1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /* Copyright(c) 2018-2019  Realtek Corporation
3  */
4 
5 #include <linux/iopoll.h>
6 
7 #include "main.h"
8 #include "coex.h"
9 #include "fw.h"
10 #include "tx.h"
11 #include "reg.h"
12 #include "sec.h"
13 #include "debug.h"
14 #include "util.h"
15 #include "wow.h"
16 #include "ps.h"
17 #include "phy.h"
18 #include "mac.h"
19 
20 static void rtw_fw_c2h_cmd_handle_ext(struct rtw_dev *rtwdev,
21 				      struct sk_buff *skb)
22 {
23 	struct rtw_c2h_cmd *c2h;
24 	u8 sub_cmd_id;
25 
26 	c2h = get_c2h_from_skb(skb);
27 	sub_cmd_id = c2h->payload[0];
28 
29 	switch (sub_cmd_id) {
30 	case C2H_CCX_RPT:
31 		rtw_tx_report_handle(rtwdev, skb, C2H_CCX_RPT);
32 		break;
33 	case C2H_SCAN_STATUS_RPT:
34 		rtw_hw_scan_status_report(rtwdev, skb);
35 		break;
36 	case C2H_CHAN_SWITCH:
37 		rtw_hw_scan_chan_switch(rtwdev, skb);
38 		break;
39 	default:
40 		break;
41 	}
42 }
43 
44 static u16 get_max_amsdu_len(u32 bit_rate)
45 {
46 	/* lower than ofdm, do not aggregate */
47 	if (bit_rate < 550)
48 		return 1;
49 
50 	/* lower than 20M 2ss mcs8, make it small */
51 	if (bit_rate < 1800)
52 		return 1200;
53 
54 	/* lower than 40M 2ss mcs9, make it medium */
55 	if (bit_rate < 4000)
56 		return 2600;
57 
58 	/* not yet 80M 2ss mcs8/9, make it twice regular packet size */
59 	if (bit_rate < 7000)
60 		return 3500;
61 
62 	/* unlimited */
63 	return 0;
64 }
65 
66 struct rtw_fw_iter_ra_data {
67 	struct rtw_dev *rtwdev;
68 	u8 *payload;
69 };
70 
71 static void rtw_fw_ra_report_iter(void *data, struct ieee80211_sta *sta)
72 {
73 	struct rtw_fw_iter_ra_data *ra_data = data;
74 	struct rtw_sta_info *si = (struct rtw_sta_info *)sta->drv_priv;
75 	u8 mac_id, rate, sgi, bw;
76 	u8 mcs, nss;
77 	u32 bit_rate;
78 
79 	mac_id = GET_RA_REPORT_MACID(ra_data->payload);
80 	if (si->mac_id != mac_id)
81 		return;
82 
83 	si->ra_report.txrate.flags = 0;
84 
85 	rate = GET_RA_REPORT_RATE(ra_data->payload);
86 	sgi = GET_RA_REPORT_SGI(ra_data->payload);
87 	bw = GET_RA_REPORT_BW(ra_data->payload);
88 
89 	if (rate < DESC_RATEMCS0) {
90 		si->ra_report.txrate.legacy = rtw_desc_to_bitrate(rate);
91 		goto legacy;
92 	}
93 
94 	rtw_desc_to_mcsrate(rate, &mcs, &nss);
95 	if (rate >= DESC_RATEVHT1SS_MCS0)
96 		si->ra_report.txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
97 	else if (rate >= DESC_RATEMCS0)
98 		si->ra_report.txrate.flags |= RATE_INFO_FLAGS_MCS;
99 
100 	if (rate >= DESC_RATEMCS0) {
101 		si->ra_report.txrate.mcs = mcs;
102 		si->ra_report.txrate.nss = nss;
103 	}
104 
105 	if (sgi)
106 		si->ra_report.txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
