1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/devcoredump.h>
5 #include <linux/etherdevice.h>
6 #include <linux/timekeeping.h>
7 #include "mt7921.h"
8 #include "../dma.h"
9 #include "mac.h"
10 #include "mcu.h"
11 
12 static struct mt76_wcid *mt7921_rx_get_wcid(struct mt7921_dev *dev,
13 					    u16 idx, bool unicast)
14 {
15 	struct mt7921_sta *sta;
16 	struct mt76_wcid *wcid;
17 
18 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
19 		return NULL;
20 
21 	wcid = rcu_dereference(dev->mt76.wcid[idx]);
22 	if (unicast || !wcid)
23 		return wcid;
24 
25 	if (!wcid->sta)
26 		return NULL;
27 
28 	sta = container_of(wcid, struct mt7921_sta, wcid);
29 	if (!sta->vif)
30 		return NULL;
31 
32 	return &sta->vif->sta.wcid;
33 }
34 
35 void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
36 {
37 }
38 EXPORT_SYMBOL_GPL(mt7921_sta_ps);
39 
40 bool mt7921_mac_wtbl_update(struct mt7921_dev *dev, int idx, u32 mask)
41 {
42 	mt76_rmw(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_WLAN_IDX,
43 		 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, idx) | mask);
44 
45 	return mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY,
46 			 0, 5000);
47 }
48 
49 void mt7921_mac_sta_poll(struct mt7921_dev *dev)
50 {
51 	static const u8 ac_to_tid[] = {
52 		[IEEE80211_AC_BE] = 0,
53 		[IEEE80211_AC_BK] = 1,
54 		[IEEE80211_AC_VI] = 4,
55 		[IEEE80211_AC_VO] = 6
56 	};
57 	struct ieee80211_sta *sta;
58 	struct mt7921_sta *msta;
59 	u32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS];
60 	LIST_HEAD(sta_poll_list);
61 	struct rate_info *rate;
62 	int i;
63 
64 	spin_lock_bh(&dev->sta_poll_lock);
65 	list_splice_init(&dev->sta_poll_list, &sta_poll_list);
66 	spin_unlock_bh(&dev->sta_poll_lock);
67 
68 	while (true) {
69 		bool clear = false;
70 		u32 addr, val;
71 		u16 idx;
72 		u8 bw;
73 
74 		spin_lock_bh(&dev->sta_poll_lock);
75 		if (list_empty(&sta_poll_list)) {
76 			spin_unlock_bh(&dev->sta_poll_lock);
77 			break;
78 		}
79 		msta = list_first_entry(&sta_poll_list,
80 					struct mt7921_sta, poll_list);
81 		list_del_init(&msta->poll_list);
82 		spin_unlock_bh(&dev->sta_poll_lock);
83 
84 		idx = msta->wcid.idx;
85 		addr = mt7921_mac_wtbl_lmac_addr(idx, MT_WTBL_AC0_CTT_OFFSET);
86 
87 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
88 			u32 tx_last = msta->airtime_ac[i];
89 			u32 rx_last = msta->airtime_ac[i + 4];
90 
91 			msta->airtime_ac[i] = mt76_rr(dev, addr);
92 			msta->airtime_ac[i + 4] = mt76_rr(dev, addr + 4);
93 
94 			tx_time[i] = msta->airtime_ac[i] - tx_last;
95 			rx_time[i] = msta->airtime_ac[i + 4] - rx_last;
96 
97 			if ((tx_last | rx_last) & BIT(30))
98 				clear = true;
99 
100 			addr += 8;
101 		}
102 
103 		if (clear) {
104 			mt7921_mac_wtbl_update(dev, idx,
105 					       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
106 			memset(msta->airtime_ac, 0, sizeof(msta->airtime_ac));
107 		}
108 
109 		if (!msta->wcid.sta)
110 			continue;
111 
112 		sta = container_of((void *)msta, struct ieee80211_sta,
113 				   drv_priv);
114 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
115 			u8 q = mt76_connac_lmac_mapping(i);
116 			u32 tx_cur = tx_time[q];
117 			u32 rx_cur = rx_time[q];
118 			u8 tid = ac_to_tid[i];
119 
120 			if (!tx_cur && !rx_cur)
121 				continue;
122 
123 			ieee80211_sta_register_airtime(sta, tid, tx_cur,
124 						       rx_cur);
125 		}
126 
127 		/* We don't support reading GI info from txs packets.
128 		 * For accurate tx status reporting and AQL improvement,
129 		 * we need to make sure that flags match so polling GI
130 		 * from per-sta counters directly.
