1 /* 2 * (c) Copyright 2002-2010, Ralink Technology, Inc. 3 * Copyright (C) 2014 Felix Fietkau <nbd@openwrt.org> 4 * Copyright (C) 2015 Jakub Kicinski <kubakici@wp.pl> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 8 * as published by the Free Software Foundation 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 */ 15 16 #include <linux/kernel.h> 17 #include <linux/firmware.h> 18 #include <linux/delay.h> 19 #include <linux/usb.h> 20 #include <linux/skbuff.h> 21 22 #include "mt7601u.h" 23 #include "dma.h" 24 #include "mcu.h" 25 #include "usb.h" 26 #include "trace.h" 27 28 #define MCU_FW_URB_MAX_PAYLOAD 0x3800 29 #define MCU_FW_URB_SIZE (MCU_FW_URB_MAX_PAYLOAD + 12) 30 #define MCU_RESP_URB_SIZE 1024 31 32 static inline int firmware_running(struct mt7601u_dev *dev) 33 { 34 return mt7601u_rr(dev, MT_MCU_COM_REG0) == 1; 35 } 36 37 static inline void skb_put_le32(struct sk_buff *skb, u32 val) 38 { 39 put_unaligned_le32(val, skb_put(skb, 4)); 40 } 41 42 static inline void mt7601u_dma_skb_wrap_cmd(struct sk_buff *skb, 43 u8 seq, enum mcu_cmd cmd) 44 { 45 WARN_ON(mt7601u_dma_skb_wrap(skb, CPU_TX_PORT, DMA_COMMAND, 46 FIELD_PREP(MT_TXD_CMD_INFO_SEQ, seq) | 47 FIELD_PREP(MT_TXD_CMD_INFO_TYPE, cmd))); 48 } 49 50 static inline void trace_mt_mcu_msg_send_cs(struct mt7601u_dev *dev, 51 struct sk_buff *skb, bool need_resp) 52 { 53 u32 i, csum = 0; 54 55 for (i = 0; i < skb->len / 4; i++) 56 csum ^= get_unaligned_le32(skb->data + i * 4); 57 58 trace_mt_mcu_msg_send(dev, skb, csum, need_resp); 59 } 60 61 static struct sk_buff * 62 mt7601u_mcu_msg_alloc(struct mt7601u_dev *dev, const void *data, int len) 63 { 64 struct sk_buff *skb; 65 66 WARN_ON(len % 4); /* if length is not divisible by 4 we need to pad */ 67 68 skb = alloc_skb(len + MT_DMA_HDR_LEN + 4, GFP_KERNEL); 69 if (skb) { 70 skb_reserve(skb, MT_DMA_HDR_LEN); 71 memcpy(skb_put(skb, len), data, len); 72 } 73 74 return skb; 75 } 76 77 static int mt7601u_mcu_wait_resp(struct mt7601u_dev *dev, u8 seq) 78 { 79 struct urb *urb = dev->mcu.resp.urb; 80 u32 rxfce; 81 int urb_status, ret, i = 5; 82 83 while (i--) { 84 if (!wait_for_completion_timeout(&dev->mcu.resp_cmpl, 85 msecs_to_jiffies(300))) { 86 dev_warn(dev->dev, "Warning: %s retrying\n", __func__); 87 continue; 88 } 89 90 /* Make copies of important data before reusing the urb */ 91 rxfce = get_unaligned_le32(dev->mcu.resp.buf); 92 urb_status = urb->status * mt7601u_urb_has_error(urb); 93 94 ret = mt7601u_usb_submit_buf(dev, USB_DIR_IN, MT_EP_IN_CMD_RESP, 95 &dev->mcu.resp, GFP_KERNEL, 96 mt7601u_complete_urb, 97 &dev->mcu.resp_cmpl); 98 if (ret) 99 return ret; 100 101 if (urb_status) 102 dev_err(dev->dev, "Error: MCU resp urb failed:%d\n", 103 urb_status); 104 105 if (FIELD_GET(MT_RXD_CMD_INFO_CMD_SEQ, rxfce) == seq && 106 FIELD_GET(MT_RXD_CMD_INFO_EVT_TYPE, rxfce) == CMD_DONE) 107 return 0; 108 109 dev_err(dev->dev, "Error: MCU resp evt:%lx seq:%hhx-%lx!