107 
108 	if (bw == RTW_CHANNEL_WIDTH_80)
109 		si->ra_report.txrate.bw = RATE_INFO_BW_80;
110 	else if (bw == RTW_CHANNEL_WIDTH_40)
111 		si->ra_report.txrate.bw = RATE_INFO_BW_40;
112 	else
113 		si->ra_report.txrate.bw = RATE_INFO_BW_20;
114 
115 legacy:
116 	bit_rate = cfg80211_calculate_bitrate(&si->ra_report.txrate);
117 
118 	si->ra_report.desc_rate = rate;
119 	si->ra_report.bit_rate = bit_rate;
120 
121 	sta->deflink.agg.max_rc_amsdu_len = get_max_amsdu_len(bit_rate);
122 }
123 
124 static void rtw_fw_ra_report_handle(struct rtw_dev *rtwdev, u8 *payload,
125 				    u8 length)
126 {
127 	struct rtw_fw_iter_ra_data ra_data;
128 
129 	if (WARN(length < 7, "invalid ra report c2h length\n"))
130 		return;
131 
132 	rtwdev->dm_info.tx_rate = GET_RA_REPORT_RATE(payload);
133 	ra_data.rtwdev = rtwdev;
134 	ra_data.payload = payload;
135 	rtw_iterate_stas_atomic(rtwdev, rtw_fw_ra_report_iter, &ra_data);
136 }
137 
138 struct rtw_beacon_filter_iter_data {
139 	struct rtw_dev *rtwdev;
140 	u8 *payload;
141 };
142 
143 static void rtw_fw_bcn_filter_notify_vif_iter(void *data, u8 *mac,
144 					      struct ieee80211_vif *vif)
145 {
146 	struct rtw_beacon_filter_iter_data *iter_data = data;
147 	struct rtw_dev *rtwdev = iter_data->rtwdev;
148 	u8 *payload = iter_data->payload;
149 	u8 type = GET_BCN_FILTER_NOTIFY_TYPE(payload);
150 	u8 event = GET_BCN_FILTER_NOTIFY_EVENT(payload);
151 	s8 sig = (s8)GET_BCN_FILTER_NOTIFY_RSSI(payload);
152 
153 	switch (type) {
154 	case BCN_FILTER_NOTIFY_SIGNAL_CHANGE:
155 		event = event ? NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH :
156 			NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW;
157 		ieee80211_cqm_rssi_notify(vif, event, sig, GFP_KERNEL);
158 		break;
159 	case BCN_FILTER_CONNECTION_LOSS:
160 		ieee80211_connection_loss(vif);
161 		break;
162 	case BCN_FILTER_CONNECTED:
163 		rtwdev->beacon_loss = false;
164 		break;
165 	case BCN_FILTER_NOTIFY_BEACON_LOSS:
166 		rtwdev->beacon_loss = true;
167 		rtw_leave_lps(rtwdev);
168 		break;
169 	}
170 }
171 
172 static void rtw_fw_bcn_filter_notify(struct rtw_dev *rtwdev, u8 *payload,
173 				     u8 length)
174 {
175 	struct rtw_beacon_filter_iter_data dev_iter_data;
176 
177 	dev_iter_data.rtwdev = rtwdev;
178 	dev_iter_data.payload = payload;
179 	rtw_iterate_vifs(rtwdev, rtw_fw_bcn_filter_notify_vif_iter,
180 			 &dev_iter_data);
181 }
182 
183 static void rtw_fw_scan_result(struct rtw_dev *rtwdev, u8 *payload,
184 			       u8 length)
185 {
186 	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
187 
188 	dm_info->scan_density = payload[0];
189 
