1 // SPDX-License-Identifier: BSD-3-Clause-Clear 2 /* 3 * Copyright (C) 2022 MediaTek Inc. 4 */ 5 6 #include <linux/etherdevice.h> 7 #include <linux/timekeeping.h> 8 #include "coredump.h" 9 #include "mt7996.h" 10 #include "../dma.h" 11 #include "mac.h" 12 #include "mcu.h" 13 14 #define to_rssi(field, rcpi) ((FIELD_GET(field, rcpi) - 220) / 2) 15 16 static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev, 17 u16 idx, u8 band_idx) 18 { 19 struct mt7996_sta_link *msta_link; 20 struct mt7996_sta *msta; 21 struct mt7996_vif *mvif; 22 struct mt76_wcid *wcid; 23 int i; 24 25 wcid = mt76_wcid_ptr(dev, idx); 26 if (!wcid || !wcid->sta) 27 return NULL; 28 29 if (!mt7996_band_valid(dev, band_idx)) 30 return NULL; 31 32 if (wcid->phy_idx == band_idx) 33 return wcid; 34 35 msta_link = container_of(wcid, struct mt7996_sta_link, wcid); 36 msta = msta_link->sta; 37 if (!msta || !msta->vif) 38 return NULL; 39 40 mvif = msta->vif; 41 for (i = 0; i < ARRAY_SIZE(mvif->mt76.link); i++) { 42 struct mt76_vif_link *mlink; 43 44 mlink = rcu_dereference(mvif->mt76.link[i]); 45 if (!mlink) 46 continue; 47 48 if (mlink->band_idx != band_idx) 49 continue; 50 51 msta_link = mt7996_sta_link(msta, i); 52 break; 53 } 54 55 return &msta_link->wcid; 56 } 57 58 bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask) 59 { 60 mt76_rmw(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_WLAN_IDX, 61 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, idx) | mask); 62 63 return mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY, 64 0, 5000); 65 } 66 67 u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw) 68 { 69 mt76_wr(dev, MT_WTBLON_TOP_WDUCR, 70 FIELD_PREP(MT_WTBLON_TOP_WDUCR_GROUP, (wcid >> 7))); 71 72 return MT_WTBL_LMAC_OFFS(wcid, dw); 73 } 74 75 static void mt7996_mac_sta_poll(struct mt7996_dev *dev) 76 { 77 static const u8 ac_to_tid[] = { 78 [IEEE80211_AC_BE] = 0, 79 [IEEE80211_AC_BK] = 1, 80 [IEEE80211_AC_VI] = 4, 81 [IEEE80211_AC_VO] = 6 82 }; 83 struct mt7996_sta_link *msta_link; 84 struct mt76_vif_link *mlink; 85 struct ieee80211_sta *sta; 86 struct mt7996_sta *msta; 87 u32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS]; 88 LIST_HEAD(sta_poll_list); 89 struct mt76_wcid *wcid; 90 int i; 91 92 spin_lock_bh(&dev->mt76.sta_poll_lock); 93 list_splice_init(&dev->mt76.sta_poll_list, &sta_poll_list); 94 spin_unlock_bh(&dev->mt76.sta_poll_lock); 95 96 rcu_read_lock(); 97 98 while (true) { 99 bool clear = false; 100 u32 addr, val; 101 u16 idx; 102 s8 rssi[4]; 103 104 spin_lock_bh(&dev->mt76.sta_poll_lock); 105 if (list_empty(&sta_poll_list)) { 106 spin_unlock_bh(&dev->mt76.sta_poll_lock); 107 break; 108 } 109 msta_link = list_first_entry(&sta_poll_list, 110 struct mt7996_sta_link, 111 wcid.poll_list); 112 msta = msta_link->sta; 113 wcid = &msta_link->wcid; 114 list_del_init(&wcid->poll_list); 115 spin_unlock_bh(&dev->mt76.sta_poll_lock); 116 117 idx = wcid->idx; 118 119 /* refresh peer's airtime reporting */ 120 addr = mt7996_mac_wtbl_lmac_addr(dev, idx, 20); 121 122 for (i = 0; i < IEEE80211_NUM_ACS; i++) { 123 u32 tx_last = msta_link->airtime_ac[i]; 124 u32 rx_last = msta_link->airtime_ac[i + 4]; 125 126 msta_link->airtime_ac[i] = mt76_rr(dev, addr); 127 msta_link->airtime_ac[i + 4] = mt76_rr(dev, addr + 4); 128 129 tx_time[i] = msta_link->airtime_ac[i] - tx_last; 130 rx_time[i] = msta_link->airtime_ac[i + 4] - rx_last; 131 132 if ((tx_last | rx_last) & BIT(30)) 133 clear = true; 134 135 addr += 8; 136 } 137 138 if (clear) { 139 mt7996_mac_wtbl_update(dev, idx, 140 MT_WTBL_UPDATE_ADM_COUNT_CLEAR); 141 memset(msta_link->airtime_ac, 0, 142 sizeof(msta_link->airtime_ac)); 143 } 144 145 if (!wcid->sta) 146 continue; 147 148 sta = container_of((void *)msta, struct ieee80211_sta, 149 drv_priv); 150 for (i = 0; i < IEEE80211_NUM_ACS; i++) { 151 u8 q = mt76_connac_lmac_mapping(i); 152 u32 tx_cur = tx_time[q]; 153 u32 rx_cur = rx_time[q]; 154 u8 tid = ac_to_tid[i]; 155 156 if (!tx_cur && !rx_cur) 157 continue; 158 159 ieee80211_sta_register_airtime(sta, tid, tx_cur, rx_cur); 160 } 161 162 /* get signal strength of resp frames (CTS/BA/ACK) */ 163 addr = mt7996_mac_wtbl_lmac_addr(dev, idx, 34); 164 val = mt76_rr(dev, addr); 165 166 rssi[0] = to_rssi(GENMASK(7, 0), val); 167 rssi[1] = to_rssi(GENMASK(15, 8), val); 168 rssi[2] = to_rssi(GENMASK(23, 16), val); 169 rssi[3] = to_rssi(GENMASK(31, 24), val); 170 171 mlink = rcu_dereference(msta->vif->mt76.link[wcid->link_id]); 172 if (mlink) { 173 struct mt76_phy *mphy = mt76_vif_link_phy(mlink); 174 175 if (mphy) 176 msta_link->ack_signal = 177 mt76_rx_signal(mphy->antenna_mask, 178 rssi); 179 } 180 181 ewma_avg_signal_add(&msta_link->avg_ack_signal, 182 -msta_link->ack_signal); 183 } 184 185 rcu_read_unlock(); 186 } 187 188 /* The HW does not translate the mac header to 802.3 for mesh point */ 189 static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap) 190 { 191 struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb; 192 struct ethhdr *eth_hdr = (struct ethhdr *)(skb->data + hdr_gap); 193 struct mt7996_sta_link *msta_link = (void *)status->wcid; 194 struct mt7996_sta *msta = msta_link->sta; 195 struct ieee80211_bss_conf *link_conf; 196 __le32 *rxd = (__le32 *)skb->data; 197 struct ieee80211_sta *sta; 198 struct ieee80211_vif *vif; 199 struct ieee80211_hdr hdr; 200 u16 frame_control; 201 202 if (le32_get_bits(rxd[3], MT_RXD3_NORMAL_ADDR_TYPE) != 203 MT_RXD3_NORMAL_U2M) 204 return -EINVAL; 205 206 if (!(le32_to_cpu(rxd[1]) & MT_RXD1_NORMAL_GROUP_4)) 207 return -EINVAL; 208 209 if (!msta || !msta->vif) 210 return -EINVAL; 211 212 sta = wcid_to_sta(status->wcid); 213 vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv); 214 link_conf = rcu_dereference(vif->link_conf[msta_link->wcid.link_id]); 215 if (!link_conf) 216 return -EINVAL; 217 218 /* store the info from RXD and ethhdr to avoid being overridden */ 219 frame_control = le32_get_bits(rxd[8], MT_RXD8_FRAME_CONTROL); 220 hdr.frame_control = cpu_to_le16(frame_control); 221 hdr.seq_ctrl = cpu_to_le16(le32_get_bits(rxd[10], MT_RXD10_SEQ_CTRL)); 222 hdr.duration_id = 0; 223 224 ether_addr_copy(hdr.addr1, vif->addr); 225 ether_addr_copy(hdr.addr2, sta->addr); 226 switch (frame_control & (IEEE80211_FCTL_TODS | 227 IEEE80211_FCTL_FROMDS)) { 228 case 0: 229 ether_addr_copy(hdr.addr3, link_conf->bssid); 230 break; 231 case IEEE80211_FCTL_FROMDS: 232 ether_addr_copy(hdr.addr3, eth_hdr->h_source); 233 break; 234 case IEEE80211_FCTL_TODS: 235 ether_addr_copy(hdr.addr3, eth_hdr->h_dest); 236 break; 237 case IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS: 238 ether_addr_copy(hdr.addr3, eth_hdr->h_dest); 239 ether_addr_copy(hdr.addr4, eth_hdr->h_source); 240 break; 241 default: 242 return -EINVAL; 243 } 244 245 skb_pull(skb, hdr_gap + sizeof(struct ethhdr) - 2); 246 if (eth_hdr->h_proto == cpu_to_be16(ETH_P_AARP) || 247 eth_hdr->h_proto == cpu_to_be16(ETH_P_IPX)) 248 ether_addr_copy(skb_push(skb, ETH_ALEN), bridge_tunnel_header); 249 else if (be16_to_cpu(eth_hdr->h_proto) >= ETH_P_802_3_MIN) 250 ether_addr_copy(skb_push(skb, ETH_ALEN), rfc1042_header); 251 else 252 skb_pull(skb, 2); 253 254 if (ieee80211_has_order(hdr.frame_control)) 255 memcpy(skb_push(skb, IEEE80211_HT_CTL_LEN), &rxd[11], 256 IEEE80211_HT_CTL_LEN); 257 if (ieee80211_is_data_qos(hdr.frame_control)) { 258 __le16 qos_ctrl; 259 260 qos_ctrl = cpu_to_le16(le32_get_bits(rxd[10], MT_RXD10_QOS_CTL)); 261 memcpy(skb_push(skb, IEEE80211_QOS_CTL_LEN), &qos_ctrl, 262 IEEE80211_QOS_CTL_LEN); 263 } 264 265 if (ieee80211_has_a4(hdr.frame_control)) 266 memcpy(skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr)); 267 else 268 memcpy(skb_push(skb, sizeof(hdr) - 6), &hdr, sizeof(hdr) - 6); 269 270 return 0; 271 } 272 273 static int 274 mt7996_mac_fill_rx_rate(struct mt7996_dev *dev, 275 struct mt76_rx_status *status, 276 struct ieee80211_supported_band *sband, 277 __le32 *rxv, u8 *mode) 278 { 279 u32 v0, v2; 280 u8 stbc, gi, bw, dcm, nss; 281 int i, idx; 282 bool cck = false; 283 284 v0 = le32_to_cpu(rxv[0]); 285 v2 = le32_to_cpu(rxv[2]); 286 287 idx = FIELD_GET(MT_PRXV_TX_RATE, v0); 288 i = idx; 289 nss = FIELD_GET(MT_PRXV_NSTS, v0) + 1; 290 291 stbc = FIELD_GET(MT_PRXV_HT_STBC, v2); 292 gi = FIELD_GET(MT_PRXV_HT_SHORT_GI, v2); 293 *mode = FIELD_GET(MT_PRXV_TX_MODE, v2); 294 dcm = FIELD_GET(MT_PRXV_DCM, v2); 295 bw = FIELD_GET(MT_PRXV_FRAME_MODE, v2); 296 297 /* the hardware reports NSTS; report the data NSS for STBC frames */ 298 if (stbc && nss > 1) 299 nss >>= 1; 300 301 switch (*mode) { 302 case MT_PHY_TYPE_CCK: 303 cck = true; 304 fallthrough; 305 case MT_PHY_TYPE_OFDM: 306 i = mt76_get_rate(&dev->mt76, sband, i, cck); 307 break; 308 case MT_PHY_TYPE_HT_GF: 309 case MT_PHY_TYPE_HT: 310 status->encoding = RX_ENC_HT; 311 if (gi) 312 status->enc_flags |= RX_ENC_FLAG_SHORT_GI; 313 if (i > 31) 314 return -EINVAL; 315 break; 316 case MT_PHY_TYPE_VHT: 317 status->nss = nss; 318 status->encoding = RX_ENC_VHT; 319 if (gi) 320 status->enc_flags |= RX_ENC_FLAG_SHORT_GI; 321 if (i > 11) 322 return -EINVAL; 323 break; 324 case MT_PHY_TYPE_HE_MU: 325 case MT_PHY_TYPE_HE_SU: 326 case MT_PHY_TYPE_HE_EXT_SU: 327 case MT_PHY_TYPE_HE_TB: 328 status->nss = nss; 329 status->encoding = RX_ENC_HE; 330 i &= GENMASK(3, 0); 331 332 if (gi <= NL80211_RATE_INFO_HE_GI_3_2) 333 status->he_gi = gi; 334 335 status->he_dcm = dcm; 336 break; 337 case MT_PHY_TYPE_EHT_SU: 338 case MT_PHY_TYPE_EHT_TRIG: 339 case MT_PHY_TYPE_EHT_MU: 340 status->nss = nss; 341 status->encoding = RX_ENC_EHT; 342 i &= GENMASK(3, 0); 343 344 if (gi <= NL80211_RATE_INFO_EHT_GI_3_2) 345 status->eht.gi = gi; 346 break; 347 default: 348 return -EINVAL; 349 } 350 status->rate_idx = i; 351 352 switch (bw) { 353 case IEEE80211_STA_RX_BW_20: 354 break; 355 case IEEE80211_STA_RX_BW_40: 356 if (*mode == MT_PHY_TYPE_HE_EXT_SU && 357 (idx & MT_PRXV_TX_ER_SU_106T)) { 358 status->bw = RATE_INFO_BW_HE_RU; 359 status->he_ru = 360 NL80211_RATE_INFO_HE_RU_ALLOC_106; 361 } else { 362 status->bw = RATE_INFO_BW_40; 363 } 364 break; 365 case IEEE80211_STA_RX_BW_80: 366 status->bw = RATE_INFO_BW_80; 367 break; 368 case IEEE80211_STA_RX_BW_160: 369 status->bw = RATE_INFO_BW_160; 370 break; 371 /* rxv reports bw 320-1 and 320-2 separately */ 372 case IEEE80211_STA_RX_BW_320: 373 case IEEE80211_STA_RX_BW_320 + 1: 374 status->bw = RATE_INFO_BW_320; 375 break; 376 default: 377 return -EINVAL; 378 } 379 380 status->enc_flags |= RX_ENC_FLAG_STBC_MASK * stbc; 381 if (*mode < MT_PHY_TYPE_HE_SU && gi) 382 status->enc_flags |= RX_ENC_FLAG_SHORT_GI; 383 384 return 0; 385 } 386 387 static void 388 mt7996_wed_check_ppe(struct mt7996_dev *dev, struct mt76_queue *q, 389 struct mt7996_sta *msta, struct sk_buff *skb, 390 u32 info) 391 { 392 struct ieee80211_vif *vif; 393 struct wireless_dev *wdev; 394 395 if (!msta || !msta->vif) 396 return; 397 398 if (!mt76_queue_is_wed_rx(q)) 399 return; 400 401 if (!