1 // SPDX-License-Identifier: BSD-3-Clause-Clear
2 /*
3  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
4  */
5 
6 #include <linux/ieee80211.h>
7 #include <linux/kernel.h>
8 #include <linux/skbuff.h>
9 #include <crypto/hash.h>
10 #include "core.h"
11 #include "debug.h"
12 #include "debugfs_htt_stats.h"
13 #include "debugfs_sta.h"
14 #include "hal_desc.h"
15 #include "hw.h"
16 #include "dp_rx.h"
17 #include "hal_rx.h"
18 #include "dp_tx.h"
19 #include "peer.h"
20 
21 #define ATH11K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ)
22 
23 static u8 *ath11k_dp_rx_h_80211_hdr(struct hal_rx_desc *desc)
24 {
25 	return desc->hdr_status;
26 }
27 
28 static enum hal_encrypt_type ath11k_dp_rx_h_mpdu_start_enctype(struct hal_rx_desc *desc)
29 {
30 	if (!(__le32_to_cpu(desc->mpdu_start.info1) &
31 	    RX_MPDU_START_INFO1_ENCRYPT_INFO_VALID))
32 		return HAL_ENCRYPT_TYPE_OPEN;
33 
34 	return FIELD_GET(RX_MPDU_START_INFO2_ENC_TYPE,
35 			 __le32_to_cpu(desc->mpdu_start.info2));
36 }
37 
38 static u8 ath11k_dp_rx_h_msdu_start_decap_type(struct hal_rx_desc *desc)
39 {
40 	return FIELD_GET(RX_MSDU_START_INFO2_DECAP_FORMAT,
41 			 __le32_to_cpu(desc->msdu_start.info2));
42 }
43 
44 static u8 ath11k_dp_rx_h_msdu_start_mesh_ctl_present(struct hal_rx_desc *desc)
45 {
46 	return FIELD_GET(RX_MSDU_START_INFO2_MESH_CTRL_PRESENT,
47 			 __le32_to_cpu(desc->msdu_start.info2));
48 }
49 
50 static bool ath11k_dp_rx_h_mpdu_start_seq_ctrl_valid(struct hal_rx_desc *desc)
51 {
52 	return !!FIELD_GET(RX_MPDU_START_INFO1_MPDU_SEQ_CTRL_VALID,
53 			   __le32_to_cpu(desc->mpdu_start.info1));
54 }
55 
56 static bool ath11k_dp_rx_h_mpdu_start_fc_valid(struct hal_rx_desc *desc)
57 {
58 	return !!FIELD_GET(RX_MPDU_START_INFO1_MPDU_FCTRL_VALID,
59 			   __le32_to_cpu(desc->mpdu_start.info1));
60 }
61 
62 static bool ath11k_dp_rx_h_mpdu_start_more_frags(struct sk_buff *skb)
63 {
64 	struct ieee80211_hdr *hdr;
65 
66 	hdr = (struct ieee80211_hdr *)(skb->data + HAL_RX_DESC_SIZE);
67 	return ieee80211_has_morefrags(hdr->frame_control);
68 }
69 
70 static u16 ath11k_dp_rx_h_mpdu_start_frag_no(struct sk_buff *skb)
71 {
72 	struct ieee80211_hdr *hdr;
73 
74 	hdr = (struct ieee80211_hdr *)(skb->data + HAL_RX_DESC_SIZE);
75 	return le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
76 }
77 
78 static u16 ath11k_dp_rx_h_mpdu_start_seq_no(struct hal_rx_desc *desc)
79 {
80 	return FIELD_GET(RX_MPDU_START_INFO1_MPDU_SEQ_NUM,
81 			 __le32_to_cpu(desc->mpdu_start.info1));
82 }
83 
84 static bool ath11k_dp_rx_h_attn_msdu_done(struct hal_rx_desc *desc)
85 {
86 	return !!FIELD_GET(RX_ATTENTION_INFO2_MSDU_DONE,
87 			   __le32_to_cpu(desc->attention.info2));
88 }
89 
90 static bool ath11k_dp_rx_h_attn_l4_cksum_fail(struct hal_rx_desc *desc)
91 {
92 	return !!FIELD_GET(RX_ATTENTION_INFO1_TCP_UDP_CKSUM_FAIL,
93 			   __le32_to_cpu(desc->attention.info1));
94 }
95 
96 static bool ath11k_dp_rx_h_attn_ip_cksum_fail(struct hal_rx_desc *desc)
97 {
98 	return !!FIELD_GET(RX_ATTENTION_INFO1_IP_CKSUM_FAIL,
99 			   __le32_to_cpu(desc->attention.info1));
100 }
101 
102 static bool ath11k_dp_rx_h_attn_is_decrypted(struct hal_rx_desc *desc)
103 {
104 	return (FIELD_GET(RX_ATTENTION_INFO2_DCRYPT_STATUS_CODE,
105 			  __le32_to_cpu(desc->attention.info2)) ==
106 		RX_DESC_DECRYPT_STATUS_CODE_OK);
107 }
108 
109 static u32 ath11k_dp_rx_h_attn_mpdu_err(struct hal_rx_desc *desc)
110 {
111 	u32 info = __le32_to_cpu(desc->attention.info1);
112 	u32 errmap = 0;
113 
114 	if (info & RX_ATTENTION_INFO1_FCS_ERR)
115 		errmap |= DP_RX_MPDU_ERR_FCS;
116 
117 	if (info & RX_ATTENTION_INFO1_DECRYPT_ERR)
118 		errmap |= DP_RX_MPDU_ERR_DECRYPT;
119 
120 	if (info & RX_ATTENTION_INFO1_TKIP_MIC_ERR)
121 		errmap |= DP_RX_MPDU_ERR_TKIP_MIC;
122 
123 	if (info & RX_ATTENTION_INFO1_A_MSDU_ERROR)
124 		errmap |= DP_RX_MPDU_ERR_AMSDU_ERR;
125 
126 	if (info & RX_ATTENTION_INFO1_OVERFLOW_ERR)
127 		errmap |= DP_RX_MPDU_ERR_OVERFLOW;
128 
129 	if (info & RX_ATTENTION_INFO1_MSDU_LEN_ERR)
130 		errmap |= DP_RX_MPDU_ERR_MSDU_LEN;
131 
132 	if (info & RX_ATTENTION_INFO1_MPDU_LEN_ERR)
133 		errmap |= DP_RX_MPDU_ERR_MPDU_LEN;
134 
135 	return errmap;
136 }
137 
138 static u16 ath11k_dp_rx_h_msdu_start_msdu_len(struct hal_rx_desc *desc)
139 {
140 	return FIELD_GET(RX_MSDU_START_INFO1_MSDU_LENGTH,
141 			 __le32_to_cpu(desc->msdu_start.info1));
142 }
143 
144 static u8 ath11k_dp_rx_h_msdu_start_sgi(struct hal_rx_desc *desc)
145 {
146 	return FIELD_GET(RX_MSDU_START_INFO3_SGI,
147 			 __le32_to_cpu(desc->msdu_start.info3));
148 }
149 
150 static u8 ath11k_dp_rx_h_msdu_start_rate_mcs(struct hal_rx_desc *desc)
151 {
152 	return FIELD_GET(RX_MSDU_START_INFO3_RATE_MCS,
153 			 __le32_to_cpu(desc->msdu_start.info3));
154 }
155 
156 static u8 ath11k_dp_rx_h_msdu_start_rx_bw(struct hal_rx_desc *desc)
157 {
158 	return FIELD_GET(RX_MSDU_START_INFO3_RECV_BW,
159 			 __le32_to_cpu(desc->msdu_start.info3));
160 }
161 
162 static u32 ath11k_dp_rx_h_msdu_start_freq(struct hal_rx_desc *desc)
163 {
164 	return __le32_to_cpu(desc->msdu_start.phy_meta_data);
165 }
166 
167 static u8 ath11k_dp_rx_h_msdu_start_pkt_type(struct hal_rx_desc *desc)
168 {
169 	return FIELD_GET(RX_MSDU_START_INFO3_PKT_TYPE,
170 			 __le32_to_cpu(desc->msdu_start.info3));
171 }
172 
173 static u8 ath11k_dp_rx_h_msdu_start_nss(struct hal_rx_desc *desc)
174 {
175 	u8 mimo_ss_bitmap = FIELD_GET(RX_MSDU_START_INFO3_MIMO_SS_BITMAP,
176 				      __le32_to_cpu(desc->msdu_start.info3));
177 
178 	return hweight8(mimo_ss_bitmap);
179 }
180 
181 static u8 ath11k_dp_rx_h_mpdu_start_tid(struct hal_rx_desc *desc)
182 {
183 	return FIELD_GET(RX_MPDU_START_INFO2_TID,
184 			 __le32_to_cpu(desc->mpdu_start.info2));
185 }
186 
187 static u16 ath11k_dp_rx_h_mpdu_start_peer_id(struct hal_rx_desc *desc)
188 {
189 	return __le16_to_cpu(desc->mpdu_start.sw_peer_id);
190 }
191 
192 static u8 ath11k_dp_rx_h_msdu_end_l3pad(struct hal_rx_desc *desc)
193 {
194 	return FIELD_GET(RX_MSDU_END_INFO2_L3_HDR_PADDING,
195 			 __le32_to_cpu(desc->msdu_end.info2));
196 }
197 
198 static bool ath11k_dp_rx_h_msdu_end_first_msdu(struct hal_rx_desc *desc)
199 {
200 	return !!FIELD_GET(RX_MSDU_END_INFO2_FIRST_MSDU,
201 			   __le32_to_cpu(desc->msdu_end.info2));
202 }
203 
204 static bool ath11k_dp_rx_h_msdu_end_last_msdu(struct hal_rx_desc *desc)
205 {
206 	return !!FIELD_GET(RX_MSDU_END_INFO2_LAST_MSDU,
207 			   __le32_to_cpu(desc->msdu_end.info2));
208 }
209 
210 static void ath11k_dp_rx_desc_end_tlv_copy(struct hal_rx_desc *fdesc,
211 					   struct hal_rx_desc *ldesc)
212 {
213 	memcpy((u8 *)&fdesc->msdu_end, (u8 *)&ldesc->msdu_end,
214 	       sizeof(struct rx_msdu_end));
215 	memcpy((u8 *)&fdesc->attention, (u8 *)&ldesc->attention,
216 	       sizeof(struct rx_attention));
217 	memcpy((u8 *)&fdesc->mpdu_end, (u8 *)&ldesc->mpdu_end,
218 	       sizeof(struct rx_mpdu_end));
219 }
220 
221 static u32 ath11k_dp_rxdesc_get_mpdulen_err(struct hal_rx_desc *rx_desc)
222 {
223 	struct rx_attention *rx_attn;
224 
225 	rx_attn = &rx_desc->attention;
226 
227 	return FIELD_GET(RX_ATTENTION_INFO1_MPDU_LEN_ERR,
228 			 __le32_to_cpu(rx_attn->info1));
229 }
230 
231 static u32 ath11k_dp_rxdesc_get_decap_format(struct hal_rx_desc *rx_desc)
232 {
233 	struct rx_msdu_start *rx_msdu_start;
234 
235 	rx_msdu_start = &rx_desc->msdu_start;
236 
237 	return FIELD_GET(RX_MSDU_START_INFO2_DECAP_FORMAT,
238 			 __le32_to_cpu(rx_msdu_start->info2));
239 }
240 
241 static u8 *ath11k_dp_rxdesc_get_80211hdr(struct hal_rx_desc *rx_desc)
242 {
243 	u8 *rx_pkt_hdr;
244 
245 	rx_pkt_hdr = &rx_desc->msdu_payload[0];
246 
247 	return rx_pkt_hdr;
248 }
249 
250 static bool ath11k_dp_rxdesc_mpdu_valid(struct hal_rx_desc *rx_desc)
251 {
252 	u32 tlv_tag;
253 
254 	tlv_tag = FIELD_GET(HAL_TLV_HDR_TAG,
255 			    __le32_to_cpu(rx_desc->mpdu_start_tag));
256 
257 	return tlv_tag == HAL_RX_MPDU_START;
258 }
259 
260 static u32 ath11k_dp_rxdesc_get_ppduid(struct hal_rx_desc *rx_desc)
261 {
262 	return __le16_to_cpu(rx_desc->mpdu_start.phy_ppdu_id);
263 }
264 
265 static void ath11k_dp_service_mon_ring(struct timer_list *t)
266 {
267 	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
268 	int i;
269 
270 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++)
271 		ath11k_dp_rx_process_mon_rings(ab, i, NULL, DP_MON_SERVICE_BUDGET);
272 
273 	mod_timer(&ab->mon_reap_timer, jiffies +
274 		  msecs_to_jiffies(ATH11K_MON_TIMER_INTERVAL));
275 }
276 
277 static int ath11k_dp_purge_mon_ring(struct ath11k_base *ab)
278 {
279 	int i, reaped = 0;
280 	unsigned long timeout = jiffies + msecs_to_jiffies(DP_MON_PURGE_TIMEOUT_MS);
281 
282 	do {
283 		for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++)
284 			reaped += ath11k_dp_rx_process_mon_rings(ab, i,
285 								 NULL,
286 								 DP_MON_SERVICE_BUDGET);
287 
288 		/* nothing more to reap */
289 		if (reaped < DP_MON_SERVICE_BUDGET)
290 			return 0;
291 
292 	} while (time_before(jiffies, timeout));
293 
294 	ath11k_warn(ab, "dp mon ring purge timeout");
295 
296 	return -ETIMEDOUT;
297 }
298 
299 /* Returns number of Rx buffers replenished */
300 int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
301 			       struct dp_rxdma_ring *rx_ring,
302 			       int req_entries,
303 			       enum hal_rx_buf_return_buf_manager mgr)
304 {
305 	struct hal_srng *srng;
306 	u32 *desc;
307 	struct sk_buff *skb;
308 	int num_free;
309 	int num_remain;
310 	int buf_id;
311 	u32 cookie;
312 	dma_addr_t paddr;
313 
314 	req_entries = min(req_entries, rx_ring->bufs_max);
315 
316 	srng = &ab->hal.srng_list[rx_ring->refill_buf_ring.ring_id];
317 
318 	spin_lock_bh(&srng->lock);
319 
320 	ath11k_hal_srng_access_begin(ab, srng);
321 
322 	num_free = ath11k_hal_srng_src_num_free(ab, srng, true);
323 	if (!req_entries && (num_free > (rx_ring->bufs_max * 3) / 4))
324 		req_entries = num_free;
325 
326 	req_entries = min(num_free, req_entries);
327 	num_remain = req_entries;
328 
329 	while (num_remain > 0) {
330 		skb = dev_alloc_skb(DP_RX_BUFFER_SIZE +
331 				    DP_RX_BUFFER_ALIGN_SIZE);
332 		if (!skb)
333 			break;
334 
335 		if (!IS_ALIGNED((unsigned long)skb->data,
336 				DP_RX_BUFFER_ALIGN_SIZE)) {
337 			skb_pull(skb,
338 				 PTR_ALIGN(skb->data, DP_RX_BUFFER_ALIGN_SIZE) -
339 				 skb->data);
340 		}
341 
342 		paddr = dma_map_single(ab->dev, skb->data,
343 				       skb->len + skb_tailroom(skb),
344 				       DMA_FROM_DEVICE);
345 		if (dma_mapping_error(ab->dev, paddr))
346 			goto fail_free_skb;
347 
348 		spin_lock_bh(&rx_ring->idr_lock);
349 		buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 0,
350 				   rx_ring->bufs_max * 3, GFP_ATOMIC);
351 		spin_unlock_bh(&rx_ring->idr_lock);
352 		if (buf_id < 0)
353 			goto fail_dma_unmap;
354 
355 		desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
356 		if (!desc)
357 			goto fail_idr_remove;
358 
359 		ATH11K_SKB_RXCB(skb)->paddr = paddr;
360 
361 		cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, mac_id) |
362 			 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
363 
364 		num_remain--;
365 
366 		ath11k_hal_rx_buf_addr_info_set(desc, paddr, cookie, mgr);
367 	}
368 
369 	ath11k_hal_srng_access_end(ab, srng);
370 
371 	spin_unlock_bh(&srng->lock);
372 
373 	return req_entries - num_remain;
374 
375 fail_idr_remove:
376 	spin_lock_bh(&rx_ring->idr_lock);
377 	idr_remove(&rx_ring->bufs_idr, buf_id);
378 	spin_unlock_bh(&rx_ring->idr_lock);
379 fail_dma_unmap:
380 	dma_unmap_single(ab->dev, paddr, skb->len + skb_tailroom(skb),
381 			 DMA_FROM_DEVICE);
382 fail_free_skb:
383 	dev_kfree_skb_any(skb);
384 
385 	ath11k_hal_srng_access_end(ab, srng);
386 
387 	spin_unlock_bh(&srng->lock);
388 
389 	return req_entries - num_remain;
390 }
391 
392 static int ath11k_dp_rxdma_buf_ring_free(struct ath11k *ar,
393 					 struct dp_rxdma_ring *rx_ring)
394 {
395 	struct ath11k_pdev_dp *dp = &ar->dp;
396 	struct sk_buff *skb;
397 	int buf_id;
398 
399 	spin_lock_bh(&rx_ring->idr_lock);
400 	idr_for_each_entry(&rx_ring->bufs_idr, skb, buf_id) {
401 		idr_remove(&rx_ring->bufs_idr, buf_id);
402 		/* TODO: Understand where internal driver does this dma_unmap
403 		 * of rxdma_buffer.
404 		 */
405 		dma_unmap_single(ar->ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
406 				 skb->len + skb_tailroom(skb), DMA_FROM_DEVICE);
407 		dev_kfree_skb_any(skb);
408 	}
409 
410 	idr_destroy(&rx_ring->bufs_idr);
411 	spin_unlock_bh(&rx_ring->idr_lock);
412 
413 	/* if rxdma1_enable is false, mon_status_refill_ring
414 	 * isn't setup, so don't clean.
415 	 */
416 	if (!ar->ab->hw_params.rxdma1_enable)
417 		return 0;
418 
419 	rx_ring = &dp->rx_mon_status_refill_ring[0];
420 
421 	spin_lock_bh(&rx_ring->idr_lock);
422 	idr_for_each_entry(&rx_ring->bufs_idr, skb, buf_id) {
423 		idr_remove(&rx_ring->bufs_idr, buf_id);
424 		/* XXX: Understand where internal driver does this dma_unmap
425 		 * of rxdma_buffer.
426 		 */
427 		dma_unmap_single(ar->ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
428 				 skb->len + skb_tailroom(skb), DMA_BIDIRECTIONAL);
429 		dev_kfree_skb_any(skb);
430 	}
431 
432 	idr_destroy(&rx_ring->bufs_idr);
433 	spin_unlock_bh(&rx_ring->idr_lock);
434 
435 	return 0;
436 }
437 
438 static int ath11k_dp_rxdma_pdev_buf_free(struct ath11k *ar)
439 {
440 	struct ath11k_pdev_dp *dp = &ar->dp;
441 	struct ath11k_base *ab = ar->ab;
442 	struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
443 	int i;
444 
445 	ath11k_dp_rxdma_buf_ring_free(ar, rx_ring);
446 
447 	rx_ring = &dp->rxdma_mon_buf_ring;
448 	ath11k_dp_rxdma_buf_ring_free(ar, rx_ring);
449 
450 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
451 		rx_ring = &dp->rx_mon_status_refill_ring[i];
452 		ath11k_dp_rxdma_buf_ring_free(ar, rx_ring);
453 	}
454 
455 	return 0;
456 }
457 
458 static int ath11k_dp_rxdma_ring_buf_setup(struct ath11k *ar,
459 					  struct dp_rxdma_ring *rx_ring,
460 					  u32 ringtype)
461 {
462 	struct ath11k_pdev_dp *dp = &ar->dp;
463 	int num_entries;
464 
465 	num_entries = rx_ring->refill_buf_ring.size /
466 		ath11k_hal_srng_get_entrysize(ar->ab, ringtype);
467 
468 	rx_ring->bufs_max = num_entries;
469 	ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id, rx_ring, num_entries,
470 				   HAL_RX_BUF_RBM_SW3_BM);
471 	return 0;
472 }
473 
474 static int ath11k_dp_rxdma_pdev_buf_setup(struct ath11k *ar)
475 {
476 	struct ath11k_pdev_dp *dp = &ar->dp;
477 	struct ath11k_base *ab = ar->ab;
478 	struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
479 	int i;
480 
481 	ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_BUF);
482 
483 	if (ar->ab->hw_params.rxdma1_enable) {
484 		rx_ring = &dp->rxdma_mon_buf_ring;
485 		ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_MONITOR_BUF);
486 	}
487 
488 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
489 		rx_ring = &dp->rx_mon_status_refill_ring[i];
490 		ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_MONITOR_STATUS);
491 	}
492 
493 	return 0;
494 }
495 
496 static void ath11k_dp_rx_pdev_srng_free(struct ath11k *ar)
497 {
498 	struct ath11k_pdev_dp *dp = &ar->dp;
499 	struct ath11k_base *ab = ar->ab;
500 	int i;
501 
502 	ath11k_dp_srng_cleanup(ab, &dp->rx_refill_buf_ring.refill_buf_ring);
503 
504 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
505 		if (ab->hw_params.rx_mac_buf_ring)
506 			ath11k_dp_srng_cleanup(ab, &dp->rx_mac_buf_ring[i]);
507 
508 		ath11k_dp_srng_cleanup(ab, &dp->rxdma_err_dst_ring[i]);
509 		ath11k_dp_srng_cleanup(ab,
510 				       &dp->rx_mon_status_refill_ring[i].refill_buf_ring);
511 	}
512 
513 	ath11k_dp_srng_cleanup(ab, &dp->rxdma_mon_buf_ring.refill_buf_ring);
514 }
515 
516 void ath11k_dp_pdev_reo_cleanup(struct ath11k_base *ab)
517 {
518 	struct ath11k_dp *dp = &ab->dp;
519 	int i;
520 
521 	for (i = 0; i < DP_REO_DST_RING_MAX; i++)
522 		ath11k_dp_srng_cleanup(ab, &dp->reo_dst_ring[i]);
523 }
524 
525 int ath11k_dp_pdev_reo_setup(struct ath11k_base *ab)
526 {
527 	struct ath11k_dp *dp = &ab->dp;
528 	int ret;
529 	int i;
530 
531 	for (i = 0; i < DP_REO_DST_RING_MAX; i++) {
532 		ret = ath11k_dp_srng_setup(ab, &dp->reo_dst_ring[i],
533 					   HAL_REO_DST, i, 0,
534 					   DP_REO_DST_RING_SIZE);
535 		if (ret) {
536 			ath11k_warn(ab, "failed to setup reo_dst_ring\n");
537 			goto err_reo_cleanup;
538 		}
539 	}
540 
541 	return 0;
542 
543 err_reo_cleanup:
544 	ath11k_dp_pdev_reo_cleanup(ab);
545 
546 	return ret;
547 }
548 
549 static int ath11k_dp_rx_pdev_srng_alloc(struct ath11k *ar)
550 {
551 	struct ath11k_pdev_dp *dp = &ar->dp;
552 	struct ath11k_base *ab = ar->ab;
553 	struct dp_srng *srng = NULL;
554 	int i;
555 	int ret;
556 
557 	ret = ath11k_dp_srng_setup(ar->ab,
558 				   &dp->rx_refill_buf_ring.refill_buf_ring,
559 				   HAL_RXDMA_BUF, 0,
560 				   dp->mac_id, DP_RXDMA_BUF_RING_SIZE);
561 	if (ret) {
562 		ath11k_warn(ar->ab, "failed to setup rx_refill_buf_ring\n");
563 		return ret;
564 	}
565 
566 	if (ar->ab->hw_params.rx_mac_buf_ring) {
567 		for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
568 			ret = ath11k_dp_srng_setup(ar->ab,
569 						   &dp->rx_mac_buf_ring[i],
570 						   HAL_RXDMA_BUF, 1,
571 						   dp->mac_id + i, 1024);
572 			if (ret) {
573 				ath11k_warn(ar->ab, "failed to setup rx_mac_buf_ring %d\n",
574 					    i);
575 				return ret;
576 			}
577 		}
578 	}
579 
580 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
581 		ret = ath11k_dp_srng_setup(ar->ab, &dp->rxdma_err_dst_ring[i],
582 					   HAL_RXDMA_DST, 0, dp->mac_id + i,
583 					   DP_RXDMA_ERR_DST_RING_SIZE);
584 		if (ret) {
585 			ath11k_warn(ar->ab, "failed to setup rxdma_err_dst_ring %d\n", i);
586 			return ret;
587 		}
588 	}
589 
590 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
591 		srng = &dp->rx_mon_status_refill_ring[i].refill_buf_ring;
592 		ret = ath11k_dp_srng_setup(ar->ab,
593 					   srng,
594 					   HAL_RXDMA_MONITOR_STATUS, 0, dp->mac_id + i,
595 					   DP_RXDMA_MON_STATUS_RING_SIZE);
596 		if (ret) {
597 			ath11k_warn(ar->ab,
598 				    "failed to setup rx_mon_status_refill_ring %d\n", i);
599 			return ret;
600 		}
601 	}
602 
603 	/* if rxdma1_enable is false, then it doesn't need
604 	 * to setup rxdam_mon_buf_ring, rxdma_mon_dst_ring
605 	 * and rxdma_mon_desc_ring.
606 	 * init reap timer for QCA6390.
