drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c

   1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
   2 /*
   3  * Copyright (C) 2012-2014, 2018-2024 Intel Corporation
   4  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
   5  * Copyright (C) 2015-2017 Intel Deutschland GmbH
   6  */
   7 #include <linux/etherdevice.h>
   8 #include <linux/skbuff.h>
   9 #include "iwl-trans.h"
  10 #include "mvm.h"
  11 #include "fw-api.h"
  12 #include "time-sync.h"
  13
  14 static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
  15                                    int queue, struct ieee80211_sta *sta)
  16 {
  17         struct iwl_mvm_sta *mvmsta;
  18         struct ieee80211_hdr *hdr = (void *)skb_mac_header(skb);
  19         struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
  20         struct iwl_mvm_key_pn *ptk_pn;
  21         int res;
  22         u8 tid, keyidx;
  23         u8 pn[IEEE80211_CCMP_PN_LEN];
  24         u8 *extiv;
  25
  26         /* do PN checking */
  27
  28         /* multicast and non-data only arrives on default queue */
  29         if (!ieee80211_is_data(hdr->frame_control) ||
  30             is_multicast_ether_addr(hdr->addr1))
  31                 return 0;
  32
  33         /* do not check PN for open AP */
  34         if (!(stats->flag & RX_FLAG_DECRYPTED))
  35                 return 0;
  36
  37         /*
  38          * avoid checking for default queue - we don't want to replicate
  39          * all the logic that's necessary for checking the PN on fragmented
  40          * frames, leave that to mac80211
  41          */
  42         if (queue == 0)
  43                 return 0;
  44
  45         /* if we are here - this for sure is either CCMP or GCMP */
  46         if (IS_ERR_OR_NULL(sta)) {
  47                 IWL_DEBUG_DROP(mvm,
  48                                "expected hw-decrypted unicast frame for station\n");
  49                 return -1;
  50         }
  51
  52         mvmsta = iwl_mvm_sta_from_mac80211(sta);
  53
  54         extiv = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
  55         keyidx = extiv[3] >> 6;
  56
  57         ptk_pn = rcu_dereference(mvmsta->ptk_pn[keyidx]);
  58         if (!ptk_pn)
  59                 return -1;
  60
  61         if (ieee80211_is_data_qos(hdr->frame_control))
  62                 tid = ieee80211_get_tid(hdr);
  63         else
  64                 tid = 0;
  65
  66         /* we don't use HCCA/802.11 QoS TSPECs, so drop such frames */
  67         if (tid >= IWL_MAX_TID_COUNT)
  68                 return -1;
  69
  70         /* load pn */
  71         pn[0] = extiv[7];
  72         pn[1] = extiv[6];
  73         pn[2] = extiv[5];
  74         pn[3] = extiv[4];
  75         pn[4] = extiv[1];
  76         pn[5] = extiv[0];
  77
  78         res = memcmp(pn, ptk_pn->q[queue].pn[tid], IEEE80211_CCMP_PN_LEN);
  79         if (res < 0)
  80                 return -1;
  81         if (!res && !(stats->flag & RX_FLAG_ALLOW_SAME_PN))
  82                 return -1;
  83
  84         memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
  85         stats->flag |= RX_FLAG_PN_VALIDATED;
  86
  87         return 0;
  88 }
  89
  90 /* iwl_mvm_create_skb Adds the rxb to a new skb */
  91 static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
  92                               struct ieee80211_hdr *hdr, u16 len, u8 crypt_len,
  93                               struct iwl_rx_cmd_buffer *rxb)
  94 {
  95         struct iwl_rx_packet *pkt = rxb_addr(rxb);
  96         struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
  97         unsigned int headlen, fraglen, pad_len = 0;
  98         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
  99         u8 mic_crc_len = u8_get_bits(desc->mac_flags1,
 100                                      IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK) << 1;
 101
 102         if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) {
 103                 len -= 2;
 104                 pad_len = 2;
 105         }
 106
 107         /*
 108          * For non monitor interface strip the bytes the RADA might not have
 109          * removed (it might be disabled, e.g. for mgmt frames). As a monitor
 110          * interface cannot exist with other interfaces, this removal is safe
 111          * and sufficient, in monitor mode there's no decryption being done.
 112          */
 113         if (len > mic_crc_len && !ieee80211_hw_check(mvm->hw, RX_INCLUDES_FCS))
 114                 len -= mic_crc_len;
 115
 116         /* If frame is small enough to fit in skb->head, pull it completely.
 117          * If not, only pull ieee80211_hdr (including crypto if present, and
 118          * an additional 8 bytes for SNAP/ethertype, see below) so that
 119          * splice() or TCP coalesce are more efficient.
 120          *
 121          * Since, in addition, ieee80211_data_to_8023() always pull in at
 122          * least 8 bytes (possibly more for mesh) we can do the same here
 123          * to save the cost of doing it later. That still doesn't pull in
 124          * the actual IP header since the typical case has a SNAP header.
 125          * If the latter changes (there are efforts in the standards group
 126          * to do so) we should revisit this and ieee80211_data_to_8023().
 127          */
 128         headlen = (len <= skb_tailroom(skb)) ? len :
 129                                                hdrlen + crypt_len + 8;
 130
 131         /* The firmware may align the packet to DWORD.
 132          * The padding is inserted after the IV.
 133          * After copying the header + IV skip the padding if
 134          * present before copying packet data.
 135          */
 136         hdrlen += crypt_len;
 137
 138         if (unlikely(headlen < hdrlen))
 139                 return -EINVAL;
 140
 141         /* Since data doesn't move data while putting data on skb and that is
 142          * the only way we use, data + len is the next place that hdr would be put
 143          */
 144         skb_set_mac_header(skb, skb->len);
 145         skb_put_data(skb, hdr, hdrlen);
 146         skb_put_data(skb, (u8 *)hdr + hdrlen + pad_len, headlen - hdrlen);
 147
 148         /*
 149          * If we did CHECKSUM_COMPLETE, the hardware only does it right for
 150          * certain cases and starts the checksum after the SNAP. Check if
 151          * this is the case - it's easier to just bail out to CHECKSUM_NONE
 152          * in the cases the hardware didn't handle, since it's rare to see
 153          * such packets, even though the hardware did calculate the checksum
 154          * in this case, just starting after the MAC header instead.
 155          *
 156          * Starting from Bz hardware, it calculates starting directly after
 157          * the MAC header, so that matches mac80211's expectation.
 158          */
 159         if (skb->ip_summed == CHECKSUM_COMPLETE) {
 160                 struct {
 161                         u8 hdr[6];
 162                         __be16 type;
 163                 } __packed *shdr = (void *)((u8 *)hdr + hdrlen + pad_len);
 164
 165                 if (unlikely(headlen - hdrlen < sizeof(*shdr) ||
 166                              !ether_addr_equal(shdr->hdr, rfc1042_header) ||
 167                              (shdr->type != htons(ETH_P_IP) &&
 168                               shdr->type != htons(ETH_P_ARP) &&
 169                               shdr->type != htons(ETH_P_IPV6) &&
 170                               shdr->type != htons(ETH_P_8021Q) &&
 171                               shdr->type != htons(ETH_P_PAE) &&
 172                               shdr->type != htons(ETH_P_TDLS))))
 173                         skb->ip_summed = CHECKSUM_NONE;
 174                 else if (mvm->trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_BZ)
 175                         /* mac80211 assumes full CSUM including SNAP header */
 176                         skb_postpush_rcsum(skb, shdr, sizeof(*shdr));
 177         }
 178
 179         fraglen = len - headlen;
 180
 181         if (fraglen) {
 182                 int offset = (u8 *)hdr + headlen + pad_len -
 183                              (u8 *)rxb_addr(rxb) + rxb_offset(rxb);
 184
 185                 skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
 186                                 fraglen, rxb->truesize);
 187         }
 188
 189         return 0;
 190 }
 191
 192 /* put a TLV on the skb and return data pointer
 193  *
 194  * Also pad to 4 the len and zero out all data part
 195  */
 196 static void *
 197 iwl_mvm_radiotap_put_tlv(struct sk_buff *skb, u16 type, u16 len)
 198 {
 199         struct ieee80211_radiotap_tlv *tlv;
 200
 201         tlv = skb_put(skb, sizeof(*tlv));
 202         tlv->type = cpu_to_le16(type);
 203         tlv->len = cpu_to_le16(len);
 204         return skb_put_zero(skb, ALIGN(len, 4));
 205 }
 206
 207 static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
 208                                             struct sk_buff *skb)
 209 {
 210         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
 211         struct ieee80211_radiotap_vendor_content *radiotap;
 212         const u16 vendor_data_len = sizeof(mvm->cur_aid);
 213
 214         if (!mvm->cur_aid)
 215                 return;
 216
 217         radiotap = iwl_mvm_radiotap_put_tlv(skb,
 218                                             IEEE80211_RADIOTAP_VENDOR_NAMESPACE,
 219                                             sizeof(*radiotap) + vendor_data_len);
 220
 221         /* Intel OUI */
 222         radiotap->oui[0] = 0xf6;
 223         radiotap->oui[1] = 0x54;
 224         radiotap->oui[2] = 0x25;
 225         /* radiotap sniffer config sub-namespace */
 226         radiotap->oui_subtype = 1;
 227         radiotap->vendor_type = 0;
 228
 229         /* fill the data now */
 230         memcpy(radiotap->data, &mvm->cur_aid, sizeof(mvm->cur_aid));
 231
 232         rx_status->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
 233 }
 234
 235 /* iwl_mvm_pass_packet_to_mac80211 - passes the packet for mac80211 */
 236 static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
 237                                             struct napi_struct *napi,
 238                                             struct sk_buff *skb, int queue,
 239                                             struct ieee80211_sta *sta,
 240                                             struct ieee80211_link_sta *link_sta)
 241 {
 242         if (unlikely(iwl_mvm_check_pn(mvm, skb, queue, sta))) {
 243                 kfree_skb(skb);
 244                 return;
 245         }
 246
 247         if (sta && sta->valid_links && link_sta) {
 248                 struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
 249
 250                 rx_status->link_valid = 1;
 251                 rx_status->link_id = link_sta->link_id;
 252         }
 253
 254         ieee80211_rx_napi(mvm->hw, sta, skb, napi);
 255 }
 256
 257 static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
 258                                         struct ieee80211_rx_status *rx_status,
 259                                         u32 rate_n_flags, int energy_a,
 260                                         int energy_b)
 261 {
 262         int max_energy;
 263         u32 rate_flags = rate_n_flags;
 264
 265         energy_a = energy_a ? -energy_a : S8_MIN;
 266         energy_b = energy_b ? -energy_b : S8_MIN;
 267         max_energy = max(energy_a, energy_b);
 268
 269         IWL_DEBUG_STATS(mvm, "energy In A %d B %d, and max %d\n",
 270                         energy_a, energy_b, max_energy);
 271
 272         rx_status->signal = max_energy;
 273         rx_status->chains =
 274                 (rate_flags & RATE_MCS_ANT_AB_MSK) >> RATE_MCS_ANT_POS;
 275         rx_status->chain_signal[0] = energy_a;
 276         rx_status->chain_signal[1] = energy_b;
 277 }
 278
 279 static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
 280                                 struct ieee80211_hdr *hdr,
 281                                 struct iwl_rx_mpdu_desc *desc,
 282                                 u32 status,
 283                                 struct ieee80211_rx_status *stats)
 284 {
 285         struct wireless_dev *wdev;
 286         struct iwl_mvm_sta *mvmsta;
 287         struct iwl_mvm_vif *mvmvif;
 288         u8 keyid;
 289         struct ieee80211_key_conf *key;
 290         u32 len = le16_to_cpu(desc->mpdu_len);
 291         const u8 *frame = (void *)hdr;
 292
 293         if ((status & IWL_RX_MPDU_STATUS_SEC_MASK) == IWL_RX_MPDU_STATUS_SEC_NONE)
 294                 return 0;
 295
 296         /*
 297          * For non-beacon, we don't really care. But beacons may
 298          * be filtered out, and we thus need the firmware's replay
 299          * detection, otherwise beacons the firmware previously
 300          * filtered could be replayed, or something like that, and
 301          * it can filter a lot - though usually only if nothing has
 302          * changed.
 303          */
 304         if (!ieee80211_is_beacon(hdr->frame_control))
 305                 return 0;
 306
 307         if (!sta)
 308                 return -1;
 309
 310         mvmsta = iwl_mvm_sta_from_mac80211(sta);
 311         mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
 312
 313         /* key mismatch - will also report !MIC_OK but we shouldn't count it */
 314         if (!(status & IWL_RX_MPDU_STATUS_KEY_VALID))
 315                 goto report;
 316
 317         /* good cases */
 318         if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK &&
 319                    !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR))) {
 320                 stats->flag |= RX_FLAG_DECRYPTED;
 321                 return 0;
 322         }
 323
 324         /*
 325          * both keys will have the same cipher and MIC length, use
 326          * whichever one is available
 327          */
 328         key = rcu_dereference(mvmvif->bcn_prot.keys[0]);
 329         if (!key) {
 330                 key = rcu_dereference(mvmvif->bcn_prot.keys[1]);
 331                 if (!key)
 332                         goto report;
 333         }
 334
 335         if (len < key->icv_len + IEEE80211_GMAC_PN_LEN + 2)
 336                 goto report;
 337
 338         /* get the real key ID */
 339         keyid = frame[len - key->icv_len - IEEE80211_GMAC_PN_LEN - 2];
 340         /* and if that's the other key, look it up */
 341         if (keyid != key->keyidx) {
 342                 /*
 343                  * shouldn't happen since firmware checked, but be safe
 344                  * in case the MIC length is wrong too, for example
 345                  */
 346                 if (keyid != 6 && keyid != 7)
 347                         return -1;
 348                 key = rcu_dereference(mvmvif->bcn_prot.keys[keyid - 6]);
 349                 if (!key)
 350                         goto report;
 351         }
 352
 353         /* Report status to mac80211 */
 354         if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
 355                 ieee80211_key_mic_failure(key);
 356         else if (status & IWL_RX_MPDU_STATUS_REPLAY_ERROR)
 357                 ieee80211_key_replay(key);
 358 report:
 359         wdev = ieee80211_vif_to_wdev(mvmsta->vif);
 360         if (wdev->netdev)
 361                 cfg80211_rx_unprot_mlme_mgmt(wdev->netdev, (void *)hdr, len);
 362
 363         return -1;
 364 }
 365
 366 static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 367                              struct ieee80211_hdr *hdr,
 368                              struct ieee80211_rx_status *stats, u16 phy_info,
 369                              struct iwl_rx_mpdu_desc *desc,
 370                              u32 pkt_flags, int queue, u8 *crypt_len)
 371 {
 372         u32 status = le32_to_cpu(desc->status);
 373
 374         /*
 375          * Drop UNKNOWN frames in aggregation, unless in monitor mode
 376          * (where we don't have the keys).
