tx.c

   1// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
   2/*
   3 * Copyright (C) 2012-2014, 2018-2025 Intel Corporation
   4 * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
   5 * Copyright (C) 2016-2017 Intel Deutschland GmbH
   6 */
   7#include <linux/ieee80211.h>
   8#include <linux/etherdevice.h>
   9#include <linux/tcp.h>
  10#include <net/gso.h>
  11#include <net/ip.h>
  12#include <net/ipv6.h>
  13
  14#include "iwl-trans.h"
  15#include "iwl-nvm-utils.h"
  16#include "iwl-utils.h"
  17#include "mvm.h"
  18#include "sta.h"
  19#include "time-sync.h"
  20
  21static void
  22iwl_mvm_bar_check_trigger(struct iwl_mvm *mvm, const u8 *addr,
  23			  u16 tid, u16 ssn)
  24{
  25	struct iwl_fw_dbg_trigger_tlv *trig;
  26	struct iwl_fw_dbg_trigger_ba *ba_trig;
  27
  28	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, NULL, FW_DBG_TRIGGER_BA);
  29	if (!trig)
  30		return;
  31
  32	ba_trig = (void *)trig->data;
  33
  34	if (!(le16_to_cpu(ba_trig->tx_bar) & BIT(tid)))
  35		return;
  36
  37	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
  38				"BAR sent to %pM, tid %d, ssn %d",
  39				addr, tid, ssn);
  40}
  41
  42#define OPT_HDR(type, skb, off) \
  43	(type *)(skb_network_header(skb) + (off))
  44
  45static u32 iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
  46			   struct ieee80211_tx_info *info,
  47			   bool amsdu)
  48{
  49	struct ieee80211_hdr *hdr = (void *)skb->data;
  50	u16 mh_len = ieee80211_hdrlen(hdr->frame_control);
  51	u16 offload_assist = 0;
  52#if IS_ENABLED(CONFIG_INET)
  53	u8 protocol = 0;
  54
  55	/* Do not compute checksum if already computed */
  56	if (skb->ip_summed != CHECKSUM_PARTIAL)
  57		goto out;
  58
  59	/* We do not expect to be requested to csum stuff we do not support */
  60	if (WARN_ONCE(!(mvm->hw->netdev_features & IWL_TX_CSUM_NETIF_FLAGS) ||
  61		      (skb->protocol != htons(ETH_P_IP) &&
  62		       skb->protocol != htons(ETH_P_IPV6)),
  63		      "No support for requested checksum\n")) {
  64		skb_checksum_help(skb);
  65		goto out;
  66	}
  67
  68	if (skb->protocol == htons(ETH_P_IP)) {
  69		protocol = ip_hdr(skb)->protocol;
  70	} else {
  71#if IS_ENABLED(CONFIG_IPV6)
  72		struct ipv6hdr *ipv6h =
  73			(struct ipv6hdr *)skb_network_header(skb);
  74		unsigned int off = sizeof(*ipv6h);
  75
  76		protocol = ipv6h->nexthdr;
  77		while (protocol != NEXTHDR_NONE && ipv6_ext_hdr(protocol)) {
  78			struct ipv6_opt_hdr *hp;
  79
  80			/* only supported extension headers */
  81			if (protocol != NEXTHDR_ROUTING &&
  82			    protocol != NEXTHDR_HOP &&
  83			    protocol != NEXTHDR_DEST) {
  84				skb_checksum_help(skb);
  85				goto out;
  86			}
  87
  88			hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
  89			protocol = hp->nexthdr;
  90			off += ipv6_optlen(hp);
  91		}
  92		/* if we get here - protocol now should be TCP/UDP */
  93#endif
  94	}
  95
  96	if (protocol != IPPROTO_TCP && protocol != IPPROTO_UDP) {
  97		WARN_ON_ONCE(1);
  98		skb_checksum_help(skb);
  99		goto out;
 100	}
 101
 102	/* enable L4 csum */
 103	offload_assist |= BIT(TX_CMD_OFFLD_L4_EN);
 104
 105	/*
 106	 * Set offset to IP header (snap).
 107	 * We don't support tunneling so no need to take care of inner header.
 108	 * Size is in words.
 109	 */
 110	offload_assist |= (4 << TX_CMD_OFFLD_IP_HDR);
 111
 112	/* Do IPv4 csum for AMSDU only (no IP csum for Ipv6) */
 113	if (skb->protocol == htons(ETH_P_IP) && amsdu) {
 114		ip_hdr(skb)->check = 0;
 115		offload_assist |= BIT(TX_CMD_OFFLD_L3_EN);
 116	}
 117
 118	/* reset UDP/TCP header csum */
 119	if (protocol == IPPROTO_TCP)
 120		tcp_hdr(skb)->check = 0;
 121	else
 122		udp_hdr(skb)->check = 0;
 123
 124out:
 125#endif
 126	/*
 127	 * mac header len should include IV, size is in words unless
 128	 * the IV is added by the firmware like in WEP.
 129	 * In new Tx API, the IV is always added by the firmware.
 130	 */
 131	if (!iwl_mvm_has_new_tx_api(mvm) && info->control.hw_key &&
 132	    info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
 133	    info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP104)
 134		mh_len += info->control.hw_key->iv_len;
 135	mh_len /= 2;
 136	offload_assist |= mh_len << TX_CMD_OFFLD_MH_SIZE;
 137
 138	if (amsdu)
 139		offload_assist |= BIT(TX_CMD_OFFLD_AMSDU);
 140	else if (ieee80211_hdrlen(hdr->frame_control) % 4)
 141		/* padding is inserted later in transport */
 142		offload_assist |= BIT(TX_CMD_OFFLD_PAD);
 143
 144	return offload_assist;
 145}
 146
 147/*
 148 * Sets most of the Tx cmd's fields
 149 */
 150void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
 151			struct iwl_tx_cmd_v6_params *tx_cmd_params,
 152			struct ieee80211_tx_info *info, u8 sta_id)
 153{
 154	struct ieee80211_hdr *hdr = (void *)skb->data;
 155	__le16 fc = hdr->frame_control;
 156	u32 tx_flags = le32_to_cpu(tx_cmd_params->tx_flags);
 157	u32 len = skb->len + FCS_LEN;
 158	bool amsdu = false;
 159	u8 ac;
 160
 161	if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) ||
 162	    (ieee80211_is_probe_resp(fc) &&
 163	     !is_multicast_ether_addr(hdr->addr1)))
 164		tx_flags |= TX_CMD_FLG_ACK;
 165	else
 166		tx_flags &= ~TX_CMD_FLG_ACK;
 167
 168	if (ieee80211_is_probe_resp(fc))
 169		tx_flags |= TX_CMD_FLG_TSF;
 170
 171	if (ieee80211_has_morefrags(fc))
 172		tx_flags |= TX_CMD_FLG_MORE_FRAG;
 173
 174	if (ieee80211_is_data_qos(fc)) {
 175		u8 *qc = ieee80211_get_qos_ctl(hdr);
 176		tx_cmd_params->tid_tspec = qc[0] & 0xf;
 177		tx_flags &= ~TX_CMD_FLG_SEQ_CTL;
 178		amsdu = *qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT;
 179	} else if (ieee80211_is_back_req(fc)) {
 180		struct ieee80211_bar *bar = (void *)skb->data;
 181		u16 control = le16_to_cpu(bar->control);
 182		u16 ssn = le16_to_cpu(bar->start_seq_num);
 183
 184		tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
 185		tx_cmd_params->tid_tspec = (control &
 186				     IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
 187			IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
 188		WARN_ON_ONCE(tx_cmd_params->tid_tspec >= IWL_MAX_TID_COUNT);
 189		iwl_mvm_bar_check_trigger(mvm, bar->ra, tx_cmd_params->tid_tspec,
 190					  ssn);
 191	} else {
 192		if (ieee80211_is_data(fc))
 193			tx_cmd_params->tid_tspec = IWL_TID_NON_QOS;
 194		else
 195			tx_cmd_params->tid_tspec = IWL_MAX_TID_COUNT;
 196
 197		if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
 198			tx_flags |= TX_CMD_FLG_SEQ_CTL;
 199		else
 200			tx_flags &= ~TX_CMD_FLG_SEQ_CTL;
 201	}
 202
 203	/* Default to 0 (BE) when tid_spec is set to IWL_MAX_TID_COUNT */
 204	if (tx_cmd_params->tid_tspec < IWL_MAX_TID_COUNT)
 205		ac = tid_to_mac80211_ac[tx_cmd_params->tid_tspec];
 206	else
 207		ac = tid_to_mac80211_ac[0];
 208
 209	tx_flags |= iwl_mvm_bt_coex_tx_prio(mvm, hdr, info, ac) <<
 210			TX_CMD_FLG_BT_PRIO_POS;
 211
 212	if (ieee80211_is_mgmt(fc)) {
 213		if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
 214			tx_cmd_params->pm_frame_timeout = cpu_to_le16(PM_FRAME_ASSOC);
 215		else if (ieee80211_is_action(fc))
 216			tx_cmd_params->pm_frame_timeout = cpu_to_le16(PM_FRAME_NONE);
 217		else
 218			tx_cmd_params->pm_frame_timeout = cpu_to_le16(PM_FRAME_MGMT);
 219
 220		/* The spec allows Action frames in A-MPDU, we don't support
 221		 * it
 222		 */
 223		WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_AMPDU);
 224	} else if (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO) {
 225		tx_cmd_params->pm_frame_timeout = cpu_to_le16(PM_FRAME_MGMT);
 226	} else {
 227		tx_cmd_params->pm_frame_timeout = cpu_to_le16(PM_FRAME_NONE);
 228	}
 229
 230	if (ieee80211_is_data(fc) && len > mvm->rts_threshold &&
 231	    !is_multicast_ether_addr(hdr->addr1))
 232		tx_flags |= TX_CMD_FLG_PROT_REQUIRE;
 233
 234	if (fw_has_capa(&mvm->fw->ucode_capa,
 235			IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT) &&
 236	    ieee80211_action_contains_tpc(skb))
 237		tx_flags |= TX_CMD_FLG_WRITE_TX_POWER;
 238
 239	tx_cmd_params->tx_flags = cpu_to_le32(tx_flags);
 240	/* Total # bytes to be transmitted - PCIe code will adjust for A-MSDU */
 241	tx_cmd_params->len = cpu_to_le16((u16)skb->len);
 242	tx_cmd_params->life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
 243	tx_cmd_params->sta_id = sta_id;
 244
 245	tx_cmd_params->offload_assist =
 246		cpu_to_le16(iwl_mvm_tx_csum(mvm, skb, info, amsdu));
 247}
 248
 249static u32 iwl_mvm_get_tx_ant(struct iwl_mvm *mvm,
 250			      struct ieee80211_tx_info *info,
 251			      struct ieee80211_sta *sta, __le16 fc)
 252{
 253	if (info->band == NL80211_BAND_2GHZ &&
 254	    !iwl_mvm_bt_coex_is_shared_ant_avail(mvm))
 255		return mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS;
 256
 257	if (sta && ieee80211_is_data(fc)) {
 258		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 259
 260		return BIT(mvmsta->tx_ant) << RATE_MCS_ANT_POS;
 261	}
 262
 263	return BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;
 264}
 265
 266static u32 iwl_mvm_convert_rate_idx(struct iwl_mvm *mvm,
 267				    struct ieee80211_tx_info *info,
 268				    int rate_idx)
 269{
 270	u32 rate_flags = 0;
 271	u8 rate_plcp;
 272	bool is_cck;
 273
 274	/* if the rate isn't a well known legacy rate, take the lowest one */
 275	if (rate_idx < 0 || rate_idx >= IWL_RATE_COUNT_LEGACY)
 276		rate_idx = iwl_mvm_mac_ctxt_get_lowest_rate(mvm,
 277							    info,
 278							    info->control.vif);
 279
 280	/* Get PLCP rate for tx_cmd->rate_n_flags */
 281	rate_plcp = iwl_mvm_mac80211_idx_to_hwrate(mvm->fw, rate_idx);
 282	is_cck = (rate_idx >= IWL_FIRST_CCK_RATE) &&
 283		 (rate_idx <= IWL_LAST_CCK_RATE);
 284
 285	/* Set CCK or OFDM flag */
 286	if (!is_cck)
 287		rate_flags |= RATE_MCS_MOD_TYPE_LEGACY_OFDM;
 288	else
 289		rate_flags |= RATE_MCS_MOD_TYPE_CCK;
 290
 291	return (u32)rate_plcp | rate_flags;
 292}
 293
 294static u32 iwl_mvm_get_inject_tx_rate(struct iwl_mvm *mvm,
 295				      struct ieee80211_tx_info *info,
 296				      struct ieee80211_sta *sta,
 297				      __le16 fc)
 298{
 299	struct ieee80211_tx_rate *rate = &info->control.rates[0];
 300	u32 result;
 301
 302	if (rate->flags & IEEE80211_TX_RC_VHT_MCS) {
 303		u8 mcs = ieee80211_rate_get_vht_mcs(rate);
 304		u8 nss = ieee80211_rate_get_vht_nss(rate);
 305
 306		result = RATE_MCS_MOD_TYPE_VHT;
 307		result |= u32_encode_bits(mcs, RATE_VHT_MCS_RATE_CODE_MSK);
 308		result |= u32_encode_bits(nss, RATE_MCS_NSS_MSK);
 309		if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
 310			result |= RATE_MCS_SGI_MSK;
 311		if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
 312			result |= RATE_MCS_CHAN_WIDTH_40;
 313		else if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
 314			result |= RATE_MCS_CHAN_WIDTH_80;
 315		else if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
 316			result |= RATE_MCS_CHAN_WIDTH_160;
 317	} else if (rate->flags & IEEE80211_TX_RC_MCS) {
 318		result = RATE_MCS_MOD_TYPE_HT;
 319		result |= u32_encode_bits(rate->idx & 0x7,
 320					  RATE_HT_MCS_CODE_MSK);
 321		result |= u32_encode_bits(rate->idx >> 3,
 322					  RATE_MCS_NSS_MSK);
 323		if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
 324			result |= RATE_MCS_SGI_MSK;
 325		if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
 326			result |= RATE_MCS_CHAN_WIDTH_40;
 327		if (info->flags & IEEE80211_TX_CTL_LDPC)
 328			result |= RATE_MCS_LDPC_MSK;
 329		if (u32_get_bits(info->flags, IEEE80211_TX_CTL_STBC))
 330			result |= RATE_MCS_STBC_MSK;
 331	} else {
 332		int rate_idx = info->control.rates[0].idx;
 333
 334		result = iwl_mvm_convert_rate_idx(mvm, info, rate_idx);
 335	}
 336
 337	if (info->control.antennas)
 338		result |= u32_encode_bits(info->control.antennas,
 339					  RATE_MCS_ANT_AB_MSK);
 340	else
 341		result |= iwl_mvm_get_tx_ant(mvm, info, sta, fc);
 342
 343	return result;
 344}
 345
 346static u32 iwl_mvm_get_tx_rate(struct iwl_mvm *mvm,
 347			       struct ieee80211_tx_info *info,
 348			       struct ieee80211_sta *sta, __le16 fc)
 349{
 350	int rate_idx = -1;
 351
 352	if (!ieee80211_hw_check(mvm->hw, HAS_RATE_CONTROL)) {
 353		/* info->control is only relevant for non HW rate control */
 354
 355		/* HT rate doesn't make sense for a non data frame */
 356		WARN_ONCE(info->control.rates[0].flags & IEEE80211_TX_RC_MCS &&
 357			  !ieee80211_is_data(fc),
 358			  "Got a HT rate (flags:0x%x/mcs:%d/fc:0x%x/state:%d) for a non data frame\n",
 359			  info->control.rates[0].flags,
 360			  info->control.rates[0].idx,
 361			  le16_to_cpu(fc),
 362			  sta ? iwl_mvm_sta_from_mac80211(sta)->sta_state : -1);
 363
 364		rate_idx = info->control.rates[0].idx;
 365
 366		/* For non 2 GHZ band, remap mac80211 rate indices into driver
 367		 * indices.
