drivers/net/wireless/mediatek/mt76-6e-usb/mt7921/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7921.h"
   7 #include "mt7921_trace.h"
   8 #include "mcu.h"
   9 #include "mac.h"
  10
  11 struct mt7921_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7921_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7921_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7921_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MT_STA_BFER                     BIT(0)
  68 #define MT_STA_BFEE                     BIT(1)
  69
  70 #define PATCH_SEC_ENC_TYPE_MASK         GENMASK(31, 24)
  71 #define PATCH_SEC_ENC_TYPE_PLAIN                0x00
  72 #define PATCH_SEC_ENC_TYPE_AES                  0x01
  73 #define PATCH_SEC_ENC_TYPE_SCRAMBLE             0x02
  74 #define PATCH_SEC_ENC_SCRAMBLE_INFO_MASK        GENMASK(15, 0)
  75 #define PATCH_SEC_ENC_AES_KEY_MASK              GENMASK(7, 0)
  76
  77 static int
  78 mt7921_mcu_parse_eeprom(struct mt76_dev *dev, struct sk_buff *skb)
  79 {
  80         struct mt7921_mcu_eeprom_info *res;
  81         u8 *buf;
  82
  83         if (!skb)
  84                 return -EINVAL;
  85
  86         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
  87
  88         res = (struct mt7921_mcu_eeprom_info *)skb->data;
  89         buf = dev->eeprom.data + le32_to_cpu(res->addr);
  90         memcpy(buf, res->data, 16);
  91
  92         return 0;
  93 }
  94
  95 int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
  96                               struct sk_buff *skb, int seq)
  97 {
  98         int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
  99         struct mt7921_mcu_rxd *rxd;
 100         int ret = 0;
 101
 102         if (!skb) {
 103                 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 104                         cmd, seq);
 105                 mt7921_reset(mdev);
 106
 107                 return -ETIMEDOUT;
 108         }
 109
 110         rxd = (struct mt7921_mcu_rxd *)skb->data;
 111         if (seq != rxd->seq)
 112                 return -EAGAIN;
 113
 114         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 115                 skb_pull(skb, sizeof(*rxd) - 4);
 116                 ret = *skb->data;
 117         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 118                 skb_pull(skb, sizeof(*rxd) + 4);
 119                 ret = le32_to_cpu(*(__le32 *)skb->data);
 120         } else if (cmd == MCU_EXT_CMD(EFUSE_ACCESS)) {
 121                 ret = mt7921_mcu_parse_eeprom(mdev, skb);
 122         } else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
 123                    cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
 124                    cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
 125                    cmd == MCU_UNI_CMD(HIF_CTRL) ||
 126                    cmd == MCU_UNI_CMD(OFFLOAD) ||
 127                    cmd == MCU_UNI_CMD(SUSPEND)) {
 128                 struct mt7921_mcu_uni_event *event;
 129
 130                 skb_pull(skb, sizeof(*rxd));
 131                 event = (struct mt7921_mcu_uni_event *)skb->data;
 132                 ret = le32_to_cpu(event->status);
 133                 /* skip invalid event */
 134                 if (mcu_cmd != event->cid)
 135                         ret = -EAGAIN;
 136         } else if (cmd == MCU_CE_QUERY(REG_READ)) {
 137                 struct mt7921_mcu_reg_event *event;
 138
 139                 skb_pull(skb, sizeof(*rxd));
 140                 event = (struct mt7921_mcu_reg_event *)skb->data;
 141                 ret = (int)le32_to_cpu(event->val);
 142         } else {
 143                 skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 144         }
 145
 146         return ret;
 147 }
 148 EXPORT_SYMBOL_GPL(mt7921_mcu_parse_response);
 149
 150 int mt7921_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
 151                             int cmd, int *wait_seq)
 152 {
 153         struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
 154         int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 155         struct mt7921_uni_txd *uni_txd;
 156         struct mt7921_mcu_txd *mcu_txd;
 157         __le32 *txd;
 158         u32 val;
 159         u8 seq;
 160
 161         if (cmd == MCU_UNI_CMD(HIF_CTRL) ||
 162             cmd == MCU_UNI_CMD(SUSPEND) ||
 163             cmd == MCU_UNI_CMD(OFFLOAD))
 164                 mdev->mcu.timeout = HZ;
 165         else
 166                 mdev->mcu.timeout = 3 * HZ;
 167
 168         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 169         if (!seq)
 170                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 171
 172         if (cmd == MCU_CMD(FW_SCATTER))
 173                 goto exit;
 174
 175         txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 176         txd = (__le32 *)skb_push(skb, txd_len);
 177
 178         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 179               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 180               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 181         txd[0] = cpu_to_le32(val);
 182
 183         val = MT_TXD1_LONG_FORMAT |
