1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
4 #include <linux/firmware.h>
7 #include "mt7921_trace.h"
11 struct mt7921_patch_hdr {
28 struct mt7921_patch_sec {
44 struct mt7921_fw_trailer {
56 struct mt7921_fw_region {
67 #define MT_STA_BFER BIT(0)
68 #define MT_STA_BFEE BIT(1)
70 #define FW_FEATURE_SET_ENCRYPT BIT(0)
71 #define FW_FEATURE_SET_KEY_IDX GENMASK(2, 1)
72 #define FW_FEATURE_ENCRY_MODE BIT(4)
73 #define FW_FEATURE_OVERRIDE_ADDR BIT(5)
75 #define DL_MODE_ENCRYPT BIT(0)
76 #define DL_MODE_KEY_IDX GENMASK(2, 1)
77 #define DL_MODE_RESET_SEC_IV BIT(3)
78 #define DL_MODE_WORKING_PDA_CR4 BIT(4)
79 #define DL_CONFIG_ENCRY_MODE_SEL BIT(6)
80 #define DL_MODE_NEED_RSP BIT(31)
82 #define FW_START_OVERRIDE BIT(0)
83 #define FW_START_WORKING_PDA_CR4 BIT(2)
85 #define PATCH_SEC_TYPE_MASK GENMASK(15, 0)
86 #define PATCH_SEC_TYPE_INFO 0x2
88 #define to_wcid_lo(id) FIELD_GET(GENMASK(7, 0), (u16)id)
89 #define to_wcid_hi(id) FIELD_GET(GENMASK(9, 8), (u16)id)
91 static enum mt7921_cipher_type
92 mt7921_mcu_get_cipher(int cipher)
95 case WLAN_CIPHER_SUITE_WEP40:
96 return MT_CIPHER_WEP40;
97 case WLAN_CIPHER_SUITE_WEP104:
98 return MT_CIPHER_WEP104;
99 case WLAN_CIPHER_SUITE_TKIP:
100 return MT_CIPHER_TKIP;
101 case WLAN_CIPHER_SUITE_AES_CMAC:
102 return MT_CIPHER_BIP_CMAC_128;
103 case WLAN_CIPHER_SUITE_CCMP:
104 return MT_CIPHER_AES_CCMP;
105 case WLAN_CIPHER_SUITE_CCMP_256:
106 return MT_CIPHER_CCMP_256;
107 case WLAN_CIPHER_SUITE_GCMP:
108 return MT_CIPHER_GCMP;
109 case WLAN_CIPHER_SUITE_GCMP_256:
110 return MT_CIPHER_GCMP_256;
111 case WLAN_CIPHER_SUITE_SMS4:
112 return MT_CIPHER_WAPI;
114 return MT_CIPHER_NONE;
118 static u8 mt7921_mcu_chan_bw(struct cfg80211_chan_def *chandef)
120 static const u8 width_to_bw[] = {
121 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
122 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
123 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
124 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
125 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
126 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
127 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
128 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
131 if (chandef->width >= ARRAY_SIZE(width_to_bw))
134 return width_to_bw[chandef->width];
138 mt7921_mcu_parse_eeprom(struct mt76_dev *dev, struct sk_buff *skb)
140 struct mt7921_mcu_eeprom_info *res;
146 skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
148 res = (struct mt7921_mcu_eeprom_info *)skb->data;
149 buf = dev->eeprom.data + le32_to_cpu(res->addr);
150 memcpy(buf, res->data, 16);
156 mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
157 struct sk_buff *skb, int seq)
159 struct mt7921_mcu_rxd *rxd;
163 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
170 rxd = (struct mt7921_mcu_rxd *)skb->data;
175 case MCU_CMD_PATCH_SEM_CONTROL:
176 skb_pull(skb, sizeof(*rxd) - 4);
179 case MCU_EXT_CMD_GET_TEMP:
180 skb_pull(skb, sizeof(*rxd) + 4);
181 ret = le32_to_cpu(*(__le32 *)skb->data);
183 case MCU_EXT_CMD_EFUSE_ACCESS:
184 ret = mt7921_mcu_parse_eeprom(mdev, skb);
186 case MCU_UNI_CMD_DEV_INFO_UPDATE:
187 case MCU_UNI_CMD_BSS_INFO_UPDATE:
188 case MCU_UNI_CMD_STA_REC_UPDATE:
