xref: /linux/drivers/net/wireless/mediatek/mt76/mt7921/mac.c (revision d6296cb65320be16dbf20f2fd584ddc25f3437cd)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/devcoredump.h>
5 #include <linux/etherdevice.h>
6 #include <linux/timekeeping.h>
7 #include "mt7921.h"
8 #include "../dma.h"
9 #include "mac.h"
10 #include "mcu.h"
11 
12 static struct mt76_wcid *mt7921_rx_get_wcid(struct mt7921_dev *dev,
13 					    u16 idx, bool unicast)
14 {
15 	struct mt7921_sta *sta;
16 	struct mt76_wcid *wcid;
17 
18 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
19 		return NULL;
20 
21 	wcid = rcu_dereference(dev->mt76.wcid[idx]);
22 	if (unicast || !wcid)
23 		return wcid;
24 
25 	if (!wcid->sta)
26 		return NULL;
27 
28 	sta = container_of(wcid, struct mt7921_sta, wcid);
29 	if (!sta->vif)
30 		return NULL;
31 
32 	return &sta->vif->sta.wcid;
33 }
34 
35 void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
36 {
37 }
38 EXPORT_SYMBOL_GPL(mt7921_sta_ps);
39 
40 bool mt7921_mac_wtbl_update(struct mt7921_dev *dev, int idx, u32 mask)
41 {
42 	mt76_rmw(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_WLAN_IDX,
43 		 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, idx) | mask);
44 
45 	return mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY,
46 			 0, 5000);
47 }
48 
49 void mt7921_mac_sta_poll(struct mt7921_dev *dev)
50 {
51 	static const u8 ac_to_tid[] = {
52 		[IEEE80211_AC_BE] = 0,
53 		[IEEE80211_AC_BK] = 1,
54 		[IEEE80211_AC_VI] = 4,
55 		[IEEE80211_AC_VO] = 6
56 	};
57 	struct ieee80211_sta *sta;
58 	struct mt7921_sta *msta;
59 	u32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS];
60 	LIST_HEAD(sta_poll_list);
61 	struct rate_info *rate;
62 	s8 rssi[4];
63 	int i;
64 
65 	spin_lock_bh(&dev->sta_poll_lock);
66 	list_splice_init(&dev->sta_poll_list, &sta_poll_list);
67 	spin_unlock_bh(&dev->sta_poll_lock);
68 
69 	while (true) {
70 		bool clear = false;
71 		u32 addr, val;
72 		u16 idx;
73 		u8 bw;
74 
75 		spin_lock_bh(&dev->sta_poll_lock);
76 		if (list_empty(&sta_poll_list)) {
77 			spin_unlock_bh(&dev->sta_poll_lock);
78 			break;
79 		}
80 		msta = list_first_entry(&sta_poll_list,
81 					struct mt7921_sta, poll_list);
82 		list_del_init(&msta->poll_list);
83 		spin_unlock_bh(&dev->sta_poll_lock);
84 
85 		idx = msta->wcid.idx;
86 		addr = mt7921_mac_wtbl_lmac_addr(idx, MT_WTBL_AC0_CTT_OFFSET);
87 
88 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
89 			u32 tx_last = msta->airtime_ac[i];
90 			u32 rx_last = msta->airtime_ac[i + 4];
91 
92 			msta->airtime_ac[i] = mt76_rr(dev, addr);
93 			msta->airtime_ac[i + 4] = mt76_rr(dev, addr + 4);
94 
95 			tx_time[i] = msta->airtime_ac[i] - tx_last;
96 			rx_time[i] = msta->airtime_ac[i + 4] - rx_last;
97 
98 			if ((tx_last | rx_last) & BIT(30))
99 				clear = true;
100 
101 			addr += 8;
102 		}
103 
104 		if (clear) {
105 			mt7921_mac_wtbl_update(dev, idx,
106 					       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
107 			memset(msta->airtime_ac, 0, sizeof(msta->airtime_ac));
108 		}
109 
110 		if (!msta->wcid.sta)
111 			continue;
112 
113 		sta = container_of((void *)msta, struct ieee80211_sta,
114 				   drv_priv);
115 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
116 			u8 q = mt76_connac_lmac_mapping(i);
117 			u32 tx_cur = tx_time[q];
118 			u32 rx_cur = rx_time[q];
119 			u8 tid = ac_to_tid[i];
120 
121 			if (!tx_cur && !rx_cur)
122 				continue;
123 
124 			ieee80211_sta_register_airtime(sta, tid, tx_cur,
125 						       rx_cur);
126 		}
127 
128 		/* We don't support reading GI info from txs packets.
129 		 * For accurate tx status reporting and AQL improvement,
130 		 * we need to make sure that flags match so polling GI
131 		 * from per-sta counters directly.