 184               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 185         txd[1] = cpu_to_le32(val);
 186
 187         if (cmd & __MCU_CMD_FIELD_UNI) {
 188                 uni_txd = (struct mt7921_uni_txd *)txd;
 189                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 190                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 191                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 192                 uni_txd->s2d_index = MCU_S2D_H2N;
 193                 uni_txd->pkt_type = MCU_PKT_ID;
 194                 uni_txd->seq = seq;
 195
 196                 goto exit;
 197         }
 198
 199         mcu_txd = (struct mt7921_mcu_txd *)txd;
 200         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 201         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 202                                                MT_TX_MCU_PORT_RX_Q0));
 203         mcu_txd->pkt_type = MCU_PKT_ID;
 204         mcu_txd->seq = seq;
 205         mcu_txd->cid = mcu_cmd;
 206         mcu_txd->s2d_index = MCU_S2D_H2N;
 207         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 208
 209         if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
 210                 if (cmd & __MCU_CMD_FIELD_QUERY)
 211                         mcu_txd->set_query = MCU_Q_QUERY;
 212                 else
 213                         mcu_txd->set_query = MCU_Q_SET;
 214                 mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
 215         } else {
 216                 mcu_txd->set_query = MCU_Q_NA;
 217         }
 218
 219 exit:
 220         if (wait_seq)
 221                 *wait_seq = seq;
 222
 223         return 0;
 224 }
 225 EXPORT_SYMBOL_GPL(mt7921_mcu_fill_message);
 226
 227 static void
 228 mt7921_mcu_scan_event(struct mt7921_dev *dev, struct sk_buff *skb)
 229 {
 230         struct mt76_phy *mphy = &dev->mt76.phy;
 231         struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
 232
 233         spin_lock_bh(&dev->mt76.lock);
 234         __skb_queue_tail(&phy->scan_event_list, skb);
 235         spin_unlock_bh(&dev->mt76.lock);
 236
 237         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 238                                      MT7921_HW_SCAN_TIMEOUT);
 239 }
 240
 241 static void
 242 mt7921_mcu_connection_loss_iter(void *priv, u8 *mac,
 243                                 struct ieee80211_vif *vif)
 244 {
 245         struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
 246         struct mt76_connac_beacon_loss_event *event = priv;
 247
 248         if (mvif->idx != event->bss_idx)
 249                 return;
 250
 251         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
 252                 return;
 253
 254         ieee80211_connection_loss(vif);
 255 }
 256
 257 static void
 258 mt7921_mcu_connection_loss_event(struct mt7921_dev *dev, struct sk_buff *skb)
 259 {
 260         struct mt76_connac_beacon_loss_event *event;
 261         struct mt76_phy *mphy = &dev->mt76.phy;
 262
 263         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 264         event = (struct mt76_connac_beacon_loss_event *)skb->data;
 265
 266         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 267                                         IEEE80211_IFACE_ITER_RESUME_ALL,
 268                                         mt7921_mcu_connection_loss_iter, event);
 269 }
 270
 271 static void
 272 mt7921_mcu_bss_event(struct mt7921_dev *dev, struct sk_buff *skb)
 273 {
 274         struct mt76_phy *mphy = &dev->mt76.phy;
 275         struct mt76_connac_mcu_bss_event *event;
 276
 277         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 278         event = (struct mt76_connac_mcu_bss_event *)skb->data;
 279         if (event->is_absent)
 280                 ieee80211_stop_queues(mphy->hw);
 281         else
 282                 ieee80211_wake_queues(mphy->hw);
 283 }
 284
 285 static void
 286 mt7921_mcu_debug_msg_event(struct mt7921_dev *dev, struct sk_buff *skb)
 287 {
 288         struct mt7921_debug_msg {
 289                 __le16 id;
 290                 u8 type;
 291                 u8 flag;
 292                 __le32 value;
 293                 __le16 len;
 294                 u8 content[512];
 295         } __packed * msg;
 296
 297         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 298         msg = (struct mt7921_debug_msg *)skb->data;
 299
 300         if (msg->type == 3) { /* fw log */
 301                 u16 len = min_t(u16, le16_to_cpu(msg->len), 512);
 302                 int i;
 303
 304                 for (i = 0 ; i < len; i++) {
 305                         if (!msg->content[i])
 306                                 msg->content[i] = ' ';
 307                 }
 308                 wiphy_info(mt76_hw(dev)->wiphy, "%.*s", len, msg->content);
 309         }
 310 }
 311
 312 static void
 313 mt7921_mcu_low_power_event(struct mt7921_dev *dev, struct sk_buff *skb)
 314 {
 315         struct mt7921_mcu_lp_event {
 316                 u8 state;
 317                 u8 reserved[3];
 318         } __packed * event;
 319
 320         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 321         event = (struct mt7921_mcu_lp_event *)skb->data;
