rx_pkt_tlv_size;
  469. origHdr = (uint8_t *) (qdf_nbuf_data(msdu) + rx_desc_len);
  470. qdf_mem_move(origHdr + dp_f_wep.ic_header, origHdr, hdrlen);
  471. qdf_nbuf_trim_tail(msdu, dp_f_wep.ic_trailer);
  472. return QDF_STATUS_SUCCESS;
  473. }
  474. /*
  475. * dp_rx_defrag_hdrsize(): Calculate the header size of the received fragment
  476. * @soc: soc handle
  477. * @nbuf: Pointer to the fragment
  478. *
  479. * Calculate the header size of the received fragment
  480. *
  481. * Returns: header size (uint16_t)
  482. */
  483. static uint16_t dp_rx_defrag_hdrsize(struct dp_soc *soc, qdf_nbuf_t nbuf)
  484. {
  485. uint8_t *rx_tlv_hdr = qdf_nbuf_data(nbuf);
  486. uint16_t size = sizeof(struct ieee80211_frame);
  487. uint16_t fc = 0;
  488. uint32_t to_ds, fr_ds;
  489. uint8_t frm_ctrl_valid;
  490. uint16_t frm_ctrl_field;
  491. to_ds = hal_rx_mpdu_get_to_ds(soc->hal_soc, rx_tlv_hdr);
  492. fr_ds = hal_rx_mpdu_get_fr_ds(soc->hal_soc, rx_tlv_hdr);
  493. frm_ctrl_valid =
  494. hal_rx_get_mpdu_frame_control_valid(soc->hal_soc,
  495. rx_tlv_hdr);
  496. frm_ctrl_field = hal_rx_get_frame_ctrl_field(soc->hal_soc, rx_tlv_hdr);
  497. if (to_ds && fr_ds)
  498. size += QDF_MAC_ADDR_SIZE;
  499. if (frm_ctrl_valid) {
  500. fc = frm_ctrl_field;
  501. /* use 1-st byte for validation */
  502. if (DP_RX_DEFRAG_IEEE80211_QOS_HAS_SEQ(fc & 0xff)) {
  503. size += sizeof(uint16_t);
  504. /* use 2-nd byte for validation */
  505. if (((fc & 0xff00) >> 8) & IEEE80211_FC1_ORDER)
  506. size += sizeof(struct ieee80211_htc);
  507. }
  508. }
  509. return size;
  510. }
  511. /*
  512. * dp_rx_defrag_michdr(): Calculate a pseudo MIC header
  513. * @wh0: Pointer to the wireless header of the fragment
  514. * @hdr: Array to hold the pseudo header
  515. *
  516. * Calculate a pseudo MIC header
  517. *
  518. * Returns: None
  519. */
  520. static void dp_rx_defrag_michdr(const struct ieee80211_frame *wh0,
  521. uint8_t hdr[])
  522. {
  523. const struct ieee80211_frame_addr4 *wh =
  524. (const struct ieee80211_frame_addr4 *)wh0;
  525. switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
  526. case IEEE80211_FC1_DIR_NODS:
  527. DP_RX_DEFRAG_IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
  528. DP_RX_DEFRAG_IEEE80211_ADDR_COPY(hdr + QDF_MAC_ADDR_SIZE,
  529. wh->i_addr2);
  530. break;
  531. case IEEE80211_FC1_DIR_TODS:
  532. DP_RX_DEFRAG_IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
  533. DP_RX_DEFRAG_IEEE80211_ADDR_COPY(hdr + QDF_MAC_ADDR_SIZE,
  534. wh->i_addr2);
  535. break;
  536. case IEEE80211_FC1_DIR_FROMDS:
  537. DP_RX_DEFRAG_IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
  538. DP_RX_DEFRAG_IEEE80211_ADDR_COPY(hdr + QDF_MAC_ADDR_SIZE,
  539. wh->i_addr3);
  540. break;
  541. case IEEE80211_FC1_DIR_DSTODS:
  542. DP_RX_DEFRAG_IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
  543. DP_RX_DEFRAG_IEEE80211_ADDR_COPY(hdr + QDF_MAC_ADDR_SIZE,
  544. wh->i_addr4);
  545. break;
  546. }
  547. /*
  548. * Bit 7 is QDF_IEEE80211_FC0_SUBTYPE_QOS for data frame, but
  549. * it could also be set for deauth, disassoc, action, etc. for
  550. * a mgt type frame. It comes into picture for MFP.
  551. */
  552. if (wh->i_fc[0] & QDF_IEEE80211_FC0_SUBTYPE_QOS) {
  553. if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) ==
  554. IEEE80211_FC1_DIR_DSTODS) {
  555. const struct ieee80211_qosframe_addr4 *qwh =
  556. (const struct ieee80211_qosframe_addr4 *)wh;
  557. hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
  558. } else {
  559. const struct ieee80211_qosframe *qwh =
  560. (const struct ieee80211_qosframe *)wh;
  561. hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
  562. }
  563. } else {
  564. hdr[12] = 0;
  565. }
  566. hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
  567. }
  568. /*
  569. * dp_rx_defrag_mic(): Calculate MIC header
  570. * @key: Pointer to the key
  571. * @wbuf: fragment buffer
  572. * @off: Offset
  573. * @data_len: Data length
  574. * @mic: Array to hold MIC
  575. *
  576. * Calculate a pseudo MIC header
  577. *
  578. * Returns: QDF_STATUS
  579. */
  580. static QDF_STATUS dp_rx_defrag_mic(struct dp_soc *soc, const uint8_t *key,
  581. qdf_nbuf_t wbuf, uint16_t off,
  582. uint16_t data_len, uint8_t mic[])
  583. {
  584. uint8_t hdr[16] = { 0, };
  585. uint32_t l, r;
  586. const uint8_t *data;
  587. uint32_t space;
  588. int rx_desc_len = soc->rx_pkt_tlv_size;
  589. dp_rx_defrag_michdr((struct ieee80211_frame *)(qdf_nbuf_data(wbuf)
  590. + rx_desc_len), hdr);
  591. l = dp_rx_get_le32(key);
  592. r = dp_rx_get_le32(key + 4);
  593. /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
  594. l ^= dp_rx_get_le32(hdr);
  595. dp_rx_michael_block(l, r);
  596. l ^= dp_rx_get_le32(&hdr[4]);
  597. dp_rx_michael_block(l, r);
  598. l ^= dp_rx_get_le32(&hdr[8]);
  599. dp_rx_michael_block(l, r);
  600. l ^= dp_rx_get_le32(&hdr[12]);
  601. dp_rx_michael_block(l, r);
  602. /* first buffer has special handling */
  603. data = (uint8_t *)qdf_nbuf_data(wbuf) + off;
  604. space = qdf_nbuf_len(wbuf) - off;
  605. for (;; ) {
  606. if (space > data_len)
  607. space = data_len;
  608. /* collect 32-bit blocks from current buffer */
  609. while (space >= sizeof(uint32_t)) {
  610. l ^= dp_rx_get_le32(data);
  611. dp_rx_michael_block(l, r);
  612. data += sizeof(uint32_t);
  613. space -= sizeof(uint32_t);
  614. data_len -= sizeof(uint32_t);
  615. }
  616. if (data_len < sizeof(uint32_t))
  617. break;
  618. wbuf = qdf_nbuf_next(wbuf);
  619. if (!wbuf)
  620. return QDF_STATUS_E_DEFRAG_ERROR;
  621. if (space != 0) {
  622. const uint8_t *data_next;
  623. /*
  624. * Block straddles buffers, split references.
  625. */
  626. data_next =
  627. (uint8_t *)qdf_nbuf_data(wbuf) + off;
  628. if ((qdf_nbuf_len(wbuf)) <
  629. sizeof(uint32_t) - space) {
  630. return QDF_STATUS_E_DEFRAG_ERROR;
  631. }
  632. switch (space) {
  633. case 1:
  634. l ^= dp_rx_get_le32_split(data[0],
  635. data_next[0], data_next[1],
  636. data_next[2]);
  637. data = data_next + 3;
  638. space = (qdf_nbuf_len(wbuf) - off) - 3;
  639. break;
  640. case 2:
  641. l ^= dp_rx_get_le32_split(data[0], data[1],
  642. data_next[0], data_next[1]);
  643. data = data_next + 2;
  644. space = (qdf_nbuf_len(wbuf) - off) - 2;
  645. break;
  646. case 3:
  647. l ^= dp_rx_get_le32_split(data[0], data[1],
  648. data[2], data_next[0]);
  649. data = data_next + 1;
  650. space = (qdf_nbuf_len(wbuf) - off) - 1;
  651. break;
  652. }
  653. dp_rx_michael_block(l, r);
  654. data_len -= sizeof(uint32_t);
  655. } else {
  656. /*
  657. * Setup for next buffer.