607 	 */
608 	if (!ar->ab->hw_params.rxdma1_enable) {
609 		//init mon status buffer reap timer
610 		timer_setup(&ar->ab->mon_reap_timer,
611 			    ath11k_dp_service_mon_ring, 0);
612 		return 0;
613 	}
614 
615 	ret = ath11k_dp_srng_setup(ar->ab,
616 				   &dp->rxdma_mon_buf_ring.refill_buf_ring,
617 				   HAL_RXDMA_MONITOR_BUF, 0, dp->mac_id,
618 				   DP_RXDMA_MONITOR_BUF_RING_SIZE);
619 	if (ret) {
620 		ath11k_warn(ar->ab,
621 			    "failed to setup HAL_RXDMA_MONITOR_BUF\n");
622 		return ret;
623 	}
624 
625 	ret = ath11k_dp_srng_setup(ar->ab, &dp->rxdma_mon_dst_ring,
626 				   HAL_RXDMA_MONITOR_DST, 0, dp->mac_id,
627 				   DP_RXDMA_MONITOR_DST_RING_SIZE);
628 	if (ret) {
629 		ath11k_warn(ar->ab,
630 			    "failed to setup HAL_RXDMA_MONITOR_DST\n");
631 		return ret;
632 	}
633 
634 	ret = ath11k_dp_srng_setup(ar->ab, &dp->rxdma_mon_desc_ring,
635 				   HAL_RXDMA_MONITOR_DESC, 0, dp->mac_id,
636 				   DP_RXDMA_MONITOR_DESC_RING_SIZE);
637 	if (ret) {
638 		ath11k_warn(ar->ab,
639 			    "failed to setup HAL_RXDMA_MONITOR_DESC\n");
640 		return ret;
641 	}
642 
643 	return 0;
644 }
645 
646 void ath11k_dp_reo_cmd_list_cleanup(struct ath11k_base *ab)
647 {
648 	struct ath11k_dp *dp = &ab->dp;
649 	struct dp_reo_cmd *cmd, *tmp;
650 	struct dp_reo_cache_flush_elem *cmd_cache, *tmp_cache;
651 
652 	spin_lock_bh(&dp->reo_cmd_lock);
653 	list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
654 		list_del(&cmd->list);
655 		dma_unmap_single(ab->dev, cmd->data.paddr,
656 				 cmd->data.size, DMA_BIDIRECTIONAL);
657 		kfree(cmd->data.vaddr);
658 		kfree(cmd);
659 	}
660 
661 	list_for_each_entry_safe(cmd_cache, tmp_cache,
662 				 &dp->reo_cmd_cache_flush_list, list) {
663 		list_del(&cmd_cache->list);
664 		dp->reo_cmd_cache_flush_count--;
665 		dma_unmap_single(ab->dev, cmd_cache->data.paddr,
666 				 cmd_cache->data.size, DMA_BIDIRECTIONAL);
667 		kfree(cmd_cache->data.vaddr);
668 		kfree(cmd_cache);
669 	}
670 	spin_unlock_bh(&dp->reo_cmd_lock);
671 }
672 
673 static void ath11k_dp_reo_cmd_free(struct ath11k_dp *dp, void *ctx,
674 				   enum hal_reo_cmd_status status)
675 {
676 	struct dp_rx_tid *rx_tid = ctx;
677 
678 	if (status != HAL_REO_CMD_SUCCESS)
679 		ath11k_warn(dp->ab, "failed to flush rx tid hw desc, tid %d status %d\n",
680 			    rx_tid->tid, status);
681 
682 	dma_unmap_single(dp->ab->dev, rx_tid->paddr, rx_tid->size,
683 			 DMA_BIDIRECTIONAL);
684 	kfree(rx_tid->vaddr);
685 }
686 
687 static void ath11k_dp_reo_cache_flush(struct ath11k_base *ab,
688 				      struct dp_rx_tid *rx_tid)
689 {
690 	struct ath11k_hal_reo_cmd cmd = {0};
691 	unsigned long tot_desc_sz, desc_sz;
692 	int ret;
693 
694 	tot_desc_sz = rx_tid->size;
695 	desc_sz = ath11k_hal_reo_qdesc_size(0, HAL_DESC_REO_NON_QOS_TID);
696 
697 	while (tot_desc_sz > desc_sz) {
698 		tot_desc_sz -= desc_sz;
699 		cmd.addr_lo = lower_32_bits(rx_tid->paddr + tot_desc_sz);
700 		cmd.addr_hi = upper_32_bits(rx_tid->paddr);
701 		ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
702 						HAL_REO_CMD_FLUSH_CACHE, &cmd,
703 						NULL);
704 		if (ret)
705 			ath11k_warn(ab,
706 				    "failed to send HAL_REO_CMD_FLUSH_CACHE, tid %d (%d)\n",
707 				    rx_tid->tid, ret);
708 	}
709 
710 	memset(&cmd, 0, sizeof(cmd));
711 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
712 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
713 	cmd.flag |= HAL_REO_CMD_FLG_NEED_STATUS;
714 	ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
715 					HAL_REO_CMD_FLUSH_CACHE,
716 					&cmd, ath11k_dp_reo_cmd_free);
717 	if (ret) {
718 		ath11k_err(ab, "failed to send HAL_REO_CMD_FLUSH_CACHE cmd, tid %d (%d)\n",
719 			   rx_tid->tid, ret);
720 		dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
721 				 DMA_BIDIRECTIONAL);
722 		kfree(rx_tid->vaddr);
723 	}
724 }
725 
726 static void ath11k_dp_rx_tid_del_func(struct ath11k_dp *dp, void *ctx,
727 				      enum hal_reo_cmd_status status)
728 {
729 	struct ath11k_base *ab = dp->ab;
730 	struct dp_rx_tid *rx_tid = ctx;
731 	struct dp_reo_cache_flush_elem *elem, *tmp;
732 
733 	if (status == HAL_REO_CMD_DRAIN) {
734 		goto free_desc;
735 	} else if (status != HAL_REO_CMD_SUCCESS) {
736 		/* Shouldn't happen! Cleanup in case of other failure? */
737 		ath11k_warn(ab, "failed to delete rx tid %d hw descriptor %d\n",
738 			    rx_tid->tid, status);
739 		return;
740 	}
741 
742 	elem = kzalloc(sizeof(*elem), GFP_ATOMIC);
743 	if (!elem)
744 		goto free_desc;
745 
746 	elem->ts = jiffies;
747 	memcpy(&elem->data, rx_tid, sizeof(*rx_tid));
748 
749 	spin_lock_bh(&dp->reo_cmd_lock);
750 	list_add_tail(&elem->list, &dp->reo_cmd_cache_flush_list);
751 	dp->reo_cmd_cache_flush_count++;
752 
753 	/* Flush and invalidate aged REO desc from HW cache */
754 	list_for_each_entry_safe(elem, tmp, &dp->reo_cmd_cache_flush_list,
755 				 list) {
756 		if (dp->reo_cmd_cache_flush_count > DP_REO_DESC_FREE_THRESHOLD ||
757 		    time_after(jiffies, elem->ts +
758 			       msecs_to_jiffies(DP_REO_DESC_FREE_TIMEOUT_MS))) {
759 			list_del(&elem->list);
760 			dp->reo_cmd_cache_flush_count--;
761 			spin_unlock_bh(&dp->reo_cmd_lock);
762 
763 			ath11k_dp_reo_cache_flush(ab, &elem->data);
764 			kfree(elem);
765 			spin_lock_bh(&dp->reo_cmd_lock);
766 		}
767 	}
768 	spin_unlock_bh(&dp->reo_cmd_lock);
769 
770 	return;
771 free_desc:
772 	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
773 			 DMA_BIDIRECTIONAL);
774 	kfree(rx_tid->vaddr);
775 }
776 
777 void ath11k_peer_rx_tid_delete(struct ath11k *ar,
778 			       struct ath11k_peer *peer, u8 tid)
779 {
780 	struct ath11k_hal_reo_cmd cmd = {0};
781 	struct dp_rx_tid *rx_tid = &peer->rx_tid[tid];
782 	int ret;
783 
784 	if (!rx_tid->active)
785 		return;
786 
787 	cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
788 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
789 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
790 	cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
791 	ret = ath11k_dp_tx_send_reo_cmd(ar->ab, rx_tid,
792 					HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
793 					ath11k_dp_rx_tid_del_func);
794 	if (ret) {
795 		ath11k_err(ar->ab, "failed to send HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n",
796 			   tid, ret);
797 		dma_unmap_single(ar->ab->dev, rx_tid->paddr, rx_tid->size,
798 				 DMA_BIDIRECTIONAL);
799 		kfree(rx_tid->vaddr);
800 	}
801 
802 	rx_tid->active = false;
803 }
804 
805 static int ath11k_dp_rx_link_desc_return(struct ath11k_base *ab,
806 					 u32 *link_desc,
807 					 enum hal_wbm_rel_bm_act action)
808 {
809 	struct ath11k_dp *dp = &ab->dp;
810 	struct hal_srng *srng;
811 	u32 *desc;
812 	int ret = 0;
813 
814 	srng = &ab->hal.srng_list[dp->wbm_desc_rel_ring.ring_id];
815 
816 	spin_lock_bh(&srng->lock);
817 
818 	ath11k_hal_srng_access_begin(ab, srng);
819 
820 	desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
821 	if (!desc) {
822 		ret = -ENOBUFS;
823 		goto exit;
824 	}
825 
826 	ath11k_hal_rx_msdu_link_desc_set(ab, (void *)desc, (void *)link_desc,
827 					 action);
828 
829 exit:
830 	ath11k_hal_srng_access_end(ab, srng);
831 
832 	spin_unlock_bh(&srng->lock);
833 
834 	return ret;
835 }
836 
837 static void ath11k_dp_rx_frags_cleanup(struct dp_rx_tid *rx_tid, bool rel_link_desc)
838 {
839 	struct ath11k_base *ab = rx_tid->ab;
840 
841 	lockdep_assert_held(&ab->base_lock);
842 
843 	if (rx_tid->dst_ring_desc) {
844 		if (rel_link_desc)
845 			ath11k_dp_rx_link_desc_return(ab, (u32 *)rx_tid->dst_ring_desc,
846 						      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
847 		kfree(rx_tid->dst_ring_desc);
848 		rx_tid->dst_ring_desc = NULL;
849 	}
850 
851 	rx_tid->cur_sn = 0;
852 	rx_tid->last_frag_no = 0;
853 	rx_tid->rx_frag_bitmap = 0;
854 	__skb_queue_purge(&rx_tid->rx_frags);
855 }
856 
857 void ath11k_peer_rx_tid_cleanup(struct ath11k *ar, struct ath11k_peer *peer)
858 {
859 	struct dp_rx_tid *rx_tid;
860 	int i;
861 
862 	lockdep_assert_held(&ar->ab->base_lock);
863 
864 	for (i = 0; i <= IEEE80211_NUM_TIDS; i++) {
865 		rx_tid = &peer->rx_tid[i];
866 
867 		ath11k_peer_rx_tid_delete(ar, peer, i);
868 		ath11k_dp_rx_frags_cleanup(rx_tid, true);
869 
870 		spin_unlock_bh(&ar->ab->base_lock);
871 		del_timer_sync(&rx_tid->frag_timer);
872 		spin_lock_bh(&ar->ab->base_lock);
873 	}
874 }
875 
876 static int ath11k_peer_rx_tid_reo_update(struct ath11k *ar,
877 					 struct ath11k_peer *peer,
878 					 struct dp_rx_tid *rx_tid,
879 					 u32 ba_win_sz, u16 ssn,
880 					 bool update_ssn)
881 {
882 	struct ath11k_hal_reo_cmd cmd = {0};
883 	int ret;
884 
885 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
886 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
887 	cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
888 	cmd.upd0 = HAL_REO_CMD_UPD0_BA_WINDOW_SIZE;
889 	cmd.ba_window_size = ba_win_sz;
890 
891 	if (update_ssn) {
892 		cmd.upd0 |= HAL_REO_CMD_UPD0_SSN;
893 		cmd.upd2 = FIELD_PREP(HAL_REO_CMD_UPD2_SSN, ssn);
894 	}
895 
896 	ret = ath11k_dp_tx_send_reo_cmd(ar->ab, rx_tid,
897 					HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
898 					NULL);
899 	if (ret) {
900 		ath11k_warn(ar->ab, "failed to update rx tid queue, tid %d (%d)\n",
901 			    rx_tid->tid, ret);
902 		return ret;
903 	}
904 
905 	rx_tid->ba_win_sz = ba_win_sz;
906 
907 	return 0;
908 }
909 
910 static void ath11k_dp_rx_tid_mem_free(struct ath11k_base *ab,
911 				      const u8 *peer_mac, int vdev_id, u8 tid)
912 {
913 	struct ath11k_peer *peer;
914 	struct dp_rx_tid *rx_tid;
915 
916 	spin_lock_bh(&ab->base_lock);
917 
918 	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
919 	if (!peer) {
920 		ath11k_warn(ab, "failed to find the peer to free up rx tid mem\n");
921 		goto unlock_exit;
922 	}
923 
924 	rx_tid = &peer->rx_tid[tid];
925 	if (!rx_tid->active)
926 		goto unlock_exit;
927 
928 	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
929 			 DMA_BIDIRECTIONAL);
930 	kfree(rx_tid->vaddr);
931 
932 	rx_tid->active = false;
933 
934 unlock_exit:
935 	spin_unlock_bh(&ab->base_lock);
936 }
937 
938 int ath11k_peer_rx_tid_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id,
939 			     u8 tid, u32 ba_win_sz, u16 ssn,
940 			     enum hal_pn_type pn_type)
941 {
942 	struct ath11k_base *ab = ar->ab;
943 	struct ath11k_peer *peer;
944 	struct dp_rx_tid *rx_tid;
945 	u32 hw_desc_sz;
946 	u32 *addr_aligned;
947 	void *vaddr;
948 	dma_addr_t paddr;
949 	int ret;
950 
951 	spin_lock_bh(&ab->base_lock);
952 
953 	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
954 	if (!peer) {
955 		ath11k_warn(ab, "failed to find the peer to set up rx tid\n");
956 		spin_unlock_bh(&ab->base_lock);
957 		return -ENOENT;
958 	}
959 
960 	rx_tid = &peer->rx_tid[tid];
961 	/* Update the tid queue if it is already setup */
962 	if (rx_tid->active) {
963 		paddr = rx_tid->paddr;
964 		ret = ath11k_peer_rx_tid_reo_update(ar, peer, rx_tid,
965 						    ba_win_sz, ssn, true);
966 		spin_unlock_bh(&ab->base_lock);
967 		if (ret) {
968 			ath11k_warn(ab, "failed to update reo for rx tid %d\n", tid);
969 			return ret;
970 		}
971 
972 		ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id,
973 							     peer_mac, paddr,
974 							     tid, 1, ba_win_sz);
975 		if (ret)
976 			ath11k_warn(ab, "failed to send wmi command to update rx reorder queue, tid :%d (%d)\n",
977 				    tid, ret);
978 		return ret;
979 	}
980 
981 	rx_tid->tid = tid;
982 
983 	rx_tid->ba_win_sz = ba_win_sz;
984 
985 	/* TODO: Optimize the memory allocation for qos tid based on
986 	 * the actual BA window size in REO tid update path.
987 	 */
988 	if (tid == HAL_DESC_REO_NON_QOS_TID)
989 		hw_desc_sz = ath11k_hal_reo_qdesc_size(ba_win_sz, tid);
990 	else
991 		hw_desc_sz = ath11k_hal_reo_qdesc_size(DP_BA_WIN_SZ_MAX, tid);
992 
993 	vaddr = kzalloc(hw_desc_sz + HAL_LINK_DESC_ALIGN - 1, GFP_ATOMIC);
994 	if (!vaddr) {
995 		spin_unlock_bh(&ab->base_lock);
996 		return -ENOMEM;
997 	}
998 
999 	addr_aligned = PTR_ALIGN(vaddr, HAL_LINK_DESC_ALIGN);
1000 
1001 	ath11k_hal_reo_qdesc_setup(addr_aligned, tid, ba_win_sz,
1002 				   ssn, pn_type);
1003 
1004 	paddr = dma_map_single(ab->dev, addr_aligned, hw_desc_sz,
1005 			       DMA_BIDIRECTIONAL);
1006 
1007 	ret = dma_mapping_error(ab->dev, paddr);
1008 	if (ret) {
1009 		spin_unlock_bh(&ab->base_lock);
1010 		goto err_mem_free;
1011 	}
1012 
1013 	rx_tid->vaddr = vaddr;
1014 	rx_tid->paddr = paddr;
1015 	rx_tid->size = hw_desc_sz;
1016 	rx_tid->active = true;
1017 
1018 	spin_unlock_bh(&ab->base_lock);
1019 
1020 	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id, peer_mac,
1021 						     paddr, tid, 1, ba_win_sz);
1022 	if (ret) {
1023 		ath11k_warn(ar->ab, "failed to setup rx reorder queue, tid :%d (%d)\n",
1024 			    tid, ret);
1025 		ath11k_dp_rx_tid_mem_free(ab, peer_mac, vdev_id, tid);
1026 	}
1027 
1028 	return ret;
1029 
1030 err_mem_free:
1031 	kfree(vaddr);
1032 
1033 	return ret;
1034 }
1035 
1036 int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
1037 			     struct ieee80211_ampdu_params *params)
1038 {
1039 	struct ath11k_base *ab = ar->ab;
1040 	struct ath11k_sta *arsta = (void *)params->sta->drv_priv;
1041 	int vdev_id = arsta->arvif->vdev_id;
1042 	int ret;
1043 
1044 	ret = ath11k_peer_rx_tid_setup(ar, params->sta->addr, vdev_id,
1045 				       params->tid, params->buf_size,
1046 				       params->ssn, arsta->pn_type);
1047 	if (ret)
1048 		ath11k_warn(ab, "failed to setup rx tid %d\n", ret);
1049 
1050 	return ret;
1051 }
1052 
1053 int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
1054 			    struct ieee80211_ampdu_params *params)
1055 {
1056 	struct ath11k_base *ab = ar->ab;
1057 	struct ath11k_peer *peer;
1058 	struct ath11k_sta *arsta = (void *)params->sta->drv_priv;
1059 	int vdev_id = arsta->arvif->vdev_id;
1060 	dma_addr_t paddr;
1061 	bool active;
1062 	int ret;
1063 
1064 	spin_lock_bh(&ab->base_lock);
1065 
1066 	peer = ath11k_peer_find(ab, vdev_id, params->sta->addr);
1067 	if (!peer) {
1068 		ath11k_warn(ab, "failed to find the peer to stop rx aggregation\n");
1069 		spin_unlock_bh(&ab->base_lock);
1070 		return -ENOENT;
1071 	}
1072 
1073 	paddr = peer->rx_tid[params->tid].paddr;
1074 	active = peer->rx_tid[params->tid].active;
1075 
1076 	if (!active) {
1077 		spin_unlock_bh(&ab->base_lock);
1078 		return 0;
1079 	}
1080 
1081 	ret = ath11k_peer_rx_tid_reo_update(ar, peer, peer->rx_tid, 1, 0, false);
1082 	spin_unlock_bh(&ab->base_lock);
1083 	if (ret) {
1084 		ath11k_warn(ab, "failed to update reo for rx tid %d: %d\n",
1085 			    params->tid, ret);
1086 		return ret;
1087 	}
1088 
1089 	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id,
1090 						     params->sta->addr, paddr,
1091 						     params->tid, 1, 1);
1092 	if (ret)
1093 		ath11k_warn(ab, "failed to send wmi to delete rx tid %d\n",
1094 			    ret);
1095 
1096 	return ret;
1097 }
1098 
1099 int ath11k_dp_peer_rx_pn_replay_config(struct ath11k_vif *arvif,
1100 				       const u8 *peer_addr,
1101 				       enum set_key_cmd key_cmd,
1102 				       struct ieee80211_key_conf *key)
1103 {
1104 	struct ath11k *ar = arvif->ar;
1105 	struct ath11k_base *ab = ar->ab;
1106 	struct ath11k_hal_reo_cmd cmd = {0};
1107 	struct ath11k_peer *peer;
1108 	struct dp_rx_tid *rx_tid;
1109 	u8 tid;
1110 	int ret = 0;
1111 
1112 	/* NOTE: Enable PN/TSC replay check offload only for unicast frames.
1113 	 * We use mac80211 PN/TSC replay check functionality for bcast/mcast
1114 	 * for now.
1115 	 */
1116 	if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1117 		return 0;
1118 
1119 	cmd.flag |= HAL_REO_CMD_FLG_NEED_STATUS;
1120 	cmd.upd0 |= HAL_REO_CMD_UPD0_PN |
1121 		    HAL_REO_CMD_UPD0_PN_SIZE |
1122 		    HAL_REO_CMD_UPD0_PN_VALID |
1123 		    HAL_REO_CMD_UPD0_PN_CHECK |
1124 		    HAL_REO_CMD_UPD0_SVLD;
1125 
1126 	switch (key->cipher) {
1127 	case WLAN_CIPHER_SUITE_TKIP:
1128 	case WLAN_CIPHER_SUITE_CCMP:
1129 	case WLAN_CIPHER_SUITE_CCMP_256:
1130 	case WLAN_CIPHER_SUITE_GCMP:
1131 	case WLAN_CIPHER_SUITE_GCMP_256:
1132 		if (key_cmd == SET_KEY) {
1133 			cmd.upd1 |= HAL_REO_CMD_UPD1_PN_CHECK;
1134 			cmd.pn_size = 48;
1135 		}
1136 		break;
1137 	default:
1138 		break;
1139 	}
1140 
1141 	spin_lock_bh(&ab->base_lock);
1142 
1143 	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
1144 	if (!peer) {
1145 		ath11k_warn(ab, "failed to find the peer to configure pn replay detection\n");
1146 		spin_unlock_bh(&ab->base_lock);
1147 		return -ENOENT;
1148 	}
1149 
1150 	for (tid = 0; tid <= IEEE80211_NUM_TIDS; tid++) {
1151 		rx_tid = &peer->rx_tid[tid];
1152 		if (!rx_tid->active)
1153 			continue;
1154 		cmd.addr_lo = lower_32_bits(rx_tid->paddr);
1155 		cmd.addr_hi = upper_32_bits(rx_tid->paddr);
1156 		ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
1157 						HAL_REO_CMD_UPDATE_RX_QUEUE,
1158 						&cmd, NULL);
1159 		if (ret) {
1160 			ath11k_warn(ab, "failed to configure rx tid %d queue for pn replay detection %d\n",
1161 				    tid, ret);
1162 			break;
1163 		}
1164 	}
1165 
1166 	spin_unlock_bh(&ar->ab->base_lock);
1167 
1168 	return ret;
1169 }
1170 
1171 static inline int ath11k_get_ppdu_user_index(struct htt_ppdu_stats *ppdu_stats,
1172 					     u16 peer_id)
1173 {
1174 	int i;
1175 
1176 	for (i = 0; i < HTT_PPDU_STATS_MAX_USERS - 1; i++) {
1177 		if (ppdu_stats->user_stats[i].is_valid_peer_id) {
1178 			if (peer_id == ppdu_stats->user_stats[i].peer_id)
1179 				return i;
1180 		} else {
1181 			return i;
1182 		}
1183 	}
1184 
1185 	return -EINVAL;
1186 }
1187 
1188 static int ath11k_htt_tlv_ppdu_stats_parse(struct ath11k_base *ab,
1189 					   u16 tag, u16 len, const void *ptr,
1190 					   void *data)
1191 {
1192 	struct htt_ppdu_stats_info *ppdu_info;
1193 	struct htt_ppdu_user_stats *user_stats;
1194 	int cur_user;
1195 	u16 peer_id;
1196 
1197 	ppdu_info = (struct htt_ppdu_stats_info *)data;
1198 
1199 	switch (tag) {
1200 	case HTT_PPDU_STATS_TAG_COMMON:
1201 		if (len < sizeof(struct htt_ppdu_stats_common)) {
1202 			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
1203 				    len, tag);
1204 			return -EINVAL;
1205 		}
1206 		memcpy((void *)&ppdu_info->ppdu_stats.common, ptr,
1207 		       sizeof(struct htt_ppdu_stats_common));
1208 		break;
1209 	case HTT_PPDU_STATS_TAG_USR_RATE:
1210 		if (len < sizeof(struct htt_ppdu_stats_user_rate)) {
1211 			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
1212 				    len, tag);
1213 			return -EINVAL;
1214 		}
1215 
1216 		peer_id = ((struct htt_ppdu_stats_user_rate *)ptr)->sw_peer_id;
1217 		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
1218 						      peer_id);
1219 		if (cur_user < 0)
1220 			return -EINVAL;
1221 		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
1222 		user_stats->peer_id = peer_id;
1223 		user_stats->is_valid_peer_id = true;
1224 		memcpy((void *)&user_stats->rate, ptr,
1225 		       sizeof(struct htt_ppdu_stats_user_rate));
1226 		user_stats->tlv_flags |= BIT(tag);
1227 		break;
1228 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON:
1229 		if (len < sizeof(struct htt_ppdu_stats_usr_cmpltn_cmn)) {
1230 			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
1231 				    len, tag);
1232 			return -EINVAL;
1233 		}
1234 
1235 		peer_id = ((struct htt_ppdu_stats_usr_cmpltn_cmn *)ptr)->sw_peer_id;
1236 		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
1237 						      peer_id);
1238 		if (cur_user < 0)
1239 			return -EINVAL;
1240 		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
1241 		user_stats->peer_id = peer_id;
1242 		user_stats->is_valid_peer_id = true;
1243 		memcpy((void *)&user_stats->cmpltn_cmn, ptr,
1244 		       sizeof(struct htt_ppdu_stats_usr_cmpltn_cmn));
1245 		user_stats->tlv_flags |= BIT(tag);
1246 		break;
1247 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_ACK_BA_STATUS:
1248 		if (len <
1249 		    sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status)) {
1250 			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
1251 				    len, tag);
1252 			return -EINVAL;
1253 		}
1254 
1255 		peer_id =
1256 		((struct htt_ppdu_stats_usr_cmpltn_ack_ba_status *)ptr)->sw_peer_id;
1257 		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
1258 						      peer_id);
1259 		if (cur_user < 0)
1260 			return -EINVAL;
1261 		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
1262 		user_stats->peer_id = peer_id;
1263 		user_stats->is_valid_peer_id = true;
1264 		memcpy((void *)&user_stats->ack_ba, ptr,
1265 		       sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status));
1266 		user_stats->tlv_flags |= BIT(tag);
1267 		break;
1268 	}
1269 	return 0;
1270 }
1271 
1272 int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
1273 			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
1274 				       const void *ptr, void *data),
1275 			   void *data)
1276 {
1277 	const struct htt_tlv *tlv;
1278 	const void *begin = ptr;
1279 	u16 tlv_tag, tlv_len;
1280 	int ret = -EINVAL;
1281 
1282 	while (len > 0) {
1283 		if (len < sizeof(*tlv)) {
1284 			ath11k_err(ab, "htt tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
1285 				   ptr - begin, len, sizeof(*tlv));
1286 			return -EINVAL;
1287 		}
1288 		tlv = (struct htt_tlv *)ptr;
1289 		tlv_tag = FIELD_GET(HTT_TLV_TAG, tlv->header);
1290 		tlv_len = FIELD_GET(HTT_TLV_LEN, tlv->header);
1291 		ptr += sizeof(*tlv);
1292 		len -= sizeof(*tlv);
1293 
1294 		if (tlv_len > len) {
1295 			ath11k_err(ab, "htt tlv parse failure of tag %hhu at byte %zd (%zu bytes left, %hhu expected)\n",
1296 				   tlv_tag, ptr - begin, len, tlv_len);
1297 			return -EINVAL;
1298 		}
1299 		ret = iter(ab, tlv_tag, tlv_len, ptr, data);
1300 		if (ret == -ENOMEM)
1301 			return ret;
1302 
1303 		ptr += tlv_len;
1304 		len -= tlv_len;
1305 	}
1306 	return 0;
1307 }
1308 
1309 static inline u32 ath11k_he_gi_to_nl80211_he_gi(u8 sgi)
1310 {
1311 	u32 ret = 0;
1312 
1313 	switch (sgi) {
1314 	case RX_MSDU_START_SGI_0_8_US:
1315 		ret = NL80211_RATE_INFO_HE_GI_0_8;
1316 		break;
1317 	case RX_MSDU_START_SGI_1_6_US:
1318 		ret = NL80211_RATE_INFO_HE_GI_1_6;
1319 		break;
1320 	case RX_MSDU_START_SGI_3_2_US:
1321 		ret = NL80211_RATE_INFO_HE_GI_3_2;
1322 		break;
1323 	}
1324 
1325 	return ret;
1326 }
1327 
1328 static void
1329 ath11k_update_per_peer_tx_stats(struct ath11k *ar,
1330 				struct htt_ppdu_stats *ppdu_stats, u8 user)
1331 {
1332 	struct ath11k_base *ab = ar->ab;
1333 	struct ath11k_peer *peer;
1334 	struct ieee80211_sta *sta;
1335 	struct ath11k_sta *arsta;
1336 	struct htt_ppdu_stats_user_rate *user_rate;
1337 	struct ath11k_per_peer_tx_stats *peer_stats = &ar->peer_tx_stats;
1338 	struct htt_ppdu_user_stats *usr_stats = &ppdu_stats->user_stats[user];
1339 	struct htt_ppdu_stats_common *common = &ppdu_stats->common;
1340 	int ret;
1341 	u8 flags, mcs, nss, bw, sgi, dcm, rate_idx = 0;
1342 	u32 succ_bytes = 0;
1343 	u16 rate = 0, succ_pkts = 0;
1344 	u32 tx_duration = 0;
1345 	u8 tid = HTT_PPDU_STATS_NON_QOS_TID;
1346 	bool is_ampdu = false;
1347 
1348 	if (!usr_stats)
1349 		return;
1350 
1351 	if (!(usr_stats->tlv_flags & BIT(HTT_PPDU_STATS_TAG_USR_RATE)))
1352 		return;
1353 
1354 	if (usr_stats->tlv_flags & BIT(HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON))
1355 		is_ampdu =
1356 			HTT_USR_CMPLTN_IS_AMPDU(usr_stats->cmpltn_cmn.flags);
1357 
1358 	if (usr_stats->tlv_flags &
1359 	    BIT(HTT_PPDU_STATS_TAG_USR_COMPLTN_ACK_BA_STATUS)) {
1360 		succ_bytes = usr_stats->ack_ba.success_bytes;
1361 		succ_pkts = FIELD_GET(HTT_PPDU_STATS_ACK_BA_INFO_NUM_MSDU_M,
1362 				      usr_stats->ack_ba.info);
1363 		tid = FIELD_GET(HTT_PPDU_STATS_ACK_BA_INFO_TID_NUM,
1364 				usr_stats->ack_ba.info);
1365 	}
1366 
1367 	if (common->fes_duration_us)
1368 		tx_duration = common->fes_duration_us;
1369 
1370 	user_rate = &usr_stats->rate;
1371 	flags = HTT_USR_RATE_PREAMBLE(user_rate->rate_flags);
1372 	bw = HTT_USR_RATE_BW(user_rate->rate_flags) - 2;
1373 	nss = HTT_USR_RATE_NSS(user_rate->rate_flags) + 1;
1374 	mcs = HTT_USR_RATE_MCS(user_rate->rate_flags);
1375 	sgi = HTT_USR_RATE_GI(user_rate->rate_flags);
1376 	dcm = HTT_USR_RATE_DCM(user_rate->rate_flags);
1377 
1378 	/* Note: If host configured fixed rates and in some other special
1379 	 * cases, the broadcast/management frames are sent in different rates.