 322
 323         trace_lp_event(dev, event->state);
 324 }
 325
 326 static void
 327 mt7921_mcu_tx_done_event(struct mt7921_dev *dev, struct sk_buff *skb)
 328 {
 329         struct mt7921_mcu_tx_done_event *event;
 330
 331         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 332         event = (struct mt7921_mcu_tx_done_event *)skb->data;
 333
 334         mt7921_mac_add_txs(dev, event->txs);
 335 }
 336
 337 static void
 338 mt7921_mcu_rx_unsolicited_event(struct mt7921_dev *dev, struct sk_buff *skb)
 339 {
 340         struct mt7921_mcu_rxd *rxd = (struct mt7921_mcu_rxd *)skb->data;
 341
 342         switch (rxd->eid) {
 343         case MCU_EVENT_BSS_BEACON_LOSS:
 344                 mt7921_mcu_connection_loss_event(dev, skb);
 345                 break;
 346         case MCU_EVENT_SCHED_SCAN_DONE:
 347         case MCU_EVENT_SCAN_DONE:
 348                 mt7921_mcu_scan_event(dev, skb);
 349                 return;
 350         case MCU_EVENT_BSS_ABSENCE:
 351                 mt7921_mcu_bss_event(dev, skb);
 352                 break;
 353         case MCU_EVENT_DBG_MSG:
 354                 mt7921_mcu_debug_msg_event(dev, skb);
 355                 break;
 356         case MCU_EVENT_COREDUMP:
 357                 dev->fw_assert = true;
 358                 mt76_connac_mcu_coredump_event(&dev->mt76, skb,
 359                                                &dev->coredump);
 360                 return;
 361         case MCU_EVENT_LP_INFO:
 362                 mt7921_mcu_low_power_event(dev, skb);
 363                 break;
 364         case MCU_EVENT_TX_DONE:
 365                 mt7921_mcu_tx_done_event(dev, skb);
 366                 break;
 367         default:
 368                 break;
 369         }
 370         dev_kfree_skb(skb);
 371 }
 372
 373 void mt7921_mcu_rx_event(struct mt7921_dev *dev, struct sk_buff *skb)
 374 {
 375         struct mt7921_mcu_rxd *rxd;
 376
 377         if (skb_linearize(skb))
 378                 return;
 379
 380         rxd = (struct mt7921_mcu_rxd *)skb->data;
 381
 382         if (rxd->eid == 0x6) {
 383                 mt76_mcu_rx_event(&dev->mt76, skb);
 384                 return;
 385         }
 386
 387         if (rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 388             rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 389             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 390             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 391             rxd->eid == MCU_EVENT_SCAN_DONE ||
 392             rxd->eid == MCU_EVENT_TX_DONE ||
 393             rxd->eid == MCU_EVENT_DBG_MSG ||
 394             rxd->eid == MCU_EVENT_COREDUMP ||
 395             rxd->eid == MCU_EVENT_LP_INFO ||
 396             !rxd->seq)
 397                 mt7921_mcu_rx_unsolicited_event(dev, skb);
 398         else
 399                 mt76_mcu_rx_event(&dev->mt76, skb);
 400 }
 401
 402 /** starec & wtbl **/
 403 int mt7921_mcu_uni_tx_ba(struct mt7921_dev *dev,
 404                          struct ieee80211_ampdu_params *params,
 405                          bool enable)
 406 {
 407         struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
 408
 409         if (enable && !params->amsdu)
 410                 msta->wcid.amsdu = false;
 411
 412         return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
 413                                       MCU_UNI_CMD(STA_REC_UPDATE),
 414                                       enable, true);
 415 }
 416
 417 int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
 418                          struct ieee80211_ampdu_params *params,
 419                          bool enable)
 420 {
 421         struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
 422
 423         return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
 424                                       MCU_UNI_CMD(STA_REC_UPDATE),
 425                                       enable, false);
 426 }
 427
 428 static u32 mt7921_get_data_mode(struct mt7921_dev *dev, u32 info)
 429 {
 430         u32 mode = DL_MODE_NEED_RSP;
 431
 432         if (info == PATCH_SEC_NOT_SUPPORT)
 433                 return mode;
 434
 435         switch (FIELD_GET(PATCH_SEC_ENC_TYPE_MASK, info)) {
 436         case PATCH_SEC_ENC_TYPE_PLAIN:
 437                 break;
 438         case PATCH_SEC_ENC_TYPE_AES:
 439                 mode |= DL_MODE_ENCRYPT;
 440                 mode |= FIELD_PREP(DL_MODE_KEY_IDX,
 441                                 (info & PATCH_SEC_ENC_AES_KEY_MASK)) & DL_MODE_KEY_IDX;
 442                 mode |= DL_MODE_RESET_SEC_IV;
 443                 break;
 444         case PATCH_SEC_ENC_TYPE_SCRAMBLE:
 445                 mode |= DL_MODE_ENCRYPT;
 446                 mode |= DL_CONFIG_ENCRY_MODE_SEL;
 447                 mode |= DL_MODE_RESET_SEC_IV;
 448                 break;
 449         default:
 450                 dev_err(dev->mt76.dev, "Encryption type not support!\n");
 451         }
 452
 453         return mode;
 454 }
 455
 456 static char *mt7921_patch_name(struct mt7921_dev *dev)
 457 {
 458         char *ret;
 459
 460         if (is_mt7922(&dev->mt76))
