1 // SPDX-License-Identifier: BSD-3-Clause-Clear
2 /*
3  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
4  */
5 
6 #include <linux/ieee80211.h>
7 #include <linux/kernel.h>
8 #include <linux/skbuff.h>
9 #include <crypto/hash.h>
10 #include "core.h"
11 #include "debug.h"
12 #include "hal_desc.h"
13 #include "hw.h"
14 #include "dp_rx.h"
15 #include "hal_rx.h"
16 #include "dp_tx.h"
17 #include "peer.h"
18 
19 #define ATH11K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ)
20 
21 static u8 *ath11k_dp_rx_h_80211_hdr(struct hal_rx_desc *desc)
22 {
23 	return desc->hdr_status;
24 }
25 
26 static enum hal_encrypt_type ath11k_dp_rx_h_mpdu_start_enctype(struct hal_rx_desc *desc)
27 {
28 	if (!(__le32_to_cpu(desc->mpdu_start.info1) &
29 	    RX_MPDU_START_INFO1_ENCRYPT_INFO_VALID))
30 		return HAL_ENCRYPT_TYPE_OPEN;
31 
32 	return FIELD_GET(RX_MPDU_START_INFO2_ENC_TYPE,
33 			 __le32_to_cpu(desc->mpdu_start.info2));
34 }
35 
36 static u8 ath11k_dp_rx_h_msdu_start_decap_type(struct hal_rx_desc *desc)
37 {
38 	return FIELD_GET(RX_MSDU_START_INFO2_DECAP_FORMAT,
39 			 __le32_to_cpu(desc->msdu_start.info2));
40 }
41 
42 static u8 ath11k_dp_rx_h_msdu_start_mesh_ctl_present(struct hal_rx_desc *desc)
43 {
44 	return FIELD_GET(RX_MSDU_START_INFO2_MESH_CTRL_PRESENT,
45 			 __le32_to_cpu(desc->msdu_start.info2));
46 }
47 
48 static bool ath11k_dp_rx_h_mpdu_start_seq_ctrl_valid(struct hal_rx_desc *desc)
49 {
50 	return !!FIELD_GET(RX_MPDU_START_INFO1_MPDU_SEQ_CTRL_VALID,
51 			   __le32_to_cpu(desc->mpdu_start.info1));
52 }
53 
54 static bool ath11k_dp_rx_h_mpdu_start_fc_valid(struct hal_rx_desc *desc)
55 {
56 	return !!FIELD_GET(RX_MPDU_START_INFO1_MPDU_FCTRL_VALID,
57 			   __le32_to_cpu(desc->mpdu_start.info1));
58 }
59 
60 static bool ath11k_dp_rx_h_mpdu_start_more_frags(struct sk_buff *skb)
61 {
62 	struct ieee80211_hdr *hdr;
63 
64 	hdr = (struct ieee80211_hdr *)(skb->data + HAL_RX_DESC_SIZE);
65 	return ieee80211_has_morefrags(hdr->frame_control);
66 }
67 
68 static u16 ath11k_dp_rx_h_mpdu_start_frag_no(struct sk_buff *skb)
69 {
70 	struct ieee80211_hdr *hdr;
71 
72 	hdr = (struct ieee80211_hdr *)(skb->data + HAL_RX_DESC_SIZE);
73 	return le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
74 }
75 
76 static u16 ath11k_dp_rx_h_mpdu_start_seq_no(struct hal_rx_desc *desc)
77 {
78 	return FIELD_GET(RX_MPDU_START_INFO1_MPDU_SEQ_NUM,
79 			 __le32_to_cpu(desc->mpdu_start.info1));
80 }
81 
82 static bool ath11k_dp_rx_h_attn_msdu_done(struct hal_rx_desc *desc)
83 {
84 	return !!FIELD_GET(RX_ATTENTION_INFO2_MSDU_DONE,
85 			   __le32_to_cpu(desc->attention.info2));
86 }
87 
88 static bool ath11k_dp_rx_h_attn_l4_cksum_fail(struct hal_rx_desc *desc)
89 {
90 	return !!FIELD_GET(RX_ATTENTION_INFO1_TCP_UDP_CKSUM_FAIL,
91 			   __le32_to_cpu(desc->attention.info1));
92 }
93 
94 static bool ath11k_dp_rx_h_attn_ip_cksum_fail(struct hal_rx_desc *desc)
95 {
96 	return !!FIELD_GET(RX_ATTENTION_INFO1_IP_CKSUM_FAIL,
97 			   __le32_to_cpu(desc->attention.info1));
98 }
99 
100 static bool ath11k_dp_rx_h_attn_is_decrypted(struct hal_rx_desc *desc)
101 {
102 	return (FIELD_GET(RX_ATTENTION_INFO2_DCRYPT_STATUS_CODE,
103 			  __le32_to_cpu(desc->attention.info2)) ==
104 		RX_DESC_DECRYPT_STATUS_CODE_OK);
105 }
106 
107 static u32 ath11k_dp_rx_h_attn_mpdu_err(struct hal_rx_desc *desc)
108 {
109 	u32 info = __le32_to_cpu(desc->attention.info1);
110 	u32 errmap = 0;
111 
112 	if (info & RX_ATTENTION_INFO1_FCS_ERR)
113 		errmap |= DP_RX_MPDU_ERR_FCS;
114 
115 	if (info & RX_ATTENTION_INFO1_DECRYPT_ERR)
116 		errmap |= DP_RX_MPDU_ERR_DECRYPT;
117 
118 	if (info & RX_ATTENTION_INFO1_TKIP_MIC_ERR)
119 		errmap |= DP_RX_MPDU_ERR_TKIP_MIC;
120 
121 	if (info & RX_ATTENTION_INFO1_A_MSDU_ERROR)
122 		errmap |= DP_RX_MPDU_ERR_AMSDU_ERR;
123 
124 	if (info & RX_ATTENTION_INFO1_OVERFLOW_ERR)
125 		errmap |= DP_RX_MPDU_ERR_OVERFLOW;
126 
127 	if (info & RX_ATTENTION_INFO1_MSDU_LEN_ERR)
128 		errmap |= DP_RX_MPDU_ERR_MSDU_LEN;
129 
130 	if (info & RX_ATTENTION_INFO1_MPDU_LEN_ERR)
131 		errmap |= DP_RX_MPDU_ERR_MPDU_LEN;
132 
133 	return errmap;
134 }
135 
136 static u16 ath11k_dp_rx_h_msdu_start_msdu_len(struct hal_rx_desc *desc)
137 {
138 	return FIELD_GET(RX_MSDU_START_INFO1_MSDU_LENGTH,
139 			 __le32_to_cpu(desc->msdu_start.info1));
140 }
141 
142 static u8 ath11k_dp_rx_h_msdu_start_sgi(struct hal_rx_desc *desc)
143 {
144 	return FIELD_GET(RX_MSDU_START_INFO3_SGI,
145 			 __le32_to_cpu(desc->msdu_start.info3));
146 }
147 
148 static u8 ath11k_dp_rx_h_msdu_start_rate_mcs(struct hal_rx_desc *desc)
149 {
150 	return FIELD_GET(RX_MSDU_START_INFO3_RATE_MCS,
151 			 __le32_to_cpu(desc->msdu_start.info3));
152 }
153 
154 static u8 ath11k_dp_rx_h_msdu_start_rx_bw(struct hal_rx_desc *desc)
155 {
156 	return FIELD_GET(RX_MSDU_START_INFO3_RECV_BW,
157 			 __le32_to_cpu(desc->msdu_start.info3));
158 }
159 
160 static u32 ath11k_dp_rx_h_msdu_start_freq(struct hal_rx_desc *desc)
161 {
162 	return __le32_to_cpu(desc->msdu_start.phy_meta_data);
163 }
164 
165 static u8 ath11k_dp_rx_h_msdu_start_pkt_type(struct hal_rx_desc *desc)
166 {
167 	return FIELD_GET(RX_MSDU_START_INFO3_PKT_TYPE,
168 			 __le32_to_cpu(desc->msdu_start.info3));
169 }
170 
171 static u8 ath11k_dp_rx_h_msdu_start_nss(struct hal_rx_desc *desc)
172 {
173 	u8 mimo_ss_bitmap = FIELD_GET(RX_MSDU_START_INFO3_MIMO_SS_BITMAP,
174 				      __le32_to_cpu(desc->msdu_start.info3));
175 
176 	return hweight8(mimo_ss_bitmap);
177 }
178 
179 static u8 ath11k_dp_rx_h_mpdu_start_tid(struct hal_rx_desc *desc)
180 {
181 	return FIELD_GET(RX_MPDU_START_INFO2_TID,
182 			 __le32_to_cpu(desc->mpdu_start.info2));
183 }
184 
185 static u16 ath11k_dp_rx_h_mpdu_start_peer_id(struct hal_rx_desc *desc)
186 {
187 	return __le16_to_cpu(desc->mpdu_start.sw_peer_id);
188 }
189 
190 static u8 ath11k_dp_rx_h_msdu_end_l3pad(struct hal_rx_desc *desc)
191 {
192 	return FIELD_GET(RX_MSDU_END_INFO2_L3_HDR_PADDING,
193 			 __le32_to_cpu(desc->msdu_end.info2));
194 }
195 
196 static bool ath11k_dp_rx_h_msdu_end_first_msdu(struct hal_rx_desc *desc)
197 {
198 	return !!FIELD_GET(RX_MSDU_END_INFO2_FIRST_MSDU,
199 			   __le32_to_cpu(desc->msdu_end.info2));
200 }
201 
202 static bool ath11k_dp_rx_h_msdu_end_last_msdu(struct hal_rx_desc *desc)
203 {
204 	return !!FIELD_GET(RX_MSDU_END_INFO2_LAST_MSDU,
205 			   __le32_to_cpu(desc->msdu_end.info2));
206 }
207 
208 static void ath11k_dp_rx_desc_end_tlv_copy(struct hal_rx_desc *fdesc,
209 					   struct hal_rx_desc *ldesc)
210 {
211 	memcpy((u8 *)&fdesc->msdu_end, (u8 *)&ldesc->msdu_end,
212 	       sizeof(struct rx_msdu_end));
213 	memcpy((u8 *)&fdesc->attention, (u8 *)&ldesc->attention,
214 	       sizeof(struct rx_attention));
215 	memcpy((u8 *)&fdesc->mpdu_end, (u8 *)&ldesc->mpdu_end,
216 	       sizeof(struct rx_mpdu_end));
217 }
218 
219 static u32 ath11k_dp_rxdesc_get_mpdulen_err(struct hal_rx_desc *rx_desc)
220 {
221 	struct rx_attention *rx_attn;
222 
223 	rx_attn = &rx_desc->attention;
224 
225 	return FIELD_GET(RX_ATTENTION_INFO1_MPDU_LEN_ERR,
226 			 __le32_to_cpu(rx_attn->info1));
227 }
228 
229 static u32 ath11k_dp_rxdesc_get_decap_format(struct hal_rx_desc *rx_desc)
230 {
231 	struct rx_msdu_start *rx_msdu_start;
232 
233 	rx_msdu_start = &rx_desc->msdu_start;
234 
235 	return FIELD_GET(RX_MSDU_START_INFO2_DECAP_FORMAT,
236 			 __le32_to_cpu(rx_msdu_start->info2));
237 }
238 
239 static u8 *ath11k_dp_rxdesc_get_80211hdr(struct hal_rx_desc *rx_desc)
240 {
241 	u8 *rx_pkt_hdr;
242 
243 	rx_pkt_hdr = &rx_desc->msdu_payload[0];
244 
245 	return rx_pkt_hdr;
246 }
247 
248 static bool ath11k_dp_rxdesc_mpdu_valid(struct hal_rx_desc *rx_desc)
249 {
250 	u32 tlv_tag;
251 
252 	tlv_tag = FIELD_GET(HAL_TLV_HDR_TAG,
253 			    __le32_to_cpu(rx_desc->mpdu_start_tag));
254 
255 	return tlv_tag == HAL_RX_MPDU_START;
256 }
257 
258 static u32 ath11k_dp_rxdesc_get_ppduid(struct hal_rx_desc *rx_desc)
259 {
260 	return __le16_to_cpu(rx_desc->mpdu_start.phy_ppdu_id);
261 }
262 
263 /* Returns number of Rx buffers replenished */
264 int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
265 			       struct dp_rxdma_ring *rx_ring,
266 			       int req_entries,
267 			       enum hal_rx_buf_return_buf_manager mgr,
268 			       gfp_t gfp)
269 {
270 	struct hal_srng *srng;
271 	u32 *desc;
272 	struct sk_buff *skb;
273 	int num_free;
274 	int num_remain;
275 	int buf_id;
276 	u32 cookie;
277 	dma_addr_t paddr;
278 
279 	req_entries = min(req_entries, rx_ring->bufs_max);
280 
281 	srng = &ab->hal.srng_list[rx_ring->refill_buf_ring.ring_id];
282 
283 	spin_lock_bh(&srng->lock);
284 
285 	ath11k_hal_srng_access_begin(ab, srng);
286 
287 	num_free = ath11k_hal_srng_src_num_free(ab, srng, true);
288 	if (!req_entries && (num_free > (rx_ring->bufs_max * 3) / 4))
289 		req_entries = num_free;
290 
291 	req_entries = min(num_free, req_entries);
292 	num_remain = req_entries;
293 
294 	while (num_remain > 0) {
295 		skb = dev_alloc_skb(DP_RX_BUFFER_SIZE +
296 				    DP_RX_BUFFER_ALIGN_SIZE);
297 		if (!skb)
298 			break;
299 
300 		if (!IS_ALIGNED((unsigned long)skb->data,
301 				DP_RX_BUFFER_ALIGN_SIZE)) {
302 			skb_pull(skb,
303 				 PTR_ALIGN(skb->data, DP_RX_BUFFER_ALIGN_SIZE) -
304 				 skb->data);
305 		}
306 
307 		paddr = dma_map_single(ab->dev, skb->data,
308 				       skb->len + skb_tailroom(skb),
309 				       DMA_FROM_DEVICE);
310 		if (dma_mapping_error(ab->dev, paddr))
311 			goto fail_free_skb;
312 
313 		spin_lock_bh(&rx_ring->idr_lock);
314 		buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 0,
315 				   rx_ring->bufs_max * 3, gfp);
316 		spin_unlock_bh(&rx_ring->idr_lock);
317 		if (buf_id < 0)
318 			goto fail_dma_unmap;
319 
320 		desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
321 		if (!desc)
322 			goto fail_idr_remove;
323 
324 		ATH11K_SKB_RXCB(skb)->paddr = paddr;
325 
326 		cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, mac_id) |
327 			 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
328 
329 		num_remain--;
330 
331 		ath11k_hal_rx_buf_addr_info_set(desc, paddr, cookie, mgr);
332 	}
333 
334 	ath11k_hal_srng_access_end(ab, srng);
335 
336 	spin_unlock_bh(&srng->lock);
337 
338 	return req_entries - num_remain;
339 
340 fail_idr_remove:
341 	spin_lock_bh(&rx_ring->idr_lock);
342 	idr_remove(&rx_ring->bufs_idr, buf_id);
343 	spin_unlock_bh(&rx_ring->idr_lock);
344 fail_dma_unmap:
345 	dma_unmap_single(ab->dev, paddr, skb->len + skb_tailroom(skb),
346 			 DMA_FROM_DEVICE);
347 fail_free_skb:
348 	dev_kfree_skb_any(skb);
349 
350 	ath11k_hal_srng_access_end(ab, srng);
351 
352 	spin_unlock_bh(&srng->lock);
353 
354 	return req_entries - num_remain;
355 }
356 
357 static int ath11k_dp_rxdma_buf_ring_free(struct ath11k *ar,
358 					 struct dp_rxdma_ring *rx_ring)
359 {
360 	struct ath11k_pdev_dp *dp = &ar->dp;
361 	struct sk_buff *skb;
362 	int buf_id;
363 
364 	spin_lock_bh(&rx_ring->idr_lock);
365 	idr_for_each_entry(&rx_ring->bufs_idr, skb, buf_id) {
366 		idr_remove(&rx_ring->bufs_idr, buf_id);
367 		/* TODO: Understand where internal driver does this dma_unmap of
368 		 * of rxdma_buffer.
369 		 */
370 		dma_unmap_single(ar->ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
371 				 skb->len + skb_tailroom(skb), DMA_FROM_DEVICE);
372 		dev_kfree_skb_any(skb);
373 	}
374 
375 	idr_destroy(&rx_ring->bufs_idr);
376 	spin_unlock_bh(&rx_ring->idr_lock);
377 
378 	rx_ring = &dp->rx_mon_status_refill_ring;
379 
380 	spin_lock_bh(&rx_ring->idr_lock);
381 	idr_for_each_entry(&rx_ring->bufs_idr, skb, buf_id) {
382 		idr_remove(&rx_ring->bufs_idr, buf_id);
383 		/* XXX: Understand where internal driver does this dma_unmap of
384 		 * of rxdma_buffer.
385 		 */
386 		dma_unmap_single(ar->ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
387 				 skb->len + skb_tailroom(skb), DMA_BIDIRECTIONAL);
388 		dev_kfree_skb_any(skb);
389 	}
390 
391 	idr_destroy(&rx_ring->bufs_idr);
392 	spin_unlock_bh(&rx_ring->idr_lock);
393 	return 0;
394 }
395 
396 static int ath11k_dp_rxdma_pdev_buf_free(struct ath11k *ar)
397 {
398 	struct ath11k_pdev_dp *dp = &ar->dp;
399 	struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
400 
401 	ath11k_dp_rxdma_buf_ring_free(ar, rx_ring);
402 
403 	rx_ring = &dp->rxdma_mon_buf_ring;
404 	ath11k_dp_rxdma_buf_ring_free(ar, rx_ring);
405 
406 	rx_ring = &dp->rx_mon_status_refill_ring;
407 	ath11k_dp_rxdma_buf_ring_free(ar, rx_ring);
408 	return 0;
409 }
410 
411 static int ath11k_dp_rxdma_ring_buf_setup(struct ath11k *ar,
412 					  struct dp_rxdma_ring *rx_ring,
413 					  u32 ringtype)
414 {
415 	struct ath11k_pdev_dp *dp = &ar->dp;
416 	int num_entries;
417 
418 	num_entries = rx_ring->refill_buf_ring.size /
419 		      ath11k_hal_srng_get_entrysize(ringtype);
420 
421 	rx_ring->bufs_max = num_entries;
422 	ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id, rx_ring, num_entries,
423 				   HAL_RX_BUF_RBM_SW3_BM, GFP_KERNEL);
424 	return 0;
425 }
426 
427 static int ath11k_dp_rxdma_pdev_buf_setup(struct ath11k *ar)
428 {
429 	struct ath11k_pdev_dp *dp = &ar->dp;
430 	struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
431 
432 	ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_BUF);
433 
434 	rx_ring = &dp->rxdma_mon_buf_ring;
435 	ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_MONITOR_BUF);
436 
437 	rx_ring = &dp->rx_mon_status_refill_ring;
438 	ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_MONITOR_STATUS);
439 
440 	return 0;
441 }
442 
443 static void ath11k_dp_rx_pdev_srng_free(struct ath11k *ar)
444 {
445 	struct ath11k_pdev_dp *dp = &ar->dp;
446 
447 	ath11k_dp_srng_cleanup(ar->ab, &dp->rx_refill_buf_ring.refill_buf_ring);
448 	ath11k_dp_srng_cleanup(ar->ab, &dp->rxdma_err_dst_ring);
449 	ath11k_dp_srng_cleanup(ar->ab, &dp->rx_mon_status_refill_ring.refill_buf_ring);
450 	ath11k_dp_srng_cleanup(ar->ab, &dp->rxdma_mon_buf_ring.refill_buf_ring);
451 }
452 
453 void ath11k_dp_pdev_reo_cleanup(struct ath11k_base *ab)
454 {
455 	struct ath11k_dp *dp = &ab->dp;
456 	int i;
457 
458 	for (i = 0; i < DP_REO_DST_RING_MAX; i++)
459 		ath11k_dp_srng_cleanup(ab, &dp->reo_dst_ring[i]);
460 }
461 
462 int ath11k_dp_pdev_reo_setup(struct ath11k_base *ab)
463 {
464 	struct ath11k_dp *dp = &ab->dp;
465 	int ret;
466 	int i;
467 
468 	for (i = 0; i < DP_REO_DST_RING_MAX; i++) {
469 		ret = ath11k_dp_srng_setup(ab, &dp->reo_dst_ring[i],
470 					   HAL_REO_DST, i, 0,
471 					   DP_REO_DST_RING_SIZE);
472 		if (ret) {
473 			ath11k_warn(ab, "failed to setup reo_dst_ring\n");
474 			goto err_reo_cleanup;
475 		}
476 	}
477 
478 	return 0;
479 
480 err_reo_cleanup:
481 	ath11k_dp_pdev_reo_cleanup(ab);
482 
483 	return ret;
484 }
485 
486 static int ath11k_dp_rx_pdev_srng_alloc(struct ath11k *ar)
487 {
488 	struct ath11k_pdev_dp *dp = &ar->dp;
489 	struct dp_srng *srng = NULL;
490 	int ret;
491 
492 	ret = ath11k_dp_srng_setup(ar->ab,
493 				   &dp->rx_refill_buf_ring.refill_buf_ring,
494 				   HAL_RXDMA_BUF, 0,
495 				   dp->mac_id, DP_RXDMA_BUF_RING_SIZE);
496 	if (ret) {
497 		ath11k_warn(ar->ab, "failed to setup rx_refill_buf_ring\n");
498 		return ret;
499 	}
500 
501 	ret = ath11k_dp_srng_setup(ar->ab, &dp->rxdma_err_dst_ring,
502 				   HAL_RXDMA_DST, 0, dp->mac_id,
503 				   DP_RXDMA_ERR_DST_RING_SIZE);
504 	if (ret) {
505 		ath11k_warn(ar->ab, "failed to setup rxdma_err_dst_ring\n");
506 		return ret;
507 	}
508 
509 	srng = &dp->rx_mon_status_refill_ring.refill_buf_ring;
510 	ret = ath11k_dp_srng_setup(ar->ab,
511 				   srng,
512 				   HAL_RXDMA_MONITOR_STATUS, 0, dp->mac_id,
513 				   DP_RXDMA_MON_STATUS_RING_SIZE);
514 	if (ret) {
515 		ath11k_warn(ar->ab,
516 			    "failed to setup rx_mon_status_refill_ring\n");
517 		return ret;
518 	}
519 	ret = ath11k_dp_srng_setup(ar->ab,
520 				   &dp->rxdma_mon_buf_ring.refill_buf_ring,
521 				   HAL_RXDMA_MONITOR_BUF, 0, dp->mac_id,
522 				   DP_RXDMA_MONITOR_BUF_RING_SIZE);
523 	if (ret) {
524 		ath11k_warn(ar->ab,
525 			    "failed to setup HAL_RXDMA_MONITOR_BUF\n");
526 		return ret;
527 	}
528 
529 	ret = ath11k_dp_srng_setup(ar->ab, &dp->rxdma_mon_dst_ring,
530 				   HAL_RXDMA_MONITOR_DST, 0, dp->mac_id,
531 				   DP_RXDMA_MONITOR_DST_RING_SIZE);
532 	if (ret) {
533 		ath11k_warn(ar->ab,
534 			    "failed to setup HAL_RXDMA_MONITOR_DST\n");
535 		return ret;
536 	}
537 
538 	ret = ath11k_dp_srng_setup(ar->ab, &dp->rxdma_mon_desc_ring,
539 				   HAL_RXDMA_MONITOR_DESC, 0, dp->mac_id,
540 				   DP_RXDMA_MONITOR_DESC_RING_SIZE);
541 	if (ret) {
542 		ath11k_warn(ar->ab,
543 			    "failed to setup HAL_RXDMA_MONITOR_DESC\n");
544 		return ret;
545 	}
546 
547 	return 0;
548 }
549 
550 void ath11k_dp_reo_cmd_list_cleanup(struct ath11k_base *ab)
551 {
552 	struct ath11k_dp *dp = &ab->dp;
553 	struct dp_reo_cmd *cmd, *tmp;
554 	struct dp_reo_cache_flush_elem *cmd_cache, *tmp_cache;
555 
556 	spin_lock_bh(&dp->reo_cmd_lock);
557 	list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
558 		list_del(&cmd->list);
559 		dma_unmap_single(ab->dev, cmd->data.paddr,
560 				 cmd->data.size, DMA_BIDIRECTIONAL);
561 		kfree(cmd->data.vaddr);
562 		kfree(cmd);
563 	}
564 
565 	list_for_each_entry_safe(cmd_cache, tmp_cache,
566 				 &dp->reo_cmd_cache_flush_list, list) {
567 		list_del(&cmd_cache->list);
568 		dp->reo_cmd_cache_flush_count--;
569 		dma_unmap_single(ab->dev, cmd_cache->data.paddr,
570 				 cmd_cache->data.size, DMA_BIDIRECTIONAL);
571 		kfree(cmd_cache->data.vaddr);
572 		kfree(cmd_cache);
573 	}
574 	spin_unlock_bh(&dp->reo_cmd_lock);
575 }
576 
577 static void ath11k_dp_reo_cmd_free(struct ath11k_dp *dp, void *ctx,
578 				   enum hal_reo_cmd_status status)
579 {
580 	struct dp_rx_tid *rx_tid = ctx;
581 
582 	if (status != HAL_REO_CMD_SUCCESS)
583 		ath11k_warn(dp->ab, "failed to flush rx tid hw desc, tid %d status %d\n",
584 			    rx_tid->tid, status);
585 
586 	dma_unmap_single(dp->ab->dev, rx_tid->paddr, rx_tid->size,
587 			 DMA_BIDIRECTIONAL);
588 	kfree(rx_tid->vaddr);
589 }
590 
591 static void ath11k_dp_reo_cache_flush(struct ath11k_base *ab,
592 				      struct dp_rx_tid *rx_tid)
593 {
594 	struct ath11k_hal_reo_cmd cmd = {0};
595 	unsigned long tot_desc_sz, desc_sz;
596 	int ret;
597 
598 	tot_desc_sz = rx_tid->size;
599 	desc_sz = ath11k_hal_reo_qdesc_size(0, HAL_DESC_REO_NON_QOS_TID);
600 
601 	while (tot_desc_sz > desc_sz) {
602 		tot_desc_sz -= desc_sz;
603 		cmd.addr_lo = lower_32_bits(rx_tid->paddr + tot_desc_sz);
604 		cmd.addr_hi = upper_32_bits(rx_tid->paddr);
605 		ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
606 						HAL_REO_CMD_FLUSH_CACHE, &cmd,
607 						NULL);
608 		if (ret)
609 			ath11k_warn(ab,
610 				    "failed to send HAL_REO_CMD_FLUSH_CACHE, tid %d (%d)\n",
611 				    rx_tid->tid, ret);
612 	}
613 
614 	memset(&cmd, 0, sizeof(cmd));
615 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
616 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
617 	cmd.flag |= HAL_REO_CMD_FLG_NEED_STATUS;
618 	ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
619 					HAL_REO_CMD_FLUSH_CACHE,
620 					&cmd, ath11k_dp_reo_cmd_free);
621 	if (ret) {
622 		ath11k_err(ab, "failed to send HAL_REO_CMD_FLUSH_CACHE cmd, tid %d (%d)\n",
623 			   rx_tid->tid, ret);
624 		dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
625 				 DMA_BIDIRECTIONAL);
626 		kfree(rx_tid->vaddr);
627 	}
628 }
629 
630 static void ath11k_dp_rx_tid_del_func(struct ath11k_dp *dp, void *ctx,
631 				      enum hal_reo_cmd_status status)
632 {
633 	struct ath11k_base *ab = dp->ab;
634 	struct dp_rx_tid *rx_tid = ctx;
635 	struct dp_reo_cache_flush_elem *elem, *tmp;
636 
637 	if (status == HAL_REO_CMD_DRAIN) {
638 		goto free_desc;
639 	} else if (status != HAL_REO_CMD_SUCCESS) {
640 		/* Shouldn't happen! Cleanup in case of other failure? */
641 		ath11k_warn(ab, "failed to delete rx tid %d hw descriptor %d\n",
642 			    rx_tid->tid, status);
