ser.c

  1// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
  2/* Copyright(c) 2019-2020  Realtek Corporation
  3 */
  4
  5#include <linux/devcoredump.h>
  6
  7#include "cam.h"
  8#include "chan.h"
  9#include "debug.h"
 10#include "fw.h"
 11#include "mac.h"
 12#include "ps.h"
 13#include "reg.h"
 14#include "ser.h"
 15#include "util.h"
 16
 17#define SER_RECFG_TIMEOUT 1000
 18
 19enum ser_evt {
 20	SER_EV_NONE,
 21	SER_EV_STATE_IN,
 22	SER_EV_STATE_OUT,
 23	SER_EV_L1_RESET_PREPARE, /* pre-M0 */
 24	SER_EV_L1_RESET, /* M1 */
 25	SER_EV_DO_RECOVERY, /* M3 */
 26	SER_EV_MAC_RESET_DONE, /* M5 */
 27	SER_EV_L2_RESET,
 28	SER_EV_L2_RECFG_DONE,
 29	SER_EV_L2_RECFG_TIMEOUT,
 30	SER_EV_M1_TIMEOUT,
 31	SER_EV_M3_TIMEOUT,
 32	SER_EV_FW_M5_TIMEOUT,
 33	SER_EV_L0_RESET,
 34	SER_EV_MAXX
 35};
 36
 37enum ser_state {
 38	SER_IDLE_ST,
 39	SER_L1_RESET_PRE_ST,
 40	SER_RESET_TRX_ST,
 41	SER_DO_HCI_ST,
 42	SER_L2_RESET_ST,
 43	SER_ST_MAX_ST
 44};
 45
 46struct ser_msg {
 47	struct list_head list;
 48	u8 event;
 49};
 50
 51struct state_ent {
 52	u8 state;
 53	char *name;
 54	void (*st_func)(struct rtw89_ser *ser, u8 event);
 55};
 56
 57struct event_ent {
 58	u8 event;
 59	char *name;
 60};
 61
 62static char *ser_ev_name(struct rtw89_ser *ser, u8 event)
 63{
 64	if (event < SER_EV_MAXX)
 65		return ser->ev_tbl[event].name;
 66
 67	return "err_ev_name";
 68}
 69
 70static char *ser_st_name(struct rtw89_ser *ser)
 71{
 72	if (ser->state < SER_ST_MAX_ST)
 73		return ser->st_tbl[ser->state].name;
 74
 75	return "err_st_name";
 76}
 77
 78#define RTW89_DEF_SER_CD_TYPE(_name, _type, _size) \
 79struct ser_cd_ ## _name { \
 80	u32 type; \
 81	u32 type_size; \
 82	u64 padding; \
 83	u8 data[_size]; \
 84} __packed; \
 85static void ser_cd_ ## _name ## _init(struct ser_cd_ ## _name *p) \
 86{ \
 87	p->type = _type; \
 88	p->type_size = sizeof(p->data); \
 89	p->padding = 0x0123456789abcdef; \
 90}
 91
 92enum rtw89_ser_cd_type {
 93	RTW89_SER_CD_FW_RSVD_PLE	= 0,
 94	RTW89_SER_CD_FW_BACKTRACE	= 1,
 95};
 96
 97RTW89_DEF_SER_CD_TYPE(fw_rsvd_ple,
 98		      RTW89_SER_CD_FW_RSVD_PLE,
 99		      RTW89_FW_RSVD_PLE_SIZE);
100
101RTW89_DEF_SER_CD_TYPE(fw_backtrace,
102		      RTW89_SER_CD_FW_BACKTRACE,
103		      RTW89_FW_BACKTRACE_MAX_SIZE);
104
105struct rtw89_ser_cd_buffer {
106	struct ser_cd_fw_rsvd_ple fwple;
107	struct ser_cd_fw_backtrace fwbt;
108} __packed;
109
110static struct rtw89_ser_cd_buffer *rtw89_ser_cd_prep(struct rtw89_dev *rtwdev)
111{
112	struct rtw89_ser_cd_buffer *buf;
113
114	buf = vzalloc(sizeof(*buf));
115	if (!buf)
116		return NULL;
117
118	ser_cd_fw_rsvd_ple_init(&buf->fwple);
119	ser_cd_fw_backtrace_init(&buf->fwbt);
120
121	return buf;
122}
123
124static void rtw89_ser_cd_send(struct rtw89_dev *rtwdev,
125			      struct rtw89_ser_cd_buffer *buf)
126{
127	rtw89_debug(rtwdev, RTW89_DBG_SER, "SER sends core dump\n");
128
129	/* After calling dev_coredump, buf's lifetime is supposed to be
130	 * handled by the device coredump framework. Note that a new dump
131	 * will be discarded if a previous one hasn't been released by
132	 * framework yet.