 461                 ret = MT7922_ROM_PATCH;
 462         else
 463                 ret = MT7921_ROM_PATCH;
 464
 465         return ret;
 466 }
 467
 468 static int mt7921_load_patch(struct mt7921_dev *dev)
 469 {
 470         const struct mt7921_patch_hdr *hdr;
 471         const struct firmware *fw = NULL;
 472         int i, ret, sem, max_len;
 473
 474         max_len = mt76_is_sdio(&dev->mt76) ? 2048 : 4096;
 475
 476         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
 477         switch (sem) {
 478         case PATCH_IS_DL:
 479                 return 0;
 480         case PATCH_NOT_DL_SEM_SUCCESS:
 481                 break;
 482         default:
 483                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
 484                 return -EAGAIN;
 485         }
 486
 487         ret = request_firmware(&fw, mt7921_patch_name(dev), dev->mt76.dev);
 488         if (ret)
 489                 goto out;
 490
 491         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
 492                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 493                 ret = -EINVAL;
 494                 goto out;
 495         }
 496
 497         hdr = (const struct mt7921_patch_hdr *)(fw->data);
 498
 499         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
 500                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
 501
 502         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
 503                 struct mt7921_patch_sec *sec;
 504                 const u8 *dl;
 505                 u32 len, addr, mode;
 506                 u32 sec_info = 0;
 507
 508                 sec = (struct mt7921_patch_sec *)(fw->data + sizeof(*hdr) +
 509                                                   i * sizeof(*sec));
 510                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
 511                     PATCH_SEC_TYPE_INFO) {
 512                         ret = -EINVAL;
 513                         goto out;
 514                 }
 515
 516                 addr = be32_to_cpu(sec->info.addr);
 517                 len = be32_to_cpu(sec->info.len);
 518                 dl = fw->data + be32_to_cpu(sec->offs);
 519                 sec_info = be32_to_cpu(sec->info.sec_key_idx);
 520                 mode = mt7921_get_data_mode(dev, sec_info);
 521
 522                 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
 523                                                     mode);
 524                 if (ret) {
 525                         dev_err(dev->mt76.dev, "Download request failed\n");
 526                         goto out;
 527                 }
 528
 529                 ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
 530                                                dl, len, max_len);
 531                 if (ret) {
 532                         dev_err(dev->mt76.dev, "Failed to send patch\n");
 533                         goto out;
 534                 }
 535         }
 536
 537         ret = mt76_connac_mcu_start_patch(&dev->mt76);
 538         if (ret)
 539                 dev_err(dev->mt76.dev, "Failed to start patch\n");
 540
 541 out:
 542         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
 543         switch (sem) {
 544         case PATCH_REL_SEM_SUCCESS:
 545                 break;
 546         default:
 547                 ret = -EAGAIN;
 548                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
 549                 break;
 550         }
 551
 552         if (!ret && mt76_is_sdio(&dev->mt76)) {
 553                 /* activate again */
 554                 ret = __mt7921_mcu_fw_pmctrl(dev);
 555                 if (!ret)
 556                         ret = __mt7921_mcu_drv_pmctrl(dev);
 557         }
 558
 559         release_firmware(fw);
 560
 561         return ret;
 562 }
 563
 564 static int
 565 mt7921_mcu_send_ram_firmware(struct mt7921_dev *dev,
 566                              const struct mt7921_fw_trailer *hdr,
 567                              const u8 *data, bool is_wa)
 568 {
 569         int i, offset = 0, max_len;
 570         u32 override = 0, option = 0;
 571
 572         max_len = mt76_is_sdio(&dev->mt76) ? 2048 : 4096;
 573
 574         for (i = 0; i < hdr->n_region; i++) {
 575                 const struct mt7921_fw_region *region;
 576                 int err;
 577                 u32 len, addr, mode;
 578
 579                 region = (const struct mt7921_fw_region *)((const u8 *)hdr -
 580                          (hdr->n_region - i) * sizeof(*region));
 581                 mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
 582                                                    region->feature_set, is_wa);
 583                 len = le32_to_cpu(region->len);
 584                 addr = le32_to_cpu(region->addr);
 585
 586                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
 587                         override = addr;
 588
 589                 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
 590                                                     mode);
 591                 if (err) {
 592                         dev_err(dev->mt76.dev, "Download request failed\n");
