1 /******************************************************************************
2  *
3  * Copyright(c) 2009-2012  Realtek Corporation.
4  *
5  * This program is free software; you can redistribute it and/or modify it
6  * under the terms of version 2 of the GNU General Public License as
7  * published by the Free Software Foundation.
8  *
9  * This program is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
12  * more details.
13  *
14  * The full GNU General Public License is included in this distribution in the
15  * file called LICENSE.
16  *
17  * Contact Information:
18  * wlanfae <wlanfae@realtek.com>
19  * Realtek Corporation, No. 2, Innovation Road II, Hsinchu Science Park,
20  * Hsinchu 300, Taiwan.
21  *
22  * Larry Finger <Larry.Finger@lwfinger.net>
23  *
24  *****************************************************************************/
25 
26 #include "../wifi.h"
27 #include "../pci.h"
28 #include "../base.h"
29 #include "reg.h"
30 #include "def.h"
31 #include "fw.h"
32 
33 static void _rtl92s_fw_set_rqpn(struct ieee80211_hw *hw)
34 {
35 	struct rtl_priv *rtlpriv = rtl_priv(hw);
36 
37 	rtl_write_dword(rtlpriv, RQPN, 0xffffffff);
38 	rtl_write_dword(rtlpriv, RQPN + 4, 0xffffffff);
39 	rtl_write_byte(rtlpriv, RQPN + 8, 0xff);
40 	rtl_write_byte(rtlpriv, RQPN + 0xB, 0x80);
41 }
42 
43 static bool _rtl92s_firmware_enable_cpu(struct ieee80211_hw *hw)
44 {
45 	struct rtl_priv *rtlpriv = rtl_priv(hw);
46 	u32 ichecktime = 200;
47 	u16 tmpu2b;
48 	u8 tmpu1b, cpustatus = 0;
49 
50 	_rtl92s_fw_set_rqpn(hw);
51 
52 	/* Enable CPU. */
53 	tmpu1b = rtl_read_byte(rtlpriv, SYS_CLKR);
54 	/* AFE source */
55 	rtl_write_byte(rtlpriv, SYS_CLKR, (tmpu1b | SYS_CPU_CLKSEL));
56 
57 	tmpu2b = rtl_read_word(rtlpriv, REG_SYS_FUNC_EN);
58 	rtl_write_word(rtlpriv, REG_SYS_FUNC_EN, (tmpu2b | FEN_CPUEN));
59 
60 	/* Polling IMEM Ready after CPU has refilled. */
61 	do {
62 		cpustatus = rtl_read_byte(rtlpriv, TCR);
63 		if (cpustatus & IMEM_RDY) {
64 			RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
65 				 "IMEM Ready after CPU has refilled\n");
66 			break;
67 		}
68 
69 		udelay(100);
70 	} while (ichecktime--);
71 
72 	if (!(cpustatus & IMEM_RDY))
73 		return false;
74 
75 	return true;
76 }
77 
78 static enum fw_status _rtl92s_firmware_get_nextstatus(
79 		enum fw_status fw_currentstatus)
80 {
81 	enum fw_status	next_fwstatus = 0;
82 
83 	switch (fw_currentstatus) {
84 	case FW_STATUS_INIT:
85 		next_fwstatus = FW_STATUS_LOAD_IMEM;
86 		break;
87 	case FW_STATUS_LOAD_IMEM:
88 		next_fwstatus = FW_STATUS_LOAD_EMEM;
89 		break;
90 	case FW_STATUS_LOAD_EMEM:
91 		next_fwstatus = FW_STATUS_LOAD_DMEM;
92 		break;
93 	case FW_STATUS_LOAD_DMEM:
94 		next_fwstatus = FW_STATUS_READY;
95 		break;
96 	default:
97 		break;
98 	}
99 
100 	return next_fwstatus;
101 }
102 
103 static u8 _rtl92s_firmware_header_map_rftype(struct ieee80211_hw *hw)
