xref: /freebsd/sys/contrib/dev/mediatek/mt76/mt7921/mac.c (revision e32fecd0c2c3ee37c47ee100f169e7eb0282a873)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/devcoredump.h>
5 #include <linux/etherdevice.h>
6 #include <linux/timekeeping.h>
7 #if defined(__FreeBSD__)
8 #include <linux/delay.h>
9 #endif
10 #include "mt7921.h"
11 #include "../dma.h"
12 #include "mac.h"
13 #include "mcu.h"
14 
15 static struct mt76_wcid *mt7921_rx_get_wcid(struct mt7921_dev *dev,
16 					    u16 idx, bool unicast)
17 {
18 	struct mt7921_sta *sta;
19 	struct mt76_wcid *wcid;
20 
21 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
22 		return NULL;
23 
24 	wcid = rcu_dereference(dev->mt76.wcid[idx]);
25 	if (unicast || !wcid)
26 		return wcid;
27 
28 	if (!wcid->sta)
29 		return NULL;
30 
31 	sta = container_of(wcid, struct mt7921_sta, wcid);
32 	if (!sta->vif)
33 		return NULL;
34 
35 	return &sta->vif->sta.wcid;
36 }
37 
38 void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
39 {
40 }
41 EXPORT_SYMBOL_GPL(mt7921_sta_ps);
42 
43 bool mt7921_mac_wtbl_update(struct mt7921_dev *dev, int idx, u32 mask)
44 {
45 	mt76_rmw(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_WLAN_IDX,
46 		 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, idx) | mask);
47 
48 	return mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY,
49 			 0, 5000);
50 }
51 
52 void mt7921_mac_sta_poll(struct mt7921_dev *dev)
53 {
54 	static const u8 ac_to_tid[] = {
55 		[IEEE80211_AC_BE] = 0,
56 		[IEEE80211_AC_BK] = 1,
57 		[IEEE80211_AC_VI] = 4,
58 		[IEEE80211_AC_VO] = 6
59 	};
60 	struct ieee80211_sta *sta;
61 	struct mt7921_sta *msta;
62 	u32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS];
63 #if defined(__linux__)
64 	LIST_HEAD(sta_poll_list);
65 #elif defined(__FreeBSD__)
66 	LINUX_LIST_HEAD(sta_poll_list);
67 #endif
68 	struct rate_info *rate;
69 	int i;
70 
71 	spin_lock_bh(&dev->sta_poll_lock);
72 	list_splice_init(&dev->sta_poll_list, &sta_poll_list);
73 	spin_unlock_bh(&dev->sta_poll_lock);
74 
75 	while (true) {
76 		bool clear = false;
77 		u32 addr, val;
78 		u16 idx;
79 		u8 bw;
80 
81 		spin_lock_bh(&dev->sta_poll_lock);
82 		if (list_empty(&sta_poll_list)) {
83 			spin_unlock_bh(&dev->sta_poll_lock);
84 			break;
85 		}
86 		msta = list_first_entry(&sta_poll_list,
87 					struct mt7921_sta, poll_list);
88 		list_del_init(&msta->poll_list);
89 		spin_unlock_bh(&dev->sta_poll_lock);
90 
91 		idx = msta->wcid.idx;
92 		addr = mt7921_mac_wtbl_lmac_addr(idx, MT_WTBL_AC0_CTT_OFFSET);
93 
94 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
95 			u32 tx_last = msta->airtime_ac[i];
96 			u32 rx_last = msta->airtime_ac[i + 4];
97 
98 			msta->airtime_ac[i] = mt76_rr(dev, addr);
99 			msta->airtime_ac[i + 4] = mt76_rr(dev, addr + 4);
100 
101 			tx_time[i] = msta->airtime_ac[i] - tx_last;
102 			rx_time[i] = msta->airtime_ac[i + 4] - rx_last;
103 
104 			if ((tx_last | rx_last) & BIT(30))
105 				clear = true;
106 
107 			addr += 8;
108 		}
109 
110 		if (clear) {
111 			mt7921_mac_wtbl_update(dev, idx,
112 					       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
113 			memset(msta->airtime_ac, 0, sizeof(msta->airtime_ac));
114 		}
115 
116 		if (!msta->wcid.sta)
117 			continue;
118 
119 		sta = container_of((void *)msta, struct ieee80211_sta,
120 				   drv_priv);
121 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
122 			u8 q = mt76_connac_lmac_mapping(i);
123 			u32 tx_cur = tx_time[q];
124 			u32 rx_cur = rx_time[q];
125 			u8 tid = ac_to_tid[i];
126 
127 			if (!tx_cur && !rx_cur)
128 				continue;
129 
130 			ieee80211_sta_register_airtime(sta, tid, tx_cur,
131 						       rx_cur);
132 		}
133 
134 		/* We don't support reading GI info from txs packets.
135 		 * For accurate tx status reporting and AQL improvement,
136 		 * we need to make sure that flags match so polling GI
137 		 * from per-sta counters directly.