 593                         return err;
 594                 }
 595
 596                 err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
 597                                                data + offset, len, max_len);
 598                 if (err) {
 599                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
 600                         return err;
 601                 }
 602
 603                 offset += len;
 604         }
 605
 606         if (override)
 607                 option |= FW_START_OVERRIDE;
 608
 609         if (is_wa)
 610                 option |= FW_START_WORKING_PDA_CR4;
 611
 612         return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
 613 }
 614
 615 static char *mt7921_ram_name(struct mt7921_dev *dev)
 616 {
 617         char *ret;
 618
 619         if (is_mt7922(&dev->mt76))
 620                 ret = MT7922_FIRMWARE_WM;
 621         else
 622                 ret = MT7921_FIRMWARE_WM;
 623
 624         return ret;
 625 }
 626
 627 static int mt7921_load_ram(struct mt7921_dev *dev)
 628 {
 629         const struct mt7921_fw_trailer *hdr;
 630         const struct firmware *fw;
 631         int ret;
 632
 633         ret = request_firmware(&fw, mt7921_ram_name(dev), dev->mt76.dev);
 634         if (ret)
 635                 return ret;
 636
 637         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
 638                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 639                 ret = -EINVAL;
 640                 goto out;
 641         }
 642
 643         hdr = (const struct mt7921_fw_trailer *)(fw->data + fw->size -
 644                                         sizeof(*hdr));
 645
 646         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
 647                  hdr->fw_ver, hdr->build_date);
 648
 649         ret = mt7921_mcu_send_ram_firmware(dev, hdr, fw->data, false);
 650         if (ret) {
 651                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
 652                 goto out;
 653         }
 654
 655         snprintf(dev->mt76.hw->wiphy->fw_version,
 656                  sizeof(dev->mt76.hw->wiphy->fw_version),
 657                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
 658
 659 out:
 660         release_firmware(fw);
 661
 662         return ret;
 663 }
 664
 665 static int mt7921_load_firmware(struct mt7921_dev *dev)
 666 {
 667         int ret;
 668
 669         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
 670         if (ret && mt76_is_mmio(&dev->mt76)) {
 671                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
 672                 goto fw_loaded;
 673         }
 674
 675         ret = mt7921_load_patch(dev);
 676         if (ret)
 677                 return ret;
 678
 679         ret = mt7921_load_ram(dev);
 680         if (ret)
 681                 return ret;
 682
 683         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
 684                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
 685                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
 686
 687                 return -EIO;
 688         }
 689
 690 fw_loaded:
 691
 692 #ifdef CONFIG_PM
 693         dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
 694 #endif /* CONFIG_PM */
 695
 696         dev_dbg(dev->mt76.dev, "Firmware init done\n");
 697
 698         return 0;
 699 }
 700
 701 int mt7921_mcu_fw_log_2_host(struct mt7921_dev *dev, u8 ctrl)
 702 {
 703         struct {
 704                 u8 ctrl_val;
 705                 u8 pad[3];
 706         } data = {
 707                 .ctrl_val = ctrl
 708         };
 709
 710         return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(FWLOG_2_HOST),
 711                                  &data, sizeof(data), false);
 712 }
 713
 714 int mt7921_run_firmware(struct mt7921_dev *dev)
 715 {
 716         int err;
 717
 718         err = mt7921_load_firmware(dev);
 719         if (err)
 720                 return err;
 721
 722         err = mt76_connac_mcu_get_nic_capability(&dev->mphy);
 723         if (err)
 724                 return err;
 725
 726         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
 727         return mt7921_mcu_fw_log_2_host(dev, 1);
 728 }
 729 EXPORT_SYMBOL_GPL(mt7921_run_firmware);
 730
 731 void mt7921_mcu_exit(struct mt7921_dev *dev)
 732 {
 733         skb_queue_purge(&dev->mt76.mcu.res_q);
 734 }
 735 EXPORT_SYMBOL_GPL(mt7921_mcu_exit);
 736
 737 int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif)
 738 {
 739         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
 740         struct edca {
 741                 __le16 cw_min;
 742                 __le16 cw_max;
 743                 __le16 txop;
 744                 __le16 aifs;
 745                 u8 guardtime;
 746                 u8 acm;
 747         } __packed;
 748         struct mt7921_mcu_tx {
 749                 struct edca edca[IEEE80211_NUM_ACS];
 750                 u8 bss_idx;
 751                 u8 qos;
 752                 u8 wmm_idx;
 753                 u8 pad;
 754         } __packed req = {
 755                 .bss_idx = mvif->mt76.idx,
 756                 .qos = vif->bss_conf.qos,