1380 	 * Firmware rate's control to be skipped for this?
1381 	 */
1382 
1383 	if (flags == WMI_RATE_PREAMBLE_HE && mcs > 11) {
1384 		ath11k_warn(ab, "Invalid HE mcs %hhd peer stats",  mcs);
1385 		return;
1386 	}
1387 
1388 	if (flags == WMI_RATE_PREAMBLE_HE && mcs > ATH11K_HE_MCS_MAX) {
1389 		ath11k_warn(ab, "Invalid HE mcs %hhd peer stats",  mcs);
1390 		return;
1391 	}
1392 
1393 	if (flags == WMI_RATE_PREAMBLE_VHT && mcs > ATH11K_VHT_MCS_MAX) {
1394 		ath11k_warn(ab, "Invalid VHT mcs %hhd peer stats",  mcs);
1395 		return;
1396 	}
1397 
1398 	if (flags == WMI_RATE_PREAMBLE_HT && (mcs > ATH11K_HT_MCS_MAX || nss < 1)) {
1399 		ath11k_warn(ab, "Invalid HT mcs %hhd nss %hhd peer stats",
1400 			    mcs, nss);
1401 		return;
1402 	}
1403 
1404 	if (flags == WMI_RATE_PREAMBLE_CCK || flags == WMI_RATE_PREAMBLE_OFDM) {
1405 		ret = ath11k_mac_hw_ratecode_to_legacy_rate(mcs,
1406 							    flags,
1407 							    &rate_idx,
1408 							    &rate);
1409 		if (ret < 0)
1410 			return;
1411 	}
1412 
1413 	rcu_read_lock();
1414 	spin_lock_bh(&ab->base_lock);
1415 	peer = ath11k_peer_find_by_id(ab, usr_stats->peer_id);
1416 
1417 	if (!peer || !peer->sta) {
1418 		spin_unlock_bh(&ab->base_lock);
1419 		rcu_read_unlock();
1420 		return;
1421 	}
1422 
1423 	sta = peer->sta;
1424 	arsta = (struct ath11k_sta *)sta->drv_priv;
1425 
1426 	memset(&arsta->txrate, 0, sizeof(arsta->txrate));
1427 
1428 	switch (flags) {
1429 	case WMI_RATE_PREAMBLE_OFDM:
1430 		arsta->txrate.legacy = rate;
1431 		break;
1432 	case WMI_RATE_PREAMBLE_CCK:
1433 		arsta->txrate.legacy = rate;
1434 		break;
1435 	case WMI_RATE_PREAMBLE_HT:
1436 		arsta->txrate.mcs = mcs + 8 * (nss - 1);
1437 		arsta->txrate.flags = RATE_INFO_FLAGS_MCS;
1438 		if (sgi)
1439 			arsta->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
1440 		break;
1441 	case WMI_RATE_PREAMBLE_VHT:
1442 		arsta->txrate.mcs = mcs;
1443 		arsta->txrate.flags = RATE_INFO_FLAGS_VHT_MCS;
1444 		if (sgi)
1445 			arsta->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
1446 		break;
1447 	case WMI_RATE_PREAMBLE_HE:
1448 		arsta->txrate.mcs = mcs;
1449 		arsta->txrate.flags = RATE_INFO_FLAGS_HE_MCS;
1450 		arsta->txrate.he_dcm = dcm;
1451 		arsta->txrate.he_gi = ath11k_he_gi_to_nl80211_he_gi(sgi);
1452 		arsta->txrate.he_ru_alloc = ath11k_he_ru_tones_to_nl80211_he_ru_alloc(
1453 						(user_rate->ru_end -
1454 						 user_rate->ru_start) + 1);
1455 		break;
1456 	}
1457 
1458 	arsta->txrate.nss = nss;
1459 	arsta->txrate.bw = ath11k_mac_bw_to_mac80211_bw(bw);
1460 	arsta->tx_duration += tx_duration;
1461 	memcpy(&arsta->last_txrate, &arsta->txrate, sizeof(struct rate_info));
1462 
1463 	/* PPDU stats reported for mgmt packet doesn't have valid tx bytes.
1464 	 * So skip peer stats update for mgmt packets.
1465 	 */
1466 	if (tid < HTT_PPDU_STATS_NON_QOS_TID) {
1467 		memset(peer_stats, 0, sizeof(*peer_stats));
1468 		peer_stats->succ_pkts = succ_pkts;
1469 		peer_stats->succ_bytes = succ_bytes;
1470 		peer_stats->is_ampdu = is_ampdu;
1471 		peer_stats->duration = tx_duration;
1472 		peer_stats->ba_fails =
1473 			HTT_USR_CMPLTN_LONG_RETRY(usr_stats->cmpltn_cmn.flags) +
1474 			HTT_USR_CMPLTN_SHORT_RETRY(usr_stats->cmpltn_cmn.flags);
1475 
1476 		if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
1477 			ath11k_debugfs_sta_add_tx_stats(arsta, peer_stats, rate_idx);
1478 	}
1479 
1480 	spin_unlock_bh(&ab->base_lock);
1481 	rcu_read_unlock();
1482 }
1483 
1484 static void ath11k_htt_update_ppdu_stats(struct ath11k *ar,
1485 					 struct htt_ppdu_stats *ppdu_stats)
1486 {
1487 	u8 user;
1488 
1489 	for (user = 0; user < HTT_PPDU_STATS_MAX_USERS - 1; user++)
1490 		ath11k_update_per_peer_tx_stats(ar, ppdu_stats, user);
1491 }
1492 
1493 static
1494 struct htt_ppdu_stats_info *ath11k_dp_htt_get_ppdu_desc(struct ath11k *ar,
1495 							u32 ppdu_id)
1496 {
1497 	struct htt_ppdu_stats_info *ppdu_info;
1498 
1499 	spin_lock_bh(&ar->data_lock);
1500 	if (!list_empty(&ar->ppdu_stats_info)) {
1501 		list_for_each_entry(ppdu_info, &ar->ppdu_stats_info, list) {
1502 			if (ppdu_info->ppdu_id == ppdu_id) {
1503 				spin_unlock_bh(&ar->data_lock);
1504 				return ppdu_info;
1505 			}
1506 		}
1507 
1508 		if (ar->ppdu_stat_list_depth > HTT_PPDU_DESC_MAX_DEPTH) {
1509 			ppdu_info = list_first_entry(&ar->ppdu_stats_info,
1510 						     typeof(*ppdu_info), list);
1511 			list_del(&ppdu_info->list);
1512 			ar->ppdu_stat_list_depth--;
1513 			ath11k_htt_update_ppdu_stats(ar, &ppdu_info->ppdu_stats);
1514 			kfree(ppdu_info);
1515 		}
1516 	}
1517 	spin_unlock_bh(&ar->data_lock);
1518 
1519 	ppdu_info = kzalloc(sizeof(*ppdu_info), GFP_ATOMIC);
1520 	if (!ppdu_info)
1521 		return NULL;
1522 
1523 	spin_lock_bh(&ar->data_lock);
1524 	list_add_tail(&ppdu_info->list, &ar->ppdu_stats_info);
1525 	ar->ppdu_stat_list_depth++;
1526 	spin_unlock_bh(&ar->data_lock);
1527 
1528 	return ppdu_info;
1529 }
1530 
1531 static int ath11k_htt_pull_ppdu_stats(struct ath11k_base *ab,
1532 				      struct sk_buff *skb)
1533 {
1534 	struct ath11k_htt_ppdu_stats_msg *msg;
1535 	struct htt_ppdu_stats_info *ppdu_info;
1536 	struct ath11k *ar;
1537 	int ret;
1538 	u8 pdev_id;
1539 	u32 ppdu_id, len;
1540 
1541 	msg = (struct ath11k_htt_ppdu_stats_msg *)skb->data;
1542 	len = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PAYLOAD_SIZE, msg->info);
1543 	pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PDEV_ID, msg->info);
1544 	ppdu_id = msg->ppdu_id;
1545 
1546 	rcu_read_lock();
1547 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
1548 	if (!ar) {
1549 		ret = -EINVAL;
1550 		goto exit;
1551 	}
1552 
1553 	if (ath11k_debugfs_is_pktlog_lite_mode_enabled(ar))
1554 		trace_ath11k_htt_ppdu_stats(ar, skb->data, len);
1555 
1556 	ppdu_info = ath11k_dp_htt_get_ppdu_desc(ar, ppdu_id);
1557 	if (!ppdu_info) {
1558 		ret = -EINVAL;
1559 		goto exit;
1560 	}
1561 
1562 	ppdu_info->ppdu_id = ppdu_id;
1563 	ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
1564 				     ath11k_htt_tlv_ppdu_stats_parse,
1565 				     (void *)ppdu_info);
1566 	if (ret) {
1567 		ath11k_warn(ab, "Failed to parse tlv %d\n", ret);
1568 		goto exit;
1569 	}
1570 
1571 exit:
1572 	rcu_read_unlock();
1573 
1574 	return ret;
1575 }
1576 
1577 static void ath11k_htt_pktlog(struct ath11k_base *ab, struct sk_buff *skb)
1578 {
1579 	struct htt_pktlog_msg *data = (struct htt_pktlog_msg *)skb->data;
1580 	struct ath_pktlog_hdr *hdr = (struct ath_pktlog_hdr *)data;
1581 	struct ath11k *ar;
1582 	u8 pdev_id;
1583 
1584 	pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PDEV_ID, data->hdr);
1585 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
1586 	if (!ar) {
1587 		ath11k_warn(ab, "invalid pdev id %d on htt pktlog\n", pdev_id);
1588 		return;
1589 	}
1590 
1591 	trace_ath11k_htt_pktlog(ar, data->payload, hdr->size,
1592 				ar->ab->pktlog_defs_checksum);
1593 }
1594 
1595 static void ath11k_htt_backpressure_event_handler(struct ath11k_base *ab,
1596 						  struct sk_buff *skb)
1597 {
1598 	u32 *data = (u32 *)skb->data;
1599 	u8 pdev_id, ring_type, ring_id, pdev_idx;
1600 	u16 hp, tp;
1601 	u32 backpressure_time;
1602 	struct ath11k_bp_stats *bp_stats;
1603 
1604 	pdev_id = FIELD_GET(HTT_BACKPRESSURE_EVENT_PDEV_ID_M, *data);
1605 	ring_type = FIELD_GET(HTT_BACKPRESSURE_EVENT_RING_TYPE_M, *data);
1606 	ring_id = FIELD_GET(HTT_BACKPRESSURE_EVENT_RING_ID_M, *data);
1607 	++data;
1608 
1609 	hp = FIELD_GET(HTT_BACKPRESSURE_EVENT_HP_M, *data);
1610 	tp = FIELD_GET(HTT_BACKPRESSURE_EVENT_TP_M, *data);
1611 	++data;
1612 
1613 	backpressure_time = *data;
1614 
1615 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "htt backpressure event, pdev %d, ring type %d,ring id %d, hp %d tp %d, backpressure time %d\n",
1616 		   pdev_id, ring_type, ring_id, hp, tp, backpressure_time);
1617 
1618 	if (ring_type == HTT_BACKPRESSURE_UMAC_RING_TYPE) {
1619 		if (ring_id >= HTT_SW_UMAC_RING_IDX_MAX)
1620 			return;
1621 
1622 		bp_stats = &ab->soc_stats.bp_stats.umac_ring_bp_stats[ring_id];
1623 	} else if (ring_type == HTT_BACKPRESSURE_LMAC_RING_TYPE) {
1624 		pdev_idx = DP_HW2SW_MACID(pdev_id);
1625 
1626 		if (ring_id >= HTT_SW_LMAC_RING_IDX_MAX || pdev_idx >= MAX_RADIOS)
1627 			return;
1628 
1629 		bp_stats = &ab->soc_stats.bp_stats.lmac_ring_bp_stats[ring_id][pdev_idx];
1630 	} else {
1631 		ath11k_warn(ab, "unknown ring type received in htt bp event %d\n",
1632 			    ring_type);
1633 		return;
1634 	}
1635 
1636 	spin_lock_bh(&ab->base_lock);
1637 	bp_stats->hp = hp;
1638 	bp_stats->tp = tp;
1639 	bp_stats->count++;
1640 	bp_stats->jiffies = jiffies;
1641 	spin_unlock_bh(&ab->base_lock);
1642 }
1643 
1644 void ath11k_dp_htt_htc_t2h_msg_handler(struct ath11k_base *ab,
1645 				       struct sk_buff *skb)
1646 {
1647 	struct ath11k_dp *dp = &ab->dp;
1648 	struct htt_resp_msg *resp = (struct htt_resp_msg *)skb->data;
1649 	enum htt_t2h_msg_type type = FIELD_GET(HTT_T2H_MSG_TYPE, *(u32 *)resp);
1650 	u16 peer_id;
1651 	u8 vdev_id;
1652 	u8 mac_addr[ETH_ALEN];
1653 	u16 peer_mac_h16;
1654 	u16 ast_hash;
1655 
1656 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "dp_htt rx msg type :0x%0x\n", type);
1657 
1658 	switch (type) {
1659 	case HTT_T2H_MSG_TYPE_VERSION_CONF:
1660 		dp->htt_tgt_ver_major = FIELD_GET(HTT_T2H_VERSION_CONF_MAJOR,
1661 						  resp->version_msg.version);
1662 		dp->htt_tgt_ver_minor = FIELD_GET(HTT_T2H_VERSION_CONF_MINOR,
1663 						  resp->version_msg.version);
1664 		complete(&dp->htt_tgt_version_received);
1665 		break;
1666 	case HTT_T2H_MSG_TYPE_PEER_MAP:
1667 		vdev_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO_VDEV_ID,
1668 				    resp->peer_map_ev.info);
1669 		peer_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO_PEER_ID,
1670 				    resp->peer_map_ev.info);
1671 		peer_mac_h16 = FIELD_GET(HTT_T2H_PEER_MAP_INFO1_MAC_ADDR_H16,
1672 					 resp->peer_map_ev.info1);
1673 		ath11k_dp_get_mac_addr(resp->peer_map_ev.mac_addr_l32,
1674 				       peer_mac_h16, mac_addr);
1675 		ath11k_peer_map_event(ab, vdev_id, peer_id, mac_addr, 0);
1676 		break;
1677 	case HTT_T2H_MSG_TYPE_PEER_MAP2:
1678 		vdev_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO_VDEV_ID,
1679 				    resp->peer_map_ev.info);
1680 		peer_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO_PEER_ID,
1681 				    resp->peer_map_ev.info);
1682 		peer_mac_h16 = FIELD_GET(HTT_T2H_PEER_MAP_INFO1_MAC_ADDR_H16,
1683 					 resp->peer_map_ev.info1);
1684 		ath11k_dp_get_mac_addr(resp->peer_map_ev.mac_addr_l32,
1685 				       peer_mac_h16, mac_addr);
1686 		ast_hash = FIELD_GET(HTT_T2H_PEER_MAP_INFO2_AST_HASH_VAL,
1687 				     resp->peer_map_ev.info2);
1688 		ath11k_peer_map_event(ab, vdev_id, peer_id, mac_addr, ast_hash);
1689 		break;
1690 	case HTT_T2H_MSG_TYPE_PEER_UNMAP:
1691 	case HTT_T2H_MSG_TYPE_PEER_UNMAP2:
1692 		peer_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_PEER_ID,
1693 				    resp->peer_unmap_ev.info);
1694 		ath11k_peer_unmap_event(ab, peer_id);
1695 		break;
1696 	case HTT_T2H_MSG_TYPE_PPDU_STATS_IND:
1697 		ath11k_htt_pull_ppdu_stats(ab, skb);
1698 		break;
1699 	case HTT_T2H_MSG_TYPE_EXT_STATS_CONF:
1700 		ath11k_debugfs_htt_ext_stats_handler(ab, skb);
1701 		break;
1702 	case HTT_T2H_MSG_TYPE_PKTLOG:
1703 		ath11k_htt_pktlog(ab, skb);
1704 		break;
1705 	case HTT_T2H_MSG_TYPE_BKPRESSURE_EVENT_IND:
1706 		ath11k_htt_backpressure_event_handler(ab, skb);
1707 		break;
1708 	default:
1709 		ath11k_warn(ab, "htt event %d not handled\n", type);
1710 		break;
1711 	}
1712 
1713 	dev_kfree_skb_any(skb);
1714 }
1715 
1716 static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar,
1717 				      struct sk_buff_head *msdu_list,
1718 				      struct sk_buff *first, struct sk_buff *last,
1719 				      u8 l3pad_bytes, int msdu_len)
1720 {
1721 	struct sk_buff *skb;
1722 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(first);
1723 	int buf_first_hdr_len, buf_first_len;
1724 	struct hal_rx_desc *ldesc;
1725 	int space_extra;
1726 	int rem_len;
1727 	int buf_len;
1728 
1729 	/* As the msdu is spread across multiple rx buffers,
1730 	 * find the offset to the start of msdu for computing
1731 	 * the length of the msdu in the first buffer.
1732 	 */
1733 	buf_first_hdr_len = HAL_RX_DESC_SIZE + l3pad_bytes;
1734 	buf_first_len = DP_RX_BUFFER_SIZE - buf_first_hdr_len;
1735 
1736 	if (WARN_ON_ONCE(msdu_len <= buf_first_len)) {
1737 		skb_put(first, buf_first_hdr_len + msdu_len);
1738 		skb_pull(first, buf_first_hdr_len);
1739 		return 0;
1740 	}
1741 
1742 	ldesc = (struct hal_rx_desc *)last->data;
1743 	rxcb->is_first_msdu = ath11k_dp_rx_h_msdu_end_first_msdu(ldesc);
1744 	rxcb->is_last_msdu = ath11k_dp_rx_h_msdu_end_last_msdu(ldesc);
1745 
1746 	/* MSDU spans over multiple buffers because the length of the MSDU
1747 	 * exceeds DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE. So assume the data
1748 	 * in the first buf is of length DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE.
1749 	 */
1750 	skb_put(first, DP_RX_BUFFER_SIZE);
1751 	skb_pull(first, buf_first_hdr_len);
1752 
1753 	/* When an MSDU spread over multiple buffers attention, MSDU_END and
1754 	 * MPDU_END tlvs are valid only in the last buffer. Copy those tlvs.
1755 	 */
1756 	ath11k_dp_rx_desc_end_tlv_copy(rxcb->rx_desc, ldesc);
1757 
1758 	space_extra = msdu_len - (buf_first_len + skb_tailroom(first));
1759 	if (space_extra > 0 &&
1760 	    (pskb_expand_head(first, 0, space_extra, GFP_ATOMIC) < 0)) {
1761 		/* Free up all buffers of the MSDU */
1762 		while ((skb = __skb_dequeue(msdu_list)) != NULL) {
1763 			rxcb = ATH11K_SKB_RXCB(skb);
1764 			if (!rxcb->is_continuation) {
1765 				dev_kfree_skb_any(skb);
1766 				break;
1767 			}
1768 			dev_kfree_skb_any(skb);
1769 		}
1770 		return -ENOMEM;
1771 	}
1772 
1773 	rem_len = msdu_len - buf_first_len;
1774 	while ((skb = __skb_dequeue(msdu_list)) != NULL && rem_len > 0) {
1775 		rxcb = ATH11K_SKB_RXCB(skb);
1776 		if (rxcb->is_continuation)
1777 			buf_len = DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE;
1778 		else
1779 			buf_len = rem_len;
1780 
1781 		if (buf_len > (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE)) {
1782 			WARN_ON_ONCE(1);
1783 			dev_kfree_skb_any(skb);
1784 			return -EINVAL;
1785 		}
1786 
1787 		skb_put(skb, buf_len + HAL_RX_DESC_SIZE);
1788 		skb_pull(skb, HAL_RX_DESC_SIZE);
1789 		skb_copy_from_linear_data(skb, skb_put(first, buf_len),
1790 					  buf_len);
1791 		dev_kfree_skb_any(skb);
1792 
1793 		rem_len -= buf_len;
1794 		if (!rxcb->is_continuation)
1795 			break;
1796 	}
1797 
1798 	return 0;
1799 }
1800 
1801 static struct sk_buff *ath11k_dp_rx_get_msdu_last_buf(struct sk_buff_head *msdu_list,
1802 						      struct sk_buff *first)
1803 {
1804 	struct sk_buff *skb;
1805 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(first);
1806 
1807 	if (!rxcb->is_continuation)
1808 		return first;
1809 
1810 	skb_queue_walk(msdu_list, skb) {
1811 		rxcb = ATH11K_SKB_RXCB(skb);
1812 		if (!rxcb->is_continuation)
1813 			return skb;
1814 	}
1815 
1816 	return NULL;
1817 }
1818 
1819 static void ath11k_dp_rx_h_csum_offload(struct sk_buff *msdu)
1820 {
1821 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
1822 	bool ip_csum_fail, l4_csum_fail;
1823 
1824 	ip_csum_fail = ath11k_dp_rx_h_attn_ip_cksum_fail(rxcb->rx_desc);
1825 	l4_csum_fail = ath11k_dp_rx_h_attn_l4_cksum_fail(rxcb->rx_desc);
1826 
1827 	msdu->ip_summed = (ip_csum_fail || l4_csum_fail) ?
1828 			  CHECKSUM_NONE : CHECKSUM_UNNECESSARY;
1829 }
1830 
1831 static int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
1832 				       enum hal_encrypt_type enctype)
1833 {
1834 	switch (enctype) {
1835 	case HAL_ENCRYPT_TYPE_OPEN:
1836 	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
1837 	case HAL_ENCRYPT_TYPE_TKIP_MIC:
1838 		return 0;
1839 	case HAL_ENCRYPT_TYPE_CCMP_128:
1840 		return IEEE80211_CCMP_MIC_LEN;
1841 	case HAL_ENCRYPT_TYPE_CCMP_256:
1842 		return IEEE80211_CCMP_256_MIC_LEN;
1843 	case HAL_ENCRYPT_TYPE_GCMP_128:
1844 	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
1845 		return IEEE80211_GCMP_MIC_LEN;
1846 	case HAL_ENCRYPT_TYPE_WEP_40:
1847 	case HAL_ENCRYPT_TYPE_WEP_104:
1848 	case HAL_ENCRYPT_TYPE_WEP_128:
1849 	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
1850 	case HAL_ENCRYPT_TYPE_WAPI:
1851 		break;
1852 	}
1853 
1854 	ath11k_warn(ar->ab, "unsupported encryption type %d for mic len\n", enctype);
1855 	return 0;
1856 }
1857 
1858 static int ath11k_dp_rx_crypto_param_len(struct ath11k *ar,
1859 					 enum hal_encrypt_type enctype)
1860 {
1861 	switch (enctype) {
1862 	case HAL_ENCRYPT_TYPE_OPEN:
1863 		return 0;
1864 	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
1865 	case HAL_ENCRYPT_TYPE_TKIP_MIC:
1866 		return IEEE80211_TKIP_IV_LEN;
1867 	case HAL_ENCRYPT_TYPE_CCMP_128:
1868 		return IEEE80211_CCMP_HDR_LEN;
1869 	case HAL_ENCRYPT_TYPE_CCMP_256:
1870 		return IEEE80211_CCMP_256_HDR_LEN;
1871 	case HAL_ENCRYPT_TYPE_GCMP_128:
1872 	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
1873 		return IEEE80211_GCMP_HDR_LEN;
1874 	case HAL_ENCRYPT_TYPE_WEP_40:
1875 	case HAL_ENCRYPT_TYPE_WEP_104:
1876 	case HAL_ENCRYPT_TYPE_WEP_128:
1877 	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
1878 	case HAL_ENCRYPT_TYPE_WAPI:
1879 		break;
1880 	}
1881 
1882 	ath11k_warn(ar->ab, "unsupported encryption type %d\n", enctype);
1883 	return 0;
1884 }
1885 
1886 static int ath11k_dp_rx_crypto_icv_len(struct ath11k *ar,
1887 				       enum hal_encrypt_type enctype)
1888 {
1889 	switch (enctype) {
1890 	case HAL_ENCRYPT_TYPE_OPEN:
1891 	case HAL_ENCRYPT_TYPE_CCMP_128:
1892 	case HAL_ENCRYPT_TYPE_CCMP_256:
1893 	case HAL_ENCRYPT_TYPE_GCMP_128:
1894 	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
1895 		return 0;
1896 	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
1897 	case HAL_ENCRYPT_TYPE_TKIP_MIC:
1898 		return IEEE80211_TKIP_ICV_LEN;
1899 	case HAL_ENCRYPT_TYPE_WEP_40:
1900 	case HAL_ENCRYPT_TYPE_WEP_104:
1901 	case HAL_ENCRYPT_TYPE_WEP_128:
1902 	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
1903 	case HAL_ENCRYPT_TYPE_WAPI:
1904 		break;
1905 	}
1906 
1907 	ath11k_warn(ar->ab, "unsupported encryption type %d\n", enctype);
1908 	return 0;
1909 }
1910 
1911 static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
1912 					 struct sk_buff *msdu,
1913 					 u8 *first_hdr,
1914 					 enum hal_encrypt_type enctype,
1915 					 struct ieee80211_rx_status *status)
1916 {
1917 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
1918 	u8 decap_hdr[DP_MAX_NWIFI_HDR_LEN];
1919 	struct ieee80211_hdr *hdr;
1920 	size_t hdr_len;
1921 	u8 da[ETH_ALEN];
1922 	u8 sa[ETH_ALEN];
1923 	u16 qos_ctl = 0;
1924 	u8 *qos;
1925 
1926 	/* copy SA & DA and pull decapped header */
1927 	hdr = (struct ieee80211_hdr *)msdu->data;
1928 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
1929 	ether_addr_copy(da, ieee80211_get_DA(hdr));
1930 	ether_addr_copy(sa, ieee80211_get_SA(hdr));
1931 	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
1932 
1933 	if (rxcb->is_first_msdu) {
1934 		/* original 802.11 header is valid for the first msdu
1935 		 * hence we can reuse the same header
1936 		 */
1937 		hdr = (struct ieee80211_hdr *)first_hdr;
1938 		hdr_len = ieee80211_hdrlen(hdr->frame_control);
1939 
1940 		/* Each A-MSDU subframe will be reported as a separate MSDU,
1941 		 * so strip the A-MSDU bit from QoS Ctl.