138 		 */
139 		rate = &msta->wcid.rate;
140 		addr = mt7921_mac_wtbl_lmac_addr(idx,
141 						 MT_WTBL_TXRX_CAP_RATE_OFFSET);
142 		val = mt76_rr(dev, addr);
143 
144 		switch (rate->bw) {
145 		case RATE_INFO_BW_160:
146 			bw = IEEE80211_STA_RX_BW_160;
147 			break;
148 		case RATE_INFO_BW_80:
149 			bw = IEEE80211_STA_RX_BW_80;
150 			break;
151 		case RATE_INFO_BW_40:
152 			bw = IEEE80211_STA_RX_BW_40;
153 			break;
154 		default:
155 			bw = IEEE80211_STA_RX_BW_20;
156 			break;
157 		}
158 
159 		if (rate->flags & RATE_INFO_FLAGS_HE_MCS) {
160 			u8 offs = MT_WTBL_TXRX_RATE_G2_HE + 2 * bw;
161 
162 			rate->he_gi = (val & (0x3 << offs)) >> offs;
163 		} else if (rate->flags &
164 			   (RATE_INFO_FLAGS_VHT_MCS | RATE_INFO_FLAGS_MCS)) {
165 			if (val & BIT(MT_WTBL_TXRX_RATE_G2 + bw))
166 				rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
167 			else
168 				rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
169 		}
170 	}
171 }
172 EXPORT_SYMBOL_GPL(mt7921_mac_sta_poll);
173 
174 static void
175 mt7921_get_status_freq_info(struct mt7921_dev *dev, struct mt76_phy *mphy,
176 			    struct mt76_rx_status *status, u8 chfreq)
177 {
178 	if (!test_bit(MT76_HW_SCANNING, &mphy->state) &&
179 	    !test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) &&
180 	    !test_bit(MT76_STATE_ROC, &mphy->state)) {
181 		status->freq = mphy->chandef.chan->center_freq;
182 		status->band = mphy->chandef.chan->band;
183 		return;
184 	}
185 
186 	if (chfreq > 180) {
187 		status->band = NL80211_BAND_6GHZ;
188 		chfreq = (chfreq - 181) * 4 + 1;
189 	} else if (chfreq > 14) {
190 		status->band = NL80211_BAND_5GHZ;
191 	} else {
192 		status->band = NL80211_BAND_2GHZ;
193 	}
194 	status->freq = ieee80211_channel_to_frequency(chfreq, status->band);
195 }
196 
197 static void
198 mt7921_mac_rssi_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
199 {
200 	struct sk_buff *skb = priv;
201 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
202 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
203 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
204 
205 	if (status->signal > 0)
206 		return;
207 
208 	if (!ether_addr_equal(vif->addr, hdr->addr1))
209 		return;
210 
211 	ewma_rssi_add(&mvif->rssi, -status->signal);
212 }
213 
214 static void
215 mt7921_mac_assoc_rssi(struct mt7921_dev *dev, struct sk_buff *skb)
216 {
217 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
218 
219 	if (!ieee80211_is_assoc_resp(hdr->frame_control) &&
220 	    !ieee80211_is_auth(hdr->frame_control))
221 		return;
222 
223 	ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
224 		IEEE80211_IFACE_ITER_RESUME_ALL,
225 		mt7921_mac_rssi_iter, skb);
226 }
227 
228 static int
229 mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
230 {
231 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
232 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
233 	bool hdr_trans, unicast, insert_ccmp_hdr = false;
234 	u8 chfreq, qos_ctl = 0, remove_pad, amsdu_info;
235 	u16 hdr_gap;
236 	__le32 *rxv = NULL, *rxd = (__le32 *)skb->data;
237 	struct mt76_phy *mphy = &dev->mt76.phy;
238 	struct mt7921_phy *phy = &dev->phy;
239 	struct ieee80211_supported_band *sband;
240 	u32 csum_status = *(u32 *)skb->cb;
241 	u32 rxd0 = le32_to_cpu(rxd[0]);
242 	u32 rxd1 = le32_to_cpu(rxd[1]);
243 	u32 rxd2 = le32_to_cpu(rxd[2]);
244 	u32 rxd3 = le32_to_cpu(rxd[3]);
245 	u32 rxd4 = le32_to_cpu(rxd[4]);
246 	struct mt7921_sta *msta = NULL;
247 	u16 seq_ctrl = 0;
248 	__le16 fc = 0;
249 	u8 mode = 0;
250 	int i, idx;
251 
252 	memset(status, 0, sizeof(*status));
253 
254 	if (rxd1 & MT_RXD1_NORMAL_BAND_IDX)
255 		return -EINVAL;
256 
257 	if (!test_bit(MT76_STATE_RUNNING, &mphy->state))
258 		return -EINVAL;
259 
260 	if (rxd2 & MT_RXD2_NORMAL_AMSDU_ERR)
261 		return -EINVAL;
262 
263 	hdr_trans = rxd2 & MT_RXD2_NORMAL_HDR_TRANS;
264 	if (hdr_trans && (rxd1 & MT_RXD1_NORMAL_CM))
265 		return -EINVAL;
266 
267 	/* ICV error or CCMP/BIP/WPI MIC error */
268 	if (rxd1 & MT_RXD1_NORMAL_ICV_ERR)
269 		status->flag |= RX_FLAG_ONLY_MONITOR;
270 
271 	chfreq = FIELD_GET(MT_RXD3_NORMAL_CH_FREQ, rxd3);
272 	unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
273 	idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
274 	status->wcid = mt7921_rx_get_wcid(dev, idx, unicast);
275 
276 	if (status->wcid) {
277 		msta = container_of(status->wcid, struct mt7921_sta, wcid);
278 		spin_lock_bh(&dev->sta_poll_lock);
279 		if (list_empty(&msta->poll_list))
280 			list_add_tail(&msta->poll_list, &dev->sta_poll_list);
281 		spin_unlock_bh(&dev->sta_poll_lock);
282 	}
283 
284 	mt7921_get_status_freq_info(dev, mphy, status, chfreq);
285 
286 	switch (status->band) {
287 	case NL80211_BAND_5GHZ:
288 		sband = &mphy->sband_5g.sband;
289 		break;
290 	case NL80211_BAND_6GHZ:
291 		sband = &mphy->sband_6g.sband;
292 		break;
293 	default:
294 		sband = &mphy->sband_2g.sband;