 757                 .wmm_idx = mvif->mt76.wmm_idx,
 758         };
 759         struct mu_edca {
 760                 u8 cw_min;
 761                 u8 cw_max;
 762                 u8 aifsn;
 763                 u8 acm;
 764                 u8 timer;
 765                 u8 padding[3];
 766         };
 767         struct mt7921_mcu_mu_tx {
 768                 u8 ver;
 769                 u8 pad0;
 770                 __le16 len;
 771                 u8 bss_idx;
 772                 u8 qos;
 773                 u8 wmm_idx;
 774                 u8 pad1;
 775                 struct mu_edca edca[IEEE80211_NUM_ACS];
 776                 u8 pad3[32];
 777         } __packed req_mu = {
 778                 .bss_idx = mvif->mt76.idx,
 779                 .qos = vif->bss_conf.qos,
 780                 .wmm_idx = mvif->mt76.wmm_idx,
 781         };
 782         static const int to_aci[] = { 1, 0, 2, 3 };
 783         int ac, ret;
 784
 785         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 786                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
 787                 struct edca *e = &req.edca[to_aci[ac]];
 788
 789                 e->aifs = cpu_to_le16(q->aifs);
 790                 e->txop = cpu_to_le16(q->txop);
 791
 792                 if (q->cw_min)
 793                         e->cw_min = cpu_to_le16(q->cw_min);
 794                 else
 795                         e->cw_min = cpu_to_le16(5);
 796
 797                 if (q->cw_max)
 798                         e->cw_max = cpu_to_le16(q->cw_max);
 799                 else
 800                         e->cw_max = cpu_to_le16(10);
 801         }
 802
 803         ret = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_EDCA_PARMS), &req,
 804                                 sizeof(req), false);
 805         if (ret)
 806                 return ret;
 807
 808         if (!vif->bss_conf.he_support)
 809                 return 0;
 810
 811         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 812                 struct ieee80211_he_mu_edca_param_ac_rec *q;
 813                 struct mu_edca *e;
 814
 815                 if (!mvif->queue_params[ac].mu_edca)
 816                         break;
 817
 818                 q = &mvif->queue_params[ac].mu_edca_param_rec;
 819                 e = &(req_mu.edca[to_aci[ac]]);
 820
 821                 e->cw_min = q->ecw_min_max & 0xf;
 822                 e->cw_max = (q->ecw_min_max & 0xf0) >> 4;
 823                 e->aifsn = q->aifsn;
 824                 e->timer = q->mu_edca_timer;
 825         }
 826
 827         return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_MU_EDCA_PARMS),
 828                                  &req_mu, sizeof(req_mu), false);
 829 }
 830
 831 int mt7921_mcu_set_chan_info(struct mt7921_phy *phy, int cmd)
 832 {
 833         struct mt7921_dev *dev = phy->dev;
 834         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 835         int freq1 = chandef->center_freq1;
 836         struct {
 837                 u8 control_ch;
 838                 u8 center_ch;
 839                 u8 bw;
 840                 u8 tx_streams_num;
 841                 u8 rx_streams;  /* mask or num */
 842                 u8 switch_reason;
 843                 u8 band_idx;
 844                 u8 center_ch2;  /* for 80+80 only */
 845                 __le16 cac_case;
 846                 u8 channel_band;
 847                 u8 rsv0;
 848                 __le32 outband_freq;
 849                 u8 txpower_drop;
 850                 u8 ap_bw;
 851                 u8 ap_center_ch;
 852                 u8 rsv1[57];
 853         } __packed req = {
 854                 .control_ch = chandef->chan->hw_value,
 855                 .center_ch = ieee80211_frequency_to_channel(freq1),
 856                 .bw = mt76_connac_chan_bw(chandef),
 857                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
 858                 .rx_streams = phy->mt76->antenna_mask,
 859                 .band_idx = phy != &dev->phy,
 860         };
 861
 862         if (chandef->chan->band == NL80211_BAND_6GHZ)
 863                 req.channel_band = 2;
 864         else
 865                 req.channel_band = chandef->chan->band;
 866
 867         if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
 868             dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
 869                 req.switch_reason = CH_SWITCH_NORMAL;
 870         else if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
 871                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
 872         else if (!cfg80211_reg_can_beacon(dev->mt76.hw->wiphy, chandef,
 873                                           NL80211_IFTYPE_AP))
 874                 req.switch_reason = CH_SWITCH_DFS;
 875         else
 876                 req.switch_reason = CH_SWITCH_NORMAL;
 877
 878         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
 879                 req.rx_streams = hweight8(req.rx_streams);
 880
 881         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 882                 int freq2 = chandef->center_freq2;
 883
 884                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
