[][MAC80211][mt76][Refactor the SER L0.5 patch to support mt7916/mt7915]
[Description]
Refactor the SER L0.5 patch to support mt7916/mt7915
[Release-log]
N/A
Change-Id: Ib94ee1414ec0eb4eb4c6777fe6897f0c8e50f797
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/5943955
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch
new file mode 100755
index 0000000..d4c81d9
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch
@@ -0,0 +1,278 @@
+From f3f9ccbb417cae6e503084e13d627b68a141b0bd Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Thu, 5 May 2022 11:45:23 +0800
+Subject: [PATCH 02/10] mt76: mt7915: reowrk SER debugfs knob
+
+1. get status of system recovery from firmware.
+2. add more recovery points.
+3. make knob per phy.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+---
+ mt7915/debugfs.c | 106 ++++++++++++++++++++++++++++++++++++++++-------
+ mt7915/mcu.c | 5 +--
+ mt7915/mcu.h | 14 +++++++
+ mt7915/mmio.c | 3 ++
+ mt7915/regs.h | 18 +++++++-
+ 5 files changed, 126 insertions(+), 20 deletions(-)
+
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 77bbeeed..b45181c1 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -44,35 +44,113 @@ mt7915_implicit_txbf_get(void *data, u64 *val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7915_implicit_txbf_get,
+ mt7915_implicit_txbf_set, "%lld\n");
+
+-/* test knob of system layer 1/2 error recovery */
+-static int mt7915_ser_trigger_set(void *data, u64 val)
++/* test knob of system error recovery */
++static ssize_t
++mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
++ size_t count, loff_t *ppos)
+ {
+- enum {
+- SER_SET_RECOVER_L1 = 1,
+- SER_SET_RECOVER_L2,
+- SER_ENABLE = 2,
+- SER_RECOVER
+- };
+- struct mt7915_dev *dev = data;
++ struct mt7915_phy *phy = file->private_data;
++ struct mt7915_dev *dev = phy->dev;
++ bool ext_phy = phy != &dev->phy;
++ char buf[16];
+ int ret = 0;
++ u16 val;
++
++ if (count >= sizeof(buf))
++ return -EINVAL;
++
++ if (copy_from_user(buf, user_buf, count))
++ return -EFAULT;
++
++ if (count && buf[count - 1] == '\n')
++ buf[count - 1] = '\0';
++ else
++ buf[count] = '\0';
++
++ if (kstrtou16(buf, 0, &val))
++ return -EINVAL;
+
+ switch (val) {
++ case SER_QUERY:
++ /* grab firmware SER stats */
++ ret = mt7915_mcu_set_ser(dev, 0, 0, ext_phy);
++ break;
+ case SER_SET_RECOVER_L1:
+ case SER_SET_RECOVER_L2:
+- ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), 0);
++ case SER_SET_RECOVER_L3_RX_ABORT:
++ case SER_SET_RECOVER_L3_TX_ABORT:
++ case SER_SET_RECOVER_L3_TX_DISABLE:
++ case SER_SET_RECOVER_L3_BF:
++ ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), ext_phy);
+ if (ret)
+ return ret;
+
+- return mt7915_mcu_set_ser(dev, SER_RECOVER, val, 0);
++ ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, ext_phy);
++ break;
+ default:
+ break;
+ }
+
++ return ret ? ret : count;
++}
++
++static ssize_t
++mt7915_fw_ser_get(struct file *file, char __user *user_buf,
++ size_t count, loff_t *ppos)
++{
++ struct mt7915_phy *phy = file->private_data;
++ struct mt7915_dev *dev = phy->dev;
++ char *buff;
++ int desc = 0;
++ ssize_t ret;
++ static const size_t bufsz = 400;
++
++ buff = kmalloc(bufsz, GFP_KERNEL);
++ if (!buff)
++ return -ENOMEM;
++
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_STATUS = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_SER_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_PLE_ERR = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_PLE_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_PLE_ERR_1 = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_PLE1_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_PLE_ERR_AMSDU = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_PLE_AMSDU_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_PSE_ERR = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_PSE_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_PSE_ERR_1 = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_PSE1_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_LMAC_WISR6_B0 = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN0_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_LMAC_WISR6_B1 = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN1_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_LMAC_WISR7_B0 = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN0_STATS));
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "::E R , SER_LMAC_WISR7_B1 = 0x%08x\n",
++ mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATS));
++
++ ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
++ kfree(buff);
+ return ret;
+ }
+
+-DEFINE_DEBUGFS_ATTRIBUTE(fops_ser_trigger, NULL,
+- mt7915_ser_trigger_set, "%lld\n");
++static const struct file_operations mt7915_fw_ser_ops = {
++ .write = mt7915_fw_ser_set,
++ .read = mt7915_fw_ser_get,
++ .open = simple_open,
++ .llseek = default_llseek,
++};
+
+ static int
+ mt7915_radar_trigger(void *data, u64 val)
+@@ -914,6 +992,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ debugfs_create_file("xmit-queues", 0400, dir, phy,
+ &mt7915_xmit_queues_fops);
+ debugfs_create_file("tx_stats", 0400, dir, phy, &mt7915_tx_stats_fops);
++ debugfs_create_file("fw_ser", 0600, dir, phy, &mt7915_fw_ser_ops);
+ debugfs_create_file("fw_debug_wm", 0600, dir, dev, &fops_fw_debug_wm);
+ debugfs_create_file("fw_debug_wa", 0600, dir, dev, &fops_fw_debug_wa);
+ debugfs_create_file("fw_debug_bin", 0600, dir, dev, &fops_fw_debug_bin);
+@@ -927,7 +1006,6 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ &mt7915_rate_txpower_fops);
+ debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
+ mt7915_twt_stats);
+- debugfs_create_file("ser_trigger", 0200, dir, dev, &fops_ser_trigger);
+ debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+
+ if (!dev->dbdc_support || phy->band_idx) {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index c215bc9e..20f32f7f 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2471,10 +2471,7 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+ /* force firmware operation mode into normal state,
+ * which should be set before firmware download stage.
