drivers/net/wireless/ath/ath10k/htt_rx.c

   1 /*
   2  * Copyright (c) 2005-2011 Atheros Communications Inc.
   3  * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
   4  *
   5  * Permission to use, copy, modify, and/or distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 #include "htc.h"
  19 #include "htt.h"
  20 #include "txrx.h"
  21 #include "debug.h"
  22
  23 #include <linux/log2.h>
  24
  25 /* slightly larger than one large A-MPDU */
  26 #define HTT_RX_RING_SIZE_MIN 128
  27
  28 /* roughly 20 ms @ 1 Gbps of 1500B MSDUs */
  29 #define HTT_RX_RING_SIZE_MAX 2048
  30
  31 #define HTT_RX_AVG_FRM_BYTES 1000
  32
  33 /* ms, very conservative */
  34 #define HTT_RX_HOST_LATENCY_MAX_MS 20
  35
  36 /* ms, conservative */
  37 #define HTT_RX_HOST_LATENCY_WORST_LIKELY_MS 10
  38
  39 /* when under memory pressure rx ring refill may fail and needs a retry */
  40 #define HTT_RX_RING_REFILL_RETRY_MS 50
  41
  42 static int ath10k_htt_rx_ring_size(struct ath10k_htt *htt)
  43 {
  44         int size;
  45
  46         /*
  47          * It is expected that the host CPU will typically be able to
  48          * service the rx indication from one A-MPDU before the rx
  49          * indication from the subsequent A-MPDU happens, roughly 1-2 ms
  50          * later. However, the rx ring should be sized very conservatively,
  51          * to accomodate the worst reasonable delay before the host CPU
  52          * services a rx indication interrupt.
  53          *
  54          * The rx ring need not be kept full of empty buffers. In theory,
  55          * the htt host SW can dynamically track the low-water mark in the
  56          * rx ring, and dynamically adjust the level to which the rx ring
  57          * is filled with empty buffers, to dynamically meet the desired
  58          * low-water mark.
  59          *
  60          * In contrast, it's difficult to resize the rx ring itself, once
  61          * it's in use. Thus, the ring itself should be sized very
  62          * conservatively, while the degree to which the ring is filled
  63          * with empty buffers should be sized moderately conservatively.
  64          */
  65
  66         /* 1e6 bps/mbps / 1e3 ms per sec = 1000 */
  67         size =
  68             htt->max_throughput_mbps +
  69             1000  /
  70             (8 * HTT_RX_AVG_FRM_BYTES) * HTT_RX_HOST_LATENCY_MAX_MS;
  71
  72         if (size < HTT_RX_RING_SIZE_MIN)
  73                 size = HTT_RX_RING_SIZE_MIN;
  74
  75         if (size > HTT_RX_RING_SIZE_MAX)
  76                 size = HTT_RX_RING_SIZE_MAX;
  77
  78         size = roundup_pow_of_two(size);
  79
  80         return size;
  81 }
  82
  83 static int ath10k_htt_rx_ring_fill_level(struct ath10k_htt *htt)
  84 {
  85         int size;
  86
  87         /* 1e6 bps/mbps / 1e3 ms per sec = 1000 */
  88         size =
  89             htt->max_throughput_mbps *
  90             1000  /
  91             (8 * HTT_RX_AVG_FRM_BYTES) * HTT_RX_HOST_LATENCY_WORST_LIKELY_MS;
  92
  93         /*
  94          * Make sure the fill level is at least 1 less than the ring size.
  95          * Leaving 1 element empty allows the SW to easily distinguish
  96          * between a full ring vs. an empty ring.
  97          */
  98         if (size >= htt->rx_ring.size)
  99                 size = htt->rx_ring.size - 1;
 100
 101         return size;
 102 }
 103
 104 static void ath10k_htt_rx_ring_free(struct ath10k_htt *htt)
 105 {
 106         struct sk_buff *skb;
 107         struct ath10k_skb_cb *cb;
 108         int i;
 109
 110         for (i = 0; i < htt->rx_ring.fill_cnt; i++) {
 111                 skb = htt->rx_ring.netbufs_ring[i];
 112                 cb = ATH10K_SKB_CB(skb);
 113                 dma_unmap_single(htt->ar->dev, cb->paddr,
 114                                  skb->len + skb_tailroom(skb),
 115                                  DMA_FROM_DEVICE);
 116                 dev_kfree_skb_any(skb);
 117         }
 118
 119         htt->rx_ring.fill_cnt = 0;
 120 }
 121
 122 static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
 123 {
 124         struct htt_rx_desc *rx_desc;
 125         struct sk_buff *skb;
 126         dma_addr_t paddr;
 127         int ret = 0, idx;
 128
 129         idx = __le32_to_cpu(*(htt->rx_ring.alloc_idx.vaddr));
 130         while (num > 0) {
 131                 skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
 132                 if (!skb) {
 133                         ret = -ENOMEM;
 134                         goto fail;
 135                 }
 136
 137                 if (!IS_ALIGNED((unsigned long)skb->data, HTT_RX_DESC_ALIGN))
 138                         skb_pull(skb,
 139                                  PTR_ALIGN(skb->data, HTT_RX_DESC_ALIGN) -
 140                                  skb->data);
 141
 142                 /* Clear rx_desc attention word before posting to Rx ring */
 143                 rx_desc = (struct htt_rx_desc *)skb->data;
 144                 rx_desc->attention.flags = __cpu_to_le32(0);
 145
 146                 paddr = dma_map_single(htt->ar->dev, skb->data,
 147                                        skb->len + skb_tailroom(skb),
 148                                        DMA_FROM_DEVICE);
 149
 150                 if (unlikely(dma_mapping_error(htt->ar->dev, paddr))) {
 151                         dev_kfree_skb_any(skb);
 152                         ret = -ENOMEM;
 153                         goto fail;
 154                 }
 155
 156                 ATH10K_SKB_CB(skb)->paddr = paddr;
 157                 htt->rx_ring.netbufs_ring[idx] = skb;
 158                 htt->rx_ring.paddrs_ring[idx] = __cpu_to_le32(paddr);
 159                 htt->rx_ring.fill_cnt++;
 160
 161                 num--;
 162                 idx++;
 163                 idx &= htt->rx_ring.size_mask;
 164         }
 165
 166 fail:
 167         *(htt->rx_ring.alloc_idx.vaddr) = __cpu_to_le32(idx);
 168         return ret;
 169 }
 170
 171 static int ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
 172 {
 173         lockdep_assert_held(&htt->rx_ring.lock);
 174         return __ath10k_htt_rx_ring_fill_n(htt, num);
 175 }
 176
 177 static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt *htt)
 178 {
 179         int ret, num_to_fill;
 180
 181         spin_lock_bh(&htt->rx_ring.lock);
 182         num_to_fill = htt->rx_ring.fill_level - htt->rx_ring.fill_cnt;
 183         ret = ath10k_htt_rx_ring_fill_n(htt, num_to_fill);
 184         if (ret == -ENOMEM) {
 185                 /*
 186                  * Failed to fill it to the desired level -
 187                  * we'll start a timer and try again next time.