 377          * We limit this to aggregation because in TKIP this is a valid
 378          * scenario, since we may not have the (correct) TTAK (phase 1
 379          * key) in the firmware.
 380          */
 381         if (phy_info & IWL_RX_MPDU_PHY_AMPDU &&
 382             (status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
 383             IWL_RX_MPDU_STATUS_SEC_UNKNOWN && !mvm->monitor_on) {
 384                 IWL_DEBUG_DROP(mvm, "Dropping packets, bad enc status\n");
 385                 return -1;
 386         }
 387
 388         if (unlikely(ieee80211_is_mgmt(hdr->frame_control) &&
 389                      !ieee80211_has_protected(hdr->frame_control)))
 390                 return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status, stats);
 391
 392         if (!ieee80211_has_protected(hdr->frame_control) ||
 393             (status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
 394             IWL_RX_MPDU_STATUS_SEC_NONE)
 395                 return 0;
 396
 397         /* TODO: handle packets encrypted with unknown alg */
 398
 399         switch (status & IWL_RX_MPDU_STATUS_SEC_MASK) {
 400         case IWL_RX_MPDU_STATUS_SEC_CCM:
 401         case IWL_RX_MPDU_STATUS_SEC_GCM:
 402                 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != IEEE80211_GCMP_PN_LEN);
 403                 /* alg is CCM: check MIC only */
 404                 if (!(status & IWL_RX_MPDU_STATUS_MIC_OK)) {
 405                         IWL_DEBUG_DROP(mvm,
 406                                        "Dropping packet, bad MIC (CCM/GCM)\n");
 407                         return -1;
 408                 }
 409
 410                 stats->flag |= RX_FLAG_DECRYPTED | RX_FLAG_MIC_STRIPPED;
 411                 *crypt_len = IEEE80211_CCMP_HDR_LEN;
 412                 return 0;
 413         case IWL_RX_MPDU_STATUS_SEC_TKIP:
 414                 /* Don't drop the frame and decrypt it in SW */
 415                 if (!fw_has_api(&mvm->fw->ucode_capa,
 416                                 IWL_UCODE_TLV_API_DEPRECATE_TTAK) &&
 417                     !(status & IWL_RX_MPDU_RES_STATUS_TTAK_OK))
 418                         return 0;
 419
 420                 if (mvm->trans->trans_cfg->gen2 &&
 421                     !(status & RX_MPDU_RES_STATUS_MIC_OK))
 422                         stats->flag |= RX_FLAG_MMIC_ERROR;
 423
 424                 *crypt_len = IEEE80211_TKIP_IV_LEN;
 425                 fallthrough;
 426         case IWL_RX_MPDU_STATUS_SEC_WEP:
 427                 if (!(status & IWL_RX_MPDU_STATUS_ICV_OK))
 428                         return -1;
 429
 430                 stats->flag |= RX_FLAG_DECRYPTED;
 431                 if ((status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
 432                                 IWL_RX_MPDU_STATUS_SEC_WEP)
 433                         *crypt_len = IEEE80211_WEP_IV_LEN;
 434
 435                 if (pkt_flags & FH_RSCSR_RADA_EN) {
 436                         stats->flag |= RX_FLAG_ICV_STRIPPED;
 437                         if (mvm->trans->trans_cfg->gen2)
 438                                 stats->flag |= RX_FLAG_MMIC_STRIPPED;
 439                 }
 440
 441                 return 0;
 442         case IWL_RX_MPDU_STATUS_SEC_EXT_ENC:
 443                 if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
 444                         return -1;
 445                 stats->flag |= RX_FLAG_DECRYPTED;
 446                 return 0;
 447         case RX_MPDU_RES_STATUS_SEC_CMAC_GMAC_ENC:
 448                 break;
 449         default:
 450                 /*
 451                  * Sometimes we can get frames that were not decrypted
 452                  * because the firmware didn't have the keys yet. This can
 453                  * happen after connection where we can get multicast frames
 454                  * before the GTK is installed.
 455                  * Silently drop those frames.
 456                  * Also drop un-decrypted frames in monitor mode.
 457                  */
 458                 if (!is_multicast_ether_addr(hdr->addr1) &&
 459                     !mvm->monitor_on && net_ratelimit())
 460                         IWL_WARN(mvm, "Unhandled alg: 0x%x\n", status);
 461         }
 462
 463         return 0;
 464 }
 465
 466 static void iwl_mvm_rx_csum(struct iwl_mvm *mvm,
 467                             struct ieee80211_sta *sta,
 468                             struct sk_buff *skb,
 469                             struct iwl_rx_packet *pkt)
 470 {
 471         struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
 472
 473         if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210) {
 474                 if (pkt->len_n_flags & cpu_to_le32(FH_RSCSR_RPA_EN)) {
 475                         u16 hwsum = be16_to_cpu(desc->v3.raw_xsum);
 476
 477                         skb->ip_summed = CHECKSUM_COMPLETE;
 478                         skb->csum = csum_unfold(~(__force __sum16)hwsum);
 479                 }
 480         } else {
 481                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 482                 struct iwl_mvm_vif *mvmvif;
 483                 u16 flags = le16_to_cpu(desc->l3l4_flags);
 484                 u8 l3_prot = (u8)((flags & IWL_RX_L3L4_L3_PROTO_MASK) >>
 485                                   IWL_RX_L3_PROTO_POS);
 486
 487                 mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
 488
 489                 if (mvmvif->features & NETIF_F_RXCSUM &&
 490                     flags & IWL_RX_L3L4_TCP_UDP_CSUM_OK &&
 491                     (flags & IWL_RX_L3L4_IP_HDR_CSUM_OK ||
 492                      l3_prot == IWL_RX_L3_TYPE_IPV6 ||
 493                      l3_prot == IWL_RX_L3_TYPE_IPV6_FRAG))
 494                         skb->ip_summed = CHECKSUM_UNNECESSARY;
 495         }
 496 }
 497
 498 /*
 499  * returns true if a packet is a duplicate or invalid tid and should be dropped.
 500  * Updates AMSDU PN tracking info
 501  */
 502 static bool iwl_mvm_is_dup(struct ieee80211_sta *sta, int queue,
 503                            struct ieee80211_rx_status *rx_status,
 504                            struct ieee80211_hdr *hdr,
 505                            struct iwl_rx_mpdu_desc *desc)
 506 {
 507         struct iwl_mvm_sta *mvm_sta;
 508         struct iwl_mvm_rxq_dup_data *dup_data;
 509         u8 tid, sub_frame_idx;
 510
 511         if (WARN_ON(IS_ERR_OR_NULL(sta)))
 512                 return false;
 513
 514         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 515
 516         if (WARN_ON_ONCE(!mvm_sta->dup_data))
 517                 return false;
 518
 519         dup_data = &mvm_sta->dup_data[queue];
 520
 521         /*
 522          * Drop duplicate 802.11 retransmissions
 523          * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
 524          */
 525         if (ieee80211_is_ctl(hdr->frame_control) ||
 526             ieee80211_is_any_nullfunc(hdr->frame_control) ||
 527             is_multicast_ether_addr(hdr->addr1))
 528                 return false;
 529
 530         if (ieee80211_is_data_qos(hdr->frame_control)) {
 531                 /* frame has qos control */
 532                 tid = ieee80211_get_tid(hdr);
 533                 if (tid >= IWL_MAX_TID_COUNT)
 534                         return true;
 535         } else {
 536                 tid = IWL_MAX_TID_COUNT;
 537         }
 538
 539         /* If this wasn't a part of an A-MSDU the sub-frame index will be 0 */
 540         sub_frame_idx = desc->amsdu_info &
 541                 IWL_RX_MPDU_AMSDU_SUBFRAME_IDX_MASK;
 542
 543         if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
 544                      dup_data->last_seq[tid] == hdr->seq_ctrl &&
 545                      dup_data->last_sub_frame[tid] >= sub_frame_idx))
 546                 return true;
 547
 548         /* Allow same PN as the first subframe for following sub frames */
 549         if (dup_data->last_seq[tid] == hdr->seq_ctrl &&
 550             sub_frame_idx > dup_data->last_sub_frame[tid] &&
 551             desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU)
 552                 rx_status->flag |= RX_FLAG_ALLOW_SAME_PN;
 553
 554         dup_data->last_seq[tid] = hdr->seq_ctrl;
 555         dup_data->last_sub_frame[tid] = sub_frame_idx;
 556
 557         rx_status->flag |= RX_FLAG_DUP_VALIDATED;
 558
 559         return false;
 560 }
 561
 562 static void iwl_mvm_release_frames(struct iwl_mvm *mvm,
 563                                    struct ieee80211_sta *sta,
 564                                    struct napi_struct *napi,
 565                                    struct iwl_mvm_baid_data *baid_data,
 566                                    struct iwl_mvm_reorder_buffer *reorder_buf,
 567                                    u16 nssn)
 568 {
 569         struct iwl_mvm_reorder_buf_entry *entries =
 570                 &baid_data->entries[reorder_buf->queue *
 571                                     baid_data->entries_per_queue];
 572         u16 ssn = reorder_buf->head_sn;
 573
 574         lockdep_assert_held(&reorder_buf->lock);
 575
 576         while (ieee80211_sn_less(ssn, nssn)) {
 577                 int index = ssn % reorder_buf->buf_size;
 578                 struct sk_buff_head *skb_list = &entries[index].frames;
 579                 struct sk_buff *skb;
 580
 581                 ssn = ieee80211_sn_inc(ssn);
 582
 583                 /*
 584                  * Empty the list. Will have more than one frame for A-MSDU.
 585                  * Empty list is valid as well since nssn indicates frames were
 586                  * received.
 587                  */
 588                 while ((skb = __skb_dequeue(skb_list))) {
 589                         iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb,
 590                                                         reorder_buf->queue,
 591                                                         sta, NULL /* FIXME */);
 592                         reorder_buf->num_stored--;
 593                 }
 594         }
 595         reorder_buf->head_sn = nssn;
 596 }
 597
 598 static void iwl_mvm_del_ba(struct iwl_mvm *mvm, int queue,
 599                            struct iwl_mvm_delba_data *data)
 600 {
 601         struct iwl_mvm_baid_data *ba_data;
 602         struct ieee80211_sta *sta;
 603         struct iwl_mvm_reorder_buffer *reorder_buf;
 604         u8 baid = data->baid;
 605         u32 sta_id;
 606
 607         if (WARN_ONCE(baid >= IWL_MAX_BAID, "invalid BAID: %x\n", baid))
 608                 return;
 609
 610         rcu_read_lock();
 611
 612         ba_data = rcu_dereference(mvm->baid_map[baid]);
 613         if (WARN_ON_ONCE(!ba_data))
 614                 goto out;
 615
 616         /* pick any STA ID to find the pointer */
 617         sta_id = ffs(ba_data->sta_mask) - 1;
 618         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
 619         if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta)))
 620                 goto out;
 621
 622         reorder_buf = &ba_data->reorder_buf[queue];
 623
 624         /* release all frames that are in the reorder buffer to the stack */
 625         spin_lock_bh(&reorder_buf->lock);
 626         iwl_mvm_release_frames(mvm, sta, NULL, ba_data, reorder_buf,
 627                                ieee80211_sn_add(reorder_buf->head_sn,
 628                                                 reorder_buf->buf_size));
 629         spin_unlock_bh(&reorder_buf->lock);
 630
 631 out:
 632         rcu_read_unlock();
 633 }
 634
 635 static void iwl_mvm_release_frames_from_notif(struct iwl_mvm *mvm,
 636                                               struct napi_struct *napi,
 637                                               u8 baid, u16 nssn, int queue)
 638 {
 639         struct ieee80211_sta *sta;
 640         struct iwl_mvm_reorder_buffer *reorder_buf;
 641         struct iwl_mvm_baid_data *ba_data;
 642         u32 sta_id;
 643
 644         IWL_DEBUG_HT(mvm, "Frame release notification for BAID %u, NSSN %d\n",
 645                      baid, nssn);
 646
 647         if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID ||
 648                          baid >= ARRAY_SIZE(mvm->baid_map)))
 649                 return;
 650
 651         rcu_read_lock();
 652
 653         ba_data = rcu_dereference(mvm->baid_map[baid]);
 654         if (WARN(!ba_data, "BAID %d not found in map\n", baid))
 655                 goto out;
 656
 657         /* pick any STA ID to find the pointer */
 658         sta_id = ffs(ba_data->sta_mask) - 1;
 659         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
 660         if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta)))
 661                 goto out;
 662
 663         reorder_buf = &ba_data->reorder_buf[queue];
 664
 665         spin_lock_bh(&reorder_buf->lock);
 666         iwl_mvm_release_frames(mvm, sta, napi, ba_data,
 667                                reorder_buf, nssn);
 668         spin_unlock_bh(&reorder_buf->lock);
 669
 670 out:
 671         rcu_read_unlock();
 672 }
 673
 674 void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct napi_struct *napi,
 675                             struct iwl_rx_cmd_buffer *rxb, int queue)
 676 {
 677         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 678         struct iwl_rxq_sync_notification *notif;
 679         struct iwl_mvm_internal_rxq_notif *internal_notif;
 680         u32 len = iwl_rx_packet_payload_len(pkt);
 681
 682         notif = (void *)pkt->data;
 683         internal_notif = (void *)notif->payload;
 684
 685         if (WARN_ONCE(len < sizeof(*notif) + sizeof(*internal_notif),
 686                       "invalid notification size %d (%d)",
 687                       len, (int)(sizeof(*notif) + sizeof(*internal_notif))))
 688                 return;
 689         len -= sizeof(*notif) + sizeof(*internal_notif);
 690
 691         if (WARN_ONCE(internal_notif->sync &&
 692                       mvm->queue_sync_cookie != internal_notif->cookie,
 693                       "Received expired RX queue sync message (cookie %d but wanted %d, queue %d)\n",
 694                       internal_notif->cookie, mvm->queue_sync_cookie, queue))
 695                 return;
 696
 697         switch (internal_notif->type) {
 698         case IWL_MVM_RXQ_EMPTY:
 699                 WARN_ONCE(len, "invalid empty notification size %d", len);
 700                 break;
 701         case IWL_MVM_RXQ_NOTIF_DEL_BA:
 702                 if (WARN_ONCE(len != sizeof(struct iwl_mvm_delba_data),
 703                               "invalid delba notification size %d (%d)",
 704                               len, (int)sizeof(struct iwl_mvm_delba_data)))
 705                         break;
 706                 iwl_mvm_del_ba(mvm, queue, (void *)internal_notif->data);
 707                 break;
 708         default:
 709                 WARN_ONCE(1, "Invalid identifier %d", internal_notif->type);
 710         }
 711
 712         if (internal_notif->sync) {
 713                 WARN_ONCE(!test_and_clear_bit(queue, &mvm->queue_sync_state),
 714                           "queue sync: queue %d responded a second time!\n",
 715                           queue);
 716                 if (READ_ONCE(mvm->queue_sync_state) == 0)
 717                         wake_up(&mvm->rx_sync_waitq);
 718         }
 719 }
 720
 721 /*
 722  * Returns true if the MPDU was buffered\dropped, false if it should be passed
 723  * to upper layer.