643 		return;
644 	}
645 
646 	elem = kzalloc(sizeof(*elem), GFP_ATOMIC);
647 	if (!elem)
648 		goto free_desc;
649 
650 	elem->ts = jiffies;
651 	memcpy(&elem->data, rx_tid, sizeof(*rx_tid));
652 
653 	spin_lock_bh(&dp->reo_cmd_lock);
654 	list_add_tail(&elem->list, &dp->reo_cmd_cache_flush_list);
655 	dp->reo_cmd_cache_flush_count++;
656 
657 	/* Flush and invalidate aged REO desc from HW cache */
658 	list_for_each_entry_safe(elem, tmp, &dp->reo_cmd_cache_flush_list,
659 				 list) {
660 		if (dp->reo_cmd_cache_flush_count > DP_REO_DESC_FREE_THRESHOLD ||
661 		    time_after(jiffies, elem->ts +
662 			       msecs_to_jiffies(DP_REO_DESC_FREE_TIMEOUT_MS))) {
663 			list_del(&elem->list);
664 			dp->reo_cmd_cache_flush_count--;
665 			spin_unlock_bh(&dp->reo_cmd_lock);
666 
667 			ath11k_dp_reo_cache_flush(ab, &elem->data);
668 			kfree(elem);
669 			spin_lock_bh(&dp->reo_cmd_lock);
670 		}
671 	}
672 	spin_unlock_bh(&dp->reo_cmd_lock);
673 
674 	return;
675 free_desc:
676 	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
677 			 DMA_BIDIRECTIONAL);
678 	kfree(rx_tid->vaddr);
679 }
680 
681 void ath11k_peer_rx_tid_delete(struct ath11k *ar,
682 			       struct ath11k_peer *peer, u8 tid)
683 {
684 	struct ath11k_hal_reo_cmd cmd = {0};
685 	struct dp_rx_tid *rx_tid = &peer->rx_tid[tid];
686 	int ret;
687 
688 	if (!rx_tid->active)
689 		return;
690 
691 	cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
692 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
693 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
694 	cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
695 	ret = ath11k_dp_tx_send_reo_cmd(ar->ab, rx_tid,
696 					HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
697 					ath11k_dp_rx_tid_del_func);
698 	if (ret) {
699 		ath11k_err(ar->ab, "failed to send HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n",
700 			   tid, ret);
701 		dma_unmap_single(ar->ab->dev, rx_tid->paddr, rx_tid->size,
702 				 DMA_BIDIRECTIONAL);
703 		kfree(rx_tid->vaddr);
704 	}
705 
706 	rx_tid->active = false;
707 }
708 
709 static int ath11k_dp_rx_link_desc_return(struct ath11k_base *ab,
710 					 u32 *link_desc,
711 					 enum hal_wbm_rel_bm_act action)
712 {
713 	struct ath11k_dp *dp = &ab->dp;
714 	struct hal_srng *srng;
715 	u32 *desc;
716 	int ret = 0;
717 
718 	srng = &ab->hal.srng_list[dp->wbm_desc_rel_ring.ring_id];
719 
720 	spin_lock_bh(&srng->lock);
721 
722 	ath11k_hal_srng_access_begin(ab, srng);
723 
724 	desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
725 	if (!desc) {
726 		ret = -ENOBUFS;
727 		goto exit;
728 	}
729 
730 	ath11k_hal_rx_msdu_link_desc_set(ab, (void *)desc, (void *)link_desc,
731 					 action);
732 
733 exit:
734 	ath11k_hal_srng_access_end(ab, srng);
735 
736 	spin_unlock_bh(&srng->lock);
737 
738 	return ret;
739 }
740 
741 static void ath11k_dp_rx_frags_cleanup(struct dp_rx_tid *rx_tid, bool rel_link_desc)
742 {
743 	struct ath11k_base *ab = rx_tid->ab;
744 
745 	lockdep_assert_held(&ab->base_lock);
746 
747 	if (rx_tid->dst_ring_desc) {
748 		if (rel_link_desc)
749 			ath11k_dp_rx_link_desc_return(ab, (u32 *)rx_tid->dst_ring_desc,
750 						      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
751 		kfree(rx_tid->dst_ring_desc);
752 		rx_tid->dst_ring_desc = NULL;
753 	}
754 
755 	rx_tid->cur_sn = 0;
756 	rx_tid->last_frag_no = 0;
757 	rx_tid->rx_frag_bitmap = 0;
758 	__skb_queue_purge(&rx_tid->rx_frags);
759 }
760 
761 void ath11k_peer_rx_tid_cleanup(struct ath11k *ar, struct ath11k_peer *peer)
762 {
763 	struct dp_rx_tid *rx_tid;
764 	int i;
765 
766 	lockdep_assert_held(&ar->ab->base_lock);
767 
768 	for (i = 0; i <= IEEE80211_NUM_TIDS; i++) {
769 		rx_tid = &peer->rx_tid[i];
770 
771 		ath11k_peer_rx_tid_delete(ar, peer, i);
772 		ath11k_dp_rx_frags_cleanup(rx_tid, true);
773 
774 		spin_unlock_bh(&ar->ab->base_lock);
775 		del_timer_sync(&rx_tid->frag_timer);
776 		spin_lock_bh(&ar->ab->base_lock);
777 	}
778 }
779 
780 static int ath11k_peer_rx_tid_reo_update(struct ath11k *ar,
781 					 struct ath11k_peer *peer,
782 					 struct dp_rx_tid *rx_tid,
783 					 u32 ba_win_sz, u16 ssn,
784 					 bool update_ssn)
785 {
786 	struct ath11k_hal_reo_cmd cmd = {0};
787 	int ret;
788 
789 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
790 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
791 	cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
792 	cmd.upd0 = HAL_REO_CMD_UPD0_BA_WINDOW_SIZE;
793 	cmd.ba_window_size = ba_win_sz;
794 
795 	if (update_ssn) {
796 		cmd.upd0 |= HAL_REO_CMD_UPD0_SSN;
797 		cmd.upd2 = FIELD_PREP(HAL_REO_CMD_UPD2_SSN, ssn);
798 	}
799 
800 	ret = ath11k_dp_tx_send_reo_cmd(ar->ab, rx_tid,
801 					HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
802 					NULL);
803 	if (ret) {
804 		ath11k_warn(ar->ab, "failed to update rx tid queue, tid %d (%d)\n",
805 			    rx_tid->tid, ret);
806 		return ret;
807 	}
808 
809 	rx_tid->ba_win_sz = ba_win_sz;
810 
811 	return 0;
812 }
813 
814 static void ath11k_dp_rx_tid_mem_free(struct ath11k_base *ab,
815 				      const u8 *peer_mac, int vdev_id, u8 tid)
816 {
817 	struct ath11k_peer *peer;
818 	struct dp_rx_tid *rx_tid;
819 
820 	spin_lock_bh(&ab->base_lock);
821 
822 	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
823 	if (!peer) {
824 		ath11k_warn(ab, "failed to find the peer to free up rx tid mem\n");
825 		goto unlock_exit;
826 	}
827 
828 	rx_tid = &peer->rx_tid[tid];
829 	if (!rx_tid->active)
830 		goto unlock_exit;
831 
832 	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
833 			 DMA_BIDIRECTIONAL);
834 	kfree(rx_tid->vaddr);
835 
836 	rx_tid->active = false;
837 
838 unlock_exit:
839 	spin_unlock_bh(&ab->base_lock);
840 }
841 
842 int ath11k_peer_rx_tid_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id,
843 			     u8 tid, u32 ba_win_sz, u16 ssn,
844 			     enum hal_pn_type pn_type)
845 {
846 	struct ath11k_base *ab = ar->ab;
847 	struct ath11k_peer *peer;
848 	struct dp_rx_tid *rx_tid;
849 	u32 hw_desc_sz;
850 	u32 *addr_aligned;
851 	void *vaddr;
852 	dma_addr_t paddr;
853 	int ret;
854 
855 	spin_lock_bh(&ab->base_lock);
856 
857 	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
858 	if (!peer) {
859 		ath11k_warn(ab, "failed to find the peer to set up rx tid\n");
860 		spin_unlock_bh(&ab->base_lock);
861 		return -ENOENT;
862 	}
863 
864 	rx_tid = &peer->rx_tid[tid];
865 	/* Update the tid queue if it is already setup */
866 	if (rx_tid->active) {
867 		paddr = rx_tid->paddr;
868 		ret = ath11k_peer_rx_tid_reo_update(ar, peer, rx_tid,
869 						    ba_win_sz, ssn, true);
870 		spin_unlock_bh(&ab->base_lock);
871 		if (ret) {
872 			ath11k_warn(ab, "failed to update reo for rx tid %d\n", tid);
873 			return ret;
874 		}
875 
876 		ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id,
877 							     peer_mac, paddr,
878 							     tid, 1, ba_win_sz);
879 		if (ret)
880 			ath11k_warn(ab, "failed to send wmi command to update rx reorder queue, tid :%d (%d)\n",
881 				    tid, ret);
882 		return ret;
883 	}
884 
885 	rx_tid->tid = tid;
886 
887 	rx_tid->ba_win_sz = ba_win_sz;
888 
889 	/* TODO: Optimize the memory allocation for qos tid based on the
890 	 * the actual BA window size in REO tid update path.
891 	 */
892 	if (tid == HAL_DESC_REO_NON_QOS_TID)
893 		hw_desc_sz = ath11k_hal_reo_qdesc_size(ba_win_sz, tid);
894 	else
895 		hw_desc_sz = ath11k_hal_reo_qdesc_size(DP_BA_WIN_SZ_MAX, tid);
896 
897 	vaddr = kzalloc(hw_desc_sz + HAL_LINK_DESC_ALIGN - 1, GFP_ATOMIC);
898 	if (!vaddr) {
899 		spin_unlock_bh(&ab->base_lock);
900 		return -ENOMEM;
901 	}
902 
903 	addr_aligned = PTR_ALIGN(vaddr, HAL_LINK_DESC_ALIGN);
904 
905 	ath11k_hal_reo_qdesc_setup(addr_aligned, tid, ba_win_sz,
906 				   ssn, pn_type);
907 
908 	paddr = dma_map_single(ab->dev, addr_aligned, hw_desc_sz,
909 			       DMA_BIDIRECTIONAL);
910 
911 	ret = dma_mapping_error(ab->dev, paddr);
912 	if (ret) {
913 		spin_unlock_bh(&ab->base_lock);
914 		goto err_mem_free;
915 	}
916 
917 	rx_tid->vaddr = vaddr;
918 	rx_tid->paddr = paddr;
919 	rx_tid->size = hw_desc_sz;
920 	rx_tid->active = true;
921 
922 	spin_unlock_bh(&ab->base_lock);
923 
924 	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id, peer_mac,
925 						     paddr, tid, 1, ba_win_sz);
926 	if (ret) {
927 		ath11k_warn(ar->ab, "failed to setup rx reorder queue, tid :%d (%d)\n",
928 			    tid, ret);
929 		ath11k_dp_rx_tid_mem_free(ab, peer_mac, vdev_id, tid);
930 	}
931 
932 	return ret;
933 
934 err_mem_free:
935 	kfree(vaddr);
936 
937 	return ret;
938 }
939 
940 int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
941 			     struct ieee80211_ampdu_params *params)
942 {
943 	struct ath11k_base *ab = ar->ab;
944 	struct ath11k_sta *arsta = (void *)params->sta->drv_priv;
945 	int vdev_id = arsta->arvif->vdev_id;
946 	int ret;
947 
948 	ret = ath11k_peer_rx_tid_setup(ar, params->sta->addr, vdev_id,
949 				       params->tid, params->buf_size,
950 				       params->ssn, arsta->pn_type);
951 	if (ret)
952 		ath11k_warn(ab, "failed to setup rx tid %d\n", ret);
953 
954 	return ret;
955 }
956 
957 int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
958 			    struct ieee80211_ampdu_params *params)
959 {
960 	struct ath11k_base *ab = ar->ab;
961 	struct ath11k_peer *peer;
962 	struct ath11k_sta *arsta = (void *)params->sta->drv_priv;
963 	int vdev_id = arsta->arvif->vdev_id;
964 	dma_addr_t paddr;
965 	bool active;
966 	int ret;
967 
968 	spin_lock_bh(&ab->base_lock);
969 
970 	peer = ath11k_peer_find(ab, vdev_id, params->sta->addr);
971 	if (!peer) {
972 		ath11k_warn(ab, "failed to find the peer to stop rx aggregation\n");
973 		spin_unlock_bh(&ab->base_lock);
974 		return -ENOENT;
975 	}
976 
977 	paddr = peer->rx_tid[params->tid].paddr;
978 	active = peer->rx_tid[params->tid].active;
979 
980 	if (!active) {
981 		spin_unlock_bh(&ab->base_lock);
982 		return 0;
983 	}
984 
985 	ret = ath11k_peer_rx_tid_reo_update(ar, peer, peer->rx_tid, 1, 0, false);
986 	spin_unlock_bh(&ab->base_lock);
987 	if (ret) {
988 		ath11k_warn(ab, "failed to update reo for rx tid %d: %d\n",
989 			    params->tid, ret);
990 		return ret;
991 	}
992 
993 	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id,
994 						     params->sta->addr, paddr,
995 						     params->tid, 1, 1);
996 	if (ret)
997 		ath11k_warn(ab, "failed to send wmi to delete rx tid %d\n",
998 			    ret);
999 
1000 	return ret;
1001 }
1002 
1003 int ath11k_dp_peer_rx_pn_replay_config(struct ath11k_vif *arvif,
1004 				       const u8 *peer_addr,
1005 				       enum set_key_cmd key_cmd,
1006 				       struct ieee80211_key_conf *key)
1007 {
1008 	struct ath11k *ar = arvif->ar;
1009 	struct ath11k_base *ab = ar->ab;
1010 	struct ath11k_hal_reo_cmd cmd = {0};
1011 	struct ath11k_peer *peer;
1012 	struct dp_rx_tid *rx_tid;
1013 	u8 tid;
1014 	int ret = 0;
1015 
1016 	/* NOTE: Enable PN/TSC replay check offload only for unicast frames.
1017 	 * We use mac80211 PN/TSC replay check functionality for bcast/mcast
1018 	 * for now.
1019 	 */
1020 	if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1021 		return 0;
1022 
1023 	cmd.flag |= HAL_REO_CMD_FLG_NEED_STATUS;
1024 	cmd.upd0 |= HAL_REO_CMD_UPD0_PN |
1025 		    HAL_REO_CMD_UPD0_PN_SIZE |
1026 		    HAL_REO_CMD_UPD0_PN_VALID |
1027 		    HAL_REO_CMD_UPD0_PN_CHECK |
1028 		    HAL_REO_CMD_UPD0_SVLD;
1029 
1030 	switch (key->cipher) {
1031 	case WLAN_CIPHER_SUITE_TKIP:
1032 	case WLAN_CIPHER_SUITE_CCMP:
1033 	case WLAN_CIPHER_SUITE_CCMP_256:
1034 	case WLAN_CIPHER_SUITE_GCMP:
1035 	case WLAN_CIPHER_SUITE_GCMP_256:
1036 		if (key_cmd == SET_KEY) {
1037 			cmd.upd1 |= HAL_REO_CMD_UPD1_PN_CHECK;
1038 			cmd.pn_size = 48;
1039 		}
1040 		break;
1041 	default:
1042 		break;
1043 	}
1044 
1045 	spin_lock_bh(&ab->base_lock);
1046 
1047 	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
1048 	if (!peer) {
1049 		ath11k_warn(ab, "failed to find the peer to configure pn replay detection\n");
1050 		spin_unlock_bh(&ab->base_lock);
1051 		return -ENOENT;
1052 	}
1053 
1054 	for (tid = 0; tid <= IEEE80211_NUM_TIDS; tid++) {
1055 		rx_tid = &peer->rx_tid[tid];
1056 		if (!rx_tid->active)
1057 			continue;
1058 		cmd.addr_lo = lower_32_bits(rx_tid->paddr);
1059 		cmd.addr_hi = upper_32_bits(rx_tid->paddr);
1060 		ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
1061 						HAL_REO_CMD_UPDATE_RX_QUEUE,
1062 						&cmd, NULL);
1063 		if (ret) {
1064 			ath11k_warn(ab, "failed to configure rx tid %d queue for pn replay detection %d\n",
1065 				    tid, ret);
1066 			break;
1067 		}
1068 	}
1069 
1070 	spin_unlock_bh(&ar->ab->base_lock);
1071 
1072 	return ret;
1073 }
1074 
1075 static inline int ath11k_get_ppdu_user_index(struct htt_ppdu_stats *ppdu_stats,
1076 					     u16 peer_id)
1077 {
1078 	int i;
1079 
1080 	for (i = 0; i < HTT_PPDU_STATS_MAX_USERS - 1; i++) {
1081 		if (ppdu_stats->user_stats[i].is_valid_peer_id) {
1082 			if (peer_id == ppdu_stats->user_stats[i].peer_id)
1083 				return i;
1084 		} else {
1085 			return i;
1086 		}
1087 	}
1088 
1089 	return -EINVAL;
1090 }
1091 
1092 static int ath11k_htt_tlv_ppdu_stats_parse(struct ath11k_base *ab,
1093 					   u16 tag, u16 len, const void *ptr,
1094 					   void *data)
1095 {
1096 	struct htt_ppdu_stats_info *ppdu_info;
1097 	struct htt_ppdu_user_stats *user_stats;
1098 	int cur_user;
1099 	u16 peer_id;
1100 
1101 	ppdu_info = (struct htt_ppdu_stats_info *)data;
1102 
1103 	switch (tag) {
1104 	case HTT_PPDU_STATS_TAG_COMMON:
1105 		if (len < sizeof(struct htt_ppdu_stats_common)) {
1106 			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
1107 				    len, tag);
1108 			return -EINVAL;
1109 		}
1110 		memcpy((void *)&ppdu_info->ppdu_stats.common, ptr,
1111 		       sizeof(struct htt_ppdu_stats_common));
1112 		break;
1113 	case HTT_PPDU_STATS_TAG_USR_RATE:
1114 		if (len < sizeof(struct htt_ppdu_stats_user_rate)) {
1115 			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
1116 				    len, tag);
1117 			return -EINVAL;
1118 		}
1119 
1120 		peer_id = ((struct htt_ppdu_stats_user_rate *)ptr)->sw_peer_id;
1121 		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
1122 						      peer_id);
1123 		if (cur_user < 0)
1124 			return -EINVAL;
1125 		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
1126 		user_stats->peer_id = peer_id;
1127 		user_stats->is_valid_peer_id = true;
1128 		memcpy((void *)&user_stats->rate, ptr,
1129 		       sizeof(struct htt_ppdu_stats_user_rate));
1130 		user_stats->tlv_flags |= BIT(tag);
1131 		break;
1132 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON:
1133 		if (len < sizeof(struct htt_ppdu_stats_usr_cmpltn_cmn)) {
1134 			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
1135 				    len, tag);
1136 			return -EINVAL;
1137 		}
1138 
1139 		peer_id = ((struct htt_ppdu_stats_usr_cmpltn_cmn *)ptr)->sw_peer_id;
1140 		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
1141 						      peer_id);
1142 		if (cur_user < 0)
1143 			return -EINVAL;
1144 		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
1145 		user_stats->peer_id = peer_id;
1146 		user_stats->is_valid_peer_id = true;
1147 		memcpy((void *)&user_stats->cmpltn_cmn, ptr,
1148 		       sizeof(struct htt_ppdu_stats_usr_cmpltn_cmn));
1149 		user_stats->tlv_flags |= BIT(tag);
1150 		break;
1151 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_ACK_BA_STATUS:
1152 		if (len <
1153 		    sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status)) {
1154 			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
1155 				    len, tag);
1156 			return -EINVAL;
1157 		}
1158 
1159 		peer_id =
1160 		((struct htt_ppdu_stats_usr_cmpltn_ack_ba_status *)ptr)->sw_peer_id;
1161 		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
1162 						      peer_id);
1163 		if (cur_user < 0)
1164 			return -EINVAL;
1165 		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
1166 		user_stats->peer_id = peer_id;
1167 		user_stats->is_valid_peer_id = true;
1168 		memcpy((void *)&user_stats->ack_ba, ptr,
1169 		       sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status));
1170 		user_stats->tlv_flags |= BIT(tag);
1171 		break;
1172 	}
1173 	return 0;
1174 }
1175 
1176 int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
1177 			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
1178 				       const void *ptr, void *data),
1179 			   void *data)
1180 {
1181 	const struct htt_tlv *tlv;
1182 	const void *begin = ptr;
1183 	u16 tlv_tag, tlv_len;
1184 	int ret = -EINVAL;
1185 
1186 	while (len > 0) {
1187 		if (len < sizeof(*tlv)) {
1188 			ath11k_err(ab, "htt tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
1189 				   ptr - begin, len, sizeof(*tlv));
1190 			return -EINVAL;
1191 		}
1192 		tlv = (struct htt_tlv *)ptr;
1193 		tlv_tag = FIELD_GET(HTT_TLV_TAG, tlv->header);
1194 		tlv_len = FIELD_GET(HTT_TLV_LEN, tlv->header);
1195 		ptr += sizeof(*tlv);
1196 		len -= sizeof(*tlv);
1197 
1198 		if (tlv_len > len) {
1199 			ath11k_err(ab, "htt tlv parse failure of tag %hhu at byte %zd (%zu bytes left, %hhu expected)\n",
1200 				   tlv_tag, ptr - begin, len, tlv_len);
1201 			return -EINVAL;
1202 		}
1203 		ret = iter(ab, tlv_tag, tlv_len, ptr, data);
1204 		if (ret == -ENOMEM)
1205 			return ret;
1206 
1207 		ptr += tlv_len;
1208 		len -= tlv_len;
1209 	}
1210 	return 0;
1211 }
1212 
1213 static inline u32 ath11k_he_gi_to_nl80211_he_gi(u8 sgi)
1214 {
1215 	u32 ret = 0;
1216 
1217 	switch (sgi) {
1218 	case RX_MSDU_START_SGI_0_8_US:
1219 		ret = NL80211_RATE_INFO_HE_GI_0_8;
1220 		break;
1221 	case RX_MSDU_START_SGI_1_6_US:
1222 		ret = NL80211_RATE_INFO_HE_GI_1_6;
1223 		break;
1224 	case RX_MSDU_START_SGI_3_2_US:
1225 		ret = NL80211_RATE_INFO_HE_GI_3_2;
1226 		break;
1227 	}
1228 
1229 	return ret;
1230 }
1231 
1232 static void
1233 ath11k_update_per_peer_tx_stats(struct ath11k *ar,
1234 				struct htt_ppdu_stats *ppdu_stats, u8 user)
1235 {
1236 	struct ath11k_base *ab = ar->ab;
1237 	struct ath11k_peer *peer;
1238 	struct ieee80211_sta *sta;
1239 	struct ath11k_sta *arsta;
1240 	struct htt_ppdu_stats_user_rate *user_rate;
1241 	struct ath11k_per_peer_tx_stats *peer_stats = &ar->peer_tx_stats;
1242 	struct htt_ppdu_user_stats *usr_stats = &ppdu_stats->user_stats[user];
1243 	struct htt_ppdu_stats_common *common = &ppdu_stats->common;
1244 	int ret;
1245 	u8 flags, mcs, nss, bw, sgi, dcm, rate_idx = 0;
1246 	u32 succ_bytes = 0;
1247 	u16 rate = 0, succ_pkts = 0;
1248 	u32 tx_duration = 0;
1249 	u8 tid = HTT_PPDU_STATS_NON_QOS_TID;
1250 	bool is_ampdu = false;
1251 
1252 	if (!usr_stats)
1253 		return;
1254 
1255 	if (!(usr_stats->tlv_flags & BIT(HTT_PPDU_STATS_TAG_USR_RATE)))
1256 		return;
1257 
1258 	if (usr_stats->tlv_flags & BIT(HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON))
1259 		is_ampdu =
1260 			HTT_USR_CMPLTN_IS_AMPDU(usr_stats->cmpltn_cmn.flags);
1261 
1262 	if (usr_stats->tlv_flags &
1263 	    BIT(HTT_PPDU_STATS_TAG_USR_COMPLTN_ACK_BA_STATUS)) {
1264 		succ_bytes = usr_stats->ack_ba.success_bytes;
1265 		succ_pkts = FIELD_GET(HTT_PPDU_STATS_ACK_BA_INFO_NUM_MSDU_M,
1266 				      usr_stats->ack_ba.info);
1267 		tid = FIELD_GET(HTT_PPDU_STATS_ACK_BA_INFO_TID_NUM,
1268 				usr_stats->ack_ba.info);
1269 	}
1270 
1271 	if (common->fes_duration_us)
1272 		tx_duration = common->fes_duration_us;
1273 
1274 	user_rate = &usr_stats->rate;
1275 	flags = HTT_USR_RATE_PREAMBLE(user_rate->rate_flags);
1276 	bw = HTT_USR_RATE_BW(user_rate->rate_flags) - 2;
1277 	nss = HTT_USR_RATE_NSS(user_rate->rate_flags) + 1;
1278 	mcs = HTT_USR_RATE_MCS(user_rate->rate_flags);
1279 	sgi = HTT_USR_RATE_GI(user_rate->rate_flags);
1280 	dcm = HTT_USR_RATE_DCM(user_rate->rate_flags);
1281 
1282 	/* Note: If host configured fixed rates and in some other special
1283 	 * cases, the broadcast/management frames are sent in different rates.
