drivers/staging/wfx/data_tx.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Datapath implementation.
   4  *
   5  * Copyright (c) 2017-2019, Silicon Laboratories, Inc.
   6  * Copyright (c) 2010, ST-Ericsson
   7  */
   8 #include <net/mac80211.h>
   9
  10 #include "data_tx.h"
  11 #include "wfx.h"
  12 #include "bh.h"
  13 #include "sta.h"
  14 #include "queue.h"
  15 #include "debug.h"
  16 #include "traces.h"
  17 #include "hif_tx_mib.h"
  18
  19 #define WFX_INVALID_RATE_ID    15
  20 #define WFX_LINK_ID_GC_TIMEOUT ((unsigned long)(10 * HZ))
  21
  22 static int wfx_get_hw_rate(struct wfx_dev *wdev,
  23                            const struct ieee80211_tx_rate *rate)
  24 {
  25         if (rate->idx < 0)
  26                 return -1;
  27         if (rate->flags & IEEE80211_TX_RC_MCS) {
  28                 if (rate->idx > 7) {
  29                         WARN(1, "wrong rate->idx value: %d", rate->idx);
  30                         return -1;
  31                 }
  32                 return rate->idx + 14;
  33         }
  34         // WFx only support 2GHz, else band information should be retrieved
  35         // from ieee80211_tx_info
  36         return wdev->hw->wiphy->bands[NL80211_BAND_2GHZ]->bitrates[rate->idx].hw_value;
  37 }
  38
  39 /* TX policy cache implementation */
  40
  41 static void wfx_tx_policy_build(struct wfx_vif *wvif, struct tx_policy *policy,
  42                                 struct ieee80211_tx_rate *rates)
  43 {
  44         int i;
  45         size_t count;
  46         struct wfx_dev *wdev = wvif->wdev;
  47
  48         WARN(rates[0].idx < 0, "invalid rate policy");
  49         memset(policy, 0, sizeof(*policy));
  50         for (i = 1; i < IEEE80211_TX_MAX_RATES; i++)
  51                 if (rates[i].idx < 0)
  52                         break;
  53         count = i;
  54
  55         /* HACK!!! Device has problems (at least) switching from
  56          * 54Mbps CTS to 1Mbps. This switch takes enormous amount
  57          * of time (100-200 ms), leading to valuable throughput drop.
  58          * As a workaround, additional g-rates are injected to the
  59          * policy.
  60          */
  61         if (count == 2 && !(rates[0].flags & IEEE80211_TX_RC_MCS) &&
  62             rates[0].idx > 4 && rates[0].count > 2 &&
  63             rates[1].idx < 2) {
  64                 int mid_rate = (rates[0].idx + 4) >> 1;
  65
  66                 /* Decrease number of retries for the initial rate */
  67                 rates[0].count -= 2;
  68
  69                 if (mid_rate != 4) {
  70                         /* Keep fallback rate at 1Mbps. */
  71                         rates[3] = rates[1];
  72
  73                         /* Inject 1 transmission on lowest g-rate */
  74                         rates[2].idx = 4;
  75                         rates[2].count = 1;
  76                         rates[2].flags = rates[1].flags;
  77
  78                         /* Inject 1 transmission on mid-rate */
  79                         rates[1].idx = mid_rate;
  80                         rates[1].count = 1;
  81
  82                         /* Fallback to 1 Mbps is a really bad thing,
  83                          * so let's try to increase probability of
  84                          * successful transmission on the lowest g rate
  85                          * even more
  86                          */
  87                         if (rates[0].count >= 3) {
  88                                 --rates[0].count;
  89                                 ++rates[2].count;
  90                         }
  91
  92                         /* Adjust amount of rates defined */
  93                         count += 2;
  94                 } else {
  95                         /* Keep fallback rate at 1Mbps. */
  96                         rates[2] = rates[1];