 724  */
 725 static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
 726                             struct napi_struct *napi,
 727                             int queue,
 728                             struct ieee80211_sta *sta,
 729                             struct sk_buff *skb,
 730                             struct iwl_rx_mpdu_desc *desc)
 731 {
 732         struct ieee80211_hdr *hdr = (void *)skb_mac_header(skb);
 733         struct iwl_mvm_baid_data *baid_data;
 734         struct iwl_mvm_reorder_buffer *buffer;
 735         u32 reorder = le32_to_cpu(desc->reorder_data);
 736         bool amsdu = desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU;
 737         bool last_subframe =
 738                 desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME;
 739         u8 tid = ieee80211_get_tid(hdr);
 740         u8 sub_frame_idx = desc->amsdu_info &
 741                            IWL_RX_MPDU_AMSDU_SUBFRAME_IDX_MASK;
 742         struct iwl_mvm_reorder_buf_entry *entries;
 743         u32 sta_mask;
 744         int index;
 745         u16 nssn, sn;
 746         u8 baid;
 747
 748         baid = (reorder & IWL_RX_MPDU_REORDER_BAID_MASK) >>
 749                 IWL_RX_MPDU_REORDER_BAID_SHIFT;
 750
 751         if (mvm->trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_9000)
 752                 return false;
 753
 754         /*
 755          * This also covers the case of receiving a Block Ack Request
 756          * outside a BA session; we'll pass it to mac80211 and that
 757          * then sends a delBA action frame.
 758          * This also covers pure monitor mode, in which case we won't
 759          * have any BA sessions.
 760          */
 761         if (baid == IWL_RX_REORDER_DATA_INVALID_BAID)
 762                 return false;
 763
 764         /* no sta yet */
 765         if (WARN_ONCE(IS_ERR_OR_NULL(sta),
 766                       "Got valid BAID without a valid station assigned\n"))
 767                 return false;
 768
 769         /* not a data packet or a bar */
 770         if (!ieee80211_is_back_req(hdr->frame_control) &&
 771             (!ieee80211_is_data_qos(hdr->frame_control) ||
 772              is_multicast_ether_addr(hdr->addr1)))
 773                 return false;
 774
 775         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
 776                 return false;
 777
 778         baid_data = rcu_dereference(mvm->baid_map[baid]);
 779         if (!baid_data) {
 780                 IWL_DEBUG_RX(mvm,
 781                              "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
 782                               baid, reorder);
 783                 return false;
 784         }
 785
 786         rcu_read_lock();
 787         sta_mask = iwl_mvm_sta_fw_id_mask(mvm, sta, -1);
 788         rcu_read_unlock();
 789
 790         if (IWL_FW_CHECK(mvm,
 791                          tid != baid_data->tid ||
 792                          !(sta_mask & baid_data->sta_mask),
 793                          "baid 0x%x is mapped to sta_mask:0x%x tid:%d, but was received for sta_mask:0x%x tid:%d\n",
 794                          baid, baid_data->sta_mask, baid_data->tid,
 795                          sta_mask, tid))
 796                 return false;
 797
 798         nssn = reorder & IWL_RX_MPDU_REORDER_NSSN_MASK;
 799         sn = (reorder & IWL_RX_MPDU_REORDER_SN_MASK) >>
 800                 IWL_RX_MPDU_REORDER_SN_SHIFT;
 801
 802         buffer = &baid_data->reorder_buf[queue];
 803         entries = &baid_data->entries[queue * baid_data->entries_per_queue];
 804
 805         spin_lock_bh(&buffer->lock);
 806
 807         if (!buffer->valid) {
 808                 if (reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN) {
 809                         spin_unlock_bh(&buffer->lock);
 810                         return false;
 811                 }
 812                 buffer->valid = true;
 813         }
 814
 815         /* drop any duplicated packets */
 816         if (desc->status & cpu_to_le32(IWL_RX_MPDU_STATUS_DUPLICATE))
 817                 goto drop;
 818
 819         /* drop any oudated packets */
 820         if (reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN)
 821                 goto drop;
 822
 823         /* release immediately if allowed by nssn and no stored frames */
 824         if (!buffer->num_stored && ieee80211_sn_less(sn, nssn)) {
 825                 if (!amsdu || last_subframe)
 826                         buffer->head_sn = nssn;
 827                 /* No need to update AMSDU last SN - we are moving the head */
 828                 spin_unlock_bh(&buffer->lock);
 829                 return false;
 830         }
 831
 832         /*
 833          * release immediately if there are no stored frames, and the sn is
 834          * equal to the head.
 835          * This can happen due to reorder timer, where NSSN is behind head_sn.
 836          * When we released everything, and we got the next frame in the
 837          * sequence, according to the NSSN we can't release immediately,
 838          * while technically there is no hole and we can move forward.
 839          */
 840         if (!buffer->num_stored && sn == buffer->head_sn) {
 841                 if (!amsdu || last_subframe)
 842                         buffer->head_sn = ieee80211_sn_inc(buffer->head_sn);
 843
 844                 /* No need to update AMSDU last SN - we are moving the head */
 845                 spin_unlock_bh(&buffer->lock);
 846                 return false;
 847         }
 848
 849         /* put in reorder buffer */
 850         index = sn % buffer->buf_size;
 851         __skb_queue_tail(&entries[index].frames, skb);
 852         buffer->num_stored++;
 853
 854         if (amsdu) {
 855                 buffer->last_amsdu = sn;
 856                 buffer->last_sub_index = sub_frame_idx;
 857         }
 858
 859         /*
 860          * We cannot trust NSSN for AMSDU sub-frames that are not the last.
 861          * The reason is that NSSN advances on the first sub-frame, and may
 862          * cause the reorder buffer to advance before all the sub-frames arrive.
 863          * Example: reorder buffer contains SN 0 & 2, and we receive AMSDU with
 864          * SN 1. NSSN for first sub frame will be 3 with the result of driver
 865          * releasing SN 0,1, 2. When sub-frame 1 arrives - reorder buffer is
 866          * already ahead and it will be dropped.
 867          * If the last sub-frame is not on this queue - we will get frame
 868          * release notification with up to date NSSN.
 869          */
 870         if (!amsdu || last_subframe)
 871                 iwl_mvm_release_frames(mvm, sta, napi, baid_data,
 872                                        buffer, nssn);
 873
 874         spin_unlock_bh(&buffer->lock);
 875         return true;
 876
 877 drop:
 878         kfree_skb(skb);
 879         spin_unlock_bh(&buffer->lock);
 880         return true;
 881 }
 882
 883 static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
 884                                     u32 reorder_data, u8 baid)
 885 {
 886         unsigned long now = jiffies;
 887         unsigned long timeout;
 888         struct iwl_mvm_baid_data *data;
 889
 890         rcu_read_lock();
 891
 892         data = rcu_dereference(mvm->baid_map[baid]);
 893         if (!data) {
 894                 IWL_DEBUG_RX(mvm,
 895                              "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
 896                               baid, reorder_data);
 897                 goto out;
 898         }
 899
 900         if (!data->timeout)
 901                 goto out;
 902
 903         timeout = data->timeout;
 904         /*
 905          * Do not update last rx all the time to avoid cache bouncing
 906          * between the rx queues.
 907          * Update it every timeout. Worst case is the session will
 908          * expire after ~ 2 * timeout, which doesn't matter that much.
 909          */
 910         if (time_before(data->last_rx + TU_TO_JIFFIES(timeout), now))
 911                 /* Update is atomic */
 912                 data->last_rx = now;
 913
 914 out:
 915         rcu_read_unlock();
 916 }
 917
 918 static void iwl_mvm_flip_address(u8 *addr)
 919 {
 920         int i;
 921         u8 mac_addr[ETH_ALEN];
 922
 923         for (i = 0; i < ETH_ALEN; i++)
 924                 mac_addr[i] = addr[ETH_ALEN - i - 1];
 925         ether_addr_copy(addr, mac_addr);
 926 }
 927
 928 struct iwl_mvm_rx_phy_data {
 929         enum iwl_rx_phy_info_type info_type;
 930         __le32 d0, d1, d2, d3, eht_d4, d5;
 931         __le16 d4;
 932         bool with_data;
 933         bool first_subframe;
 934         __le32 rx_vec[4];
 935
 936         u32 rate_n_flags;
 937         u32 gp2_on_air_rise;
 938         u16 phy_info;
 939         u8 energy_a, energy_b;
 940         u8 channel;
 941 };
 942
 943 static void iwl_mvm_decode_he_mu_ext(struct iwl_mvm *mvm,
 944                                      struct iwl_mvm_rx_phy_data *phy_data,
 945                                      struct ieee80211_radiotap_he_mu *he_mu)
 946 {
 947         u32 phy_data2 = le32_to_cpu(phy_data->d2);
 948         u32 phy_data3 = le32_to_cpu(phy_data->d3);
 949         u16 phy_data4 = le16_to_cpu(phy_data->d4);
 950         u32 rate_n_flags = phy_data->rate_n_flags;
 951
 952         if (FIELD_GET(IWL_RX_PHY_DATA4_HE_MU_EXT_CH1_CRC_OK, phy_data4)) {
 953                 he_mu->flags1 |=
 954                         cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_RU_KNOWN |
 955                                     IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_CTR_26T_RU_KNOWN);
 956
 957                 he_mu->flags1 |=
 958                         le16_encode_bits(FIELD_GET(IWL_RX_PHY_DATA4_HE_MU_EXT_CH1_CTR_RU,
 959                                                    phy_data4),
 960                                          IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_CTR_26T_RU);
 961
 962                 he_mu->ru_ch1[0] = FIELD_GET(IWL_RX_PHY_DATA2_HE_MU_EXT_CH1_RU0,
 963                                              phy_data2);
 964                 he_mu->ru_ch1[1] = FIELD_GET(IWL_RX_PHY_DATA3_HE_MU_EXT_CH1_RU1,
 965                                              phy_data3);
 966                 he_mu->ru_ch1[2] = FIELD_GET(IWL_RX_PHY_DATA2_HE_MU_EXT_CH1_RU2,
 967                                              phy_data2);
 968                 he_mu->ru_ch1[3] = FIELD_GET(IWL_RX_PHY_DATA3_HE_MU_EXT_CH1_RU3,
 969                                              phy_data3);
 970         }
 971
 972         if (FIELD_GET(IWL_RX_PHY_DATA4_HE_MU_EXT_CH2_CRC_OK, phy_data4) &&
 973             (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK_V1) != RATE_MCS_CHAN_WIDTH_20) {
 974                 he_mu->flags1 |=
 975                         cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH2_RU_KNOWN |
 976                                     IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH2_CTR_26T_RU_KNOWN);
 977
 978                 he_mu->flags2 |=
 979                         le16_encode_bits(FIELD_GET(IWL_RX_PHY_DATA4_HE_MU_EXT_CH2_CTR_RU,
 980                                                    phy_data4),
 981                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_CH2_CTR_26T_RU);
 982
 983                 he_mu->ru_ch2[0] = FIELD_GET(IWL_RX_PHY_DATA2_HE_MU_EXT_CH2_RU0,
 984                                              phy_data2);
 985                 he_mu->ru_ch2[1] = FIELD_GET(IWL_RX_PHY_DATA3_HE_MU_EXT_CH2_RU1,
 986                                              phy_data3);
 987                 he_mu->ru_ch2[2] = FIELD_GET(IWL_RX_PHY_DATA2_HE_MU_EXT_CH2_RU2,
 988                                              phy_data2);
 989                 he_mu->ru_ch2[3] = FIELD_GET(IWL_RX_PHY_DATA3_HE_MU_EXT_CH2_RU3,
 990                                              phy_data3);
 991         }
 992 }
 993
 994 static void
 995 iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data,
 996                                struct ieee80211_radiotap_he *he,
 997                                struct ieee80211_radiotap_he_mu *he_mu,
 998                                struct ieee80211_rx_status *rx_status)
 999 {
1000         /*
1001          * Unfortunately, we have to leave the mac80211 data
1002          * incorrect for the case that we receive an HE-MU
1003          * transmission and *don't* have the HE phy data (due
1004          * to the bits being used for TSF). This shouldn't
1005          * happen though as management frames where we need
1006          * the TSF/timers are not be transmitted in HE-MU.
