OMAPDSS: VENC: fix NULL pointer dereference in DSS2 VENC sysfs debug attr on OMAP4
[zen-stable.git] / drivers / net / wireless / wl12xx / rx.c
blob4fbd2a722ffabf28eb4f3c383490b2060c1535dc
1 /*
2 * This file is part of wl1271
4 * Copyright (C) 2009 Nokia Corporation
6 * Contact: Luciano Coelho <luciano.coelho@nokia.com>
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * version 2 as published by the Free Software Foundation.
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
20 * 02110-1301 USA
24 #include <linux/gfp.h>
25 #include <linux/sched.h>
27 #include "wl12xx.h"
28 #include "debug.h"
29 #include "acx.h"
30 #include "reg.h"
31 #include "rx.h"
32 #include "tx.h"
33 #include "io.h"
35 static u8 wl12xx_rx_get_mem_block(struct wl12xx_fw_status *status,
36 u32 drv_rx_counter)
38 return le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
39 RX_MEM_BLOCK_MASK;
42 static u32 wl12xx_rx_get_buf_size(struct wl12xx_fw_status *status,
43 u32 drv_rx_counter)
45 return (le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
46 RX_BUF_SIZE_MASK) >> RX_BUF_SIZE_SHIFT_DIV;
49 static bool wl12xx_rx_get_unaligned(struct wl12xx_fw_status *status,
50 u32 drv_rx_counter)
52 /* Convert the value to bool */
53 return !!(le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
54 RX_BUF_UNALIGNED_PAYLOAD);
57 static void wl1271_rx_status(struct wl1271 *wl,
58 struct wl1271_rx_descriptor *desc,
59 struct ieee80211_rx_status *status,
60 u8 beacon)
62 memset(status, 0, sizeof(struct ieee80211_rx_status));
64 if ((desc->flags & WL1271_RX_DESC_BAND_MASK) == WL1271_RX_DESC_BAND_BG)
65 status->band = IEEE80211_BAND_2GHZ;
66 else
67 status->band = IEEE80211_BAND_5GHZ;
69 status->rate_idx = wl1271_rate_to_idx(desc->rate, status->band);
71 /* 11n support */
72 if (desc->rate <= CONF_HW_RXTX_RATE_MCS0)
73 status->flag |= RX_FLAG_HT;
75 status->signal = desc->rssi;
78 * FIXME: In wl1251, the SNR should be divided by two. In wl1271 we
79 * need to divide by two for now, but TI has been discussing about
80 * changing it. This needs to be rechecked.
82 wl->noise = desc->rssi - (desc->snr >> 1);
84 status->freq = ieee80211_channel_to_frequency(desc->channel,
85 status->band);
87 if (desc->flags & WL1271_RX_DESC_ENCRYPT_MASK) {
88 u8 desc_err_code = desc->status & WL1271_RX_DESC_STATUS_MASK;
90 status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED |
91 RX_FLAG_DECRYPTED;
93 if (unlikely(desc_err_code == WL1271_RX_DESC_MIC_FAIL)) {
94 status->flag |= RX_FLAG_MMIC_ERROR;
95 wl1271_warning("Michael MIC error");
100 static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
101 bool unaligned, u8 *hlid)
103 struct wl1271_rx_descriptor *desc;
104 struct sk_buff *skb;
105 struct ieee80211_hdr *hdr;
106 u8 *buf;
107 u8 beacon = 0;
108 u8 is_data = 0;
109 u8 reserved = unaligned ? NET_IP_ALIGN : 0;
110 u16 seq_num;
113 * In PLT mode we seem to get frames and mac80211 warns about them,
114 * workaround this by not retrieving them at all.
116 if (unlikely(wl->state == WL1271_STATE_PLT))
117 return -EINVAL;
119 /* the data read starts with the descriptor */
120 desc = (struct wl1271_rx_descriptor *) data;
122 if (desc->packet_class == WL12XX_RX_CLASS_LOGGER) {
123 size_t len = length - sizeof(*desc);
124 wl12xx_copy_fwlog(wl, data + sizeof(*desc), len);
125 wake_up_interruptible(&wl->fwlog_waitq);
126 return 0;
129 switch (desc->status & WL1271_RX_DESC_STATUS_MASK) {
130 /* discard corrupted packets */
131 case WL1271_RX_DESC_DRIVER_RX_Q_FAIL:
132 case WL1271_RX_DESC_DECRYPT_FAIL:
133 wl1271_warning("corrupted packet in RX with status: 0x%x",
134 desc->status & WL1271_RX_DESC_STATUS_MASK);
135 return -EINVAL;
136 case WL1271_RX_DESC_SUCCESS:
137 case WL1271_RX_DESC_MIC_FAIL:
138 break;
139 default:
140 wl1271_error("invalid RX descriptor status: 0x%x",
141 desc->status & WL1271_RX_DESC_STATUS_MASK);
142 return -EINVAL;
145 /* skb length not included rx descriptor */
146 skb = __dev_alloc_skb(length + reserved - sizeof(*desc), GFP_KERNEL);
147 if (!skb) {
148 wl1271_error("Couldn't allocate RX frame");
149 return -ENOMEM;
152 /* reserve the unaligned payload(if any) */
153 skb_reserve(skb, reserved);
155 buf = skb_put(skb, length - sizeof(*desc));
158 * Copy packets from aggregation buffer to the skbs without rx
159 * descriptor and with packet payload aligned care. In case of unaligned
160 * packets copy the packets in offset of 2 bytes guarantee IP header
161 * payload aligned to 4 bytes.