1942 		 */
1943 		if (ieee80211_is_data_qos(hdr->frame_control)) {
1944 			qos = ieee80211_get_qos_ctl(hdr);
1945 			qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
1946 		}
1947 	} else {
1948 		/*  Rebuild qos header if this is a middle/last msdu */
1949 		hdr->frame_control |= __cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1950 
1951 		/* Reset the order bit as the HT_Control header is stripped */
1952 		hdr->frame_control &= ~(__cpu_to_le16(IEEE80211_FCTL_ORDER));
1953 
1954 		qos_ctl = rxcb->tid;
1955 
1956 		if (ath11k_dp_rx_h_msdu_start_mesh_ctl_present(rxcb->rx_desc))
1957 			qos_ctl |= IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT;
1958 
1959 		/* TODO Add other QoS ctl fields when required */
1960 
1961 		/* copy decap header before overwriting for reuse below */
1962 		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
1963 	}
1964 
1965 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
1966 		memcpy(skb_push(msdu,
1967 				ath11k_dp_rx_crypto_param_len(ar, enctype)),
1968 		       (void *)hdr + hdr_len,
1969 		       ath11k_dp_rx_crypto_param_len(ar, enctype));
1970 	}
1971 
1972 	if (!rxcb->is_first_msdu) {
1973 		memcpy(skb_push(msdu,
1974 				IEEE80211_QOS_CTL_LEN), &qos_ctl,
1975 				IEEE80211_QOS_CTL_LEN);
1976 		memcpy(skb_push(msdu, hdr_len), decap_hdr, hdr_len);
1977 		return;
1978 	}
1979 
1980 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
1981 
1982 	/* original 802.11 header has a different DA and in
1983 	 * case of 4addr it may also have different SA
1984 	 */
1985 	hdr = (struct ieee80211_hdr *)msdu->data;
1986 	ether_addr_copy(ieee80211_get_DA(hdr), da);
1987 	ether_addr_copy(ieee80211_get_SA(hdr), sa);
1988 }
1989 
1990 static void ath11k_dp_rx_h_undecap_raw(struct ath11k *ar, struct sk_buff *msdu,
1991 				       enum hal_encrypt_type enctype,
1992 				       struct ieee80211_rx_status *status,
1993 				       bool decrypted)
1994 {
1995 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
1996 	struct ieee80211_hdr *hdr;
1997 	size_t hdr_len;
1998 	size_t crypto_len;
1999 
2000 	if (!rxcb->is_first_msdu ||
2001 	    !(rxcb->is_first_msdu && rxcb->is_last_msdu)) {
2002 		WARN_ON_ONCE(1);
2003 		return;
2004 	}
2005 
2006 	skb_trim(msdu, msdu->len - FCS_LEN);
2007 
2008 	if (!decrypted)
2009 		return;
2010 
2011 	hdr = (void *)msdu->data;
2012 
2013 	/* Tail */
2014 	if (status->flag & RX_FLAG_IV_STRIPPED) {
2015 		skb_trim(msdu, msdu->len -
2016 			 ath11k_dp_rx_crypto_mic_len(ar, enctype));
2017 
2018 		skb_trim(msdu, msdu->len -
2019 			 ath11k_dp_rx_crypto_icv_len(ar, enctype));
2020 	} else {
2021 		/* MIC */
2022 		if (status->flag & RX_FLAG_MIC_STRIPPED)
2023 			skb_trim(msdu, msdu->len -
2024 				 ath11k_dp_rx_crypto_mic_len(ar, enctype));
2025 
2026 		/* ICV */
2027 		if (status->flag & RX_FLAG_ICV_STRIPPED)
2028 			skb_trim(msdu, msdu->len -
2029 				 ath11k_dp_rx_crypto_icv_len(ar, enctype));
2030 	}
2031 
2032 	/* MMIC */
2033 	if ((status->flag & RX_FLAG_MMIC_STRIPPED) &&
2034 	    !ieee80211_has_morefrags(hdr->frame_control) &&
2035 	    enctype == HAL_ENCRYPT_TYPE_TKIP_MIC)
2036 		skb_trim(msdu, msdu->len - IEEE80211_CCMP_MIC_LEN);
2037 
2038 	/* Head */
2039 	if (status->flag & RX_FLAG_IV_STRIPPED) {
2040 		hdr_len = ieee80211_hdrlen(hdr->frame_control);
2041 		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
2042 
2043 		memmove((void *)msdu->data + crypto_len,
2044 			(void *)msdu->data, hdr_len);
2045 		skb_pull(msdu, crypto_len);
2046 	}
2047 }
2048 
2049 static void *ath11k_dp_rx_h_find_rfc1042(struct ath11k *ar,
2050 					 struct sk_buff *msdu,
2051 					 enum hal_encrypt_type enctype)
2052 {
2053 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
2054 	struct ieee80211_hdr *hdr;
2055 	size_t hdr_len, crypto_len;
2056 	void *rfc1042;
2057 	bool is_amsdu;
2058 
2059 	is_amsdu = !(rxcb->is_first_msdu && rxcb->is_last_msdu);
2060 	hdr = (struct ieee80211_hdr *)ath11k_dp_rx_h_80211_hdr(rxcb->rx_desc);
2061 	rfc1042 = hdr;
2062 
2063 	if (rxcb->is_first_msdu) {
2064 		hdr_len = ieee80211_hdrlen(hdr->frame_control);
2065 		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
2066 
2067 		rfc1042 += hdr_len + crypto_len;
2068 	}
2069 
2070 	if (is_amsdu)
2071 		rfc1042 += sizeof(struct ath11k_dp_amsdu_subframe_hdr);
2072 
2073 	return rfc1042;
2074 }
2075 
2076 static void ath11k_dp_rx_h_undecap_eth(struct ath11k *ar,
2077 				       struct sk_buff *msdu,
2078 				       u8 *first_hdr,
2079 				       enum hal_encrypt_type enctype,
2080 				       struct ieee80211_rx_status *status)
2081 {
2082 	struct ieee80211_hdr *hdr;
2083 	struct ethhdr *eth;
2084 	size_t hdr_len;
2085 	u8 da[ETH_ALEN];
2086 	u8 sa[ETH_ALEN];
2087 	void *rfc1042;
2088 
2089 	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
2090 	if (WARN_ON_ONCE(!rfc1042))
2091 		return;
2092 
2093 	/* pull decapped header and copy SA & DA */
2094 	eth = (struct ethhdr *)msdu->data;
2095 	ether_addr_copy(da, eth->h_dest);
2096 	ether_addr_copy(sa, eth->h_source);
2097 	skb_pull(msdu, sizeof(struct ethhdr));
2098 
2099 	/* push rfc1042/llc/snap */
2100 	memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), rfc1042,
2101 	       sizeof(struct ath11k_dp_rfc1042_hdr));
2102 
2103 	/* push original 802.11 header */
2104 	hdr = (struct ieee80211_hdr *)first_hdr;
2105 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
2106 
2107 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
2108 		memcpy(skb_push(msdu,
2109 				ath11k_dp_rx_crypto_param_len(ar, enctype)),
2110 		       (void *)hdr + hdr_len,
2111 		       ath11k_dp_rx_crypto_param_len(ar, enctype));
2112 	}
2113 
2114 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
2115 
2116 	/* original 802.11 header has a different DA and in
2117 	 * case of 4addr it may also have different SA
2118 	 */
2119 	hdr = (struct ieee80211_hdr *)msdu->data;
2120 	ether_addr_copy(ieee80211_get_DA(hdr), da);
2121 	ether_addr_copy(ieee80211_get_SA(hdr), sa);
2122 }
2123 
2124 static void ath11k_dp_rx_h_undecap(struct ath11k *ar, struct sk_buff *msdu,
2125 				   struct hal_rx_desc *rx_desc,
2126 				   enum hal_encrypt_type enctype,
2127 				   struct ieee80211_rx_status *status,
2128 				   bool decrypted)
2129 {
2130 	u8 *first_hdr;
2131 	u8 decap;
2132 
2133 	first_hdr = ath11k_dp_rx_h_80211_hdr(rx_desc);
2134 	decap = ath11k_dp_rx_h_msdu_start_decap_type(rx_desc);
2135 
2136 	switch (decap) {
2137 	case DP_RX_DECAP_TYPE_NATIVE_WIFI:
2138 		ath11k_dp_rx_h_undecap_nwifi(ar, msdu, first_hdr,
2139 					     enctype, status);
2140 		break;
2141 	case DP_RX_DECAP_TYPE_RAW:
2142 		ath11k_dp_rx_h_undecap_raw(ar, msdu, enctype, status,
2143 					   decrypted);
2144 		break;
2145 	case DP_RX_DECAP_TYPE_ETHERNET2_DIX:
2146 		/* TODO undecap support for middle/last msdu's of amsdu */
2147 		ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
2148 					   enctype, status);
2149 		break;
2150 	case DP_RX_DECAP_TYPE_8023:
2151 		/* TODO: Handle undecap for these formats */
2152 		break;
2153 	}
2154 }
2155 
2156 static void ath11k_dp_rx_h_mpdu(struct ath11k *ar,
2157 				struct sk_buff *msdu,
2158 				struct hal_rx_desc *rx_desc,
2159 				struct ieee80211_rx_status *rx_status)
2160 {
2161 	bool  fill_crypto_hdr, mcast;
2162 	enum hal_encrypt_type enctype;
2163 	bool is_decrypted = false;
2164 	struct ieee80211_hdr *hdr;
2165 	struct ath11k_peer *peer;
2166 	u32 err_bitmap;
2167 
2168 	hdr = (struct ieee80211_hdr *)msdu->data;
2169 
2170 	/* PN for multicast packets will be checked in mac80211 */
2171 
2172 	mcast = is_multicast_ether_addr(hdr->addr1);
2173 	fill_crypto_hdr = mcast;
2174 
2175 	spin_lock_bh(&ar->ab->base_lock);
2176 	peer = ath11k_peer_find_by_addr(ar->ab, hdr->addr2);
2177 	if (peer) {
2178 		if (mcast)
2179 			enctype = peer->sec_type_grp;
2180 		else
2181 			enctype = peer->sec_type;
2182 	} else {
2183 		enctype = HAL_ENCRYPT_TYPE_OPEN;
2184 	}
2185 	spin_unlock_bh(&ar->ab->base_lock);
2186 
2187 	err_bitmap = ath11k_dp_rx_h_attn_mpdu_err(rx_desc);
2188 	if (enctype != HAL_ENCRYPT_TYPE_OPEN && !err_bitmap)
2189 		is_decrypted = ath11k_dp_rx_h_attn_is_decrypted(rx_desc);
2190 
2191 	/* Clear per-MPDU flags while leaving per-PPDU flags intact */
2192 	rx_status->flag &= ~(RX_FLAG_FAILED_FCS_CRC |
2193 			     RX_FLAG_MMIC_ERROR |
2194 			     RX_FLAG_DECRYPTED |
2195 			     RX_FLAG_IV_STRIPPED |
2196 			     RX_FLAG_MMIC_STRIPPED);
2197 
2198 	if (err_bitmap & DP_RX_MPDU_ERR_FCS)
2199 		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
2200 	if (err_bitmap & DP_RX_MPDU_ERR_TKIP_MIC)
2201 		rx_status->flag |= RX_FLAG_MMIC_ERROR;
2202 
2203 	if (is_decrypted) {
2204 		rx_status->flag |= RX_FLAG_DECRYPTED | RX_FLAG_MMIC_STRIPPED;
2205 
2206 		if (fill_crypto_hdr)
2207 			rx_status->flag |= RX_FLAG_MIC_STRIPPED |
2208 					RX_FLAG_ICV_STRIPPED;
2209 		else
2210 			rx_status->flag |= RX_FLAG_IV_STRIPPED |
2211 					   RX_FLAG_PN_VALIDATED;
2212 	}
2213 
2214 	ath11k_dp_rx_h_csum_offload(msdu);
2215 	ath11k_dp_rx_h_undecap(ar, msdu, rx_desc,
2216 			       enctype, rx_status, is_decrypted);
2217 
2218 	if (!is_decrypted || fill_crypto_hdr)
2219 		return;
2220 
2221 	hdr = (void *)msdu->data;
2222 	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2223 }
2224 
2225 static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,
2226 				struct ieee80211_rx_status *rx_status)
2227 {
2228 	struct ieee80211_supported_band *sband;
2229 	enum rx_msdu_start_pkt_type pkt_type;
2230 	u8 bw;
2231 	u8 rate_mcs, nss;
2232 	u8 sgi;
2233 	bool is_cck;
2234 
2235 	pkt_type = ath11k_dp_rx_h_msdu_start_pkt_type(rx_desc);
2236 	bw = ath11k_dp_rx_h_msdu_start_rx_bw(rx_desc);
2237 	rate_mcs = ath11k_dp_rx_h_msdu_start_rate_mcs(rx_desc);
2238 	nss = ath11k_dp_rx_h_msdu_start_nss(rx_desc);
2239 	sgi = ath11k_dp_rx_h_msdu_start_sgi(rx_desc);
2240 
2241 	switch (pkt_type) {
2242 	case RX_MSDU_START_PKT_TYPE_11A:
2243 	case RX_MSDU_START_PKT_TYPE_11B:
2244 		is_cck = (pkt_type == RX_MSDU_START_PKT_TYPE_11B);
2245 		sband = &ar->mac.sbands[rx_status->band];
2246 		rx_status->rate_idx = ath11k_mac_hw_rate_to_idx(sband, rate_mcs,
2247 								is_cck);
2248 		break;
2249 	case RX_MSDU_START_PKT_TYPE_11N:
2250 		rx_status->encoding = RX_ENC_HT;
2251 		if (rate_mcs > ATH11K_HT_MCS_MAX) {
2252 			ath11k_warn(ar->ab,
2253 				    "Received with invalid mcs in HT mode %d\n",
2254 				     rate_mcs);
2255 			break;
2256 		}
2257 		rx_status->rate_idx = rate_mcs + (8 * (nss - 1));
2258 		if (sgi)
2259 			rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
2260 		rx_status->bw = ath11k_mac_bw_to_mac80211_bw(bw);
2261 		break;
2262 	case RX_MSDU_START_PKT_TYPE_11AC:
2263 		rx_status->encoding = RX_ENC_VHT;
2264 		rx_status->rate_idx = rate_mcs;
2265 		if (rate_mcs > ATH11K_VHT_MCS_MAX) {
2266 			ath11k_warn(ar->ab,
2267 				    "Received with invalid mcs in VHT mode %d\n",
2268 				     rate_mcs);
2269 			break;
2270 		}
2271 		rx_status->nss = nss;
2272 		if (sgi)
2273 			rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
2274 		rx_status->bw = ath11k_mac_bw_to_mac80211_bw(bw);
2275 		break;
2276 	case RX_MSDU_START_PKT_TYPE_11AX:
2277 		rx_status->rate_idx = rate_mcs;
2278 		if (rate_mcs > ATH11K_HE_MCS_MAX) {
2279 			ath11k_warn(ar->ab,
2280 				    "Received with invalid mcs in HE mode %d\n",
2281 				    rate_mcs);
2282 			break;
2283 		}
2284 		rx_status->encoding = RX_ENC_HE;
2285 		rx_status->nss = nss;
2286 		rx_status->he_gi = ath11k_he_gi_to_nl80211_he_gi(sgi);
2287 		rx_status->bw = ath11k_mac_bw_to_mac80211_bw(bw);
2288 		break;
2289 	}
2290 }
2291 
2292 static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc,
2293 				struct ieee80211_rx_status *rx_status)
2294 {
2295 	u8 channel_num;
2296 	u32 center_freq;
2297 	struct ieee80211_channel *channel;
2298 
2299 	rx_status->freq = 0;
2300 	rx_status->rate_idx = 0;
2301 	rx_status->nss = 0;
2302 	rx_status->encoding = RX_ENC_LEGACY;
2303 	rx_status->bw = RATE_INFO_BW_20;
2304 
2305 	rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
2306 
2307 	channel_num = ath11k_dp_rx_h_msdu_start_freq(rx_desc);
2308 	center_freq = ath11k_dp_rx_h_msdu_start_freq(rx_desc) >> 16;
2309 
2310 	if (center_freq >= 5935 && center_freq <= 7105) {
2311 		rx_status->band = NL80211_BAND_6GHZ;
2312 	} else if (channel_num >= 1 && channel_num <= 14) {
2313 		rx_status->band = NL80211_BAND_2GHZ;
2314 	} else if (channel_num >= 36 && channel_num <= 173) {
2315 		rx_status->band = NL80211_BAND_5GHZ;
2316 	} else {
2317 		spin_lock_bh(&ar->data_lock);
2318 		channel = ar->rx_channel;
2319 		if (channel) {
2320 			rx_status->band = channel->band;
2321 			channel_num =
2322 				ieee80211_frequency_to_channel(channel->center_freq);
2323 		}
2324 		spin_unlock_bh(&ar->data_lock);
2325 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "rx_desc: ",
2326 				rx_desc, sizeof(struct hal_rx_desc));
2327 	}
2328 
2329 	rx_status->freq = ieee80211_channel_to_frequency(channel_num,
2330 							 rx_status->band);
2331 
2332 	ath11k_dp_rx_h_rate(ar, rx_desc, rx_status);
2333 }
2334 
2335 static char *ath11k_print_get_tid(struct ieee80211_hdr *hdr, char *out,
2336 				  size_t size)
2337 {
2338 	u8 *qc;
2339 	int tid;
2340 
2341 	if (!ieee80211_is_data_qos(hdr->frame_control))
2342 		return "";
2343 
2344 	qc = ieee80211_get_qos_ctl(hdr);
2345 	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
2346 	snprintf(out, size, "tid %d", tid);
2347 
2348 	return out;
2349 }
2350 
2351 static void ath11k_dp_rx_deliver_msdu(struct ath11k *ar, struct napi_struct *napi,
2352 				      struct sk_buff *msdu)
2353 {
2354 	static const struct ieee80211_radiotap_he known = {
2355 		.data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
2356 				     IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN),
2357 		.data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN),
2358 	};
2359 	struct ieee80211_rx_status *status;
2360 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
2361 	struct ieee80211_radiotap_he *he = NULL;
2362 	char tid[32];
2363 
2364 	status = IEEE80211_SKB_RXCB(msdu);
2365 	if (status->encoding == RX_ENC_HE) {
2366 		he = skb_push(msdu, sizeof(known));
2367 		memcpy(he, &known, sizeof(known));
2368 		status->flag |= RX_FLAG_RADIOTAP_HE;
2369 	}
2370 
2371 	ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
2372 		   "rx skb %pK len %u peer %pM %s %s sn %u %s%s%s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n",
2373 		   msdu,
2374 		   msdu->len,
2375 		   ieee80211_get_SA(hdr),
2376 		   ath11k_print_get_tid(hdr, tid, sizeof(tid)),
2377 		   is_multicast_ether_addr(ieee80211_get_DA(hdr)) ?
2378 							"mcast" : "ucast",
2379 		   (__le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4,
2380 		   (status->encoding == RX_ENC_LEGACY) ? "legacy" : "",
2381 		   (status->encoding == RX_ENC_HT) ? "ht" : "",
2382 		   (status->encoding == RX_ENC_VHT) ? "vht" : "",
2383 		   (status->encoding == RX_ENC_HE) ? "he" : "",
2384 		   (status->bw == RATE_INFO_BW_40) ? "40" : "",
2385 		   (status->bw == RATE_INFO_BW_80) ? "80" : "",
2386 		   (status->bw == RATE_INFO_BW_160) ? "160" : "",
2387 		   status->enc_flags & RX_ENC_FLAG_SHORT_GI ? "sgi " : "",
2388 		   status->rate_idx,
2389 		   status->nss,
2390 		   status->freq,
2391 		   status->band, status->flag,
2392 		   !!(status->flag & RX_FLAG_FAILED_FCS_CRC),
2393 		   !!(status->flag & RX_FLAG_MMIC_ERROR),
2394 		   !!(status->flag & RX_FLAG_AMSDU_MORE));
2395 
2396 	ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_RX, NULL, "dp rx msdu: ",
2397 			msdu->data, msdu->len);
2398 
2399 	/* TODO: trace rx packet */
2400 
2401 	ieee80211_rx_napi(ar->hw, NULL, msdu, napi);
2402 }
2403 
2404 static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
2405 				     struct sk_buff *msdu,
2406 				     struct sk_buff_head *msdu_list)
2407 {
2408 	struct hal_rx_desc *rx_desc, *lrx_desc;
2409 	struct ieee80211_rx_status rx_status = {0};
2410 	struct ieee80211_rx_status *status;
2411 	struct ath11k_skb_rxcb *rxcb;
2412 	struct ieee80211_hdr *hdr;
2413 	struct sk_buff *last_buf;
2414 	u8 l3_pad_bytes;
2415 	u8 *hdr_status;
2416 	u16 msdu_len;
2417 	int ret;
2418 
2419 	last_buf = ath11k_dp_rx_get_msdu_last_buf(msdu_list, msdu);
2420 	if (!last_buf) {
2421 		ath11k_warn(ar->ab,
2422 			    "No valid Rx buffer to access Atten/MSDU_END/MPDU_END tlvs\n");
2423 		ret = -EIO;
2424 		goto free_out;
2425 	}
2426 
2427 	rx_desc = (struct hal_rx_desc *)msdu->data;
2428 	lrx_desc = (struct hal_rx_desc *)last_buf->data;
2429 	if (!ath11k_dp_rx_h_attn_msdu_done(lrx_desc)) {
2430 		ath11k_warn(ar->ab, "msdu_done bit in attention is not set\n");
2431 		ret = -EIO;
2432 		goto free_out;
2433 	}
2434 
2435 	rxcb = ATH11K_SKB_RXCB(msdu);
2436 	rxcb->rx_desc = rx_desc;
2437 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(rx_desc);
2438 	l3_pad_bytes = ath11k_dp_rx_h_msdu_end_l3pad(lrx_desc);
2439 
2440 	if (rxcb->is_frag) {
2441 		skb_pull(msdu, HAL_RX_DESC_SIZE);
2442 	} else if (!rxcb->is_continuation) {
2443 		if ((msdu_len + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE) {
2444 			hdr_status = ath11k_dp_rx_h_80211_hdr(rx_desc);
2445 			ret = -EINVAL;
2446 			ath11k_warn(ar->ab, "invalid msdu len %u\n", msdu_len);
2447 			ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
2448 					sizeof(struct ieee80211_hdr));
2449 			ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
2450 					sizeof(struct hal_rx_desc));
2451 			goto free_out;
2452 		}
2453 		skb_put(msdu, HAL_RX_DESC_SIZE + l3_pad_bytes + msdu_len);
2454 		skb_pull(msdu, HAL_RX_DESC_SIZE + l3_pad_bytes);
2455 	} else {
2456 		ret = ath11k_dp_rx_msdu_coalesce(ar, msdu_list,
2457 						 msdu, last_buf,
2458 						 l3_pad_bytes, msdu_len);
2459 		if (ret) {
2460 			ath11k_warn(ar->ab,
2461 				    "failed to coalesce msdu rx buffer%d\n", ret);
2462 			goto free_out;
2463 		}
2464 	}
2465 
2466 	hdr = (struct ieee80211_hdr *)msdu->data;
2467 
2468 	/* Process only data frames */
2469 	if (!ieee80211_is_data(hdr->frame_control))
2470 		return -EINVAL;
2471 
2472 	ath11k_dp_rx_h_ppdu(ar, rx_desc, &rx_status);
2473 	ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, &rx_status);
2474 
2475 	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
2476 
2477 	status = IEEE80211_SKB_RXCB(msdu);
2478 	*status = rx_status;
2479 	return 0;
2480 
2481 free_out:
2482 	return ret;
2483 }
2484 
2485 static void ath11k_dp_rx_process_received_packets(struct ath11k_base *ab,
2486 						  struct napi_struct *napi,
2487 						  struct sk_buff_head *msdu_list,
2488 						  int *quota, int ring_id)
2489 {
2490 	struct ath11k_skb_rxcb *rxcb;
2491 	struct sk_buff *msdu;
2492 	struct ath11k *ar;
2493 	u8 mac_id;
2494 	int ret;
2495 
2496 	if (skb_queue_empty(msdu_list))
2497 		return;
2498 
2499 	rcu_read_lock();
2500 
2501 	while (*quota && (msdu = __skb_dequeue(msdu_list))) {
2502 		rxcb = ATH11K_SKB_RXCB(msdu);
2503 		mac_id = rxcb->mac_id;
2504 		ar = ab->pdevs[mac_id].ar;
2505 		if (!rcu_dereference(ab->pdevs_active[mac_id])) {
2506 			dev_kfree_skb_any(msdu);
2507 			continue;
2508 		}
2509 
2510 		if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
2511 			dev_kfree_skb_any(msdu);
2512 			continue;
2513 		}
2514 
2515 		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list);
2516 		if (ret) {
2517 			ath11k_dbg(ab, ATH11K_DBG_DATA,
2518 				   "Unable to process msdu %d", ret);
2519 			dev_kfree_skb_any(msdu);
2520 			continue;
2521 		}
2522 
2523 		ath11k_dp_rx_deliver_msdu(ar, napi, msdu);
2524 		(*quota)--;
2525 	}
2526 
2527 	rcu_read_unlock();
2528 }
2529 
2530 int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
2531 			 struct napi_struct *napi, int budget)
2532 {
2533 	struct ath11k_dp *dp = &ab->dp;
2534 	struct dp_rxdma_ring *rx_ring;
2535 	int num_buffs_reaped[MAX_RADIOS] = {0};
2536 	struct sk_buff_head msdu_list;
2537 	struct ath11k_skb_rxcb *rxcb;
2538 	int total_msdu_reaped = 0;
2539 	struct hal_srng *srng;
2540 	struct sk_buff *msdu;
2541 	int quota = budget;
2542 	bool done = false;
2543 	int buf_id, mac_id;
2544 	struct ath11k *ar;
2545 	u32 *rx_desc;
2546 	int i;
2547 
2548 	__skb_queue_head_init(&msdu_list);
2549 
2550 	srng = &ab->hal.srng_list[dp->reo_dst_ring[ring_id].ring_id];
2551 
2552 	spin_lock_bh(&srng->lock);
2553 
2554 	ath11k_hal_srng_access_begin(ab, srng);
2555 
2556 try_again:
2557 	while ((rx_desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
2558 		struct hal_reo_dest_ring desc = *(struct hal_reo_dest_ring *)rx_desc;
2559 		enum hal_reo_dest_ring_push_reason push_reason;
2560 		u32 cookie;
2561 
2562 		cookie = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
2563 				   desc.buf_addr_info.info1);
2564 		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
2565 				   cookie);
2566 		mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie);
2567 
2568 		ar = ab->pdevs[mac_id].ar;
2569 		rx_ring = &ar->dp.rx_refill_buf_ring;
2570 		spin_lock_bh(&rx_ring->idr_lock);
2571 		msdu = idr_find(&rx_ring->bufs_idr, buf_id);
2572 		if (!msdu) {
2573 			ath11k_warn(ab, "frame rx with invalid buf_id %d\n",
2574 				    buf_id);
2575 			spin_unlock_bh(&rx_ring->idr_lock);
2576 			continue;
2577 		}
2578 
2579 		idr_remove(&rx_ring->bufs_idr, buf_id);
2580 		spin_unlock_bh(&rx_ring->idr_lock);
2581 
2582 		rxcb = ATH11K_SKB_RXCB(msdu);
2583 		dma_unmap_single(ab->dev, rxcb->paddr,
2584 				 msdu->len + skb_tailroom(msdu),
2585 				 DMA_FROM_DEVICE);
2586 
2587 		num_buffs_reaped[mac_id]++;
2588 		total_msdu_reaped++;
2589 
2590 		push_reason = FIELD_GET(HAL_REO_DEST_RING_INFO0_PUSH_REASON,
2591 					desc.info0);
2592 		if (push_reason !=
2593 		    HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) {
2594 			dev_kfree_skb_any(msdu);
2595 			ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++;
2596 			continue;
2597 		}
2598 
2599 		rxcb->is_first_msdu = !!(desc.rx_msdu_info.info0 &
2600 					 RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU);
2601 		rxcb->is_last_msdu = !!(desc.rx_msdu_info.info0 &
2602 					RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU);
2603 		rxcb->is_continuation = !!(desc.rx_msdu_info.info0 &
2604 					   RX_MSDU_DESC_INFO0_MSDU_CONTINUATION);
2605 		rxcb->mac_id = mac_id;
2606 		rxcb->tid = FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM,
2607 				      desc.info0);
2608 
2609 		__skb_queue_tail(&msdu_list, msdu);
2610 
2611 		if (total_msdu_reaped >= quota && !rxcb->is_continuation) {
2612 			done = true;
2613 			break;
2614 		}
2615 	}
2616 
2617 	/* Hw might have updated the head pointer after we cached it.