1007          */
1008         u8 ru = le32_get_bits(phy_data->d1, IWL_RX_PHY_DATA1_HE_RU_ALLOC_MASK);
1009         u32 rate_n_flags = phy_data->rate_n_flags;
1010         u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK_V1;
1011         u8 offs = 0;
1012
1013         rx_status->bw = RATE_INFO_BW_HE_RU;
1014
1015         he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN);
1016
1017         switch (ru) {
1018         case 0 ... 36:
1019                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_26;
1020                 offs = ru;
1021                 break;
1022         case 37 ... 52:
1023                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_52;
1024                 offs = ru - 37;
1025                 break;
1026         case 53 ... 60:
1027                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_106;
1028                 offs = ru - 53;
1029                 break;
1030         case 61 ... 64:
1031                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_242;
1032                 offs = ru - 61;
1033                 break;
1034         case 65 ... 66:
1035                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_484;
1036                 offs = ru - 65;
1037                 break;
1038         case 67:
1039                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_996;
1040                 break;
1041         case 68:
1042                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_2x996;
1043                 break;
1044         }
1045         he->data2 |= le16_encode_bits(offs,
1046                                       IEEE80211_RADIOTAP_HE_DATA2_RU_OFFSET);
1047         he->data2 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_KNOWN |
1048                                  IEEE80211_RADIOTAP_HE_DATA2_RU_OFFSET_KNOWN);
1049         if (phy_data->d1 & cpu_to_le32(IWL_RX_PHY_DATA1_HE_RU_ALLOC_SEC80))
1050                 he->data2 |=
1051                         cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_SEC);
1052
1053 #define CHECK_BW(bw) \
1054         BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_ ## bw ## MHZ != \
1055                      RATE_MCS_CHAN_WIDTH_##bw >> RATE_MCS_CHAN_WIDTH_POS); \
1056         BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_ ## bw ## MHZ != \
1057                      RATE_MCS_CHAN_WIDTH_##bw >> RATE_MCS_CHAN_WIDTH_POS)
1058         CHECK_BW(20);
1059         CHECK_BW(40);
1060         CHECK_BW(80);
1061         CHECK_BW(160);
1062
1063         if (he_mu)
1064                 he_mu->flags2 |=
1065                         le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK_V1,
1066                                                    rate_n_flags),
1067                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW);
1068         else if (he_type == RATE_MCS_HE_TYPE_TRIG_V1)
1069                 he->data6 |=
1070                         cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_KNOWN) |
1071                         le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK_V1,
1072                                                    rate_n_flags),
1073                                          IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW);
1074 }
1075
1076 static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
1077                                        struct iwl_mvm_rx_phy_data *phy_data,
1078                                        struct ieee80211_radiotap_he *he,
1079                                        struct ieee80211_radiotap_he_mu *he_mu,
1080                                        struct ieee80211_rx_status *rx_status,
1081                                        int queue)
1082 {
1083         switch (phy_data->info_type) {
1084         case IWL_RX_PHY_INFO_TYPE_NONE:
1085         case IWL_RX_PHY_INFO_TYPE_CCK:
1086         case IWL_RX_PHY_INFO_TYPE_OFDM_LGCY:
1087         case IWL_RX_PHY_INFO_TYPE_HT:
1088         case IWL_RX_PHY_INFO_TYPE_VHT_SU:
1089         case IWL_RX_PHY_INFO_TYPE_VHT_MU:
1090         case IWL_RX_PHY_INFO_TYPE_EHT_MU:
1091         case IWL_RX_PHY_INFO_TYPE_EHT_TB:
1092         case IWL_RX_PHY_INFO_TYPE_EHT_MU_EXT:
1093         case IWL_RX_PHY_INFO_TYPE_EHT_TB_EXT:
1094                 return;
1095         case IWL_RX_PHY_INFO_TYPE_HE_TB_EXT:
1096                 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN |
1097                                          IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE2_KNOWN |
1098                                          IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE3_KNOWN |
1099                                          IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE4_KNOWN);
1100                 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
1101                                                             IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE1),
1102                                               IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE1);
1103                 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
1104                                                             IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE2),
1105                                               IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE2);
1106                 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
1107                                                             IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE3),
1108                                               IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE3);
1109                 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
1110                                                             IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE4),
1111                                               IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE4);
1112                 fallthrough;
1113         case IWL_RX_PHY_INFO_TYPE_HE_SU:
1114         case IWL_RX_PHY_INFO_TYPE_HE_MU:
1115         case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
1116         case IWL_RX_PHY_INFO_TYPE_HE_TB:
1117                 /* HE common */
1118                 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_LDPC_XSYMSEG_KNOWN |
1119                                          IEEE80211_RADIOTAP_HE_DATA1_DOPPLER_KNOWN |
1120                                          IEEE80211_RADIOTAP_HE_DATA1_BSS_COLOR_KNOWN);
1121                 he->data2 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRE_FEC_PAD_KNOWN |
1122                                          IEEE80211_RADIOTAP_HE_DATA2_PE_DISAMBIG_KNOWN |
1123                                          IEEE80211_RADIOTAP_HE_DATA2_TXOP_KNOWN |
1124                                          IEEE80211_RADIOTAP_HE_DATA2_NUM_LTF_SYMS_KNOWN);
1125                 he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1126                                                             IWL_RX_PHY_DATA0_HE_BSS_COLOR_MASK),
1127                                               IEEE80211_RADIOTAP_HE_DATA3_BSS_COLOR);
1128                 if (phy_data->info_type != IWL_RX_PHY_INFO_TYPE_HE_TB &&
1129                     phy_data->info_type != IWL_RX_PHY_INFO_TYPE_HE_TB_EXT) {
1130                         he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_UL_DL_KNOWN);
1131                         he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1132                                                             IWL_RX_PHY_DATA0_HE_UPLINK),
1133                                                       IEEE80211_RADIOTAP_HE_DATA3_UL_DL);
1134                 }
1135                 he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1136                                                             IWL_RX_PHY_DATA0_HE_LDPC_EXT_SYM),
1137                                               IEEE80211_RADIOTAP_HE_DATA3_LDPC_XSYMSEG);
1138                 he->data5 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1139                                                             IWL_RX_PHY_DATA0_HE_PRE_FEC_PAD_MASK),
1140                                               IEEE80211_RADIOTAP_HE_DATA5_PRE_FEC_PAD);
1141                 he->data5 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1142                                                             IWL_RX_PHY_DATA0_HE_PE_DISAMBIG),
1143                                               IEEE80211_RADIOTAP_HE_DATA5_PE_DISAMBIG);
1144                 he->data5 |= le16_encode_bits(le32_get_bits(phy_data->d1,
1145                                                             IWL_RX_PHY_DATA1_HE_LTF_NUM_MASK),
1146                                               IEEE80211_RADIOTAP_HE_DATA5_NUM_LTF_SYMS);
1147                 he->data6 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1148                                                             IWL_RX_PHY_DATA0_HE_TXOP_DUR_MASK),
1149                                               IEEE80211_RADIOTAP_HE_DATA6_TXOP);
1150                 he->data6 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1151                                                             IWL_RX_PHY_DATA0_HE_DOPPLER),
1152                                               IEEE80211_RADIOTAP_HE_DATA6_DOPPLER);
1153                 break;
1154         }
1155
1156         switch (phy_data->info_type) {
1157         case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
1158         case IWL_RX_PHY_INFO_TYPE_HE_MU:
1159         case IWL_RX_PHY_INFO_TYPE_HE_SU:
1160                 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN);
1161                 he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1162                                                             IWL_RX_PHY_DATA0_HE_SPATIAL_REUSE_MASK),
1163                                               IEEE80211_RADIOTAP_HE_DATA4_SU_MU_SPTL_REUSE);
1164                 break;
1165         default:
1166                 /* nothing here */
1167                 break;
1168         }
1169
1170         switch (phy_data->info_type) {
1171         case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
1172                 he_mu->flags1 |=
1173                         le16_encode_bits(le16_get_bits(phy_data->d4,
1174                                                        IWL_RX_PHY_DATA4_HE_MU_EXT_SIGB_DCM),
1175                                          IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_DCM);
1176                 he_mu->flags1 |=
1177                         le16_encode_bits(le16_get_bits(phy_data->d4,
1178                                                        IWL_RX_PHY_DATA4_HE_MU_EXT_SIGB_MCS_MASK),
1179                                          IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_MCS);
1180                 he_mu->flags2 |=
1181                         le16_encode_bits(le16_get_bits(phy_data->d4,
1182                                                        IWL_RX_PHY_DATA4_HE_MU_EXT_PREAMBLE_PUNC_TYPE_MASK),
1183                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW);
1184                 iwl_mvm_decode_he_mu_ext(mvm, phy_data, he_mu);
1185                 fallthrough;
1186         case IWL_RX_PHY_INFO_TYPE_HE_MU:
1187                 he_mu->flags2 |=
1188                         le16_encode_bits(le32_get_bits(phy_data->d1,
1189                                                        IWL_RX_PHY_DATA1_HE_MU_SIBG_SYM_OR_USER_NUM_MASK),
1190                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_SIG_B_SYMS_USERS);
1191                 he_mu->flags2 |=
1192                         le16_encode_bits(le32_get_bits(phy_data->d1,
1193                                                        IWL_RX_PHY_DATA1_HE_MU_SIGB_COMPRESSION),
1194                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_SIG_B_COMP);
1195                 fallthrough;
1196         case IWL_RX_PHY_INFO_TYPE_HE_TB:
1197         case IWL_RX_PHY_INFO_TYPE_HE_TB_EXT:
1198                 iwl_mvm_decode_he_phy_ru_alloc(phy_data, he, he_mu, rx_status);
1199                 break;
1200         case IWL_RX_PHY_INFO_TYPE_HE_SU:
1201                 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_BEAM_CHANGE_KNOWN);
1202                 he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
1203                                                             IWL_RX_PHY_DATA0_HE_BEAM_CHNG),
1204                                               IEEE80211_RADIOTAP_HE_DATA3_BEAM_CHANGE);
1205                 break;
1206         default:
1207                 /* nothing */
1208                 break;
1209         }
1210 }
1211
1212 #define LE32_DEC_ENC(value, dec_bits, enc_bits) \
1213         le32_encode_bits(le32_get_bits(value, dec_bits), enc_bits)
1214
1215 #define IWL_MVM_ENC_USIG_VALUE_MASK(usig, in_value, dec_bits, enc_bits) do { \
1216         typeof(enc_bits) _enc_bits = enc_bits; \
1217         typeof(usig) _usig = usig; \
1218         (_usig)->mask |= cpu_to_le32(_enc_bits); \
1219         (_usig)->value |= LE32_DEC_ENC(in_value, dec_bits, _enc_bits); \
1220 } while (0)
1221
1222 #define __IWL_MVM_ENC_EHT_RU(rt_data, rt_ru, fw_data, fw_ru) \
1223         eht->data[(rt_data)] |= \
1224                 (cpu_to_le32 \
1225                  (IEEE80211_RADIOTAP_EHT_DATA ## rt_data ## _RU_ALLOC_CC_ ## rt_ru ## _KNOWN) | \
1226                  LE32_DEC_ENC(data ## fw_data, \
1227                               IWL_RX_PHY_DATA ## fw_data ## _EHT_MU_EXT_RU_ALLOC_ ## fw_ru, \
1228                               IEEE80211_RADIOTAP_EHT_DATA ## rt_data ## _RU_ALLOC_CC_ ## rt_ru))
1229
1230 #define _IWL_MVM_ENC_EHT_RU(rt_data, rt_ru, fw_data, fw_ru)     \
1231         __IWL_MVM_ENC_EHT_RU(rt_data, rt_ru, fw_data, fw_ru)
1232
1233 #define IEEE80211_RADIOTAP_RU_DATA_1_1_1        1
1234 #define IEEE80211_RADIOTAP_RU_DATA_2_1_1        2
1235 #define IEEE80211_RADIOTAP_RU_DATA_1_1_2        2
1236 #define IEEE80211_RADIOTAP_RU_DATA_2_1_2        2
1237 #define IEEE80211_RADIOTAP_RU_DATA_1_2_1        3
1238 #define IEEE80211_RADIOTAP_RU_DATA_2_2_1        3
1239 #define IEEE80211_RADIOTAP_RU_DATA_1_2_2        3
1240 #define IEEE80211_RADIOTAP_RU_DATA_2_2_2        4
1241
1242 #define IWL_RX_RU_DATA_A1                       2
1243 #define IWL_RX_RU_DATA_A2                       2
1244 #define IWL_RX_RU_DATA_B1                       2
1245 #define IWL_RX_RU_DATA_B2                       4
1246 #define IWL_RX_RU_DATA_C1                       3
1247 #define IWL_RX_RU_DATA_C2                       3
1248 #define IWL_RX_RU_DATA_D1                       4
1249 #define IWL_RX_RU_DATA_D2                       4
1250
1251 #define IWL_MVM_ENC_EHT_RU(rt_ru, fw_ru)                                \
1252         _IWL_MVM_ENC_EHT_RU(IEEE80211_RADIOTAP_RU_DATA_ ## rt_ru,       \
1253                             rt_ru,                                      \
1254                             IWL_RX_RU_DATA_ ## fw_ru,                   \
1255                             fw_ru)
1256
1257 static void iwl_mvm_decode_eht_ext_mu(struct iwl_mvm *mvm,
1258                                       struct iwl_mvm_rx_phy_data *phy_data,
1259                                       struct ieee80211_rx_status *rx_status,
1260                                       struct ieee80211_radiotap_eht *eht,
1261                                       struct ieee80211_radiotap_eht_usig *usig)
1262 {
1263         if (phy_data->with_data) {
1264                 __le32 data1 = phy_data->d1;
1265                 __le32 data2 = phy_data->d2;
1266                 __le32 data3 = phy_data->d3;
1267                 __le32 data4 = phy_data->eht_d4;
1268                 __le32 data5 = phy_data->d5;
1269                 u32 phy_bw = phy_data->rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK;
1270
1271                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, data5,
1272                                             IWL_RX_PHY_DATA5_EHT_TYPE_AND_COMP,
1273                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B0_B1_PPDU_TYPE);
1274                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, data5,
1275                                             IWL_RX_PHY_DATA5_EHT_MU_PUNC_CH_CODE,
1276                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B3_B7_PUNCTURED_INFO);
1277                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, data4,
1278                                             IWL_RX_PHY_DATA4_EHT_MU_EXT_SIGB_MCS,
1279                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B9_B10_SIG_MCS);
1280                 IWL_MVM_ENC_USIG_VALUE_MASK
1281                         (usig, data1, IWL_RX_PHY_DATA1_EHT_MU_NUM_SIG_SYM_USIGA2,
1282                          IEEE80211_RADIOTAP_EHT_USIG2_MU_B11_B15_EHT_SIG_SYMBOLS);
1283
1284                 eht->user_info[0] |=
1285                         cpu_to_le32(IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID_KNOWN) |
1286                         LE32_DEC_ENC(data5, IWL_RX_PHY_DATA5_EHT_MU_STA_ID_USR,
1287                                      IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID);
1288
1289                 eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_NR_NON_OFDMA_USERS_M);
1290                 eht->data[7] |= LE32_DEC_ENC
1291                         (data5, IWL_RX_PHY_DATA5_EHT_MU_NUM_USR_NON_OFDMA,
1292                          IEEE80211_RADIOTAP_EHT_DATA7_NUM_OF_NON_OFDMA_USERS);
1293
1294                 /*
1295                  * Hardware labels the content channels/RU allocation values
1296                  * as follows:
1297                  *           Content Channel 1          Content Channel 2
1298                  *   20 MHz: A1
1299                  *   40 MHz: A1                         B1
1300                  *   80 MHz: A1 C1                      B1 D1
1301                  *  160 MHz: A1 C1 A2 C2                B1 D1 B2 D2
1302                  *  320 MHz: A1 C1 A2 C2 A3 C3 A4 C4    B1 D1 B2 D2 B3 D3 B4 D4
1303                  *
1304                  * However firmware can only give us A1-D2, so the higher
1305                  * frequencies are missing.
