[RFC PATCH wireless-next 13/17] wifi: bcm4323x: add the receive path

[Ragul Balaji <ragulbaby@gmail.com>]

Add the RX path of the device. RX supports RX aggregation.

Signed-off-by: Ragul Balaji <ragulbaby@gmail.com>
Signed-off-by: Ho Jie Feng <hjf3108@gmail.com>
---
 .../broadcom/brcm80211/bcm4323x/bcm4323x_rx.c | 317 ++++++++++++++++++
 1 file changed, 317 insertions(+)
 create mode 100644 drivers/net/wireless/broadcom/brcm80211/bcm4323x/bcm4323x_rx.c

diff --git a/drivers/net/wireless/broadcom/brcm80211/bcm4323x/bcm4323x_rx.c b/drivers/net/wireless/broadcom/brcm80211/bcm4323x/bcm4323x_rx.c
new file mode 100644
index 000000000..8f5b3e01f
--- /dev/null
+++ b/drivers/net/wireless/broadcom/brcm80211/bcm4323x/bcm4323x_rx.c
@@ -0,0 +1,317 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include "bcm4323x.h"
+
+#define BCM4323X_RPC_PROC_RX 0x51
+#define BCM4323X_RPC_PROC_TX_STATUS 0x52
+#define BCM4323X_RPC_PROC_NOISE_RESULT 0x66
+
+struct bcm4323x_handshake_reply {
+	__le32 version;
+	__le32 state;
+	__le32 chip;
+} __packed;
+
+/* Procedure 0x51 */
+struct bcm4323x_rxhdr {
+	/* The length of the body up to the end of the frame, without its FCS */
+	__le32 length;
+	/* from brcmfmac: struct wlc_d11rxhdr */
+	struct d11rxhdr_le rxhdr;
+	__le32 tsf_l;
+	s8 rssi;
+	u8 reserved0[3];
+	s8 rxpwr0;
+	s8 rxpwr1;
+	u8 reserved1[4];
+} __packed;
+
+/* Procedure 0x66 */
+struct bcm4323x_noise {
+	__le32 channel;
+	__le32 dbm;
+} __packed;
+
+#define BCM4323X_RX_FRAME_OFFSET (sizeof(struct bcm4323x_rxhdr) + D11_PHY_HDR_LEN)
+
+/* Verify the receive frame key slot matches */
+static bool bcm4323x_rx_key_match(struct bcm4323x *dev, struct sk_buff *skb, unsigned int index)
+{
+	const struct ieee80211_hdr *hdr = (void *)skb->data;
+	bool multicast;
+	bool group_slot;
+	const u8 *frame_bssid;
+	struct ieee80211_vif *vif;
+	const u8 *bssid;
+	bool addressed;
+
+	if (ieee80211_get_hdrlen_from_skb(skb) < sizeof(struct ieee80211_hdr_3addr) ||
+	    !ieee80211_has_protected(hdr->frame_control) || index >= BCM4323X_HW_KEYS)
+		return false;
+	/* A group key takes the slot of its key ID, below the pairwise keys. */
+	multicast = is_multicast_ether_addr(hdr->addr1);
+	group_slot = index < BCM4323X_HW_PAIRWISE_BASE;
+	if (multicast != group_slot)
+		return false;
+
+	rcu_read_lock();
+	vif = rcu_dereference(dev->active_vif);
+	if (!vif) {
+		addressed = false;
+	} else if (multicast) {
+		/* An interface type change can repoint it. */
+		bssid = READ_ONCE(vif->bss_conf.bssid);
+		frame_bssid = ieee80211_get_bssid((void *)skb->data, skb->len, vif->type);
+		addressed = frame_bssid && bssid && ether_addr_equal(frame_bssid, bssid);
+	} else {
+		addressed = ether_addr_equal(hdr->addr1, vif->addr);
+	}
+	rcu_read_unlock();
+	if (!addressed)
+		return false;
+
+	/* bcm4323x_set_key() sets the peer before it puts the slot in use. */
+	if (!test_bit_acquire(index, dev->keys))