1284 	 * Firmware rate's control to be skipped for this?
1285 	 */
1286 
1287 	if (flags == WMI_RATE_PREAMBLE_HE && mcs > 11) {
1288 		ath11k_warn(ab, "Invalid HE mcs %hhd peer stats",  mcs);
1289 		return;
1290 	}
1291 
1292 	if (flags == WMI_RATE_PREAMBLE_HE && mcs > ATH11K_HE_MCS_MAX) {
1293 		ath11k_warn(ab, "Invalid HE mcs %hhd peer stats",  mcs);
1294 		return;
1295 	}
1296 
1297 	if (flags == WMI_RATE_PREAMBLE_VHT && mcs > ATH11K_VHT_MCS_MAX) {
1298 		ath11k_warn(ab, "Invalid VHT mcs %hhd peer stats",  mcs);
1299 		return;
1300 	}
1301 
1302 	if (flags == WMI_RATE_PREAMBLE_HT && (mcs > ATH11K_HT_MCS_MAX || nss < 1)) {
1303 		ath11k_warn(ab, "Invalid HT mcs %hhd nss %hhd peer stats",
1304 			    mcs, nss);
1305 		return;
1306 	}
1307 
1308 	if (flags == WMI_RATE_PREAMBLE_CCK || flags == WMI_RATE_PREAMBLE_OFDM) {
1309 		ret = ath11k_mac_hw_ratecode_to_legacy_rate(mcs,
1310 							    flags,
1311 							    &rate_idx,
1312 							    &rate);
1313 		if (ret < 0)
1314 			return;
1315 	}
1316 
1317 	rcu_read_lock();
1318 	spin_lock_bh(&ab->base_lock);
1319 	peer = ath11k_peer_find_by_id(ab, usr_stats->peer_id);
1320 
1321 	if (!peer || !peer->sta) {
1322 		spin_unlock_bh(&ab->base_lock);
1323 		rcu_read_unlock();
1324 		return;
1325 	}
1326 
1327 	sta = peer->sta;
1328 	arsta = (struct ath11k_sta *)sta->drv_priv;
1329 
1330 	memset(&arsta->txrate, 0, sizeof(arsta->txrate));
1331 
1332 	switch (flags) {
1333 	case WMI_RATE_PREAMBLE_OFDM:
1334 		arsta->txrate.legacy = rate;
1335 		break;
1336 	case WMI_RATE_PREAMBLE_CCK:
1337 		arsta->txrate.legacy = rate;
1338 		break;
1339 	case WMI_RATE_PREAMBLE_HT:
1340 		arsta->txrate.mcs = mcs + 8 * (nss - 1);
1341 		arsta->txrate.flags = RATE_INFO_FLAGS_MCS;
1342 		if (sgi)
1343 			arsta->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
1344 		break;
1345 	case WMI_RATE_PREAMBLE_VHT:
1346 		arsta->txrate.mcs = mcs;
1347 		arsta->txrate.flags = RATE_INFO_FLAGS_VHT_MCS;
1348 		if (sgi)
1349 			arsta->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
1350 		break;
1351 	case WMI_RATE_PREAMBLE_HE:
1352 		arsta->txrate.mcs = mcs;
1353 		arsta->txrate.flags = RATE_INFO_FLAGS_HE_MCS;
1354 		arsta->txrate.he_dcm = dcm;
1355 		arsta->txrate.he_gi = ath11k_he_gi_to_nl80211_he_gi(sgi);
1356 		arsta->txrate.he_ru_alloc = ath11k_he_ru_tones_to_nl80211_he_ru_alloc(
1357 						(user_rate->ru_end -
1358 						 user_rate->ru_start) + 1);
1359 		break;
1360 	}
1361 
1362 	arsta->txrate.nss = nss;
1363 	arsta->txrate.bw = ath11k_mac_bw_to_mac80211_bw(bw);
1364 	arsta->tx_duration += tx_duration;
1365 	memcpy(&arsta->last_txrate, &arsta->txrate, sizeof(struct rate_info));
1366 
1367 	/* PPDU stats reported for mgmt packet doesn't have valid tx bytes.
1368 	 * So skip peer stats update for mgmt packets.
1369 	 */
1370 	if (tid < HTT_PPDU_STATS_NON_QOS_TID) {
1371 		memset(peer_stats, 0, sizeof(*peer_stats));
1372 		peer_stats->succ_pkts = succ_pkts;
1373 		peer_stats->succ_bytes = succ_bytes;
1374 		peer_stats->is_ampdu = is_ampdu;
1375 		peer_stats->duration = tx_duration;
1376 		peer_stats->ba_fails =
1377 			HTT_USR_CMPLTN_LONG_RETRY(usr_stats->cmpltn_cmn.flags) +
1378 			HTT_USR_CMPLTN_SHORT_RETRY(usr_stats->cmpltn_cmn.flags);
1379 
1380 		if (ath11k_debug_is_extd_tx_stats_enabled(ar))
1381 			ath11k_accumulate_per_peer_tx_stats(arsta,
1382 							    peer_stats, rate_idx);
1383 	}
1384 
1385 	spin_unlock_bh(&ab->base_lock);
1386 	rcu_read_unlock();
1387 }
1388 
1389 static void ath11k_htt_update_ppdu_stats(struct ath11k *ar,
1390 					 struct htt_ppdu_stats *ppdu_stats)
1391 {
1392 	u8 user;
1393 
1394 	for (user = 0; user < HTT_PPDU_STATS_MAX_USERS - 1; user++)
1395 		ath11k_update_per_peer_tx_stats(ar, ppdu_stats, user);
1396 }
1397 
1398 static
1399 struct htt_ppdu_stats_info *ath11k_dp_htt_get_ppdu_desc(struct ath11k *ar,
1400 							u32 ppdu_id)
1401 {
1402 	struct htt_ppdu_stats_info *ppdu_info;
1403 
1404 	spin_lock_bh(&ar->data_lock);
1405 	if (!list_empty(&ar->ppdu_stats_info)) {
1406 		list_for_each_entry(ppdu_info, &ar->ppdu_stats_info, list) {
1407 			if (ppdu_info->ppdu_id == ppdu_id) {
1408 				spin_unlock_bh(&ar->data_lock);
1409 				return ppdu_info;
1410 			}
1411 		}
1412 
1413 		if (ar->ppdu_stat_list_depth > HTT_PPDU_DESC_MAX_DEPTH) {
1414 			ppdu_info = list_first_entry(&ar->ppdu_stats_info,
1415 						     typeof(*ppdu_info), list);
1416 			list_del(&ppdu_info->list);
1417 			ar->ppdu_stat_list_depth--;
1418 			ath11k_htt_update_ppdu_stats(ar, &ppdu_info->ppdu_stats);
1419 			kfree(ppdu_info);
1420 		}
1421 	}
1422 	spin_unlock_bh(&ar->data_lock);
1423 
1424 	ppdu_info = kzalloc(sizeof(*ppdu_info), GFP_KERNEL);
1425 	if (!ppdu_info)
1426 		return NULL;
1427 
1428 	spin_lock_bh(&ar->data_lock);
1429 	list_add_tail(&ppdu_info->list, &ar->ppdu_stats_info);
1430 	ar->ppdu_stat_list_depth++;
1431 	spin_unlock_bh(&ar->data_lock);
1432 
1433 	return ppdu_info;
1434 }
1435 
1436 static int ath11k_htt_pull_ppdu_stats(struct ath11k_base *ab,
1437 				      struct sk_buff *skb)
1438 {
1439 	struct ath11k_htt_ppdu_stats_msg *msg;
1440 	struct htt_ppdu_stats_info *ppdu_info;
1441 	struct ath11k *ar;
1442 	int ret;
1443 	u8 pdev_id;
1444 	u32 ppdu_id, len;
1445 
1446 	msg = (struct ath11k_htt_ppdu_stats_msg *)skb->data;
1447 	len = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PAYLOAD_SIZE, msg->info);
1448 	pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PDEV_ID, msg->info);
1449 	ppdu_id = msg->ppdu_id;
1450 
1451 	rcu_read_lock();
1452 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
1453 	if (!ar) {
1454 		ret = -EINVAL;
1455 		goto exit;
1456 	}
1457 
1458 	if (ath11k_debug_is_pktlog_lite_mode_enabled(ar))
1459 		trace_ath11k_htt_ppdu_stats(ar, skb->data, len);
1460 
1461 	ppdu_info = ath11k_dp_htt_get_ppdu_desc(ar, ppdu_id);
1462 	if (!ppdu_info) {
1463 		ret = -EINVAL;
1464 		goto exit;
1465 	}
1466 
1467 	ppdu_info->ppdu_id = ppdu_id;
1468 	ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
1469 				     ath11k_htt_tlv_ppdu_stats_parse,
1470 				     (void *)ppdu_info);
1471 	if (ret) {
1472 		ath11k_warn(ab, "Failed to parse tlv %d\n", ret);
1473 		goto exit;
1474 	}
1475 
1476 exit:
1477 	rcu_read_unlock();
1478 
1479 	return ret;
1480 }
1481 
1482 static void ath11k_htt_pktlog(struct ath11k_base *ab, struct sk_buff *skb)
1483 {
1484 	struct htt_pktlog_msg *data = (struct htt_pktlog_msg *)skb->data;
1485 	struct ath_pktlog_hdr *hdr = (struct ath_pktlog_hdr *)data;
1486 	struct ath11k *ar;
1487 	u8 pdev_id;
1488 
1489 	pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PDEV_ID, data->hdr);
1490 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
1491 	if (!ar) {
1492 		ath11k_warn(ab, "invalid pdev id %d on htt pktlog\n", pdev_id);
1493 		return;
1494 	}
1495 
1496 	trace_ath11k_htt_pktlog(ar, data->payload, hdr->size,
1497 				ar->ab->pktlog_defs_checksum);
1498 }
1499 
1500 static void ath11k_htt_backpressure_event_handler(struct ath11k_base *ab,
1501 						  struct sk_buff *skb)
1502 {
1503 	u32 *data = (u32 *)skb->data;
1504 	u8 pdev_id, ring_type, ring_id, pdev_idx;
1505 	u16 hp, tp;
1506 	u32 backpressure_time;
1507 	struct ath11k_bp_stats *bp_stats;
1508 
1509 	pdev_id = FIELD_GET(HTT_BACKPRESSURE_EVENT_PDEV_ID_M, *data);
1510 	ring_type = FIELD_GET(HTT_BACKPRESSURE_EVENT_RING_TYPE_M, *data);
1511 	ring_id = FIELD_GET(HTT_BACKPRESSURE_EVENT_RING_ID_M, *data);
1512 	++data;
1513 
1514 	hp = FIELD_GET(HTT_BACKPRESSURE_EVENT_HP_M, *data);
1515 	tp = FIELD_GET(HTT_BACKPRESSURE_EVENT_TP_M, *data);
1516 	++data;
1517 
1518 	backpressure_time = *data;
1519 
1520 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "htt backpressure event, pdev %d, ring type %d,ring id %d, hp %d tp %d, backpressure time %d\n",
1521 		   pdev_id, ring_type, ring_id, hp, tp, backpressure_time);
1522 
1523 	if (ring_type == HTT_BACKPRESSURE_UMAC_RING_TYPE) {
1524 		if (ring_id >= HTT_SW_UMAC_RING_IDX_MAX)
1525 			return;
1526 
1527 		bp_stats = &ab->soc_stats.bp_stats.umac_ring_bp_stats[ring_id];
1528 	} else if (ring_type == HTT_BACKPRESSURE_LMAC_RING_TYPE) {
1529 		pdev_idx = DP_HW2SW_MACID(pdev_id);
1530 
1531 		if (ring_id >= HTT_SW_LMAC_RING_IDX_MAX || pdev_idx >= MAX_RADIOS)
1532 			return;
1533 
1534 		bp_stats = &ab->soc_stats.bp_stats.lmac_ring_bp_stats[ring_id][pdev_idx];
1535 	} else {
1536 		ath11k_warn(ab, "unknown ring type received in htt bp event %d\n",
1537 			    ring_type);
1538 		return;
1539 	}
1540 
1541 	spin_lock_bh(&ab->base_lock);
1542 	bp_stats->hp = hp;
1543 	bp_stats->tp = tp;
1544 	bp_stats->count++;
1545 	bp_stats->jiffies = jiffies;
1546 	spin_unlock_bh(&ab->base_lock);
1547 }
1548 
1549 void ath11k_dp_htt_htc_t2h_msg_handler(struct ath11k_base *ab,
1550 				       struct sk_buff *skb)
1551 {
1552 	struct ath11k_dp *dp = &ab->dp;
1553 	struct htt_resp_msg *resp = (struct htt_resp_msg *)skb->data;
1554 	enum htt_t2h_msg_type type = FIELD_GET(HTT_T2H_MSG_TYPE, *(u32 *)resp);
1555 	u16 peer_id;
1556 	u8 vdev_id;
1557 	u8 mac_addr[ETH_ALEN];
1558 	u16 peer_mac_h16;
1559 	u16 ast_hash;
1560 
1561 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "dp_htt rx msg type :0x%0x\n", type);
1562 
1563 	switch (type) {
1564 	case HTT_T2H_MSG_TYPE_VERSION_CONF:
1565 		dp->htt_tgt_ver_major = FIELD_GET(HTT_T2H_VERSION_CONF_MAJOR,
1566 						  resp->version_msg.version);
1567 		dp->htt_tgt_ver_minor = FIELD_GET(HTT_T2H_VERSION_CONF_MINOR,
1568 						  resp->version_msg.version);
1569 		complete(&dp->htt_tgt_version_received);
1570 		break;
1571 	case HTT_T2H_MSG_TYPE_PEER_MAP:
1572 		vdev_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO_VDEV_ID,
1573 				    resp->peer_map_ev.info);
1574 		peer_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO_PEER_ID,
1575 				    resp->peer_map_ev.info);
1576 		peer_mac_h16 = FIELD_GET(HTT_T2H_PEER_MAP_INFO1_MAC_ADDR_H16,
1577 					 resp->peer_map_ev.info1);
1578 		ath11k_dp_get_mac_addr(resp->peer_map_ev.mac_addr_l32,
1579 				       peer_mac_h16, mac_addr);
1580 		ast_hash = FIELD_GET(HTT_T2H_PEER_MAP_INFO2_AST_HASH_VAL,
1581 				     resp->peer_map_ev.info2);
1582 		ath11k_peer_map_event(ab, vdev_id, peer_id, mac_addr, ast_hash);
1583 		break;
1584 	case HTT_T2H_MSG_TYPE_PEER_UNMAP:
1585 		peer_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_PEER_ID,
1586 				    resp->peer_unmap_ev.info);
1587 		ath11k_peer_unmap_event(ab, peer_id);
1588 		break;
1589 	case HTT_T2H_MSG_TYPE_PPDU_STATS_IND:
1590 		ath11k_htt_pull_ppdu_stats(ab, skb);
1591 		break;
1592 	case HTT_T2H_MSG_TYPE_EXT_STATS_CONF:
1593 		ath11k_dbg_htt_ext_stats_handler(ab, skb);
1594 		break;
1595 	case HTT_T2H_MSG_TYPE_PKTLOG:
1596 		ath11k_htt_pktlog(ab, skb);
1597 		break;
1598 	case HTT_T2H_MSG_TYPE_BKPRESSURE_EVENT_IND:
1599 		ath11k_htt_backpressure_event_handler(ab, skb);
1600 		break;
1601 	default:
1602 		ath11k_warn(ab, "htt event %d not handled\n", type);
1603 		break;
1604 	}
1605 
1606 	dev_kfree_skb_any(skb);
1607 }
1608 
1609 static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar,
1610 				      struct sk_buff_head *msdu_list,
1611 				      struct sk_buff *first, struct sk_buff *last,
1612 				      u8 l3pad_bytes, int msdu_len)
1613 {
1614 	struct sk_buff *skb;
1615 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(first);
1616 	int buf_first_hdr_len, buf_first_len;
1617 	struct hal_rx_desc *ldesc;
1618 	int space_extra;
1619 	int rem_len;
1620 	int buf_len;
1621 
1622 	/* As the msdu is spread across multiple rx buffers,
1623 	 * find the offset to the start of msdu for computing
1624 	 * the length of the msdu in the first buffer.
1625 	 */
1626 	buf_first_hdr_len = HAL_RX_DESC_SIZE + l3pad_bytes;
1627 	buf_first_len = DP_RX_BUFFER_SIZE - buf_first_hdr_len;
1628 
1629 	if (WARN_ON_ONCE(msdu_len <= buf_first_len)) {
1630 		skb_put(first, buf_first_hdr_len + msdu_len);
1631 		skb_pull(first, buf_first_hdr_len);
1632 		return 0;
1633 	}
1634 
1635 	ldesc = (struct hal_rx_desc *)last->data;
1636 	rxcb->is_first_msdu = ath11k_dp_rx_h_msdu_end_first_msdu(ldesc);
1637 	rxcb->is_last_msdu = ath11k_dp_rx_h_msdu_end_last_msdu(ldesc);
1638 
1639 	/* MSDU spans over multiple buffers because the length of the MSDU
1640 	 * exceeds DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE. So assume the data
1641 	 * in the first buf is of length DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE.
1642 	 */
1643 	skb_put(first, DP_RX_BUFFER_SIZE);
1644 	skb_pull(first, buf_first_hdr_len);
1645 
1646 	/* When an MSDU spread over multiple buffers attention, MSDU_END and
1647 	 * MPDU_END tlvs are valid only in the last buffer. Copy those tlvs.
1648 	 */
1649 	ath11k_dp_rx_desc_end_tlv_copy(rxcb->rx_desc, ldesc);
1650 
1651 	space_extra = msdu_len - (buf_first_len + skb_tailroom(first));
1652 	if (space_extra > 0 &&
1653 	    (pskb_expand_head(first, 0, space_extra, GFP_ATOMIC) < 0)) {
1654 		/* Free up all buffers of the MSDU */
1655 		while ((skb = __skb_dequeue(msdu_list)) != NULL) {
1656 			rxcb = ATH11K_SKB_RXCB(skb);
1657 			if (!rxcb->is_continuation) {
1658 				dev_kfree_skb_any(skb);
1659 				break;
1660 			}
1661 			dev_kfree_skb_any(skb);
1662 		}
1663 		return -ENOMEM;
1664 	}
1665 
1666 	rem_len = msdu_len - buf_first_len;
1667 	while ((skb = __skb_dequeue(msdu_list)) != NULL && rem_len > 0) {
1668 		rxcb = ATH11K_SKB_RXCB(skb);
1669 		if (rxcb->is_continuation)
1670 			buf_len = DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE;
1671 		else
1672 			buf_len = rem_len;
1673 
1674 		if (buf_len > (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE)) {
1675 			WARN_ON_ONCE(1);
1676 			dev_kfree_skb_any(skb);
1677 			return -EINVAL;
1678 		}
1679 
1680 		skb_put(skb, buf_len + HAL_RX_DESC_SIZE);
1681 		skb_pull(skb, HAL_RX_DESC_SIZE);
1682 		skb_copy_from_linear_data(skb, skb_put(first, buf_len),
1683 					  buf_len);
1684 		dev_kfree_skb_any(skb);
1685 
1686 		rem_len -= buf_len;
1687 		if (!rxcb->is_continuation)
1688 			break;
1689 	}
1690 
1691 	return 0;
1692 }
1693 
1694 static struct sk_buff *ath11k_dp_rx_get_msdu_last_buf(struct sk_buff_head *msdu_list,
1695 						      struct sk_buff *first)
1696 {
1697 	struct sk_buff *skb;
1698 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(first);
1699 
1700 	if (!rxcb->is_continuation)
1701 		return first;
1702 
1703 	skb_queue_walk(msdu_list, skb) {
1704 		rxcb = ATH11K_SKB_RXCB(skb);
1705 		if (!rxcb->is_continuation)
1706 			return skb;
1707 	}
1708 
1709 	return NULL;
1710 }
1711 
1712 static void ath11k_dp_rx_h_csum_offload(struct sk_buff *msdu)
1713 {
1714 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
1715 	bool ip_csum_fail, l4_csum_fail;
1716 
1717 	ip_csum_fail = ath11k_dp_rx_h_attn_ip_cksum_fail(rxcb->rx_desc);
1718 	l4_csum_fail = ath11k_dp_rx_h_attn_l4_cksum_fail(rxcb->rx_desc);
1719 
1720 	msdu->ip_summed = (ip_csum_fail || l4_csum_fail) ?
1721 			  CHECKSUM_NONE : CHECKSUM_UNNECESSARY;
1722 }
1723 
1724 static int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
1725 				       enum hal_encrypt_type enctype)
1726 {
1727 	switch (enctype) {
1728 	case HAL_ENCRYPT_TYPE_OPEN:
1729 	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
1730 	case HAL_ENCRYPT_TYPE_TKIP_MIC:
1731 		return 0;
1732 	case HAL_ENCRYPT_TYPE_CCMP_128:
1733 		return IEEE80211_CCMP_MIC_LEN;
1734 	case HAL_ENCRYPT_TYPE_CCMP_256:
1735 		return IEEE80211_CCMP_256_MIC_LEN;
1736 	case HAL_ENCRYPT_TYPE_GCMP_128:
1737 	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
1738 		return IEEE80211_GCMP_MIC_LEN;
1739 	case HAL_ENCRYPT_TYPE_WEP_40:
1740 	case HAL_ENCRYPT_TYPE_WEP_104:
1741 	case HAL_ENCRYPT_TYPE_WEP_128:
1742 	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
1743 	case HAL_ENCRYPT_TYPE_WAPI:
1744 		break;
1745 	}
1746 
1747 	ath11k_warn(ar->ab, "unsupported encryption type %d for mic len\n", enctype);
1748 	return 0;
1749 }
1750 
1751 static int ath11k_dp_rx_crypto_param_len(struct ath11k *ar,
1752 					 enum hal_encrypt_type enctype)
1753 {
1754 	switch (enctype) {
1755 	case HAL_ENCRYPT_TYPE_OPEN:
1756 		return 0;
1757 	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
1758 	case HAL_ENCRYPT_TYPE_TKIP_MIC:
1759 		return IEEE80211_TKIP_IV_LEN;
1760 	case HAL_ENCRYPT_TYPE_CCMP_128:
1761 		return IEEE80211_CCMP_HDR_LEN;
1762 	case HAL_ENCRYPT_TYPE_CCMP_256:
1763 		return IEEE80211_CCMP_256_HDR_LEN;
1764 	case HAL_ENCRYPT_TYPE_GCMP_128:
1765 	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
1766 		return IEEE80211_GCMP_HDR_LEN;
1767 	case HAL_ENCRYPT_TYPE_WEP_40:
1768 	case HAL_ENCRYPT_TYPE_WEP_104:
1769 	case HAL_ENCRYPT_TYPE_WEP_128:
1770 	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
1771 	case HAL_ENCRYPT_TYPE_WAPI:
1772 		break;
1773 	}
1774 
1775 	ath11k_warn(ar->ab, "unsupported encryption type %d\n", enctype);
1776 	return 0;
1777 }
1778 
1779 static int ath11k_dp_rx_crypto_icv_len(struct ath11k *ar,
1780 				       enum hal_encrypt_type enctype)
1781 {
1782 	switch (enctype) {
1783 	case HAL_ENCRYPT_TYPE_OPEN:
1784 	case HAL_ENCRYPT_TYPE_CCMP_128:
1785 	case HAL_ENCRYPT_TYPE_CCMP_256:
1786 	case HAL_ENCRYPT_TYPE_GCMP_128:
1787 	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
1788 		return 0;
1789 	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
1790 	case HAL_ENCRYPT_TYPE_TKIP_MIC:
1791 		return IEEE80211_TKIP_ICV_LEN;
1792 	case HAL_ENCRYPT_TYPE_WEP_40:
1793 	case HAL_ENCRYPT_TYPE_WEP_104:
1794 	case HAL_ENCRYPT_TYPE_WEP_128:
1795 	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
1796 	case HAL_ENCRYPT_TYPE_WAPI:
1797 		break;
1798 	}
1799 
1800 	ath11k_warn(ar->ab, "unsupported encryption type %d\n", enctype);
1801 	return 0;
1802 }
1803 
1804 static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
1805 					 struct sk_buff *msdu,
1806 					 u8 *first_hdr,
1807 					 enum hal_encrypt_type enctype,
1808 					 struct ieee80211_rx_status *status)
1809 {
1810 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
1811 	u8 decap_hdr[DP_MAX_NWIFI_HDR_LEN];
1812 	struct ieee80211_hdr *hdr;
1813 	size_t hdr_len;
1814 	u8 da[ETH_ALEN];
1815 	u8 sa[ETH_ALEN];
1816 	u16 qos_ctl = 0;
1817 	u8 *qos;
1818 
1819 	/* copy SA & DA and pull decapped header */
1820 	hdr = (struct ieee80211_hdr *)msdu->data;
1821 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
1822 	ether_addr_copy(da, ieee80211_get_DA(hdr));
1823 	ether_addr_copy(sa, ieee80211_get_SA(hdr));
1824 	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
1825 
1826 	if (rxcb->is_first_msdu) {
1827 		/* original 802.11 header is valid for the first msdu
1828 		 * hence we can reuse the same header
1829 		 */
1830 		hdr = (struct ieee80211_hdr *)first_hdr;
1831 		hdr_len = ieee80211_hdrlen(hdr->frame_control);
1832 
1833 		/* Each A-MSDU subframe will be reported as a separate MSDU,
1834 		 * so strip the A-MSDU bit from QoS Ctl.