133	 */
134	dev_coredumpv(rtwdev->dev, buf, sizeof(*buf), GFP_KERNEL);
135}
136
137static void rtw89_ser_cd_free(struct rtw89_dev *rtwdev,
138			      struct rtw89_ser_cd_buffer *buf, bool free_self)
139{
140	if (!free_self)
141		return;
142
143	rtw89_debug(rtwdev, RTW89_DBG_SER, "SER frees core dump by self\n");
144
145	/* When some problems happen during filling data of core dump,
146	 * we won't send it to device coredump framework. Instead, we
147	 * free buf by ourselves.
148	 */
149	vfree(buf);
150}
151
152static void ser_state_run(struct rtw89_ser *ser, u8 evt)
153{
154	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
155
156	rtw89_debug(rtwdev, RTW89_DBG_SER, "ser: %s receive %s\n",
157		    ser_st_name(ser), ser_ev_name(ser, evt));
158
159	wiphy_lock(rtwdev->hw->wiphy);
160	rtw89_leave_lps(rtwdev);
161	wiphy_unlock(rtwdev->hw->wiphy);
162
163	ser->st_tbl[ser->state].st_func(ser, evt);
164}
165
166static void ser_state_goto(struct rtw89_ser *ser, u8 new_state)
167{
168	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
169
170	if (ser->state == new_state || new_state >= SER_ST_MAX_ST)
171		return;
172	ser_state_run(ser, SER_EV_STATE_OUT);
173
174	rtw89_debug(rtwdev, RTW89_DBG_SER, "ser: %s goto -> %s\n",
175		    ser_st_name(ser), ser->st_tbl[new_state].name);
176
177	ser->state = new_state;
178	ser_state_run(ser, SER_EV_STATE_IN);
179}
180
181static struct ser_msg *__rtw89_ser_dequeue_msg(struct rtw89_ser *ser)
182{
183	struct ser_msg *msg;
184
185	spin_lock_irq(&ser->msg_q_lock);
186	msg = list_first_entry_or_null(&ser->msg_q, struct ser_msg, list);
187	if (msg)
188		list_del(&msg->list);
189	spin_unlock_irq(&ser->msg_q_lock);
190
191	return msg;
192}
193
194static void rtw89_ser_hdl_work(struct work_struct *work)
195{
196	struct ser_msg *msg;
197	struct rtw89_ser *ser = container_of(work, struct rtw89_ser,
198					     ser_hdl_work);
199
200	while ((msg = __rtw89_ser_dequeue_msg(ser))) {
201		ser_state_run(ser, msg->event);
202		kfree(msg);
203	}
204}
205
206static int ser_send_msg(struct rtw89_ser *ser, u8 event)
207{
208	struct ser_msg *msg = NULL;
209
210	if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
211		return -EIO;
212
213	msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
214	if (!msg)
215		return -ENOMEM;
216
217	msg->event = event;
218
219	spin_lock_irq(&ser->msg_q_lock);
220	list_add(&msg->list, &ser->msg_q);
221	spin_unlock_irq(&ser->msg_q_lock);
222
223	schedule_work(&ser->ser_hdl_work);
224	return 0;
225}
226
227static void rtw89_ser_alarm_work(struct work_struct *work)
228{
229	struct rtw89_ser *ser = container_of(work, struct rtw89_ser,
230					     ser_alarm_work.work);
231
232	ser_send_msg(ser, ser->alarm_event);
233	ser->alarm_event = SER_EV_NONE;
234}
235
236static void ser_set_alarm(struct rtw89_ser *ser, u32 ms, u8 event)
237{
238	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