  97
  98                         /* Inject 2 transmissions on lowest g-rate */
  99                         rates[1].idx = 4;
 100                         rates[1].count = 2;
 101
 102                         /* Adjust amount of rates defined */
 103                         count += 1;
 104                 }
 105         }
 106
 107         for (i = 0; i < IEEE80211_TX_MAX_RATES; ++i) {
 108                 int rateid;
 109                 u8 count;
 110
 111                 if (rates[i].idx < 0)
 112                         break;
 113                 WARN_ON(rates[i].count > 15);
 114                 rateid = wfx_get_hw_rate(wdev, &rates[i]);
 115                 // Pack two values in each byte of policy->rates
 116                 count = rates[i].count;
 117                 if (rateid % 2)
 118                         count <<= 4;
 119                 policy->rates[rateid / 2] |= count;
 120         }
 121 }
 122
 123 static bool tx_policy_is_equal(const struct tx_policy *a,
 124                                const struct tx_policy *b)
 125 {
 126         return !memcmp(a->rates, b->rates, sizeof(a->rates));
 127 }
 128
 129 static int wfx_tx_policy_find(struct tx_policy_cache *cache,
 130                               struct tx_policy *wanted)
 131 {
 132         struct tx_policy *it;
 133
 134         list_for_each_entry(it, &cache->used, link)
 135                 if (tx_policy_is_equal(wanted, it))
 136                         return it - cache->cache;
 137         list_for_each_entry(it, &cache->free, link)
 138                 if (tx_policy_is_equal(wanted, it))
 139                         return it - cache->cache;
 140         return -1;
 141 }
 142
 143 static void wfx_tx_policy_use(struct tx_policy_cache *cache,
 144                               struct tx_policy *entry)
 145 {
 146         ++entry->usage_count;
 147         list_move(&entry->link, &cache->used);
 148 }
 149
 150 static int wfx_tx_policy_release(struct tx_policy_cache *cache,
 151                                  struct tx_policy *entry)
 152 {
 153         int ret = --entry->usage_count;
 154
 155         if (!ret)
 156                 list_move(&entry->link, &cache->free);
 157         return ret;
 158 }
 159
 160 static int wfx_tx_policy_get(struct wfx_vif *wvif,
 161                              struct ieee80211_tx_rate *rates,
 162                              bool *renew)
 163 {
 164         int idx;
 165         struct tx_policy_cache *cache = &wvif->tx_policy_cache;
 166         struct tx_policy wanted;
 167
 168         wfx_tx_policy_build(wvif, &wanted, rates);
 169
 170         spin_lock_bh(&cache->lock);
 171         if (list_empty(&cache->free)) {
 172                 WARN(1, "unable to get a valid Tx policy");
 173                 spin_unlock_bh(&cache->lock);
 174                 return WFX_INVALID_RATE_ID;
 175         }
 176         idx = wfx_tx_policy_find(cache, &wanted);
 177         if (idx >= 0) {
 178                 *renew = false;
 179         } else {
 180                 struct tx_policy *entry;
 181                 *renew = true;
 182                 /* If policy is not found create a new one
 183                  * using the oldest entry in "free" list
 184                  */
 185                 entry = list_entry(cache->free.prev, struct tx_policy, link);
 186                 memcpy(entry->rates, wanted.rates, sizeof(entry->rates));
 187                 entry->uploaded = false;
 188                 entry->usage_count = 0;
 189                 idx = entry - cache->cache;
 190         }
 191         wfx_tx_policy_use(cache, &cache->cache[idx]);
 192         if (list_empty(&cache->free)) {
 193                 /* Lock TX queues. */
 194                 wfx_tx_queues_lock(wvif->wdev);
 195         }
 196         spin_unlock_bh(&cache->lock);
 197         return idx;
 198 }
 199