 368		 */
 369		if (info->band != NL80211_BAND_2GHZ ||
 370		    (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
 371			rate_idx += IWL_FIRST_OFDM_RATE;
 372
 373		/* For 2.4 GHZ band, check that there is no need to remap */
 374		BUILD_BUG_ON(IWL_FIRST_CCK_RATE != 0);
 375	}
 376
 377	return iwl_mvm_convert_rate_idx(mvm, info, rate_idx);
 378}
 379
 380static __le32 iwl_mvm_get_tx_rate_n_flags(struct iwl_mvm *mvm,
 381					  struct ieee80211_tx_info *info,
 382					  struct ieee80211_sta *sta, __le16 fc)
 383{
 384	u32 rate;
 385
 386	if (unlikely(info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT))
 387		rate = iwl_mvm_get_inject_tx_rate(mvm, info, sta, fc);
 388	else
 389		rate = iwl_mvm_get_tx_rate(mvm, info, sta, fc) |
 390		       iwl_mvm_get_tx_ant(mvm, info, sta, fc);
 391
 392	return iwl_mvm_v3_rate_to_fw(rate, mvm->fw_rates_ver);
 393}
 394
 395/*
 396 * Sets the fields in the Tx cmd that are rate related
 397 */
 398void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
 399			     struct iwl_tx_cmd_v6_params *tx_cmd_params,
 400			     struct ieee80211_tx_info *info,
 401			     struct ieee80211_sta *sta, __le16 fc)
 402{
 403	/* Set retry limit on RTS packets */
 404	tx_cmd_params->rts_retry_limit = IWL_RTS_DFAULT_RETRY_LIMIT;
 405
 406	/* Set retry limit on DATA packets and Probe Responses*/
 407	if (ieee80211_is_probe_resp(fc)) {
 408		tx_cmd_params->data_retry_limit = IWL_MGMT_DFAULT_RETRY_LIMIT;
 409		tx_cmd_params->rts_retry_limit =
 410			min(tx_cmd_params->data_retry_limit, tx_cmd_params->rts_retry_limit);
 411	} else if (ieee80211_is_back_req(fc)) {
 412		tx_cmd_params->data_retry_limit = IWL_BAR_DFAULT_RETRY_LIMIT;
 413	} else {
 414		tx_cmd_params->data_retry_limit = IWL_DEFAULT_TX_RETRY;
 415	}
 416
 417	/*
 418	 * for data packets, rate info comes from the table inside the fw. This
 419	 * table is controlled by LINK_QUALITY commands
 420	 */
 421
 422	if (likely(ieee80211_is_data(fc) && sta &&
 423		   !(info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT))) {
 424		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 425
 426		if (mvmsta->sta_state >= IEEE80211_STA_AUTHORIZED) {
 427			tx_cmd_params->initial_rate_index = 0;
 428			tx_cmd_params->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE);
 429			return;
 430		}
 431	} else if (ieee80211_is_back_req(fc)) {
 432		tx_cmd_params->tx_flags |=
 433			cpu_to_le32(TX_CMD_FLG_ACK | TX_CMD_FLG_BAR);
 434	}
 435
 436	/* Set the rate in the TX cmd */
 437	tx_cmd_params->rate_n_flags = iwl_mvm_get_tx_rate_n_flags(mvm, info, sta, fc);
 438}
 439
 440static inline void iwl_mvm_set_tx_cmd_pn(struct ieee80211_tx_info *info,
 441					 u8 *crypto_hdr)
 442{
 443	struct ieee80211_key_conf *keyconf = info->control.hw_key;
 444	u64 pn;
 445
 446	pn = atomic64_inc_return(&keyconf->tx_pn);
 447	crypto_hdr[0] = pn;
 448	crypto_hdr[2] = 0;
 449	crypto_hdr[3] = 0x20 | (keyconf->keyidx << 6);
 450	crypto_hdr[1] = pn >> 8;
 451	crypto_hdr[4] = pn >> 16;
 452	crypto_hdr[5] = pn >> 24;
 453	crypto_hdr[6] = pn >> 32;
 454	crypto_hdr[7] = pn >> 40;
 455}
 456
 457/*
 458 * Sets the fields in the Tx cmd that are crypto related
 459 */
 460static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
 461				      struct ieee80211_tx_info *info,
 462				      struct iwl_tx_cmd_v6_params *tx_cmd_params,
 463				      struct sk_buff *skb_frag,
 464				      int hdrlen)
 465{
 466	struct ieee80211_key_conf *keyconf = info->control.hw_key;
 467	u8 *crypto_hdr = skb_frag->data + hdrlen;
 468	enum iwl_tx_cmd_sec_ctrl type = TX_CMD_SEC_CCM;
 469	u64 pn;
 470
 471	switch (keyconf->cipher) {
 472	case WLAN_CIPHER_SUITE_CCMP:
 473		iwl_mvm_set_tx_cmd_ccmp(info, tx_cmd_params);
 474		iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);
 475		break;
 476
 477	case WLAN_CIPHER_SUITE_TKIP:
 478		tx_cmd_params->sec_ctl = TX_CMD_SEC_TKIP;
 479		pn = atomic64_inc_return(&keyconf->tx_pn);
 480		ieee80211_tkip_add_iv(crypto_hdr, keyconf, pn);
 481		ieee80211_get_tkip_p2k(keyconf, skb_frag, tx_cmd_params->key);
 482		break;
 483
 484	case WLAN_CIPHER_SUITE_WEP104:
 485		tx_cmd_params->sec_ctl |= TX_CMD_SEC_KEY128;
 486		fallthrough;
 487	case WLAN_CIPHER_SUITE_WEP40:
 488		tx_cmd_params->sec_ctl |= TX_CMD_SEC_WEP |
 489			((keyconf->keyidx << TX_CMD_SEC_WEP_KEY_IDX_POS) &
 490			  TX_CMD_SEC_WEP_KEY_IDX_MSK);
 491
 492		memcpy(&tx_cmd_params->key[3], keyconf->key, keyconf->keylen);
 493		break;
 494	case WLAN_CIPHER_SUITE_GCMP:
 495	case WLAN_CIPHER_SUITE_GCMP_256:
 496		type = TX_CMD_SEC_GCMP;
 497		fallthrough;
 498	case WLAN_CIPHER_SUITE_CCMP_256:
 499		/* TODO: Taking the key from the table might introduce a race
 500		 * when PTK rekeying is done, having an old packets with a PN
 501		 * based on the old key but the message encrypted with a new
 502		 * one.
 503		 * Need to handle this.
 504		 */
 505		tx_cmd_params->sec_ctl |= type | TX_CMD_SEC_KEY_FROM_TABLE;
 506		tx_cmd_params->key[0] = keyconf->hw_key_idx;
 507		iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);
 508		break;
 509	default:
 510		tx_cmd_params->sec_ctl |= TX_CMD_SEC_EXT;
 511	}
 512}
 513
 514static bool iwl_mvm_use_host_rate(struct iwl_mvm *mvm,
 515				  struct iwl_mvm_sta *mvmsta,
 516				  struct ieee80211_hdr *hdr,
 517				  struct ieee80211_tx_info *info)
 518{
 519	if (unlikely(!mvmsta))
 520		return true;
 521
 522	if (unlikely(info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT))
 523		return true;
 524
 525	if (likely(ieee80211_is_data(hdr->frame_control) &&
 526		   mvmsta->sta_state >= IEEE80211_STA_AUTHORIZED))
 527		return false;
 528
 529	/*
 530	 * Not a data frame, use host rate if on an old device that
 531	 * can't possibly be doing MLO (firmware may be selecting a
 532	 * bad rate), if we might be doing MLO we need to let FW pick
 533	 * (since we don't necesarily know the link), but FW rate
 534	 * selection was fixed.
 535	 */
 536	return mvm->trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_BZ;
 537}
 538
 539static void iwl_mvm_copy_hdr(void *cmd, const void *hdr, int hdrlen,
 540			     const u8 *addr3_override)
 541{
 542	struct ieee80211_hdr *out_hdr = cmd;
 543
 544	memcpy(cmd, hdr, hdrlen);
 545	if (addr3_override)
 546		memcpy(out_hdr->addr3, addr3_override, ETH_ALEN);
 547}
 548
 549/*
 550 * Allocates and sets the Tx cmd the driver data pointers in the skb
 551 */
 552static struct iwl_device_tx_cmd *
 553iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
 554		      struct ieee80211_tx_info *info, int hdrlen,
 555		      struct ieee80211_sta *sta, u8 sta_id,
 556		      const u8 *addr3_override)
 557{
 558	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 559	struct iwl_device_tx_cmd *dev_cmd;
 560	struct iwl_tx_cmd_v6 *tx_cmd;
 561
 562	dev_cmd = iwl_trans_alloc_tx_cmd(mvm->trans);
 563
 564	if (unlikely(!dev_cmd))
 565		return NULL;
 566
 567	dev_cmd->hdr.cmd = TX_CMD;
 568
 569	if (iwl_mvm_has_new_tx_api(mvm)) {
 570		__le32 rate_n_flags = 0;
 571		u16 flags = 0;
 572		struct iwl_mvm_sta *mvmsta = sta ?