239
240	if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
241		return;
242
243	ser->alarm_event = event;
244	ieee80211_queue_delayed_work(rtwdev->hw, &ser->ser_alarm_work,
245				     msecs_to_jiffies(ms));
246}
247
248static void ser_del_alarm(struct rtw89_ser *ser)
249{
250	cancel_delayed_work(&ser->ser_alarm_work);
251	ser->alarm_event = SER_EV_NONE;
252}
253
254/* driver function */
255static void drv_stop_tx(struct rtw89_ser *ser)
256{
257	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
258
259	ieee80211_stop_queues(rtwdev->hw);
260	set_bit(RTW89_SER_DRV_STOP_TX, ser->flags);
261}
262
263static void drv_stop_rx(struct rtw89_ser *ser)
264{
265	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
266
267	clear_bit(RTW89_FLAG_RUNNING, rtwdev->flags);
268	set_bit(RTW89_SER_DRV_STOP_RX, ser->flags);
269}
270
271static void drv_trx_reset(struct rtw89_ser *ser)
272{
273	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
274
275	rtw89_hci_reset(rtwdev);
276}
277
278static void drv_resume_tx(struct rtw89_ser *ser)
279{
280	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
281
282	if (!test_bit(RTW89_SER_DRV_STOP_TX, ser->flags))
283		return;
284
285	ieee80211_wake_queues(rtwdev->hw);
286	clear_bit(RTW89_SER_DRV_STOP_TX, ser->flags);
287}
288
289static void drv_resume_rx(struct rtw89_ser *ser)
290{
291	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
292
293	if (!test_bit(RTW89_SER_DRV_STOP_RX, ser->flags))
294		return;
295
296	set_bit(RTW89_FLAG_RUNNING, rtwdev->flags);
297	clear_bit(RTW89_SER_DRV_STOP_RX, ser->flags);
298}
299
300static void ser_reset_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
301{
302	struct rtw89_vif_link *rtwvif_link;
303	unsigned int link_id;
304
305	rtwvif->tdls_peer = 0;
306
307	rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) {
308		rtw89_core_release_bit_map(rtwdev->hw_port, rtwvif_link->port);
309		rtwvif_link->net_type = RTW89_NET_TYPE_NO_LINK;
310		rtwvif_link->trigger = false;
311		rtwvif_link->rand_tsf_done = false;
312
313		rtw89_p2p_noa_once_deinit(rtwvif_link);
314	}
315}
316
317static void ser_sta_deinit_cam_iter(void *data, struct ieee80211_sta *sta)
318{
319	struct rtw89_vif *target_rtwvif = (struct rtw89_vif *)data;
320	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
321	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
322	struct rtw89_dev *rtwdev = rtwvif->rtwdev;
323	struct rtw89_vif_link *rtwvif_link;
324	struct rtw89_sta_link *rtwsta_link;
325	unsigned int link_id;
326
327	if (rtwvif != target_rtwvif)
328		return;
329
330	rtw89_sta_for_each_link(rtwsta, rtwsta_link, link_id) {
331		rtwvif_link = rtwsta_link->rtwvif_link;
332
333		if (rtwvif_link->net_type == RTW89_NET_TYPE_AP_MODE || sta->tdls)
334			rtw89_cam_deinit_addr_cam(rtwdev, &rtwsta_link->addr_cam);
335		if (sta->tdls)
336			rtw89_cam_deinit_bssid_cam(rtwdev, &rtwsta_link->bssid_cam);