+		return false;
+	return multicast || ether_addr_equal(hdr->addr2, dev->key_peers[index]);
+}
+
+/* from brcmsmac: prep_mac80211_status */
+static void bcm4323x_set_rx_rate(struct bcm4323x *dev, struct ieee80211_rx_status *status,
+				 const u8 *body, unsigned int frame_offset)
+{
+	const struct bcm4323x_rxhdr *hdr = (const void *)body;
+	const struct ieee80211_supported_band *sband = &dev->bands[status->band];
+	struct d11rxhdr rxh = {
+		.PhyRxStatus_0 = le16_to_cpu(hdr->rxhdr.PhyRxStatus_0),
+		.RxChan = le16_to_cpu(hdr->rxhdr.RxChan),
+	};
+	u8 *plcp = (u8 *)body + frame_offset - D11_PHY_HDR_LEN;
+	unsigned int i;
+	u32 rspec;
+
+	if ((rxh.PhyRxStatus_0 & PRXS0_FT_MASK) == PRXS0_PREN) {
+		if (plcp[0] || plcp[1] || plcp[2])
+			memcpy(dev->rx_ht_plcp, plcp, sizeof(dev->rx_ht_plcp));
+		plcp = dev->rx_ht_plcp;
+	}
+	rspec = brcmu_compute_rspec(&rxh, plcp);
+	if (is_mcs_rate(rspec)) {
+		status->encoding = RX_ENC_HT;
+		status->rate_idx = rspec & RSPEC_RATE_MASK;
+		if (status->rate_idx >= BCM4323X_NUM_MCS)
+			status->rate_idx = 0;
+		if (rspec_is40mhz(rspec))
+			status->bw = RATE_INFO_BW_40;
+		if (rspec_issgi(rspec))
+			status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
+		/* The HT-SIG byte has the STBC field where plcp3_issgi() finds SGI. */
+		status->enc_flags |= rspec_stc(plcp[3] << 16) << RX_ENC_FLAG_STBC_SHIFT;
+		return;
+	}
+	for (i = 0; i < sband->n_bitrates; i++)
+		if (sband->bitrates[i].hw_value == rspec2rate(rspec)) {
+			status->rate_idx = i;
+			break;
+		}
+	if (is_cck_rate(rspec) && (rxh.PhyRxStatus_0 & PRXS0_SHORTH))
+		status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
+}
+
+static unsigned int bcm4323x_rx_frame_offset(const struct bcm4323x_rxhdr *hdr)
+{
+	if (le16_to_cpu(hdr->rxhdr.RxStatus1) & RXS_PBPRES)
+		return BCM4323X_RX_FRAME_OFFSET + sizeof(__le16);
+	return BCM4323X_RX_FRAME_OFFSET;
+}
+
+/* Whether a procedure 0x51 body holds a whole frame, on a channel of the device */
+static bool bcm4323x_rx_valid(struct bcm4323x *dev, const u8 *body, size_t body_length)
+{
+	const struct bcm4323x_rxhdr *hdr = (const void *)body;
+	unsigned int frame_size;
+	unsigned int channel;
+
+	if (body_length < BCM4323X_RX_FRAME_OFFSET + sizeof(__le32))
+		return false;
+	frame_size = le32_to_cpu(hdr->length);
+	if (ALIGN(frame_size + sizeof(__le32), sizeof(__le32)) > body_length ||
+	    frame_size <= bcm4323x_rx_frame_offset(hdr))
+		return false;
+	channel = le16_get_bits(hdr->rxhdr.RxChan, RXS_CHAN_ID_MASK);
+	if (le16_to_cpu(hdr->rxhdr.RxChan) & RXS_CHAN_5G)
+		return channel && dev->chip->has_5ghz && channel <= 196;
+	return channel && channel <= BCM4323X_NUM_2GHZ_CHANNELS;
+}
+
+/*
+ * from brcmsmac: wlc_phy_chanspec_set, which gives the microcode the center of
+ * a 40 MHz channel, while mac80211 expects the control channel
+ *
+ * Returns 0 for a frame received before a switch.