189 case MCU_UNI_CMD_HIF_CTRL:
190 case MCU_UNI_CMD_OFFLOAD:
191 case MCU_UNI_CMD_SUSPEND: {
192 struct mt7921_mcu_uni_event *event;
194 skb_pull(skb, sizeof(*rxd));
195 event = (struct mt7921_mcu_uni_event *)skb->data;
196 ret = le32_to_cpu(event->status);
199 case MCU_CMD_REG_READ: {
200 struct mt7921_mcu_reg_event *event;
202 skb_pull(skb, sizeof(*rxd));
203 event = (struct mt7921_mcu_reg_event *)skb->data;
204 ret = (int)le32_to_cpu(event->val);
208 skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
216 mt7921_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
217 int cmd, int *wait_seq)
219 struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
220 int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
221 enum mt76_mcuq_id txq = MT_MCUQ_WM;
222 struct mt7921_uni_txd *uni_txd;
223 struct mt7921_mcu_txd *mcu_txd;
229 case MCU_UNI_CMD_HIF_CTRL:
230 case MCU_UNI_CMD_SUSPEND:
231 case MCU_UNI_CMD_OFFLOAD:
232 mdev->mcu.timeout = HZ / 3;
235 mdev->mcu.timeout = 3 * HZ;
239 seq = ++dev->mt76.mcu.msg_seq & 0xf;
241 seq = ++dev->mt76.mcu.msg_seq & 0xf;
243 if (cmd == MCU_CMD_FW_SCATTER) {
248 txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
249 txd = (__le32 *)skb_push(skb, txd_len);
251 val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
252 FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
253 FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
254 txd[0] = cpu_to_le32(val);
256 val = MT_TXD1_LONG_FORMAT |
257 FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
258 txd[1] = cpu_to_le32(val);
260 if (cmd & MCU_UNI_PREFIX) {
261 uni_txd = (struct mt7921_uni_txd *)txd;
262 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
263 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
264 uni_txd->cid = cpu_to_le16(mcu_cmd);
265 uni_txd->s2d_index = MCU_S2D_H2N;
266 uni_txd->pkt_type = MCU_PKT_ID;
272 mcu_txd = (struct mt7921_mcu_txd *)txd;
273 mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
274 mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
275 MT_TX_MCU_PORT_RX_Q0));
276 mcu_txd->pkt_type = MCU_PKT_ID;
279 switch (cmd & ~MCU_CMD_MASK) {
281 mcu_txd->set_query = MCU_Q_NA;
282 mcu_txd->cid = mcu_cmd;
285 if (cmd & MCU_QUERY_MASK)
286 mcu_txd->set_query = MCU_Q_QUERY;
288 mcu_txd->set_query = MCU_Q_SET;
289 mcu_txd->cid = mcu_cmd;
292 mcu_txd->cid = MCU_CMD_EXT_CID;
293 if (cmd & MCU_QUERY_PREFIX || cmd == MCU_EXT_CMD_EFUSE_ACCESS)
294 mcu_txd->set_query = MCU_Q_QUERY;
296 mcu_txd->set_query = MCU_Q_SET;
297 mcu_txd->ext_cid = mcu_cmd;
298 mcu_txd->ext_cid_ack = 1;
302 mcu_txd->s2d_index = MCU_S2D_H2N;
303 WARN_ON(cmd == MCU_EXT_CMD_EFUSE_ACCESS &&
304 mcu_txd->set_query != MCU_Q_QUERY);
310 return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[txq], skb, 0);
314 mt7921_mcu_tx_rate_parse(struct mt76_phy *mphy,
315 struct mt7921_mcu_peer_cap *peer,
316 struct rate_info *rate, u16 r)
318 struct ieee80211_supported_band *sband;
320 u8 txmode = FIELD_GET(MT_WTBL_RATE_TX_MODE, r);
324 rate->mcs = FIELD_GET(MT_WTBL_RATE_MCS, r);
325 rate->nss = FIELD_GET(MT_WTBL_RATE_NSS, r) + 1;
328 case IEEE80211_STA_RX_BW_160:
331 case IEEE80211_STA_RX_BW_80:
334 case IEEE80211_STA_RX_BW_40:
342 gi = txmode >= MT_PHY_TYPE_HE_SU ?