(info & MT_DMA_INFO_PPE_VLD)) 402 return; 403 404 vif = container_of((void *)msta->vif, struct ieee80211_vif, 405 drv_priv); 406 wdev = ieee80211_vif_to_wdev(vif); 407 skb->dev = wdev->netdev; 408 409 mtk_wed_device_ppe_check(&dev->mt76.mmio.wed, skb, 410 FIELD_GET(MT_DMA_PPE_CPU_REASON, info), 411 FIELD_GET(MT_DMA_PPE_ENTRY, info)); 412 } 413 414 static int 415 mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q, 416 struct sk_buff *skb, u32 *info) 417 { 418 struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb; 419 struct mt76_phy *mphy = &dev->mt76.phy; 420 struct mt7996_phy *phy = &dev->phy; 421 struct ieee80211_supported_band *sband; 422 __le32 *rxd = (__le32 *)skb->data; 423 __le32 *rxv = NULL; 424 u32 rxd0 = le32_to_cpu(rxd[0]); 425 u32 rxd1 = le32_to_cpu(rxd[1]); 426 u32 rxd2 = le32_to_cpu(rxd[2]); 427 u32 rxd3 = le32_to_cpu(rxd[3]); 428 u32 rxd4 = le32_to_cpu(rxd[4]); 429 u32 csum_mask = MT_RXD3_NORMAL_IP_SUM | MT_RXD3_NORMAL_UDP_TCP_SUM; 430 u32 csum_status = *(u32 *)skb->cb; 431 u32 mesh_mask = MT_RXD0_MESH | MT_RXD0_MHCP; 432 bool is_mesh = (rxd0 & mesh_mask) == mesh_mask; 433 bool unicast, insert_ccmp_hdr = false; 434 u8 remove_pad, amsdu_info, band_idx; 435 u8 mode = 0, qos_ctl = 0; 436 bool hdr_trans; 437 u16 hdr_gap; 438 u16 seq_ctrl = 0; 439 __le16 fc = 0; 440 int idx; 441 u8 hw_aggr = false; 442 struct mt7996_sta *msta = NULL; 443 444 hw_aggr = status->aggr; 445 memset(status, 0, sizeof(*status)); 446 447 band_idx = FIELD_GET(MT_RXD1_NORMAL_BAND_IDX, rxd1); 448 if (!mt7996_band_valid(dev, band_idx)) 449 return -EINVAL; 450 451 mphy = dev->mt76.phys[band_idx]; 452 if (!mphy) 453 return -EINVAL; 454 455 phy = mphy->priv; 456 status->phy_idx = mphy->band_idx; 457 458 if (!test_bit(MT76_STATE_RUNNING, &mphy->state)) 459 return -EINVAL; 460 461 if (rxd2 & MT_RXD2_NORMAL_AMSDU_ERR) 462 return -EINVAL; 463 464 hdr_trans = rxd2 & MT_RXD2_NORMAL_HDR_TRANS; 465 if (hdr_trans && (rxd1 & MT_RXD1_NORMAL_CM)) 466 return -EINVAL; 467 468 /* ICV error or CCMP/BIP/WPI MIC error */ 469 if (rxd1 & MT_RXD1_NORMAL_ICV_ERR) 470 status->flag |= RX_FLAG_ONLY_MONITOR; 471 472 unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M; 473 idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1); 474 status->wcid = mt7996_rx_get_wcid(dev, idx, band_idx); 475 476 if (status->wcid) { 477 struct mt7996_sta_link *msta_link; 478 479 msta_link = container_of(status->wcid, struct mt7996_sta_link, 480 wcid); 481 msta = msta_link->sta; 482 mt76_wcid_add_poll(&dev->mt76, &msta_link->wcid); 483 } 484 485 status->freq = mphy->chandef.chan->center_freq; 486 status->band = mphy->chandef.chan->band; 487 if (status->band == NL80211_BAND_5GHZ) 488 sband = &mphy->sband_5g.sband; 489 else if (status->band == NL80211_BAND_6GHZ) 490 sband = &mphy->sband_6g.sband; 491 else 492 sband = &mphy->sband_2g.sband; 493 494 if (!sband->channels) 495 return -EINVAL; 496 497 if ((rxd3 & csum_mask) == csum_mask && 498 !(csum_status & (BIT(0) | BIT(2) | BIT(3)))) 499 skb->ip_summed = CHECKSUM_UNNECESSARY; 500 501 if (rxd3 & MT_RXD3_NORMAL_FCS_ERR) 502 status->flag |= RX_FLAG_FAILED_FCS_CRC; 503 504 if (rxd1 & MT_RXD1_NORMAL_TKIP_MIC_ERR) 505 status->flag |= RX_FLAG_MMIC_ERROR; 506 507 if (FIELD_GET(MT_RXD2_NORMAL_SEC_MODE, rxd2) != 0 && 508 !(rxd1 & (MT_RXD1_NORMAL_CLM | MT_RXD1_NORMAL_CM))) { 509 status->flag |= RX_FLAG_DECRYPTED; 510 status->flag |= RX_FLAG_IV_STRIPPED; 511 status->flag |= RX_FLAG_MMIC_STRIPPED | RX_FLAG_MIC_STRIPPED; 512 } 513 514 remove_pad = FIELD_GET(MT_RXD2_NORMAL_HDR_OFFSET, rxd2); 515 516 if (rxd2 & MT_RXD2_NORMAL_MAX_LEN_ERROR) 517 return -EINVAL; 518 519 rxd += 8; 520 if (rxd1 & MT_RXD1_NORMAL_GROUP_4) { 521 u32 v0 = le32_to_cpu(rxd[0]); 522 u32 v2 = le32_to_cpu(rxd[2]); 523 524 fc = cpu_to_le16(FIELD_GET(MT_RXD8_FRAME_CONTROL, v0)); 525 qos_ctl = FIELD_GET(MT_RXD10_QOS_CTL, v2); 526 seq_ctrl = FIELD_GET(MT_RXD10_SEQ_CTRL, v2); 527 528 rxd += 4; 529 if ((u8 *)rxd - skb->data >= skb->len) 530 return -EINVAL; 531 } 532 533 if (rxd1 & MT_RXD1_NORMAL_GROUP_1) { 534 u8 *data = (u8 *)rxd; 535 536 if (status->flag & RX_FLAG_DECRYPTED) { 537 switch (FIELD_GET(MT_RXD2_NORMAL_SEC_MODE, rxd2)) { 538 case MT_CIPHER_AES_CCMP: 539 case MT_CIPHER_CCMP_CCX: 540 case MT_CIPHER_CCMP_256: 541 insert_ccmp_hdr = 542 FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2); 543 fallthrough; 544 case MT_CIPHER_TKIP: 545 case MT_CIPHER_TKIP_NO_MIC: 546 case MT_CIPHER_GCMP: 547 case MT_CIPHER_GCMP_256: 548 status->iv[0] = data[5]; 549 status->iv[1] = data[4]; 550 status->iv[2] = data[3]; 551 status->iv[3] = data[2]; 552 status->iv[4] = data[1]; 553 status->iv[5] = data[0]; 554 break; 555 default: 556 break; 557 } 558 } 559 rxd += 4; 560 if ((u8 *)rxd - skb->data >= skb->len) 561 return -EINVAL; 562 } 563 564 if (rxd1 & MT_RXD1_NORMAL_GROUP_2) { 565 status->timestamp = le32_to_cpu(rxd[0]); 566 status->flag |= RX_FLAG_MACTIME_START; 567 568 if (!(rxd2 & MT_RXD2_NORMAL_NON_AMPDU)) { 569 status->flag |= RX_FLAG_AMPDU_DETAILS; 570 571 /* all subframes of an A-MPDU have the same timestamp */ 572 if (phy->rx_ampdu_ts != status->timestamp) { 573 if (!++phy->ampdu_ref) 574 phy->ampdu_ref++; 575 } 576 phy->rx_ampdu_ts = status->timestamp; 577 578 status->ampdu_ref = phy->ampdu_ref; 579 } 580 581 rxd += 4; 582 if ((u8 *)rxd - skb->data >= skb->len) 583 return -EINVAL; 584 } 585 586 /* RXD Group 3 - P-RXV */ 587 if (rxd1 & MT_RXD1_NORMAL_GROUP_3) { 588 u32 v3; 589 int ret; 590 591 rxv = rxd; 592 rxd += 4; 593 if ((u8 *)rxd - skb->data >= skb->len) 594 return -EINVAL; 595 596 v3 = le32_to_cpu(rxv[3]); 597 598 status->chains = mphy->antenna_mask; 599 status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v3); 600 status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v3); 601 status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v3); 602 status->chain_signal[3] = to_rssi(MT_PRXV_RCPI3, v3); 603 604 /* RXD Group 5 - C-RXV */ 605 if (rxd1 & MT_RXD1_NORMAL_GROUP_5) { 606 rxd += 24; 607 if ((u8 *)rxd - skb->data >= skb->len) 608 return -EINVAL; 609 } 610 611 ret = mt7996_mac_fill_rx_rate(dev, status, sband, rxv, &mode); 612 if (ret < 0) 613 return ret; 614 } 615 616 amsdu_info = FIELD_GET(MT_RXD4_NORMAL_PAYLOAD_FORMAT, rxd4); 617 status->amsdu = !!amsdu_info; 618 if (status->amsdu) { 619 status->first_amsdu = amsdu_info == MT_RXD4_FIRST_AMSDU_FRAME; 620 status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME; 621 } 622 623 /* IEEE 802.11 fragmentation can only be applied to unicast frames. 624 * Hence, drop fragments with multicast/broadcast RA. 625 * This check fixes vulnerabilities, like CVE-2020-26145. 626 */ 627 if ((ieee80211_has_morefrags(fc) || seq_ctrl & IEEE80211_SCTL_FRAG) && 628 FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) != MT_RXD3_NORMAL_U2M) 629 return -EINVAL; 630 631 hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad; 632 if (hdr_trans && ieee80211_has_morefrags(fc)) { 633 if (mt7996_reverse_frag0_hdr_trans(skb, hdr_gap)) 634 return -EINVAL; 635 hdr_trans = false; 636 } else { 637 int pad_start = 0; 638 639 skb_pull(skb, hdr_gap); 640 if (!hdr_trans && status->amsdu && !(ieee80211_has_a4(fc) && is_mesh)) { 641 pad_start = ieee80211_get_hdrlen_from_skb(skb); 642 } else if (hdr_trans && (rxd2 & MT_RXD2_NORMAL_HDR_TRANS_ERROR)) { 643 /* When header translation failure is indicated, 644 * the hardware will insert an extra 2-byte field 645 * containing the data length after the protocol 646 * type field. This happens either when the LLC-SNAP 647 * pattern did not match, or if a VLAN header was 648 * detected. 649 */ 650 pad_start = 12; 651 if (get_unaligned_be16(skb->data + pad_start) == ETH_P_8021Q) 652 pad_start += 4; 653 else 654 pad_start = 0; 655 } 656 657 if (pad_start) { 658 memmove(skb->data + 2, skb->data, pad_start); 659 skb_pull(skb, 2); 660 } 661 } 662 663 if (!hdr_trans) { 664 struct ieee80211_hdr *hdr; 665 666 if (insert_ccmp_hdr) { 667 u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1); 668 669 mt76_insert_ccmp_hdr(skb, key_id); 670 } 671 672 hdr = mt76_skb_get_hdr(skb); 673 fc = hdr->frame_control; 674 if (ieee80211_is_beacon(fc)) 675 mt76_rx_beacon(mphy, skb); 676 if (ieee80211_is_data_qos(fc)) { 677 u8 *qos = ieee80211_get_qos_ctl(hdr); 678 679 seq_ctrl = le16_to_cpu(hdr->seq_ctrl); 680 qos_ctl = *qos; 681 682 /* Mesh DA/SA/Length will be stripped after hardware 683 * de-amsdu, so here needs to clear amsdu present bit 684 * to mark it as a normal mesh frame. 685 */ 686 if (ieee80211_has_a4(fc) && is_mesh && status->amsdu) 687 *qos &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT; 688 } 689 skb_set_mac_header(skb, (unsigned char *)hdr - skb->data); 690 } else { 691 status->flag |= RX_FLAG_8023; 692 mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb, 693 *info); 694 mt76_npu_check_ppe(&dev->mt76, skb, *info); 695 } 696 697 if (rxv && !(status->flag & RX_FLAG_8023)) { 698 switch (status->encoding) { 699 case RX_ENC_EHT: 700 mt76_connac3_mac_decode_eht_radiotap(skb, rxv, mode); 701 break; 702 case RX_ENC_HE: 703 mt76_connac3_mac_decode_he_radiotap(skb, rxv, mode); 704 break; 705 default: 706 break; 707 } 708 } 709 710 if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr) 711 return 0; 712 713 status->aggr = unicast && 714 !ieee80211_is_qos_nullfunc(fc); 715 status->qos_ctl = qos_ctl; 716 status->seqno = IEEE80211_SEQ_TO_SN(seq_ctrl); 717 718 return 0; 719 } 720 721 static void 722 mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi, 723 struct sk_buff *skb, struct mt76_wcid *wcid) 724 { 725 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK; 726 u8 fc_type, fc_stype; 727 u16 ethertype; 728 bool wmm = false; 729 u32 val; 730 731 if (wcid->sta) { 732 struct ieee80211_sta *sta = wcid_to_sta(wcid); 733 734 wmm = sta->wme; 735 } 736 737 val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_802_3) | 738 FIELD_PREP(MT_TXD1_TID, tid); 739 740 ethertype = get_unaligned_be16(&skb->data[12]); 741 if (ethertype >= ETH_P_802_3_MIN) 742 val |= MT_TXD1_ETH_802_3; 743 744 txwi[1] |= cpu_to_le32(val); 745 746 fc_type = IEEE80211_FTYPE_DATA >> 2; 747 fc_stype = wmm ? IEEE80211_STYPE_QOS_DATA >> 4 : 0; 748 749 val = FIELD_PREP(MT_TXD2_FRAME_TYPE, fc_type) | 750 FIELD_PREP(MT_TXD2_SUB_TYPE, fc_stype); 751 752 txwi[2] |= cpu_to_le32(val); 753 754 if (wcid->amsdu) 755 txwi[3] |= cpu_to_le32(MT_TXD3_HW_AMSDU); 756 } 757 758 static void 759 mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi, 760 struct sk_buff *skb, 761 struct ieee80211_key_conf *key, 762 struct mt76_wcid *wcid) 763 { 764 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 765 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data; 766 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 767 bool multicast = is_multicast_ether_addr(hdr->addr1); 768 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK; 769 __le16 fc = hdr->frame_control, sc = hdr->seq_ctrl; 770 struct ieee80211_vif *vif = info->control.vif; 771 u16 seqno = le16_to_cpu(sc); 772 bool hw_bigtk = false; 773 u8 fc_type, fc_stype; 774 u32 val; 775 776 if (ieee80211_is_action(fc) && 777 skb->len >= IEEE80211_MIN_ACTION_SIZE(action_code) && 778 mgmt->u.action.category == WLAN_CATEGORY_BACK && 779 mgmt->u.action.action_code == WLAN_ACTION_ADDBA_REQ) { 780 if (is_mt7990(&dev->mt76)) 781 txwi[6] |= cpu_to_le32(FIELD_PREP(MT_TXD6_TID_ADDBA, tid)); 782 else 783 txwi[7] |= cpu_to_le32(MT_TXD7_MAC_TXD); 784 785 tid = MT_TX_ADDBA; 786 } else if (ieee80211_is_mgmt(hdr->frame_control)) { 787 tid = MT_TX_NORMAL; 788 } 789 790 val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_802_11) | 791 FIELD_PREP(MT_TXD1_HDR_INFO, 792 ieee80211_get_hdrlen_from_skb(skb) / 2) | 793 FIELD_PREP(MT_TXD1_TID, tid); 794 795 if (!ieee80211_is_data(fc) || multicast || 796 info->flags & IEEE80211_TX_CTL_USE_MINRATE) 797 val |= MT_TXD1_FIXED_RATE; 798 799 if (is_mt7990(&dev->mt76) && ieee80211_is_beacon(fc) && 800 (wcid->hw_key_idx2 == 6 || wcid->hw_key_idx2 == 7)) 801 hw_bigtk = true; 802 803 if ((key && multicast && ieee80211_is_robust_mgmt_frame(skb)) || hw_bigtk) { 804 val |= MT_TXD1_BIP; 805 txwi[3] &= ~cpu_to_le32(MT_TXD3_PROTECT_FRAME); 806 } 807 808 txwi[1] |= cpu_to_le32(val); 809 810 fc_type = (le16_to_cpu(fc) & IEEE80211_FCTL_FTYPE) >> 2; 811 fc_stype = (le16_to_cpu(fc) & IEEE80211_FCTL_STYPE) >> 4; 812 813 val = FIELD_PREP(MT_TXD2_FRAME_TYPE, fc_type) | 814 FIELD_PREP(MT_TXD2_SUB_TYPE, fc_stype); 815 816 if (ieee80211_has_morefrags(fc) && ieee80211_is_first_frag(sc)) 817 val |= FIELD_PREP(MT_TXD2_FRAG, MT_TX_FRAG_FIRST); 818 else if (ieee80211_has_morefrags(fc) && !ieee80211_is_first_frag(sc)) 819 val |= FIELD_PREP(MT_TXD2_FRAG, MT_TX_FRAG_MID); 820 else if (!ieee80211_has_morefrags(fc) && !ieee80211_is_first_frag(sc)) 821 val |= FIELD_PREP(MT_TXD2_FRAG, MT_TX_FRAG_LAST); 822 else 823 val |= FIELD_PREP(MT_TXD2_FRAG, MT_TX_FRAG_NONE); 824 825 txwi[2] |= cpu_to_le32(val); 826 827 txwi[3] |= cpu_to_le32(FIELD_PREP(MT_TXD3_BCM, multicast)); 828 if (ieee80211_is_beacon(fc)) { 829 txwi[3] &= ~cpu_to_le32(MT_TXD3_SW_POWER_MGMT); 830 txwi[3] |= cpu_to_le32(MT_TXD3_REM_TX_COUNT); 831 } 832 833 if (multicast && vif && ieee80211_vif_is_mld(vif)) { 834 val = MT_TXD3_SN_VALID | 835 FIELD_PREP(MT_TXD3_SEQ, IEEE80211_SEQ_TO_SN(seqno)); 836 txwi[3] |= cpu_to_le32(val); 837 } 838 839 if (info->flags & IEEE80211_TX_CTL_INJECTED) { 840 if (ieee80211_is_back_req(hdr->frame_control)) { 841 struct ieee80211_bar *bar; 842 843 bar = (struct ieee80211_bar *)skb->data; 844 seqno = le16_to_cpu(bar->start_seq_num); 845 } 846 847 val = MT_TXD3_SN_VALID | 848 FIELD_PREP(MT_TXD3_SEQ, IEEE80211_SEQ_TO_SN(seqno)); 849 txwi[3] |= cpu_to_le32(val); 850 txwi[3] &= ~cpu_to_le32(MT_TXD3_HW_AMSDU); 851 } 852 853 if (vif && ieee80211_vif_is_mld(vif) && 854 (multicast || unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE)))) 855 txwi[5] |= cpu_to_le32(MT_TXD5_FL); 856 857 if (ieee80211_is_nullfunc(fc) && ieee80211_has_a4(fc) && 858 vif && ieee80211_vif_is_mld(vif)) { 859 txwi[5] |= cpu_to_le32(MT_TXD5_FL); 860 txwi[6] |= cpu_to_le32(MT_TXD6_DIS_MAT); 861 } 862 863 if (!wcid->sta && ieee80211_is_mgmt(fc)) 864 txwi[6] |= cpu_to_le32(MT_TXD6_DIS_MAT); 865 } 866 867 /* The WLAN_IDX in the TXD and TXP must belong to the primary or secondary 868 * link of an MLD station; any other link id can make the firmware spin when 869 * that link is in powersave. Completion events carry the same index, so the 870 * wcid used for status tracking and accounting must match it 871 */ 872 struct mt76_wcid *mt7996_get_tx_wcid(struct mt76_wcid *wcid) 873 { 874 struct mt7996_sta_link *msta_link; 875 struct mt7996_sta *msta; 876 877 if (!wcid->sta) 878 return wcid; 879 880 msta_link = container_of(wcid, struct mt7996_sta_link, wcid); 881 msta = msta_link->sta; 882 883 if (!msta || wcid->link_id == msta->seclink_id || 884 wcid->link_id == msta->deflink_id) 885 return wcid; 886 887 msta_link = mt7996_sta_link(msta, msta->deflink_id); 888 if (msta_link) 889 return &msta_link->wcid; 890 891 return wcid; 892 } 893 894 void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, 895 struct sk_buff *skb, struct mt76_wcid *wcid, 896 struct ieee80211_key_conf *key, int pid, 897 enum mt76_txq_id qid, u32 changed, 898 unsigned int link_id) 899 { 900 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 901 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 902 struct ieee80211_vif *vif = info->control.vif; 903 u8 band_idx = (info->hw_queue & MT_TX_HW_QUEUE_PHY) >> 2; 904 u8 p_fmt, q_idx, omac_idx = 0, wmm_idx = 0; 905 bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP; 906 struct mt76_vif_link *mlink = NULL; 907 struct mt7996_vif *mvif; 908 u16 tx_count = 15; 909 u32 val; 910 bool inband_disc = !!(changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP | 911 BSS_CHANGED_FILS_DISCOVERY)); 912 bool beacon = !!(changed & (BSS_CHANGED_BEACON | 913 BSS_CHANGED_BEACON_ENABLED)) && (!inband_disc); 914 915 mvif = vif ? (struct mt7996_vif *)vif->drv_priv : NULL; 916 if (mvif) { 917 if (wcid->offchannel) 918 mlink = mt7996_offchannel_link(wcid); 919 if (!mlink && link_id != IEEE80211_LINK_UNSPECIFIED) 920 mlink = rcu_dereference(mvif->mt76.link[link_id]); 921 } 922 923 if (mlink) { 924 omac_idx = mlink->omac_idx; 925 wmm_idx = mlink->wmm_idx; 926 band_idx = mlink->band_idx; 927 } 928 929 if (inband_disc) { 930 p_fmt = MT_TX_TYPE_FW; 931 q_idx = MT_LMAC_ALTX0; 932 } else if (beacon) { 933 p_fmt = MT_TX_TYPE_FW; 934 q_idx = MT_LMAC_BCN0; 935 } else if (qid >= MT_TXQ_PSD) { 936 p_fmt = MT_TX_TYPE_CT; 937 q_idx = MT_LMAC_ALTX0; 938 } else { 939 p_fmt = MT_TX_TYPE_CT; 940 q_idx = wmm_idx * MT7996_MAX_WMM_SETS + 941 mt76_connac_lmac_mapping(skb_get_queue_mapping(skb)); 942 } 943 944 val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len + MT_TXD_SIZE) | 945 FIELD_PREP(MT_TXD0_PKT_FMT, p_fmt) | 946 FIELD_PREP(MT_TXD0_Q_IDX, q_idx); 947 txwi[0] = cpu_to_le32(val); 948 949 val = FIELD_PREP(MT_TXD1_WLAN_IDX, wcid->idx) | 950 FIELD_PREP(MT_TXD1_OWN_MAC, omac_idx); 951 952 if (band_idx) 953 val |= FIELD_PREP(MT_TXD1_TGID, band_idx); 954 955 txwi[1] = cpu_to_le32(val); 956 txwi[2] = 0; 957 958 val = MT_TXD3_SW_POWER_MGMT | 959 FIELD_PREP(MT_TXD3_REM_TX_COUNT, tx_count); 960 if (key) 961 val |= MT_TXD3_PROTECT_FRAME; 962 if (info->flags & IEEE80211_TX_CTL_NO_ACK) 963 val |= MT_TXD3_NO_ACK; 964 965 txwi[3] = cpu_to_le32(val); 966 txwi[4] = 0; 967 968 val = FIELD_PREP(MT_TXD5_PID, pid); 969 if (pid >= MT_PACKET_ID_FIRST) 970 val |= MT_TXD5_TX_STATUS_HOST; 971 txwi[5] = cpu_to_le32(val); 972 973 val = MT_TXD6_DAS | MT_TXD6_VTA; 974 if ((q_idx >= MT_LMAC_ALTX0 && q_idx <= MT_LMAC_BCN0) || 975 skb->protocol == cpu_to_be16(ETH_P_PAE)) 976 val |= MT_TXD6_DIS_MAT; 977 978 if (is_mt7996(&dev->mt76)) 979 val |= FIELD_PREP(MT_TXD6_MSDU_CNT, 1); 980 else if (is_8023 || !ieee80211_is_mgmt(hdr->frame_control)) 981 val |= FIELD_PREP(MT_TXD6_MSDU_CNT_V2, 1); 982 983 txwi[6] = cpu_to_le32(val); 984 txwi[7] = 0; 985 986 if (is_8023) 987 mt7996_mac_write_txwi_8023(dev, txwi, skb, wcid); 988 else 989 mt7996_mac_write_txwi_80211(dev, txwi, skb, key, wcid); 990 991 if (txwi[1] & cpu_to_le32(MT_TXD1_FIXED_RATE)) { 992 bool mcast = ieee80211_is_data(hdr->frame_control) && 993 is_multicast_ether_addr(hdr->addr1); 994 u8 idx = MT7996_BASIC_RATES_TBL; 995 996 if (mlink) { 997 if (mcast && mlink->mcast_rates_idx) 998 idx = mlink->mcast_rates_idx; 999 else if (beacon && mlink->beacon_rates_idx) 1000 idx = mlink->beacon_rates_idx; 1001 else 1002 idx = mlink->basic_rates_idx; 1003 } 1004 1005 val = FIELD_PREP(MT_TXD6_TX_RATE, idx) | MT_TXD6_FIXED_BW; 1006 if (mcast) 1007 val |= MT_TXD6_DIS_MAT; 1008 txwi[6] |= cpu_to_le32(val); 1009 txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE); 1010 } 1011 } 1012 1013 static bool 1014 mt7996_tx_use_mgmt(struct mt7996_dev *dev, struct sk_buff *skb) 1015 { 1016 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1017 1018 if (ieee80211_is_mgmt(hdr->frame_control)) 1019 return true; 1020 1021 /* for SDO to bypass specific data frame */ 1022 if (!mt7996_has_wa(dev)) { 1023 if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE))) 1024 return true; 1025 1026 if (ieee80211_has_a4(hdr->frame_control) && 1027 !ieee80211_is_data_present(hdr->frame_control)) 1028 return true; 1029 } 1030 1031 return false; 1032 } 1033 1034 int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, 1035 enum mt76_txq_id qid, struct mt76_wcid *wcid, 1036 struct ieee80211_sta *sta, 1037 struct mt76_tx_info *tx_info) 1038 { 1039 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data; 1040 struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); 1041 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb); 1042 struct ieee80211_key_conf *key = info->control.hw_key; 1043 struct ieee80211_vif *vif = info->control.vif; 1044 struct mt7996_vif *mvif = vif ? (struct mt7996_vif *)vif->drv_priv : NULL; 1045 struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv : NULL; 1046 struct mt76_vif_link *mlink = NULL; 1047 struct mt76_txwi_cache *t; 1048 int id, i, pid, nbuf = tx_info->nbuf - 1; 1049 bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP; 1050 __le32 *ptr = (__le32 *)txwi_ptr; 1051 u8 *txwi = (u8 *)txwi_ptr; 1052 u8 link_id; 1053 1054 if (unlikely(tx_info->skb->len <= ETH_HLEN)) 1055 return -EINVAL; 1056 1057 if (!wcid) 1058 wcid = &dev->mt76.global_wcid; 1059 1060 if (sta && (is_8023 || ieee80211_is_data_qos(hdr->frame_control)) && sta->mlo && 1061 likely(tx_info->skb->protocol != cpu_to_be16(ETH_P_PAE))) { 1062 u8 tid = tx_info->skb->priority & IEEE80211_QOS_CTL_TID_MASK; 1063 1064 link_id = (tid % 2) ? msta->seclink_id : msta->deflink_id; 1065 } else { 1066 link_id = u32_get_bits(info->control.flags, 1067 IEEE80211_TX_CTRL_MLO_LINK); 1068 } 1069 1070 /* non-MLD frames are LINK_UNSPECIFIED; use the wcid's own link */ 1071 if (link_id == IEEE80211_LINK_UNSPECIFIED && 1072 wcid != &dev->mt76.global_wcid) 1073 link_id = wcid->link_id; 1074 1075 if (link_id != wcid->link_id && link_id != IEEE80211_LINK_UNSPECIFIED) { 1076 if (msta) { 1077 struct mt7996_sta_link *msta_link = 1078 mt7996_sta_link(msta, link_id); 1079 1080 if (msta_link) 1081 wcid = &msta_link->wcid; 1082 } else if (mvif) { 1083 mlink = rcu_dereference(mvif->mt76.link[link_id]); 1084 if (mlink && mlink->wcid) 1085 wcid = mlink->wcid; 1086 } 1087 } 1088 1089 t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size); 1090 t->skb = tx_info->skb; 1091 1092 id = mt76_token_consume(mdev, &t); 1093 if (id < 0) 1094 return id; 1095 1096 /* Since the rules of HW MLD address translation are not fully 1097 * compatible with 802.11 EAPOL frame, we do the translation by 1098 * software 1099 */ 1100 if (sta && tx_info->skb->protocol == cpu_to_be16(ETH_P_PAE) && sta->mlo) { 1101 struct ieee80211_hdr *hdr = (void *)tx_info->skb->data; 1102 struct ieee80211_bss_conf *link_conf; 1103 struct ieee80211_link_sta *link_sta; 1104 1105 link_conf = rcu_dereference(vif->link_conf[wcid->link_id]); 1106 if (!link_conf) 1107 goto error_release_token; 1108 1109 link_sta = rcu_dereference(sta->link[wcid->link_id]); 1110 if (!link_sta) 1111 goto error_release_token; 1112 1113 dma_sync_single_for_cpu(mdev->dma_dev, tx_info->buf[1].addr, 1114 tx_info->buf[1].len, DMA_TO_DEVICE); 1115 1116 memcpy(hdr->addr1, link_sta->addr, ETH_ALEN); 1117 memcpy(hdr->addr2, link_conf->addr, ETH_ALEN); 1118 if (ieee80211_has_a4(hdr->frame_control)) { 1119 memcpy(hdr->addr3, sta->addr, ETH_ALEN); 1120 memcpy(hdr->addr4, vif->addr, ETH_ALEN); 1121 } else if (ieee80211_has_tods(hdr->frame_control)) { 1122 memcpy(hdr->addr3, sta->addr, ETH_ALEN); 1123 } else if (ieee80211_has_fromds(hdr->frame_control)) { 1124 memcpy(hdr->addr3, vif->addr, ETH_ALEN); 1125 } 1126 1127 dma_sync_single_for_device(mdev->dma_dev, tx_info->buf[1].addr, 1128 tx_info->buf[1].len, DMA_TO_DEVICE); 1129 } 1130 1131 wcid = mt7996_get_tx_wcid(wcid); 1132 1133 pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb); 1134 memset(txwi_ptr, 0, MT_TXD_SIZE); 1135 /* Transmit non qos data by 802.11 header and need to fill txd by host*/ 1136 if (!is_8023 || pid >= MT_PACKET_ID_FIRST) 1137 mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key, 1138 pid, qid, 0, link_id); 1139 1140 /* MT7996 and MT7992 require driver to provide the MAC TXP for AddBA 1141 * req 1142 */ 1143 if (le32_to_cpu(ptr[7]) & MT_TXD7_MAC_TXD) { 1144 u32 val, mac_txp_size = sizeof(struct mt76_connac_hw_txp); 1145 1146 ptr = (__le32 *)(txwi + MT_TXD_SIZE); 1147 memset((void *)ptr, 0, mac_txp_size); 1148 1149 val = FIELD_PREP(MT_TXP0_TOKEN_ID0, id) | 1150 MT_TXP0_TOKEN_ID0_VALID_MASK; 1151 ptr[0] = cpu_to_le32(val); 1152 1153 val = FIELD_PREP(MT_TXP1_TID_ADDBA, 1154 tx_info->skb->priority & 1155 IEEE80211_QOS_CTL_TID_MASK); 1156 ptr[1] = cpu_to_le32(val); 1157 ptr[2] = cpu_to_le32(tx_info->buf[1].addr & 0xFFFFFFFF); 1158 1159 val = FIELD_PREP(MT_TXP_BUF_LEN, tx_info->buf[1].len) | 1160 MT_TXP3_ML0_MASK; 1161 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT 1162 val |= FIELD_PREP(MT_TXP3_DMA_ADDR_H, 1163 tx_info->buf[1].addr >> 32); 1164 #endif 1165 ptr[3] = cpu_to_le32(val); 1166 1167 tx_info->buf[0].len = MT_TXD_SIZE + mac_txp_size; 1168 } else { 1169 struct mt76_connac_txp_common *txp; 1170 1171 txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE); 1172 for (i = 0; i < nbuf; i++) { 1173 u16 len; 1174 1175 len = FIELD_PREP(MT_TXP_BUF_LEN, tx_info->buf[i + 1].len); 1176 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT 1177 len |= FIELD_PREP(MT_TXP_DMA_ADDR_H, 1178 tx_info->buf[i + 1].addr >> 32); 1179 #endif 1180 1181 txp->fw.buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr); 1182 txp->fw.len[i] = cpu_to_le16(len); 1183 } 1184 txp->fw.nbuf = nbuf; 1185 1186 txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST); 1187 1188 if (!is_8023 || pid >= MT_PACKET_ID_FIRST) 1189 txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD); 1190 1191 if (!key) 1192 txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME); 1193 1194 if (!is_8023 && mt7996_tx_use_mgmt(dev, tx_info->skb)) 1195 txp->fw.flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME); 1196 1197 if (mvif) { 1198 if (wcid->offchannel) 1199 mlink = mt7996_offchannel_link(wcid); 1200 if (!mlink) 1201 mlink = rcu_dereference(mvif->mt76.link[wcid->link_id]); 1202 1203 txp->fw.bss_idx = mlink ? mlink->idx : mvif->deflink.mt76.idx; 1204 } 1205 1206 txp->fw.token = cpu_to_le16(id); 1207 txp->fw.rept_wds_wcid = cpu_to_le16(sta ? wcid->idx : 0xfff); 1208 } 1209 1210 tx_info->skb = NULL; 1211 1212 /* pass partial skb header to fw */ 1213 tx_info->buf[1].len = MT_CT_PARSE_LEN; 1214 tx_info->buf[1].skip_unmap = true; 1215 tx_info->nbuf = MT_CT_DMA_BUF_NUM; 1216 1217 return 0; 1218 1219 error_release_token: 1220 mt76_token_release(mdev, id, NULL); 1221 return -EINVAL; 1222 } 1223 1224 u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id) 1225 { 1226 struct mt76_connac_fw_txp *txp = ptr + MT_TXD_SIZE; 1227 __le32 *txwi = ptr; 1228 u32 val; 1229 1230 memset(ptr, 0, MT_TXD_SIZE + sizeof(*txp)); 1231 1232 val = FIELD_PREP(MT_TXD0_TX_BYTES, MT_TXD_SIZE) | 1233 FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CT); 1234 txwi[0] = cpu_to_le32(val); 1235 1236 val = BIT(31) | 1237 FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_802_3); 1238 txwi[1] = cpu_to_le32(val); 1239 1240 txp->token = cpu_to_le16(token_id); 1241 txp->nbuf = 1; 1242 txp->buf[0] = cpu_to_le32(phys + MT_TXD_SIZE + sizeof(*txp)); 1243 1244 return MT_TXD_SIZE + sizeof(*txp); 1245 } 1246 1247 static void 1248 mt7996_tx_check_aggr(struct ieee80211_link_sta *link_sta, 1249 struct mt76_wcid *wcid, struct sk_buff *skb) 1250 { 1251 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1252 bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP; 1253 u16 fc, tid; 1254 1255 if (!