 885         }
 886
 887         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
 888 }
 889
 890 int mt7921_mcu_set_eeprom(struct mt7921_dev *dev)
 891 {
 892         struct req_hdr {
 893                 u8 buffer_mode;
 894                 u8 format;
 895                 __le16 len;
 896         } __packed req = {
 897                 .buffer_mode = EE_MODE_EFUSE,
 898                 .format = EE_FORMAT_WHOLE,
 899         };
 900
 901         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 902                                  &req, sizeof(req), true);
 903 }
 904 EXPORT_SYMBOL_GPL(mt7921_mcu_set_eeprom);
 905
 906 int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif)
 907 {
 908         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
 909         struct {
 910                 struct {
 911                         u8 bss_idx;
 912                         u8 pad[3];
 913                 } __packed hdr;
 914                 struct ps_tlv {
 915                         __le16 tag;
 916                         __le16 len;
 917                         u8 ps_state; /* 0: device awake
 918                                       * 1: static power save
 919                                       * 2: dynamic power saving
 920                                       * 3: enter TWT power saving
 921                                       * 4: leave TWT power saving
 922                                       */
 923                         u8 pad[3];
 924                 } __packed ps;
 925         } __packed ps_req = {
 926                 .hdr = {
 927                         .bss_idx = mvif->mt76.idx,
 928                 },
 929                 .ps = {
 930                         .tag = cpu_to_le16(UNI_BSS_INFO_PS),
 931                         .len = cpu_to_le16(sizeof(struct ps_tlv)),
 932                         .ps_state = vif->bss_conf.ps ? 2 : 0,
 933                 },
 934         };
 935
 936         if (vif->type != NL80211_IFTYPE_STATION)
 937                 return -EOPNOTSUPP;
 938
 939         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
 940                                  &ps_req, sizeof(ps_req), true);
 941 }
 942
 943 static int
 944 mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
 945                          bool enable)
 946 {
 947         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
 948         struct {
 949                 struct {
 950                         u8 bss_idx;
 951                         u8 pad[3];
 952                 } __packed hdr;
 953                 struct bcnft_tlv {
 954                         __le16 tag;
 955                         __le16 len;
 956                         __le16 bcn_interval;
 957                         u8 dtim_period;
 958                         u8 pad;
 959                 } __packed bcnft;
 960         } __packed bcnft_req = {
 961                 .hdr = {
 962                         .bss_idx = mvif->mt76.idx,
 963                 },
 964                 .bcnft = {
 965                         .tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
 966                         .len = cpu_to_le16(sizeof(struct bcnft_tlv)),
 967                         .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
 968                         .dtim_period = vif->bss_conf.dtim_period,
 969                 },
 970         };
 971
 972         if (vif->type != NL80211_IFTYPE_STATION)
 973                 return 0;
 974
 975         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
 976                                  &bcnft_req, sizeof(bcnft_req), true);
 977 }
 978
 979 static int
 980 mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
 981                       bool enable)
 982 {
 983         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
 984         struct {
 985                 u8 bss_idx;
 986                 u8 dtim_period;
 987                 __le16 aid;
 988                 __le16 bcn_interval;
 989                 __le16 atim_window;
 990                 u8 uapsd;
 991                 u8 bmc_delivered_ac;
 992                 u8 bmc_triggered_ac;
 993                 u8 pad;
 994         } req = {
 995                 .bss_idx = mvif->mt76.idx,
 996                 .aid = cpu_to_le16(vif->bss_conf.aid),
 997                 .dtim_period = vif->bss_conf.dtim_period,
 998                 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
 999         };
1000         struct {
1001                 u8 bss_idx;
1002                 u8 pad[3];
1003         } req_hdr = {
1004                 .bss_idx = mvif->mt76.idx,
1005         };
1006         int err;
1007
1008         if (vif->type != NL80211_IFTYPE_STATION)
1009                 return 0;
1010
1011         err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
1012                                 &req_hdr, sizeof(req_hdr), false);
1013         if (err < 0 || !enable)
1014                 return err;
1015
1016         return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
1017                                  &req, sizeof(req), false);
1018 }
1019
1020 int mt7921_mcu_sta_update(struct mt7921_dev *dev, struct ieee80211_sta *sta,