+ */
+- if (is_mt7915(&dev->mt76))
+- mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
+- else
+- mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
++ mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
+
+ ret = mt7915_driver_own(dev, 0);
+ if (ret)
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index df7aefca..5cbc3ecf 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -464,6 +464,20 @@ enum {
+ MURU_GET_TXC_TX_STATS = 151,
+ };
+
++enum {
++ SER_QUERY,
++ /* recovery */
++ SER_SET_RECOVER_L1,
++ SER_SET_RECOVER_L2,
++ SER_SET_RECOVER_L3_RX_ABORT,
++ SER_SET_RECOVER_L3_TX_ABORT,
++ SER_SET_RECOVER_L3_TX_DISABLE,
++ SER_SET_RECOVER_L3_BF,
++ /* action */
++ SER_ENABLE = 2,
++ SER_RECOVER
++};
++
+ #define MT7915_BSS_UPDATE_MAX_SIZE (sizeof(struct sta_req_hdr) + \
+ sizeof(struct bss_info_omac) + \
+ sizeof(struct bss_info_basic) +\
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 0bd32daa..2d733d32 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -22,6 +22,7 @@ static const u32 mt7915_reg[] = {
+ [WFDMA_EXT_CSR_ADDR] = 0xd7000,
+ [CBTOP1_PHY_END] = 0x77ffffff,
+ [INFRA_MCU_ADDR_END] = 0x7c3fffff,
++ [SWDEF_BASE_ADDR] = 0x41f200,
+ };
+
+ static const u32 mt7916_reg[] = {
+@@ -36,6 +37,7 @@ static const u32 mt7916_reg[] = {
+ [WFDMA_EXT_CSR_ADDR] = 0xd7000,
+ [CBTOP1_PHY_END] = 0x7fffffff,
+ [INFRA_MCU_ADDR_END] = 0x7c085fff,
++ [SWDEF_BASE_ADDR] = 0x411400,
+ };
+
+ static const u32 mt7986_reg[] = {
+@@ -50,6 +52,7 @@ static const u32 mt7986_reg[] = {
+ [WFDMA_EXT_CSR_ADDR] = 0x27000,
+ [CBTOP1_PHY_END] = 0x7fffffff,
+ [INFRA_MCU_ADDR_END] = 0x7c085fff,
++ [SWDEF_BASE_ADDR] = 0x411400,
+ };
+
+ static const u32 mt7915_offs[] = {
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 97984aaf..4251cf78 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -30,6 +30,7 @@ enum reg_rev {
+ WFDMA_EXT_CSR_ADDR,
+ CBTOP1_PHY_END,
+ INFRA_MCU_ADDR_END,
++ SWDEF_BASE_ADDR,
+ __MT_REG_MAX,
+ };
+
+@@ -942,12 +943,25 @@ enum offs_rev {
+ #define MT_ADIE_TYPE_MASK BIT(1)
+
+ /* FW MODE SYNC */
+-#define MT_SWDEF_MODE 0x41f23c
+-#define MT_SWDEF_MODE_MT7916 0x41143c
++#define MT_SWDEF_BASE __REG(SWDEF_BASE_ADDR)
++
++#define MT_SWDEF(ofs) (MT_SWDEF_BASE + (ofs))
++#define MT_SWDEF_MODE MT_SWDEF(0x3c)
+ #define MT_SWDEF_NORMAL_MODE 0
+ #define MT_SWDEF_ICAP_MODE 1
+ #define MT_SWDEF_SPECTRUM_MODE 2
+
++#define MT_SWDEF_SER_STATS MT_SWDEF(0x040)
++#define MT_SWDEF_PLE_STATS MT_SWDEF(0x044)
++#define MT_SWDEF_PLE1_STATS MT_SWDEF(0x048)
++#define MT_SWDEF_PLE_AMSDU_STATS MT_SWDEF(0x04C)
++#define MT_SWDEF_PSE_STATS MT_SWDEF(0x050)
++#define MT_SWDEF_PSE1_STATS MT_SWDEF(0x054)
++#define MT_SWDEF_LAMC_WISR6_BN0_STATS MT_SWDEF(0x058)
++#define MT_SWDEF_LAMC_WISR6_BN1_STATS MT_SWDEF(0x05C)
++#define MT_SWDEF_LAMC_WISR7_BN0_STATS MT_SWDEF(0x060)
++#define MT_SWDEF_LAMC_WISR7_BN1_STATS MT_SWDEF(0x064)
++
+ #define MT_DIC_CMD_REG_BASE 0x41f000
+ #define MT_DIC_CMD_REG(ofs) (MT_DIC_CMD_REG_BASE + (ofs))
+ #define MT_DIC_CMD_REG_CMD MT_DIC_CMD_REG(0x10)
+--
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch
new file mode 100755
index 0000000..9e20c45
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch
@@ -0,0 +1,43 @@
+From a56d23330b0ac01929a54c427bd338b02a7e727e Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Fri, 6 May 2022 21:06:55 +0800
+Subject: [PATCH 03/10] mt76: mt7615/mt7915: do reset_work with mt76's work
+ queue
+
+reset_work may be blocked when mcu message timeout occurs
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ mt7615/mmio.c | 2 +-
+ mt7915/mmio.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt7615/mmio.c b/mt7615/mmio.c
+index ce45c3bf..a208035e 100644
+--- a/mt7615/mmio.c
++++ b/mt7615/mmio.c
+@@ -145,7 +145,7 @@ static void mt7615_irq_tasklet(struct tasklet_struct *t)
+ return;
+
+ dev->reset_state = mcu_int;
+- ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
++ queue_work(dev->mt76.wq, &dev->reset_work);
+ wake_up(&dev->reset_wait);
+ }
+
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 2d733d32..4d4537cd 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -612,7 +612,7 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+ mt76_wr(dev, MT_MCU_CMD, val);
+ if (val & MT_MCU_CMD_ERROR_MASK) {
+ dev->reset_state = val;
+- ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
++ queue_work(dev->mt76.wq, &dev->reset_work);
+ wake_up(&dev->reset_wait);
+ }
+ }
+--
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
new file mode 100755
index 0000000..20ccd9d
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -0,0 +1,935 @@
+From ce9d865db52e49410af55a3b348f00ed1511ccbc Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Thu, 5 May 2022 16:25:44 +0800
+Subject: [PATCH 04/10] mt76: mt7915: add L0.5 system error recovery support
+
+add L0.5 system error recovery support
+auto trigger l0.5 ser when detect fw exception or mem dma hang.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ mt7915/debugfs.c | 88 ++++++++++++---
+ mt7915/dma.c | 48 ++++++++
+ mt7915/init.c | 8 +-
+ mt7915/mac.c | 280 +++++++++++++++++++++++++++++++++++++----------
+ mt7915/main.c | 20 +++-
+ mt7915/mcu.c | 96 ++++++++++++++--
+ mt7915/mcu.h | 3 +-
+ mt7915/mmio.c | 8 +-
+ mt7915/mt7915.h | 23 ++++
+ mt7915/regs.h | 16 +++
+ 10 files changed, 493 insertions(+), 97 deletions(-)
+
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index b45181c1..f07df470 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -49,12 +49,17 @@ static ssize_t
+ mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
+ size_t count, loff_t *ppos)
+ {
++#define SER_LEVEL GENMASK(3, 0)
++#define SER_ACTION GENMASK(11, 8)
++
+ struct mt7915_phy *phy = file->private_data;
+ struct mt7915_dev *dev = phy->dev;
+- bool ext_phy = phy != &dev->phy;
++ u8 ser_action, ser_set, set_val;
++ u8 band_idx = phy->band_idx;
+ char buf[16];
+ int ret = 0;
+ u16 val;
++ u32 intr;
+
+ if (count >= sizeof(buf))
+ return -EINVAL;
+@@ -70,28 +75,71 @@ mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
+ if (kstrtou16(buf, 0, &val))
+ return -EINVAL;
+
+- switch (val) {
++ ser_action = FIELD_GET(SER_ACTION, val);
++ ser_set = set_val = FIELD_GET(SER_LEVEL, val);
++
++ switch (ser_action) {
+ case SER_QUERY:
+ /* grab firmware SER stats */
+- ret = mt7915_mcu_set_ser(dev, 0, 0, ext_phy);
++ ser_set = 0;
+ break;
+- case SER_SET_RECOVER_L1:
+- case SER_SET_RECOVER_L2:
+- case SER_SET_RECOVER_L3_RX_ABORT:
+- case SER_SET_RECOVER_L3_TX_ABORT:
+- case SER_SET_RECOVER_L3_TX_DISABLE:
+- case SER_SET_RECOVER_L3_BF:
+- ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), ext_phy);
+- if (ret)
+- return ret;
+-
+- ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, ext_phy);
++ case SER_SET:
++ /*
++ * 0x100: disable system error recovery function.
++ * 0x101: enable system error recovery function.
++ * 0x103: enable l0.5 recover function.
