0009-mt76-include-fixes-for-MT7603-MT7612.patch

From: David Bauer <mail@david-bauer.net>
Date: Thu, 14 Mar 2024 09:39:22 +0100
Subject: mt76: include fixes for MT7603 / MT7612

diff --git a/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch b/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch
new file mode 100644
index 0000000000000000000000000000000000000000..568c590f24c251dda70522865af32b3753cd5beb
--- /dev/null
+++ b/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch
@@ -0,0 +1,79 @@
+From a95c23b2c2e923ed293eb794b74735c7d6c5b272 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 1 Mar 2024 17:41:33 +0100
+Subject: [PATCH 1/2] tx: add limit for TXS ack override
+
+Add an upper limit for overriding missing TX status for each client.
+
+This avoids clients, which to mac80211 still appear as if they are
+connected when in fact they are not reachable for the AP anymore.
+
+This can happen, as the radio (observed on MT7603 in particular) might
+skip TX status-reporting which the host will then mark as acked. This
+prevents the client from timing out and become "sticky" on the AP.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ mt76.h |  2 ++
+ tx.c   | 20 +++++++++++++++++++-
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/mt76.h b/mt76.h
+index fd527649..6d9b7028 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -330,6 +330,8 @@ struct mt76_wcid {
+ 	u8 rx_key_pn[IEEE80211_NUM_TIDS + 1][6];
+ 	u16 cipher;
+ 
++	u8 txs_failed_cnt;
++
+ 	u32 tx_info;
+ 	bool sw_iv;
+ 
+diff --git a/tx.c b/tx.c
+index 1809b032..65d6104f 100644
+--- a/tx.c
++++ b/tx.c
+@@ -91,6 +91,7 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags,
+ {
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
++	struct mt76_wcid *wcid;
+ 	u8 done = MT_TX_CB_DMA_DONE | MT_TX_CB_TXS_DONE;
+ 
+ 	flags |= cb->flags;
+@@ -98,12 +99,29 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags,
+ 
+ 	if ((flags & done) != done)
+ 		return;
++	
++	wcid = rcu_dereference(dev->wcid[cb->wcid]);
+ 
+ 	/* Tx status can be unreliable. if it fails, mark the frame as ACKed */
+ 	if (flags & MT_TX_CB_TXS_FAILED) {
++		/* Increment station counter */
++		if (wcid && wcid->sta)
++			wcid->txs_failed_cnt++;
++
+ 		info->status.rates[0].count = 0;
+ 		info->status.rates[0].idx = -1;
+-		info->flags |= IEEE80211_TX_STAT_ACK;
++
++		/**
++		 * Check if station counter exceeds the limit for
++		 * implicit acks. If not, mark the frame as ACKed.
++		 */
++		if (!wcid || wcid->txs_failed_cnt < 25) {
++			info->flags |= IEEE80211_TX_STAT_ACK;
++		}
++	} else if (info->flags & IEEE80211_TX_STAT_ACK) {
++		/* Reset station counter */
++		if (wcid && wcid->sta)
++			wcid->txs_failed_cnt = 0;
+ 	}
+ 
+ 	__skb_queue_tail(list, skb);
+-- 
+2.43.0
+
diff --git a/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch b/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch
new file mode 100644
index 0000000000000000000000000000000000000000..0910ed99ef473db9cf4129f88017912b5d63267d
--- /dev/null
+++ b/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch
@@ -0,0 +1,80 @@
+From 3c9ecc0c77e85d9ff91faddde59764fbc9316b7c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 2 Mar 2024 13:14:49 +0100
+Subject: [PATCH 2/2] mt76x02: avoid action ghost-ack
+
+On PMF enabled networks, chip reports ACTION frames always as acked.
+
+In case a roaming-assistant sens link-measurements periodically,
+this results in the station never becoming inactive and not being removed
+from the AP's station list.
+
+Avoid this from happening by marking action frames sent on a PMF enabled
+network as no-ack.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ mt76x02_mac.c | 27 +++++++++++++++++++++++++++
+ mt76x02_mac.h |  1 +
+ 2 files changed, 28 insertions(+)
+
+diff --git a/mt76x02_mac.c b/mt76x02_mac.c
+index d5db6ffd..672e01ec 100644
+--- a/mt76x02_mac.c
++++ b/mt76x02_mac.c
+@@ -544,6 +544,7 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
+ 	struct ieee80211_tx_status status = {
+ 		.info = &info
+ 	};
++	struct ieee80211_hdr *hdr;
+ 	static const u8 ac_to_tid[4] = {
+ 		[IEEE80211_AC_BE] = 0,
+ 		[IEEE80211_AC_BK] = 1,
+@@ -619,6 +620,32 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
+ 		*update = 1;
+ 	}
+ 
++	if (msta && status.skb &&
++	    (status.info->flags & IEEE80211_TX_STAT_ACK)) {
++		hdr = (struct ieee80211_hdr *)status.skb->data;
++
++		if (ieee80211_has_protected(hdr->frame_control) &&
++		    ieee80211_is_robust_mgmt_frame(status.skb)) {
++			/**
++			 * On PMF enabled networks, chip reports ACTION frames
++			 * always as acked.
++			 *
++			 * In case a roaming-assistant sends link-measurements
++			 * periodically, this results in the station never
++			 * becoming inactive and not being removed from the
++			 * AP's station list.
++			 */
++
++			if (msta->n_enc_mgmt >= 25) {
++				status.info->flags &= ~IEEE80211_TX_STAT_ACK;
++			} else {
++				msta->n_enc_mgmt++;
++			}
++		} else {
++			msta->n_enc_mgmt = 0;
++		}
++	}
++
+ 	if (status.skb) {
+ 		info = *status.info;
+ 		len = status.skb->len;
+diff --git a/mt76x02_mac.h b/mt76x02_mac.h
+index 5dc6c834..1bd2288f 100644
+--- a/mt76x02_mac.h
++++ b/mt76x02_mac.h
+@@ -39,6 +39,7 @@ struct mt76x02_sta {
+ 	struct mt76x02_vif *vif;
+ 	struct mt76x02_tx_status status;
+ 	int n_frames;
++	u8 n_enc_mgmt;
+ 
+ 	struct ewma_pktlen pktlen;
+ };
+-- 
+2.43.0
+