1 // SPDX-License-Identifier: ISC 2 3 #include <linux/firmware.h> 4 #include "mt7603.h" 5 #include "mcu.h" 6 #include "eeprom.h" 7 8 #define MCU_SKB_RESERVE 8 9 10 struct mt7603_fw_trailer { 11 char fw_ver[10]; 12 char build_date[15]; 13 __le32 dl_len; 14 } __packed; 15 16 static int 17 mt7603_mcu_parse_response(struct mt76_dev *mdev, int cmd, 18 struct sk_buff *skb, int seq) 19 { 20 struct mt7603_mcu_rxd *rxd = (struct mt7603_mcu_rxd *)skb->data; 21 22 if (seq != rxd->seq) 23 return -EAGAIN; 24 25 return 0; 26 } 27 28 static int 29 __mt7603_mcu_msg_send(struct mt7603_dev *dev, struct sk_buff *skb, 30 int cmd, int *wait_seq) 31 { 32 int hdrlen = dev->mcu_running ? sizeof(struct mt7603_mcu_txd) : 12; 33 struct mt76_dev *mdev = &dev->mt76; 34 struct mt7603_mcu_txd *txd; 35 u8 seq; 36 37 seq = ++mdev->mcu.msg_seq & 0xf; 38 if (!seq) 39 seq = ++mdev->mcu.msg_seq & 0xf; 40 41 txd = (struct mt7603_mcu_txd *)skb_push(skb, hdrlen); 42 43 txd->len = cpu_to_le16(skb->len); 44 if (cmd == -MCU_CMD_FW_SCATTER) 45 txd->pq_id = cpu_to_le16(MCU_PORT_QUEUE_FW); 46 else 47 txd->pq_id = cpu_to_le16(MCU_PORT_QUEUE); 48 txd->pkt_type = MCU_PKT_ID; 49 txd->seq = seq; 50 51 if (cmd < 0) { 52 txd->cid = -cmd; 53 txd->set_query = MCU_Q_NA; 54 } else { 55 txd->cid = MCU_CMD_EXT_CID; 56 txd->ext_cid = cmd; 57 txd->set_query = MCU_Q_SET; 58 txd->ext_cid_ack = 1; 59 } 60 61 if (wait_seq) 62 *wait_seq = seq; 63 64 return mt76_tx_queue_skb_raw(dev, MT_TXQ_MCU, skb, 0); 65 } 66 67 static int 68 mt7603_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data, 69 int len, bool wait_resp) 70 { 71 struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76); 72 unsigned long expires = jiffies + 3 * HZ; 73 struct sk_buff *skb; 74 int ret, seq; 75 76 skb = mt76_mcu_msg_alloc(mdev, data, len); 77 if (!skb) 78 return -ENOMEM; 79 80 mutex_lock(&mdev->mcu.mutex); 81 82 ret = __mt7603_mcu_msg_send(dev, skb, cmd, &seq); 83 if (ret) 84 goto out; 85 86 while (wait_resp) { 87 skb = mt76_mcu_get_response(&dev->mt76, expires); 88 if (!skb) { 89 dev_err(mdev->dev, 90 "MCU message %d (seq %d) timed out\n", 91 cmd, seq); 92 dev->mcu_hang = MT7603_WATCHDOG_TIMEOUT; 93 ret = -ETIMEDOUT; 94 break; 95 } 96 97 ret = mt7603_mcu_parse_response(mdev, cmd, skb, seq); 98 dev_kfree_skb(skb); 99 if (ret != -EAGAIN) 100 break; 101 } 102 103 out: 104 mutex_unlock(&mdev->mcu.mutex); 105 106 return ret; 107 } 108 109 static int 110 mt7603_mcu_init_download(struct mt7603_dev *dev, u32 addr, u32 len) 111 { 112 struct { 113 __le32 addr; 114 __le32 len; 115 __le32 mode; 116 } req = { 117 .addr = cpu_to_le32(addr), 118 .len = cpu_to_le32(len), 119 .mode = cpu_to_le32(BIT(31)), 120 }; 121 122 return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_TARGET_ADDRESS_LEN_REQ, 123 &req, sizeof(req), true); 124 } 125 126 static int 127 mt7603_mcu_send_firmware(struct mt7603_dev *dev, const void *data, int len) 128 { 129 int cur_len, ret = 0; 130 131 while (len > 0) { 132 cur_len = min_t(int, 4096 - sizeof(struct mt7603_mcu_txd), 133 len); 134 135 ret = mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_SCATTER, data, 136 cur_len, false); 137 if (ret) 138 break; 139 140 data += cur_len; 141 len -= cur_len; 142 } 143 144 return ret; 145 } 146 147 static int 148 mt7603_mcu_start_firmware(struct mt7603_dev *dev, u32 addr) 149 { 150 struct { 151 __le32 override; 152 __le32 addr; 153 } req = { 154 .override = cpu_to_le32(addr ? 