337
338		INIT_LIST_HEAD(&rtwsta_link->ba_cam_list);
339	}
340}
341
342static void ser_deinit_cam(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
343{
344	struct rtw89_vif_link *rtwvif_link;
345	unsigned int link_id;
346
347	ieee80211_iterate_stations_atomic(rtwdev->hw,
348					  ser_sta_deinit_cam_iter,
349					  rtwvif);
350
351	rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)
352		rtw89_cam_deinit(rtwdev, rtwvif_link);
353
354	bitmap_zero(rtwdev->cam_info.ba_cam_map, RTW89_MAX_BA_CAM_NUM);
355}
356
357static void ser_reset_mac_binding(struct rtw89_dev *rtwdev)
358{
359	struct rtw89_vif *rtwvif;
360
361	rtw89_cam_reset_keys(rtwdev);
362	rtw89_for_each_rtwvif(rtwdev, rtwvif)
363		ser_deinit_cam(rtwdev, rtwvif);
364
365	rtw89_core_release_all_bits_map(rtwdev->mac_id_map, RTW89_MAX_MAC_ID_NUM);
366	rtw89_for_each_rtwvif(rtwdev, rtwvif)
367		ser_reset_vif(rtwdev, rtwvif);
368
369	rtwdev->total_sta_assoc = 0;
370	refcount_set(&rtwdev->refcount_ap_info, 0);
371}
372
373/* hal function */
374static int hal_enable_dma(struct rtw89_ser *ser)
375{
376	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
377	int ret;
378
379	if (!test_bit(RTW89_SER_HAL_STOP_DMA, ser->flags))
380		return 0;
381
382	if (!rtwdev->hci.ops->mac_lv1_rcvy)
383		return -EIO;
384
385	ret = rtwdev->hci.ops->mac_lv1_rcvy(rtwdev, RTW89_LV1_RCVY_STEP_2);
386	if (!ret)
387		clear_bit(RTW89_SER_HAL_STOP_DMA, ser->flags);
388	else
389		rtw89_debug(rtwdev, RTW89_DBG_SER,
390			    "lv1 rcvy fail to start dma: %d\n", ret);
391
392	return ret;
393}
394
395static int hal_stop_dma(struct rtw89_ser *ser)
396{
397	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
398	int ret;
399
400	if (!rtwdev->hci.ops->mac_lv1_rcvy)
401		return -EIO;
402
403	ret = rtwdev->hci.ops->mac_lv1_rcvy(rtwdev, RTW89_LV1_RCVY_STEP_1);
404	if (!ret)
405		set_bit(RTW89_SER_HAL_STOP_DMA, ser->flags);
406	else
407		rtw89_debug(rtwdev, RTW89_DBG_SER,
408			    "lv1 rcvy fail to stop dma: %d\n", ret);
409
410	return ret;
411}
412
413static void hal_send_post_m0_event(struct rtw89_ser *ser)
414{
415	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
416
417	rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RESET_START_DMAC);
418}
419
420static void hal_send_m2_event(struct rtw89_ser *ser)
421{
422	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
423
424	rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_DISABLE_EN);
425}
426
427static void hal_send_m4_event(struct rtw89_ser *ser)
428{
429	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
430
431	rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN);
432}
433
434static void hal_enable_err_imr(struct rtw89_ser *ser)
435{
436	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
437	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
438
439	mac->err_imr_ctrl(rtwdev, true);
440}
441