131 		 */
132 		rate = &msta->wcid.rate;
133 		addr = mt7921_mac_wtbl_lmac_addr(idx,
134 						 MT_WTBL_TXRX_CAP_RATE_OFFSET);
135 		val = mt76_rr(dev, addr);
136 
137 		switch (rate->bw) {
138 		case RATE_INFO_BW_160:
139 			bw = IEEE80211_STA_RX_BW_160;
140 			break;
141 		case RATE_INFO_BW_80:
142 			bw = IEEE80211_STA_RX_BW_80;
143 			break;
144 		case RATE_INFO_BW_40:
145 			bw = IEEE80211_STA_RX_BW_40;
146 			break;
147 		default:
148 			bw = IEEE80211_STA_RX_BW_20;
149 			break;
150 		}
151 
152 		if (rate->flags & RATE_INFO_FLAGS_HE_MCS) {
153 			u8 offs = MT_WTBL_TXRX_RATE_G2_HE + 2 * bw;
154 
155 			rate->he_gi = (val & (0x3 << offs)) >> offs;
156 		} else if (rate->flags &
157 			   (RATE_INFO_FLAGS_VHT_MCS | RATE_INFO_FLAGS_MCS)) {
158 			if (val & BIT(MT_WTBL_TXRX_RATE_G2 + bw))
159 				rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
160 			else
161 				rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
162 		}
163 	}
164 }
165 EXPORT_SYMBOL_GPL(mt7921_mac_sta_poll);
166 
167 static void
168 mt7921_get_status_freq_info(struct mt7921_dev *dev, struct mt76_phy *mphy,
169 			    struct mt76_rx_status *status, u8 chfreq)
170 {
171 	if (chfreq > 180) {
172 		status->band = NL80211_BAND_6GHZ;
173 		chfreq = (chfreq - 181) * 4 + 1;
174 	} else if (chfreq > 14) {
175 		status->band = NL80211_BAND_5GHZ;
176 	} else {
177 		status->band = NL80211_BAND_2GHZ;
178 	}
179 	status->freq = ieee80211_channel_to_frequency(chfreq, status->band);
180 }
181 
182 static void
183 mt7921_mac_rssi_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
184 {
185 	struct sk_buff *skb = priv;
186 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
187 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
188 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
189 
190 	if (status->signal > 0)
191 		return;
192 
193 	if (!ether_addr_equal(vif->addr, hdr->addr1))
194 		return;
195 
196 	ewma_rssi_add(&mvif->rssi, -status->signal);
197 }
198 
199 static void
200 mt7921_mac_assoc_rssi(struct mt7921_dev *dev, struct sk_buff *skb)
201 {
202 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
203 
204 	if (!ieee80211_is_assoc_resp(hdr->frame_control) &&
205 	    !ieee80211_is_auth(hdr->frame_control))
206 		return;
207 
208 	ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
209 		IEEE80211_IFACE_ITER_RESUME_ALL,
210 		mt7921_mac_rssi_iter, skb);
211 }
212 
213 static int
214 mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
215 {
216 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
217 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
218 	bool hdr_trans, unicast, insert_ccmp_hdr = false;
219 	u8 chfreq, qos_ctl = 0, remove_pad, amsdu_info;
220 	u16 hdr_gap;
221 	__le32 *rxv = NULL, *rxd = (__le32 *)skb->data;
222 	struct mt76_phy *mphy = &dev->mt76.phy;
223 	struct mt7921_phy *phy = &dev->phy;
224 	struct ieee80211_supported_band *sband;
225 	u32 csum_status = *(u32 *)skb->cb;
226 	u32 rxd0 = le32_to_cpu(rxd[0]);
227 	u32 rxd1 = le32_to_cpu(rxd[1]);
228 	u32 rxd2 = le32_to_cpu(rxd[2]);
229 	u32 rxd3 = le32_to_cpu(rxd[3]);
230 	u32 rxd4 = le32_to_cpu(rxd[4]);
231 	struct mt7921_sta *msta = NULL;
232 	u16 seq_ctrl = 0;
233 	__le16 fc = 0;
234 	u8 mode = 0;
235 	int i, idx;
236 
237 	memset(status, 0, sizeof(*status));
238 
239 	if (rxd1 & MT_RXD1_NORMAL_BAND_IDX)
240 		return -EINVAL;
241 
242 	if (!test_bit(MT76_STATE_RUNNING, &mphy->state))
243 		return -EINVAL;
244 
245 	if (rxd2 & MT_RXD2_NORMAL_AMSDU_ERR)
246 		return -EINVAL;
247 
248 	hdr_trans = rxd2 & MT_RXD2_NORMAL_HDR_TRANS;
249 	if (hdr_trans && (rxd1 & MT_RXD1_NORMAL_CM))
250 		return -EINVAL;
251 
252 	/* ICV error or CCMP/BIP/WPI MIC error */
253 	if (rxd1 & MT_RXD1_NORMAL_ICV_ERR)
254 		status->flag |= RX_FLAG_ONLY_MONITOR;
255 
256 	chfreq = FIELD_GET(MT_RXD3_NORMAL_CH_FREQ, rxd3);
257 	unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
258 	idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
259 	status->wcid = mt7921_rx_get_wcid(dev, idx, unicast);
260 
261 	if (status->wcid) {
262 		msta = container_of(status->wcid, struct mt7921_sta, wcid);
263 		spin_lock_bh(&dev->sta_poll_lock);
264 		if (list_empty(&msta->poll_list))
265 			list_add_tail(&msta->poll_list, &dev->sta_poll_list);
266 		spin_unlock_bh(&dev->sta_poll_lock);
267 	}
268 
269 	mt7921_get_status_freq_info(dev, mphy, status, chfreq);
270 
271 	switch (status->band) {
272 	case NL80211_BAND_5GHZ:
273 		sband = &mphy->sband_5g.sband;
274 		break;
275 	case NL80211_BAND_6GHZ:
276 		sband = &mphy->sband_6g.sband;
277 		break;
278 	default:
279 		sband = &mphy->sband_2g.sband;
280 		break;
281 	}
282 
283 	if (!sband->channels)
284 		return -EINVAL;
285 
286 	if (mt76_is_mmio(&dev->mt76) && (rxd0 & csum_mask) == csum_mask &&
287 	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))
