1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /* Copyright(c) 2019-2020  Realtek Corporation
3  */
4 
5 #include <linux/devcoredump.h>
6 
7 #include "cam.h"
8 #include "chan.h"
9 #include "debug.h"
10 #include "fw.h"
11 #include "mac.h"
12 #include "ps.h"
13 #include "reg.h"
14 #include "ser.h"
15 #include "util.h"
16 
17 #define SER_RECFG_TIMEOUT 1000
18 
19 enum ser_evt {
20 	SER_EV_NONE,
21 	SER_EV_STATE_IN,
22 	SER_EV_STATE_OUT,
23 	SER_EV_L1_RESET_PREPARE, /* pre-M0 */
24 	SER_EV_L1_RESET, /* M1 */
25 	SER_EV_DO_RECOVERY, /* M3 */
26 	SER_EV_MAC_RESET_DONE, /* M5 */
27 	SER_EV_L2_RESET,
28 	SER_EV_L2_RECFG_DONE,
29 	SER_EV_L2_RECFG_TIMEOUT,
30 	SER_EV_M1_TIMEOUT,
31 	SER_EV_M3_TIMEOUT,
32 	SER_EV_FW_M5_TIMEOUT,
33 	SER_EV_L0_RESET,
34 	SER_EV_MAXX
35 };
36 
37 enum ser_state {
38 	SER_IDLE_ST,
39 	SER_L1_RESET_PRE_ST,
40 	SER_RESET_TRX_ST,
41 	SER_DO_HCI_ST,
42 	SER_L2_RESET_ST,
43 	SER_ST_MAX_ST
44 };
45 
46 struct ser_msg {
47 	struct list_head list;
48 	u8 event;
49 };
50 
51 struct state_ent {
52 	u8 state;
53 	char *name;
54 	void (*st_func)(struct rtw89_ser *ser, u8 event);
55 };
56 
57 struct event_ent {
58 	u8 event;
59 	char *name;
60 };
61 
62 static char *ser_ev_name(struct rtw89_ser *ser, u8 event)
63 {
64 	if (event < SER_EV_MAXX)
65 		return ser->ev_tbl[event].name;
66 
67 	return "err_ev_name";
68 }
69 
70 static char *ser_st_name(struct rtw89_ser *ser)
71 {
72 	if (ser->state < SER_ST_MAX_ST)
73 		return ser->st_tbl[ser->state].name;
74 
75 	return "err_st_name";
76 }
77 
78 #define RTW89_DEF_SER_CD_TYPE(_name, _type, _size) \
79 struct ser_cd_ ## _name { \
80 	u32 type; \
81 	u32 type_size; \
82 	u64 padding; \
83 	u8 data[_size]; \
84 } __packed; \
85 static void ser_cd_ ## _name ## _init(struct ser_cd_ ## _name *p) \
86 { \
87 	p->type = _type; \
88 	p->type_size = sizeof(p->data); \
89 	p->padding = 0x0123456789abcdef; \
90 }
91 
92 enum rtw89_ser_cd_type {
93 	RTW89_SER_CD_FW_RSVD_PLE	= 0,
94 	RTW89_SER_CD_FW_BACKTRACE	= 1,
95 };
96 
97 RTW89_DEF_SER_CD_TYPE(fw_rsvd_ple,
98 		      RTW89_SER_CD_FW_RSVD_PLE,
99 		      RTW89_FW_RSVD_PLE_SIZE);
100 
101 RTW89_DEF_SER_CD_TYPE(fw_backtrace,
102 		      RTW89_SER_CD_FW_BACKTRACE,
103 		      RTW89_FW_BACKTRACE_MAX_SIZE);
104 
105 struct rtw89_ser_cd_buffer {
106 	struct ser_cd_fw_rsvd_ple fwple;
107 	struct ser_cd_fw_backtrace fwbt;
108 } __packed;
109 
110 static struct rtw89_ser_cd_buffer *rtw89_ser_cd_prep(struct rtw89_dev *rtwdev)
111 {
112 	struct rtw89_ser_cd_buffer *buf;
113 
114 	buf = vzalloc(sizeof(*buf));
115 	if (!buf)
116 		return NULL;
117 
118 	ser_cd_fw_rsvd_ple_init(&buf->fwple);
119 	ser_cd_fw_backtrace_init(&buf->fwbt);
120 
121 	return buf;
122 }
123 
124 static void rtw89_ser_cd_send(struct rtw89_dev *rtwdev,
125 			      struct rtw89_ser_cd_buffer *buf)
126 {
127 	rtw89_debug(rtwdev, RTW89_DBG_SER, "SER sends core dump\n");
128 
129 	/* After calling dev_coredump, buf's lifetime is supposed to be
130 	 * handled by the device coredump framework. Note that a new dump
131 	 * will be discarded if a previous one hasn't been released by
132 	 * framework yet.
