1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/devcoredump.h>
5 #include <linux/etherdevice.h>
6 #include <linux/timekeeping.h>
7 #include "mt7921.h"
8 #include "../dma.h"
9 #include "mac.h"
10 #include "mcu.h"
11 
12 static struct mt76_wcid *mt7921_rx_get_wcid(struct mt7921_dev *dev,
13 					    u16 idx, bool unicast)
14 {
15 	struct mt7921_sta *sta;
16 	struct mt76_wcid *wcid;
17 
18 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
19 		return NULL;
20 
21 	wcid = rcu_dereference(dev->mt76.wcid[idx]);
22 	if (unicast || !wcid)
23 		return wcid;
24 
25 	if (!wcid->sta)
26 		return NULL;
27 
28 	sta = container_of(wcid, struct mt7921_sta, wcid);
29 	if (!sta->vif)
30 		return NULL;
31 
32 	return &sta->vif->sta.wcid;
33 }
34 
35 void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
36 {
37 }
38 EXPORT_SYMBOL_GPL(mt7921_sta_ps);
39 
40 bool mt7921_mac_wtbl_update(struct mt7921_dev *dev, int idx, u32 mask)
41 {
42 	mt76_rmw(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_WLAN_IDX,
43 		 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, idx) | mask);
44 
45 	return mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY,
46 			 0, 5000);
47 }
48 
49 void mt7921_mac_sta_poll(struct mt7921_dev *dev)
50 {
51 	static const u8 ac_to_tid[] = {
52 		[IEEE80211_AC_BE] = 0,
53 		[IEEE80211_AC_BK] = 1,
54 		[IEEE80211_AC_VI] = 4,
55 		[IEEE80211_AC_VO] = 6
56 	};
57 	struct ieee80211_sta *sta;
58 	struct mt7921_sta *msta;
59 	u32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS];
60 	LIST_HEAD(sta_poll_list);
61 	struct rate_info *rate;
62 	int i;
63 
64 	spin_lock_bh(&dev->sta_poll_lock);
65 	list_splice_init(&dev->sta_poll_list, &sta_poll_list);
66 	spin_unlock_bh(&dev->sta_poll_lock);
67 
68 	while (true) {
69 		bool clear = false;
70 		u32 addr, val;
71 		u16 idx;
72 		u8 bw;
73 
74 		spin_lock_bh(&dev->sta_poll_lock);
75 		if (list_empty(&sta_poll_list)) {
76 			spin_unlock_bh(&dev->sta_poll_lock);
77 			break;
78 		}
79 		msta = list_first_entry(&sta_poll_list,
80 					struct mt7921_sta, poll_list);
81 		list_del_init(&msta->poll_list);
82 		spin_unlock_bh(&dev->sta_poll_lock);
83 
84 		idx = msta->wcid.idx;
85 		addr = mt7921_mac_wtbl_lmac_addr(idx, MT_WTBL_AC0_CTT_OFFSET);
86 
87 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
88 			u32 tx_last = msta->airtime_ac[i];
89 			u32 rx_last = msta->airtime_ac[i + 4];
90 
91 			msta->airtime_ac[i] = mt76_rr(dev, addr);
92 			msta->airtime_ac[i + 4] = mt76_rr(dev, addr + 4);
93 
94 			tx_time[i] = msta->airtime_ac[i] - tx_last;
95 			rx_time[i] = msta->airtime_ac[i + 4] - rx_last;
96 
97 			if ((tx_last | rx_last) & BIT(30))
98 				clear = true;
99 
100 			addr += 8;
101 		}
102 
103 		if (clear) {
104 			mt7921_mac_wtbl_update(dev, idx,
105 					       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
106 			memset(msta->airtime_ac, 0, sizeof(msta->airtime_ac));
107 		}
108 
109 		if (!msta->wcid.sta)
110 			continue;
111 
112 		sta = container_of((void *)msta, struct ieee80211_sta,
113 				   drv_priv);
114 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
115 			u8 q = mt76_connac_lmac_mapping(i);
116 			u32 tx_cur = tx_time[q];
117 			u32 rx_cur = rx_time[q];
118 			u8 tid = ac_to_tid[i];
119 
120 			if (!tx_cur && !rx_cur)
121 				continue;
122 
123 			ieee80211_sta_register_airtime(sta, tid, tx_cur,
124 						       rx_cur);
125 		}
126 
127 		/* We don't support reading GI info from txs packets.
128 		 * For accurate tx status reporting and AQL improvement,
129 		 * we need to make sure that flags match so polling GI
130 		 * from per-sta counters directly.