288 		skb->ip_summed = CHECKSUM_UNNECESSARY;
289 
290 	if (rxd1 & MT_RXD1_NORMAL_FCS_ERR)
291 		status->flag |= RX_FLAG_FAILED_FCS_CRC;
292 
293 	if (rxd1 & MT_RXD1_NORMAL_TKIP_MIC_ERR)
294 		status->flag |= RX_FLAG_MMIC_ERROR;
295 
296 	if (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1) != 0 &&
297 	    !(rxd1 & (MT_RXD1_NORMAL_CLM | MT_RXD1_NORMAL_CM))) {
298 		status->flag |= RX_FLAG_DECRYPTED;
299 		status->flag |= RX_FLAG_IV_STRIPPED;
300 		status->flag |= RX_FLAG_MMIC_STRIPPED | RX_FLAG_MIC_STRIPPED;
301 	}
302 
303 	remove_pad = FIELD_GET(MT_RXD2_NORMAL_HDR_OFFSET, rxd2);
304 
305 	if (rxd2 & MT_RXD2_NORMAL_MAX_LEN_ERROR)
306 		return -EINVAL;
307 
308 	rxd += 6;
309 	if (rxd1 & MT_RXD1_NORMAL_GROUP_4) {
310 		u32 v0 = le32_to_cpu(rxd[0]);
311 		u32 v2 = le32_to_cpu(rxd[2]);
312 
313 		fc = cpu_to_le16(FIELD_GET(MT_RXD6_FRAME_CONTROL, v0));
314 		seq_ctrl = FIELD_GET(MT_RXD8_SEQ_CTRL, v2);
315 		qos_ctl = FIELD_GET(MT_RXD8_QOS_CTL, v2);
316 
317 		rxd += 4;
318 		if ((u8 *)rxd - skb->data >= skb->len)
319 			return -EINVAL;
320 	}
321 
322 	if (rxd1 & MT_RXD1_NORMAL_GROUP_1) {
323 		u8 *data = (u8 *)rxd;
324 
325 		if (status->flag & RX_FLAG_DECRYPTED) {
326 			switch (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1)) {
327 			case MT_CIPHER_AES_CCMP:
328 			case MT_CIPHER_CCMP_CCX:
329 			case MT_CIPHER_CCMP_256:
330 				insert_ccmp_hdr =
331 					FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
332 				fallthrough;
333 			case MT_CIPHER_TKIP:
334 			case MT_CIPHER_TKIP_NO_MIC:
335 			case MT_CIPHER_GCMP:
336 			case MT_CIPHER_GCMP_256:
337 				status->iv[0] = data[5];
338 				status->iv[1] = data[4];
339 				status->iv[2] = data[3];
340 				status->iv[3] = data[2];
341 				status->iv[4] = data[1];
342 				status->iv[5] = data[0];
343 				break;
344 			default:
345 				break;
346 			}
347 		}
348 		rxd += 4;
349 		if ((u8 *)rxd - skb->data >= skb->len)
350 			return -EINVAL;
351 	}
352 
353 	if (rxd1 & MT_RXD1_NORMAL_GROUP_2) {
354 		status->timestamp = le32_to_cpu(rxd[0]);
355 		status->flag |= RX_FLAG_MACTIME_START;
356 
357 		if (!(rxd2 & MT_RXD2_NORMAL_NON_AMPDU)) {
358 			status->flag |= RX_FLAG_AMPDU_DETAILS;
359 
360 			/* all subframes of an A-MPDU have the same timestamp */
361 			if (phy->rx_ampdu_ts != status->timestamp) {
362 				if (!++phy->ampdu_ref)
363 					phy->ampdu_ref++;
364 			}
365 			phy->rx_ampdu_ts = status->timestamp;
366 
367 			status->ampdu_ref = phy->ampdu_ref;
368 		}
369 
370 		rxd += 2;
371 		if ((u8 *)rxd - skb->data >= skb->len)
372 			return -EINVAL;
373 	}
374 
375 	/* RXD Group 3 - P-RXV */
376 	if (rxd1 & MT_RXD1_NORMAL_GROUP_3) {
377 		u32 v0, v1;
378 		int ret;
379 
380 		rxv = rxd;
381 		rxd += 2;
382 		if ((u8 *)rxd - skb->data >= skb->len)
383 			return -EINVAL;
384 
385 		v0 = le32_to_cpu(rxv[0]);
386 		v1 = le32_to_cpu(rxv[1]);
387 
388 		if (v0 & MT_PRXV_HT_AD_CODE)
389 			status->enc_flags |= RX_ENC_FLAG_LDPC;
390 
391 		ret = mt76_connac2_mac_fill_rx_rate(&dev->mt76, status, sband,
392 						    rxv, &mode);
393 		if (ret < 0)
394 			return ret;
395 
396 		if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
397 			rxd += 6;
398 			if ((u8 *)rxd - skb->data >= skb->len)
399 				return -EINVAL;
400 
401 			rxv = rxd;
402 			/* Monitor mode would use RCPI described in GROUP 5
403 			 * instead.
404 			 */
405 			v1 = le32_to_cpu(rxv[0]);
406 
407 			rxd += 12;
408 			if ((u8 *)rxd - skb->data >= skb->len)
409 				return -EINVAL;
410 		}
411 
412 		status->chains = mphy->antenna_mask;
413 		status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v1);
414 		status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1);
415 		status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1);
416 		status->chain_signal[3] = to_rssi(MT_PRXV_RCPI3, v1);
417 		status->signal = -128;
418 		for (i = 0; i < hweight8(mphy->antenna_mask); i++) {
419 			if (!(status->chains & BIT(i)) ||
420 			    status->chain_signal[i] >= 0)
421 				continue;
422 
423 			status->signal = max(status->signal,
424 					     status->chain_signal[i]);
425 		}
426 	}
427 
428 	amsdu_info = FIELD_GET(MT_RXD4_NORMAL_PAYLOAD_FORMAT, rxd4);
429 	status->amsdu = !!amsdu_info;
430 	if (status->amsdu) {
431 		status->first_amsdu = amsdu_info == MT_RXD4_FIRST_AMSDU_FRAME;
432 		status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME;
433 	}
434 
435 	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
436 	if (hdr_trans && ieee80211_has_morefrags(fc)) {
437 		struct ieee80211_vif *vif;
438 		int err;
439 
440 		if (!msta || !msta->vif)
441 			return -EINVAL;
442 
443 		vif = container_of((void *)msta->vif, struct ieee80211_vif,
444 				   drv_priv);
445 		err = mt76_connac2_reverse_frag0_hdr_trans(vif, skb, hdr_gap);
446 		if (err)
447 			return err;