  658. */
  659. data = (uint8_t *)qdf_nbuf_data(wbuf) + off;
  660. space = qdf_nbuf_len(wbuf) - off;
  661. }
  662. }
  663. /* Last block and padding (0x5a, 4..7 x 0) */
  664. switch (data_len) {
  665. case 0:
  666. l ^= dp_rx_get_le32_split(0x5a, 0, 0, 0);
  667. break;
  668. case 1:
  669. l ^= dp_rx_get_le32_split(data[0], 0x5a, 0, 0);
  670. break;
  671. case 2:
  672. l ^= dp_rx_get_le32_split(data[0], data[1], 0x5a, 0);
  673. break;
  674. case 3:
  675. l ^= dp_rx_get_le32_split(data[0], data[1], data[2], 0x5a);
  676. break;
  677. }
  678. dp_rx_michael_block(l, r);
  679. dp_rx_michael_block(l, r);
  680. dp_rx_put_le32(mic, l);
  681. dp_rx_put_le32(mic + 4, r);
  682. return QDF_STATUS_SUCCESS;
  683. }
  684. /*
  685. * dp_rx_defrag_tkip_demic(): Remove MIC header from the TKIP frame
  686. * @key: Pointer to the key
  687. * @msdu: fragment buffer
  688. * @hdrlen: Length of the header information
  689. *
  690. * Remove MIC information from the TKIP frame
  691. *
  692. * Returns: QDF_STATUS
  693. */
  694. static QDF_STATUS dp_rx_defrag_tkip_demic(struct dp_soc *soc,
  695. const uint8_t *key,
  696. qdf_nbuf_t msdu, uint16_t hdrlen)
  697. {
  698. QDF_STATUS status;
  699. uint32_t pktlen = 0, prev_data_len;
  700. uint8_t mic[IEEE80211_WEP_MICLEN];
  701. uint8_t mic0[IEEE80211_WEP_MICLEN];
  702. qdf_nbuf_t prev = NULL, prev0, next;
  703. uint8_t len0 = 0;
  704. next = msdu;
  705. prev0 = msdu;
  706. while (next) {
  707. pktlen += (qdf_nbuf_len(next) - hdrlen);
  708. prev = next;
  709. dp_debug("pktlen %u",
  710. (uint32_t)(qdf_nbuf_len(next) - hdrlen));
  711. next = qdf_nbuf_next(next);
  712. if (next && !qdf_nbuf_next(next))
  713. prev0 = prev;
  714. }
  715. if (!prev) {
  716. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  717. "%s Defrag chaining failed !\n", __func__);
  718. return QDF_STATUS_E_DEFRAG_ERROR;
  719. }
  720. prev_data_len = qdf_nbuf_len(prev) - hdrlen;
  721. if (prev_data_len < dp_f_tkip.ic_miclen) {
  722. if (prev0 == prev) {
  723. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  724. "%s Fragments don't have MIC header !\n", __func__);
  725. return QDF_STATUS_E_DEFRAG_ERROR;
  726. }
  727. len0 = dp_f_tkip.ic_miclen - (uint8_t)prev_data_len;
  728. qdf_nbuf_copy_bits(prev0, qdf_nbuf_len(prev0) - len0, len0,
  729. (caddr_t)mic0);
  730. qdf_nbuf_trim_tail(prev0, len0);
  731. }
  732. qdf_nbuf_copy_bits(prev, (qdf_nbuf_len(prev) -
  733. (dp_f_tkip.ic_miclen - len0)),
  734. (dp_f_tkip.ic_miclen - len0),
  735. (caddr_t)(&mic0[len0]));
  736. qdf_nbuf_trim_tail(prev, (dp_f_tkip.ic_miclen - len0));
  737. pktlen -= dp_f_tkip.ic_miclen;
  738. if (((qdf_nbuf_len(prev) - hdrlen) == 0) && prev != msdu) {
  739. dp_rx_nbuf_free(prev);
  740. qdf_nbuf_set_next(prev0, NULL);
  741. }
  742. status = dp_rx_defrag_mic(soc, key, msdu, hdrlen,
  743. pktlen, mic);
  744. if (QDF_IS_STATUS_ERROR(status))
  745. return status;
  746. if (qdf_mem_cmp(mic, mic0, dp_f_tkip.ic_miclen))
  747. return QDF_STATUS_E_DEFRAG_ERROR;
  748. return QDF_STATUS_SUCCESS;
  749. }
  750. /*
  751. * dp_rx_frag_pull_hdr(): Pulls the RXTLV & the 802.11 headers
  752. * @nbuf: buffer pointer
  753. * @hdrsize: size of the header to be pulled
  754. *
  755. * Pull the RXTLV & the 802.11 headers
  756. *
  757. * Returns: None
  758. */
  759. static void dp_rx_frag_pull_hdr(struct dp_soc *soc,
  760. qdf_nbuf_t nbuf, uint16_t hdrsize)
  761. {
  762. hal_rx_print_pn(soc->hal_soc, qdf_nbuf_data(nbuf));
  763. qdf_nbuf_pull_head(nbuf, soc->rx_pkt_tlv_size + hdrsize);
  764. dp_debug("final pktlen %d .11len %d",
  765. (uint32_t)qdf_nbuf_len(nbuf), hdrsize);
  766. }
  767. /*
  768. * dp_rx_defrag_pn_check(): Check the PN of current fragmented with prev PN
  769. * @msdu: msdu to get the current PN
  770. * @cur_pn128: PN extracted from current msdu
  771. * @prev_pn128: Prev PN
  772. *
  773. * Returns: 0 on success, non zero on failure
  774. */
  775. static int dp_rx_defrag_pn_check(struct dp_soc *soc, qdf_nbuf_t msdu,
  776. uint64_t *cur_pn128, uint64_t *prev_pn128)
  777. {
  778. int out_of_order = 0;
  779. hal_rx_tlv_get_pn_num(soc->hal_soc, qdf_nbuf_data(msdu), cur_pn128);
  780. if (cur_pn128[1] == prev_pn128[1])
  781. out_of_order = (cur_pn128[0] - prev_pn128[0] != 1);
  782. else
  783. out_of_order = (cur_pn128[1] - prev_pn128[1] != 1);
  784. return out_of_order;
  785. }
  786. /*
  787. * dp_rx_construct_fraglist(): Construct a nbuf fraglist
  788. * @txrx peer: Pointer to the txrx peer
  789. * @head: Pointer to list of fragments
  790. * @hdrsize: Size of the header to be pulled
  791. *
  792. * Construct a nbuf fraglist
  793. *
  794. * Returns: None
  795. */
  796. static int
  797. dp_rx_construct_fraglist(struct dp_txrx_peer *txrx_peer, int tid,
  798. qdf_nbuf_t head,
  799. uint16_t hdrsize)
  800. {
  801. struct dp_soc *soc = txrx_peer->vdev->pdev->soc;
  802. qdf_nbuf_t msdu = qdf_nbuf_next(head);
  803. qdf_nbuf_t rx_nbuf = msdu;
  804. struct dp_rx_tid_defrag *rx_tid = &txrx_peer->rx_tid[tid];
  805. uint32_t len = 0;
  806. uint64_t cur_pn128[2] = {0, 0}, prev_pn128[2];
  807. int out_of_order = 0;
  808. int index;
  809. int needs_pn_check = 0;
  810. enum cdp_sec_type sec_type;
  811. prev_pn128[0] = rx_tid->pn128[0];
  812. prev_pn128[1] = rx_tid->pn128[1];
  813. index = hal_rx_msdu_is_wlan_mcast(soc->hal_soc, msdu) ? dp_sec_mcast :
  814. dp_sec_ucast;
  815. sec_type = txrx_peer->security[index].sec_type;
  816. if (!(sec_type == cdp_sec_type_none || sec_type == cdp_sec_type_wep128 ||
  817. sec_type == cdp_sec_type_wep104 || sec_type == cdp_sec_type_wep40))
  818. needs_pn_check = 1;
  819. while (msdu) {
  820. if (qdf_likely(needs_pn_check))
  821. out_of_order = dp_rx_defrag_pn_check(soc, msdu,
  822. &cur_pn128[0],
  823. &prev_pn128[0]);
  824. if (qdf_unlikely(out_of_order)) {
  825. dp_info_rl("cur_pn128[0] 0x%llx cur_pn128[1] 0x%llx prev_pn128[0] 0x%llx prev_pn128[1] 0x%llx",
  826. cur_pn128[0], cur_pn128[1],
  827. prev_pn128[0], prev_pn128[1]);
  828. return QDF_STATUS_E_FAILURE;
  829. }
  830. prev_pn128[0] = cur_pn128[0];
  831. prev_pn128[1] = cur_pn128[1];
  832. /*
  833. * Broadcast and multicast frames should never be fragmented.
  834. * Iterating through all msdus and dropping fragments if even
  835. * one of them has mcast/bcast destination address.