343 FIELD_GET(MT_WTBL_RATE_HE_GI, gi) :
344 FIELD_GET(MT_WTBL_RATE_GI, gi);
347 case MT_PHY_TYPE_CCK:
348 case MT_PHY_TYPE_OFDM:
349 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
350 sband = &mphy->sband_5g.sband;
352 sband = &mphy->sband_2g.sband;
354 rate->legacy = sband->bitrates[rate->mcs].bitrate;
357 case MT_PHY_TYPE_HT_GF:
358 flags |= RATE_INFO_FLAGS_MCS;
361 flags |= RATE_INFO_FLAGS_SHORT_GI;
363 case MT_PHY_TYPE_VHT:
364 flags |= RATE_INFO_FLAGS_VHT_MCS;
367 flags |= RATE_INFO_FLAGS_SHORT_GI;
369 case MT_PHY_TYPE_HE_SU:
370 case MT_PHY_TYPE_HE_EXT_SU:
371 case MT_PHY_TYPE_HE_TB:
372 case MT_PHY_TYPE_HE_MU:
374 rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
376 flags |= RATE_INFO_FLAGS_HE_MCS;
383 bw = mt7921_mcu_chan_bw(&mphy->chandef) - FIELD_GET(MT_RA_RATE_BW, r);
386 case IEEE80211_STA_RX_BW_160:
387 rate->bw = RATE_INFO_BW_160;
389 case IEEE80211_STA_RX_BW_80:
390 rate->bw = RATE_INFO_BW_80;
392 case IEEE80211_STA_RX_BW_40:
393 rate->bw = RATE_INFO_BW_40;
396 rate->bw = RATE_INFO_BW_20;
402 mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb,
405 struct mt7921_mcu_wlan_info_event *wtbl_info;
406 struct mt76_phy *mphy = &dev->mphy;
407 struct mt7921_sta_stats *stats;
408 struct rate_info rate = {};
409 struct mt7921_sta *msta;
410 struct mt76_wcid *wcid;
413 if (wlan_idx >= MT76_N_WCIDS)
416 wtbl_info = (struct mt7921_mcu_wlan_info_event *)skb->data;
417 idx = wtbl_info->rate_info.rate_idx;
418 if (idx >= ARRAY_SIZE(wtbl_info->rate_info.rate))
423 wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
427 msta = container_of(wcid, struct mt7921_sta, wcid);
428 stats = &msta->stats;
431 mt7921_mcu_tx_rate_parse(mphy, &wtbl_info->peer_cap, &rate,
432 le16_to_cpu(wtbl_info->rate_info.rate[idx]));
433 stats->tx_rate = rate;
439 mt7921_mcu_scan_event(struct mt7921_dev *dev, struct sk_buff *skb)
441 struct mt76_phy *mphy = &dev->mt76.phy;
442 struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
444 spin_lock_bh(&dev->mt76.lock);
445 __skb_queue_tail(&phy->scan_event_list, skb);
446 spin_unlock_bh(&dev->mt76.lock);
448 ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
449 MT7921_HW_SCAN_TIMEOUT);
453 mt7921_mcu_beacon_loss_event(struct mt7921_dev *dev, struct sk_buff *skb)
455 struct mt76_connac_beacon_loss_event *event;
456 struct mt76_phy *mphy;
457 u8 band_idx = 0; /* DBDC support */
459 skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
460 event = (struct mt76_connac_beacon_loss_event *)skb->data;
461 if (band_idx && dev->mt76.phy2)
462 mphy = dev->mt76.phy2;
464 mphy = &dev->mt76.phy;
466 ieee80211_iterate_active_interfaces_atomic(mphy->hw,
467 IEEE80211_IFACE_ITER_RESUME_ALL,
468 mt76_connac_mcu_beacon_loss_iter, event);
472 mt7921_mcu_bss_event(struct mt7921_dev *dev, struct sk_buff *skb)
474 struct mt76_phy *mphy = &dev->mt76.phy;
475 struct mt76_connac_mcu_bss_event *event;
477 skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
478 event = (struct mt76_connac_mcu_bss_event *)skb->data;
479 if (event->is_absent)
480 ieee80211_stop_queues(mphy->hw);
482 ieee80211_wake_queues(mphy->hw);
486 mt7921_mcu_debug_msg_event(struct mt7921_dev *dev, struct sk_buff *skb)
488 struct mt7921_debug_msg {
497 skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