 200 static void wfx_tx_policy_put(struct wfx_vif *wvif, int idx)
 201 {
 202         int usage, locked;
 203         struct tx_policy_cache *cache = &wvif->tx_policy_cache;
 204
 205         if (idx == WFX_INVALID_RATE_ID)
 206                 return;
 207         spin_lock_bh(&cache->lock);
 208         locked = list_empty(&cache->free);
 209         usage = wfx_tx_policy_release(cache, &cache->cache[idx]);
 210         if (locked && !usage) {
 211                 /* Unlock TX queues. */
 212                 wfx_tx_queues_unlock(wvif->wdev);
 213         }
 214         spin_unlock_bh(&cache->lock);
 215 }
 216
 217 static int wfx_tx_policy_upload(struct wfx_vif *wvif)
 218 {
 219         struct tx_policy *policies = wvif->tx_policy_cache.cache;
 220         u8 tmp_rates[12];
 221         int i;
 222
 223         do {
 224                 spin_lock_bh(&wvif->tx_policy_cache.lock);
 225                 for (i = 0; i < HIF_MIB_NUM_TX_RATE_RETRY_POLICIES; ++i)
 226                         if (!policies[i].uploaded &&
 227                             memzcmp(policies[i].rates, sizeof(policies[i].rates)))
 228                                 break;
 229                 if (i < HIF_MIB_NUM_TX_RATE_RETRY_POLICIES) {
 230                         policies[i].uploaded = 1;
 231                         memcpy(tmp_rates, policies[i].rates, sizeof(tmp_rates));
 232                         spin_unlock_bh(&wvif->tx_policy_cache.lock);
 233                         hif_set_tx_rate_retry_policy(wvif, i, tmp_rates);
 234                 } else {
 235                         spin_unlock_bh(&wvif->tx_policy_cache.lock);
 236                 }
 237         } while (i < HIF_MIB_NUM_TX_RATE_RETRY_POLICIES);
 238         return 0;
 239 }
 240
 241 void wfx_tx_policy_upload_work(struct work_struct *work)
 242 {
 243         struct wfx_vif *wvif =
 244                 container_of(work, struct wfx_vif, tx_policy_upload_work);
 245
 246         wfx_tx_policy_upload(wvif);
 247
 248         wfx_tx_unlock(wvif->wdev);
 249         wfx_tx_queues_unlock(wvif->wdev);
 250 }
 251
 252 void wfx_tx_policy_init(struct wfx_vif *wvif)
 253 {
 254         struct tx_policy_cache *cache = &wvif->tx_policy_cache;
 255         int i;
 256
 257         memset(cache, 0, sizeof(*cache));
 258
 259         spin_lock_init(&cache->lock);
 260         INIT_LIST_HEAD(&cache->used);
 261         INIT_LIST_HEAD(&cache->free);
 262
 263         for (i = 0; i < HIF_MIB_NUM_TX_RATE_RETRY_POLICIES; ++i)
 264                 list_add(&cache->cache[i].link, &cache->free);
 265 }
 266
 267 /* Tx implementation */
 268
 269 static bool ieee80211_is_action_back(struct ieee80211_hdr *hdr)
 270 {
 271         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)hdr;
 272
 273         if (!ieee80211_is_action(mgmt->frame_control))
 274                 return false;
 275         if (mgmt->u.action.category != WLAN_CATEGORY_BACK)
 276                 return false;
 277         return true;
 278 }
 279
 280 static void wfx_tx_manage_pm(struct wfx_vif *wvif, struct ieee80211_hdr *hdr,
 281                              struct wfx_tx_priv *tx_priv,
 282                              struct ieee80211_sta *sta)
 283 {
 284         u32 mask = ~BIT(tx_priv->raw_link_id);
 285         struct wfx_sta_priv *sta_priv;
 286         int tid = ieee80211_get_tid(hdr);
 287
 288         spin_lock_bh(&wvif->ps_state_lock);
 289         if (ieee80211_is_auth(hdr->frame_control))
 290                 wvif->sta_asleep_mask &= mask;
 291         spin_unlock_bh(&wvif->ps_state_lock);
 292
 293         if (sta) {
 294                 sta_priv = (struct wfx_sta_priv *)&sta->drv_priv;
 295                 spin_lock_bh(&sta_priv->lock);
 296                 sta_priv->buffered[tid]++;
 297                 ieee80211_sta_set_buffered(sta, tid, true);
 298                 spin_unlock_bh(&sta_priv->lock);