\n", 110 FIELD_GET(MT_RXD_CMD_INFO_EVT_TYPE, rxfce), 111 seq, FIELD_GET(MT_RXD_CMD_INFO_CMD_SEQ, rxfce)); 112 } 113 114 dev_err(dev->dev, "Error: %s timed out\n", __func__); 115 return -ETIMEDOUT; 116 } 117 118 static int 119 mt7601u_mcu_msg_send(struct mt7601u_dev *dev, struct sk_buff *skb, 120 enum mcu_cmd cmd, bool wait_resp) 121 { 122 struct usb_device *usb_dev = mt7601u_to_usb_dev(dev); 123 unsigned cmd_pipe = usb_sndbulkpipe(usb_dev, 124 dev->out_eps[MT_EP_OUT_INBAND_CMD]); 125 int sent, ret; 126 u8 seq = 0; 127 128 if (test_bit(MT7601U_STATE_REMOVED, &dev->state)) 129 return 0; 130 131 mutex_lock(&dev->mcu.mutex); 132 133 if (wait_resp) 134 while (!seq) 135 seq = ++dev->mcu.msg_seq & 0xf; 136 137 mt7601u_dma_skb_wrap_cmd(skb, seq, cmd); 138 139 if (dev->mcu.resp_cmpl.done) 140 dev_err(dev->dev, "Error: MCU response pre-completed!\n"); 141 142 trace_mt_mcu_msg_send_cs(dev, skb, wait_resp); 143 trace_mt_submit_urb_sync(dev, cmd_pipe, skb->len); 144 ret = usb_bulk_msg(usb_dev, cmd_pipe, skb->data, skb->len, &sent, 500); 145 if (ret) { 146 dev_err(dev->dev, "Error: send MCU cmd failed:%d\n", ret); 147 goto out; 148 } 149 if (sent != skb->len) 150 dev_err(dev->dev, "Error: %s sent != skb->len\n", __func__); 151 152 if (wait_resp) 153 ret = mt7601u_mcu_wait_resp(dev, seq); 154 out: 155 mutex_unlock(&dev->mcu.mutex); 156 157 consume_skb(skb); 158 159 return ret; 160 } 161 162 static int mt7601u_mcu_function_select(struct mt7601u_dev *dev, 163 enum mcu_function func, u32 val) 164 { 165 struct sk_buff *skb; 166 struct { 167 __le32 id; 168 __le32 value; 169 } __packed __aligned(4) msg = { 170 .id = cpu_to_le32(func), 171 .value = cpu_to_le32(val), 172 }; 173 174 skb = mt7601u_mcu_msg_alloc(dev, &msg, sizeof(msg)); 175 if (!skb) 176 return -ENOMEM; 177 return mt7601u_mcu_msg_send(dev, skb, CMD_FUN_SET_OP, func == 5); 178 } 179 180 int mt7601u_mcu_tssi_read_kick(struct mt7601u_dev *dev, int use_hvga) 181 { 182 int ret; 183 184 if (!test_bit(MT7601U_STATE_MCU_RUNNING, &dev->state)) 185 return 0; 186 187 ret = mt7601u_mcu_function_select(dev, ATOMIC_TSSI_SETTING, 188 use_hvga); 189 if (ret) { 190 dev_warn(dev->dev, "Warning: MCU TSSI read kick failed\n"); 191 return ret; 192 } 193 194 dev->tssi_read_trig = true; 195 196 return 0; 197 } 198 199 int 200 mt7601u_mcu_calibrate(struct mt7601u_dev *dev, enum mcu_calibrate cal, u32 val) 201 { 202 struct sk_buff *skb; 203 struct { 204 __le32 id; 205 __le32 value; 206 } __packed __aligned(4) msg = { 207 .id = cpu_to_le32(cal), 208 .value = cpu_to_le32(val), 209 }; 210 211 skb = mt7601u_mcu_msg_alloc(dev, &msg, sizeof(msg)); 212 if (!skb) 213 return -ENOMEM; 214 return mt7601u_mcu_msg_send(dev, skb, CMD_CALIBRATION_OP, true); 215 } 216 217 int mt7601u_write_reg_pairs(struct