1835 		 */
1836 		if (ieee80211_is_data_qos(hdr->frame_control)) {
1837 			qos = ieee80211_get_qos_ctl(hdr);
1838 			qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
1839 		}
1840 	} else {
1841 		/*  Rebuild qos header if this is a middle/last msdu */
1842 		hdr->frame_control |= __cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1843 
1844 		/* Reset the order bit as the HT_Control header is stripped */
1845 		hdr->frame_control &= ~(__cpu_to_le16(IEEE80211_FCTL_ORDER));
1846 
1847 		qos_ctl = rxcb->tid;
1848 
1849 		if (ath11k_dp_rx_h_msdu_start_mesh_ctl_present(rxcb->rx_desc))
1850 			qos_ctl |= IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT;
1851 
1852 		/* TODO Add other QoS ctl fields when required */
1853 
1854 		/* copy decap header before overwriting for reuse below */
1855 		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
1856 	}
1857 
1858 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
1859 		memcpy(skb_push(msdu,
1860 				ath11k_dp_rx_crypto_param_len(ar, enctype)),
1861 		       (void *)hdr + hdr_len,
1862 		       ath11k_dp_rx_crypto_param_len(ar, enctype));
1863 	}
1864 
1865 	if (!rxcb->is_first_msdu) {
1866 		memcpy(skb_push(msdu,
1867 				IEEE80211_QOS_CTL_LEN), &qos_ctl,
1868 				IEEE80211_QOS_CTL_LEN);
1869 		memcpy(skb_push(msdu, hdr_len), decap_hdr, hdr_len);
1870 		return;
1871 	}
1872 
1873 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
1874 
1875 	/* original 802.11 header has a different DA and in
1876 	 * case of 4addr it may also have different SA
1877 	 */
1878 	hdr = (struct ieee80211_hdr *)msdu->data;
1879 	ether_addr_copy(ieee80211_get_DA(hdr), da);
1880 	ether_addr_copy(ieee80211_get_SA(hdr), sa);
1881 }
1882 
1883 static void ath11k_dp_rx_h_undecap_raw(struct ath11k *ar, struct sk_buff *msdu,
1884 				       enum hal_encrypt_type enctype,
1885 				       struct ieee80211_rx_status *status,
1886 				       bool decrypted)
1887 {
1888 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
1889 	struct ieee80211_hdr *hdr;
1890 	size_t hdr_len;
1891 	size_t crypto_len;
1892 
1893 	if (!rxcb->is_first_msdu ||
1894 	    !(rxcb->is_first_msdu && rxcb->is_last_msdu)) {
1895 		WARN_ON_ONCE(1);
1896 		return;
1897 	}
1898 
1899 	skb_trim(msdu, msdu->len - FCS_LEN);
1900 
1901 	if (!decrypted)
1902 		return;
1903 
1904 	hdr = (void *)msdu->data;
1905 
1906 	/* Tail */
1907 	if (status->flag & RX_FLAG_IV_STRIPPED) {
1908 		skb_trim(msdu, msdu->len -
1909 			 ath11k_dp_rx_crypto_mic_len(ar, enctype));
1910 
1911 		skb_trim(msdu, msdu->len -
1912 			 ath11k_dp_rx_crypto_icv_len(ar, enctype));
1913 	} else {
1914 		/* MIC */
1915 		if (status->flag & RX_FLAG_MIC_STRIPPED)
1916 			skb_trim(msdu, msdu->len -
1917 				 ath11k_dp_rx_crypto_mic_len(ar, enctype));
1918 
1919 		/* ICV */
1920 		if (status->flag & RX_FLAG_ICV_STRIPPED)
1921 			skb_trim(msdu, msdu->len -
1922 				 ath11k_dp_rx_crypto_icv_len(ar, enctype));
1923 	}
1924 
1925 	/* MMIC */
1926 	if ((status->flag & RX_FLAG_MMIC_STRIPPED) &&
1927 	    !ieee80211_has_morefrags(hdr->frame_control) &&
1928 	    enctype == HAL_ENCRYPT_TYPE_TKIP_MIC)
1929 		skb_trim(msdu, msdu->len - IEEE80211_CCMP_MIC_LEN);
1930 
1931 	/* Head */
1932 	if (status->flag & RX_FLAG_IV_STRIPPED) {
1933 		hdr_len = ieee80211_hdrlen(hdr->frame_control);
1934 		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
1935 
1936 		memmove((void *)msdu->data + crypto_len,
1937 			(void *)msdu->data, hdr_len);
1938 		skb_pull(msdu, crypto_len);
1939 	}
1940 }
1941 
1942 static void *ath11k_dp_rx_h_find_rfc1042(struct ath11k *ar,
1943 					 struct sk_buff *msdu,
1944 					 enum hal_encrypt_type enctype)
1945 {
1946 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
1947 	struct ieee80211_hdr *hdr;
1948 	size_t hdr_len, crypto_len;
1949 	void *rfc1042;
1950 	bool is_amsdu;
1951 
1952 	is_amsdu = !(rxcb->is_first_msdu && rxcb->is_last_msdu);
1953 	hdr = (struct ieee80211_hdr *)ath11k_dp_rx_h_80211_hdr(rxcb->rx_desc);
1954 	rfc1042 = hdr;
1955 
1956 	if (rxcb->is_first_msdu) {
1957 		hdr_len = ieee80211_hdrlen(hdr->frame_control);
1958 		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
1959 
1960 		rfc1042 += hdr_len + crypto_len;
1961 	}
1962 
1963 	if (is_amsdu)
1964 		rfc1042 += sizeof(struct ath11k_dp_amsdu_subframe_hdr);
1965 
1966 	return rfc1042;
1967 }
1968 
1969 static void ath11k_dp_rx_h_undecap_eth(struct ath11k *ar,
1970 				       struct sk_buff *msdu,
1971 				       u8 *first_hdr,
1972 				       enum hal_encrypt_type enctype,
1973 				       struct ieee80211_rx_status *status)
1974 {
1975 	struct ieee80211_hdr *hdr;
1976 	struct ethhdr *eth;
1977 	size_t hdr_len;
1978 	u8 da[ETH_ALEN];
1979 	u8 sa[ETH_ALEN];
1980 	void *rfc1042;
1981 
1982 	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
1983 	if (WARN_ON_ONCE(!rfc1042))
1984 		return;
1985 
1986 	/* pull decapped header and copy SA & DA */
1987 	eth = (struct ethhdr *)msdu->data;
1988 	ether_addr_copy(da, eth->h_dest);
1989 	ether_addr_copy(sa, eth->h_source);
1990 	skb_pull(msdu, sizeof(struct ethhdr));
1991 
1992 	/* push rfc1042/llc/snap */
1993 	memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), rfc1042,
1994 	       sizeof(struct ath11k_dp_rfc1042_hdr));
1995 
1996 	/* push original 802.11 header */
1997 	hdr = (struct ieee80211_hdr *)first_hdr;
1998 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
1999 
2000 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
2001 		memcpy(skb_push(msdu,
2002 				ath11k_dp_rx_crypto_param_len(ar, enctype)),
2003 		       (void *)hdr + hdr_len,
2004 		       ath11k_dp_rx_crypto_param_len(ar, enctype));
2005 	}
2006 
2007 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
2008 
2009 	/* original 802.11 header has a different DA and in
2010 	 * case of 4addr it may also have different SA
2011 	 */
2012 	hdr = (struct ieee80211_hdr *)msdu->data;
2013 	ether_addr_copy(ieee80211_get_DA(hdr), da);
2014 	ether_addr_copy(ieee80211_get_SA(hdr), sa);
2015 }
2016 
2017 static void ath11k_dp_rx_h_undecap(struct ath11k *ar, struct sk_buff *msdu,
2018 				   struct hal_rx_desc *rx_desc,
2019 				   enum hal_encrypt_type enctype,
2020 				   struct ieee80211_rx_status *status,
2021 				   bool decrypted)
2022 {
2023 	u8 *first_hdr;
2024 	u8 decap;
2025 
2026 	first_hdr = ath11k_dp_rx_h_80211_hdr(rx_desc);
2027 	decap = ath11k_dp_rx_h_msdu_start_decap_type(rx_desc);
2028 
2029 	switch (decap) {
2030 	case DP_RX_DECAP_TYPE_NATIVE_WIFI:
2031 		ath11k_dp_rx_h_undecap_nwifi(ar, msdu, first_hdr,
2032 					     enctype, status);
2033 		break;
2034 	case DP_RX_DECAP_TYPE_RAW:
2035 		ath11k_dp_rx_h_undecap_raw(ar, msdu, enctype, status,
2036 					   decrypted);
2037 		break;
2038 	case DP_RX_DECAP_TYPE_ETHERNET2_DIX:
2039 		/* TODO undecap support for middle/last msdu's of amsdu */
2040 		ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
2041 					   enctype, status);
2042 		break;
2043 	case DP_RX_DECAP_TYPE_8023:
2044 		/* TODO: Handle undecap for these formats */
2045 		break;
2046 	}
2047 }
2048 
2049 static void ath11k_dp_rx_h_mpdu(struct ath11k *ar,
2050 				struct sk_buff *msdu,
2051 				struct hal_rx_desc *rx_desc,
2052 				struct ieee80211_rx_status *rx_status)
2053 {
2054 	bool  fill_crypto_hdr, mcast;
2055 	enum hal_encrypt_type enctype;
2056 	bool is_decrypted = false;
2057 	struct ieee80211_hdr *hdr;
2058 	struct ath11k_peer *peer;
2059 	u32 err_bitmap;
2060 
2061 	hdr = (struct ieee80211_hdr *)msdu->data;
2062 
2063 	/* PN for multicast packets will be checked in mac80211 */
2064 
2065 	mcast = is_multicast_ether_addr(hdr->addr1);
2066 	fill_crypto_hdr = mcast;
2067 
2068 	is_decrypted = ath11k_dp_rx_h_attn_is_decrypted(rx_desc);
2069 
2070 	spin_lock_bh(&ar->ab->base_lock);
2071 	peer = ath11k_peer_find_by_addr(ar->ab, hdr->addr2);
2072 	if (peer) {
2073 		if (mcast)
2074 			enctype = peer->sec_type_grp;
2075 		else
2076 			enctype = peer->sec_type;
2077 	} else {
2078 		enctype = HAL_ENCRYPT_TYPE_OPEN;
2079 	}
2080 	spin_unlock_bh(&ar->ab->base_lock);
2081 
2082 	err_bitmap = ath11k_dp_rx_h_attn_mpdu_err(rx_desc);
2083 
2084 	/* Clear per-MPDU flags while leaving per-PPDU flags intact */
2085 	rx_status->flag &= ~(RX_FLAG_FAILED_FCS_CRC |
2086 			     RX_FLAG_MMIC_ERROR |
2087 			     RX_FLAG_DECRYPTED |
2088 			     RX_FLAG_IV_STRIPPED |
2089 			     RX_FLAG_MMIC_STRIPPED);
2090 
2091 	if (err_bitmap & DP_RX_MPDU_ERR_FCS)
2092 		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
2093 	if (err_bitmap & DP_RX_MPDU_ERR_TKIP_MIC)
2094 		rx_status->flag |= RX_FLAG_MMIC_ERROR;
2095 
2096 	if (is_decrypted) {
2097 		rx_status->flag |= RX_FLAG_DECRYPTED | RX_FLAG_MMIC_STRIPPED;
2098 
2099 		if (fill_crypto_hdr)
2100 			rx_status->flag |= RX_FLAG_MIC_STRIPPED |
2101 					RX_FLAG_ICV_STRIPPED;
2102 		else
2103 			rx_status->flag |= RX_FLAG_IV_STRIPPED |
2104 					   RX_FLAG_PN_VALIDATED;
2105 	}
2106 
2107 	ath11k_dp_rx_h_csum_offload(msdu);
2108 	ath11k_dp_rx_h_undecap(ar, msdu, rx_desc,
2109 			       enctype, rx_status, is_decrypted);
2110 
2111 	if (!is_decrypted || fill_crypto_hdr)
2112 		return;
2113 
2114 	hdr = (void *)msdu->data;
2115 	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2116 }
2117 
2118 static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,
2119 				struct ieee80211_rx_status *rx_status)
2120 {
2121 	struct ieee80211_supported_band *sband;
2122 	enum rx_msdu_start_pkt_type pkt_type;
2123 	u8 bw;
2124 	u8 rate_mcs, nss;
2125 	u8 sgi;
2126 	bool is_cck;
2127 
2128 	pkt_type = ath11k_dp_rx_h_msdu_start_pkt_type(rx_desc);
2129 	bw = ath11k_dp_rx_h_msdu_start_rx_bw(rx_desc);
2130 	rate_mcs = ath11k_dp_rx_h_msdu_start_rate_mcs(rx_desc);
2131 	nss = ath11k_dp_rx_h_msdu_start_nss(rx_desc);
2132 	sgi = ath11k_dp_rx_h_msdu_start_sgi(rx_desc);
2133 
2134 	switch (pkt_type) {
2135 	case RX_MSDU_START_PKT_TYPE_11A:
2136 	case RX_MSDU_START_PKT_TYPE_11B:
2137 		is_cck = (pkt_type == RX_MSDU_START_PKT_TYPE_11B);
2138 		sband = &ar->mac.sbands[rx_status->band];
2139 		rx_status->rate_idx = ath11k_mac_hw_rate_to_idx(sband, rate_mcs,
2140 								is_cck);
2141 		break;
2142 	case RX_MSDU_START_PKT_TYPE_11N:
2143 		rx_status->encoding = RX_ENC_HT;
2144 		if (rate_mcs > ATH11K_HT_MCS_MAX) {
2145 			ath11k_warn(ar->ab,
2146 				    "Received with invalid mcs in HT mode %d\n",
2147 				     rate_mcs);
2148 			break;
2149 		}
2150 		rx_status->rate_idx = rate_mcs + (8 * (nss - 1));
2151 		if (sgi)
2152 			rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
2153 		rx_status->bw = ath11k_mac_bw_to_mac80211_bw(bw);
2154 		break;
2155 	case RX_MSDU_START_PKT_TYPE_11AC:
2156 		rx_status->encoding = RX_ENC_VHT;
2157 		rx_status->rate_idx = rate_mcs;
2158 		if (rate_mcs > ATH11K_VHT_MCS_MAX) {
2159 			ath11k_warn(ar->ab,
2160 				    "Received with invalid mcs in VHT mode %d\n",
2161 				     rate_mcs);
2162 			break;
2163 		}
2164 		rx_status->nss = nss;
2165 		if (sgi)
2166 			rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
2167 		rx_status->bw = ath11k_mac_bw_to_mac80211_bw(bw);
2168 		break;
2169 	case RX_MSDU_START_PKT_TYPE_11AX:
2170 		rx_status->rate_idx = rate_mcs;
2171 		if (rate_mcs > ATH11K_HE_MCS_MAX) {
2172 			ath11k_warn(ar->ab,
2173 				    "Received with invalid mcs in HE mode %d\n",
2174 				    rate_mcs);
2175 			break;
2176 		}
2177 		rx_status->encoding = RX_ENC_HE;
2178 		rx_status->nss = nss;
2179 		rx_status->he_gi = ath11k_he_gi_to_nl80211_he_gi(sgi);
2180 		rx_status->bw = ath11k_mac_bw_to_mac80211_bw(bw);
2181 		break;
2182 	}
2183 }
2184 
2185 static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc,
2186 				struct ieee80211_rx_status *rx_status)
2187 {
2188 	u8 channel_num;
2189 	u32 center_freq;
2190 
2191 	rx_status->freq = 0;
2192 	rx_status->rate_idx = 0;
2193 	rx_status->nss = 0;
2194 	rx_status->encoding = RX_ENC_LEGACY;
2195 	rx_status->bw = RATE_INFO_BW_20;
2196 
2197 	rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
2198 
2199 	channel_num = ath11k_dp_rx_h_msdu_start_freq(rx_desc);
2200 	center_freq = ath11k_dp_rx_h_msdu_start_freq(rx_desc) >> 16;
2201 
2202 	if (center_freq >= 5935 && center_freq <= 7105) {
2203 		rx_status->band = NL80211_BAND_6GHZ;
2204 	} else if (channel_num >= 1 && channel_num <= 14) {
2205 		rx_status->band = NL80211_BAND_2GHZ;
2206 	} else if (channel_num >= 36 && channel_num <= 173) {
2207 		rx_status->band = NL80211_BAND_5GHZ;
2208 	} else {
2209 		spin_lock_bh(&ar->data_lock);
2210 		rx_status->band = ar->rx_channel->band;
2211 		channel_num =
2212 			ieee80211_frequency_to_channel(ar->rx_channel->center_freq);
2213 		spin_unlock_bh(&ar->data_lock);
2214 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "rx_desc: ",
2215 				rx_desc, sizeof(struct hal_rx_desc));
2216 	}
2217 
2218 	rx_status->freq = ieee80211_channel_to_frequency(channel_num,
2219 							 rx_status->band);
2220 
2221 	ath11k_dp_rx_h_rate(ar, rx_desc, rx_status);
2222 }
2223 
2224 static char *ath11k_print_get_tid(struct ieee80211_hdr *hdr, char *out,
2225 				  size_t size)
2226 {
2227 	u8 *qc;
2228 	int tid;
2229 
2230 	if (!ieee80211_is_data_qos(hdr->frame_control))
2231 		return "";
2232 
2233 	qc = ieee80211_get_qos_ctl(hdr);
2234 	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
2235 	snprintf(out, size, "tid %d", tid);
2236 
2237 	return out;
2238 }
2239 
2240 static void ath11k_dp_rx_deliver_msdu(struct ath11k *ar, struct napi_struct *napi,
2241 				      struct sk_buff *msdu)
2242 {
2243 	static const struct ieee80211_radiotap_he known = {
2244 		.data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
2245 				     IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN),
2246 		.data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN),
2247 	};
2248 	struct ieee80211_rx_status *status;
2249 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
2250 	struct ieee80211_radiotap_he *he = NULL;
2251 	char tid[32];
2252 
2253 	status = IEEE80211_SKB_RXCB(msdu);
2254 	if (status->encoding == RX_ENC_HE) {
2255 		he = skb_push(msdu, sizeof(known));
2256 		memcpy(he, &known, sizeof(known));
2257 		status->flag |= RX_FLAG_RADIOTAP_HE;
2258 	}
2259 
2260 	ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
2261 		   "rx skb %pK len %u peer %pM %s %s sn %u %s%s%s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n",
2262 		   msdu,
2263 		   msdu->len,
2264 		   ieee80211_get_SA(hdr),
2265 		   ath11k_print_get_tid(hdr, tid, sizeof(tid)),
2266 		   is_multicast_ether_addr(ieee80211_get_DA(hdr)) ?
2267 							"mcast" : "ucast",
2268 		   (__le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4,
2269 		   (status->encoding == RX_ENC_LEGACY) ? "legacy" : "",
2270 		   (status->encoding == RX_ENC_HT) ? "ht" : "",
2271 		   (status->encoding == RX_ENC_VHT) ? "vht" : "",
2272 		   (status->encoding == RX_ENC_HE) ? "he" : "",
2273 		   (status->bw == RATE_INFO_BW_40) ? "40" : "",
2274 		   (status->bw == RATE_INFO_BW_80) ? "80" : "",
2275 		   (status->bw == RATE_INFO_BW_160) ? "160" : "",
2276 		   status->enc_flags & RX_ENC_FLAG_SHORT_GI ? "sgi " : "",
2277 		   status->rate_idx,
2278 		   status->nss,
2279 		   status->freq,
2280 		   status->band, status->flag,
2281 		   !!(status->flag & RX_FLAG_FAILED_FCS_CRC),
2282 		   !!(status->flag & RX_FLAG_MMIC_ERROR),
2283 		   !!(status->flag & RX_FLAG_AMSDU_MORE));
2284 
2285 	/* TODO: trace rx packet */
2286 
2287 	ieee80211_rx_napi(ar->hw, NULL, msdu, napi);
2288 }
2289 
2290 static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
2291 				     struct sk_buff *msdu,
2292 				     struct sk_buff_head *msdu_list)
2293 {
2294 	struct hal_rx_desc *rx_desc, *lrx_desc;
2295 	struct ieee80211_rx_status rx_status = {0};
2296 	struct ieee80211_rx_status *status;
2297 	struct ath11k_skb_rxcb *rxcb;
2298 	struct ieee80211_hdr *hdr;
2299 	struct sk_buff *last_buf;
2300 	u8 l3_pad_bytes;
2301 	u8 *hdr_status;
2302 	u16 msdu_len;
2303 	int ret;
2304 
2305 	last_buf = ath11k_dp_rx_get_msdu_last_buf(msdu_list, msdu);
2306 	if (!last_buf) {
2307 		ath11k_warn(ar->ab,
2308 			    "No valid Rx buffer to access Atten/MSDU_END/MPDU_END tlvs\n");
2309 		ret = -EIO;
2310 		goto free_out;
2311 	}
2312 
2313 	rx_desc = (struct hal_rx_desc *)msdu->data;
2314 	lrx_desc = (struct hal_rx_desc *)last_buf->data;
2315 	if (!ath11k_dp_rx_h_attn_msdu_done(lrx_desc)) {
2316 		ath11k_warn(ar->ab, "msdu_done bit in attention is not set\n");
2317 		ret = -EIO;
2318 		goto free_out;
2319 	}
2320 
2321 	rxcb = ATH11K_SKB_RXCB(msdu);
2322 	rxcb->rx_desc = rx_desc;
2323 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(rx_desc);
2324 	l3_pad_bytes = ath11k_dp_rx_h_msdu_end_l3pad(lrx_desc);
2325 
2326 	if (rxcb->is_frag) {
2327 		skb_pull(msdu, HAL_RX_DESC_SIZE);
2328 	} else if (!rxcb->is_continuation) {
2329 		if ((msdu_len + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE) {
2330 			hdr_status = ath11k_dp_rx_h_80211_hdr(rx_desc);
2331 			ret = -EINVAL;
2332 			ath11k_warn(ar->ab, "invalid msdu len %u\n", msdu_len);
2333 			ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
2334 					sizeof(struct ieee80211_hdr));
2335 			ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
2336 					sizeof(struct hal_rx_desc));
2337 			goto free_out;
2338 		}
2339 		skb_put(msdu, HAL_RX_DESC_SIZE + l3_pad_bytes + msdu_len);
2340 		skb_pull(msdu, HAL_RX_DESC_SIZE + l3_pad_bytes);
2341 	} else {
2342 		ret = ath11k_dp_rx_msdu_coalesce(ar, msdu_list,
2343 						 msdu, last_buf,
2344 						 l3_pad_bytes, msdu_len);
2345 		if (ret) {
2346 			ath11k_warn(ar->ab,
2347 				    "failed to coalesce msdu rx buffer%d\n", ret);
2348 			goto free_out;
2349 		}
2350 	}
2351 
2352 	hdr = (struct ieee80211_hdr *)msdu->data;
2353 
2354 	/* Process only data frames */
2355 	if (!ieee80211_is_data(hdr->frame_control))
2356 		return -EINVAL;
2357 
2358 	ath11k_dp_rx_h_ppdu(ar, rx_desc, &rx_status);
2359 	ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, &rx_status);
2360 
2361 	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
2362 
2363 	status = IEEE80211_SKB_RXCB(msdu);
2364 	*status = rx_status;
2365 	return 0;
2366 
2367 free_out:
2368 	return ret;
2369 }
2370 
2371 static void ath11k_dp_rx_process_received_packets(struct ath11k_base *ab,
2372 						  struct napi_struct *napi,
2373 						  struct sk_buff_head *msdu_list,
2374 						  int *quota, int ring_id)
2375 {
2376 	struct ath11k_skb_rxcb *rxcb;
2377 	struct sk_buff *msdu;
2378 	struct ath11k *ar;
2379 	u8 mac_id;
2380 	int ret;
2381 
2382 	if (skb_queue_empty(msdu_list))
2383 		return;
2384 
2385 	rcu_read_lock();
2386 
2387 	while (*quota && (msdu = __skb_dequeue(msdu_list))) {
2388 		rxcb = ATH11K_SKB_RXCB(msdu);
2389 		mac_id = rxcb->mac_id;
2390 		ar = ab->pdevs[mac_id].ar;
2391 		if (!rcu_dereference(ab->pdevs_active[mac_id])) {
2392 			dev_kfree_skb_any(msdu);
2393 			continue;
2394 		}
2395 
2396 		if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
2397 			dev_kfree_skb_any(msdu);
2398 			continue;
2399 		}
2400 
2401 		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list);
2402 		if (ret) {
2403 			ath11k_dbg(ab, ATH11K_DBG_DATA,
2404 				   "Unable to process msdu %d", ret);
2405 			dev_kfree_skb_any(msdu);
2406 			continue;
2407 		}
2408 
2409 		ath11k_dp_rx_deliver_msdu(ar, napi, msdu);
2410 		(*quota)--;
2411 	}
2412 
2413 	rcu_read_unlock();
2414 }
2415 
2416 int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
2417 			 struct napi_struct *napi, int budget)
2418 {
2419 	struct ath11k_dp *dp = &ab->dp;
2420 	struct dp_rxdma_ring *rx_ring;
2421 	int num_buffs_reaped[MAX_RADIOS] = {0};
2422 	struct sk_buff_head msdu_list;
2423 	struct ath11k_skb_rxcb *rxcb;
2424 	int total_msdu_reaped = 0;
2425 	struct hal_srng *srng;
2426 	struct sk_buff *msdu;
2427 	int quota = budget;
2428 	bool done = false;
2429 	int buf_id, mac_id;
2430 	struct ath11k *ar;
2431 	u32 *rx_desc;
2432 	int i;
2433 
2434 	__skb_queue_head_init(&msdu_list);
2435 
2436 	srng = &ab->hal.srng_list[dp->reo_dst_ring[ring_id].ring_id];
2437 
2438 	spin_lock_bh(&srng->lock);
2439 
2440 	ath11k_hal_srng_access_begin(ab, srng);
2441 
2442 try_again:
2443 	while ((rx_desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
2444 		struct hal_reo_dest_ring desc = *(struct hal_reo_dest_ring *)rx_desc;
2445 		enum hal_reo_dest_ring_push_reason push_reason;
2446 		u32 cookie;
2447 
2448 		cookie = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
2449 				   desc.buf_addr_info.info1);
2450 		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
2451 				   cookie);
2452 		mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie);
2453 
2454 		ar = ab->pdevs[mac_id].ar;
2455 		rx_ring = &ar->dp.rx_refill_buf_ring;
2456 		spin_lock_bh(&rx_ring->idr_lock);
2457 		msdu = idr_find(&rx_ring->bufs_idr, buf_id);
2458 		if (!msdu) {
2459 			ath11k_warn(ab, "frame rx with invalid buf_id %d\n",
2460 				    buf_id);
2461 			spin_unlock_bh(&rx_ring->idr_lock);
2462 			continue;
2463 		}
2464 
2465 		idr_remove(&rx_ring->bufs_idr, buf_id);
2466 		spin_unlock_bh(&rx_ring->idr_lock);
2467 
2468 		rxcb = ATH11K_SKB_RXCB(msdu);
2469 		dma_unmap_single(ab->dev, rxcb->paddr,
2470 				 msdu->len + skb_tailroom(msdu),
2471 				 DMA_FROM_DEVICE);
2472 
2473 		num_buffs_reaped[mac_id]++;
2474 		total_msdu_reaped++;
2475 
2476 		push_reason = FIELD_GET(HAL_REO_DEST_RING_INFO0_PUSH_REASON,
2477 					desc.info0);
2478 		if (push_reason !=
2479 		    HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) {
2480 			dev_kfree_skb_any(msdu);
2481 			ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++;
2482 			continue;
2483 		}
2484 
2485 		rxcb->is_first_msdu = !!(desc.rx_msdu_info.info0 &
2486 					 RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU);
2487 		rxcb->is_last_msdu = !!(desc.rx_msdu_info.info0 &
2488 					RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU);
2489 		rxcb->is_continuation = !!(desc.rx_msdu_info.info0 &
2490 					   RX_MSDU_DESC_INFO0_MSDU_CONTINUATION);
2491 		rxcb->mac_id = mac_id;
2492 		rxcb->tid = FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM,
2493 				      desc.info0);
2494 
2495 		__skb_queue_tail(&msdu_list, msdu);
2496 
2497 		if (total_msdu_reaped >= quota && !rxcb->is_continuation) {
2498 			done = true;
2499 			break;
2500 		}
2501 	}
2502 
2503 	/* Hw might have updated the head pointer after we cached it.
