From d663fd304a7bd5701b2b3ac42b4743dabb252750 Mon Sep 17 00:00:00 2001
From: "sujuan.chen" <sujuan.chen@mediatek.com>
Date: Thu, 18 May 2023 15:01:47 +0800
Subject: [PATCH 68/98] wifi: mt76: mt7996: reset addr_elem when delete ba

The old addr element info may be used when the signature is not equel to
0xff, and sta will find error SDP cause the SDP/SDL=0 issue.

Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
---
 mt76.h            |  1 +
 mt76_connac_mcu.h |  1 +
 mt7996/init.c     |  3 ++
 mt7996/mac.c      | 97 +++++++++++++++++++++++++++++++++++++++++++++++
 mt7996/mcu.c      | 77 +++++++++++++++++++++++++++++++++++++
 mt7996/mcu.h      | 46 ++++++++++++++++++++++
 mt7996/mt7996.h   | 27 +++++++++++++
 mt7996/regs.h     |  6 +++
 8 files changed, 258 insertions(+)

diff --git a/mt76.h b/mt76.h
index b960f3d..bea58ff 100644
--- a/mt76.h
+++ b/mt76.h
@@ -434,6 +434,7 @@ struct mt76_rx_tid {
 	u16 nframes;
 
 	u8 num;
+	u16 session_id;
 
 	u8 started:1, stopped:1, timer_pending:1;
 
diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
index e904ebc..f659d2e 100644
--- a/mt76_connac_mcu.h
+++ b/mt76_connac_mcu.h
@@ -1038,6 +1038,7 @@ enum {
 	MCU_UNI_EVENT_THERMAL = 0x35,
 	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
 	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
+	MCU_UNI_EVENT_RRO = 0x57,
 	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
 	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
 };
diff --git a/mt7996/init.c b/mt7996/init.c
index 4503482..1f01f24 100644
--- a/mt7996/init.c
+++ b/mt7996/init.c
@@ -779,6 +779,9 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
 	mt76_wr(dev, MT_RRO_HOST_INT_ENA,
 		MT_RRO_HOST_INT_ENA_HOST_RRO_DONE_ENA);
 
+	INIT_WORK(&dev->wed_rro.rro_del_work, mt7996_rro_delete_sessions);
+	INIT_LIST_HEAD(&dev->wed_rro.rro_poll_list);
+
 	/* rro ind cmd queue init */
 	return mt7996_dma_rro_init(dev);
 #else
diff --git a/mt7996/mac.c b/mt7996/mac.c
index b24f237..60ca23b 100644
--- a/mt7996/mac.c
+++ b/mt7996/mac.c
@@ -1450,6 +1450,96 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 	}
 }
 