132 		 */
133 		rate = &msta->wcid.rate;
134 		addr = mt7921_mac_wtbl_lmac_addr(idx,
135 						 MT_WTBL_TXRX_CAP_RATE_OFFSET);
136 		val = mt76_rr(dev, addr);
137 
138 		switch (rate->bw) {
139 		case RATE_INFO_BW_160:
140 			bw = IEEE80211_STA_RX_BW_160;
141 			break;
142 		case RATE_INFO_BW_80:
143 			bw = IEEE80211_STA_RX_BW_80;
144 			break;
145 		case RATE_INFO_BW_40:
146 			bw = IEEE80211_STA_RX_BW_40;
147 			break;
148 		default:
149 			bw = IEEE80211_STA_RX_BW_20;
150 			break;
151 		}
152 
153 		if (rate->flags & RATE_INFO_FLAGS_HE_MCS) {
154 			u8 offs = MT_WTBL_TXRX_RATE_G2_HE + 2 * bw;
155 
156 			rate->he_gi = (val & (0x3 << offs)) >> offs;
157 		} else if (rate->flags &
158 			   (RATE_INFO_FLAGS_VHT_MCS | RATE_INFO_FLAGS_MCS)) {
159 			if (val & BIT(MT_WTBL_TXRX_RATE_G2 + bw))
160 				rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
161 			else
162 				rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
163 		}
164 
165 		/* get signal strength of resp frames (CTS/BA/ACK) */
166 		addr = mt7921_mac_wtbl_lmac_addr(idx, 30);
167 		val = mt76_rr(dev, addr);
168 
169 		rssi[0] = to_rssi(GENMASK(7, 0), val);
170 		rssi[1] = to_rssi(GENMASK(15, 8), val);
171 		rssi[2] = to_rssi(GENMASK(23, 16), val);
172 		rssi[3] = to_rssi(GENMASK(31, 14), val);
173 
174 		msta->ack_signal =
175 			mt76_rx_signal(msta->vif->phy->mt76->antenna_mask, rssi);
176 
177 		ewma_avg_signal_add(&msta->avg_ack_signal, -msta->ack_signal);
178 	}
179 }
180 EXPORT_SYMBOL_GPL(mt7921_mac_sta_poll);
181 
182 static void
183 mt7921_get_status_freq_info(struct mt7921_dev *dev, struct mt76_phy *mphy,
184 			    struct mt76_rx_status *status, u8 chfreq)
185 {
186 	if (chfreq > 180) {
187 		status->band = NL80211_BAND_6GHZ;
188 		chfreq = (chfreq - 181) * 4 + 1;
189 	} else if (chfreq > 14) {
190 		status->band = NL80211_BAND_5GHZ;
191 	} else {
192 		status->band = NL80211_BAND_2GHZ;
193 	}
194 	status->freq = ieee80211_channel_to_frequency(chfreq, status->band);
195 }
196 
197 static void
198 mt7921_mac_rssi_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
199 {
200 	struct sk_buff *skb = priv;
201 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
202 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
203 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
204 
205 	if (status->signal > 0)
206 		return;
207 
208 	if (!ether_addr_equal(vif->addr, hdr->addr1))
209 		return;
210 
211 	ewma_rssi_add(&mvif->rssi, -status->signal);
212 }
213 
214 static void
215 mt7921_mac_assoc_rssi(struct mt7921_dev *dev, struct sk_buff *skb)
216 {
217 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
218 
219 	if (!ieee80211_is_assoc_resp(hdr->frame_control) &&
220 	    !ieee80211_is_auth(hdr->frame_control))
221 		return;
222 
223 	ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
224 		IEEE80211_IFACE_ITER_RESUME_ALL,
225 		mt7921_mac_rssi_iter, skb);
226 }
227 
228 static int
229 mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
230 {
231 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
232 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
233 	bool hdr_trans, unicast, insert_ccmp_hdr = false;
234 	u8 chfreq, qos_ctl = 0, remove_pad, amsdu_info;
235 	u16 hdr_gap;
236 	__le32 *rxv = NULL, *rxd = (__le32 *)skb->data;
237 	struct mt76_phy *mphy = &dev->mt76.phy;
238 	struct mt7921_phy *phy = &dev->phy;
239 	struct ieee80211_supported_band *sband;
240 	u32 csum_status = *(u32 *)skb->cb;
241 	u32 rxd0 = le32_to_cpu(rxd[0]);
242 	u32 rxd1 = le32_to_cpu(rxd[1]);
243 	u32 rxd2 = le32_to_cpu(rxd[2]);
244 	u32 rxd3 = le32_to_cpu(rxd[3]);
245 	u32 rxd4 = le32_to_cpu(rxd[4]);
246 	struct mt7921_sta *msta = NULL;
247 	u16 seq_ctrl = 0;
248 	__le16 fc = 0;
249 	u8 mode = 0;
250 	int i, idx;
251 
252 	memset(status, 0, sizeof(*status));
253 
254 	if (rxd1 & MT_RXD1_NORMAL_BAND_IDX)
255 		return -EINVAL;
256 
257 	if (!test_bit(MT76_STATE_RUNNING, &mphy->state))
258 		return -EINVAL;
259 
260 	if (rxd2 & MT_RXD2_NORMAL_AMSDU_ERR)
261 		return -EINVAL;
262 
263 	hdr_trans = rxd2 & MT_RXD2_NORMAL_HDR_TRANS;
264 	if (hdr_trans && (rxd1 & MT_RXD1_NORMAL_CM))
265 		return -EINVAL;
266 
267 	/* ICV error or CCMP/BIP/WPI MIC error */
268 	if (rxd1 & MT_RXD1_NORMAL_ICV_ERR)
269 		status->flag |= RX_FLAG_ONLY_MONITOR;
270 
271 	chfreq = FIELD_GET(MT_RXD3_NORMAL_CH_FREQ, rxd3);