104 {
105 	struct rtl_priv *rtlpriv = rtl_priv(hw);
106 	struct rtl_phy *rtlphy = &(rtlpriv->phy);
107 
108 	switch (rtlphy->rf_type) {
109 	case RF_1T1R:
110 		return 0x11;
111 	case RF_1T2R:
112 		return 0x12;
113 	case RF_2T2R:
114 		return 0x22;
115 	default:
116 		RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG, "Unknown RF type(%x)\n",
117 			 rtlphy->rf_type);
118 		break;
119 	}
120 	return 0x22;
121 }
122 
123 static void _rtl92s_firmwareheader_priveupdate(struct ieee80211_hw *hw,
124 		struct fw_priv *pfw_priv)
125 {
126 	/* Update RF types for RATR settings. */
127 	pfw_priv->rf_config = _rtl92s_firmware_header_map_rftype(hw);
128 }
129 
130 
131 
132 static bool _rtl92s_cmd_send_packet(struct ieee80211_hw *hw,
133 		struct sk_buff *skb, u8 last)
134 {
135 	struct rtl_priv *rtlpriv = rtl_priv(hw);
136 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
137 	struct rtl8192_tx_ring *ring;
138 	struct rtl_tx_desc *pdesc;
139 	unsigned long flags;
140 	u8 idx = 0;
141 
142 	ring = &rtlpci->tx_ring[TXCMD_QUEUE];
143 
144 	spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
145 
146 	idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries;
147 	pdesc = &ring->desc[idx];
148 	rtlpriv->cfg->ops->fill_tx_cmddesc(hw, (u8 *)pdesc, 1, 1, skb);
149 	__skb_queue_tail(&ring->queue, skb);
150 
151 	spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
152 
153 	return true;
154 }
155 
156 static bool _rtl92s_firmware_downloadcode(struct ieee80211_hw *hw,
157 		u8 *code_virtual_address, u32 buffer_len)
158 {
159 	struct rtl_priv *rtlpriv = rtl_priv(hw);
160 	struct sk_buff *skb;
161 	struct rtl_tcb_desc *tcb_desc;
162 	unsigned char *seg_ptr;
163 	u16 frag_threshold = MAX_FIRMWARE_CODE_SIZE;
164 	u16 frag_length, frag_offset = 0;
165 	u16 extra_descoffset = 0;
166 	u8 last_inipkt = 0;
167 
168 	_rtl92s_fw_set_rqpn(hw);
169 
170 	if (buffer_len >= MAX_FIRMWARE_CODE_SIZE) {
171 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
172 			 "Size over FIRMWARE_CODE_SIZE!\n");
173 
174 		return false;
175 	}
176 
177 	extra_descoffset = 0;
178 
179 	do {
180 		if ((buffer_len - frag_offset) > frag_threshold) {
181 			frag_length = frag_threshold + extra_descoffset;
182 		} else {
183 			frag_length = (u16)(buffer_len - frag_offset +
184 					    extra_descoffset);
185 			last_inipkt = 1;
186 		}
187 
188 		/* Allocate skb buffer to contain firmware */
189 		/* info and tx descriptor info. */
190 		skb = dev_alloc_skb(frag_length);
191 		if (!skb)
192 			return false;
193 		skb_reserve(skb, extra_descoffset);
194 		seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length -
195 					extra_descoffset));
196 		memcpy(seg_ptr, code_virtual_address + frag_offset,
197 		       (u32)(frag_length - extra_descoffset));
198 
199 		tcb_desc = (struct rtl_tcb_desc *)(skb->cb);
200 		tcb_desc->queue_index = TXCMD_QUEUE;