++ */
++ ser_set = !!set_val;
++
++ dev->ser.reset_enable = ser_set;
++ intr = mt76_rr(dev, MT_WFDMA0_MCU_HOST_INT_ENA);
++ if (dev->ser.reset_enable)
++ intr |= MT_MCU_CMD_WDT_MASK;
++ else
++ intr &= ~MT_MCU_CMD_WDT_MASK;
++ mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, intr);
+ break;
+- default:
++ case SER_ENABLE:
++ /*
++ * 0x200: enable system error tracking.
++ * 0x201: enable system error L1 recover.
++ * 0x202: enable system error L2 recover.
++ * 0x203: enable system error L3 rx abort.
++ * 0x204: enable system error L3 tx abort.
++ * 0x205: enable system error L3 tx disable.
++ * 0x206: enable system error L3 bf recover.
++ * 0x207: enable system error all recover.
++ */
++ ser_set = set_val > 7 ? 0x7f : BIT(set_val);
++ break;
++ case SER_RECOVER:
++ /*
++ * 0x300: trigger L0.5 recover.
++ * 0x301: trigger L1 recover.
++ * 0x302: trigger L2 recover.
++ * 0x303: trigger L3 rx abort.
++ * 0x304: trigger L3 tx abort
++ * 0x305: trigger L3 tx disable.
++ * 0x306: trigger L3 bf recover.
++ */
++ if (!ser_set) {
++ if (dev->ser.reset_enable) {
++ dev->reset_state |= MT_MCU_CMD_WDT_MASK;
++ mt7915_reset(dev);
++ } else {
++ dev_info(dev->mt76.dev, "SER: chip full recovery not enable\n");
++ }
++ goto out;
++ }
+ break;
++ default:
++ goto out;
+ }
+-
+- return ret ? ret : count;
++ ret = mt7915_mcu_set_ser(dev, ser_action, ser_set, band_idx);
++ if (ret)
++ return ret;
++out:
++ return count;
+ }
+
+ static ssize_t
+@@ -140,6 +188,12 @@ mt7915_fw_ser_get(struct file *file, char __user *user_buf,
+ "::E R , SER_LMAC_WISR7_B1 = 0x%08x\n",
+ mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATS));
+
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "\nWF RESET STATUS: EN %d, WM %d, WA %d\n",
++ dev->ser.reset_enable,
++ dev->ser.wf_reset_wm_count,
++ dev->ser.wf_reset_wa_count);
++
+ ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
+ kfree(buff);
+ return ret;
+diff --git a/mt7915/dma.c b/mt7915/dma.c
+index c2d655cd..9e3d14db 100644
+--- a/mt7915/dma.c
++++ b/mt7915/dma.c
+@@ -486,6 +486,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ return 0;
+ }
+
++int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
++{
++ struct mt76_phy *mphy_ext = dev->mt76.phy2;
++ int i;
++
++ /* clean up hw queues */
++ for (i = 0; i < ARRAY_SIZE(dev->mt76.phy.q_tx); i++) {
++ mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
++ if (mphy_ext)
++ mt76_queue_tx_cleanup(dev, mphy_ext->q_tx[i], true);
++ }
++
++ for (i = 0; i < ARRAY_SIZE(dev->mt76.q_mcu); i++)
++ mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
++
++ mt76_for_each_q_rx(&dev->mt76, i)
++ mt76_queue_rx_cleanup(dev, &dev->mt76.q_rx[i]);
++
++ /* reset wfsys */
++ if (force)
++ mt7915_wfsys_reset(dev);
++
++ /* disable wfdma */
++ mt7915_dma_disable(dev, force);
++
++ /* reset hw queues */
++ for (i = 0; i < __MT_TXQ_MAX; i++) {
++ mt76_queue_reset(dev, dev->mphy.q_tx[i]);
++ if (mphy_ext)
++ mt76_queue_reset(dev, mphy_ext->q_tx[i]);
++ }
++
++ for (i = 0; i < __MT_MCUQ_MAX; i++)
++ mt76_queue_reset(dev, dev->mt76.q_mcu[i]);
++
++ mt76_for_each_q_rx(&dev->mt76, i)
++ mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
++
++ mt76_tx_status_check(&dev->mt76, true);
++
++ mt7915_dma_enable(dev);
++
++ mt76_for_each_q_rx(&dev->mt76, i)
++ mt76_queue_rx_reset(dev, i);
++
++ return 0;
++}
++
+ void mt7915_dma_cleanup(struct mt7915_dev *dev)
+ {
+ mt7915_dma_disable(dev, true);
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 1c956d3d..4984ec8f 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
+ mt7915_led_set_config(led_cdev, 0xff, 0);
+ }
+
+-static void
++void
+ mt7915_init_txpower(struct mt7915_dev *dev,
+ struct ieee80211_supported_band *sband)
+ {
+@@ -441,7 +441,7 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+ mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
+ }
+
+-static void mt7915_mac_init(struct mt7915_dev *dev)
++void mt7915_mac_init(struct mt7915_dev *dev)
+ {
+ int i;
+ u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
+@@ -471,7 +471,7 @@ static void mt7915_mac_init(struct mt7915_dev *dev)
+ }
+ }
+
+-static int mt7915_txbf_init(struct mt7915_dev *dev)
++int mt7915_txbf_init(struct mt7915_dev *dev)
+ {
+ int ret;
+
+@@ -1112,6 +1112,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+
+ mt7915_init_debugfs(&dev->phy);
+
++ dev->ser.hw_init_done = true;
++
+ return 0;
+
+ unreg_thermal:
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index de5f3f10..1a1798d2 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -3,6 +3,7 @@
+
+ #include <linux/etherdevice.h>
+ #include <linux/timekeeping.h>
++#include <linux/pci.h>
+ #include "mt7915.h"
+ #include "../dma.h"
+ #include "mac.h"
+@@ -2037,85 +2038,188 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+ mt7915_update_vif_beacon, dev->mt76.phy2->hw);
+ }
+
+-static void
+-mt7915_dma_reset(struct mt7915_dev *dev)
++void mt7915_tx_token_put(struct mt7915_dev *dev)
+ {
+- struct mt76_phy *mphy_ext = dev->mt76.phy2;
+- u32 hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
+- int i;
++ struct mt76_txwi_cache *txwi;
++ int id;
+
+- mt76_clear(dev, MT_WFDMA0_GLO_CFG,
+- MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+- MT_WFDMA0_GLO_CFG_RX_DMA_EN);
++ spin_lock_bh(&dev->mt76.token_lock);
++ idr_for_each_entry(&dev->mt76.token, txwi, id) {
++ mt7915_txwi_free(dev, txwi, NULL, NULL);
++ dev->mt76.token_count--;
++ }
++ spin_unlock_bh(&dev->mt76.token_lock);
++ idr_destroy(&dev->mt76.token);
++}
+
+- if (is_mt7915(&dev->mt76))
+- mt76_clear(dev, MT_WFDMA1_GLO_CFG,
+- MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+- MT_WFDMA1_GLO_CFG_RX_DMA_EN);
++static int
++mt7915_mac_reset(struct mt7915_dev *dev)
++{
++ struct mt7915_phy *phy2;
++ struct mt76_phy *ext_phy;
++ struct mt76_dev *mdev = &dev->mt76;
++ int i, ret;
++ u32 irq_mask;
++
++ ext_phy = dev->mt76.phy2;
++ phy2 = ext_phy ? ext_phy->priv : NULL;
++
++ /* irq disable */
++ mt76_wr(dev, MT_INT_MASK_CSR, 0x0);
++ mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
+ if (dev->hif2) {
+- mt76_clear(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
+- MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+- MT_WFDMA0_GLO_CFG_RX_DMA_EN);
++ mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
++ mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
++ }
++ if (dev_is_pci(mdev->dev)) {
++ mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0);
++ if (dev->hif2)
++ mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
++ }
+
+- if (is_mt7915(&dev->mt76))
+- mt76_clear(dev, MT_WFDMA1_GLO_CFG + hif1_ofs,
+- MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+- MT_WFDMA1_GLO_CFG_RX_DMA_EN);
++ set_bit(MT76_RESET, &dev->mphy.state);
++ set_bit(MT76_MCU_RESET, &dev->mphy.state);
++ wake_up(&dev->mt76.mcu.wait);
++ if (ext_phy) {
++ set_bit(MT76_RESET, &ext_phy->state);
++ set_bit(MT76_MCU_RESET, &ext_phy->state);
+ }
+
+- usleep_range(1000, 2000);
++ /* lock/unlock all queues to ensure that no tx is pending */
++ mt76_txq_schedule_all(&dev->mphy);
++ if (ext_phy)
++ mt76_txq_schedule_all(ext_phy);
+
+- for (i = 0; i < __MT_TXQ_MAX; i++) {
+- mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
+- if (mphy_ext)
+- mt76_queue_tx_cleanup(dev, mphy_ext->q_tx[i], true);
++ /* disable all tx/rx napi */
++ mt76_worker_disable(&dev->mt76.tx_worker);
++ mt76_for_each_q_rx(mdev, i) {
++ if (mdev->q_rx[i].ndesc)
++ napi_disable(&dev->mt76.napi[i]);
+ }
++ napi_disable(&dev->mt76.tx_napi);
+
+- for (i = 0; i < __MT_MCUQ_MAX; i++)
+- mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
+-
+- mt76_for_each_q_rx(&dev->mt76, i)
+- mt76_queue_rx_reset(dev, i);
++ /* token reinit */
++ mt7915_tx_token_put(dev);
++ idr_init(&dev->mt76.token);
+
+- mt76_tx_status_check(&dev->mt76, true);
++ mt7915_dma_reset(dev, true);
+
+- /* re-init prefetch settings after reset */
+- mt7915_dma_prefetch(dev);
++ local_bh_disable();
++ mt76_for_each_q_rx(mdev, i) {
++ if (mdev->q_rx[i].ndesc) {
++ napi_enable(&dev->mt76.napi[i]);
++ napi_schedule(&dev->mt76.napi[i]);
++ }
++ }
++ local_bh_enable();
++ clear_bit(MT76_MCU_RESET, &dev->mphy.state);
++ clear_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
+
+- mt76_set(dev, MT_WFDMA0_GLO_CFG,
+- MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN);
+- if (is_mt7915(&dev->mt76))
+- mt76_set(dev, MT_WFDMA1_GLO_CFG,
+- MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+- MT_WFDMA1_GLO_CFG_RX_DMA_EN |
+- MT_WFDMA1_GLO_CFG_OMIT_TX_INFO |
+- MT_WFDMA1_GLO_CFG_OMIT_RX_INFO);
++ mt76_wr(dev, MT_INT_MASK_CSR, dev->mt76.mmio.irqmask);
++ mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
+ if (dev->hif2) {
+- mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
+- MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+- MT_WFDMA0_GLO_CFG_RX_DMA_EN);
++ mt76_wr(dev, MT_INT1_MASK_CSR, irq_mask);
++ mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
++ }
++ if (dev_is_pci(mdev->dev)) {
++ mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
++ if (dev->hif2)
++ mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff);
++ }
++
++ /* load firmware */
++ ret = mt7915_run_firmware(dev);
++ if (ret)
++ goto out;
++
++ /* set the necessary init items */
++ ret = mt7915_mcu_set_eeprom(dev, dev->flash_mode);
++ if (ret)
++ goto out;
++
++ mt7915_mac_init(dev);
++ mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
++ mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
++ ret = mt7915_txbf_init(dev);
+
+- if (is_mt7915(&dev->mt76))
+- mt76_set(dev, MT_WFDMA1_GLO_CFG + hif1_ofs,
+- MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+- MT_WFDMA1_GLO_CFG_RX_DMA_EN |
+- MT_WFDMA1_GLO_CFG_OMIT_TX_INFO |
+- MT_WFDMA1_GLO_CFG_OMIT_RX_INFO);
++ if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
++ ret = __mt7915_start(dev->mphy.hw);
++ if (ret)
++ goto out;
++ }
++
++ if (ext_phy && test_bit(MT76_STATE_RUNNING, &ext_phy->state)) {
++ ret = __mt7915_start(ext_phy->hw);
++ if (ret)
++ goto out;
+ }
++
++out:
++ /* reset done */
++ clear_bit(MT76_RESET, &dev->mphy.state);
++ if (phy2)
++ clear_bit(MT76_RESET, &phy2->mt76->state);
++
++ local_bh_disable();
++ napi_enable(&dev->mt76.tx_napi);
++ napi_schedule(&dev->mt76.tx_napi);
++ local_bh_enable();
++
++ mt76_worker_enable(&dev->mt76.tx_worker);
++
++ return ret;
+ }
+
+-void mt7915_tx_token_put(struct mt7915_dev *dev)
++static void
++mt7915_mac_full_reset(struct mt7915_dev *dev)
+ {
+- struct mt76_txwi_cache *txwi;
+- int id;
++ struct mt7915_phy *phy2;
++ struct mt76_phy *ext_phy;
++ int i;
+
+- spin_lock_bh(&dev->mt76.token_lock);
+- idr_for_each_entry(&dev->mt76.token, txwi, id) {
+- mt7915_txwi_free(dev, txwi, NULL, NULL);
+- dev->mt76.token_count--;
++ ext_phy = dev->mt76.phy2;
++ phy2 = ext_phy ? ext_phy->priv : NULL;
++
++ dev->ser.hw_full_reset = true;
++ if (READ_ONCE(dev->reset_state) & MT_MCU_CMD_WA_WDT)
++ dev->ser.wf_reset_wa_count++;
++ else
++ dev->ser.wf_reset_wm_count++;
++
++ wake_up(&dev->mt76.mcu.wait);
++ ieee80211_stop_queues(mt76_hw(dev));
++ if (ext_phy)
++ ieee80211_stop_queues(ext_phy->hw);
++
++ cancel_delayed_work_sync(&dev->mphy.mac_work);
++ if (ext_phy)
++ cancel_delayed_work_sync(&ext_phy->mac_work);
++
++ mutex_lock(&dev->mt76.mutex);
++ for (i = 0; i < 10; i++) {
++ if (!mt7915_mac_reset(dev))
++ break;
+ }
+- spin_unlock_bh(&dev->mt76.token_lock);
+- idr_destroy(&dev->mt76.token);
++ mutex_unlock(&dev->mt76.mutex);
++
++ if (i == 10)
++ dev_err(dev->mt76.dev, "chip full reset failed\n");
++
++ ieee80211_restart_hw(mt76_hw(dev));
++ if (ext_phy)
++ ieee80211_restart_hw(ext_phy->hw);
++
++ ieee80211_wake_queues(mt76_hw(dev));
++ if (ext_phy)
++ ieee80211_wake_queues(ext_phy->hw);
++
++ dev->ser.hw_full_reset = false;
++ ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
++ MT7915_WATCHDOG_TIME);
++ if (ext_phy)
++ ieee80211_queue_delayed_work(ext_phy->hw,
++ &ext_phy->mac_work,
++ MT7915_WATCHDOG_TIME);
+ }
+
+ /* system error recovery */
+@@ -2129,6 +2233,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ ext_phy = dev->mt76.phy2;
+ phy2 = ext_phy ? ext_phy->priv : NULL;
+
++ /* chip full reset */
++ if (dev->ser.reset_type == SER_TYPE_FULL_RESET) {
++ u32 intr;
++
++ /* disable WA/WM WDT */
++ intr = mt76_rr(dev, MT_WFDMA0_MCU_HOST_INT_ENA);
++ intr &= ~MT_MCU_CMD_WDT_MASK;
++ mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, intr);
++
++ mt7915_mac_full_reset(dev);
++
++ /* enable the mcu irq*/
++ mt7915_irq_enable(dev, MT_INT_MCU_CMD);
++ mt7915_irq_disable(dev, 0);
++
++ /* re-enable WA/WM WDT */
++ intr = mt76_rr(dev, MT_WFDMA0_MCU_HOST_INT_ENA);
++ intr |= MT_MCU_CMD_WDT_MASK;
++ mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, intr);
++
++ dev->reset_state = MT_MCU_CMD_NORMAL_STATE;
++ dev->ser.reset_type = SER_TYPE_NONE;
++ dev_info(dev->mt76.dev, "SER: chip full reset completed, WM %d, WA %d\n",
++ dev->ser.wf_reset_wm_count,
++ dev->ser.wf_reset_wa_count);
++ return;
++ }
++
++ /* chip partial reset */
++ dev->ser.reset_type = SER_TYPE_NONE;
+ if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
+ return;
+
+@@ -2155,7 +2289,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
+
+ if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
+- mt7915_dma_reset(dev);
++ mt7915_dma_reset(dev, false);
+
+ mt7915_tx_token_put(dev);
+ idr_init(&dev->mt76.token);
+@@ -2206,6 +2340,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ MT7915_WATCHDOG_TIME);
+ }
+
++void mt7915_reset(struct mt7915_dev *dev)
++{
++ if (!dev->ser.hw_init_done)
++ return;
++
++ if (dev->ser.hw_full_reset)
++ return;
++
++ /* wm/wa exception: do full recovery */
++ if (READ_ONCE(dev->reset_state) & MT_MCU_CMD_WDT_MASK) {
++ dev_info(dev->mt76.dev, "SER: chip full recovery start, WM %d, WA %d\n",
++ dev->ser.wf_reset_wm_count,
++ dev->ser.wf_reset_wa_count);
++
++ dev->ser.reset_type = SER_TYPE_FULL_RESET;
++
++ mt7915_irq_disable(dev, MT_INT_MCU_CMD);
++ queue_work(dev->mt76.wq, &dev->reset_work);
++ return;
++ }
++
++ dev_info(dev->mt76.dev, "SER: chip partial recovery, reset_state(0x%08X)\n",
++ READ_ONCE(dev->reset_state));
++ dev->ser.reset_type = SER_TYPE_PARTIAL_RESET;
++ queue_work(dev->mt76.wq, &dev->reset_work);
++ wake_up(&dev->reset_wait);
++}
++
+ void mt7915_mac_update_stats(struct mt7915_phy *phy)
+ {
+ struct mt7915_dev *dev = phy->dev;
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 78bf5ffa..eabcd785 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
+ return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
+ }
+
+-static int mt7915_start(struct ieee80211_hw *hw)
++int __mt7915_start(struct ieee80211_hw *hw)
+ {
+ struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ bool running;
+ int ret;
+
+- flush_work(&dev->init_work);
+-
+- mutex_lock(&dev->mt76.mutex);
+-
+ running = mt7915_dev_running(dev);
+
+ if (!running) {
+@@ -80,6 +76,19 @@ static int mt7915_start(struct ieee80211_hw *hw)
+ mt7915_mac_reset_counters(phy);
+
+ out:
++ return ret;
++}
++
++static int mt7915_start(struct ieee80211_hw *hw)
++{
++ struct mt7915_dev *dev = mt7915_hw_dev(hw);
++ bool running;
++ int ret;
++
++ flush_work(&dev->init_work);
++
++ mutex_lock(&dev->mt76.mutex);
++ ret = __mt7915_start(hw);
+ mutex_unlock(&dev->mt76.mutex);
+
+ return ret;
+@@ -91,6 +100,7 @@ static void mt7915_stop(struct ieee80211_hw *hw)
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+
+ cancel_delayed_work_sync(&phy->mt76->mac_work);
++ cancel_work_sync(&dev->reset_work);
+
+ mutex_lock(&dev->mt76.mutex);
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 20f32f7f..b29776e9 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -203,19 +203,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
+ ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
+ }
+
++static int
++mt7915_fw_exception_chk(struct mt7915_dev *dev)
++{
++ u32 reg_val;
++
++ reg_val = mt76_rr(dev, MT_EXCEPTION_ADDR);
++
++ if (is_mt7915(&dev->mt76))
++ reg_val >>= 8;
++
++ return !!(reg_val & 0xff);
++}
++
++static void
++mt7915_fw_heart_beat_chk(struct mt7915_dev *dev)
++{
++#define WM_TIMEOUT_COUNT_CHECK 5
++#define WM_HANG_COUNT_CHECK 9
++ static u32 cidx_rec[5], didx_rec[5];
++ u32 cnt, cidx, didx, queue;
++ u32 idx, i;
++
++ if (dev->ser.hw_full_reset)
++ return;
++
++ if (dev->ser.cmd_fail_cnt >= WM_TIMEOUT_COUNT_CHECK) {
++ cnt = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 4);
++ cidx = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 8);
++ didx = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 12);
++ queue = (didx > cidx) ?
++ (didx - cidx - 1) : (didx - cidx + cnt - 1);
++
++ idx = (dev->ser.cmd_fail_cnt - WM_TIMEOUT_COUNT_CHECK) % 5;
++ cidx_rec[idx] = cidx;
++ didx_rec[idx] = didx;
++
++ if ((cnt - 1) == queue &&
++ dev->ser.cmd_fail_cnt >= WM_HANG_COUNT_CHECK) {
++
++ for (i = 0; i < 5; i++) {
++ if (cidx_rec[i] != cidx ||
++ didx_rec[i] != didx)
++ return;
++ }
++ dev_err(dev->mt76.dev, "detect mem dma hang!\n");
++ if (dev->ser.reset_enable) {
++ dev->reset_state |= MT_MCU_CMD_WDT_MASK;
++ mt7915_reset(dev);
++ }
++ dev->ser.cmd_fail_cnt = 0;
++ }
++ }
++}
++
+ static int
+ mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
+ struct sk_buff *skb, int seq)
+ {
++ struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
+ struct mt7915_mcu_rxd *rxd;
+ int ret = 0;
+
+ if (!skb) {
+ dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
+ cmd, seq);
++
++ dev->ser.cmd_fail_cnt++;
++
++ if (dev->ser.cmd_fail_cnt < 5) {
++ int exp_type = mt7915_fw_exception_chk(dev);
++
++ dev_err(mdev->dev, "Fw is status(%d)\n", exp_type);
++ if (exp_type && dev->ser.reset_enable) {
++ dev->reset_state |= MT_MCU_CMD_WDT_MASK;
++ mt7915_reset(dev);
++ }
++ }
++ mt7915_fw_heart_beat_chk(dev);
++
+ return -ETIMEDOUT;
+ }
+
++ dev->ser.cmd_fail_cnt = 0;
++
+ rxd = (struct mt7915_mcu_rxd *)skb->data;
+ if (seq != rxd->seq)
+ return -EAGAIN;
+@@ -2456,18 +2527,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+ sizeof(req), true);
+ }
+
+-int mt7915_mcu_init(struct mt7915_dev *dev)
++int mt7915_run_firmware(struct mt7915_dev *dev)
+ {
+- static const struct mt76_mcu_ops mt7915_mcu_ops = {
+- .headroom = sizeof(struct mt7915_mcu_txd),
+- .mcu_skb_send_msg = mt7915_mcu_send_message,
+- .mcu_parse_response = mt7915_mcu_parse_response,
+- .mcu_restart = mt76_connac_mcu_restart,
+- };
+ int ret;
+
+- dev->mt76.mcu_ops = &mt7915_mcu_ops;
+-
+ /* force firmware operation mode into normal state,
+ * which should be set before firmware download stage.