131 		 */
132 		rate = &msta->wcid.rate;
133 		addr = mt7921_mac_wtbl_lmac_addr(idx,
134 						 MT_WTBL_TXRX_CAP_RATE_OFFSET);
135 		val = mt76_rr(dev, addr);
136 
137 		switch (rate->bw) {
138 		case RATE_INFO_BW_160:
139 			bw = IEEE80211_STA_RX_BW_160;
140 			break;
141 		case RATE_INFO_BW_80:
142 			bw = IEEE80211_STA_RX_BW_80;
143 			break;
144 		case RATE_INFO_BW_40:
145 			bw = IEEE80211_STA_RX_BW_40;
146 			break;
147 		default:
148 			bw = IEEE80211_STA_RX_BW_20;
149 			break;
150 		}
151 
152 		if (rate->flags & RATE_INFO_FLAGS_HE_MCS) {
153 			u8 offs = MT_WTBL_TXRX_RATE_G2_HE + 2 * bw;
154 
155 			rate->he_gi = (val & (0x3 << offs)) >> offs;
156 		} else if (rate->flags &
157 			   (RATE_INFO_FLAGS_VHT_MCS | RATE_INFO_FLAGS_MCS)) {
158 			if (val & BIT(MT_WTBL_TXRX_RATE_G2 + bw))
159 				rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
160 			else
161 				rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
162 		}
163 	}
164 }
165 EXPORT_SYMBOL_GPL(mt7921_mac_sta_poll);
166 
167 static void
168 mt7921_get_status_freq_info(struct mt7921_dev *dev, struct mt76_phy *mphy,
169 			    struct mt76_rx_status *status, u8 chfreq)
170 {
171 	if (!test_bit(MT76_HW_SCANNING, &mphy->state) &&
172 	    !test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) &&
173 	    !test_bit(MT76_STATE_ROC, &mphy->state)) {
174 		status->freq = mphy->chandef.chan->center_freq;
175 		status->band = mphy->chandef.chan->band;
176 		return;
177 	}
178 
179 	if (chfreq > 180) {
180 		status->band = NL80211_BAND_6GHZ;
181 		chfreq = (chfreq - 181) * 4 + 1;
182 	} else if (chfreq > 14) {
183 		status->band = NL80211_BAND_5GHZ;
184 	} else {
185 		status->band = NL80211_BAND_2GHZ;
186 	}
187 	status->freq = ieee80211_channel_to_frequency(chfreq, status->band);
188 }
189 
190 static void
191 mt7921_mac_rssi_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
192 {
193 	struct sk_buff *skb = priv;
194 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
195 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
196 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
197 
198 	if (status->signal > 0)
199 		return;
200 
201 	if (!ether_addr_equal(vif->addr, hdr->addr1))
202 		return;
203 
204 	ewma_rssi_add(&mvif->rssi, -status->signal);
205 }
206 
207 static void
208 mt7921_mac_assoc_rssi(struct mt7921_dev *dev, struct sk_buff *skb)
209 {
210 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
211 
212 	if (!ieee80211_is_assoc_resp(hdr->frame_control) &&
213 	    !ieee80211_is_auth(hdr->frame_control))
214 		return;
215 
216 	ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
217 		IEEE80211_IFACE_ITER_RESUME_ALL,
218 		mt7921_mac_rssi_iter, skb);
219 }
220 
221 static int
222 mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
223 {
224 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
225 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
226 	bool hdr_trans, unicast, insert_ccmp_hdr = false;
227 	u8 chfreq, qos_ctl = 0, remove_pad, amsdu_info;
228 	u16 hdr_gap;
229 	__le32 *rxv = NULL, *rxd = (__le32 *)skb->data;
230 	struct mt76_phy *mphy = &dev->mt76.phy;
231 	struct mt7921_phy *phy = &dev->phy;
232 	struct ieee80211_supported_band *sband;
233 	u32 csum_status = *(u32 *)skb->cb;
234 	u32 rxd0 = le32_to_cpu(rxd[0]);
235 	u32 rxd1 = le32_to_cpu(rxd[1]);
236 	u32 rxd2 = le32_to_cpu(rxd[2]);
237 	u32 rxd3 = le32_to_cpu(rxd[3]);
238 	u32 rxd4 = le32_to_cpu(rxd[4]);
239 	struct mt7921_sta *msta = NULL;
240 	u16 seq_ctrl = 0;
241 	__le16 fc = 0;
242 	u8 mode = 0;
243 	int i, idx;
244 
245 	memset(status, 0, sizeof(*status));
246 
247 	if (rxd1 & MT_RXD1_NORMAL_BAND_IDX)
248 		return -EINVAL;
249 
250 	if (!test_bit(MT76_STATE_RUNNING, &mphy->state))
251 		return -EINVAL;
252 
253 	if (rxd2 & MT_RXD2_NORMAL_AMSDU_ERR)
254 		return -EINVAL;
255 
256 	hdr_trans = rxd2 & MT_RXD2_NORMAL_HDR_TRANS;
257 	if (hdr_trans && (rxd1 & MT_RXD1_NORMAL_CM))
258 		return -EINVAL;
259 
260 	/* ICV error or CCMP/BIP/WPI MIC error */
261 	if (rxd1 & MT_RXD1_NORMAL_ICV_ERR)
262 		status->flag |= RX_FLAG_ONLY_MONITOR;
263 
264 	chfreq = FIELD_GET(MT_RXD3_NORMAL_CH_FREQ, rxd3);
265 	unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
266 	idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
267 	status->wcid = mt7921_rx_get_wcid(dev, idx, unicast);
268 
269 	if (status->wcid) {
270 		msta = container_of(status->wcid, struct mt7921_sta, wcid);
271 		spin_lock_bh(&dev->sta_poll_lock);
272 		if (list_empty(&msta->poll_list))
273 			list_add_tail(&msta->poll_list, &dev->sta_poll_list);
274 		spin_unlock_bh(&dev->sta_poll_lock);
275 	}
276 
277 	mt7921_get_status_freq_info(dev, mphy, status, chfreq);
278 
279 	switch (status->band) {
280 	case NL80211_BAND_5GHZ:
281 		sband = &mphy->sband_5g.sband;
282 		break;
283 	case NL80211_BAND_6GHZ:
284 		sband = &mphy->sband_6g.sband;
285 		break;
286 	default:
287 		sband = &mphy->sband_2g.sband;
288 		break;
289 	}
290 
291 	if (!sband->channels)
292 		return -EINVAL;
293 
294 	if (mt76_is_mmio(&dev->mt76) && (rxd0 & csum_mask) == csum_mask &&
295 	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))
296 		skb->ip_summed = CHECKSUM_UNNECESSARY;
297 
298 	if (rxd1 & MT_RXD1_NORMAL_FCS_ERR)
299 		status->flag |= RX_FLAG_FAILED_FCS_CRC;
300 
301 	if (rxd1 & MT_RXD1_NORMAL_TKIP_MIC_ERR)
302 		status->flag |= RX_FLAG_MMIC_ERROR;
303 
304 	if (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1) != 0 &&
305 	    !(rxd1 & (MT_RXD1_NORMAL_CLM | MT_RXD1_NORMAL_CM))) {
306 		status->flag |= RX_FLAG_DECRYPTED;
307 		status->flag |= RX_FLAG_IV_STRIPPED;
308 		status->flag |= RX_FLAG_MMIC_STRIPPED | RX_FLAG_MIC_STRIPPED;
309 	}
310 
311 	remove_pad = FIELD_GET(MT_RXD2_NORMAL_HDR_OFFSET, rxd2);
312 
313 	if (rxd2 & MT_RXD2_NORMAL_MAX_LEN_ERROR)
314 		return -EINVAL;
315 
316 	rxd += 6;
317 	if (rxd1 & MT_RXD1_NORMAL_GROUP_4) {
318 		u32 v0 = le32_to_cpu(rxd[0]);
319 		u32 v2 = le32_to_cpu(rxd[2]);
320 
321 		fc = cpu_to_le16(FIELD_GET(MT_RXD6_FRAME_CONTROL, v0));
322 		seq_ctrl = FIELD_GET(MT_RXD8_SEQ_CTRL, v2);
323 		qos_ctl = FIELD_GET(MT_RXD8_QOS_CTL, v2);
324 
325 		rxd += 4;
326 		if ((u8 *)rxd - skb->data >= skb->len)
327 			return -EINVAL;
328 	}
329 
330 	if (rxd1 & MT_RXD1_NORMAL_GROUP_1) {
331 		u8 *data = (u8 *)rxd;
332 
333 		if (status->flag & RX_FLAG_DECRYPTED) {
334 			switch (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1)) {
335 			case MT_CIPHER_AES_CCMP:
336 			case MT_CIPHER_CCMP_CCX:
337 			case MT_CIPHER_CCMP_256:
338 				insert_ccmp_hdr =
339 					FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
340 				fallthrough;
341 			case MT_CIPHER_TKIP:
342 			case MT_CIPHER_TKIP_NO_MIC:
343 			case MT_CIPHER_GCMP:
344 			case MT_CIPHER_GCMP_256:
345 				status->iv[0] = data[5];
346 				status->iv[1] = data[4];
347 				status->iv[2] = data[3];
348 				status->iv[3] = data[2];
349 				status->iv[4] = data[1];
350 				status->iv[5] = data[0];
351 				break;
352 			default:
353 				break;
354 			}
355 		}
356 		rxd += 4;
357 		if ((u8 *)rxd - skb->data >= skb->len)
358 			return -EINVAL;
359 	}
360 
361 	if (rxd1 & MT_RXD1_NORMAL_GROUP_2) {
362 		status->timestamp = le32_to_cpu(rxd[0]);
363 		status->flag |= RX_FLAG_MACTIME_START;
364 
365 		if (!(rxd2 & MT_RXD2_NORMAL_NON_AMPDU)) {
366 			status->flag |= RX_FLAG_AMPDU_DETAILS;
367 
368 			/* all subframes of an A-MPDU have the same timestamp */
369 			if (phy->rx_ampdu_ts != status->timestamp) {
370 				if (!++phy->ampdu_ref)
371 					phy->ampdu_ref++;
372 			}
373 			phy->rx_ampdu_ts = status->timestamp;
374 
375 			status->ampdu_ref = phy->ampdu_ref;
376 		}
377 
378 		rxd += 2;
379 		if ((u8 *)rxd - skb->data >= skb->len)
380 			return -EINVAL;
381 	}
382 
383 	/* RXD Group 3 - P-RXV */
384 	if (rxd1 & MT_RXD1_NORMAL_GROUP_3) {
385 		u32 v0, v1;
386 		int ret;
387 
388 		rxv = rxd;
389 		rxd += 2;
390 		if ((u8 *)rxd - skb->data >= skb->len)
391 			return -EINVAL;
392 
393 		v0 = le32_to_cpu(rxv[0]);
394 		v1 = le32_to_cpu(rxv[1]);
395 
396 		if (v0 & MT_PRXV_HT_AD_CODE)
397 			status->enc_flags |= RX_ENC_FLAG_LDPC;
398 
399 		status->chains = mphy->antenna_mask;
400 		status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v1);
401 		status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1);
402 		status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1);
403 		status->chain_signal[3] = to_rssi(MT_PRXV_RCPI3, v1);
404 		status->signal = -128;
405 		for (i = 0; i < hweight8(mphy->antenna_mask); i++) {
406 			if (!(status->chains & BIT(i)) ||
407 			    status->chain_signal[i] >= 0)
408 				continue;
409 
410 			status->signal = max(status->signal,
411 					     status->chain_signal[i]);
412 		}
413 
414 		ret = mt76_connac2_mac_fill_rx_rate(&dev->mt76, status, sband,
415 						    rxv, &mode);
416 		if (ret < 0)
417 			return ret;
418 
419 		if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
420 			rxd += 18;
421 			if ((u8 *)rxd - skb->data >= skb->len)
422 				return -EINVAL;
423 		}
424 	}
425 
426 	amsdu_info = FIELD_GET(MT_RXD4_NORMAL_PAYLOAD_FORMAT, rxd4);
427 	status->amsdu = !!amsdu_info;
428 	if (status->amsdu) {
429 		status->first_amsdu = amsdu_info == MT_RXD4_FIRST_AMSDU_FRAME;
430 		status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME;
431 	}
432 
433 	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
434 	if (hdr_trans && ieee80211_has_morefrags(fc)) {
435 		struct ieee80211_vif *vif;
436 		int err;
437 
438 		if (!msta || !msta->vif)
439 			return -EINVAL;
440 
441 		vif = container_of((void *)msta->vif, struct ieee80211_vif,
442 				   drv_priv);
443 		err = mt76_connac2_reverse_frag0_hdr_trans(vif, skb, hdr_gap);