133 	 */
134 	dev_coredumpv(rtwdev->dev, buf, sizeof(*buf), GFP_KERNEL);
135 }
136 
137 static void rtw89_ser_cd_free(struct rtw89_dev *rtwdev,
138 			      struct rtw89_ser_cd_buffer *buf, bool free_self)
139 {
140 	if (!free_self)
141 		return;
142 
143 	rtw89_debug(rtwdev, RTW89_DBG_SER, "SER frees core dump by self\n");
144 
145 	/* When some problems happen during filling data of core dump,
146 	 * we won't send it to device coredump framework. Instead, we
147 	 * free buf by ourselves.
148 	 */
149 	vfree(buf);
150 }
151 
152 static void ser_state_run(struct rtw89_ser *ser, u8 evt)
153 {
154 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
155 
156 	rtw89_debug(rtwdev, RTW89_DBG_SER, "ser: %s receive %s\n",
157 		    ser_st_name(ser), ser_ev_name(ser, evt));
158 
159 	mutex_lock(&rtwdev->mutex);
160 	rtw89_leave_lps(rtwdev);
161 	mutex_unlock(&rtwdev->mutex);
162 
163 	ser->st_tbl[ser->state].st_func(ser, evt);
164 }
165 
166 static void ser_state_goto(struct rtw89_ser *ser, u8 new_state)
167 {
168 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
169 
170 	if (ser->state == new_state || new_state >= SER_ST_MAX_ST)
171 		return;
172 	ser_state_run(ser, SER_EV_STATE_OUT);
173 
174 	rtw89_debug(rtwdev, RTW89_DBG_SER, "ser: %s goto -> %s\n",
175 		    ser_st_name(ser), ser->st_tbl[new_state].name);
176 
177 	ser->state = new_state;
178 	ser_state_run(ser, SER_EV_STATE_IN);
179 }
180 
181 static struct ser_msg *__rtw89_ser_dequeue_msg(struct rtw89_ser *ser)
182 {
183 	struct ser_msg *msg;
184 
185 	spin_lock_irq(&ser->msg_q_lock);
186 	msg = list_first_entry_or_null(&ser->msg_q, struct ser_msg, list);
187 	if (msg)
188 		list_del(&msg->list);
189 	spin_unlock_irq(&ser->msg_q_lock);
190 
191 	return msg;
192 }
193 
194 static void rtw89_ser_hdl_work(struct work_struct *work)
195 {
196 	struct ser_msg *msg;
197 	struct rtw89_ser *ser = container_of(work, struct rtw89_ser,
198 					     ser_hdl_work);
199 
200 	while ((msg = __rtw89_ser_dequeue_msg(ser))) {
201 		ser_state_run(ser, msg->event);
202 		kfree(msg);
203 	}
204 }
205 
206 static int ser_send_msg(struct rtw89_ser *ser, u8 event)
207 {
208 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
209 	struct ser_msg *msg = NULL;
210 
211 	if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
212 		return -EIO;
213 
214 	msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
215 	if (!msg)
216 		return -ENOMEM;
217 
218 	msg->event = event;
219 
220 	spin_lock_irq(&ser->msg_q_lock);
221 	list_add(&msg->list, &ser->msg_q);
222 	spin_unlock_irq(&ser->msg_q_lock);
223 
224 	ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
225 	return 0;
226 }
227 
