xref: /linux/drivers/net/wireless/mediatek/mt76/mt7921/mac.c (revision b86406d42ae3c41ae0ce332ea24350829b88af51)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/devcoredump.h>
5 #include <linux/etherdevice.h>
6 #include <linux/timekeeping.h>
7 #include "mt7921.h"
8 #include "../dma.h"
9 #include "mac.h"
10 #include "mcu.h"
11 
12 static struct mt76_wcid *mt7921_rx_get_wcid(struct mt7921_dev *dev,
13 					    u16 idx, bool unicast)
14 {
15 	struct mt7921_sta *sta;
16 	struct mt76_wcid *wcid;
17 
18 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
19 		return NULL;
20 
21 	wcid = rcu_dereference(dev->mt76.wcid[idx]);
22 	if (unicast || !wcid)
23 		return wcid;
24 
25 	if (!wcid->sta)
26 		return NULL;
27 
28 	sta = container_of(wcid, struct mt7921_sta, wcid);
29 	if (!sta->vif)
30 		return NULL;
31 
32 	return &sta->vif->sta.wcid;
33 }
34 
35 void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
36 {
37 }
38 EXPORT_SYMBOL_GPL(mt7921_sta_ps);
39 
40 bool mt7921_mac_wtbl_update(struct mt7921_dev *dev, int idx, u32 mask)
41 {
42 	mt76_rmw(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_WLAN_IDX,
43 		 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, idx) | mask);
44 
45 	return mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY,
46 			 0, 5000);
47 }
48 
49 void mt7921_mac_sta_poll(struct mt7921_dev *dev)
50 {
51 	static const u8 ac_to_tid[] = {
52 		[IEEE80211_AC_BE] = 0,
53 		[IEEE80211_AC_BK] = 1,
54 		[IEEE80211_AC_VI] = 4,
55 		[IEEE80211_AC_VO] = 6
56 	};
57 	struct ieee80211_sta *sta;
58 	struct mt7921_sta *msta;
59 	u32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS];
60 	LIST_HEAD(sta_poll_list);
61 	struct rate_info *rate;
62 	int i;
63 
64 	spin_lock_bh(&dev->sta_poll_lock);
65 	list_splice_init(&dev->sta_poll_list, &sta_poll_list);
66 	spin_unlock_bh(&dev->sta_poll_lock);
67 
68 	while (true) {
69 		bool clear = false;
70 		u32 addr, val;
71 		u16 idx;
72 		u8 bw;
73 
74 		spin_lock_bh(&dev->sta_poll_lock);
75 		if (list_empty(&sta_poll_list)) {
76 			spin_unlock_bh(&dev->sta_poll_lock);
77 			break;
78 		}
79 		msta = list_first_entry(&sta_poll_list,
80 					struct mt7921_sta, poll_list);
81 		list_del_init(&msta->poll_list);
82 		spin_unlock_bh(&dev->sta_poll_lock);
83 
84 		idx = msta->wcid.idx;
85 		addr = mt7921_mac_wtbl_lmac_addr(idx, MT_WTBL_AC0_CTT_OFFSET);
86 
87 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
88 			u32 tx_last = msta->airtime_ac[i];
89 			u32 rx_last = msta->airtime_ac[i + 4];
90 
91 			msta->airtime_ac[i] = mt76_rr(dev, addr);
92 			msta->airtime_ac[i + 4] = mt76_rr(dev, addr + 4);
93 
94 			tx_time[i] = msta->airtime_ac[i] - tx_last;
95 			rx_time[i] = msta->airtime_ac[i + 4] - rx_last;
96 
97 			if ((tx_last | rx_last) & BIT(30))
98 				clear = true;
99 
100 			addr += 8;
101 		}
102 
103 		if (clear) {
104 			mt7921_mac_wtbl_update(dev, idx,
105 					       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
106 			memset(msta->airtime_ac, 0, sizeof(msta->airtime_ac));
107 		}
108 
109 		if (!msta->wcid.sta)
110 			continue;
111 
112 		sta = container_of((void *)msta, struct ieee80211_sta,
113 				   drv_priv);
114 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
115 			u8 q = mt76_connac_lmac_mapping(i);
116 			u32 tx_cur = tx_time[q];
117 			u32 rx_cur = rx_time[q];
118 			u8 tid = ac_to_tid[i];
119 
120 			if (!tx_cur && !rx_cur)
121 				continue;
122 
123 			ieee80211_sta_register_airtime(sta, tid, tx_cur,
124 						       rx_cur);
125 		}
126 
127 		/* We don't support reading GI info from txs packets.
128 		 * For accurate tx status reporting and AQL improvement,
129 		 * we need to make sure that flags match so polling GI
130 		 * from per-sta counters directly.