272 	unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
273 	idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
274 	status->wcid = mt7921_rx_get_wcid(dev, idx, unicast);
275 
276 	if (status->wcid) {
277 		msta = container_of(status->wcid, struct mt7921_sta, wcid);
278 		spin_lock_bh(&dev->sta_poll_lock);
279 		if (list_empty(&msta->poll_list))
280 			list_add_tail(&msta->poll_list, &dev->sta_poll_list);
281 		spin_unlock_bh(&dev->sta_poll_lock);
282 	}
283 
284 	mt7921_get_status_freq_info(dev, mphy, status, chfreq);
285 
286 	switch (status->band) {
287 	case NL80211_BAND_5GHZ:
288 		sband = &mphy->sband_5g.sband;
289 		break;
290 	case NL80211_BAND_6GHZ:
291 		sband = &mphy->sband_6g.sband;
292 		break;
293 	default:
294 		sband = &mphy->sband_2g.sband;
295 		break;
296 	}
297 
298 	if (!sband->channels)
299 		return -EINVAL;
300 
301 	if (mt76_is_mmio(&dev->mt76) && (rxd0 & csum_mask) == csum_mask &&
302 	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))
303 		skb->ip_summed = CHECKSUM_UNNECESSARY;
304 
305 	if (rxd1 & MT_RXD1_NORMAL_FCS_ERR)
306 		status->flag |= RX_FLAG_FAILED_FCS_CRC;
307 
308 	if (rxd1 & MT_RXD1_NORMAL_TKIP_MIC_ERR)
309 		status->flag |= RX_FLAG_MMIC_ERROR;
310 
311 	if (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1) != 0 &&
312 	    !(rxd1 & (MT_RXD1_NORMAL_CLM | MT_RXD1_NORMAL_CM))) {
313 		status->flag |= RX_FLAG_DECRYPTED;
314 		status->flag |= RX_FLAG_IV_STRIPPED;
315 		status->flag |= RX_FLAG_MMIC_STRIPPED | RX_FLAG_MIC_STRIPPED;
316 	}
317 
318 	remove_pad = FIELD_GET(MT_RXD2_NORMAL_HDR_OFFSET, rxd2);
319 
320 	if (rxd2 & MT_RXD2_NORMAL_MAX_LEN_ERROR)
321 		return -EINVAL;
322 
323 	rxd += 6;
324 	if (rxd1 & MT_RXD1_NORMAL_GROUP_4) {
325 		u32 v0 = le32_to_cpu(rxd[0]);
326 		u32 v2 = le32_to_cpu(rxd[2]);
327 
328 		fc = cpu_to_le16(FIELD_GET(MT_RXD6_FRAME_CONTROL, v0));
329 		seq_ctrl = FIELD_GET(MT_RXD8_SEQ_CTRL, v2);
330 		qos_ctl = FIELD_GET(MT_RXD8_QOS_CTL, v2);
331 
332 		rxd += 4;
333 		if ((u8 *)rxd - skb->data >= skb->len)
334 			return -EINVAL;
335 	}
336 
337 	if (rxd1 & MT_RXD1_NORMAL_GROUP_1) {
338 		u8 *data = (u8 *)rxd;
339 
340 		if (status->flag & RX_FLAG_DECRYPTED) {
341 			switch (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1)) {
342 			case MT_CIPHER_AES_CCMP:
343 			case MT_CIPHER_CCMP_CCX:
344 			case MT_CIPHER_CCMP_256:
345 				insert_ccmp_hdr =
346 					FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
347 				fallthrough;
348 			case MT_CIPHER_TKIP:
349 			case MT_CIPHER_TKIP_NO_MIC:
350 			case MT_CIPHER_GCMP:
351 			case MT_CIPHER_GCMP_256:
352 				status->iv[0] = data[5];
353 				status->iv[1] = data[4];
354 				status->iv[2] = data[3];
355 				status->iv[3] = data[2];
356 				status->iv[4] = data[1];
357 				status->iv[5] = data[0];
358 				break;
359 			default:
360 				break;
361 			}
362 		}
363 		rxd += 4;
364 		if ((u8 *)rxd - skb->data >= skb->len)
365 			return -EINVAL;
366 	}
367 
368 	if (rxd1 & MT_RXD1_NORMAL_GROUP_2) {
369 		status->timestamp = le32_to_cpu(rxd[0]);
370 		status->flag |= RX_FLAG_MACTIME_START;
371 
372 		if (!(rxd2 & MT_RXD2_NORMAL_NON_AMPDU)) {
373 			status->flag |= RX_FLAG_AMPDU_DETAILS;
374 
375 			/* all subframes of an A-MPDU have the same timestamp */
376 			if (phy->rx_ampdu_ts != status->timestamp) {
377 				if (!++phy->ampdu_ref)
378 					phy->ampdu_ref++;
379 			}
380 			phy->rx_ampdu_ts = status->timestamp;
381 
382 			status->ampdu_ref = phy->ampdu_ref;
383 		}
384 
385 		rxd += 2;
386 		if ((u8 *)rxd - skb->data >= skb->len)
387 			return -EINVAL;
388 	}
389 
390 	/* RXD Group 3 - P-RXV */
391 	if (rxd1 & MT_RXD1_NORMAL_GROUP_3) {
392 		u32 v0, v1;
393 		int ret;
394 
395 		rxv = rxd;
396 		rxd += 2;
397 		if ((u8 *)rxd - skb->data >= skb->len)
398 			return -EINVAL;
399 
400 		v0 = le32_to_cpu(rxv[0]);
401 		v1 = le32_to_cpu(rxv[1]);
402 
403 		if (v0 & MT_PRXV_HT_AD_CODE)
404 			status->enc_flags |= RX_ENC_FLAG_LDPC;
405 
406 		ret = mt76_connac2_mac_fill_rx_rate(&dev->mt76, status, sband,
407 						    rxv, &mode);
408 		if (ret < 0)
409 			return ret;
410 
411 		if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
412 			rxd += 6;
413 			if ((u8 *)rxd - skb->data >= skb->len)
414 				return -EINVAL;
415 
416 			rxv = rxd;
417 			/* Monitor mode would use RCPI described in GROUP 5
418 			 * instead.