448 
449 		hdr_trans = false;
450 	} else {
451 		skb_pull(skb, hdr_gap);
452 		if (!hdr_trans && status->amsdu) {
453 			memmove(skb->data + 2, skb->data,
454 				ieee80211_get_hdrlen_from_skb(skb));
455 			skb_pull(skb, 2);
456 		}
457 	}
458 
459 	if (!hdr_trans) {
460 		struct ieee80211_hdr *hdr;
461 
462 		if (insert_ccmp_hdr) {
463 			u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1);
464 
465 			mt76_insert_ccmp_hdr(skb, key_id);
466 		}
467 
468 		hdr = mt76_skb_get_hdr(skb);
469 		fc = hdr->frame_control;
470 		if (ieee80211_is_data_qos(fc)) {
471 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
472 			qos_ctl = *ieee80211_get_qos_ctl(hdr);
473 		}
474 	} else {
475 		status->flag |= RX_FLAG_8023;
476 	}
477 
478 	mt7921_mac_assoc_rssi(dev, skb);
479 
480 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
481 		mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv, mode);
482 
483 	if (!status->wcid || !ieee80211_is_data_qos(fc))
484 		return 0;
485 
486 	status->aggr = unicast && !ieee80211_is_qos_nullfunc(fc);
487 	status->seqno = IEEE80211_SEQ_TO_SN(seq_ctrl);
488 	status->qos_ctl = qos_ctl;
489 
490 	return 0;
491 }
492 
493 static void mt7921_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
494 {
495 	struct mt7921_sta *msta;
496 	u16 fc, tid;
497 	u32 val;
498 
499 	if (!sta || !(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
500 		return;
501 
502 	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
503 	if (tid >= 6) /* skip VO queue */
504 		return;
505 
506 	val = le32_to_cpu(txwi[2]);
507 	fc = FIELD_GET(MT_TXD2_FRAME_TYPE, val) << 2 |
508 	     FIELD_GET(MT_TXD2_SUB_TYPE, val) << 4;
509 	if (unlikely(fc != (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA)))
510 		return;
511 
512 	msta = (struct mt7921_sta *)sta->drv_priv;
513 	if (!test_and_set_bit(tid, &msta->ampdu_state))
514 		ieee80211_start_tx_ba_session(sta, tid, 0);
515 }
516 
517 void mt7921_mac_add_txs(struct mt7921_dev *dev, void *data)
518 {
519 	struct mt7921_sta *msta = NULL;
520 	struct mt76_wcid *wcid;
521 	__le32 *txs_data = data;
522 	u16 wcidx;
523 	u8 pid;
524 
525 	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
526 		return;
527 
528 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
529 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
530 
531 	if (pid < MT_PACKET_ID_FIRST)
532 		return;
533 
534 	if (wcidx >= MT7921_WTBL_SIZE)
535 		return;
536 
537 	rcu_read_lock();
538 
539 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
540 	if (!wcid)
541 		goto out;
542 
543 	msta = container_of(wcid, struct mt7921_sta, wcid);
544 
545 	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
546 	if (!wcid->sta)
547 		goto out;
548 
549 	spin_lock_bh(&dev->sta_poll_lock);
550 	if (list_empty(&msta->poll_list))
551 		list_add_tail(&msta->poll_list, &dev->sta_poll_list);
552 	spin_unlock_bh(&dev->sta_poll_lock);
553 
554 out:
555 	rcu_read_unlock();
556 }
557 
558 void mt7921_txwi_free(struct mt7921_dev *dev, struct mt76_txwi_cache *t,
559 		      struct ieee80211_sta *sta, bool clear_status,
560 		      struct list_head *free_list)
561 {
562 	struct mt76_dev *mdev = &dev->mt76;
563 	__le32 *txwi;
564 	u16 wcid_idx;
565 
566 	mt76_connac_txp_skb_unmap(mdev, t);
567 	if (!t->skb)
568 		goto out;
569 
570 	txwi = (__le32 *)mt76_get_txwi_ptr(mdev, t);
571 	if (sta) {
572 		struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
573 
574 		if (likely(t->skb->protocol != cpu_to_be16(ETH_P_PAE)))
575 			mt7921_tx_check_aggr(sta, txwi);
576 
577 		wcid_idx = wcid->idx;
578 	} else {
579 		wcid_idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
580 	}
581 
582 	__mt76_tx_complete_skb(mdev, wcid_idx, t->skb, free_list);
583 out:
584 	t->skb = NULL;
585 	mt76_put_txwi(mdev, t);
586 }
587 EXPORT_SYMBOL_GPL(mt7921_txwi_free);
588 
589 static void mt7921_mac_tx_free(struct mt7921_dev *dev, void *data, int len)
590 {
591 	struct mt76_connac_tx_free *free = data;
592 	__le32 *tx_info = (__le32 *)(data + sizeof(*free));
593 	struct mt76_dev *mdev = &dev->mt76;
594 	struct mt76_txwi_cache *txwi;
595 	struct ieee80211_sta *sta = NULL;
596 	struct sk_buff *skb, *tmp;
597 	void *end = data + len;
598 	LIST_HEAD(free_list);
599 	bool wake = false;
600 	u8 i, count;
601 
602 	/* clean DMA queues and unmap buffers first */
603 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_PSD], false);
604 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BE], false);
605 
606 	count = le16_get_bits(free->ctrl, MT_TX_FREE_MSDU_CNT);
607 	if (WARN_ON_ONCE((void *)&tx_info[count] > end))
608 		return;
609 
610 	for (i = 0; i < count; i++) {
611 		u32 msdu, info = le32_to_cpu(tx_info[i]);
612 		u8 stat;
613 
614 		/* 1'b1: new wcid pair.
615 		 * 1'b0: msdu_id with the same 'wcid pair' as above.