  836. */
  837. if (hal_rx_msdu_is_wlan_mcast(soc->hal_soc, msdu)) {
  838. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  839. "Dropping multicast/broadcast fragments");
  840. return QDF_STATUS_E_FAILURE;
  841. }
  842. dp_rx_frag_pull_hdr(soc, msdu, hdrsize);
  843. len += qdf_nbuf_len(msdu);
  844. msdu = qdf_nbuf_next(msdu);
  845. }
  846. qdf_nbuf_append_ext_list(head, rx_nbuf, len);
  847. qdf_nbuf_set_next(head, NULL);
  848. qdf_nbuf_set_is_frag(head, 1);
  849. dp_debug("head len %d ext len %d data len %d ",
  850. (uint32_t)qdf_nbuf_len(head),
  851. (uint32_t)qdf_nbuf_len(rx_nbuf),
  852. (uint32_t)(head->data_len));
  853. return QDF_STATUS_SUCCESS;
  854. }
  855. /**
  856. * dp_rx_defrag_err() - rx err handler
  857. * @pdev: handle to pdev object
  858. * @vdev_id: vdev id
  859. * @peer_mac_addr: peer mac address
  860. * @tid: TID
  861. * @tsf32: TSF
  862. * @err_type: error type
  863. * @rx_frame: rx frame
  864. * @pn: PN Number
  865. * @key_id: key id
  866. *
  867. * This function handles rx error and send MIC error notification
  868. *
  869. * Return: None
  870. */
  871. static void dp_rx_defrag_err(struct dp_vdev *vdev, qdf_nbuf_t nbuf)
  872. {
  873. struct ol_if_ops *tops = NULL;
  874. struct dp_pdev *pdev = vdev->pdev;
  875. int rx_desc_len = pdev->soc->rx_pkt_tlv_size;
  876. uint8_t *orig_hdr;
  877. struct ieee80211_frame *wh;
  878. struct cdp_rx_mic_err_info mic_failure_info;
  879. orig_hdr = (uint8_t *)(qdf_nbuf_data(nbuf) + rx_desc_len);
  880. wh = (struct ieee80211_frame *)orig_hdr;
  881. qdf_copy_macaddr((struct qdf_mac_addr *)&mic_failure_info.da_mac_addr,
  882. (struct qdf_mac_addr *)&wh->i_addr1);
  883. qdf_copy_macaddr((struct qdf_mac_addr *)&mic_failure_info.ta_mac_addr,
  884. (struct qdf_mac_addr *)&wh->i_addr2);
  885. mic_failure_info.key_id = 0;
  886. mic_failure_info.multicast =
  887. IEEE80211_IS_MULTICAST(wh->i_addr1);
  888. qdf_mem_zero(mic_failure_info.tsc, MIC_SEQ_CTR_SIZE);
  889. mic_failure_info.frame_type = cdp_rx_frame_type_802_11;
  890. mic_failure_info.data = (uint8_t *)wh;
  891. mic_failure_info.vdev_id = vdev->vdev_id;
  892. tops = pdev->soc->cdp_soc.ol_ops;
  893. if (tops->rx_mic_error)
  894. tops->rx_mic_error(pdev->soc->ctrl_psoc, pdev->pdev_id,
  895. &mic_failure_info);
  896. }
  897. /*
  898. * dp_rx_defrag_nwifi_to_8023(): Transcap 802.11 to 802.3
  899. * @soc: dp soc handle
  900. * @txrx_peer: txrx_peer handle
  901. * @nbuf: Pointer to the fragment buffer
  902. * @hdrsize: Size of headers
  903. *
  904. * Transcap the fragment from 802.11 to 802.3
  905. *
  906. * Returns: None
  907. */
  908. static void
  909. dp_rx_defrag_nwifi_to_8023(struct dp_soc *soc, struct dp_txrx_peer *txrx_peer,
  910. int tid, qdf_nbuf_t nbuf, uint16_t hdrsize)
  911. {
  912. struct llc_snap_hdr_t *llchdr;
  913. struct ethernet_hdr_t *eth_hdr;
  914. uint8_t ether_type[2];
  915. uint16_t fc = 0;
  916. union dp_align_mac_addr mac_addr;
  917. uint8_t *rx_desc_info = qdf_mem_malloc(soc->rx_pkt_tlv_size);
  918. struct dp_rx_tid_defrag *rx_tid = &txrx_peer->rx_tid[tid];
  919. struct ieee80211_frame_addr4 wh = {0};
  920. hal_rx_tlv_get_pn_num(soc->hal_soc, qdf_nbuf_data(nbuf), rx_tid->pn128);
  921. hal_rx_print_pn(soc->hal_soc, qdf_nbuf_data(nbuf));
  922. if (!rx_desc_info) {
  923. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  924. "%s: Memory alloc failed ! ", __func__);
  925. QDF_ASSERT(0);
  926. return;
  927. }
  928. qdf_mem_zero(&wh, sizeof(struct ieee80211_frame_addr4));
  929. if (hal_rx_get_mpdu_mac_ad4_valid(soc->hal_soc, qdf_nbuf_data(nbuf)))
  930. qdf_mem_copy(&wh, qdf_nbuf_data(nbuf) + soc->rx_pkt_tlv_size,
  931. hdrsize);
  932. qdf_mem_copy(rx_desc_info, qdf_nbuf_data(nbuf), soc->rx_pkt_tlv_size);
  933. llchdr = (struct llc_snap_hdr_t *)(qdf_nbuf_data(nbuf) +
  934. soc->rx_pkt_tlv_size + hdrsize);
  935. qdf_mem_copy(ether_type, llchdr->ethertype, 2);
  936. qdf_nbuf_pull_head(nbuf, (soc->rx_pkt_tlv_size + hdrsize +
  937. sizeof(struct llc_snap_hdr_t) -
  938. sizeof(struct ethernet_hdr_t)));
  939. eth_hdr = (struct ethernet_hdr_t *)(qdf_nbuf_data(nbuf));
  940. if (hal_rx_get_mpdu_frame_control_valid(soc->hal_soc,
  941. rx_desc_info))
  942. fc = hal_rx_get_frame_ctrl_field(soc->hal_soc, rx_desc_info);
  943. dp_debug("Frame control type: 0x%x", fc);
  944. switch (((fc & 0xff00) >> 8) & IEEE80211_FC1_DIR_MASK) {
  945. case IEEE80211_FC1_DIR_NODS:
  946. hal_rx_mpdu_get_addr1(soc->hal_soc, rx_desc_info,
  947. &mac_addr.raw[0]);
  948. qdf_mem_copy(eth_hdr->dest_addr, &mac_addr.raw[0],
  949. QDF_MAC_ADDR_SIZE);
  950. hal_rx_mpdu_get_addr2(soc->hal_soc, rx_desc_info,
  951. &mac_addr.raw[0]);
  952. qdf_mem_copy(eth_hdr->src_addr, &mac_addr.raw[0],
  953. QDF_MAC_ADDR_SIZE);
  954. break;
  955. case IEEE80211_FC1_DIR_TODS:
  956. hal_rx_mpdu_get_addr3(soc->hal_soc, rx_desc_info,
  957. &mac_addr.raw[0]);
  958. qdf_mem_copy(eth_hdr->dest_addr, &mac_addr.raw[0],
  959. QDF_MAC_ADDR_SIZE);
  960. hal_rx_mpdu_get_addr2(soc->hal_soc, rx_desc_info,
  961. &mac_addr.raw[0]);
  962. qdf_mem_copy(eth_hdr->src_addr, &mac_addr.raw[0],
  963. QDF_MAC_ADDR_SIZE);
  964. break;
  965. case IEEE80211_FC1_DIR_FROMDS:
  966. hal_rx_mpdu_get_addr1(soc->hal_soc, rx_desc_info,
  967. &mac_addr.raw[0]);
  968. qdf_mem_copy(eth_hdr->dest_addr, &mac_addr.raw[0],
  969. QDF_MAC_ADDR_SIZE);
  970. hal_rx_mpdu_get_addr3(soc->hal_soc, rx_desc_info,
  971. &mac_addr.raw[0]);
  972. qdf_mem_copy(eth_hdr->src_addr, &mac_addr.raw[0],
  973. QDF_MAC_ADDR_SIZE);
  974. break;
  975. case IEEE80211_FC1_DIR_DSTODS:
  976. hal_rx_mpdu_get_addr3(soc->hal_soc, rx_desc_info,
  977. &mac_addr.raw[0]);
  978. qdf_mem_copy(eth_hdr->dest_addr, &mac_addr.raw[0],
  979. QDF_MAC_ADDR_SIZE);
  980. qdf_mem_copy(eth_hdr->src_addr, &wh.i_addr4[0],
  981. QDF_MAC_ADDR_SIZE);
  982. break;
  983. default:
  984. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  985. "%s: Unknown frame control type: 0x%x", __func__, fc);
  986. }
  987. qdf_mem_copy(eth_hdr->ethertype, ether_type,
  988. sizeof(ether_type));
  989. qdf_nbuf_push_head(nbuf, soc->rx_pkt_tlv_size);
  990. qdf_mem_copy(qdf_nbuf_data(nbuf), rx_desc_info, soc->rx_pkt_tlv_size);
  991. qdf_mem_free(rx_desc_info);
  992. }
  993. #ifdef RX_DEFRAG_DO_NOT_REINJECT
  994. /*
  995. * dp_rx_defrag_deliver(): Deliver defrag packet to stack
  996. * @peer: Pointer to the peer
  997. * @tid: Transmit Identifier
  998. * @head: Nbuf to be delivered
  999. *
  1000. * Returns: None
  1001. */
  1002. static inline void dp_rx_defrag_deliver(struct dp_txrx_peer *txrx_peer,
  1003. unsigned int tid,
  1004. qdf_nbuf_t head)
  1005. {
  1006. struct dp_vdev *vdev = txrx_peer->vdev;
  1007. struct dp_soc *soc = vdev->pdev->soc;
  1008. qdf_nbuf_t deliver_list_head = NULL;
  1009. qdf_nbuf_t deliver_list_tail = NULL;