1306                  */
1307
1308                 switch (phy_bw) {
1309                 case RATE_MCS_CHAN_WIDTH_320:
1310                         /* additional values are missing in RX metadata */
1311                 case RATE_MCS_CHAN_WIDTH_160:
1312                         /* content channel 1 */
1313                         IWL_MVM_ENC_EHT_RU(1_2_1, A2);
1314                         IWL_MVM_ENC_EHT_RU(1_2_2, C2);
1315                         /* content channel 2 */
1316                         IWL_MVM_ENC_EHT_RU(2_2_1, B2);
1317                         IWL_MVM_ENC_EHT_RU(2_2_2, D2);
1318                         fallthrough;
1319                 case RATE_MCS_CHAN_WIDTH_80:
1320                         /* content channel 1 */
1321                         IWL_MVM_ENC_EHT_RU(1_1_2, C1);
1322                         /* content channel 2 */
1323                         IWL_MVM_ENC_EHT_RU(2_1_2, D1);
1324                         fallthrough;
1325                 case RATE_MCS_CHAN_WIDTH_40:
1326                         /* content channel 2 */
1327                         IWL_MVM_ENC_EHT_RU(2_1_1, B1);
1328                         fallthrough;
1329                 case RATE_MCS_CHAN_WIDTH_20:
1330                         IWL_MVM_ENC_EHT_RU(1_1_1, A1);
1331                         break;
1332                 }
1333         } else {
1334                 __le32 usig_a1 = phy_data->rx_vec[0];
1335                 __le32 usig_a2 = phy_data->rx_vec[1];
1336
1337                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a1,
1338                                             IWL_RX_USIG_A1_DISREGARD,
1339                                             IEEE80211_RADIOTAP_EHT_USIG1_MU_B20_B24_DISREGARD);
1340                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a1,
1341                                             IWL_RX_USIG_A1_VALIDATE,
1342                                             IEEE80211_RADIOTAP_EHT_USIG1_MU_B25_VALIDATE);
1343                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1344                                             IWL_RX_USIG_A2_EHT_PPDU_TYPE,
1345                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B0_B1_PPDU_TYPE);
1346                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1347                                             IWL_RX_USIG_A2_EHT_USIG2_VALIDATE_B2,
1348                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B2_VALIDATE);
1349                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1350                                             IWL_RX_USIG_A2_EHT_PUNC_CHANNEL,
1351                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B3_B7_PUNCTURED_INFO);
1352                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1353                                             IWL_RX_USIG_A2_EHT_USIG2_VALIDATE_B8,
1354                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B8_VALIDATE);
1355                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1356                                             IWL_RX_USIG_A2_EHT_SIG_MCS,
1357                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B9_B10_SIG_MCS);
1358                 IWL_MVM_ENC_USIG_VALUE_MASK
1359                         (usig, usig_a2, IWL_RX_USIG_A2_EHT_SIG_SYM_NUM,
1360                          IEEE80211_RADIOTAP_EHT_USIG2_MU_B11_B15_EHT_SIG_SYMBOLS);
1361                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1362                                             IWL_RX_USIG_A2_EHT_CRC_OK,
1363                                             IEEE80211_RADIOTAP_EHT_USIG2_MU_B16_B19_CRC);
1364         }
1365 }
1366
1367 static void iwl_mvm_decode_eht_ext_tb(struct iwl_mvm *mvm,
1368                                       struct iwl_mvm_rx_phy_data *phy_data,
1369                                       struct ieee80211_rx_status *rx_status,
1370                                       struct ieee80211_radiotap_eht *eht,
1371                                       struct ieee80211_radiotap_eht_usig *usig)
1372 {
1373         if (phy_data->with_data) {
1374                 __le32 data5 = phy_data->d5;
1375
1376                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, data5,
1377                                             IWL_RX_PHY_DATA5_EHT_TYPE_AND_COMP,
1378                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B0_B1_PPDU_TYPE);
1379                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, data5,
1380                                             IWL_RX_PHY_DATA5_EHT_TB_SPATIAL_REUSE1,
1381                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B3_B6_SPATIAL_REUSE_1);
1382
1383                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, data5,
1384                                             IWL_RX_PHY_DATA5_EHT_TB_SPATIAL_REUSE2,
1385                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B7_B10_SPATIAL_REUSE_2);
1386         } else {
1387                 __le32 usig_a1 = phy_data->rx_vec[0];
1388                 __le32 usig_a2 = phy_data->rx_vec[1];
1389
1390                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a1,
1391                                             IWL_RX_USIG_A1_DISREGARD,
1392                                             IEEE80211_RADIOTAP_EHT_USIG1_TB_B20_B25_DISREGARD);
1393                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1394                                             IWL_RX_USIG_A2_EHT_PPDU_TYPE,
1395                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B0_B1_PPDU_TYPE);
1396                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1397                                             IWL_RX_USIG_A2_EHT_USIG2_VALIDATE_B2,
1398                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B2_VALIDATE);
1399                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1400                                             IWL_RX_USIG_A2_EHT_TRIG_SPATIAL_REUSE_1,
1401                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B3_B6_SPATIAL_REUSE_1);
1402                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1403                                             IWL_RX_USIG_A2_EHT_TRIG_SPATIAL_REUSE_2,
1404                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B7_B10_SPATIAL_REUSE_2);
1405                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1406                                             IWL_RX_USIG_A2_EHT_TRIG_USIG2_DISREGARD,
1407                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B11_B15_DISREGARD);
1408                 IWL_MVM_ENC_USIG_VALUE_MASK(usig, usig_a2,
1409                                             IWL_RX_USIG_A2_EHT_CRC_OK,
1410                                             IEEE80211_RADIOTAP_EHT_USIG2_TB_B16_B19_CRC);
1411         }
1412 }
1413
1414 static void iwl_mvm_decode_eht_ru(struct iwl_mvm *mvm,
1415                                   struct ieee80211_rx_status *rx_status,
1416                                   struct ieee80211_radiotap_eht *eht)
1417 {
1418         u32 ru = le32_get_bits(eht->data[8],
1419                                IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_B7_B1);
1420         enum nl80211_eht_ru_alloc nl_ru;
1421
1422         /* Using D1.5 Table 9-53a - Encoding of PS160 and RU Allocation subfields
1423          * in an EHT variant User Info field
1424          */
1425
1426         switch (ru) {
1427         case 0 ... 36:
1428                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_26;
1429                 break;
1430         case 37 ... 52:
1431                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_52;
1432                 break;
1433         case 53 ... 60:
1434                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_106;
1435                 break;
1436         case 61 ... 64:
1437                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_242;
1438                 break;
1439         case 65 ... 66:
1440                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_484;
1441                 break;
1442         case 67:
1443                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_996;
1444                 break;
1445         case 68:
1446                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_2x996;
1447                 break;
1448         case 69:
1449                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_4x996;
1450                 break;
1451         case 70 ... 81:
1452                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_52P26;
1453                 break;
1454         case 82 ... 89:
1455                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_106P26;
1456                 break;
1457         case 90 ... 93:
1458                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_484P242;
1459                 break;
1460         case 94 ... 95:
1461                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_996P484;
1462                 break;
1463         case 96 ... 99:
1464                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242;
1465                 break;
1466         case 100 ... 103:
1467                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484;
1468                 break;
1469         case 104:
1470                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_3x996;
1471                 break;
1472         case 105 ... 106:
1473                 nl_ru = NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484;
1474                 break;
1475         default:
1476                 return;
1477         }
1478
1479         rx_status->bw = RATE_INFO_BW_EHT_RU;
1480         rx_status->eht.ru = nl_ru;
1481 }
1482
1483 static void iwl_mvm_decode_eht_phy_data(struct iwl_mvm *mvm,
1484                                         struct iwl_mvm_rx_phy_data *phy_data,
1485                                         struct ieee80211_rx_status *rx_status,
1486                                         struct ieee80211_radiotap_eht *eht,
1487                                         struct ieee80211_radiotap_eht_usig *usig)
1488
1489 {
1490         __le32 data0 = phy_data->d0;
1491         __le32 data1 = phy_data->d1;
1492         __le32 usig_a1 = phy_data->rx_vec[0];
1493         u8 info_type = phy_data->info_type;
1494
1495         /* Not in EHT range */
1496         if (info_type < IWL_RX_PHY_INFO_TYPE_EHT_MU ||
1497             info_type > IWL_RX_PHY_INFO_TYPE_EHT_TB_EXT)
1498                 return;
1499
1500         usig->common |= cpu_to_le32
1501                 (IEEE80211_RADIOTAP_EHT_USIG_COMMON_UL_DL_KNOWN |
1502                  IEEE80211_RADIOTAP_EHT_USIG_COMMON_BSS_COLOR_KNOWN);
1503         if (phy_data->with_data) {
1504                 usig->common |= LE32_DEC_ENC(data0,
1505                                              IWL_RX_PHY_DATA0_EHT_UPLINK,
1506                                              IEEE80211_RADIOTAP_EHT_USIG_COMMON_UL_DL);
1507                 usig->common |= LE32_DEC_ENC(data0,
1508                                              IWL_RX_PHY_DATA0_EHT_BSS_COLOR_MASK,
1509                                              IEEE80211_RADIOTAP_EHT_USIG_COMMON_BSS_COLOR);
1510         } else {
1511                 usig->common |= LE32_DEC_ENC(usig_a1,
1512                                              IWL_RX_USIG_A1_UL_FLAG,
1513                                              IEEE80211_RADIOTAP_EHT_USIG_COMMON_UL_DL);
1514                 usig->common |= LE32_DEC_ENC(usig_a1,
1515                                              IWL_RX_USIG_A1_BSS_COLOR,
1516                                              IEEE80211_RADIOTAP_EHT_USIG_COMMON_BSS_COLOR);
1517         }
1518
1519         if (fw_has_capa(&mvm->fw->ucode_capa,
1520                         IWL_UCODE_TLV_CAPA_SNIFF_VALIDATE_SUPPORT)) {
1521                 usig->common |=
1522                         cpu_to_le32(IEEE80211_RADIOTAP_EHT_USIG_COMMON_VALIDATE_BITS_CHECKED);
1523                 usig->common |=
1524                         LE32_DEC_ENC(data0, IWL_RX_PHY_DATA0_EHT_VALIDATE,
1525                                      IEEE80211_RADIOTAP_EHT_USIG_COMMON_VALIDATE_BITS_OK);
1526         }
1527
1528         eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_SPATIAL_REUSE);
1529         eht->data[0] |= LE32_DEC_ENC(data0,
1530                                      IWL_RX_PHY_DATA0_ETH_SPATIAL_REUSE_MASK,
1531                                      IEEE80211_RADIOTAP_EHT_DATA0_SPATIAL_REUSE);
1532
1533         /* All RU allocating size/index is in TB format */
1534         eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_RU_ALLOC_TB_FMT);
1535         eht->data[8] |= LE32_DEC_ENC(data0, IWL_RX_PHY_DATA0_EHT_PS160,
1536                                      IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_PS_160);
1537         eht->data[8] |= LE32_DEC_ENC(data1, IWL_RX_PHY_DATA1_EHT_RU_ALLOC_B0,
1538                                      IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_B0);
1539         eht->data[8] |= LE32_DEC_ENC(data1, IWL_RX_PHY_DATA1_EHT_RU_ALLOC_B1_B7,
1540                                      IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_B7_B1);
1541
1542         iwl_mvm_decode_eht_ru(mvm, rx_status, eht);
1543
1544         /* We only get here in case of IWL_RX_MPDU_PHY_TSF_OVERLOAD is set
1545          * which is on only in case of monitor mode so no need to check monitor
1546          * mode
1547          */
1548         eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_PRIMARY_80);
1549         eht->data[1] |=
1550                 le32_encode_bits(mvm->monitor_p80,
1551                                  IEEE80211_RADIOTAP_EHT_DATA1_PRIMARY_80);
1552
1553         usig->common |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_USIG_COMMON_TXOP_KNOWN);
1554         if (phy_data->with_data)
1555                 usig->common |= LE32_DEC_ENC(data0, IWL_RX_PHY_DATA0_EHT_TXOP_DUR_MASK,
1556                                              IEEE80211_RADIOTAP_EHT_USIG_COMMON_TXOP);
1557         else
1558                 usig->common |= LE32_DEC_ENC(usig_a1, IWL_RX_USIG_A1_TXOP_DURATION,
1559                                              IEEE80211_RADIOTAP_EHT_USIG_COMMON_TXOP);
1560
1561         eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_LDPC_EXTRA_SYM_OM);
1562         eht->data[0] |= LE32_DEC_ENC(data0, IWL_RX_PHY_DATA0_EHT_LDPC_EXT_SYM,
1563                                      IEEE80211_RADIOTAP_EHT_DATA0_LDPC_EXTRA_SYM_OM);
1564
1565         eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_PRE_PADD_FACOR_OM);
1566         eht->data[0] |= LE32_DEC_ENC(data0, IWL_RX_PHY_DATA0_EHT_PRE_FEC_PAD_MASK,
1567                                     IEEE80211_RADIOTAP_EHT_DATA0_PRE_PADD_FACOR_OM);
1568
1569         eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_PE_DISAMBIGUITY_OM);
1570         eht->data[0] |= LE32_DEC_ENC(data0, IWL_RX_PHY_DATA0_EHT_PE_DISAMBIG,
1571                                      IEEE80211_RADIOTAP_EHT_DATA0_PE_DISAMBIGUITY_OM);
1572
1573         /* TODO: what about IWL_RX_PHY_DATA0_EHT_BW320_SLOT */
1574
1575         if (!le32_get_bits(data0, IWL_RX_PHY_DATA0_EHT_SIGA_CRC_OK))
1576                 usig->common |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_USIG_COMMON_BAD_USIG_CRC);
1577
1578         usig->common |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_USIG_COMMON_PHY_VER_KNOWN);
1579         usig->common |= LE32_DEC_ENC(data0, IWL_RX_PHY_DATA0_EHT_PHY_VER,
1580                                      IEEE80211_RADIOTAP_EHT_USIG_COMMON_PHY_VER);
1581
1582         /*
1583          * TODO: what about TB - IWL_RX_PHY_DATA1_EHT_TB_PILOT_TYPE,
1584          *                       IWL_RX_PHY_DATA1_EHT_TB_LOW_SS
1585          */
1586
1587         eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF);
1588         eht->data[0] |= LE32_DEC_ENC(data1, IWL_RX_PHY_DATA1_EHT_SIG_LTF_NUM,
1589                                      IEEE80211_RADIOTAP_EHT_DATA0_EHT_LTF);
1590
1591         if (info_type == IWL_RX_PHY_INFO_TYPE_EHT_TB_EXT ||
1592             info_type == IWL_RX_PHY_INFO_TYPE_EHT_TB)
1593                 iwl_mvm_decode_eht_ext_tb(mvm, phy_data, rx_status, eht, usig);
1594
1595         if (info_type == IWL_RX_PHY_INFO_TYPE_EHT_MU_EXT ||
1596             info_type == IWL_RX_PHY_INFO_TYPE_EHT_MU)
1597                 iwl_mvm_decode_eht_ext_mu(mvm, phy_data, rx_status, eht, usig);
1598 }
1599
1600 static void iwl_mvm_rx_eht(struct iwl_mvm *mvm, struct sk_buff *skb,
1601                            struct iwl_mvm_rx_phy_data *phy_data,
1602                            int queue)
1603 {
1604         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
1605
1606         struct ieee80211_radiotap_eht *eht;
1607         struct ieee80211_radiotap_eht_usig *usig;
1608         size_t eht_len = sizeof(*eht);
1609
1610         u32 rate_n_flags = phy_data->rate_n_flags;
1611         u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK;
1612         /* EHT and HE have the same valus for LTF */
1613         u8 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_UNKNOWN;
1614         u16 phy_info = phy_data->phy_info;
1615         u32 bw;
1616
1617         /* u32 for 1 user_info */
1618         if (phy_data->with_data)
1619                 eht_len += sizeof(u32);
1620
1621         eht = iwl_mvm_radiotap_put_tlv(skb, IEEE80211_RADIOTAP_EHT, eht_len);
1622
1623         usig = iwl_mvm_radiotap_put_tlv(skb, IEEE80211_RADIOTAP_EHT_USIG,
1624                                         sizeof(*usig));
1625         rx_status->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
1626         usig->common |=
1627                 cpu_to_le32(IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_KNOWN);
1628
1629         /* specific handling for 320MHz */
1630         bw = FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK, rate_n_flags);
1631         if (bw == RATE_MCS_CHAN_WIDTH_320_VAL)