228 static void rtw89_ser_alarm_work(struct work_struct *work)
229 {
230 	struct rtw89_ser *ser = container_of(work, struct rtw89_ser,
231 					     ser_alarm_work.work);
232 
233 	ser_send_msg(ser, ser->alarm_event);
234 	ser->alarm_event = SER_EV_NONE;
235 }
236 
237 static void ser_set_alarm(struct rtw89_ser *ser, u32 ms, u8 event)
238 {
239 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
240 
241 	if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
242 		return;
243 
244 	ser->alarm_event = event;
245 	ieee80211_queue_delayed_work(rtwdev->hw, &ser->ser_alarm_work,
246 				     msecs_to_jiffies(ms));
247 }
248 
249 static void ser_del_alarm(struct rtw89_ser *ser)
250 {
251 	cancel_delayed_work(&ser->ser_alarm_work);
252 	ser->alarm_event = SER_EV_NONE;
253 }
254 
255 /* driver function */
256 static void drv_stop_tx(struct rtw89_ser *ser)
257 {
258 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
259 
260 	ieee80211_stop_queues(rtwdev->hw);
261 	set_bit(RTW89_SER_DRV_STOP_TX, ser->flags);
262 }
263 
264 static void drv_stop_rx(struct rtw89_ser *ser)
265 {
266 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
267 
268 	clear_bit(RTW89_FLAG_RUNNING, rtwdev->flags);
269 	set_bit(RTW89_SER_DRV_STOP_RX, ser->flags);
270 }
271 
272 static void drv_trx_reset(struct rtw89_ser *ser)
273 {
274 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
275 
276 	rtw89_hci_reset(rtwdev);
277 }
278 
279 static void drv_resume_tx(struct rtw89_ser *ser)
280 {
281 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
282 
283 	if (!test_bit(RTW89_SER_DRV_STOP_TX, ser->flags))
284 		return;
285 
286 	ieee80211_wake_queues(rtwdev->hw);
287 	clear_bit(RTW89_SER_DRV_STOP_TX, ser->flags);
288 }
289 
290 static void drv_resume_rx(struct rtw89_ser *ser)
291 {
292 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
293 
294 	if (!test_bit(RTW89_SER_DRV_STOP_RX, ser->flags))
295 		return;
296 
297 	set_bit(RTW89_FLAG_RUNNING, rtwdev->flags);
298 	clear_bit(RTW89_SER_DRV_STOP_RX, ser->flags);
299 }
300 
301 static void ser_reset_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
302 {
303 	rtw89_core_release_bit_map(rtwdev->hw_port, rtwvif->port);
304 	rtwvif->net_type = RTW89_NET_TYPE_NO_LINK;
305 	rtwvif->trigger = false;
306 	rtwvif->tdls_peer = 0;
307 }
308 
309 static void ser_sta_deinit_cam_iter(void *data, struct ieee80211_sta *sta)
310 {
311 	struct rtw89_vif *rtwvif = (struct rtw89_vif *)data;
312 	struct rtw89_dev *rtwdev = rtwvif->rtwdev;
313 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
314 
315 	if (rtwvif->net_type == RTW89_NET_TYPE_AP_MODE || sta->tdls)
316 		rtw89_cam_deinit_addr_cam(rtwdev, &rtwsta->addr_cam);
317 	if (sta->tdls)