163 memcpy(buf, data + sizeof(*desc), length - sizeof(*desc));
164 *hlid = desc->hlid;
166 hdr = (struct ieee80211_hdr *)skb->data;
167 if (ieee80211_is_beacon(hdr->frame_control))
168 beacon = 1;
169 if (ieee80211_is_data_present(hdr->frame_control))
170 is_data = 1;
172 wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon);
174 seq_num = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
175 wl1271_debug(DEBUG_RX, "rx skb 0x%p: %d B %s seq %d hlid %d", skb,
176 skb->len - desc->pad_len,
177 beacon ? "beacon" : "",
178 seq_num, *hlid);
180 skb_trim(skb, skb->len - desc->pad_len);
182 skb_queue_tail(&wl->deferred_rx_queue, skb);
183 queue_work(wl->freezable_wq, &wl->netstack_work);
185 return is_data;
188 void wl12xx_rx(struct wl1271 *wl, struct wl12xx_fw_status *status)
190 struct wl1271_acx_mem_map *wl_mem_map = wl->target_mem_map;
191 unsigned long active_hlids[BITS_TO_LONGS(WL12XX_MAX_LINKS)] = {0};
192 u32 buf_size;
193 u32 fw_rx_counter = status->fw_rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
194 u32 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
195 u32 rx_counter;
196 u32 mem_block;
197 u32 pkt_length;
198 u32 pkt_offset;
199 u8 hlid;
200 bool unaligned = false;
202 while (drv_rx_counter != fw_rx_counter) {
203 buf_size = 0;
204 rx_counter = drv_rx_counter;
205 while (rx_counter != fw_rx_counter) {
206 pkt_length = wl12xx_rx_get_buf_size(status, rx_counter);
207 if (buf_size + pkt_length > WL1271_AGGR_BUFFER_SIZE)
208 break;
209 buf_size += pkt_length;
210 rx_counter++;
211 rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
214 if (buf_size == 0) {
215 wl1271_warning("received empty data");
216 break;
219 if (wl->chip.id != CHIP_ID_1283_PG20) {
221 * Choose the block we want to read
222 * For aggregated packets, only the first memory block
223 * should be retrieved. The FW takes care of the rest.
225 mem_block = wl12xx_rx_get_mem_block(status,
226 drv_rx_counter);
228 wl->rx_mem_pool_addr.addr = (mem_block << 8) +
229 le32_to_cpu(wl_mem_map->packet_memory_pool_start);
231 wl->rx_mem_pool_addr.addr_extra =
232 wl->rx_mem_pool_addr.addr + 4;
234 wl1271_write(wl, WL1271_SLV_REG_DATA,
235 &wl->rx_mem_pool_addr,
236 sizeof(wl->rx_mem_pool_addr), false);
239 /* Read all available packets at once */
240 wl1271_read(wl, WL1271_SLV_MEM_DATA, wl->aggr_buf,
241 buf_size, true);
243 /* Split data into separate packets */
244 pkt_offset = 0;
245 while (pkt_offset < buf_size) {
246 pkt_length = wl12xx_rx_get_buf_size(status,
247 drv_rx_counter);
249 unaligned = wl12xx_rx_get_unaligned(status,
250 drv_rx_counter);
253 * the handle data call can only fail in memory-outage
254 * conditions, in that case the received frame will just
255 * be dropped.
257 if (wl1271_rx_handle_data(wl,
258 wl->aggr_buf + pkt_offset,
259 pkt_length, unaligned,
260 &hlid) == 1) {
261 if (hlid < WL12XX_MAX_LINKS)
262 __set_bit(hlid, active_hlids);
263 else
264 WARN(1,
265 "hlid exceeded WL12XX_MAX_LINKS "
266 "(%d)\n", hlid);
269 wl->rx_counter++;
270 drv_rx_counter++;
271 drv_rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
272 pkt_offset += pkt_length;
277 * Write the driver's packet counter to the FW. This is only required
278 * for older hardware revisions
280 if (wl->quirks & WL12XX_QUIRK_END_OF_TRANSACTION)
281 wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
283 wl12xx_rearm_rx_streaming(wl, active_hlids);