419 			 */
420 			v1 = le32_to_cpu(rxv[0]);
421 
422 			rxd += 12;
423 			if ((u8 *)rxd - skb->data >= skb->len)
424 				return -EINVAL;
425 		}
426 
427 		status->chains = mphy->antenna_mask;
428 		status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v1);
429 		status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1);
430 		status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1);
431 		status->chain_signal[3] = to_rssi(MT_PRXV_RCPI3, v1);
432 		status->signal = -128;
433 		for (i = 0; i < hweight8(mphy->antenna_mask); i++) {
434 			if (!(status->chains & BIT(i)) ||
435 			    status->chain_signal[i] >= 0)
436 				continue;
437 
438 			status->signal = max(status->signal,
439 					     status->chain_signal[i]);
440 		}
441 	}
442 
443 	amsdu_info = FIELD_GET(MT_RXD4_NORMAL_PAYLOAD_FORMAT, rxd4);
444 	status->amsdu = !!amsdu_info;
445 	if (status->amsdu) {
446 		status->first_amsdu = amsdu_info == MT_RXD4_FIRST_AMSDU_FRAME;
447 		status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME;
448 	}
449 
450 	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
451 	if (hdr_trans && ieee80211_has_morefrags(fc)) {
452 		struct ieee80211_vif *vif;
453 		int err;
454 
455 		if (!msta || !msta->vif)
456 			return -EINVAL;
457 
458 		vif = container_of((void *)msta->vif, struct ieee80211_vif,
459 				   drv_priv);
460 		err = mt76_connac2_reverse_frag0_hdr_trans(vif, skb, hdr_gap);
461 		if (err)
462 			return err;
463 
464 		hdr_trans = false;
465 	} else {
466 		skb_pull(skb, hdr_gap);
467 		if (!hdr_trans && status->amsdu) {
468 			memmove(skb->data + 2, skb->data,
469 				ieee80211_get_hdrlen_from_skb(skb));
470 			skb_pull(skb, 2);
471 		}
472 	}
473 
474 	if (!hdr_trans) {
475 		struct ieee80211_hdr *hdr;
476 
477 		if (insert_ccmp_hdr) {
478 			u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1);
479 
480 			mt76_insert_ccmp_hdr(skb, key_id);
481 		}
482 
483 		hdr = mt76_skb_get_hdr(skb);
484 		fc = hdr->frame_control;
485 		if (ieee80211_is_data_qos(fc)) {
486 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
487 			qos_ctl = *ieee80211_get_qos_ctl(hdr);
488 		}
489 	} else {
490 		status->flag |= RX_FLAG_8023;
491 	}
492 
493 	mt7921_mac_assoc_rssi(dev, skb);
494 
495 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
496 		mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv, mode);
497 
498 	if (!status->wcid || !ieee80211_is_data_qos(fc))
499 		return 0;
500 
501 	status->aggr = unicast && !ieee80211_is_qos_nullfunc(fc);
502 	status->seqno = IEEE80211_SEQ_TO_SN(seq_ctrl);
503 	status->qos_ctl = qos_ctl;
504 
505 	return 0;
506 }
507 
508 static void mt7921_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
509 {
510 	struct mt7921_sta *msta;
511 	u16 fc, tid;
512 	u32 val;
513 
514 	if (!sta || !(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
515 		return;
516 
517 	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
518 	if (tid >= 6) /* skip VO queue */
519 		return;
520 
521 	val = le32_to_cpu(txwi[2]);
522 	fc = FIELD_GET(MT_TXD2_FRAME_TYPE, val) << 2 |
523 	     FIELD_GET(MT_TXD2_SUB_TYPE, val) << 4;
524 	if (unlikely(fc != (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA)))
525 		return;
526 
527 	msta = (struct mt7921_sta *)sta->drv_priv;
528 	if (!test_and_set_bit(tid, &msta->ampdu_state))
529 		ieee80211_start_tx_ba_session(sta, tid, 0);
530 }
531 
532 void mt7921_mac_add_txs(struct mt7921_dev *dev, void *data)
533 {
534 	struct mt7921_sta *msta = NULL;
535 	struct mt76_wcid *wcid;
536 	__le32 *txs_data = data;
537 	u16 wcidx;
538 	u8 pid;
539 
540 	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
541 		return;
542 
543 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
544 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
545 
546 	if (pid < MT_PACKET_ID_FIRST)
547 		return;
548 
549 	if (wcidx >= MT7921_WTBL_SIZE)
550 		return;
551 
552 	rcu_read_lock();
553 
554 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
555 	if (!wcid)
556 		goto out;
557 
558 	msta = container_of(wcid, struct mt7921_sta, wcid);
559 
560 	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
561 	if (!wcid->sta)
562 		goto out;
563 
564 	spin_lock_bh(&dev->sta_poll_lock);
565 	if (list_empty(&msta->poll_list))
566 		list_add_tail(&msta->poll_list, &dev->sta_poll_list);
567 	spin_unlock_bh(&dev->sta_poll_lock);
568 
569 out:
570 	rcu_read_unlock();
571 }
572 
573 void mt7921_txwi_free(struct mt7921_dev *dev, struct mt76_txwi_cache *t,
574 		      struct ieee80211_sta *sta, bool clear_status,
575 		      struct list_head *free_list)
576 {
577 	struct mt76_dev *mdev = &dev->mt76;
578 	__le32 *txwi;
579 	u16 wcid_idx;
580 
581 	mt76_connac_txp_skb_unmap(mdev, t);
582 	if (!t->skb)
583 		goto out;
584 
585 	txwi = (__le32 *)mt76_get_txwi_ptr(mdev, t);
586 	if (sta) {
587 		struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
588 
589 		if (likely(t->skb->protocol != cpu_to_be16(ETH_P_PAE)))
590 			mt7921_tx_check_aggr(sta, txwi);
591 
592 		wcid_idx = wcid->idx;
593 	} else {
594 		wcid_idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
595 	}
596 
597 	__mt76_tx_complete_skb(mdev, wcid_idx, t->skb, free_list);
598 out:
599 	t->skb = NULL;
600 	mt76_put_txwi(mdev, t);
601 }
602 EXPORT_SYMBOL_GPL(mt7921_txwi_free);
603 
604 static void mt7921_mac_tx_free(struct mt7921_dev *dev, void *data, int len)
605 {
606 	struct mt76_connac_tx_free *free = data;
607 	__le32 *tx_info = (__le32 *)(data + sizeof(*free));
608 	struct mt76_dev *mdev = &dev->mt76;
609 	struct mt76_txwi_cache *txwi;
610 	struct ieee80211_sta *sta = NULL;
611 	struct sk_buff *skb, *tmp;
612 	void *end = data + len;
613 	LIST_HEAD(free_list);
614 	bool wake = false;
615 	u8 i, count;
616 
617 	/* clean DMA queues and unmap buffers first */
618 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_PSD], false);
619 	mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BE], false);
620 
621 	count = le16_get_bits(free->ctrl, MT_TX_FREE_MSDU_CNT);
622 	if (WARN_ON_ONCE((void *)&tx_info[count] > end))
623 		return;
624 
625 	for (i = 0; i < count; i++) {
626 		u32 msdu, info = le32_to_cpu(tx_info[i]);
627 		u8 stat;
628 
629 		/* 1'b1: new wcid pair.
630 		 * 1'b0: msdu_id with the same 'wcid pair' as above.