 188                  * As long as enough buffers are left in the ring for
 189                  * another A-MPDU rx, no special recovery is needed.
 190                  */
 191                 mod_timer(&htt->rx_ring.refill_retry_timer, jiffies +
 192                           msecs_to_jiffies(HTT_RX_RING_REFILL_RETRY_MS));
 193         }
 194         spin_unlock_bh(&htt->rx_ring.lock);
 195 }
 196
 197 static void ath10k_htt_rx_ring_refill_retry(unsigned long arg)
 198 {
 199         struct ath10k_htt *htt = (struct ath10k_htt *)arg;
 200         ath10k_htt_rx_msdu_buff_replenish(htt);
 201 }
 202
 203 static unsigned ath10k_htt_rx_ring_elems(struct ath10k_htt *htt)
 204 {
 205         return (__le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr) -
 206                 htt->rx_ring.sw_rd_idx.msdu_payld) & htt->rx_ring.size_mask;
 207 }
 208
 209 void ath10k_htt_rx_detach(struct ath10k_htt *htt)
 210 {
 211         int sw_rd_idx = htt->rx_ring.sw_rd_idx.msdu_payld;
 212
 213         del_timer_sync(&htt->rx_ring.refill_retry_timer);
 214
 215         while (sw_rd_idx != __le32_to_cpu(*(htt->rx_ring.alloc_idx.vaddr))) {
 216                 struct sk_buff *skb =
 217                                 htt->rx_ring.netbufs_ring[sw_rd_idx];
 218                 struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
 219
 220                 dma_unmap_single(htt->ar->dev, cb->paddr,
 221                                  skb->len + skb_tailroom(skb),
 222                                  DMA_FROM_DEVICE);
 223                 dev_kfree_skb_any(htt->rx_ring.netbufs_ring[sw_rd_idx]);
 224                 sw_rd_idx++;
 225                 sw_rd_idx &= htt->rx_ring.size_mask;
 226         }
 227
 228         dma_free_coherent(htt->ar->dev,
 229                           (htt->rx_ring.size *
 230                            sizeof(htt->rx_ring.paddrs_ring)),
 231                           htt->rx_ring.paddrs_ring,
 232                           htt->rx_ring.base_paddr);
 233
 234         dma_free_coherent(htt->ar->dev,
 235                           sizeof(*htt->rx_ring.alloc_idx.vaddr),
 236                           htt->rx_ring.alloc_idx.vaddr,
 237                           htt->rx_ring.alloc_idx.paddr);
 238
 239         kfree(htt->rx_ring.netbufs_ring);
 240 }
 241
 242 static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
 243 {
 244         int idx;
 245         struct sk_buff *msdu;
 246
 247         spin_lock_bh(&htt->rx_ring.lock);
 248
 249         if (ath10k_htt_rx_ring_elems(htt) == 0)
 250                 ath10k_warn("htt rx ring is empty!\n");
 251
 252         idx = htt->rx_ring.sw_rd_idx.msdu_payld;
 253         msdu = htt->rx_ring.netbufs_ring[idx];
 254
 255         idx++;
 256         idx &= htt->rx_ring.size_mask;
 257         htt->rx_ring.sw_rd_idx.msdu_payld = idx;
 258         htt->rx_ring.fill_cnt--;
 259
 260         spin_unlock_bh(&htt->rx_ring.lock);
 261         return msdu;
 262 }
 263
 264 static void ath10k_htt_rx_free_msdu_chain(struct sk_buff *skb)
 265 {
 266         struct sk_buff *next;
 267
 268         while (skb) {
 269                 next = skb->next;
 270                 dev_kfree_skb_any(skb);
 271                 skb = next;
 272         }
 273 }
 274
 275 static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
 276                                    u8 **fw_desc, int *fw_desc_len,
 277                                    struct sk_buff **head_msdu,
 278                                    struct sk_buff **tail_msdu)
 279 {
 280         int msdu_len, msdu_chaining = 0;
 281         struct sk_buff *msdu;
 282         struct htt_rx_desc *rx_desc;
 283
 284         if (ath10k_htt_rx_ring_elems(htt) == 0)
 285                 ath10k_warn("htt rx ring is empty!\n");
 286
 287         if (htt->rx_confused) {
 288                 ath10k_warn("htt is confused. refusing rx\n");
 289                 return 0;
 290         }
 291
 292         msdu = *head_msdu = ath10k_htt_rx_netbuf_pop(htt);
 293         while (msdu) {
 294                 int last_msdu, msdu_len_invalid, msdu_chained;
 295
 296                 dma_unmap_single(htt->ar->dev,
 297                                  ATH10K_SKB_CB(msdu)->paddr,
 298                                  msdu->len + skb_tailroom(msdu),
 299                                  DMA_FROM_DEVICE);
 300
 301                 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx: ",
 302                                 msdu->data, msdu->len + skb_tailroom(msdu));
 303
 304                 rx_desc = (struct htt_rx_desc *)msdu->data;
 305
 306                 /* FIXME: we must report msdu payload since this is what caller
 307                  *        expects now */
 308                 skb_put(msdu, offsetof(struct htt_rx_desc, msdu_payload));
 309                 skb_pull(msdu, offsetof(struct htt_rx_desc, msdu_payload));
 310
 311                 /*
 312                  * Sanity check - confirm the HW is finished filling in the
 313                  * rx data.