2504 	 * In this case, even though there are entries in the ring we'll
2505 	 * get rx_desc NULL. Give the read another try with updated cached
2506 	 * head pointer so that we can reap complete MPDU in the current
2507 	 * rx processing.
2508 	 */
2509 	if (!done && ath11k_hal_srng_dst_num_free(ab, srng, true)) {
2510 		ath11k_hal_srng_access_end(ab, srng);
2511 		goto try_again;
2512 	}
2513 
2514 	ath11k_hal_srng_access_end(ab, srng);
2515 
2516 	spin_unlock_bh(&srng->lock);
2517 
2518 	if (!total_msdu_reaped)
2519 		goto exit;
2520 
2521 	for (i = 0; i < ab->num_radios; i++) {
2522 		if (!num_buffs_reaped[i])
2523 			continue;
2524 
2525 		ar = ab->pdevs[i].ar;
2526 		rx_ring = &ar->dp.rx_refill_buf_ring;
2527 
2528 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
2529 					   HAL_RX_BUF_RBM_SW3_BM, GFP_ATOMIC);
2530 	}
2531 
2532 	ath11k_dp_rx_process_received_packets(ab, napi, &msdu_list,
2533 					      &quota, ring_id);
2534 
2535 exit:
2536 	return budget - quota;
2537 }
2538 
2539 static void ath11k_dp_rx_update_peer_stats(struct ath11k_sta *arsta,
2540 					   struct hal_rx_mon_ppdu_info *ppdu_info)
2541 {
2542 	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
2543 	u32 num_msdu;
2544 
2545 	if (!rx_stats)
2546 		return;
2547 
2548 	num_msdu = ppdu_info->tcp_msdu_count + ppdu_info->tcp_ack_msdu_count +
2549 		   ppdu_info->udp_msdu_count + ppdu_info->other_msdu_count;
2550 
2551 	rx_stats->num_msdu += num_msdu;
2552 	rx_stats->tcp_msdu_count += ppdu_info->tcp_msdu_count +
2553 				    ppdu_info->tcp_ack_msdu_count;
2554 	rx_stats->udp_msdu_count += ppdu_info->udp_msdu_count;
2555 	rx_stats->other_msdu_count += ppdu_info->other_msdu_count;
2556 
2557 	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11A ||
2558 	    ppdu_info->preamble_type == HAL_RX_PREAMBLE_11B) {
2559 		ppdu_info->nss = 1;
2560 		ppdu_info->mcs = HAL_RX_MAX_MCS;
2561 		ppdu_info->tid = IEEE80211_NUM_TIDS;
2562 	}
2563 
2564 	if (ppdu_info->nss > 0 && ppdu_info->nss <= HAL_RX_MAX_NSS)
2565 		rx_stats->nss_count[ppdu_info->nss - 1] += num_msdu;
2566 
2567 	if (ppdu_info->mcs <= HAL_RX_MAX_MCS)
2568 		rx_stats->mcs_count[ppdu_info->mcs] += num_msdu;
2569 
2570 	if (ppdu_info->gi < HAL_RX_GI_MAX)
2571 		rx_stats->gi_count[ppdu_info->gi] += num_msdu;
2572 
2573 	if (ppdu_info->bw < HAL_RX_BW_MAX)
2574 		rx_stats->bw_count[ppdu_info->bw] += num_msdu;
2575 
2576 	if (ppdu_info->ldpc < HAL_RX_SU_MU_CODING_MAX)
2577 		rx_stats->coding_count[ppdu_info->ldpc] += num_msdu;
2578 
2579 	if (ppdu_info->tid <= IEEE80211_NUM_TIDS)
2580 		rx_stats->tid_count[ppdu_info->tid] += num_msdu;
2581 
2582 	if (ppdu_info->preamble_type < HAL_RX_PREAMBLE_MAX)
2583 		rx_stats->pream_cnt[ppdu_info->preamble_type] += num_msdu;
2584 
2585 	if (ppdu_info->reception_type < HAL_RX_RECEPTION_TYPE_MAX)
2586 		rx_stats->reception_type[ppdu_info->reception_type] += num_msdu;
2587 
2588 	if (ppdu_info->is_stbc)
2589 		rx_stats->stbc_count += num_msdu;
2590 
2591 	if (ppdu_info->beamformed)
2592 		rx_stats->beamformed_count += num_msdu;
2593 
2594 	if (ppdu_info->num_mpdu_fcs_ok > 1)
2595 		rx_stats->ampdu_msdu_count += num_msdu;
2596 	else
2597 		rx_stats->non_ampdu_msdu_count += num_msdu;
2598 
2599 	rx_stats->num_mpdu_fcs_ok += ppdu_info->num_mpdu_fcs_ok;
2600 	rx_stats->num_mpdu_fcs_err += ppdu_info->num_mpdu_fcs_err;
2601 	rx_stats->dcm_count += ppdu_info->dcm;
2602 	rx_stats->ru_alloc_cnt[ppdu_info->ru_alloc] += num_msdu;
2603 
2604 	arsta->rssi_comb = ppdu_info->rssi_comb;
2605 	rx_stats->rx_duration += ppdu_info->rx_duration;
2606 	arsta->rx_duration = rx_stats->rx_duration;
2607 }
2608 
2609 static struct sk_buff *ath11k_dp_rx_alloc_mon_status_buf(struct ath11k_base *ab,
2610 							 struct dp_rxdma_ring *rx_ring,
2611 							 int *buf_id, gfp_t gfp)
2612 {
2613 	struct sk_buff *skb;
2614 	dma_addr_t paddr;
2615 
2616 	skb = dev_alloc_skb(DP_RX_BUFFER_SIZE +
2617 			    DP_RX_BUFFER_ALIGN_SIZE);
2618 
2619 	if (!skb)
2620 		goto fail_alloc_skb;
2621 
2622 	if (!IS_ALIGNED((unsigned long)skb->data,
2623 			DP_RX_BUFFER_ALIGN_SIZE)) {
2624 		skb_pull(skb, PTR_ALIGN(skb->data, DP_RX_BUFFER_ALIGN_SIZE) -
2625 			 skb->data);
2626 	}
2627 
2628 	paddr = dma_map_single(ab->dev, skb->data,
2629 			       skb->len + skb_tailroom(skb),
2630 			       DMA_BIDIRECTIONAL);
2631 	if (unlikely(dma_mapping_error(ab->dev, paddr)))
2632 		goto fail_free_skb;
2633 
2634 	spin_lock_bh(&rx_ring->idr_lock);
2635 	*buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 0,
2636 			    rx_ring->bufs_max, gfp);
2637 	spin_unlock_bh(&rx_ring->idr_lock);
2638 	if (*buf_id < 0)
2639 		goto fail_dma_unmap;
2640 
2641 	ATH11K_SKB_RXCB(skb)->paddr = paddr;
2642 	return skb;
2643 
2644 fail_dma_unmap:
2645 	dma_unmap_single(ab->dev, paddr, skb->len + skb_tailroom(skb),
2646 			 DMA_BIDIRECTIONAL);
2647 fail_free_skb:
2648 	dev_kfree_skb_any(skb);
2649 fail_alloc_skb:
2650 	return NULL;
2651 }
2652 
2653 int ath11k_dp_rx_mon_status_bufs_replenish(struct ath11k_base *ab, int mac_id,
2654 					   struct dp_rxdma_ring *rx_ring,
2655 					   int req_entries,
2656 					   enum hal_rx_buf_return_buf_manager mgr,
2657 					   gfp_t gfp)
2658 {
2659 	struct hal_srng *srng;
2660 	u32 *desc;
2661 	struct sk_buff *skb;
2662 	int num_free;
2663 	int num_remain;
2664 	int buf_id;
2665 	u32 cookie;
2666 	dma_addr_t paddr;
2667 
2668 	req_entries = min(req_entries, rx_ring->bufs_max);
2669 
2670 	srng = &ab->hal.srng_list[rx_ring->refill_buf_ring.ring_id];
2671 
2672 	spin_lock_bh(&srng->lock);
2673 
2674 	ath11k_hal_srng_access_begin(ab, srng);
2675 
2676 	num_free = ath11k_hal_srng_src_num_free(ab, srng, true);
2677 
2678 	req_entries = min(num_free, req_entries);
2679 	num_remain = req_entries;
2680 
2681 	while (num_remain > 0) {
2682 		skb = ath11k_dp_rx_alloc_mon_status_buf(ab, rx_ring,
2683 							&buf_id, gfp);
2684 		if (!skb)
2685 			break;
2686 		paddr = ATH11K_SKB_RXCB(skb)->paddr;
2687 
2688 		desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
2689 		if (!desc)
2690 			goto fail_desc_get;
2691 
2692 		cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, mac_id) |
2693 			 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
2694 
2695 		num_remain--;
2696 
2697 		ath11k_hal_rx_buf_addr_info_set(desc, paddr, cookie, mgr);
2698 	}
2699 
2700 	ath11k_hal_srng_access_end(ab, srng);
2701 
2702 	spin_unlock_bh(&srng->lock);
2703 
2704 	return req_entries - num_remain;
2705 
2706 fail_desc_get:
2707 	spin_lock_bh(&rx_ring->idr_lock);
2708 	idr_remove(&rx_ring->bufs_idr, buf_id);
2709 	spin_unlock_bh(&rx_ring->idr_lock);
2710 	dma_unmap_single(ab->dev, paddr, skb->len + skb_tailroom(skb),
2711 			 DMA_BIDIRECTIONAL);
2712 	dev_kfree_skb_any(skb);
2713 	ath11k_hal_srng_access_end(ab, srng);
2714 	spin_unlock_bh(&srng->lock);
2715 
2716 	return req_entries - num_remain;
2717 }
2718 
2719 static int ath11k_dp_rx_reap_mon_status_ring(struct ath11k_base *ab, int mac_id,
2720 					     int *budget, struct sk_buff_head *skb_list)
2721 {
2722 	struct ath11k *ar = ab->pdevs[mac_id].ar;
2723 	struct ath11k_pdev_dp *dp = &ar->dp;
2724 	struct dp_rxdma_ring *rx_ring = &dp->rx_mon_status_refill_ring;
2725 	struct hal_srng *srng;
2726 	void *rx_mon_status_desc;
2727 	struct sk_buff *skb;
2728 	struct ath11k_skb_rxcb *rxcb;
2729 	struct hal_tlv_hdr *tlv;
2730 	u32 cookie;
2731 	int buf_id;
2732 	dma_addr_t paddr;
2733 	u8 rbm;
2734 	int num_buffs_reaped = 0;
2735 
2736 	srng = &ab->hal.srng_list[rx_ring->refill_buf_ring.ring_id];
2737 
2738 	spin_lock_bh(&srng->lock);
2739 
2740 	ath11k_hal_srng_access_begin(ab, srng);
2741 	while (*budget) {
2742 		*budget -= 1;
2743 		rx_mon_status_desc =
2744 			ath11k_hal_srng_src_peek(ab, srng);
2745 		if (!rx_mon_status_desc)
2746 			break;
2747 
2748 		ath11k_hal_rx_buf_addr_info_get(rx_mon_status_desc, &paddr,
2749 						&cookie, &rbm);
2750 		if (paddr) {
2751 			buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID, cookie);
2752 
2753 			spin_lock_bh(&rx_ring->idr_lock);
2754 			skb = idr_find(&rx_ring->bufs_idr, buf_id);
2755 			if (!skb) {
2756 				ath11k_warn(ab, "rx monitor status with invalid buf_id %d\n",
2757 					    buf_id);
2758 				spin_unlock_bh(&rx_ring->idr_lock);
2759 				goto move_next;
2760 			}
2761 
2762 			idr_remove(&rx_ring->bufs_idr, buf_id);
2763 			spin_unlock_bh(&rx_ring->idr_lock);
2764 
2765 			rxcb = ATH11K_SKB_RXCB(skb);
2766 
2767 			dma_sync_single_for_cpu(ab->dev, rxcb->paddr,
2768 						skb->len + skb_tailroom(skb),
2769 						DMA_FROM_DEVICE);
2770 
2771 			dma_unmap_single(ab->dev, rxcb->paddr,
2772 					 skb->len + skb_tailroom(skb),
2773 					 DMA_BIDIRECTIONAL);
2774 
2775 			tlv = (struct hal_tlv_hdr *)skb->data;
2776 			if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) !=
2777 					HAL_RX_STATUS_BUFFER_DONE) {
2778 				ath11k_warn(ab, "mon status DONE not set %lx\n",
2779 					    FIELD_GET(HAL_TLV_HDR_TAG,
2780 						      tlv->tl));
2781 				dev_kfree_skb_any(skb);
2782 				goto move_next;
2783 			}
2784 
2785 			__skb_queue_tail(skb_list, skb);
2786 		}
2787 move_next:
2788 		skb = ath11k_dp_rx_alloc_mon_status_buf(ab, rx_ring,
2789 							&buf_id, GFP_ATOMIC);
2790 
2791 		if (!skb) {
2792 			ath11k_hal_rx_buf_addr_info_set(rx_mon_status_desc, 0, 0,
2793 							HAL_RX_BUF_RBM_SW3_BM);
2794 			num_buffs_reaped++;
2795 			break;
2796 		}
2797 		rxcb = ATH11K_SKB_RXCB(skb);
2798 
2799 		cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, mac_id) |
2800 			 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
2801 
2802 		ath11k_hal_rx_buf_addr_info_set(rx_mon_status_desc, rxcb->paddr,
2803 						cookie, HAL_RX_BUF_RBM_SW3_BM);
2804 		ath11k_hal_srng_src_get_next_entry(ab, srng);
2805 		num_buffs_reaped++;
2806 	}
2807 	ath11k_hal_srng_access_end(ab, srng);
2808 	spin_unlock_bh(&srng->lock);
2809 
2810 	return num_buffs_reaped;
2811 }
2812 
2813 int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id,
2814 				    struct napi_struct *napi, int budget)
2815 {
2816 	struct ath11k *ar = ab->pdevs[mac_id].ar;
2817 	enum hal_rx_mon_status hal_status;
2818 	struct sk_buff *skb;
2819 	struct sk_buff_head skb_list;
2820 	struct hal_rx_mon_ppdu_info ppdu_info;
2821 	struct ath11k_peer *peer;
2822 	struct ath11k_sta *arsta;
2823 	int num_buffs_reaped = 0;
2824 
2825 	__skb_queue_head_init(&skb_list);
2826 
2827 	num_buffs_reaped = ath11k_dp_rx_reap_mon_status_ring(ab, mac_id, &budget,
2828 							     &skb_list);
2829 	if (!num_buffs_reaped)
2830 		goto exit;
2831 
2832 	while ((skb = __skb_dequeue(&skb_list))) {
2833 		memset(&ppdu_info, 0, sizeof(ppdu_info));
2834 		ppdu_info.peer_id = HAL_INVALID_PEERID;
2835 
2836 		if (ath11k_debug_is_pktlog_rx_stats_enabled(ar))
2837 			trace_ath11k_htt_rxdesc(ar, skb->data, DP_RX_BUFFER_SIZE);
2838 
2839 		hal_status = ath11k_hal_rx_parse_mon_status(ab, &ppdu_info, skb);
2840 
2841 		if (ppdu_info.peer_id == HAL_INVALID_PEERID ||
2842 		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE) {
2843 			dev_kfree_skb_any(skb);
2844 			continue;
2845 		}
2846 
2847 		rcu_read_lock();
2848 		spin_lock_bh(&ab->base_lock);
2849 		peer = ath11k_peer_find_by_id(ab, ppdu_info.peer_id);
2850 
2851 		if (!peer || !peer->sta) {
2852 			ath11k_dbg(ab, ATH11K_DBG_DATA,
2853 				   "failed to find the peer with peer_id %d\n",
2854 				   ppdu_info.peer_id);
2855 			spin_unlock_bh(&ab->base_lock);
2856 			rcu_read_unlock();
2857 			dev_kfree_skb_any(skb);
2858 			continue;
2859 		}
2860 
2861 		arsta = (struct ath11k_sta *)peer->sta->drv_priv;
2862 		ath11k_dp_rx_update_peer_stats(arsta, &ppdu_info);
2863 
2864 		if (ath11k_debug_is_pktlog_peer_valid(ar, peer->addr))
2865 			trace_ath11k_htt_rxdesc(ar, skb->data, DP_RX_BUFFER_SIZE);
2866 
2867 		spin_unlock_bh(&ab->base_lock);
2868 		rcu_read_unlock();
2869 
2870 		dev_kfree_skb_any(skb);
2871 	}
2872 exit:
2873 	return num_buffs_reaped;
2874 }
2875 
2876 static void ath11k_dp_rx_frag_timer(struct timer_list *timer)
2877 {
2878 	struct dp_rx_tid *rx_tid = from_timer(rx_tid, timer, frag_timer);
2879 
2880 	spin_lock_bh(&rx_tid->ab->base_lock);
2881 	if (rx_tid->last_frag_no &&
2882 	    rx_tid->rx_frag_bitmap == GENMASK(rx_tid->last_frag_no, 0)) {
2883 		spin_unlock_bh(&rx_tid->ab->base_lock);
2884 		return;
2885 	}
2886 	ath11k_dp_rx_frags_cleanup(rx_tid, true);
2887 	spin_unlock_bh(&rx_tid->ab->base_lock);
2888 }
2889 
2890 int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id)
2891 {
2892 	struct ath11k_base *ab = ar->ab;
2893 	struct crypto_shash *tfm;
2894 	struct ath11k_peer *peer;
2895 	struct dp_rx_tid *rx_tid;
2896 	int i;
2897 
2898 	tfm = crypto_alloc_shash("michael_mic", 0, 0);
2899 	if (IS_ERR(tfm))
2900 		return PTR_ERR(tfm);
2901 
2902 	spin_lock_bh(&ab->base_lock);
2903 
2904 	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
2905 	if (!peer) {
2906 		ath11k_warn(ab, "failed to find the peer to set up fragment info\n");
2907 		spin_unlock_bh(&ab->base_lock);
2908 		return -ENOENT;
2909 	}
2910 
2911 	for (i = 0; i <= IEEE80211_NUM_TIDS; i++) {
2912 		rx_tid = &peer->rx_tid[i];
2913 		rx_tid->ab = ab;
2914 		timer_setup(&rx_tid->frag_timer, ath11k_dp_rx_frag_timer, 0);
2915 		skb_queue_head_init(&rx_tid->rx_frags);
2916 	}
2917 
2918 	peer->tfm_mmic = tfm;
2919 	spin_unlock_bh(&ab->base_lock);
2920 
2921 	return 0;
2922 }
2923 
2924 static int ath11k_dp_rx_h_michael_mic(struct crypto_shash *tfm, u8 *key,
2925 				      struct ieee80211_hdr *hdr, u8 *data,
2926 				      size_t data_len, u8 *mic)
2927 {
2928 	SHASH_DESC_ON_STACK(desc, tfm);
2929 	u8 mic_hdr[16] = {0};
2930 	u8 tid = 0;
2931 	int ret;
2932 
2933 	if (!tfm)
2934 		return -EINVAL;
2935 
2936 	desc->tfm = tfm;
2937 
2938 	ret = crypto_shash_setkey(tfm, key, 8);
2939 	if (ret)
2940 		goto out;
2941 
2942 	ret = crypto_shash_init(desc);
2943 	if (ret)
2944 		goto out;
2945 
2946 	/* TKIP MIC header */
2947 	memcpy(mic_hdr, ieee80211_get_DA(hdr), ETH_ALEN);
2948 	memcpy(mic_hdr + ETH_ALEN, ieee80211_get_SA(hdr), ETH_ALEN);
2949 	if (ieee80211_is_data_qos(hdr->frame_control))
2950 		tid = ieee80211_get_tid(hdr);
2951 	mic_hdr[12] = tid;
2952 
2953 	ret = crypto_shash_update(desc, mic_hdr, 16);
2954 	if (ret)
2955 		goto out;
2956 	ret = crypto_shash_update(desc, data, data_len);
2957 	if (ret)
2958 		goto out;
2959 	ret = crypto_shash_final(desc, mic);
2960 out:
2961 	shash_desc_zero(desc);
2962 	return ret;
2963 }
2964 
2965 static int ath11k_dp_rx_h_verify_tkip_mic(struct ath11k *ar, struct ath11k_peer *peer,
2966 					  struct sk_buff *msdu)
2967 {
2968 	struct hal_rx_desc *rx_desc = (struct hal_rx_desc *)msdu->data;
2969 	struct ieee80211_rx_status *rxs = IEEE80211_SKB_RXCB(msdu);
2970 	struct ieee80211_key_conf *key_conf;
2971 	struct ieee80211_hdr *hdr;
2972 	u8 mic[IEEE80211_CCMP_MIC_LEN];
2973 	int head_len, tail_len, ret;
2974 	size_t data_len;
2975 	u32 hdr_len;
2976 	u8 *key, *data;
2977 	u8 key_idx;
2978 
2979 	if (ath11k_dp_rx_h_mpdu_start_enctype(rx_desc) != HAL_ENCRYPT_TYPE_TKIP_MIC)
2980 		return 0;
2981 
2982 	hdr = (struct ieee80211_hdr *)(msdu->data + HAL_RX_DESC_SIZE);
2983 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
2984 	head_len = hdr_len + HAL_RX_DESC_SIZE + IEEE80211_TKIP_IV_LEN;
2985 	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
2986 
2987 	if (!is_multicast_ether_addr(hdr->addr1))
2988 		key_idx = peer->ucast_keyidx;
2989 	else
2990 		key_idx = peer->mcast_keyidx;
2991 
2992 	key_conf = peer->keys[key_idx];
2993 
2994 	data = msdu->data + head_len;
2995 	data_len = msdu->len - head_len - tail_len;
2996 	key = &key_conf->key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
2997 
2998 	ret = ath11k_dp_rx_h_michael_mic(peer->tfm_mmic, key, hdr, data, data_len, mic);
2999 	if (ret || memcmp(mic, data + data_len, IEEE80211_CCMP_MIC_LEN))
3000 		goto mic_fail;
3001 
3002 	return 0;
3003 
3004 mic_fail:
3005 	(ATH11K_SKB_RXCB(msdu))->is_first_msdu = true;
3006 	(ATH11K_SKB_RXCB(msdu))->is_last_msdu = true;
3007 
3008 	rxs->flag |= RX_FLAG_MMIC_ERROR | RX_FLAG_MMIC_STRIPPED |
3009 		    RX_FLAG_IV_STRIPPED | RX_FLAG_DECRYPTED;
3010 	skb_pull(msdu, HAL_RX_DESC_SIZE);
3011 
3012 	ath11k_dp_rx_h_ppdu(ar, rx_desc, rxs);
3013 	ath11k_dp_rx_h_undecap(ar, msdu, rx_desc,
3014 			       HAL_ENCRYPT_TYPE_TKIP_MIC, rxs, true);
3015 	ieee80211_rx(ar->hw, msdu);
3016 	return -EINVAL;
3017 }
3018 
3019 static void ath11k_dp_rx_h_undecap_frag(struct ath11k *ar, struct sk_buff *msdu,
3020 					enum hal_encrypt_type enctype, u32 flags)
3021 {
3022 	struct ieee80211_hdr *hdr;
3023 	size_t hdr_len;
3024 	size_t crypto_len;
3025 
3026 	if (!flags)
3027 		return;
3028 
3029 	hdr = (struct ieee80211_hdr *)(msdu->data + HAL_RX_DESC_SIZE);
3030 
3031 	if (flags & RX_FLAG_MIC_STRIPPED)
3032 		skb_trim(msdu, msdu->len -
3033 			 ath11k_dp_rx_crypto_mic_len(ar, enctype));
3034 
3035 	if (flags & RX_FLAG_ICV_STRIPPED)
3036 		skb_trim(msdu, msdu->len -
3037 			 ath11k_dp_rx_crypto_icv_len(ar, enctype));
3038 
3039 	if (flags & RX_FLAG_IV_STRIPPED) {
3040 		hdr_len = ieee80211_hdrlen(hdr->frame_control);
3041 		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
3042 
3043 		memmove((void *)msdu->data + HAL_RX_DESC_SIZE + crypto_len,
3044 			(void *)msdu->data + HAL_RX_DESC_SIZE, hdr_len);
3045 		skb_pull(msdu, crypto_len);
3046 	}
3047 }
3048 
3049 static int ath11k_dp_rx_h_defrag(struct ath11k *ar,
3050 				 struct ath11k_peer *peer,
3051 				 struct dp_rx_tid *rx_tid,
3052 				 struct sk_buff **defrag_skb)
3053 {
3054 	struct hal_rx_desc *rx_desc;
3055 	struct sk_buff *skb, *first_frag, *last_frag;
3056 	struct ieee80211_hdr *hdr;
3057 	enum hal_encrypt_type enctype;
3058 	bool is_decrypted = false;
3059 	int msdu_len = 0;
3060 	int extra_space;
3061 	u32 flags;
3062 
3063 	first_frag = skb_peek(&rx_tid->rx_frags);
3064 	last_frag = skb_peek_tail(&rx_tid->rx_frags);
3065 
3066 	skb_queue_walk(&rx_tid->rx_frags, skb) {
3067 		flags = 0;
3068 		rx_desc = (struct hal_rx_desc *)skb->data;
3069 		hdr = (struct ieee80211_hdr *)(skb->data + HAL_RX_DESC_SIZE);
3070 
3071 		enctype = ath11k_dp_rx_h_mpdu_start_enctype(rx_desc);
3072 		if (enctype != HAL_ENCRYPT_TYPE_OPEN)
3073 			is_decrypted = ath11k_dp_rx_h_attn_is_decrypted(rx_desc);
3074 
3075 		if (is_decrypted) {
3076 			if (skb != first_frag)
3077 				flags |=  RX_FLAG_IV_STRIPPED;
3078 			if (skb != last_frag)
3079 				flags |= RX_FLAG_ICV_STRIPPED |
3080 					 RX_FLAG_MIC_STRIPPED;
3081 		}
3082 
3083 		/* RX fragments are always raw packets */
3084 		if (skb != last_frag)
3085 			skb_trim(skb, skb->len - FCS_LEN);
3086 		ath11k_dp_rx_h_undecap_frag(ar, skb, enctype, flags);
3087 
3088 		if (skb != first_frag)
3089 			skb_pull(skb, HAL_RX_DESC_SIZE +
3090 				      ieee80211_hdrlen(hdr->frame_control));
3091 		msdu_len += skb->len;
3092 	}
3093 
3094 	extra_space = msdu_len - (DP_RX_BUFFER_SIZE + skb_tailroom(first_frag));
3095 	if (extra_space > 0 &&
3096 	    (pskb_expand_head(first_frag, 0, extra_space, GFP_ATOMIC) < 0))
3097 		return -ENOMEM;
3098 
3099 	__skb_unlink(first_frag, &rx_tid->rx_frags);
3100 	while ((skb = __skb_dequeue(&rx_tid->rx_frags))) {
3101 		skb_put_data(first_frag, skb->data, skb->len);
3102 		dev_kfree_skb_any(skb);
3103 	}
3104 