 573			iwl_mvm_sta_from_mac80211(sta) : NULL;
 574		bool amsdu = false;
 575
 576		if (ieee80211_is_data_qos(hdr->frame_control)) {
 577			u8 *qc = ieee80211_get_qos_ctl(hdr);
 578
 579			amsdu = *qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT;
 580		}
 581
 582		if (!info->control.hw_key)
 583			flags |= IWL_TX_FLAGS_ENCRYPT_DIS;
 584
 585		/*
 586		 * For data and mgmt packets rate info comes from the fw (for
 587		 * new devices, older FW is somewhat broken for this). Only
 588		 * set rate/antenna for injected frames with fixed rate, or
 589		 * when no sta is given, or with older firmware.
 590		 */
 591		if (unlikely(iwl_mvm_use_host_rate(mvm, mvmsta, hdr, info))) {
 592			flags |= IWL_TX_FLAGS_CMD_RATE;
 593			rate_n_flags =
 594				iwl_mvm_get_tx_rate_n_flags(mvm, info, sta,
 595							    hdr->frame_control);
 596		} else if (!ieee80211_is_data(hdr->frame_control) ||
 597			   mvmsta->sta_state < IEEE80211_STA_AUTHORIZED) {
 598			/* These are important frames */
 599			flags |= IWL_TX_FLAGS_HIGH_PRI;
 600		}
 601
 602		if (mvm->trans->mac_cfg->device_family >=
 603		    IWL_DEVICE_FAMILY_AX210) {
 604			struct iwl_tx_cmd *cmd = (void *)dev_cmd->payload;
 605			u32 offload_assist = iwl_mvm_tx_csum(mvm, skb,
 606							     info, amsdu);
 607
 608			cmd->offload_assist = cpu_to_le32(offload_assist);
 609
 610			/* Total # bytes to be transmitted */
 611			cmd->len = cpu_to_le16((u16)skb->len);
 612
 613			/* Copy MAC header from skb into command buffer */
 614			iwl_mvm_copy_hdr(cmd->hdr, hdr, hdrlen, addr3_override);
 615
 616			cmd->flags = cpu_to_le16(flags);
 617			cmd->rate_n_flags = rate_n_flags;
 618		} else {
 619			struct iwl_tx_cmd_v9 *cmd = (void *)dev_cmd->payload;
 620			u16 offload_assist = iwl_mvm_tx_csum(mvm, skb,
 621							     info, amsdu);
 622
 623			cmd->offload_assist = cpu_to_le16(offload_assist);
 624
 625			/* Total # bytes to be transmitted */
 626			cmd->len = cpu_to_le16((u16)skb->len);
 627
 628			/* Copy MAC header from skb into command buffer */
 629			iwl_mvm_copy_hdr(cmd->hdr, hdr, hdrlen, addr3_override);
 630
 631			cmd->flags = cpu_to_le32(flags);
 632			cmd->rate_n_flags = rate_n_flags;
 633		}
 634		goto out;
 635	}
 636
 637	tx_cmd = (struct iwl_tx_cmd_v6 *)dev_cmd->payload;
 638
 639	if (info->control.hw_key)
 640		iwl_mvm_set_tx_cmd_crypto(mvm, info, &tx_cmd->params, skb, hdrlen);
 641
 642	iwl_mvm_set_tx_cmd(mvm, skb, &tx_cmd->params, info, sta_id);
 643
 644	iwl_mvm_set_tx_cmd_rate(mvm, &tx_cmd->params, info, sta, hdr->frame_control);
 645
 646	/* Copy MAC header from skb into command buffer */
 647	iwl_mvm_copy_hdr(tx_cmd->hdr, hdr, hdrlen, addr3_override);
 648
 649out:
 650	return dev_cmd;
 651}
 652
 653static void iwl_mvm_skb_prepare_status(struct sk_buff *skb,
 654				       struct iwl_device_tx_cmd *cmd)
 655{
 656	struct ieee80211_tx_info *skb_info = IEEE80211_SKB_CB(skb);
 657
 658	memset(&skb_info->status, 0, sizeof(skb_info->status));
 659	memset(skb_info->driver_data, 0, sizeof(skb_info->driver_data));
 660
 661	skb_info->driver_data[1] = cmd;
 662}
 663
 664static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
 665				      struct iwl_mvm_vif_link_info *link,
 666				      struct ieee80211_tx_info *info,
 667				      struct sk_buff *skb)
 668{
 669	struct ieee80211_hdr *hdr = (void *)skb->data;
 670	__le16 fc = hdr->frame_control;
 671
 672	switch (info->control.vif->type) {
 673	case NL80211_IFTYPE_AP:
 674	case NL80211_IFTYPE_ADHOC:
 675		/*
 676		 * Non-bufferable frames use the broadcast station, thus they
 677		 * use the probe queue.
 678		 * Also take care of the case where we send a deauth to a
 679		 * station that we don't have, or similarly an association
 680		 * response (with non-success status) for a station we can't
 681		 * accept.
 682		 * Also, disassociate frames might happen, particular with
 683		 * reason 7 ("Class 3 frame received from nonassociated STA").
 684		 */
 685		if (ieee80211_is_mgmt(fc) &&
 686		    (!ieee80211_is_bufferable_mmpdu(skb) ||
 687		     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
 688			return link->mgmt_queue;
 689
 690		if (!ieee80211_has_order(fc) && !ieee80211_is_probe_req(fc) &&
 691		    is_multicast_ether_addr(hdr->addr1))
 692			return link->cab_queue;
 693
 694		WARN_ONCE(info->control.vif->type != NL80211_IFTYPE_ADHOC,
 695			  "fc=0x%02x", le16_to_cpu(fc));
 696		return link->mgmt_queue;
 697	case NL80211_IFTYPE_P2P_DEVICE:
 698		if (ieee80211_is_mgmt(fc))
 699			return mvm->p2p_dev_queue;
 700
 701		WARN_ON_ONCE(1);
 702		return mvm->p2p_dev_queue;
 703	default:
 704		WARN_ONCE(1, "Not a ctrl vif, no available queue\n");
 705		return -1;
 706	}
 707}
 708
 709static void iwl_mvm_probe_resp_set_noa(struct iwl_mvm *mvm,
 710				       struct sk_buff *skb)
 711{
 712	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 713	struct iwl_mvm_vif *mvmvif =
 714		iwl_mvm_vif_from_mac80211(info->control.vif);
 715	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 716	int base_len = (u8 *)mgmt->u.probe_resp.variable - (u8 *)mgmt;
 717	struct iwl_probe_resp_data *resp_data;
 718	const u8 *ie;
 719	u8 *pos;
 720	u8 match[] = {
 721		(WLAN_OUI_WFA >> 16) & 0xff,
 722		(WLAN_OUI_WFA >> 8) & 0xff,
 723		WLAN_OUI_WFA & 0xff,
 724		WLAN_OUI_TYPE_WFA_P2P,
 725	};
 726
 727	rcu_read_lock();
 728
 729	resp_data = rcu_dereference(mvmvif->deflink.probe_resp_data);
 730	if (!resp_data)
 731		goto out;
 732
 733	if (!resp_data->notif.noa_active)
 734		goto out;
 735
 736	ie = cfg80211_find_ie_match(WLAN_EID_VENDOR_SPECIFIC,
 737				    mgmt->u.probe_resp.variable,
 738				    skb->len - base_len,
 739				    match, 4, 2);
 740	if (!ie) {
 741		IWL_DEBUG_TX(mvm, "probe resp doesn't have P2P IE\n");
 742		goto out;
 743	}
 744
 745	if (skb_tailroom(skb) < resp_data->noa_len) {
 746		if (pskb_expand_head(skb, 0, resp_data->noa_len, GFP_ATOMIC)) {
 747			IWL_ERR(mvm,
 748				"Failed to reallocate probe resp\n");
 749			goto out;
 750		}
 751	}
 752
 753	pos = skb_put(skb, resp_data->noa_len);
 754
 755	*pos++ = WLAN_EID_VENDOR_SPECIFIC;
 756	/* Set length of IE body (not including ID and length itself) */
 757	*pos++ = resp_data->noa_len - 2;
 758	*pos++ = (WLAN_OUI_WFA >> 16) & 0xff;
 759	*pos++ = (WLAN_OUI_WFA >> 8) & 0xff;
 760	*pos++ = WLAN_OUI_WFA & 0xff;
 761	*pos++ = WLAN_OUI_TYPE_WFA_P2P;
 762
 763	memcpy(pos, &resp_data->notif.noa_attr,
 764	       resp_data->noa_len - sizeof(struct ieee80211_vendor_ie));
 765
 766out:
 767	rcu_read_unlock();
 768}
 769
 770int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
 771{
 772	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 773	struct ieee80211_tx_info info;
 774	struct iwl_device_tx_cmd *dev_cmd;
 775	u8 sta_id;
 776	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 777	__le16 fc = hdr->frame_control;
 778	bool offchannel = IEEE80211_SKB_CB(skb)->flags &
 779		IEEE80211_TX_CTL_TX_OFFCHAN;
 780	int queue = -1;
 781
 782	if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))
 783		return -1;
 784
 785	memcpy(&info, skb->cb, sizeof(info));
 786
 787	if (WARN_ON_ONCE(skb->len > IEEE80211_MAX_DATA_LEN + hdrlen))
 788		return -1;
 789
 790	if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
 791		return -1;
 792
 793	if (info.control.vif) {
 794		struct iwl_mvm_vif *mvmvif =
 795			iwl_mvm_vif_from_mac80211(info.control.vif);
 796		bool p2p_aux = iwl_mvm_has_p2p_over_aux(mvm);
 797
 798		if ((info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE &&
 799		     p2p_aux) ||
 800		    (info.control.vif->type == NL80211_IFTYPE_STATION &&
 801		     offchannel)) {
 802			/*
 803			 * IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets
 804			 * that can be used in 2 different types of vifs, P2P
 805			 * Device and STATION.
 806			 * P2P Device uses the offchannel queue.
 807			 * STATION (HS2.0) uses the auxiliary context of the FW,
 808			 * and hence needs to be sent on the aux queue.
 809			 * If P2P_DEV_OVER_AUX is supported (p2p_aux = true)
 810			 * also P2P Device uses the aux queue.
 811			 */
 812			sta_id = mvm->aux_sta.sta_id;
 813			queue = mvm->aux_queue;
 814			if (WARN_ON(queue == IWL_MVM_INVALID_QUEUE))
 815				return -1;
 816		} else if (info.control.vif->type ==
 817			   NL80211_IFTYPE_P2P_DEVICE ||
 818			   info.control.vif->type == NL80211_IFTYPE_AP ||
 819			   info.control.vif->type == NL80211_IFTYPE_ADHOC) {
 820			u32 link_id = u32_get_bits(info.control.flags,
 821						   IEEE80211_TX_CTRL_MLO_LINK);
 822			struct iwl_mvm_vif_link_info *link;
 823
 824			if (link_id == IEEE80211_LINK_UNSPECIFIED) {
 825				if (info.control.vif->active_links)
 826					link_id = ffs(info.control.vif->active_links) - 1;
 827				else
 828					link_id = 0;
 829			}
 830
 831			link = mvmvif->link[link_id];
 832			if (WARN_ON(!link))
 833				return -1;
 834
 835			if (!ieee80211_is_data(hdr->frame_control))
 836				sta_id = link->bcast_sta.sta_id;
 837			else
 838				sta_id = link->mcast_sta.sta_id;
 839
 840			queue = iwl_mvm_get_ctrl_vif_queue(mvm, link, &info,
 841							   skb);
 842		} else if (info.control.vif->type == NL80211_IFTYPE_MONITOR) {
 843			queue = mvm->snif_queue;
 844			sta_id = mvm->snif_sta.sta_id;
 845		}
 846	}
 847
 848	if (queue < 0) {
 849		IWL_ERR(mvm, "No queue was found. Dropping TX\n");
 850		return -1;
 851	}
 852
 853	if (unlikely(ieee80211_is_probe_resp(fc)))
 854		iwl_mvm_probe_resp_set_noa(mvm, skb);
 855
 856	IWL_DEBUG_TX(mvm, "station Id %d, queue=%d\n", sta_id, queue);
 857
 858	dev_cmd = iwl_mvm_set_tx_params(mvm, skb, &info, hdrlen, NULL, sta_id,
 859					NULL);
 860	if (!dev_cmd)
 861		return -1;
 862
 863	/* From now on, we cannot access info->control */
 864	iwl_mvm_skb_prepare_status(skb, dev_cmd);
 865
 866	if (iwl_trans_tx(mvm->trans, skb, dev_cmd, queue)) {
 867		iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);
 868		return -1;
 869	}
 870
 871	return 0;
 872}
 873
 874unsigned int iwl_mvm_max_amsdu_size(struct iwl_mvm *mvm,
 875				    struct ieee80211_sta *sta, unsigned int tid)
 876{
 877	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 878	u8 ac = tid_to_mac80211_ac[tid];
 879	enum nl80211_band band;
 880	unsigned int txf;
 881	unsigned int val;
 882	int lmac;
 883
 884	/* For HE redirect to trigger based fifos */
 885	if (sta->deflink.he_cap.has_he && !WARN_ON(!iwl_mvm_has_new_tx_api(mvm)))
 886		ac += 4;
 887
 888	txf = iwl_mvm_mac_ac_to_tx_fifo(mvm, ac);
 889
 890	/*
 891	 * Don't send an AMSDU that will be longer than the TXF.