 314                  * If the HW and SW are working correctly, then it's guaranteed
 315                  * that the HW's MAC DMA is done before this point in the SW.
 316                  * To prevent the case that we handle a stale Rx descriptor,
 317                  * just assert for now until we have a way to recover.
 318                  */
 319                 if (!(__le32_to_cpu(rx_desc->attention.flags)
 320                                 & RX_ATTENTION_FLAGS_MSDU_DONE)) {
 321                         ath10k_htt_rx_free_msdu_chain(*head_msdu);
 322                         *head_msdu = NULL;
 323                         msdu = NULL;
 324                         ath10k_err("htt rx stopped. cannot recover\n");
 325                         htt->rx_confused = true;
 326                         break;
 327                 }
 328
 329                 /*
 330                  * Copy the FW rx descriptor for this MSDU from the rx
 331                  * indication message into the MSDU's netbuf. HL uses the
 332                  * same rx indication message definition as LL, and simply
 333                  * appends new info (fields from the HW rx desc, and the
 334                  * MSDU payload itself). So, the offset into the rx
 335                  * indication message only has to account for the standard
 336                  * offset of the per-MSDU FW rx desc info within the
 337                  * message, and how many bytes of the per-MSDU FW rx desc
 338                  * info have already been consumed. (And the endianness of
 339                  * the host, since for a big-endian host, the rx ind
 340                  * message contents, including the per-MSDU rx desc bytes,
 341                  * were byteswapped during upload.)
 342                  */
 343                 if (*fw_desc_len > 0) {
 344                         rx_desc->fw_desc.info0 = **fw_desc;
 345                         /*
 346                          * The target is expected to only provide the basic
 347                          * per-MSDU rx descriptors. Just to be sure, verify
 348                          * that the target has not attached extension data
 349                          * (e.g. LRO flow ID).
 350                          */
 351
 352                         /* or more, if there's extension data */
 353                         (*fw_desc)++;
 354                         (*fw_desc_len)--;
 355                 } else {
 356                         /*
 357                          * When an oversized AMSDU happened, FW will lost
 358                          * some of MSDU status - in this case, the FW
 359                          * descriptors provided will be less than the
 360                          * actual MSDUs inside this MPDU. Mark the FW
 361                          * descriptors so that it will still deliver to
 362                          * upper stack, if no CRC error for this MPDU.
 363                          *
 364                          * FIX THIS - the FW descriptors are actually for
 365                          * MSDUs in the end of this A-MSDU instead of the
 366                          * beginning.
 367                          */
 368                         rx_desc->fw_desc.info0 = 0;
 369                 }
 370
 371                 msdu_len_invalid = !!(__le32_to_cpu(rx_desc->attention.flags)
 372                                         & (RX_ATTENTION_FLAGS_MPDU_LENGTH_ERR |
 373                                            RX_ATTENTION_FLAGS_MSDU_LENGTH_ERR));
 374                 msdu_len = MS(__le32_to_cpu(rx_desc->msdu_start.info0),
 375                               RX_MSDU_START_INFO0_MSDU_LENGTH);
 376                 msdu_chained = rx_desc->frag_info.ring2_more_count;
 377
 378                 if (msdu_len_invalid)
 379                         msdu_len = 0;
 380
 381                 skb_trim(msdu, 0);
 382                 skb_put(msdu, min(msdu_len, HTT_RX_MSDU_SIZE));
 383                 msdu_len -= msdu->len;
 384
 385                 /* FIXME: Do chained buffers include htt_rx_desc or not? */
 386                 while (msdu_chained--) {
 387                         struct sk_buff *next = ath10k_htt_rx_netbuf_pop(htt);
 388
 389                         dma_unmap_single(htt->ar->dev,
 390                                          ATH10K_SKB_CB(next)->paddr,
 391                                          next->len + skb_tailroom(next),
 392                                          DMA_FROM_DEVICE);
 393
 394                         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx: ",
 395                                         next->data,
 396                                         next->len + skb_tailroom(next));
 397
 398                         skb_trim(next, 0);
 399                         skb_put(next, min(msdu_len, HTT_RX_BUF_SIZE));
 400                         msdu_len -= next->len;
 401
 402                         msdu->next = next;
 403                         msdu = next;
 404                         msdu_chaining = 1;
 405                 }
 406
 407                 if (msdu_len > 0) {
 408                         /* This may suggest FW bug? */
 409                         ath10k_warn("htt rx msdu len not consumed (%d)\n",
 410                                     msdu_len);
 411                 }
 412
 413                 last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) &
 414                                 RX_MSDU_END_INFO0_LAST_MSDU;
 415
 416                 if (last_msdu) {
 417                         msdu->next = NULL;
 418                         break;
 419                 } else {
 420                         struct sk_buff *next = ath10k_htt_rx_netbuf_pop(htt);
 421                         msdu->next = next;
 422                         msdu = next;
 423                 }
 424         }
 425         *tail_msdu = msdu;
 426
 427         /*
 428          * Don't refill the ring yet.
 429          *
 430          * First, the elements popped here are still in use - it is not
 431          * safe to overwrite them until the matching call to
 432          * mpdu_desc_list_next. Second, for efficiency it is preferable to
 433          * refill the rx ring with 1 PPDU's worth of rx buffers (something
 434          * like 32 x 3 buffers), rather than one MPDU's worth of rx buffers
 435          * (something like 3 buffers). Consequently, we'll rely on the txrx
 436          * SW to tell us when it is done pulling all the PPDU's rx buffers
 437          * out of the rx ring, and then refill it just once.