631 		 */
632 		if (info & MT_TX_FREE_PAIR) {
633 			struct mt7921_sta *msta;
634 			struct mt76_wcid *wcid;
635 			u16 idx;
636 
637 			count++;
638 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
639 			wcid = rcu_dereference(dev->mt76.wcid[idx]);
640 			sta = wcid_to_sta(wcid);
641 			if (!sta)
642 				continue;
643 
644 			msta = container_of(wcid, struct mt7921_sta, wcid);
645 			spin_lock_bh(&dev->sta_poll_lock);
646 			if (list_empty(&msta->poll_list))
647 				list_add_tail(&msta->poll_list, &dev->sta_poll_list);
648 			spin_unlock_bh(&dev->sta_poll_lock);
649 			continue;
650 		}
651 
652 		msdu = FIELD_GET(MT_TX_FREE_MSDU_ID, info);
653 		stat = FIELD_GET(MT_TX_FREE_STATUS, info);
654 
655 		txwi = mt76_token_release(mdev, msdu, &wake);
656 		if (!txwi)
657 			continue;
658 
659 		mt7921_txwi_free(dev, txwi, sta, stat, &free_list);
660 	}
661 
662 	if (wake)
663 		mt76_set_tx_blocked(&dev->mt76, false);
664 
665 	list_for_each_entry_safe(skb, tmp, &free_list, list) {
666 		skb_list_del_init(skb);
667 		napi_consume_skb(skb, 1);
668 	}
669 
670 	rcu_read_lock();
671 	mt7921_mac_sta_poll(dev);
672 	rcu_read_unlock();
673 
674 	mt76_worker_schedule(&dev->mt76.tx_worker);
675 }
676 
677 bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
678 {
679 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
680 	__le32 *rxd = (__le32 *)data;
681 	__le32 *end = (__le32 *)&rxd[len / 4];
682 	enum rx_pkt_type type;
683 
684 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
685 
686 	switch (type) {
687 	case PKT_TYPE_TXRX_NOTIFY:
688 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
689 		mt7921_mac_tx_free(dev, data, len); /* mmio */
690 		return false;
691 	case PKT_TYPE_TXS:
692 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
693 			mt7921_mac_add_txs(dev, rxd);
694 		return false;
695 	default:
696 		return true;
697 	}
698 }
699 EXPORT_SYMBOL_GPL(mt7921_rx_check);
700 
701 void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
702 			 struct sk_buff *skb, u32 *info)
703 {
704 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
705 	__le32 *rxd = (__le32 *)skb->data;
706 	__le32 *end = (__le32 *)&skb->data[skb->len];
707 	enum rx_pkt_type type;
708 	u16 flag;
709 
710 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
711 	flag = le32_get_bits(rxd[0], MT_RXD0_PKT_FLAG);
712 
713 	if (type == PKT_TYPE_RX_EVENT && flag == 0x1)
714 		type = PKT_TYPE_NORMAL_MCU;
715 
716 	switch (type) {
717 	case PKT_TYPE_TXRX_NOTIFY:
718 		/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */
719 		mt7921_mac_tx_free(dev, skb->data, skb->len);
720 		napi_consume_skb(skb, 1);
721 		break;
722 	case PKT_TYPE_RX_EVENT:
723 		mt7921_mcu_rx_event(dev, skb);
724 		break;
725 	case PKT_TYPE_TXS:
726 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
727 			mt7921_mac_add_txs(dev, rxd);
728 		dev_kfree_skb(skb);
729 		break;
730 	case PKT_TYPE_NORMAL_MCU:
731 	case PKT_TYPE_NORMAL:
732 		if (!mt7921_mac_fill_rx(dev, skb)) {
733 			mt76_rx(&dev->mt76, q, skb);
734 			return;
735 		}
736 		fallthrough;
737 	default:
738 		dev_kfree_skb(skb);
739 		break;
740 	}
741 }
742 EXPORT_SYMBOL_GPL(mt7921_queue_rx_skb);
743 
744 void mt7921_mac_reset_counters(struct mt7921_phy *phy)
745 {
746 	struct mt7921_dev *dev = phy->dev;
747 	int i;
748 
749 	for (i = 0; i < 4; i++) {
750 		mt76_rr(dev, MT_TX_AGG_CNT(0, i));
751 		mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
752 	}
753 
754 	dev->mt76.phy.survey_time = ktime_get_boottime();
755 	memset(phy->mt76->aggr_stats, 0, sizeof(phy->mt76->aggr_stats));
756 
757 	/* reset airtime counters */
758 	mt76_rr(dev, MT_MIB_SDR9(0));
759 	mt76_rr(dev, MT_MIB_SDR36(0));
760 	mt76_rr(dev, MT_MIB_SDR37(0));
761 
762 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
763 	mt76_set(dev, MT_WF_RMAC_MIB_AIRTIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
764 }
765 
766 void mt7921_mac_set_timing(struct mt7921_phy *phy)
767 {
768 	s16 coverage_class = phy->coverage_class;
769 	struct mt7921_dev *dev = phy->dev;
770 	u32 val, reg_offset;
771 	u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) |
772 		  FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48);
773 	u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) |
774 		   FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28);
775 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
776 	int sifs = is_2ghz ? 10 : 16, offset;
777 
778 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
779 		return;
780 
781 	mt76_set(dev, MT_ARB_SCR(0),
782 		 MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
783 	udelay(1);
784 
785 	offset = 3 * coverage_class;
786 	reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) |
787 		     FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset);
788 
789 	mt76_wr(dev, MT_TMAC_CDTR(0), cck + reg_offset);