498 msg = (struct mt7921_debug_msg *)skb->data;
500 if (msg->type == 3) { /* fw log */
501 u16 len = min_t(u16, le16_to_cpu(msg->len), 512);
504 for (i = 0 ; i < len; i++) {
505 if (!msg->content[i])
506 msg->content[i] = ' ';
508 wiphy_info(mt76_hw(dev)->wiphy, "%.*s", len, msg->content);
513 mt7921_mcu_low_power_event(struct mt7921_dev *dev, struct sk_buff *skb)
515 struct mt7921_mcu_lp_event {
520 skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
521 event = (struct mt7921_mcu_lp_event *)skb->data;
523 trace_lp_event(dev, event->state);
527 mt7921_mcu_rx_unsolicited_event(struct mt7921_dev *dev, struct sk_buff *skb)
529 struct mt7921_mcu_rxd *rxd = (struct mt7921_mcu_rxd *)skb->data;
532 case MCU_EVENT_BSS_BEACON_LOSS:
533 mt7921_mcu_beacon_loss_event(dev, skb);
535 case MCU_EVENT_SCHED_SCAN_DONE:
536 case MCU_EVENT_SCAN_DONE:
537 mt7921_mcu_scan_event(dev, skb);
539 case MCU_EVENT_BSS_ABSENCE:
540 mt7921_mcu_bss_event(dev, skb);
542 case MCU_EVENT_DBG_MSG:
543 mt7921_mcu_debug_msg_event(dev, skb);
545 case MCU_EVENT_COREDUMP:
546 mt76_connac_mcu_coredump_event(&dev->mt76, skb,
549 case MCU_EVENT_LP_INFO:
550 mt7921_mcu_low_power_event(dev, skb);
558 void mt7921_mcu_rx_event(struct mt7921_dev *dev, struct sk_buff *skb)
560 struct mt7921_mcu_rxd *rxd = (struct mt7921_mcu_rxd *)skb->data;
562 if (rxd->eid == 0x6) {
563 mt76_mcu_rx_event(&dev->mt76, skb);
567 if (rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
568 rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
569 rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
570 rxd->eid == MCU_EVENT_BSS_ABSENCE ||
571 rxd->eid == MCU_EVENT_SCAN_DONE ||
572 rxd->eid == MCU_EVENT_DBG_MSG ||
573 rxd->eid == MCU_EVENT_COREDUMP ||
574 rxd->eid == MCU_EVENT_LP_INFO ||
576 mt7921_mcu_rx_unsolicited_event(dev, skb);
578 mt76_mcu_rx_event(&dev->mt76, skb);
581 /** starec & wtbl **/
583 mt7921_mcu_sta_key_tlv(struct mt7921_sta *msta, struct sk_buff *skb,
584 struct ieee80211_key_conf *key, enum set_key_cmd cmd)
586 struct mt7921_sta_key_conf *bip = &msta->bip;
587 struct sta_rec_sec *sec;
589 u32 len = sizeof(*sec);
591 tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
593 sec = (struct sta_rec_sec *)tlv;
596 if (cmd == SET_KEY) {
597 struct sec_key *sec_key;
600 cipher = mt7921_mcu_get_cipher(key->cipher);
601 if (cipher == MT_CIPHER_NONE)
604 sec_key = &sec->key[0];
605 sec_key->cipher_len = sizeof(*sec_key);
607 if (cipher == MT_CIPHER_BIP_CMAC_128) {
608 sec_key->cipher_id = MT_CIPHER_AES_CCMP;
609 sec_key->key_id = bip->keyidx;
610 sec_key->key_len = 16;
611 memcpy(sec_key->key, bip->key, 16);
613 sec_key = &sec->key[1];
614 sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
615 sec_key->cipher_len = sizeof(*sec_key);
616 sec_key->key_len = 16;
617 memcpy(sec_key->key, key->key, 16);
621 sec_key->cipher_id = cipher;
622 sec_key->key_id = key->keyidx;
623 sec_key->key_len = key->keylen;
624 memcpy(sec_key->key, key->key, key->keylen);
626 if (cipher == MT_CIPHER_TKIP) {
627 /* Rx/Tx MIC keys are swapped */
628 memcpy(sec_key->key + 16, key->key + 24, 8);
629 memcpy(sec_key->key + 24, key->key + 16, 8);
632 /* store key_conf for BIP batch update */
633 if (cipher == MT_CIPHER_AES_CCMP) {
634 memcpy(bip->key, key->key, key->keylen);