 438          */
 439
 440         return msdu_chaining;
 441 }
 442
 443 int ath10k_htt_rx_attach(struct ath10k_htt *htt)
 444 {
 445         dma_addr_t paddr;
 446         void *vaddr;
 447         struct timer_list *timer = &htt->rx_ring.refill_retry_timer;
 448
 449         htt->rx_ring.size = ath10k_htt_rx_ring_size(htt);
 450         if (!is_power_of_2(htt->rx_ring.size)) {
 451                 ath10k_warn("htt rx ring size is not power of 2\n");
 452                 return -EINVAL;
 453         }
 454
 455         htt->rx_ring.size_mask = htt->rx_ring.size - 1;
 456
 457         /*
 458          * Set the initial value for the level to which the rx ring
 459          * should be filled, based on the max throughput and the
 460          * worst likely latency for the host to fill the rx ring
 461          * with new buffers. In theory, this fill level can be
 462          * dynamically adjusted from the initial value set here, to
 463          * reflect the actual host latency rather than a
 464          * conservative assumption about the host latency.
 465          */
 466         htt->rx_ring.fill_level = ath10k_htt_rx_ring_fill_level(htt);
 467
 468         htt->rx_ring.netbufs_ring =
 469                 kmalloc(htt->rx_ring.size * sizeof(struct sk_buff *),
 470                         GFP_KERNEL);
 471         if (!htt->rx_ring.netbufs_ring)
 472                 goto err_netbuf;
 473
 474         vaddr = dma_alloc_coherent(htt->ar->dev,
 475                    (htt->rx_ring.size * sizeof(htt->rx_ring.paddrs_ring)),
 476                    &paddr, GFP_DMA);
 477         if (!vaddr)
 478                 goto err_dma_ring;
 479
 480         htt->rx_ring.paddrs_ring = vaddr;
 481         htt->rx_ring.base_paddr = paddr;
 482
 483         vaddr = dma_alloc_coherent(htt->ar->dev,
 484                                    sizeof(*htt->rx_ring.alloc_idx.vaddr),
 485                                    &paddr, GFP_DMA);
 486         if (!vaddr)
 487                 goto err_dma_idx;
 488
 489         htt->rx_ring.alloc_idx.vaddr = vaddr;
 490         htt->rx_ring.alloc_idx.paddr = paddr;
 491         htt->rx_ring.sw_rd_idx.msdu_payld = 0;
 492         *htt->rx_ring.alloc_idx.vaddr = 0;
 493
 494         /* Initialize the Rx refill retry timer */
 495         setup_timer(timer, ath10k_htt_rx_ring_refill_retry, (unsigned long)htt);
 496
 497         spin_lock_init(&htt->rx_ring.lock);
 498
 499         htt->rx_ring.fill_cnt = 0;
 500         if (__ath10k_htt_rx_ring_fill_n(htt, htt->rx_ring.fill_level))
 501                 goto err_fill_ring;
 502
 503         ath10k_dbg(ATH10K_DBG_HTT, "HTT RX ring size: %d, fill_level: %d\n",
 504                    htt->rx_ring.size, htt->rx_ring.fill_level);
 505         return 0;
 506
 507 err_fill_ring:
 508         ath10k_htt_rx_ring_free(htt);
 509         dma_free_coherent(htt->ar->dev,
 510                           sizeof(*htt->rx_ring.alloc_idx.vaddr),
 511                           htt->rx_ring.alloc_idx.vaddr,
 512                           htt->rx_ring.alloc_idx.paddr);
 513 err_dma_idx:
 514         dma_free_coherent(htt->ar->dev,
 515                           (htt->rx_ring.size *
 516                            sizeof(htt->rx_ring.paddrs_ring)),
 517                           htt->rx_ring.paddrs_ring,
 518                           htt->rx_ring.base_paddr);
 519 err_dma_ring:
 520         kfree(htt->rx_ring.netbufs_ring);
 521 err_netbuf:
 522         return -ENOMEM;
 523 }
 524
 525 static int ath10k_htt_rx_crypto_param_len(enum htt_rx_mpdu_encrypt_type type)
 526 {
 527         switch (type) {
 528         case HTT_RX_MPDU_ENCRYPT_WEP40:
 529         case HTT_RX_MPDU_ENCRYPT_WEP104:
 530                 return 4;
 531         case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC:
 532         case HTT_RX_MPDU_ENCRYPT_WEP128: /* not tested */
 533         case HTT_RX_MPDU_ENCRYPT_TKIP_WPA:
 534         case HTT_RX_MPDU_ENCRYPT_WAPI: /* not tested */
 535         case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
 536                 return 8;
 537         case HTT_RX_MPDU_ENCRYPT_NONE:
 538                 return 0;
 539         }
 540
 541         ath10k_warn("unknown encryption type %d\n", type);
 542         return 0;
 543 }
 544
 545 static int ath10k_htt_rx_crypto_tail_len(enum htt_rx_mpdu_encrypt_type type)
 546 {
 547         switch (type) {
 548         case HTT_RX_MPDU_ENCRYPT_NONE:
 549         case HTT_RX_MPDU_ENCRYPT_WEP40:
 550         case HTT_RX_MPDU_ENCRYPT_WEP104:
 551         case HTT_RX_MPDU_ENCRYPT_WEP128:
 552         case HTT_RX_MPDU_ENCRYPT_WAPI:
 553                 return 0;
 554         case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC:
 555         case HTT_RX_MPDU_ENCRYPT_TKIP_WPA:
 556                 return 4;
 557         case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
 558                 return 8;
 559         }
 560
 561         ath10k_warn("unknown encryption type %d\n", type);
 562         return 0;
 563 }
 564
 565 /* Applies for first msdu in chain, before altering it. */
 566 static struct ieee80211_hdr *ath10k_htt_rx_skb_get_hdr(struct sk_buff *skb)
 567 {
 568         struct htt_rx_desc *rxd;
 569         enum rx_msdu_decap_format fmt;
 570
 571         rxd = (void *)skb->data - sizeof(*rxd);
 572         fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
 573                         RX_MSDU_START_INFO1_DECAP_FORMAT);
 574
 575         if (fmt == RX_MSDU_DECAP_RAW)
 576                 return (void *)skb->data;
 577         else
 578                 return (void *)skb->data - RX_HTT_HDR_STATUS_LEN;
 579 }
 580
 581 /* This function only applies for first msdu in an msdu chain */
 582 static bool ath10k_htt_rx_hdr_is_amsdu(struct ieee80211_hdr *hdr)
 583 {
 584         if (ieee80211_is_data_qos(hdr->frame_control)) {
 585                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 586                 if (qc[0] & 0x80)
 587                         return true;
 588         }
 589         return false;
 590 }
 591
 592 static int ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