131 		 */
132 		rate = &msta->wcid.rate;
133 		addr = mt7921_mac_wtbl_lmac_addr(idx,
134 						 MT_WTBL_TXRX_CAP_RATE_OFFSET);
135 		val = mt76_rr(dev, addr);
136 
137 		switch (rate->bw) {
138 		case RATE_INFO_BW_160:
139 			bw = IEEE80211_STA_RX_BW_160;
140 			break;
141 		case RATE_INFO_BW_80:
142 			bw = IEEE80211_STA_RX_BW_80;
143 			break;
144 		case RATE_INFO_BW_40:
145 			bw = IEEE80211_STA_RX_BW_40;
146 			break;
147 		default:
148 			bw = IEEE80211_STA_RX_BW_20;
149 			break;
150 		}
151 
152 		if (rate->flags & RATE_INFO_FLAGS_HE_MCS) {
153 			u8 offs = MT_WTBL_TXRX_RATE_G2_HE + 2 * bw;
154 
155 			rate->he_gi = (val & (0x3 << offs)) >> offs;
156 		} else if (rate->flags &
157 			   (RATE_INFO_FLAGS_VHT_MCS | RATE_INFO_FLAGS_MCS)) {
158 			if (val & BIT(MT_WTBL_TXRX_RATE_G2 + bw))
159 				rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
160 			else
161 				rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
162 		}
163 	}
164 }
165 EXPORT_SYMBOL_GPL(mt7921_mac_sta_poll);
166 
167 static void
168 mt7921_get_status_freq_info(struct mt7921_dev *dev, struct mt76_phy *mphy,
169 			    struct mt76_rx_status *status, u8 chfreq)
170 {
171 	if (!test_bit(MT76_HW_SCANNING, &mphy->state) &&
172 	    !test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) &&
173 	    !test_bit(MT76_STATE_ROC, &mphy->state)) {
174 		status->freq = mphy->chandef.chan->center_freq;
175 		status->band = mphy->chandef.chan->band;
176 		return;
177 	}
178 
179 	if (chfreq > 180) {
180 		status->band = NL80211_BAND_6GHZ;
181 		chfreq = (chfreq - 181) * 4 + 1;
182 	} else if (chfreq > 14) {
183 		status->band = NL80211_BAND_5GHZ;
184 	} else {
185 		status->band = NL80211_BAND_2GHZ;
186 	}
187 	status->freq = ieee80211_channel_to_frequency(chfreq, status->band);
188 }
189 
190 static void
191 mt7921_mac_rssi_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
192 {
193 	struct sk_buff *skb = priv;
194 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
195 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
196 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
197 
198 	if (status->signal > 0)
199 		return;
200 
201 	if (!ether_addr_equal(vif->addr, hdr->addr1))
202 		return;
203 
204 	ewma_rssi_add(&mvif->rssi, -status->signal);
205 }
206 
207 static void
208 mt7921_mac_assoc_rssi(struct mt7921_dev *dev, struct sk_buff *skb)
209 {
210 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
211 
212 	if (!ieee80211_is_assoc_resp(hdr->frame_control) &&
213 	    !ieee80211_is_auth(hdr->frame_control))
214 		return;
215 
216 	ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
217 		IEEE80211_IFACE_ITER_RESUME_ALL,
218 		mt7921_mac_rssi_iter, skb);
219 }
220 
221 static int
222 mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
223 {
224 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
225 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
226 	bool hdr_trans, unicast, insert_ccmp_hdr = false;
227 	u8 chfreq, qos_ctl = 0, remove_pad, amsdu_info;
228 	u16 hdr_gap;
229 	__le32 *rxv = NULL, *rxd = (__le32 *)skb->data;
230 	struct mt76_phy *mphy = &dev->mt76.phy;
231 	struct mt7921_phy *phy = &dev->phy;
232 	struct ieee80211_supported_band *sband;
233 	u32 rxd0 = le32_to_cpu(rxd[0]);
234 	u32 rxd1 = le32_to_cpu(rxd[1]);
235 	u32 rxd2 = le32_to_cpu(rxd[2]);
236 	u32 rxd3 = le32_to_cpu(rxd[3]);
237 	u32 rxd4 = le32_to_cpu(rxd[4]);
238 	struct mt7921_sta *msta = NULL;
239 	u16 seq_ctrl = 0;
240 	__le16 fc = 0;
241 	u8 mode = 0;
242 	int i, idx;
243 
244 	memset(status, 0, sizeof(*status));
245 
246 	if (rxd1 & MT_RXD1_NORMAL_BAND_IDX)
247 		return -EINVAL;
248 
249 	if (!test_bit(MT76_STATE_RUNNING, &mphy->state))
250 		return -EINVAL;
251 
252 	if (rxd2 & MT_RXD2_NORMAL_AMSDU_ERR)
253 		return -EINVAL;
254 
255 	hdr_trans = rxd2 & MT_RXD2_NORMAL_HDR_TRANS;
256 	if (hdr_trans && (rxd1 & MT_RXD1_NORMAL_CM))
257 		return -EINVAL;
258 
259 	/* ICV error or CCMP/BIP/WPI MIC error */
260 	if (rxd1 & MT_RXD1_NORMAL_ICV_ERR)
261 		status->flag |= RX_FLAG_ONLY_MONITOR;
262 
263 	chfreq = FIELD_GET(MT_RXD3_NORMAL_CH_FREQ, rxd3);
264 	unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
265 	idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
266 	status->wcid = mt7921_rx_get_wcid(dev, idx, unicast);
267 
268 	if (status->wcid) {
269 		msta = container_of(status->wcid, struct mt7921_sta, wcid);
270 		spin_lock_bh(&dev->sta_poll_lock);
271 		if (list_empty(&msta->poll_list))
272 			list_add_tail(&msta->poll_list, &dev->sta_poll_list);
273 		spin_unlock_bh(&dev->sta_poll_lock);
274 	}
275 
276 	mt7921_get_status_freq_info(dev, mphy, status, chfreq);
277 
278 	switch (status->band) {
279 	case NL80211_BAND_5GHZ:
280 		sband = &mphy->sband_5g.sband;
281 		break;
282 	case NL80211_BAND_6GHZ:
283 		sband = &mphy->sband_6g.sband;
284 		break;
285 	default:
286 		sband = &mphy->sband_2g.sband;
287 		break;
288 	}
289 
290 	if (!sband->channels)
291 		return -EINVAL;
292 
293 	if ((rxd0 & csum_mask) == csum_mask)
294 		skb->ip_summed = CHECKSUM_UNNECESSARY;
295 
296 	if (rxd1 & MT_RXD1_NORMAL_FCS_ERR)
297 		status->flag |= RX_FLAG_FAILED_FCS_CRC;
298 
299 	if (rxd1 & MT_RXD1_NORMAL_TKIP_MIC_ERR)
300 		status->flag |= RX_FLAG_MMIC_ERROR;
301 
302 	if (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1) != 0 &&
303 	    !(rxd1 & (MT_RXD1_NORMAL_CLM | MT_RXD1_NORMAL_CM))) {
304 		status->flag |= RX_FLAG_DECRYPTED;
305 		status->flag |= RX_FLAG_IV_STRIPPED;
306 		status->flag |= RX_FLAG_MMIC_STRIPPED | RX_FLAG_MIC_STRIPPED;
307 	}
308 
309 	remove_pad = FIELD_GET(MT_RXD2_NORMAL_HDR_OFFSET, rxd2);
310 
311 	if (rxd2 & MT_RXD2_NORMAL_MAX_LEN_ERROR)
312 		return -EINVAL;
313 
314 	rxd += 6;
315 	if (rxd1 & MT_RXD1_NORMAL_GROUP_4) {
316 		u32 v0 = le32_to_cpu(rxd[0]);
317 		u32 v2 = le32_to_cpu(rxd[2]);
318 
319 		fc = cpu_to_le16(FIELD_GET(MT_RXD6_FRAME_CONTROL, v0));
320 		seq_ctrl = FIELD_GET(MT_RXD8_SEQ_CTRL, v2);
321 		qos_ctl = FIELD_GET(MT_RXD8_QOS_CTL, v2);
322 
323 		rxd += 4;
324 		if ((u8 *)rxd - skb->data >= skb->len)
325 			return -EINVAL;
326 	}
327 
328 	if (rxd1 & MT_RXD1_NORMAL_GROUP_1) {
329 		u8 *data = (u8 *)rxd;
330 
331 		if (status->flag & RX_FLAG_DECRYPTED) {
332 			switch (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1)) {
333 			case MT_CIPHER_AES_CCMP:
334 			case MT_CIPHER_CCMP_CCX:
335 			case MT_CIPHER_CCMP_256:
336 				insert_ccmp_hdr =
337 					FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
338 				fallthrough;
339 			case MT_CIPHER_TKIP:
340 			case MT_CIPHER_TKIP_NO_MIC:
341 			case MT_CIPHER_GCMP:
342 			case MT_CIPHER_GCMP_256:
343 				status->iv[0] = data[5];
344 				status->iv[1] = data[4];
345 				status->iv[2] = data[3];
346 				status->iv[3] = data[2];
347 				status->iv[4] = data[1];
348 				status->iv[5] = data[0];
349 				break;
350 			default:
351 				break;
352 			}
353 		}
354 		rxd += 4;
355 		if ((u8 *)rxd - skb->data >= skb->len)
356 			return -EINVAL;
357 	}
358 
359 	if (rxd1 & MT_RXD1_NORMAL_GROUP_2) {
360 		status->timestamp = le32_to_cpu(rxd[0]);
361 		status->flag |= RX_FLAG_MACTIME_START;
362 
363 		if (!(rxd2 & MT_RXD2_NORMAL_NON_AMPDU)) {
364 			status->flag |= RX_FLAG_AMPDU_DETAILS;
365 
366 			/* all subframes of an A-MPDU have the same timestamp */
367 			if (phy->rx_ampdu_ts != status->timestamp) {
368 				if (!++phy->ampdu_ref)
369 					phy->ampdu_ref++;
370 			}
371 			phy->rx_ampdu_ts = status->timestamp;
372 
373 			status->ampdu_ref = phy->ampdu_ref;
374 		}
375 
376 		rxd += 2;
377 		if ((u8 *)rxd - skb->data >= skb->len)
378 			return -EINVAL;
379 	}
380 
381 	/* RXD Group 3 - P-RXV */
382 	if (rxd1 & MT_RXD1_NORMAL_GROUP_3) {
383 		u32 v0, v1;
384 		int ret;
385 
386 		rxv = rxd;
387 		rxd += 2;
388 		if ((u8 *)rxd - skb->data >= skb->len)
389 			return -EINVAL;
390 
391 		v0 = le32_to_cpu(rxv[0]);
392 		v1 = le32_to_cpu(rxv[1]);
393 
394 		if (v0 & MT_PRXV_HT_AD_CODE)
395 			status->enc_flags |= RX_ENC_FLAG_LDPC;
396 
397 		status->chains = mphy->antenna_mask;
398 		status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v1);
399 		status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1);
400 		status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1);
401 		status->chain_signal[3] = to_rssi(MT_PRXV_RCPI3, v1);
402 		status->signal = -128;
403 		for (i = 0; i < hweight8(mphy->antenna_mask); i++) {
404 			if (!(status->chains & BIT(i)) ||
405 			    status->chain_signal[i] >= 0)
406 				continue;
407 
408 			status->signal = max(status->signal,
409 					     status->chain_signal[i]);
410 		}
411 
412 		ret = mt76_connac2_mac_fill_rx_rate(&dev->mt76, status, sband,
413 						    rxv, &mode);
414 		if (ret < 0)
415 			return ret;
416 
417 		if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
418 			rxd += 18;
419 			if ((u8 *)rxd - skb->data >= skb->len)
420 				return -EINVAL;
421 		}
422 	}
423 
424 	amsdu_info = FIELD_GET(MT_RXD4_NORMAL_PAYLOAD_FORMAT, rxd4);
425 	status->amsdu = !!amsdu_info;
426 	if (status->amsdu) {
427 		status->first_amsdu = amsdu_info == MT_RXD4_FIRST_AMSDU_FRAME;
428 		status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME;
429 	}
430 
431 	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
432 	if (hdr_trans && ieee80211_has_morefrags(fc)) {
433 		struct ieee80211_vif *vif;
434 		int err;
435 
436 		if (!msta || !msta->vif)
437 			return -EINVAL;
438 
439 		vif = container_of((void *)msta->vif, struct ieee80211_vif,
440 				   drv_priv);
441 		err = mt76_connac2_reverse_frag0_hdr_trans(vif, skb, hdr_gap);
442 		if (err)
443 			return err;
444 