635 bip->keyidx = key->keyidx;
638 len -= sizeof(*sec_key);
642 len -= sizeof(sec->key);
645 sec->len = cpu_to_le16(len);
650 int mt7921_mcu_add_key(struct mt7921_dev *dev, struct ieee80211_vif *vif,
651 struct mt7921_sta *msta, struct ieee80211_key_conf *key,
652 enum set_key_cmd cmd)
654 struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
658 skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
663 ret = mt7921_mcu_sta_key_tlv(msta, skb, key, cmd);
667 return mt76_mcu_skb_send_msg(&dev->mt76, skb,
668 MCU_UNI_CMD_STA_REC_UPDATE, true);
671 int mt7921_mcu_uni_tx_ba(struct mt7921_dev *dev,
672 struct ieee80211_ampdu_params *params,
675 struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
677 if (enable && !params->amsdu)
678 msta->wcid.amsdu = false;
680 return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
684 int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
685 struct ieee80211_ampdu_params *params,
688 struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
690 return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
694 static int mt7921_mcu_restart(struct mt76_dev *dev)
703 return mt76_mcu_send_msg(dev, MCU_CMD_NIC_POWER_CTRL, &req,
707 static int mt7921_driver_own(struct mt7921_dev *dev)
709 u32 reg = mt7921_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
711 mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
712 if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
714 dev_err(dev->mt76.dev, "Timeout for driver own\n");
721 static int mt7921_load_patch(struct mt7921_dev *dev)
723 const struct mt7921_patch_hdr *hdr;
724 const struct firmware *fw = NULL;
727 sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
731 case PATCH_NOT_DL_SEM_SUCCESS:
734 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
738 ret = request_firmware(&fw, MT7921_ROM_PATCH, dev->mt76.dev);
742 if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
743 dev_err(dev->mt76.dev, "Invalid firmware\n");
748 hdr = (const struct mt7921_patch_hdr *)(fw->data);
750 dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
751 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
753 for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
754 struct mt7921_patch_sec *sec;
758 sec = (struct mt7921_patch_sec *)(fw->data + sizeof(*hdr) +
760 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
761 PATCH_SEC_TYPE_INFO) {
766 addr = be32_to_cpu(sec->info.addr);
767 len = be32_to_cpu(sec->info.len);
768 dl = fw->data + be32_to_cpu(sec->offs);
770 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
773 dev_err(dev->mt76.dev, "Download request failed\n");
777 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
780 dev_err(dev->mt76.dev, "Failed to send patch\n");
785 ret = mt76_connac_mcu_start_patch(&dev->mt76);
787 dev_err(dev->mt76.dev, "Failed to start patch\n");
790 sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
792 case PATCH_REL_SEM_SUCCESS:
796 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
799 release_firmware(fw);
804 static u32 mt7921_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
808 ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
809 (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
810 ret |= (feature_set & FW_FEATURE_ENCRY_MODE) ?