 299         }
 300 }
 301
 302 static u8 wfx_tx_get_raw_link_id(struct wfx_vif *wvif,
 303                                       struct ieee80211_sta *sta,
 304                                       struct ieee80211_hdr *hdr)
 305 {
 306         struct wfx_sta_priv *sta_priv =
 307                 sta ? (struct wfx_sta_priv *) &sta->drv_priv : NULL;
 308         const u8 *da = ieee80211_get_DA(hdr);
 309
 310         if (sta_priv && sta_priv->link_id)
 311                 return sta_priv->link_id;
 312         if (wvif->vif->type != NL80211_IFTYPE_AP)
 313                 return 0;
 314         if (is_multicast_ether_addr(da))
 315                 return 0;
 316         return WFX_LINK_ID_NO_ASSOC;
 317 }
 318
 319 static void wfx_tx_fixup_rates(struct ieee80211_tx_rate *rates)
 320 {
 321         int i;
 322         bool finished;
 323
 324         // Firmware is not able to mix rates with differents flags
 325         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
 326                 if (rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
 327                         rates[i].flags |= IEEE80211_TX_RC_SHORT_GI;
 328                 if (!(rates[0].flags & IEEE80211_TX_RC_SHORT_GI))
 329                         rates[i].flags &= ~IEEE80211_TX_RC_SHORT_GI;
 330                 if (!(rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS))
 331                         rates[i].flags &= ~IEEE80211_TX_RC_USE_RTS_CTS;
 332         }
 333
 334         // Sort rates and remove duplicates
 335         do {
 336                 finished = true;
 337                 for (i = 0; i < IEEE80211_TX_MAX_RATES - 1; i++) {
 338                         if (rates[i + 1].idx == rates[i].idx &&
 339                             rates[i].idx != -1) {
 340                                 rates[i].count += rates[i + 1].count;
 341                                 if (rates[i].count > 15)
 342                                         rates[i].count = 15;
 343                                 rates[i + 1].idx = -1;
 344                                 rates[i + 1].count = 0;
 345
 346                                 finished = false;
 347                         }
 348                         if (rates[i + 1].idx > rates[i].idx) {
 349                                 swap(rates[i + 1], rates[i]);
 350                                 finished = false;
 351                         }
 352                 }
 353         } while (!finished);
 354         // Ensure that MCS0 or 1Mbps is present at the end of the retry list
 355         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
 356                 if (rates[i].idx == 0)
 357                         break;
 358                 if (rates[i].idx == -1) {
 359                         rates[i].idx = 0;
 360                         rates[i].count = 8; // == hw->max_rate_tries
 361                         rates[i].flags = rates[i - 1].flags & IEEE80211_TX_RC_MCS;
 362                         break;
 363                 }
 364         }
 365         // All retries use long GI
 366         for (i = 1; i < IEEE80211_TX_MAX_RATES; i++)
 367                 rates[i].flags &= ~IEEE80211_TX_RC_SHORT_GI;
 368 }
 369
 370 static u8 wfx_tx_get_rate_id(struct wfx_vif *wvif,
 371                                   struct ieee80211_tx_info *tx_info)
 372 {
 373         bool tx_policy_renew = false;
 374         u8 rate_id;
 375
 376         rate_id = wfx_tx_policy_get(wvif,
 377                                     tx_info->driver_rates, &tx_policy_renew);
 378         if (rate_id == WFX_INVALID_RATE_ID)
 379                 dev_warn(wvif->wdev->dev, "unable to get a valid Tx policy");
 380
 381         if (tx_policy_renew) {
 382                 /* FIXME: It's not so optimal to stop TX queues every now and
 383                  * then.  Better to reimplement task scheduling with a counter.