318 		rtw89_cam_deinit_bssid_cam(rtwdev, &rtwsta->bssid_cam);
319 
320 	INIT_LIST_HEAD(&rtwsta->ba_cam_list);
321 }
322 
323 static void ser_deinit_cam(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
324 {
325 	ieee80211_iterate_stations_atomic(rtwdev->hw,
326 					  ser_sta_deinit_cam_iter,
327 					  rtwvif);
328 
329 	rtw89_cam_deinit(rtwdev, rtwvif);
330 
331 	bitmap_zero(rtwdev->cam_info.ba_cam_map, RTW89_MAX_BA_CAM_NUM);
332 }
333 
334 static void ser_reset_mac_binding(struct rtw89_dev *rtwdev)
335 {
336 	struct rtw89_vif *rtwvif;
337 
338 	rtw89_cam_reset_keys(rtwdev);
339 	rtw89_for_each_rtwvif(rtwdev, rtwvif)
340 		ser_deinit_cam(rtwdev, rtwvif);
341 
342 	rtw89_core_release_all_bits_map(rtwdev->mac_id_map, RTW89_MAX_MAC_ID_NUM);
343 	rtw89_for_each_rtwvif(rtwdev, rtwvif)
344 		ser_reset_vif(rtwdev, rtwvif);
345 
346 	rtwdev->total_sta_assoc = 0;
347 }
348 
349 /* hal function */
350 static int hal_enable_dma(struct rtw89_ser *ser)
351 {
352 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
353 	int ret;
354 
355 	if (!test_bit(RTW89_SER_HAL_STOP_DMA, ser->flags))
356 		return 0;
357 
358 	if (!rtwdev->hci.ops->mac_lv1_rcvy)
359 		return -EIO;
360 
361 	ret = rtwdev->hci.ops->mac_lv1_rcvy(rtwdev, RTW89_LV1_RCVY_STEP_2);
362 	if (!ret)
363 		clear_bit(RTW89_SER_HAL_STOP_DMA, ser->flags);
364 
365 	return ret;
366 }
367 
368 static int hal_stop_dma(struct rtw89_ser *ser)
369 {
370 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
371 	int ret;
372 
373 	if (!rtwdev->hci.ops->mac_lv1_rcvy)
374 		return -EIO;
375 
376 	ret = rtwdev->hci.ops->mac_lv1_rcvy(rtwdev, RTW89_LV1_RCVY_STEP_1);
377 	if (!ret)
378 		set_bit(RTW89_SER_HAL_STOP_DMA, ser->flags);
379 
380 	return ret;
381 }
382 
383 static void hal_send_post_m0_event(struct rtw89_ser *ser)
384 {
385 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
386 
387 	rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RESET_START_DMAC);
388 }
389 
390 static void hal_send_m2_event(struct rtw89_ser *ser)
391 {
392 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
393 
394 	rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_DISABLE_EN);
395 }
396 
397 static void hal_send_m4_event(struct rtw89_ser *ser)
398 {
399 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
400 
401 	rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN);
402 }
403 
404 /* state handler */
405 static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt)
406 {
407 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
408 
409 	switch (evt) {
410 	case SER_EV_STATE_IN:
411 		rtw89_hci_recovery_complete(rtwdev);
412 		clear_bit(RTW89_FLAG_SER_HANDLING, rtwdev->flags);
413 		clear_bit(RTW89_FLAG_CRASH_SIMULATING, rtwdev->flags);