442/* state handler */
443static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt)
444{
445	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
446
447	switch (evt) {
448	case SER_EV_STATE_IN:
449		rtw89_hci_recovery_complete(rtwdev);
450		clear_bit(RTW89_FLAG_SER_HANDLING, rtwdev->flags);
451		clear_bit(RTW89_FLAG_CRASH_SIMULATING, rtwdev->flags);
452		break;
453	case SER_EV_L1_RESET_PREPARE:
454		ser_state_goto(ser, SER_L1_RESET_PRE_ST);
455		break;
456	case SER_EV_L1_RESET:
457		ser_state_goto(ser, SER_RESET_TRX_ST);
458		break;
459	case SER_EV_L2_RESET:
460		ser_state_goto(ser, SER_L2_RESET_ST);
461		break;
462	case SER_EV_STATE_OUT:
463		set_bit(RTW89_FLAG_SER_HANDLING, rtwdev->flags);
464		rtw89_hci_recovery_start(rtwdev);
465		break;
466	default:
467		break;
468	}
469}
470
471static void ser_l1_reset_pre_st_hdl(struct rtw89_ser *ser, u8 evt)
472{
473	switch (evt) {
474	case SER_EV_STATE_IN:
475		ser->prehandle_l1 = true;
476		hal_send_post_m0_event(ser);
477		ser_set_alarm(ser, 1000, SER_EV_M1_TIMEOUT);
478		break;
479	case SER_EV_L1_RESET:
480		ser_state_goto(ser, SER_RESET_TRX_ST);
481		break;
482	case SER_EV_M1_TIMEOUT:
483		ser_state_goto(ser, SER_L2_RESET_ST);
484		break;
485	case SER_EV_STATE_OUT:
486		ser_del_alarm(ser);
487		break;
488	default:
489		break;
490	}
491}
492
493static void ser_reset_trx_st_hdl(struct rtw89_ser *ser, u8 evt)
494{
495	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
496	struct wiphy *wiphy = rtwdev->hw->wiphy;
497
498	switch (evt) {
499	case SER_EV_STATE_IN:
500		wiphy_lock(wiphy);
501		wiphy_delayed_work_cancel(wiphy, &rtwdev->track_work);
502		wiphy_delayed_work_cancel(wiphy, &rtwdev->track_ps_work);
503		wiphy_unlock(wiphy);
504		drv_stop_tx(ser);
505
506		if (hal_stop_dma(ser)) {
507			ser_state_goto(ser, SER_L2_RESET_ST);
508			break;
509		}
510
511		drv_stop_rx(ser);
512		wiphy_lock(wiphy);
513		drv_trx_reset(ser);
514		wiphy_unlock(wiphy);
515
516		/* wait m3 */
517		hal_send_m2_event(ser);
518
519		/* set alarm to prevent FW response timeout */
520		ser_set_alarm(ser, 1000, SER_EV_M3_TIMEOUT);
521		break;
522
523	case SER_EV_DO_RECOVERY:
524		ser_state_goto(ser, SER_DO_HCI_ST);
525		break;
526
527	case SER_EV_M3_TIMEOUT:
528		ser_state_goto(ser, SER_L2_RESET_ST);
529		break;
530
531	case SER_EV_STATE_OUT:
532		ser_del_alarm(ser);
533		hal_enable_dma(ser);
534		drv_resume_rx(ser);
535		drv_resume_tx(ser);
536		wiphy_delayed_work_queue(wiphy, &rtwdev->track_work,
537					 RTW89_TRACK_WORK_PERIOD);
538		wiphy_delayed_work_queue(wiphy, &rtwdev->track_ps_work,
539					 RTW89_TRACK_PS_WORK_PERIOD);
540		break;
541
542	default:
543		break;
544	}
545}
546
547static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt)
548{
549	switch (evt) {
550	case SER_EV_STATE_IN:
551		/* wait m5 */
552		hal_send_m4_event(ser);
553
554		/* prevent FW response timeout */