1632                 bw += FIELD_GET(IWL_RX_PHY_DATA0_EHT_BW320_SLOT,
1633                                 le32_to_cpu(phy_data->d0));
1634
1635         usig->common |= cpu_to_le32
1636                 (FIELD_PREP(IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW, bw));
1637
1638         /* report the AMPDU-EOF bit on single frames */
1639         if (!queue && !(phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
1640                 rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
1641                 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT_KNOWN;
1642                 if (phy_data->d0 & cpu_to_le32(IWL_RX_PHY_DATA0_EHT_DELIM_EOF))
1643                         rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT;
1644         }
1645
1646         /* update aggregation data for monitor sake on default queue */
1647         if (!queue && (phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD) &&
1648             (phy_info & IWL_RX_MPDU_PHY_AMPDU) && phy_data->first_subframe) {
1649                 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT_KNOWN;
1650                 if (phy_data->d0 & cpu_to_le32(IWL_RX_PHY_DATA0_EHT_DELIM_EOF))
1651                         rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT;
1652         }
1653
1654         if (phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD)
1655                 iwl_mvm_decode_eht_phy_data(mvm, phy_data, rx_status, eht, usig);
1656
1657 #define CHECK_TYPE(F)                                                   \
1658         BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA1_FORMAT_ ## F !=        \
1659                      (RATE_MCS_HE_TYPE_ ## F >> RATE_MCS_HE_TYPE_POS))
1660
1661         CHECK_TYPE(SU);
1662         CHECK_TYPE(EXT_SU);
1663         CHECK_TYPE(MU);
1664         CHECK_TYPE(TRIG);
1665
1666         switch (FIELD_GET(RATE_MCS_HE_GI_LTF_MSK, rate_n_flags)) {
1667         case 0:
1668                 if (he_type == RATE_MCS_HE_TYPE_TRIG) {
1669                         rx_status->eht.gi = NL80211_RATE_INFO_EHT_GI_1_6;
1670                         ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_1X;
1671                 } else {
1672                         rx_status->eht.gi = NL80211_RATE_INFO_EHT_GI_0_8;
1673                         ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_2X;
1674                 }
1675                 break;
1676         case 1:
1677                 rx_status->eht.gi = NL80211_RATE_INFO_EHT_GI_1_6;
1678                 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_2X;
1679                 break;
1680         case 2:
1681                 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1682                 if (he_type == RATE_MCS_HE_TYPE_TRIG)
1683                         rx_status->eht.gi = NL80211_RATE_INFO_EHT_GI_3_2;
1684                 else
1685                         rx_status->eht.gi = NL80211_RATE_INFO_EHT_GI_0_8;
1686                 break;
1687         case 3:
1688                 if (he_type != RATE_MCS_HE_TYPE_TRIG) {
1689                         ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1690                         rx_status->eht.gi = NL80211_RATE_INFO_EHT_GI_3_2;
1691                 }
1692                 break;
1693         default:
1694                 /* nothing here */
1695                 break;
1696         }
1697
1698         if (ltf != IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_UNKNOWN) {
1699                 eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_GI);
1700                 eht->data[0] |= cpu_to_le32
1701                         (FIELD_PREP(IEEE80211_RADIOTAP_EHT_DATA0_LTF,
1702                                     ltf) |
1703                          FIELD_PREP(IEEE80211_RADIOTAP_EHT_DATA0_GI,
1704                                     rx_status->eht.gi));
1705         }
1706
1707
1708         if (!phy_data->with_data) {
1709                 eht->known |= cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_NSS_S |
1710                                           IEEE80211_RADIOTAP_EHT_KNOWN_BEAMFORMED_S);
1711                 eht->data[7] |=
1712                         le32_encode_bits(le32_get_bits(phy_data->rx_vec[2],
1713                                                        RX_NO_DATA_RX_VEC2_EHT_NSTS_MSK),
1714                                          IEEE80211_RADIOTAP_EHT_DATA7_NSS_S);
1715                 if (rate_n_flags & RATE_MCS_BF_MSK)
1716                         eht->data[7] |=
1717                                 cpu_to_le32(IEEE80211_RADIOTAP_EHT_DATA7_BEAMFORMED_S);
1718         } else {
1719                 eht->user_info[0] |=
1720                         cpu_to_le32(IEEE80211_RADIOTAP_EHT_USER_INFO_MCS_KNOWN |
1721                                     IEEE80211_RADIOTAP_EHT_USER_INFO_CODING_KNOWN |
1722                                     IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_KNOWN_O |
1723                                     IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING_KNOWN_O |
1724                                     IEEE80211_RADIOTAP_EHT_USER_INFO_DATA_FOR_USER);
1725
1726                 if (rate_n_flags & RATE_MCS_BF_MSK)
1727                         eht->user_info[0] |=
1728                                 cpu_to_le32(IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING_O);
1729
1730                 if (rate_n_flags & RATE_MCS_LDPC_MSK)
1731                         eht->user_info[0] |=
1732                                 cpu_to_le32(IEEE80211_RADIOTAP_EHT_USER_INFO_CODING);
1733
1734                 eht->user_info[0] |= cpu_to_le32
1735                         (FIELD_PREP(IEEE80211_RADIOTAP_EHT_USER_INFO_MCS,
1736                                     FIELD_GET(RATE_VHT_MCS_RATE_CODE_MSK,
1737                                               rate_n_flags)) |
1738                          FIELD_PREP(IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_O,
1739                                     FIELD_GET(RATE_MCS_NSS_MSK, rate_n_flags)));
1740         }
1741 }
1742
1743 static void iwl_mvm_rx_he(struct iwl_mvm *mvm, struct sk_buff *skb,
1744                           struct iwl_mvm_rx_phy_data *phy_data,
1745                           int queue)
1746 {
1747         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
1748         struct ieee80211_radiotap_he *he = NULL;
1749         struct ieee80211_radiotap_he_mu *he_mu = NULL;
1750         u32 rate_n_flags = phy_data->rate_n_flags;
1751         u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK;
1752         u8 ltf;
1753         static const struct ieee80211_radiotap_he known = {
1754                 .data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
1755                                      IEEE80211_RADIOTAP_HE_DATA1_DATA_DCM_KNOWN |
1756                                      IEEE80211_RADIOTAP_HE_DATA1_STBC_KNOWN |
1757                                      IEEE80211_RADIOTAP_HE_DATA1_CODING_KNOWN),
1758                 .data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN |
1759                                      IEEE80211_RADIOTAP_HE_DATA2_TXBF_KNOWN),
1760         };
1761         static const struct ieee80211_radiotap_he_mu mu_known = {
1762                 .flags1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_MCS_KNOWN |
1763                                       IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_DCM_KNOWN |
1764                                       IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_SYMS_USERS_KNOWN |
1765                                       IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_COMP_KNOWN),
1766                 .flags2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW_KNOWN |
1767                                       IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_KNOWN),
1768         };
1769         u16 phy_info = phy_data->phy_info;
1770
1771         he = skb_put_data(skb, &known, sizeof(known));
1772         rx_status->flag |= RX_FLAG_RADIOTAP_HE;
1773
1774         if (phy_data->info_type == IWL_RX_PHY_INFO_TYPE_HE_MU ||
1775             phy_data->info_type == IWL_RX_PHY_INFO_TYPE_HE_MU_EXT) {
1776                 he_mu = skb_put_data(skb, &mu_known, sizeof(mu_known));
1777                 rx_status->flag |= RX_FLAG_RADIOTAP_HE_MU;
1778         }
1779
1780         /* report the AMPDU-EOF bit on single frames */
1781         if (!queue && !(phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
1782                 rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
1783                 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT_KNOWN;
1784                 if (phy_data->d0 & cpu_to_le32(IWL_RX_PHY_DATA0_HE_DELIM_EOF))
1785                         rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT;
1786         }
1787
1788         if (phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD)
1789                 iwl_mvm_decode_he_phy_data(mvm, phy_data, he, he_mu, rx_status,
1790                                            queue);
1791
1792         /* update aggregation data for monitor sake on default queue */
1793         if (!queue && (phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD) &&
1794             (phy_info & IWL_RX_MPDU_PHY_AMPDU) && phy_data->first_subframe) {
1795                 rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT_KNOWN;
1796                 if (phy_data->d0 & cpu_to_le32(IWL_RX_PHY_DATA0_EHT_DELIM_EOF))
1797                         rx_status->flag |= RX_FLAG_AMPDU_EOF_BIT;
1798         }
1799
1800         if (he_type == RATE_MCS_HE_TYPE_EXT_SU &&
1801             rate_n_flags & RATE_MCS_HE_106T_MSK) {
1802                 rx_status->bw = RATE_INFO_BW_HE_RU;
1803                 rx_status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_106;
1804         }
1805
1806         /* actually data is filled in mac80211 */
1807         if (he_type == RATE_MCS_HE_TYPE_SU ||
1808             he_type == RATE_MCS_HE_TYPE_EXT_SU)
1809                 he->data1 |=
1810                         cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN);
1811
1812 #define CHECK_TYPE(F)                                                   \
1813         BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA1_FORMAT_ ## F !=        \
1814                      (RATE_MCS_HE_TYPE_ ## F >> RATE_MCS_HE_TYPE_POS))
1815
1816         CHECK_TYPE(SU);
1817         CHECK_TYPE(EXT_SU);
1818         CHECK_TYPE(MU);
1819         CHECK_TYPE(TRIG);
1820
1821         he->data1 |= cpu_to_le16(he_type >> RATE_MCS_HE_TYPE_POS);
1822
1823         if (rate_n_flags & RATE_MCS_BF_MSK)
1824                 he->data5 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA5_TXBF);
1825
1826         switch ((rate_n_flags & RATE_MCS_HE_GI_LTF_MSK) >>
1827                 RATE_MCS_HE_GI_LTF_POS) {
1828         case 0:
1829                 if (he_type == RATE_MCS_HE_TYPE_TRIG)
1830                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
1831                 else
1832                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1833                 if (he_type == RATE_MCS_HE_TYPE_MU)
1834                         ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1835                 else
1836                         ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_1X;
1837                 break;
1838         case 1:
1839                 if (he_type == RATE_MCS_HE_TYPE_TRIG)
1840                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
1841                 else
1842                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1843                 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_2X;
1844                 break;
1845         case 2:
1846                 if (he_type == RATE_MCS_HE_TYPE_TRIG) {
1847                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
1848                         ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1849                 } else {
1850                         rx_status->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
1851                         ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_2X;
1852                 }
1853                 break;
1854         case 3:
1855                 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
1856                 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1857                 break;
1858         case 4:
1859                 rx_status->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
1860                 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X;
1861                 break;
1862         default:
1863                 ltf = IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_UNKNOWN;
1864         }
1865
1866         he->data5 |= le16_encode_bits(ltf,
1867                                       IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE);
1868 }
1869
1870 static void iwl_mvm_decode_lsig(struct sk_buff *skb,
1871                                 struct iwl_mvm_rx_phy_data *phy_data)
1872 {
1873         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
1874         struct ieee80211_radiotap_lsig *lsig;
1875
1876         switch (phy_data->info_type) {
1877         case IWL_RX_PHY_INFO_TYPE_HT:
1878         case IWL_RX_PHY_INFO_TYPE_VHT_SU:
1879         case IWL_RX_PHY_INFO_TYPE_VHT_MU:
1880         case IWL_RX_PHY_INFO_TYPE_HE_TB_EXT:
1881         case IWL_RX_PHY_INFO_TYPE_HE_SU:
1882         case IWL_RX_PHY_INFO_TYPE_HE_MU:
1883         case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
1884         case IWL_RX_PHY_INFO_TYPE_HE_TB:
1885         case IWL_RX_PHY_INFO_TYPE_EHT_MU:
1886         case IWL_RX_PHY_INFO_TYPE_EHT_TB:
1887         case IWL_RX_PHY_INFO_TYPE_EHT_MU_EXT:
1888         case IWL_RX_PHY_INFO_TYPE_EHT_TB_EXT:
1889                 lsig = skb_put(skb, sizeof(*lsig));
1890                 lsig->data1 = cpu_to_le16(IEEE80211_RADIOTAP_LSIG_DATA1_LENGTH_KNOWN);
1891                 lsig->data2 = le16_encode_bits(le32_get_bits(phy_data->d1,
1892                                                              IWL_RX_PHY_DATA1_LSIG_LEN_MASK),
1893                                                IEEE80211_RADIOTAP_LSIG_DATA2_LENGTH);
1894                 rx_status->flag |= RX_FLAG_RADIOTAP_LSIG;
1895                 break;
1896         default:
1897                 break;
1898         }
1899 }
1900
1901 static inline u8 iwl_mvm_nl80211_band_from_rx_msdu(u8 phy_band)
1902 {
1903         switch (phy_band) {
1904         case PHY_BAND_24:
1905                 return NL80211_BAND_2GHZ;
1906         case PHY_BAND_5:
1907                 return NL80211_BAND_5GHZ;
1908         case PHY_BAND_6:
1909                 return NL80211_BAND_6GHZ;
1910         default:
1911                 WARN_ONCE(1, "Unsupported phy band (%u)\n", phy_band);
1912                 return NL80211_BAND_5GHZ;
1913         }
1914 }
1915
1916 struct iwl_rx_sta_csa {
1917         bool all_sta_unblocked;
1918         struct ieee80211_vif *vif;
1919 };
1920
1921 static void iwl_mvm_rx_get_sta_block_tx(void *data, struct ieee80211_sta *sta)
1922 {
1923         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1924         struct iwl_rx_sta_csa *rx_sta_csa = data;
1925
1926         if (mvmsta->vif != rx_sta_csa->vif)
1927                 return;
1928
1929         if (mvmsta->disable_tx)
1930                 rx_sta_csa->all_sta_unblocked = false;
1931 }
1932
1933 /*
1934  * Note: requires also rx_status->band to be prefilled, as well
1935  * as phy_data (apart from phy_data->info_type)
1936  */
1937 static void iwl_mvm_rx_fill_status(struct iwl_mvm *mvm,
1938                                    struct sk_buff *skb,
1939                                    struct iwl_mvm_rx_phy_data *phy_data,
1940                                    int queue)
1941 {
1942         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
1943         u32 rate_n_flags = phy_data->rate_n_flags;
1944         u8 stbc = u32_get_bits(rate_n_flags, RATE_MCS_STBC_MSK);
1945         u32 format = rate_n_flags & RATE_MCS_MOD_TYPE_MSK;
1946         bool is_sgi;
1947
1948         phy_data->info_type = IWL_RX_PHY_INFO_TYPE_NONE;
1949
1950         if (phy_data->phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD)
1951                 phy_data->info_type =
1952                         le32_get_bits(phy_data->d1,
1953                                       IWL_RX_PHY_DATA1_INFO_TYPE_MASK);
1954
1955         /* This may be overridden by iwl_mvm_rx_he() to HE_RU */
1956         switch (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK) {
1957         case RATE_MCS_CHAN_WIDTH_20:
1958                 break;
1959         case RATE_MCS_CHAN_WIDTH_40:
1960                 rx_status->bw = RATE_INFO_BW_40;
1961                 break;
1962         case RATE_MCS_CHAN_WIDTH_80:
1963                 rx_status->bw = RATE_INFO_BW_80;
1964                 break;
1965         case RATE_MCS_CHAN_WIDTH_160:
1966                 rx_status->bw = RATE_INFO_BW_160;
1967                 break;
1968         case RATE_MCS_CHAN_WIDTH_320:
1969                 rx_status->bw = RATE_INFO_BW_320;
1970                 break;
1971         }
1972
1973         /* must be before L-SIG data */
1974         if (format == RATE_MCS_HE_MSK)
1975                 iwl_mvm_rx_he(mvm, skb, phy_data, queue);
1976
1977         iwl_mvm_decode_lsig(skb, phy_data);
1978
1979         rx_status->device_timestamp = phy_data->gp2_on_air_rise;
1980         rx_status->freq = ieee80211_channel_to_frequency(phy_data->channel,
1981                                                          rx_status->band);
1982         iwl_mvm_get_signal_strength(mvm, rx_status, rate_n_flags,
1983                                     phy_data->energy_a, phy_data->energy_b);
1984
1985         /* using TLV format and must be after all fixed len fields */
1986         if (format == RATE_MCS_EHT_MSK)
1987                 iwl_mvm_rx_eht(mvm, skb, phy_data, queue);
1988
1989         if (unlikely(mvm->monitor_on))
1990                 iwl_mvm_add_rtap_sniffer_config(mvm, skb);
1991
1992         is_sgi = format == RATE_MCS_HE_MSK ?