2618 	 * In this case, even though there are entries in the ring we'll
2619 	 * get rx_desc NULL. Give the read another try with updated cached
2620 	 * head pointer so that we can reap complete MPDU in the current
2621 	 * rx processing.
2622 	 */
2623 	if (!done && ath11k_hal_srng_dst_num_free(ab, srng, true)) {
2624 		ath11k_hal_srng_access_end(ab, srng);
2625 		goto try_again;
2626 	}
2627 
2628 	ath11k_hal_srng_access_end(ab, srng);
2629 
2630 	spin_unlock_bh(&srng->lock);
2631 
2632 	if (!total_msdu_reaped)
2633 		goto exit;
2634 
2635 	for (i = 0; i < ab->num_radios; i++) {
2636 		if (!num_buffs_reaped[i])
2637 			continue;
2638 
2639 		ar = ab->pdevs[i].ar;
2640 		rx_ring = &ar->dp.rx_refill_buf_ring;
2641 
2642 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
2643 					   HAL_RX_BUF_RBM_SW3_BM);
2644 	}
2645 
2646 	ath11k_dp_rx_process_received_packets(ab, napi, &msdu_list,
2647 					      &quota, ring_id);
2648 
2649 exit:
2650 	return budget - quota;
2651 }
2652 
2653 static void ath11k_dp_rx_update_peer_stats(struct ath11k_sta *arsta,
2654 					   struct hal_rx_mon_ppdu_info *ppdu_info)
2655 {
2656 	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
2657 	u32 num_msdu;
2658 
2659 	if (!rx_stats)
2660 		return;
2661 
2662 	num_msdu = ppdu_info->tcp_msdu_count + ppdu_info->tcp_ack_msdu_count +
2663 		   ppdu_info->udp_msdu_count + ppdu_info->other_msdu_count;
2664 
2665 	rx_stats->num_msdu += num_msdu;
2666 	rx_stats->tcp_msdu_count += ppdu_info->tcp_msdu_count +
2667 				    ppdu_info->tcp_ack_msdu_count;
2668 	rx_stats->udp_msdu_count += ppdu_info->udp_msdu_count;
2669 	rx_stats->other_msdu_count += ppdu_info->other_msdu_count;
2670 
2671 	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11A ||
2672 	    ppdu_info->preamble_type == HAL_RX_PREAMBLE_11B) {
2673 		ppdu_info->nss = 1;
2674 		ppdu_info->mcs = HAL_RX_MAX_MCS;
2675 		ppdu_info->tid = IEEE80211_NUM_TIDS;
2676 	}
2677 
2678 	if (ppdu_info->nss > 0 && ppdu_info->nss <= HAL_RX_MAX_NSS)
2679 		rx_stats->nss_count[ppdu_info->nss - 1] += num_msdu;
2680 
2681 	if (ppdu_info->mcs <= HAL_RX_MAX_MCS)
2682 		rx_stats->mcs_count[ppdu_info->mcs] += num_msdu;
2683 
2684 	if (ppdu_info->gi < HAL_RX_GI_MAX)
2685 		rx_stats->gi_count[ppdu_info->gi] += num_msdu;
2686 
2687 	if (ppdu_info->bw < HAL_RX_BW_MAX)
2688 		rx_stats->bw_count[ppdu_info->bw] += num_msdu;
2689 
2690 	if (ppdu_info->ldpc < HAL_RX_SU_MU_CODING_MAX)
2691 		rx_stats->coding_count[ppdu_info->ldpc] += num_msdu;
2692 
2693 	if (ppdu_info->tid <= IEEE80211_NUM_TIDS)
2694 		rx_stats->tid_count[ppdu_info->tid] += num_msdu;
2695 
2696 	if (ppdu_info->preamble_type < HAL_RX_PREAMBLE_MAX)
2697 		rx_stats->pream_cnt[ppdu_info->preamble_type] += num_msdu;
2698 
2699 	if (ppdu_info->reception_type < HAL_RX_RECEPTION_TYPE_MAX)
2700 		rx_stats->reception_type[ppdu_info->reception_type] += num_msdu;
2701 
2702 	if (ppdu_info->is_stbc)
2703 		rx_stats->stbc_count += num_msdu;
2704 
2705 	if (ppdu_info->beamformed)
2706 		rx_stats->beamformed_count += num_msdu;
2707 
2708 	if (ppdu_info->num_mpdu_fcs_ok > 1)
2709 		rx_stats->ampdu_msdu_count += num_msdu;
2710 	else
2711 		rx_stats->non_ampdu_msdu_count += num_msdu;
2712 
2713 	rx_stats->num_mpdu_fcs_ok += ppdu_info->num_mpdu_fcs_ok;
2714 	rx_stats->num_mpdu_fcs_err += ppdu_info->num_mpdu_fcs_err;
2715 	rx_stats->dcm_count += ppdu_info->dcm;
2716 	rx_stats->ru_alloc_cnt[ppdu_info->ru_alloc] += num_msdu;
2717 
2718 	arsta->rssi_comb = ppdu_info->rssi_comb;
2719 	rx_stats->rx_duration += ppdu_info->rx_duration;
2720 	arsta->rx_duration = rx_stats->rx_duration;
2721 }
2722 
2723 static struct sk_buff *ath11k_dp_rx_alloc_mon_status_buf(struct ath11k_base *ab,
2724 							 struct dp_rxdma_ring *rx_ring,
2725 							 int *buf_id)
2726 {
2727 	struct sk_buff *skb;
2728 	dma_addr_t paddr;
2729 
2730 	skb = dev_alloc_skb(DP_RX_BUFFER_SIZE +
2731 			    DP_RX_BUFFER_ALIGN_SIZE);
2732 
2733 	if (!skb)
2734 		goto fail_alloc_skb;
2735 
2736 	if (!IS_ALIGNED((unsigned long)skb->data,
2737 			DP_RX_BUFFER_ALIGN_SIZE)) {
2738 		skb_pull(skb, PTR_ALIGN(skb->data, DP_RX_BUFFER_ALIGN_SIZE) -
2739 			 skb->data);
2740 	}
2741 
2742 	paddr = dma_map_single(ab->dev, skb->data,
2743 			       skb->len + skb_tailroom(skb),
2744 			       DMA_FROM_DEVICE);
2745 	if (unlikely(dma_mapping_error(ab->dev, paddr)))
2746 		goto fail_free_skb;
2747 
2748 	spin_lock_bh(&rx_ring->idr_lock);
2749 	*buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 0,
2750 			    rx_ring->bufs_max, GFP_ATOMIC);
2751 	spin_unlock_bh(&rx_ring->idr_lock);
2752 	if (*buf_id < 0)
2753 		goto fail_dma_unmap;
2754 
2755 	ATH11K_SKB_RXCB(skb)->paddr = paddr;
2756 	return skb;
2757 
2758 fail_dma_unmap:
2759 	dma_unmap_single(ab->dev, paddr, skb->len + skb_tailroom(skb),
2760 			 DMA_FROM_DEVICE);
2761 fail_free_skb:
2762 	dev_kfree_skb_any(skb);
2763 fail_alloc_skb:
2764 	return NULL;
2765 }
2766 
2767 int ath11k_dp_rx_mon_status_bufs_replenish(struct ath11k_base *ab, int mac_id,
2768 					   struct dp_rxdma_ring *rx_ring,
2769 					   int req_entries,
2770 					   enum hal_rx_buf_return_buf_manager mgr)
2771 {
2772 	struct hal_srng *srng;
2773 	u32 *desc;
2774 	struct sk_buff *skb;
2775 	int num_free;
2776 	int num_remain;
2777 	int buf_id;
2778 	u32 cookie;
2779 	dma_addr_t paddr;
2780 
2781 	req_entries = min(req_entries, rx_ring->bufs_max);
2782 
2783 	srng = &ab->hal.srng_list[rx_ring->refill_buf_ring.ring_id];
2784 
2785 	spin_lock_bh(&srng->lock);
2786 
2787 	ath11k_hal_srng_access_begin(ab, srng);
2788 
2789 	num_free = ath11k_hal_srng_src_num_free(ab, srng, true);
2790 
2791 	req_entries = min(num_free, req_entries);
2792 	num_remain = req_entries;
2793 
2794 	while (num_remain > 0) {
2795 		skb = ath11k_dp_rx_alloc_mon_status_buf(ab, rx_ring,
2796 							&buf_id);
2797 		if (!skb)
2798 			break;
2799 		paddr = ATH11K_SKB_RXCB(skb)->paddr;
2800 
2801 		desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
2802 		if (!desc)
2803 			goto fail_desc_get;
2804 
2805 		cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, mac_id) |
2806 			 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
2807 
2808 		num_remain--;
2809 
2810 		ath11k_hal_rx_buf_addr_info_set(desc, paddr, cookie, mgr);
2811 	}
2812 
2813 	ath11k_hal_srng_access_end(ab, srng);
2814 
2815 	spin_unlock_bh(&srng->lock);
2816 
2817 	return req_entries - num_remain;
2818 
2819 fail_desc_get:
2820 	spin_lock_bh(&rx_ring->idr_lock);
2821 	idr_remove(&rx_ring->bufs_idr, buf_id);
2822 	spin_unlock_bh(&rx_ring->idr_lock);
2823 	dma_unmap_single(ab->dev, paddr, skb->len + skb_tailroom(skb),
2824 			 DMA_FROM_DEVICE);
2825 	dev_kfree_skb_any(skb);
2826 	ath11k_hal_srng_access_end(ab, srng);
2827 	spin_unlock_bh(&srng->lock);
2828 
2829 	return req_entries - num_remain;
2830 }
2831 
2832 static int ath11k_dp_rx_reap_mon_status_ring(struct ath11k_base *ab, int mac_id,
2833 					     int *budget, struct sk_buff_head *skb_list)
2834 {
2835 	struct ath11k *ar;
2836 	struct ath11k_pdev_dp *dp;
2837 	struct dp_rxdma_ring *rx_ring;
2838 	struct hal_srng *srng;
2839 	void *rx_mon_status_desc;
2840 	struct sk_buff *skb;
2841 	struct ath11k_skb_rxcb *rxcb;
2842 	struct hal_tlv_hdr *tlv;
2843 	u32 cookie;
2844 	int buf_id, srng_id;
2845 	dma_addr_t paddr;
2846 	u8 rbm;
2847 	int num_buffs_reaped = 0;
2848 
2849 	ar = ab->pdevs[ath11k_hw_mac_id_to_pdev_id(&ab->hw_params, mac_id)].ar;
2850 	dp = &ar->dp;
2851 	srng_id = ath11k_hw_mac_id_to_srng_id(&ab->hw_params, mac_id);
2852 	rx_ring = &dp->rx_mon_status_refill_ring[srng_id];
2853 
2854 	srng = &ab->hal.srng_list[rx_ring->refill_buf_ring.ring_id];
2855 
2856 	spin_lock_bh(&srng->lock);
2857 
2858 	ath11k_hal_srng_access_begin(ab, srng);
2859 	while (*budget) {
2860 		*budget -= 1;
2861 		rx_mon_status_desc =
2862 			ath11k_hal_srng_src_peek(ab, srng);
2863 		if (!rx_mon_status_desc)
2864 			break;
2865 
2866 		ath11k_hal_rx_buf_addr_info_get(rx_mon_status_desc, &paddr,
2867 						&cookie, &rbm);
2868 		if (paddr) {
2869 			buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID, cookie);
2870 
2871 			spin_lock_bh(&rx_ring->idr_lock);
2872 			skb = idr_find(&rx_ring->bufs_idr, buf_id);
2873 			if (!skb) {
2874 				ath11k_warn(ab, "rx monitor status with invalid buf_id %d\n",
2875 					    buf_id);
2876 				spin_unlock_bh(&rx_ring->idr_lock);
2877 				goto move_next;
2878 			}
2879 
2880 			idr_remove(&rx_ring->bufs_idr, buf_id);
2881 			spin_unlock_bh(&rx_ring->idr_lock);
2882 
2883 			rxcb = ATH11K_SKB_RXCB(skb);
2884 
2885 			dma_unmap_single(ab->dev, rxcb->paddr,
2886 					 skb->len + skb_tailroom(skb),
2887 					 DMA_FROM_DEVICE);
2888 
2889 			tlv = (struct hal_tlv_hdr *)skb->data;
2890 			if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) !=
2891 					HAL_RX_STATUS_BUFFER_DONE) {
2892 				ath11k_warn(ab, "mon status DONE not set %lx\n",
2893 					    FIELD_GET(HAL_TLV_HDR_TAG,
2894 						      tlv->tl));
2895 				dev_kfree_skb_any(skb);
2896 				goto move_next;
2897 			}
2898 
2899 			__skb_queue_tail(skb_list, skb);
2900 		}
2901 move_next:
2902 		skb = ath11k_dp_rx_alloc_mon_status_buf(ab, rx_ring,
2903 							&buf_id);
2904 
2905 		if (!skb) {
2906 			ath11k_hal_rx_buf_addr_info_set(rx_mon_status_desc, 0, 0,
2907 							HAL_RX_BUF_RBM_SW3_BM);
2908 			num_buffs_reaped++;
2909 			break;
2910 		}
2911 		rxcb = ATH11K_SKB_RXCB(skb);
2912 
2913 		cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, mac_id) |
2914 			 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
2915 
2916 		ath11k_hal_rx_buf_addr_info_set(rx_mon_status_desc, rxcb->paddr,
2917 						cookie, HAL_RX_BUF_RBM_SW3_BM);
2918 		ath11k_hal_srng_src_get_next_entry(ab, srng);
2919 		num_buffs_reaped++;
2920 	}
2921 	ath11k_hal_srng_access_end(ab, srng);
2922 	spin_unlock_bh(&srng->lock);
2923 
2924 	return num_buffs_reaped;
2925 }
2926 
2927 int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id,
2928 				    struct napi_struct *napi, int budget)
2929 {
2930 	struct ath11k *ar = ath11k_ab_to_ar(ab, mac_id);
2931 	enum hal_rx_mon_status hal_status;
2932 	struct sk_buff *skb;
2933 	struct sk_buff_head skb_list;
2934 	struct hal_rx_mon_ppdu_info ppdu_info;
2935 	struct ath11k_peer *peer;
2936 	struct ath11k_sta *arsta;
2937 	int num_buffs_reaped = 0;
2938 
2939 	__skb_queue_head_init(&skb_list);
2940 
2941 	num_buffs_reaped = ath11k_dp_rx_reap_mon_status_ring(ab, mac_id, &budget,
2942 							     &skb_list);
2943 	if (!num_buffs_reaped)
2944 		goto exit;
2945 
2946 	while ((skb = __skb_dequeue(&skb_list))) {
2947 		memset(&ppdu_info, 0, sizeof(ppdu_info));
2948 		ppdu_info.peer_id = HAL_INVALID_PEERID;
2949 
2950 		if (ath11k_debugfs_is_pktlog_rx_stats_enabled(ar))
2951 			trace_ath11k_htt_rxdesc(ar, skb->data, DP_RX_BUFFER_SIZE);
2952 
2953 		hal_status = ath11k_hal_rx_parse_mon_status(ab, &ppdu_info, skb);
2954 
2955 		if (ppdu_info.peer_id == HAL_INVALID_PEERID ||
2956 		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE) {
2957 			dev_kfree_skb_any(skb);
2958 			continue;
2959 		}
2960 
2961 		rcu_read_lock();
2962 		spin_lock_bh(&ab->base_lock);
2963 		peer = ath11k_peer_find_by_id(ab, ppdu_info.peer_id);
2964 
2965 		if (!peer || !peer->sta) {
2966 			ath11k_dbg(ab, ATH11K_DBG_DATA,
2967 				   "failed to find the peer with peer_id %d\n",
2968 				   ppdu_info.peer_id);
2969 			spin_unlock_bh(&ab->base_lock);
2970 			rcu_read_unlock();
2971 			dev_kfree_skb_any(skb);
2972 			continue;
2973 		}
2974 
2975 		arsta = (struct ath11k_sta *)peer->sta->drv_priv;
2976 		ath11k_dp_rx_update_peer_stats(arsta, &ppdu_info);
2977 
2978 		if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr))
2979 			trace_ath11k_htt_rxdesc(ar, skb->data, DP_RX_BUFFER_SIZE);
2980 
2981 		spin_unlock_bh(&ab->base_lock);
2982 		rcu_read_unlock();
2983 
2984 		dev_kfree_skb_any(skb);
2985 	}
2986 exit:
2987 	return num_buffs_reaped;
2988 }
2989 
2990 static void ath11k_dp_rx_frag_timer(struct timer_list *timer)
2991 {
2992 	struct dp_rx_tid *rx_tid = from_timer(rx_tid, timer, frag_timer);
2993 
2994 	spin_lock_bh(&rx_tid->ab->base_lock);
2995 	if (rx_tid->last_frag_no &&
2996 	    rx_tid->rx_frag_bitmap == GENMASK(rx_tid->last_frag_no, 0)) {
2997 		spin_unlock_bh(&rx_tid->ab->base_lock);
2998 		return;
2999 	}
3000 	ath11k_dp_rx_frags_cleanup(rx_tid, true);
3001 	spin_unlock_bh(&rx_tid->ab->base_lock);
3002 }
3003 
3004 int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id)
3005 {
3006 	struct ath11k_base *ab = ar->ab;
3007 	struct crypto_shash *tfm;
3008 	struct ath11k_peer *peer;
3009 	struct dp_rx_tid *rx_tid;
3010 	int i;
3011 
3012 	tfm = crypto_alloc_shash("michael_mic", 0, 0);
3013 	if (IS_ERR(tfm))
3014 		return PTR_ERR(tfm);
3015 
3016 	spin_lock_bh(&ab->base_lock);
3017 
3018 	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
3019 	if (!peer) {
3020 		ath11k_warn(ab, "failed to find the peer to set up fragment info\n");
3021 		spin_unlock_bh(&ab->base_lock);
3022 		return -ENOENT;
3023 	}
3024 
3025 	for (i = 0; i <= IEEE80211_NUM_TIDS; i++) {
3026 		rx_tid = &peer->rx_tid[i];
3027 		rx_tid->ab = ab;
3028 		timer_setup(&rx_tid->frag_timer, ath11k_dp_rx_frag_timer, 0);
3029 		skb_queue_head_init(&rx_tid->rx_frags);
3030 	}
3031 
3032 	peer->tfm_mmic = tfm;
3033 	spin_unlock_bh(&ab->base_lock);
3034 
3035 	return 0;
3036 }
3037 
3038 static int ath11k_dp_rx_h_michael_mic(struct crypto_shash *tfm, u8 *key,
3039 				      struct ieee80211_hdr *hdr, u8 *data,
3040 				      size_t data_len, u8 *mic)
3041 {
3042 	SHASH_DESC_ON_STACK(desc, tfm);
3043 	u8 mic_hdr[16] = {0};
3044 	u8 tid = 0;
3045 	int ret;
3046 
3047 	if (!tfm)
3048 		return -EINVAL;
3049 
3050 	desc->tfm = tfm;
3051 
3052 	ret = crypto_shash_setkey(tfm, key, 8);
3053 	if (ret)
3054 		goto out;
3055 
3056 	ret = crypto_shash_init(desc);
3057 	if (ret)
3058 		goto out;
3059 
3060 	/* TKIP MIC header */
3061 	memcpy(mic_hdr, ieee80211_get_DA(hdr), ETH_ALEN);
3062 	memcpy(mic_hdr + ETH_ALEN, ieee80211_get_SA(hdr), ETH_ALEN);
3063 	if (ieee80211_is_data_qos(hdr->frame_control))
3064 		tid = ieee80211_get_tid(hdr);
3065 	mic_hdr[12] = tid;
3066 
3067 	ret = crypto_shash_update(desc, mic_hdr, 16);
3068 	if (ret)
3069 		goto out;
3070 	ret = crypto_shash_update(desc, data, data_len);
3071 	if (ret)
3072 		goto out;
3073 	ret = crypto_shash_final(desc, mic);
3074 out:
3075 	shash_desc_zero(desc);
3076 	return ret;
3077 }
3078 
3079 static int ath11k_dp_rx_h_verify_tkip_mic(struct ath11k *ar, struct ath11k_peer *peer,
3080 					  struct sk_buff *msdu)
3081 {
3082 	struct hal_rx_desc *rx_desc = (struct hal_rx_desc *)msdu->data;
3083 	struct ieee80211_rx_status *rxs = IEEE80211_SKB_RXCB(msdu);
3084 	struct ieee80211_key_conf *key_conf;
3085 	struct ieee80211_hdr *hdr;
3086 	u8 mic[IEEE80211_CCMP_MIC_LEN];
3087 	int head_len, tail_len, ret;
3088 	size_t data_len;
3089 	u32 hdr_len;
3090 	u8 *key, *data;
3091 	u8 key_idx;
3092 
3093 	if (ath11k_dp_rx_h_mpdu_start_enctype(rx_desc) != HAL_ENCRYPT_TYPE_TKIP_MIC)
3094 		return 0;
3095 
3096 	hdr = (struct ieee80211_hdr *)(msdu->data + HAL_RX_DESC_SIZE);
3097 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
3098 	head_len = hdr_len + HAL_RX_DESC_SIZE + IEEE80211_TKIP_IV_LEN;
3099 	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
3100 
3101 	if (!is_multicast_ether_addr(hdr->addr1))
3102 		key_idx = peer->ucast_keyidx;
3103 	else
3104 		key_idx = peer->mcast_keyidx;
3105 
3106 	key_conf = peer->keys[key_idx];
3107 
3108 	data = msdu->data + head_len;
3109 	data_len = msdu->len - head_len - tail_len;
3110 	key = &key_conf->key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
3111 
3112 	ret = ath11k_dp_rx_h_michael_mic(peer->tfm_mmic, key, hdr, data, data_len, mic);
3113 	if (ret || memcmp(mic, data + data_len, IEEE80211_CCMP_MIC_LEN))
3114 		goto mic_fail;
3115 
3116 	return 0;
3117 
3118 mic_fail:
3119 	(ATH11K_SKB_RXCB(msdu))->is_first_msdu = true;
3120 	(ATH11K_SKB_RXCB(msdu))->is_last_msdu = true;
3121 
3122 	rxs->flag |= RX_FLAG_MMIC_ERROR | RX_FLAG_MMIC_STRIPPED |
3123 		    RX_FLAG_IV_STRIPPED | RX_FLAG_DECRYPTED;
3124 	skb_pull(msdu, HAL_RX_DESC_SIZE);
3125 
3126 	ath11k_dp_rx_h_ppdu(ar, rx_desc, rxs);
3127 	ath11k_dp_rx_h_undecap(ar, msdu, rx_desc,
3128 			       HAL_ENCRYPT_TYPE_TKIP_MIC, rxs, true);
3129 	ieee80211_rx(ar->hw, msdu);
3130 	return -EINVAL;
3131 }
3132 
3133 static void ath11k_dp_rx_h_undecap_frag(struct ath11k *ar, struct sk_buff *msdu,
3134 					enum hal_encrypt_type enctype, u32 flags)
3135 {
3136 	struct ieee80211_hdr *hdr;
3137 	size_t hdr_len;
3138 	size_t crypto_len;
3139 
3140 	if (!flags)
3141 		return;
3142 
3143 	hdr = (struct ieee80211_hdr *)(msdu->data + HAL_RX_DESC_SIZE);
3144 
3145 	if (flags & RX_FLAG_MIC_STRIPPED)
3146 		skb_trim(msdu, msdu->len -
3147 			 ath11k_dp_rx_crypto_mic_len(ar, enctype));
3148 
3149 	if (flags & RX_FLAG_ICV_STRIPPED)
3150 		skb_trim(msdu, msdu->len -
3151 			 ath11k_dp_rx_crypto_icv_len(ar, enctype));
3152 
3153 	if (flags & RX_FLAG_IV_STRIPPED) {
3154 		hdr_len = ieee80211_hdrlen(hdr->frame_control);
3155 		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
3156 
3157 		memmove((void *)msdu->data + HAL_RX_DESC_SIZE + crypto_len,
3158 			(void *)msdu->data + HAL_RX_DESC_SIZE, hdr_len);
3159 		skb_pull(msdu, crypto_len);
3160 	}
3161 }
3162 
3163 static int ath11k_dp_rx_h_defrag(struct ath11k *ar,
3164 				 struct ath11k_peer *peer,
3165 				 struct dp_rx_tid *rx_tid,
3166 				 struct sk_buff **defrag_skb)
3167 {
3168 	struct hal_rx_desc *rx_desc;
3169 	struct sk_buff *skb, *first_frag, *last_frag;
3170 	struct ieee80211_hdr *hdr;
3171 	enum hal_encrypt_type enctype;
3172 	bool is_decrypted = false;
3173 	int msdu_len = 0;
3174 	int extra_space;
3175 	u32 flags;
3176 
3177 	first_frag = skb_peek(&rx_tid->rx_frags);
3178 	last_frag = skb_peek_tail(&rx_tid->rx_frags);
3179 
3180 	skb_queue_walk(&rx_tid->rx_frags, skb) {
3181 		flags = 0;
3182 		rx_desc = (struct hal_rx_desc *)skb->data;
3183 		hdr = (struct ieee80211_hdr *)(skb->data + HAL_RX_DESC_SIZE);
3184 
3185 		enctype = ath11k_dp_rx_h_mpdu_start_enctype(rx_desc);
3186 		if (enctype != HAL_ENCRYPT_TYPE_OPEN)
3187 			is_decrypted = ath11k_dp_rx_h_attn_is_decrypted(rx_desc);
3188 
3189 		if (is_decrypted) {
3190 			if (skb != first_frag)
3191 				flags |=  RX_FLAG_IV_STRIPPED;
3192 			if (skb != last_frag)
3193 				flags |= RX_FLAG_ICV_STRIPPED |
3194 					 RX_FLAG_MIC_STRIPPED;
3195 		}
3196 
3197 		/* RX fragments are always raw packets */
3198 		if (skb != last_frag)
3199 			skb_trim(skb, skb->len - FCS_LEN);
3200 		ath11k_dp_rx_h_undecap_frag(ar, skb, enctype, flags);
3201 
3202 		if (skb != first_frag)
3203 			skb_pull(skb, HAL_RX_DESC_SIZE +
3204 				      ieee80211_hdrlen(hdr->frame_control));
3205 		msdu_len += skb->len;
3206 	}
3207 
3208 	extra_space = msdu_len - (DP_RX_BUFFER_SIZE + skb_tailroom(first_frag));
3209 	if (extra_space > 0 &&
3210 	    (pskb_expand_head(first_frag, 0, extra_space, GFP_ATOMIC) < 0))
3211 		return -ENOMEM;
3212 
3213 	__skb_unlink(first_frag, &rx_tid->rx_frags);
3214 	while ((skb = __skb_dequeue(&rx_tid->rx_frags))) {
3215 		skb_put_data(first_frag, skb->data, skb->len);
3216 		dev_kfree_skb_any(skb);
3217 	}
3218 
3219 	hdr = (struct ieee80211_hdr *)(first_frag->data + HAL_RX_DESC_SIZE);