 892	 * Add a security margin of 256 for the TX command + headers.
 893	 * We also want to have the start of the next packet inside the
 894	 * fifo to be able to send bursts.
 895	 */
 896	val = mvmsta->max_amsdu_len;
 897
 898	if (hweight16(sta->valid_links) <= 1) {
 899		if (sta->valid_links) {
 900			struct ieee80211_bss_conf *link_conf;
 901			unsigned int link = ffs(sta->valid_links) - 1;
 902
 903			rcu_read_lock();
 904			link_conf = rcu_dereference(mvmsta->vif->link_conf[link]);
 905			if (WARN_ON(!link_conf))
 906				band = NL80211_BAND_2GHZ;
 907			else
 908				band = link_conf->chanreq.oper.chan->band;
 909			rcu_read_unlock();
 910		} else {
 911			band = mvmsta->vif->bss_conf.chanreq.oper.chan->band;
 912		}
 913
 914		lmac = iwl_mvm_get_lmac_id(mvm, band);
 915	} else if (fw_has_capa(&mvm->fw->ucode_capa,
 916			       IWL_UCODE_TLV_CAPA_CDB_SUPPORT)) {
 917		/* for real MLO restrict to both LMACs if they exist */
 918		lmac = IWL_LMAC_5G_INDEX;
 919		val = min_t(unsigned int, val,
 920			    mvm->fwrt.smem_cfg.lmac[lmac].txfifo_size[txf] - 256);
 921		lmac = IWL_LMAC_24G_INDEX;
 922	} else {
 923		lmac = IWL_LMAC_24G_INDEX;
 924	}
 925
 926	return min_t(unsigned int, val,
 927		     mvm->fwrt.smem_cfg.lmac[lmac].txfifo_size[txf] - 256);
 928}
 929
 930#ifdef CONFIG_INET
 931
 932static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
 933			  struct ieee80211_tx_info *info,
 934			  struct ieee80211_sta *sta,
 935			  struct sk_buff_head *mpdus_skb)
 936{
 937	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 938	struct ieee80211_hdr *hdr = (void *)skb->data;
 939	unsigned int mss = skb_shinfo(skb)->gso_size;
 940	unsigned int num_subframes, tcp_payload_len, subf_len, max_amsdu_len;
 941	u16 snap_ip_tcp, pad;
 942	netdev_features_t netdev_flags = NETIF_F_CSUM_MASK | NETIF_F_SG;
 943	u8 tid;
 944
 945	snap_ip_tcp = 8 + skb_network_header_len(skb) + tcp_hdrlen(skb);
 946
 947	if (!mvmsta->max_amsdu_len ||
 948	    !ieee80211_is_data_qos(hdr->frame_control) ||
 949	    !mvmsta->amsdu_enabled)
 950		return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);
 951
 952	/*
 953	 * Do not build AMSDU for IPv6 with extension headers.
 954	 * ask stack to segment and checkum the generated MPDUs for us.
 955	 */
 956	if (skb->protocol == htons(ETH_P_IPV6) &&
 957	    ((struct ipv6hdr *)skb_network_header(skb))->nexthdr !=
 958	    IPPROTO_TCP) {
 959		netdev_flags &= ~NETIF_F_CSUM_MASK;
 960		return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);
 961	}
 962
 963	tid = ieee80211_get_tid(hdr);
 964	if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
 965		return -EINVAL;
 966
 967	/*
 968	 * No need to lock amsdu_in_ampdu_allowed since it can't be modified
 969	 * during an BA session.
 970	 */
 971	if ((info->flags & IEEE80211_TX_CTL_AMPDU &&
 972	     !mvmsta->tid_data[tid].amsdu_in_ampdu_allowed) ||
 973	    !(mvmsta->amsdu_enabled & BIT(tid)))
 974		return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);
 975
 976	/*
 977	 * Take the min of ieee80211 station and mvm station
 978	 */
 979	max_amsdu_len =
 980		min_t(unsigned int, sta->cur->max_amsdu_len,
 981		      iwl_mvm_max_amsdu_size(mvm, sta, tid));
 982
 983	/*
 984	 * Limit A-MSDU in A-MPDU to 4095 bytes when VHT is not
 985	 * supported. This is a spec requirement (IEEE 802.11-2015
 986	 * section 8.7.3 NOTE 3).
 987	 */
 988	if (info->flags & IEEE80211_TX_CTL_AMPDU &&
 989	    !sta->deflink.vht_cap.vht_supported)
 990		max_amsdu_len = min_t(unsigned int, max_amsdu_len, 4095);
 991
 992	/* Sub frame header + SNAP + IP header + TCP header + MSS */
 993	subf_len = sizeof(struct ethhdr) + snap_ip_tcp + mss;
 994	pad = (4 - subf_len) & 0x3;
 995
 996	/*
 997	 * If we have N subframes in the A-MSDU, then the A-MSDU's size is
 998	 * N * subf_len + (N - 1) * pad.
 999	 */
1000	num_subframes = (max_amsdu_len + pad) / (subf_len + pad);
1001
1002	if (sta->max_amsdu_subframes &&
1003	    num_subframes > sta->max_amsdu_subframes)
1004		num_subframes = sta->max_amsdu_subframes;
1005
1006	tcp_payload_len = skb_tail_pointer(skb) - skb_transport_header(skb) -
1007		tcp_hdrlen(skb) + skb->data_len;
1008
1009	/*
1010	 * Make sure we have enough TBs for the A-MSDU:
1011	 *	2 for each subframe
1012	 *	1 more for each fragment
1013	 *	1 more for the potential data in the header
1014	 */
1015	if ((num_subframes * 2 + skb_shinfo(skb)->nr_frags + 1) >
1016	    mvm->trans->info.max_skb_frags)
1017		num_subframes = 1;
1018
1019	if (num_subframes > 1)
1020		*ieee80211_get_qos_ctl(hdr) |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
1021
1022	/* This skb fits in one single A-MSDU */
1023	if (num_subframes * mss >= tcp_payload_len) {
1024		__skb_queue_tail(mpdus_skb, skb);
1025		return 0;
1026	}
1027
1028	/*
1029	 * Trick the segmentation function to make it
1030	 * create SKBs that can fit into one A-MSDU.
1031	 */
1032	return iwl_tx_tso_segment(skb, num_subframes, netdev_flags, mpdus_skb);
1033}
1034#else /* CONFIG_INET */
1035static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
1036			  struct ieee80211_tx_info *info,
1037			  struct ieee80211_sta *sta,
1038			  struct sk_buff_head *mpdus_skb)
1039{
1040	/* Impossible to get TSO with CONFIG_INET */
1041	WARN_ON(1);
1042
1043	return -1;
1044}
1045#endif
1046
1047/* Check if there are any timed-out TIDs on a given shared TXQ */
1048static bool iwl_mvm_txq_should_update(struct iwl_mvm *mvm, int txq_id)
1049{
1050	unsigned long queue_tid_bitmap = mvm->queue_info[txq_id].tid_bitmap;
1051	unsigned long now = jiffies;
1052	int tid;
1053
1054	if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
1055		return false;
1056
1057	for_each_set_bit(tid, &queue_tid_bitmap, IWL_MAX_TID_COUNT + 1) {
1058		if (time_before(mvm->queue_info[txq_id].last_frame_time[tid] +
1059				IWL_MVM_DQA_QUEUE_TIMEOUT, now))
1060			return true;
1061	}
1062
1063	return false;
1064}
1065
1066static void iwl_mvm_tx_airtime(struct iwl_mvm *mvm,
1067			       struct iwl_mvm_sta *mvmsta,
1068			       int airtime)
1069{
1070	int mac = mvmsta->mac_id_n_color & FW_CTXT_ID_MSK;
1071	struct iwl_mvm_tcm_mac *mdata;
1072
1073	if (mac >= NUM_MAC_INDEX_DRIVER)
1074		return;
1075
1076	mdata = &mvm->tcm.data[mac];
1077
1078	if (mvm->tcm.paused)
1079		return;
1080
1081	if (time_after(jiffies, mvm->tcm.ts + MVM_TCM_PERIOD))
1082		schedule_delayed_work(&mvm->tcm.work, 0);
1083
1084	mdata->tx.airtime += airtime;
1085}
1086
1087static int iwl_mvm_tx_pkt_queued(struct iwl_mvm *mvm,
1088				 struct iwl_mvm_sta *mvmsta, int tid)
1089{
1090	u32 ac = tid_to_mac80211_ac[tid];
1091	int mac = mvmsta->mac_id_n_color & FW_CTXT_ID_MSK;
1092	struct iwl_mvm_tcm_mac *mdata;
1093
1094	if (mac >= NUM_MAC_INDEX_DRIVER)
1095		return -EINVAL;
1096
1097	mdata = &mvm->tcm.data[mac];
1098
1099	mdata->tx.pkts[ac]++;
1100
1101	return 0;
1102}
1103
1104/*
1105 * Sets the fields in the Tx cmd that are crypto related.
1106 *
1107 * This function must be called with BHs disabled.
1108 */
1109static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
1110			   struct ieee80211_tx_info *info,
1111			   struct ieee80211_sta *sta,
1112			   const u8 *addr3_override)
1113{
1114	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1115	struct iwl_mvm_sta *mvmsta;
1116	struct iwl_device_tx_cmd *dev_cmd;
1117	__le16 fc;
1118	u16 seq_number = 0;
1119	u8 tid = IWL_MAX_TID_COUNT;
1120	u16 txq_id;
1121	bool is_ampdu = false;
1122	int hdrlen;
1123
1124	if (WARN_ON_ONCE(!sta))
1125		return -1;
1126
1127	mvmsta = iwl_mvm_sta_from_mac80211(sta);
1128	fc = hdr->frame_control;
1129	hdrlen = ieee80211_hdrlen(fc);
1130
1131	if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))
1132		return -1;
1133
1134	if (WARN_ON_ONCE(mvmsta->deflink.sta_id == IWL_INVALID_STA))
1135		return -1;
1136
1137	if (unlikely(ieee80211_is_any_nullfunc(fc)) && sta->deflink.he_cap.has_he)
1138		return -1;
1139
1140	if (unlikely(ieee80211_is_probe_resp(fc)))
1141		iwl_mvm_probe_resp_set_noa(mvm, skb);
1142
1143	dev_cmd = iwl_mvm_set_tx_params(mvm, skb, info, hdrlen,
1144					sta, mvmsta->deflink.sta_id,
1145					addr3_override);
1146	if (!dev_cmd)
1147		goto drop;
1148
1149	/*
1150	 * we handle that entirely ourselves -- for uAPSD the firmware
1151	 * will always send a notification, and for PS-Poll responses
1152	 * we'll notify mac80211 when getting frame status
1153	 */
1154	info->flags &= ~IEEE80211_TX_STATUS_EOSP;
1155
1156	spin_lock(&mvmsta->lock);
1157
1158	/* nullfunc frames should go to the MGMT queue regardless of QOS,
1159	 * the conditions of !ieee80211_is_qos_nullfunc(fc) and
1160	 * !ieee80211_is_data_qos(fc) keep the default assignment of MGMT TID
1161	 */
1162	if (ieee80211_is_data_qos(fc) && !ieee80211_is_qos_nullfunc(fc)) {
1163		tid = ieee80211_get_tid(hdr);
1164		if (WARN_ONCE(tid >= IWL_MAX_TID_COUNT, "Invalid TID %d", tid))
1165			goto drop_unlock_sta;
1166
1167		is_ampdu = info->flags & IEEE80211_TX_CTL_AMPDU;
1168		if (WARN_ONCE(is_ampdu &&
1169			      mvmsta->tid_data[tid].state != IWL_AGG_ON,
1170			      "Invalid internal agg state %d for TID %d",
1171			       mvmsta->tid_data[tid].state, tid))
1172			goto drop_unlock_sta;
1173
1174		seq_number = mvmsta->tid_data[tid].seq_number;
1175		seq_number &= IEEE80211_SCTL_SEQ;
1176
1177		if (!iwl_mvm_has_new_tx_api(mvm)) {
1178			struct iwl_tx_cmd_v6 *tx_cmd = (void *)dev_cmd->payload;
1179
1180			hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
1181			hdr->seq_ctrl |= cpu_to_le16(seq_number);
1182			/* update the tx_cmd hdr as it was already copied */
1183			tx_cmd->hdr->seq_ctrl = hdr->seq_ctrl;
1184		}
1185	} else if (ieee80211_is_data(fc) && !ieee80211_is_data_qos(fc) &&
1186		   !ieee80211_is_nullfunc(fc)) {
1187		tid = IWL_TID_NON_QOS;
1188	}
1189
1190	txq_id = mvmsta->tid_data[tid].txq_id;
1191
1192	WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM);
1193
1194	if (WARN_ONCE(txq_id == IWL_MVM_INVALID_QUEUE, "Invalid TXQ id")) {
1195		iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);
1196		spin_unlock(&mvmsta->lock);
1197		return -1;
1198	}
1199
1200	if (!iwl_mvm_has_new_tx_api(mvm)) {
1201		/* Keep track of the time of the last frame for this RA/TID */
1202		mvm->queue_info[txq_id].last_frame_time[tid] = jiffies;
1203
1204		/*
1205		 * If we have timed-out TIDs - schedule the worker that will
1206		 * reconfig the queues and update them
1207		 *
1208		 * Note that the no lock is taken here in order to not serialize
1209		 * the TX flow. This isn't dangerous because scheduling
1210		 * mvm->add_stream_wk can't ruin the state, and if we DON'T
1211		 * schedule it due to some race condition then next TX we get
1212		 * here we will.
