From: David Bauer <mail@david-bauer.net>
Date: Thu, 14 Mar 2024 09:39:22 +0100
Subject: mt76: include fixes for MT7603 / MT7612
diff --git a/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch b/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch
new file mode 100644
index 0000000000000000000000000000000000000000..568c590f24c251dda70522865af32b3753cd5beb
--- /dev/null
+++ b/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch
@@ -0,0 +1,79 @@
+From a95c23b2c2e923ed293eb794b74735c7d6c5b272 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 1 Mar 2024 17:41:33 +0100
+Subject: [PATCH 1/2] tx: add limit for TXS ack override
+
+Add an upper limit for overriding missing TX status for each client.
+
+This avoids clients, which to mac80211 still appear as if they are
+connected when in fact they are not reachable for the AP anymore.
+
+This can happen, as the radio (observed on MT7603 in particular) might
+skip TX status-reporting which the host will then mark as acked. This
+prevents the client from timing out and become "sticky" on the AP.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ mt76.h | 2 ++
+ tx.c | 20 +++++++++++++++++++-
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/mt76.h b/mt76.h
+index fd527649..6d9b7028 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -330,6 +330,8 @@ struct mt76_wcid {
+ u8 rx_key_pn[IEEE80211_NUM_TIDS + 1][6];
+ u16 cipher;
+
++ u8 txs_failed_cnt;
++
+ u32 tx_info;
+ bool sw_iv;
+
+diff --git a/tx.c b/tx.c
+index 1809b032..65d6104f 100644
+--- a/tx.c
++++ b/tx.c
+@@ -91,6 +91,7 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags,
+ {
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
++ struct mt76_wcid *wcid;
+ u8 done = MT_TX_CB_DMA_DONE | MT_TX_CB_TXS_DONE;
+
+ flags |= cb->flags;
+@@ -98,12 +99,29 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags,
+
+ if ((flags & done) != done)
+ return;
++
++ wcid = rcu_dereference(dev->wcid[cb->wcid]);
+
+ /* Tx status can be unreliable. if it fails, mark the frame as ACKed */
+ if (flags & MT_TX_CB_TXS_FAILED) {
++ /* Increment station counter */
++ if (wcid && wcid->sta)
++ wcid->txs_failed_cnt++;
++
+ info->status.rates[0].count = 0;
+ info->status.rates[0].idx = -1;
+- info->flags |= IEEE80211_TX_STAT_ACK;
++
++ /**
++ * Check if station counter exceeds the limit for
++ * implicit acks. If not, mark the frame as ACKed.
++ */
++ if (!wcid || wcid->txs_failed_cnt < 25) {
++ info->flags |= IEEE80211_TX_STAT_ACK;
++ }
++ } else if (info->flags & IEEE80211_TX_STAT_ACK) {
++ /* Reset station counter */
++ if (wcid && wcid->sta)
++ wcid->txs_failed_cnt = 0;
+ }
+
+ __skb_queue_tail(list, skb);
+--
+2.43.0
+
diff --git a/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch b/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch
new file mode 100644
index 0000000000000000000000000000000000000000..0910ed99ef473db9cf4129f88017912b5d63267d
--- /dev/null
+++ b/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch
@@ -0,0 +1,80 @@
+From 3c9ecc0c77e85d9ff91faddde59764fbc9316b7c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 2 Mar 2024 13:14:49 +0100
+Subject: [PATCH 2/2] mt76x02: avoid action ghost-ack
+
+On PMF enabled networks, chip reports ACTION frames always as acked.
+
+In case a roaming-assistant sens link-measurements periodically,
+this results in the station never becoming inactive and not being removed
+from the AP's station list.
+
+Avoid this from happening by marking action frames sent on a PMF enabled
+network as no-ack.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ mt76x02_mac.c | 27 +++++++++++++++++++++++++++
+ mt76x02_mac.h | 1 +
+ 2 files changed, 28 insertions(+)
+
+diff --git a/mt76x02_mac.c b/mt76x02_mac.c
+index d5db6ffd..672e01ec 100644
+--- a/mt76x02_mac.c
++++ b/mt76x02_mac.c
+@@ -544,6 +544,7 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
+ struct ieee80211_tx_status status = {
+ .info = &info
+ };
++ struct ieee80211_hdr *hdr;
+ static const u8 ac_to_tid[4] = {
+ [IEEE80211_AC_BE] = 0,
+ [IEEE80211_AC_BK] = 1,
+@@ -619,6 +620,32 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
+ *update = 1;
+ }
+
++ if (msta && status.skb &&
++ (status.info->flags & IEEE80211_TX_STAT_ACK)) {
++ hdr = (struct ieee80211_hdr *)status.skb->data;
++
++ if (ieee80211_has_protected(hdr->frame_control) &&
++ ieee80211_is_robust_mgmt_frame(status.skb)) {
++ /**
++ * On PMF enabled networks, chip reports ACTION frames
++ * always as acked.
++ *
++ * In case a roaming-assistant sends link-measurements
++ * periodically, this results in the station never
++ * becoming inactive and not being removed from the
++ * AP's station list.
++ */
++
++ if (msta->n_enc_mgmt >= 25) {
++ status.info->flags &= ~IEEE80211_TX_STAT_ACK;
++ } else {
++ msta->n_enc_mgmt++;
++ }
++ } else {
++ msta->n_enc_mgmt = 0;
++ }
++ }
++
+ if (status.skb) {
+ info = *status.info;
+ len = status.skb->len;
+diff --git a/mt76x02_mac.h b/mt76x02_mac.h
+index 5dc6c834..1bd2288f 100644
+--- a/mt76x02_mac.h
++++ b/mt76x02_mac.h
+@@ -39,6 +39,7 @@ struct mt76x02_sta {
+ struct mt76x02_vif *vif;
+ struct mt76x02_tx_status status;
+ int n_frames;
++ u8 n_enc_mgmt;
+
+ struct ewma_pktlen pktlen;
+ };
+--
+2.43.0
+