(link_sta->ht_cap.ht_supported || link_sta->he_cap.has_he)) 1256 return; 1257 1258 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK; 1259 1260 if (is_8023) { 1261 fc = IEEE80211_FTYPE_DATA | 1262 (link_sta->sta->wme ? IEEE80211_STYPE_QOS_DATA 1263 : IEEE80211_STYPE_DATA); 1264 } else { 1265 /* No need to get precise TID for Action/Management Frame, 1266 * since it will not meet the following Frame Control 1267 * condition anyway. 1268 */ 1269 1270 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1271 1272 fc = le16_to_cpu(hdr->frame_control) & 1273 (IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE); 1274 } 1275 1276 if (unlikely(fc != (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA))) 1277 return; 1278 1279 if (!test_and_set_bit(tid, &wcid->ampdu_state) && 1280 ieee80211_start_tx_ba_session(link_sta->sta, tid, 0)) 1281 clear_bit(tid, &wcid->ampdu_state); 1282 } 1283 1284 static void 1285 mt7996_txp_skb_unmap(struct mt76_dev *mdev, struct mt76_txwi_cache *t) 1286 { 1287 u8 *txwi_ptr = mt76_get_txwi_ptr(mdev, t); 1288 __le32 *txwi = (__le32 *)txwi_ptr; 1289 __le32 *txp; 1290 dma_addr_t addr; 1291 u32 val; 1292 1293 if (!(le32_to_cpu(txwi[7]) & MT_TXD7_MAC_TXD)) { 1294 mt76_connac_txp_skb_unmap(mdev, t); 1295 return; 1296 } 1297 1298 txp = (__le32 *)(txwi_ptr + MT_TXD_SIZE); 1299 val = le32_to_cpu(txp[3]); 1300 addr = le32_to_cpu(txp[2]); 1301 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT 1302 addr |= (dma_addr_t)FIELD_GET(MT_TXP3_DMA_ADDR_H, val) << 32; 1303 #endif 1304 dma_unmap_single(mdev->dma_dev, addr, FIELD_GET(MT_TXP_BUF_LEN, val), 1305 DMA_TO_DEVICE); 1306 } 1307 1308 static void 1309 mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t, 1310 struct ieee80211_link_sta *link_sta, 1311 struct mt76_wcid *wcid, struct list_head *free_list) 1312 { 1313 struct mt76_dev *mdev = &dev->mt76; 1314 __le32 *txwi; 1315 u16 wcid_idx; 1316 1317 mt7996_txp_skb_unmap(mdev, t); 1318 if (!t->skb) 1319 goto out; 1320 1321 txwi = (__le32 *)mt76_get_txwi_ptr(mdev, t); 1322 if (link_sta) { 1323 wcid_idx = wcid->idx; 1324 if (likely(t->skb->protocol != cpu_to_be16(ETH_P_PAE))) { 1325 struct mt7996_sta *msta; 1326 1327 /* AMPDU state is stored in the primary link */ 1328 msta = (void *)link_sta->sta->drv_priv; 1329 mt7996_tx_check_aggr(link_sta, &msta->deflink.wcid, 1330 t->skb); 1331 } 1332 } else { 1333 wcid_idx = le32_get_bits(txwi[9], MT_TXD9_WLAN_IDX); 1334 } 1335 1336 __mt76_tx_complete_skb(mdev, wcid_idx, t->skb, free_list); 1337 1338 out: 1339 t->skb = NULL; 1340 mt76_put_txwi(mdev, t); 1341 } 1342 1343 static void 1344 mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len) 1345 { 1346 __le32 *tx_free = (__le32 *)data, *cur_info; 1347 struct mt76_dev *mdev = &dev->mt76; 1348 struct mt76_phy *phy2 = mdev->phys[MT_BAND1]; 1349 struct mt76_phy *phy3 = mdev->phys[MT_BAND2]; 1350 struct ieee80211_link_sta *link_sta = NULL; 1351 struct mt76_txwi_cache *txwi; 1352 struct mt76_wcid *wcid = NULL; 1353 LIST_HEAD(free_list); 1354 struct sk_buff *skb, *tmp; 1355 void *end = data + len; 1356 bool wake = false; 1357 u16 total, count = 0; 1358 u8 ver; 1359 1360 /* clean DMA queues and unmap buffers first */ 1361 mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_PSD], false); 1362 mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BE], false); 1363 if (phy2) { 1364 mt76_queue_tx_cleanup(dev, phy2->q_tx[MT_TXQ_PSD], false); 1365 mt76_queue_tx_cleanup(dev, phy2->q_tx[MT_TXQ_BE], false); 1366 } 1367 if (phy3) { 1368 mt76_queue_tx_cleanup(dev, phy3->q_tx[MT_TXQ_PSD], false); 1369 mt76_queue_tx_cleanup(dev, phy3->q_tx[MT_TXQ_BE], false); 1370 } 1371 1372 ver = le32_get_bits(tx_free[1], MT_TXFREE1_VER); 1373 if (WARN_ON_ONCE(ver < 5)) 1374 return; 1375 1376 total = le32_get_bits(tx_free[0], MT_TXFREE0_MSDU_CNT); 1377 for (cur_info = &tx_free[2]; count < total; cur_info++) { 1378 u32 msdu, info; 1379 u8 i; 1380 1381 if (WARN_ON_ONCE((void *)cur_info >= end)) 1382 return; 1383 /* 1'b1: new wcid pair. 1384 * 1'b0: msdu_id with the same 'wcid pair' as above. 1385 */ 1386 info = le32_to_cpu(*cur_info); 1387 if (info & MT_TXFREE_INFO_PAIR) { 1388 struct ieee80211_sta *sta; 1389 unsigned long valid_links; 1390 struct mt7996_sta *msta; 1391 unsigned int id; 1392 u16 idx; 1393 1394 idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info); 1395 wcid = mt76_wcid_ptr(dev, idx); 1396 sta = wcid_to_sta(wcid); 1397 if (!sta) { 1398 link_sta = NULL; 1399 goto next; 1400 } 1401 1402 link_sta = rcu_dereference(sta->link[wcid->link_id]); 1403 if (!link_sta) 1404 goto next; 1405 1406 msta = (struct mt7996_sta *)sta->drv_priv; 1407 valid_links = sta->valid_links ?: BIT(0); 1408 1409 /* For MLD STA, add all link's wcid to sta_poll_list */ 1410 for_each_set_bit(id, &valid_links, 1411 IEEE80211_MLD_MAX_NUM_LINKS) { 1412 struct mt7996_sta_link *msta_link; 1413 1414 msta_link = mt7996_sta_link(msta, id); 1415 if (!msta_link) 1416 continue; 1417 1418 mt76_wcid_add_poll(&dev->mt76, 1419 &msta_link->wcid); 1420 } 1421 next: 1422 /* ver 7 has a new DW with pair = 1, skip it */ 1423 if (ver == 7 && ((void *)(cur_info + 1) < end) && 1424 (le32_to_cpu(*(cur_info + 1)) & MT_TXFREE_INFO_PAIR)) 1425 cur_info++; 1426 continue; 1427 } else if (info & MT_TXFREE_INFO_HEADER) { 1428 u32 tx_retries = 0, tx_failed = 0, count; 1429 1430 if (!wcid) 1431 continue; 1432 1433 count = FIELD_GET(MT_TXFREE_INFO_COUNT, info); 1434 tx_retries = count ? count - 1 : 0; 1435 tx_failed = tx_retries + 1436 !!FIELD_GET(MT_TXFREE_INFO_STAT, info); 1437 1438 wcid->stats.tx_retries += tx_retries; 1439 wcid->stats.tx_failed += tx_failed; 1440 continue; 1441 } 1442 1443 for (i = 0; i < 2; i++) { 1444 msdu = (info >> (15 * i)) & MT_TXFREE_INFO_MSDU_ID; 1445 if (msdu == MT_TXFREE_INFO_MSDU_ID) 1446 continue; 1447 1448 count++; 1449 txwi = mt76_token_release(mdev, msdu, &wake); 1450 if (!txwi) 1451 continue; 1452 1453 mt7996_txwi_free(dev, txwi, link_sta, wcid, 1454 &free_list); 1455 } 1456 } 1457 1458 mt7996_mac_sta_poll(dev); 1459 1460 if (wake) 1461 mt76_set_tx_blocked(&dev->mt76, false); 1462 1463 mt76_worker_schedule(&dev->mt76.tx_worker); 1464 1465 list_for_each_entry_safe(skb, tmp, &free_list, list) { 1466 skb_list_del_init(skb); 1467 napi_consume_skb(skb, 1); 1468 } 1469 } 1470 1471 static bool 1472 mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid, 1473 int pid, __le32 *txs_data) 1474 { 1475 struct mt76_sta_stats *stats = &wcid->stats; 1476 struct ieee80211_supported_band *sband; 1477 struct mt76_dev *mdev = &dev->mt76; 1478 struct mt76_phy *mphy; 1479 struct ieee80211_tx_info *info; 1480 struct sk_buff_head list; 1481 struct rate_info rate = {}; 1482 struct sk_buff *skb = NULL; 1483 bool cck = false; 1484 u32 txrate, txs, mode, stbc; 1485 1486 txs = le32_to_cpu(txs_data[0]); 1487 1488 mt76_tx_status_lock(mdev, &list); 1489 1490 /* only report MPDU TXS */ 1491 if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == 0) { 1492 skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list); 1493 if (skb) { 1494 info = IEEE80211_SKB_CB(skb); 1495 if (!(txs & MT_TXS0_ACK_ERROR_MASK)) 1496 info->flags |= IEEE80211_TX_STAT_ACK; 1497 1498 info->status.ampdu_len = 1; 1499 info->status.ampdu_ack_len = 1500 !!(info->flags & IEEE80211_TX_STAT_ACK); 1501 1502 info->status.rates[0].idx = -1; 1503 } 1504 } 1505 1506 if ((mtk_wed_device_active(&dev->mt76.mmio.wed) || 1507 mt76_npu_device_active(&dev->mt76)) && wcid->sta) { 1508 struct ieee80211_sta *sta; 1509 u8 tid; 1510 1511 sta = wcid_to_sta(wcid); 1512 tid = FIELD_GET(MT_TXS0_TID, txs); 1513 ieee80211_refresh_tx_agg_session_timer(sta, tid); 1514 } 1515 1516 txrate = FIELD_GET(MT_TXS0_TX_RATE, txs); 1517 1518 rate.mcs = FIELD_GET(MT_TX_RATE_IDX, txrate); 1519 rate.nss = FIELD_GET(MT_TX_RATE_NSS, txrate) + 1; 1520 stbc = le32_get_bits(txs_data[3], MT_TXS3_RATE_STBC); 1521 1522 if (stbc && rate.nss > 1) 1523 rate.nss >>= 1; 1524 1525 if (rate.nss - 1 < ARRAY_SIZE(stats->tx_nss)) 1526 stats->tx_nss[rate.nss - 1]++; 1527 if (rate.mcs < ARRAY_SIZE(stats->tx_mcs)) 1528 stats->tx_mcs[rate.mcs]++; 1529 1530 mode = FIELD_GET(MT_TX_RATE_MODE, txrate); 1531 switch (mode) { 1532 case MT_PHY_TYPE_CCK: 1533 cck = true; 1534 fallthrough; 1535 case MT_PHY_TYPE_OFDM: 1536 mphy = mt76_dev_phy(mdev, wcid->phy_idx); 1537 1538 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ) 1539 sband = &mphy->sband_5g.sband; 1540 else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ) 1541 sband = &mphy->sband_6g.sband; 1542 else 1543 sband = &mphy->sband_2g.sband; 1544 1545 rate.mcs = mt76_get_rate(mphy->dev, sband, rate.mcs, cck); 1546 rate.legacy = sband->bitrates[rate.mcs].bitrate; 1547 break; 1548 case MT_PHY_TYPE_HT: 1549 case MT_PHY_TYPE_HT_GF: 1550 if (rate.mcs > 31) 1551 goto out; 1552 1553 rate.flags = RATE_INFO_FLAGS_MCS; 1554 if (wcid->rate.flags & RATE_INFO_FLAGS_SHORT_GI) 1555 rate.flags |= RATE_INFO_FLAGS_SHORT_GI; 1556 break; 1557 case MT_PHY_TYPE_VHT: 1558 if (rate.mcs > 9) 1559 goto out; 1560 1561 rate.flags = RATE_INFO_FLAGS_VHT_MCS; 1562 if (wcid->rate.flags & RATE_INFO_FLAGS_SHORT_GI) 1563 rate.flags |= RATE_INFO_FLAGS_SHORT_GI; 1564 break; 1565 case MT_PHY_TYPE_HE_SU: 1566 case MT_PHY_TYPE_HE_EXT_SU: 1567 case MT_PHY_TYPE_HE_TB: 1568 case MT_PHY_TYPE_HE_MU: 1569 if (rate.mcs > 11) 1570 goto out; 1571 1572 rate.he_gi = wcid->rate.he_gi; 1573 rate.he_dcm = FIELD_GET(MT_TX_RATE_DCM, txrate); 1574 rate.flags = RATE_INFO_FLAGS_HE_MCS; 1575 break; 1576 case MT_PHY_TYPE_EHT_SU: 1577 case MT_PHY_TYPE_EHT_TRIG: 1578 case MT_PHY_TYPE_EHT_MU: 1579 if (rate.mcs > 13) 1580 goto out; 1581 1582 rate.eht_gi = wcid->rate.eht_gi; 1583 rate.flags = RATE_INFO_FLAGS_EHT_MCS; 1584 break; 1585 default: 1586 goto out; 1587 } 1588 1589 stats->tx_mode[mode]++; 1590 1591 switch (FIELD_GET(MT_TXS0_BW, txs)) { 1592 case IEEE80211_STA_RX_BW_320: 1593 rate.bw = RATE_INFO_BW_320; 1594 stats->tx_bw[4]++; 1595 break; 1596 case IEEE80211_STA_RX_BW_160: 1597 rate.bw = RATE_INFO_BW_160; 1598 stats->tx_bw[3]++; 1599 break; 1600 case IEEE80211_STA_RX_BW_80: 1601 rate.bw = RATE_INFO_BW_80; 1602 stats->tx_bw[2]++; 1603 break; 1604 case IEEE80211_STA_RX_BW_40: 1605 rate.bw = RATE_INFO_BW_40; 1606 stats->tx_bw[1]++; 1607 break; 1608 default: 1609 rate.bw = RATE_INFO_BW_20; 1610 stats->tx_bw[0]++; 1611 break; 1612 } 1613 wcid->rate = rate; 1614 1615 out: 1616 if (skb) 1617 mt76_tx_status_skb_done(mdev, skb, &list); 1618 mt76_tx_status_unlock(mdev, &list); 1619 1620 return !!skb; 1621 } 1622 1623 static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data) 1624 { 1625 struct mt7996_sta_link *msta_link; 1626 struct mt76_wcid *wcid; 1627 __le32 *txs_data = data; 1628 u16 wcidx; 1629 u8 pid; 1630 1631 wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID); 1632 pid = le32_get_bits(txs_data[3], MT_TXS3_PID); 1633 1634 if (pid < MT_PACKET_ID_NO_SKB) 1635 return; 1636 1637 rcu_read_lock(); 1638 1639 wcid = mt76_wcid_ptr(dev, wcidx); 1640 if (!wcid) 1641 goto out; 1642 1643 mt7996_mac_add_txs_skb(dev, wcid, pid, txs_data); 