+ */
+@@ -2516,6 +2579,21 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+ MCU_WA_PARAM_RED, 0, 0);
+ }
+
++int mt7915_mcu_init(struct mt7915_dev *dev)
++{
++ static const struct mt76_mcu_ops mt7915_mcu_ops = {
++ .headroom = sizeof(struct mt7915_mcu_txd),
++ .mcu_skb_send_msg = mt7915_mcu_send_message,
++ .mcu_parse_response = mt7915_mcu_parse_response,
++ .mcu_restart = mt76_connac_mcu_restart,
++ };
++ int ret;
++
++ dev->mt76.mcu_ops = &mt7915_mcu_ops;
++
++ return mt7915_run_firmware(dev);
++}
++
+ void mt7915_mcu_exit(struct mt7915_dev *dev)
+ {
+ __mt76_mcu_restart(&dev->mt76);
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 5cbc3ecf..229b9d72 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -466,8 +466,9 @@ enum {
+
+ enum {
+ SER_QUERY,
++ SER_SET,
+ /* recovery */
+- SER_SET_RECOVER_L1,
++ SER_SET_RECOVER_L1 = 1,
+ SER_SET_RECOVER_L2,
+ SER_SET_RECOVER_L3_RX_ABORT,
+ SER_SET_RECOVER_L3_TX_ABORT,
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 4d4537cd..b3de3a7a 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -23,6 +23,7 @@ static const u32 mt7915_reg[] = {
+ [CBTOP1_PHY_END] = 0x77ffffff,
+ [INFRA_MCU_ADDR_END] = 0x7c3fffff,
+ [SWDEF_BASE_ADDR] = 0x41f200,
++ [EXCEPTION_BASE_ADDR] = 0x219848,
+ };
+
+ static const u32 mt7916_reg[] = {
+@@ -38,6 +39,7 @@ static const u32 mt7916_reg[] = {
+ [CBTOP1_PHY_END] = 0x7fffffff,
+ [INFRA_MCU_ADDR_END] = 0x7c085fff,
+ [SWDEF_BASE_ADDR] = 0x411400,
++ [EXCEPTION_BASE_ADDR] = 0x022050BC,
+ };
+
+ static const u32 mt7986_reg[] = {
+@@ -53,6 +55,7 @@ static const u32 mt7986_reg[] = {
+ [CBTOP1_PHY_END] = 0x7fffffff,
+ [INFRA_MCU_ADDR_END] = 0x7c085fff,
+ [SWDEF_BASE_ADDR] = 0x411400,
++ [EXCEPTION_BASE_ADDR] = 0x02204FFC,
+ };
+
+ static const u32 mt7915_offs[] = {
+@@ -610,10 +613,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+ u32 val = mt76_rr(dev, MT_MCU_CMD);
+
+ mt76_wr(dev, MT_MCU_CMD, val);
+- if (val & MT_MCU_CMD_ERROR_MASK) {
++ if (val & (MT_MCU_CMD_ERROR_MASK | MT_MCU_CMD_WDT_MASK)) {
+ dev->reset_state = val;
+- queue_work(dev->mt76.wq, &dev->reset_work);
+- wake_up(&dev->reset_wait);
++ mt7915_reset(dev);
+ }
+ }
+ }
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index e5f89161..7f7ecdfe 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -297,6 +297,15 @@ struct mt7915_dev {
+ struct work_struct reset_work;
+ wait_queue_head_t reset_wait;
+ u32 reset_state;
++ struct {
++ bool hw_full_reset:1;
++ bool hw_init_done:1;
++ bool reset_enable:1;
++ u32 reset_type;
++ u32 cmd_fail_cnt;
++ u32 wf_reset_wm_count;
++ u32 wf_reset_wa_count;
++ }ser;
+
+ struct list_head sta_rc_list;
+ struct list_head sta_poll_list;
+@@ -335,6 +344,12 @@ enum {
+ __MT_WFDMA_MAX,
+ };
+
++enum {
++ SER_TYPE_NONE,
++ SER_TYPE_PARTIAL_RESET,
++ SER_TYPE_FULL_RESET,
++};
++
+ enum {
+ MT_CTX0,
+ MT_HIF0 = 0x0,
+@@ -446,6 +461,14 @@ s8 mt7915_eeprom_get_power_delta(struct mt7915_dev *dev, int band);
+ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2);
+ void mt7915_dma_prefetch(struct mt7915_dev *dev);
+ void mt7915_dma_cleanup(struct mt7915_dev *dev);
++void mt7915_reset(struct mt7915_dev *dev);
++int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
++int __mt7915_start(struct ieee80211_hw *hw);
++void mt7915_init_txpower(struct mt7915_dev *dev,
++ struct ieee80211_supported_band *sband);
++int mt7915_txbf_init(struct mt7915_dev *dev);
++void mt7915_mac_init(struct mt7915_dev *dev);
++int mt7915_run_firmware(struct mt7915_dev *dev);
+ int mt7915_mcu_init(struct mt7915_dev *dev);
+ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ struct mt7915_vif *mvif,
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 4251cf78..99834310 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -31,6 +31,7 @@ enum reg_rev {
+ CBTOP1_PHY_END,
+ INFRA_MCU_ADDR_END,
+ SWDEF_BASE_ADDR,
++ EXCEPTION_BASE_ADDR,
+ __MT_REG_MAX,
+ };
+
+@@ -112,6 +113,11 @@ enum offs_rev {
+ #define __REG(id) (dev->reg.reg_rev[(id)])
+ #define __OFFS(id) (dev->reg.offs_rev[(id)])
+
++/* MEM WFDMA */
++#define WF_WFDMA_MEM_DMA 0x58000000
++
++#define WF_WFDMA_MEM_DMA_RX_RING_CTL (WF_WFDMA_MEM_DMA + (0x510))
++
+ /* MCU WFDMA0 */
+ #define MT_MCU_WFDMA0_BASE 0x2000
+ #define MT_MCU_WFDMA0(ofs) (MT_MCU_WFDMA0_BASE + (ofs))
+@@ -556,6 +562,10 @@ enum offs_rev {
+ #define MT_WFDMA0_PRI_DLY_INT_CFG1 MT_WFDMA0(0x2f4)
+ #define MT_WFDMA0_PRI_DLY_INT_CFG2 MT_WFDMA0(0x2f8)
+
++#define MT_WFDMA0_MCU_HOST_INT_ENA MT_WFDMA0(0x1f4)
++#define MT_WFDMA0_MT_WA_WDT_INT BIT(31)
++#define MT_WFDMA0_MT_WM_WDT_INT BIT(30)
++
+ /* WFDMA1 */
+ #define MT_WFDMA1_BASE 0xd5000
+ #define MT_WFDMA1(ofs) (MT_WFDMA1_BASE + (ofs))
+@@ -701,6 +711,10 @@ enum offs_rev {
+ #define MT_MCU_CMD_NORMAL_STATE BIT(5)
+ #define MT_MCU_CMD_ERROR_MASK GENMASK(5, 1)
+
++#define MT_MCU_CMD_WA_WDT BIT(31)
++#define MT_MCU_CMD_WM_WDT BIT(30)
++#define MT_MCU_CMD_WDT_MASK GENMASK(31, 30)
++
+ /* TOP RGU */
+ #define MT_TOP_RGU_BASE 0x18000000
+ #define MT_TOP_PWR_CTRL (MT_TOP_RGU_BASE + (0x0))
+@@ -974,6 +988,8 @@ enum offs_rev {
+ #define MT_CPU_UTIL_PEAK_IDLE_CNT MT_CPU_UTIL(0x0c)
+ #define MT_CPU_UTIL_CTRL MT_CPU_UTIL(0x1c)
+
++#define MT_EXCEPTION_ADDR __REG(EXCEPTION_BASE_ADDR)
++
+ /* LED */
+ #define MT_LED_TOP_BASE 0x18013000
+ #define MT_LED_PHYS(_n) (MT_LED_TOP_BASE + (_n))
+--
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-mt7915-add-debugfs-for-ser-show-and-ser-trigger.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-mt7915-add-debugfs-for-ser-show-and-ser-trigger.patch