295 		break;
296 	}
297 
298 	if (!sband->channels)
299 		return -EINVAL;
300 
301 	if (mt76_is_mmio(&dev->mt76) && (rxd0 & csum_mask) == csum_mask &&
302 	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))
303 		skb->ip_summed = CHECKSUM_UNNECESSARY;
304 
305 	if (rxd1 & MT_RXD1_NORMAL_FCS_ERR)
306 		status->flag |= RX_FLAG_FAILED_FCS_CRC;
307 
308 	if (rxd1 & MT_RXD1_NORMAL_TKIP_MIC_ERR)
309 		status->flag |= RX_FLAG_MMIC_ERROR;
310 
311 	if (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1) != 0 &&
312 	    !(rxd1 & (MT_RXD1_NORMAL_CLM | MT_RXD1_NORMAL_CM))) {
313 		status->flag |= RX_FLAG_DECRYPTED;
314 		status->flag |= RX_FLAG_IV_STRIPPED;
315 		status->flag |= RX_FLAG_MMIC_STRIPPED | RX_FLAG_MIC_STRIPPED;
316 	}
317 
318 	remove_pad = FIELD_GET(MT_RXD2_NORMAL_HDR_OFFSET, rxd2);
319 
320 	if (rxd2 & MT_RXD2_NORMAL_MAX_LEN_ERROR)
321 		return -EINVAL;
322 
323 	rxd += 6;
324 	if (rxd1 & MT_RXD1_NORMAL_GROUP_4) {
325 		u32 v0 = le32_to_cpu(rxd[0]);
326 		u32 v2 = le32_to_cpu(rxd[2]);
327 
328 		fc = cpu_to_le16(FIELD_GET(MT_RXD6_FRAME_CONTROL, v0));
329 		seq_ctrl = FIELD_GET(MT_RXD8_SEQ_CTRL, v2);
330 		qos_ctl = FIELD_GET(MT_RXD8_QOS_CTL, v2);
331 
332 		rxd += 4;
333 		if ((u8 *)rxd - skb->data >= skb->len)
334 			return -EINVAL;
335 	}
336 
337 	if (rxd1 & MT_RXD1_NORMAL_GROUP_1) {
338 		u8 *data = (u8 *)rxd;
339 
340 		if (status->flag & RX_FLAG_DECRYPTED) {
341 			switch (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1)) {
342 			case MT_CIPHER_AES_CCMP:
343 			case MT_CIPHER_CCMP_CCX:
344 			case MT_CIPHER_CCMP_256:
345 				insert_ccmp_hdr =
346 					FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
347 				fallthrough;
348 			case MT_CIPHER_TKIP:
349 			case MT_CIPHER_TKIP_NO_MIC:
350 			case MT_CIPHER_GCMP:
351 			case MT_CIPHER_GCMP_256:
352 				status->iv[0] = data[5];
353 				status->iv[1] = data[4];
354 				status->iv[2] = data[3];
355 				status->iv[3] = data[2];
356 				status->iv[4] = data[1];
357 				status->iv[5] = data[0];
358 				break;
359 			default:
360 				break;
361 			}
362 		}
363 		rxd += 4;
364 		if ((u8 *)rxd - skb->data >= skb->len)
365 			return -EINVAL;
366 	}
367 
368 	if (rxd1 & MT_RXD1_NORMAL_GROUP_2) {
369 		status->timestamp = le32_to_cpu(rxd[0]);
370 		status->flag |= RX_FLAG_MACTIME_START;
371 
372 		if (!(rxd2 & MT_RXD2_NORMAL_NON_AMPDU)) {
373 			status->flag |= RX_FLAG_AMPDU_DETAILS;
374 
375 			/* all subframes of an A-MPDU have the same timestamp */
376 			if (phy->rx_ampdu_ts != status->timestamp) {
377 				if (!++phy->ampdu_ref)
378 					phy->ampdu_ref++;
379 			}
380 			phy->rx_ampdu_ts = status->timestamp;
381 
382 			status->ampdu_ref = phy->ampdu_ref;
383 		}
384 
385 		rxd += 2;
386 		if ((u8 *)rxd - skb->data >= skb->len)
387 			return -EINVAL;
388 	}
389 
390 	/* RXD Group 3 - P-RXV */
391 	if (rxd1 & MT_RXD1_NORMAL_GROUP_3) {
392 		u32 v0, v1;
393 		int ret;
394 
395 		rxv = rxd;
396 		rxd += 2;
397 		if ((u8 *)rxd - skb->data >= skb->len)
398 			return -EINVAL;
399 
400 		v0 = le32_to_cpu(rxv[0]);
401 		v1 = le32_to_cpu(rxv[1]);
402 
403 		if (v0 & MT_PRXV_HT_AD_CODE)
404 			status->enc_flags |= RX_ENC_FLAG_LDPC;
405 
406 		status->chains = mphy->antenna_mask;
407 		status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v1);
408 		status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1);
409 		status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1);
410 		status->chain_signal[3] = to_rssi(MT_PRXV_RCPI3, v1);
411 		status->signal = -128;
412 		for (i = 0; i < hweight8(mphy->antenna_mask); i++) {
413 			if (!(status->chains & BIT(i)) ||
414 			    status->chain_signal[i] >= 0)
415 				continue;
416 
417 			status->signal = max(status->signal,
418 					     status->chain_signal[i]);
419 		}
420 
421 		ret = mt76_connac2_mac_fill_rx_rate(&dev->mt76, status, sband,
422 						    rxv, &mode);
423 		if (ret < 0)
424 			return ret;
425 
426 		if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
427 			rxd += 18;
428 			if ((u8 *)rxd - skb->data >= skb->len)
429 				return -EINVAL;
430 		}
431 	}
432 
433 	amsdu_info = FIELD_GET(MT_RXD4_NORMAL_PAYLOAD_FORMAT, rxd4);
434 	status->amsdu = !!amsdu_info;
435 	if (status->amsdu) {
436 		status->first_amsdu = amsdu_info == MT_RXD4_FIRST_AMSDU_FRAME;
437 		status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME;
438 	}
439 
440 	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
441 	if (hdr_trans && ieee80211_has_morefrags(fc)) {
442 		struct ieee80211_vif *vif;
443 		int err;
444 
445 		if (!msta || !msta->vif)
446 			return -EINVAL;
447 
448 		vif = container_of((void *)msta->vif, struct ieee80211_vif,
449 				   drv_priv);
450 		err = mt76_connac2_reverse_frag0_hdr_trans(vif, skb, hdr_gap);
451 		if (err)
452 			return err;
453 
454 		hdr_trans = false;
455 	} else {
456 		skb_pull(skb, hdr_gap);
457 		if (!hdr_trans && status->amsdu) {