1644 1645 if (!wcid->sta) 1646 goto out; 1647 1648 msta_link = container_of(wcid, struct mt7996_sta_link, wcid); 1649 mt76_wcid_add_poll(&dev->mt76, &msta_link->wcid); 1650 1651 out: 1652 rcu_read_unlock(); 1653 } 1654 1655 bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len) 1656 { 1657 struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); 1658 __le32 *rxd = (__le32 *)data; 1659 __le32 *end = (__le32 *)&rxd[len / 4]; 1660 enum rx_pkt_type type; 1661 1662 type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE); 1663 if (type != PKT_TYPE_NORMAL) { 1664 u32 sw_type = le32_get_bits(rxd[0], MT_RXD0_SW_PKT_TYPE_MASK); 1665 1666 if (unlikely((sw_type & MT_RXD0_SW_PKT_TYPE_MAP) == 1667 MT_RXD0_SW_PKT_TYPE_FRAME)) 1668 return true; 1669 } 1670 1671 switch (type) { 1672 case PKT_TYPE_TXRX_NOTIFY: 1673 mt7996_mac_tx_free(dev, data, len); 1674 return false; 1675 case PKT_TYPE_TXS: 1676 for (rxd += MT_TXS_HDR_SIZE; rxd + MT_TXS_SIZE <= end; rxd += MT_TXS_SIZE) 1677 mt7996_mac_add_txs(dev, rxd); 1678 return false; 1679 case PKT_TYPE_RX_FW_MONITOR: 1680 mt7996_debugfs_rx_fw_monitor(dev, data, len); 1681 return false; 1682 default: 1683 return true; 1684 } 1685 } 1686 1687 void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q, 1688 struct sk_buff *skb, u32 *info) 1689 { 1690 struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); 1691 __le32 *rxd = (__le32 *)skb->data; 1692 __le32 *end = (__le32 *)&skb->data[skb->len]; 1693 enum rx_pkt_type type; 1694 1695 type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE); 1696 if (type != PKT_TYPE_NORMAL) { 1697 u32 sw_type = le32_get_bits(rxd[0], MT_RXD0_SW_PKT_TYPE_MASK); 1698 1699 if (unlikely((sw_type & MT_RXD0_SW_PKT_TYPE_MAP) == 1700 MT_RXD0_SW_PKT_TYPE_FRAME)) 1701 type = PKT_TYPE_NORMAL; 1702 } 1703 1704 switch (type) { 1705 case PKT_TYPE_TXRX_NOTIFY: 1706 if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2) && 1707 q == MT_RXQ_TXFREE_BAND2) { 1708 dev_kfree_skb(skb); 1709 break; 1710 } 1711 1712 mt7996_mac_tx_free(dev, skb->data, skb->len); 1713 napi_consume_skb(skb, 1); 1714 break; 1715 case PKT_TYPE_RX_EVENT: 1716 mt7996_mcu_rx_event(dev, skb); 1717 break; 1718 case PKT_TYPE_TXS: 1719 for (rxd += MT_TXS_HDR_SIZE; rxd + MT_TXS_SIZE <= end; rxd += MT_TXS_SIZE) 1720 mt7996_mac_add_txs(dev, rxd); 1721 dev_kfree_skb(skb); 1722 break; 1723 case PKT_TYPE_RX_FW_MONITOR: 1724 mt7996_debugfs_rx_fw_monitor(dev, skb->data, skb->len); 1725 dev_kfree_skb(skb); 1726 break; 1727 case PKT_TYPE_NORMAL: 1728 if (!mt7996_mac_fill_rx(dev, q, skb, info)) { 1729 mt76_rx(&dev->mt76, q, skb); 1730 return; 1731 } 1732 fallthrough; 1733 default: 1734 dev_kfree_skb(skb); 1735 break; 1736 } 1737 } 1738 1739 static struct mt7996_msdu_page * 1740 mt7996_msdu_page_get_from_cache(struct mt7996_dev *dev) 1741 { 1742 struct mt7996_msdu_page *p = NULL; 1743 1744 spin_lock(&dev->wed_rro.lock); 1745 1746 if (!list_empty(&dev->wed_rro.page_cache)) { 1747 p = list_first_entry(&dev->wed_rro.page_cache, 1748 struct mt7996_msdu_page, list); 1749 list_del(&p->list); 1750 } 1751 1752 spin_unlock(&dev->wed_rro.lock); 1753 1754 return p; 1755 } 1756 1757 static struct mt7996_msdu_page *mt7996_msdu_page_get(struct mt7996_dev *dev) 1758 { 1759 struct mt7996_msdu_page *p; 1760 1761 p = mt7996_msdu_page_get_from_cache(dev); 1762 if (!p) { 1763 p = kzalloc(L1_CACHE_ALIGN(sizeof(*p)), GFP_ATOMIC); 1764 if (p) 1765 INIT_LIST_HEAD(&p->list); 1766 } 1767 1768 return p; 1769 } 1770 1771 static void mt7996_msdu_page_put_to_cache(struct mt7996_dev *dev, 1772 struct mt7996_msdu_page *p) 1773 { 1774 if (p->buf) { 1775 mt76_put_page_pool_buf(p->buf, false); 1776 p->buf = NULL; 1777 } 1778 1779 spin_lock(&dev->wed_rro.lock); 1780 list_add(&p->list, &dev->wed_rro.page_cache); 1781 spin_unlock(&dev->wed_rro.lock); 1782 } 1783 1784 static void mt7996_msdu_page_free_cache(struct mt7996_dev *dev) 1785 { 1786 while (true) { 1787 struct mt7996_msdu_page *p; 1788 1789 p = mt7996_msdu_page_get_from_cache(dev); 1790 if (!p) 1791 break; 1792 1793 if (p->buf) 1794 mt76_put_page_pool_buf(p->buf, false); 1795 1796 kfree(p); 1797 } 1798 } 1799 1800 static u32 mt7996_msdu_page_hash_from_addr(dma_addr_t dma_addr) 1801 { 1802 u32 val = 0; 1803 int i = 0; 1804 1805 while (dma_addr) { 1806 val += (u32)((dma_addr & 0xff) + i) % MT7996_RRO_MSDU_PG_HASH_SIZE; 1807 dma_addr >>= 8; 1808 i += 13; 1809 } 1810 1811 return val % MT7996_RRO_MSDU_PG_HASH_SIZE; 1812 } 1813 1814 static struct mt7996_msdu_page * 1815 mt7996_rro_msdu_page_get(struct mt7996_dev *dev, dma_addr_t dma_addr) 1816 { 1817 u32 hash = mt7996_msdu_page_hash_from_addr(dma_addr); 1818 struct mt7996_msdu_page *p, *tmp, *addr = NULL; 1819 1820 spin_lock(&dev->wed_rro.lock); 1821 1822 list_for_each_entry_safe(p, tmp, &dev->wed_rro.page_map[hash], 1823 list) { 1824 if (p->dma_addr == dma_addr) { 1825 list_del(&p->list); 1826 addr = p; 1827 break; 1828 } 1829 } 1830 1831 spin_unlock(&dev->wed_rro.lock); 1832 1833 return addr; 1834 } 1835 1836 static void mt7996_rx_token_put(struct mt7996_dev *dev) 1837 { 1838 int i; 1839 1840 for (i = 0; i < dev->mt76.rx_token_size; i++) { 1841 struct mt76_txwi_cache *t; 1842 1843 t = mt76_rx_token_release(&dev->mt76, i); 1844 if (!t || !t->ptr) 1845 continue; 1846 1847 mt76_put_page_pool_buf(t->ptr, false); 1848 t->dma_addr = 0; 1849 t->ptr = NULL; 1850 1851 mt76_put_rxwi(&dev->mt76, t); 1852 } 1853 } 1854 1855 void mt7996_rro_msdu_page_map_free(struct mt7996_dev *dev) 1856 { 1857 struct mt7996_msdu_page *p, *tmp; 1858 int i; 1859 1860 local_bh_disable(); 1861 1862 for (i = 0; i < ARRAY_SIZE(dev->wed_rro.page_map); i++) { 1863 list_for_each_entry_safe(p, tmp, &dev->wed_rro.page_map[i], 1864 list) { 1865 list_del_init(&p->list); 1866 if (p->buf) 1867 mt76_put_page_pool_buf(p->buf, false); 1868 kfree(p); 1869 } 1870 } 1871 mt7996_msdu_page_free_cache(dev); 1872 1873 local_bh_enable(); 1874 1875 mt7996_rx_token_put(dev); 1876 } 1877 1878 int mt7996_rro_msdu_page_add(struct mt76_dev *mdev, struct mt76_queue *q, 1879 dma_addr_t dma_addr, void *data) 1880 { 1881 struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); 1882 struct mt7996_msdu_page_info *pinfo = data; 1883 struct mt7996_msdu_page *p; 1884 u32 hash; 1885 1886 pinfo->data |= cpu_to_le32(FIELD_PREP(MSDU_PAGE_INFO_OWNER_MASK, 1)); 1887 p = mt7996_msdu_page_get(dev); 1888 if (!p) 1889 return -ENOMEM; 1890 1891 p->buf = data; 1892 p->dma_addr = dma_addr; 1893 p->q = q; 1894 1895 hash = mt7996_msdu_page_hash_from_addr(dma_addr); 1896 1897 spin_lock(&dev->wed_rro.lock); 1898 list_add_tail(&p->list, &dev->wed_rro.page_map[hash]); 1899 spin_unlock(&dev->wed_rro.lock); 1900 1901 return 0; 1902 } 1903 1904 static struct mt7996_wed_rro_addr * 1905 mt7996_rro_addr_elem_get(struct mt7996_dev *dev, u16 session_id, u16 seq_num) 1906 { 1907 u32 idx = 0; 1908 void *addr; 1909 1910 if (session_id == MT7996_RRO_MAX_SESSION) { 1911 addr = dev->wed_rro.session.ptr; 1912 } else { 1913 idx = session_id / MT7996_RRO_BA_BITMAP_SESSION_SIZE; 1914 addr = dev->wed_rro.addr_elem[idx].ptr; 1915 1916 idx = session_id % MT7996_RRO_BA_BITMAP_SESSION_SIZE; 1917 idx = idx * MT7996_RRO_WINDOW_MAX_LEN; 1918 } 1919 idx += seq_num % MT7996_RRO_WINDOW_MAX_LEN; 1920 1921 return addr + idx * sizeof(struct mt7996_wed_rro_addr); 1922 } 1923 1924 #define MT996_RRO_SN_MASK GENMASK(11, 0) 1925 1926 void mt7996_rro_rx_process(struct mt76_dev *mdev, void *data) 1927 { 1928 struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); 1929 struct mt76_wed_rro_ind *cmd = (struct mt76_wed_rro_ind *)data; 1930 u32 cmd_data0 = le32_to_cpu(cmd->data0); 1931 u32 cmd_data1 = le32_to_cpu(cmd->data1); 1932 u8 ind_reason = FIELD_GET(RRO_IND_DATA0_IND_REASON_MASK, cmd_data0); 1933 u16 start_seq = FIELD_GET(RRO_IND_DATA0_START_SEQ_MASK, cmd_data0); 1934 u16 seq_id = FIELD_GET(RRO_IND_DATA0_SEQ_ID_MASK, cmd_data0); 1935 u16 ind_count = FIELD_GET(RRO_IND_DATA1_IND_COUNT_MASK, cmd_data1); 1936 struct mt7996_msdu_page_info *pinfo = NULL; 1937 struct mt7996_msdu_page *p = NULL; 1938 int i, seq_num = 0; 1939 1940 if (seq_id > MT7996_RRO_MAX_SESSION) 1941 return; 1942 1943 for (i = 0; i < ind_count; i++) { 1944 struct mt7996_wed_rro_addr *e; 1945 struct mt76_rx_status *status; 1946 struct mt7996_rro_hif *rxd; 1947 int j, len, qid, data_len; 1948 struct mt76_txwi_cache *t; 1949 dma_addr_t dma_addr = 0; 1950 u16 rx_token_id, count; 1951 struct mt76_queue *q; 1952 struct sk_buff *skb; 1953 u32 info = 0, data; 1954 u8 signature; 1955 void *buf; 1956 bool ls; 1957 1958 seq_num = FIELD_GET(MT996_RRO_SN_MASK, start_seq + i); 1959 e = mt7996_rro_addr_elem_get(dev, seq_id, seq_num); 1960 data = le32_to_cpu(e->data); 1961 signature = FIELD_GET(WED_RRO_ADDR_SIGNATURE_MASK, data); 1962 if (signature != (seq_num / MT7996_RRO_WINDOW_MAX_LEN)) { 1963 u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 1964 0xff); 1965 1966 e->data |= cpu_to_le32(val); 1967 goto update_ack_seq_num; 1968 } 1969 1970 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT 1971 dma_addr = FIELD_GET(WED_RRO_ADDR_HEAD_HIGH_MASK, data); 1972 dma_addr <<= 32; 1973 #endif 1974 dma_addr |= le32_to_cpu(e->head_low); 1975 1976 count = FIELD_GET(WED_RRO_ADDR_COUNT_MASK, data); 1977 for (j = 0; j < count; j++) { 1978 if (!p) { 1979 p = mt7996_rro_msdu_page_get(dev, dma_addr); 1980 if (!p) 1981 continue; 1982 1983 dma_sync_single_for_cpu(mdev->dma_dev, p->dma_addr, 1984 SKB_WITH_OVERHEAD(p->q->buf_size), 1985 page_pool_get_dma_dir(p->q->page_pool)); 1986 pinfo = (struct mt7996_msdu_page_info *)p->buf; 1987 } 1988 1989 rxd = &pinfo->rxd[j % MT7996_MAX_HIF_RXD_IN_PG]; 1990 len = FIELD_GET(RRO_HIF_DATA1_SDL_MASK, 1991 le32_to_cpu(rxd->data1)); 1992 1993 rx_token_id = FIELD_GET(RRO_HIF_DATA4_RX_TOKEN_ID_MASK, 1994 le32_to_cpu(rxd->data4)); 1995 t = mt76_rx_token_release(mdev, rx_token_id); 1996 if (!t) 1997 goto next_page; 1998 1999 qid = t->qid; 2000 buf = t->ptr; 2001 q = &mdev->q_rx[qid]; 2002 dma_sync_single_for_cpu(mdev->dma_dev, t->dma_addr, 2003 SKB_WITH_OVERHEAD(q->buf_size), 2004 page_pool_get_dma_dir(q->page_pool)); 2005 2006 t->dma_addr = 0; 2007 t->ptr = NULL; 2008 mt76_put_rxwi(mdev, t); 2009 if (!buf) 2010 goto next_page; 2011 2012 if (q->rx_head) 2013 data_len = q->buf_size; 2014 else 2015 data_len = SKB_WITH_OVERHEAD(q->buf_size); 2016 2017 if (data_len < len + q->buf_offset) { 2018 dev_kfree_skb(q->rx_head); 2019 mt76_put_page_pool_buf(buf, false); 2020 q->rx_head = NULL; 2021 goto next_page; 2022 } 2023 2024 ls = FIELD_GET(RRO_HIF_DATA1_LS_MASK, 2025 le32_to_cpu(rxd->data1)); 2026 if (q->rx_head) { 2027 /* TODO: Take into account non-linear skb. */ 2028 mt76_put_page_pool_buf(buf, false); 2029 if (ls) { 2030 dev_kfree_skb(q->rx_head); 2031 q->rx_head = NULL; 2032 } 2033 goto next_page; 2034 } 2035 2036 if (ls && !mt7996_rx_check(mdev, buf, len)) 2037 goto next_page; 2038 2039 skb = build_skb(buf, q->buf_size); 2040 if (!skb) 2041 goto next_page; 2042 2043 skb_reserve(skb, q->buf_offset); 2044 skb_mark_for_recycle(skb); 2045 __skb_put(skb, len); 2046 2047 if (ind_reason == 1 || ind_reason == 2) { 2048 dev_kfree_skb(skb); 2049 goto next_page; 2050 } 2051 2052 if (!ls) { 2053 q->rx_head = skb; 2054 goto next_page; 2055 } 2056 2057 status = (struct mt76_rx_status *)skb->cb; 2058 if (seq_id != MT7996_RRO_MAX_SESSION) 2059 status->aggr = true; 2060 2061 mt7996_queue_rx_skb(mdev, qid, skb, &info); 2062 next_page: 2063 if ((j + 1) % MT7996_MAX_HIF_RXD_IN_PG == 0) { 2064 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT 2065 dma_addr = 2066 FIELD_GET(MSDU_PAGE_INFO_PG_HIGH_MASK, 2067 le32_to_cpu(pinfo->data)); 2068 dma_addr <<= 32; 2069 dma_addr |= le32_to_cpu(pinfo->pg_low); 2070 #else 2071 dma_addr = le32_to_cpu(pinfo->pg_low); 2072 #endif 2073 mt7996_msdu_page_put_to_cache(dev, p); 2074 p = NULL; 2075 } 2076 } 2077 2078 update_ack_seq_num: 2079 if ((i + 1) % 4 == 0) 2080 mt76_wr(dev, MT_RRO_ACK_SN_CTRL, 2081 FIELD_PREP(MT_RRO_ACK_SN_CTRL_SESSION_MASK, 2082 seq_id) | 2083 FIELD_PREP(MT_RRO_ACK_SN_CTRL_SN_MASK, 2084 seq_num)); 2085 if (p) { 2086 mt7996_msdu_page_put_to_cache(dev, p); 2087 p = NULL; 2088 } 2089 } 2090 2091 /* Update ack_seq_num for remaining addr_elem */ 