1021                           struct ieee80211_vif *vif, bool enable,
1022                           enum mt76_sta_info_state state)
1023 {
1024         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1025         int rssi = -ewma_rssi_read(&mvif->rssi);
1026         struct mt76_sta_cmd_info info = {
1027                 .sta = sta,
1028                 .vif = vif,
1029                 .enable = enable,
1030                 .cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1031                 .state = state,
1032                 .offload_fw = true,
1033                 .rcpi = to_rcpi(rssi),
1034         };
1035         struct mt7921_sta *msta;
1036
1037         msta = sta ? (struct mt7921_sta *)sta->drv_priv : NULL;
1038         info.wcid = msta ? &msta->wcid : &mvif->sta.wcid;
1039         info.newly = msta ? state != MT76_STA_INFO_STATE_ASSOC : true;
1040
1041         return mt76_connac_mcu_sta_cmd(&dev->mphy, &info);
1042 }
1043
1044 int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
1045 {
1046         struct mt76_phy *mphy = &dev->mt76.phy;
1047         struct mt76_connac_pm *pm = &dev->pm;
1048         int err = 0;
1049
1050         mutex_lock(&pm->mutex);
1051
1052         if (!test_bit(MT76_STATE_PM, &mphy->state))
1053                 goto out;
1054
1055         err = __mt7921_mcu_drv_pmctrl(dev);
1056 out:
1057         mutex_unlock(&pm->mutex);
1058
1059         if (err)
1060                 mt7921_reset(&dev->mt76);
1061
1062         return err;
1063 }
1064 EXPORT_SYMBOL_GPL(mt7921_mcu_drv_pmctrl);
1065
1066 int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev)
1067 {
1068         struct mt76_phy *mphy = &dev->mt76.phy;
1069         struct mt76_connac_pm *pm = &dev->pm;
1070         int err = 0;
1071
1072         mutex_lock(&pm->mutex);
1073
1074         if (mt76_connac_skip_fw_pmctrl(mphy, pm))
1075                 goto out;
1076
1077         err = __mt7921_mcu_fw_pmctrl(dev);
1078 out:
1079         mutex_unlock(&pm->mutex);
1080
1081         if (err)
1082                 mt7921_reset(&dev->mt76);
1083
1084         return err;
1085 }
1086 EXPORT_SYMBOL_GPL(mt7921_mcu_fw_pmctrl);
1087
1088 int mt7921_mcu_set_beacon_filter(struct mt7921_dev *dev,
1089                                  struct ieee80211_vif *vif,
1090                                  bool enable)
1091 {
1092         struct ieee80211_hw *hw = mt76_hw(dev);
1093         int err;
1094
1095         if (enable) {
1096                 err = mt7921_mcu_uni_bss_bcnft(dev, vif, true);
1097                 if (err)
1098                         return err;
1099
1100                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
1101                 ieee80211_hw_set(hw, CONNECTION_MONITOR);
1102                 mt76_set(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1103
1104                 return 0;
1105         }
1106
1107         err = mt7921_mcu_set_bss_pm(dev, vif, false);
1108         if (err)
1109                 return err;
1110
1111         vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
1112         __clear_bit(IEEE80211_HW_CONNECTION_MONITOR, hw->flags);
1113         mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1114
1115         return 0;
1116 }
1117
1118 int mt7921_get_txpwr_info(struct mt7921_dev *dev, struct mt7921_txpwr *txpwr)
1119 {
1120         struct mt7921_txpwr_event *event;
1121         struct mt7921_txpwr_req req = {
1122                 .dbdc_idx = 0,
1123         };
1124         struct sk_buff *skb;
1125         int ret;
1126
1127         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CE_CMD(GET_TXPWR),
1128                                         &req, sizeof(req), true, &skb);
1129         if (ret)
1130                 return ret;
1131
1132         event = (struct mt7921_txpwr_event *)skb->data;
1133         WARN_ON(skb->len != le16_to_cpu(event->len));
1134         memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1135
1136         dev_kfree_skb(skb);
1137
1138         return 0;
1139 }
1140
1141 int mt7921_mcu_set_sniffer(struct mt7921_dev *dev, struct ieee80211_vif *vif,
1142                            bool enable)
1143 {
1144         struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1145         struct {
1146                 struct {
1147                         u8 band_idx;
1148                         u8 pad[3];
1149                 } __packed hdr;
1150                 struct sniffer_enable_tlv {
1151                         __le16 tag;
1152                         __le16 len;
1153                         u8 enable;
1154                         u8 pad[3];
1155                 } __packed enable;
1156         } req = {
1157                 .hdr = {
1158                         .band_idx = mvif->band_idx,
1159                 },
1160                 .enable = {
1161                         .tag = cpu_to_le16(0),
1162                         .len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
1163                         .enable = enable,
1164                 },
1165         };
1166
1167         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
1168                                  true);
1169 }