 593                         struct htt_rx_info *info)
 594 {
 595         struct htt_rx_desc *rxd;
 596         struct sk_buff *amsdu;
 597         struct sk_buff *first;
 598         struct ieee80211_hdr *hdr;
 599         struct sk_buff *skb = info->skb;
 600         enum rx_msdu_decap_format fmt;
 601         enum htt_rx_mpdu_encrypt_type enctype;
 602         unsigned int hdr_len;
 603         int crypto_len;
 604
 605         rxd = (void *)skb->data - sizeof(*rxd);
 606         fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
 607                         RX_MSDU_START_INFO1_DECAP_FORMAT);
 608         enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
 609                         RX_MPDU_START_INFO0_ENCRYPT_TYPE);
 610
 611         /* FIXME: No idea what assumptions are safe here. Need logs */
 612         if ((fmt == RX_MSDU_DECAP_RAW && skb->next) ||
 613             (fmt == RX_MSDU_DECAP_8023_SNAP_LLC)) {
 614                 ath10k_htt_rx_free_msdu_chain(skb->next);
 615                 skb->next = NULL;
 616                 return -ENOTSUPP;
 617         }
 618
 619         /* A-MSDU max is a little less than 8K */
 620         amsdu = dev_alloc_skb(8*1024);
 621         if (!amsdu) {
 622                 ath10k_warn("A-MSDU allocation failed\n");
 623                 ath10k_htt_rx_free_msdu_chain(skb->next);
 624                 skb->next = NULL;
 625                 return -ENOMEM;
 626         }
 627
 628         if (fmt >= RX_MSDU_DECAP_NATIVE_WIFI) {
 629                 int hdrlen;
 630
 631                 hdr = (void *)rxd->rx_hdr_status;
 632                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
 633                 memcpy(skb_put(amsdu, hdrlen), hdr, hdrlen);
 634         }
 635
 636         first = skb;
 637         while (skb) {
 638                 void *decap_hdr;
 639                 int decap_len = 0;
 640
 641                 rxd = (void *)skb->data - sizeof(*rxd);
 642                 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
 643                                 RX_MSDU_START_INFO1_DECAP_FORMAT);
 644                 decap_hdr = (void *)rxd->rx_hdr_status;
 645
 646                 if (skb == first) {
 647                         /* We receive linked A-MSDU subframe skbuffs. The
 648                          * first one contains the original 802.11 header (and
 649                          * possible crypto param) in the RX descriptor. The
 650                          * A-MSDU subframe header follows that. Each part is
 651                          * aligned to 4 byte boundary. */
 652
 653                         hdr = (void *)amsdu->data;
 654                         hdr_len = ieee80211_hdrlen(hdr->frame_control);
 655                         crypto_len = ath10k_htt_rx_crypto_param_len(enctype);
 656
 657                         decap_hdr += roundup(hdr_len, 4);
 658                         decap_hdr += roundup(crypto_len, 4);
 659                 }
 660
 661                 if (fmt == RX_MSDU_DECAP_ETHERNET2_DIX) {
 662                         /* Ethernet2 decap inserts ethernet header in place of
 663                          * A-MSDU subframe header. */
 664                         skb_pull(skb, 6 + 6 + 2);
 665
 666                         /* A-MSDU subframe header length */
 667                         decap_len += 6 + 6 + 2;
 668
 669                         /* Ethernet2 decap also strips the LLC/SNAP so we need
 670                          * to re-insert it. The LLC/SNAP follows A-MSDU
 671                          * subframe header. */
 672                         /* FIXME: Not all LLCs are 8 bytes long */
 673                         decap_len += 8;
 674
 675                         memcpy(skb_put(amsdu, decap_len), decap_hdr, decap_len);
 676                 }
 677
 678                 if (fmt == RX_MSDU_DECAP_NATIVE_WIFI) {
 679                         /* Native Wifi decap inserts regular 802.11 header
 680                          * in place of A-MSDU subframe header. */
 681                         hdr = (struct ieee80211_hdr *)skb->data;
 682                         skb_pull(skb, ieee80211_hdrlen(hdr->frame_control));
 683
 684                         /* A-MSDU subframe header length */
 685                         decap_len += 6 + 6 + 2;
 686
 687                         memcpy(skb_put(amsdu, decap_len), decap_hdr, decap_len);
 688                 }
 689
 690                 if (fmt == RX_MSDU_DECAP_RAW)
 691                         skb_trim(skb, skb->len - 4); /* remove FCS */
 692
 693                 memcpy(skb_put(amsdu, skb->len), skb->data, skb->len);
 694
 695                 /* A-MSDU subframes are padded to 4bytes
 696                  * but relative to first subframe, not the whole MPDU */
 697                 if (skb->next && ((decap_len + skb->len) & 3)) {
 698                         int padlen = 4 - ((decap_len + skb->len) & 3);
 699                         memset(skb_put(amsdu, padlen), 0, padlen);
 700                 }
 701
 702                 skb = skb->next;
 703         }
 704
 705         info->skb = amsdu;
 706         info->encrypt_type = enctype;
 707
 708         ath10k_htt_rx_free_msdu_chain(first);
 709
 710         return 0;
 711 }
 712
 713 static int ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
 714 {
 715         struct sk_buff *skb = info->skb;
 716         struct htt_rx_desc *rxd;
 717         struct ieee80211_hdr *hdr;
 718         enum rx_msdu_decap_format fmt;
 719         enum htt_rx_mpdu_encrypt_type enctype;
 720
 721         /* This shouldn't happen. If it does than it may be a FW bug. */
 722         if (skb->next) {
 723                 ath10k_warn("received chained non A-MSDU frame\n");
 724                 ath10k_htt_rx_free_msdu_chain(skb->next);
 725                 skb->next = NULL;
 726         }
 727
 728         rxd = (void *)skb->data - sizeof(*rxd);
 729         fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
 730                         RX_MSDU_START_INFO1_DECAP_FORMAT);
 731         enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
 732                         RX_MPDU_START_INFO0_ENCRYPT_TYPE);