414 		break;
415 	case SER_EV_L1_RESET_PREPARE:
416 		ser_state_goto(ser, SER_L1_RESET_PRE_ST);
417 		break;
418 	case SER_EV_L1_RESET:
419 		ser_state_goto(ser, SER_RESET_TRX_ST);
420 		break;
421 	case SER_EV_L2_RESET:
422 		ser_state_goto(ser, SER_L2_RESET_ST);
423 		break;
424 	case SER_EV_STATE_OUT:
425 		set_bit(RTW89_FLAG_SER_HANDLING, rtwdev->flags);
426 		rtw89_hci_recovery_start(rtwdev);
427 		break;
428 	default:
429 		break;
430 	}
431 }
432 
433 static void ser_l1_reset_pre_st_hdl(struct rtw89_ser *ser, u8 evt)
434 {
435 	switch (evt) {
436 	case SER_EV_STATE_IN:
437 		ser->prehandle_l1 = true;
438 		hal_send_post_m0_event(ser);
439 		ser_set_alarm(ser, 1000, SER_EV_M1_TIMEOUT);
440 		break;
441 	case SER_EV_L1_RESET:
442 		ser_state_goto(ser, SER_RESET_TRX_ST);
443 		break;
444 	case SER_EV_M1_TIMEOUT:
445 		ser_state_goto(ser, SER_L2_RESET_ST);
446 		break;
447 	case SER_EV_STATE_OUT:
448 		ser_del_alarm(ser);
449 		break;
450 	default:
451 		break;
452 	}
453 }
454 
455 static void ser_reset_trx_st_hdl(struct rtw89_ser *ser, u8 evt)
456 {
457 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
458 
459 	switch (evt) {
460 	case SER_EV_STATE_IN:
461 		cancel_delayed_work_sync(&rtwdev->track_work);
462 		drv_stop_tx(ser);
463 
464 		if (hal_stop_dma(ser)) {
465 			ser_state_goto(ser, SER_L2_RESET_ST);
466 			break;
467 		}
468 
469 		drv_stop_rx(ser);
470 		drv_trx_reset(ser);
471 
472 		/* wait m3 */
473 		hal_send_m2_event(ser);
474 
475 		/* set alarm to prevent FW response timeout */
476 		ser_set_alarm(ser, 1000, SER_EV_M3_TIMEOUT);
477 		break;
478 
479 	case SER_EV_DO_RECOVERY:
480 		ser_state_goto(ser, SER_DO_HCI_ST);
481 		break;
482 
483 	case SER_EV_M3_TIMEOUT:
484 		ser_state_goto(ser, SER_L2_RESET_ST);
485 		break;
486 
487 	case SER_EV_STATE_OUT:
488 		ser_del_alarm(ser);
489 		hal_enable_dma(ser);
490 		drv_resume_rx(ser);
491 		drv_resume_tx(ser);
492 		ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->track_work,
493 					     RTW89_TRACK_WORK_PERIOD);
494 		break;
495 
496 	default:
497 		break;
498 	}
499 }
500 
501 static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt)
502 {
503 	switch (evt) {
504 	case SER_EV_STATE_IN:
505 		/* wait m5 */
506 		hal_send_m4_event(ser);
507 
508 		/* prevent FW response timeout */
509 		ser_set_alarm(ser, 1000, SER_EV_FW_M5_TIMEOUT);
510 		break;
511 
512 	case SER_EV_FW_M5_TIMEOUT:
513 		ser_state_goto(ser, SER_L2_RESET_ST);
514 		break;
515 
516 	case SER_EV_MAC_RESET_DONE:
517 		ser_state_goto(ser, SER_IDLE_ST);
518 		break;
519 
520 	case SER_EV_STATE_OUT:
521 		ser_del_alarm(ser);
522 		break;
523 
524 	default:
525 		break;
526 	}
527 }
528 