1993                 iwl_he_is_sgi(rate_n_flags) :
1994                 rate_n_flags & RATE_MCS_SGI_MSK;
1995
1996         if (!(format == RATE_MCS_CCK_MSK) && is_sgi)
1997                 rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
1998
1999         if (rate_n_flags & RATE_MCS_LDPC_MSK)
2000                 rx_status->enc_flags |= RX_ENC_FLAG_LDPC;
2001
2002         switch (format) {
2003         case RATE_MCS_VHT_MSK:
2004                 rx_status->encoding = RX_ENC_VHT;
2005                 break;
2006         case RATE_MCS_HE_MSK:
2007                 rx_status->encoding = RX_ENC_HE;
2008                 rx_status->he_dcm =
2009                         !!(rate_n_flags & RATE_HE_DUAL_CARRIER_MODE_MSK);
2010                 break;
2011         case RATE_MCS_EHT_MSK:
2012                 rx_status->encoding = RX_ENC_EHT;
2013                 break;
2014         }
2015
2016         switch (format) {
2017         case RATE_MCS_HT_MSK:
2018                 rx_status->encoding = RX_ENC_HT;
2019                 rx_status->rate_idx = RATE_HT_MCS_INDEX(rate_n_flags);
2020                 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
2021                 break;
2022         case RATE_MCS_VHT_MSK:
2023         case RATE_MCS_HE_MSK:
2024         case RATE_MCS_EHT_MSK:
2025                 rx_status->nss =
2026                         u32_get_bits(rate_n_flags, RATE_MCS_NSS_MSK) + 1;
2027                 rx_status->rate_idx = rate_n_flags & RATE_MCS_CODE_MSK;
2028                 rx_status->enc_flags |= stbc << RX_ENC_FLAG_STBC_SHIFT;
2029                 break;
2030         default: {
2031                 int rate = iwl_mvm_legacy_hw_idx_to_mac80211_idx(rate_n_flags,
2032                                                                  rx_status->band);
2033
2034                 rx_status->rate_idx = rate;
2035
2036                 if ((rate < 0 || rate > 0xFF)) {
2037                         rx_status->rate_idx = 0;
2038                         if (net_ratelimit())
2039                                 IWL_ERR(mvm, "Invalid rate flags 0x%x, band %d,\n",
2040                                         rate_n_flags, rx_status->band);
2041                 }
2042
2043                 break;
2044                 }
2045         }
2046 }
2047
2048 void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
2049                         struct iwl_rx_cmd_buffer *rxb, int queue)
2050 {
2051         struct ieee80211_rx_status *rx_status;
2052         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2053         struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
2054         struct ieee80211_hdr *hdr;
2055         u32 len;
2056         u32 pkt_len = iwl_rx_packet_payload_len(pkt);
2057         struct ieee80211_sta *sta = NULL;
2058         struct ieee80211_link_sta *link_sta = NULL;
2059         struct sk_buff *skb;
2060         u8 crypt_len = 0;
2061         size_t desc_size;
2062         struct iwl_mvm_rx_phy_data phy_data = {};
2063         u32 format;
2064
2065         if (unlikely(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)))
2066                 return;
2067
2068         if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
2069                 desc_size = sizeof(*desc);
2070         else
2071                 desc_size = IWL_RX_DESC_SIZE_V1;
2072
2073         if (unlikely(pkt_len < desc_size)) {
2074                 IWL_DEBUG_DROP(mvm, "Bad REPLY_RX_MPDU_CMD size\n");
2075                 return;
2076         }
2077
2078         if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210) {
2079                 phy_data.rate_n_flags = le32_to_cpu(desc->v3.rate_n_flags);
2080                 phy_data.channel = desc->v3.channel;
2081                 phy_data.gp2_on_air_rise = le32_to_cpu(desc->v3.gp2_on_air_rise);
2082                 phy_data.energy_a = desc->v3.energy_a;
2083                 phy_data.energy_b = desc->v3.energy_b;
2084
2085                 phy_data.d0 = desc->v3.phy_data0;
2086                 phy_data.d1 = desc->v3.phy_data1;
2087                 phy_data.d2 = desc->v3.phy_data2;
2088                 phy_data.d3 = desc->v3.phy_data3;
2089                 phy_data.eht_d4 = desc->phy_eht_data4;
2090                 phy_data.d5 = desc->v3.phy_data5;
2091         } else {
2092                 phy_data.rate_n_flags = le32_to_cpu(desc->v1.rate_n_flags);
2093                 phy_data.channel = desc->v1.channel;
2094                 phy_data.gp2_on_air_rise = le32_to_cpu(desc->v1.gp2_on_air_rise);
2095                 phy_data.energy_a = desc->v1.energy_a;
2096                 phy_data.energy_b = desc->v1.energy_b;
2097
2098                 phy_data.d0 = desc->v1.phy_data0;
2099                 phy_data.d1 = desc->v1.phy_data1;
2100                 phy_data.d2 = desc->v1.phy_data2;
2101                 phy_data.d3 = desc->v1.phy_data3;
2102         }
2103
2104         if (iwl_fw_lookup_notif_ver(mvm->fw, LEGACY_GROUP,
2105                                     REPLY_RX_MPDU_CMD, 0) < 4) {
2106                 phy_data.rate_n_flags = iwl_new_rate_from_v1(phy_data.rate_n_flags);
2107                 IWL_DEBUG_DROP(mvm, "Got old format rate, converting. New rate: 0x%x\n",
2108                                phy_data.rate_n_flags);
2109         }
2110
2111         format = phy_data.rate_n_flags & RATE_MCS_MOD_TYPE_MSK;
2112
2113         len = le16_to_cpu(desc->mpdu_len);
2114
2115         if (unlikely(len + desc_size > pkt_len)) {
2116                 IWL_DEBUG_DROP(mvm, "FW lied about packet len\n");
2117                 return;
2118         }
2119
2120         phy_data.with_data = true;
2121         phy_data.phy_info = le16_to_cpu(desc->phy_info);
2122         phy_data.d4 = desc->phy_data4;
2123
2124         hdr = (void *)(pkt->data + desc_size);
2125         /* Dont use dev_alloc_skb(), we'll have enough headroom once
2126          * ieee80211_hdr pulled.
2127          */
2128         skb = alloc_skb(128, GFP_ATOMIC);
2129         if (!skb) {
2130                 IWL_ERR(mvm, "alloc_skb failed\n");
2131                 return;
2132         }
2133
2134         if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) {
2135                 /*
2136                  * If the device inserted padding it means that (it thought)
2137                  * the 802.11 header wasn't a multiple of 4 bytes long. In
2138                  * this case, reserve two bytes at the start of the SKB to
2139                  * align the payload properly in case we end up copying it.
2140                  */
2141                 skb_reserve(skb, 2);
2142         }
2143
2144         rx_status = IEEE80211_SKB_RXCB(skb);
2145
2146         /*
2147          * Keep packets with CRC errors (and with overrun) for monitor mode
2148          * (otherwise the firmware discards them) but mark them as bad.
2149          */
2150         if (!(desc->status & cpu_to_le32(IWL_RX_MPDU_STATUS_CRC_OK)) ||
2151             !(desc->status & cpu_to_le32(IWL_RX_MPDU_STATUS_OVERRUN_OK))) {
2152                 IWL_DEBUG_RX(mvm, "Bad CRC or FIFO: 0x%08X.\n",
2153                              le32_to_cpu(desc->status));
2154                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
2155         }
2156
2157         /* set the preamble flag if appropriate */
2158         if (format == RATE_MCS_CCK_MSK &&
2159             phy_data.phy_info & IWL_RX_MPDU_PHY_SHORT_PREAMBLE)
2160                 rx_status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
2161
2162         if (likely(!(phy_data.phy_info & IWL_RX_MPDU_PHY_TSF_OVERLOAD))) {
2163                 u64 tsf_on_air_rise;
2164
2165                 if (mvm->trans->trans_cfg->device_family >=
2166                     IWL_DEVICE_FAMILY_AX210)
2167                         tsf_on_air_rise = le64_to_cpu(desc->v3.tsf_on_air_rise);
2168                 else
2169                         tsf_on_air_rise = le64_to_cpu(desc->v1.tsf_on_air_rise);
2170
2171                 rx_status->mactime = tsf_on_air_rise;
2172                 /* TSF as indicated by the firmware is at INA time */
2173                 rx_status->flag |= RX_FLAG_MACTIME_PLCP_START;
2174         }
2175
2176         if (iwl_mvm_is_band_in_rx_supported(mvm)) {
2177                 u8 band = BAND_IN_RX_STATUS(desc->mac_phy_idx);
2178
2179                 rx_status->band = iwl_mvm_nl80211_band_from_rx_msdu(band);
2180         } else {
2181                 rx_status->band = phy_data.channel > 14 ? NL80211_BAND_5GHZ :
2182                         NL80211_BAND_2GHZ;
2183         }
2184
2185         /* update aggregation data for monitor sake on default queue */
2186         if (!queue && (phy_data.phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
2187                 bool toggle_bit;
2188
2189                 toggle_bit = phy_data.phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE;
2190                 rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
2191                 /*
2192                  * Toggle is switched whenever new aggregation starts. Make
2193                  * sure ampdu_reference is never 0 so we can later use it to
2194                  * see if the frame was really part of an A-MPDU or not.
2195                  */
2196                 if (toggle_bit != mvm->ampdu_toggle) {
2197                         mvm->ampdu_ref++;
2198                         if (mvm->ampdu_ref == 0)
2199                                 mvm->ampdu_ref++;
2200                         mvm->ampdu_toggle = toggle_bit;
2201                         phy_data.first_subframe = true;
2202                 }
2203                 rx_status->ampdu_reference = mvm->ampdu_ref;
2204         }
2205
2206         rcu_read_lock();
2207
2208         if (desc->status & cpu_to_le32(IWL_RX_MPDU_STATUS_SRC_STA_FOUND)) {
2209                 u8 id = le32_get_bits(desc->status, IWL_RX_MPDU_STATUS_STA_ID);
2210
2211                 if (!WARN_ON_ONCE(id >= mvm->fw->ucode_capa.num_stations)) {
2212                         sta = rcu_dereference(mvm->fw_id_to_mac_id[id]);
2213                         if (IS_ERR(sta))
2214                                 sta = NULL;
2215                         link_sta = rcu_dereference(mvm->fw_id_to_link_sta[id]);
2216                 }
2217         } else if (!is_multicast_ether_addr(hdr->addr2)) {
2218                 /*
2219                  * This is fine since we prevent two stations with the same
2220                  * address from being added.