+static struct mt7996_wed_rro_addr *
+mt7996_rro_get_addr_elem(struct mt7996_dev *dev, u16 seid, u16 sn)
+{
+	u32 idx;
+	void *addr;
+
+	if (seid == MT7996_RRO_MAX_SESSION) {
+		addr = dev->wed_rro.session.ptr;
+		idx = sn % MT7996_RRO_WINDOW_MAX_LEN;
+	} else {
+		addr = dev->wed_rro.addr_elem[seid / MT7996_RRO_BA_BITMAP_SESSION_SIZE].ptr;
+		idx = (seid % MT7996_RRO_BA_BITMAP_SESSION_SIZE) * MT7996_RRO_WINDOW_MAX_LEN
+			+ (sn % MT7996_RRO_WINDOW_MAX_LEN);
+	}
+	return addr + idx * sizeof(struct mt7996_wed_rro_addr);
+}
+
+static bool mt7996_rro_reset_sessions(struct mt7996_dev *dev, u16 session_id)
+{
+	struct  mt7996_wed_rro_addr *elem;
+	int i;
+
+	for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) {
+		elem = mt7996_rro_get_addr_elem(dev, session_id, i);
+		elem->signature = 0xff;
+	}
+	return true;
+
+}
+
+void  mt7996_rro_delete_sessions(struct work_struct *work)
+{
+	struct mt7996_dev *dev;
+	struct mt7996_rro_ba_session_elem *e;
+	int elem_nums;
+	LIST_HEAD(rro_poll_list);
+
+	dev = (struct mt7996_dev *)container_of(work, struct mt7996_dev,
+					       wed_rro.rro_del_work);
+	elem_nums = dev->wed_rro.elem_nums;
+
+	spin_lock_bh(&dev->wed_rro.rro_stbl_lock);
+	list_splice_init(&dev->wed_rro.rro_poll_list, &rro_poll_list);
+	spin_unlock_bh(&dev->wed_rro.rro_stbl_lock);
+
+	do {
+		spin_lock_bh(&dev->wed_rro.rro_stbl_lock);
+		if (list_empty(&rro_poll_list)) {
+			spin_unlock_bh(&dev->wed_rro.rro_stbl_lock);
+			break;
+		}
+
+		e = list_first_entry(&rro_poll_list,
+				     struct mt7996_rro_ba_session_elem,
+				     poll_list);
+		if (!e) {
+			spin_unlock_bh(&dev->wed_rro.rro_stbl_lock);
+			break;
+		}
+		list_del_init(&e->poll_list);
+		spin_unlock_bh(&dev->wed_rro.rro_stbl_lock);
+
+		if (mt7996_rro_reset_sessions(dev, e->session_id)) {
+			mt7996_mcu_reset_rro_sessions(dev, e->session_id);
+			kfree(e);
+			dev->wed_rro.elem_nums--;
+		}
+		elem_nums--;
+	} while (elem_nums);
+}
+
+int mt7996_rro_add_delete_elem(struct mt7996_dev *dev, u16 seid)
+{
+	struct mt7996_rro_ba_session_elem *e;
+
+	e = kzalloc(sizeof(*e), GFP_ATOMIC);
+	if (!e)
+		return -ENOMEM;
+
+	e->session_id = seid;
+
+	spin_lock_bh(&dev->wed_rro.rro_stbl_lock);
+	list_add_tail(&e->poll_list, &dev->wed_rro.rro_poll_list);
+	spin_unlock_bh(&dev->wed_rro.rro_stbl_lock);
+	dev->wed_rro.elem_nums++;
+
+	ieee80211_queue_work(mt76_hw(dev), &dev->wed_rro.rro_del_work);
+	return 0;
+}
+
 void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy)
 {
 	struct mt7996_dev *dev = phy->dev;
@@ -1774,6 +1864,9 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
 	if (phy3)
 		ieee80211_stop_queues(phy3->mt76->hw);
 
+	if (dev->has_rro)
+		cancel_work_sync(&dev->wed_rro.rro_del_work);
+
 	cancel_delayed_work_sync(&dev->mphy.mac_work);
 	if (phy2)
 		cancel_delayed_work_sync(&phy2->mt76->mac_work);
@@ -1865,6 +1958,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
 	set_bit(MT76_RESET, &dev->mphy.state);
 	set_bit(MT76_MCU_RESET, &dev->mphy.state);
 	wake_up(&dev->mt76.mcu.wait);
+
+	if (dev->has_rro)
+		cancel_work_sync(&dev->wed_rro.rro_del_work);
+
 	cancel_delayed_work_sync(&dev->mphy.mac_work);
 	if (phy2) {
 		set_bit(MT76_RESET, &phy2->mt76->state);
diff --git a/mt7996/mcu.c b/mt7996/mcu.c
index 6589610..ce38a5e 100644
--- a/mt7996/mcu.c
+++ b/mt7996/mcu.c
@@ -538,6 +538,60 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
 	return 0;
 }
 