  1010. uint8_t *rx_tlv_hdr;
  1011. rx_tlv_hdr = qdf_nbuf_data(head);
  1012. QDF_NBUF_CB_RX_VDEV_ID(head) = vdev->vdev_id;
  1013. qdf_nbuf_set_tid_val(head, tid);
  1014. qdf_nbuf_pull_head(head, soc->rx_pkt_tlv_size);
  1015. DP_RX_LIST_APPEND(deliver_list_head, deliver_list_tail,
  1016. head);
  1017. dp_rx_deliver_to_stack(soc, vdev, txrx_peer, deliver_list_head,
  1018. deliver_list_tail);
  1019. }
  1020. /*
  1021. * dp_rx_defrag_reo_reinject(): Reinject the fragment chain back into REO
  1022. * @txrx peer: Pointer to the peer
  1023. * @tid: Transmit Identifier
  1024. * @head: Buffer to be reinjected back
  1025. *
  1026. * Reinject the fragment chain back into REO
  1027. *
  1028. * Returns: QDF_STATUS
  1029. */
  1030. static QDF_STATUS dp_rx_defrag_reo_reinject(struct dp_txrx_peer *txrx_peer,
  1031. unsigned int tid, qdf_nbuf_t head)
  1032. {
  1033. struct dp_rx_reorder_array_elem *rx_reorder_array_elem;
  1034. rx_reorder_array_elem = txrx_peer->rx_tid[tid].array;
  1035. dp_rx_defrag_deliver(txrx_peer, tid, head);
  1036. rx_reorder_array_elem->head = NULL;
  1037. rx_reorder_array_elem->tail = NULL;
  1038. dp_rx_return_head_frag_desc(txrx_peer, tid);
  1039. return QDF_STATUS_SUCCESS;
  1040. }
  1041. #else
  1042. #ifdef WLAN_FEATURE_DP_RX_RING_HISTORY
  1043. /**
  1044. * dp_rx_reinject_ring_record_entry() - Record reinject ring history
  1045. * @soc: Datapath soc structure
  1046. * @paddr: paddr of the buffer reinjected to SW2REO ring
  1047. * @sw_cookie: SW cookie of the buffer reinjected to SW2REO ring
  1048. * @rbm: Return buffer manager of the buffer reinjected to SW2REO ring
  1049. *
  1050. * Returns: None
  1051. */
  1052. static inline void
  1053. dp_rx_reinject_ring_record_entry(struct dp_soc *soc, uint64_t paddr,
  1054. uint32_t sw_cookie, uint8_t rbm)
  1055. {
  1056. struct dp_buf_info_record *record;
  1057. uint32_t idx;
  1058. if (qdf_unlikely(!soc->rx_reinject_ring_history))
  1059. return;
  1060. idx = dp_history_get_next_index(&soc->rx_reinject_ring_history->index,
  1061. DP_RX_REINJECT_HIST_MAX);
  1062. /* No NULL check needed for record since its an array */
  1063. record = &soc->rx_reinject_ring_history->entry[idx];
  1064. record->timestamp = qdf_get_log_timestamp();
  1065. record->hbi.paddr = paddr;
  1066. record->hbi.sw_cookie = sw_cookie;
  1067. record->hbi.rbm = rbm;
  1068. }
  1069. #else
  1070. static inline void
  1071. dp_rx_reinject_ring_record_entry(struct dp_soc *soc, uint64_t paddr,
  1072. uint32_t sw_cookie, uint8_t rbm)
  1073. {
  1074. }
  1075. #endif
  1076. /*
  1077. * dp_rx_defrag_reo_reinject(): Reinject the fragment chain back into REO
  1078. * @txrx_peer: Pointer to the txrx_peer
  1079. * @tid: Transmit Identifier
  1080. * @head: Buffer to be reinjected back
  1081. *
  1082. * Reinject the fragment chain back into REO
  1083. *
  1084. * Returns: QDF_STATUS
  1085. */
  1086. static QDF_STATUS dp_rx_defrag_reo_reinject(struct dp_txrx_peer *txrx_peer,
  1087. unsigned int tid, qdf_nbuf_t head)
  1088. {
  1089. struct dp_pdev *pdev = txrx_peer->vdev->pdev;
  1090. struct dp_soc *soc = pdev->soc;
  1091. struct hal_buf_info buf_info;
  1092. struct hal_buf_info temp_buf_info;
  1093. void *link_desc_va;
  1094. void *msdu0, *msdu_desc_info;
  1095. void *ent_ring_desc, *ent_mpdu_desc_info, *ent_qdesc_addr;
  1096. void *dst_mpdu_desc_info;
  1097. uint64_t dst_qdesc_addr;
  1098. qdf_dma_addr_t paddr;
  1099. uint32_t nbuf_len, seq_no, dst_ind;
  1100. uint32_t *mpdu_wrd;
  1101. uint32_t ret, cookie;
  1102. hal_ring_desc_t dst_ring_desc =
  1103. txrx_peer->rx_tid[tid].dst_ring_desc;
  1104. hal_ring_handle_t hal_srng = soc->reo_reinject_ring.hal_srng;
  1105. struct dp_rx_desc *rx_desc = txrx_peer->rx_tid[tid].head_frag_desc;
  1106. struct dp_rx_reorder_array_elem *rx_reorder_array_elem =
  1107. txrx_peer->rx_tid[tid].array;
  1108. qdf_nbuf_t nbuf_head;
  1109. struct rx_desc_pool *rx_desc_pool = NULL;
  1110. void *buf_addr_info = HAL_RX_REO_BUF_ADDR_INFO_GET(dst_ring_desc);
  1111. uint8_t rx_defrag_rbm_id = dp_rx_get_defrag_bm_id(soc);
  1112. /* do duplicate link desc address check */
  1113. dp_rx_link_desc_refill_duplicate_check(
  1114. soc,
  1115. &soc->last_op_info.reo_reinject_link_desc,
  1116. buf_addr_info);
  1117. nbuf_head = dp_ipa_handle_rx_reo_reinject(soc, head);
  1118. if (qdf_unlikely(!nbuf_head)) {
  1119. dp_err_rl("IPA RX REO reinject failed");
  1120. return QDF_STATUS_E_FAILURE;
  1121. }
  1122. /* update new allocated skb in case IPA is enabled */
  1123. if (nbuf_head != head) {
  1124. head = nbuf_head;
  1125. rx_desc->nbuf = head;
  1126. rx_reorder_array_elem->head = head;
  1127. }
  1128. ent_ring_desc = hal_srng_src_get_next(soc->hal_soc, hal_srng);
  1129. if (!ent_ring_desc) {
  1130. dp_err_rl("HAL src ring next entry NULL");
  1131. return QDF_STATUS_E_FAILURE;
  1132. }
  1133. hal_rx_reo_buf_paddr_get(soc->hal_soc, dst_ring_desc, &buf_info);
  1134. /* buffer_addr_info is the first element of ring_desc */
  1135. hal_rx_buf_cookie_rbm_get(soc->hal_soc, (uint32_t *)dst_ring_desc,
  1136. &buf_info);
  1137. link_desc_va = dp_rx_cookie_2_link_desc_va(soc, &buf_info);
  1138. qdf_assert_always(link_desc_va);
  1139. msdu0 = hal_rx_msdu0_buffer_addr_lsb(soc->hal_soc, link_desc_va);
  1140. nbuf_len = qdf_nbuf_len(head) - soc->rx_pkt_tlv_size;
  1141. HAL_RX_UNIFORM_HDR_SET(link_desc_va, OWNER, UNI_DESC_OWNER_SW);
  1142. HAL_RX_UNIFORM_HDR_SET(link_desc_va, BUFFER_TYPE,
  1143. UNI_DESC_BUF_TYPE_RX_MSDU_LINK);
  1144. /* msdu reconfig */
  1145. msdu_desc_info = hal_rx_msdu_desc_info_ptr_get(soc->hal_soc, msdu0);
  1146. dst_ind = hal_rx_msdu_reo_dst_ind_get(soc->hal_soc, link_desc_va);
  1147. qdf_mem_zero(msdu_desc_info, sizeof(struct rx_msdu_desc_info));
  1148. hal_msdu_desc_info_set(soc->hal_soc, msdu_desc_info, dst_ind, nbuf_len);
  1149. /* change RX TLV's */
  1150. hal_rx_tlv_msdu_len_set(soc->hal_soc, qdf_nbuf_data(head), nbuf_len);
  1151. hal_rx_buf_cookie_rbm_get(soc->hal_soc, (uint32_t *)msdu0,
  1152. &temp_buf_info);
  1153. cookie = temp_buf_info.sw_cookie;
  1154. rx_desc_pool = &soc->rx_desc_buf[pdev->lmac_id];
  1155. /* map the nbuf before reinject it into HW */
  1156. ret = qdf_nbuf_map_nbytes_single(soc->osdev, head,
  1157. QDF_DMA_FROM_DEVICE,
  1158. rx_desc_pool->buf_size);
  1159. if (qdf_unlikely(ret == QDF_STATUS_E_FAILURE)) {
  1160. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1161. "%s: nbuf map failed !", __func__);
  1162. return QDF_STATUS_E_FAILURE;
  1163. }
  1164. dp_ipa_handle_rx_buf_smmu_mapping(soc, head, rx_desc_pool->buf_size,
  1165. true, __func__, __LINE__);
  1166. /*
  1167. * As part of rx frag handler buffer was unmapped and rx desc
  1168. * unmapped is set to 1. So again for defrag reinject frame reset
  1169. * it back to 0.