444 		if (err)
445 			return err;
446 
447 		hdr_trans = false;
448 	} else {
449 		skb_pull(skb, hdr_gap);
450 		if (!hdr_trans && status->amsdu) {
451 			memmove(skb->data + 2, skb->data,
452 				ieee80211_get_hdrlen_from_skb(skb));
453 			skb_pull(skb, 2);
454 		}
455 	}
456 
457 	if (!hdr_trans) {
458 		struct ieee80211_hdr *hdr;
459 
460 		if (insert_ccmp_hdr) {
461 			u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1);
462 
463 			mt76_insert_ccmp_hdr(skb, key_id);
464 		}
465 
466 		hdr = mt76_skb_get_hdr(skb);
467 		fc = hdr->frame_control;
468 		if (ieee80211_is_data_qos(fc)) {
469 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
470 			qos_ctl = *ieee80211_get_qos_ctl(hdr);
471 		}
472 	} else {
473 		status->flag |= RX_FLAG_8023;
474 	}
475 
476 	mt7921_mac_assoc_rssi(dev, skb);
477 
478 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
479 		mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv, mode);
480 
481 	if (!status->wcid || !ieee80211_is_data_qos(fc))
482 		return 0;
483 
484 	status->aggr = unicast && !ieee80211_is_qos_nullfunc(fc);
485 	status->seqno = IEEE80211_SEQ_TO_SN(seq_ctrl);
486 	status->qos_ctl = qos_ctl;
487 
488 	return 0;
489 }
490 
491 static void mt7921_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
492 {
493 	struct mt7921_sta *msta;
494 	u16 fc, tid;
495 	u32 val;
496 
497 	if (!sta || !(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
498 		return;
499 
500 	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
501 	if (tid >= 6) /* skip VO queue */
502 		return;
503 
504 	val = le32_to_cpu(txwi[2]);
505 	fc = FIELD_GET(MT_TXD2_FRAME_TYPE, val) << 2 |
506 	     FIELD_GET(MT_TXD2_SUB_TYPE, val) << 4;
507 	if (unlikely(fc != (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA)))
508 		return;
509 
510 	msta = (struct mt7921_sta *)sta->drv_priv;
511 	if (!test_and_set_bit(tid, &msta->ampdu_state))
512 		ieee80211_start_tx_ba_session(sta, tid, 0);
513 }
514 
515 void mt7921_mac_add_txs(struct mt7921_dev *dev, void *data)
516 {
517 	struct mt7921_sta *msta = NULL;
518 	struct mt76_wcid *wcid;
519 	__le32 *txs_data = data;
520 	u16 wcidx;
521 	u8 pid;
522 
523 	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
524 		return;
525 
526 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
527 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
528 
529 	if (pid < MT_PACKET_ID_FIRST)
530 		return;
531 
532 	if (wcidx >= MT7921_WTBL_SIZE)
533 		return;
534 
535 	rcu_read_lock();
536 
537 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
538 	if (!wcid)
539 		goto out;
540 
541 	msta = container_of(wcid, struct mt7921_sta, wcid);
542 
543 	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
544 	if (!wcid->sta)
545 		goto out;
546 
547 	spin_lock_bh(&dev->sta_poll_lock);
548 	if (list_empty(&msta->poll_list))
549 		list_add_tail(&msta->poll_list, &dev->sta_poll_list);
550 	spin_unlock_bh(&dev->sta_poll_lock);
551 
552 out:
553 	rcu_read_unlock();
554 }
555 
556 void mt7921_txwi_free(struct mt7921_dev *dev, struct mt76_txwi_cache *t,
557 		      struct ieee80211_sta *sta, bool clear_status,
558 		      struct list_head *free_list)
559 {
560 	struct mt76_dev *mdev = &dev->mt76;
561 	__le32 *txwi;
562 	u16 wcid_idx;
563 
564 	mt76_connac_txp_skb_unmap(mdev, t);
565 	if (!t->skb)
566 		goto out;
567 
568 	txwi = (__le32 *)mt76_get_txwi_ptr(mdev, t);
569 	if (sta) {
570 		struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
571 
572 		if (likely(t->skb->protocol != cpu_to_be16(ETH_P_PAE)))
573 			mt7921_tx_check_aggr(sta, txwi);
574 
575 		wcid_idx = wcid->idx;
576 	} else {
577 		wcid_idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
578 	}
579 
580 	__mt76_tx_complete_skb(mdev, wcid_idx, t->skb, free_list);
581 out:
582 	t->skb = NULL;
583 	mt76_put_txwi(mdev, t);
584 }
585 EXPORT_SYMBOL_GPL(mt7921_txwi_free);
586 
587 static void mt7921_mac_tx_free(struct mt7921_dev *dev, void *data, int len)
588 {
589 	struct mt76_connac_tx_free *free = data;
590 	__le32 *tx_info = (__le32 *)(data + sizeof(*free));
591 	struct mt76_dev *mdev = &dev->mt76;
592 	struct mt76_txwi_cache *txwi;
593 	struct ieee80211_sta *sta = NULL;
594 	struct sk_buff *skb, *tmp;
595 	void *end = data + len;
596 	LIST_HEAD(free_list);
597 	bool wake = false;
598 	u8 i, count;
599 
600 	/* clean DMA queues and unmap buffers first */
601 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_PSD], false);
602 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BE], false);
603 
604 	count = le16_get_bits(free->ctrl, MT_TX_FREE_MSDU_CNT);
605 	if (WARN_ON_ONCE((void *)&tx_info[count] > end))
606 		return;
607 
608 	for (i = 0; i < count; i++) {
609 		u32 msdu, info = le32_to_cpu(tx_info[i]);
610 		u8 stat;
611 
612 		/* 1'b1: new wcid pair.
613 		 * 1'b0: msdu_id with the same 'wcid pair' as above.