mt7601u_dev *dev, u32 base, 218 const struct mt76_reg_pair *data, int n) 219 { 220 const int max_vals_per_cmd = INBAND_PACKET_MAX_LEN / 8; 221 struct sk_buff *skb; 222 int cnt, i, ret; 223 224 if (!n) 225 return 0; 226 227 cnt = min(max_vals_per_cmd, n); 228 229 skb = alloc_skb(cnt * 8 + MT_DMA_HDR_LEN + 4, GFP_KERNEL); 230 if (!skb) 231 return -ENOMEM; 232 skb_reserve(skb, MT_DMA_HDR_LEN); 233 234 for (i = 0; i < cnt; i++) { 235 skb_put_le32(skb, base + data[i].reg); 236 skb_put_le32(skb, data[i].value); 237 } 238 239 ret = mt7601u_mcu_msg_send(dev, skb, CMD_RANDOM_WRITE, cnt == n); 240 if (ret) 241 return ret; 242 243 return mt7601u_write_reg_pairs(dev, base, data + cnt, n - cnt); 244 } 245 246 int mt7601u_burst_write_regs(struct mt7601u_dev *dev, u32 offset, 247 const u32 *data, int n) 248 { 249 const int max_regs_per_cmd = INBAND_PACKET_MAX_LEN / 4 - 1; 250 struct sk_buff *skb; 251 int cnt, i, ret; 252 253 if (!n) 254 return 0; 255 256 cnt = min(max_regs_per_cmd, n); 257 258 skb = alloc_skb(cnt * 4 + MT_DMA_HDR_LEN + 4, GFP_KERNEL); 259 if (!skb) 260 return -ENOMEM; 261 skb_reserve(skb, MT_DMA_HDR_LEN); 262 263 skb_put_le32(skb, MT_MCU_MEMMAP_WLAN + offset); 264 for (i = 0; i < cnt; i++) 265 skb_put_le32(skb, data[i]); 266 267 ret = mt7601u_mcu_msg_send(dev, skb, CMD_BURST_WRITE, cnt == n); 268 if (ret) 269 return ret; 270 271 return mt7601u_burst_write_regs(dev, offset + cnt * 4, 272 data + cnt, n - cnt); 273 } 274 275 struct mt76_fw_header { 276 __le32 ilm_len; 277 __le32 dlm_len; 278 __le16 build_ver; 279 __le16 fw_ver; 280 u8 pad[4]; 281 char build_time[16]; 282 }; 283 284 struct mt76_fw { 285 struct mt76_fw_header hdr; 286 u8 ivb[MT_MCU_IVB_SIZE]; 287 u8 ilm[]; 288 }; 289 290 static int __mt7601u_dma_fw(struct mt7601u_dev *dev, 291 const struct mt7601u_dma_buf *dma_buf, 292 const void *data, u32 len, u32 dst_addr) 293 { 294 DECLARE_COMPLETION_ONSTACK(cmpl); 295 struct mt7601u_dma_buf buf = *dma_buf; /* we need to fake length */ 296 __le32 reg; 297 u32 val; 298 int ret; 299 300 reg = cpu_to_le32(FIELD_PREP(MT_TXD_INFO_TYPE, DMA_PACKET) | 301 FIELD_PREP(MT_TXD_INFO_D_PORT, CPU_TX_PORT) | 302 FIELD_PREP(MT_TXD_INFO_LEN, len)); 303 memcpy(buf.buf, ®, sizeof(reg)); 304 memcpy(buf.buf + sizeof(reg), data, len); 305 memset(buf.buf + sizeof(reg) + len, 0, 8); 306 307 ret = mt7601u_vendor_single_wr(dev, MT_VEND_WRITE_FCE, 308 MT_FCE_DMA_ADDR, dst_addr); 309 if (ret) 310 return ret; 311 len = roundup(len, 4); 312 ret = mt7601u_vendor_single_wr(dev, MT_VEND_WRITE_FCE, 313 MT_FCE_DMA_LEN, len << 16); 314 if (ret) 315 return ret; 316 317 buf.len = MT_DMA_HDR_LEN + len + 4; 318 ret = mt7601u_usb_submit_buf(dev, USB_DIR_OUT, MT_EP_OUT_INBAND_CMD, 319 &buf, GFP_KERNEL, 320 mt7601u_complete_urb, &cmpl); 321 if (ret) 322 return ret; 323 324 if (!wait_for_completion_timeout(&cmpl, msecs_to_jiffies(1000))) { 