790 	mt76_wr(dev, MT_TMAC_ODTR(0), ofdm + reg_offset);
791 	mt76_wr(dev, MT_TMAC_ICR0(0),
792 		FIELD_PREP(MT_IFS_EIFS, 360) |
793 		FIELD_PREP(MT_IFS_RIFS, 2) |
794 		FIELD_PREP(MT_IFS_SIFS, sifs) |
795 		FIELD_PREP(MT_IFS_SLOT, phy->slottime));
796 
797 	if (phy->slottime < 20 || !is_2ghz)
798 		val = MT7921_CFEND_RATE_DEFAULT;
799 	else
800 		val = MT7921_CFEND_RATE_11B;
801 
802 	mt76_rmw_field(dev, MT_AGG_ACR0(0), MT_AGG_ACR_CFEND_RATE, val);
803 	mt76_clear(dev, MT_ARB_SCR(0),
804 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
805 }
806 
807 static u8
808 mt7921_phy_get_nf(struct mt7921_phy *phy, int idx)
809 {
810 	return 0;
811 }
812 
813 static void
814 mt7921_phy_update_channel(struct mt76_phy *mphy, int idx)
815 {
816 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
817 	struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
818 	struct mt76_channel_state *state;
819 	u64 busy_time, tx_time, rx_time, obss_time;
820 	int nf;
821 
822 	busy_time = mt76_get_field(dev, MT_MIB_SDR9(idx),
823 				   MT_MIB_SDR9_BUSY_MASK);
824 	tx_time = mt76_get_field(dev, MT_MIB_SDR36(idx),
825 				 MT_MIB_SDR36_TXTIME_MASK);
826 	rx_time = mt76_get_field(dev, MT_MIB_SDR37(idx),
827 				 MT_MIB_SDR37_RXTIME_MASK);
828 	obss_time = mt76_get_field(dev, MT_WF_RMAC_MIB_AIRTIME14(idx),
829 				   MT_MIB_OBSSTIME_MASK);
830 
831 	nf = mt7921_phy_get_nf(phy, idx);
832 	if (!phy->noise)
833 		phy->noise = nf << 4;
834 	else if (nf)
835 		phy->noise += nf - (phy->noise >> 4);
836 
837 	state = mphy->chan_state;
838 	state->cc_busy += busy_time;
839 	state->cc_tx += tx_time;
840 	state->cc_rx += rx_time + obss_time;
841 	state->cc_bss_rx += rx_time;
842 	state->noise = -(phy->noise >> 4);
843 }
844 
845 void mt7921_update_channel(struct mt76_phy *mphy)
846 {
847 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
848 
849 	if (mt76_connac_pm_wake(mphy, &dev->pm))
850 		return;
851 
852 	mt7921_phy_update_channel(mphy, 0);
853 	/* reset obss airtime */
854 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
855 
856 	mt76_connac_power_save_sched(mphy, &dev->pm);
857 }
858 EXPORT_SYMBOL_GPL(mt7921_update_channel);
859 
860 static void
861 mt7921_vif_connect_iter(void *priv, u8 *mac,
862 			struct ieee80211_vif *vif)
863 {
864 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
865 	struct mt7921_dev *dev = mvif->phy->dev;
866 	struct ieee80211_hw *hw = mt76_hw(dev);
867 
868 	if (vif->type == NL80211_IFTYPE_STATION)
869 		ieee80211_disconnect(vif, true);
870 
871 	mt76_connac_mcu_uni_add_dev(&dev->mphy, vif, &mvif->sta.wcid, true);
872 	mt7921_mcu_set_tx(dev, vif);
873 
874 	if (vif->type == NL80211_IFTYPE_AP) {
875 		mt76_connac_mcu_uni_add_bss(dev->phy.mt76, vif, &mvif->sta.wcid,
876 					    true, NULL);
877 		mt7921_mcu_sta_update(dev, NULL, vif, true,
878 				      MT76_STA_INFO_STATE_NONE);
879 		mt7921_mcu_uni_add_beacon_offload(dev, hw, vif, true);
880 	}
881 }
882 
883 /* system error recovery */
884 void mt7921_mac_reset_work(struct work_struct *work)
885 {
886 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
887 					      reset_work);
888 	struct ieee80211_hw *hw = mt76_hw(dev);
889 	struct mt76_connac_pm *pm = &dev->pm;
890 	int i, ret;
891 
892 	dev_dbg(dev->mt76.dev, "chip reset\n");
893 	dev->hw_full_reset = true;
894 	ieee80211_stop_queues(hw);
895 
896 	cancel_delayed_work_sync(&dev->mphy.mac_work);
897 	cancel_delayed_work_sync(&pm->ps_work);
898 	cancel_work_sync(&pm->wake_work);
899 
900 	for (i = 0; i < 10; i++) {
901 		mutex_lock(&dev->mt76.mutex);
902 		ret = mt7921_dev_reset(dev);
903 		mutex_unlock(&dev->mt76.mutex);
904 
905 		if (!ret)
906 			break;
907 	}
908 
909 	if (i == 10)
910 		dev_err(dev->mt76.dev, "chip reset failed\n");
911 
912 	if (test_and_clear_bit(MT76_HW_SCANNING, &dev->mphy.state)) {
913 		struct cfg80211_scan_info info = {
914 			.aborted = true,
915 		};
916 
917 		ieee80211_scan_completed(dev->mphy.hw, &info);
918 	}
919 
920 	dev->hw_full_reset = false;
921 	pm->suspended = false;
922 	ieee80211_wake_queues(hw);
923 	ieee80211_iterate_active_interfaces(hw,
924 					    IEEE80211_IFACE_ITER_RESUME_ALL,
925 					    mt7921_vif_connect_iter, NULL);
926 	mt76_connac_power_save_sched(&dev->mt76.phy, pm);
927 }
928 
929 void mt7921_reset(struct mt76_dev *mdev)
930 {
931 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
932 	struct mt76_connac_pm *pm = &dev->pm;
933 
934 	if (!dev->hw_init_done)
935 		return;
936 
937 	if (dev->hw_full_reset)
938 		return;
939 
940 	if (pm->suspended)
941 		return;
942 
943 	queue_work(dev->mt76.wq, &dev->reset_work);
944 }
945 EXPORT_SYMBOL_GPL(mt7921_reset);
946 
947 void mt7921_mac_update_mib_stats(struct mt7921_phy *phy)
948 {
949 	struct mt7921_dev *dev = phy->dev;
950 	struct mib_stats *mib = &phy->mib;
951 	int i, aggr0 = 0, aggr1;