614 		 */
615 		if (info & MT_TX_FREE_PAIR) {
616 			struct mt7921_sta *msta;
617 			struct mt76_wcid *wcid;
618 			u16 idx;
619 
620 			count++;
621 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
622 			wcid = rcu_dereference(dev->mt76.wcid[idx]);
623 			sta = wcid_to_sta(wcid);
624 			if (!sta)
625 				continue;
626 
627 			msta = container_of(wcid, struct mt7921_sta, wcid);
628 			spin_lock_bh(&dev->sta_poll_lock);
629 			if (list_empty(&msta->poll_list))
630 				list_add_tail(&msta->poll_list, &dev->sta_poll_list);
631 			spin_unlock_bh(&dev->sta_poll_lock);
632 			continue;
633 		}
634 
635 		msdu = FIELD_GET(MT_TX_FREE_MSDU_ID, info);
636 		stat = FIELD_GET(MT_TX_FREE_STATUS, info);
637 
638 		txwi = mt76_token_release(mdev, msdu, &wake);
639 		if (!txwi)
640 			continue;
641 
642 		mt7921_txwi_free(dev, txwi, sta, stat, &free_list);
643 	}
644 
645 	if (wake)
646 		mt76_set_tx_blocked(&dev->mt76, false);
647 
648 	list_for_each_entry_safe(skb, tmp, &free_list, list) {
649 		skb_list_del_init(skb);
650 		napi_consume_skb(skb, 1);
651 	}
652 
653 	rcu_read_lock();
654 	mt7921_mac_sta_poll(dev);
655 	rcu_read_unlock();
656 
657 	mt76_worker_schedule(&dev->mt76.tx_worker);
658 }
659 
660 bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
661 {
662 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
663 	__le32 *rxd = (__le32 *)data;
664 	__le32 *end = (__le32 *)&rxd[len / 4];
665 	enum rx_pkt_type type;
666 
667 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
668 
669 	switch (type) {
670 	case PKT_TYPE_TXRX_NOTIFY:
671 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
672 		mt7921_mac_tx_free(dev, data, len); /* mmio */
673 		return false;
674 	case PKT_TYPE_TXS:
675 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
676 			mt7921_mac_add_txs(dev, rxd);
677 		return false;
678 	default:
679 		return true;
680 	}
681 }
682 EXPORT_SYMBOL_GPL(mt7921_rx_check);
683 
684 void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
685 			 struct sk_buff *skb)
686 {
687 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
688 	__le32 *rxd = (__le32 *)skb->data;
689 	__le32 *end = (__le32 *)&skb->data[skb->len];
690 	enum rx_pkt_type type;
691 	u16 flag;
692 
693 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
694 	flag = le32_get_bits(rxd[0], MT_RXD0_PKT_FLAG);
695 
696 	if (type == PKT_TYPE_RX_EVENT && flag == 0x1)
697 		type = PKT_TYPE_NORMAL_MCU;
698 
699 	switch (type) {
700 	case PKT_TYPE_TXRX_NOTIFY:
701 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
702 		mt7921_mac_tx_free(dev, skb->data, skb->len);
703 		napi_consume_skb(skb, 1);
704 		break;
705 	case PKT_TYPE_RX_EVENT:
706 		mt7921_mcu_rx_event(dev, skb);
707 		break;
708 	case PKT_TYPE_TXS:
709 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
710 			mt7921_mac_add_txs(dev, rxd);
711 		dev_kfree_skb(skb);
712 		break;
713 	case PKT_TYPE_NORMAL_MCU:
714 	case PKT_TYPE_NORMAL:
715 		if (!mt7921_mac_fill_rx(dev, skb)) {
716 			mt76_rx(&dev->mt76, q, skb);
717 			return;
718 		}
719 		fallthrough;
720 	default:
721 		dev_kfree_skb(skb);
722 		break;
723 	}
724 }
725 EXPORT_SYMBOL_GPL(mt7921_queue_rx_skb);
726 
727 void mt7921_mac_reset_counters(struct mt7921_phy *phy)
728 {
729 	struct mt7921_dev *dev = phy->dev;
730 	int i;
731 
732 	for (i = 0; i < 4; i++) {
733 		mt76_rr(dev, MT_TX_AGG_CNT(0, i));
734 		mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
735 	}
736 
737 	dev->mt76.phy.survey_time = ktime_get_boottime();
738 	memset(&dev->mt76.aggr_stats[0], 0, sizeof(dev->mt76.aggr_stats) / 2);
739 
740 	/* reset airtime counters */
741 	mt76_rr(dev, MT_MIB_SDR9(0));
742 	mt76_rr(dev, MT_MIB_SDR36(0));
743 	mt76_rr(dev, MT_MIB_SDR37(0));
744 
745 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
746 	mt76_set(dev, MT_WF_RMAC_MIB_AIRTIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
747 }
748 
749 void mt7921_mac_set_timing(struct mt7921_phy *phy)
750 {
751 	s16 coverage_class = phy->coverage_class;
752 	struct mt7921_dev *dev = phy->dev;
753 	u32 val, reg_offset;
754 	u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) |
755 		  FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48);
756 	u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) |
757 		   FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28);
758 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
759 	int sifs = is_2ghz ? 10 : 16, offset;
760 
761 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
762 		return;
763 
764 	mt76_set(dev, MT_ARB_SCR(0),
765 		 MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
766 	udelay(1);
767 
768 	offset = 3 * coverage_class;
769 	reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) |
770 		     FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset);
771 
772 	mt76_wr(dev, MT_TMAC_CDTR(0), cck + reg_offset);