201 		tcb_desc->cmd_or_init = DESC_PACKET_TYPE_INIT;
202 		tcb_desc->last_inipkt = last_inipkt;
203 
204 		_rtl92s_cmd_send_packet(hw, skb, last_inipkt);
205 
206 		frag_offset += (frag_length - extra_descoffset);
207 
208 	} while (frag_offset < buffer_len);
209 
210 	rtl_write_byte(rtlpriv, TP_POLL, TPPOLL_CQ);
211 
212 	return true ;
213 }
214 
215 static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw,
216 		u8 loadfw_status)
217 {
218 	struct rtl_priv *rtlpriv = rtl_priv(hw);
219 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
220 	struct rt_firmware *firmware = (struct rt_firmware *)rtlhal->pfirmware;
221 	u32 tmpu4b;
222 	u8 cpustatus = 0;
223 	short pollingcnt = 1000;
224 	bool rtstatus = true;
225 
226 	RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
227 		 "LoadStaus(%d)\n", loadfw_status);
228 
229 	firmware->fwstatus = (enum fw_status)loadfw_status;
230 
231 	switch (loadfw_status) {
232 	case FW_STATUS_LOAD_IMEM:
233 		/* Polling IMEM code done. */
234 		do {
235 			cpustatus = rtl_read_byte(rtlpriv, TCR);
236 			if (cpustatus & IMEM_CODE_DONE)
237 				break;
238 			udelay(5);
239 		} while (pollingcnt--);
240 
241 		if (!(cpustatus & IMEM_CHK_RPT) || (pollingcnt <= 0)) {
242 			RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
243 				 "FW_STATUS_LOAD_IMEM FAIL CPU, Status=%x\n",
244 				 cpustatus);
245 			goto status_check_fail;
246 		}
247 		break;
248 
249 	case FW_STATUS_LOAD_EMEM:
250 		/* Check Put Code OK and Turn On CPU */
251 		/* Polling EMEM code done. */
252 		do {
253 			cpustatus = rtl_read_byte(rtlpriv, TCR);
254 			if (cpustatus & EMEM_CODE_DONE)
255 				break;
256 			udelay(5);
257 		} while (pollingcnt--);
258 
259 		if (!(cpustatus & EMEM_CHK_RPT) || (pollingcnt <= 0)) {
260 			RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
261 				 "FW_STATUS_LOAD_EMEM FAIL CPU, Status=%x\n",
262 				 cpustatus);
263 			goto status_check_fail;
264 		}
265 
266 		/* Turn On CPU */
267 		rtstatus = _rtl92s_firmware_enable_cpu(hw);
268 		if (!rtstatus) {
269 			RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
270 				 "Enable CPU fail!\n");
271 			goto status_check_fail;
272 		}
273 		break;
274 
275 	case FW_STATUS_LOAD_DMEM:
276 		/* Polling DMEM code done */
277 		do {
278 			cpustatus = rtl_read_byte(rtlpriv, TCR);
279 			if (cpustatus & DMEM_CODE_DONE)
280 				break;
281 			udelay(5);
282 		} while (pollingcnt--);
283 
284 		if (!(cpustatus & DMEM_CODE_DONE) || (pollingcnt <= 0)) {
285 			RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
286 				 "Polling DMEM code done fail ! cpustatus(%#x)\n",
287 				 cpustatus);
288 			goto status_check_fail;
289 		}
290 
291 		RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
292 			 "DMEM code download success, cpustatus(%#x)\n",
293 			 cpustatus);
294 
295 		/* Prevent Delay too much and being scheduled out */
296 		/* Polling Load Firmware ready */