+static void mt7996_mcu_rx_rro(struct mt7996_dev *dev, struct sk_buff *skb)
+{
+	struct mt7996_mcu_rro_event *event;
+	struct mt7996_mcu_rro_ba *rro;
+	struct mt7996_mcu_rro_ba_del_chk_done *delba;
+	u16 len;
+
+	if (!dev->has_rro)
+		return;
+
+	event = (struct mt7996_mcu_rro_event *)skb->data;
+	skb_pull(skb, sizeof(struct mt7996_mcu_rxd) + 4);
+
+	switch (event->tag) {
+	case UNI_RRO_BA_SESSION_STATUS: {
+		len = sizeof(struct mt7996_mcu_rro_ba);
+		while (unlikely(len > skb->len) ? NULL : true) {
+			rro = (struct mt7996_mcu_rro_ba *)skb->data;
+			u16 idx = cpu_to_le16(rro->wlan_id);
+			struct mt76_rx_tid *tid;
+			struct mt76_wcid *wcid;
+
+			wcid = rcu_dereference(dev->mt76.wcid[idx]);
+			if (!wcid || !wcid->sta)
+				return;
+
+			tid = rcu_dereference(wcid->aggr[rro->tid]);
+			if (!tid)
+				return;
+			tid->session_id = cpu_to_le16(rro->session_id);
+			skb_pull(skb, len);
+		}
+		break;
+	}
+	case UNI_RRO_BA_SESSION_DEL_CHK_DONE: {
+		len = sizeof(struct mt7996_mcu_rro_ba_del_chk_done);
+		while (unlikely(len > skb->len) ? NULL : true) {
+			delba = (struct mt7996_mcu_rro_ba_del_chk_done *)skb->data;
+			u16 session_id = cpu_to_le16(delba->session_id);
+
+			mt7996_rro_add_delete_elem(dev, session_id);
+			skb_pull(skb, len);
+		}
+		break;
+	}
+
+	default:
+		dev_info(dev->mt76.dev, "%s: unknown rro event tag %d\n",
+			 __func__, event->tag);
+		break;
+	}
+
+}
+
 static void
 mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
 {
@@ -663,6 +717,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
 		mt7996_tm_rf_test_event(dev, skb);
 		break;
 #endif
+	case MCU_UNI_EVENT_RRO:
+		mt7996_mcu_rx_rro(dev, skb);
+		break;
 	default:
 		break;
 	}
@@ -4615,6 +4672,26 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
 				 sizeof(req), true);
 }
 
+int mt7996_mcu_reset_rro_sessions(struct mt7996_dev *dev, u16 seid)
+{
+	struct {
+		/* fixed field */
+		u8 __rsv[4];
+
+		__le16 tag;
+		__le16 len;
+		__le16 session_id;
+		u8 pad[4];
+	} __packed req = {
+		.tag = cpu_to_le16(UNI_RRO_DEL_BA_SESSION),
+		.len = cpu_to_le16(sizeof(req) - 4),
+		.session_id = cpu_to_le16(seid),
+	};
+
+	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO),
+				 &req, sizeof(req), true);
+}
+
 int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
 {
 	struct mt7996_dev *dev = phy->dev;
diff --git a/mt7996/mcu.h b/mt7996/mcu.h
index 666216a..0aa68f7 100644
--- a/mt7996/mcu.h
+++ b/mt7996/mcu.h
@@ -239,6 +239,50 @@ struct mt7996_mcu_all_sta_info_event {
 	};
 } __packed;
 
+struct mt7996_mcu_rro_event {
+	struct mt7996_mcu_rxd rxd;
+
+	u8 __rsv1[4];
+
+	__le16 tag;
+	__le16 len;
+} __packed;
+
+struct mt7996_mcu_rro_ba {
+	__le16 tag;
+	__le16 len;
+
+	__le16 wlan_id;
+	u8 tid;
+	u8 __rsv1;
+	__le32 status;
+	__le16 session_id;
+	u8 __rsv2[2];
+} __packed;
+
+struct mt7996_mcu_rro_ba_del_chk_done {
+	__le16 tag;
+	__le16 len;
+
+	__le16 session_id;
+	u8 __rsv2[2];
+} __packed;
+
+enum  {
+	UNI_RRO_BA_SESSION_STATUS = 0,
+	UNI_RRO_BA_SESSION_TBL	= 1,
+	UNI_RRO_BA_SESSION_DEL_CHK_DONE = 2,
+	UNI_RRO_BA_SESSION_MAX_NUM
+};
+
+struct mt7996_mcu_rro_del_ba {
+	struct mt7996_mcu_rro_event event;
+
+	u8  wlan_idx;
+	u8  tid;
+	u8 __rsv2[2];
+};
+
 enum mt7996_chan_mib_offs {
 	UNI_MIB_OBSS_AIRTIME = 26,
 	UNI_MIB_NON_WIFI_TIME = 27,
@@ -840,6 +884,8 @@ enum {
 	UNI_RRO_GET_BA_SESSION_TABLE,
 	UNI_RRO_SET_BYPASS_MODE,
 	UNI_RRO_SET_TXFREE_PATH,
+	UNI_RRO_DEL_BA_SESSION,
+	UNI_RRO_SET_FLUSH_TIMEOUT
 };
 