811 DL_CONFIG_ENCRY_MODE_SEL : 0;
812 ret |= FIELD_PREP(DL_MODE_KEY_IDX,
813 FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
814 ret |= DL_MODE_NEED_RSP;
815 ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
821 mt7921_mcu_send_ram_firmware(struct mt7921_dev *dev,
822 const struct mt7921_fw_trailer *hdr,
823 const u8 *data, bool is_wa)
826 u32 override = 0, option = 0;
828 for (i = 0; i < hdr->n_region; i++) {
829 const struct mt7921_fw_region *region;
833 region = (const struct mt7921_fw_region *)((const u8 *)hdr -
834 (hdr->n_region - i) * sizeof(*region));
835 mode = mt7921_mcu_gen_dl_mode(region->feature_set, is_wa);
836 len = le32_to_cpu(region->len);
837 addr = le32_to_cpu(region->addr);
839 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
842 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
845 dev_err(dev->mt76.dev, "Download request failed\n");
849 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
852 dev_err(dev->mt76.dev, "Failed to send firmware.\n");
860 option |= FW_START_OVERRIDE;
863 option |= FW_START_WORKING_PDA_CR4;
865 return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
868 static int mt7921_load_ram(struct mt7921_dev *dev)
870 const struct mt7921_fw_trailer *hdr;
871 const struct firmware *fw;
874 ret = request_firmware(&fw, MT7921_FIRMWARE_WM, dev->mt76.dev);
878 if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
879 dev_err(dev->mt76.dev, "Invalid firmware\n");
884 hdr = (const struct mt7921_fw_trailer *)(fw->data + fw->size -
887 dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
888 hdr->fw_ver, hdr->build_date);
890 ret = mt7921_mcu_send_ram_firmware(dev, hdr, fw->data, false);
892 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
896 snprintf(dev->mt76.hw->wiphy->fw_version,
897 sizeof(dev->mt76.hw->wiphy->fw_version),
898 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
901 release_firmware(fw);
906 static int mt7921_load_firmware(struct mt7921_dev *dev)
910 ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
912 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
916 ret = mt7921_load_patch(dev);
920 ret = mt7921_load_ram(dev);
924 if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
925 MT_TOP_MISC2_FW_N9_RDY, 1500)) {
926 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
931 mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
934 dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
935 #endif /* CONFIG_PM */
937 clear_bit(MT76_STATE_PM, &dev->mphy.state);
939 dev_err(dev->mt76.dev, "Firmware init done\n");
944 int mt7921_mcu_fw_log_2_host(struct mt7921_dev *dev, u8 ctrl)
953 return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FWLOG_2_HOST, &data,
954 sizeof(data), false);
957 int mt7921_run_firmware(struct mt7921_dev *dev)
961 err = mt7921_driver_own(dev);
965 err = mt7921_load_firmware(dev);
969 set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
970 mt7921_mcu_fw_log_2_host(dev, 1);
975 int mt7921_mcu_init(struct mt7921_dev *dev)
977 static const struct mt76_mcu_ops mt7921_mcu_ops = {
978 .headroom = sizeof(struct mt7921_mcu_txd),
979 .mcu_skb_send_msg = mt7921_mcu_send_message,
980 .mcu_parse_response = mt7921_mcu_parse_response,
981 .mcu_restart = mt7921_mcu_restart,
984 dev->mt76.mcu_ops = &mt7921_mcu_ops;
986 return mt7921_run_firmware(dev);
989 void mt7921_mcu_exit(struct mt7921_dev *dev)
991 mt7921_wfsys_reset(dev);
992 skb_queue_purge(&dev->mt76.mcu.res_q);
995 int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif)
997 #define WMM_AIFS_SET BIT(0)
998 #define WMM_CW_MIN_SET BIT(1)
999 #define WMM_CW_MAX_SET BIT(2)
1000 #define WMM_TXOP_SET BIT(3)
1001 #define WMM_PARAM_SET GENMASK(3, 0)
1002 #define TX_CMD_MODE 1
1011 struct mt7921_mcu_tx {
1017 struct edca edca[IEEE80211_NUM_ACS];
1020 .mode = TX_CMD_MODE,
1021 .total = IEEE80211_NUM_ACS,