445 		hdr_trans = false;
446 	} else {
447 		skb_pull(skb, hdr_gap);
448 		if (!hdr_trans && status->amsdu) {
449 			memmove(skb->data + 2, skb->data,
450 				ieee80211_get_hdrlen_from_skb(skb));
451 			skb_pull(skb, 2);
452 		}
453 	}
454 
455 	if (!hdr_trans) {
456 		struct ieee80211_hdr *hdr;
457 
458 		if (insert_ccmp_hdr) {
459 			u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1);
460 
461 			mt76_insert_ccmp_hdr(skb, key_id);
462 		}
463 
464 		hdr = mt76_skb_get_hdr(skb);
465 		fc = hdr->frame_control;
466 		if (ieee80211_is_data_qos(fc)) {
467 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
468 			qos_ctl = *ieee80211_get_qos_ctl(hdr);
469 		}
470 	} else {
471 		status->flag |= RX_FLAG_8023;
472 	}
473 
474 	mt7921_mac_assoc_rssi(dev, skb);
475 
476 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
477 		mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv, mode);
478 
479 	if (!status->wcid || !ieee80211_is_data_qos(fc))
480 		return 0;
481 
482 	status->aggr = unicast && !ieee80211_is_qos_nullfunc(fc);
483 	status->seqno = IEEE80211_SEQ_TO_SN(seq_ctrl);
484 	status->qos_ctl = qos_ctl;
485 
486 	return 0;
487 }
488 
489 static void mt7921_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
490 {
491 	struct mt7921_sta *msta;
492 	u16 fc, tid;
493 	u32 val;
494 
495 	if (!sta || !(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
496 		return;
497 
498 	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
499 	if (tid >= 6) /* skip VO queue */
500 		return;
501 
502 	val = le32_to_cpu(txwi[2]);
503 	fc = FIELD_GET(MT_TXD2_FRAME_TYPE, val) << 2 |
504 	     FIELD_GET(MT_TXD2_SUB_TYPE, val) << 4;
505 	if (unlikely(fc != (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA)))
506 		return;
507 
508 	msta = (struct mt7921_sta *)sta->drv_priv;
509 	if (!test_and_set_bit(tid, &msta->ampdu_state))
510 		ieee80211_start_tx_ba_session(sta, tid, 0);
511 }
512 
513 void mt7921_mac_add_txs(struct mt7921_dev *dev, void *data)
514 {
515 	struct mt7921_sta *msta = NULL;
516 	struct mt76_wcid *wcid;
517 	__le32 *txs_data = data;
518 	u16 wcidx;
519 	u8 pid;
520 
521 	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
522 		return;
523 
524 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
525 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
526 
527 	if (pid < MT_PACKET_ID_FIRST)
528 		return;
529 
530 	if (wcidx >= MT7921_WTBL_SIZE)
531 		return;
532 
533 	rcu_read_lock();
534 
535 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
536 	if (!wcid)
537 		goto out;
538 
539 	msta = container_of(wcid, struct mt7921_sta, wcid);
540 
541 	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
542 	if (!wcid->sta)
543 		goto out;
544 
545 	spin_lock_bh(&dev->sta_poll_lock);
546 	if (list_empty(&msta->poll_list))
547 		list_add_tail(&msta->poll_list, &dev->sta_poll_list);
548 	spin_unlock_bh(&dev->sta_poll_lock);
549 
550 out:
551 	rcu_read_unlock();
552 }
553 
554 void mt7921_txwi_free(struct mt7921_dev *dev, struct mt76_txwi_cache *t,
555 		      struct ieee80211_sta *sta, bool clear_status,
556 		      struct list_head *free_list)
557 {
558 	struct mt76_dev *mdev = &dev->mt76;
559 	__le32 *txwi;
560 	u16 wcid_idx;
561 
562 	mt76_connac_txp_skb_unmap(mdev, t);
563 	if (!t->skb)
564 		goto out;
565 
566 	txwi = (__le32 *)mt76_get_txwi_ptr(mdev, t);
567 	if (sta) {
568 		struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
569 
570 		if (likely(t->skb->protocol != cpu_to_be16(ETH_P_PAE)))
571 			mt7921_tx_check_aggr(sta, txwi);
572 
573 		wcid_idx = wcid->idx;
574 	} else {
575 		wcid_idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
576 	}
577 
578 	__mt76_tx_complete_skb(mdev, wcid_idx, t->skb, free_list);
579 out:
580 	t->skb = NULL;
581 	mt76_put_txwi(mdev, t);
582 }
583 EXPORT_SYMBOL_GPL(mt7921_txwi_free);
584 
585 static void mt7921_mac_tx_free(struct mt7921_dev *dev, void *data, int len)
586 {
587 	struct mt76_connac_tx_free *free = data;
588 	__le32 *tx_info = (__le32 *)(data + sizeof(*free));
589 	struct mt76_dev *mdev = &dev->mt76;
590 	struct mt76_txwi_cache *txwi;
591 	struct ieee80211_sta *sta = NULL;
592 	struct sk_buff *skb, *tmp;
593 	void *end = data + len;
594 	LIST_HEAD(free_list);
595 	bool wake = false;
596 	u8 i, count;
597 
598 	/* clean DMA queues and unmap buffers first */
599 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_PSD], false);
600 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BE], false);
601 
602 	count = le16_get_bits(free->ctrl, MT_TX_FREE_MSDU_CNT);
603 	if (WARN_ON_ONCE((void *)&tx_info[count] > end))
604 		return;
605 
606 	for (i = 0; i < count; i++) {
607 		u32 msdu, info = le32_to_cpu(tx_info[i]);
608 		u8 stat;
609 
610 		/* 1'b1: new wcid pair.
611 		 * 1'b0: msdu_id with the same 'wcid pair' as above.