1213		 */
1214		if (unlikely(mvm->queue_info[txq_id].status ==
1215			     IWL_MVM_QUEUE_SHARED &&
1216			     iwl_mvm_txq_should_update(mvm, txq_id)))
1217			schedule_work(&mvm->add_stream_wk);
1218	}
1219
1220	IWL_DEBUG_TX(mvm, "TX to [%d|%d] Q:%d - seq: 0x%x len %d\n",
1221		     mvmsta->deflink.sta_id, tid, txq_id,
1222		     IEEE80211_SEQ_TO_SN(seq_number), skb->len);
1223
1224	/* From now on, we cannot access info->control */
1225	iwl_mvm_skb_prepare_status(skb, dev_cmd);
1226
1227	/*
1228	 * The IV is introduced by the HW for new tx api, and it is not present
1229	 * in the skb, hence, don't tell iwl_mvm_mei_tx_copy_to_csme about the
1230	 * IV for those devices.
1231	 */
1232	if (ieee80211_is_data(fc))
1233		iwl_mvm_mei_tx_copy_to_csme(mvm, skb,
1234					    info->control.hw_key &&
1235					    !iwl_mvm_has_new_tx_api(mvm) ?
1236					    info->control.hw_key->iv_len : 0);
1237
1238	if (iwl_trans_tx(mvm->trans, skb, dev_cmd, txq_id))
1239		goto drop_unlock_sta;
1240
1241	if (tid < IWL_MAX_TID_COUNT && !ieee80211_has_morefrags(fc))
1242		mvmsta->tid_data[tid].seq_number = seq_number + 0x10;
1243
1244	spin_unlock(&mvmsta->lock);
1245
1246	if (iwl_mvm_tx_pkt_queued(mvm, mvmsta,
1247				  tid == IWL_MAX_TID_COUNT ? 0 : tid))
1248		goto drop;
1249
1250	return 0;
1251
1252drop_unlock_sta:
1253	iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);
1254	spin_unlock(&mvmsta->lock);
1255drop:
1256	IWL_DEBUG_TX(mvm, "TX to [%d|%d] dropped\n", mvmsta->deflink.sta_id,
1257		     tid);
1258	return -1;
1259}
1260
1261int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,
1262		       struct ieee80211_sta *sta)
1263{
1264	struct iwl_mvm_sta *mvmsta;
1265	struct ieee80211_tx_info info;
1266	struct sk_buff_head mpdus_skbs;
1267	struct ieee80211_vif *vif;
1268	unsigned int payload_len;
1269	int ret;
1270	struct sk_buff *orig_skb = skb;
1271	const u8 *addr3;
1272
1273	if (WARN_ON_ONCE(!sta))
1274		return -1;
1275
1276	mvmsta = iwl_mvm_sta_from_mac80211(sta);
1277
1278	if (WARN_ON_ONCE(mvmsta->deflink.sta_id == IWL_INVALID_STA))
1279		return -1;
1280
1281	memcpy(&info, skb->cb, sizeof(info));
1282
1283	if (!skb_is_gso(skb))
1284		return iwl_mvm_tx_mpdu(mvm, skb, &info, sta, NULL);
1285
1286	payload_len = skb_tail_pointer(skb) - skb_transport_header(skb) -
1287		tcp_hdrlen(skb) + skb->data_len;
1288
1289	if (payload_len <= skb_shinfo(skb)->gso_size)
1290		return iwl_mvm_tx_mpdu(mvm, skb, &info, sta, NULL);
1291
1292	__skb_queue_head_init(&mpdus_skbs);
1293
1294	vif = info.control.vif;
1295	if (!vif)
1296		return -1;
1297
1298	ret = iwl_mvm_tx_tso(mvm, skb, &info, sta, &mpdus_skbs);
1299	if (ret)
1300		return ret;
1301
1302	WARN_ON(skb_queue_empty(&mpdus_skbs));
1303
1304	/*
1305	 * As described in IEEE sta 802.11-2020, table 9-30 (Address
1306	 * field contents), A-MSDU address 3 should contain the BSSID
1307	 * address.
1308	 * Pass address 3 down to iwl_mvm_tx_mpdu() and further to set it
1309	 * in the command header. We need to preserve the original
1310	 * address 3 in the skb header to correctly create all the
1311	 * A-MSDU subframe headers from it.
1312	 */
1313	switch (vif->type) {
1314	case NL80211_IFTYPE_STATION:
1315		addr3 = vif->cfg.ap_addr;
1316		break;
1317	case NL80211_IFTYPE_AP:
1318		addr3 = vif->addr;
1319		break;
1320	default:
1321		addr3 = NULL;
1322		break;
1323	}
1324
1325	while (!skb_queue_empty(&mpdus_skbs)) {
1326		struct ieee80211_hdr *hdr;
1327		bool amsdu;
1328
1329		skb = __skb_dequeue(&mpdus_skbs);
1330		hdr = (void *)skb->data;
1331		amsdu = ieee80211_is_data_qos(hdr->frame_control) &&
1332			(*ieee80211_get_qos_ctl(hdr) &
1333			 IEEE80211_QOS_CTL_A_MSDU_PRESENT);
1334
1335		ret = iwl_mvm_tx_mpdu(mvm, skb, &info, sta,
1336				      amsdu ? addr3 : NULL);
1337		if (ret) {
1338			/* Free skbs created as part of TSO logic that have not yet been dequeued */
1339			__skb_queue_purge(&mpdus_skbs);
1340			/* skb here is not necessarily same as skb that entered this method,
1341			 * so free it explicitly.
1342			 */
1343			if (skb == orig_skb)
1344				ieee80211_free_txskb(mvm->hw, skb);
1345			else
1346				kfree_skb(skb);
1347			/* there was error, but we consumed skb one way or another, so return 0 */
1348			return 0;
1349		}
1350	}
1351
1352	return 0;
1353}
1354
1355static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,
1356				      struct ieee80211_sta *sta, u8 tid)
1357{
1358	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1359	struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
1360	struct ieee80211_vif *vif = mvmsta->vif;
1361	u16 normalized_ssn;
1362
1363	lockdep_assert_held(&mvmsta->lock);
1364
1365	if (tid_data->state == IWL_AGG_ON &&
1366	    iwl_mvm_tid_queued(mvm, tid_data) == 0) {
1367		/*
1368		 * Now that this aggregation or DQA queue is empty tell
1369		 * mac80211 so it knows we no longer have frames buffered for
1370		 * the station on this TID (for the TIM bitmap calculation.)
1371		 */
1372		ieee80211_sta_set_buffered(sta, tid, false);
1373	}
1374
1375	/*
1376	 * In 22000 HW, the next_reclaimed index is only 8 bit, so we'll need
1377	 * to align the wrap around of ssn so we compare relevant values.
1378	 */
1379	normalized_ssn = tid_data->ssn;
1380	if (mvm->trans->mac_cfg->gen2)
1381		normalized_ssn &= 0xff;
1382
1383	if (normalized_ssn != tid_data->next_reclaimed)
1384		return;
1385
1386	switch (tid_data->state) {
1387	case IWL_EMPTYING_HW_QUEUE_ADDBA:
1388		IWL_DEBUG_TX_QUEUES(mvm,
1389				    "Can continue addBA flow ssn = next_recl = %d\n",
1390				    tid_data->next_reclaimed);
1391		tid_data->state = IWL_AGG_STARTING;
1392		ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1393		break;
1394	default:
1395		break;
1396	}
1397}
1398
1399#ifdef CONFIG_IWLWIFI_DEBUG
1400const char *iwl_mvm_get_tx_fail_reason(u32 status)
1401{
1402#define TX_STATUS_FAIL(x) case TX_STATUS_FAIL_ ## x: return #x
1403#define TX_STATUS_POSTPONE(x) case TX_STATUS_POSTPONE_ ## x: return #x
1404
1405	switch (status & TX_STATUS_MSK) {
1406	case TX_STATUS_SUCCESS:
1407		return "SUCCESS";
1408	TX_STATUS_POSTPONE(DELAY);
1409	TX_STATUS_POSTPONE(FEW_BYTES);
1410	TX_STATUS_POSTPONE(BT_PRIO);
1411	TX_STATUS_POSTPONE(QUIET_PERIOD);
1412	TX_STATUS_POSTPONE(CALC_TTAK);
1413	TX_STATUS_FAIL(INTERNAL_CROSSED_RETRY);
1414	TX_STATUS_FAIL(SHORT_LIMIT);
1415	TX_STATUS_FAIL(LONG_LIMIT);
1416	TX_STATUS_FAIL(UNDERRUN);
1417	TX_STATUS_FAIL(DRAIN_FLOW);
1418	TX_STATUS_FAIL(RFKILL_FLUSH);
1419	TX_STATUS_FAIL(LIFE_EXPIRE);
1420	TX_STATUS_FAIL(DEST_PS);
1421	TX_STATUS_FAIL(HOST_ABORTED);
1422	TX_STATUS_FAIL(BT_RETRY);
1423	TX_STATUS_FAIL(STA_INVALID);
1424	TX_STATUS_FAIL(FRAG_DROPPED);
1425	TX_STATUS_FAIL(TID_DISABLE);
1426	TX_STATUS_FAIL(FIFO_FLUSHED);
1427	TX_STATUS_FAIL(SMALL_CF_POLL);
1428	TX_STATUS_FAIL(FW_DROP);
1429	TX_STATUS_FAIL(STA_COLOR_MISMATCH);
1430	}
1431
1432	return "UNKNOWN";
1433
1434#undef TX_STATUS_FAIL
1435#undef TX_STATUS_POSTPONE
1436}
1437#endif /* CONFIG_IWLWIFI_DEBUG */
1438
1439static int iwl_mvm_get_hwrate_chan_width(u32 chan_width)
1440{
1441	switch (chan_width) {
1442	case RATE_MCS_CHAN_WIDTH_20:
1443		return 0;
1444	case RATE_MCS_CHAN_WIDTH_40:
1445		return IEEE80211_TX_RC_40_MHZ_WIDTH;
1446	case RATE_MCS_CHAN_WIDTH_80:
1447		return IEEE80211_TX_RC_80_MHZ_WIDTH;
1448	case RATE_MCS_CHAN_WIDTH_160:
1449		return IEEE80211_TX_RC_160_MHZ_WIDTH;
1450	default:
1451		return 0;
1452	}
1453}
1454
1455void iwl_mvm_hwrate_to_tx_rate(u32 rate_n_flags,
1456			       enum nl80211_band band,
1457			       struct ieee80211_tx_rate *r)
1458{
1459	u32 format = rate_n_flags & RATE_MCS_MOD_TYPE_MSK;
1460	u32 rate = format == RATE_MCS_MOD_TYPE_HT ?