190 	rtw_dbg(rtwdev, RTW_DBG_FW, "scan.density = %x\n",
191 		dm_info->scan_density);
192 }
193 
194 static void rtw_fw_adaptivity_result(struct rtw_dev *rtwdev, u8 *payload,
195 				     u8 length)
196 {
197 	struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
198 	struct rtw_c2h_adaptivity *result = (struct rtw_c2h_adaptivity *)payload;
199 
200 	rtw_dbg(rtwdev, RTW_DBG_ADAPTIVITY,
201 		"Adaptivity: density %x igi %x l2h_th_init %x l2h %x h2l %x option %x\n",
202 		result->density, result->igi, result->l2h_th_init, result->l2h,
203 		result->h2l, result->option);
204 
205 	rtw_dbg(rtwdev, RTW_DBG_ADAPTIVITY, "Reg Setting: L2H %x H2L %x\n",
206 		rtw_read32_mask(rtwdev, edcca_th[EDCCA_TH_L2H_IDX].hw_reg.addr,
207 				edcca_th[EDCCA_TH_L2H_IDX].hw_reg.mask),
208 		rtw_read32_mask(rtwdev, edcca_th[EDCCA_TH_H2L_IDX].hw_reg.addr,
209 				edcca_th[EDCCA_TH_H2L_IDX].hw_reg.mask));
210 
211 	rtw_dbg(rtwdev, RTW_DBG_ADAPTIVITY, "EDCCA Flag %s\n",
212 		rtw_read32_mask(rtwdev, REG_EDCCA_REPORT, BIT_EDCCA_FLAG) ?
213 		"Set" : "Unset");
214 }
215 
216 void rtw_fw_c2h_cmd_handle(struct rtw_dev *rtwdev, struct sk_buff *skb)
217 {
218 	struct rtw_c2h_cmd *c2h;
219 	u32 pkt_offset;
220 	u8 len;
221 
222 	pkt_offset = *((u32 *)skb->cb);
223 	c2h = (struct rtw_c2h_cmd *)(skb->data + pkt_offset);
224 	len = skb->len - pkt_offset - 2;
225 
226 	mutex_lock(&rtwdev->mutex);
227 
228 	if (!test_bit(RTW_FLAG_RUNNING, rtwdev->flags))
229 		goto unlock;
230 
231 	switch (c2h->id) {
232 	case C2H_CCX_TX_RPT:
233 		rtw_tx_report_handle(rtwdev, skb, C2H_CCX_TX_RPT);
234 		break;
235 	case C2H_BT_INFO:
236 		rtw_coex_bt_info_notify(rtwdev, c2h->payload, len);
237 		break;
238 	case C2H_BT_HID_INFO:
239 		rtw_coex_bt_hid_info_notify(rtwdev, c2h->payload, len);
240 		break;
241 	case C2H_WLAN_INFO:
242 		rtw_coex_wl_fwdbginfo_notify(rtwdev, c2h->payload, len);
243 		break;
244 	case C2H_BCN_FILTER_NOTIFY:
245 		rtw_fw_bcn_filter_notify(rtwdev, c2h->payload, len);
246 		break;
247 	case C2H_HALMAC:
248 		rtw_fw_c2h_cmd_handle_ext(rtwdev, skb);
249 		break;
250 	case C2H_RA_RPT:
251 		rtw_fw_ra_report_handle(rtwdev, c2h->payload, len);
252 		break;
253 	default:
254 		rtw_dbg(rtwdev, RTW_DBG_FW, "C2H 0x%x isn't handled\n", c2h->id);
255 		break;
256 	}
257 
258 unlock:
259 	mutex_unlock(&rtwdev->mutex);
260 }
261 
262 void rtw_fw_c2h_cmd_rx_irqsafe(struct rtw_dev *rtwdev, u32 pkt_offset,
263 			       struct sk_buff *skb)
264 {
265 	struct rtw_c2h_cmd *c2h;
266 	u8 len;
267 
268 	c2h = (struct rtw_c2h_cmd *)(skb->data + pkt_offset);
269 	len = skb->len - pkt_offset - 2;
270 	*((u32 *)skb->cb) = pkt_offset;