555		ser_set_alarm(ser, 1000, SER_EV_FW_M5_TIMEOUT);
556		break;
557
558	case SER_EV_FW_M5_TIMEOUT:
559		ser_state_goto(ser, SER_L2_RESET_ST);
560		break;
561
562	case SER_EV_MAC_RESET_DONE:
563		hal_enable_err_imr(ser);
564
565		ser_state_goto(ser, SER_IDLE_ST);
566		break;
567
568	case SER_EV_STATE_OUT:
569		ser_del_alarm(ser);
570		break;
571
572	default:
573		break;
574	}
575}
576
577static void ser_mac_mem_dump(struct rtw89_dev *rtwdev, u8 *buf,
578			     u8 sel, u32 start_addr, u32 len)
579{
580	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
581	u32 filter_model_addr = mac->filter_model_addr;
582	u32 indir_access_addr = mac->indir_access_addr;
583	u32 mem_page_size = mac->mem_page_size;
584	u32 *ptr = (u32 *)buf;
585	u32 base_addr, start_page, residue;
586	u32 cnt = 0;
587	u32 i;
588
589	start_page = start_addr / mem_page_size;
590	residue = start_addr % mem_page_size;
591	base_addr = mac->mem_base_addrs[sel];
592	base_addr += start_page * mem_page_size;
593
594	while (cnt < len) {
595		rtw89_write32(rtwdev, filter_model_addr, base_addr);
596
597		for (i = indir_access_addr + residue;
598		     i < indir_access_addr + mem_page_size;
599		     i += 4, ptr++) {
600			*ptr = rtw89_read32(rtwdev, i);
601			cnt += 4;
602			if (cnt >= len)
603				break;
604		}
605
606		residue = 0;
607		base_addr += mem_page_size;
608	}
609}
610
611static void rtw89_ser_fw_rsvd_ple_dump(struct rtw89_dev *rtwdev, u8 *buf)
612{
613	u32 start_addr = rtwdev->chip->rsvd_ple_ofst;
614
615	rtw89_debug(rtwdev, RTW89_DBG_SER,
616		    "dump mem for fw rsvd payload engine (start addr: 0x%x)\n",
617		    start_addr);
618	ser_mac_mem_dump(rtwdev, buf, RTW89_MAC_MEM_SHARED_BUF, start_addr,
619			 RTW89_FW_RSVD_PLE_SIZE);
620}
621
622struct __fw_backtrace_entry {
623	u32 wcpu_addr;
624	u32 size;
625	u32 key;
626} __packed;
627
628struct __fw_backtrace_info {
629	u32 ra;
630	u32 sp;
631} __packed;
632
633static_assert(RTW89_FW_BACKTRACE_INFO_SIZE ==
634	      sizeof(struct __fw_backtrace_info));
635
636static u32 convert_addr_from_wcpu(u32 wcpu_addr)
637{
638	if (wcpu_addr < 0x30000000)
639		return wcpu_addr;
640
641	return wcpu_addr & GENMASK(28, 0);
642}
643
644static int rtw89_ser_fw_backtrace_dump(struct rtw89_dev *rtwdev, u8 *buf,
645				       const struct __fw_backtrace_entry *ent)
646{
647	struct __fw_backtrace_info *ptr = (struct __fw_backtrace_info *)buf;
648	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
649	u32 filter_model_addr = mac->filter_model_addr;
650	u32 indir_access_addr = mac->indir_access_addr;
651	u32 fwbt_addr = convert_addr_from_wcpu(ent->wcpu_addr);
652	u32 fwbt_size = ent->size;
653	u32 fwbt_key = ent->key;
654	u32 i;
655
656	if (fwbt_addr == 0) {
657		rtw89_warn(rtwdev, "FW backtrace invalid address: 0x%x\n",
658			   fwbt_addr);
659		return -EINVAL;
660	}
661
662	if (fwbt_key != RTW89_FW_BACKTRACE_KEY) {
663		rtw89_warn(rtwdev, "FW backtrace invalid key: 0x%x\n",