deleted file mode 100644
index 2cf5216..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-mt7915-add-debugfs-for-ser-show-and-ser-trigger.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-From 7af1b6dfec852291fa4d2a21cba350a46a1b7c49 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 4 May 2022 20:39:07 +0800
-Subject: [PATCH] mt76: mt7915: add debugfs for ser show and ser trigger
-
----
- mt7915/debugfs.c | 103 ++++++++++++++++++++++++++++++++++++++++++++++-
- mt7915/mcu.c | 5 +--
- mt7915/mmio.c | 3 ++
- mt7915/regs.h | 18 ++++++++-
- 4 files changed, 122 insertions(+), 7 deletions(-)
-
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index e8e26ac1..61e1c126 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -47,7 +47,8 @@ mt7915_implicit_txbf_get(void *data, u64 *val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7915_implicit_txbf_get,
- mt7915_implicit_txbf_set, "%lld\n");
-
--/* test knob of system layer 1/2 error recovery */
-+/* test knob of system layer 0.5/1/2 error recovery */
-+/*
- static int mt7915_ser_trigger_set(void *data, u64 val)
- {
- enum {
-@@ -74,9 +75,107 @@ static int mt7915_ser_trigger_set(void *data, u64 val)
- return ret;
- }
-
-+*/
-+static int mt7915_ser_trigger_set(void *data, u64 val)
-+{
-+#define SER_SET GENMASK(3, 0)
-+#define SER_BAND GENMASK(7, 4)
-+#define SER_ACTION GENMASK(11, 8)
-+ enum {
-+ SER_ACTION_SET = 1,
-+ SER_ACTION_SET_MASK = 2,
-+ SER_ACTION_TRIGGER = 3,
-+ };
-+
-+ struct mt7915_dev *dev = data;
-+ u8 ser_action, ser_band, ser_set, set_val;
-+
-+ ser_action = FIELD_GET(SER_ACTION, val);
-+ ser_set = set_val = FIELD_GET(SER_SET, val);
-+ ser_band = (ser_action == SER_ACTION_TRIGGER) ?
-+ FIELD_GET(SER_BAND, val) : 0;
-+
-+ if (ser_band > 1)
-+ return -1;
-+
-+ switch (ser_action) {
-+ case SER_ACTION_SET:
-+ /*
-+ * 0x100: disable system error recovery function.
-+ * 0x101: enable system error recovery function.
-+ */
-+ ser_set = !!set_val;
-+ break;
-+ case SER_ACTION_SET_MASK:
-+ /*
-+ * 0x200: enable system error tracking.
-+ * 0x201: enable system error L1 recover.
-+ * 0x202: enable system error L2 recover.
-+ * 0x203: enable system error L3 rx abort.
-+ * 0x204: enable system error L3 tx abort.
-+ * 0x205: enable system error L3 tx disable.
-+ * 0x206: enable system error L3 bf recover.
-+ * 0x207: enable system error all recover.
-+ */
-+ ser_set = set_val > 7 ? 0x7f : BIT(set_val);
-+ break;
-+ case SER_ACTION_TRIGGER:
-+ /*
-+ * 0x301/0x311: trigger L1 recover for band0/band1.
-+ * 0x302/0x312: trigger L2 recover for band0/band1.
-+ * 0x303/0x313: trigger L3 rx abort for band0/band1.
-+ * 0x304/0x314: trigger L3 tx abort for band0/band1.
-+ * 0x305/0x315: trigger L3 tx disable for band0/band1.
-+ * 0x306/0x316: trigger L3 bf recover for band0/band1.
-+ */
-+ if (ser_set > 6)
-+ return -1;
-+ break;
-+ default:
-+ return -1;
-+ }
-+
-+ return mt7915_mcu_set_ser(dev, ser_action, ser_set, ser_band);
-+}
-+
- DEFINE_DEBUGFS_ATTRIBUTE(fops_ser_trigger, NULL,
- mt7915_ser_trigger_set, "%lld\n");
-
-+static int
-+mt7915_ser_stats_show(struct seq_file *s, void *data)
-+{
-+#define SER_ACTION_QUERY 0
-+ struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+ int ret = 0;
-+
-+ /* get more info from firmware */
-+ ret = mt7915_mcu_set_ser(dev, SER_ACTION_QUERY, 0, 0);
-+ msleep(100);
-+
-+ seq_printf(s, "::E R , SER_STATUS = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_SER_STATUS));
-+ seq_printf(s, "::E R , SER_PLE_ERR = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_PLE_STATUS));
-+ seq_printf(s, "::E R , SER_PLE_ERR_1 = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_PLE1_STATUS));
-+ seq_printf(s, "::E R , SER_PLE_ERR_AMSDU = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_PLE_AMSDU_STATUS));
-+ seq_printf(s, "::E R , SER_PSE_ERR = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_PSE_STATUS));
-+ seq_printf(s, "::E R , SER_PSE_ERR_1 = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_PSE1_STATUS));
-+ seq_printf(s, "::E R , SER_LMAC_WISR6_B0 = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN0_STATUS));
-+ seq_printf(s, "::E R , SER_LMAC_WISR6_B1 = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN1_STATUS));
-+ seq_printf(s, "::E R , SER_LMAC_WISR7_B0 = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN0_STATUS));
-+ seq_printf(s, "::E R , SER_LMAC_WISR7_B1 = 0x%08X\n",
-+ mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATUS));
-+
-+ return ret;
-+}
-+
- static int
- mt7915_radar_trigger(void *data, u64 val)
- {
-@@ -943,6 +1042,8 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
- debugfs_create_file("xmit-queues", 0400, dir, phy,
- &mt7915_xmit_queues_fops);
- debugfs_create_file("tx_stats", 0400, dir, phy, &mt7915_tx_stats_fops);
-+ debugfs_create_devm_seqfile(dev->mt76.dev, "ser_show", dir,
-+ mt7915_ser_stats_show);
- debugfs_create_file("fw_debug_wm", 0600, dir, dev, &fops_fw_debug_wm);
- debugfs_create_file("fw_debug_wa", 0600, dir, dev, &fops_fw_debug_wa);
- debugfs_create_file("fw_debug_bin", 0600, dir, dev, &fops_fw_debug_bin);
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 681ede23..10450bd7 100755
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2487,10 +2487,7 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
- /* force firmware operation mode into normal state,
- * which should be set before firmware download stage.