1023 struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1026 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1027 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
1028 struct edca *e = &req.edca[ac];
1030 e->set = WMM_PARAM_SET;
1031 e->queue = ac + mvif->mt76.wmm_idx * MT7921_MAX_WMM_SETS;
1033 e->txop = cpu_to_le16(q->txop);
1036 e->cw_min = fls(q->cw_min);
1041 e->cw_max = cpu_to_le16(fls(q->cw_max));
1043 e->cw_max = cpu_to_le16(10);
1045 return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
1049 int mt7921_mcu_set_chan_info(struct mt7921_phy *phy, int cmd)
1051 struct mt7921_dev *dev = phy->dev;
1052 struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1053 int freq1 = chandef->center_freq1;
1059 u8 rx_streams; /* mask or num */
1062 u8 center_ch2; /* for 80+80 only */
1066 __le32 outband_freq;
1072 .control_ch = chandef->chan->hw_value,
1073 .center_ch = ieee80211_frequency_to_channel(freq1),
1074 .bw = mt7921_mcu_chan_bw(chandef),
1075 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
1076 .rx_streams = phy->mt76->antenna_mask,
1077 .band_idx = phy != &dev->phy,
1078 .channel_band = chandef->chan->band,
1081 if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
1082 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
1083 else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
1084 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
1085 req.switch_reason = CH_SWITCH_DFS;
1087 req.switch_reason = CH_SWITCH_NORMAL;
1089 if (cmd == MCU_EXT_CMD_CHANNEL_SWITCH)
1090 req.rx_streams = hweight8(req.rx_streams);
1092 if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
1093 int freq2 = chandef->center_freq2;
1095 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
1098 return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
1101 int mt7921_mcu_set_eeprom(struct mt7921_dev *dev)
1108 .buffer_mode = EE_MODE_EFUSE,
1109 .format = EE_FORMAT_WHOLE,
1112 return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
1113 &req, sizeof(req), true);
1116 int mt7921_mcu_get_eeprom(struct mt7921_dev *dev, u32 offset)
1118 struct mt7921_mcu_eeprom_info req = {
1119 .addr = cpu_to_le32(round_down(offset, 16)),
1121 struct mt7921_mcu_eeprom_info *res;
1122 struct sk_buff *skb;
1126 ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_ACCESS, &req,
1127 sizeof(req), true, &skb);
1131 res = (struct mt7921_mcu_eeprom_info *)skb->data;
1132 buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
1133 memcpy(buf, res->data, 16);
1139 u32 mt7921_get_wtbl_info(struct mt7921_dev *dev, u32 wlan_idx)
1141 struct mt7921_mcu_wlan_info wtbl_info = {
1142 .wlan_idx = cpu_to_le32(wlan_idx),
1144 struct sk_buff *skb;
1147 ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CMD_GET_WTBL,
1148 &wtbl_info, sizeof(wtbl_info), true,
1153 mt7921_mcu_tx_rate_report(dev, skb, wlan_idx);
1159 int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif)
1161 struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1170 u8 ps_state; /* 0: device awake
1171 * 1: static power save
1172 * 2: dynamic power saving
1173 * 3: enter TWT power saving
1174 * 4: leave TWT power saving
1178 } __packed ps_req = {
1180 .bss_idx = mvif->mt76.idx,
1183 .tag = cpu_to_le16(UNI_BSS_INFO_PS),
1184 .len = cpu_to_le16(sizeof(struct ps_tlv)),
1185 .ps_state = vif->bss_conf.ps ? 2 : 0,
1189 if (vif->type != NL80211_IFTYPE_STATION)
1192 return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1193 &ps_req, sizeof(ps_req), true);
1196 int mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
1199 struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1208 __le16 bcn_interval;
1212 } __packed bcnft_req = {
1214 .bss_idx = mvif->mt76.idx,
1217 .tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1218 .len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1219 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1220 .dtim_period = vif->bss_conf.dtim_period,
1224 if (vif->type != NL80211_IFTYPE_STATION)