  1170. */
  1171. rx_desc->unmapped = 0;
  1172. paddr = qdf_nbuf_get_frag_paddr(head, 0);
  1173. ret = dp_check_paddr(soc, &head, &paddr, rx_desc_pool);
  1174. if (ret == QDF_STATUS_E_FAILURE) {
  1175. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1176. "%s: x86 check failed !", __func__);
  1177. return QDF_STATUS_E_FAILURE;
  1178. }
  1179. hal_rxdma_buff_addr_info_set(soc->hal_soc, msdu0, paddr, cookie,
  1180. rx_defrag_rbm_id);
  1181. /* Lets fill entrance ring now !!! */
  1182. if (qdf_unlikely(hal_srng_access_start(soc->hal_soc, hal_srng))) {
  1183. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1184. "HAL RING Access For REO entrance SRNG Failed: %pK",
  1185. hal_srng);
  1186. return QDF_STATUS_E_FAILURE;
  1187. }
  1188. dp_rx_reinject_ring_record_entry(soc, paddr, cookie,
  1189. rx_defrag_rbm_id);
  1190. paddr = (uint64_t)buf_info.paddr;
  1191. /* buf addr */
  1192. hal_rxdma_buff_addr_info_set(soc->hal_soc, ent_ring_desc, paddr,
  1193. buf_info.sw_cookie,
  1194. soc->idle_link_bm_id);
  1195. /* mpdu desc info */
  1196. ent_mpdu_desc_info = hal_ent_mpdu_desc_info(soc->hal_soc,
  1197. ent_ring_desc);
  1198. dst_mpdu_desc_info = hal_dst_mpdu_desc_info(soc->hal_soc,
  1199. dst_ring_desc);
  1200. qdf_mem_copy(ent_mpdu_desc_info, dst_mpdu_desc_info,
  1201. sizeof(struct rx_mpdu_desc_info));
  1202. qdf_mem_zero(ent_mpdu_desc_info, sizeof(uint32_t));
  1203. mpdu_wrd = (uint32_t *)dst_mpdu_desc_info;
  1204. seq_no = hal_rx_get_rx_sequence(soc->hal_soc, rx_desc->rx_buf_start);
  1205. hal_mpdu_desc_info_set(soc->hal_soc, ent_ring_desc, ent_mpdu_desc_info,
  1206. seq_no);
  1207. /* qdesc addr */
  1208. ent_qdesc_addr = hal_get_reo_ent_desc_qdesc_addr(soc->hal_soc,
  1209. (uint8_t *)ent_ring_desc);
  1210. dst_qdesc_addr = soc->arch_ops.get_reo_qdesc_addr(
  1211. soc->hal_soc,
  1212. (uint8_t *)dst_ring_desc,
  1213. qdf_nbuf_data(head),
  1214. txrx_peer, tid);
  1215. qdf_mem_copy(ent_qdesc_addr, &dst_qdesc_addr, 5);
  1216. hal_set_reo_ent_desc_reo_dest_ind(soc->hal_soc,
  1217. (uint8_t *)ent_ring_desc, dst_ind);
  1218. hal_srng_access_end(soc->hal_soc, hal_srng);
  1219. DP_STATS_INC(soc, rx.reo_reinject, 1);
  1220. dp_debug("reinjection done !");
  1221. return QDF_STATUS_SUCCESS;
  1222. }
  1223. #endif
  1224. /*
  1225. * dp_rx_defrag_gcmp_demic(): Remove MIC information from GCMP fragment
  1226. * @soc: Datapath soc structure
  1227. * @nbuf: Pointer to the fragment buffer
  1228. * @hdrlen: 802.11 header length
  1229. *
  1230. * Remove MIC information from GCMP fragment
  1231. *
  1232. * Returns: QDF_STATUS
  1233. */
  1234. static QDF_STATUS dp_rx_defrag_gcmp_demic(struct dp_soc *soc, qdf_nbuf_t nbuf,
  1235. uint16_t hdrlen)
  1236. {
  1237. uint8_t *ivp, *orig_hdr;
  1238. int rx_desc_len = soc->rx_pkt_tlv_size;
  1239. /* start of the 802.11 header */
  1240. orig_hdr = (uint8_t *)(qdf_nbuf_data(nbuf) + rx_desc_len);
  1241. /*
  1242. * GCMP header is located after 802.11 header and EXTIV
  1243. * field should always be set to 1 for GCMP protocol.
  1244. */
  1245. ivp = orig_hdr + hdrlen;
  1246. if (!(ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV))
  1247. return QDF_STATUS_E_DEFRAG_ERROR;
  1248. qdf_nbuf_trim_tail(nbuf, dp_f_gcmp.ic_trailer);
  1249. return QDF_STATUS_SUCCESS;
  1250. }
  1251. /*
  1252. * dp_rx_defrag(): Defragment the fragment chain
  1253. * @txrx peer: Pointer to the peer
  1254. * @tid: Transmit Identifier
  1255. * @frag_list_head: Pointer to head list
  1256. * @frag_list_tail: Pointer to tail list
  1257. *
  1258. * Defragment the fragment chain
  1259. *
  1260. * Returns: QDF_STATUS
  1261. */
  1262. static QDF_STATUS dp_rx_defrag(struct dp_txrx_peer *txrx_peer, unsigned int tid,
  1263. qdf_nbuf_t frag_list_head,
  1264. qdf_nbuf_t frag_list_tail)
  1265. {
  1266. qdf_nbuf_t tmp_next, prev;
  1267. qdf_nbuf_t cur = frag_list_head, msdu;
  1268. uint32_t index, tkip_demic = 0;
  1269. uint16_t hdr_space;
  1270. uint8_t key[DEFRAG_IEEE80211_KEY_LEN];
  1271. struct dp_vdev *vdev = txrx_peer->vdev;
  1272. struct dp_soc *soc = vdev->pdev->soc;
  1273. uint8_t status = 0;
  1274. if (!cur)
  1275. return QDF_STATUS_E_DEFRAG_ERROR;
  1276. hdr_space = dp_rx_defrag_hdrsize(soc, cur);
  1277. index = hal_rx_msdu_is_wlan_mcast(soc->hal_soc, cur) ?
  1278. dp_sec_mcast : dp_sec_ucast;
  1279. /* Remove FCS from all fragments */
  1280. while (cur) {
  1281. tmp_next = qdf_nbuf_next(cur);
  1282. qdf_nbuf_set_next(cur, NULL);
  1283. qdf_nbuf_trim_tail(cur, DEFRAG_IEEE80211_FCS_LEN);
  1284. prev = cur;
  1285. qdf_nbuf_set_next(cur, tmp_next);
  1286. cur = tmp_next;
  1287. }
  1288. cur = frag_list_head;
  1289. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_DEBUG,
  1290. "%s: index %d Security type: %d", __func__,
  1291. index, txrx_peer->security[index].sec_type);
  1292. switch (txrx_peer->security[index].sec_type) {
  1293. case cdp_sec_type_tkip:
  1294. tkip_demic = 1;
  1295. fallthrough;
  1296. case cdp_sec_type_tkip_nomic:
  1297. while (cur) {
  1298. tmp_next = qdf_nbuf_next(cur);
  1299. if (dp_rx_defrag_tkip_decap(soc, cur, hdr_space)) {
  1300. QDF_TRACE(QDF_MODULE_ID_TXRX,
  1301. QDF_TRACE_LEVEL_ERROR,
  1302. "dp_rx_defrag: TKIP decap failed");
  1303. return QDF_STATUS_E_DEFRAG_ERROR;
  1304. }
  1305. cur = tmp_next;
  1306. }
  1307. /* If success, increment header to be stripped later */
  1308. hdr_space += dp_f_tkip.ic_header;
  1309. break;
  1310. case cdp_sec_type_aes_ccmp:
  1311. while (cur) {
  1312. tmp_next = qdf_nbuf_next(cur);
  1313. if (dp_rx_defrag_ccmp_demic(soc, cur, hdr_space)) {
  1314. QDF_TRACE(QDF_MODULE_ID_TXRX,
  1315. QDF_TRACE_LEVEL_ERROR,
  1316. "dp_rx_defrag: CCMP demic failed");
  1317. return QDF_STATUS_E_DEFRAG_ERROR;
  1318. }
  1319. if (dp_rx_defrag_ccmp_decap(soc, cur, hdr_space)) {
  1320. QDF_TRACE(QDF_MODULE_ID_TXRX,
  1321. QDF_TRACE_LEVEL_ERROR,
  1322. "dp_rx_defrag: CCMP decap failed");
  1323. return QDF_STATUS_E_DEFRAG_ERROR;
  1324. }
  1325. cur = tmp_next;
  1326. }
  1327. /* If success, increment header to be stripped later */
  1328. hdr_space += dp_f_ccmp.ic_header;
  1329. break;
  1330. case cdp_sec_type_wep40:
  1331. case cdp_sec_type_wep104:
  1332. case cdp_sec_type_wep128:
  1333. while (cur) {
  1334. tmp_next = qdf_nbuf_next(cur);