297 		pollingcnt = 2000;
298 		do {
299 			cpustatus = rtl_read_byte(rtlpriv, TCR);
300 			if (cpustatus & FWRDY)
301 				break;
302 			udelay(40);
303 		} while (pollingcnt--);
304 
305 		RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
306 			 "Polling Load Firmware ready, cpustatus(%x)\n",
307 			 cpustatus);
308 
309 		if (((cpustatus & LOAD_FW_READY) != LOAD_FW_READY) ||
310 		    (pollingcnt <= 0)) {
311 			RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
312 				 "Polling Load Firmware ready fail ! cpustatus(%x)\n",
313 				 cpustatus);
314 			goto status_check_fail;
315 		}
316 
317 		/* If right here, we can set TCR/RCR to desired value  */
318 		/* and config MAC lookback mode to normal mode */
319 		tmpu4b = rtl_read_dword(rtlpriv, TCR);
320 		rtl_write_dword(rtlpriv, TCR, (tmpu4b & (~TCR_ICV)));
321 
322 		tmpu4b = rtl_read_dword(rtlpriv, RCR);
323 		rtl_write_dword(rtlpriv, RCR, (tmpu4b | RCR_APPFCS |
324 				RCR_APP_ICV | RCR_APP_MIC));
325 
326 		RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
327 			 "Current RCR settings(%#x)\n", tmpu4b);
328 
329 		/* Set to normal mode. */
330 		rtl_write_byte(rtlpriv, LBKMD_SEL, LBK_NORMAL);
331 		break;
332 
333 	default:
334 		RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG,
335 			 "Unknown status check!\n");
336 		rtstatus = false;
337 		break;
338 	}
339 
340 status_check_fail:
341 	RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
342 		 "loadfw_status(%d), rtstatus(%x)\n",
343 		 loadfw_status, rtstatus);
344 	return rtstatus;
345 }
346 
347 int rtl92s_download_fw(struct ieee80211_hw *hw)
348 {
349 	struct rtl_priv *rtlpriv = rtl_priv(hw);
350 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
351 	struct rt_firmware *firmware = NULL;
352 	struct fw_hdr *pfwheader;
353 	struct fw_priv *pfw_priv = NULL;
354 	u8 *puc_mappedfile = NULL;
355 	u32 ul_filelength = 0;
356 	u8 fwhdr_size = RT_8192S_FIRMWARE_HDR_SIZE;
357 	u8 fwstatus = FW_STATUS_INIT;
358 	bool rtstatus = true;
359 
360 	if (rtlpriv->max_fw_size == 0 || !rtlhal->pfirmware)
361 		return 1;
362 
363 	firmware = (struct rt_firmware *)rtlhal->pfirmware;
364 	firmware->fwstatus = FW_STATUS_INIT;
365 
366 	puc_mappedfile = firmware->sz_fw_tmpbuffer;
367 
368 	/* 1. Retrieve FW header. */
369 	firmware->pfwheader = (struct fw_hdr *) puc_mappedfile;
370 	pfwheader = firmware->pfwheader;
371 	firmware->firmwareversion =  byte(pfwheader->version, 0);
372 	firmware->pfwheader->fwpriv.hci_sel = 1;/* pcie */
373 
374 	RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
375 		 "signature:%x, version:%x, size:%x, imemsize:%x, sram size:%x\n",
376 		 pfwheader->signature,
377 		 pfwheader->version, pfwheader->dmem_size,
378 		 pfwheader->img_imem_size, pfwheader->img_sram_size);
379 
380 	/* 2. Retrieve IMEM image. */
381 	if ((pfwheader->img_imem_size == 0) || (pfwheader->img_imem_size >