3105 	hdr = (struct ieee80211_hdr *)(first_frag->data + HAL_RX_DESC_SIZE);
3106 	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
3107 	ATH11K_SKB_RXCB(first_frag)->is_frag = 1;
3108 
3109 	if (ath11k_dp_rx_h_verify_tkip_mic(ar, peer, first_frag))
3110 		first_frag = NULL;
3111 
3112 	*defrag_skb = first_frag;
3113 	return 0;
3114 }
3115 
3116 static int ath11k_dp_rx_h_defrag_reo_reinject(struct ath11k *ar, struct dp_rx_tid *rx_tid,
3117 					      struct sk_buff *defrag_skb)
3118 {
3119 	struct ath11k_base *ab = ar->ab;
3120 	struct ath11k_pdev_dp *dp = &ar->dp;
3121 	struct dp_rxdma_ring *rx_refill_ring = &dp->rx_refill_buf_ring;
3122 	struct hal_rx_desc *rx_desc = (struct hal_rx_desc *)defrag_skb->data;
3123 	struct hal_reo_entrance_ring *reo_ent_ring;
3124 	struct hal_reo_dest_ring *reo_dest_ring;
3125 	struct dp_link_desc_bank *link_desc_banks;
3126 	struct hal_rx_msdu_link *msdu_link;
3127 	struct hal_rx_msdu_details *msdu0;
3128 	struct hal_srng *srng;
3129 	dma_addr_t paddr;
3130 	u32 desc_bank, msdu_info, mpdu_info;
3131 	u32 dst_idx, cookie;
3132 	u32 *msdu_len_offset;
3133 	int ret, buf_id;
3134 
3135 	link_desc_banks = ab->dp.link_desc_banks;
3136 	reo_dest_ring = rx_tid->dst_ring_desc;
3137 
3138 	ath11k_hal_rx_reo_ent_paddr_get(ab, reo_dest_ring, &paddr, &desc_bank);
3139 	msdu_link = (struct hal_rx_msdu_link *)(link_desc_banks[desc_bank].vaddr +
3140 			(paddr - link_desc_banks[desc_bank].paddr));
3141 	msdu0 = &msdu_link->msdu_link[0];
3142 	dst_idx = FIELD_GET(RX_MSDU_DESC_INFO0_REO_DEST_IND, msdu0->rx_msdu_info.info0);
3143 	memset(msdu0, 0, sizeof(*msdu0));
3144 
3145 	msdu_info = FIELD_PREP(RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU, 1) |
3146 		    FIELD_PREP(RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU, 1) |
3147 		    FIELD_PREP(RX_MSDU_DESC_INFO0_MSDU_CONTINUATION, 0) |
3148 		    FIELD_PREP(RX_MSDU_DESC_INFO0_MSDU_LENGTH,
3149 			       defrag_skb->len - HAL_RX_DESC_SIZE) |
3150 		    FIELD_PREP(RX_MSDU_DESC_INFO0_REO_DEST_IND, dst_idx) |
3151 		    FIELD_PREP(RX_MSDU_DESC_INFO0_VALID_SA, 1) |
3152 		    FIELD_PREP(RX_MSDU_DESC_INFO0_VALID_DA, 1);
3153 	msdu0->rx_msdu_info.info0 = msdu_info;
3154 
3155 	/* change msdu len in hal rx desc */
3156 	msdu_len_offset = (u32 *)&rx_desc->msdu_start;
3157 	*msdu_len_offset &= ~(RX_MSDU_START_INFO1_MSDU_LENGTH);
3158 	*msdu_len_offset |= defrag_skb->len - HAL_RX_DESC_SIZE;
3159 
3160 	paddr = dma_map_single(ab->dev, defrag_skb->data,
3161 			       defrag_skb->len + skb_tailroom(defrag_skb),
3162 			       DMA_FROM_DEVICE);
3163 	if (dma_mapping_error(ab->dev, paddr))
3164 		return -ENOMEM;
3165 
3166 	spin_lock_bh(&rx_refill_ring->idr_lock);
3167 	buf_id = idr_alloc(&rx_refill_ring->bufs_idr, defrag_skb, 0,
3168 			   rx_refill_ring->bufs_max * 3, GFP_ATOMIC);
3169 	spin_unlock_bh(&rx_refill_ring->idr_lock);
3170 	if (buf_id < 0) {
3171 		ret = -ENOMEM;
3172 		goto err_unmap_dma;
3173 	}
3174 
3175 	ATH11K_SKB_RXCB(defrag_skb)->paddr = paddr;
3176 	cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, dp->mac_id) |
3177 		 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
3178 
3179 	ath11k_hal_rx_buf_addr_info_set(msdu0, paddr, cookie, HAL_RX_BUF_RBM_SW3_BM);
3180 
3181 	/* Fill mpdu details into reo entrace ring */
3182 	srng = &ab->hal.srng_list[ab->dp.reo_reinject_ring.ring_id];
3183 
3184 	spin_lock_bh(&srng->lock);
3185 	ath11k_hal_srng_access_begin(ab, srng);
3186 
3187 	reo_ent_ring = (struct hal_reo_entrance_ring *)
3188 			ath11k_hal_srng_src_get_next_entry(ab, srng);
3189 	if (!reo_ent_ring) {
3190 		ath11k_hal_srng_access_end(ab, srng);
3191 		spin_unlock_bh(&srng->lock);
3192 		ret = -ENOSPC;
3193 		goto err_free_idr;
3194 	}
3195 	memset(reo_ent_ring, 0, sizeof(*reo_ent_ring));
3196 
3197 	ath11k_hal_rx_reo_ent_paddr_get(ab, reo_dest_ring, &paddr, &desc_bank);
3198 	ath11k_hal_rx_buf_addr_info_set(reo_ent_ring, paddr, desc_bank,
3199 					HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST);
3200 
3201 	mpdu_info = FIELD_PREP(RX_MPDU_DESC_INFO0_MSDU_COUNT, 1) |
3202 		    FIELD_PREP(RX_MPDU_DESC_INFO0_SEQ_NUM, rx_tid->cur_sn) |
3203 		    FIELD_PREP(RX_MPDU_DESC_INFO0_FRAG_FLAG, 0) |
3204 		    FIELD_PREP(RX_MPDU_DESC_INFO0_VALID_SA, 1) |
3205 		    FIELD_PREP(RX_MPDU_DESC_INFO0_VALID_DA, 1) |
3206 		    FIELD_PREP(RX_MPDU_DESC_INFO0_RAW_MPDU, 1) |
3207 		    FIELD_PREP(RX_MPDU_DESC_INFO0_VALID_PN, 1);
3208 
3209 	reo_ent_ring->rx_mpdu_info.info0 = mpdu_info;
3210 	reo_ent_ring->rx_mpdu_info.meta_data = reo_dest_ring->rx_mpdu_info.meta_data;
3211 	reo_ent_ring->queue_addr_lo = reo_dest_ring->queue_addr_lo;
3212 	reo_ent_ring->info0 = FIELD_PREP(HAL_REO_ENTR_RING_INFO0_QUEUE_ADDR_HI,
3213 					 FIELD_GET(HAL_REO_DEST_RING_INFO0_QUEUE_ADDR_HI,
3214 						   reo_dest_ring->info0)) |
3215 			      FIELD_PREP(HAL_REO_ENTR_RING_INFO0_DEST_IND, dst_idx);
3216 	ath11k_hal_srng_access_end(ab, srng);
3217 	spin_unlock_bh(&srng->lock);
3218 
3219 	return 0;
3220 
3221 err_free_idr:
3222 	spin_lock_bh(&rx_refill_ring->idr_lock);
3223 	idr_remove(&rx_refill_ring->bufs_idr, buf_id);
3224 	spin_unlock_bh(&rx_refill_ring->idr_lock);
3225 err_unmap_dma:
3226 	dma_unmap_single(ab->dev, paddr, defrag_skb->len + skb_tailroom(defrag_skb),
3227 			 DMA_FROM_DEVICE);
3228 	return ret;
3229 }
3230 
3231 static int ath11k_dp_rx_h_cmp_frags(struct sk_buff *a, struct sk_buff *b)
3232 {
3233 	int frag1, frag2;
3234 
3235 	frag1 = ath11k_dp_rx_h_mpdu_start_frag_no(a);
3236 	frag2 = ath11k_dp_rx_h_mpdu_start_frag_no(b);
3237 
3238 	return frag1 - frag2;
3239 }
3240 
3241 static void ath11k_dp_rx_h_sort_frags(struct sk_buff_head *frag_list,
3242 				      struct sk_buff *cur_frag)
3243 {
3244 	struct sk_buff *skb;
3245 	int cmp;
3246 
3247 	skb_queue_walk(frag_list, skb) {
3248 		cmp = ath11k_dp_rx_h_cmp_frags(skb, cur_frag);
3249 		if (cmp < 0)
3250 			continue;
3251 		__skb_queue_before(frag_list, skb, cur_frag);
3252 		return;
3253 	}
3254 	__skb_queue_tail(frag_list, cur_frag);
3255 }
3256 
3257 static u64 ath11k_dp_rx_h_get_pn(struct sk_buff *skb)
3258 {
3259 	struct ieee80211_hdr *hdr;
3260 	u64 pn = 0;
3261 	u8 *ehdr;
3262 
3263 	hdr = (struct ieee80211_hdr *)(skb->data + HAL_RX_DESC_SIZE);
3264 	ehdr = skb->data + HAL_RX_DESC_SIZE + ieee80211_hdrlen(hdr->frame_control);
3265 
3266 	pn = ehdr[0];
3267 	pn |= (u64)ehdr[1] << 8;
3268 	pn |= (u64)ehdr[4] << 16;
3269 	pn |= (u64)ehdr[5] << 24;
3270 	pn |= (u64)ehdr[6] << 32;
3271 	pn |= (u64)ehdr[7] << 40;
3272 
3273 	return pn;
3274 }
3275 
3276 static bool
3277 ath11k_dp_rx_h_defrag_validate_incr_pn(struct ath11k *ar, struct dp_rx_tid *rx_tid)
3278 {
3279 	enum hal_encrypt_type encrypt_type;
3280 	struct sk_buff *first_frag, *skb;
3281 	struct hal_rx_desc *desc;
3282 	u64 last_pn;
3283 	u64 cur_pn;
3284 
3285 	first_frag = skb_peek(&rx_tid->rx_frags);
3286 	desc = (struct hal_rx_desc *)first_frag->data;
3287 
3288 	encrypt_type = ath11k_dp_rx_h_mpdu_start_enctype(desc);
3289 	if (encrypt_type != HAL_ENCRYPT_TYPE_CCMP_128 &&
3290 	    encrypt_type != HAL_ENCRYPT_TYPE_CCMP_256 &&
3291 	    encrypt_type != HAL_ENCRYPT_TYPE_GCMP_128 &&
3292 	    encrypt_type != HAL_ENCRYPT_TYPE_AES_GCMP_256)
3293 		return true;
3294 
3295 	last_pn = ath11k_dp_rx_h_get_pn(first_frag);
3296 	skb_queue_walk(&rx_tid->rx_frags, skb) {
3297 		if (skb == first_frag)
3298 			continue;
3299 
3300 		cur_pn = ath11k_dp_rx_h_get_pn(skb);
3301 		if (cur_pn != last_pn + 1)
3302 			return false;
3303 		last_pn = cur_pn;
3304 	}
3305 	return true;
3306 }
3307 
3308 static int ath11k_dp_rx_frag_h_mpdu(struct ath11k *ar,
3309 				    struct sk_buff *msdu,
3310 				    u32 *ring_desc)
3311 {
3312 	struct ath11k_base *ab = ar->ab;
3313 	struct hal_rx_desc *rx_desc;
3314 	struct ath11k_peer *peer;
3315 	struct dp_rx_tid *rx_tid;
3316 	struct sk_buff *defrag_skb = NULL;
3317 	u32 peer_id;
3318 	u16 seqno, frag_no;
3319 	u8 tid;
3320 	int ret = 0;
3321 	bool more_frags;
3322 
3323 	rx_desc = (struct hal_rx_desc *)msdu->data;
3324 	peer_id = ath11k_dp_rx_h_mpdu_start_peer_id(rx_desc);
3325 	tid = ath11k_dp_rx_h_mpdu_start_tid(rx_desc);
3326 	seqno = ath11k_dp_rx_h_mpdu_start_seq_no(rx_desc);
3327 	frag_no = ath11k_dp_rx_h_mpdu_start_frag_no(msdu);
3328 	more_frags = ath11k_dp_rx_h_mpdu_start_more_frags(msdu);
3329 
3330 	if (!ath11k_dp_rx_h_mpdu_start_seq_ctrl_valid(rx_desc) ||
3331 	    !ath11k_dp_rx_h_mpdu_start_fc_valid(rx_desc) ||
3332 	    tid > IEEE80211_NUM_TIDS)
3333 		return -EINVAL;
3334 
3335 	/* received unfragmented packet in reo
3336 	 * exception ring, this shouldn't happen
3337 	 * as these packets typically come from
3338 	 * reo2sw srngs.
3339 	 */
3340 	if (WARN_ON_ONCE(!frag_no && !more_frags))
3341 		return -EINVAL;
3342 
3343 	spin_lock_bh(&ab->base_lock);
3344 	peer = ath11k_peer_find_by_id(ab, peer_id);
3345 	if (!peer) {
3346 		ath11k_warn(ab, "failed to find the peer to de-fragment received fragment peer_id %d\n",
3347 			    peer_id);
3348 		ret = -ENOENT;
3349 		goto out_unlock;
3350 	}
3351 	rx_tid = &peer->rx_tid[tid];
3352 
3353 	if ((!skb_queue_empty(&rx_tid->rx_frags) && seqno != rx_tid->cur_sn) ||
3354 	    skb_queue_empty(&rx_tid->rx_frags)) {
3355 		/* Flush stored fragments and start a new sequence */
3356 		ath11k_dp_rx_frags_cleanup(rx_tid, true);
3357 		rx_tid->cur_sn = seqno;
3358 	}
3359 
3360 	if (rx_tid->rx_frag_bitmap & BIT(frag_no)) {
3361 		/* Fragment already present */
3362 		ret = -EINVAL;
3363 		goto out_unlock;
3364 	}
3365 
3366 	if (frag_no > __fls(rx_tid->rx_frag_bitmap))
3367 		__skb_queue_tail(&rx_tid->rx_frags, msdu);
3368 	else
3369 		ath11k_dp_rx_h_sort_frags(&rx_tid->rx_frags, msdu);
3370 
3371 	rx_tid->rx_frag_bitmap |= BIT(frag_no);
3372 	if (!more_frags)
3373 		rx_tid->last_frag_no = frag_no;
3374 
3375 	if (frag_no == 0) {
3376 		rx_tid->dst_ring_desc = kmemdup(ring_desc,
3377 						sizeof(*rx_tid->dst_ring_desc),
3378 						GFP_ATOMIC);
3379 		if (!rx_tid->dst_ring_desc) {
3380 			ret = -ENOMEM;
3381 			goto out_unlock;
3382 		}
3383 	} else {
3384 		ath11k_dp_rx_link_desc_return(ab, ring_desc,
3385 					      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
3386 	}
3387 
3388 	if (!rx_tid->last_frag_no ||
3389 	    rx_tid->rx_frag_bitmap != GENMASK(rx_tid->last_frag_no, 0)) {
3390 		mod_timer(&rx_tid->frag_timer, jiffies +
3391 					       ATH11K_DP_RX_FRAGMENT_TIMEOUT_MS);
3392 		goto out_unlock;
3393 	}
3394 
3395 	spin_unlock_bh(&ab->base_lock);
3396 	del_timer_sync(&rx_tid->frag_timer);
3397 	spin_lock_bh(&ab->base_lock);
3398 
3399 	peer = ath11k_peer_find_by_id(ab, peer_id);
3400 	if (!peer)
3401 		goto err_frags_cleanup;
3402 
3403 	if (!ath11k_dp_rx_h_defrag_validate_incr_pn(ar, rx_tid))
3404 		goto err_frags_cleanup;
3405 
3406 	if (ath11k_dp_rx_h_defrag(ar, peer, rx_tid, &defrag_skb))
3407 		goto err_frags_cleanup;
3408 
3409 	if (!defrag_skb)
3410 		goto err_frags_cleanup;
3411 
3412 	if (ath11k_dp_rx_h_defrag_reo_reinject(ar, rx_tid, defrag_skb))
3413 		goto err_frags_cleanup;
3414 
3415 	ath11k_dp_rx_frags_cleanup(rx_tid, false);
3416 	goto out_unlock;
3417 
3418 err_frags_cleanup:
3419 	dev_kfree_skb_any(defrag_skb);
3420 	ath11k_dp_rx_frags_cleanup(rx_tid, true);
3421 out_unlock:
3422 	spin_unlock_bh(&ab->base_lock);
3423 	return ret;
3424 }
3425 
3426 static int
3427 ath11k_dp_process_rx_err_buf(struct ath11k *ar, u32 *ring_desc, int buf_id, bool drop)
3428 {
3429 	struct ath11k_pdev_dp *dp = &ar->dp;
3430 	struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
3431 	struct sk_buff *msdu;
3432 	struct ath11k_skb_rxcb *rxcb;
3433 	struct hal_rx_desc *rx_desc;
3434 	u8 *hdr_status;
3435 	u16 msdu_len;
3436 
3437 	spin_lock_bh(&rx_ring->idr_lock);
3438 	msdu = idr_find(&rx_ring->bufs_idr, buf_id);
3439 	if (!msdu) {
3440 		ath11k_warn(ar->ab, "rx err buf with invalid buf_id %d\n",
3441 			    buf_id);
3442 		spin_unlock_bh(&rx_ring->idr_lock);
3443 		return -EINVAL;
3444 	}
3445 
3446 	idr_remove(&rx_ring->bufs_idr, buf_id);
3447 	spin_unlock_bh(&rx_ring->idr_lock);
3448 
3449 	rxcb = ATH11K_SKB_RXCB(msdu);
3450 	dma_unmap_single(ar->ab->dev, rxcb->paddr,
3451 			 msdu->len + skb_tailroom(msdu),
3452 			 DMA_FROM_DEVICE);
3453 
3454 	if (drop) {
3455 		dev_kfree_skb_any(msdu);
3456 		return 0;
3457 	}
3458 
3459 	rcu_read_lock();
3460 	if (!rcu_dereference(ar->ab->pdevs_active[ar->pdev_idx])) {
3461 		dev_kfree_skb_any(msdu);
3462 		goto exit;
3463 	}
3464 
3465 	if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
3466 		dev_kfree_skb_any(msdu);
3467 		goto exit;
3468 	}
3469 
3470 	rx_desc = (struct hal_rx_desc *)msdu->data;
3471 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(rx_desc);
3472 	if ((msdu_len + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE) {
3473 		hdr_status = ath11k_dp_rx_h_80211_hdr(rx_desc);
3474 		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
3475 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
3476 				sizeof(struct ieee80211_hdr));
3477 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
3478 				sizeof(struct hal_rx_desc));
3479 		dev_kfree_skb_any(msdu);
3480 		goto exit;
3481 	}
3482 
3483 	skb_put(msdu, HAL_RX_DESC_SIZE + msdu_len);
3484 
3485 	if (ath11k_dp_rx_frag_h_mpdu(ar, msdu, ring_desc)) {
3486 		dev_kfree_skb_any(msdu);
3487 		ath11k_dp_rx_link_desc_return(ar->ab, ring_desc,
3488 					      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
3489 	}
3490 exit:
3491 	rcu_read_unlock();
3492 	return 0;
3493 }
3494 
3495 int ath11k_dp_process_rx_err(struct ath11k_base *ab, struct napi_struct *napi,
3496 			     int budget)
3497 {
3498 	u32 msdu_cookies[HAL_NUM_RX_MSDUS_PER_LINK_DESC];
3499 	struct dp_link_desc_bank *link_desc_banks;
3500 	enum hal_rx_buf_return_buf_manager rbm;
3501 	int tot_n_bufs_reaped, quota, ret, i;
3502 	int n_bufs_reaped[MAX_RADIOS] = {0};
3503 	struct dp_rxdma_ring *rx_ring;
3504 	struct dp_srng *reo_except;
3505 	u32 desc_bank, num_msdus;
3506 	struct hal_srng *srng;
3507 	struct ath11k_dp *dp;
3508 	void *link_desc_va;
3509 	int buf_id, mac_id;
3510 	struct ath11k *ar;
3511 	dma_addr_t paddr;
3512 	u32 *desc;
3513 	bool is_frag;
3514 	u8 drop = 0;
3515 
3516 	tot_n_bufs_reaped = 0;
3517 	quota = budget;
3518 
3519 	dp = &ab->dp;
3520 	reo_except = &dp->reo_except_ring;
3521 	link_desc_banks = dp->link_desc_banks;
3522 
3523 	srng = &ab->hal.srng_list[reo_except->ring_id];
3524 
3525 	spin_lock_bh(&srng->lock);
3526 
3527 	ath11k_hal_srng_access_begin(ab, srng);
3528 
3529 	while (budget &&
3530 	       (desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
3531 		struct hal_reo_dest_ring *reo_desc = (struct hal_reo_dest_ring *)desc;
3532 
3533 		ab->soc_stats.err_ring_pkts++;
3534 		ret = ath11k_hal_desc_reo_parse_err(ab, desc, &paddr,
3535 						    &desc_bank);
3536 		if (ret) {
3537 			ath11k_warn(ab, "failed to parse error reo desc %d\n",
3538 				    ret);
3539 			continue;
3540 		}
3541 		link_desc_va = link_desc_banks[desc_bank].vaddr +
3542 			       (paddr - link_desc_banks[desc_bank].paddr);
3543 		ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus, msdu_cookies,
3544 						 &rbm);
3545 		if (rbm != HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST &&
3546 		    rbm != HAL_RX_BUF_RBM_SW3_BM) {
3547 			ab->soc_stats.invalid_rbm++;
3548 			ath11k_warn(ab, "invalid return buffer manager %d\n", rbm);
3549 			ath11k_dp_rx_link_desc_return(ab, desc,
3550 						      HAL_WBM_REL_BM_ACT_REL_MSDU);
3551 			continue;
3552 		}
3553 
3554 		is_frag = !!(reo_desc->rx_mpdu_info.info0 & RX_MPDU_DESC_INFO0_FRAG_FLAG);
3555 
3556 		/* Process only rx fragments with one msdu per link desc below, and drop
3557 		 * msdu's indicated due to error reasons.
3558 		 */
3559 		if (!is_frag || num_msdus > 1) {
3560 			drop = 1;
3561 			/* Return the link desc back to wbm idle list */
3562 			ath11k_dp_rx_link_desc_return(ab, desc,
3563 						      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
3564 		}
3565 
3566 		for (i = 0; i < num_msdus; i++) {
3567 			buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
3568 					   msdu_cookies[i]);
3569 
3570 			mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID,
3571 					   msdu_cookies[i]);
3572 
3573 			ar = ab->pdevs[mac_id].ar;
3574 
3575 			if (!ath11k_dp_process_rx_err_buf(ar, desc, buf_id, drop)) {
3576 				n_bufs_reaped[mac_id]++;
3577 				tot_n_bufs_reaped++;
3578 			}
3579 		}
3580 
3581 		if (tot_n_bufs_reaped >= quota) {
3582 			tot_n_bufs_reaped = quota;
3583 			goto exit;
3584 		}
3585 
3586 		budget = quota - tot_n_bufs_reaped;
3587 	}
3588 
3589 exit:
3590 	ath11k_hal_srng_access_end(ab, srng);
3591 
3592 	spin_unlock_bh(&srng->lock);
3593 
3594 	for (i = 0; i <  ab->num_radios; i++) {
3595 		if (!n_bufs_reaped[i])
3596 			continue;
3597 
3598 		ar = ab->pdevs[i].ar;
3599 		rx_ring = &ar->dp.rx_refill_buf_ring;
3600 
3601 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, n_bufs_reaped[i],
3602 					   HAL_RX_BUF_RBM_SW3_BM, GFP_ATOMIC);
3603 	}
3604 
3605 	return tot_n_bufs_reaped;
3606 }
3607 
3608 static void ath11k_dp_rx_null_q_desc_sg_drop(struct ath11k *ar,
3609 					     int msdu_len,
3610 					     struct sk_buff_head *msdu_list)
3611 {
3612 	struct sk_buff *skb, *tmp;
3613 	struct ath11k_skb_rxcb *rxcb;
3614 	int n_buffs;
3615 
3616 	n_buffs = DIV_ROUND_UP(msdu_len,
3617 			       (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE));
3618 
3619 	skb_queue_walk_safe(msdu_list, skb, tmp) {
3620 		rxcb = ATH11K_SKB_RXCB(skb);
3621 		if (rxcb->err_rel_src == HAL_WBM_REL_SRC_MODULE_REO &&
3622 		    rxcb->err_code == HAL_REO_DEST_RING_ERROR_CODE_DESC_ADDR_ZERO) {
3623 			if (!n_buffs)
3624 				break;
3625 			__skb_unlink(skb, msdu_list);
3626 			dev_kfree_skb_any(skb);
3627 			n_buffs--;
3628 		}
3629 	}
3630 }
3631 
3632 static int ath11k_dp_rx_h_null_q_desc(struct ath11k *ar, struct sk_buff *msdu,
3633 				      struct ieee80211_rx_status *status,
3634 				      struct sk_buff_head *msdu_list)
3635 {
3636 	u16 msdu_len;
3637 	struct hal_rx_desc *desc = (struct hal_rx_desc *)msdu->data;
3638 	u8 l3pad_bytes;
3639 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3640 
3641 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(desc);
3642 
3643 	if (!rxcb->is_frag && ((msdu_len + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE)) {
3644 		/* First buffer will be freed by the caller, so deduct it's length */
3645 		msdu_len = msdu_len - (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE);
3646 		ath11k_dp_rx_null_q_desc_sg_drop(ar, msdu_len, msdu_list);
3647 		return -EINVAL;
3648 	}
3649 
3650 	if (!ath11k_dp_rx_h_attn_msdu_done(desc)) {
3651 		ath11k_warn(ar->ab,
3652 			    "msdu_done bit not set in null_q_des processing\n");
3653 		__skb_queue_purge(msdu_list);
3654 		return -EIO;
3655 	}
3656 
3657 	/* Handle NULL queue descriptor violations arising out a missing
3658 	 * REO queue for a given peer or a given TID. This typically
3659 	 * may happen if a packet is received on a QOS enabled TID before the
3660 	 * ADDBA negotiation for that TID, when the TID queue is setup. Or
3661 	 * it may also happen for MC/BC frames if they are not routed to the
3662 	 * non-QOS TID queue, in the absence of any other default TID queue.