664			   fwbt_key);
665		return -EINVAL;
666	}
667
668	if (fwbt_size == 0 || !RTW89_VALID_FW_BACKTRACE_SIZE(fwbt_size) ||
669	    fwbt_size > RTW89_FW_BACKTRACE_MAX_SIZE) {
670		rtw89_warn(rtwdev, "FW backtrace invalid size: 0x%x\n",
671			   fwbt_size);
672		return -EINVAL;
673	}
674
675	rtw89_debug(rtwdev, RTW89_DBG_SER, "dump fw backtrace start\n");
676	rtw89_write32(rtwdev, filter_model_addr, fwbt_addr);
677
678	for (i = indir_access_addr;
679	     i < indir_access_addr + fwbt_size;
680	     i += RTW89_FW_BACKTRACE_INFO_SIZE, ptr++) {
681		*ptr = (struct __fw_backtrace_info){
682			.ra = rtw89_read32(rtwdev, i),
683			.sp = rtw89_read32(rtwdev, i + 4),
684		};
685		rtw89_debug(rtwdev, RTW89_DBG_SER,
686			    "next sp: 0x%x, next ra: 0x%x\n",
687			    ptr->sp, ptr->ra);
688	}
689
690	rtw89_debug(rtwdev, RTW89_DBG_SER, "dump fw backtrace end\n");
691	return 0;
692}
693
694static void ser_l2_reset_st_pre_hdl(struct rtw89_ser *ser)
695{
696	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
697	struct rtw89_ser_cd_buffer *buf;
698	struct __fw_backtrace_entry fwbt_ent;
699	int ret = 0;
700
701	buf = rtw89_ser_cd_prep(rtwdev);
702	if (!buf) {
703		ret = -ENOMEM;
704		goto bottom;
705	}
706
707	rtw89_ser_fw_rsvd_ple_dump(rtwdev, buf->fwple.data);
708
709	fwbt_ent = *(struct __fw_backtrace_entry *)buf->fwple.data;
710	ret = rtw89_ser_fw_backtrace_dump(rtwdev, buf->fwbt.data, &fwbt_ent);
711	if (ret)
712		goto bottom;
713
714	rtw89_ser_cd_send(rtwdev, buf);
715
716bottom:
717	rtw89_ser_cd_free(rtwdev, buf, !!ret);
718
719	ser_reset_mac_binding(rtwdev);
720	rtw89_core_stop(rtwdev);
721	rtw89_entity_init(rtwdev);
722	rtw89_fw_release_general_pkt_list(rtwdev, false);
723	INIT_LIST_HEAD(&rtwdev->rtwvifs_list);
724}
725
726static void ser_l2_reset_st_hdl(struct rtw89_ser *ser, u8 evt)
727{
728	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
729
730	switch (evt) {
731	case SER_EV_STATE_IN:
732		wiphy_lock(rtwdev->hw->wiphy);
733		ser_l2_reset_st_pre_hdl(ser);
734		wiphy_unlock(rtwdev->hw->wiphy);
735
736		ieee80211_restart_hw(rtwdev->hw);
737		ser_set_alarm(ser, SER_RECFG_TIMEOUT, SER_EV_L2_RECFG_TIMEOUT);
738		break;
739
740	case SER_EV_L2_RECFG_TIMEOUT:
741		rtw89_info(rtwdev, "Err: ser L2 re-config timeout\n");
742		fallthrough;
743	case SER_EV_L2_RECFG_DONE:
744		ser_state_goto(ser, SER_IDLE_ST);
745		break;
746
747	case SER_EV_STATE_OUT:
748		ser_del_alarm(ser);
749		break;
750
751	default:
752		break;
753	}
754}
755
756static const struct event_ent ser_ev_tbl[] = {
757	{SER_EV_NONE, "SER_EV_NONE"},
758	{SER_EV_STATE_IN, "SER_EV_STATE_IN"},
759	{SER_EV_STATE_OUT, "SER_EV_STATE_OUT"},
760	{SER_EV_L1_RESET_PREPARE, "SER_EV_L1_RESET_PREPARE pre-m0"},
761	{SER_EV_L1_RESET, "SER_EV_L1_RESET m1"},
762	{SER_EV_DO_RECOVERY, "SER_EV_DO_RECOVERY m3"},
763	{SER_EV_MAC_RESET_DONE, "SER_EV_MAC_RESET_DONE m5"},