+ */
+static unsigned int bcm4323x_rx_channel(struct bcm4323x *dev, const struct d11rxhdr_le *rxh)
+{
+	unsigned int channel = le16_get_bits(rxh->RxChan, RXS_CHAN_ID_MASK);
+	u16 chanspec;
+
+	if (!(le16_to_cpu(rxh->RxChan) & RXS_CHAN_40))
+		return channel;
+	chanspec = READ_ONCE(dev->chanspec);
+	if (!CHSPEC_IS40(chanspec) || CHSPEC_CHANNEL(chanspec) != channel)
+		return 0;
+	return CHSPEC_CTL_CHAN(chanspec);
+}
+
+/* from brcmsmac: brcms_c_recv, prep_mac80211_status */
+static void bcm4323x_rx_80211(struct bcm4323x *dev, const u8 *body, size_t body_length)
+{
+	const struct bcm4323x_rxhdr *hdr = (const void *)body;
+	const struct d11rxhdr_le *rxh = &hdr->rxhdr;
+	unsigned int frame_offset;
+	unsigned int frame_length;
+	unsigned int rx_status1;
+	unsigned int channel;
+	struct sk_buff *skb;
+	struct ieee80211_rx_status *status;
+
+	if (!READ_ONCE(dev->running))
+		return;
+	if (!bcm4323x_rx_valid(dev, body, body_length)) {
+		dev_dbg_ratelimited(&dev->intf->dev, "malformed procedure 0x51 body (%zu bytes)\n",
+				    body_length);
+		return;
+	}
+	channel = bcm4323x_rx_channel(dev, rxh);
+	if (!channel)
+		return;
+
+	frame_offset = bcm4323x_rx_frame_offset(hdr);
+	frame_length = le32_to_cpu(hdr->length) - frame_offset;
+	/* Aligns the IP header of QoS data, which mac80211 would otherwise move. */
+	skb = dev_alloc_skb(frame_length + 2);
+	if (!skb)
+		return;
+	skb_reserve(skb, 2);
+	skb_put_data(skb, body + frame_offset, frame_length);
+
+	status = IEEE80211_SKB_RXCB(skb);
+	status->band = le16_to_cpu(rxh->RxChan) & RXS_CHAN_5G ? NL80211_BAND_5GHZ :
+								NL80211_BAND_2GHZ;
+	status->freq = ieee80211_channel_to_frequency(channel, status->band);
+	bcm4323x_set_rx_rate(dev, status, body, frame_offset);
+	/* PHY status is valid only on the last subframe of an A-MPDU. */
+	if ((le16_to_cpu(rxh->RxStatus2) & RXS_PHYRXST_VALID) && hdr->rssi < 0) {
+		status->signal = hdr->rssi;
+		status->chains = BCM4323X_ANTENNAS;
+		status->chain_signal[0] = hdr->rxpwr0;
+		status->chain_signal[1] = hdr->rxpwr1;
+	} else {
+		status->flag |= RX_FLAG_NO_SIGNAL_VAL;
+	}
+	rx_status1 = le16_to_cpu(rxh->RxStatus1);
+	if (rx_status1 & RXS_FCSERR)
+		status->flag |= RX_FLAG_FAILED_FCS_CRC;
+
+	/* Only accept hw decrypted frame if it isn't corrupted */
+	if ((rx_status1 & RXS_DECATMPT) && !(rx_status1 & RXS_DECERR) &&
+	    bcm4323x_rx_key_match(dev, skb, FIELD_GET(RXS_SECKINDX_MASK, rx_status1)))
+		status->flag |= RX_FLAG_DECRYPTED;
+	ieee80211_rx_irqsafe(dev->hw, skb);
+}
+
+static void bcm4323x_handle_handshake_reply(struct bcm4323x *dev, const u8 *body,
+					    size_t body_length)
+{
+	const struct bcm4323x_handshake_reply *reply = (const void *)body;
+
+	dev->handshake_chip = 0;
+	if (body_length == sizeof(*reply) && le32_to_cpu(reply->version) == BCM4323X_RPC_VERSION)