1461		RATE_HT_MCS_INDEX(rate_n_flags) :
1462		rate_n_flags & RATE_MCS_CODE_MSK;
1463
1464	r->flags |=
1465		iwl_mvm_get_hwrate_chan_width(rate_n_flags &
1466					      RATE_MCS_CHAN_WIDTH_MSK);
1467
1468	if (rate_n_flags & RATE_MCS_SGI_MSK)
1469		r->flags |= IEEE80211_TX_RC_SHORT_GI;
1470	switch (format) {
1471	case RATE_MCS_MOD_TYPE_HT:
1472		r->flags |= IEEE80211_TX_RC_MCS;
1473		r->idx = rate;
1474		break;
1475	case RATE_MCS_MOD_TYPE_VHT:
1476		ieee80211_rate_set_vht(r, rate,
1477				       FIELD_GET(RATE_MCS_NSS_MSK,
1478						 rate_n_flags) + 1);
1479		r->flags |= IEEE80211_TX_RC_VHT_MCS;
1480		break;
1481	case RATE_MCS_MOD_TYPE_HE:
1482	case RATE_MCS_MOD_TYPE_EHT:
1483		/* mac80211 cannot do this without ieee80211_tx_status_ext()
1484		 * but it only matters for radiotap */
1485		r->idx = 0;
1486		break;
1487	default:
1488		r->idx = iwl_mvm_legacy_hw_idx_to_mac80211_idx(rate_n_flags,
1489							       band);
1490	}
1491}
1492
1493/*
1494 * translate ucode response to mac80211 tx status control values
1495 */
1496static void iwl_mvm_hwrate_to_tx_status(struct iwl_mvm *mvm,
1497					__le32 rate_n_flags,
1498					struct ieee80211_tx_info *info)
1499{
1500	struct ieee80211_tx_rate *r = &info->status.rates[0];
1501	u32 rate;
1502
1503	/*
1504	 * Technically this conversion is incorrect for BA status, however:
1505	 *  - we only use the BA notif data for older firmware that have
1506	 *    host rate scaling and don't use newer rate formats
1507	 *  - the firmware API changed together for BA notif and TX CMD
1508	 *    as well
1509	 */
1510	rate = iwl_mvm_v3_rate_from_fw(rate_n_flags, mvm->fw_rates_ver);
1511
1512	info->status.antenna =
1513		((rate & RATE_MCS_ANT_AB_MSK) >> RATE_MCS_ANT_POS);
1514	iwl_mvm_hwrate_to_tx_rate(rate, info->band, r);
1515}
1516
1517static void iwl_mvm_tx_status_check_trigger(struct iwl_mvm *mvm,
1518					    u32 status, __le16 frame_control)
1519{
1520	struct iwl_fw_dbg_trigger_tlv *trig;
1521	struct iwl_fw_dbg_trigger_tx_status *status_trig;
1522	int i;
1523
1524	if ((status & TX_STATUS_MSK) != TX_STATUS_SUCCESS) {
1525		enum iwl_fw_ini_time_point tp =
1526			IWL_FW_INI_TIME_POINT_TX_FAILED;
1527
1528		if (ieee80211_is_action(frame_control))
1529			tp = IWL_FW_INI_TIME_POINT_TX_WFD_ACTION_FRAME_FAILED;
1530
1531		iwl_dbg_tlv_time_point(&mvm->fwrt,
1532				       tp, NULL);
1533		return;
1534	}
1535
1536	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, NULL,
1537				     FW_DBG_TRIGGER_TX_STATUS);
1538	if (!trig)
1539		return;
1540
1541	status_trig = (void *)trig->data;
1542
1543	for (i = 0; i < ARRAY_SIZE(status_trig->statuses); i++) {
1544		/* don't collect on status 0 */
1545		if (!status_trig->statuses[i].status)
1546			break;
1547
1548		if (status_trig->statuses[i].status != (status & TX_STATUS_MSK))
1549			continue;
1550
1551		iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
1552					"Tx status %d was received",
1553					status & TX_STATUS_MSK);
1554		break;
1555	}
1556}
1557
1558/*
1559 * iwl_mvm_get_scd_ssn - returns the SSN of the SCD
1560 * @tx_resp: the Tx response from the fw (agg or non-agg)
1561 *
1562 * When the fw sends an AMPDU, it fetches the MPDUs one after the other. Since
1563 * it can't know that everything will go well until the end of the AMPDU, it
1564 * can't know in advance the number of MPDUs that will be sent in the current
1565 * batch. This is why it writes the agg Tx response while it fetches the MPDUs.
1566 * Hence, it can't know in advance what the SSN of the SCD will be at the end
1567 * of the batch. This is why the SSN of the SCD is written at the end of the
1568 * whole struct at a variable offset. This function knows how to cope with the
1569 * variable offset and returns the SSN of the SCD.
1570 *
1571 * For 22000-series and lower, this is just 12 bits. For later, 16 bits.
1572 */
1573static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm *mvm,
1574				      struct iwl_tx_resp *tx_resp)
1575{
1576	u32 val = le32_to_cpup((__le32 *)iwl_mvm_get_agg_status(mvm, tx_resp) +
1577			       tx_resp->frame_count);
1578
1579	if (mvm->trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
1580		return val & 0xFFFF;
1581	return val & 0xFFF;
1582}
1583
1584static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
1585				     struct iwl_rx_packet *pkt)
1586{
1587	struct ieee80211_sta *sta;
1588	u16 sequence = le16_to_cpu(pkt->hdr.sequence);
1589	int txq_id = SEQ_TO_QUEUE(sequence);
1590	/* struct iwl_tx_resp_v3 is almost the same */
1591	struct iwl_tx_resp *tx_resp = (void *)pkt->data;
1592	int sta_id = IWL_TX_RES_GET_RA(tx_resp->ra_tid);
1593	int tid = IWL_TX_RES_GET_TID(tx_resp->ra_tid);
1594	struct agg_tx_status *agg_status =
1595		iwl_mvm_get_agg_status(mvm, tx_resp);
1596	u32 status = le16_to_cpu(agg_status->status);
1597	u16 ssn = iwl_mvm_get_scd_ssn(mvm, tx_resp);
1598	struct sk_buff_head skbs;
1599	u8 skb_freed = 0;
1600	u8 lq_color;
1601	u16 next_reclaimed, seq_ctl;
1602	bool is_ndp = false;
1603
1604	__skb_queue_head_init(&skbs);
1605
1606	if (iwl_mvm_has_new_tx_api(mvm))
1607		txq_id = le16_to_cpu(tx_resp->tx_queue);
1608
1609	seq_ctl = le16_to_cpu(tx_resp->seq_ctl);
1610
1611	/* we can free until ssn % q.n_bd not inclusive */
1612	iwl_trans_reclaim(mvm->trans, txq_id, ssn, &skbs, false);
1613
1614	while (!skb_queue_empty(&skbs)) {
1615		struct sk_buff *skb = __skb_dequeue(&skbs);
1616		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1617		struct ieee80211_hdr *hdr = (void *)skb->data;
1618		bool flushed = false;
1619
1620		skb_freed++;
1621
1622		iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
1623
1624		memset(&info->status, 0, sizeof(info->status));
1625		info->flags &= ~(IEEE80211_TX_STAT_ACK | IEEE80211_TX_STAT_TX_FILTERED);
1626
1627		/* inform mac80211 about what happened with the frame */
1628		switch (status & TX_STATUS_MSK) {
1629		case TX_STATUS_SUCCESS:
1630		case TX_STATUS_DIRECT_DONE:
1631			info->flags |= IEEE80211_TX_STAT_ACK;
1632			break;
1633		case TX_STATUS_FAIL_FIFO_FLUSHED:
1634		case TX_STATUS_FAIL_DRAIN_FLOW:
1635			flushed = true;
1636			break;
1637		case TX_STATUS_FAIL_DEST_PS:
1638			/* the FW should have stopped the queue and not
1639			 * return this status
1640			 */
1641			IWL_ERR_LIMIT(mvm,
1642				      "FW reported TX filtered, status=0x%x, FC=0x%x\n",
1643				      status, le16_to_cpu(hdr->frame_control));
1644			info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
1645			break;
1646		default:
1647			break;
1648		}
1649
1650		if ((status & TX_STATUS_MSK) != TX_STATUS_SUCCESS &&
1651		    ieee80211_is_mgmt(hdr->frame_control))
1652			iwl_mvm_toggle_tx_ant(mvm, &mvm->mgmt_last_antenna_idx);
1653
1654		/*
1655		 * If we are freeing multiple frames, mark all the frames
1656		 * but the first one as acked, since they were acknowledged
1657		 * before
1658		 * */
1659		if (skb_freed > 1)
1660			info->flags |= IEEE80211_TX_STAT_ACK;
1661
1662		iwl_mvm_tx_status_check_trigger(mvm, status, hdr->frame_control);
1663
1664		info->status.rates[0].count = tx_resp->failure_frame + 1;
1665
1666		iwl_mvm_hwrate_to_tx_status(mvm, tx_resp->initial_rate, info);
1667
1668		/* Don't assign the converted initial_rate, because driver
1669		 * TLC uses this and doesn't support the new FW rate
1670		 */
1671		info->status.status_driver_data[1] =
1672			(void *)(uintptr_t)le32_to_cpu(tx_resp->initial_rate);
1673
1674		/* Single frame failure in an AMPDU queue => send BAR */
1675		if (info->flags & IEEE80211_TX_CTL_AMPDU &&
1676		    !(info->flags & IEEE80211_TX_STAT_ACK) &&
1677		    !(info->flags & IEEE80211_TX_STAT_TX_FILTERED) && !flushed)
1678			info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
1679		info->flags &= ~IEEE80211_TX_CTL_AMPDU;
1680
1681		/* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */
1682		if (ieee80211_is_back_req(hdr->frame_control))
1683			seq_ctl = 0;
1684		else if (status != TX_STATUS_SUCCESS)
1685			seq_ctl = le16_to_cpu(hdr->seq_ctrl);
1686
1687		if (unlikely(!seq_ctl)) {
1688			/*
1689			 * If it is an NDP, we can't update next_reclaim since
1690			 * its sequence control is 0. Note that for that same
1691			 * reason, NDPs are never sent to A-MPDU'able queues
1692			 * so that we can never have more than one freed frame
1693			 * for a single Tx resonse (see WARN_ON below).
1694			 */
1695			if (ieee80211_is_qos_nullfunc(hdr->frame_control))
1696				is_ndp = true;
1697		}
1698
1699		/*
1700		 * TODO: this is not accurate if we are freeing more than one
1701		 * packet.
1702		 */
1703		info->status.tx_time =
1704			le16_to_cpu(tx_resp->wireless_media_time);
1705		BUILD_BUG_ON(ARRAY_SIZE(info->status.status_driver_data) < 1);
1706		lq_color = TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);
1707		info->status.status_driver_data[0] =
1708			RS_DRV_DATA_PACK(lq_color, tx_resp->reduced_tpc);
1709
1710		if (likely(!iwl_mvm_time_sync_frame(mvm, skb, hdr->addr1)))
1711			ieee80211_tx_status_skb(mvm->hw, skb);
1712	}
1713
1714	/* This is an aggregation queue or might become one, so we use
1715	 * the ssn since: ssn = wifi seq_num % 256.
1716	 * The seq_ctl is the sequence control of the packet to which
1717	 * this Tx response relates. But if there is a hole in the
1718	 * bitmap of the BA we received, this Tx response may allow to
1719	 * reclaim the hole and all the subsequent packets that were
1720	 * already acked. In that case, seq_ctl != ssn, and the next
1721	 * packet to be reclaimed will be ssn and not seq_ctl. In that
1722	 * case, several packets will be reclaimed even if
1723	 * frame_count = 1.
1724	 *
1725	 * The ssn is the index (% 256) of the latest packet that has
1726	 * treated (acked / dropped) + 1.
1727	 */
1728	next_reclaimed = ssn;
1729
1730	IWL_DEBUG_TX_REPLY(mvm,
1731			   "TXQ %d status %s (0x%08x)\n",
1732			   txq_id, iwl_mvm_get_tx_fail_reason(status), status);
1733
1734	IWL_DEBUG_TX_REPLY(mvm,
1735			   "\t\t\t\tinitial_rate 0x%x retries %d, idx=%d ssn=%d next_reclaimed=0x%x seq_ctl=0x%x\n",
1736			   le32_to_cpu(tx_resp->initial_rate),
1737			   tx_resp->failure_frame, SEQ_TO_INDEX(sequence),
1738			   ssn, next_reclaimed, seq_ctl);
1739
1740	rcu_read_lock();
1741
1742	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
1743	/*
1744	 * sta can't be NULL otherwise it'd mean that the sta has been freed in
1745	 * the firmware while we still have packets for it in the Tx queues.