3663 	 * This error can show up both in a REO destination or WBM release ring.
3664 	 */
3665 
3666 	rxcb->is_first_msdu = ath11k_dp_rx_h_msdu_end_first_msdu(desc);
3667 	rxcb->is_last_msdu = ath11k_dp_rx_h_msdu_end_last_msdu(desc);
3668 
3669 	if (rxcb->is_frag) {
3670 		skb_pull(msdu, HAL_RX_DESC_SIZE);
3671 	} else {
3672 		l3pad_bytes = ath11k_dp_rx_h_msdu_end_l3pad(desc);
3673 
3674 		if ((HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len) > DP_RX_BUFFER_SIZE)
3675 			return -EINVAL;
3676 
3677 		skb_put(msdu, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len);
3678 		skb_pull(msdu, HAL_RX_DESC_SIZE + l3pad_bytes);
3679 	}
3680 	ath11k_dp_rx_h_ppdu(ar, desc, status);
3681 
3682 	ath11k_dp_rx_h_mpdu(ar, msdu, desc, status);
3683 
3684 	rxcb->tid = ath11k_dp_rx_h_mpdu_start_tid(desc);
3685 
3686 	/* Please note that caller will having the access to msdu and completing
3687 	 * rx with mac80211. Need not worry about cleaning up amsdu_list.
3688 	 */
3689 
3690 	return 0;
3691 }
3692 
3693 static bool ath11k_dp_rx_h_reo_err(struct ath11k *ar, struct sk_buff *msdu,
3694 				   struct ieee80211_rx_status *status,
3695 				   struct sk_buff_head *msdu_list)
3696 {
3697 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3698 	bool drop = false;
3699 
3700 	ar->ab->soc_stats.reo_error[rxcb->err_code]++;
3701 
3702 	switch (rxcb->err_code) {
3703 	case HAL_REO_DEST_RING_ERROR_CODE_DESC_ADDR_ZERO:
3704 		if (ath11k_dp_rx_h_null_q_desc(ar, msdu, status, msdu_list))
3705 			drop = true;
3706 		break;
3707 	case HAL_REO_DEST_RING_ERROR_CODE_PN_CHECK_FAILED:
3708 		/* TODO: Do not drop PN failed packets in the driver;
3709 		 * instead, it is good to drop such packets in mac80211
3710 		 * after incrementing the replay counters.
3711 		 */
3712 
3713 		/* fall through */
3714 	default:
3715 		/* TODO: Review other errors and process them to mac80211
3716 		 * as appropriate.
3717 		 */
3718 		drop = true;
3719 		break;
3720 	}
3721 
3722 	return drop;
3723 }
3724 
3725 static void ath11k_dp_rx_h_tkip_mic_err(struct ath11k *ar, struct sk_buff *msdu,
3726 					struct ieee80211_rx_status *status)
3727 {
3728 	u16 msdu_len;
3729 	struct hal_rx_desc *desc = (struct hal_rx_desc *)msdu->data;
3730 	u8 l3pad_bytes;
3731 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3732 
3733 	rxcb->is_first_msdu = ath11k_dp_rx_h_msdu_end_first_msdu(desc);
3734 	rxcb->is_last_msdu = ath11k_dp_rx_h_msdu_end_last_msdu(desc);
3735 
3736 	l3pad_bytes = ath11k_dp_rx_h_msdu_end_l3pad(desc);
3737 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(desc);
3738 	skb_put(msdu, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len);
3739 	skb_pull(msdu, HAL_RX_DESC_SIZE + l3pad_bytes);
3740 
3741 	ath11k_dp_rx_h_ppdu(ar, desc, status);
3742 
3743 	status->flag |= (RX_FLAG_MMIC_STRIPPED | RX_FLAG_MMIC_ERROR |
3744 			 RX_FLAG_DECRYPTED);
3745 
3746 	ath11k_dp_rx_h_undecap(ar, msdu, desc,
3747 			       HAL_ENCRYPT_TYPE_TKIP_MIC, status, false);
3748 }
3749 
3750 static bool ath11k_dp_rx_h_rxdma_err(struct ath11k *ar,  struct sk_buff *msdu,
3751 				     struct ieee80211_rx_status *status)
3752 {
3753 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3754 	bool drop = false;
3755 
3756 	ar->ab->soc_stats.rxdma_error[rxcb->err_code]++;
3757 
3758 	switch (rxcb->err_code) {
3759 	case HAL_REO_ENTR_RING_RXDMA_ECODE_TKIP_MIC_ERR:
3760 		ath11k_dp_rx_h_tkip_mic_err(ar, msdu, status);
3761 		break;
3762 	default:
3763 		/* TODO: Review other rxdma error code to check if anything is
3764 		 * worth reporting to mac80211
3765 		 */
3766 		drop = true;
3767 		break;
3768 	}
3769 
3770 	return drop;
3771 }
3772 
3773 static void ath11k_dp_rx_wbm_err(struct ath11k *ar,
3774 				 struct napi_struct *napi,
3775 				 struct sk_buff *msdu,
3776 				 struct sk_buff_head *msdu_list)
3777 {
3778 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3779 	struct ieee80211_rx_status rxs = {0};
3780 	struct ieee80211_rx_status *status;
3781 	bool drop = true;
3782 
3783 	switch (rxcb->err_rel_src) {
3784 	case HAL_WBM_REL_SRC_MODULE_REO:
3785 		drop = ath11k_dp_rx_h_reo_err(ar, msdu, &rxs, msdu_list);
3786 		break;
3787 	case HAL_WBM_REL_SRC_MODULE_RXDMA:
3788 		drop = ath11k_dp_rx_h_rxdma_err(ar, msdu, &rxs);
3789 		break;
3790 	default:
3791 		/* msdu will get freed */
3792 		break;
3793 	}
3794 
3795 	if (drop) {
3796 		dev_kfree_skb_any(msdu);
3797 		return;
3798 	}
3799 
3800 	status = IEEE80211_SKB_RXCB(msdu);
3801 	*status = rxs;
3802 
3803 	ath11k_dp_rx_deliver_msdu(ar, napi, msdu);
3804 }
3805 
3806 int ath11k_dp_rx_process_wbm_err(struct ath11k_base *ab,
3807 				 struct napi_struct *napi, int budget)
3808 {
3809 	struct ath11k *ar;
3810 	struct ath11k_dp *dp = &ab->dp;
3811 	struct dp_rxdma_ring *rx_ring;
3812 	struct hal_rx_wbm_rel_info err_info;
3813 	struct hal_srng *srng;
3814 	struct sk_buff *msdu;
3815 	struct sk_buff_head msdu_list[MAX_RADIOS];
3816 	struct ath11k_skb_rxcb *rxcb;
3817 	u32 *rx_desc;
3818 	int buf_id, mac_id;
3819 	int num_buffs_reaped[MAX_RADIOS] = {0};
3820 	int total_num_buffs_reaped = 0;
3821 	int ret, i;
3822 
3823 	for (i = 0; i < MAX_RADIOS; i++)
3824 		__skb_queue_head_init(&msdu_list[i]);
3825 
3826 	srng = &ab->hal.srng_list[dp->rx_rel_ring.ring_id];
3827 
3828 	spin_lock_bh(&srng->lock);
3829 
3830 	ath11k_hal_srng_access_begin(ab, srng);
3831 
3832 	while (budget) {
3833 		rx_desc = ath11k_hal_srng_dst_get_next_entry(ab, srng);
3834 		if (!rx_desc)
3835 			break;
3836 
3837 		ret = ath11k_hal_wbm_desc_parse_err(ab, rx_desc, &err_info);
3838 		if (ret) {
3839 			ath11k_warn(ab,
3840 				    "failed to parse rx error in wbm_rel ring desc %d\n",
3841 				    ret);
3842 			continue;
3843 		}
3844 
3845 		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID, err_info.cookie);
3846 		mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, err_info.cookie);
3847 
3848 		ar = ab->pdevs[mac_id].ar;
3849 		rx_ring = &ar->dp.rx_refill_buf_ring;
3850 
3851 		spin_lock_bh(&rx_ring->idr_lock);
3852 		msdu = idr_find(&rx_ring->bufs_idr, buf_id);
3853 		if (!msdu) {
3854 			ath11k_warn(ab, "frame rx with invalid buf_id %d pdev %d\n",
3855 				    buf_id, mac_id);
3856 			spin_unlock_bh(&rx_ring->idr_lock);
3857 			continue;
3858 		}
3859 
3860 		idr_remove(&rx_ring->bufs_idr, buf_id);
3861 		spin_unlock_bh(&rx_ring->idr_lock);
3862 
3863 		rxcb = ATH11K_SKB_RXCB(msdu);
3864 		dma_unmap_single(ab->dev, rxcb->paddr,
3865 				 msdu->len + skb_tailroom(msdu),
3866 				 DMA_FROM_DEVICE);
3867 
3868 		num_buffs_reaped[mac_id]++;
3869 		total_num_buffs_reaped++;
3870 		budget--;
3871 
3872 		if (err_info.push_reason !=
3873 		    HAL_REO_DEST_RING_PUSH_REASON_ERR_DETECTED) {
3874 			dev_kfree_skb_any(msdu);
3875 			continue;
3876 		}
3877 
3878 		rxcb->err_rel_src = err_info.err_rel_src;
3879 		rxcb->err_code = err_info.err_code;
3880 		rxcb->rx_desc = (struct hal_rx_desc *)msdu->data;
3881 		__skb_queue_tail(&msdu_list[mac_id], msdu);
3882 	}
3883 
3884 	ath11k_hal_srng_access_end(ab, srng);
3885 
3886 	spin_unlock_bh(&srng->lock);
3887 
3888 	if (!total_num_buffs_reaped)
3889 		goto done;
3890 
3891 	for (i = 0; i <  ab->num_radios; i++) {
3892 		if (!num_buffs_reaped[i])
3893 			continue;
3894 
3895 		ar = ab->pdevs[i].ar;
3896 		rx_ring = &ar->dp.rx_refill_buf_ring;
3897 
3898 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
3899 					   HAL_RX_BUF_RBM_SW3_BM, GFP_ATOMIC);
3900 	}
3901 
3902 	rcu_read_lock();
3903 	for (i = 0; i <  ab->num_radios; i++) {
3904 		if (!rcu_dereference(ab->pdevs_active[i])) {
3905 			__skb_queue_purge(&msdu_list[i]);
3906 			continue;
3907 		}
3908 
3909 		ar = ab->pdevs[i].ar;
3910 
3911 		if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
3912 			__skb_queue_purge(&msdu_list[i]);
3913 			continue;
3914 		}
3915 
3916 		while ((msdu = __skb_dequeue(&msdu_list[i])) != NULL)
3917 			ath11k_dp_rx_wbm_err(ar, napi, msdu, &msdu_list[i]);
3918 	}
3919 	rcu_read_unlock();
3920 done:
3921 	return total_num_buffs_reaped;
3922 }
3923 
3924 int ath11k_dp_process_rxdma_err(struct ath11k_base *ab, int mac_id, int budget)
3925 {
3926 	struct ath11k *ar = ab->pdevs[mac_id].ar;
3927 	struct dp_srng *err_ring = &ar->dp.rxdma_err_dst_ring;
3928 	struct dp_rxdma_ring *rx_ring = &ar->dp.rx_refill_buf_ring;
3929 	struct dp_link_desc_bank *link_desc_banks = ab->dp.link_desc_banks;
3930 	struct hal_srng *srng;
3931 	u32 msdu_cookies[HAL_NUM_RX_MSDUS_PER_LINK_DESC];
3932 	enum hal_rx_buf_return_buf_manager rbm;
3933 	enum hal_reo_entr_rxdma_ecode rxdma_err_code;
3934 	struct ath11k_skb_rxcb *rxcb;
3935 	struct sk_buff *skb;
3936 	struct hal_reo_entrance_ring *entr_ring;
3937 	void *desc;
3938 	int num_buf_freed = 0;
3939 	int quota = budget;
3940 	dma_addr_t paddr;
3941 	u32 desc_bank;
3942 	void *link_desc_va;
3943 	int num_msdus;
3944 	int i;
3945 	int buf_id;
3946 
3947 	srng = &ab->hal.srng_list[err_ring->ring_id];
3948 
3949 	spin_lock_bh(&srng->lock);
3950 
3951 	ath11k_hal_srng_access_begin(ab, srng);
3952 
3953 	while (quota-- &&
3954 	       (desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
3955 		ath11k_hal_rx_reo_ent_paddr_get(ab, desc, &paddr, &desc_bank);
3956 
3957 		entr_ring = (struct hal_reo_entrance_ring *)desc;
3958 		rxdma_err_code =
3959 			FIELD_GET(HAL_REO_ENTR_RING_INFO1_RXDMA_ERROR_CODE,
3960 				  entr_ring->info1);
3961 		ab->soc_stats.rxdma_error[rxdma_err_code]++;
3962 
3963 		link_desc_va = link_desc_banks[desc_bank].vaddr +
3964 			       (paddr - link_desc_banks[desc_bank].paddr);
3965 		ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus,
3966 						 msdu_cookies, &rbm);
3967 
3968 		for (i = 0; i < num_msdus; i++) {
3969 			buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
3970 					   msdu_cookies[i]);
3971 
3972 			spin_lock_bh(&rx_ring->idr_lock);
3973 			skb = idr_find(&rx_ring->bufs_idr, buf_id);
3974 			if (!skb) {
3975 				ath11k_warn(ab, "rxdma error with invalid buf_id %d\n",
3976 					    buf_id);
3977 				spin_unlock_bh(&rx_ring->idr_lock);
3978 				continue;
3979 			}
3980 
3981 			idr_remove(&rx_ring->bufs_idr, buf_id);
3982 			spin_unlock_bh(&rx_ring->idr_lock);
3983 
3984 			rxcb = ATH11K_SKB_RXCB(skb);
3985 			dma_unmap_single(ab->dev, rxcb->paddr,
3986 					 skb->len + skb_tailroom(skb),
3987 					 DMA_FROM_DEVICE);
3988 			dev_kfree_skb_any(skb);
3989 
3990 			num_buf_freed++;
3991 		}
3992 
3993 		ath11k_dp_rx_link_desc_return(ab, desc,
3994 					      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
3995 	}
3996 
3997 	ath11k_hal_srng_access_end(ab, srng);
3998 
3999 	spin_unlock_bh(&srng->lock);
4000 
4001 	if (num_buf_freed)
4002 		ath11k_dp_rxbufs_replenish(ab, mac_id, rx_ring, num_buf_freed,
4003 					   HAL_RX_BUF_RBM_SW3_BM, GFP_ATOMIC);
4004 
4005 	return budget - quota;
4006 }
4007 
4008 void ath11k_dp_process_reo_status(struct ath11k_base *ab)
4009 {
4010 	struct ath11k_dp *dp = &ab->dp;
4011 	struct hal_srng *srng;
4012 	struct dp_reo_cmd *cmd, *tmp;
4013 	bool found = false;
4014 	u32 *reo_desc;
4015 	u16 tag;
4016 	struct hal_reo_status reo_status;
4017 
4018 	srng = &ab->hal.srng_list[dp->reo_status_ring.ring_id];
4019 
4020 	memset(&reo_status, 0, sizeof(reo_status));
4021 
4022 	spin_lock_bh(&srng->lock);
4023 
4024 	ath11k_hal_srng_access_begin(ab, srng);
4025 
4026 	while ((reo_desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
4027 		tag = FIELD_GET(HAL_SRNG_TLV_HDR_TAG, *reo_desc);
4028 
4029 		switch (tag) {
4030 		case HAL_REO_GET_QUEUE_STATS_STATUS:
4031 			ath11k_hal_reo_status_queue_stats(ab, reo_desc,
4032 							  &reo_status);
4033 			break;
4034 		case HAL_REO_FLUSH_QUEUE_STATUS:
4035 			ath11k_hal_reo_flush_queue_status(ab, reo_desc,
4036 							  &reo_status);
4037 			break;
4038 		case HAL_REO_FLUSH_CACHE_STATUS:
4039 			ath11k_hal_reo_flush_cache_status(ab, reo_desc,
4040 							  &reo_status);
4041 			break;
4042 		case HAL_REO_UNBLOCK_CACHE_STATUS:
4043 			ath11k_hal_reo_unblk_cache_status(ab, reo_desc,
4044 							  &reo_status);
4045 			break;
4046 		case HAL_REO_FLUSH_TIMEOUT_LIST_STATUS:
4047 			ath11k_hal_reo_flush_timeout_list_status(ab, reo_desc,
4048 								 &reo_status);
4049 			break;
4050 		case HAL_REO_DESCRIPTOR_THRESHOLD_REACHED_STATUS:
4051 			ath11k_hal_reo_desc_thresh_reached_status(ab, reo_desc,
4052 								  &reo_status);
4053 			break;
4054 		case HAL_REO_UPDATE_RX_REO_QUEUE_STATUS:
4055 			ath11k_hal_reo_update_rx_reo_queue_status(ab, reo_desc,
4056 								  &reo_status);
4057 			break;
4058 		default:
4059 			ath11k_warn(ab, "Unknown reo status type %d\n", tag);
4060 			continue;
4061 		}
4062 
4063 		spin_lock_bh(&dp->reo_cmd_lock);
4064 		list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
4065 			if (reo_status.uniform_hdr.cmd_num == cmd->cmd_num) {
4066 				found = true;
4067 				list_del(&cmd->list);
4068 				break;
4069 			}
4070 		}
4071 		spin_unlock_bh(&dp->reo_cmd_lock);
4072 
4073 		if (found) {
4074 			cmd->handler(dp, (void *)&cmd->data,
4075 				     reo_status.uniform_hdr.cmd_status);
4076 			kfree(cmd);
4077 		}
4078 
4079 		found = false;
4080 	}
4081 
4082 	ath11k_hal_srng_access_end(ab, srng);
4083 
4084 	spin_unlock_bh(&srng->lock);
4085 }
4086 
4087 void ath11k_dp_rx_pdev_free(struct ath11k_base *ab, int mac_id)
4088 {
4089 	struct ath11k *ar = ab->pdevs[mac_id].ar;
4090 
4091 	ath11k_dp_rx_pdev_srng_free(ar);
4092 	ath11k_dp_rxdma_pdev_buf_free(ar);
4093 }
4094 
4095 int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
4096 {
4097 	struct ath11k *ar = ab->pdevs[mac_id].ar;
4098 	struct ath11k_pdev_dp *dp = &ar->dp;
4099 	u32 ring_id;
4100 	int ret;
4101 
4102 	ret = ath11k_dp_rx_pdev_srng_alloc(ar);
4103 	if (ret) {
4104 		ath11k_warn(ab, "failed to setup rx srngs\n");
4105 		return ret;
4106 	}
4107 
4108 	ret = ath11k_dp_rxdma_pdev_buf_setup(ar);
4109 	if (ret) {
4110 		ath11k_warn(ab, "failed to setup rxdma ring\n");
4111 		return ret;
4112 	}
4113 
4114 	ring_id = dp->rx_refill_buf_ring.refill_buf_ring.ring_id;
4115 	ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id, mac_id, HAL_RXDMA_BUF);
4116 	if (ret) {
4117 		ath11k_warn(ab, "failed to configure rx_refill_buf_ring %d\n",
4118 			    ret);
4119 		return ret;
4120 	}
4121 
4122 	ring_id = dp->rxdma_err_dst_ring.ring_id;
4123 	ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id, mac_id, HAL_RXDMA_DST);
4124 	if (ret) {
4125 		ath11k_warn(ab, "failed to configure rxdma_err_dest_ring %d\n",
4126 			    ret);
4127 		return ret;
4128 	}
4129 
4130 	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
4131 	ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id,
4132 					  mac_id, HAL_RXDMA_MONITOR_BUF);
4133 	if (ret) {
4134 		ath11k_warn(ab, "failed to configure rxdma_mon_buf_ring %d\n",
4135 			    ret);
4136 		return ret;
4137 	}
4138 	ret = ath11k_dp_tx_htt_srng_setup(ab,
4139 					  dp->rxdma_mon_dst_ring.ring_id,
4140 					  mac_id, HAL_RXDMA_MONITOR_DST);
4141 	if (ret) {
4142 		ath11k_warn(ab, "failed to configure rxdma_mon_dst_ring %d\n",
4143 			    ret);
4144 		return ret;
4145 	}
4146 	ret = ath11k_dp_tx_htt_srng_setup(ab,
4147 					  dp->rxdma_mon_desc_ring.ring_id,
4148 					  mac_id, HAL_RXDMA_MONITOR_DESC);
4149 	if (ret) {
4150 		ath11k_warn(ab, "failed to configure rxdma_mon_dst_ring %d\n",
4151 			    ret);
4152 		return ret;
4153 	}
4154 	ring_id = dp->rx_mon_status_refill_ring.refill_buf_ring.ring_id;
4155 	ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id, mac_id,
4156 					  HAL_RXDMA_MONITOR_STATUS);
4157 	if (ret) {
4158 		ath11k_warn(ab,
4159 			    "failed to configure mon_status_refill_ring %d\n",
4160 			    ret);
4161 		return ret;
4162 	}
4163 	return 0;
4164 }
4165 
4166 static void ath11k_dp_mon_set_frag_len(u32 *total_len, u32 *frag_len)
4167 {
4168 	if (*total_len >= (DP_RX_BUFFER_SIZE - sizeof(struct hal_rx_desc))) {
4169 		*frag_len = DP_RX_BUFFER_SIZE - sizeof(struct hal_rx_desc);
4170 		*total_len -= *frag_len;
4171 	} else {
4172 		*frag_len = *total_len;
4173 		*total_len = 0;
4174 	}
4175 }
4176 
4177 static
4178 int ath11k_dp_rx_monitor_link_desc_return(struct ath11k *ar,
4179 					  void *p_last_buf_addr_info,
4180 					  u8 mac_id)
4181 {
4182 	struct ath11k_pdev_dp *dp = &ar->dp;
4183 	struct dp_srng *dp_srng;
4184 	void *hal_srng;
4185 	void *src_srng_desc;
4186 	int ret = 0;
4187 
4188 	dp_srng = &dp->rxdma_mon_desc_ring;
4189 	hal_srng = &ar->ab->hal.srng_list[dp_srng->ring_id];
4190 
4191 	ath11k_hal_srng_access_begin(ar->ab, hal_srng);
4192 
4193 	src_srng_desc = ath11k_hal_srng_src_get_next_entry(ar->ab, hal_srng);
4194 
4195 	if (src_srng_desc) {
4196 		struct ath11k_buffer_addr *src_desc =
4197 				(struct ath11k_buffer_addr *)src_srng_desc;
4198 
4199 		*src_desc = *((struct ath11k_buffer_addr *)p_last_buf_addr_info);
4200 	} else {
4201 		ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4202 			   "Monitor Link Desc Ring %d Full", mac_id);
4203 		ret = -ENOMEM;
4204 	}
4205 
4206 	ath11k_hal_srng_access_end(ar->ab, hal_srng);
4207 	return ret;
4208 }
4209 
4210 static
4211 void ath11k_dp_rx_mon_next_link_desc_get(void *rx_msdu_link_desc,
4212 					 dma_addr_t *paddr, u32 *sw_cookie,
4213 					 void **pp_buf_addr_info)
4214 {
4215 	struct hal_rx_msdu_link *msdu_link =
4216 			(struct hal_rx_msdu_link *)rx_msdu_link_desc;
4217 	struct ath11k_buffer_addr *buf_addr_info;
4218 	u8 rbm = 0;
4219 
4220 	buf_addr_info = (struct ath11k_buffer_addr *)&msdu_link->buf_addr_info;
4221 
4222 	ath11k_hal_rx_buf_addr_info_get(buf_addr_info, paddr, sw_cookie, &rbm);
4223 
4224 	*pp_buf_addr_info = (void *)buf_addr_info;
4225 }
4226 
4227 static int ath11k_dp_pkt_set_pktlen(struct sk_buff *skb, u32 len)
4228 {
4229 	if (skb->len > len) {
4230 		skb_trim(skb, len);
4231 	} else {
4232 		if (skb_tailroom(skb) < len - skb->len) {
4233 			if ((pskb_expand_head(skb, 0,
4234 					      len - skb->len - skb_tailroom(skb),
4235 					      GFP_ATOMIC))) {
4236 				dev_kfree_skb_any(skb);
4237 				return -ENOMEM;
4238 			}
4239 		}
4240 		skb_put(skb, (len - skb->len));
4241 	}
4242 	return 0;
4243 }
4244 
4245 static void ath11k_hal_rx_msdu_list_get(struct ath11k *ar,
4246 					void *msdu_link_desc,
4247 					struct hal_rx_msdu_list *msdu_list,
4248 					u16 *num_msdus)
4249 {
4250 	struct hal_rx_msdu_details *msdu_details = NULL;
4251 	struct rx_msdu_desc *msdu_desc_info = NULL;
4252 	struct hal_rx_msdu_link *msdu_link = NULL;
4253 	int i;
4254 	u32 last = FIELD_PREP(RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU, 1);
4255 	u32 first = FIELD_PREP(RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU, 1);
4256 	u8  tmp  = 0;
4257 
4258 	msdu_link = (struct hal_rx_msdu_link *)msdu_link_desc;
4259 	msdu_details = &msdu_link->msdu_link[0];
4260 
4261 	for (i = 0; i < HAL_RX_NUM_MSDU_DESC; i++) {
4262 		if (FIELD_GET(BUFFER_ADDR_INFO0_ADDR,
4263 			      msdu_details[i].buf_addr_info.info0) == 0) {
4264 			msdu_desc_info = &msdu_details[i - 1].rx_msdu_info;