 384                  */
 385                 wfx_tx_lock(wvif->wdev);
 386                 wfx_tx_queues_lock(wvif->wdev);
 387                 if (!schedule_work(&wvif->tx_policy_upload_work)) {
 388                         wfx_tx_queues_unlock(wvif->wdev);
 389                         wfx_tx_unlock(wvif->wdev);
 390                 }
 391         }
 392         return rate_id;
 393 }
 394
 395 static struct hif_ht_tx_parameters wfx_tx_get_tx_parms(struct wfx_dev *wdev, struct ieee80211_tx_info *tx_info)
 396 {
 397         struct ieee80211_tx_rate *rate = &tx_info->driver_rates[0];
 398         struct hif_ht_tx_parameters ret = { };
 399
 400         if (!(rate->flags & IEEE80211_TX_RC_MCS))
 401                 ret.frame_format = HIF_FRAME_FORMAT_NON_HT;
 402         else if (!(rate->flags & IEEE80211_TX_RC_GREEN_FIELD))
 403                 ret.frame_format = HIF_FRAME_FORMAT_MIXED_FORMAT_HT;
 404         else
 405                 ret.frame_format = HIF_FRAME_FORMAT_GF_HT_11N;
 406         if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
 407                 ret.short_gi = 1;
 408         if (tx_info->flags & IEEE80211_TX_CTL_STBC)
 409                 ret.stbc = 0; // FIXME: Not yet supported by firmware?
 410         return ret;
 411 }
 412
 413 static int wfx_tx_get_icv_len(struct ieee80211_key_conf *hw_key)
 414 {
 415         int mic_space;
 416
 417         if (!hw_key)
 418                 return 0;
 419         mic_space = (hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) ? 8 : 0;
 420         return hw_key->icv_len + mic_space;
 421 }
 422
 423 static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta,
 424                         struct sk_buff *skb)
 425 {
 426         struct hif_msg *hif_msg;
 427         struct hif_req_tx *req;
 428         struct wfx_tx_priv *tx_priv;
 429         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
 430         struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
 431         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 432         int queue_id = tx_info->hw_queue;
 433         size_t offset = (size_t) skb->data & 3;
 434         int wmsg_len = sizeof(struct hif_msg) +
 435                         sizeof(struct hif_req_tx) + offset;
 436
 437         WARN(queue_id >= IEEE80211_NUM_ACS, "unsupported queue_id");
 438         wfx_tx_fixup_rates(tx_info->driver_rates);
 439
 440         // From now tx_info->control is unusable
 441         memset(tx_info->rate_driver_data, 0, sizeof(struct wfx_tx_priv));
 442         // Fill tx_priv
 443         tx_priv = (struct wfx_tx_priv *)tx_info->rate_driver_data;
 444         tx_priv->raw_link_id = wfx_tx_get_raw_link_id(wvif, sta, hdr);
 445         tx_priv->link_id = tx_priv->raw_link_id;
 446         if (ieee80211_has_protected(hdr->frame_control))
 447                 tx_priv->hw_key = hw_key;
 448         if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
 449                 tx_priv->link_id = WFX_LINK_ID_AFTER_DTIM;
 450         if (sta && (sta->uapsd_queues & BIT(queue_id)))
 451                 tx_priv->link_id = WFX_LINK_ID_UAPSD;
 452
 453         // Fill hif_msg
 454         WARN(skb_headroom(skb) < wmsg_len, "not enough space in skb");
 455         WARN(offset & 1, "attempt to transmit an unaligned frame");
 456         skb_put(skb, wfx_tx_get_icv_len(tx_priv->hw_key));
 457         skb_push(skb, wmsg_len);
 458         memset(skb->data, 0, wmsg_len);
 459         hif_msg = (struct hif_msg *)skb->data;
 460         hif_msg->len = cpu_to_le16(skb->len);
 461         hif_msg->id = HIF_REQ_ID_TX;
 462         hif_msg->interface = wvif->id;
 463         if (skb->len > wvif->wdev->hw_caps.size_inp_ch_buf) {
 464                 dev_warn(wvif->wdev->dev, "requested frame size (%d) is larger than maximum supported (%d)\n",
 465                          skb->len, wvif->wdev->hw_caps.size_inp_ch_buf);
 466                 skb_pull(skb, wmsg_len);
 467                 return -EIO;
 468         }
 469
 470         // Fill tx request
 471         req = (struct hif_req_tx *)hif_msg->body;
 472         // packet_id just need to be unique on device. 32bits are more than
 473         // necessary for that task, so we tae advantage of it to add some extra
 474         // data for debug.