1 : 0), 155 .addr = cpu_to_le32(addr), 156 }; 157 158 return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ, &req, 159 sizeof(req), true); 160 } 161 162 static int 163 mt7603_mcu_restart(struct mt76_dev *dev) 164 { 165 return mt76_mcu_send_msg(dev, -MCU_CMD_RESTART_DL_REQ, NULL, 0, true); 166 } 167 168 static int mt7603_load_firmware(struct mt7603_dev *dev) 169 { 170 const struct firmware *fw; 171 const struct mt7603_fw_trailer *hdr; 172 const char *firmware; 173 int dl_len; 174 u32 addr, val; 175 int ret; 176 177 if (is_mt7628(dev)) { 178 if (mt76xx_rev(dev) == MT7628_REV_E1) 179 firmware = MT7628_FIRMWARE_E1; 180 else 181 firmware = MT7628_FIRMWARE_E2; 182 } else { 183 if (mt76xx_rev(dev) < MT7603_REV_E2) 184 firmware = MT7603_FIRMWARE_E1; 185 else 186 firmware = MT7603_FIRMWARE_E2; 187 } 188 189 ret = request_firmware(&fw, firmware, dev->mt76.dev); 190 if (ret) 191 return ret; 192 193 if (!fw || !fw->data || fw->size < sizeof(*hdr)) { 194 dev_err(dev->mt76.dev, "Invalid firmware\n"); 195 ret = -EINVAL; 196 goto out; 197 } 198 199 hdr = (const struct mt7603_fw_trailer *)(fw->data + fw->size - 200 sizeof(*hdr)); 201 202 dev_info(dev->mt76.dev, "Firmware Version: %.10s\n", hdr->fw_ver); 203 dev_info(dev->mt76.dev, "Build Time: %.15s\n", hdr->build_date); 204 205 addr = mt7603_reg_map(dev, 0x50012498); 206 mt76_wr(dev, addr, 0x5); 207 mt76_wr(dev, addr, 0x5); 208 udelay(1); 209 210 /* switch to bypass mode */ 211 mt76_rmw(dev, MT_SCH_4, MT_SCH_4_FORCE_QID, 212 MT_SCH_4_BYPASS | FIELD_PREP(MT_SCH_4_FORCE_QID, 5)); 213 214 val = mt76_rr(dev, MT_TOP_MISC2); 215 if (val & BIT(1)) { 216 dev_info(dev->mt76.dev, "Firmware already running...\n"); 217 goto running; 218 } 219 220 if (!mt76_poll_msec(dev, MT_TOP_MISC2, BIT(0) | BIT(1), BIT(0), 500)) { 221 dev_err(dev->mt76.dev, "Timeout waiting for ROM code to become ready\n"); 222 ret = -EIO; 223 goto out; 224 } 225 226 dl_len = le32_to_cpu(hdr->dl_len) + 4; 227 ret = mt7603_mcu_init_download(dev, MCU_FIRMWARE_ADDRESS, dl_len); 228 if (ret) { 229 dev_err(dev->mt76.dev, "Download request failed\n"); 230 goto out; 231 } 232 233 ret = mt7603_mcu_send_firmware(dev, fw->data, dl_len); 234 if (ret) { 235 dev_err(dev->mt76.dev, "Failed to send firmware to device\n"); 236 goto out; 237 } 238 239 ret = mt7603_mcu_start_firmware(dev, MCU_FIRMWARE_ADDRESS); 240 if (ret) { 241 dev_err(dev->mt76.dev, "Failed to start firmware\n"); 242 goto out; 243 } 244 245 if (!mt76_poll_msec(dev, MT_TOP_MISC2, BIT(1), BIT(1), 500)) { 246 dev_err(dev->mt76.dev, "Timeout waiting for firmware to initialize\n"); 247 ret = -EIO; 248 goto out; 249 } 250 251 running: 252 mt76_clear(dev, MT_SCH_4, MT_SCH_4_FORCE_QID | MT_SCH_4_BYPASS); 253 254 mt76_set(dev, MT_SCH_4, BIT(8)); 255 