458 			memmove(skb->data + 2, skb->data,
459 				ieee80211_get_hdrlen_from_skb(skb));
460 			skb_pull(skb, 2);
461 		}
462 	}
463 
464 	if (!hdr_trans) {
465 		struct ieee80211_hdr *hdr;
466 
467 		if (insert_ccmp_hdr) {
468 			u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1);
469 
470 			mt76_insert_ccmp_hdr(skb, key_id);
471 		}
472 
473 		hdr = mt76_skb_get_hdr(skb);
474 		fc = hdr->frame_control;
475 		if (ieee80211_is_data_qos(fc)) {
476 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
477 			qos_ctl = *ieee80211_get_qos_ctl(hdr);
478 		}
479 	} else {
480 		status->flag |= RX_FLAG_8023;
481 	}
482 
483 	mt7921_mac_assoc_rssi(dev, skb);
484 
485 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
486 		mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv, mode);
487 
488 	if (!status->wcid || !ieee80211_is_data_qos(fc))
489 		return 0;
490 
491 	status->aggr = unicast && !ieee80211_is_qos_nullfunc(fc);
492 	status->seqno = IEEE80211_SEQ_TO_SN(seq_ctrl);
493 	status->qos_ctl = qos_ctl;
494 
495 	return 0;
496 }
497 
498 static void mt7921_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
499 {
500 	struct mt7921_sta *msta;
501 	u16 fc, tid;
502 	u32 val;
503 
504 	if (!sta || !(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
505 		return;
506 
507 	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
508 	if (tid >= 6) /* skip VO queue */
509 		return;
510 
511 	val = le32_to_cpu(txwi[2]);
512 	fc = FIELD_GET(MT_TXD2_FRAME_TYPE, val) << 2 |
513 	     FIELD_GET(MT_TXD2_SUB_TYPE, val) << 4;
514 	if (unlikely(fc != (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA)))
515 		return;
516 
517 	msta = (struct mt7921_sta *)sta->drv_priv;
518 	if (!test_and_set_bit(tid, &msta->ampdu_state))
519 		ieee80211_start_tx_ba_session(sta, tid, 0);
520 }
521 
522 void mt7921_mac_add_txs(struct mt7921_dev *dev, void *data)
523 {
524 	struct mt7921_sta *msta = NULL;
525 	struct mt76_wcid *wcid;
526 	__le32 *txs_data = data;
527 	u16 wcidx;
528 	u8 pid;
529 
530 	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
531 		return;
532 
533 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
534 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
535 
536 	if (pid < MT_PACKET_ID_FIRST)
537 		return;
538 
539 	if (wcidx >= MT7921_WTBL_SIZE)
540 		return;
541 
542 	rcu_read_lock();
543 
544 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
545 	if (!wcid)
546 		goto out;
547 
548 	msta = container_of(wcid, struct mt7921_sta, wcid);
549 
550 	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
551 	if (!wcid->sta)
552 		goto out;
553 
554 	spin_lock_bh(&dev->sta_poll_lock);
555 	if (list_empty(&msta->poll_list))
556 		list_add_tail(&msta->poll_list, &dev->sta_poll_list);
557 	spin_unlock_bh(&dev->sta_poll_lock);
558 
559 out:
560 	rcu_read_unlock();
561 }
562 
563 void mt7921_txwi_free(struct mt7921_dev *dev, struct mt76_txwi_cache *t,
564 		      struct ieee80211_sta *sta, bool clear_status,
565 		      struct list_head *free_list)
566 {
567 	struct mt76_dev *mdev = &dev->mt76;
568 	__le32 *txwi;
569 	u16 wcid_idx;
570 
571 	mt76_connac_txp_skb_unmap(mdev, t);
572 	if (!t->skb)
573 		goto out;
574 
575 	txwi = (__le32 *)mt76_get_txwi_ptr(mdev, t);
576 	if (sta) {
577 		struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
578 
579 		if (likely(t->skb->protocol != cpu_to_be16(ETH_P_PAE)))
580 			mt7921_tx_check_aggr(sta, txwi);
581 
582 		wcid_idx = wcid->idx;
583 	} else {
584 		wcid_idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
585 	}
586 
587 	__mt76_tx_complete_skb(mdev, wcid_idx, t->skb, free_list);
588 out:
589 	t->skb = NULL;
590 	mt76_put_txwi(mdev, t);
591 }
592 EXPORT_SYMBOL_GPL(mt7921_txwi_free);
593 
594 static void mt7921_mac_tx_free(struct mt7921_dev *dev, void *data, int len)
595 {
596 	struct mt76_connac_tx_free *free = data;
597 #if defined(__linux__)
598 	__le32 *tx_info = (__le32 *)(data + sizeof(*free));
599 #elif defined(__FreeBSD__)
600 	__le32 *tx_info = (__le32 *)((u8 *)data + sizeof(*free));
601 #endif
602 	struct mt76_dev *mdev = &dev->mt76;
603 	struct mt76_txwi_cache *txwi;
604 	struct ieee80211_sta *sta = NULL;
605 	struct sk_buff *skb, *tmp;
606 #if defined(__linux__)
607 	void *end = data + len;
608 #elif defined(__FreeBSD__)
609 	void *end = (u8 *)data + len;
610 #endif
611 	LIST_HEAD(free_list);
612 	bool wake = false;
613 	u8 i, count;
614 
615 	/* clean DMA queues and unmap buffers first */
616 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_PSD], false);
617 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BE], false);
618 
619 	count = le16_get_bits(free->ctrl, MT_TX_FREE_MSDU_CNT);
620 	if (WARN_ON_ONCE((void *)&tx_info[count] > end))
621 		return;
622 
623 	for (i = 0; i < count; i++) {
624 		u32 msdu, info = le32_to_cpu(tx_info[i]);
625 		u8 stat;
626 
627 		/* 1'b1: new wcid pair.
628 		 * 1'b0: msdu_id with the same 'wcid pair' as above.