 733         hdr = (void *)skb->data - RX_HTT_HDR_STATUS_LEN;
 734
 735         switch (fmt) {
 736         case RX_MSDU_DECAP_RAW:
 737                 /* remove trailing FCS */
 738                 skb_trim(skb, skb->len - 4);
 739                 break;
 740         case RX_MSDU_DECAP_NATIVE_WIFI:
 741                 /* nothing to do here */
 742                 break;
 743         case RX_MSDU_DECAP_ETHERNET2_DIX:
 744                 /* macaddr[6] + macaddr[6] + ethertype[2] */
 745                 skb_pull(skb, 6 + 6 + 2);
 746                 break;
 747         case RX_MSDU_DECAP_8023_SNAP_LLC:
 748                 /* macaddr[6] + macaddr[6] + len[2] */
 749                 /* we don't need this for non-A-MSDU */
 750                 skb_pull(skb, 6 + 6 + 2);
 751                 break;
 752         }
 753
 754         if (fmt == RX_MSDU_DECAP_ETHERNET2_DIX) {
 755                 void *llc;
 756                 int llclen;
 757
 758                 llclen = 8;
 759                 llc  = hdr;
 760                 llc += roundup(ieee80211_hdrlen(hdr->frame_control), 4);
 761                 llc += roundup(ath10k_htt_rx_crypto_param_len(enctype), 4);
 762
 763                 skb_push(skb, llclen);
 764                 memcpy(skb->data, llc, llclen);
 765         }
 766
 767         if (fmt >= RX_MSDU_DECAP_ETHERNET2_DIX) {
 768                 int len = ieee80211_hdrlen(hdr->frame_control);
 769                 skb_push(skb, len);
 770                 memcpy(skb->data, hdr, len);
 771         }
 772
 773         info->skb = skb;
 774         info->encrypt_type = enctype;
 775         return 0;
 776 }
 777
 778 static bool ath10k_htt_rx_has_decrypt_err(struct sk_buff *skb)
 779 {
 780         struct htt_rx_desc *rxd;
 781         u32 flags;
 782
 783         rxd = (void *)skb->data - sizeof(*rxd);
 784         flags = __le32_to_cpu(rxd->attention.flags);
 785
 786         if (flags & RX_ATTENTION_FLAGS_DECRYPT_ERR)
 787                 return true;
 788
 789         return false;
 790 }
 791
 792 static bool ath10k_htt_rx_has_fcs_err(struct sk_buff *skb)
 793 {
 794         struct htt_rx_desc *rxd;
 795         u32 flags;
 796
 797         rxd = (void *)skb->data - sizeof(*rxd);
 798         flags = __le32_to_cpu(rxd->attention.flags);
 799
 800         if (flags & RX_ATTENTION_FLAGS_FCS_ERR)
 801                 return true;
 802
 803         return false;
 804 }
 805
 806 static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
 807                                   struct htt_rx_indication *rx)
 808 {
 809         struct htt_rx_info info;
 810         struct htt_rx_indication_mpdu_range *mpdu_ranges;
 811         struct ieee80211_hdr *hdr;
 812         int num_mpdu_ranges;
 813         int fw_desc_len;
 814         u8 *fw_desc;
 815         int i, j;
 816         int ret;
 817
 818         memset(&info, 0, sizeof(info));
 819
 820         fw_desc_len = __le16_to_cpu(rx->prefix.fw_rx_desc_bytes);
 821         fw_desc = (u8 *)&rx->fw_desc;
 822
 823         num_mpdu_ranges = MS(__le32_to_cpu(rx->hdr.info1),
 824                              HTT_RX_INDICATION_INFO1_NUM_MPDU_RANGES);
 825         mpdu_ranges = htt_rx_ind_get_mpdu_ranges(rx);
 826
 827         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx ind: ",
 828                         rx, sizeof(*rx) +
 829                         (sizeof(struct htt_rx_indication_mpdu_range) *
 830                                 num_mpdu_ranges));
 831
 832         for (i = 0; i < num_mpdu_ranges; i++) {
 833                 info.status = mpdu_ranges[i].mpdu_range_status;
 834
 835                 for (j = 0; j < mpdu_ranges[i].mpdu_count; j++) {
 836                         struct sk_buff *msdu_head, *msdu_tail;
 837                         enum htt_rx_mpdu_status status;
 838                         int msdu_chaining;
 839
 840                         msdu_head = NULL;
 841                         msdu_tail = NULL;
 842                         msdu_chaining = ath10k_htt_rx_amsdu_pop(htt,
 843                                                          &fw_desc,
 844                                                          &fw_desc_len,
 845                                                          &msdu_head,
 846                                                          &msdu_tail);
 847
 848                         if (!msdu_head) {
 849                                 ath10k_warn("htt rx no data!\n");
 850                                 continue;
 851                         }
 852
 853                         if (msdu_head->len == 0) {
 854                                 ath10k_dbg(ATH10K_DBG_HTT,
 855                                            "htt rx dropping due to zero-len\n");
 856                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
 857                                 continue;
 858                         }
 859
 860                         if (ath10k_htt_rx_has_decrypt_err(msdu_head)) {
 861                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
 862                                 continue;
 863                         }
 864
 865                         status = info.status;
 866
 867                         /* Skip mgmt frames while we handle this in WMI */
 868                         if (status == HTT_RX_IND_MPDU_STATUS_MGMT_CTRL) {
 869                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
 870                                 continue;
 871                         }
 872
 873                         if (status != HTT_RX_IND_MPDU_STATUS_OK &&
 874                             status != HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR &&
 875                             !htt->ar->monitor_enabled) {
 876                                 ath10k_dbg(ATH10K_DBG_HTT,
 877                                            "htt rx ignoring frame w/ status %d\n",
 878                                            status);
 879                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
 880                                 continue;
 881                         }
 882
 883                         /* FIXME: we do not support chaining yet.