952 	u32 val;
953 
954 	mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(0),
955 					   MT_MIB_SDR3_FCS_ERR_MASK);
956 	mib->ack_fail_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR3(0),
957 					    MT_MIB_ACK_FAIL_COUNT_MASK);
958 	mib->ba_miss_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR2(0),
959 					   MT_MIB_BA_FAIL_COUNT_MASK);
960 	mib->rts_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR0(0),
961 				       MT_MIB_RTS_COUNT_MASK);
962 	mib->rts_retries_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR1(0),
963 					       MT_MIB_RTS_FAIL_COUNT_MASK);
964 
965 	mib->tx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR12(0));
966 	mib->tx_mpdu_attempts_cnt += mt76_rr(dev, MT_MIB_SDR14(0));
967 	mib->tx_mpdu_success_cnt += mt76_rr(dev, MT_MIB_SDR15(0));
968 
969 	val = mt76_rr(dev, MT_MIB_SDR32(0));
970 	mib->tx_pkt_ebf_cnt += FIELD_GET(MT_MIB_SDR9_EBF_CNT_MASK, val);
971 	mib->tx_pkt_ibf_cnt += FIELD_GET(MT_MIB_SDR9_IBF_CNT_MASK, val);
972 
973 	val = mt76_rr(dev, MT_ETBF_TX_APP_CNT(0));
974 	mib->tx_bf_ibf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_IBF_CNT, val);
975 	mib->tx_bf_ebf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_EBF_CNT, val);
976 
977 	val = mt76_rr(dev, MT_ETBF_RX_FB_CNT(0));
978 	mib->tx_bf_rx_fb_all_cnt += FIELD_GET(MT_ETBF_RX_FB_ALL, val);
979 	mib->tx_bf_rx_fb_he_cnt += FIELD_GET(MT_ETBF_RX_FB_HE, val);
980 	mib->tx_bf_rx_fb_vht_cnt += FIELD_GET(MT_ETBF_RX_FB_VHT, val);
981 	mib->tx_bf_rx_fb_ht_cnt += FIELD_GET(MT_ETBF_RX_FB_HT, val);
982 
983 	mib->rx_mpdu_cnt += mt76_rr(dev, MT_MIB_SDR5(0));
984 	mib->rx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR22(0));
985 	mib->rx_ampdu_bytes_cnt += mt76_rr(dev, MT_MIB_SDR23(0));
986 	mib->rx_ba_cnt += mt76_rr(dev, MT_MIB_SDR31(0));
987 
988 	for (i = 0; i < ARRAY_SIZE(mib->tx_amsdu); i++) {
989 		val = mt76_rr(dev, MT_PLE_AMSDU_PACK_MSDU_CNT(i));
990 		mib->tx_amsdu[i] += val;
991 		mib->tx_amsdu_cnt += val;
992 	}
993 
994 	for (i = 0, aggr1 = aggr0 + 8; i < 4; i++) {
995 		u32 val2;
996 
997 		val = mt76_rr(dev, MT_TX_AGG_CNT(0, i));
998 		val2 = mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
999 
1000 		phy->mt76->aggr_stats[aggr0++] += val & 0xffff;
1001 		phy->mt76->aggr_stats[aggr0++] += val >> 16;
1002 		phy->mt76->aggr_stats[aggr1++] += val2 & 0xffff;
1003 		phy->mt76->aggr_stats[aggr1++] += val2 >> 16;
1004 	}
1005 }
1006 
1007 void mt7921_mac_work(struct work_struct *work)
1008 {
1009 	struct mt7921_phy *phy;
1010 	struct mt76_phy *mphy;
1011 
1012 	mphy = (struct mt76_phy *)container_of(work, struct mt76_phy,
1013 					       mac_work.work);
1014 	phy = mphy->priv;
1015 
1016 	mt7921_mutex_acquire(phy->dev);
1017 
1018 	mt76_update_survey(mphy);
1019 	if (++mphy->mac_work_count == 2) {
1020 		mphy->mac_work_count = 0;
1021 
1022 		mt7921_mac_update_mib_stats(phy);
1023 	}
1024 
1025 	mt7921_mutex_release(phy->dev);
1026 
1027 	mt76_tx_status_check(mphy->dev, false);
1028 	ieee80211_queue_delayed_work(phy->mt76->hw, &mphy->mac_work,
1029 				     MT7921_WATCHDOG_TIME);
1030 }
1031 
1032 void mt7921_pm_wake_work(struct work_struct *work)
1033 {
1034 	struct mt7921_dev *dev;
1035 	struct mt76_phy *mphy;
1036 
1037 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1038 						pm.wake_work);
1039 	mphy = dev->phy.mt76;
1040 
1041 	if (!mt7921_mcu_drv_pmctrl(dev)) {
1042 		struct mt76_dev *mdev = &dev->mt76;
1043 		int i;
1044 
1045 		if (mt76_is_sdio(mdev)) {
1046 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1047 			mt76_worker_schedule(&mdev->sdio.txrx_worker);
1048 		} else {
1049 			local_bh_disable();
1050 			mt76_for_each_q_rx(mdev, i)
1051 				napi_schedule(&mdev->napi[i]);
1052 			local_bh_enable();
1053 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
1054 			mt76_connac_tx_cleanup(mdev);
1055 		}
1056 		if (test_bit(MT76_STATE_RUNNING, &mphy->state))
1057 			ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
1058 						     MT7921_WATCHDOG_TIME);
1059 	}
1060 
1061 	ieee80211_wake_queues(mphy->hw);
1062 	wake_up(&dev->pm.wait);
1063 }
1064 
1065 void mt7921_pm_power_save_work(struct work_struct *work)
1066 {
1067 	struct mt7921_dev *dev;
1068 	unsigned long delta;
1069 	struct mt76_phy *mphy;
1070 
1071 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1072 						pm.ps_work.work);
1073 	mphy = dev->phy.mt76;
1074 
1075 	delta = dev->pm.idle_timeout;
1076 	if (test_bit(MT76_HW_SCANNING, &mphy->state) ||
1077 	    test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) ||
1078 	    dev->fw_assert)
1079 		goto out;
1080 
1081 	if (mutex_is_locked(&dev->mt76.mutex))
1082 		/* if mt76 mutex is held we should not put the device
1083 		 * to sleep since we are currently accessing device
1084 		 * register map. We need to wait for the next power_save
1085 		 * trigger.