629 		 */
630 		if (info & MT_TX_FREE_PAIR) {
631 			struct mt7921_sta *msta;
632 			struct mt76_wcid *wcid;
633 			u16 idx;
634 
635 			count++;
636 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
637 			wcid = rcu_dereference(dev->mt76.wcid[idx]);
638 			sta = wcid_to_sta(wcid);
639 			if (!sta)
640 				continue;
641 
642 			msta = container_of(wcid, struct mt7921_sta, wcid);
643 			spin_lock_bh(&dev->sta_poll_lock);
644 			if (list_empty(&msta->poll_list))
645 				list_add_tail(&msta->poll_list, &dev->sta_poll_list);
646 			spin_unlock_bh(&dev->sta_poll_lock);
647 			continue;
648 		}
649 
650 		msdu = FIELD_GET(MT_TX_FREE_MSDU_ID, info);
651 		stat = FIELD_GET(MT_TX_FREE_STATUS, info);
652 
653 		txwi = mt76_token_release(mdev, msdu, &wake);
654 		if (!txwi)
655 			continue;
656 
657 		mt7921_txwi_free(dev, txwi, sta, stat, &free_list);
658 	}
659 
660 	if (wake)
661 		mt76_set_tx_blocked(&dev->mt76, false);
662 
663 	list_for_each_entry_safe(skb, tmp, &free_list, list) {
664 		skb_list_del_init(skb);
665 		napi_consume_skb(skb, 1);
666 	}
667 
668 	rcu_read_lock();
669 	mt7921_mac_sta_poll(dev);
670 	rcu_read_unlock();
671 
672 	mt76_worker_schedule(&dev->mt76.tx_worker);
673 }
674 
675 bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
676 {
677 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
678 	__le32 *rxd = (__le32 *)data;
679 	__le32 *end = (__le32 *)&rxd[len / 4];
680 	enum rx_pkt_type type;
681 
682 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
683 
684 	switch (type) {
685 	case PKT_TYPE_TXRX_NOTIFY:
686 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
687 		mt7921_mac_tx_free(dev, data, len); /* mmio */
688 		return false;
689 	case PKT_TYPE_TXS:
690 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
691 			mt7921_mac_add_txs(dev, rxd);
692 		return false;
693 	default:
694 		return true;
695 	}
696 }
697 EXPORT_SYMBOL_GPL(mt7921_rx_check);
698 
699 void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
700 			 struct sk_buff *skb)
701 {
702 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
703 	__le32 *rxd = (__le32 *)skb->data;
704 	__le32 *end = (__le32 *)&skb->data[skb->len];
705 	enum rx_pkt_type type;
706 	u16 flag;
707 
708 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
709 	flag = le32_get_bits(rxd[0], MT_RXD0_PKT_FLAG);
710 
711 	if (type == PKT_TYPE_RX_EVENT && flag == 0x1)
712 		type = PKT_TYPE_NORMAL_MCU;
713 
714 	switch (type) {
715 	case PKT_TYPE_TXRX_NOTIFY:
716 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
717 		mt7921_mac_tx_free(dev, skb->data, skb->len);
718 		napi_consume_skb(skb, 1);
719 		break;
720 	case PKT_TYPE_RX_EVENT:
721 		mt7921_mcu_rx_event(dev, skb);
722 		break;
723 	case PKT_TYPE_TXS:
724 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
725 			mt7921_mac_add_txs(dev, rxd);
726 		dev_kfree_skb(skb);
727 		break;
728 	case PKT_TYPE_NORMAL_MCU:
729 	case PKT_TYPE_NORMAL:
730 		if (!mt7921_mac_fill_rx(dev, skb)) {
731 			mt76_rx(&dev->mt76, q, skb);
732 			return;
733 		}
734 		fallthrough;
735 	default:
736 		dev_kfree_skb(skb);
737 		break;
738 	}
739 }
740 EXPORT_SYMBOL_GPL(mt7921_queue_rx_skb);
741 
742 void mt7921_mac_reset_counters(struct mt7921_phy *phy)
743 {
744 	struct mt7921_dev *dev = phy->dev;
745 	int i;
746 
747 	for (i = 0; i < 4; i++) {
748 		mt76_rr(dev, MT_TX_AGG_CNT(0, i));
749 		mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
750 	}
751 
752 	dev->mt76.phy.survey_time = ktime_get_boottime();
753 	memset(&dev->mt76.aggr_stats[0], 0, sizeof(dev->mt76.aggr_stats) / 2);
754 
755 	/* reset airtime counters */
756 	mt76_rr(dev, MT_MIB_SDR9(0));
757 	mt76_rr(dev, MT_MIB_SDR36(0));
758 	mt76_rr(dev, MT_MIB_SDR37(0));
759 
760 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
761 	mt76_set(dev, MT_WF_RMAC_MIB_AIRTIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
762 }
763 
764 void mt7921_mac_set_timing(struct mt7921_phy *phy)
765 {
766 	s16 coverage_class = phy->coverage_class;
767 	struct mt7921_dev *dev = phy->dev;
768 	u32 val, reg_offset;
769 	u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) |
770 		  FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48);
771 	u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) |
772 		   FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28);
773 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
774 	int sifs = is_2ghz ? 10 : 16, offset;
775 
776 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
777 		return;
778 
779 	mt76_set(dev, MT_ARB_SCR(0),
780 		 MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
781 	udelay(1);
782 
783 	offset = 3 * coverage_class;
784 	reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) |
785 		     FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset);
786 
787 	mt76_wr(dev, MT_TMAC_CDTR(0), cck + reg_offset);