616 		 */
617 		if (info & MT_TX_FREE_PAIR) {
618 			struct mt7921_sta *msta;
619 			struct mt76_wcid *wcid;
620 			u16 idx;
621 
622 			count++;
623 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
624 			wcid = rcu_dereference(dev->mt76.wcid[idx]);
625 			sta = wcid_to_sta(wcid);
626 			if (!sta)
627 				continue;
628 
629 			msta = container_of(wcid, struct mt7921_sta, wcid);
630 			spin_lock_bh(&dev->sta_poll_lock);
631 			if (list_empty(&msta->poll_list))
632 				list_add_tail(&msta->poll_list, &dev->sta_poll_list);
633 			spin_unlock_bh(&dev->sta_poll_lock);
634 			continue;
635 		}
636 
637 		msdu = FIELD_GET(MT_TX_FREE_MSDU_ID, info);
638 		stat = FIELD_GET(MT_TX_FREE_STATUS, info);
639 
640 		txwi = mt76_token_release(mdev, msdu, &wake);
641 		if (!txwi)
642 			continue;
643 
644 		mt7921_txwi_free(dev, txwi, sta, stat, &free_list);
645 	}
646 
647 	if (wake)
648 		mt76_set_tx_blocked(&dev->mt76, false);
649 
650 	list_for_each_entry_safe(skb, tmp, &free_list, list) {
651 		skb_list_del_init(skb);
652 		napi_consume_skb(skb, 1);
653 	}
654 
655 	rcu_read_lock();
656 	mt7921_mac_sta_poll(dev);
657 	rcu_read_unlock();
658 
659 	mt76_worker_schedule(&dev->mt76.tx_worker);
660 }
661 
662 bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
663 {
664 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
665 	__le32 *rxd = (__le32 *)data;
666 	__le32 *end = (__le32 *)&rxd[len / 4];
667 	enum rx_pkt_type type;
668 
669 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
670 
671 	switch (type) {
672 	case PKT_TYPE_TXRX_NOTIFY:
673 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
674 		mt7921_mac_tx_free(dev, data, len); /* mmio */
675 		return false;
676 	case PKT_TYPE_TXS:
677 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
678 			mt7921_mac_add_txs(dev, rxd);
679 		return false;
680 	default:
681 		return true;
682 	}
683 }
684 EXPORT_SYMBOL_GPL(mt7921_rx_check);
685 
686 void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
687 			 struct sk_buff *skb, u32 *info)
688 {
689 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
690 	__le32 *rxd = (__le32 *)skb->data;
691 	__le32 *end = (__le32 *)&skb->data[skb->len];
692 	enum rx_pkt_type type;
693 	u16 flag;
694 
695 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
696 	flag = le32_get_bits(rxd[0], MT_RXD0_PKT_FLAG);
697 
698 	if (type == PKT_TYPE_RX_EVENT && flag == 0x1)
699 		type = PKT_TYPE_NORMAL_MCU;
700 
701 	switch (type) {
702 	case PKT_TYPE_TXRX_NOTIFY:
703 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
704 		mt7921_mac_tx_free(dev, skb->data, skb->len);
705 		napi_consume_skb(skb, 1);
706 		break;
707 	case PKT_TYPE_RX_EVENT:
708 		mt7921_mcu_rx_event(dev, skb);
709 		break;
710 	case PKT_TYPE_TXS:
711 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
712 			mt7921_mac_add_txs(dev, rxd);
713 		dev_kfree_skb(skb);
714 		break;
715 	case PKT_TYPE_NORMAL_MCU:
716 	case PKT_TYPE_NORMAL:
717 		if (!mt7921_mac_fill_rx(dev, skb)) {
718 			mt76_rx(&dev->mt76, q, skb);
719 			return;
720 		}
721 		fallthrough;
722 	default:
723 		dev_kfree_skb(skb);
724 		break;
725 	}
726 }
727 EXPORT_SYMBOL_GPL(mt7921_queue_rx_skb);
728 
729 void mt7921_mac_reset_counters(struct mt7921_phy *phy)
730 {
731 	struct mt7921_dev *dev = phy->dev;
732 	int i;
733 
734 	for (i = 0; i < 4; i++) {
735 		mt76_rr(dev, MT_TX_AGG_CNT(0, i));
736 		mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
737 	}
738 
739 	dev->mt76.phy.survey_time = ktime_get_boottime();
740 	memset(phy->mt76->aggr_stats, 0, sizeof(phy->mt76->aggr_stats));
741 
742 	/* reset airtime counters */
743 	mt76_rr(dev, MT_MIB_SDR9(0));
744 	mt76_rr(dev, MT_MIB_SDR36(0));
745 	mt76_rr(dev, MT_MIB_SDR37(0));
746 
747 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
748 	mt76_set(dev, MT_WF_RMAC_MIB_AIRTIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
749 }
750 
751 void mt7921_mac_set_timing(struct mt7921_phy *phy)
752 {
753 	s16 coverage_class = phy->coverage_class;
754 	struct mt7921_dev *dev = phy->dev;
755 	u32 val, reg_offset;
756 	u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) |
757 		  FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48);
758 	u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) |
759 		   FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28);
760 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
761 	int sifs = is_2ghz ? 10 : 16, offset;
762 
763 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
764 		return;
765 
766 	mt76_set(dev, MT_ARB_SCR(0),
767 		 MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
768 	udelay(1);
769 
770 	offset = 3 * coverage_class;
771 	reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) |
772 		     FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset);
773 
774 	mt76_wr(dev, MT_TMAC_CDTR(0), cck + reg_offset);