+		dev->handshake_chip = reply->chip;
+	complete(&dev->handshake_done);
+}
+
+static void bcm4323x_rx_noise(struct bcm4323x *dev, const u8 *body, size_t body_length)
+{
+	const struct bcm4323x_noise *noise = (const void *)body;
+	u32 channel;
+	s32 dbm;
+	unsigned int i;
+
+	if (body_length < sizeof(*noise))
+		return;
+	/* Channels above 0x7F are presented as sign-extended */
+	channel = le32_to_cpu(noise->channel) & 0xff;
+	dbm = le32_to_cpu(noise->dbm);
+	if (dbm >= 0 || dbm < S8_MIN)
+		return;
+	for (i = 0; i < BCM4323X_NUM_CHANNELS; i++)
+		if (dev->channels[i].hw_value == channel) {
+			WRITE_ONCE(dev->noise[i], dbm);
+			break;
+		}
+}
+
+static void bcm4323x_handle_runtime_frame(struct bcm4323x *dev, const u8 *frame, size_t length)
+{
+	const struct bcm4323x_rpc_header *rpc = (const void *)frame;
+	u8 rpc_class = FIELD_GET(BCM4323X_RPC_CLASS_MASK, le32_to_cpu(rpc->xid_class));
+	u32 procedure = le32_to_cpu(rpc->procedure);
+	const u8 *body = frame + sizeof(*rpc);
+	size_t body_length = length - sizeof(*rpc);
+
+	if (rpc_class == BCM4323X_RPC_CLASS_TRANSPORT) {
+		if (procedure == BCM4323X_RPC_PROC_VERSION ||
+		    procedure == BCM4323X_RPC_PROC_CHIP_ACK)
+			bcm4323x_handle_handshake_reply(dev, body, body_length);
+	} else if (rpc_class == BCM4323X_RPC_CLASS_DATA) {
+		switch (procedure) {
+		case BCM4323X_RPC_PROC_RX:
+			bcm4323x_rx_80211(dev, body, body_length);
+			break;
+		case BCM4323X_RPC_PROC_TX_STATUS:
+			bcm4323x_tx_status(dev, body, body_length);
+			break;
+		case BCM4323X_RPC_PROC_NOISE_RESULT:
+			bcm4323x_rx_noise(dev, body, body_length);
+			break;
+		}
+	}
+}
+
+void bcm4323x_rx_complete(struct urb *urb)
+{
+	struct bcm4323x *dev = urb->context;
+	u8 *cursor = urb->transfer_buffer;
+	size_t remaining = urb->actual_length;
+	int ret = 0;
+
+	/* Errors on explicit stops don't need an error print */
+	if (urb->status == -ENOENT || urb->status == -ECONNRESET || urb->status == -ESHUTDOWN)
+		return;
+	if (urb->status) {
+		dev_err_ratelimited(&dev->intf->dev, "RX URB failed: %d\n", urb->status);
+		bcm4323x_fatal_error(dev);
+		return;
+	}
+
+	/* RPC frames don't split across transfers */
+	while (remaining) {
+		const struct bcm4323x_rpc_header *rpc = (const void *)cursor;
+		u32 length = remaining < sizeof(*rpc) ? 0 :
+			     le32_to_cpu(rpc->length) + sizeof(rpc->length);
+
+		if (length < sizeof(*rpc) || length > remaining) {
+			dev_warn_ratelimited(&dev->intf->dev, "invalid RX RPC length %u of %zu\n",
+					     length, remaining);
+			break;
+		}
+		bcm4323x_handle_runtime_frame(dev, cursor, length);
+		cursor += length;
+		remaining -= length;
+	}
+	if (!READ_ONCE(dev->dead))
+		ret = usb_submit_urb(urb, GFP_ATOMIC);
+	if (ret && ret != -EPERM)
+		dev_warn_ratelimited(&dev->intf->dev, "RX URB left idle: %d\n", ret);
+}
-- 
2.53.0