  1335. if (dp_rx_defrag_wep_decap(soc, cur, hdr_space)) {
  1336. QDF_TRACE(QDF_MODULE_ID_TXRX,
  1337. QDF_TRACE_LEVEL_ERROR,
  1338. "dp_rx_defrag: WEP decap failed");
  1339. return QDF_STATUS_E_DEFRAG_ERROR;
  1340. }
  1341. cur = tmp_next;
  1342. }
  1343. /* If success, increment header to be stripped later */
  1344. hdr_space += dp_f_wep.ic_header;
  1345. break;
  1346. case cdp_sec_type_aes_gcmp:
  1347. case cdp_sec_type_aes_gcmp_256:
  1348. while (cur) {
  1349. tmp_next = qdf_nbuf_next(cur);
  1350. if (dp_rx_defrag_gcmp_demic(soc, cur, hdr_space)) {
  1351. QDF_TRACE(QDF_MODULE_ID_TXRX,
  1352. QDF_TRACE_LEVEL_ERROR,
  1353. "dp_rx_defrag: GCMP demic failed");
  1354. return QDF_STATUS_E_DEFRAG_ERROR;
  1355. }
  1356. cur = tmp_next;
  1357. }
  1358. hdr_space += dp_f_gcmp.ic_header;
  1359. break;
  1360. default:
  1361. break;
  1362. }
  1363. if (tkip_demic) {
  1364. msdu = frag_list_head;
  1365. qdf_mem_copy(key,
  1366. &txrx_peer->security[index].michael_key[0],
  1367. IEEE80211_WEP_MICLEN);
  1368. status = dp_rx_defrag_tkip_demic(soc, key, msdu,
  1369. soc->rx_pkt_tlv_size +
  1370. hdr_space);
  1371. if (status) {
  1372. dp_rx_defrag_err(vdev, frag_list_head);
  1373. QDF_TRACE(QDF_MODULE_ID_TXRX,
  1374. QDF_TRACE_LEVEL_ERROR,
  1375. "%s: TKIP demic failed status %d",
  1376. __func__, status);
  1377. return QDF_STATUS_E_DEFRAG_ERROR;
  1378. }
  1379. }
  1380. /* Convert the header to 802.3 header */
  1381. dp_rx_defrag_nwifi_to_8023(soc, txrx_peer, tid, frag_list_head,
  1382. hdr_space);
  1383. if (qdf_nbuf_next(frag_list_head)) {
  1384. if (dp_rx_construct_fraglist(txrx_peer, tid, frag_list_head,
  1385. hdr_space))
  1386. return QDF_STATUS_E_DEFRAG_ERROR;
  1387. }
  1388. return QDF_STATUS_SUCCESS;
  1389. }
  1390. /*
  1391. * dp_rx_defrag_cleanup(): Clean up activities
  1392. * @txrx_peer: Pointer to the peer
  1393. * @tid: Transmit Identifier
  1394. *
  1395. * Returns: None
  1396. */
  1397. void dp_rx_defrag_cleanup(struct dp_txrx_peer *txrx_peer, unsigned int tid)
  1398. {
  1399. struct dp_rx_reorder_array_elem *rx_reorder_array_elem =
  1400. txrx_peer->rx_tid[tid].array;
  1401. if (rx_reorder_array_elem) {
  1402. /* Free up nbufs */
  1403. dp_rx_defrag_frames_free(rx_reorder_array_elem->head);
  1404. rx_reorder_array_elem->head = NULL;
  1405. rx_reorder_array_elem->tail = NULL;
  1406. } else {
  1407. dp_info("Cleanup self peer %pK and TID %u",
  1408. txrx_peer, tid);
  1409. }
  1410. /* Free up saved ring descriptors */
  1411. dp_rx_clear_saved_desc_info(txrx_peer, tid);
  1412. txrx_peer->rx_tid[tid].defrag_timeout_ms = 0;
  1413. txrx_peer->rx_tid[tid].curr_frag_num = 0;
  1414. txrx_peer->rx_tid[tid].curr_seq_num = 0;
  1415. }
  1416. /*
  1417. * dp_rx_defrag_save_info_from_ring_desc(): Save info from REO ring descriptor
  1418. * @soc: Pointer to the SOC data structure
  1419. * @ring_desc: Pointer to the dst ring descriptor
  1420. * @txrx_peer: Pointer to the peer
  1421. * @tid: Transmit Identifier
  1422. *
  1423. * Returns: None
  1424. */
  1425. static QDF_STATUS
  1426. dp_rx_defrag_save_info_from_ring_desc(struct dp_soc *soc,
  1427. hal_ring_desc_t ring_desc,
  1428. struct dp_rx_desc *rx_desc,
  1429. struct dp_txrx_peer *txrx_peer,
  1430. unsigned int tid)
  1431. {
  1432. void *dst_ring_desc;
  1433. dst_ring_desc = qdf_mem_malloc(hal_srng_get_entrysize(soc->hal_soc,
  1434. REO_DST));
  1435. if (!dst_ring_desc) {
  1436. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1437. "%s: Memory alloc failed !", __func__);
  1438. QDF_ASSERT(0);
  1439. return QDF_STATUS_E_NOMEM;
  1440. }
  1441. qdf_mem_copy(dst_ring_desc, ring_desc,
  1442. hal_srng_get_entrysize(soc->hal_soc, REO_DST));
  1443. txrx_peer->rx_tid[tid].dst_ring_desc = dst_ring_desc;
  1444. txrx_peer->rx_tid[tid].head_frag_desc = rx_desc;
  1445. return QDF_STATUS_SUCCESS;
  1446. }
  1447. /*
  1448. * dp_rx_defrag_store_fragment(): Store incoming fragments
  1449. * @soc: Pointer to the SOC data structure
  1450. * @ring_desc: Pointer to the ring descriptor
  1451. * @mpdu_desc_info: MPDU descriptor info
  1452. * @tid: Traffic Identifier
  1453. * @rx_desc: Pointer to rx descriptor
  1454. * @rx_bfs: Number of bfs consumed
  1455. *
  1456. * Returns: QDF_STATUS
  1457. */
  1458. static QDF_STATUS
  1459. dp_rx_defrag_store_fragment(struct dp_soc *soc,
  1460. hal_ring_desc_t ring_desc,
  1461. union dp_rx_desc_list_elem_t **head,
  1462. union dp_rx_desc_list_elem_t **tail,
  1463. struct hal_rx_mpdu_desc_info *mpdu_desc_info,
  1464. unsigned int tid, struct dp_rx_desc *rx_desc,
  1465. uint32_t *rx_bfs)
  1466. {
  1467. struct dp_rx_reorder_array_elem *rx_reorder_array_elem;
  1468. struct dp_pdev *pdev;
  1469. struct dp_txrx_peer *txrx_peer = NULL;
  1470. dp_txrx_ref_handle txrx_ref_handle = NULL;
  1471. uint16_t peer_id;
  1472. uint8_t fragno, more_frag, all_frag_present = 0;
  1473. uint16_t rxseq = mpdu_desc_info->mpdu_seq;
  1474. QDF_STATUS status;
  1475. struct dp_rx_tid_defrag *rx_tid;
  1476. uint8_t mpdu_sequence_control_valid;
  1477. uint8_t mpdu_frame_control_valid;
  1478. qdf_nbuf_t frag = rx_desc->nbuf;
  1479. uint32_t msdu_len;
  1480. if (qdf_nbuf_len(frag) > 0) {
  1481. dp_info("Dropping unexpected packet with skb_len: %d,"
  1482. "data len: %d, cookie: %d",
  1483. (uint32_t)qdf_nbuf_len(frag), frag->data_len,
  1484. rx_desc->cookie);
  1485. DP_STATS_INC(soc, rx.rx_frag_err_len_error, 1);
  1486. goto discard_frag;
  1487. }
  1488. if (dp_rx_buffer_pool_refill(soc, frag, rx_desc->pool_id)) {
  1489. /* fragment queued back to the pool, free the link desc */
  1490. goto err_free_desc;
  1491. }
  1492. msdu_len = hal_rx_msdu_start_msdu_len_get(soc->hal_soc,
  1493. rx_desc->rx_buf_start);
  1494. qdf_nbuf_set_pktlen(frag, (msdu_len + soc->rx_pkt_tlv_size));
  1495. qdf_nbuf_append_ext_list(frag, NULL, 0);
  1496. /* Check if the packet is from a valid peer */
  1497. peer_id = dp_rx_peer_metadata_peer_id_get(soc,
  1498. mpdu_desc_info->peer_meta_data);
  1499. txrx_peer = dp_txrx_peer_get_ref_by_id(soc, peer_id, &txrx_ref_handle,
  1500. DP_MOD_ID_RX_ERR);
  1501. if (!txrx_peer) {
  1502. /* We should not receive anything from unknown peer
  1503. * however, that might happen while we are in the monitor mode.