529 static void ser_mac_mem_dump(struct rtw89_dev *rtwdev, u8 *buf,
530 			     u8 sel, u32 start_addr, u32 len)
531 {
532 	u32 *ptr = (u32 *)buf;
533 	u32 base_addr, start_page, residue;
534 	u32 cnt = 0;
535 	u32 i;
536 
537 	start_page = start_addr / MAC_MEM_DUMP_PAGE_SIZE;
538 	residue = start_addr % MAC_MEM_DUMP_PAGE_SIZE;
539 	base_addr = rtw89_mac_mem_base_addrs[sel];
540 	base_addr += start_page * MAC_MEM_DUMP_PAGE_SIZE;
541 
542 	while (cnt < len) {
543 		rtw89_write32(rtwdev, R_AX_FILTER_MODEL_ADDR, base_addr);
544 
545 		for (i = R_AX_INDIR_ACCESS_ENTRY + residue;
546 		     i < R_AX_INDIR_ACCESS_ENTRY + MAC_MEM_DUMP_PAGE_SIZE;
547 		     i += 4, ptr++) {
548 			*ptr = rtw89_read32(rtwdev, i);
549 			cnt += 4;
550 			if (cnt >= len)
551 				break;
552 		}
553 
554 		residue = 0;
555 		base_addr += MAC_MEM_DUMP_PAGE_SIZE;
556 	}
557 }
558 
559 static void rtw89_ser_fw_rsvd_ple_dump(struct rtw89_dev *rtwdev, u8 *buf)
560 {
561 	u32 start_addr = rtwdev->chip->rsvd_ple_ofst;
562 
563 	rtw89_debug(rtwdev, RTW89_DBG_SER,
564 		    "dump mem for fw rsvd payload engine (start addr: 0x%x)\n",
565 		    start_addr);
566 	ser_mac_mem_dump(rtwdev, buf, RTW89_MAC_MEM_SHARED_BUF, start_addr,
567 			 RTW89_FW_RSVD_PLE_SIZE);
568 }
569 
570 struct __fw_backtrace_entry {
571 	u32 wcpu_addr;
572 	u32 size;
573 	u32 key;
574 } __packed;
575 
576 struct __fw_backtrace_info {
577 	u32 ra;
578 	u32 sp;
579 } __packed;
580 
581 static_assert(RTW89_FW_BACKTRACE_INFO_SIZE ==
582 	      sizeof(struct __fw_backtrace_info));
583 
584 static int rtw89_ser_fw_backtrace_dump(struct rtw89_dev *rtwdev, u8 *buf,
585 				       const struct __fw_backtrace_entry *ent)
586 {
587 	struct __fw_backtrace_info *ptr = (struct __fw_backtrace_info *)buf;
588 	u32 fwbt_addr = ent->wcpu_addr & RTW89_WCPU_BASE_MASK;
589 	u32 fwbt_size = ent->size;
590 	u32 fwbt_key = ent->key;
591 	u32 i;
592 
593 	if (fwbt_addr == 0) {
594 		rtw89_warn(rtwdev, "FW backtrace invalid address: 0x%x\n",
595 			   fwbt_addr);
596 		return -EINVAL;
597 	}
598 
599 	if (fwbt_key != RTW89_FW_BACKTRACE_KEY) {
600 		rtw89_warn(rtwdev, "FW backtrace invalid key: 0x%x\n",
601 			   fwbt_key);
602 		return -EINVAL;
603 	}
604 
605 	if (fwbt_size == 0 || !RTW89_VALID_FW_BACKTRACE_SIZE(fwbt_size) ||
606 	    fwbt_size > RTW89_FW_BACKTRACE_MAX_SIZE) {
607 		rtw89_warn(rtwdev, "FW backtrace invalid size: 0x%x\n",
608 			   fwbt_size);
609 		return -EINVAL;
610 	}
611 
612 	rtw89_debug(rtwdev, RTW89_DBG_SER, "dump fw backtrace start\n");
613 	rtw89_write32(rtwdev, R_AX_FILTER_MODEL_ADDR, fwbt_addr);
614 
615 	for (i = R_AX_INDIR_ACCESS_ENTRY;
616 	     i < R_AX_INDIR_ACCESS_ENTRY + fwbt_size;