2221                  */
2222                 sta = ieee80211_find_sta_by_ifaddr(mvm->hw, hdr->addr2, NULL);
2223         }
2224
2225         if (iwl_mvm_rx_crypto(mvm, sta, hdr, rx_status, phy_data.phy_info, desc,
2226                               le32_to_cpu(pkt->len_n_flags), queue,
2227                               &crypt_len)) {
2228                 kfree_skb(skb);
2229                 goto out;
2230         }
2231
2232         iwl_mvm_rx_fill_status(mvm, skb, &phy_data, queue);
2233
2234         if (sta) {
2235                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2236                 struct ieee80211_vif *tx_blocked_vif =
2237                         rcu_dereference(mvm->csa_tx_blocked_vif);
2238                 u8 baid = (u8)((le32_to_cpu(desc->reorder_data) &
2239                                IWL_RX_MPDU_REORDER_BAID_MASK) >>
2240                                IWL_RX_MPDU_REORDER_BAID_SHIFT);
2241                 struct iwl_fw_dbg_trigger_tlv *trig;
2242                 struct ieee80211_vif *vif = mvmsta->vif;
2243
2244                 if (!mvm->tcm.paused && len >= sizeof(*hdr) &&
2245                     !is_multicast_ether_addr(hdr->addr1) &&
2246                     ieee80211_is_data(hdr->frame_control) &&
2247                     time_after(jiffies, mvm->tcm.ts + MVM_TCM_PERIOD))
2248                         schedule_delayed_work(&mvm->tcm.work, 0);
2249
2250                 /*
2251                  * We have tx blocked stations (with CS bit). If we heard
2252                  * frames from a blocked station on a new channel we can
2253                  * TX to it again.
2254                  */
2255                 if (unlikely(tx_blocked_vif) && tx_blocked_vif == vif) {
2256                         struct iwl_mvm_vif *mvmvif =
2257                                 iwl_mvm_vif_from_mac80211(tx_blocked_vif);
2258                         struct iwl_rx_sta_csa rx_sta_csa = {
2259                                 .all_sta_unblocked = true,
2260                                 .vif = tx_blocked_vif,
2261                         };
2262
2263                         if (mvmvif->csa_target_freq == rx_status->freq)
2264                                 iwl_mvm_sta_modify_disable_tx_ap(mvm, sta,
2265                                                                  false);
2266                         ieee80211_iterate_stations_atomic(mvm->hw,
2267                                                           iwl_mvm_rx_get_sta_block_tx,
2268                                                           &rx_sta_csa);
2269
2270                         if (rx_sta_csa.all_sta_unblocked) {
2271                                 RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2272                                 /* Unblock BCAST / MCAST station */
2273                                 iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, false);
2274                                 cancel_delayed_work(&mvm->cs_tx_unblock_dwork);
2275                         }
2276                 }
2277
2278                 rs_update_last_rssi(mvm, mvmsta, rx_status);
2279
2280                 trig = iwl_fw_dbg_trigger_on(&mvm->fwrt,
2281                                              ieee80211_vif_to_wdev(vif),
2282                                              FW_DBG_TRIGGER_RSSI);
2283
2284                 if (trig && ieee80211_is_beacon(hdr->frame_control)) {
2285                         struct iwl_fw_dbg_trigger_low_rssi *rssi_trig;
2286                         s32 rssi;
2287
2288                         rssi_trig = (void *)trig->data;
2289                         rssi = le32_to_cpu(rssi_trig->rssi);
2290
2291                         if (rx_status->signal < rssi)
2292                                 iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2293                                                         NULL);
2294                 }
2295
2296                 if (ieee80211_is_data(hdr->frame_control))
2297                         iwl_mvm_rx_csum(mvm, sta, skb, pkt);
2298
2299                 if (iwl_mvm_is_dup(sta, queue, rx_status, hdr, desc)) {
2300                         IWL_DEBUG_DROP(mvm, "Dropping duplicate packet 0x%x\n",
2301                                        le16_to_cpu(hdr->seq_ctrl));
2302                         kfree_skb(skb);
2303                         goto out;
2304                 }
2305
2306                 /*
2307                  * Our hardware de-aggregates AMSDUs but copies the mac header
2308                  * as it to the de-aggregated MPDUs. We need to turn off the
2309                  * AMSDU bit in the QoS control ourselves.
2310                  * In addition, HW reverses addr3 and addr4 - reverse it back.
2311                  */
2312                 if ((desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU) &&
2313                     !WARN_ON(!ieee80211_is_data_qos(hdr->frame_control))) {
2314                         u8 *qc = ieee80211_get_qos_ctl(hdr);
2315
2316                         *qc &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
2317
2318                         if (mvm->trans->trans_cfg->device_family ==
2319                             IWL_DEVICE_FAMILY_9000) {
2320                                 iwl_mvm_flip_address(hdr->addr3);
2321
2322                                 if (ieee80211_has_a4(hdr->frame_control))
2323                                         iwl_mvm_flip_address(hdr->addr4);
2324                         }
2325                 }
2326                 if (baid != IWL_RX_REORDER_DATA_INVALID_BAID) {
2327                         u32 reorder_data = le32_to_cpu(desc->reorder_data);
2328
2329                         iwl_mvm_agg_rx_received(mvm, reorder_data, baid);
2330                 }
2331         }
2332
2333         /* management stuff on default queue */
2334         if (!queue) {
2335                 if (unlikely((ieee80211_is_beacon(hdr->frame_control) ||
2336                               ieee80211_is_probe_resp(hdr->frame_control)) &&
2337                              mvm->sched_scan_pass_all ==
2338                              SCHED_SCAN_PASS_ALL_ENABLED))
2339                         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_FOUND;
2340
2341                 if (unlikely(ieee80211_is_beacon(hdr->frame_control) ||
2342                              ieee80211_is_probe_resp(hdr->frame_control)))
2343                         rx_status->boottime_ns = ktime_get_boottime_ns();
2344         }
2345
2346         if (iwl_mvm_create_skb(mvm, skb, hdr, len, crypt_len, rxb)) {
2347                 kfree_skb(skb);
2348                 goto out;
2349         }
2350
2351         if (!iwl_mvm_reorder(mvm, napi, queue, sta, skb, desc) &&
2352             likely(!iwl_mvm_time_sync_frame(mvm, skb, hdr->addr2)) &&
2353             likely(!iwl_mvm_mei_filter_scan(mvm, skb))) {
2354                 if (mvm->trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_9000 &&
2355                     (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU) &&
2356                     !(desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME))
2357                         rx_status->flag |= RX_FLAG_AMSDU_MORE;
2358
2359                 iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta,
2360                                                 link_sta);
2361         }
2362 out:
2363         rcu_read_unlock();
2364 }
2365
2366 void iwl_mvm_rx_monitor_no_data(struct iwl_mvm *mvm, struct napi_struct *napi,
2367                                 struct iwl_rx_cmd_buffer *rxb, int queue)
2368 {
2369         struct ieee80211_rx_status *rx_status;
2370         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2371         struct iwl_rx_no_data_ver_3 *desc = (void *)pkt->data;
2372         u32 rssi;
2373         u32 info_type;
2374         struct ieee80211_sta *sta = NULL;
2375         struct sk_buff *skb;
2376         struct iwl_mvm_rx_phy_data phy_data;
2377         u32 format;
2378
2379         if (unlikely(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)))
2380                 return;
2381
2382         if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(struct iwl_rx_no_data)))
2383                 return;
2384
2385         rssi = le32_to_cpu(desc->rssi);
2386         info_type = le32_to_cpu(desc->info) & RX_NO_DATA_INFO_TYPE_MSK;
2387         phy_data.d0 = desc->phy_info[0];
2388         phy_data.d1 = desc->phy_info[1];
2389         phy_data.phy_info = IWL_RX_MPDU_PHY_TSF_OVERLOAD;
2390         phy_data.gp2_on_air_rise = le32_to_cpu(desc->on_air_rise_time);
2391         phy_data.rate_n_flags = le32_to_cpu(desc->rate);
2392         phy_data.energy_a = u32_get_bits(rssi, RX_NO_DATA_CHAIN_A_MSK);
2393         phy_data.energy_b = u32_get_bits(rssi, RX_NO_DATA_CHAIN_B_MSK);
2394         phy_data.channel = u32_get_bits(rssi, RX_NO_DATA_CHANNEL_MSK);
2395         phy_data.with_data = false;
2396         phy_data.rx_vec[0] = desc->rx_vec[0];
2397         phy_data.rx_vec[1] = desc->rx_vec[1];
2398
2399         if (iwl_fw_lookup_notif_ver(mvm->fw, DATA_PATH_GROUP,
2400                                     RX_NO_DATA_NOTIF, 0) < 2) {
2401                 IWL_DEBUG_DROP(mvm, "Got an old rate format. Old rate: 0x%x\n",
2402                                phy_data.rate_n_flags);
2403                 phy_data.rate_n_flags = iwl_new_rate_from_v1(phy_data.rate_n_flags);
2404                 IWL_DEBUG_DROP(mvm, " Rate after conversion to the new format: 0x%x\n",
2405                                phy_data.rate_n_flags);
2406         }
2407
2408         format = phy_data.rate_n_flags & RATE_MCS_MOD_TYPE_MSK;
2409
2410         if (iwl_fw_lookup_notif_ver(mvm->fw, DATA_PATH_GROUP,
2411                                     RX_NO_DATA_NOTIF, 0) >= 3) {
2412                 if (unlikely(iwl_rx_packet_payload_len(pkt) <
2413                     sizeof(struct iwl_rx_no_data_ver_3)))
2414                 /* invalid len for ver 3 */
2415                         return;
2416                 phy_data.rx_vec[2] = desc->rx_vec[2];
2417                 phy_data.rx_vec[3] = desc->rx_vec[3];
2418         } else {
2419                 if (format == RATE_MCS_EHT_MSK)
2420                         /* no support for EHT before version 3 API */
2421                         return;
2422         }
2423
2424         /* Dont use dev_alloc_skb(), we'll have enough headroom once
2425          * ieee80211_hdr pulled.
2426          */
2427         skb = alloc_skb(128, GFP_ATOMIC);
2428         if (!skb) {
2429                 IWL_ERR(mvm, "alloc_skb failed\n");
2430                 return;
2431         }
2432
2433         rx_status = IEEE80211_SKB_RXCB(skb);
2434
2435         /* 0-length PSDU */
2436         rx_status->flag |= RX_FLAG_NO_PSDU;
2437
2438         switch (info_type) {
2439         case RX_NO_DATA_INFO_TYPE_NDP:
2440                 rx_status->zero_length_psdu_type =
2441                         IEEE80211_RADIOTAP_ZERO_LEN_PSDU_SOUNDING;
2442                 break;
2443         case RX_NO_DATA_INFO_TYPE_MU_UNMATCHED:
2444         case RX_NO_DATA_INFO_TYPE_TB_UNMATCHED:
2445                 rx_status->zero_length_psdu_type =
2446                         IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED;
2447                 break;
2448         default:
2449                 rx_status->zero_length_psdu_type =
2450                         IEEE80211_RADIOTAP_ZERO_LEN_PSDU_VENDOR;
2451                 break;
2452         }
2453
2454         rx_status->band = phy_data.channel > 14 ? NL80211_BAND_5GHZ :
2455                 NL80211_BAND_2GHZ;
2456
2457         iwl_mvm_rx_fill_status(mvm, skb, &phy_data, queue);
2458
2459         /* no more radio tap info should be put after this point.
2460          *
2461          * We mark it as mac header, for upper layers to know where
2462          * all radio tap header ends.
2463          */
2464         skb_reset_mac_header(skb);
2465
2466         /*
2467          * Override the nss from the rx_vec since the rate_n_flags has
2468          * only 2 bits for the nss which gives a max of 4 ss but there
2469          * may be up to 8 spatial streams.
2470          */
2471         switch (format) {
2472         case RATE_MCS_VHT_MSK:
2473                 rx_status->nss =
2474                         le32_get_bits(desc->rx_vec[0],
2475                                       RX_NO_DATA_RX_VEC0_VHT_NSTS_MSK) + 1;
2476                 break;
2477         case RATE_MCS_HE_MSK:
2478                 rx_status->nss =
2479                         le32_get_bits(desc->rx_vec[0],
2480                                       RX_NO_DATA_RX_VEC0_HE_NSTS_MSK) + 1;
2481                 break;
2482         case RATE_MCS_EHT_MSK:
2483                 rx_status->nss =
2484                         le32_get_bits(desc->rx_vec[2],
2485                                       RX_NO_DATA_RX_VEC2_EHT_NSTS_MSK) + 1;
2486         }
2487
2488         rcu_read_lock();
2489         ieee80211_rx_napi(mvm->hw, sta, skb, napi);
2490         rcu_read_unlock();
2491 }
2492
2493 void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
2494                               struct iwl_rx_cmd_buffer *rxb, int queue)
2495 {
2496         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2497         struct iwl_frame_release *release = (void *)pkt->data;
2498
2499         if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release)))
2500                 return;
2501
2502         iwl_mvm_release_frames_from_notif(mvm, napi, release->baid,
2503                                           le16_to_cpu(release->nssn),
2504                                           queue);
2505 }
2506
2507 void iwl_mvm_rx_bar_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
2508                                   struct iwl_rx_cmd_buffer *rxb, int queue)
2509 {
2510         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2511         struct iwl_bar_frame_release *release = (void *)pkt->data;
2512         unsigned int baid = le32_get_bits(release->ba_info,
2513                                           IWL_BAR_FRAME_RELEASE_BAID_MASK);
2514         unsigned int nssn = le32_get_bits(release->ba_info,
2515                                           IWL_BAR_FRAME_RELEASE_NSSN_MASK);
2516         unsigned int sta_id = le32_get_bits(release->sta_tid,
2517                                             IWL_BAR_FRAME_RELEASE_STA_MASK);
2518         unsigned int tid = le32_get_bits(release->sta_tid,
2519                                          IWL_BAR_FRAME_RELEASE_TID_MASK);
2520         struct iwl_mvm_baid_data *baid_data;
2521
2522         if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release)))
2523                 return;
2524
2525         if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID ||
2526                          baid >= ARRAY_SIZE(mvm->baid_map)))
2527                 return;
2528
2529         rcu_read_lock();
2530         baid_data = rcu_dereference(mvm->baid_map[baid]);
2531         if (!baid_data) {
2532                 IWL_DEBUG_RX(mvm,
2533                              "Got valid BAID %d but not allocated, invalid BAR release!\n",
2534                               baid);
2535                 goto out;
2536         }
2537
2538         if (WARN(tid != baid_data->tid || sta_id > IWL_MVM_STATION_COUNT_MAX ||
2539                  !(baid_data->sta_mask & BIT(sta_id)),
2540                  "baid 0x%x is mapped to sta_mask:0x%x tid:%d, but BAR release received for sta:%d tid:%d\n",
2541                  baid, baid_data->sta_mask, baid_data->tid, sta_id,
2542                  tid))
2543                 goto out;
2544
2545         IWL_DEBUG_DROP(mvm, "Received a BAR, expect packet loss: nssn %d\n",
2546                        nssn);
2547
2548         iwl_mvm_release_frames_from_notif(mvm, napi, baid, nssn, queue);
2549 out:
2550         rcu_read_unlock();
2551 }