775 	mt76_wr(dev, MT_TMAC_ODTR(0), ofdm + reg_offset);
776 	mt76_wr(dev, MT_TMAC_ICR0(0),
777 		FIELD_PREP(MT_IFS_EIFS, 360) |
778 		FIELD_PREP(MT_IFS_RIFS, 2) |
779 		FIELD_PREP(MT_IFS_SIFS, sifs) |
780 		FIELD_PREP(MT_IFS_SLOT, phy->slottime));
781 
782 	if (phy->slottime < 20 || !is_2ghz)
783 		val = MT7921_CFEND_RATE_DEFAULT;
784 	else
785 		val = MT7921_CFEND_RATE_11B;
786 
787 	mt76_rmw_field(dev, MT_AGG_ACR0(0), MT_AGG_ACR_CFEND_RATE, val);
788 	mt76_clear(dev, MT_ARB_SCR(0),
789 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
790 }
791 
792 static u8
793 mt7921_phy_get_nf(struct mt7921_phy *phy, int idx)
794 {
795 	return 0;
796 }
797 
798 static void
799 mt7921_phy_update_channel(struct mt76_phy *mphy, int idx)
800 {
801 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
802 	struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
803 	struct mt76_channel_state *state;
804 	u64 busy_time, tx_time, rx_time, obss_time;
805 	int nf;
806 
807 	busy_time = mt76_get_field(dev, MT_MIB_SDR9(idx),
808 				   MT_MIB_SDR9_BUSY_MASK);
809 	tx_time = mt76_get_field(dev, MT_MIB_SDR36(idx),
810 				 MT_MIB_SDR36_TXTIME_MASK);
811 	rx_time = mt76_get_field(dev, MT_MIB_SDR37(idx),
812 				 MT_MIB_SDR37_RXTIME_MASK);
813 	obss_time = mt76_get_field(dev, MT_WF_RMAC_MIB_AIRTIME14(idx),
814 				   MT_MIB_OBSSTIME_MASK);
815 
816 	nf = mt7921_phy_get_nf(phy, idx);
817 	if (!phy->noise)
818 		phy->noise = nf << 4;
819 	else if (nf)
820 		phy->noise += nf - (phy->noise >> 4);
821 
822 	state = mphy->chan_state;
823 	state->cc_busy += busy_time;
824 	state->cc_tx += tx_time;
825 	state->cc_rx += rx_time + obss_time;
826 	state->cc_bss_rx += rx_time;
827 	state->noise = -(phy->noise >> 4);
828 }
829 
830 void mt7921_update_channel(struct mt76_phy *mphy)
831 {
832 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
833 
834 	if (mt76_connac_pm_wake(mphy, &dev->pm))
835 		return;
836 
837 	mt7921_phy_update_channel(mphy, 0);
838 	/* reset obss airtime */
839 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
840 
841 	mt76_connac_power_save_sched(mphy, &dev->pm);
842 }
843 EXPORT_SYMBOL_GPL(mt7921_update_channel);
844 
845 static void
846 mt7921_vif_connect_iter(void *priv, u8 *mac,
847 			struct ieee80211_vif *vif)
848 {
849 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
850 	struct mt7921_dev *dev = mvif->phy->dev;
851 	struct ieee80211_hw *hw = mt76_hw(dev);
852 
853 	if (vif->type == NL80211_IFTYPE_STATION)
854 		ieee80211_disconnect(vif, true);
855 
856 	mt76_connac_mcu_uni_add_dev(&dev->mphy, vif, &mvif->sta.wcid, true);
857 	mt7921_mcu_set_tx(dev, vif);
858 
859 	if (vif->type == NL80211_IFTYPE_AP) {
860 		mt76_connac_mcu_uni_add_bss(dev->phy.mt76, vif, &mvif->sta.wcid,
861 					    true, NULL);
862 		mt7921_mcu_sta_update(dev, NULL, vif, true,
863 				      MT76_STA_INFO_STATE_NONE);
864 		mt7921_mcu_uni_add_beacon_offload(dev, hw, vif, true);
865 	}
866 }
867 
868 /* system error recovery */
869 void mt7921_mac_reset_work(struct work_struct *work)
870 {
871 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
872 					      reset_work);
873 	struct ieee80211_hw *hw = mt76_hw(dev);
874 	struct mt76_connac_pm *pm = &dev->pm;
875 	int i, ret;
876 
877 	dev_dbg(dev->mt76.dev, "chip reset\n");
878 	dev->hw_full_reset = true;
879 	ieee80211_stop_queues(hw);
880 
881 	cancel_delayed_work_sync(&dev->mphy.mac_work);
882 	cancel_delayed_work_sync(&pm->ps_work);
883 	cancel_work_sync(&pm->wake_work);
884 
885 	for (i = 0; i < 10; i++) {
886 		mutex_lock(&dev->mt76.mutex);
887 		ret = mt7921_dev_reset(dev);
888 		mutex_unlock(&dev->mt76.mutex);
889 
890 		if (!ret)
891 			break;
892 	}
893 
894 	if (i == 10)
895 		dev_err(dev->mt76.dev, "chip reset failed\n");
896 
897 	if (test_and_clear_bit(MT76_HW_SCANNING, &dev->mphy.state)) {
898 		struct cfg80211_scan_info info = {
899 			.aborted = true,
900 		};
901 
902 		ieee80211_scan_completed(dev->mphy.hw, &info);
903 	}
904 
905 	dev->hw_full_reset = false;
906 	pm->suspended = false;
907 	ieee80211_wake_queues(hw);
908 	ieee80211_iterate_active_interfaces(hw,
909 					    IEEE80211_IFACE_ITER_RESUME_ALL,
910 					    mt7921_vif_connect_iter, NULL);
911 	mt76_connac_power_save_sched(&dev->mt76.phy, pm);
912 }
913 
914 void mt7921_reset(struct mt76_dev *mdev)
915 {
916 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
917 	struct mt76_connac_pm *pm = &dev->pm;
918 
919 	if (!dev->hw_init_done)
920 		return;
921 
922 	if (dev->hw_full_reset)
923 		return;
924 
925 	if (pm->suspended)
926 		return;
927 
928 	queue_work(dev->mt76.wq, &dev->reset_work);
929 }
930 EXPORT_SYMBOL_GPL(mt7921_reset);
931 
932 void mt7921_mac_update_mib_stats(struct mt7921_phy *phy)
933 {
934 	struct mt7921_dev *dev = phy->dev;
935 	struct mib_stats *mib = &phy->mib;
936 	int i, aggr0 = 0, aggr1;