3220 	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
3221 	ATH11K_SKB_RXCB(first_frag)->is_frag = 1;
3222 
3223 	if (ath11k_dp_rx_h_verify_tkip_mic(ar, peer, first_frag))
3224 		first_frag = NULL;
3225 
3226 	*defrag_skb = first_frag;
3227 	return 0;
3228 }
3229 
3230 static int ath11k_dp_rx_h_defrag_reo_reinject(struct ath11k *ar, struct dp_rx_tid *rx_tid,
3231 					      struct sk_buff *defrag_skb)
3232 {
3233 	struct ath11k_base *ab = ar->ab;
3234 	struct ath11k_pdev_dp *dp = &ar->dp;
3235 	struct dp_rxdma_ring *rx_refill_ring = &dp->rx_refill_buf_ring;
3236 	struct hal_rx_desc *rx_desc = (struct hal_rx_desc *)defrag_skb->data;
3237 	struct hal_reo_entrance_ring *reo_ent_ring;
3238 	struct hal_reo_dest_ring *reo_dest_ring;
3239 	struct dp_link_desc_bank *link_desc_banks;
3240 	struct hal_rx_msdu_link *msdu_link;
3241 	struct hal_rx_msdu_details *msdu0;
3242 	struct hal_srng *srng;
3243 	dma_addr_t paddr;
3244 	u32 desc_bank, msdu_info, mpdu_info;
3245 	u32 dst_idx, cookie;
3246 	u32 *msdu_len_offset;
3247 	int ret, buf_id;
3248 
3249 	link_desc_banks = ab->dp.link_desc_banks;
3250 	reo_dest_ring = rx_tid->dst_ring_desc;
3251 
3252 	ath11k_hal_rx_reo_ent_paddr_get(ab, reo_dest_ring, &paddr, &desc_bank);
3253 	msdu_link = (struct hal_rx_msdu_link *)(link_desc_banks[desc_bank].vaddr +
3254 			(paddr - link_desc_banks[desc_bank].paddr));
3255 	msdu0 = &msdu_link->msdu_link[0];
3256 	dst_idx = FIELD_GET(RX_MSDU_DESC_INFO0_REO_DEST_IND, msdu0->rx_msdu_info.info0);
3257 	memset(msdu0, 0, sizeof(*msdu0));
3258 
3259 	msdu_info = FIELD_PREP(RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU, 1) |
3260 		    FIELD_PREP(RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU, 1) |
3261 		    FIELD_PREP(RX_MSDU_DESC_INFO0_MSDU_CONTINUATION, 0) |
3262 		    FIELD_PREP(RX_MSDU_DESC_INFO0_MSDU_LENGTH,
3263 			       defrag_skb->len - HAL_RX_DESC_SIZE) |
3264 		    FIELD_PREP(RX_MSDU_DESC_INFO0_REO_DEST_IND, dst_idx) |
3265 		    FIELD_PREP(RX_MSDU_DESC_INFO0_VALID_SA, 1) |
3266 		    FIELD_PREP(RX_MSDU_DESC_INFO0_VALID_DA, 1);
3267 	msdu0->rx_msdu_info.info0 = msdu_info;
3268 
3269 	/* change msdu len in hal rx desc */
3270 	msdu_len_offset = (u32 *)&rx_desc->msdu_start;
3271 	*msdu_len_offset &= ~(RX_MSDU_START_INFO1_MSDU_LENGTH);
3272 	*msdu_len_offset |= defrag_skb->len - HAL_RX_DESC_SIZE;
3273 
3274 	paddr = dma_map_single(ab->dev, defrag_skb->data,
3275 			       defrag_skb->len + skb_tailroom(defrag_skb),
3276 			       DMA_FROM_DEVICE);
3277 	if (dma_mapping_error(ab->dev, paddr))
3278 		return -ENOMEM;
3279 
3280 	spin_lock_bh(&rx_refill_ring->idr_lock);
3281 	buf_id = idr_alloc(&rx_refill_ring->bufs_idr, defrag_skb, 0,
3282 			   rx_refill_ring->bufs_max * 3, GFP_ATOMIC);
3283 	spin_unlock_bh(&rx_refill_ring->idr_lock);
3284 	if (buf_id < 0) {
3285 		ret = -ENOMEM;
3286 		goto err_unmap_dma;
3287 	}
3288 
3289 	ATH11K_SKB_RXCB(defrag_skb)->paddr = paddr;
3290 	cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, dp->mac_id) |
3291 		 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
3292 
3293 	ath11k_hal_rx_buf_addr_info_set(msdu0, paddr, cookie, HAL_RX_BUF_RBM_SW3_BM);
3294 
3295 	/* Fill mpdu details into reo entrace ring */
3296 	srng = &ab->hal.srng_list[ab->dp.reo_reinject_ring.ring_id];
3297 
3298 	spin_lock_bh(&srng->lock);
3299 	ath11k_hal_srng_access_begin(ab, srng);
3300 
3301 	reo_ent_ring = (struct hal_reo_entrance_ring *)
3302 			ath11k_hal_srng_src_get_next_entry(ab, srng);
3303 	if (!reo_ent_ring) {
3304 		ath11k_hal_srng_access_end(ab, srng);
3305 		spin_unlock_bh(&srng->lock);
3306 		ret = -ENOSPC;
3307 		goto err_free_idr;
3308 	}
3309 	memset(reo_ent_ring, 0, sizeof(*reo_ent_ring));
3310 
3311 	ath11k_hal_rx_reo_ent_paddr_get(ab, reo_dest_ring, &paddr, &desc_bank);
3312 	ath11k_hal_rx_buf_addr_info_set(reo_ent_ring, paddr, desc_bank,
3313 					HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST);
3314 
3315 	mpdu_info = FIELD_PREP(RX_MPDU_DESC_INFO0_MSDU_COUNT, 1) |
3316 		    FIELD_PREP(RX_MPDU_DESC_INFO0_SEQ_NUM, rx_tid->cur_sn) |
3317 		    FIELD_PREP(RX_MPDU_DESC_INFO0_FRAG_FLAG, 0) |
3318 		    FIELD_PREP(RX_MPDU_DESC_INFO0_VALID_SA, 1) |
3319 		    FIELD_PREP(RX_MPDU_DESC_INFO0_VALID_DA, 1) |
3320 		    FIELD_PREP(RX_MPDU_DESC_INFO0_RAW_MPDU, 1) |
3321 		    FIELD_PREP(RX_MPDU_DESC_INFO0_VALID_PN, 1);
3322 
3323 	reo_ent_ring->rx_mpdu_info.info0 = mpdu_info;
3324 	reo_ent_ring->rx_mpdu_info.meta_data = reo_dest_ring->rx_mpdu_info.meta_data;
3325 	reo_ent_ring->queue_addr_lo = reo_dest_ring->queue_addr_lo;
3326 	reo_ent_ring->info0 = FIELD_PREP(HAL_REO_ENTR_RING_INFO0_QUEUE_ADDR_HI,
3327 					 FIELD_GET(HAL_REO_DEST_RING_INFO0_QUEUE_ADDR_HI,
3328 						   reo_dest_ring->info0)) |
3329 			      FIELD_PREP(HAL_REO_ENTR_RING_INFO0_DEST_IND, dst_idx);
3330 	ath11k_hal_srng_access_end(ab, srng);
3331 	spin_unlock_bh(&srng->lock);
3332 
3333 	return 0;
3334 
3335 err_free_idr:
3336 	spin_lock_bh(&rx_refill_ring->idr_lock);
3337 	idr_remove(&rx_refill_ring->bufs_idr, buf_id);
3338 	spin_unlock_bh(&rx_refill_ring->idr_lock);
3339 err_unmap_dma:
3340 	dma_unmap_single(ab->dev, paddr, defrag_skb->len + skb_tailroom(defrag_skb),
3341 			 DMA_FROM_DEVICE);
3342 	return ret;
3343 }
3344 
3345 static int ath11k_dp_rx_h_cmp_frags(struct sk_buff *a, struct sk_buff *b)
3346 {
3347 	int frag1, frag2;
3348 
3349 	frag1 = ath11k_dp_rx_h_mpdu_start_frag_no(a);
3350 	frag2 = ath11k_dp_rx_h_mpdu_start_frag_no(b);
3351 
3352 	return frag1 - frag2;
3353 }
3354 
3355 static void ath11k_dp_rx_h_sort_frags(struct sk_buff_head *frag_list,
3356 				      struct sk_buff *cur_frag)
3357 {
3358 	struct sk_buff *skb;
3359 	int cmp;
3360 
3361 	skb_queue_walk(frag_list, skb) {
3362 		cmp = ath11k_dp_rx_h_cmp_frags(skb, cur_frag);
3363 		if (cmp < 0)
3364 			continue;
3365 		__skb_queue_before(frag_list, skb, cur_frag);
3366 		return;
3367 	}
3368 	__skb_queue_tail(frag_list, cur_frag);
3369 }
3370 
3371 static u64 ath11k_dp_rx_h_get_pn(struct sk_buff *skb)
3372 {
3373 	struct ieee80211_hdr *hdr;
3374 	u64 pn = 0;
3375 	u8 *ehdr;
3376 
3377 	hdr = (struct ieee80211_hdr *)(skb->data + HAL_RX_DESC_SIZE);
3378 	ehdr = skb->data + HAL_RX_DESC_SIZE + ieee80211_hdrlen(hdr->frame_control);
3379 
3380 	pn = ehdr[0];
3381 	pn |= (u64)ehdr[1] << 8;
3382 	pn |= (u64)ehdr[4] << 16;
3383 	pn |= (u64)ehdr[5] << 24;
3384 	pn |= (u64)ehdr[6] << 32;
3385 	pn |= (u64)ehdr[7] << 40;
3386 
3387 	return pn;
3388 }
3389 
3390 static bool
3391 ath11k_dp_rx_h_defrag_validate_incr_pn(struct ath11k *ar, struct dp_rx_tid *rx_tid)
3392 {
3393 	enum hal_encrypt_type encrypt_type;
3394 	struct sk_buff *first_frag, *skb;
3395 	struct hal_rx_desc *desc;
3396 	u64 last_pn;
3397 	u64 cur_pn;
3398 
3399 	first_frag = skb_peek(&rx_tid->rx_frags);
3400 	desc = (struct hal_rx_desc *)first_frag->data;
3401 
3402 	encrypt_type = ath11k_dp_rx_h_mpdu_start_enctype(desc);
3403 	if (encrypt_type != HAL_ENCRYPT_TYPE_CCMP_128 &&
3404 	    encrypt_type != HAL_ENCRYPT_TYPE_CCMP_256 &&
3405 	    encrypt_type != HAL_ENCRYPT_TYPE_GCMP_128 &&
3406 	    encrypt_type != HAL_ENCRYPT_TYPE_AES_GCMP_256)
3407 		return true;
3408 
3409 	last_pn = ath11k_dp_rx_h_get_pn(first_frag);
3410 	skb_queue_walk(&rx_tid->rx_frags, skb) {
3411 		if (skb == first_frag)
3412 			continue;
3413 
3414 		cur_pn = ath11k_dp_rx_h_get_pn(skb);
3415 		if (cur_pn != last_pn + 1)
3416 			return false;
3417 		last_pn = cur_pn;
3418 	}
3419 	return true;
3420 }
3421 
3422 static int ath11k_dp_rx_frag_h_mpdu(struct ath11k *ar,
3423 				    struct sk_buff *msdu,
3424 				    u32 *ring_desc)
3425 {
3426 	struct ath11k_base *ab = ar->ab;
3427 	struct hal_rx_desc *rx_desc;
3428 	struct ath11k_peer *peer;
3429 	struct dp_rx_tid *rx_tid;
3430 	struct sk_buff *defrag_skb = NULL;
3431 	u32 peer_id;
3432 	u16 seqno, frag_no;
3433 	u8 tid;
3434 	int ret = 0;
3435 	bool more_frags;
3436 
3437 	rx_desc = (struct hal_rx_desc *)msdu->data;
3438 	peer_id = ath11k_dp_rx_h_mpdu_start_peer_id(rx_desc);
3439 	tid = ath11k_dp_rx_h_mpdu_start_tid(rx_desc);
3440 	seqno = ath11k_dp_rx_h_mpdu_start_seq_no(rx_desc);
3441 	frag_no = ath11k_dp_rx_h_mpdu_start_frag_no(msdu);
3442 	more_frags = ath11k_dp_rx_h_mpdu_start_more_frags(msdu);
3443 
3444 	if (!ath11k_dp_rx_h_mpdu_start_seq_ctrl_valid(rx_desc) ||
3445 	    !ath11k_dp_rx_h_mpdu_start_fc_valid(rx_desc) ||
3446 	    tid > IEEE80211_NUM_TIDS)
3447 		return -EINVAL;
3448 
3449 	/* received unfragmented packet in reo
3450 	 * exception ring, this shouldn't happen
3451 	 * as these packets typically come from
3452 	 * reo2sw srngs.
3453 	 */
3454 	if (WARN_ON_ONCE(!frag_no && !more_frags))
3455 		return -EINVAL;
3456 
3457 	spin_lock_bh(&ab->base_lock);
3458 	peer = ath11k_peer_find_by_id(ab, peer_id);
3459 	if (!peer) {
3460 		ath11k_warn(ab, "failed to find the peer to de-fragment received fragment peer_id %d\n",
3461 			    peer_id);
3462 		ret = -ENOENT;
3463 		goto out_unlock;
3464 	}
3465 	rx_tid = &peer->rx_tid[tid];
3466 
3467 	if ((!skb_queue_empty(&rx_tid->rx_frags) && seqno != rx_tid->cur_sn) ||
3468 	    skb_queue_empty(&rx_tid->rx_frags)) {
3469 		/* Flush stored fragments and start a new sequence */
3470 		ath11k_dp_rx_frags_cleanup(rx_tid, true);
3471 		rx_tid->cur_sn = seqno;
3472 	}
3473 
3474 	if (rx_tid->rx_frag_bitmap & BIT(frag_no)) {
3475 		/* Fragment already present */
3476 		ret = -EINVAL;
3477 		goto out_unlock;
3478 	}
3479 
3480 	if (frag_no > __fls(rx_tid->rx_frag_bitmap))
3481 		__skb_queue_tail(&rx_tid->rx_frags, msdu);
3482 	else
3483 		ath11k_dp_rx_h_sort_frags(&rx_tid->rx_frags, msdu);
3484 
3485 	rx_tid->rx_frag_bitmap |= BIT(frag_no);
3486 	if (!more_frags)
3487 		rx_tid->last_frag_no = frag_no;
3488 
3489 	if (frag_no == 0) {
3490 		rx_tid->dst_ring_desc = kmemdup(ring_desc,
3491 						sizeof(*rx_tid->dst_ring_desc),
3492 						GFP_ATOMIC);
3493 		if (!rx_tid->dst_ring_desc) {
3494 			ret = -ENOMEM;
3495 			goto out_unlock;
3496 		}
3497 	} else {
3498 		ath11k_dp_rx_link_desc_return(ab, ring_desc,
3499 					      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
3500 	}
3501 
3502 	if (!rx_tid->last_frag_no ||
3503 	    rx_tid->rx_frag_bitmap != GENMASK(rx_tid->last_frag_no, 0)) {
3504 		mod_timer(&rx_tid->frag_timer, jiffies +
3505 					       ATH11K_DP_RX_FRAGMENT_TIMEOUT_MS);
3506 		goto out_unlock;
3507 	}
3508 
3509 	spin_unlock_bh(&ab->base_lock);
3510 	del_timer_sync(&rx_tid->frag_timer);
3511 	spin_lock_bh(&ab->base_lock);
3512 
3513 	peer = ath11k_peer_find_by_id(ab, peer_id);
3514 	if (!peer)
3515 		goto err_frags_cleanup;
3516 
3517 	if (!ath11k_dp_rx_h_defrag_validate_incr_pn(ar, rx_tid))
3518 		goto err_frags_cleanup;
3519 
3520 	if (ath11k_dp_rx_h_defrag(ar, peer, rx_tid, &defrag_skb))
3521 		goto err_frags_cleanup;
3522 
3523 	if (!defrag_skb)
3524 		goto err_frags_cleanup;
3525 
3526 	if (ath11k_dp_rx_h_defrag_reo_reinject(ar, rx_tid, defrag_skb))
3527 		goto err_frags_cleanup;
3528 
3529 	ath11k_dp_rx_frags_cleanup(rx_tid, false);
3530 	goto out_unlock;
3531 
3532 err_frags_cleanup:
3533 	dev_kfree_skb_any(defrag_skb);
3534 	ath11k_dp_rx_frags_cleanup(rx_tid, true);
3535 out_unlock:
3536 	spin_unlock_bh(&ab->base_lock);
3537 	return ret;
3538 }
3539 
3540 static int
3541 ath11k_dp_process_rx_err_buf(struct ath11k *ar, u32 *ring_desc, int buf_id, bool drop)
3542 {
3543 	struct ath11k_pdev_dp *dp = &ar->dp;
3544 	struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
3545 	struct sk_buff *msdu;
3546 	struct ath11k_skb_rxcb *rxcb;
3547 	struct hal_rx_desc *rx_desc;
3548 	u8 *hdr_status;
3549 	u16 msdu_len;
3550 
3551 	spin_lock_bh(&rx_ring->idr_lock);
3552 	msdu = idr_find(&rx_ring->bufs_idr, buf_id);
3553 	if (!msdu) {
3554 		ath11k_warn(ar->ab, "rx err buf with invalid buf_id %d\n",
3555 			    buf_id);
3556 		spin_unlock_bh(&rx_ring->idr_lock);
3557 		return -EINVAL;
3558 	}
3559 
3560 	idr_remove(&rx_ring->bufs_idr, buf_id);
3561 	spin_unlock_bh(&rx_ring->idr_lock);
3562 
3563 	rxcb = ATH11K_SKB_RXCB(msdu);
3564 	dma_unmap_single(ar->ab->dev, rxcb->paddr,
3565 			 msdu->len + skb_tailroom(msdu),
3566 			 DMA_FROM_DEVICE);
3567 
3568 	if (drop) {
3569 		dev_kfree_skb_any(msdu);
3570 		return 0;
3571 	}
3572 
3573 	rcu_read_lock();
3574 	if (!rcu_dereference(ar->ab->pdevs_active[ar->pdev_idx])) {
3575 		dev_kfree_skb_any(msdu);
3576 		goto exit;
3577 	}
3578 
3579 	if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
3580 		dev_kfree_skb_any(msdu);
3581 		goto exit;
3582 	}
3583 
3584 	rx_desc = (struct hal_rx_desc *)msdu->data;
3585 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(rx_desc);
3586 	if ((msdu_len + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE) {
3587 		hdr_status = ath11k_dp_rx_h_80211_hdr(rx_desc);
3588 		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
3589 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
3590 				sizeof(struct ieee80211_hdr));
3591 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
3592 				sizeof(struct hal_rx_desc));
3593 		dev_kfree_skb_any(msdu);
3594 		goto exit;
3595 	}
3596 
3597 	skb_put(msdu, HAL_RX_DESC_SIZE + msdu_len);
3598 
3599 	if (ath11k_dp_rx_frag_h_mpdu(ar, msdu, ring_desc)) {
3600 		dev_kfree_skb_any(msdu);
3601 		ath11k_dp_rx_link_desc_return(ar->ab, ring_desc,
3602 					      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
3603 	}
3604 exit:
3605 	rcu_read_unlock();
3606 	return 0;
3607 }
3608 
3609 int ath11k_dp_process_rx_err(struct ath11k_base *ab, struct napi_struct *napi,
3610 			     int budget)
3611 {
3612 	u32 msdu_cookies[HAL_NUM_RX_MSDUS_PER_LINK_DESC];
3613 	struct dp_link_desc_bank *link_desc_banks;
3614 	enum hal_rx_buf_return_buf_manager rbm;
3615 	int tot_n_bufs_reaped, quota, ret, i;
3616 	int n_bufs_reaped[MAX_RADIOS] = {0};
3617 	struct dp_rxdma_ring *rx_ring;
3618 	struct dp_srng *reo_except;
3619 	u32 desc_bank, num_msdus;
3620 	struct hal_srng *srng;
3621 	struct ath11k_dp *dp;
3622 	void *link_desc_va;
3623 	int buf_id, mac_id;
3624 	struct ath11k *ar;
3625 	dma_addr_t paddr;
3626 	u32 *desc;
3627 	bool is_frag;
3628 	u8 drop = 0;
3629 
3630 	tot_n_bufs_reaped = 0;
3631 	quota = budget;
3632 
3633 	dp = &ab->dp;
3634 	reo_except = &dp->reo_except_ring;
3635 	link_desc_banks = dp->link_desc_banks;
3636 
3637 	srng = &ab->hal.srng_list[reo_except->ring_id];
3638 
3639 	spin_lock_bh(&srng->lock);
3640 
3641 	ath11k_hal_srng_access_begin(ab, srng);
3642 
3643 	while (budget &&
3644 	       (desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
3645 		struct hal_reo_dest_ring *reo_desc = (struct hal_reo_dest_ring *)desc;
3646 
3647 		ab->soc_stats.err_ring_pkts++;
3648 		ret = ath11k_hal_desc_reo_parse_err(ab, desc, &paddr,
3649 						    &desc_bank);
3650 		if (ret) {
3651 			ath11k_warn(ab, "failed to parse error reo desc %d\n",
3652 				    ret);
3653 			continue;
3654 		}
3655 		link_desc_va = link_desc_banks[desc_bank].vaddr +
3656 			       (paddr - link_desc_banks[desc_bank].paddr);
3657 		ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus, msdu_cookies,
3658 						 &rbm);
3659 		if (rbm != HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST &&
3660 		    rbm != HAL_RX_BUF_RBM_SW3_BM) {
3661 			ab->soc_stats.invalid_rbm++;
3662 			ath11k_warn(ab, "invalid return buffer manager %d\n", rbm);
3663 			ath11k_dp_rx_link_desc_return(ab, desc,
3664 						      HAL_WBM_REL_BM_ACT_REL_MSDU);
3665 			continue;
3666 		}
3667 
3668 		is_frag = !!(reo_desc->rx_mpdu_info.info0 & RX_MPDU_DESC_INFO0_FRAG_FLAG);
3669 
3670 		/* Process only rx fragments with one msdu per link desc below, and drop
3671 		 * msdu's indicated due to error reasons.
3672 		 */
3673 		if (!is_frag || num_msdus > 1) {
3674 			drop = 1;
3675 			/* Return the link desc back to wbm idle list */
3676 			ath11k_dp_rx_link_desc_return(ab, desc,
3677 						      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
3678 		}
3679 
3680 		for (i = 0; i < num_msdus; i++) {
3681 			buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
3682 					   msdu_cookies[i]);
3683 
3684 			mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID,
3685 					   msdu_cookies[i]);
3686 
3687 			ar = ab->pdevs[mac_id].ar;
3688 
3689 			if (!ath11k_dp_process_rx_err_buf(ar, desc, buf_id, drop)) {
3690 				n_bufs_reaped[mac_id]++;
3691 				tot_n_bufs_reaped++;
3692 			}
3693 		}
3694 
3695 		if (tot_n_bufs_reaped >= quota) {
3696 			tot_n_bufs_reaped = quota;
3697 			goto exit;
3698 		}
3699 
3700 		budget = quota - tot_n_bufs_reaped;
3701 	}
3702 
3703 exit:
3704 	ath11k_hal_srng_access_end(ab, srng);
3705 
3706 	spin_unlock_bh(&srng->lock);
3707 
3708 	for (i = 0; i <  ab->num_radios; i++) {
3709 		if (!n_bufs_reaped[i])
3710 			continue;
3711 
3712 		ar = ab->pdevs[i].ar;
3713 		rx_ring = &ar->dp.rx_refill_buf_ring;
3714 
3715 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, n_bufs_reaped[i],
3716 					   HAL_RX_BUF_RBM_SW3_BM);
3717 	}
3718 
3719 	return tot_n_bufs_reaped;
3720 }
3721 
3722 static void ath11k_dp_rx_null_q_desc_sg_drop(struct ath11k *ar,
3723 					     int msdu_len,
3724 					     struct sk_buff_head *msdu_list)
3725 {
3726 	struct sk_buff *skb, *tmp;
3727 	struct ath11k_skb_rxcb *rxcb;
3728 	int n_buffs;
3729 
3730 	n_buffs = DIV_ROUND_UP(msdu_len,
3731 			       (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE));
3732 
3733 	skb_queue_walk_safe(msdu_list, skb, tmp) {
3734 		rxcb = ATH11K_SKB_RXCB(skb);
3735 		if (rxcb->err_rel_src == HAL_WBM_REL_SRC_MODULE_REO &&
3736 		    rxcb->err_code == HAL_REO_DEST_RING_ERROR_CODE_DESC_ADDR_ZERO) {
3737 			if (!n_buffs)
3738 				break;
3739 			__skb_unlink(skb, msdu_list);
3740 			dev_kfree_skb_any(skb);
3741 			n_buffs--;
3742 		}
3743 	}
3744 }
3745 
3746 static int ath11k_dp_rx_h_null_q_desc(struct ath11k *ar, struct sk_buff *msdu,
3747 				      struct ieee80211_rx_status *status,
3748 				      struct sk_buff_head *msdu_list)
3749 {
3750 	u16 msdu_len;
3751 	struct hal_rx_desc *desc = (struct hal_rx_desc *)msdu->data;
3752 	u8 l3pad_bytes;
3753 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3754 
3755 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(desc);
3756 
3757 	if (!rxcb->is_frag && ((msdu_len + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE)) {
3758 		/* First buffer will be freed by the caller, so deduct it's length */
3759 		msdu_len = msdu_len - (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE);
3760 		ath11k_dp_rx_null_q_desc_sg_drop(ar, msdu_len, msdu_list);
3761 		return -EINVAL;
3762 	}
3763 
3764 	if (!ath11k_dp_rx_h_attn_msdu_done(desc)) {
3765 		ath11k_warn(ar->ab,
3766 			    "msdu_done bit not set in null_q_des processing\n");
3767 		__skb_queue_purge(msdu_list);
3768 		return -EIO;
3769 	}
3770 
3771 	/* Handle NULL queue descriptor violations arising out a missing
3772 	 * REO queue for a given peer or a given TID. This typically
3773 	 * may happen if a packet is received on a QOS enabled TID before the
3774 	 * ADDBA negotiation for that TID, when the TID queue is setup. Or
3775 	 * it may also happen for MC/BC frames if they are not routed to the
3776 	 * non-QOS TID queue, in the absence of any other default TID queue.
3777 	 * This error can show up both in a REO destination or WBM release ring.