788 	mt76_wr(dev, MT_TMAC_ODTR(0), ofdm + reg_offset);
789 	mt76_wr(dev, MT_TMAC_ICR0(0),
790 		FIELD_PREP(MT_IFS_EIFS, 360) |
791 		FIELD_PREP(MT_IFS_RIFS, 2) |
792 		FIELD_PREP(MT_IFS_SIFS, sifs) |
793 		FIELD_PREP(MT_IFS_SLOT, phy->slottime));
794 
795 	if (phy->slottime < 20 || !is_2ghz)
796 		val = MT7921_CFEND_RATE_DEFAULT;
797 	else
798 		val = MT7921_CFEND_RATE_11B;
799 
800 	mt76_rmw_field(dev, MT_AGG_ACR0(0), MT_AGG_ACR_CFEND_RATE, val);
801 	mt76_clear(dev, MT_ARB_SCR(0),
802 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
803 }
804 
805 static u8
806 mt7921_phy_get_nf(struct mt7921_phy *phy, int idx)
807 {
808 	return 0;
809 }
810 
811 static void
812 mt7921_phy_update_channel(struct mt76_phy *mphy, int idx)
813 {
814 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
815 	struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
816 	struct mt76_channel_state *state;
817 	u64 busy_time, tx_time, rx_time, obss_time;
818 	int nf;
819 
820 	busy_time = mt76_get_field(dev, MT_MIB_SDR9(idx),
821 				   MT_MIB_SDR9_BUSY_MASK);
822 	tx_time = mt76_get_field(dev, MT_MIB_SDR36(idx),
823 				 MT_MIB_SDR36_TXTIME_MASK);
824 	rx_time = mt76_get_field(dev, MT_MIB_SDR37(idx),
825 				 MT_MIB_SDR37_RXTIME_MASK);
826 	obss_time = mt76_get_field(dev, MT_WF_RMAC_MIB_AIRTIME14(idx),
827 				   MT_MIB_OBSSTIME_MASK);
828 
829 	nf = mt7921_phy_get_nf(phy, idx);
830 	if (!phy->noise)
831 		phy->noise = nf << 4;
832 	else if (nf)
833 		phy->noise += nf - (phy->noise >> 4);
834 
835 	state = mphy->chan_state;
836 	state->cc_busy += busy_time;
837 	state->cc_tx += tx_time;
838 	state->cc_rx += rx_time + obss_time;
839 	state->cc_bss_rx += rx_time;
840 	state->noise = -(phy->noise >> 4);
841 }
842 
843 void mt7921_update_channel(struct mt76_phy *mphy)
844 {
845 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
846 
847 	if (mt76_connac_pm_wake(mphy, &dev->pm))
848 		return;
849 
850 	mt7921_phy_update_channel(mphy, 0);
851 	/* reset obss airtime */
852 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
853 
854 	mt76_connac_power_save_sched(mphy, &dev->pm);
855 }
856 EXPORT_SYMBOL_GPL(mt7921_update_channel);
857 
858 static void
859 mt7921_vif_connect_iter(void *priv, u8 *mac,
860 			struct ieee80211_vif *vif)
861 {
862 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
863 	struct mt7921_dev *dev = mvif->phy->dev;
864 	struct ieee80211_hw *hw = mt76_hw(dev);
865 
866 	if (vif->type == NL80211_IFTYPE_STATION)
867 		ieee80211_disconnect(vif, true);
868 
869 	mt76_connac_mcu_uni_add_dev(&dev->mphy, vif, &mvif->sta.wcid, true);
870 	mt7921_mcu_set_tx(dev, vif);
871 
872 	if (vif->type == NL80211_IFTYPE_AP) {
873 		mt76_connac_mcu_uni_add_bss(dev->phy.mt76, vif, &mvif->sta.wcid,
874 					    true);
875 		mt7921_mcu_sta_update(dev, NULL, vif, true,
876 				      MT76_STA_INFO_STATE_NONE);
877 		mt7921_mcu_uni_add_beacon_offload(dev, hw, vif, true);
878 	}
879 }
880 
881 /* system error recovery */
882 void mt7921_mac_reset_work(struct work_struct *work)
883 {
884 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
885 					      reset_work);
886 	struct ieee80211_hw *hw = mt76_hw(dev);
887 	struct mt76_connac_pm *pm = &dev->pm;
888 	int i, ret;
889 
890 	dev_dbg(dev->mt76.dev, "chip reset\n");
891 	dev->hw_full_reset = true;
892 	ieee80211_stop_queues(hw);
893 
894 	cancel_delayed_work_sync(&dev->mphy.mac_work);
895 	cancel_delayed_work_sync(&pm->ps_work);
896 	cancel_work_sync(&pm->wake_work);
897 
898 	for (i = 0; i < 10; i++) {
899 		mutex_lock(&dev->mt76.mutex);
900 		ret = mt7921_dev_reset(dev);
901 		mutex_unlock(&dev->mt76.mutex);
902 
903 		if (!ret)
904 			break;
905 	}
906 
907 	if (i == 10)
908 		dev_err(dev->mt76.dev, "chip reset failed\n");
909 
910 	if (test_and_clear_bit(MT76_HW_SCANNING, &dev->mphy.state)) {
911 		struct cfg80211_scan_info info = {
912 			.aborted = true,
913 		};
914 
915 		ieee80211_scan_completed(dev->mphy.hw, &info);
916 	}
917 
918 	dev->hw_full_reset = false;
919 	pm->suspended = false;
920 	ieee80211_wake_queues(hw);
921 	ieee80211_iterate_active_interfaces(hw,
922 					    IEEE80211_IFACE_ITER_RESUME_ALL,
923 					    mt7921_vif_connect_iter, NULL);
924 	mt76_connac_power_save_sched(&dev->mt76.phy, pm);
925 }
926 
927 void mt7921_reset(struct mt76_dev *mdev)
928 {
929 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
930 	struct mt76_connac_pm *pm = &dev->pm;
931 
932 	if (!dev->hw_init_done)
933 		return;
934 
935 	if (dev->hw_full_reset)
936 		return;
937 
938 	if (pm->suspended)
939 		return;
940 
941 	queue_work(dev->mt76.wq, &dev->reset_work);
942 }
943 EXPORT_SYMBOL_GPL(mt7921_reset);
944 
945 void mt7921_mac_update_mib_stats(struct mt7921_phy *phy)
946 {
947 	struct mt7921_dev *dev = phy->dev;
948 	struct mib_stats *mib = &phy->mib;
949 	int i, aggr0 = 0, aggr1;