937 	u32 val;
938 
939 	mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(0),
940 					   MT_MIB_SDR3_FCS_ERR_MASK);
941 	mib->ack_fail_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR3(0),
942 					    MT_MIB_ACK_FAIL_COUNT_MASK);
943 	mib->ba_miss_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR2(0),
944 					   MT_MIB_BA_FAIL_COUNT_MASK);
945 	mib->rts_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR0(0),
946 				       MT_MIB_RTS_COUNT_MASK);
947 	mib->rts_retries_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR1(0),
948 					       MT_MIB_RTS_FAIL_COUNT_MASK);
949 
950 	mib->tx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR12(0));
951 	mib->tx_mpdu_attempts_cnt += mt76_rr(dev, MT_MIB_SDR14(0));
952 	mib->tx_mpdu_success_cnt += mt76_rr(dev, MT_MIB_SDR15(0));
953 
954 	val = mt76_rr(dev, MT_MIB_SDR32(0));
955 	mib->tx_pkt_ebf_cnt += FIELD_GET(MT_MIB_SDR9_EBF_CNT_MASK, val);
956 	mib->tx_pkt_ibf_cnt += FIELD_GET(MT_MIB_SDR9_IBF_CNT_MASK, val);
957 
958 	val = mt76_rr(dev, MT_ETBF_TX_APP_CNT(0));
959 	mib->tx_bf_ibf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_IBF_CNT, val);
960 	mib->tx_bf_ebf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_EBF_CNT, val);
961 
962 	val = mt76_rr(dev, MT_ETBF_RX_FB_CNT(0));
963 	mib->tx_bf_rx_fb_all_cnt += FIELD_GET(MT_ETBF_RX_FB_ALL, val);
964 	mib->tx_bf_rx_fb_he_cnt += FIELD_GET(MT_ETBF_RX_FB_HE, val);
965 	mib->tx_bf_rx_fb_vht_cnt += FIELD_GET(MT_ETBF_RX_FB_VHT, val);
966 	mib->tx_bf_rx_fb_ht_cnt += FIELD_GET(MT_ETBF_RX_FB_HT, val);
967 
968 	mib->rx_mpdu_cnt += mt76_rr(dev, MT_MIB_SDR5(0));
969 	mib->rx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR22(0));
970 	mib->rx_ampdu_bytes_cnt += mt76_rr(dev, MT_MIB_SDR23(0));
971 	mib->rx_ba_cnt += mt76_rr(dev, MT_MIB_SDR31(0));
972 
973 	for (i = 0; i < ARRAY_SIZE(mib->tx_amsdu); i++) {
974 		val = mt76_rr(dev, MT_PLE_AMSDU_PACK_MSDU_CNT(i));
975 		mib->tx_amsdu[i] += val;
976 		mib->tx_amsdu_cnt += val;
977 	}
978 
979 	for (i = 0, aggr1 = aggr0 + 8; i < 4; i++) {
980 		u32 val2;
981 
982 		val = mt76_rr(dev, MT_TX_AGG_CNT(0, i));
983 		val2 = mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
984 
985 		phy->mt76->aggr_stats[aggr0++] += val & 0xffff;
986 		phy->mt76->aggr_stats[aggr0++] += val >> 16;
987 		phy->mt76->aggr_stats[aggr1++] += val2 & 0xffff;
988 		phy->mt76->aggr_stats[aggr1++] += val2 >> 16;
989 	}
990 }
991 
992 void mt7921_mac_work(struct work_struct *work)
993 {
994 	struct mt7921_phy *phy;
995 	struct mt76_phy *mphy;
996 
997 	mphy = (struct mt76_phy *)container_of(work, struct mt76_phy,
998 					       mac_work.work);
999 	phy = mphy->priv;
1000 
1001 	mt7921_mutex_acquire(phy->dev);
1002 
1003 	mt76_update_survey(mphy);
1004 	if (++mphy->mac_work_count == 2) {
1005 		mphy->mac_work_count = 0;
1006 
1007 		mt7921_mac_update_mib_stats(phy);
1008 	}
1009 
1010 	mt7921_mutex_release(phy->dev);
1011 
1012 	mt76_tx_status_check(mphy->dev, false);
1013 	ieee80211_queue_delayed_work(phy->mt76->hw, &mphy->mac_work,
1014 				     MT7921_WATCHDOG_TIME);
1015 }
1016 
1017 void mt7921_pm_wake_work(struct work_struct *work)
1018 {
1019 	struct mt7921_dev *dev;
1020 	struct mt76_phy *mphy;
1021 
1022 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1023 						pm.wake_work);
1024 	mphy = dev->phy.mt76;
1025 
1026 	if (!mt7921_mcu_drv_pmctrl(dev)) {
1027 		struct mt76_dev *mdev = &dev->mt76;
1028 		int i;
1029 
1030 		if (mt76_is_sdio(mdev)) {
1031 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1032 			mt76_worker_schedule(&mdev->sdio.txrx_worker);
1033 		} else {
1034 			local_bh_disable();
1035 			mt76_for_each_q_rx(mdev, i)
1036 				napi_schedule(&mdev->napi[i]);
1037 			local_bh_enable();
1038 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1039 			mt76_connac_tx_cleanup(mdev);
1040 		}
1041 		if (test_bit(MT76_STATE_RUNNING, &mphy->state))
1042 			ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
1043 						     MT7921_WATCHDOG_TIME);
1044 	}
1045 
1046 	ieee80211_wake_queues(mphy->hw);
1047 	wake_up(&dev->pm.wait);
1048 }
1049 
1050 void mt7921_pm_power_save_work(struct work_struct *work)
1051 {
1052 	struct mt7921_dev *dev;
1053 	unsigned long delta;
1054 	struct mt76_phy *mphy;
1055 
1056 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1057 						pm.ps_work.work);
1058 	mphy = dev->phy.mt76;
1059 
1060 	delta = dev->pm.idle_timeout;
1061 	if (test_bit(MT76_HW_SCANNING, &mphy->state) ||
1062 	    test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) ||
1063 	    dev->fw_assert)
1064 		goto out;
1065 
1066 	if (mutex_is_locked(&dev->mt76.mutex))
1067 		/* if mt76 mutex is held we should not put the device
1068 		 * to sleep since we are currently accessing device
1069 		 * register map. We need to wait for the next power_save
1070 		 * trigger.