3778 	 */
3779 
3780 	rxcb->is_first_msdu = ath11k_dp_rx_h_msdu_end_first_msdu(desc);
3781 	rxcb->is_last_msdu = ath11k_dp_rx_h_msdu_end_last_msdu(desc);
3782 
3783 	if (rxcb->is_frag) {
3784 		skb_pull(msdu, HAL_RX_DESC_SIZE);
3785 	} else {
3786 		l3pad_bytes = ath11k_dp_rx_h_msdu_end_l3pad(desc);
3787 
3788 		if ((HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len) > DP_RX_BUFFER_SIZE)
3789 			return -EINVAL;
3790 
3791 		skb_put(msdu, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len);
3792 		skb_pull(msdu, HAL_RX_DESC_SIZE + l3pad_bytes);
3793 	}
3794 	ath11k_dp_rx_h_ppdu(ar, desc, status);
3795 
3796 	ath11k_dp_rx_h_mpdu(ar, msdu, desc, status);
3797 
3798 	rxcb->tid = ath11k_dp_rx_h_mpdu_start_tid(desc);
3799 
3800 	/* Please note that caller will having the access to msdu and completing
3801 	 * rx with mac80211. Need not worry about cleaning up amsdu_list.
3802 	 */
3803 
3804 	return 0;
3805 }
3806 
3807 static bool ath11k_dp_rx_h_reo_err(struct ath11k *ar, struct sk_buff *msdu,
3808 				   struct ieee80211_rx_status *status,
3809 				   struct sk_buff_head *msdu_list)
3810 {
3811 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3812 	bool drop = false;
3813 
3814 	ar->ab->soc_stats.reo_error[rxcb->err_code]++;
3815 
3816 	switch (rxcb->err_code) {
3817 	case HAL_REO_DEST_RING_ERROR_CODE_DESC_ADDR_ZERO:
3818 		if (ath11k_dp_rx_h_null_q_desc(ar, msdu, status, msdu_list))
3819 			drop = true;
3820 		break;
3821 	case HAL_REO_DEST_RING_ERROR_CODE_PN_CHECK_FAILED:
3822 		/* TODO: Do not drop PN failed packets in the driver;
3823 		 * instead, it is good to drop such packets in mac80211
3824 		 * after incrementing the replay counters.
3825 		 */
3826 		fallthrough;
3827 	default:
3828 		/* TODO: Review other errors and process them to mac80211
3829 		 * as appropriate.
3830 		 */
3831 		drop = true;
3832 		break;
3833 	}
3834 
3835 	return drop;
3836 }
3837 
3838 static void ath11k_dp_rx_h_tkip_mic_err(struct ath11k *ar, struct sk_buff *msdu,
3839 					struct ieee80211_rx_status *status)
3840 {
3841 	u16 msdu_len;
3842 	struct hal_rx_desc *desc = (struct hal_rx_desc *)msdu->data;
3843 	u8 l3pad_bytes;
3844 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3845 
3846 	rxcb->is_first_msdu = ath11k_dp_rx_h_msdu_end_first_msdu(desc);
3847 	rxcb->is_last_msdu = ath11k_dp_rx_h_msdu_end_last_msdu(desc);
3848 
3849 	l3pad_bytes = ath11k_dp_rx_h_msdu_end_l3pad(desc);
3850 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(desc);
3851 	skb_put(msdu, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len);
3852 	skb_pull(msdu, HAL_RX_DESC_SIZE + l3pad_bytes);
3853 
3854 	ath11k_dp_rx_h_ppdu(ar, desc, status);
3855 
3856 	status->flag |= (RX_FLAG_MMIC_STRIPPED | RX_FLAG_MMIC_ERROR |
3857 			 RX_FLAG_DECRYPTED);
3858 
3859 	ath11k_dp_rx_h_undecap(ar, msdu, desc,
3860 			       HAL_ENCRYPT_TYPE_TKIP_MIC, status, false);
3861 }
3862 
3863 static bool ath11k_dp_rx_h_rxdma_err(struct ath11k *ar,  struct sk_buff *msdu,
3864 				     struct ieee80211_rx_status *status)
3865 {
3866 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3867 	bool drop = false;
3868 
3869 	ar->ab->soc_stats.rxdma_error[rxcb->err_code]++;
3870 
3871 	switch (rxcb->err_code) {
3872 	case HAL_REO_ENTR_RING_RXDMA_ECODE_TKIP_MIC_ERR:
3873 		ath11k_dp_rx_h_tkip_mic_err(ar, msdu, status);
3874 		break;
3875 	default:
3876 		/* TODO: Review other rxdma error code to check if anything is
3877 		 * worth reporting to mac80211
3878 		 */
3879 		drop = true;
3880 		break;
3881 	}
3882 
3883 	return drop;
3884 }
3885 
3886 static void ath11k_dp_rx_wbm_err(struct ath11k *ar,
3887 				 struct napi_struct *napi,
3888 				 struct sk_buff *msdu,
3889 				 struct sk_buff_head *msdu_list)
3890 {
3891 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
3892 	struct ieee80211_rx_status rxs = {0};
3893 	struct ieee80211_rx_status *status;
3894 	bool drop = true;
3895 
3896 	switch (rxcb->err_rel_src) {
3897 	case HAL_WBM_REL_SRC_MODULE_REO:
3898 		drop = ath11k_dp_rx_h_reo_err(ar, msdu, &rxs, msdu_list);
3899 		break;
3900 	case HAL_WBM_REL_SRC_MODULE_RXDMA:
3901 		drop = ath11k_dp_rx_h_rxdma_err(ar, msdu, &rxs);
3902 		break;
3903 	default:
3904 		/* msdu will get freed */
3905 		break;
3906 	}
3907 
3908 	if (drop) {
3909 		dev_kfree_skb_any(msdu);
3910 		return;
3911 	}
3912 
3913 	status = IEEE80211_SKB_RXCB(msdu);
3914 	*status = rxs;
3915 
3916 	ath11k_dp_rx_deliver_msdu(ar, napi, msdu);
3917 }
3918 
3919 int ath11k_dp_rx_process_wbm_err(struct ath11k_base *ab,
3920 				 struct napi_struct *napi, int budget)
3921 {
3922 	struct ath11k *ar;
3923 	struct ath11k_dp *dp = &ab->dp;
3924 	struct dp_rxdma_ring *rx_ring;
3925 	struct hal_rx_wbm_rel_info err_info;
3926 	struct hal_srng *srng;
3927 	struct sk_buff *msdu;
3928 	struct sk_buff_head msdu_list[MAX_RADIOS];
3929 	struct ath11k_skb_rxcb *rxcb;
3930 	u32 *rx_desc;
3931 	int buf_id, mac_id;
3932 	int num_buffs_reaped[MAX_RADIOS] = {0};
3933 	int total_num_buffs_reaped = 0;
3934 	int ret, i;
3935 
3936 	for (i = 0; i < ab->num_radios; i++)
3937 		__skb_queue_head_init(&msdu_list[i]);
3938 
3939 	srng = &ab->hal.srng_list[dp->rx_rel_ring.ring_id];
3940 
3941 	spin_lock_bh(&srng->lock);
3942 
3943 	ath11k_hal_srng_access_begin(ab, srng);
3944 
3945 	while (budget) {
3946 		rx_desc = ath11k_hal_srng_dst_get_next_entry(ab, srng);
3947 		if (!rx_desc)
3948 			break;
3949 
3950 		ret = ath11k_hal_wbm_desc_parse_err(ab, rx_desc, &err_info);
3951 		if (ret) {
3952 			ath11k_warn(ab,
3953 				    "failed to parse rx error in wbm_rel ring desc %d\n",
3954 				    ret);
3955 			continue;
3956 		}
3957 
3958 		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID, err_info.cookie);
3959 		mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, err_info.cookie);
3960 
3961 		ar = ab->pdevs[mac_id].ar;
3962 		rx_ring = &ar->dp.rx_refill_buf_ring;
3963 
3964 		spin_lock_bh(&rx_ring->idr_lock);
3965 		msdu = idr_find(&rx_ring->bufs_idr, buf_id);
3966 		if (!msdu) {
3967 			ath11k_warn(ab, "frame rx with invalid buf_id %d pdev %d\n",
3968 				    buf_id, mac_id);
3969 			spin_unlock_bh(&rx_ring->idr_lock);
3970 			continue;
3971 		}
3972 
3973 		idr_remove(&rx_ring->bufs_idr, buf_id);
3974 		spin_unlock_bh(&rx_ring->idr_lock);
3975 
3976 		rxcb = ATH11K_SKB_RXCB(msdu);
3977 		dma_unmap_single(ab->dev, rxcb->paddr,
3978 				 msdu->len + skb_tailroom(msdu),
3979 				 DMA_FROM_DEVICE);
3980 
3981 		num_buffs_reaped[mac_id]++;
3982 		total_num_buffs_reaped++;
3983 		budget--;
3984 
3985 		if (err_info.push_reason !=
3986 		    HAL_REO_DEST_RING_PUSH_REASON_ERR_DETECTED) {
3987 			dev_kfree_skb_any(msdu);
3988 			continue;
3989 		}
3990 
3991 		rxcb->err_rel_src = err_info.err_rel_src;
3992 		rxcb->err_code = err_info.err_code;
3993 		rxcb->rx_desc = (struct hal_rx_desc *)msdu->data;
3994 		__skb_queue_tail(&msdu_list[mac_id], msdu);
3995 	}
3996 
3997 	ath11k_hal_srng_access_end(ab, srng);
3998 
3999 	spin_unlock_bh(&srng->lock);
4000 
4001 	if (!total_num_buffs_reaped)
4002 		goto done;
4003 
4004 	for (i = 0; i <  ab->num_radios; i++) {
4005 		if (!num_buffs_reaped[i])
4006 			continue;
4007 
4008 		ar = ab->pdevs[i].ar;
4009 		rx_ring = &ar->dp.rx_refill_buf_ring;
4010 
4011 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
4012 					   HAL_RX_BUF_RBM_SW3_BM);
4013 	}
4014 
4015 	rcu_read_lock();
4016 	for (i = 0; i <  ab->num_radios; i++) {
4017 		if (!rcu_dereference(ab->pdevs_active[i])) {
4018 			__skb_queue_purge(&msdu_list[i]);
4019 			continue;
4020 		}
4021 
4022 		ar = ab->pdevs[i].ar;
4023 
4024 		if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
4025 			__skb_queue_purge(&msdu_list[i]);
4026 			continue;
4027 		}
4028 
4029 		while ((msdu = __skb_dequeue(&msdu_list[i])) != NULL)
4030 			ath11k_dp_rx_wbm_err(ar, napi, msdu, &msdu_list[i]);
4031 	}
4032 	rcu_read_unlock();
4033 done:
4034 	return total_num_buffs_reaped;
4035 }
4036 
4037 int ath11k_dp_process_rxdma_err(struct ath11k_base *ab, int mac_id, int budget)
4038 {
4039 	struct ath11k *ar;
4040 	struct dp_srng *err_ring;
4041 	struct dp_rxdma_ring *rx_ring;
4042 	struct dp_link_desc_bank *link_desc_banks = ab->dp.link_desc_banks;
4043 	struct hal_srng *srng;
4044 	u32 msdu_cookies[HAL_NUM_RX_MSDUS_PER_LINK_DESC];
4045 	enum hal_rx_buf_return_buf_manager rbm;
4046 	enum hal_reo_entr_rxdma_ecode rxdma_err_code;
4047 	struct ath11k_skb_rxcb *rxcb;
4048 	struct sk_buff *skb;
4049 	struct hal_reo_entrance_ring *entr_ring;
4050 	void *desc;
4051 	int num_buf_freed = 0;
4052 	int quota = budget;
4053 	dma_addr_t paddr;
4054 	u32 desc_bank;
4055 	void *link_desc_va;
4056 	int num_msdus;
4057 	int i;
4058 	int buf_id;
4059 
4060 	ar = ab->pdevs[ath11k_hw_mac_id_to_pdev_id(&ab->hw_params, mac_id)].ar;
4061 	err_ring = &ar->dp.rxdma_err_dst_ring[ath11k_hw_mac_id_to_srng_id(&ab->hw_params,
4062 									  mac_id)];
4063 	rx_ring = &ar->dp.rx_refill_buf_ring;
4064 
4065 	srng = &ab->hal.srng_list[err_ring->ring_id];
4066 
4067 	spin_lock_bh(&srng->lock);
4068 
4069 	ath11k_hal_srng_access_begin(ab, srng);
4070 
4071 	while (quota-- &&
4072 	       (desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
4073 		ath11k_hal_rx_reo_ent_paddr_get(ab, desc, &paddr, &desc_bank);
4074 
4075 		entr_ring = (struct hal_reo_entrance_ring *)desc;
4076 		rxdma_err_code =
4077 			FIELD_GET(HAL_REO_ENTR_RING_INFO1_RXDMA_ERROR_CODE,
4078 				  entr_ring->info1);
4079 		ab->soc_stats.rxdma_error[rxdma_err_code]++;
4080 
4081 		link_desc_va = link_desc_banks[desc_bank].vaddr +
4082 			       (paddr - link_desc_banks[desc_bank].paddr);
4083 		ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus,
4084 						 msdu_cookies, &rbm);
4085 
4086 		for (i = 0; i < num_msdus; i++) {
4087 			buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
4088 					   msdu_cookies[i]);
4089 
4090 			spin_lock_bh(&rx_ring->idr_lock);
4091 			skb = idr_find(&rx_ring->bufs_idr, buf_id);
4092 			if (!skb) {
4093 				ath11k_warn(ab, "rxdma error with invalid buf_id %d\n",
4094 					    buf_id);
4095 				spin_unlock_bh(&rx_ring->idr_lock);
4096 				continue;
4097 			}
4098 
4099 			idr_remove(&rx_ring->bufs_idr, buf_id);
4100 			spin_unlock_bh(&rx_ring->idr_lock);
4101 
4102 			rxcb = ATH11K_SKB_RXCB(skb);
4103 			dma_unmap_single(ab->dev, rxcb->paddr,
4104 					 skb->len + skb_tailroom(skb),
4105 					 DMA_FROM_DEVICE);
4106 			dev_kfree_skb_any(skb);
4107 
4108 			num_buf_freed++;
4109 		}
4110 
4111 		ath11k_dp_rx_link_desc_return(ab, desc,
4112 					      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
4113 	}
4114 
4115 	ath11k_hal_srng_access_end(ab, srng);
4116 
4117 	spin_unlock_bh(&srng->lock);
4118 
4119 	if (num_buf_freed)
4120 		ath11k_dp_rxbufs_replenish(ab, mac_id, rx_ring, num_buf_freed,
4121 					   HAL_RX_BUF_RBM_SW3_BM);
4122 
4123 	return budget - quota;
4124 }
4125 
4126 void ath11k_dp_process_reo_status(struct ath11k_base *ab)
4127 {
4128 	struct ath11k_dp *dp = &ab->dp;
4129 	struct hal_srng *srng;
4130 	struct dp_reo_cmd *cmd, *tmp;
4131 	bool found = false;
4132 	u32 *reo_desc;
4133 	u16 tag;
4134 	struct hal_reo_status reo_status;
4135 
4136 	srng = &ab->hal.srng_list[dp->reo_status_ring.ring_id];
4137 
4138 	memset(&reo_status, 0, sizeof(reo_status));
4139 
4140 	spin_lock_bh(&srng->lock);
4141 
4142 	ath11k_hal_srng_access_begin(ab, srng);
4143 
4144 	while ((reo_desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
4145 		tag = FIELD_GET(HAL_SRNG_TLV_HDR_TAG, *reo_desc);
4146 
4147 		switch (tag) {
4148 		case HAL_REO_GET_QUEUE_STATS_STATUS:
4149 			ath11k_hal_reo_status_queue_stats(ab, reo_desc,
4150 							  &reo_status);
4151 			break;
4152 		case HAL_REO_FLUSH_QUEUE_STATUS:
4153 			ath11k_hal_reo_flush_queue_status(ab, reo_desc,
4154 							  &reo_status);
4155 			break;
4156 		case HAL_REO_FLUSH_CACHE_STATUS:
4157 			ath11k_hal_reo_flush_cache_status(ab, reo_desc,
4158 							  &reo_status);
4159 			break;
4160 		case HAL_REO_UNBLOCK_CACHE_STATUS:
4161 			ath11k_hal_reo_unblk_cache_status(ab, reo_desc,
4162 							  &reo_status);
4163 			break;
4164 		case HAL_REO_FLUSH_TIMEOUT_LIST_STATUS:
4165 			ath11k_hal_reo_flush_timeout_list_status(ab, reo_desc,
4166 								 &reo_status);
4167 			break;
4168 		case HAL_REO_DESCRIPTOR_THRESHOLD_REACHED_STATUS:
4169 			ath11k_hal_reo_desc_thresh_reached_status(ab, reo_desc,
4170 								  &reo_status);
4171 			break;
4172 		case HAL_REO_UPDATE_RX_REO_QUEUE_STATUS:
4173 			ath11k_hal_reo_update_rx_reo_queue_status(ab, reo_desc,
4174 								  &reo_status);
4175 			break;
4176 		default:
4177 			ath11k_warn(ab, "Unknown reo status type %d\n", tag);
4178 			continue;
4179 		}
4180 
4181 		spin_lock_bh(&dp->reo_cmd_lock);
4182 		list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
4183 			if (reo_status.uniform_hdr.cmd_num == cmd->cmd_num) {
4184 				found = true;
4185 				list_del(&cmd->list);
4186 				break;
4187 			}
4188 		}
4189 		spin_unlock_bh(&dp->reo_cmd_lock);
4190 
4191 		if (found) {
4192 			cmd->handler(dp, (void *)&cmd->data,
4193 				     reo_status.uniform_hdr.cmd_status);
4194 			kfree(cmd);
4195 		}
4196 
4197 		found = false;
4198 	}
4199 
4200 	ath11k_hal_srng_access_end(ab, srng);
4201 
4202 	spin_unlock_bh(&srng->lock);
4203 }
4204 
4205 void ath11k_dp_rx_pdev_free(struct ath11k_base *ab, int mac_id)
4206 {
4207 	struct ath11k *ar = ab->pdevs[mac_id].ar;
4208 
4209 	ath11k_dp_rx_pdev_srng_free(ar);
4210 	ath11k_dp_rxdma_pdev_buf_free(ar);
4211 }
4212 
4213 int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
4214 {
4215 	struct ath11k *ar = ab->pdevs[mac_id].ar;
4216 	struct ath11k_pdev_dp *dp = &ar->dp;
4217 	u32 ring_id;
4218 	int i;
4219 	int ret;
4220 
4221 	ret = ath11k_dp_rx_pdev_srng_alloc(ar);
4222 	if (ret) {
4223 		ath11k_warn(ab, "failed to setup rx srngs\n");
4224 		return ret;
4225 	}
4226 
4227 	ret = ath11k_dp_rxdma_pdev_buf_setup(ar);
4228 	if (ret) {
4229 		ath11k_warn(ab, "failed to setup rxdma ring\n");
4230 		return ret;
4231 	}
4232 
4233 	ring_id = dp->rx_refill_buf_ring.refill_buf_ring.ring_id;
4234 	ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id, mac_id, HAL_RXDMA_BUF);
4235 	if (ret) {
4236 		ath11k_warn(ab, "failed to configure rx_refill_buf_ring %d\n",
4237 			    ret);
4238 		return ret;
4239 	}
4240 
4241 	if (ab->hw_params.rx_mac_buf_ring) {
4242 		for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
4243 			ring_id = dp->rx_mac_buf_ring[i].ring_id;
4244 			ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id,
4245 							  mac_id + i, HAL_RXDMA_BUF);
4246 			if (ret) {
4247 				ath11k_warn(ab, "failed to configure rx_mac_buf_ring%d %d\n",
4248 					    i, ret);
4249 				return ret;
4250 			}
4251 		}
4252 	}
4253 
4254 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
4255 		ring_id = dp->rxdma_err_dst_ring[i].ring_id;
4256 		ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id,
4257 						  mac_id + i, HAL_RXDMA_DST);
4258 		if (ret) {
4259 			ath11k_warn(ab, "failed to configure rxdma_err_dest_ring%d %d\n",
4260 				    i, ret);
4261 			return ret;
4262 		}
4263 	}
4264 
4265 	if (!ab->hw_params.rxdma1_enable)
4266 		goto config_refill_ring;
4267 
4268 	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
4269 	ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id,
4270 					  mac_id, HAL_RXDMA_MONITOR_BUF);
4271 	if (ret) {
4272 		ath11k_warn(ab, "failed to configure rxdma_mon_buf_ring %d\n",
4273 			    ret);
4274 		return ret;
4275 	}
4276 	ret = ath11k_dp_tx_htt_srng_setup(ab,
4277 					  dp->rxdma_mon_dst_ring.ring_id,
4278 					  mac_id, HAL_RXDMA_MONITOR_DST);
4279 	if (ret) {
4280 		ath11k_warn(ab, "failed to configure rxdma_mon_dst_ring %d\n",
4281 			    ret);
4282 		return ret;
4283 	}
4284 	ret = ath11k_dp_tx_htt_srng_setup(ab,
4285 					  dp->rxdma_mon_desc_ring.ring_id,
4286 					  mac_id, HAL_RXDMA_MONITOR_DESC);
4287 	if (ret) {
4288 		ath11k_warn(ab, "failed to configure rxdma_mon_dst_ring %d\n",
4289 			    ret);
4290 		return ret;
4291 	}
4292 
4293 config_refill_ring:
4294 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
4295 		ring_id = dp->rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
4296 		ret = ath11k_dp_tx_htt_srng_setup(ab, ring_id, mac_id + i,
4297 						  HAL_RXDMA_MONITOR_STATUS);
4298 		if (ret) {
4299 			ath11k_warn(ab,
4300 				    "failed to configure mon_status_refill_ring%d %d\n",
4301 				    i, ret);
4302 			return ret;
4303 		}
4304 	}
4305 
4306 	return 0;
4307 }
4308 
4309 static void ath11k_dp_mon_set_frag_len(u32 *total_len, u32 *frag_len)
4310 {
4311 	if (*total_len >= (DP_RX_BUFFER_SIZE - sizeof(struct hal_rx_desc))) {
4312 		*frag_len = DP_RX_BUFFER_SIZE - sizeof(struct hal_rx_desc);
4313 		*total_len -= *frag_len;
4314 	} else {
4315 		*frag_len = *total_len;
4316 		*total_len = 0;
4317 	}
4318 }
4319 
4320 static
4321 int ath11k_dp_rx_monitor_link_desc_return(struct ath11k *ar,
4322 					  void *p_last_buf_addr_info,
4323 					  u8 mac_id)
4324 {
4325 	struct ath11k_pdev_dp *dp = &ar->dp;
4326 	struct dp_srng *dp_srng;
4327 	void *hal_srng;
4328 	void *src_srng_desc;
4329 	int ret = 0;
4330 
4331 	if (ar->ab->hw_params.rxdma1_enable) {
4332 		dp_srng = &dp->rxdma_mon_desc_ring;
4333 		hal_srng = &ar->ab->hal.srng_list[dp_srng->ring_id];
4334 	} else {
4335 		dp_srng = &ar->ab->dp.wbm_desc_rel_ring;
4336 		hal_srng = &ar->ab->hal.srng_list[dp_srng->ring_id];
4337 	}
4338 
4339 	ath11k_hal_srng_access_begin(ar->ab, hal_srng);
4340 
4341 	src_srng_desc = ath11k_hal_srng_src_get_next_entry(ar->ab, hal_srng);
4342 
4343 	if (src_srng_desc) {
4344 		struct ath11k_buffer_addr *src_desc =
4345 				(struct ath11k_buffer_addr *)src_srng_desc;
4346 
4347 		*src_desc = *((struct ath11k_buffer_addr *)p_last_buf_addr_info);
4348 	} else {
4349 		ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4350 			   "Monitor Link Desc Ring %d Full", mac_id);
4351 		ret = -ENOMEM;
4352 	}
4353 
4354 	ath11k_hal_srng_access_end(ar->ab, hal_srng);
4355 	return ret;
4356 }
4357 
4358 static
4359 void ath11k_dp_rx_mon_next_link_desc_get(void *rx_msdu_link_desc,
4360 					 dma_addr_t *paddr, u32 *sw_cookie,
4361 					 u8 *rbm,
4362 					 void **pp_buf_addr_info)
4363 {
4364 	struct hal_rx_msdu_link *msdu_link =
4365 			(struct hal_rx_msdu_link *)rx_msdu_link_desc;
4366 	struct ath11k_buffer_addr *buf_addr_info;
4367 
4368 	buf_addr_info = (struct ath11k_buffer_addr *)&msdu_link->buf_addr_info;
4369 
4370 	ath11k_hal_rx_buf_addr_info_get(buf_addr_info, paddr, sw_cookie, rbm);
4371 
4372 	*pp_buf_addr_info = (void *)buf_addr_info;
4373 }
4374 
4375 static int ath11k_dp_pkt_set_pktlen(struct sk_buff *skb, u32 len)
4376 {
4377 	if (skb->len > len) {
4378 		skb_trim(skb, len);
4379 	} else {
4380 		if (skb_tailroom(skb) < len - skb->len) {
4381 			if ((pskb_expand_head(skb, 0,
4382 					      len - skb->len - skb_tailroom(skb),
4383 					      GFP_ATOMIC))) {
4384 				dev_kfree_skb_any(skb);
4385 				return -ENOMEM;
4386 			}
4387 		}
4388 		skb_put(skb, (len - skb->len));
4389 	}
4390 	return 0;
4391 }
4392 
4393 static void ath11k_hal_rx_msdu_list_get(struct ath11k *ar,
4394 					void *msdu_link_desc,
4395 					struct hal_rx_msdu_list *msdu_list,
4396 					u16 *num_msdus)
4397 {
4398 	struct hal_rx_msdu_details *msdu_details = NULL;
4399 	struct rx_msdu_desc *msdu_desc_info = NULL;
4400 	struct hal_rx_msdu_link *msdu_link = NULL;
4401 	int i;
4402 	u32 last = FIELD_PREP(RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU, 1);
4403 	u32 first = FIELD_PREP(RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU, 1);
4404 	u8  tmp  = 0;
4405 
4406 	msdu_link = (struct hal_rx_msdu_link *)msdu_link_desc;
4407 	msdu_details = &msdu_link->msdu_link[0];
4408 
4409 	for (i = 0; i < HAL_RX_NUM_MSDU_DESC; i++) {
4410 		if (FIELD_GET(BUFFER_ADDR_INFO0_ADDR,
4411 			      msdu_details[i].buf_addr_info.info0) == 0) {
4412 			msdu_desc_info = &msdu_details[i - 1].rx_msdu_info;
4413 			msdu_desc_info->info0 |= last;
4414 			;
4415 			break;
4416 		}
4417 		msdu_desc_info = &msdu_details[i].rx_msdu_info;
4418 
4419 		if (!i)
4420 			msdu_desc_info->info0 |= first;
4421 		else if (i == (HAL_RX_NUM_MSDU_DESC - 1))
4422 			msdu_desc_info->info0 |= last;
4423 		msdu_list->msdu_info[i].msdu_flags = msdu_desc_info->info0;
4424 		msdu_list->msdu_info[i].msdu_len =
4425 			 HAL_RX_MSDU_PKT_LENGTH_GET(msdu_desc_info->info0);
4426 		msdu_list->sw_cookie[i] =