 475         req->packet_id = queue_id << 28 |
 476                          IEEE80211_SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl)) << 16 |
 477                          (atomic_add_return(1, &wvif->wdev->packet_id) & 0xFFFF);
 478         req->data_flags.fc_offset = offset;
 479         if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
 480                 req->data_flags.after_dtim = 1;
 481         req->queue_id.peer_sta_id = tx_priv->raw_link_id;
 482         // Queue index are inverted between firmware and Linux
 483         req->queue_id.queue_id = 3 - queue_id;
 484         req->ht_tx_parameters = wfx_tx_get_tx_parms(wvif->wdev, tx_info);
 485         req->tx_flags.retry_policy_index = wfx_tx_get_rate_id(wvif, tx_info);
 486
 487         // Auxiliary operations
 488         wfx_tx_manage_pm(wvif, hdr, tx_priv, sta);
 489         wfx_tx_queue_put(wvif->wdev, &wvif->wdev->tx_queue[queue_id], skb);
 490         if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
 491                 schedule_work(&wvif->update_tim_work);
 492         wfx_bh_request_tx(wvif->wdev);
 493         return 0;
 494 }
 495
 496 void wfx_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 497             struct sk_buff *skb)
 498 {
 499         struct wfx_dev *wdev = hw->priv;
 500         struct wfx_vif *wvif;
 501         struct ieee80211_sta *sta = control ? control->sta : NULL;
 502         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
 503         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 504         size_t driver_data_room = sizeof_field(struct ieee80211_tx_info,
 505                                                rate_driver_data);
 506
 507         compiletime_assert(sizeof(struct wfx_tx_priv) <= driver_data_room,
 508                            "struct tx_priv is too large");
 509         WARN(skb->next || skb->prev, "skb is already member of a list");
 510         // control.vif can be NULL for injected frames
 511         if (tx_info->control.vif)
 512                 wvif = (struct wfx_vif *)tx_info->control.vif->drv_priv;
 513         else
 514                 wvif = wvif_iterate(wdev, NULL);
 515         if (WARN_ON(!wvif))
 516                 goto drop;
 517         // FIXME: why?
 518         if (ieee80211_is_action_back(hdr)) {
 519                 dev_info(wdev->dev, "drop BA action\n");
 520                 goto drop;
 521         }
 522         if (wfx_tx_inner(wvif, sta, skb))
 523                 goto drop;
 524
 525         return;
 526
 527 drop:
 528         ieee80211_tx_status_irqsafe(wdev->hw, skb);
 529 }
 530
 531 void wfx_tx_confirm_cb(struct wfx_vif *wvif, const struct hif_cnf_tx *arg)
 532 {
 533         int i;
 534         int tx_count;
 535         struct sk_buff *skb;
 536         struct ieee80211_tx_rate *rate;
 537         struct ieee80211_tx_info *tx_info;
 538         const struct wfx_tx_priv *tx_priv;
 539
 540         skb = wfx_pending_get(wvif->wdev, arg->packet_id);
 541         if (!skb) {
 542                 dev_warn(wvif->wdev->dev,
 543                          "received unknown packet_id (%#.8x) from chip\n",
 544                          arg->packet_id);
 545                 return;
 546         }
 547         tx_info = IEEE80211_SKB_CB(skb);
 548         tx_priv = wfx_skb_tx_priv(skb);
 549         _trace_tx_stats(arg, skb,
 550                         wfx_pending_get_pkt_us_delay(wvif->wdev, skb));
 551
 552         // You can touch to tx_priv, but don't touch to tx_info->status.