612 		 */
613 		if (info & MT_TX_FREE_PAIR) {
614 			struct mt7921_sta *msta;
615 			struct mt76_wcid *wcid;
616 			u16 idx;
617 
618 			count++;
619 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
620 			wcid = rcu_dereference(dev->mt76.wcid[idx]);
621 			sta = wcid_to_sta(wcid);
622 			if (!sta)
623 				continue;
624 
625 			msta = container_of(wcid, struct mt7921_sta, wcid);
626 			spin_lock_bh(&dev->sta_poll_lock);
627 			if (list_empty(&msta->poll_list))
628 				list_add_tail(&msta->poll_list, &dev->sta_poll_list);
629 			spin_unlock_bh(&dev->sta_poll_lock);
630 			continue;
631 		}
632 
633 		msdu = FIELD_GET(MT_TX_FREE_MSDU_ID, info);
634 		stat = FIELD_GET(MT_TX_FREE_STATUS, info);
635 
636 		txwi = mt76_token_release(mdev, msdu, &wake);
637 		if (!txwi)
638 			continue;
639 
640 		mt7921_txwi_free(dev, txwi, sta, stat, &free_list);
641 	}
642 
643 	if (wake)
644 		mt76_set_tx_blocked(&dev->mt76, false);
645 
646 	list_for_each_entry_safe(skb, tmp, &free_list, list) {
647 		skb_list_del_init(skb);
648 		napi_consume_skb(skb, 1);
649 	}
650 
651 	rcu_read_lock();
652 	mt7921_mac_sta_poll(dev);
653 	rcu_read_unlock();
654 
655 	mt76_worker_schedule(&dev->mt76.tx_worker);
656 }
657 
658 bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
659 {
660 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
661 	__le32 *rxd = (__le32 *)data;
662 	__le32 *end = (__le32 *)&rxd[len / 4];
663 	enum rx_pkt_type type;
664 
665 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
666 
667 	switch (type) {
668 	case PKT_TYPE_TXRX_NOTIFY:
669 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
670 		mt7921_mac_tx_free(dev, data, len); /* mmio */
671 		return false;
672 	case PKT_TYPE_TXS:
673 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
674 			mt7921_mac_add_txs(dev, rxd);
675 		return false;
676 	default:
677 		return true;
678 	}
679 }
680 EXPORT_SYMBOL_GPL(mt7921_rx_check);
681 
682 void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
683 			 struct sk_buff *skb)
684 {
685 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
686 	__le32 *rxd = (__le32 *)skb->data;
687 	__le32 *end = (__le32 *)&skb->data[skb->len];
688 	enum rx_pkt_type type;
689 	u16 flag;
690 
691 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
692 	flag = le32_get_bits(rxd[0], MT_RXD0_PKT_FLAG);
693 
694 	if (type == PKT_TYPE_RX_EVENT && flag == 0x1)
695 		type = PKT_TYPE_NORMAL_MCU;
696 
697 	switch (type) {
698 	case PKT_TYPE_TXRX_NOTIFY:
699 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
700 		mt7921_mac_tx_free(dev, skb->data, skb->len);
701 		napi_consume_skb(skb, 1);
702 		break;
703 	case PKT_TYPE_RX_EVENT:
704 		mt7921_mcu_rx_event(dev, skb);
705 		break;
706 	case PKT_TYPE_TXS:
707 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
708 			mt7921_mac_add_txs(dev, rxd);
709 		dev_kfree_skb(skb);
710 		break;
711 	case PKT_TYPE_NORMAL_MCU:
712 	case PKT_TYPE_NORMAL:
713 		if (!mt7921_mac_fill_rx(dev, skb)) {
714 			mt76_rx(&dev->mt76, q, skb);
715 			return;
716 		}
717 		fallthrough;
718 	default:
719 		dev_kfree_skb(skb);
720 		break;
721 	}
722 }
723 EXPORT_SYMBOL_GPL(mt7921_queue_rx_skb);
724 
725 void mt7921_mac_reset_counters(struct mt7921_phy *phy)
726 {
727 	struct mt7921_dev *dev = phy->dev;
728 	int i;
729 
730 	for (i = 0; i < 4; i++) {
731 		mt76_rr(dev, MT_TX_AGG_CNT(0, i));
732 		mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
733 	}
734 
735 	dev->mt76.phy.survey_time = ktime_get_boottime();
736 	memset(&dev->mt76.aggr_stats[0], 0, sizeof(dev->mt76.aggr_stats) / 2);
737 
738 	/* reset airtime counters */
739 	mt76_rr(dev, MT_MIB_SDR9(0));
740 	mt76_rr(dev, MT_MIB_SDR36(0));
741 	mt76_rr(dev, MT_MIB_SDR37(0));
742 
743 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
744 	mt76_set(dev, MT_WF_RMAC_MIB_AIRTIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
745 }
746 
747 void mt7921_mac_set_timing(struct mt7921_phy *phy)
748 {
749 	s16 coverage_class = phy->coverage_class;
750 	struct mt7921_dev *dev = phy->dev;
751 	u32 val, reg_offset;
752 	u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) |
753 		  FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48);
754 	u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) |
755 		   FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28);
756 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
757 	int sifs = is_2ghz ? 10 : 16, offset;
758 
759 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
760 		return;
761 
762 	mt76_set(dev, MT_ARB_SCR(0),
763 		 MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
764 	udelay(1);
765 
766 	offset = 3 * coverage_class;
767 	reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) |
768 		     FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset);
769 
770 	mt76_wr(dev, MT_TMAC_CDTR(0), cck + reg_offset);