1086 		 */
1087 		goto out;
1088 
1089 	if (time_is_after_jiffies(dev->pm.last_activity + delta)) {
1090 		delta = dev->pm.last_activity + delta - jiffies;
1091 		goto out;
1092 	}
1093 
1094 	if (!mt7921_mcu_fw_pmctrl(dev)) {
1095 		cancel_delayed_work_sync(&mphy->mac_work);
1096 		return;
1097 	}
1098 out:
1099 	queue_delayed_work(dev->mt76.wq, &dev->pm.ps_work, delta);
1100 }
1101 
1102 void mt7921_coredump_work(struct work_struct *work)
1103 {
1104 	struct mt7921_dev *dev;
1105 	char *dump, *data;
1106 
1107 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
1108 						coredump.work.work);
1109 
1110 	if (time_is_after_jiffies(dev->coredump.last_activity +
1111 				  4 * MT76_CONNAC_COREDUMP_TIMEOUT)) {
1112 		queue_delayed_work(dev->mt76.wq, &dev->coredump.work,
1113 				   MT76_CONNAC_COREDUMP_TIMEOUT);
1114 		return;
1115 	}
1116 
1117 	dump = vzalloc(MT76_CONNAC_COREDUMP_SZ);
1118 	data = dump;
1119 
1120 	while (true) {
1121 		struct sk_buff *skb;
1122 
1123 		spin_lock_bh(&dev->mt76.lock);
1124 		skb = __skb_dequeue(&dev->coredump.msg_list);
1125 		spin_unlock_bh(&dev->mt76.lock);
1126 
1127 		if (!skb)
1128 			break;
1129 
1130 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
1131 		if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
1132 			dev_kfree_skb(skb);
1133 			continue;
1134 		}
1135 
1136 		memcpy(data, skb->data, skb->len);
1137 		data += skb->len;
1138 
1139 		dev_kfree_skb(skb);
1140 	}
1141 
1142 	if (dump)
1143 		dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
1144 			      GFP_KERNEL);
1145 
1146 	mt7921_reset(&dev->mt76);
1147 }
1148 
1149 /* usb_sdio */
1150 static void
1151 mt7921_usb_sdio_write_txwi(struct mt7921_dev *dev, struct mt76_wcid *wcid,
1152 			   enum mt76_txq_id qid, struct ieee80211_sta *sta,
1153 			   struct ieee80211_key_conf *key, int pid,
1154 			   struct sk_buff *skb)
1155 {
1156 	__le32 *txwi = (__le32 *)(skb->data - MT_SDIO_TXD_SIZE);
1157 
1158 	memset(txwi, 0, MT_SDIO_TXD_SIZE);
1159 	mt76_connac2_mac_write_txwi(&dev->mt76, txwi, skb, wcid, key, pid, qid, 0);
1160 	skb_push(skb, MT_SDIO_TXD_SIZE);
1161 }
1162 
1163 int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
1164 				   enum mt76_txq_id qid, struct mt76_wcid *wcid,
1165 				   struct ieee80211_sta *sta,
1166 				   struct mt76_tx_info *tx_info)
1167 {
1168 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1169 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
1170 	struct ieee80211_key_conf *key = info->control.hw_key;
1171 	struct sk_buff *skb = tx_info->skb;
1172 	int err, pad, pktid, type;
1173 
1174 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
1175 		return -EINVAL;
1176 
1177 	if (!wcid)
1178 		wcid = &dev->mt76.global_wcid;
1179 
1180 	if (sta) {
1181 		struct mt7921_sta *msta = (struct mt7921_sta *)sta->drv_priv;
1182 
1183 		if (time_after(jiffies, msta->last_txs + HZ / 4)) {
1184 			info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1185 			msta->last_txs = jiffies;
1186 		}
1187 	}
1188 
1189 	pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb);
1190 	mt7921_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);
1191 
1192 	type = mt76_is_sdio(mdev) ? MT7921_SDIO_DATA : 0;
1193 	mt7921_skb_add_usb_sdio_hdr(dev, skb, type);
1194 	pad = round_up(skb->len, 4) - skb->len;
1195 	if (mt76_is_usb(mdev))
1196 		pad += 4;
1197 
1198 	err = mt76_skb_adjust_pad(skb, pad);
1199 	if (err)
1200 		/* Release pktid in case of error. */
1201 		idr_remove(&wcid->pktid, pktid);
1202 
1203 	return err;
1204 }
1205 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_prepare_skb);
1206 
1207 void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,
1208 				     struct mt76_queue_entry *e)
1209 {
1210 	__le32 *txwi = (__le32 *)(e->skb->data + MT_SDIO_HDR_SIZE);
1211 	unsigned int headroom = MT_SDIO_TXD_SIZE + MT_SDIO_HDR_SIZE;
1212 	struct ieee80211_sta *sta;
1213 	struct mt76_wcid *wcid;
1214 	u16 idx;
1215 
1216 	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
1217 	wcid = rcu_dereference(mdev->wcid[idx]);
1218 	sta = wcid_to_sta(wcid);
1219 
1220 	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))
1221 		mt7921_tx_check_aggr(sta, txwi);
1222 
1223 	skb_pull(e->skb, headroom);
1224 	mt76_tx_complete_skb(mdev, e->wcid, e->skb);
1225 }
1226 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_complete_skb);
1227 
1228 bool mt7921_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)
1229 {
1230 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1231 
1232 	mt7921_mutex_acquire(dev);
1233 	mt7921_mac_sta_poll(dev);
1234 	mt7921_mutex_release(dev);
1235 
1236 	return false;
1237 }
1238 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_status_data);
1239 
1240 #if IS_ENABLED(CONFIG_IPV6)
1241 void mt7921_set_ipv6_ns_work(struct work_struct *work)
1242 {
1243 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
1244 						ipv6_ns_work);
1245 	struct sk_buff *skb;
1246 	int ret = 0;
1247 
1248 	do {
1249 		skb = skb_dequeue(&dev->ipv6_ns_list);
1250 
1251 		if (!skb)
1252 			break;
1253 
1254 		mt7921_mutex_acquire(dev);
1255 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1256 					    MCU_UNI_CMD(OFFLOAD), true);
1257 		mt7921_mutex_release(dev);
1258 
1259 	} while (!ret);
1260 
1261 	if (ret)
1262 		skb_queue_purge(&dev->ipv6_ns_list);
1263 }
1264 #endif
1265