4265 			msdu_desc_info->info0 |= last;
4266 			;
4267 			break;
4268 		}
4269 		msdu_desc_info = &msdu_details[i].rx_msdu_info;
4270 
4271 		if (!i)
4272 			msdu_desc_info->info0 |= first;
4273 		else if (i == (HAL_RX_NUM_MSDU_DESC - 1))
4274 			msdu_desc_info->info0 |= last;
4275 		msdu_list->msdu_info[i].msdu_flags = msdu_desc_info->info0;
4276 		msdu_list->msdu_info[i].msdu_len =
4277 			 HAL_RX_MSDU_PKT_LENGTH_GET(msdu_desc_info->info0);
4278 		msdu_list->sw_cookie[i] =
4279 			FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
4280 				  msdu_details[i].buf_addr_info.info1);
4281 		tmp = FIELD_GET(BUFFER_ADDR_INFO1_RET_BUF_MGR,
4282 				msdu_details[i].buf_addr_info.info1);
4283 		msdu_list->rbm[i] = tmp;
4284 	}
4285 	*num_msdus = i;
4286 }
4287 
4288 static u32 ath11k_dp_rx_mon_comp_ppduid(u32 msdu_ppdu_id, u32 *ppdu_id,
4289 					u32 *rx_bufs_used)
4290 {
4291 	u32 ret = 0;
4292 
4293 	if ((*ppdu_id < msdu_ppdu_id) &&
4294 	    ((msdu_ppdu_id - *ppdu_id) < DP_NOT_PPDU_ID_WRAP_AROUND)) {
4295 		*ppdu_id = msdu_ppdu_id;
4296 		ret = msdu_ppdu_id;
4297 	} else if ((*ppdu_id > msdu_ppdu_id) &&
4298 		((*ppdu_id - msdu_ppdu_id) > DP_NOT_PPDU_ID_WRAP_AROUND)) {
4299 		/* mon_dst is behind than mon_status
4300 		 * skip dst_ring and free it
4301 		 */
4302 		*rx_bufs_used += 1;
4303 		*ppdu_id = msdu_ppdu_id;
4304 		ret = msdu_ppdu_id;
4305 	}
4306 	return ret;
4307 }
4308 
4309 static void ath11k_dp_mon_get_buf_len(struct hal_rx_msdu_desc_info *info,
4310 				      bool *is_frag, u32 *total_len,
4311 				      u32 *frag_len, u32 *msdu_cnt)
4312 {
4313 	if (info->msdu_flags & RX_MSDU_DESC_INFO0_MSDU_CONTINUATION) {
4314 		if (!*is_frag) {
4315 			*total_len = info->msdu_len;
4316 			*is_frag = true;
4317 		}
4318 		ath11k_dp_mon_set_frag_len(total_len,
4319 					   frag_len);
4320 	} else {
4321 		if (*is_frag) {
4322 			ath11k_dp_mon_set_frag_len(total_len,
4323 						   frag_len);
4324 		} else {
4325 			*frag_len = info->msdu_len;
4326 		}
4327 		*is_frag = false;
4328 		*msdu_cnt -= 1;
4329 	}
4330 }
4331 
4332 static u32
4333 ath11k_dp_rx_mon_mpdu_pop(struct ath11k *ar,
4334 			  void *ring_entry, struct sk_buff **head_msdu,
4335 			  struct sk_buff **tail_msdu, u32 *npackets,
4336 			  u32 *ppdu_id)
4337 {
4338 	struct ath11k_pdev_dp *dp = &ar->dp;
4339 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4340 	struct dp_rxdma_ring *rx_ring = &dp->rxdma_mon_buf_ring;
4341 	struct sk_buff *msdu = NULL, *last = NULL;
4342 	struct hal_rx_msdu_list msdu_list;
4343 	void *p_buf_addr_info, *p_last_buf_addr_info;
4344 	struct hal_rx_desc *rx_desc;
4345 	void *rx_msdu_link_desc;
4346 	dma_addr_t paddr;
4347 	u16 num_msdus = 0;
4348 	u32 rx_buf_size, rx_pkt_offset, sw_cookie;
4349 	u32 rx_bufs_used = 0, i = 0;
4350 	u32 msdu_ppdu_id = 0, msdu_cnt = 0;
4351 	u32 total_len = 0, frag_len = 0;
4352 	bool is_frag, is_first_msdu;
4353 	bool drop_mpdu = false;
4354 	struct ath11k_skb_rxcb *rxcb;
4355 	struct hal_reo_entrance_ring *ent_desc =
4356 			(struct hal_reo_entrance_ring *)ring_entry;
4357 	int buf_id;
4358 
4359 	ath11k_hal_rx_reo_ent_buf_paddr_get(ring_entry, &paddr,
4360 					    &sw_cookie, &p_last_buf_addr_info,
4361 					    &msdu_cnt);
4362 
4363 	if (FIELD_GET(HAL_REO_ENTR_RING_INFO1_RXDMA_PUSH_REASON,
4364 		      ent_desc->info1) ==
4365 		      HAL_REO_DEST_RING_PUSH_REASON_ERR_DETECTED) {
4366 		u8 rxdma_err =
4367 			FIELD_GET(HAL_REO_ENTR_RING_INFO1_RXDMA_ERROR_CODE,
4368 				  ent_desc->info1);
4369 		if (rxdma_err == HAL_REO_ENTR_RING_RXDMA_ECODE_FLUSH_REQUEST_ERR ||
4370 		    rxdma_err == HAL_REO_ENTR_RING_RXDMA_ECODE_MPDU_LEN_ERR ||
4371 		    rxdma_err == HAL_REO_ENTR_RING_RXDMA_ECODE_OVERFLOW_ERR) {
4372 			drop_mpdu = true;
4373 			pmon->rx_mon_stats.dest_mpdu_drop++;
4374 		}
4375 	}
4376 
4377 	is_frag = false;
4378 	is_first_msdu = true;
4379 
4380 	do {
4381 		if (pmon->mon_last_linkdesc_paddr == paddr) {
4382 			pmon->rx_mon_stats.dup_mon_linkdesc_cnt++;
4383 			return rx_bufs_used;
4384 		}
4385 
4386 		rx_msdu_link_desc =
4387 			(void *)pmon->link_desc_banks[sw_cookie].vaddr +
4388 			(paddr - pmon->link_desc_banks[sw_cookie].paddr);
4389 
4390 		ath11k_hal_rx_msdu_list_get(ar, rx_msdu_link_desc, &msdu_list,
4391 					    &num_msdus);
4392 
4393 		for (i = 0; i < num_msdus; i++) {
4394 			u32 l2_hdr_offset;
4395 
4396 			if (pmon->mon_last_buf_cookie == msdu_list.sw_cookie[i]) {
4397 				ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4398 					   "i %d last_cookie %d is same\n",
4399 					   i, pmon->mon_last_buf_cookie);
4400 				drop_mpdu = true;
4401 				pmon->rx_mon_stats.dup_mon_buf_cnt++;
4402 				continue;
4403 			}
4404 			buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
4405 					   msdu_list.sw_cookie[i]);
4406 
4407 			spin_lock_bh(&rx_ring->idr_lock);
4408 			msdu = idr_find(&rx_ring->bufs_idr, buf_id);
4409 			spin_unlock_bh(&rx_ring->idr_lock);
4410 			if (!msdu) {
4411 				ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4412 					   "msdu_pop: invalid buf_id %d\n", buf_id);
4413 				break;
4414 			}
4415 			rxcb = ATH11K_SKB_RXCB(msdu);
4416 			if (!rxcb->unmapped) {
4417 				dma_unmap_single(ar->ab->dev, rxcb->paddr,
4418 						 msdu->len +
4419 						 skb_tailroom(msdu),
4420 						 DMA_FROM_DEVICE);
4421 				rxcb->unmapped = 1;
4422 			}
4423 			if (drop_mpdu) {
4424 				ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4425 					   "i %d drop msdu %p *ppdu_id %x\n",
4426 					   i, msdu, *ppdu_id);
4427 				dev_kfree_skb_any(msdu);
4428 				msdu = NULL;
4429 				goto next_msdu;
4430 			}
4431 
4432 			rx_desc = (struct hal_rx_desc *)msdu->data;
4433 
4434 			rx_pkt_offset = sizeof(struct hal_rx_desc);
4435 			l2_hdr_offset = ath11k_dp_rx_h_msdu_end_l3pad(rx_desc);
4436 
4437 			if (is_first_msdu) {
4438 				if (!ath11k_dp_rxdesc_mpdu_valid(rx_desc)) {
4439 					drop_mpdu = true;
4440 					dev_kfree_skb_any(msdu);
4441 					msdu = NULL;
4442 					pmon->mon_last_linkdesc_paddr = paddr;
4443 					goto next_msdu;
4444 				}
4445 
4446 				msdu_ppdu_id =
4447 					ath11k_dp_rxdesc_get_ppduid(rx_desc);
4448 
4449 				if (ath11k_dp_rx_mon_comp_ppduid(msdu_ppdu_id,
4450 								 ppdu_id,
4451 								 &rx_bufs_used)) {
4452 					if (rx_bufs_used) {
4453 						drop_mpdu = true;
4454 						dev_kfree_skb_any(msdu);
4455 						msdu = NULL;
4456 						goto next_msdu;
4457 					}
4458 					return rx_bufs_used;
4459 				}
4460 				pmon->mon_last_linkdesc_paddr = paddr;
4461 				is_first_msdu = false;
4462 			}
4463 			ath11k_dp_mon_get_buf_len(&msdu_list.msdu_info[i],
4464 						  &is_frag, &total_len,
4465 						  &frag_len, &msdu_cnt);
4466 			rx_buf_size = rx_pkt_offset + l2_hdr_offset + frag_len;
4467 
4468 			ath11k_dp_pkt_set_pktlen(msdu, rx_buf_size);
4469 
4470 			if (!(*head_msdu))
4471 				*head_msdu = msdu;
4472 			else if (last)
4473 				last->next = msdu;
4474 
4475 			last = msdu;
4476 next_msdu:
4477 			pmon->mon_last_buf_cookie = msdu_list.sw_cookie[i];
4478 			rx_bufs_used++;
4479 			spin_lock_bh(&rx_ring->idr_lock);
4480 			idr_remove(&rx_ring->bufs_idr, buf_id);
4481 			spin_unlock_bh(&rx_ring->idr_lock);
4482 		}
4483 
4484 		ath11k_dp_rx_mon_next_link_desc_get(rx_msdu_link_desc, &paddr,
4485 						    &sw_cookie,
4486 						    &p_buf_addr_info);
4487 
4488 		if (ath11k_dp_rx_monitor_link_desc_return(ar,
4489 							  p_last_buf_addr_info,
4490 							  dp->mac_id))
4491 			ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4492 				   "dp_rx_monitor_link_desc_return failed");
4493 
4494 		p_last_buf_addr_info = p_buf_addr_info;
4495 
4496 	} while (paddr && msdu_cnt);
4497 
4498 	if (last)
4499 		last->next = NULL;
4500 
4501 	*tail_msdu = msdu;
4502 
4503 	if (msdu_cnt == 0)
4504 		*npackets = 1;
4505 
4506 	return rx_bufs_used;
4507 }
4508 
4509 static void ath11k_dp_rx_msdus_set_payload(struct sk_buff *msdu)
4510 {
4511 	u32 rx_pkt_offset, l2_hdr_offset;
4512 
4513 	rx_pkt_offset = sizeof(struct hal_rx_desc);
4514 	l2_hdr_offset = ath11k_dp_rx_h_msdu_end_l3pad((struct hal_rx_desc *)msdu->data);
4515 	skb_pull(msdu, rx_pkt_offset + l2_hdr_offset);
4516 }
4517 
4518 static struct sk_buff *
4519 ath11k_dp_rx_mon_merg_msdus(struct ath11k *ar,
4520 			    u32 mac_id, struct sk_buff *head_msdu,
4521 			    struct sk_buff *last_msdu,
4522 			    struct ieee80211_rx_status *rxs)
4523 {
4524 	struct sk_buff *msdu, *mpdu_buf, *prev_buf;
4525 	u32 decap_format, wifi_hdr_len;
4526 	struct hal_rx_desc *rx_desc;
4527 	char *hdr_desc;
4528 	u8 *dest;
4529 	struct ieee80211_hdr_3addr *wh;
4530 
4531 	mpdu_buf = NULL;
4532 
4533 	if (!head_msdu)
4534 		goto err_merge_fail;
4535 
4536 	rx_desc = (struct hal_rx_desc *)head_msdu->data;
4537 
4538 	if (ath11k_dp_rxdesc_get_mpdulen_err(rx_desc))
4539 		return NULL;
4540 
4541 	decap_format = ath11k_dp_rxdesc_get_decap_format(rx_desc);
4542 
4543 	ath11k_dp_rx_h_ppdu(ar, rx_desc, rxs);
4544 
4545 	if (decap_format == DP_RX_DECAP_TYPE_RAW) {
4546 		ath11k_dp_rx_msdus_set_payload(head_msdu);
4547 
4548 		prev_buf = head_msdu;
4549 		msdu = head_msdu->next;
4550 
4551 		while (msdu) {
4552 			ath11k_dp_rx_msdus_set_payload(msdu);
4553 
4554 			prev_buf = msdu;
4555 			msdu = msdu->next;
4556 		}
4557 
4558 		prev_buf->next = NULL;
4559 
4560 		skb_trim(prev_buf, prev_buf->len - HAL_RX_FCS_LEN);
4561 	} else if (decap_format == DP_RX_DECAP_TYPE_NATIVE_WIFI) {
4562 		__le16 qos_field;
4563 		u8 qos_pkt = 0;
4564 
4565 		rx_desc = (struct hal_rx_desc *)head_msdu->data;
4566 		hdr_desc = ath11k_dp_rxdesc_get_80211hdr(rx_desc);
4567 
4568 		/* Base size */
4569 		wifi_hdr_len = sizeof(struct ieee80211_hdr_3addr);
4570 		wh = (struct ieee80211_hdr_3addr *)hdr_desc;
4571 
4572 		if (ieee80211_is_data_qos(wh->frame_control)) {
4573 			struct ieee80211_qos_hdr *qwh =
4574 					(struct ieee80211_qos_hdr *)hdr_desc;
4575 
4576 			qos_field = qwh->qos_ctrl;
4577 			qos_pkt = 1;
4578 		}
4579 		msdu = head_msdu;
4580 
4581 		while (msdu) {
4582 			rx_desc = (struct hal_rx_desc *)msdu->data;
4583 			hdr_desc = ath11k_dp_rxdesc_get_80211hdr(rx_desc);
4584 
4585 			if (qos_pkt) {
4586 				dest = skb_push(msdu, sizeof(__le16));
4587 				if (!dest)
4588 					goto err_merge_fail;
4589 				memcpy(dest, hdr_desc, wifi_hdr_len);
4590 				memcpy(dest + wifi_hdr_len,
4591 				       (u8 *)&qos_field, sizeof(__le16));
4592 			}
4593 			ath11k_dp_rx_msdus_set_payload(msdu);
4594 			prev_buf = msdu;
4595 			msdu = msdu->next;
4596 		}
4597 		dest = skb_put(prev_buf, HAL_RX_FCS_LEN);
4598 		if (!dest)
4599 			goto err_merge_fail;
4600 
4601 		ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4602 			   "mpdu_buf %pK mpdu_buf->len %u",
4603 			   prev_buf, prev_buf->len);
4604 	} else {
4605 		ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4606 			   "decap format %d is not supported!\n",
4607 			   decap_format);
4608 		goto err_merge_fail;
4609 	}
4610 
4611 	return head_msdu;
4612 
4613 err_merge_fail:
4614 	if (mpdu_buf && decap_format != DP_RX_DECAP_TYPE_RAW) {
4615 		ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4616 			   "err_merge_fail mpdu_buf %pK", mpdu_buf);
4617 		/* Free the head buffer */
4618 		dev_kfree_skb_any(mpdu_buf);
4619 	}
4620 	return NULL;
4621 }
4622 
4623 static int ath11k_dp_rx_mon_deliver(struct ath11k *ar, u32 mac_id,
4624 				    struct sk_buff *head_msdu,
4625 				    struct sk_buff *tail_msdu,
4626 				    struct napi_struct *napi)
4627 {
4628 	struct ath11k_pdev_dp *dp = &ar->dp;
4629 	struct sk_buff *mon_skb, *skb_next, *header;
4630 	struct ieee80211_rx_status *rxs = &dp->rx_status, *status;
4631 
4632 	mon_skb = ath11k_dp_rx_mon_merg_msdus(ar, mac_id, head_msdu,
4633 					      tail_msdu, rxs);
4634 
4635 	if (!mon_skb)
4636 		goto mon_deliver_fail;
4637 
4638 	header = mon_skb;
4639 
4640 	rxs->flag = 0;
4641 	do {
4642 		skb_next = mon_skb->next;
4643 		if (!skb_next)
4644 			rxs->flag &= ~RX_FLAG_AMSDU_MORE;
4645 		else
4646 			rxs->flag |= RX_FLAG_AMSDU_MORE;
4647 
4648 		if (mon_skb == header) {
4649 			header = NULL;
4650 			rxs->flag &= ~RX_FLAG_ALLOW_SAME_PN;
4651 		} else {
4652 			rxs->flag |= RX_FLAG_ALLOW_SAME_PN;
4653 		}
4654 		rxs->flag |= RX_FLAG_ONLY_MONITOR;
4655 
4656 		status = IEEE80211_SKB_RXCB(mon_skb);
4657 		*status = *rxs;
4658 
4659 		ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb);
4660 		mon_skb = skb_next;
4661 	} while (mon_skb);
4662 	rxs->flag = 0;
4663 
4664 	return 0;
4665 
4666 mon_deliver_fail:
4667 	mon_skb = head_msdu;
4668 	while (mon_skb) {
4669 		skb_next = mon_skb->next;
4670 		dev_kfree_skb_any(mon_skb);
4671 		mon_skb = skb_next;
4672 	}
4673 	return -EINVAL;
4674 }
4675 
4676 static void ath11k_dp_rx_mon_dest_process(struct ath11k *ar, u32 quota,
4677 					  struct napi_struct *napi)
4678 {
4679 	struct ath11k_pdev_dp *dp = &ar->dp;
4680 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4681 	void *ring_entry;
4682 	void *mon_dst_srng;
4683 	u32 ppdu_id;
4684 	u32 rx_bufs_used;
4685 	struct ath11k_pdev_mon_stats *rx_mon_stats;
4686 	u32	 npackets = 0;
4687 
4688 	mon_dst_srng = &ar->ab->hal.srng_list[dp->rxdma_mon_dst_ring.ring_id];
4689 
4690 	if (!mon_dst_srng) {
4691 		ath11k_warn(ar->ab,
4692 			    "HAL Monitor Destination Ring Init Failed -- %pK",
4693 			    mon_dst_srng);
4694 		return;
4695 	}
4696 
4697 	spin_lock_bh(&pmon->mon_lock);
4698 
4699 	ath11k_hal_srng_access_begin(ar->ab, mon_dst_srng);
4700 
4701 	ppdu_id = pmon->mon_ppdu_info.ppdu_id;
4702 	rx_bufs_used = 0;
4703 	rx_mon_stats = &pmon->rx_mon_stats;
4704 
4705 	while ((ring_entry = ath11k_hal_srng_dst_peek(ar->ab, mon_dst_srng))) {
4706 		struct sk_buff *head_msdu, *tail_msdu;
4707 
4708 		head_msdu = NULL;
4709 		tail_msdu = NULL;
4710 
4711 		rx_bufs_used += ath11k_dp_rx_mon_mpdu_pop(ar, ring_entry,
4712 							  &head_msdu,
4713 							  &tail_msdu,
4714 							  &npackets, &ppdu_id);
4715 
4716 		if (ppdu_id != pmon->mon_ppdu_info.ppdu_id) {
4717 			pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
4718 			ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4719 				   "dest_rx: new ppdu_id %x != status ppdu_id %x",
4720 				   ppdu_id, pmon->mon_ppdu_info.ppdu_id);
4721 			break;
4722 		}
4723 		if (head_msdu && tail_msdu) {
4724 			ath11k_dp_rx_mon_deliver(ar, dp->mac_id, head_msdu,
4725 						 tail_msdu, napi);
4726 			rx_mon_stats->dest_mpdu_done++;
4727 		}
4728 
4729 		ring_entry = ath11k_hal_srng_dst_get_next_entry(ar->ab,
4730 								mon_dst_srng);
4731 	}
4732 	ath11k_hal_srng_access_end(ar->ab, mon_dst_srng);
4733 
4734 	spin_unlock_bh(&pmon->mon_lock);
4735 
4736 	if (rx_bufs_used) {
4737 		rx_mon_stats->dest_ppdu_done++;
4738 		ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
4739 					   &dp->rxdma_mon_buf_ring,
4740 					   rx_bufs_used,
4741 					   HAL_RX_BUF_RBM_SW3_BM, GFP_ATOMIC);
4742 	}
4743 }
4744 
4745 static void ath11k_dp_rx_mon_status_process_tlv(struct ath11k *ar,
4746 						u32 quota,
4747 						struct napi_struct *napi)
4748 {
4749 	struct ath11k_pdev_dp *dp = &ar->dp;
4750 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4751 	struct hal_rx_mon_ppdu_info *ppdu_info;
4752 	struct sk_buff *status_skb;
4753 	u32 tlv_status = HAL_TLV_STATUS_BUF_DONE;
4754 	struct ath11k_pdev_mon_stats *rx_mon_stats;
4755 
4756 	ppdu_info = &pmon->mon_ppdu_info;
4757 	rx_mon_stats = &pmon->rx_mon_stats;
4758 
4759 	if (pmon->mon_ppdu_status != DP_PPDU_STATUS_START)
4760 		return;
4761 
4762 	while (!skb_queue_empty(&pmon->rx_status_q)) {
4763 		status_skb = skb_dequeue(&pmon->rx_status_q);
4764 
4765 		tlv_status = ath11k_hal_rx_parse_mon_status(ar->ab, ppdu_info,
4766 							    status_skb);
4767 		if (tlv_status == HAL_TLV_STATUS_PPDU_DONE) {
4768 			rx_mon_stats->status_ppdu_done++;
4769 			pmon->mon_ppdu_status = DP_PPDU_STATUS_DONE;
4770 			ath11k_dp_rx_mon_dest_process(ar, quota, napi);
4771 			pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
4772 		}
4773 		dev_kfree_skb_any(status_skb);
4774 	}
4775 }
4776 
4777 static int ath11k_dp_mon_process_rx(struct ath11k_base *ab, int mac_id,
4778 				    struct napi_struct *napi, int budget)
4779 {
4780 	struct ath11k *ar = ab->pdevs[mac_id].ar;
4781 	struct ath11k_pdev_dp *dp = &ar->dp;
4782 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4783 	int num_buffs_reaped = 0;
4784 
4785 	num_buffs_reaped = ath11k_dp_rx_reap_mon_status_ring(ar->ab, dp->mac_id, &budget,
4786 							     &pmon->rx_status_q);
4787 	if (num_buffs_reaped)
4788 		ath11k_dp_rx_mon_status_process_tlv(ar, budget, napi);
4789 
4790 	return num_buffs_reaped;
4791 }
4792 
4793 int ath11k_dp_rx_process_mon_rings(struct ath11k_base *ab, int mac_id,
4794 				   struct napi_struct *napi, int budget)
4795 {
4796 	struct ath11k *ar = ab->pdevs[mac_id].ar;
4797 	int ret = 0;
4798 
4799 	if (test_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags))
4800 		ret = ath11k_dp_mon_process_rx(ab, mac_id, napi, budget);
4801 	else
4802 		ret = ath11k_dp_rx_process_mon_status(ab, mac_id, napi, budget);
4803 	return ret;
4804 }
4805 
4806 static int ath11k_dp_rx_pdev_mon_status_attach(struct ath11k *ar)
4807 {
4808 	struct ath11k_pdev_dp *dp = &ar->dp;
4809 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4810 
4811 	skb_queue_head_init(&pmon->rx_status_q);
4812 
4813 	pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
4814 
4815 	memset(&pmon->rx_mon_stats, 0,
4816 	       sizeof(pmon->rx_mon_stats));
4817 	return 0;
4818 }
4819 
4820 int ath11k_dp_rx_pdev_mon_attach(struct ath11k *ar)
4821 {
4822 	struct ath11k_pdev_dp *dp = &ar->dp;
4823 	struct ath11k_mon_data *pmon = &dp->mon_data;
4824 	struct hal_srng *mon_desc_srng = NULL;
4825 	struct dp_srng *dp_srng;
4826 	int ret = 0;
4827 	u32 n_link_desc = 0;
4828 
4829 	ret = ath11k_dp_rx_pdev_mon_status_attach(ar);
4830 	if (ret) {
4831 		ath11k_warn(ar->ab, "pdev_mon_status_attach() failed");
4832 		return ret;
4833 	}
4834 
4835 	dp_srng = &dp->rxdma_mon_desc_ring;
4836 	n_link_desc = dp_srng->size /
4837 		ath11k_hal_srng_get_entrysize(HAL_RXDMA_MONITOR_DESC);
4838 	mon_desc_srng =
4839 		&ar->ab->hal.srng_list[dp->rxdma_mon_desc_ring.ring_id];
4840 
4841 	ret = ath11k_dp_link_desc_setup(ar->ab, pmon->link_desc_banks,
4842 					HAL_RXDMA_MONITOR_DESC, mon_desc_srng,
4843 					n_link_desc);
4844 	if (ret) {
4845 		ath11k_warn(ar->ab, "mon_link_desc_pool_setup() failed");
4846 		return ret;
4847 	}
4848 	pmon->mon_last_linkdesc_paddr = 0;
4849 	pmon->mon_last_buf_cookie = DP_RX_DESC_COOKIE_MAX + 1;
4850 	spin_lock_init(&pmon->mon_lock);
4851 	return 0;
4852 }
4853 
4854 static int ath11k_dp_mon_link_free(struct ath11k *ar)
4855 {
4856 	struct ath11k_pdev_dp *dp = &ar->dp;
4857 	struct ath11k_mon_data *pmon = &dp->mon_data;
4858 
4859 	ath11k_dp_link_desc_cleanup(ar->ab, pmon->link_desc_banks,
4860 				    HAL_RXDMA_MONITOR_DESC,
4861 				    &dp->rxdma_mon_desc_ring);
4862 	return 0;
4863 }
4864 
4865 int ath11k_dp_rx_pdev_mon_detach(struct ath11k *ar)
4866 {
4867 	ath11k_dp_mon_link_free(ar);
4868 	return 0;
4869 }
4870