950 	u32 val;
951 
952 	mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(0),
953 					   MT_MIB_SDR3_FCS_ERR_MASK);
954 	mib->ack_fail_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR3(0),
955 					    MT_MIB_ACK_FAIL_COUNT_MASK);
956 	mib->ba_miss_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR2(0),
957 					   MT_MIB_BA_FAIL_COUNT_MASK);
958 	mib->rts_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR0(0),
959 				       MT_MIB_RTS_COUNT_MASK);
960 	mib->rts_retries_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR1(0),
961 					       MT_MIB_RTS_FAIL_COUNT_MASK);
962 
963 	mib->tx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR12(0));
964 	mib->tx_mpdu_attempts_cnt += mt76_rr(dev, MT_MIB_SDR14(0));
965 	mib->tx_mpdu_success_cnt += mt76_rr(dev, MT_MIB_SDR15(0));
966 
967 	val = mt76_rr(dev, MT_MIB_SDR32(0));
968 	mib->tx_pkt_ebf_cnt += FIELD_GET(MT_MIB_SDR9_EBF_CNT_MASK, val);
969 	mib->tx_pkt_ibf_cnt += FIELD_GET(MT_MIB_SDR9_IBF_CNT_MASK, val);
970 
971 	val = mt76_rr(dev, MT_ETBF_TX_APP_CNT(0));
972 	mib->tx_bf_ibf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_IBF_CNT, val);
973 	mib->tx_bf_ebf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_EBF_CNT, val);
974 
975 	val = mt76_rr(dev, MT_ETBF_RX_FB_CNT(0));
976 	mib->tx_bf_rx_fb_all_cnt += FIELD_GET(MT_ETBF_RX_FB_ALL, val);
977 	mib->tx_bf_rx_fb_he_cnt += FIELD_GET(MT_ETBF_RX_FB_HE, val);
978 	mib->tx_bf_rx_fb_vht_cnt += FIELD_GET(MT_ETBF_RX_FB_VHT, val);
979 	mib->tx_bf_rx_fb_ht_cnt += FIELD_GET(MT_ETBF_RX_FB_HT, val);
980 
981 	mib->rx_mpdu_cnt += mt76_rr(dev, MT_MIB_SDR5(0));
982 	mib->rx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR22(0));
983 	mib->rx_ampdu_bytes_cnt += mt76_rr(dev, MT_MIB_SDR23(0));
984 	mib->rx_ba_cnt += mt76_rr(dev, MT_MIB_SDR31(0));
985 
986 	for (i = 0; i < ARRAY_SIZE(mib->tx_amsdu); i++) {
987 		val = mt76_rr(dev, MT_PLE_AMSDU_PACK_MSDU_CNT(i));
988 		mib->tx_amsdu[i] += val;
989 		mib->tx_amsdu_cnt += val;
990 	}
991 
992 	for (i = 0, aggr1 = aggr0 + 4; i < 4; i++) {
993 		u32 val2;
994 
995 		val = mt76_rr(dev, MT_TX_AGG_CNT(0, i));
996 		val2 = mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
997 
998 		dev->mt76.aggr_stats[aggr0++] += val & 0xffff;
999 		dev->mt76.aggr_stats[aggr0++] += val >> 16;
1000 		dev->mt76.aggr_stats[aggr1++] += val2 & 0xffff;
1001 		dev->mt76.aggr_stats[aggr1++] += val2 >> 16;
1002 	}
1003 }
1004 
1005 void mt7921_mac_work(struct work_struct *work)
1006 {
1007 	struct mt7921_phy *phy;
1008 	struct mt76_phy *mphy;
1009 
1010 	mphy = (struct mt76_phy *)container_of(work, struct mt76_phy,
1011 					       mac_work.work);
1012 	phy = mphy->priv;
1013 
1014 	mt7921_mutex_acquire(phy->dev);
1015 
1016 	mt76_update_survey(mphy);
1017 	if (++mphy->mac_work_count == 2) {
1018 		mphy->mac_work_count = 0;
1019 
1020 		mt7921_mac_update_mib_stats(phy);
1021 	}
1022 
1023 	mt7921_mutex_release(phy->dev);
1024 
1025 	mt76_tx_status_check(mphy->dev, false);
1026 	ieee80211_queue_delayed_work(phy->mt76->hw, &mphy->mac_work,
1027 				     MT7921_WATCHDOG_TIME);
1028 }
1029 
1030 void mt7921_pm_wake_work(struct work_struct *work)
1031 {
1032 	struct mt7921_dev *dev;
1033 	struct mt76_phy *mphy;
1034 
1035 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1036 						pm.wake_work);
1037 	mphy = dev->phy.mt76;
1038 
1039 	if (!mt7921_mcu_drv_pmctrl(dev)) {
1040 		struct mt76_dev *mdev = &dev->mt76;
1041 		int i;
1042 
1043 		if (mt76_is_sdio(mdev)) {
1044 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1045 			mt76_worker_schedule(&mdev->sdio.txrx_worker);
1046 		} else {
1047 			local_bh_disable();
1048 			mt76_for_each_q_rx(mdev, i)
1049 				napi_schedule(&mdev->napi[i]);
1050 			local_bh_enable();
1051 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1052 			mt76_connac_tx_cleanup(mdev);
1053 		}
1054 		if (test_bit(MT76_STATE_RUNNING, &mphy->state))
1055 			ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
1056 						     MT7921_WATCHDOG_TIME);
1057 	}
1058 
1059 	ieee80211_wake_queues(mphy->hw);
1060 	wake_up(&dev->pm.wait);
1061 }
1062 
1063 void mt7921_pm_power_save_work(struct work_struct *work)
1064 {
1065 	struct mt7921_dev *dev;
1066 	unsigned long delta;
1067 	struct mt76_phy *mphy;
1068 
1069 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1070 						pm.ps_work.work);
1071 	mphy = dev->phy.mt76;
1072 
1073 	delta = dev->pm.idle_timeout;
1074 	if (test_bit(MT76_HW_SCANNING, &mphy->state) ||
1075 	    test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) ||
1076 	    dev->fw_assert)
1077 		goto out;
1078 
1079 	if (mutex_is_locked(&dev->mt76.mutex))
1080 		/* if mt76 mutex is held we should not put the device
1081 		 * to sleep since we are currently accessing device
1082 		 * register map. We need to wait for the next power_save
1083 		 * trigger.