773 	mt76_wr(dev, MT_TMAC_ODTR(0), ofdm + reg_offset);
774 	mt76_wr(dev, MT_TMAC_ICR0(0),
775 		FIELD_PREP(MT_IFS_EIFS, 360) |
776 		FIELD_PREP(MT_IFS_RIFS, 2) |
777 		FIELD_PREP(MT_IFS_SIFS, sifs) |
778 		FIELD_PREP(MT_IFS_SLOT, phy->slottime));
779 
780 	if (phy->slottime < 20 || !is_2ghz)
781 		val = MT7921_CFEND_RATE_DEFAULT;
782 	else
783 		val = MT7921_CFEND_RATE_11B;
784 
785 	mt76_rmw_field(dev, MT_AGG_ACR0(0), MT_AGG_ACR_CFEND_RATE, val);
786 	mt76_clear(dev, MT_ARB_SCR(0),
787 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
788 }
789 
790 static u8
791 mt7921_phy_get_nf(struct mt7921_phy *phy, int idx)
792 {
793 	return 0;
794 }
795 
796 static void
797 mt7921_phy_update_channel(struct mt76_phy *mphy, int idx)
798 {
799 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
800 	struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
801 	struct mt76_channel_state *state;
802 	u64 busy_time, tx_time, rx_time, obss_time;
803 	int nf;
804 
805 	busy_time = mt76_get_field(dev, MT_MIB_SDR9(idx),
806 				   MT_MIB_SDR9_BUSY_MASK);
807 	tx_time = mt76_get_field(dev, MT_MIB_SDR36(idx),
808 				 MT_MIB_SDR36_TXTIME_MASK);
809 	rx_time = mt76_get_field(dev, MT_MIB_SDR37(idx),
810 				 MT_MIB_SDR37_RXTIME_MASK);
811 	obss_time = mt76_get_field(dev, MT_WF_RMAC_MIB_AIRTIME14(idx),
812 				   MT_MIB_OBSSTIME_MASK);
813 
814 	nf = mt7921_phy_get_nf(phy, idx);
815 	if (!phy->noise)
816 		phy->noise = nf << 4;
817 	else if (nf)
818 		phy->noise += nf - (phy->noise >> 4);
819 
820 	state = mphy->chan_state;
821 	state->cc_busy += busy_time;
822 	state->cc_tx += tx_time;
823 	state->cc_rx += rx_time + obss_time;
824 	state->cc_bss_rx += rx_time;
825 	state->noise = -(phy->noise >> 4);
826 }
827 
828 void mt7921_update_channel(struct mt76_phy *mphy)
829 {
830 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
831 
832 	if (mt76_connac_pm_wake(mphy, &dev->pm))
833 		return;
834 
835 	mt7921_phy_update_channel(mphy, 0);
836 	/* reset obss airtime */
837 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
838 
839 	mt76_connac_power_save_sched(mphy, &dev->pm);
840 }
841 EXPORT_SYMBOL_GPL(mt7921_update_channel);
842 
843 static void
844 mt7921_vif_connect_iter(void *priv, u8 *mac,
845 			struct ieee80211_vif *vif)
846 {
847 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
848 	struct mt7921_dev *dev = mvif->phy->dev;
849 	struct ieee80211_hw *hw = mt76_hw(dev);
850 
851 	if (vif->type == NL80211_IFTYPE_STATION)
852 		ieee80211_disconnect(vif, true);
853 
854 	mt76_connac_mcu_uni_add_dev(&dev->mphy, vif, &mvif->sta.wcid, true);
855 	mt7921_mcu_set_tx(dev, vif);
856 
857 	if (vif->type == NL80211_IFTYPE_AP) {
858 		mt76_connac_mcu_uni_add_bss(dev->phy.mt76, vif, &mvif->sta.wcid,
859 					    true);
860 		mt7921_mcu_sta_update(dev, NULL, vif, true,
861 				      MT76_STA_INFO_STATE_NONE);
862 		mt7921_mcu_uni_add_beacon_offload(dev, hw, vif, true);
863 	}
864 }
865 
866 /* system error recovery */
867 void mt7921_mac_reset_work(struct work_struct *work)
868 {
869 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
870 					      reset_work);
871 	struct ieee80211_hw *hw = mt76_hw(dev);
872 	struct mt76_connac_pm *pm = &dev->pm;
873 	int i, ret;
874 
875 	dev_dbg(dev->mt76.dev, "chip reset\n");
876 	dev->hw_full_reset = true;
877 	ieee80211_stop_queues(hw);
878 
879 	cancel_delayed_work_sync(&dev->mphy.mac_work);
880 	cancel_delayed_work_sync(&pm->ps_work);
881 	cancel_work_sync(&pm->wake_work);
882 
883 	for (i = 0; i < 10; i++) {
884 		mutex_lock(&dev->mt76.mutex);
885 		ret = mt7921_dev_reset(dev);
886 		mutex_unlock(&dev->mt76.mutex);
887 
888 		if (!ret)
889 			break;
890 	}
891 
892 	if (i == 10)
893 		dev_err(dev->mt76.dev, "chip reset failed\n");
894 
895 	if (test_and_clear_bit(MT76_HW_SCANNING, &dev->mphy.state)) {
896 		struct cfg80211_scan_info info = {
897 			.aborted = true,
898 		};
899 
900 		ieee80211_scan_completed(dev->mphy.hw, &info);
901 	}
902 
903 	dev->hw_full_reset = false;
904 	pm->suspended = false;
905 	ieee80211_wake_queues(hw);
906 	ieee80211_iterate_active_interfaces(hw,
907 					    IEEE80211_IFACE_ITER_RESUME_ALL,
908 					    mt7921_vif_connect_iter, NULL);
909 	mt76_connac_power_save_sched(&dev->mt76.phy, pm);
910 }
911 
912 void mt7921_reset(struct mt76_dev *mdev)
913 {
914 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
915 	struct mt76_connac_pm *pm = &dev->pm;
916 
917 	if (!dev->hw_init_done)
918 		return;
919 
920 	if (dev->hw_full_reset)
921 		return;
922 
923 	if (pm->suspended)
924 		return;
925 
926 	queue_work(dev->mt76.wq, &dev->reset_work);
927 }
928 EXPORT_SYMBOL_GPL(mt7921_reset);
929 
930 void mt7921_mac_update_mib_stats(struct mt7921_phy *phy)
931 {
932 	struct mt7921_dev *dev = phy->dev;
933 	struct mib_stats *mib = &phy->mib;
934 	int i, aggr0 = 0, aggr1;