mt76_clear(dev, MT_SCH_4, BIT(8)); 256 257 dev->mcu_running = true; 258 snprintf(dev->mt76.hw->wiphy->fw_version, 259 sizeof(dev->mt76.hw->wiphy->fw_version), 260 "%.10s-%.15s", hdr->fw_ver, hdr->build_date); 261 dev_info(dev->mt76.dev, "firmware init done\n"); 262 263 out: 264 release_firmware(fw); 265 266 return ret; 267 } 268 269 int mt7603_mcu_init(struct mt7603_dev *dev) 270 { 271 static const struct mt76_mcu_ops mt7603_mcu_ops = { 272 .headroom = sizeof(struct mt7603_mcu_txd), 273 .mcu_send_msg = mt7603_mcu_msg_send, 274 .mcu_parse_response = mt7603_mcu_parse_response, 275 .mcu_restart = mt7603_mcu_restart, 276 }; 277 278 dev->mt76.mcu_ops = &mt7603_mcu_ops; 279 return mt7603_load_firmware(dev); 280 } 281 282 void mt7603_mcu_exit(struct mt7603_dev *dev) 283 { 284 __mt76_mcu_restart(&dev->mt76); 285 skb_queue_purge(&dev->mt76.mcu.res_q); 286 } 287 288 int mt7603_mcu_set_eeprom(struct mt7603_dev *dev) 289 { 290 static const u16 req_fields[] = { 291 #define WORD(_start) \ 292 _start, \ 293 _start + 1 294 #define GROUP_2G(_start) \ 295 WORD(_start), \ 296 WORD(_start + 2), \ 297 WORD(_start + 4) 298 299 MT_EE_NIC_CONF_0 + 1, 300 WORD(MT_EE_NIC_CONF_1), 301 MT_EE_WIFI_RF_SETTING, 302 MT_EE_TX_POWER_DELTA_BW40, 303 MT_EE_TX_POWER_DELTA_BW80 + 1, 304 MT_EE_TX_POWER_EXT_PA_5G, 305 MT_EE_TEMP_SENSOR_CAL, 306 GROUP_2G(MT_EE_TX_POWER_0_START_2G), 307 GROUP_2G(MT_EE_TX_POWER_1_START_2G), 308 WORD(MT_EE_TX_POWER_CCK), 309 WORD(MT_EE_TX_POWER_OFDM_2G_6M), 310 WORD(MT_EE_TX_POWER_OFDM_2G_24M), 311 WORD(MT_EE_TX_POWER_OFDM_2G_54M), 312 WORD(MT_EE_TX_POWER_HT_BPSK_QPSK), 313 WORD(MT_EE_TX_POWER_HT_16_64_QAM), 314 WORD(MT_EE_TX_POWER_HT_64_QAM), 315 MT_EE_ELAN_RX_MODE_GAIN, 316 MT_EE_ELAN_RX_MODE_NF, 317 MT_EE_ELAN_RX_MODE_P1DB, 318 MT_EE_ELAN_BYPASS_MODE_GAIN, 319 MT_EE_ELAN_BYPASS_MODE_NF, 320 MT_EE_ELAN_BYPASS_MODE_P1DB, 321 WORD(MT_EE_STEP_NUM_NEG_6_7), 322 WORD(MT_EE_STEP_NUM_NEG_4_5), 323 WORD(MT_EE_STEP_NUM_NEG_2_3), 324 WORD(MT_EE_STEP_NUM_NEG_0_1), 325 WORD(MT_EE_REF_STEP_24G), 326 WORD(MT_EE_STEP_NUM_PLUS_1_2), 327 WORD(MT_EE_STEP_NUM_PLUS_3_4), 328 WORD(MT_EE_STEP_NUM_PLUS_5_6), 329 MT_EE_STEP_NUM_PLUS_7, 330 MT_EE_XTAL_FREQ_OFFSET, 331 MT_EE_XTAL_TRIM_2_COMP, 332 MT_EE_XTAL_TRIM_3_COMP, 333 MT_EE_XTAL_WF_RFCAL, 334 335 /* unknown fields below */ 336 WORD(0x24), 337 0x34, 338 0x39, 339 0x3b, 340 WORD(0x42), 341 WORD(0x9e), 342 0xf2, 343 WORD(0xf8), 344 0xfa, 345 0x12e, 346 WORD(0x130), WORD(0x132), WORD(0x134), WORD(0x136), 347 WORD(0x138), WORD(0x13a), WORD(0x13c), WORD(0x13e), 348 349 #undef GROUP_2G 350 #undef WORD 351 352 }; 353 struct req_data { 354 __le16 addr; 355 u8 val; 356 u8 pad; 357 } __packed; 358 struct { 359 u8 buffer_mode; 360 u8 len; 361 u8 pad[2]; 362 } req_hdr = { 363 .buffer_mode = 1, 364 .len = ARRAY_SIZE(req_fields) - 1, 365 }; 366 const int size = 0xff * sizeof(struct req_data); 367 u8 *req, *eep = (u8 *)dev->mt76.eeprom.data; 368 int i, ret, len = sizeof(req_hdr) + size; 369 struct req_data *data; 370 371 BUILD_BUG_ON(ARRAY_SIZE(req_fields) * sizeof(*data) > size); 372 373 req = kmalloc(len, GFP_KERNEL); 