 884                          * this needs investigation */
 885                         if (msdu_chaining) {
 886                                 ath10k_warn("msdu_chaining is true\n");
 887                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
 888                                 continue;
 889                         }
 890
 891                         info.skb     = msdu_head;
 892                         info.fcs_err = ath10k_htt_rx_has_fcs_err(msdu_head);
 893                         info.signal  = ATH10K_DEFAULT_NOISE_FLOOR;
 894                         info.signal += rx->ppdu.combined_rssi;
 895
 896                         info.rate.info0 = rx->ppdu.info0;
 897                         info.rate.info1 = __le32_to_cpu(rx->ppdu.info1);
 898                         info.rate.info2 = __le32_to_cpu(rx->ppdu.info2);
 899
 900                         hdr = ath10k_htt_rx_skb_get_hdr(msdu_head);
 901
 902                         if (ath10k_htt_rx_hdr_is_amsdu(hdr))
 903                                 ret = ath10k_htt_rx_amsdu(htt, &info);
 904                         else
 905                                 ret = ath10k_htt_rx_msdu(htt, &info);
 906
 907                         if (ret && !info.fcs_err) {
 908                                 ath10k_warn("error processing msdus %d\n", ret);
 909                                 dev_kfree_skb_any(info.skb);
 910                                 continue;
 911                         }
 912
 913                         if (ath10k_htt_rx_hdr_is_amsdu((void *)info.skb->data))
 914                                 ath10k_dbg(ATH10K_DBG_HTT, "htt mpdu is amsdu\n");
 915
 916                         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt mpdu: ",
 917                                         info.skb->data, info.skb->len);
 918                         ath10k_process_rx(htt->ar, &info);
 919                 }
 920         }
 921
 922         ath10k_htt_rx_msdu_buff_replenish(htt);
 923 }
 924
 925 static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
 926                                 struct htt_rx_fragment_indication *frag)
 927 {
 928         struct sk_buff *msdu_head, *msdu_tail;
 929         struct htt_rx_desc *rxd;
 930         enum rx_msdu_decap_format fmt;
 931         struct htt_rx_info info = {};
 932         struct ieee80211_hdr *hdr;
 933         int msdu_chaining;
 934         bool tkip_mic_err;
 935         bool decrypt_err;
 936         u8 *fw_desc;
 937         int fw_desc_len, hdrlen, paramlen;
 938         int trim;
 939
 940         fw_desc_len = __le16_to_cpu(frag->fw_rx_desc_bytes);
 941         fw_desc = (u8 *)frag->fw_msdu_rx_desc;
 942
 943         msdu_head = NULL;
 944         msdu_tail = NULL;
 945         msdu_chaining = ath10k_htt_rx_amsdu_pop(htt, &fw_desc, &fw_desc_len,
 946                                                 &msdu_head, &msdu_tail);
 947
 948         ath10k_dbg(ATH10K_DBG_HTT_DUMP, "htt rx frag ahead\n");
 949
 950         if (!msdu_head) {
 951                 ath10k_warn("htt rx frag no data\n");
 952                 return;
 953         }
 954
 955         if (msdu_chaining || msdu_head != msdu_tail) {
 956                 ath10k_warn("aggregation with fragmentation?!\n");
 957                 ath10k_htt_rx_free_msdu_chain(msdu_head);
 958                 return;
 959         }
 960
 961         /* FIXME: implement signal strength */
 962
 963         hdr = (struct ieee80211_hdr *)msdu_head->data;
 964         rxd = (void *)msdu_head->data - sizeof(*rxd);
 965         tkip_mic_err = !!(__le32_to_cpu(rxd->attention.flags) &
 966                                 RX_ATTENTION_FLAGS_TKIP_MIC_ERR);
 967         decrypt_err = !!(__le32_to_cpu(rxd->attention.flags) &
 968                                 RX_ATTENTION_FLAGS_DECRYPT_ERR);
 969         fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
 970                         RX_MSDU_START_INFO1_DECAP_FORMAT);
 971
 972         if (fmt != RX_MSDU_DECAP_RAW) {
 973                 ath10k_warn("we dont support non-raw fragmented rx yet\n");
 974                 dev_kfree_skb_any(msdu_head);
 975                 goto end;
 976         }
 977
 978         info.skb = msdu_head;
 979         info.status = HTT_RX_IND_MPDU_STATUS_OK;
 980         info.encrypt_type = MS(__le32_to_cpu(rxd->mpdu_start.info0),
 981                                 RX_MPDU_START_INFO0_ENCRYPT_TYPE);
 982
 983         if (tkip_mic_err) {
 984                 ath10k_warn("tkip mic error\n");
 985                 info.status = HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR;
 986         }
 987
 988         if (decrypt_err) {
 989                 ath10k_warn("decryption err in fragmented rx\n");
 990                 dev_kfree_skb_any(info.skb);
 991                 goto end;
 992         }
 993
 994         if (info.encrypt_type != HTT_RX_MPDU_ENCRYPT_NONE) {
 995                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
 996                 paramlen = ath10k_htt_rx_crypto_param_len(info.encrypt_type);
 997
 998                 /* It is more efficient to move the header than the payload */
 999                 memmove((void *)info.skb->data + paramlen,
1000                         (void *)info.skb->data,
1001                         hdrlen);
1002                 skb_pull(info.skb, paramlen);
1003                 hdr = (struct ieee80211_hdr *)info.skb->data;
1004         }
1005
1006         /* remove trailing FCS */
1007         trim  = 4;
1008
1009         /* remove crypto trailer */
1010         trim += ath10k_htt_rx_crypto_tail_len(info.encrypt_type);
1011
1012         /* last fragment of TKIP frags has MIC */
1013         if (!ieee80211_has_morefrags(hdr->frame_control) &&
1014             info.encrypt_type == HTT_RX_MPDU_ENCRYPT_TKIP_WPA)
1015                 trim += 8;
1016
1017         if (trim > info.skb->len) {
1018                 ath10k_warn("htt rx fragment: trailer longer than the frame itself? drop\n");
1019                 dev_kfree_skb_any(info.skb);
1020                 goto end;
1021         }
1022
1023         skb_trim(info.skb, info.skb->len - trim);
1024
1025         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt frag mpdu: ",