325 dev_err(dev->dev, "Error: firmware upload timed out\n"); 326 usb_kill_urb(buf.urb); 327 return -ETIMEDOUT; 328 } 329 if (mt7601u_urb_has_error(buf.urb)) { 330 dev_err(dev->dev, "Error: firmware upload urb failed:%d\n", 331 buf.urb->status); 332 return buf.urb->status; 333 } 334 335 val = mt7601u_rr(dev, MT_TX_CPU_FROM_FCE_CPU_DESC_IDX); 336 val++; 337 mt7601u_wr(dev, MT_TX_CPU_FROM_FCE_CPU_DESC_IDX, val); 338 339 return 0; 340 } 341 342 static int 343 mt7601u_dma_fw(struct mt7601u_dev *dev, struct mt7601u_dma_buf *dma_buf, 344 const void *data, int len, u32 dst_addr) 345 { 346 int n, ret; 347 348 if (len == 0) 349 return 0; 350 351 n = min(MCU_FW_URB_MAX_PAYLOAD, len); 352 ret = __mt7601u_dma_fw(dev, dma_buf, data, n, dst_addr); 353 if (ret) 354 return ret; 355 356 if (!mt76_poll_msec(dev, MT_MCU_COM_REG1, BIT(31), BIT(31), 500)) 357 return -ETIMEDOUT; 358 359 return mt7601u_dma_fw(dev, dma_buf, data + n, len - n, dst_addr + n); 360 } 361 362 static int 363 mt7601u_upload_firmware(struct mt7601u_dev *dev, const struct mt76_fw *fw) 364 { 365 struct mt7601u_dma_buf dma_buf; 366 void *ivb; 367 u32 ilm_len, dlm_len; 368 int i, ret; 369 370 ivb = kmemdup(fw->ivb, sizeof(fw->ivb), GFP_KERNEL); 371 if (!ivb) 372 return -ENOMEM; 373 if (mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf)) { 374 ret = -ENOMEM; 375 goto error; 376 } 377 378 ilm_len = le32_to_cpu(fw->hdr.ilm_len) - sizeof(fw->ivb); 379 dev_dbg(dev->dev, "loading FW - ILM %u + IVB %zu\n", 380 ilm_len, sizeof(fw->ivb)); 381 ret = mt7601u_dma_fw(dev, &dma_buf, fw->ilm, ilm_len, sizeof(fw->ivb)); 382 if (ret) 383 goto error; 384 385 dlm_len = le32_to_cpu(fw->hdr.dlm_len); 386 dev_dbg(dev->dev, "loading FW - DLM %u\n", dlm_len); 387 ret = mt7601u_dma_fw(dev, &dma_buf, fw->ilm + ilm_len, 388 dlm_len, MT_MCU_DLM_OFFSET); 389 if (ret) 390 goto error; 391 392 ret = mt7601u_vendor_request(dev, MT_VEND_DEV_MODE, USB_DIR_OUT, 393 0x12, 0, ivb, sizeof(fw->ivb)); 394 if (ret < 0) 395 goto error; 396 ret = 0; 397 398 for (i = 100; i && !firmware_running(dev); i--) 399 msleep(10); 400 if (!i) { 401 ret = -ETIMEDOUT; 402 goto error; 403 } 404 405 dev_dbg(dev->dev, "Firmware running!\n"); 406 error: 407 kfree(ivb); 408 mt7601u_usb_free_buf(dev, &dma_buf); 409 410 return ret; 411 } 412 413 static int mt7601u_load_firmware(struct mt7601u_dev *dev) 414 { 415 const struct firmware *fw; 416 const struct mt76_fw_header *hdr; 417 int len, ret; 418 u32 val; 419 420 mt7601u_wr(dev, MT_USB_DMA_CFG, (MT_USB_DMA_CFG_RX_BULK_EN | 421 MT_USB_DMA_CFG_TX_BULK_EN)); 422 423 if (firmware_running(dev)) 424 return 0; 425 426 ret = request_firmware(&fw, MT7601U_FIRMWARE, dev->dev); 427 if (ret) 428 return ret; 429 430 if (!fw || !fw->data || fw->size < sizeof(*hdr)) 431 goto err_inv_fw; 432 433 hdr = (const struct mt76_fw_header *) fw->data; 434 435 if (le32_to_cpu(hdr->ilm_len) <= MT_MCU_IVB_SIZE) 436 goto err_inv_fw; 437 438 len = sizeof(*hdr); 439 len += le32_to_cpu(hdr->ilm_len); 440 len += le32_to_cpu(hdr->dlm_len); 441 442 if (fw->size != len) 443 goto err_inv_fw; 444 445 val = le16_to_cpu(hdr->fw_ver); 446 dev_info(dev->dev, 447 "Firmware Version: %d.