]> bbs.cooldavid.org Git - net-next-2.6.git/blob - drivers/net/wireless/wl12xx/wl1271_rx.c
sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()
[net-next-2.6.git] / drivers / net / wireless / wl12xx / wl1271_rx.c
1 /*
2  * This file is part of wl1271
3  *
4  * Copyright (C) 2009 Nokia Corporation
5  *
6  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU General Public License
10  * version 2 as published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful, but
13  * WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
20  * 02110-1301 USA
21  *
22  */
23
24 #include <linux/gfp.h>
25
26 #include "wl1271.h"
27 #include "wl1271_acx.h"
28 #include "wl1271_reg.h"
29 #include "wl1271_rx.h"
30 #include "wl1271_io.h"
31
32 static u8 wl1271_rx_get_mem_block(struct wl1271_fw_status *status,
33                                   u32 drv_rx_counter)
34 {
35         return le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
36                 RX_MEM_BLOCK_MASK;
37 }
38
39 static u32 wl1271_rx_get_buf_size(struct wl1271_fw_status *status,
40                                  u32 drv_rx_counter)
41 {
42         return (le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
43                 RX_BUF_SIZE_MASK) >> RX_BUF_SIZE_SHIFT_DIV;
44 }
45
46 static void wl1271_rx_status(struct wl1271 *wl,
47                              struct wl1271_rx_descriptor *desc,
48                              struct ieee80211_rx_status *status,
49                              u8 beacon)
50 {
51         memset(status, 0, sizeof(struct ieee80211_rx_status));
52
53         status->band = wl->band;
54         status->rate_idx = wl1271_rate_to_idx(wl, desc->rate);
55
56         status->signal = desc->rssi;
57
58         /*
59          * FIXME: In wl1251, the SNR should be divided by two.  In wl1271 we
60          * need to divide by two for now, but TI has been discussing about
61          * changing it.  This needs to be rechecked.
62          */
63         wl->noise = desc->rssi - (desc->snr >> 1);
64
65         status->freq = ieee80211_channel_to_frequency(desc->channel);
66
67         if (desc->flags & WL1271_RX_DESC_ENCRYPT_MASK) {
68                 status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED;
69
70                 if (likely(!(desc->status & WL1271_RX_DESC_DECRYPT_FAIL)))
71                         status->flag |= RX_FLAG_DECRYPTED;
72                 if (unlikely(desc->status & WL1271_RX_DESC_MIC_FAIL))
73                         status->flag |= RX_FLAG_MMIC_ERROR;
74         }
75 }
76
77 static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
78 {
79         struct ieee80211_rx_status rx_status;
80         struct wl1271_rx_descriptor *desc;
81         struct sk_buff *skb;
82         u16 *fc;
83         u8 *buf;
84         u8 beacon = 0;
85
86         /*
87          * In PLT mode we seem to get frames and mac80211 warns about them,
88          * workaround this by not retrieving them at all.
89          */
90         if (unlikely(wl->state == WL1271_STATE_PLT))
91                 return;
92
93         skb = __dev_alloc_skb(length, GFP_KERNEL);
94         if (!skb) {
95                 wl1271_error("Couldn't allocate RX frame");
96                 return;
97         }
98
99         buf = skb_put(skb, length);
100         wl1271_read(wl, WL1271_SLV_MEM_DATA, buf, length, true);
101
102         /* the data read starts with the descriptor */
103         desc = (struct wl1271_rx_descriptor *) buf;
104
105         /* now we pull the descriptor out of the buffer */
106         skb_pull(skb, sizeof(*desc));
107
108         fc = (u16 *)skb->data;
109         if ((*fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
110                 beacon = 1;
111
112         wl1271_rx_status(wl, desc, &rx_status, beacon);
113
114         wl1271_debug(DEBUG_RX, "rx skb 0x%p: %d B %s", skb, skb->len,
115                      beacon ? "beacon" : "");
116
117         skb_trim(skb, skb->len - desc->pad_len);
118
119         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
120         ieee80211_rx_ni(wl->hw, skb);
121 }
122
123 void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
124 {
125         struct wl1271_acx_mem_map *wl_mem_map = wl->target_mem_map;
126         u32 buf_size;
127         u32 fw_rx_counter  = status->fw_rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
128         u32 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
129         u32 mem_block;
130
131         while (drv_rx_counter != fw_rx_counter) {
132                 mem_block = wl1271_rx_get_mem_block(status, drv_rx_counter);
133                 buf_size = wl1271_rx_get_buf_size(status, drv_rx_counter);
134
135                 if (buf_size == 0) {
136                         wl1271_warning("received empty data");
137                         break;
138                 }
139
140                 wl->rx_mem_pool_addr.addr = (mem_block << 8) +
141                         le32_to_cpu(wl_mem_map->packet_memory_pool_start);
142                 wl->rx_mem_pool_addr.addr_extra =
143                         wl->rx_mem_pool_addr.addr + 4;
144
145                 /* Choose the block we want to read */
146                 wl1271_write(wl, WL1271_SLV_REG_DATA, &wl->rx_mem_pool_addr,
147                              sizeof(wl->rx_mem_pool_addr), false);
148
149                 wl1271_rx_handle_data(wl, buf_size);
150
151                 wl->rx_counter++;
152                 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
153         }
154
155         wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
156 }