 enum{
diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
index bba1364..af67c59 100644
--- a/mt7996/mt7996.h
+++ b/mt7996/mt7996.h
@@ -282,6 +282,26 @@ struct mt7996_wed_rro_addr {
 	u32 signature : 8;
 };
 
+struct mt7996_rro_ba_session {
+	u32 ack_sn         :12;
+	u32 win_sz         :3;
+	u32 bn             :1;
+	u32 last_in_sn     :12;
+	u32 bc             :1;
+	u32 bd             :1;
+	u32 sat            :1;
+	u32 cn             :1;
+	u32 within_cnt     :12;
+	u32 to_sel         :3;
+	u32 rsv            :1;
+	u32 last_in_rxtime :12;
+};
+
+struct mt7996_rro_ba_session_elem {
+	struct list_head poll_list;
+	u16 session_id;
+};
+
 struct mt7996_phy {
 	struct mt76_phy *mt76;
 	struct mt7996_dev *dev;
@@ -418,6 +438,10 @@ struct mt7996_dev {
 			void *ptr;
 			dma_addr_t phy_addr;
 		} session;
+		struct work_struct rro_del_work;
+		spinlock_t rro_stbl_lock;
+		struct list_head rro_poll_list;
+		u16 elem_nums;
 	} wed_rro;
 
 	bool testmode_enable;
@@ -653,6 +677,7 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
 int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set);
 int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans);
 int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val);
+int mt7996_mcu_reset_rro_sessions(struct mt7996_dev *dev, u16 seid);
 int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
 int mt7996_mcu_red_config(struct mt7996_dev *dev, bool enable);
 int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
@@ -757,6 +782,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
 			  struct ieee80211_sta *sta,
 			  struct mt76_tx_info *tx_info);
 void mt7996_tx_token_put(struct mt7996_dev *dev);
+void  mt7996_rro_delete_sessions(struct work_struct *work);
+int mt7996_rro_add_delete_elem(struct mt7996_dev *dev, u16 seid);
 void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 			 struct sk_buff *skb, u32 *info);
 bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
diff --git a/mt7996/regs.h b/mt7996/regs.h
index d305c25..38467d9 100644
--- a/mt7996/regs.h
+++ b/mt7996/regs.h
@@ -101,6 +101,12 @@ enum offs_rev {
 #define MT_RRO_ACK_SN_CTRL_SN_MASK		GENMASK(27, 16)
 #define MT_RRO_ACK_SN_CTRL_SESSION_MASK		GENMASK(11, 0)
 
+#define MT_RRO_DBG_RD_CTRL			MT_RRO_TOP(0xe0)
+#define MT_RRO_DBG_RD_ADDR			GENMASK(15, 0)
+#define MT_RRO_DBG_RD_EXEC			BIT(31)
+
+#define MT_RRO_DBG_RDAT_DW(_n)			MT_RRO_TOP(0xf0 + _n * 0x4)
+
 #define MT_MCU_INT_EVENT			0x2108
 #define MT_MCU_INT_EVENT_DMA_STOPPED		BIT(0)
 #define MT_MCU_INT_EVENT_DMA_INIT		BIT(1)
-- 
2.18.0