764	{SER_EV_L2_RESET, "SER_EV_L2_RESET"},
765	{SER_EV_L2_RECFG_DONE, "SER_EV_L2_RECFG_DONE"},
766	{SER_EV_L2_RECFG_TIMEOUT, "SER_EV_L2_RECFG_TIMEOUT"},
767	{SER_EV_M1_TIMEOUT, "SER_EV_M1_TIMEOUT"},
768	{SER_EV_M3_TIMEOUT, "SER_EV_M3_TIMEOUT"},
769	{SER_EV_FW_M5_TIMEOUT, "SER_EV_FW_M5_TIMEOUT"},
770	{SER_EV_L0_RESET, "SER_EV_L0_RESET"},
771	{SER_EV_MAXX, "SER_EV_MAX"}
772};
773
774static const struct state_ent ser_st_tbl[] = {
775	{SER_IDLE_ST, "SER_IDLE_ST", ser_idle_st_hdl},
776	{SER_L1_RESET_PRE_ST, "SER_L1_RESET_PRE_ST", ser_l1_reset_pre_st_hdl},
777	{SER_RESET_TRX_ST, "SER_RESET_TRX_ST", ser_reset_trx_st_hdl},
778	{SER_DO_HCI_ST, "SER_DO_HCI_ST", ser_do_hci_st_hdl},
779	{SER_L2_RESET_ST, "SER_L2_RESET_ST", ser_l2_reset_st_hdl}
780};
781
782int rtw89_ser_init(struct rtw89_dev *rtwdev)
783{
784	struct rtw89_ser *ser = &rtwdev->ser;
785
786	memset(ser, 0, sizeof(*ser));
787	INIT_LIST_HEAD(&ser->msg_q);
788	ser->state = SER_IDLE_ST;
789	ser->st_tbl = ser_st_tbl;
790	ser->ev_tbl = ser_ev_tbl;
791
792	bitmap_zero(ser->flags, RTW89_NUM_OF_SER_FLAGS);
793	spin_lock_init(&ser->msg_q_lock);
794	INIT_WORK(&ser->ser_hdl_work, rtw89_ser_hdl_work);
795	INIT_DELAYED_WORK(&ser->ser_alarm_work, rtw89_ser_alarm_work);
796	return 0;
797}
798
799int rtw89_ser_deinit(struct rtw89_dev *rtwdev)
800{
801	struct rtw89_ser *ser = (struct rtw89_ser *)&rtwdev->ser;
802
803	set_bit(RTW89_SER_DRV_STOP_RUN, ser->flags);
804	cancel_delayed_work_sync(&ser->ser_alarm_work);
805	cancel_work_sync(&ser->ser_hdl_work);
806	clear_bit(RTW89_SER_DRV_STOP_RUN, ser->flags);
807	return 0;
808}
809
810void rtw89_ser_recfg_done(struct rtw89_dev *rtwdev)
811{
812	ser_send_msg(&rtwdev->ser, SER_EV_L2_RECFG_DONE);
813}
814
815int rtw89_ser_notify(struct rtw89_dev *rtwdev, u32 err)
816{
817	u8 event = SER_EV_NONE;
818
819	rtw89_info(rtwdev, "SER catches error: 0x%x\n", err);
820
821	switch (err) {
822	case MAC_AX_ERR_L1_PREERR_DMAC: /* pre-M0 */
823		event = SER_EV_L1_RESET_PREPARE;
824		break;
825	case MAC_AX_ERR_L1_ERR_DMAC:
826	case MAC_AX_ERR_L0_PROMOTE_TO_L1:
827		event = SER_EV_L1_RESET; /* M1 */
828		break;
829	case MAC_AX_ERR_L1_RESET_DISABLE_DMAC_DONE:
830		event = SER_EV_DO_RECOVERY; /* M3 */
831		break;
832	case MAC_AX_ERR_L1_RESET_RECOVERY_DONE:
833		event = SER_EV_MAC_RESET_DONE; /* M5 */
834		break;
835	case MAC_AX_ERR_L0_ERR_CMAC0:
836	case MAC_AX_ERR_L0_ERR_CMAC1:
837	case MAC_AX_ERR_L0_RESET_DONE:
838		event = SER_EV_L0_RESET;
839		break;
840	default:
841		if (err == MAC_AX_ERR_L1_PROMOTE_TO_L2 ||
842		    (err >= MAC_AX_ERR_L2_ERR_AH_DMA &&
843		     err <= MAC_AX_GET_ERR_MAX))
844			event = SER_EV_L2_RESET;
845		break;
846	}
847
848	if (event == SER_EV_NONE) {
849		rtw89_warn(rtwdev, "SER cannot recognize error: 0x%x\n", err);
850		return -EINVAL;
851	}
852
853	ser_send_msg(&rtwdev->ser, event);
854	return 0;
855}
856EXPORT_SYMBOL(rtw89_ser_notify);