1227 return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1228 &bcnft_req, sizeof(bcnft_req), true);
1231 int mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
1234 struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1239 __le16 bcn_interval;
1242 u8 bmc_delivered_ac;
1243 u8 bmc_triggered_ac;
1246 .bss_idx = mvif->mt76.idx,
1247 .aid = cpu_to_le16(vif->bss_conf.aid),
1248 .dtim_period = vif->bss_conf.dtim_period,
1249 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1255 .bss_idx = mvif->mt76.idx,
1259 if (vif->type != NL80211_IFTYPE_STATION)
1262 err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
1263 sizeof(req_hdr), false);
1264 if (err < 0 || !enable)
1267 return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
1268 sizeof(req), false);
1271 int mt7921_mcu_sta_add(struct mt7921_dev *dev, struct ieee80211_sta *sta,
1272 struct ieee80211_vif *vif, bool enable)
1274 struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1275 int rssi = -ewma_rssi_read(&mvif->rssi);
1276 struct mt76_sta_cmd_info info = {
1280 .cmd = MCU_UNI_CMD_STA_REC_UPDATE,
1281 .rcpi = to_rcpi(rssi),
1283 struct mt7921_sta *msta;
1285 msta = sta ? (struct mt7921_sta *)sta->drv_priv : NULL;
1286 info.wcid = msta ? &msta->wcid : &mvif->sta.wcid;
1288 return mt76_connac_mcu_add_sta_cmd(&dev->mphy, &info);
1291 int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
1293 struct mt76_phy *mphy = &dev->mt76.phy;
1294 struct mt76_connac_pm *pm = &dev->pm;
1297 mutex_lock(&pm->mutex);
1299 if (!test_bit(MT76_STATE_PM, &mphy->state))
1302 for (i = 0; i < MT7921_DRV_OWN_RETRY_COUNT; i++) {
1303 mt76_wr(dev, MT_CONN_ON_LPCTL, PCIE_LPCR_HOST_CLR_OWN);
1304 if (mt76_poll_msec(dev, MT_CONN_ON_LPCTL,
1305 PCIE_LPCR_HOST_OWN_SYNC, 0, 50))
1309 if (i == MT7921_DRV_OWN_RETRY_COUNT) {
1310 dev_err(dev->mt76.dev, "driver own failed\n");
1315 mt7921_wpdma_reinit_cond(dev);
1316 clear_bit(MT76_STATE_PM, &mphy->state);
1318 pm->stats.last_wake_event = jiffies;
1319 pm->stats.doze_time += pm->stats.last_wake_event -
1320 pm->stats.last_doze_event;
1322 mutex_unlock(&pm->mutex);
1325 mt7921_reset(&dev->mt76);
1330 int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev)
1332 struct mt76_phy *mphy = &dev->mt76.phy;
1333 struct mt76_connac_pm *pm = &dev->pm;
1336 mutex_lock(&pm->mutex);
1338 if (mt76_connac_skip_fw_pmctrl(mphy, pm))
1341 for (i = 0; i < MT7921_DRV_OWN_RETRY_COUNT; i++) {
1342 mt76_wr(dev, MT_CONN_ON_LPCTL, PCIE_LPCR_HOST_SET_OWN);
1343 if (mt76_poll_msec(dev, MT_CONN_ON_LPCTL,
1344 PCIE_LPCR_HOST_OWN_SYNC, 4, 50))
1348 if (i == MT7921_DRV_OWN_RETRY_COUNT) {
1349 dev_err(dev->mt76.dev, "firmware own failed\n");
1350 clear_bit(MT76_STATE_PM, &mphy->state);
1354 pm->stats.last_doze_event = jiffies;
1355 pm->stats.awake_time += pm->stats.last_doze_event -
1356 pm->stats.last_wake_event;
1358 mutex_unlock(&pm->mutex);
1361 mt7921_reset(&dev->mt76);
1367 mt7921_pm_interface_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
1369 struct mt7921_phy *phy = priv;
1370 struct mt7921_dev *dev = phy->dev;
1374 ret = mt7921_mcu_uni_bss_bcnft(dev, vif, true);
1376 ret = mt7921_mcu_set_bss_pm(dev, vif, false);
1381 if (dev->pm.enable) {
1382 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
1383 mt76_set(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1385 vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
1386 mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1390 int mt7921_get_txpwr_info(struct mt7921_dev *dev, struct mt7921_txpwr *txpwr)
1392 struct mt7921_txpwr_event *event;
1393 struct mt7921_txpwr_req req = {
1396 struct sk_buff *skb;
1399 ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CMD_GET_TXPWR,
1400 &req, sizeof(req), true, &skb);
1404 event = (struct mt7921_txpwr_event *)skb->data;
1405 WARN_ON(skb->len != le16_to_cpu(event->len));
1406 memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));