1746	 */
1747	if (WARN_ON_ONCE(!sta))
1748		goto out;
1749
1750	if (!IS_ERR(sta)) {
1751		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1752
1753		iwl_mvm_tx_airtime(mvm, mvmsta,
1754				   le16_to_cpu(tx_resp->wireless_media_time));
1755
1756		if ((status & TX_STATUS_MSK) != TX_STATUS_SUCCESS &&
1757		    mvmsta->sta_state < IEEE80211_STA_AUTHORIZED)
1758			iwl_mvm_toggle_tx_ant(mvm, &mvmsta->tx_ant);
1759
1760		if (sta->wme && tid != IWL_MGMT_TID) {
1761			struct iwl_mvm_tid_data *tid_data =
1762				&mvmsta->tid_data[tid];
1763			bool send_eosp_ndp = false;
1764
1765			spin_lock_bh(&mvmsta->lock);
1766
1767			if (!is_ndp) {
1768				tid_data->next_reclaimed = next_reclaimed;
1769				IWL_DEBUG_TX_REPLY(mvm,
1770						   "Next reclaimed packet:%d\n",
1771						   next_reclaimed);
1772			} else {
1773				IWL_DEBUG_TX_REPLY(mvm,
1774						   "NDP - don't update next_reclaimed\n");
1775			}
1776
1777			iwl_mvm_check_ratid_empty(mvm, sta, tid);
1778
1779			if (mvmsta->sleep_tx_count) {
1780				mvmsta->sleep_tx_count--;
1781				if (mvmsta->sleep_tx_count &&
1782				    !iwl_mvm_tid_queued(mvm, tid_data)) {
1783					/*
1784					 * The number of frames in the queue
1785					 * dropped to 0 even if we sent less
1786					 * frames than we thought we had on the
1787					 * Tx queue.
1788					 * This means we had holes in the BA
1789					 * window that we just filled, ask
1790					 * mac80211 to send EOSP since the
1791					 * firmware won't know how to do that.
1792					 * Send NDP and the firmware will send
1793					 * EOSP notification that will trigger
1794					 * a call to ieee80211_sta_eosp().
1795					 */
1796					send_eosp_ndp = true;
1797				}
1798			}
1799
1800			spin_unlock_bh(&mvmsta->lock);
1801			if (send_eosp_ndp) {
1802				iwl_mvm_sta_modify_sleep_tx_count(mvm, sta,
1803					IEEE80211_FRAME_RELEASE_UAPSD,
1804					1, tid, false, false);
1805				mvmsta->sleep_tx_count = 0;
1806				ieee80211_send_eosp_nullfunc(sta, tid);
1807			}
1808		}
1809
1810		if (mvmsta->next_status_eosp) {
1811			mvmsta->next_status_eosp = false;
1812			ieee80211_sta_eosp(sta);
1813		}
1814	}
1815out:
1816	rcu_read_unlock();
1817}
1818
1819#ifdef CONFIG_IWLWIFI_DEBUG
1820#define AGG_TX_STATE_(x) case AGG_TX_STATE_ ## x: return #x
1821static const char *iwl_get_agg_tx_status(u16 status)
1822{
1823	switch (status & AGG_TX_STATE_STATUS_MSK) {
1824	AGG_TX_STATE_(TRANSMITTED);
1825	AGG_TX_STATE_(UNDERRUN);
1826	AGG_TX_STATE_(BT_PRIO);
1827	AGG_TX_STATE_(FEW_BYTES);
1828	AGG_TX_STATE_(ABORT);
1829	AGG_TX_STATE_(TX_ON_AIR_DROP);
1830	AGG_TX_STATE_(LAST_SENT_TRY_CNT);
1831	AGG_TX_STATE_(LAST_SENT_BT_KILL);
1832	AGG_TX_STATE_(SCD_QUERY);
1833	AGG_TX_STATE_(TEST_BAD_CRC32);
1834	AGG_TX_STATE_(RESPONSE);
1835	AGG_TX_STATE_(DUMP_TX);
1836	AGG_TX_STATE_(DELAY_TX);
1837	}
1838
1839	return "UNKNOWN";
1840}
1841
1842static void iwl_mvm_rx_tx_cmd_agg_dbg(struct iwl_mvm *mvm,
1843				      struct iwl_rx_packet *pkt)
1844{
1845	struct iwl_tx_resp *tx_resp = (void *)pkt->data;
1846	struct agg_tx_status *frame_status =
1847		iwl_mvm_get_agg_status(mvm, tx_resp);
1848	int i;
1849	bool tirgger_timepoint = false;
1850
1851	for (i = 0; i < tx_resp->frame_count; i++) {
1852		u16 fstatus = le16_to_cpu(frame_status[i].status);
1853		/* In case one frame wasn't transmitted trigger time point */
1854		tirgger_timepoint |= ((fstatus & AGG_TX_STATE_STATUS_MSK) !=
1855				      AGG_TX_STATE_TRANSMITTED);
1856		IWL_DEBUG_TX_REPLY(mvm,
1857				   "status %s (0x%04x), try-count (%d) seq (0x%x)\n",
1858				   iwl_get_agg_tx_status(fstatus),
1859				   fstatus & AGG_TX_STATE_STATUS_MSK,
1860				   (fstatus & AGG_TX_STATE_TRY_CNT_MSK) >>
1861					AGG_TX_STATE_TRY_CNT_POS,
1862				   le16_to_cpu(frame_status[i].sequence));
1863	}
1864
1865	if (tirgger_timepoint)
1866		iwl_dbg_tlv_time_point(&mvm->fwrt,
1867				       IWL_FW_INI_TIME_POINT_TX_FAILED, NULL);
1868
1869}
1870#else
1871static void iwl_mvm_rx_tx_cmd_agg_dbg(struct iwl_mvm *mvm,
1872				      struct iwl_rx_packet *pkt)
1873{}
1874#endif /* CONFIG_IWLWIFI_DEBUG */
1875
1876static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
1877				  struct iwl_rx_packet *pkt)
1878{
1879	struct iwl_tx_resp *tx_resp = (void *)pkt->data;
1880	int sta_id = IWL_TX_RES_GET_RA(tx_resp->ra_tid);
1881	int tid = IWL_TX_RES_GET_TID(tx_resp->ra_tid);
1882	u16 sequence = le16_to_cpu(pkt->hdr.sequence);
1883	struct iwl_mvm_sta *mvmsta;
1884	int queue = SEQ_TO_QUEUE(sequence);
1885	struct ieee80211_sta *sta;
1886
1887	if (WARN_ON_ONCE(queue < IWL_MVM_DQA_MIN_DATA_QUEUE &&
1888			 (queue != IWL_MVM_DQA_BSS_CLIENT_QUEUE)))
1889		return;
1890
1891	iwl_mvm_rx_tx_cmd_agg_dbg(mvm, pkt);
1892
1893	rcu_read_lock();
1894
1895	mvmsta = iwl_mvm_sta_from_staid_rcu(mvm, sta_id);
1896
1897	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
1898	if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta) || !sta->wme)) {
1899		rcu_read_unlock();
1900		return;
1901	}
1902
1903	if (!WARN_ON_ONCE(!mvmsta)) {
1904		mvmsta->tid_data[tid].rate_n_flags =
1905			tx_resp->initial_rate;
1906		mvmsta->tid_data[tid].tx_time =
1907			le16_to_cpu(tx_resp->wireless_media_time);
1908		mvmsta->tid_data[tid].lq_color =
1909			TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);
1910		iwl_mvm_tx_airtime(mvm, mvmsta,
1911				   le16_to_cpu(tx_resp->wireless_media_time));
1912	}
1913
1914	rcu_read_unlock();
1915}
1916
1917void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
1918{
1919	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1920	struct iwl_tx_resp *tx_resp = (void *)pkt->data;
1921
1922	if (tx_resp->frame_count == 1)
1923		iwl_mvm_rx_tx_cmd_single(mvm, pkt);
1924	else
1925		iwl_mvm_rx_tx_cmd_agg(mvm, pkt);
1926}
1927
1928static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,
1929			       int txq, int index,
1930			       struct ieee80211_tx_info *tx_info, __le32 rate,
1931			       bool is_flush)
1932{
1933	struct sk_buff_head reclaimed_skbs;
1934	struct iwl_mvm_tid_data *tid_data = NULL;
1935	struct ieee80211_sta *sta;
1936	struct iwl_mvm_sta *mvmsta = NULL;
1937	struct sk_buff *skb;
1938	int freed;
1939
1940	if (WARN_ONCE(sta_id >= mvm->fw->ucode_capa.num_stations ||
1941		      tid > IWL_MAX_TID_COUNT,
1942		      "sta_id %d tid %d", sta_id, tid))
1943		return;
1944
1945	rcu_read_lock();
1946
1947	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
1948
1949	/* Reclaiming frames for a station that has been deleted ? */
1950	if (WARN_ON_ONCE(!sta)) {
1951		rcu_read_unlock();
1952		return;
1953	}
1954
1955	__skb_queue_head_init(&reclaimed_skbs);
1956
1957	/*
1958	 * Release all TFDs before the SSN, i.e. all TFDs in front of
1959	 * block-ack window (we assume that they've been successfully
1960	 * transmitted ... if not, it's too late anyway).
1961	 */
1962	iwl_trans_reclaim(mvm->trans, txq, index, &reclaimed_skbs, is_flush);
1963
1964	skb_queue_walk(&reclaimed_skbs, skb) {
1965		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1966
1967		iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
1968
1969		memset(&info->status, 0, sizeof(info->status));
1970		/* Packet was transmitted successfully, failures come as single
1971		 * frames because before failing a frame the firmware transmits
1972		 * it without aggregation at least once.
1973		 */
1974		if (!is_flush)
1975			info->flags |= IEEE80211_TX_STAT_ACK;
1976		else
1977			info->flags &= ~IEEE80211_TX_STAT_ACK;
1978	}
1979
1980	/*
1981	 * It's possible to get a BA response after invalidating the rcu (rcu is
1982	 * invalidated in order to prevent new Tx from being sent, but there may
1983	 * be some frames already in-flight).
1984	 * In this case we just want to reclaim, and could skip all the
1985	 * sta-dependent stuff since it's in the middle of being removed
1986	 * anyways.
1987	 */
1988	if (IS_ERR(sta))
1989		goto out;
1990
1991	mvmsta = iwl_mvm_sta_from_mac80211(sta);
1992	tid_data = &mvmsta->tid_data[tid];
1993
1994	if (tid_data->txq_id != txq) {
1995		IWL_ERR(mvm,
1996			"invalid reclaim request: Q %d, tid %d\n",
1997			tid_data->txq_id, tid);
1998		rcu_read_unlock();
1999		return;
2000	}
2001
2002	spin_lock_bh(&mvmsta->lock);
2003
2004	tid_data->next_reclaimed = index;
2005
2006	iwl_mvm_check_ratid_empty(mvm, sta, tid);
2007
2008	freed = 0;
2009
2010	/* pack lq color from tid_data along the reduced txp */
2011	tx_info->status.status_driver_data[0] =
2012		RS_DRV_DATA_PACK(tid_data->lq_color,
2013				 tx_info->status.status_driver_data[0]);
2014	/* the value is only consumed for old FW that has v1 rates anyway */
2015	tx_info->status.status_driver_data[1] =
2016		(void *)(uintptr_t)le32_to_cpu(rate);
2017
2018	skb_queue_walk(&reclaimed_skbs, skb) {
2019		struct ieee80211_hdr *hdr = (void *)skb->data;
2020		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2021
2022		if (!is_flush) {
2023			if (ieee80211_is_data_qos(hdr->frame_control))
2024				freed++;
2025			else
2026				WARN_ON_ONCE(tid != IWL_MAX_TID_COUNT);
2027		}
2028
2029		/* this is the first skb we deliver in this batch */
2030		/* put the rate scaling data there */
2031		if (freed == 1) {
2032			info->flags |= IEEE80211_TX_STAT_AMPDU;
2033			memcpy(&info->status, &tx_info->status,
2034			       sizeof(tx_info->status));
2035			iwl_mvm_hwrate_to_tx_status(mvm, rate, info);
2036		}
2037	}
2038
2039	spin_unlock_bh(&mvmsta->lock);
2040
2041	/* We got a BA notif with 0 acked or scd_ssn didn't progress which is
2042	 * possible (i.e. first MPDU in the aggregation wasn't acked)
2043	 * Still it's important to update RS about sent vs. acked.