 553         tx_count = arg->ack_failures;
 554         if (!arg->status || arg->ack_failures)
 555                 tx_count += 1; // Also report success
 556         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
 557                 rate = &tx_info->status.rates[i];
 558                 if (rate->idx < 0)
 559                         break;
 560                 if (tx_count < rate->count &&
 561                     arg->status == HIF_STATUS_RETRY_EXCEEDED &&
 562                     arg->ack_failures)
 563                         dev_dbg(wvif->wdev->dev, "all retries were not consumed: %d != %d\n",
 564                                 rate->count, tx_count);
 565                 if (tx_count <= rate->count && tx_count &&
 566                     arg->txed_rate != wfx_get_hw_rate(wvif->wdev, rate))
 567                         dev_dbg(wvif->wdev->dev,
 568                                 "inconsistent tx_info rates: %d != %d\n",
 569                                 arg->txed_rate,
 570                                 wfx_get_hw_rate(wvif->wdev, rate));
 571                 if (tx_count > rate->count) {
 572                         tx_count -= rate->count;
 573                 } else if (!tx_count) {
 574                         rate->count = 0;
 575                         rate->idx = -1;
 576                 } else {
 577                         rate->count = tx_count;
 578                         tx_count = 0;
 579                 }
 580         }
 581         if (tx_count)
 582                 dev_dbg(wvif->wdev->dev,
 583                         "%d more retries than expected\n", tx_count);
 584         skb_trim(skb, skb->len - wfx_tx_get_icv_len(tx_priv->hw_key));
 585
 586         // From now, you can touch to tx_info->status, but do not touch to
 587         // tx_priv anymore
 588         // FIXME: use ieee80211_tx_info_clear_status()
 589         memset(tx_info->rate_driver_data, 0, sizeof(tx_info->rate_driver_data));
 590         memset(tx_info->pad, 0, sizeof(tx_info->pad));
 591
 592         if (!arg->status) {
 593                 if (wvif->bss_loss_state &&
 594                     arg->packet_id == wvif->bss_loss_confirm_id)
 595                         wfx_cqm_bssloss_sm(wvif, 0, 1, 0);
 596                 tx_info->status.tx_time =
 597                 arg->media_delay - arg->tx_queue_delay;
 598                 if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
 599                         tx_info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
 600                 else
 601                         tx_info->flags |= IEEE80211_TX_STAT_ACK;
 602         } else if (arg->status == HIF_REQUEUE) {
 603                 WARN(!arg->tx_result_flags.requeue, "incoherent status and result_flags");
 604                 if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) {
 605                         wvif->after_dtim_tx_allowed = false; // DTIM period elapsed
 606                         schedule_work(&wvif->update_tim_work);
 607                 }
 608                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
 609         } else {
 610                 if (wvif->bss_loss_state &&
 611                     arg->packet_id == wvif->bss_loss_confirm_id)
 612                         wfx_cqm_bssloss_sm(wvif, 0, 0, 1);
 613         }
 614         wfx_pending_remove(wvif->wdev, skb);
 615 }
 616
 617 static void wfx_notify_buffered_tx(struct wfx_vif *wvif, struct sk_buff *skb)
 618 {
 619         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 620         struct ieee80211_sta *sta;
 621         struct wfx_sta_priv *sta_priv;
 622         int tid = ieee80211_get_tid(hdr);
 623
 624         rcu_read_lock(); // protect sta
 625         sta = ieee80211_find_sta(wvif->vif, hdr->addr1);
 626         if (sta) {
 627                 sta_priv = (struct wfx_sta_priv *)&sta->drv_priv;
 628                 spin_lock_bh(&sta_priv->lock);
 629                 WARN(!sta_priv->buffered[tid], "inconsistent notification");
 630                 sta_priv->buffered[tid]--;
 631                 if (!sta_priv->buffered[tid])
 632                         ieee80211_sta_set_buffered(sta, tid, false);
 633                 spin_unlock_bh(&sta_priv->lock);
 634         }
 635         rcu_read_unlock();
 636 }
 637
 638 void wfx_skb_dtor(struct wfx_dev *wdev, struct sk_buff *skb)
 639 {
 640         struct hif_msg *hif = (struct hif_msg *)skb->data;
 641         struct hif_req_tx *req = (struct hif_req_tx *)hif->body;
 642         struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);
 643         unsigned int offset = sizeof(struct hif_req_tx) +
 644                                 sizeof(struct hif_msg) +
 645                                 req->data_flags.fc_offset;
 646
 647         WARN_ON(!wvif);
 648         skb_pull(skb, offset);
 649         wfx_notify_buffered_tx(wvif, skb);
 650         wfx_tx_policy_put(wvif, req->tx_flags.retry_policy_index);
 651         ieee80211_tx_status_irqsafe(wdev->hw, skb);
 652 }