  1504. * We don't need to handle that here
  1505. */
  1506. dp_info_rl("Unknown peer with peer_id %d, dropping fragment",
  1507. peer_id);
  1508. DP_STATS_INC(soc, rx.rx_frag_err_no_peer, 1);
  1509. goto discard_frag;
  1510. }
  1511. if (tid >= DP_MAX_TIDS) {
  1512. dp_info("TID out of bounds: %d", tid);
  1513. qdf_assert_always(0);
  1514. goto discard_frag;
  1515. }
  1516. mpdu_sequence_control_valid =
  1517. hal_rx_get_mpdu_sequence_control_valid(soc->hal_soc,
  1518. rx_desc->rx_buf_start);
  1519. /* Invalid MPDU sequence control field, MPDU is of no use */
  1520. if (!mpdu_sequence_control_valid) {
  1521. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1522. "Invalid MPDU seq control field, dropping MPDU");
  1523. qdf_assert(0);
  1524. goto discard_frag;
  1525. }
  1526. mpdu_frame_control_valid =
  1527. hal_rx_get_mpdu_frame_control_valid(soc->hal_soc,
  1528. rx_desc->rx_buf_start);
  1529. /* Invalid frame control field */
  1530. if (!mpdu_frame_control_valid) {
  1531. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1532. "Invalid frame control field, dropping MPDU");
  1533. qdf_assert(0);
  1534. goto discard_frag;
  1535. }
  1536. /* Current mpdu sequence */
  1537. more_frag = dp_rx_frag_get_more_frag_bit(soc, rx_desc->rx_buf_start);
  1538. /* HW does not populate the fragment number as of now
  1539. * need to get from the 802.11 header
  1540. */
  1541. fragno = dp_rx_frag_get_mpdu_frag_number(soc, rx_desc->rx_buf_start);
  1542. pdev = txrx_peer->vdev->pdev;
  1543. rx_tid = &txrx_peer->rx_tid[tid];
  1544. dp_rx_err_send_pktlog(soc, pdev, mpdu_desc_info, frag,
  1545. QDF_TX_RX_STATUS_OK, false);
  1546. qdf_spin_lock_bh(&rx_tid->defrag_tid_lock);
  1547. rx_reorder_array_elem = txrx_peer->rx_tid[tid].array;
  1548. if (!rx_reorder_array_elem) {
  1549. dp_err_rl("Rcvd Fragmented pkt before tid setup for peer %pK",
  1550. txrx_peer);
  1551. qdf_spin_unlock_bh(&rx_tid->defrag_tid_lock);
  1552. goto discard_frag;
  1553. }
  1554. /*
  1555. * !more_frag: no more fragments to be delivered
  1556. * !frag_no: packet is not fragmented
  1557. * !rx_reorder_array_elem->head: no saved fragments so far
  1558. */
  1559. if ((!more_frag) && (!fragno) && (!rx_reorder_array_elem->head)) {
  1560. /* We should not get into this situation here.
  1561. * It means an unfragmented packet with fragment flag
  1562. * is delivered over the REO exception ring.
  1563. * Typically it follows normal rx path.
  1564. */
  1565. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1566. "Rcvd unfragmented pkt on REO Err srng, dropping");
  1567. qdf_spin_unlock_bh(&rx_tid->defrag_tid_lock);
  1568. qdf_assert(0);
  1569. goto discard_frag;
  1570. }
  1571. /* Check if the fragment is for the same sequence or a different one */
  1572. dp_debug("rx_tid %d", tid);
  1573. if (rx_reorder_array_elem->head) {
  1574. dp_debug("rxseq %d\n", rxseq);
  1575. if (rxseq != rx_tid->curr_seq_num) {
  1576. dp_debug("mismatch cur_seq %d rxseq %d\n",
  1577. rx_tid->curr_seq_num, rxseq);
  1578. /* Drop stored fragments if out of sequence
  1579. * fragment is received
  1580. */
  1581. dp_rx_reorder_flush_frag(txrx_peer, tid);
  1582. DP_STATS_INC(soc, rx.rx_frag_oor, 1);
  1583. dp_debug("cur rxseq %d\n", rxseq);
  1584. /*
  1585. * The sequence number for this fragment becomes the
  1586. * new sequence number to be processed
  1587. */
  1588. rx_tid->curr_seq_num = rxseq;
  1589. }
  1590. } else {
  1591. /* Check if we are processing first fragment if it is
  1592. * not first fragment discard fragment.
  1593. */
  1594. if (fragno) {
  1595. qdf_spin_unlock_bh(&rx_tid->defrag_tid_lock);
  1596. goto discard_frag;
  1597. }
  1598. dp_debug("cur rxseq %d\n", rxseq);
  1599. /* Start of a new sequence */
  1600. dp_rx_defrag_cleanup(txrx_peer, tid);
  1601. rx_tid->curr_seq_num = rxseq;
  1602. /* store PN number also */
  1603. }
  1604. /*
  1605. * If the earlier sequence was dropped, this will be the fresh start.
  1606. * Else, continue with next fragment in a given sequence
  1607. */
  1608. status = dp_rx_defrag_fraglist_insert(txrx_peer, tid,
  1609. &rx_reorder_array_elem->head,
  1610. &rx_reorder_array_elem->tail,
  1611. frag, &all_frag_present);
  1612. /*
  1613. * Currently, we can have only 6 MSDUs per-MPDU, if the current
  1614. * packet sequence has more than 6 MSDUs for some reason, we will
  1615. * have to use the next MSDU link descriptor and chain them together
  1616. * before reinjection.
  1617. * ring_desc is validated in dp_rx_err_process.
  1618. */
  1619. if ((fragno == 0) && (status == QDF_STATUS_SUCCESS) &&
  1620. (rx_reorder_array_elem->head == frag)) {
  1621. status = dp_rx_defrag_save_info_from_ring_desc(soc, ring_desc,
  1622. rx_desc,
  1623. txrx_peer, tid);
  1624. if (status != QDF_STATUS_SUCCESS) {
  1625. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1626. "%s: Unable to store ring desc !", __func__);
  1627. qdf_spin_unlock_bh(&rx_tid->defrag_tid_lock);
  1628. goto discard_frag;
  1629. }
  1630. } else {
  1631. dp_rx_add_to_free_desc_list(head, tail, rx_desc);
  1632. (*rx_bfs)++;
  1633. /* Return the non-head link desc */
  1634. if (dp_rx_link_desc_return(soc, ring_desc,
  1635. HAL_BM_ACTION_PUT_IN_IDLE_LIST) !=
  1636. QDF_STATUS_SUCCESS)
  1637. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1638. "%s: Failed to return link desc", __func__);
  1639. }
  1640. if (pdev->soc->rx.flags.defrag_timeout_check)
  1641. dp_rx_defrag_waitlist_remove(txrx_peer, tid);
  1642. /* Yet to receive more fragments for this sequence number */
  1643. if (!all_frag_present) {
  1644. uint32_t now_ms =
  1645. qdf_system_ticks_to_msecs(qdf_system_ticks());
  1646. txrx_peer->rx_tid[tid].defrag_timeout_ms =
  1647. now_ms + pdev->soc->rx.defrag.timeout_ms;
  1648. dp_rx_defrag_waitlist_add(txrx_peer, tid);
  1649. dp_txrx_peer_unref_delete(txrx_ref_handle, DP_MOD_ID_RX_ERR);
  1650. qdf_spin_unlock_bh(&rx_tid->defrag_tid_lock);
  1651. return QDF_STATUS_SUCCESS;
  1652. }
  1653. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_DEBUG,
  1654. "All fragments received for sequence: %d", rxseq);
  1655. /* Process the fragments */
  1656. status = dp_rx_defrag(txrx_peer, tid, rx_reorder_array_elem->head,
  1657. rx_reorder_array_elem->tail);
  1658. if (QDF_IS_STATUS_ERROR(status)) {
  1659. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1660. "Fragment processing failed");
  1661. dp_rx_add_to_free_desc_list(head, tail,
  1662. txrx_peer->rx_tid[tid].head_frag_desc);
  1663. (*rx_bfs)++;
  1664. if (dp_rx_link_desc_return(soc,
  1665. txrx_peer->rx_tid[tid].dst_ring_desc,
  1666. HAL_BM_ACTION_PUT_IN_IDLE_LIST) !=
  1667. QDF_STATUS_SUCCESS)
  1668. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1669. "%s: Failed to return link desc",
  1670. __func__);
  1671. dp_rx_defrag_cleanup(txrx_peer, tid);
  1672. qdf_spin_unlock_bh(&rx_tid->defrag_tid_lock);
  1673. goto end;
  1674. }
  1675. /* Re-inject the fragments back to REO for further processing */
  1676. status = dp_rx_defrag_reo_reinject(txrx_peer, tid,
  1677. rx_reorder_array_elem->head);
  1678. if (QDF_IS_STATUS_SUCCESS(status)) {
  1679. rx_reorder_array_elem->head = NULL;
  1680. rx_reorder_array_elem->tail = NULL;
  1681. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_DEBUG,
  1682. "Fragmented sequence successfully reinjected");
  1683. } else {
  1684. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1685. "Fragmented sequence reinjection failed");
  1686. dp_rx_return_head_frag_desc(txrx_peer, tid);
  1687. }
  1688. dp_rx_defrag_cleanup(txrx_peer, tid);
  1689. qdf_spin_unlock_bh(&rx_tid->defrag_tid_lock);
  1690. dp_txrx_peer_unref_delete(txrx_ref_handle, DP_MOD_ID_RX_ERR);
  1691. return QDF_STATUS_SUCCESS;
  1692. discard_frag:
  1693. dp_rx_nbuf_free(frag);
  1694. err_free_desc:
  1695. dp_rx_add_to_free_desc_list(head, tail, rx_desc);
  1696. if (dp_rx_link_desc_return(soc, ring_desc,
  1697. HAL_BM_ACTION_PUT_IN_IDLE_LIST) !=
  1698. QDF_STATUS_SUCCESS)
  1699. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1700. "%s: Failed to return link desc", __func__);
  1701. (*rx_bfs)++;
  1702. end:
  1703. if (txrx_peer)
  1704. dp_txrx_peer_unref_delete(txrx_ref_handle, DP_MOD_ID_RX_ERR);
  1705. DP_STATS_INC(soc, rx.rx_frag_err, 1);
  1706. return QDF_STATUS_E_DEFRAG_ERROR;
  1707. }
  1708. /**
  1709. * dp_rx_frag_handle() - Handles fragmented Rx frames
  1710. *
  1711. * @soc: core txrx main context
  1712. * @ring_desc: opaque pointer to the REO error ring descriptor
  1713. * @mpdu_desc_info: MPDU descriptor information from ring descriptor
  1714. * @head: head of the local descriptor free-list
  1715. * @tail: tail of the local descriptor free-list
  1716. * @quota: No. of units (packets) that can be serviced in one shot.