1071 		 */
1072 		goto out;
1073 
1074 	if (time_is_after_jiffies(dev->pm.last_activity + delta)) {
1075 		delta = dev->pm.last_activity + delta - jiffies;
1076 		goto out;
1077 	}
1078 
1079 	if (!mt7921_mcu_fw_pmctrl(dev)) {
1080 		cancel_delayed_work_sync(&mphy->mac_work);
1081 		return;
1082 	}
1083 out:
1084 	queue_delayed_work(dev->mt76.wq, &dev->pm.ps_work, delta);
1085 }
1086 
1087 void mt7921_coredump_work(struct work_struct *work)
1088 {
1089 	struct mt7921_dev *dev;
1090 	char *dump, *data;
1091 
1092 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1093 						coredump.work.work);
1094 
1095 	if (time_is_after_jiffies(dev->coredump.last_activity +
1096 				  4 * MT76_CONNAC_COREDUMP_TIMEOUT)) {
1097 		queue_delayed_work(dev->mt76.wq, &dev->coredump.work,
1098 				   MT76_CONNAC_COREDUMP_TIMEOUT);
1099 		return;
1100 	}
1101 
1102 	dump = vzalloc(MT76_CONNAC_COREDUMP_SZ);
1103 	data = dump;
1104 
1105 	while (true) {
1106 		struct sk_buff *skb;
1107 
1108 		spin_lock_bh(&dev->mt76.lock);
1109 		skb = __skb_dequeue(&dev->coredump.msg_list);
1110 		spin_unlock_bh(&dev->mt76.lock);
1111 
1112 		if (!skb)
1113 			break;
1114 
1115 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
1116 		if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
1117 			dev_kfree_skb(skb);
1118 			continue;
1119 		}
1120 
1121 		memcpy(data, skb->data, skb->len);
1122 		data += skb->len;
1123 
1124 		dev_kfree_skb(skb);
1125 	}
1126 
1127 	if (dump)
1128 		dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
1129 			      GFP_KERNEL);
1130 
1131 	mt7921_reset(&dev->mt76);
1132 }
1133 
1134 /* usb_sdio */
1135 static void
1136 mt7921_usb_sdio_write_txwi(struct mt7921_dev *dev, struct mt76_wcid *wcid,
1137 			   enum mt76_txq_id qid, struct ieee80211_sta *sta,
1138 			   struct ieee80211_key_conf *key, int pid,
1139 			   struct sk_buff *skb)
1140 {
1141 	__le32 *txwi = (__le32 *)(skb->data - MT_SDIO_TXD_SIZE);
1142 
1143 	memset(txwi, 0, MT_SDIO_TXD_SIZE);
1144 	mt76_connac2_mac_write_txwi(&dev->mt76, txwi, skb, wcid, key, pid, qid, 0);
1145 	skb_push(skb, MT_SDIO_TXD_SIZE);
1146 }
1147 
1148 int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
1149 				   enum mt76_txq_id qid, struct mt76_wcid *wcid,
1150 				   struct ieee80211_sta *sta,
1151 				   struct mt76_tx_info *tx_info)
1152 {
1153 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1154 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
1155 	struct ieee80211_key_conf *key = info->control.hw_key;
1156 	struct sk_buff *skb = tx_info->skb;
1157 	int err, pad, pktid, type;
1158 
1159 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
1160 		return -EINVAL;
1161 
1162 	if (!wcid)
1163 		wcid = &dev->mt76.global_wcid;
1164 
1165 	if (sta) {
1166 		struct mt7921_sta *msta = (struct mt7921_sta *)sta->drv_priv;
1167 
1168 		if (time_after(jiffies, msta->last_txs + HZ / 4)) {
1169 			info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1170 			msta->last_txs = jiffies;
1171 		}
1172 	}
1173 
1174 	pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb);
1175 	mt7921_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);
1176 
1177 	type = mt76_is_sdio(mdev) ? MT7921_SDIO_DATA : 0;
1178 	mt7921_skb_add_usb_sdio_hdr(dev, skb, type);
1179 	pad = round_up(skb->len, 4) - skb->len;
1180 	if (mt76_is_usb(mdev))
1181 		pad += 4;
1182 
1183 	err = mt76_skb_adjust_pad(skb, pad);
1184 	if (err)
1185 		/* Release pktid in case of error. */
1186 		idr_remove(&wcid->pktid, pktid);
1187 
1188 	return err;
1189 }
1190 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_prepare_skb);
1191 
1192 void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,
1193 				     struct mt76_queue_entry *e)
1194 {
1195 	__le32 *txwi = (__le32 *)(e->skb->data + MT_SDIO_HDR_SIZE);
1196 	unsigned int headroom = MT_SDIO_TXD_SIZE + MT_SDIO_HDR_SIZE;
1197 	struct ieee80211_sta *sta;
1198 	struct mt76_wcid *wcid;
1199 	u16 idx;
1200 
1201 	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
1202 	wcid = rcu_dereference(mdev->wcid[idx]);
1203 	sta = wcid_to_sta(wcid);
1204 
1205 	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))
1206 		mt7921_tx_check_aggr(sta, txwi);
1207 
1208 	skb_pull(e->skb, headroom);
1209 	mt76_tx_complete_skb(mdev, e->wcid, e->skb);
1210 }
1211 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_complete_skb);
1212 
1213 bool mt7921_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)
1214 {
1215 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1216 
1217 	mt7921_mutex_acquire(dev);
1218 	mt7921_mac_sta_poll(dev);
1219 	mt7921_mutex_release(dev);
1220 
1221 	return false;
1222 }
1223 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_status_data);
1224 
1225 #if IS_ENABLED(CONFIG_IPV6)
1226 void mt7921_set_ipv6_ns_work(struct work_struct *work)
1227 {
1228 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
1229 						ipv6_ns_work);
1230 	struct sk_buff *skb;
1231 	int ret = 0;
1232 
1233 	do {
1234 		skb = skb_dequeue(&dev->ipv6_ns_list);
1235 
1236 		if (!skb)
1237 			break;
1238 
1239 		mt7921_mutex_acquire(dev);
1240 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1241 					    MCU_UNI_CMD(OFFLOAD), true);
1242 		mt7921_mutex_release(dev);
1243 
1244 	} while (!ret);
1245 
1246 	if (ret)
1247 		skb_queue_purge(&dev->ipv6_ns_list);
1248 }
1249 #endif
1250