2092 if (i % 4) 2093 mt76_wr(dev, MT_RRO_ACK_SN_CTRL, 2094 FIELD_PREP(MT_RRO_ACK_SN_CTRL_SESSION_MASK, seq_id) | 2095 FIELD_PREP(MT_RRO_ACK_SN_CTRL_SN_MASK, seq_num)); 2096 } 2097 2098 void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy) 2099 { 2100 struct mt7996_dev *dev = phy->dev; 2101 u32 reg = MT_WF_PHYRX_BAND_RX_CTRL1(phy->mt76->band_idx); 2102 2103 mt76_clear(dev, reg, MT_WF_PHYRX_BAND_RX_CTRL1_STSCNT_EN); 2104 mt76_set(dev, reg, BIT(11) | BIT(9)); 2105 } 2106 2107 void mt7996_mac_reset_counters(struct mt7996_phy *phy) 2108 { 2109 struct mt7996_dev *dev = phy->dev; 2110 u8 band_idx = phy->mt76->band_idx; 2111 int i; 2112 2113 for (i = 0; i < 16; i++) 2114 mt76_rr(dev, MT_TX_AGG_CNT(band_idx, i)); 2115 2116 phy->mt76->survey_time = ktime_get_boottime(); 2117 2118 memset(phy->mt76->aggr_stats, 0, sizeof(phy->mt76->aggr_stats)); 2119 2120 /* reset airtime counters */ 2121 mt76_set(dev, MT_WF_RMAC_MIB_AIRTIME0(band_idx), 2122 MT_WF_RMAC_MIB_RXTIME_CLR); 2123 2124 mt7996_mcu_get_chan_mib_info(phy, true); 2125 } 2126 2127 void mt7996_mac_set_coverage_class(struct mt7996_phy *phy) 2128 { 2129 s16 coverage_class = phy->coverage_class; 2130 struct mt7996_dev *dev = phy->dev; 2131 u32 reg_offset; 2132 u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) | 2133 FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48); 2134 u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) | 2135 FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28); 2136 u8 band_idx = phy->mt76->band_idx; 2137 int offset; 2138 2139 if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state)) 2140 return; 2141 2142 offset = 3 * coverage_class; 2143 reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) | 2144 FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset); 2145 2146 mt76_wr(dev, MT_TMAC_CDTR(band_idx), cck + reg_offset); 2147 mt76_wr(dev, MT_TMAC_ODTR(band_idx), ofdm + reg_offset); 2148 } 2149 2150 void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band) 2151 { 2152 mt76_set(dev, MT_WF_PHYRX_CSD_BAND_RXTD12(band), 2153 MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR_ONLY | 2154 MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR); 2155 2156 mt76_set(dev, MT_WF_PHYRX_BAND_RX_CTRL1(band), 2157 FIELD_PREP(MT_WF_PHYRX_BAND_RX_CTRL1_IPI_EN, 0x5)); 2158 } 2159 2160 static u8 2161 mt7996_phy_get_nf(struct mt7996_phy *phy, u8 band_idx) 2162 { 2163 static const u8 nf_power[] = { 92, 89, 86, 83, 80, 75, 70, 65, 60, 55, 52 }; 2164 struct mt7996_dev *dev = phy->dev; 2165 u32 val, sum = 0, n = 0; 2166 int ant, i; 2167 2168 for (ant = 0; ant < hweight8(phy->mt76->antenna_mask); ant++) { 2169 u32 reg = MT_WF_PHYRX_CSD_IRPI(band_idx, ant); 2170 2171 for (i = 0; i < ARRAY_SIZE(nf_power); i++, reg += 4) { 2172 val = mt76_rr(dev, reg); 2173 sum += val * nf_power[i]; 2174 n += val; 2175 } 2176 } 2177 2178 return n ? sum / n : 0; 2179 } 2180 2181 void mt7996_update_channel(struct mt76_phy *mphy) 2182 { 2183 struct mt7996_phy *phy = mphy->priv; 2184 struct mt76_channel_state *state = mphy->chan_state; 2185 int nf; 2186 2187 mt7996_mcu_get_chan_mib_info(phy, false); 2188 2189 nf = mt7996_phy_get_nf(phy, mphy->band_idx); 2190 if (!phy->noise) 2191 phy->noise = nf << 4; 2192 else if (nf) 2193 phy->noise += nf - (phy->noise >> 4); 2194 2195 state->noise = -(phy->noise >> 4); 2196 } 2197 2198 static bool 2199 mt7996_wait_reset_state(struct mt7996_dev *dev, u32 state) 2200 { 2201 bool ret; 2202 2203 ret = wait_event_timeout(dev->reset_wait, 2204 (READ_ONCE(dev->recovery.state) & state), 2205 MT7996_RESET_TIMEOUT); 2206 2207 WARN(!ret, "Timeout waiting for MCU reset state %x\n", state); 2208 return ret; 2209 } 2210 2211 static void 2212 mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif) 2213 { 2214 struct ieee80211_bss_conf *link_conf; 2215 struct mt7996_phy *phy = priv; 2216 struct mt7996_dev *dev = phy->dev; 2217 unsigned int link_id; 2218 2219 2220 switch (vif->type) { 2221 case NL80211_IFTYPE_MESH_POINT: 2222 case NL80211_IFTYPE_ADHOC: 2223 case NL80211_IFTYPE_AP: 2224 break; 2225 default: 2226 return; 2227 } 2228 2229 for_each_vif_active_link(vif, link_conf, link_id) { 2230 struct mt7996_vif_link *link; 2231 struct mt7996_phy *link_phy; 2232 2233 link = mt7996_vif_link(dev, vif, link_id); 2234 if (!link) 2235 continue; 2236 2237 link_phy = mt7996_vif_link_phy(link); 2238 if (link_phy != phy) 2239 continue; 2240 2241 mt7996_mcu_add_beacon(dev->mt76.hw, vif, link_conf, 2242 link_conf->enable_beacon); 2243 } 2244 } 2245 2246 void mt7996_mac_update_beacons(struct mt7996_phy *phy) 2247 { 2248 ieee80211_iterate_active_interfaces(phy->mt76->hw, 2249 IEEE80211_IFACE_ITER_RESUME_ALL, 2250 mt7996_update_vif_beacon, phy); 2251 } 2252 2253 static void 2254 mt7996_update_beacons(struct mt7996_dev *dev) 2255 { 2256 struct mt76_phy *phy2, *phy3; 2257 2258 mt7996_mac_update_beacons(&dev->phy); 2259 2260 phy2 = dev->mt76.phys[MT_BAND1]; 2261 if (phy2) 2262 mt7996_mac_update_beacons(phy2->priv); 2263 2264 phy3 = dev->mt76.phys[MT_BAND2]; 2265 if (phy3) 2266 mt7996_mac_update_beacons(phy3->priv); 2267 } 2268 2269 void mt7996_tx_token_put(struct mt7996_dev *dev) 2270 { 2271 struct mt76_txwi_cache *txwi; 2272 int id; 2273 2274 spin_lock_bh(&dev->mt76.token_lock); 2275 idr_for_each_entry(&dev->mt76.token, txwi, id) { 2276 mt7996_txwi_free(dev, txwi, NULL, NULL, NULL); 2277 dev->mt76.token_count--; 2278 } 2279 spin_unlock_bh(&dev->mt76.token_lock); 2280 idr_destroy(&dev->mt76.token); 2281 2282 for (id = 0; id < __MT_MAX_BAND; id++) { 2283 struct mt76_phy *phy = dev->mt76.phys[id]; 2284 if (phy) 2285 atomic_set(&phy->mgmt_tx_pending, 0); 2286 } 2287 } 2288 2289 static int 2290 mt7996_mac_restart(struct mt7996_dev *dev) 2291 { 2292 struct mt76_dev *mdev = &dev->mt76; 2293 struct mt7996_phy *phy; 2294 int i, ret; 2295 2296 if (dev->hif2) { 2297 mt76_wr(dev, MT_INT1_MASK_CSR, 0x0); 2298 mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0); 2299 } 2300 2301 if (dev_is_pci(mdev->dev)) { 2302 mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0); 2303 if (dev->hif2) 2304 mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0); 2305 } 2306 2307 set_bit(MT76_MCU_RESET, &dev->mphy.state); 2308 mt7996_for_each_phy(dev, phy) 2309 set_bit(MT76_RESET, &phy->mt76->state); 2310 wake_up(&dev->mt76.mcu.wait); 2311 2312 /* lock/unlock all queues to ensure that no tx is pending */ 2313 mt7996_for_each_phy(dev, phy) 2314 mt76_txq_schedule_all(phy->mt76); 2315 2316 /* disable all tx/rx napi */ 2317 mt76_worker_disable(&dev->mt76.tx_worker); 2318 mt76_for_each_q_rx(mdev, i) { 2319 if (mtk_wed_device_active(&dev->mt76.mmio.wed) && 2320 mt76_queue_is_wed_rro(&mdev->q_rx[i])) 2321 continue; 2322 2323 if (mdev->q_rx[i].ndesc) 2324 napi_disable(&dev->mt76.napi[i]); 2325 } 2326 napi_disable(&dev->mt76.tx_napi); 2327 2328 /* token reinit */ 2329 mt7996_tx_token_put(dev); 2330 idr_init(&dev->mt76.token); 2331 2332 mt7996_dma_reset(dev, true); 2333 2334 mt76_for_each_q_rx(mdev, i) { 2335 if (mtk_wed_device_active(&dev->mt76.mmio.wed) && 2336 mt76_queue_is_wed_rro(&mdev->q_rx[i])) 2337 continue; 2338 2339 if (mdev->q_rx[i].ndesc) { 2340 napi_enable(&dev->mt76.napi[i]); 2341 local_bh_disable(); 2342 napi_schedule(&dev->mt76.napi[i]); 2343 local_bh_enable(); 2344 } 2345 } 2346 clear_bit(MT76_MCU_RESET, &dev->mphy.state); 2347 clear_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state); 2348 2349 mt76_wr(dev, MT_INT_MASK_CSR, dev->mt76.mmio.irqmask); 2350 mt76_wr(dev, MT_INT_SOURCE_CSR, ~0); 2351 if (dev->hif2) { 2352 mt76_wr(dev, MT_INT1_MASK_CSR, dev->mt76.mmio.irqmask); 2353 mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0); 2354 } 2355 if (dev_is_pci(mdev->dev)) { 2356 mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff); 2357 if (dev->hif2) 2358 mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff); 2359 } 2360 2361 /* load firmware */ 2362 ret = mt7996_mcu_init_firmware(dev); 2363 if (ret) 2364 goto out; 2365 2366 if (mtk_wed_device_active(&dev->mt76.mmio.wed) && 2367 mt7996_has_hwrro(dev)) { 2368 u32 wed_irq_mask = dev->mt76.mmio.irqmask | 2369 MT_INT_TX_DONE_BAND2; 2370 2371 mt7996_rro_hw_init(dev); 2372 mt76_for_each_q_rx(&dev->mt76, i) { 2373 if (mt76_queue_is_wed_rro_ind(&dev->mt76.q_rx[i]) || 2374 mt76_queue_is_wed_rro_msdu_pg(&dev->mt76.q_rx[i])) 2375 mt76_queue_rx_reset(dev, i); 2376 } 2377 2378 mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask); 2379 mtk_wed_device_start_hw_rro(&dev->mt76.mmio.wed, wed_irq_mask, 2380 false); 2381 mt7996_irq_enable(dev, wed_irq_mask); 2382 mt7996_irq_disable(dev, 0); 2383 } 2384 2385 if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2)) { 2386 mt76_wr(dev, MT_INT_PCIE1_MASK_CSR, 2387 MT_INT_TX_RX_DONE_EXT); 2388 mtk_wed_device_start(&dev->mt76.mmio.wed_hif2, 2389 MT_INT_TX_RX_DONE_EXT); 2390 } 2391 2392 /* set the necessary init items */ 2393 ret = mt7996_mcu_set_eeprom(dev); 2394 if (ret) 2395 goto out; 2396 2397 mt7996_mac_init(dev); 2398 mt7996_for_each_phy(dev, phy) 2399 mt7996_init_txpower(phy); 2400 ret = mt7996_txbf_init(dev); 2401 if (ret) 2402 goto out; 2403 2404 mt7996_for_each_phy(dev, phy) { 2405 if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state)) 2406 continue; 2407 2408 ret = mt7996_run(phy); 2409 if (ret) 2410 goto out; 2411 } 2412 2413 out: 2414 /* reset done */ 2415 mt7996_for_each_phy(dev, phy) 2416 clear_bit(MT76_RESET, &phy->mt76->state); 2417 2418 napi_enable(&dev->mt76.tx_napi); 2419 local_bh_disable(); 2420 napi_schedule(&dev->mt76.tx_napi); 2421 local_bh_enable(); 2422 2423 mt76_worker_enable(&dev->mt76.tx_worker); 2424 return ret; 2425 } 2426 2427 static void 2428 mt7996_mac_reset_sta_iter(void *data, struct ieee80211_sta *sta) 2429 { 2430 struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; 2431 struct mt7996_dev *dev = data; 2432 int i; 2433 2434 for (i = 0; i < ARRAY_SIZE(msta->link); i++) 2435 mt7996_mac_sta_remove_link(dev, sta, i, true); 2436 } 2437 2438 static void 2439 mt7996_mac_reset_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif) 2440 { 2441 struct mt76_vif_link *mlink = (struct mt76_vif_link *)vif->drv_priv; 2442 struct mt76_vif_data *mvif = mlink->mvif; 2443 struct mt7996_dev *dev = data; 2444 int i; 2445 2446 rcu_read_lock(); 2447 for (i = 0; i < ARRAY_SIZE(mvif->link); i++) { 2448 2449 mlink = mt76_dereference(mvif->link[i], &dev->mt76); 2450 if (!mlink || mlink == (struct mt76_vif_link *)vif->drv_priv) 2451 continue; 2452 2453 rcu_assign_pointer(mvif->link[i], NULL); 2454 kfree_rcu(mlink, rcu_head); 2455 } 2456 mvif->valid_links = 0; 2457 rcu_read_unlock(); 2458 } 2459 2460 static void 2461 mt7996_mac_full_reset(struct mt7996_dev *dev) 2462 { 2463 struct ieee80211_hw *hw = mt76_hw(dev); 2464 struct mt7996_phy *phy; 2465 LIST_HEAD(list); 2466 int i; 2467 2468 dev->recovery.hw_full_reset = true; 2469 2470 set_bit(MT76_RESTART, &dev->mphy.state); 2471 set_bit(MT76_MCU_RESET, &dev->mphy.state); 2472 wake_up(&dev->mt76.mcu.wait); 2473 ieee80211_stop_queues(hw); 2474 2475 cancel_work_sync(&dev->wed_rro.work); 2476 mt7996_for_each_phy(dev, phy) 2477 cancel_delayed_work_sync(&phy->mt76->mac_work); 2478 2479 mt76_abort_scan(&dev->mt76); 2480 2481 mutex_lock(&dev->mt76.mutex); 2482 for (i = 0; i < 10; i++) { 2483 if (!mt7996_mac_restart(dev)) 2484 break; 2485 } 2486 2487 if (i == 10) 2488 dev_err(dev->mt76.dev, "chip full reset failed\n"); 2489 2490 mt7996_for_each_phy(dev, phy) 2491 phy->omac_mask = 0; 2492 dev->mld_idx_mask = 0; 2493 dev->mld_remap_idx_mask = 0; 2494 2495 ieee80211_iterate_stations_atomic(hw, mt7996_mac_reset_sta_iter, dev); 2496 mt76_reset_device(&dev->mt76); 2497 ieee80211_iterate_active_interfaces_atomic(hw, 2498 IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER, 2499 mt7996_mac_reset_vif_iter, dev); 2500 2501 INIT_LIST_HEAD(&dev->sta_rc_list); 2502 INIT_LIST_HEAD(&dev->twt_list); 2503 2504 spin_lock_bh(&dev->wed_rro.lock); 2505 list_splice_init(&dev->wed_rro.poll_list, &list); 2506 spin_unlock_bh(&dev->wed_rro.lock); 2507 2508 while (!list_empty(&list)) { 2509 struct mt7996_wed_rro_session_id *e; 2510 2511 e = list_first_entry(&list, struct mt7996_wed_rro_session_id, 2512 list); 2513 list_del_init(&e->list); 