771 	mt76_wr(dev, MT_TMAC_ODTR(0), ofdm + reg_offset);
772 	mt76_wr(dev, MT_TMAC_ICR0(0),
773 		FIELD_PREP(MT_IFS_EIFS, 360) |
774 		FIELD_PREP(MT_IFS_RIFS, 2) |
775 		FIELD_PREP(MT_IFS_SIFS, sifs) |
776 		FIELD_PREP(MT_IFS_SLOT, phy->slottime));
777 
778 	if (phy->slottime < 20 || !is_2ghz)
779 		val = MT7921_CFEND_RATE_DEFAULT;
780 	else
781 		val = MT7921_CFEND_RATE_11B;
782 
783 	mt76_rmw_field(dev, MT_AGG_ACR0(0), MT_AGG_ACR_CFEND_RATE, val);
784 	mt76_clear(dev, MT_ARB_SCR(0),
785 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
786 }
787 
788 static u8
789 mt7921_phy_get_nf(struct mt7921_phy *phy, int idx)
790 {
791 	return 0;
792 }
793 
794 static void
795 mt7921_phy_update_channel(struct mt76_phy *mphy, int idx)
796 {
797 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
798 	struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
799 	struct mt76_channel_state *state;
800 	u64 busy_time, tx_time, rx_time, obss_time;
801 	int nf;
802 
803 	busy_time = mt76_get_field(dev, MT_MIB_SDR9(idx),
804 				   MT_MIB_SDR9_BUSY_MASK);
805 	tx_time = mt76_get_field(dev, MT_MIB_SDR36(idx),
806 				 MT_MIB_SDR36_TXTIME_MASK);
807 	rx_time = mt76_get_field(dev, MT_MIB_SDR37(idx),
808 				 MT_MIB_SDR37_RXTIME_MASK);
809 	obss_time = mt76_get_field(dev, MT_WF_RMAC_MIB_AIRTIME14(idx),
810 				   MT_MIB_OBSSTIME_MASK);
811 
812 	nf = mt7921_phy_get_nf(phy, idx);
813 	if (!phy->noise)
814 		phy->noise = nf << 4;
815 	else if (nf)
816 		phy->noise += nf - (phy->noise >> 4);
817 
818 	state = mphy->chan_state;
819 	state->cc_busy += busy_time;
820 	state->cc_tx += tx_time;
821 	state->cc_rx += rx_time + obss_time;
822 	state->cc_bss_rx += rx_time;
823 	state->noise = -(phy->noise >> 4);
824 }
825 
826 void mt7921_update_channel(struct mt76_phy *mphy)
827 {
828 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
829 
830 	if (mt76_connac_pm_wake(mphy, &dev->pm))
831 		return;
832 
833 	mt7921_phy_update_channel(mphy, 0);
834 	/* reset obss airtime */
835 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
836 
837 	mt76_connac_power_save_sched(mphy, &dev->pm);
838 }
839 EXPORT_SYMBOL_GPL(mt7921_update_channel);
840 
841 static void
842 mt7921_vif_connect_iter(void *priv, u8 *mac,
843 			struct ieee80211_vif *vif)
844 {
845 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
846 	struct mt7921_dev *dev = mvif->phy->dev;
847 	struct ieee80211_hw *hw = mt76_hw(dev);
848 
849 	if (vif->type == NL80211_IFTYPE_STATION)
850 		ieee80211_disconnect(vif, true);
851 
852 	mt76_connac_mcu_uni_add_dev(&dev->mphy, vif, &mvif->sta.wcid, true);
853 	mt7921_mcu_set_tx(dev, vif);
854 
855 	if (vif->type == NL80211_IFTYPE_AP) {
856 		mt76_connac_mcu_uni_add_bss(dev->phy.mt76, vif, &mvif->sta.wcid,
857 					    true);
858 		mt7921_mcu_sta_update(dev, NULL, vif, true,
859 				      MT76_STA_INFO_STATE_NONE);
860 		mt7921_mcu_uni_add_beacon_offload(dev, hw, vif, true);
861 	}
862 }
863 
864 /* system error recovery */
865 void mt7921_mac_reset_work(struct work_struct *work)
866 {
867 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
868 					      reset_work);
869 	struct ieee80211_hw *hw = mt76_hw(dev);
870 	struct mt76_connac_pm *pm = &dev->pm;
871 	int i, ret;
872 
873 	dev_dbg(dev->mt76.dev, "chip reset\n");
874 	dev->hw_full_reset = true;
875 	ieee80211_stop_queues(hw);
876 
877 	cancel_delayed_work_sync(&dev->mphy.mac_work);
878 	cancel_delayed_work_sync(&pm->ps_work);
879 	cancel_work_sync(&pm->wake_work);
880 
881 	for (i = 0; i < 10; i++) {
882 		mutex_lock(&dev->mt76.mutex);
883 		ret = mt7921_dev_reset(dev);
884 		mutex_unlock(&dev->mt76.mutex);
885 
886 		if (!ret)
887 			break;
888 	}
889 
890 	if (i == 10)
891 		dev_err(dev->mt76.dev, "chip reset failed\n");
892 
893 	if (test_and_clear_bit(MT76_HW_SCANNING, &dev->mphy.state)) {
894 		struct cfg80211_scan_info info = {
895 			.aborted = true,
896 		};
897 
898 		ieee80211_scan_completed(dev->mphy.hw, &info);
899 	}
900 
901 	dev->hw_full_reset = false;
902 	pm->suspended = false;
903 	ieee80211_wake_queues(hw);
904 	ieee80211_iterate_active_interfaces(hw,
905 					    IEEE80211_IFACE_ITER_RESUME_ALL,
906 					    mt7921_vif_connect_iter, NULL);
907 	mt76_connac_power_save_sched(&dev->mt76.phy, pm);
908 }
909 
910 void mt7921_reset(struct mt76_dev *mdev)
911 {
912 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
913 	struct mt76_connac_pm *pm = &dev->pm;
914 
915 	if (!dev->hw_init_done)
916 		return;
917 
918 	if (dev->hw_full_reset)
919 		return;
920 
921 	if (pm->suspended)
922 		return;
923 
924 	queue_work(dev->mt76.wq, &dev->reset_work);
925 }
926 EXPORT_SYMBOL_GPL(mt7921_reset);
927 
928 void mt7921_mac_update_mib_stats(struct mt7921_phy *phy)
929 {
930 	struct mt7921_dev *dev = phy->dev;
931 	struct mib_stats *mib = &phy->mib;
932 	int i, aggr0 = 0, aggr1;