935 	u32 val;
936 
937 	mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(0),
938 					   MT_MIB_SDR3_FCS_ERR_MASK);
939 	mib->ack_fail_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR3(0),
940 					    MT_MIB_ACK_FAIL_COUNT_MASK);
941 	mib->ba_miss_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR2(0),
942 					   MT_MIB_BA_FAIL_COUNT_MASK);
943 	mib->rts_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR0(0),
944 				       MT_MIB_RTS_COUNT_MASK);
945 	mib->rts_retries_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR1(0),
946 					       MT_MIB_RTS_FAIL_COUNT_MASK);
947 
948 	mib->tx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR12(0));
949 	mib->tx_mpdu_attempts_cnt += mt76_rr(dev, MT_MIB_SDR14(0));
950 	mib->tx_mpdu_success_cnt += mt76_rr(dev, MT_MIB_SDR15(0));
951 
952 	val = mt76_rr(dev, MT_MIB_SDR32(0));
953 	mib->tx_pkt_ebf_cnt += FIELD_GET(MT_MIB_SDR9_EBF_CNT_MASK, val);
954 	mib->tx_pkt_ibf_cnt += FIELD_GET(MT_MIB_SDR9_IBF_CNT_MASK, val);
955 
956 	val = mt76_rr(dev, MT_ETBF_TX_APP_CNT(0));
957 	mib->tx_bf_ibf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_IBF_CNT, val);
958 	mib->tx_bf_ebf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_EBF_CNT, val);
959 
960 	val = mt76_rr(dev, MT_ETBF_RX_FB_CNT(0));
961 	mib->tx_bf_rx_fb_all_cnt += FIELD_GET(MT_ETBF_RX_FB_ALL, val);
962 	mib->tx_bf_rx_fb_he_cnt += FIELD_GET(MT_ETBF_RX_FB_HE, val);
963 	mib->tx_bf_rx_fb_vht_cnt += FIELD_GET(MT_ETBF_RX_FB_VHT, val);
964 	mib->tx_bf_rx_fb_ht_cnt += FIELD_GET(MT_ETBF_RX_FB_HT, val);
965 
966 	mib->rx_mpdu_cnt += mt76_rr(dev, MT_MIB_SDR5(0));
967 	mib->rx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR22(0));
968 	mib->rx_ampdu_bytes_cnt += mt76_rr(dev, MT_MIB_SDR23(0));
969 	mib->rx_ba_cnt += mt76_rr(dev, MT_MIB_SDR31(0));
970 
971 	for (i = 0; i < ARRAY_SIZE(mib->tx_amsdu); i++) {
972 		val = mt76_rr(dev, MT_PLE_AMSDU_PACK_MSDU_CNT(i));
973 		mib->tx_amsdu[i] += val;
974 		mib->tx_amsdu_cnt += val;
975 	}
976 
977 	for (i = 0, aggr1 = aggr0 + 4; i < 4; i++) {
978 		u32 val2;
979 
980 		val = mt76_rr(dev, MT_TX_AGG_CNT(0, i));
981 		val2 = mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
982 
983 		dev->mt76.aggr_stats[aggr0++] += val & 0xffff;
984 		dev->mt76.aggr_stats[aggr0++] += val >> 16;
985 		dev->mt76.aggr_stats[aggr1++] += val2 & 0xffff;
986 		dev->mt76.aggr_stats[aggr1++] += val2 >> 16;
987 	}
988 }
989 
990 void mt7921_mac_work(struct work_struct *work)
991 {
992 	struct mt7921_phy *phy;
993 	struct mt76_phy *mphy;
994 
995 	mphy = (struct mt76_phy *)container_of(work, struct mt76_phy,
996 					       mac_work.work);
997 	phy = mphy->priv;
998 
999 	mt7921_mutex_acquire(phy->dev);
1000 
1001 	mt76_update_survey(mphy);
1002 	if (++mphy->mac_work_count == 2) {
1003 		mphy->mac_work_count = 0;
1004 
1005 		mt7921_mac_update_mib_stats(phy);
1006 	}
1007 
1008 	mt7921_mutex_release(phy->dev);
1009 
1010 	mt76_tx_status_check(mphy->dev, false);
1011 	ieee80211_queue_delayed_work(phy->mt76->hw, &mphy->mac_work,
1012 				     MT7921_WATCHDOG_TIME);
1013 }
1014 
1015 void mt7921_pm_wake_work(struct work_struct *work)
1016 {
1017 	struct mt7921_dev *dev;
1018 	struct mt76_phy *mphy;
1019 
1020 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1021 						pm.wake_work);
1022 	mphy = dev->phy.mt76;
1023 
1024 	if (!mt7921_mcu_drv_pmctrl(dev)) {
1025 		struct mt76_dev *mdev = &dev->mt76;
1026 		int i;
1027 
1028 		if (mt76_is_sdio(mdev)) {
1029 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1030 			mt76_worker_schedule(&mdev->sdio.txrx_worker);
1031 		} else {
1032 			local_bh_disable();
1033 			mt76_for_each_q_rx(mdev, i)
1034 				napi_schedule(&mdev->napi[i]);
1035 			local_bh_enable();
1036 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1037 			mt76_connac_tx_cleanup(mdev);
1038 		}
1039 		if (test_bit(MT76_STATE_RUNNING, &mphy->state))
1040 			ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
1041 						     MT7921_WATCHDOG_TIME);
1042 	}
1043 
1044 	ieee80211_wake_queues(mphy->hw);
1045 	wake_up(&dev->pm.wait);
1046 }
1047 
1048 void mt7921_pm_power_save_work(struct work_struct *work)
1049 {
1050 	struct mt7921_dev *dev;
1051 	unsigned long delta;
1052 	struct mt76_phy *mphy;
1053 
1054 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1055 						pm.ps_work.work);
1056 	mphy = dev->phy.mt76;
1057 
1058 	delta = dev->pm.idle_timeout;
1059 	if (test_bit(MT76_HW_SCANNING, &mphy->state) ||
1060 	    test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) ||
1061 	    dev->fw_assert)
1062 		goto out;
1063 
1064 	if (mutex_is_locked(&dev->mt76.mutex))
1065 		/* if mt76 mutex is held we should not put the device
1066 		 * to sleep since we are currently accessing device
1067 		 * register map. We need to wait for the next power_save
1068 		 * trigger.