2514 kfree(e); 2515 } 2516 2517 i = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7996_WTBL_STA); 2518 dev->mt76.global_wcid.idx = i; 2519 dev->recovery.hw_full_reset = false; 2520 2521 mutex_unlock(&dev->mt76.mutex); 2522 2523 ieee80211_wake_queues(mt76_hw(dev)); 2524 2525 ieee80211_restart_hw(mt76_hw(dev)); 2526 } 2527 2528 void mt7996_mac_reset_work(struct work_struct *work) 2529 { 2530 struct ieee80211_hw *hw; 2531 struct mt7996_dev *dev; 2532 struct mt7996_phy *phy; 2533 int i; 2534 2535 dev = container_of(work, struct mt7996_dev, reset_work); 2536 hw = mt76_hw(dev); 2537 2538 /* chip full reset */ 2539 if (dev->recovery.restart) { 2540 /* disable WA/WM WDT */ 2541 mt76_clear(dev, MT_WFDMA0_MCU_HOST_INT_ENA, 2542 MT_MCU_CMD_WDT_MASK); 2543 2544 if (READ_ONCE(dev->recovery.state) & MT_MCU_CMD_WA_WDT) 2545 dev->recovery.wa_reset_count++; 2546 else 2547 dev->recovery.wm_reset_count++; 2548 2549 mt7996_mac_full_reset(dev); 2550 2551 /* enable mcu irq */ 2552 mt7996_irq_enable(dev, MT_INT_MCU_CMD); 2553 mt7996_irq_disable(dev, 0); 2554 2555 /* enable WA/WM WDT */ 2556 mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, MT_MCU_CMD_WDT_MASK); 2557 2558 dev->recovery.state = MT_MCU_CMD_NORMAL_STATE; 2559 dev->recovery.restart = false; 2560 return; 2561 } 2562 2563 if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA)) 2564 return; 2565 2566 dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.", 2567 wiphy_name(hw->wiphy)); 2568 2569 if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2)) 2570 mtk_wed_device_stop(&dev->mt76.mmio.wed_hif2); 2571 2572 if (mtk_wed_device_active(&dev->mt76.mmio.wed)) 2573 mtk_wed_device_stop(&dev->mt76.mmio.wed); 2574 2575 mt7996_npu_hw_stop(dev); 2576 ieee80211_stop_queues(mt76_hw(dev)); 2577 2578 set_bit(MT76_RESET, &dev->mphy.state); 2579 set_bit(MT76_MCU_RESET, &dev->mphy.state); 2580 wake_up(&dev->mt76.mcu.wait); 2581 mt76_abort_scan(&dev->mt76); 2582 2583 cancel_work_sync(&dev->wed_rro.work); 2584 mt7996_for_each_phy(dev, phy) { 2585 mt76_abort_roc(phy->mt76); 2586 set_bit(MT76_RESET, &phy->mt76->state); 2587 cancel_delayed_work_sync(&phy->mt76->mac_work); 2588 } 2589 2590 mutex_lock(&dev->mt76.mutex); 2591 2592 mt76_worker_disable(&dev->mt76.tx_worker); 2593 mt76_for_each_q_rx(&dev->mt76, i) { 2594 if (mtk_wed_device_active(&dev->mt76.mmio.wed) && 2595 mt76_queue_is_wed_rro(&dev->mt76.q_rx[i])) 2596 continue; 2597 2598 if (mt76_npu_device_active(&dev->mt76) && 2599 mt76_queue_is_wed_rro(&dev->mt76.q_rx[i])) 2600 continue; 2601 2602 if (mt76_queue_is_npu_txfree(&dev->mt76.q_rx[i])) 2603 continue; 2604 2605 napi_disable(&dev->mt76.napi[i]); 2606 } 2607 napi_disable(&dev->mt76.tx_napi); 2608 2609 mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED); 2610 2611 if (mt7996_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) { 2612 mt7996_dma_reset(dev, false); 2613 2614 mt7996_tx_token_put(dev); 2615 idr_init(&dev->mt76.token); 2616 2617 mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_INIT); 2618 mt7996_wait_reset_state(dev, MT_MCU_CMD_RECOVERY_DONE); 2619 } 2620 2621 mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_RESET_DONE); 2622 mt7996_wait_reset_state(dev, MT_MCU_CMD_NORMAL_STATE); 2623 2624 /* enable DMA Rx/Tx and interrupt */ 2625 mt7996_dma_start(dev, false, false); 2626 2627 if (!is_mt7996(&dev->mt76) && dev->mt76.hwrro_mode == MT76_HWRRO_V3) 2628 mt76_set(dev, MT_RRO_3_0_EMU_CONF, MT_RRO_3_0_EMU_CONF_EN_MASK); 2629 2630 if (mtk_wed_device_active(&dev->mt76.mmio.wed)) { 2631 u32 wed_irq_mask = MT_INT_TX_DONE_BAND2 | 2632 dev->mt76.mmio.irqmask; 2633 2634 mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask); 2635 mtk_wed_device_start_hw_rro(&dev->mt76.mmio.wed, wed_irq_mask, 2636 true); 2637 mt7996_irq_enable(dev, wed_irq_mask); 2638 mt7996_irq_disable(dev, 0); 2639 } 2640 2641 if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2)) { 2642 mt76_wr(dev, MT_INT_PCIE1_MASK_CSR, MT_INT_TX_RX_DONE_EXT); 2643 mtk_wed_device_start(&dev->mt76.mmio.wed_hif2, 2644 MT_INT_TX_RX_DONE_EXT); 2645 } 2646 2647 __mt7996_npu_hw_init(dev); 2648 2649 clear_bit(MT76_MCU_RESET, &dev->mphy.state); 2650 mt7996_for_each_phy(dev, phy) 2651 clear_bit(MT76_RESET, &phy->mt76->state); 2652 2653 mt76_for_each_q_rx(&dev->mt76, i) { 2654 if (mtk_wed_device_active(&dev->mt76.mmio.wed) && 2655 mt76_queue_is_wed_rro(&dev->mt76.q_rx[i])) 2656 continue; 2657 2658 if (mt76_npu_device_active(&dev->mt76) && 2659 mt76_queue_is_wed_rro(&dev->mt76.q_rx[i])) 2660 continue; 2661 2662 if (mt76_queue_is_npu_txfree(&dev->mt76.q_rx[i])) 2663 continue; 2664 2665 napi_enable(&dev->mt76.napi[i]); 2666 local_bh_disable(); 2667 napi_schedule(&dev->mt76.napi[i]); 2668 local_bh_enable(); 2669 } 2670 2671 tasklet_schedule(&dev->mt76.irq_tasklet); 2672 2673 mt76_worker_enable(&dev->mt76.tx_worker); 2674 2675 napi_enable(&dev->mt76.tx_napi); 2676 local_bh_disable(); 2677 napi_schedule(&dev->mt76.tx_napi); 2678 local_bh_enable(); 2679 2680 ieee80211_wake_queues(hw); 2681 mt7996_update_beacons(dev); 2682 2683 mutex_unlock(&dev->mt76.mutex); 2684 2685 mt7996_for_each_phy(dev, phy) 2686 ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work, 2687 MT7996_WATCHDOG_TIME); 2688 dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.", 2689 wiphy_name(dev->mt76.hw->wiphy)); 2690 } 2691 2692 /* firmware coredump */ 2693 void mt7996_mac_dump_work(struct work_struct *work) 2694 { 2695 const struct mt7996_mem_region *mem_region; 2696 struct mt7996_crash_data *crash_data; 2697 struct mt7996_dev *dev; 2698 struct mt7996_mem_hdr *hdr; 2699 size_t buf_len; 2700 int i; 2701 u32 num; 2702 u8 *buf; 2703 2704 dev = container_of(work, struct mt7996_dev, dump_work); 2705 2706 mutex_lock(&dev->dump_mutex); 2707 2708 crash_data = mt7996_coredump_new(dev); 2709 if (!crash_data) { 2710 mutex_unlock(&dev->dump_mutex); 2711 goto skip_coredump; 2712 } 2713 2714 mem_region = mt7996_coredump_get_mem_layout(dev, &num); 2715 if (!mem_region || !crash_data->memdump_buf_len) { 2716 mutex_unlock(&dev->dump_mutex); 2717 goto skip_memdump; 2718 } 2719 2720 buf = crash_data->memdump_buf; 2721 buf_len = crash_data->memdump_buf_len; 2722 2723 /* dumping memory content... */ 2724 memset(buf, 0, buf_len); 2725 for (i = 0; i < num; i++) { 2726 if (mem_region->len > buf_len) { 2727 dev_warn(dev->mt76.dev, "%s len %zu is too large\n", 2728 mem_region->name, mem_region->len); 2729 break; 2730 } 2731 2732 /* reserve space for the header */ 2733 hdr = (void *)buf; 2734 buf += sizeof(*hdr); 2735 buf_len -= sizeof(*hdr); 2736 2737 mt7996_memcpy_fromio(dev, buf, mem_region->start, 2738 mem_region->len); 2739 2740 hdr->start = mem_region->start; 2741 hdr->len = mem_region->len; 2742 2743 if (!mem_region->len) 2744 /* note: the header remains, just with zero length */ 2745 break; 2746 2747 buf += mem_region->len; 2748 buf_len -= mem_region->len; 2749 2750 mem_region++; 2751 } 2752 2753 mutex_unlock(&dev->dump_mutex); 2754 2755 skip_memdump: 2756 mt7996_coredump_submit(dev); 2757 skip_coredump: 2758 queue_work(dev->mt76.wq, &dev->reset_work); 2759 } 2760 2761 void mt7996_reset(struct mt7996_dev *dev) 2762 { 2763 if (!dev->recovery.hw_init_done) 2764 return; 2765 2766 if (dev->recovery.hw_full_reset) 2767 return; 2768 2769 /* wm/wa exception: do full recovery */ 2770 if (READ_ONCE(dev->recovery.state) & MT_MCU_CMD_WDT_MASK) { 2771 dev->recovery.restart = true; 2772 dev_info(dev->mt76.dev, 2773 "%s indicated firmware crash, attempting recovery\n", 2774 wiphy_name(dev->mt76.hw->wiphy)); 2775 2776 mt7996_irq_disable(dev, MT_INT_MCU_CMD); 2777 queue_work(dev->mt76.wq, &dev->dump_work); 2778 return; 2779 } 2780 2781 if (READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA) { 2782 set_bit(MT76_MCU_RESET, &dev->mphy.state); 2783 wake_up(&dev->mt76.mcu.wait); 2784 } 2785 2786 queue_work(dev->mt76.wq, &dev->reset_work); 2787 wake_up(&dev->reset_wait); 2788 } 2789 2790 void mt7996_mac_update_stats(struct mt7996_phy *phy) 2791 { 2792 struct mt76_mib_stats *mib = &phy->mib; 2793 struct mt7996_dev *dev = phy->dev; 2794 u8 band_idx = phy->mt76->band_idx; 2795 u32 cnt; 2796 int i; 2797 2798 cnt = mt76_rr(dev, MT_MIB_RSCR1(band_idx)); 2799 mib->fcs_err_cnt += cnt; 2800 2801 cnt = mt76_rr(dev, MT_MIB_RSCR33(band_idx)); 2802 mib->rx_fifo_full_cnt += cnt; 2803 2804 cnt = mt76_rr(dev, MT_MIB_RSCR31(band_idx)); 2805 mib->rx_mpdu_cnt += cnt; 2806 2807 cnt = mt76_rr(dev, MT_MIB_SDR6(band_idx)); 2808 mib->channel_idle_cnt += FIELD_GET(MT_MIB_SDR6_CHANNEL_IDL_CNT_MASK, cnt); 2809 2810 cnt = mt76_rr(dev, MT_MIB_RVSR0(band_idx)); 2811 mib->rx_vector_mismatch_cnt += cnt; 2812 2813 cnt = mt76_rr(dev, MT_MIB_RSCR35(band_idx)); 2814 mib->rx_delimiter_fail_cnt += cnt; 2815 2816 cnt = mt76_rr(dev, MT_MIB_RSCR36(band_idx)); 2817 mib->rx_len_mismatch_cnt += cnt; 2818 2819 cnt = mt76_rr(dev, MT_MIB_TSCR0(band_idx)); 2820 mib->tx_ampdu_cnt += cnt; 2821 2822 cnt = mt76_rr(dev, MT_MIB_TSCR2(band_idx)); 2823 mib->tx_stop_q_empty_cnt += cnt; 2824 2825 cnt = mt76_rr(dev, MT_MIB_TSCR3(band_idx)); 2826 mib->tx_mpdu_attempts_cnt += cnt; 2827 2828 cnt = mt76_rr(dev, MT_MIB_TSCR4(band_idx)); 2829 mib->tx_mpdu_success_cnt += cnt; 2830 2831 cnt = mt76_rr(dev, MT_MIB_RSCR27(band_idx)); 2832 mib->rx_ampdu_cnt += cnt; 2833 2834 cnt = mt76_rr(dev, MT_MIB_RSCR28(band_idx)); 2835 mib->rx_ampdu_bytes_cnt += cnt; 2836 2837 cnt = mt76_rr(dev, MT_MIB_RSCR29(band_idx)); 2838 mib->rx_ampdu_valid_subframe_cnt += cnt; 2839 2840 cnt = mt76_rr(dev, MT_MIB_RSCR30(band_idx)); 2841 mib->rx_ampdu_valid_subframe_bytes_cnt += cnt; 2842 2843 cnt = mt76_rr(dev, MT_MIB_SDR27(band_idx)); 2844 mib->tx_rwp_fail_cnt += FIELD_GET(MT_MIB_SDR27_TX_RWP_FAIL_CNT, cnt); 2845 2846 cnt = mt76_rr(dev, MT_MIB_SDR28(band_idx)); 2847 mib->tx_rwp_need_cnt += FIELD_GET(MT_MIB_SDR28_TX_RWP_NEED_CNT, cnt); 2848 2849 cnt = mt76_rr(dev, MT_UMIB_RPDCR(band_idx)); 2850 mib->rx_pfdrop_cnt += cnt; 2851 2852 cnt = mt76_rr(dev, MT_MIB_RVSR1(band_idx)); 2853 mib->rx_vec_queue_overflow_drop_cnt += cnt; 2854 2855 cnt = mt76_rr(dev, MT_MIB_TSCR1(band_idx)); 2856 mib->rx_ba_cnt += cnt; 2857 2858 cnt = mt76_rr(dev, MT_MIB_BSCR0(band_idx)); 2859 mib->tx_bf_ebf_ppdu_cnt += cnt; 2860 2861 cnt = mt76_rr(dev, MT_MIB_BSCR1(band_idx)); 2862 mib->tx_bf_ibf_ppdu_cnt += cnt; 2863 2864 cnt = mt76_rr(dev, MT_MIB_BSCR2(band_idx)); 2865 mib->tx_mu_bf_cnt += cnt; 2866 2867 cnt = mt76_rr(dev, MT_MIB_TSCR5(band_idx)); 2868 mib->tx_mu_mpdu_cnt += cnt; 2869 2870 cnt = mt76_rr(dev, MT_MIB_TSCR6(band_idx)); 2871 mib->tx_mu_acked_mpdu_cnt += cnt; 2872 2873 cnt = mt76_rr(dev, MT_MIB_TSCR7(band_idx)); 2874 mib->tx_su_acked_mpdu_cnt += cnt; 2875 2876 cnt = mt76_rr(dev, MT_MIB_BSCR3(band_idx)); 2877 mib->tx_bf_rx_fb_ht_cnt += cnt; 2878 mib->tx_bf_rx_fb_all_cnt += cnt; 2879 2880 cnt = mt76_rr(dev, MT_MIB_BSCR4(band_idx)); 2881 mib->tx_bf_rx_fb_vht_cnt += cnt; 2882 mib->tx_bf_rx_fb_all_cnt += cnt; 2883 2884 cnt = mt76_rr(dev, MT_MIB_BSCR5(band_idx)); 2885 mib->tx_bf_rx_fb_he_cnt += cnt; 2886 mib->tx_bf_rx_fb_all_cnt += cnt; 2887 2888 cnt = mt76_rr(dev, MT_MIB_BSCR6(band_idx)); 2889 mib->tx_bf_rx_fb_eht_cnt += cnt; 2890 mib->tx_bf_rx_fb_all_cnt += cnt; 2891 2892 cnt = mt76_rr(dev, MT_ETBF_RX_FB_CONT(band_idx)); 2893 mib->tx_bf_rx_fb_bw = FIELD_GET(MT_ETBF_RX_FB_BW, cnt); 2894 mib->tx_bf_rx_fb_nc_cnt += FIELD_GET(MT_ETBF_RX_FB_NC, cnt); 2895 mib->tx_bf_rx_fb_nr_cnt += FIELD_GET(MT_ETBF_RX_FB_NR, cnt); 2896 2897 cnt = mt76_rr(dev, MT_MIB_BSCR7(band_idx)); 2898 mib->tx_bf_fb_trig_cnt += cnt; 2899 2900 cnt = mt76_rr(dev, MT_MIB_BSCR17(band_idx)); 2901 mib->tx_bf_fb_cpl_cnt += cnt; 2902 2903 for (i = 0; i < ARRAY_SIZE(mib->tx_amsdu); i++) { 2904 cnt = mt76_rr(dev, MT_PLE_AMSDU_PACK_MSDU_CNT(i)); 2905 mib->tx_amsdu[i] += cnt; 2906 mib->tx_amsdu_cnt += cnt; 2907 } 2908 2909 /* rts count */ 2910 cnt = mt76_rr(dev, MT_MIB_BTSCR5(band_idx)); 2911 mib->rts_cnt += cnt; 2912 2913 /* rts retry count */ 2914 cnt = mt76_rr(dev, MT_MIB_BTSCR6(band_idx)); 2915 mib->rts_retries_cnt += cnt; 2916 2917 /* ba miss count */ 2918 cnt = mt76_rr(dev, MT_MIB_BTSCR0(band_idx)); 2919 mib->ba_miss_cnt += cnt; 2920 2921 /* ack fail count */ 2922 cnt = mt76_rr(dev, MT_MIB_BFTFCR(band_idx)); 