617 	     i += RTW89_FW_BACKTRACE_INFO_SIZE, ptr++) {
618 		*ptr = (struct __fw_backtrace_info){
619 			.ra = rtw89_read32(rtwdev, i),
620 			.sp = rtw89_read32(rtwdev, i + 4),
621 		};
622 		rtw89_debug(rtwdev, RTW89_DBG_SER,
623 			    "next sp: 0x%x, next ra: 0x%x\n",
624 			    ptr->sp, ptr->ra);
625 	}
626 
627 	rtw89_debug(rtwdev, RTW89_DBG_SER, "dump fw backtrace end\n");
628 	return 0;
629 }
630 
631 static void ser_l2_reset_st_pre_hdl(struct rtw89_ser *ser)
632 {
633 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
634 	struct rtw89_ser_cd_buffer *buf;
635 	struct __fw_backtrace_entry fwbt_ent;
636 	int ret = 0;
637 
638 	buf = rtw89_ser_cd_prep(rtwdev);
639 	if (!buf) {
640 		ret = -ENOMEM;
641 		goto bottom;
642 	}
643 
644 	rtw89_ser_fw_rsvd_ple_dump(rtwdev, buf->fwple.data);
645 
646 	fwbt_ent = *(struct __fw_backtrace_entry *)buf->fwple.data;
647 	ret = rtw89_ser_fw_backtrace_dump(rtwdev, buf->fwbt.data, &fwbt_ent);
648 	if (ret)
649 		goto bottom;
650 
651 	rtw89_ser_cd_send(rtwdev, buf);
652 
653 bottom:
654 	rtw89_ser_cd_free(rtwdev, buf, !!ret);
655 
656 	ser_reset_mac_binding(rtwdev);
657 	rtw89_core_stop(rtwdev);
658 	rtw89_entity_init(rtwdev);
659 	rtw89_fw_release_general_pkt_list(rtwdev, false);
660 	INIT_LIST_HEAD(&rtwdev->rtwvifs_list);
661 }
662 
663 static void ser_l2_reset_st_hdl(struct rtw89_ser *ser, u8 evt)
664 {
665 	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
666 
667 	switch (evt) {
668 	case SER_EV_STATE_IN:
669 		mutex_lock(&rtwdev->mutex);
670 		ser_l2_reset_st_pre_hdl(ser);
671 		mutex_unlock(&rtwdev->mutex);
672 
673 		ieee80211_restart_hw(rtwdev->hw);
674 		ser_set_alarm(ser, SER_RECFG_TIMEOUT, SER_EV_L2_RECFG_TIMEOUT);
675 		break;
676 
677 	case SER_EV_L2_RECFG_TIMEOUT:
678 		rtw89_info(rtwdev, "Err: ser L2 re-config timeout\n");
679 		fallthrough;
680 	case SER_EV_L2_RECFG_DONE:
681 		ser_state_goto(ser, SER_IDLE_ST);
682 		break;
683 
684 	case SER_EV_STATE_OUT:
685 		ser_del_alarm(ser);
686 		break;
687 
688 	default:
689 		break;
690 	}
691 }
692 
693 static const struct event_ent ser_ev_tbl[] = {
694 	{SER_EV_NONE, "SER_EV_NONE"},
695 	{SER_EV_STATE_IN, "SER_EV_STATE_IN"},
696 	{SER_EV_STATE_OUT, "SER_EV_STATE_OUT"},
697 	{SER_EV_L1_RESET_PREPARE, "SER_EV_L1_RESET_PREPARE pre-m0"},
698 	{SER_EV_L1_RESET, "SER_EV_L1_RESET m1"},
699 	{SER_EV_DO_RECOVERY, "SER_EV_DO_RECOVERY m3"},
700 	{SER_EV_MAC_RESET_DONE, "SER_EV_MAC_RESET_DONE m5"},
701 	{SER_EV_L2_RESET, "SER_EV_L2_RESET"},
702 	{SER_EV_L2_RECFG_DONE, "SER_EV_L2_RECFG_DONE"},
703 	{SER_EV_L2_RECFG_TIMEOUT, "SER_EV_L2_RECFG_TIMEOUT"},
704 	{SER_EV_M1_TIMEOUT, "SER_EV_M1_TIMEOUT"},
705 	{SER_EV_M3_TIMEOUT, "SER_EV_M3_TIMEOUT"},
706 	{SER_EV_FW_M5_TIMEOUT, "SER_EV_FW_M5_TIMEOUT"},