933 	u32 val;
934 
935 	mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(0),
936 					   MT_MIB_SDR3_FCS_ERR_MASK);
937 	mib->ack_fail_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR3(0),
938 					    MT_MIB_ACK_FAIL_COUNT_MASK);
939 	mib->ba_miss_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR2(0),
940 					   MT_MIB_BA_FAIL_COUNT_MASK);
941 	mib->rts_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR0(0),
942 				       MT_MIB_RTS_COUNT_MASK);
943 	mib->rts_retries_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR1(0),
944 					       MT_MIB_RTS_FAIL_COUNT_MASK);
945 
946 	mib->tx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR12(0));
947 	mib->tx_mpdu_attempts_cnt += mt76_rr(dev, MT_MIB_SDR14(0));
948 	mib->tx_mpdu_success_cnt += mt76_rr(dev, MT_MIB_SDR15(0));
949 
950 	val = mt76_rr(dev, MT_MIB_SDR32(0));
951 	mib->tx_pkt_ebf_cnt += FIELD_GET(MT_MIB_SDR9_EBF_CNT_MASK, val);
952 	mib->tx_pkt_ibf_cnt += FIELD_GET(MT_MIB_SDR9_IBF_CNT_MASK, val);
953 
954 	val = mt76_rr(dev, MT_ETBF_TX_APP_CNT(0));
955 	mib->tx_bf_ibf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_IBF_CNT, val);
956 	mib->tx_bf_ebf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_EBF_CNT, val);
957 
958 	val = mt76_rr(dev, MT_ETBF_RX_FB_CNT(0));
959 	mib->tx_bf_rx_fb_all_cnt += FIELD_GET(MT_ETBF_RX_FB_ALL, val);
960 	mib->tx_bf_rx_fb_he_cnt += FIELD_GET(MT_ETBF_RX_FB_HE, val);
961 	mib->tx_bf_rx_fb_vht_cnt += FIELD_GET(MT_ETBF_RX_FB_VHT, val);
962 	mib->tx_bf_rx_fb_ht_cnt += FIELD_GET(MT_ETBF_RX_FB_HT, val);
963 
964 	mib->rx_mpdu_cnt += mt76_rr(dev, MT_MIB_SDR5(0));
965 	mib->rx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR22(0));
966 	mib->rx_ampdu_bytes_cnt += mt76_rr(dev, MT_MIB_SDR23(0));
967 	mib->rx_ba_cnt += mt76_rr(dev, MT_MIB_SDR31(0));
968 
969 	for (i = 0; i < ARRAY_SIZE(mib->tx_amsdu); i++) {
970 		val = mt76_rr(dev, MT_PLE_AMSDU_PACK_MSDU_CNT(i));
971 		mib->tx_amsdu[i] += val;
972 		mib->tx_amsdu_cnt += val;
973 	}
974 
975 	for (i = 0, aggr1 = aggr0 + 4; i < 4; i++) {
976 		u32 val2;
977 
978 		val = mt76_rr(dev, MT_TX_AGG_CNT(0, i));
979 		val2 = mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
980 
981 		dev->mt76.aggr_stats[aggr0++] += val & 0xffff;
982 		dev->mt76.aggr_stats[aggr0++] += val >> 16;
983 		dev->mt76.aggr_stats[aggr1++] += val2 & 0xffff;
984 		dev->mt76.aggr_stats[aggr1++] += val2 >> 16;
985 	}
986 }
987 
988 void mt7921_mac_work(struct work_struct *work)
989 {
990 	struct mt7921_phy *phy;
991 	struct mt76_phy *mphy;
992 
993 	mphy = (struct mt76_phy *)container_of(work, struct mt76_phy,
994 					       mac_work.work);
995 	phy = mphy->priv;
996 
997 	mt7921_mutex_acquire(phy->dev);
998 
999 	mt76_update_survey(mphy);
1000 	if (++mphy->mac_work_count == 2) {
1001 		mphy->mac_work_count = 0;
1002 
1003 		mt7921_mac_update_mib_stats(phy);
1004 	}
1005 
1006 	mt7921_mutex_release(phy->dev);
1007 
1008 	mt76_tx_status_check(mphy->dev, false);
1009 	ieee80211_queue_delayed_work(phy->mt76->hw, &mphy->mac_work,
1010 				     MT7921_WATCHDOG_TIME);
1011 }
1012 
1013 void mt7921_pm_wake_work(struct work_struct *work)
1014 {
1015 	struct mt7921_dev *dev;
1016 	struct mt76_phy *mphy;
1017 
1018 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1019 						pm.wake_work);
1020 	mphy = dev->phy.mt76;
1021 
1022 	if (!mt7921_mcu_drv_pmctrl(dev)) {
1023 		struct mt76_dev *mdev = &dev->mt76;
1024 		int i;
1025 
1026 		if (mt76_is_sdio(mdev)) {
1027 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1028 			mt76_worker_schedule(&mdev->sdio.txrx_worker);
1029 		} else {
1030 			local_bh_disable();
1031 			mt76_for_each_q_rx(mdev, i)
1032 				napi_schedule(&mdev->napi[i]);
1033 			local_bh_enable();
1034 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1035 			mt76_connac_tx_cleanup(mdev);
1036 		}
1037 		if (test_bit(MT76_STATE_RUNNING, &mphy->state))
1038 			ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
1039 						     MT7921_WATCHDOG_TIME);
1040 	}
1041 
1042 	ieee80211_wake_queues(mphy->hw);
1043 	wake_up(&dev->pm.wait);
1044 }
1045 
1046 void mt7921_pm_power_save_work(struct work_struct *work)
1047 {
1048 	struct mt7921_dev *dev;
1049 	unsigned long delta;
1050 	struct mt76_phy *mphy;
1051 
1052 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1053 						pm.ps_work.work);
1054 	mphy = dev->phy.mt76;
1055 
1056 	delta = dev->pm.idle_timeout;
1057 	if (test_bit(MT76_HW_SCANNING, &mphy->state) ||
1058 	    test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) ||
1059 	    dev->fw_assert)
1060 		goto out;
1061 
1062 	if (mutex_is_locked(&dev->mt76.mutex))
1063 		/* if mt76 mutex is held we should not put the device
1064 		 * to sleep since we are currently accessing device
1065 		 * register map. We need to wait for the next power_save
1066 		 * trigger.