4427 			FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
4428 				  msdu_details[i].buf_addr_info.info1);
4429 		tmp = FIELD_GET(BUFFER_ADDR_INFO1_RET_BUF_MGR,
4430 				msdu_details[i].buf_addr_info.info1);
4431 		msdu_list->rbm[i] = tmp;
4432 	}
4433 	*num_msdus = i;
4434 }
4435 
4436 static u32 ath11k_dp_rx_mon_comp_ppduid(u32 msdu_ppdu_id, u32 *ppdu_id,
4437 					u32 *rx_bufs_used)
4438 {
4439 	u32 ret = 0;
4440 
4441 	if ((*ppdu_id < msdu_ppdu_id) &&
4442 	    ((msdu_ppdu_id - *ppdu_id) < DP_NOT_PPDU_ID_WRAP_AROUND)) {
4443 		*ppdu_id = msdu_ppdu_id;
4444 		ret = msdu_ppdu_id;
4445 	} else if ((*ppdu_id > msdu_ppdu_id) &&
4446 		((*ppdu_id - msdu_ppdu_id) > DP_NOT_PPDU_ID_WRAP_AROUND)) {
4447 		/* mon_dst is behind than mon_status
4448 		 * skip dst_ring and free it
4449 		 */
4450 		*rx_bufs_used += 1;
4451 		*ppdu_id = msdu_ppdu_id;
4452 		ret = msdu_ppdu_id;
4453 	}
4454 	return ret;
4455 }
4456 
4457 static void ath11k_dp_mon_get_buf_len(struct hal_rx_msdu_desc_info *info,
4458 				      bool *is_frag, u32 *total_len,
4459 				      u32 *frag_len, u32 *msdu_cnt)
4460 {
4461 	if (info->msdu_flags & RX_MSDU_DESC_INFO0_MSDU_CONTINUATION) {
4462 		if (!*is_frag) {
4463 			*total_len = info->msdu_len;
4464 			*is_frag = true;
4465 		}
4466 		ath11k_dp_mon_set_frag_len(total_len,
4467 					   frag_len);
4468 	} else {
4469 		if (*is_frag) {
4470 			ath11k_dp_mon_set_frag_len(total_len,
4471 						   frag_len);
4472 		} else {
4473 			*frag_len = info->msdu_len;
4474 		}
4475 		*is_frag = false;
4476 		*msdu_cnt -= 1;
4477 	}
4478 }
4479 
4480 static u32
4481 ath11k_dp_rx_mon_mpdu_pop(struct ath11k *ar, int mac_id,
4482 			  void *ring_entry, struct sk_buff **head_msdu,
4483 			  struct sk_buff **tail_msdu, u32 *npackets,
4484 			  u32 *ppdu_id)
4485 {
4486 	struct ath11k_pdev_dp *dp = &ar->dp;
4487 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4488 	struct dp_rxdma_ring *rx_ring = &dp->rxdma_mon_buf_ring;
4489 	struct sk_buff *msdu = NULL, *last = NULL;
4490 	struct hal_rx_msdu_list msdu_list;
4491 	void *p_buf_addr_info, *p_last_buf_addr_info;
4492 	struct hal_rx_desc *rx_desc;
4493 	void *rx_msdu_link_desc;
4494 	dma_addr_t paddr;
4495 	u16 num_msdus = 0;
4496 	u32 rx_buf_size, rx_pkt_offset, sw_cookie;
4497 	u32 rx_bufs_used = 0, i = 0;
4498 	u32 msdu_ppdu_id = 0, msdu_cnt = 0;
4499 	u32 total_len = 0, frag_len = 0;
4500 	bool is_frag, is_first_msdu;
4501 	bool drop_mpdu = false;
4502 	struct ath11k_skb_rxcb *rxcb;
4503 	struct hal_reo_entrance_ring *ent_desc =
4504 			(struct hal_reo_entrance_ring *)ring_entry;
4505 	int buf_id;
4506 	u32 rx_link_buf_info[2];
4507 	u8 rbm;
4508 
4509 	if (!ar->ab->hw_params.rxdma1_enable)
4510 		rx_ring = &dp->rx_refill_buf_ring;
4511 
4512 	ath11k_hal_rx_reo_ent_buf_paddr_get(ring_entry, &paddr,
4513 					    &sw_cookie,
4514 					    &p_last_buf_addr_info, &rbm,
4515 					    &msdu_cnt);
4516 
4517 	if (FIELD_GET(HAL_REO_ENTR_RING_INFO1_RXDMA_PUSH_REASON,
4518 		      ent_desc->info1) ==
4519 		      HAL_REO_DEST_RING_PUSH_REASON_ERR_DETECTED) {
4520 		u8 rxdma_err =
4521 			FIELD_GET(HAL_REO_ENTR_RING_INFO1_RXDMA_ERROR_CODE,
4522 				  ent_desc->info1);
4523 		if (rxdma_err == HAL_REO_ENTR_RING_RXDMA_ECODE_FLUSH_REQUEST_ERR ||
4524 		    rxdma_err == HAL_REO_ENTR_RING_RXDMA_ECODE_MPDU_LEN_ERR ||
4525 		    rxdma_err == HAL_REO_ENTR_RING_RXDMA_ECODE_OVERFLOW_ERR) {
4526 			drop_mpdu = true;
4527 			pmon->rx_mon_stats.dest_mpdu_drop++;
4528 		}
4529 	}
4530 
4531 	is_frag = false;
4532 	is_first_msdu = true;
4533 
4534 	do {
4535 		if (pmon->mon_last_linkdesc_paddr == paddr) {
4536 			pmon->rx_mon_stats.dup_mon_linkdesc_cnt++;
4537 			return rx_bufs_used;
4538 		}
4539 
4540 		if (ar->ab->hw_params.rxdma1_enable)
4541 			rx_msdu_link_desc =
4542 				(void *)pmon->link_desc_banks[sw_cookie].vaddr +
4543 				(paddr - pmon->link_desc_banks[sw_cookie].paddr);
4544 		else
4545 			rx_msdu_link_desc =
4546 				(void *)ar->ab->dp.link_desc_banks[sw_cookie].vaddr +
4547 				(paddr - ar->ab->dp.link_desc_banks[sw_cookie].paddr);
4548 
4549 		ath11k_hal_rx_msdu_list_get(ar, rx_msdu_link_desc, &msdu_list,
4550 					    &num_msdus);
4551 
4552 		for (i = 0; i < num_msdus; i++) {
4553 			u32 l2_hdr_offset;
4554 
4555 			if (pmon->mon_last_buf_cookie == msdu_list.sw_cookie[i]) {
4556 				ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4557 					   "i %d last_cookie %d is same\n",
4558 					   i, pmon->mon_last_buf_cookie);
4559 				drop_mpdu = true;
4560 				pmon->rx_mon_stats.dup_mon_buf_cnt++;
4561 				continue;
4562 			}
4563 			buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
4564 					   msdu_list.sw_cookie[i]);
4565 
4566 			spin_lock_bh(&rx_ring->idr_lock);
4567 			msdu = idr_find(&rx_ring->bufs_idr, buf_id);
4568 			spin_unlock_bh(&rx_ring->idr_lock);
4569 			if (!msdu) {
4570 				ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4571 					   "msdu_pop: invalid buf_id %d\n", buf_id);
4572 				break;
4573 			}
4574 			rxcb = ATH11K_SKB_RXCB(msdu);
4575 			if (!rxcb->unmapped) {
4576 				dma_unmap_single(ar->ab->dev, rxcb->paddr,
4577 						 msdu->len +
4578 						 skb_tailroom(msdu),
4579 						 DMA_FROM_DEVICE);
4580 				rxcb->unmapped = 1;
4581 			}
4582 			if (drop_mpdu) {
4583 				ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4584 					   "i %d drop msdu %p *ppdu_id %x\n",
4585 					   i, msdu, *ppdu_id);
4586 				dev_kfree_skb_any(msdu);
4587 				msdu = NULL;
4588 				goto next_msdu;
4589 			}
4590 
4591 			rx_desc = (struct hal_rx_desc *)msdu->data;
4592 
4593 			rx_pkt_offset = sizeof(struct hal_rx_desc);
4594 			l2_hdr_offset = ath11k_dp_rx_h_msdu_end_l3pad(rx_desc);
4595 
4596 			if (is_first_msdu) {
4597 				if (!ath11k_dp_rxdesc_mpdu_valid(rx_desc)) {
4598 					drop_mpdu = true;
4599 					dev_kfree_skb_any(msdu);
4600 					msdu = NULL;
4601 					pmon->mon_last_linkdesc_paddr = paddr;
4602 					goto next_msdu;
4603 				}
4604 
4605 				msdu_ppdu_id =
4606 					ath11k_dp_rxdesc_get_ppduid(rx_desc);
4607 
4608 				if (ath11k_dp_rx_mon_comp_ppduid(msdu_ppdu_id,
4609 								 ppdu_id,
4610 								 &rx_bufs_used)) {
4611 					if (rx_bufs_used) {
4612 						drop_mpdu = true;
4613 						dev_kfree_skb_any(msdu);
4614 						msdu = NULL;
4615 						goto next_msdu;
4616 					}
4617 					return rx_bufs_used;
4618 				}
4619 				pmon->mon_last_linkdesc_paddr = paddr;
4620 				is_first_msdu = false;
4621 			}
4622 			ath11k_dp_mon_get_buf_len(&msdu_list.msdu_info[i],
4623 						  &is_frag, &total_len,
4624 						  &frag_len, &msdu_cnt);
4625 			rx_buf_size = rx_pkt_offset + l2_hdr_offset + frag_len;
4626 
4627 			ath11k_dp_pkt_set_pktlen(msdu, rx_buf_size);
4628 
4629 			if (!(*head_msdu))
4630 				*head_msdu = msdu;
4631 			else if (last)
4632 				last->next = msdu;
4633 
4634 			last = msdu;
4635 next_msdu:
4636 			pmon->mon_last_buf_cookie = msdu_list.sw_cookie[i];
4637 			rx_bufs_used++;
4638 			spin_lock_bh(&rx_ring->idr_lock);
4639 			idr_remove(&rx_ring->bufs_idr, buf_id);
4640 			spin_unlock_bh(&rx_ring->idr_lock);
4641 		}
4642 
4643 		ath11k_hal_rx_buf_addr_info_set(rx_link_buf_info, paddr, sw_cookie, rbm);
4644 
4645 		ath11k_dp_rx_mon_next_link_desc_get(rx_msdu_link_desc, &paddr,
4646 						    &sw_cookie, &rbm,
4647 						    &p_buf_addr_info);
4648 
4649 		if (ar->ab->hw_params.rxdma1_enable) {
4650 			if (ath11k_dp_rx_monitor_link_desc_return(ar,
4651 								  p_last_buf_addr_info,
4652 								  dp->mac_id))
4653 				ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4654 					   "dp_rx_monitor_link_desc_return failed");
4655 		} else {
4656 			ath11k_dp_rx_link_desc_return(ar->ab, rx_link_buf_info,
4657 						      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
4658 		}
4659 
4660 		p_last_buf_addr_info = p_buf_addr_info;
4661 
4662 	} while (paddr && msdu_cnt);
4663 
4664 	if (last)
4665 		last->next = NULL;
4666 
4667 	*tail_msdu = msdu;
4668 
4669 	if (msdu_cnt == 0)
4670 		*npackets = 1;
4671 
4672 	return rx_bufs_used;
4673 }
4674 
4675 static void ath11k_dp_rx_msdus_set_payload(struct sk_buff *msdu)
4676 {
4677 	u32 rx_pkt_offset, l2_hdr_offset;
4678 
4679 	rx_pkt_offset = sizeof(struct hal_rx_desc);
4680 	l2_hdr_offset = ath11k_dp_rx_h_msdu_end_l3pad((struct hal_rx_desc *)msdu->data);
4681 	skb_pull(msdu, rx_pkt_offset + l2_hdr_offset);
4682 }
4683 
4684 static struct sk_buff *
4685 ath11k_dp_rx_mon_merg_msdus(struct ath11k *ar,
4686 			    u32 mac_id, struct sk_buff *head_msdu,
4687 			    struct sk_buff *last_msdu,
4688 			    struct ieee80211_rx_status *rxs)
4689 {
4690 	struct sk_buff *msdu, *mpdu_buf, *prev_buf;
4691 	u32 decap_format, wifi_hdr_len;
4692 	struct hal_rx_desc *rx_desc;
4693 	char *hdr_desc;
4694 	u8 *dest;
4695 	struct ieee80211_hdr_3addr *wh;
4696 
4697 	mpdu_buf = NULL;
4698 
4699 	if (!head_msdu)
4700 		goto err_merge_fail;
4701 
4702 	rx_desc = (struct hal_rx_desc *)head_msdu->data;
4703 
4704 	if (ath11k_dp_rxdesc_get_mpdulen_err(rx_desc))
4705 		return NULL;
4706 
4707 	decap_format = ath11k_dp_rxdesc_get_decap_format(rx_desc);
4708 
4709 	ath11k_dp_rx_h_ppdu(ar, rx_desc, rxs);
4710 
4711 	if (decap_format == DP_RX_DECAP_TYPE_RAW) {
4712 		ath11k_dp_rx_msdus_set_payload(head_msdu);
4713 
4714 		prev_buf = head_msdu;
4715 		msdu = head_msdu->next;
4716 
4717 		while (msdu) {
4718 			ath11k_dp_rx_msdus_set_payload(msdu);
4719 
4720 			prev_buf = msdu;
4721 			msdu = msdu->next;
4722 		}
4723 
4724 		prev_buf->next = NULL;
4725 
4726 		skb_trim(prev_buf, prev_buf->len - HAL_RX_FCS_LEN);
4727 	} else if (decap_format == DP_RX_DECAP_TYPE_NATIVE_WIFI) {
4728 		__le16 qos_field;
4729 		u8 qos_pkt = 0;
4730 
4731 		rx_desc = (struct hal_rx_desc *)head_msdu->data;
4732 		hdr_desc = ath11k_dp_rxdesc_get_80211hdr(rx_desc);
4733 
4734 		/* Base size */
4735 		wifi_hdr_len = sizeof(struct ieee80211_hdr_3addr);
4736 		wh = (struct ieee80211_hdr_3addr *)hdr_desc;
4737 
4738 		if (ieee80211_is_data_qos(wh->frame_control)) {
4739 			struct ieee80211_qos_hdr *qwh =
4740 					(struct ieee80211_qos_hdr *)hdr_desc;
4741 
4742 			qos_field = qwh->qos_ctrl;
4743 			qos_pkt = 1;
4744 		}
4745 		msdu = head_msdu;
4746 
4747 		while (msdu) {
4748 			rx_desc = (struct hal_rx_desc *)msdu->data;
4749 			hdr_desc = ath11k_dp_rxdesc_get_80211hdr(rx_desc);
4750 
4751 			if (qos_pkt) {
4752 				dest = skb_push(msdu, sizeof(__le16));
4753 				if (!dest)
4754 					goto err_merge_fail;
4755 				memcpy(dest, hdr_desc, wifi_hdr_len);
4756 				memcpy(dest + wifi_hdr_len,
4757 				       (u8 *)&qos_field, sizeof(__le16));
4758 			}
4759 			ath11k_dp_rx_msdus_set_payload(msdu);
4760 			prev_buf = msdu;
4761 			msdu = msdu->next;
4762 		}
4763 		dest = skb_put(prev_buf, HAL_RX_FCS_LEN);
4764 		if (!dest)
4765 			goto err_merge_fail;
4766 
4767 		ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4768 			   "mpdu_buf %pK mpdu_buf->len %u",
4769 			   prev_buf, prev_buf->len);
4770 	} else {
4771 		ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4772 			   "decap format %d is not supported!\n",
4773 			   decap_format);
4774 		goto err_merge_fail;
4775 	}
4776 
4777 	return head_msdu;
4778 
4779 err_merge_fail:
4780 	if (mpdu_buf && decap_format != DP_RX_DECAP_TYPE_RAW) {
4781 		ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4782 			   "err_merge_fail mpdu_buf %pK", mpdu_buf);
4783 		/* Free the head buffer */
4784 		dev_kfree_skb_any(mpdu_buf);
4785 	}
4786 	return NULL;
4787 }
4788 
4789 static int ath11k_dp_rx_mon_deliver(struct ath11k *ar, u32 mac_id,
4790 				    struct sk_buff *head_msdu,
4791 				    struct sk_buff *tail_msdu,
4792 				    struct napi_struct *napi)
4793 {
4794 	struct ath11k_pdev_dp *dp = &ar->dp;
4795 	struct sk_buff *mon_skb, *skb_next, *header;
4796 	struct ieee80211_rx_status *rxs = &dp->rx_status, *status;
4797 
4798 	mon_skb = ath11k_dp_rx_mon_merg_msdus(ar, mac_id, head_msdu,
4799 					      tail_msdu, rxs);
4800 
4801 	if (!mon_skb)
4802 		goto mon_deliver_fail;
4803 
4804 	header = mon_skb;
4805 
4806 	rxs->flag = 0;
4807 	do {
4808 		skb_next = mon_skb->next;
4809 		if (!skb_next)
4810 			rxs->flag &= ~RX_FLAG_AMSDU_MORE;
4811 		else
4812 			rxs->flag |= RX_FLAG_AMSDU_MORE;
4813 
4814 		if (mon_skb == header) {
4815 			header = NULL;
4816 			rxs->flag &= ~RX_FLAG_ALLOW_SAME_PN;
4817 		} else {
4818 			rxs->flag |= RX_FLAG_ALLOW_SAME_PN;
4819 		}
4820 		rxs->flag |= RX_FLAG_ONLY_MONITOR;
4821 
4822 		status = IEEE80211_SKB_RXCB(mon_skb);
4823 		*status = *rxs;
4824 
4825 		ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb);
4826 		mon_skb = skb_next;
4827 	} while (mon_skb);
4828 	rxs->flag = 0;
4829 
4830 	return 0;
4831 
4832 mon_deliver_fail:
4833 	mon_skb = head_msdu;
4834 	while (mon_skb) {
4835 		skb_next = mon_skb->next;
4836 		dev_kfree_skb_any(mon_skb);
4837 		mon_skb = skb_next;
4838 	}
4839 	return -EINVAL;
4840 }
4841 
4842 static void ath11k_dp_rx_mon_dest_process(struct ath11k *ar, int mac_id,
4843 					  u32 quota, struct napi_struct *napi)
4844 {
4845 	struct ath11k_pdev_dp *dp = &ar->dp;
4846 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4847 	void *ring_entry;
4848 	void *mon_dst_srng;
4849 	u32 ppdu_id;
4850 	u32 rx_bufs_used;
4851 	u32 ring_id;
4852 	struct ath11k_pdev_mon_stats *rx_mon_stats;
4853 	u32	 npackets = 0;
4854 
4855 	if (ar->ab->hw_params.rxdma1_enable)
4856 		ring_id = dp->rxdma_mon_dst_ring.ring_id;
4857 	else
4858 		ring_id = dp->rxdma_err_dst_ring[mac_id].ring_id;
4859 
4860 	mon_dst_srng = &ar->ab->hal.srng_list[ring_id];
4861 
4862 	if (!mon_dst_srng) {
4863 		ath11k_warn(ar->ab,
4864 			    "HAL Monitor Destination Ring Init Failed -- %pK",
4865 			    mon_dst_srng);
4866 		return;
4867 	}
4868 
4869 	spin_lock_bh(&pmon->mon_lock);
4870 
4871 	ath11k_hal_srng_access_begin(ar->ab, mon_dst_srng);
4872 
4873 	ppdu_id = pmon->mon_ppdu_info.ppdu_id;
4874 	rx_bufs_used = 0;
4875 	rx_mon_stats = &pmon->rx_mon_stats;
4876 
4877 	while ((ring_entry = ath11k_hal_srng_dst_peek(ar->ab, mon_dst_srng))) {
4878 		struct sk_buff *head_msdu, *tail_msdu;
4879 
4880 		head_msdu = NULL;
4881 		tail_msdu = NULL;
4882 
4883 		rx_bufs_used += ath11k_dp_rx_mon_mpdu_pop(ar, mac_id, ring_entry,
4884 							  &head_msdu,
4885 							  &tail_msdu,
4886 							  &npackets, &ppdu_id);
4887 
4888 		if (ppdu_id != pmon->mon_ppdu_info.ppdu_id) {
4889 			pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
4890 			ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
4891 				   "dest_rx: new ppdu_id %x != status ppdu_id %x",
4892 				   ppdu_id, pmon->mon_ppdu_info.ppdu_id);
4893 			break;
4894 		}
4895 		if (head_msdu && tail_msdu) {
4896 			ath11k_dp_rx_mon_deliver(ar, dp->mac_id, head_msdu,
4897 						 tail_msdu, napi);
4898 			rx_mon_stats->dest_mpdu_done++;
4899 		}
4900 
4901 		ring_entry = ath11k_hal_srng_dst_get_next_entry(ar->ab,
4902 								mon_dst_srng);
4903 	}
4904 	ath11k_hal_srng_access_end(ar->ab, mon_dst_srng);
4905 
4906 	spin_unlock_bh(&pmon->mon_lock);
4907 
4908 	if (rx_bufs_used) {
4909 		rx_mon_stats->dest_ppdu_done++;
4910 		if (ar->ab->hw_params.rxdma1_enable)
4911 			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
4912 						   &dp->rxdma_mon_buf_ring,
4913 						   rx_bufs_used,
4914 						   HAL_RX_BUF_RBM_SW3_BM);
4915 		else
4916 			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
4917 						   &dp->rx_refill_buf_ring,
4918 						   rx_bufs_used,
4919 						   HAL_RX_BUF_RBM_SW3_BM);
4920 	}
4921 }
4922 
4923 static void ath11k_dp_rx_mon_status_process_tlv(struct ath11k *ar,
4924 						int mac_id, u32 quota,
4925 						struct napi_struct *napi)
4926 {
4927 	struct ath11k_pdev_dp *dp = &ar->dp;
4928 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4929 	struct hal_rx_mon_ppdu_info *ppdu_info;
4930 	struct sk_buff *status_skb;
4931 	u32 tlv_status = HAL_TLV_STATUS_BUF_DONE;
4932 	struct ath11k_pdev_mon_stats *rx_mon_stats;
4933 
4934 	ppdu_info = &pmon->mon_ppdu_info;
4935 	rx_mon_stats = &pmon->rx_mon_stats;
4936 
4937 	if (pmon->mon_ppdu_status != DP_PPDU_STATUS_START)
4938 		return;
4939 
4940 	while (!skb_queue_empty(&pmon->rx_status_q)) {
4941 		status_skb = skb_dequeue(&pmon->rx_status_q);
4942 
4943 		tlv_status = ath11k_hal_rx_parse_mon_status(ar->ab, ppdu_info,
4944 							    status_skb);
4945 		if (tlv_status == HAL_TLV_STATUS_PPDU_DONE) {
4946 			rx_mon_stats->status_ppdu_done++;
4947 			pmon->mon_ppdu_status = DP_PPDU_STATUS_DONE;
4948 			ath11k_dp_rx_mon_dest_process(ar, mac_id, quota, napi);
4949 			pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
4950 		}
4951 		dev_kfree_skb_any(status_skb);
4952 	}
4953 }
4954 
4955 static int ath11k_dp_mon_process_rx(struct ath11k_base *ab, int mac_id,
4956 				    struct napi_struct *napi, int budget)
4957 {
4958 	struct ath11k *ar = ath11k_ab_to_ar(ab, mac_id);
4959 	struct ath11k_pdev_dp *dp = &ar->dp;
4960 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4961 	int num_buffs_reaped = 0;
4962 
4963 	num_buffs_reaped = ath11k_dp_rx_reap_mon_status_ring(ar->ab, mac_id, &budget,
4964 							     &pmon->rx_status_q);
4965 	if (num_buffs_reaped)
4966 		ath11k_dp_rx_mon_status_process_tlv(ar, mac_id, budget, napi);
4967 
4968 	return num_buffs_reaped;
4969 }
4970 
4971 int ath11k_dp_rx_process_mon_rings(struct ath11k_base *ab, int mac_id,
4972 				   struct napi_struct *napi, int budget)
4973 {
4974 	struct ath11k *ar = ath11k_ab_to_ar(ab, mac_id);
4975 	int ret = 0;
4976 
4977 	if (test_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags))
4978 		ret = ath11k_dp_mon_process_rx(ab, mac_id, napi, budget);
4979 	else
4980 		ret = ath11k_dp_rx_process_mon_status(ab, mac_id, napi, budget);
4981 	return ret;
4982 }
4983 
4984 static int ath11k_dp_rx_pdev_mon_status_attach(struct ath11k *ar)
4985 {
4986 	struct ath11k_pdev_dp *dp = &ar->dp;
4987 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
4988 
4989 	skb_queue_head_init(&pmon->rx_status_q);
4990 
4991 	pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
4992 
4993 	memset(&pmon->rx_mon_stats, 0,
4994 	       sizeof(pmon->rx_mon_stats));
4995 	return 0;
4996 }
4997 
4998 int ath11k_dp_rx_pdev_mon_attach(struct ath11k *ar)
4999 {
5000 	struct ath11k_pdev_dp *dp = &ar->dp;
5001 	struct ath11k_mon_data *pmon = &dp->mon_data;
5002 	struct hal_srng *mon_desc_srng = NULL;
5003 	struct dp_srng *dp_srng;
5004 	int ret = 0;
5005 	u32 n_link_desc = 0;
5006 
5007 	ret = ath11k_dp_rx_pdev_mon_status_attach(ar);
5008 	if (ret) {
5009 		ath11k_warn(ar->ab, "pdev_mon_status_attach() failed");
5010 		return ret;
5011 	}
5012 
5013 	/* if rxdma1_enable is false, no need to setup
5014 	 * rxdma_mon_desc_ring.
5015 	 */
5016 	if (!ar->ab->hw_params.rxdma1_enable)
5017 		return 0;
5018 
5019 	dp_srng = &dp->rxdma_mon_desc_ring;
5020 	n_link_desc = dp_srng->size /
5021 		ath11k_hal_srng_get_entrysize(ar->ab, HAL_RXDMA_MONITOR_DESC);
5022 	mon_desc_srng =
5023 		&ar->ab->hal.srng_list[dp->rxdma_mon_desc_ring.ring_id];
5024 
5025 	ret = ath11k_dp_link_desc_setup(ar->ab, pmon->link_desc_banks,
5026 					HAL_RXDMA_MONITOR_DESC, mon_desc_srng,
5027 					n_link_desc);
5028 	if (ret) {
5029 		ath11k_warn(ar->ab, "mon_link_desc_pool_setup() failed");
5030 		return ret;
5031 	}
5032 	pmon->mon_last_linkdesc_paddr = 0;
5033 	pmon->mon_last_buf_cookie = DP_RX_DESC_COOKIE_MAX + 1;
5034 	spin_lock_init(&pmon->mon_lock);
5035 
5036 	return 0;
5037 }
5038 
5039 static int ath11k_dp_mon_link_free(struct ath11k *ar)
5040 {
5041 	struct ath11k_pdev_dp *dp = &ar->dp;
5042 	struct ath11k_mon_data *pmon = &dp->mon_data;
5043 
5044 	ath11k_dp_link_desc_cleanup(ar->ab, pmon->link_desc_banks,
5045 				    HAL_RXDMA_MONITOR_DESC,
5046 				    &dp->rxdma_mon_desc_ring);
5047 	return 0;
5048 }
5049 
5050 int ath11k_dp_rx_pdev_mon_detach(struct ath11k *ar)
5051 {
5052 	ath11k_dp_mon_link_free(ar);
5053 	return 0;
5054 }
5055 
5056 int ath11k_dp_rx_pktlog_start(struct ath11k_base *ab)
5057 {
5058 	/* start reap timer */
5059 	mod_timer(&ab->mon_reap_timer,
5060 		  jiffies + msecs_to_jiffies(ATH11K_MON_TIMER_INTERVAL));
5061 
5062 	return 0;
5063 }
5064 
5065 int ath11k_dp_rx_pktlog_stop(struct ath11k_base *ab, bool stop_timer)
5066 {
5067 	int ret;
5068 
5069 	if (stop_timer)
5070 		del_timer_sync(&ab->mon_reap_timer);
5071 
5072 	/* reap all the monitor related rings */
5073 	ret = ath11k_dp_purge_mon_ring(ab);
5074 	if (ret) {
5075 		ath11k_warn(ab, "failed to purge dp mon ring: %d\n", ret);
5076 		return ret;
5077 	}
5078 
5079 	return 0;
5080 }
5081