[PATCH] wifi: mt76: mt7996: route disassoc frames to ALTXQ

If AP sends deauth or disassoc to a peer station while the station is
in power-save mode, the frame may queue in the normal ACQ and lead to
PLE hang, since the station won't wake up to receive it.

Deauth frames are already routed to MT_TXQ_PSD / ALTX0. Extend the
same handling to disassoc frames, and additionally route any frame to
a station that hasn't completed authorization (tx_info without
MT_WCID_TX_INFO_SET) to ALTX0 in mt7996_mac_write_txwi(), clearing the
flag again on MT76_STA_EVENT_DISASSOC so it gets re-armed on the next
association.

MediaTek's vendor tree has an equivalent fix, though written against
a newer MLO-aware version of this code that doesn't apply directly to
this tree:
https://github.com/mediatek/mtk-openwrt-feeds/commit/ed6924828479aaeadbb7c402ec390df26dcbd8bc

Signed-off-by: Valera Kozlov <[email protected]>
---
 mt7996/mac.c  | 2 +-
 mt7996/main.c | 1 +
 tx.c          | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/mt7996/mac.c b/mt7996/mac.c
index 570f85d7..10d4264c 100644
--- a/mt7996/mac.c
+++ b/mt7996/mac.c
@@ -932,7 +932,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
 	} else if (beacon) {
 		p_fmt = MT_TX_TYPE_FW;
 		q_idx = MT_LMAC_BCN0;
-	} else if (qid >= MT_TXQ_PSD) {
+	} else if (qid >= MT_TXQ_PSD || (!(wcid->tx_info & MT_WCID_TX_INFO_SET))) {
 		p_fmt = MT_TX_TYPE_CT;
 		q_idx = MT_LMAC_ALTX0;
 	} else {
diff --git a/mt7996/main.c b/mt7996/main.c
index 1afb926c..8d45af3e 100644
--- a/mt7996/main.c
+++ b/mt7996/main.c
@@ -1414,6 +1414,7 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,
 				goto unlock;
 			break;
 		case MT76_STA_EVENT_DISASSOC:
+			msta_link->wcid.tx_info &= ~MT_WCID_TX_INFO_SET;
 			for (i = 0; i < ARRAY_SIZE(msta_link->twt.flow); i++)
 				mt7996_mac_twt_teardown_flow(dev, link,
 							     msta_link, i);
diff --git a/tx.c b/tx.c
index b863e449..6bcad275 100644
--- a/tx.c
+++ b/tx.c
@@ -689,6 +689,7 @@ mt76_txq_schedule_pending_wcid(struct mt76_phy *phy, struct mt76_wcid *wcid,
 		    !ieee80211_is_data_present(hdr->frame_control) &&
 		    (!ieee80211_is_bufferable_mmpdu(skb) ||
 		     ieee80211_is_deauth(hdr->frame_control) ||
+		     ieee80211_is_disassoc(hdr->frame_control) ||
 		     head == &wcid->tx_offchannel))
 			qid = MT_TXQ_PSD;
 
-- 
2.53.0