1084 		 */
1085 		goto out;
1086 
1087 	if (time_is_after_jiffies(dev->pm.last_activity + delta)) {
1088 		delta = dev->pm.last_activity + delta - jiffies;
1089 		goto out;
1090 	}
1091 
1092 	if (!mt7921_mcu_fw_pmctrl(dev)) {
1093 		cancel_delayed_work_sync(&mphy->mac_work);
1094 		return;
1095 	}
1096 out:
1097 	queue_delayed_work(dev->mt76.wq, &dev->pm.ps_work, delta);
1098 }
1099 
1100 void mt7921_coredump_work(struct work_struct *work)
1101 {
1102 	struct mt7921_dev *dev;
1103 	char *dump, *data;
1104 
1105 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1106 						coredump.work.work);
1107 
1108 	if (time_is_after_jiffies(dev->coredump.last_activity +
1109 				  4 * MT76_CONNAC_COREDUMP_TIMEOUT)) {
1110 		queue_delayed_work(dev->mt76.wq, &dev->coredump.work,
1111 				   MT76_CONNAC_COREDUMP_TIMEOUT);
1112 		return;
1113 	}
1114 
1115 	dump = vzalloc(MT76_CONNAC_COREDUMP_SZ);
1116 	data = dump;
1117 
1118 	while (true) {
1119 		struct sk_buff *skb;
1120 
1121 		spin_lock_bh(&dev->mt76.lock);
1122 		skb = __skb_dequeue(&dev->coredump.msg_list);
1123 		spin_unlock_bh(&dev->mt76.lock);
1124 
1125 		if (!skb)
1126 			break;
1127 
1128 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
1129 		if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
1130 			dev_kfree_skb(skb);
1131 			continue;
1132 		}
1133 
1134 		memcpy(data, skb->data, skb->len);
1135 		data += skb->len;
1136 
1137 		dev_kfree_skb(skb);
1138 	}
1139 
1140 	if (dump)
1141 		dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
1142 			      GFP_KERNEL);
1143 
1144 	mt7921_reset(&dev->mt76);
1145 }
1146 
1147 /* usb_sdio */
1148 static void
1149 mt7921_usb_sdio_write_txwi(struct mt7921_dev *dev, struct mt76_wcid *wcid,
1150 			   enum mt76_txq_id qid, struct ieee80211_sta *sta,
1151 			   struct ieee80211_key_conf *key, int pid,
1152 			   struct sk_buff *skb)
1153 {
1154 	__le32 *txwi = (__le32 *)(skb->data - MT_SDIO_TXD_SIZE);
1155 
1156 	memset(txwi, 0, MT_SDIO_TXD_SIZE);
1157 	mt76_connac2_mac_write_txwi(&dev->mt76, txwi, skb, wcid, key, pid, qid, 0);
1158 	skb_push(skb, MT_SDIO_TXD_SIZE);
1159 }
1160 
1161 int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
1162 				   enum mt76_txq_id qid, struct mt76_wcid *wcid,
1163 				   struct ieee80211_sta *sta,
1164 				   struct mt76_tx_info *tx_info)
1165 {
1166 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1167 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
1168 	struct ieee80211_key_conf *key = info->control.hw_key;
1169 	struct sk_buff *skb = tx_info->skb;
1170 	int err, pad, pktid, type;
1171 
1172 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
1173 		return -EINVAL;
1174 
1175 	if (!wcid)
1176 		wcid = &dev->mt76.global_wcid;
1177 
1178 	if (sta) {
1179 		struct mt7921_sta *msta = (struct mt7921_sta *)sta->drv_priv;
1180 
1181 		if (time_after(jiffies, msta->last_txs + HZ / 4)) {
1182 			info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1183 			msta->last_txs = jiffies;
1184 		}
1185 	}
1186 
1187 	pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb);
1188 	mt7921_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);
1189 
1190 	type = mt76_is_sdio(mdev) ? MT7921_SDIO_DATA : 0;
1191 	mt7921_skb_add_usb_sdio_hdr(dev, skb, type);
1192 	pad = round_up(skb->len, 4) - skb->len;
1193 	if (mt76_is_usb(mdev))
1194 		pad += 4;
1195 
1196 	err = mt76_skb_adjust_pad(skb, pad);
1197 	if (err)
1198 		/* Release pktid in case of error. */
1199 		idr_remove(&wcid->pktid, pktid);
1200 
1201 	return err;
1202 }
1203 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_prepare_skb);
1204 
1205 void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,
1206 				     struct mt76_queue_entry *e)
1207 {
1208 	__le32 *txwi = (__le32 *)(e->skb->data + MT_SDIO_HDR_SIZE);
1209 	unsigned int headroom = MT_SDIO_TXD_SIZE + MT_SDIO_HDR_SIZE;
1210 	struct ieee80211_sta *sta;
1211 	struct mt76_wcid *wcid;
1212 	u16 idx;
1213 
1214 	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
1215 	wcid = rcu_dereference(mdev->wcid[idx]);
1216 	sta = wcid_to_sta(wcid);
1217 
1218 	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))
1219 		mt7921_tx_check_aggr(sta, txwi);
1220 
1221 	skb_pull(e->skb, headroom);
1222 	mt76_tx_complete_skb(mdev, e->wcid, e->skb);
1223 }
1224 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_complete_skb);
1225 
1226 bool mt7921_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)
1227 {
1228 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1229 
1230 	mt7921_mutex_acquire(dev);
1231 	mt7921_mac_sta_poll(dev);
1232 	mt7921_mutex_release(dev);
1233 
1234 	return false;
1235 }
1236 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_status_data);
1237 
1238 #if IS_ENABLED(CONFIG_IPV6)
1239 void mt7921_set_ipv6_ns_work(struct work_struct *work)
1240 {
1241 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
1242 						ipv6_ns_work);
1243 	struct sk_buff *skb;
1244 	int ret = 0;
1245 
1246 	do {
1247 		skb = skb_dequeue(&dev->ipv6_ns_list);
1248 
1249 		if (!skb)
1250 			break;
1251 
1252 		mt7921_mutex_acquire(dev);
1253 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1254 					    MCU_UNI_CMD(OFFLOAD), true);
1255 		mt7921_mutex_release(dev);
1256 
1257 	} while (!ret);
1258 
1259 	if (ret)
1260 		skb_queue_purge(&dev->ipv6_ns_list);
1261 }
1262 #endif
1263