374 if (!req) 375 return -ENOMEM; 376 377 memcpy(req, &req_hdr, sizeof(req_hdr)); 378 data = (struct req_data *)(req + sizeof(req_hdr)); 379 memset(data, 0, size); 380 for (i = 0; i < ARRAY_SIZE(req_fields); i++) { 381 data[i].addr = cpu_to_le16(req_fields[i]); 382 data[i].val = eep[req_fields[i]]; 383 } 384 385 ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE, 386 req, len, true); 387 kfree(req); 388 389 return ret; 390 } 391 392 static int mt7603_mcu_set_tx_power(struct mt7603_dev *dev) 393 { 394 struct { 395 u8 center_channel; 396 u8 tssi; 397 u8 temp_comp; 398 u8 target_power[2]; 399 u8 rate_power_delta[14]; 400 u8 bw_power_delta; 401 u8 ch_power_delta[6]; 402 u8 temp_comp_power[17]; 403 u8 reserved; 404 } req = { 405 .center_channel = dev->mphy.chandef.chan->hw_value, 406 #define EEP_VAL(n) ((u8 *)dev->mt76.eeprom.data)[n] 407 .tssi = EEP_VAL(MT_EE_NIC_CONF_1 + 1), 408 .temp_comp = EEP_VAL(MT_EE_NIC_CONF_1), 409 .target_power = { 410 EEP_VAL(MT_EE_TX_POWER_0_START_2G + 2), 411 EEP_VAL(MT_EE_TX_POWER_1_START_2G + 2) 412 }, 413 .bw_power_delta = EEP_VAL(MT_EE_TX_POWER_DELTA_BW40), 414 .ch_power_delta = { 415 EEP_VAL(MT_EE_TX_POWER_0_START_2G + 3), 416 EEP_VAL(MT_EE_TX_POWER_0_START_2G + 4), 417 EEP_VAL(MT_EE_TX_POWER_0_START_2G + 5), 418 EEP_VAL(MT_EE_TX_POWER_1_START_2G + 3), 419 EEP_VAL(MT_EE_TX_POWER_1_START_2G + 4), 420 EEP_VAL(MT_EE_TX_POWER_1_START_2G + 5) 421 }, 422 #undef EEP_VAL 423 }; 424 u8 *eep = (u8 *)dev->mt76.eeprom.data; 425 426 memcpy(req.rate_power_delta, eep + MT_EE_TX_POWER_CCK, 427 sizeof(req.rate_power_delta)); 428 429 memcpy(req.temp_comp_power, eep + MT_EE_STEP_NUM_NEG_6_7, 430 sizeof(req.temp_comp_power)); 431 432 return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_TX_POWER_CTRL, 433 &req, sizeof(req), true); 434 } 435 436 int mt7603_mcu_set_channel(struct mt7603_dev *dev) 437 { 438 struct cfg80211_chan_def *chandef = &dev->mphy.chandef; 439 struct ieee80211_hw *hw = mt76_hw(dev); 440 int n_chains = hweight8(dev->mphy.antenna_mask); 441 struct { 442 u8 control_chan; 443 u8 center_chan; 444 u8 bw; 445 u8 tx_streams; 446 u8 rx_streams; 447 u8 _res0[7]; 448 u8 txpower[21]; 449 u8 _res1[3]; 450 } req = { 451 .control_chan = chandef->chan->hw_value, 452 .center_chan = chandef->chan->hw_value, 453 .bw = MT_BW_20, 454 .tx_streams = n_chains, 455 .rx_streams = n_chains, 456 }; 457 s8 tx_power; 458 int i, ret; 459 460 if (dev->mphy.chandef.width == NL80211_CHAN_WIDTH_40) { 461 req.bw = MT_BW_40; 462 if (chandef->center_freq1 > chandef->chan->center_freq) 463 req.center_chan += 2; 464 else 465 req.center_chan -= 2; 466 } 467 468 tx_power = hw->conf.power_level * 2; 469 if (dev->mphy.antenna_mask == 3) 470 tx_power -= 6; 471 tx_power = min(tx_power, dev->tx_power_limit); 472 473 dev->mphy.txpower_cur = tx_power; 474 475 for (i = 0; i < ARRAY_SIZE(req.txpower); i++) 476 req.txpower[i] = tx_power; 477 478 ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_CHANNEL_SWITCH, &req, 479 sizeof(req), true); 480 if (ret) 481 return ret; 482 483 return mt7603_mcu_set_tx_power(dev); 484 } 485