2923 mib->ack_fail_cnt += cnt; 2924 2925 for (i = 0; i < 16; i++) { 2926 cnt = mt76_rr(dev, MT_TX_AGG_CNT(band_idx, i)); 2927 phy->mt76->aggr_stats[i] += cnt; 2928 } 2929 } 2930 2931 void mt7996_mac_sta_rc_work(struct work_struct *work) 2932 { 2933 struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work); 2934 struct mt7996_sta_link *msta_link; 2935 struct ieee80211_vif *vif; 2936 struct mt7996_vif *mvif; 2937 LIST_HEAD(list); 2938 u32 changed; 2939 2940 mutex_lock(&dev->mt76.mutex); 2941 2942 spin_lock_bh(&dev->mt76.sta_poll_lock); 2943 list_splice_init(&dev->sta_rc_list, &list); 2944 2945 while (!list_empty(&list)) { 2946 msta_link = list_first_entry(&list, struct mt7996_sta_link, 2947 rc_list); 2948 list_del_init(&msta_link->rc_list); 2949 2950 changed = msta_link->changed; 2951 msta_link->changed = 0; 2952 2953 if (!msta_link->connected) 2954 continue; 2955 2956 mvif = msta_link->sta->vif; 2957 vif = container_of((void *)mvif, struct ieee80211_vif, 2958 drv_priv); 2959 2960 spin_unlock_bh(&dev->mt76.sta_poll_lock); 2961 2962 if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED | 2963 IEEE80211_RC_NSS_CHANGED | 2964 IEEE80211_RC_BW_CHANGED)) 2965 mt7996_mcu_add_rate_ctrl(dev, msta_link->sta, vif, 2966 msta_link->wcid.link_id, 2967 true); 2968 2969 if (changed & IEEE80211_RC_SMPS_CHANGED) 2970 mt7996_mcu_set_fixed_field(dev, msta_link->sta, NULL, 2971 msta_link->wcid.link_id, 2972 RATE_PARAM_MMPS_UPDATE); 2973 2974 spin_lock_bh(&dev->mt76.sta_poll_lock); 2975 } 2976 2977 spin_unlock_bh(&dev->mt76.sta_poll_lock); 2978 2979 mutex_unlock(&dev->mt76.mutex); 2980 } 2981 2982 void mt7996_mac_work(struct work_struct *work) 2983 { 2984 struct mt7996_phy *phy; 2985 struct mt76_phy *mphy; 2986 2987 mphy = (struct mt76_phy *)container_of(work, struct mt76_phy, 2988 mac_work.work); 2989 phy = mphy->priv; 2990 2991 mutex_lock(&mphy->dev->mutex); 2992 2993 mt76_update_survey(mphy); 2994 if (++mphy->mac_work_count == 5) { 2995 mphy->mac_work_count = 0; 2996 2997 mt7996_mac_update_stats(phy); 2998 2999 mt7996_mcu_get_all_sta_info(phy, UNI_ALL_STA_TXRX_RATE); 3000 if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) { 3001 mt7996_mcu_get_all_sta_info(phy, UNI_ALL_STA_TXRX_ADM_STAT); 3002 mt7996_mcu_get_all_sta_info(phy, UNI_ALL_STA_TXRX_MSDU_COUNT); 3003 } 3004 } 3005 3006 mutex_unlock(&mphy->dev->mutex); 3007 3008 mt76_beacon_mon_check(mphy); 3009 mt76_tx_status_check(mphy->dev, false); 3010 3011 ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work, 3012 MT7996_WATCHDOG_TIME); 3013 } 3014 3015 static void mt7996_dfs_stop_radar_detector(struct mt7996_phy *phy) 3016 { 3017 struct mt7996_dev *dev = phy->dev; 3018 int rdd_idx = mt7996_get_rdd_idx(phy, false); 3019 3020 if (rdd_idx < 0) 3021 return; 3022 3023 mt7996_mcu_rdd_cmd(dev, RDD_STOP, rdd_idx, 0); 3024 } 3025 3026 static int mt7996_dfs_start_rdd(struct mt7996_dev *dev, int rdd_idx) 3027 { 3028 int region; 3029 3030 switch (dev->mt76.region) { 3031 case NL80211_DFS_ETSI: 3032 region = 0; 3033 break; 3034 case NL80211_DFS_JP: 3035 region = 2; 3036 break; 3037 case NL80211_DFS_FCC: 3038 default: 3039 region = 1; 3040 break; 3041 } 3042 3043 return mt7996_mcu_rdd_cmd(dev, RDD_START, rdd_idx, region); 3044 } 3045 3046 static int mt7996_dfs_start_radar_detector(struct mt7996_phy *phy) 3047 { 3048 struct mt7996_dev *dev = phy->dev; 3049 int err, rdd_idx; 3050 3051 rdd_idx = mt7996_get_rdd_idx(phy, false); 3052 if (rdd_idx < 0) 3053 return -EINVAL; 3054 3055 /* start CAC */ 3056 err = mt7996_mcu_rdd_cmd(dev, RDD_CAC_START, rdd_idx, 0); 3057 if (err < 0) 3058 return err; 3059 3060 err = mt7996_dfs_start_rdd(dev, rdd_idx); 3061 3062 return err; 3063 } 3064 3065 int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy) 3066 { 3067 struct mt7996_dev *dev = phy->dev; 3068 enum mt76_dfs_state dfs_state, prev_state; 3069 int err, rdd_idx = mt7996_get_rdd_idx(phy, false); 3070 3071 prev_state = phy->mt76->dfs_state; 3072 dfs_state = mt76_phy_dfs_state(phy->mt76); 3073 3074 if (prev_state == dfs_state || rdd_idx < 0) 3075 return 0; 3076 3077 if (prev_state == MT_DFS_STATE_UNKNOWN) 3078 mt7996_dfs_stop_radar_detector(phy); 3079 3080 if (dfs_state == MT_DFS_STATE_DISABLED) 3081 goto stop; 3082 3083 if (prev_state <= MT_DFS_STATE_DISABLED) { 3084 err = mt7996_dfs_start_radar_detector(phy); 3085 if (err < 0) 3086 return err; 3087 3088 phy->mt76->dfs_state = MT_DFS_STATE_CAC; 3089 } 3090 3091 if (dfs_state == MT_DFS_STATE_CAC) 3092 return 0; 3093 3094 err = mt7996_mcu_rdd_cmd(dev, RDD_CAC_END, rdd_idx, 0); 3095 if (err < 0) { 3096 phy->mt76->dfs_state = MT_DFS_STATE_UNKNOWN; 3097 return err; 3098 } 3099 3100 phy->mt76->dfs_state = MT_DFS_STATE_ACTIVE; 3101 return 0; 3102 3103 stop: 3104 err = mt7996_mcu_rdd_cmd(dev, RDD_NORMAL_START, rdd_idx, 0); 3105 if (err < 0) 3106 return err; 3107 3108 mt7996_dfs_stop_radar_detector(phy); 3109 phy->mt76->dfs_state = MT_DFS_STATE_DISABLED; 3110 3111 return 0; 3112 } 3113 3114 static int 3115 mt7996_mac_twt_duration_align(int duration) 3116 { 3117 return duration << 8; 3118 } 3119 3120 static u64 3121 mt7996_mac_twt_sched_list_add(struct mt7996_dev *dev, 3122 struct mt7996_twt_flow *flow) 3123 { 3124 struct mt7996_twt_flow *iter, *iter_next; 3125 u32 duration = flow->duration << 8; 3126 u64 start_tsf; 3127 3128 iter = list_first_entry_or_null(&dev->twt_list, 3129 struct mt7996_twt_flow, list); 3130 if (!iter || !iter->sched || iter->start_tsf > duration) { 3131 /* add flow as first entry in the list */ 3132 list_add(&flow->list, &dev->twt_list); 3133 return 0; 3134 } 3135 3136 list_for_each_entry_safe(iter, iter_next, &dev->twt_list, list) { 3137 start_tsf = iter->start_tsf + 3138 mt7996_mac_twt_duration_align(iter->duration); 3139 if (list_is_last(&iter->list, &dev->twt_list)) 3140 break; 3141 3142 if (!iter_next->sched || 3143 iter_next->start_tsf > start_tsf + duration) { 3144 list_add(&flow->list, &iter->list); 3145 goto out; 3146 } 3147 } 3148 3149 /* add flow as last entry in the list */ 3150 list_add_tail(&flow->list, &dev->twt_list); 3151 out: 3152 return start_tsf; 3153 } 3154 3155 static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt) 3156 { 3157 struct ieee80211_twt_params *twt_agrt; 3158 u64 interval, duration; 3159 u16 mantissa; 3160 u8 exp; 3161 3162 /* only individual agreement supported */ 3163 if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) 3164 return -EOPNOTSUPP; 3165 3166 /* only 256us unit supported */ 3167 if (twt->control & IEEE80211_TWT_CONTROL_WAKE_DUR_UNIT) 3168 return -EOPNOTSUPP; 3169 3170 twt_agrt = (struct ieee80211_twt_params *)twt->params; 3171 3172 /* explicit agreement not supported */ 3173 if (!(twt_agrt->req_type & cpu_to_le16(IEEE80211_TWT_REQTYPE_IMPLICIT))) 3174 return -EOPNOTSUPP; 3175 3176 exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, 3177 le16_to_cpu(twt_agrt->req_type)); 3178 mantissa = le16_to_cpu(twt_agrt->mantissa); 3179 duration = twt_agrt->min_twt_dur << 8; 3180 3181 interval = (u64)mantissa << exp; 3182 if (interval < duration) 3183 return -EOPNOTSUPP; 3184 3185 return 0; 3186 } 3187 3188 static bool 3189 mt7996_mac_twt_param_equal(struct mt7996_sta_link *msta_link, 3190 struct ieee80211_twt_params *twt_agrt) 3191 { 3192 u16 type = le16_to_cpu(twt_agrt->req_type); 3193 u8 exp; 3194 int i; 3195 3196 exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, type); 3197 for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) { 3198 struct mt7996_twt_flow *f; 3199 3200 if (!(msta_link->twt.flowid_mask & BIT(i))) 3201 continue; 3202 3203 f = &msta_link->twt.flow[i]; 3204 if (f->duration == twt_agrt->min_twt_dur && 3205 f->mantissa == twt_agrt->mantissa && 3206 f->exp == exp && 3207 f->protection == !!(type & IEEE80211_TWT_REQTYPE_PROTECTION) && 3208 f->flowtype == !!(type & IEEE80211_TWT_REQTYPE_FLOWTYPE) && 3209 f->trigger == !!(type & IEEE80211_TWT_REQTYPE_TRIGGER)) 3210 return true; 3211 } 3212 3213 return false; 3214 } 3215 3216 void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw, 3217 struct ieee80211_sta *sta, 3218 struct ieee80211_twt_setup *twt) 3219 { 3220 enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT; 3221 struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; 3222 struct ieee80211_twt_params *twt_agrt = (void *)twt->params; 3223 struct mt7996_sta_link *msta_link = &msta->deflink; 3224 u16 req_type = le16_to_cpu(twt_agrt->req_type); 3225 enum ieee80211_twt_setup_cmd sta_setup_cmd; 3226 struct mt7996_dev *dev = mt7996_hw_dev(hw); 3227 struct mt7996_twt_flow *flow; 3228 u8 flowid, table_id, exp; 3229 3230 /* the firmware does not support iTWT agreements with MLD peers, and 3231 * driver TWT state is only tracked on the default link 3232 */ 3233 if (sta->mlo) 3234 goto out; 3235 3236 if (mt7996_mac_check_twt_req(twt)) 3237 goto out; 3238 3239 mutex_lock(&dev->mt76.mutex); 3240 3241 if (dev->twt.n_agrt == MT7996_MAX_TWT_AGRT) 3242 goto unlock; 3243 3244 if (hweight8(msta_link->twt.flowid_mask) == 3245 ARRAY_SIZE(msta_link->twt.flow)) 3246 goto unlock; 3247 3248 if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) { 3249 setup_cmd = TWT_SETUP_CMD_DICTATE; 3250 twt_agrt->min_twt_dur = MT7996_MIN_TWT_DUR; 3251 goto unlock; 3252 } 3253 3254 if (mt7996_mac_twt_param_equal(msta_link, twt_agrt)) 3255 goto unlock; 3256 3257 flowid = ffs(~msta_link->twt.flowid_mask) - 1; 3258 twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID); 3259 twt_agrt->req_type |= le16_encode_bits(flowid, 3260 IEEE80211_TWT_REQTYPE_FLOWID); 3261 3262 table_id = ffs(~dev->twt.table_mask) - 1; 3263 exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type); 3264 sta_setup_cmd = FIELD_GET(IEEE80211_TWT_REQTYPE_SETUP_CMD, req_type); 3265 3266 flow = &msta_link->twt.flow[flowid]; 3267 memset(flow, 0, sizeof(*flow)); 3268 INIT_LIST_HEAD(&flow->list); 3269 flow->wcid = msta_link->wcid.idx; 3270 flow->table_id = table_id; 3271 flow->id = flowid; 3272 flow->duration = twt_agrt->min_twt_dur; 3273 flow->mantissa = twt_agrt->mantissa; 3274 flow->exp = exp; 3275 flow->protection = !!(req_type & IEEE80211_TWT_REQTYPE_PROTECTION); 3276 flow->flowtype = !!(req_type & IEEE80211_TWT_REQTYPE_FLOWTYPE); 3277 flow->trigger = !!(req_type & IEEE80211_TWT_REQTYPE_TRIGGER); 3278 3279 if (sta_setup_cmd == TWT_SETUP_CMD_REQUEST || 3280 sta_setup_cmd == TWT_SETUP_CMD_SUGGEST) { 3281 u64 interval = (u64)le16_to_cpu(twt_agrt->mantissa) << exp; 3282 u64 flow_tsf, curr_tsf; 3283 u32 rem; 3284 3285 flow->sched = true; 3286 flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow); 3287 curr_tsf = __mt7996_get_tsf(hw, &msta->vif->deflink); 3288 div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem); 3289 flow_tsf = curr_tsf + interval - rem; 3290 twt_agrt->twt = cpu_to_le64(flow_tsf); 3291 } else { 3292 list_add_tail(&flow->list, &dev->twt_list); 3293 } 3294 flow->tsf = le64_to_cpu(twt_agrt->twt); 3295 3296 if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow, 3297 MCU_TWT_AGRT_ADD)) { 3298 list_del(&flow->list); 3299 goto unlock; 3300 } 3301 3302 setup_cmd = TWT_SETUP_CMD_ACCEPT; 3303 dev->twt.table_mask |= BIT(table_id); 3304 msta_link->twt.flowid_mask |= BIT(flowid); 3305 dev->twt.n_agrt++; 3306 3307 unlock: 3308 mutex_unlock(&dev->mt76.mutex); 3309 out: 3310 twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_SETUP_CMD); 3311 twt_agrt->req_type |= 3312 le16_encode_bits(setup_cmd, IEEE80211_TWT_REQTYPE_SETUP_CMD); 3313 twt->control = twt->control & IEEE80211_TWT_CONTROL_RX_DISABLED; 3314 } 3315 3316 void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev, 3317 struct mt7996_vif_link *link, 3318 struct mt7996_sta_link *msta_link, 3319 u8 flowid) 3320 { 3321 struct mt7996_twt_flow *flow; 3322 3323 lockdep_assert_held(&dev->mt76.mutex); 3324 3325 if (flowid >= ARRAY_SIZE(msta_link->twt.flow)) 3326 return; 3327 3328 if (!(msta_link->twt.flowid_mask & BIT(flowid))) 3329 return; 3330 3331 flow = &msta_link->twt.flow[flowid]; 3332 if (mt7996_mcu_twt_agrt_update(dev, link, flow, MCU_TWT_AGRT_DELETE)) 3333 return; 3334 3335 list_del_init(&flow->list); 3336 msta_link->twt.flowid_mask &= ~BIT(flowid); 3337 dev->twt.table_mask &= ~BIT(flow->table_id); 3338 dev->twt.n_agrt--; 3339 } 3340