382 	    sizeof(firmware->fw_imem))) {
383 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
384 			 "memory for data image is less than IMEM required\n");
385 		goto fail;
386 	} else {
387 		puc_mappedfile += fwhdr_size;
388 
389 		memcpy(firmware->fw_imem, puc_mappedfile,
390 		       pfwheader->img_imem_size);
391 		firmware->fw_imem_len = pfwheader->img_imem_size;
392 	}
393 
394 	/* 3. Retriecve EMEM image. */
395 	if (pfwheader->img_sram_size > sizeof(firmware->fw_emem)) {
396 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
397 			 "memory for data image is less than EMEM required\n");
398 		goto fail;
399 	} else {
400 		puc_mappedfile += firmware->fw_imem_len;
401 
402 		memcpy(firmware->fw_emem, puc_mappedfile,
403 		       pfwheader->img_sram_size);
404 		firmware->fw_emem_len = pfwheader->img_sram_size;
405 	}
406 
407 	/* 4. download fw now */
408 	fwstatus = _rtl92s_firmware_get_nextstatus(firmware->fwstatus);
409 	while (fwstatus != FW_STATUS_READY) {
410 		/* Image buffer redirection. */
411 		switch (fwstatus) {
412 		case FW_STATUS_LOAD_IMEM:
413 			puc_mappedfile = firmware->fw_imem;
414 			ul_filelength = firmware->fw_imem_len;
415 			break;
416 		case FW_STATUS_LOAD_EMEM:
417 			puc_mappedfile = firmware->fw_emem;
418 			ul_filelength = firmware->fw_emem_len;
419 			break;
420 		case FW_STATUS_LOAD_DMEM:
421 			/* Partial update the content of header private. */
422 			pfwheader = firmware->pfwheader;
423 			pfw_priv = &pfwheader->fwpriv;
424 			_rtl92s_firmwareheader_priveupdate(hw, pfw_priv);
425 			puc_mappedfile = (u8 *)(firmware->pfwheader) +
426 					RT_8192S_FIRMWARE_HDR_EXCLUDE_PRI_SIZE;
427 			ul_filelength = fwhdr_size -
428 					RT_8192S_FIRMWARE_HDR_EXCLUDE_PRI_SIZE;
429 			break;
430 		default:
431 			RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
432 				 "Unexpected Download step!!\n");
433 			goto fail;
434 		}
435 
436 		/* <2> Download image file */
437 		rtstatus = _rtl92s_firmware_downloadcode(hw, puc_mappedfile,
438 				ul_filelength);
439 
440 		if (!rtstatus) {
441 			RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "fail!\n");
442 			goto fail;
443 		}
444 
445 		/* <3> Check whether load FW process is ready */
446 		rtstatus = _rtl92s_firmware_checkready(hw, fwstatus);
447 		if (!rtstatus) {
448 			RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "fail!\n");
449 			goto fail;
450 		}
451 
452 		fwstatus = _rtl92s_firmware_get_nextstatus(firmware->fwstatus);
453 	}
454 
455 	return rtstatus;
456 fail:
457 	return 0;
458 }
459 
460 static u32 _rtl92s_fill_h2c_cmd(struct sk_buff *skb, u32 h2cbufferlen,
461 				u32 cmd_num, u32 *pelement_id, u32 *pcmd_len,
462 				u8 **pcmb_buffer, u8 *cmd_start_seq)
463 {
464 	u32 totallen = 0, len = 0, tx_desclen = 0;
465 	u32 pre_continueoffset = 0;
466 	u8 *ph2c_buffer;
467 	u8 i = 0;
468 
469 	do {
470 		/* 8 - Byte aligment */