1026                         info.skb->data, info.skb->len);
1027         ath10k_process_rx(htt->ar, &info);
1028
1029 end:
1030         if (fw_desc_len > 0) {
1031                 ath10k_dbg(ATH10K_DBG_HTT,
1032                            "expecting more fragmented rx in one indication %d\n",
1033                            fw_desc_len);
1034         }
1035 }
1036
1037 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
1038 {
1039         struct ath10k_htt *htt = ar->htt;
1040         struct htt_resp *resp = (struct htt_resp *)skb->data;
1041
1042         /* confirm alignment */
1043         if (!IS_ALIGNED((unsigned long)skb->data, 4))
1044                 ath10k_warn("unaligned htt message, expect trouble\n");
1045
1046         ath10k_dbg(ATH10K_DBG_HTT, "HTT RX, msg_type: 0x%0X\n",
1047                    resp->hdr.msg_type);
1048         switch (resp->hdr.msg_type) {
1049         case HTT_T2H_MSG_TYPE_VERSION_CONF: {
1050                 htt->target_version_major = resp->ver_resp.major;
1051                 htt->target_version_minor = resp->ver_resp.minor;
1052                 complete(&htt->target_version_received);
1053                 break;
1054         }
1055         case HTT_T2H_MSG_TYPE_RX_IND: {
1056                 ath10k_htt_rx_handler(htt, &resp->rx_ind);
1057                 break;
1058         }
1059         case HTT_T2H_MSG_TYPE_PEER_MAP: {
1060                 struct htt_peer_map_event ev = {
1061                         .vdev_id = resp->peer_map.vdev_id,
1062                         .peer_id = __le16_to_cpu(resp->peer_map.peer_id),
1063                 };
1064                 memcpy(ev.addr, resp->peer_map.addr, sizeof(ev.addr));
1065                 ath10k_peer_map_event(htt, &ev);
1066                 break;
1067         }
1068         case HTT_T2H_MSG_TYPE_PEER_UNMAP: {
1069                 struct htt_peer_unmap_event ev = {
1070                         .peer_id = __le16_to_cpu(resp->peer_unmap.peer_id),
1071                 };
1072                 ath10k_peer_unmap_event(htt, &ev);
1073                 break;
1074         }
1075         case HTT_T2H_MSG_TYPE_MGMT_TX_COMPLETION: {
1076                 struct htt_tx_done tx_done = {};
1077                 int status = __le32_to_cpu(resp->mgmt_tx_completion.status);
1078
1079                 tx_done.msdu_id =
1080                         __le32_to_cpu(resp->mgmt_tx_completion.desc_id);
1081
1082                 switch (status) {
1083                 case HTT_MGMT_TX_STATUS_OK:
1084                         break;
1085                 case HTT_MGMT_TX_STATUS_RETRY:
1086                         tx_done.no_ack = true;
1087                         break;
1088                 case HTT_MGMT_TX_STATUS_DROP:
1089                         tx_done.discard = true;
1090                         break;
1091                 }
1092
1093                 ath10k_txrx_tx_completed(htt, &tx_done);
1094                 break;
1095         }
1096         case HTT_T2H_MSG_TYPE_TX_COMPL_IND: {
1097                 struct htt_tx_done tx_done = {};
1098                 int status = MS(resp->data_tx_completion.flags,
1099                                 HTT_DATA_TX_STATUS);
1100                 __le16 msdu_id;
1101                 int i;
1102
1103                 switch (status) {
1104                 case HTT_DATA_TX_STATUS_NO_ACK:
1105                         tx_done.no_ack = true;
1106                         break;
1107                 case HTT_DATA_TX_STATUS_OK:
1108                         break;
1109                 case HTT_DATA_TX_STATUS_DISCARD:
1110                 case HTT_DATA_TX_STATUS_POSTPONE:
1111                 case HTT_DATA_TX_STATUS_DOWNLOAD_FAIL:
1112                         tx_done.discard = true;
1113                         break;
1114                 default:
1115                         ath10k_warn("unhandled tx completion status %d\n",
1116                                     status);
1117                         tx_done.discard = true;
1118                         break;
1119                 }
1120
1121                 ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion num_msdus %d\n",
1122                            resp->data_tx_completion.num_msdus);
1123
1124                 for (i = 0; i < resp->data_tx_completion.num_msdus; i++) {
1125                         msdu_id = resp->data_tx_completion.msdus[i];
1126                         tx_done.msdu_id = __le16_to_cpu(msdu_id);
1127                         ath10k_txrx_tx_completed(htt, &tx_done);
1128                 }
1129                 break;
1130         }
1131         case HTT_T2H_MSG_TYPE_SEC_IND: {
1132                 struct ath10k *ar = htt->ar;
1133                 struct htt_security_indication *ev = &resp->security_indication;
1134
1135                 ath10k_dbg(ATH10K_DBG_HTT,
1136                            "sec ind peer_id %d unicast %d type %d\n",
1137                           __le16_to_cpu(ev->peer_id),
1138                           !!(ev->flags & HTT_SECURITY_IS_UNICAST),
1139                           MS(ev->flags, HTT_SECURITY_TYPE));
1140                 complete(&ar->install_key_done);
1141                 break;
1142         }
1143         case HTT_T2H_MSG_TYPE_RX_FRAG_IND: {
1144                 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
1145                                 skb->data, skb->len);
1146                 ath10k_htt_rx_frag_handler(htt, &resp->rx_frag_ind);
1147                 break;
1148         }
1149         case HTT_T2H_MSG_TYPE_TEST:
1150                 /* FIX THIS */
1151                 break;
1152         case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
1153         case HTT_T2H_MSG_TYPE_STATS_CONF:
1154         case HTT_T2H_MSG_TYPE_RX_ADDBA:
1155         case HTT_T2H_MSG_TYPE_RX_DELBA:
1156         case HTT_T2H_MSG_TYPE_RX_FLUSH:
1157         default:
1158                 ath10k_dbg(ATH10K_DBG_HTT, "htt event (%d) not handled\n",
1159                            resp->hdr.msg_type);
1160                 ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
1161                                 skb->data, skb->len);
1162                 break;
1163         };
1164
1165         /* Free the indication buffer */
1166         dev_kfree_skb_any(skb);
1167 }