1067 		 */
1068 		goto out;
1069 
1070 	if (time_is_after_jiffies(dev->pm.last_activity + delta)) {
1071 		delta = dev->pm.last_activity + delta - jiffies;
1072 		goto out;
1073 	}
1074 
1075 	if (!mt7921_mcu_fw_pmctrl(dev)) {
1076 		cancel_delayed_work_sync(&mphy->mac_work);
1077 		return;
1078 	}
1079 out:
1080 	queue_delayed_work(dev->mt76.wq, &dev->pm.ps_work, delta);
1081 }
1082 
1083 void mt7921_coredump_work(struct work_struct *work)
1084 {
1085 	struct mt7921_dev *dev;
1086 	char *dump, *data;
1087 
1088 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1089 						coredump.work.work);
1090 
1091 	if (time_is_after_jiffies(dev->coredump.last_activity +
1092 				  4 * MT76_CONNAC_COREDUMP_TIMEOUT)) {
1093 		queue_delayed_work(dev->mt76.wq, &dev->coredump.work,
1094 				   MT76_CONNAC_COREDUMP_TIMEOUT);
1095 		return;
1096 	}
1097 
1098 	dump = vzalloc(MT76_CONNAC_COREDUMP_SZ);
1099 	data = dump;
1100 
1101 	while (true) {
1102 		struct sk_buff *skb;
1103 
1104 		spin_lock_bh(&dev->mt76.lock);
1105 		skb = __skb_dequeue(&dev->coredump.msg_list);
1106 		spin_unlock_bh(&dev->mt76.lock);
1107 
1108 		if (!skb)
1109 			break;
1110 
1111 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
1112 		if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
1113 			dev_kfree_skb(skb);
1114 			continue;
1115 		}
1116 
1117 		memcpy(data, skb->data, skb->len);
1118 		data += skb->len;
1119 
1120 		dev_kfree_skb(skb);
1121 	}
1122 
1123 	if (dump)
1124 		dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
1125 			      GFP_KERNEL);
1126 
1127 	mt7921_reset(&dev->mt76);
1128 }
1129 
1130 /* usb_sdio */
1131 static void
1132 mt7921_usb_sdio_write_txwi(struct mt7921_dev *dev, struct mt76_wcid *wcid,
1133 			   enum mt76_txq_id qid, struct ieee80211_sta *sta,
1134 			   struct ieee80211_key_conf *key, int pid,
1135 			   struct sk_buff *skb)
1136 {
1137 	__le32 *txwi = (__le32 *)(skb->data - MT_SDIO_TXD_SIZE);
1138 
1139 	memset(txwi, 0, MT_SDIO_TXD_SIZE);
1140 	mt76_connac2_mac_write_txwi(&dev->mt76, txwi, skb, wcid, key, pid, qid, 0);
1141 	skb_push(skb, MT_SDIO_TXD_SIZE);
1142 }
1143 
1144 int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
1145 				   enum mt76_txq_id qid, struct mt76_wcid *wcid,
1146 				   struct ieee80211_sta *sta,
1147 				   struct mt76_tx_info *tx_info)
1148 {
1149 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1150 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
1151 	struct ieee80211_key_conf *key = info->control.hw_key;
1152 	struct sk_buff *skb = tx_info->skb;
1153 	int err, pad, pktid, type;
1154 
1155 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
1156 		return -EINVAL;
1157 
1158 	if (!wcid)
1159 		wcid = &dev->mt76.global_wcid;
1160 
1161 	if (sta) {
1162 		struct mt7921_sta *msta = (struct mt7921_sta *)sta->drv_priv;
1163 
1164 		if (time_after(jiffies, msta->last_txs + HZ / 4)) {
1165 			info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1166 			msta->last_txs = jiffies;
1167 		}
1168 	}
1169 
1170 	pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb);
1171 	mt7921_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);
1172 
1173 	type = mt76_is_sdio(mdev) ? MT7921_SDIO_DATA : 0;
1174 	mt7921_skb_add_usb_sdio_hdr(dev, skb, type);
1175 	pad = round_up(skb->len, 4) - skb->len;
1176 	if (mt76_is_usb(mdev))
1177 		pad += 4;
1178 
1179 	err = mt76_skb_adjust_pad(skb, pad);
1180 	if (err)
1181 		/* Release pktid in case of error. */
1182 		idr_remove(&wcid->pktid, pktid);
1183 
1184 	return err;
1185 }
1186 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_prepare_skb);
1187 
1188 void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,
1189 				     struct mt76_queue_entry *e)
1190 {
1191 	__le32 *txwi = (__le32 *)(e->skb->data + MT_SDIO_HDR_SIZE);
1192 	unsigned int headroom = MT_SDIO_TXD_SIZE + MT_SDIO_HDR_SIZE;
1193 	struct ieee80211_sta *sta;
1194 	struct mt76_wcid *wcid;
1195 	u16 idx;
1196 
1197 	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
1198 	wcid = rcu_dereference(mdev->wcid[idx]);
1199 	sta = wcid_to_sta(wcid);
1200 
1201 	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))
1202 		mt7921_tx_check_aggr(sta, txwi);
1203 
1204 	skb_pull(e->skb, headroom);
1205 	mt76_tx_complete_skb(mdev, e->wcid, e->skb);
1206 }
1207 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_complete_skb);
1208 
1209 bool mt7921_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)
1210 {
1211 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1212 
1213 	mt7921_mutex_acquire(dev);
1214 	mt7921_mac_sta_poll(dev);
1215 	mt7921_mutex_release(dev);
1216 
1217 	return false;
1218 }
1219 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_status_data);
1220 
1221 #if IS_ENABLED(CONFIG_IPV6)
1222 void mt7921_set_ipv6_ns_work(struct work_struct *work)
1223 {
1224 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
1225 						ipv6_ns_work);
1226 	struct sk_buff *skb;
1227 	int ret = 0;
1228 
1229 	do {
1230 		skb = skb_dequeue(&dev->ipv6_ns_list);
1231 
1232 		if (!skb)
1233 			break;
1234 
1235 		mt7921_mutex_acquire(dev);
1236 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1237 					    MCU_UNI_CMD(OFFLOAD), true);
1238 		mt7921_mutex_release(dev);
1239 
1240 	} while (!ret);
1241 
1242 	if (ret)
1243 		skb_queue_purge(&dev->ipv6_ns_list);
1244 }
1245 #endif
1246