471 		len = H2C_TX_CMD_HDR_LEN + N_BYTE_ALIGMENT(pcmd_len[i], 8);
472 
473 		/* Buffer length is not enough */
474 		if (h2cbufferlen < totallen + len + tx_desclen)
475 			break;
476 
477 		/* Clear content */
478 		ph2c_buffer = (u8 *)skb_put(skb, (u32)len);
479 		memset((ph2c_buffer + totallen + tx_desclen), 0, len);
480 
481 		/* CMD len */
482 		SET_BITS_TO_LE_4BYTE((ph2c_buffer + totallen + tx_desclen),
483 				      0, 16, pcmd_len[i]);
484 
485 		/* CMD ID */
486 		SET_BITS_TO_LE_4BYTE((ph2c_buffer + totallen + tx_desclen),
487 				      16, 8, pelement_id[i]);
488 
489 		/* CMD Sequence */
490 		*cmd_start_seq = *cmd_start_seq % 0x80;
491 		SET_BITS_TO_LE_4BYTE((ph2c_buffer + totallen + tx_desclen),
492 				      24, 7, *cmd_start_seq);
493 		++*cmd_start_seq;
494 
495 		/* Copy memory */
496 		memcpy((ph2c_buffer + totallen + tx_desclen +
497 			H2C_TX_CMD_HDR_LEN), pcmb_buffer[i], pcmd_len[i]);
498 
499 		/* CMD continue */
500 		/* set the continue in prevoius cmd. */
501 		if (i < cmd_num - 1)
502 			SET_BITS_TO_LE_4BYTE((ph2c_buffer + pre_continueoffset),
503 					      31, 1, 1);
504 
505 		pre_continueoffset = totallen;
506 
507 		totallen += len;
508 	} while (++i < cmd_num);
509 
510 	return totallen;
511 }
512 
513 static u32 _rtl92s_get_h2c_cmdlen(u32 h2cbufferlen, u32 cmd_num, u32 *pcmd_len)
514 {
515 	u32 totallen = 0, len = 0, tx_desclen = 0;
516 	u8 i = 0;
517 
518 	do {
519 		/* 8 - Byte aligment */
520 		len = H2C_TX_CMD_HDR_LEN + N_BYTE_ALIGMENT(pcmd_len[i], 8);
521 
522 		/* Buffer length is not enough */
523 		if (h2cbufferlen < totallen + len + tx_desclen)
524 			break;
525 
526 		totallen += len;
527 	} while (++i < cmd_num);
528 
529 	return totallen + tx_desclen;
530 }
531 
532 static bool _rtl92s_firmware_set_h2c_cmd(struct ieee80211_hw *hw, u8 h2c_cmd,
533 					 u8 *pcmd_buffer)
534 {
535 	struct rtl_priv *rtlpriv = rtl_priv(hw);
536 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
537 	struct rtl_tcb_desc *cb_desc;
538 	struct sk_buff *skb;
539 	u32	element_id = 0;
540 	u32	cmd_len = 0;
541 	u32	len;
542 
543 	switch (h2c_cmd) {
544 	case FW_H2C_SETPWRMODE:
545 		element_id = H2C_SETPWRMODE_CMD ;
546 		cmd_len = sizeof(struct h2c_set_pwrmode_parm);
547 		break;
548 	case FW_H2C_JOINBSSRPT:
549 		element_id = H2C_JOINBSSRPT_CMD;
550 		cmd_len = sizeof(struct h2c_joinbss_rpt_parm);
551 		break;
552 	case FW_H2C_WOWLAN_UPDATE_GTK:
553 		element_id = H2C_WOWLAN_UPDATE_GTK_CMD;
554 		cmd_len = sizeof(struct h2c_wpa_two_way_parm);
555 		break;
556 	case FW_H2C_WOWLAN_UPDATE_IV:
557 		element_id = H2C_WOWLAN_UPDATE_IV_CMD;
558 		cmd_len = sizeof(unsigned long long);
559 		break;
560 	case FW_H2C_WOWLAN_OFFLOAD:
561 		element_id = H2C_WOWLAN_FW_OFFLOAD;
562 		cmd_len = sizeof(u8);
563 		break;
564 	default:
565 		break;
566 	}
567 
568 	len = _rtl92s_get_h2c_cmdlen(MAX_TRANSMIT_BUFFER_SIZE, 1, &cmd_len);