- */
-- if (is_mt7915(&dev->mt76))
-- mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
-- else
-- mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
-+ mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
-
- ret = mt7915_driver_own(dev, 0);
- if (ret)
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 0bd32daa..2d733d32 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -22,6 +22,7 @@ static const u32 mt7915_reg[] = {
- [WFDMA_EXT_CSR_ADDR] = 0xd7000,
- [CBTOP1_PHY_END] = 0x77ffffff,
- [INFRA_MCU_ADDR_END] = 0x7c3fffff,
-+ [SWDEF_BASE_ADDR] = 0x41f200,
- };
-
- static const u32 mt7916_reg[] = {
-@@ -36,6 +37,7 @@ static const u32 mt7916_reg[] = {
- [WFDMA_EXT_CSR_ADDR] = 0xd7000,
- [CBTOP1_PHY_END] = 0x7fffffff,
- [INFRA_MCU_ADDR_END] = 0x7c085fff,
-+ [SWDEF_BASE_ADDR] = 0x411400,
- };
-
- static const u32 mt7986_reg[] = {
-@@ -50,6 +52,7 @@ static const u32 mt7986_reg[] = {
- [WFDMA_EXT_CSR_ADDR] = 0x27000,
- [CBTOP1_PHY_END] = 0x7fffffff,
- [INFRA_MCU_ADDR_END] = 0x7c085fff,
-+ [SWDEF_BASE_ADDR] = 0x411400,
- };
-
- static const u32 mt7915_offs[] = {
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 97984aaf..ee212c99 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -30,6 +30,7 @@ enum reg_rev {
- WFDMA_EXT_CSR_ADDR,
- CBTOP1_PHY_END,
- INFRA_MCU_ADDR_END,
-+ SWDEF_BASE_ADDR,
- __MT_REG_MAX,
- };
-
-@@ -942,12 +943,25 @@ enum offs_rev {
- #define MT_ADIE_TYPE_MASK BIT(1)
-
- /* FW MODE SYNC */
--#define MT_SWDEF_MODE 0x41f23c
--#define MT_SWDEF_MODE_MT7916 0x41143c
-+#define MT_SWDEF_BASE __REG(SWDEF_BASE_ADDR)
-+
-+#define MT_SWDEF(ofs) (MT_SWDEF_BASE + (ofs))
-+#define MT_SWDEF_MODE MT_SWDEF(0x3c)
- #define MT_SWDEF_NORMAL_MODE 0
- #define MT_SWDEF_ICAP_MODE 1
- #define MT_SWDEF_SPECTRUM_MODE 2
-
-+#define MT_SWDEF_SER_STATUS MT_SWDEF(0x040)
-+#define MT_SWDEF_PLE_STATUS MT_SWDEF(0x044)
-+#define MT_SWDEF_PLE1_STATUS MT_SWDEF(0x048)
-+#define MT_SWDEF_PLE_AMSDU_STATUS MT_SWDEF(0x04C)
-+#define MT_SWDEF_PSE_STATUS MT_SWDEF(0x050)
-+#define MT_SWDEF_PSE1_STATUS MT_SWDEF(0x054)
-+#define MT_SWDEF_LAMC_WISR6_BN0_STATUS MT_SWDEF(0x058)
-+#define MT_SWDEF_LAMC_WISR6_BN1_STATUS MT_SWDEF(0x05C)
-+#define MT_SWDEF_LAMC_WISR7_BN0_STATUS MT_SWDEF(0x060)
-+#define MT_SWDEF_LAMC_WISR7_BN1_STATUS MT_SWDEF(0x064)
-+
- #define MT_DIC_CMD_REG_BASE 0x41f000
- #define MT_DIC_CMD_REG(ofs) (MT_DIC_CMD_REG_BASE + (ofs))
- #define MT_DIC_CMD_REG_CMD MT_DIC_CMD_REG(0x10)
---
-2.18.0
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch
old mode 100644
new mode 100755
index 1785a61..9de9b75
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch
@@ -1,8 +1,8 @@
-From bbfc52d9e15334a0e72884754be04b8df335de39 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 6 May 2022 15:53:07 +0800
-Subject: [PATCH 1114/1116] mt76: mt7915: drop packetes when TWT stations use
- more token then 128
+From fa3b5a740661e91e59b68ffab139cc1e32a0cd6e Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Mon, 9 May 2022 13:37:09 +0800
+Subject: [PATCH 08/10] mt76: mt7915: drop packetes when TWT stations use more
+ token then 128
---
mt7915/mac.c | 21 ++++++++++++++++++---
@@ -10,10 +10,10 @@
2 files changed, 20 insertions(+), 3 deletions(-)
diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b899697c..1935acff 100644
+index db35eb14..2ee49b82 100644
--- a/mt7915/mac.c
+++ b/mt7915/mac.c
-@@ -1303,6 +1303,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1306,6 +1306,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
struct ieee80211_key_conf *key = info->control.hw_key;
struct ieee80211_vif *vif = info->control.vif;
@@ -21,7 +21,7 @@
struct mt76_txwi_cache *t;
struct mt7915_txp *txp;
int id, i, nbuf = tx_info->nbuf - 1;
-@@ -1316,8 +1317,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1319,8 +1320,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
wcid = &dev->mt76.global_wcid;
if (sta) {
@@ -30,9 +30,9 @@
msta = (struct mt7915_sta *)sta->drv_priv;
if (time_after(jiffies, msta->jiffies + HZ / 4)) {
-@@ -1329,10 +1328,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
- t->skb = tx_info->skb;
+@@ -1336,10 +1335,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ mgmt->u.action.category == 0xff)
+ return -1;
+ spin_lock_bh(&mdev->token_lock);
+ if (msta && msta->twt.flowid_mask && msta->token_count > 128) {
@@ -53,7 +53,7 @@
pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
mt7915_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, key,
false);
-@@ -1524,6 +1535,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1531,6 +1542,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
struct mt76_dev *mdev = &dev->mt76;
struct mt76_txwi_cache *txwi;
struct ieee80211_sta *sta = NULL;
@@ -61,7 +61,7 @@
LIST_HEAD(free_list);
void *end = data + len;
bool v3, wake = false;
-@@ -1547,7 +1559,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1554,7 +1566,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
* 1'b0: msdu_id with the same 'wcid pair' as above.
*/
if (info & MT_TX_FREE_PAIR) {
@@ -69,7 +69,7 @@
struct mt76_wcid *wcid;
u16 idx;
-@@ -1583,6 +1594,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1590,6 +1601,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
txwi = mt76_token_release(mdev, msdu, &wake);
if (!txwi)
continue;
@@ -81,7 +81,7 @@
mt7915_txwi_free(dev, txwi, sta, &free_list);
}
diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 24276da5..0feccb17 100644
+index bc7f746f..56f6ba6c 100644
--- a/mt7915/mt7915.h
+++ b/mt7915/mt7915.h
@@ -136,6 +136,8 @@ struct mt7915_sta {