707 	{SER_EV_L0_RESET, "SER_EV_L0_RESET"},
708 	{SER_EV_MAXX, "SER_EV_MAX"}
709 };
710 
711 static const struct state_ent ser_st_tbl[] = {
712 	{SER_IDLE_ST, "SER_IDLE_ST", ser_idle_st_hdl},
713 	{SER_L1_RESET_PRE_ST, "SER_L1_RESET_PRE_ST", ser_l1_reset_pre_st_hdl},
714 	{SER_RESET_TRX_ST, "SER_RESET_TRX_ST", ser_reset_trx_st_hdl},
715 	{SER_DO_HCI_ST, "SER_DO_HCI_ST", ser_do_hci_st_hdl},
716 	{SER_L2_RESET_ST, "SER_L2_RESET_ST", ser_l2_reset_st_hdl}
717 };
718 
719 int rtw89_ser_init(struct rtw89_dev *rtwdev)
720 {
721 	struct rtw89_ser *ser = &rtwdev->ser;
722 
723 	memset(ser, 0, sizeof(*ser));
724 	INIT_LIST_HEAD(&ser->msg_q);
725 	ser->state = SER_IDLE_ST;
726 	ser->st_tbl = ser_st_tbl;
727 	ser->ev_tbl = ser_ev_tbl;
728 
729 	bitmap_zero(ser->flags, RTW89_NUM_OF_SER_FLAGS);
730 	spin_lock_init(&ser->msg_q_lock);
731 	INIT_WORK(&ser->ser_hdl_work, rtw89_ser_hdl_work);
732 	INIT_DELAYED_WORK(&ser->ser_alarm_work, rtw89_ser_alarm_work);
733 	return 0;
734 }
735 
736 int rtw89_ser_deinit(struct rtw89_dev *rtwdev)
737 {
738 	struct rtw89_ser *ser = (struct rtw89_ser *)&rtwdev->ser;
739 
740 	set_bit(RTW89_SER_DRV_STOP_RUN, ser->flags);
741 	cancel_delayed_work_sync(&ser->ser_alarm_work);
742 	cancel_work_sync(&ser->ser_hdl_work);
743 	clear_bit(RTW89_SER_DRV_STOP_RUN, ser->flags);
744 	return 0;
745 }
746 
747 void rtw89_ser_recfg_done(struct rtw89_dev *rtwdev)
748 {
749 	ser_send_msg(&rtwdev->ser, SER_EV_L2_RECFG_DONE);
750 }
751 
752 int rtw89_ser_notify(struct rtw89_dev *rtwdev, u32 err)
753 {
754 	u8 event = SER_EV_NONE;
755 
756 	rtw89_info(rtwdev, "SER catches error: 0x%x\n", err);
757 
758 	switch (err) {
759 	case MAC_AX_ERR_L1_PREERR_DMAC: /* pre-M0 */
760 		event = SER_EV_L1_RESET_PREPARE;
761 		break;
762 	case MAC_AX_ERR_L1_ERR_DMAC:
763 	case MAC_AX_ERR_L0_PROMOTE_TO_L1:
764 		event = SER_EV_L1_RESET; /* M1 */
765 		break;
766 	case MAC_AX_ERR_L1_RESET_DISABLE_DMAC_DONE:
767 		event = SER_EV_DO_RECOVERY; /* M3 */
768 		break;
769 	case MAC_AX_ERR_L1_RESET_RECOVERY_DONE:
770 		event = SER_EV_MAC_RESET_DONE; /* M5 */
771 		break;
772 	case MAC_AX_ERR_L0_ERR_CMAC0:
773 	case MAC_AX_ERR_L0_ERR_CMAC1:
774 	case MAC_AX_ERR_L0_RESET_DONE:
775 		event = SER_EV_L0_RESET;
776 		break;
777 	default:
778 		if (err == MAC_AX_ERR_L1_PROMOTE_TO_L2 ||
779 		    (err >= MAC_AX_ERR_L2_ERR_AH_DMA &&
780 		     err <= MAC_AX_GET_ERR_MAX))
781 			event = SER_EV_L2_RESET;
782 		break;
783 	}
784 
785 	if (event == SER_EV_NONE) {
786 		rtw89_warn(rtwdev, "SER cannot recognize error: 0x%x\n", err);
787 		return -EINVAL;
788 	}
789 
790 	ser_send_msg(&rtwdev->ser, event);
791 	return 0;
792 }
793 EXPORT_SYMBOL(rtw89_ser_notify);
794