1069 		 */
1070 		goto out;
1071 
1072 	if (time_is_after_jiffies(dev->pm.last_activity + delta)) {
1073 		delta = dev->pm.last_activity + delta - jiffies;
1074 		goto out;
1075 	}
1076 
1077 	if (!mt7921_mcu_fw_pmctrl(dev)) {
1078 		cancel_delayed_work_sync(&mphy->mac_work);
1079 		return;
1080 	}
1081 out:
1082 	queue_delayed_work(dev->mt76.wq, &dev->pm.ps_work, delta);
1083 }
1084 
1085 void mt7921_coredump_work(struct work_struct *work)
1086 {
1087 	struct mt7921_dev *dev;
1088 	char *dump, *data;
1089 
1090 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1091 						coredump.work.work);
1092 
1093 	if (time_is_after_jiffies(dev->coredump.last_activity +
1094 				  4 * MT76_CONNAC_COREDUMP_TIMEOUT)) {
1095 		queue_delayed_work(dev->mt76.wq, &dev->coredump.work,
1096 				   MT76_CONNAC_COREDUMP_TIMEOUT);
1097 		return;
1098 	}
1099 
1100 	dump = vzalloc(MT76_CONNAC_COREDUMP_SZ);
1101 	data = dump;
1102 
1103 	while (true) {
1104 		struct sk_buff *skb;
1105 
1106 		spin_lock_bh(&dev->mt76.lock);
1107 		skb = __skb_dequeue(&dev->coredump.msg_list);
1108 		spin_unlock_bh(&dev->mt76.lock);
1109 
1110 		if (!skb)
1111 			break;
1112 
1113 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
1114 		if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
1115 			dev_kfree_skb(skb);
1116 			continue;
1117 		}
1118 
1119 		memcpy(data, skb->data, skb->len);
1120 		data += skb->len;
1121 
1122 		dev_kfree_skb(skb);
1123 	}
1124 
1125 	if (dump)
1126 		dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
1127 			      GFP_KERNEL);
1128 
1129 	mt7921_reset(&dev->mt76);
1130 }
1131 
1132 /* usb_sdio */
1133 static void
1134 mt7921_usb_sdio_write_txwi(struct mt7921_dev *dev, struct mt76_wcid *wcid,
1135 			   enum mt76_txq_id qid, struct ieee80211_sta *sta,
1136 			   struct ieee80211_key_conf *key, int pid,
1137 			   struct sk_buff *skb)
1138 {
1139 	__le32 *txwi = (__le32 *)(skb->data - MT_SDIO_TXD_SIZE);
1140 
1141 	memset(txwi, 0, MT_SDIO_TXD_SIZE);
1142 	mt76_connac2_mac_write_txwi(&dev->mt76, txwi, skb, wcid, key, pid, qid, 0);
1143 	skb_push(skb, MT_SDIO_TXD_SIZE);
1144 }
1145 
1146 int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
1147 				   enum mt76_txq_id qid, struct mt76_wcid *wcid,
1148 				   struct ieee80211_sta *sta,
1149 				   struct mt76_tx_info *tx_info)
1150 {
1151 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1152 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
1153 	struct ieee80211_key_conf *key = info->control.hw_key;
1154 	struct sk_buff *skb = tx_info->skb;
1155 	int err, pad, pktid, type;
1156 
1157 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
1158 		return -EINVAL;
1159 
1160 	if (!wcid)
1161 		wcid = &dev->mt76.global_wcid;
1162 
1163 	if (sta) {
1164 		struct mt7921_sta *msta = (struct mt7921_sta *)sta->drv_priv;
1165 
1166 		if (time_after(jiffies, msta->last_txs + HZ / 4)) {
1167 			info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1168 			msta->last_txs = jiffies;
1169 		}
1170 	}
1171 
1172 	pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb);
1173 	mt7921_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);
1174 
1175 	type = mt76_is_sdio(mdev) ? MT7921_SDIO_DATA : 0;
1176 	mt7921_skb_add_usb_sdio_hdr(dev, skb, type);
1177 	pad = round_up(skb->len, 4) - skb->len;
1178 	if (mt76_is_usb(mdev))
1179 		pad += 4;
1180 
1181 	err = mt76_skb_adjust_pad(skb, pad);
1182 	if (err)
1183 		/* Release pktid in case of error. */
1184 		idr_remove(&wcid->pktid, pktid);
1185 
1186 	return err;
1187 }
1188 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_prepare_skb);
1189 
1190 void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,
1191 				     struct mt76_queue_entry *e)
1192 {
1193 	__le32 *txwi = (__le32 *)(e->skb->data + MT_SDIO_HDR_SIZE);
1194 	unsigned int headroom = MT_SDIO_TXD_SIZE + MT_SDIO_HDR_SIZE;
1195 	struct ieee80211_sta *sta;
1196 	struct mt76_wcid *wcid;
1197 	u16 idx;
1198 
1199 	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
1200 	wcid = rcu_dereference(mdev->wcid[idx]);
1201 	sta = wcid_to_sta(wcid);
1202 
1203 	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))
1204 		mt7921_tx_check_aggr(sta, txwi);
1205 
1206 	skb_pull(e->skb, headroom);
1207 	mt76_tx_complete_skb(mdev, e->wcid, e->skb);
1208 }
1209 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_complete_skb);
1210 
1211 bool mt7921_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)
1212 {
1213 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1214 
1215 	mt7921_mutex_acquire(dev);
1216 	mt7921_mac_sta_poll(dev);
1217 	mt7921_mutex_release(dev);
1218 
1219 	return false;
1220 }
1221 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_status_data);
1222 
1223 #if IS_ENABLED(CONFIG_IPV6)
1224 void mt7921_set_ipv6_ns_work(struct work_struct *work)
1225 {
1226 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
1227 						ipv6_ns_work);
1228 	struct sk_buff *skb;
1229 	int ret = 0;
1230 
1231 	do {
1232 		skb = skb_dequeue(&dev->ipv6_ns_list);
1233 
1234 		if (!skb)
1235 			break;
1236 
1237 		mt7921_mutex_acquire(dev);
1238 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1239 					    MCU_UNI_CMD(OFFLOAD), true);
1240 		mt7921_mutex_release(dev);
1241 
1242 	} while (!ret);
1243 
1244 	if (ret)
1245 		skb_queue_purge(&dev->ipv6_ns_list);
1246 }
1247 #endif
1248