2044	 */
2045	if (!is_flush && skb_queue_empty(&reclaimed_skbs) &&
2046	    !iwl_mvm_has_tlc_offload(mvm)) {
2047		struct ieee80211_chanctx_conf *chanctx_conf = NULL;
2048
2049		/* no TLC offload, so non-MLD mode */
2050		if (mvmsta->vif)
2051			chanctx_conf =
2052				rcu_dereference(mvmsta->vif->bss_conf.chanctx_conf);
2053
2054		if (WARN_ON_ONCE(!chanctx_conf))
2055			goto out;
2056
2057		tx_info->band = chanctx_conf->def.chan->band;
2058		iwl_mvm_hwrate_to_tx_status(mvm, rate, tx_info);
2059
2060		IWL_DEBUG_TX_REPLY(mvm, "No reclaim. Update rs directly\n");
2061		iwl_mvm_rs_tx_status(mvm, sta, tid, tx_info, false);
2062	}
2063
2064out:
2065	rcu_read_unlock();
2066
2067	while (!skb_queue_empty(&reclaimed_skbs)) {
2068		skb = __skb_dequeue(&reclaimed_skbs);
2069		ieee80211_tx_status_skb(mvm->hw, skb);
2070	}
2071}
2072
2073void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2074{
2075	struct iwl_rx_packet *pkt = rxb_addr(rxb);
2076	unsigned int pkt_len = iwl_rx_packet_payload_len(pkt);
2077	int sta_id, tid, txq, index;
2078	struct ieee80211_tx_info ba_info = {};
2079	struct iwl_mvm_ba_notif *ba_notif;
2080	struct iwl_mvm_tid_data *tid_data;
2081	struct iwl_mvm_sta *mvmsta;
2082
2083	ba_info.flags = IEEE80211_TX_STAT_AMPDU;
2084
2085	if (iwl_mvm_has_new_tx_api(mvm)) {
2086		struct iwl_compressed_ba_notif *ba_res =
2087			(void *)pkt->data;
2088		u8 lq_color = TX_RES_RATE_TABLE_COL_GET(ba_res->tlc_rate_info);
2089		u16 tfd_cnt;
2090		int i;
2091
2092		if (IWL_FW_CHECK(mvm, sizeof(*ba_res) > pkt_len,
2093				 "short BA notification (%d)\n", pkt_len))
2094			return;
2095
2096		sta_id = ba_res->sta_id;
2097		ba_info.status.ampdu_ack_len = (u8)le16_to_cpu(ba_res->done);
2098		ba_info.status.ampdu_len = (u8)le16_to_cpu(ba_res->txed);
2099		ba_info.status.tx_time =
2100			(u16)le32_to_cpu(ba_res->wireless_time);
2101		ba_info.status.status_driver_data[0] =
2102			(void *)(uintptr_t)ba_res->reduced_txp;
2103
2104		tfd_cnt = le16_to_cpu(ba_res->tfd_cnt);
2105		if (!tfd_cnt)
2106			return;
2107
2108		if (IWL_FW_CHECK(mvm,
2109				 struct_size(ba_res, tfd, tfd_cnt) > pkt_len,
2110				 "short BA notification (tfds:%d, size:%d)\n",
2111				 tfd_cnt, pkt_len))
2112			return;
2113
2114		IWL_DEBUG_TX_REPLY(mvm,
2115				   "BA_NOTIFICATION Received from sta_id = %d, flags %x, sent:%d, acked:%d\n",
2116				   sta_id, le32_to_cpu(ba_res->flags),
2117				   le16_to_cpu(ba_res->txed),
2118				   le16_to_cpu(ba_res->done));
2119
2120		rcu_read_lock();
2121
2122		mvmsta = iwl_mvm_sta_from_staid_rcu(mvm, sta_id);
2123		/*
2124		 * It's possible to get a BA response after invalidating the rcu
2125		 * (rcu is invalidated in order to prevent new Tx from being
2126		 * sent, but there may be some frames already in-flight).
2127		 * In this case we just want to reclaim, and could skip all the
2128		 * sta-dependent stuff since it's in the middle of being removed
2129		 * anyways.
2130		 */
2131
2132		/* Free per TID */
2133		for (i = 0; i < tfd_cnt; i++) {
2134			struct iwl_compressed_ba_tfd *ba_tfd = &ba_res->tfd[i];
2135
2136			tid = ba_tfd->tid;
2137			if (tid == IWL_MGMT_TID)
2138				tid = IWL_MAX_TID_COUNT;
2139
2140			if (mvmsta)
2141				mvmsta->tid_data[i].lq_color = lq_color;
2142
2143			iwl_mvm_tx_reclaim(mvm, sta_id, tid,
2144					   (int)(le16_to_cpu(ba_tfd->q_num)),
2145					   le16_to_cpu(ba_tfd->tfd_index),
2146					   &ba_info,
2147					   ba_res->tx_rate, false);
2148		}
2149
2150		if (mvmsta)
2151			iwl_mvm_tx_airtime(mvm, mvmsta,
2152					   le32_to_cpu(ba_res->wireless_time));
2153
2154		rcu_read_unlock();
2155		return;
2156	}
2157
2158	ba_notif = (void *)pkt->data;
2159	sta_id = ba_notif->sta_id;
2160	tid = ba_notif->tid;
2161	/* "flow" corresponds to Tx queue */
2162	txq = le16_to_cpu(ba_notif->scd_flow);
2163	/* "ssn" is start of block-ack Tx window, corresponds to index
2164	 * (in Tx queue's circular buffer) of first TFD/frame in window */
2165	index = le16_to_cpu(ba_notif->scd_ssn);
2166
2167	rcu_read_lock();
2168	mvmsta = iwl_mvm_sta_from_staid_rcu(mvm, sta_id);
2169	if (IWL_FW_CHECK(mvm, !mvmsta,
2170			 "invalid STA ID %d in BA notif\n",
2171			 sta_id)) {
2172		rcu_read_unlock();
2173		return;
2174	}
2175
2176	tid_data = &mvmsta->tid_data[tid];
2177
2178	ba_info.status.ampdu_ack_len = ba_notif->txed_2_done;
2179	ba_info.status.ampdu_len = ba_notif->txed;
2180	ba_info.status.tx_time = tid_data->tx_time;
2181	ba_info.status.status_driver_data[0] =
2182		(void *)(uintptr_t)ba_notif->reduced_txp;
2183
2184	rcu_read_unlock();
2185
2186	IWL_DEBUG_TX_REPLY(mvm,
2187			   "BA_NOTIFICATION Received from %pM, sta_id = %d\n",
2188			   ba_notif->sta_addr, ba_notif->sta_id);
2189
2190	IWL_DEBUG_TX_REPLY(mvm,
2191			   "TID = %d, SeqCtl = %d, bitmap = 0x%llx, scd_flow = %d, scd_ssn = %d sent:%d, acked:%d\n",
2192			   ba_notif->tid, le16_to_cpu(ba_notif->seq_ctl),
2193			   le64_to_cpu(ba_notif->bitmap), txq, index,
2194			   ba_notif->txed, ba_notif->txed_2_done);
2195
2196	IWL_DEBUG_TX_REPLY(mvm, "reduced txp from ba notif %d\n",
2197			   ba_notif->reduced_txp);
2198
2199	iwl_mvm_tx_reclaim(mvm, sta_id, tid, txq, index, &ba_info,
2200			   tid_data->rate_n_flags, false);
2201}
2202
2203/*
2204 * Note that there are transports that buffer frames before they reach
2205 * the firmware. This means that after flush_tx_path is called, the
2206 * queue might not be empty. The race-free way to handle this is to:
2207 * 1) set the station as draining
2208 * 2) flush the Tx path
2209 * 3) wait for the transport queues to be empty
2210 */
2211int iwl_mvm_flush_tx_path(struct iwl_mvm *mvm, u32 tfd_msk)
2212{
2213	int ret;
2214	struct iwl_tx_path_flush_cmd_v1 flush_cmd = {
2215		.queues_ctl = cpu_to_le32(tfd_msk),
2216		.flush_ctl = cpu_to_le16(DUMP_TX_FIFO_FLUSH),
2217	};
2218
2219	WARN_ON(iwl_mvm_has_new_tx_api(mvm));
2220	ret = iwl_mvm_send_cmd_pdu(mvm, TXPATH_FLUSH, 0,
2221				   sizeof(flush_cmd), &flush_cmd);
2222	if (ret)
2223		IWL_ERR(mvm, "Failed to send flush command (%d)\n", ret);
2224	return ret;
2225}
2226
2227int iwl_mvm_flush_sta_tids(struct iwl_mvm *mvm, u32 sta_id, u16 tids)
2228{
2229	int ret;
2230	struct iwl_tx_path_flush_cmd_rsp *rsp;
2231	struct iwl_tx_path_flush_cmd flush_cmd = {
2232		.sta_id = cpu_to_le32(sta_id),
2233		.tid_mask = cpu_to_le16(tids),
2234	};
2235
2236	struct iwl_host_cmd cmd = {
2237		.id = TXPATH_FLUSH,
2238		.len = { sizeof(flush_cmd), },
2239		.data = { &flush_cmd, },
2240	};
2241
2242	WARN_ON(!iwl_mvm_has_new_tx_api(mvm));
2243
2244	if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, TXPATH_FLUSH, 0) > 0)
2245		cmd.flags |= CMD_WANT_SKB | CMD_SEND_IN_RFKILL;
2246
2247	IWL_DEBUG_TX_QUEUES(mvm, "flush for sta id %d tid mask 0x%x\n",
2248			    sta_id, tids);
2249
2250	ret = iwl_mvm_send_cmd(mvm, &cmd);
2251
2252	if (ret) {
2253		IWL_ERR(mvm, "Failed to send flush command (%d)\n", ret);
2254		return ret;
2255	}
2256
2257	if (cmd.flags & CMD_WANT_SKB) {
2258		int i;
2259		int num_flushed_queues;
2260
2261		if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != sizeof(*rsp))) {
2262			ret = -EIO;
2263			goto free_rsp;
2264		}
2265
2266		rsp = (void *)cmd.resp_pkt->data;
2267
2268		if (WARN_ONCE(le16_to_cpu(rsp->sta_id) != sta_id,
2269			      "sta_id %d != rsp_sta_id %d",
2270			      sta_id, le16_to_cpu(rsp->sta_id))) {
2271			ret = -EIO;
2272			goto free_rsp;
2273		}
2274
2275		num_flushed_queues = le16_to_cpu(rsp->num_flushed_queues);
2276		if (WARN_ONCE(num_flushed_queues > IWL_TX_FLUSH_QUEUE_RSP,
2277			      "num_flushed_queues %d", num_flushed_queues)) {
2278			ret = -EIO;
2279			goto free_rsp;
2280		}
2281
2282		for (i = 0; i < num_flushed_queues; i++) {
2283			struct ieee80211_tx_info tx_info = {};
2284			struct iwl_flush_queue_info *queue_info = &rsp->queues[i];
2285			int tid = le16_to_cpu(queue_info->tid);
2286			int read_before = le16_to_cpu(queue_info->read_before_flush);
2287			int read_after = le16_to_cpu(queue_info->read_after_flush);
2288			int queue_num = le16_to_cpu(queue_info->queue_num);
2289
2290			if (tid == IWL_MGMT_TID)
2291				tid = IWL_MAX_TID_COUNT;
2292
2293			IWL_DEBUG_TX_QUEUES(mvm,
2294					    "tid %d queue_id %d read-before %d read-after %d\n",
2295					    tid, queue_num, read_before, read_after);
2296
2297			iwl_mvm_tx_reclaim(mvm, sta_id, tid, queue_num, read_after,
2298					   &tx_info, 0, true);
2299		}
2300free_rsp:
2301		iwl_free_resp(&cmd);
2302	}
2303	return ret;
2304}
2305
2306int iwl_mvm_flush_sta(struct iwl_mvm *mvm, u32 sta_id, u32 tfd_queue_mask)
2307{
2308	if (iwl_mvm_has_new_tx_api(mvm))
2309		return iwl_mvm_flush_sta_tids(mvm, sta_id, 0xffff);
2310
2311	return iwl_mvm_flush_tx_path(mvm, tfd_queue_mask);
2312}