  1717. *
  1718. * This function implements RX 802.11 fragmentation handling
  1719. * The handling is mostly same as legacy fragmentation handling.
  1720. * If required, this function can re-inject the frames back to
  1721. * REO ring (with proper setting to by-pass fragmentation check
  1722. * but use duplicate detection / re-ordering and routing these frames
  1723. * to a different core.
  1724. *
  1725. * Return: uint32_t: No. of elements processed
  1726. */
  1727. uint32_t dp_rx_frag_handle(struct dp_soc *soc, hal_ring_desc_t ring_desc,
  1728. struct hal_rx_mpdu_desc_info *mpdu_desc_info,
  1729. struct dp_rx_desc *rx_desc,
  1730. uint8_t *mac_id,
  1731. uint32_t quota)
  1732. {
  1733. uint32_t rx_bufs_used = 0;
  1734. qdf_nbuf_t msdu = NULL;
  1735. uint32_t tid;
  1736. uint32_t rx_bfs = 0;
  1737. struct dp_pdev *pdev;
  1738. QDF_STATUS status = QDF_STATUS_SUCCESS;
  1739. struct rx_desc_pool *rx_desc_pool;
  1740. qdf_assert(soc);
  1741. qdf_assert(mpdu_desc_info);
  1742. qdf_assert(rx_desc);
  1743. dp_debug("Number of MSDUs to process, num_msdus: %d",
  1744. mpdu_desc_info->msdu_count);
  1745. if (qdf_unlikely(mpdu_desc_info->msdu_count == 0)) {
  1746. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1747. "Not sufficient MSDUs to process");
  1748. return rx_bufs_used;
  1749. }
  1750. /* all buffers in MSDU link belong to same pdev */
  1751. pdev = dp_get_pdev_for_lmac_id(soc, rx_desc->pool_id);
  1752. if (!pdev) {
  1753. dp_nofl_debug("pdev is null for pool_id = %d",
  1754. rx_desc->pool_id);
  1755. return rx_bufs_used;
  1756. }
  1757. *mac_id = rx_desc->pool_id;
  1758. msdu = rx_desc->nbuf;
  1759. rx_desc_pool = &soc->rx_desc_buf[rx_desc->pool_id];
  1760. if (rx_desc->unmapped)
  1761. return rx_bufs_used;
  1762. dp_ipa_rx_buf_smmu_mapping_lock(soc);
  1763. dp_rx_nbuf_unmap_pool(soc, rx_desc_pool, rx_desc->nbuf);
  1764. rx_desc->unmapped = 1;
  1765. dp_ipa_rx_buf_smmu_mapping_unlock(soc);
  1766. rx_desc->rx_buf_start = qdf_nbuf_data(msdu);
  1767. tid = hal_rx_mpdu_start_tid_get(soc->hal_soc, rx_desc->rx_buf_start);
  1768. /* Process fragment-by-fragment */
  1769. status = dp_rx_defrag_store_fragment(soc, ring_desc,
  1770. &pdev->free_list_head,
  1771. &pdev->free_list_tail,
  1772. mpdu_desc_info,
  1773. tid, rx_desc, &rx_bfs);
  1774. if (rx_bfs)
  1775. rx_bufs_used += rx_bfs;
  1776. if (!QDF_IS_STATUS_SUCCESS(status))
  1777. dp_info_rl("Rx Defrag err seq#:0x%x msdu_count:%d flags:%d",
  1778. mpdu_desc_info->mpdu_seq,
  1779. mpdu_desc_info->msdu_count,
  1780. mpdu_desc_info->mpdu_flags);
  1781. return rx_bufs_used;
  1782. }
  1783. QDF_STATUS dp_rx_defrag_add_last_frag(struct dp_soc *soc,
  1784. struct dp_txrx_peer *txrx_peer,
  1785. uint16_t tid,
  1786. uint16_t rxseq, qdf_nbuf_t nbuf)
  1787. {
  1788. struct dp_rx_tid_defrag *rx_tid = &txrx_peer->rx_tid[tid];
  1789. struct dp_rx_reorder_array_elem *rx_reorder_array_elem;
  1790. uint8_t all_frag_present;
  1791. uint32_t msdu_len;
  1792. QDF_STATUS status;
  1793. rx_reorder_array_elem = txrx_peer->rx_tid[tid].array;
  1794. /*
  1795. * HW may fill in unexpected peer_id in RX PKT TLV,
  1796. * if this peer_id related peer is valid by coincidence,
  1797. * but actually this peer won't do dp_peer_rx_init(like SAP vdev
  1798. * self peer), then invalid access to rx_reorder_array_elem happened.
  1799. */
  1800. if (!rx_reorder_array_elem) {
  1801. dp_verbose_debug(
  1802. "peer id:%d drop rx frame!",
  1803. txrx_peer->peer_id);
  1804. DP_STATS_INC(soc, rx.err.defrag_peer_uninit, 1);
  1805. dp_rx_nbuf_free(nbuf);
  1806. goto fail;
  1807. }
  1808. if (rx_reorder_array_elem->head &&
  1809. rxseq != rx_tid->curr_seq_num) {
  1810. /* Drop stored fragments if out of sequence
  1811. * fragment is received
  1812. */
  1813. dp_rx_reorder_flush_frag(txrx_peer, tid);
  1814. QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
  1815. "%s: No list found for TID %d Seq# %d",
  1816. __func__, tid, rxseq);
  1817. dp_rx_nbuf_free(nbuf);
  1818. goto fail;
  1819. }
  1820. msdu_len = hal_rx_msdu_start_msdu_len_get(soc->hal_soc,
  1821. qdf_nbuf_data(nbuf));
  1822. qdf_nbuf_set_pktlen(nbuf, (msdu_len + soc->rx_pkt_tlv_size));
  1823. status = dp_rx_defrag_fraglist_insert(txrx_peer, tid,
  1824. &rx_reorder_array_elem->head,
  1825. &rx_reorder_array_elem->tail, nbuf,
  1826. &all_frag_present);
  1827. if (QDF_IS_STATUS_ERROR(status)) {
  1828. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1829. "%s Fragment insert failed", __func__);
  1830. goto fail;
  1831. }
  1832. if (soc->rx.flags.defrag_timeout_check)
  1833. dp_rx_defrag_waitlist_remove(txrx_peer, tid);
  1834. if (!all_frag_present) {
  1835. uint32_t now_ms =
  1836. qdf_system_ticks_to_msecs(qdf_system_ticks());
  1837. txrx_peer->rx_tid[tid].defrag_timeout_ms =
  1838. now_ms + soc->rx.defrag.timeout_ms;
  1839. dp_rx_defrag_waitlist_add(txrx_peer, tid);
  1840. return QDF_STATUS_SUCCESS;
  1841. }
  1842. status = dp_rx_defrag(txrx_peer, tid, rx_reorder_array_elem->head,
  1843. rx_reorder_array_elem->tail);
  1844. if (QDF_IS_STATUS_ERROR(status)) {
  1845. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1846. "%s Fragment processing failed", __func__);
  1847. dp_rx_return_head_frag_desc(txrx_peer, tid);
  1848. dp_rx_defrag_cleanup(txrx_peer, tid);
  1849. goto fail;
  1850. }
  1851. /* Re-inject the fragments back to REO for further processing */
  1852. status = dp_rx_defrag_reo_reinject(txrx_peer, tid,
  1853. rx_reorder_array_elem->head);
  1854. if (QDF_IS_STATUS_SUCCESS(status)) {
  1855. rx_reorder_array_elem->head = NULL;
  1856. rx_reorder_array_elem->tail = NULL;
  1857. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_INFO,
  1858. "%s: Frag seq successfully reinjected",
  1859. __func__);
  1860. } else {
  1861. QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
  1862. "%s: Frag seq reinjection failed", __func__);
  1863. dp_rx_return_head_frag_desc(txrx_peer, tid);
  1864. }
  1865. dp_rx_defrag_cleanup(txrx_peer, tid);
  1866. return QDF_STATUS_SUCCESS;
  1867. fail:
  1868. return QDF_STATUS_E_DEFRAG_ERROR;
  1869. }