569 	skb = dev_alloc_skb(len);
570 	if (!skb)
571 		return false;
572 	cb_desc = (struct rtl_tcb_desc *)(skb->cb);
573 	cb_desc->queue_index = TXCMD_QUEUE;
574 	cb_desc->cmd_or_init = DESC_PACKET_TYPE_NORMAL;
575 	cb_desc->last_inipkt = false;
576 
577 	_rtl92s_fill_h2c_cmd(skb, MAX_TRANSMIT_BUFFER_SIZE, 1, &element_id,
578 			&cmd_len, &pcmd_buffer,	&rtlhal->h2c_txcmd_seq);
579 	_rtl92s_cmd_send_packet(hw, skb, false);
580 	rtlpriv->cfg->ops->tx_polling(hw, TXCMD_QUEUE);
581 
582 	return true;
583 }
584 
585 void rtl92s_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 Mode)
586 {
587 	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
588 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
589 	struct h2c_set_pwrmode_parm	pwrmode;
590 	u16 max_wakeup_period = 0;
591 
592 	pwrmode.mode = Mode;
593 	pwrmode.flag_low_traffic_en = 0;
594 	pwrmode.flag_lpnav_en = 0;
595 	pwrmode.flag_rf_low_snr_en = 0;
596 	pwrmode.flag_dps_en = 0;
597 	pwrmode.bcn_rx_en = 0;
598 	pwrmode.bcn_to = 0;
599 	SET_BITS_TO_LE_2BYTE((u8 *)(&pwrmode) + 8, 0, 16,
600 			mac->vif->bss_conf.beacon_int);
601 	pwrmode.app_itv = 0;
602 	pwrmode.awake_bcn_itvl = ppsc->reg_max_lps_awakeintvl;
603 	pwrmode.smart_ps = 1;
604 	pwrmode.bcn_pass_period = 10;
605 
606 	/* Set beacon pass count */
607 	if (pwrmode.mode == FW_PS_MIN_MODE)
608 		max_wakeup_period = mac->vif->bss_conf.beacon_int;
609 	else if (pwrmode.mode == FW_PS_MAX_MODE)
610 		max_wakeup_period = mac->vif->bss_conf.beacon_int *
611 			mac->vif->bss_conf.dtim_period;
612 
613 	if (max_wakeup_period >= 500)
614 		pwrmode.bcn_pass_cnt = 1;
615 	else if ((max_wakeup_period >= 300) && (max_wakeup_period < 500))
616 		pwrmode.bcn_pass_cnt = 2;
617 	else if ((max_wakeup_period >= 200) && (max_wakeup_period < 300))
618 		pwrmode.bcn_pass_cnt = 3;
619 	else if ((max_wakeup_period >= 20) && (max_wakeup_period < 200))
620 		pwrmode.bcn_pass_cnt = 5;
621 	else
622 		pwrmode.bcn_pass_cnt = 1;
623 
624 	_rtl92s_firmware_set_h2c_cmd(hw, FW_H2C_SETPWRMODE, (u8 *)&pwrmode);
625 
626 }
627 
628 void rtl92s_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw,
629 		u8 mstatus, u8 ps_qosinfo)
630 {
631 	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
632 	struct h2c_joinbss_rpt_parm joinbss_rpt;
633 
634 	joinbss_rpt.opmode = mstatus;
635 	joinbss_rpt.ps_qos_info = ps_qosinfo;
636 	joinbss_rpt.bssid[0] = mac->bssid[0];
637 	joinbss_rpt.bssid[1] = mac->bssid[1];
638 	joinbss_rpt.bssid[2] = mac->bssid[2];
639 	joinbss_rpt.bssid[3] = mac->bssid[3];
640 	joinbss_rpt.bssid[4] = mac->bssid[4];
641 	joinbss_rpt.bssid[5] = mac->bssid[5];
642 	SET_BITS_TO_LE_2BYTE((u8 *)(&joinbss_rpt) + 8, 0, 16,
643 			mac->vif->bss_conf.beacon_int);
644 	SET_BITS_TO_LE_2BYTE((u8 *)(&joinbss_rpt) + 10, 0, 16, mac->assoc_id);
645 
646 	_rtl92s_firmware_set_h2c_cmd(hw, FW_H2C_JOINBSSRPT, (u8 *)&joinbss_rpt);
647 }
648 
649