%d.%02d Build: %x Build time: %.16s\n", 448 (val >> 12) & 0xf, (val >> 8) & 0xf, val & 0xf, 449 le16_to_cpu(hdr->build_ver), hdr->build_time); 450 451 len = le32_to_cpu(hdr->ilm_len); 452 453 mt7601u_wr(dev, 0x94c, 0); 454 mt7601u_wr(dev, MT_FCE_PSE_CTRL, 0); 455 456 mt7601u_vendor_reset(dev); 457 msleep(5); 458 459 mt7601u_wr(dev, 0xa44, 0); 460 mt7601u_wr(dev, 0x230, 0x84210); 461 mt7601u_wr(dev, 0x400, 0x80c00); 462 mt7601u_wr(dev, 0x800, 1); 463 464 mt7601u_rmw(dev, MT_PBF_CFG, 0, (MT_PBF_CFG_TX0Q_EN | 465 MT_PBF_CFG_TX1Q_EN | 466 MT_PBF_CFG_TX2Q_EN | 467 MT_PBF_CFG_TX3Q_EN)); 468 469 mt7601u_wr(dev, MT_FCE_PSE_CTRL, 1); 470 471 mt7601u_wr(dev, MT_USB_DMA_CFG, (MT_USB_DMA_CFG_RX_BULK_EN | 472 MT_USB_DMA_CFG_TX_BULK_EN)); 473 val = mt76_set(dev, MT_USB_DMA_CFG, MT_USB_DMA_CFG_TX_CLR); 474 val &= ~MT_USB_DMA_CFG_TX_CLR; 475 mt7601u_wr(dev, MT_USB_DMA_CFG, val); 476 477 /* FCE tx_fs_base_ptr */ 478 mt7601u_wr(dev, MT_TX_CPU_FROM_FCE_BASE_PTR, 0x400230); 479 /* FCE tx_fs_max_cnt */ 480 mt7601u_wr(dev, MT_TX_CPU_FROM_FCE_MAX_COUNT, 1); 481 /* FCE pdma enable */ 482 mt7601u_wr(dev, MT_FCE_PDMA_GLOBAL_CONF, 0x44); 483 /* FCE skip_fs_en */ 484 mt7601u_wr(dev, MT_FCE_SKIP_FS, 3); 485 486 ret = mt7601u_upload_firmware(dev, (const struct mt76_fw *)fw->data); 487 488 release_firmware(fw); 489 490 return ret; 491 492 err_inv_fw: 493 dev_err(dev->dev, "Invalid firmware image\n"); 494 release_firmware(fw); 495 return -ENOENT; 496 } 497 498 int mt7601u_mcu_init(struct mt7601u_dev *dev) 499 { 500 int ret; 501 502 mutex_init(&dev->mcu.mutex); 503 504 ret = mt7601u_load_firmware(dev); 505 if (ret) 506 return ret; 507 508 set_bit(MT7601U_STATE_MCU_RUNNING, &dev->state); 509 510 return 0; 511 } 512 513 int mt7601u_mcu_cmd_init(struct mt7601u_dev *dev) 514 { 515 int ret; 516 517 ret = mt7601u_mcu_function_select(dev, Q_SELECT, 1); 518 if (ret) 519 return ret; 520 521 init_completion(&dev->mcu.resp_cmpl); 522 if (mt7601u_usb_alloc_buf(dev, MCU_RESP_URB_SIZE, &dev->mcu.resp)) { 523 mt7601u_usb_free_buf(dev, &dev->mcu.resp); 524 return -ENOMEM; 525 } 526 527 ret = mt7601u_usb_submit_buf(dev, USB_DIR_IN, MT_EP_IN_CMD_RESP, 528 &dev->mcu.resp, GFP_KERNEL, 529 mt7601u_complete_urb, &dev->mcu.resp_cmpl); 530 if (ret) { 531 mt7601u_usb_free_buf(dev, &dev->mcu.resp); 532 return ret; 533 } 534 535 return 0; 536 } 537 538 void mt7601u_mcu_cmd_deinit(struct mt7601u_dev *dev) 539 { 540 usb_kill_urb(dev->mcu.resp.urb); 541 mt7601u_usb_free_buf(dev, &dev->mcu.resp); 542 } 543