271 
272 	rtw_dbg(rtwdev, RTW_DBG_FW, "recv C2H, id=0x%02x, seq=0x%02x, len=%d\n",
273 		c2h->id, c2h->seq, len);
274 
275 	switch (c2h->id) {
276 	case C2H_BT_MP_INFO:
277 		rtw_coex_info_response(rtwdev, skb);
278 		break;
279 	case C2H_WLAN_RFON:
280 		complete(&rtwdev->lps_leave_check);
281 		dev_kfree_skb_any(skb);
282 		break;
283 	case C2H_SCAN_RESULT:
284 		complete(&rtwdev->fw_scan_density);
285 		rtw_fw_scan_result(rtwdev, c2h->payload, len);
286 		dev_kfree_skb_any(skb);
287 		break;
288 	case C2H_ADAPTIVITY:
289 		rtw_fw_adaptivity_result(rtwdev, c2h->payload, len);
290 		dev_kfree_skb_any(skb);
291 		break;
292 	default:
293 		/* pass offset for further operation */
294 		*((u32 *)skb->cb) = pkt_offset;
295 		skb_queue_tail(&rtwdev->c2h_queue, skb);
296 		ieee80211_queue_work(rtwdev->hw, &rtwdev->c2h_work);
297 		break;
298 	}
299 }
300 EXPORT_SYMBOL(rtw_fw_c2h_cmd_rx_irqsafe);
301 
302 void rtw_fw_c2h_cmd_isr(struct rtw_dev *rtwdev)
303 {
304 	if (rtw_read8(rtwdev, REG_MCU_TST_CFG) == VAL_FW_TRIGGER)
305 		rtw_fw_recovery(rtwdev);
306 	else
307 		rtw_warn(rtwdev, "unhandled firmware c2h interrupt\n");
308 }
309 EXPORT_SYMBOL(rtw_fw_c2h_cmd_isr);
310 
311 static void rtw_fw_send_h2c_command(struct rtw_dev *rtwdev,
312 				    u8 *h2c)
313 {
314 	u8 box;
315 	u8 box_state;
316 	u32 box_reg, box_ex_reg;
317 	int idx;
318 	int ret;
319 
320 	rtw_dbg(rtwdev, RTW_DBG_FW,
321 		"send H2C content %02x%02x%02x%02x %02x%02x%02x%02x\n",
322 		h2c[3], h2c[2], h2c[1], h2c[0],
323 		h2c[7], h2c[6], h2c[5], h2c[4]);
324 
325 	spin_lock(&rtwdev->h2c.lock);
326 
327 	box = rtwdev->h2c.last_box_num;
328 	switch (box) {
329 	case 0:
330 		box_reg = REG_HMEBOX0;
331 		box_ex_reg = REG_HMEBOX0_EX;
332 		break;
333 	case 1:
334 		box_reg = REG_HMEBOX1;
335 		box_ex_reg = REG_HMEBOX1_EX;
336 		break;
337 	case 2:
338 		box_reg = REG_HMEBOX2;
339 		box_ex_reg = REG_HMEBOX2_EX;
340 		break;
341 	case 3:
342 		box_reg = REG_HMEBOX3;
343 		box_ex_reg = REG_HMEBOX3_EX;
344 		break;
345 	default:
346 		WARN(1, "invalid h2c mail box number\n");
347 		goto out;
348 	}
349 
350 	ret = read_poll_timeout_atomic(rtw_read8, box_state,
351 				       !((box_state >> box) & 0x1), 100, 3000,
352 				       false, rtwdev, REG_HMETFR);
353 
354 	if (ret) {
355 		rtw_err(rtwdev, "failed to send h2c command\n");
356 		goto out;
357 	}
358 
359 	for (idx = 0; idx < 4; idx++)
360 		rtw_write8(rtwdev, box_reg + idx, h2c[idx]);
361 	for (idx = 0; idx < 4; idx++)
362 		rtw_write8(rtwdev, box_ex_reg + idx, h2c[idx + 4]);
363 
364 	if (++rtwdev->h2c.last_box_num >= 4)
365 		rtwdev->h2c.last_box_num = 0;
366 
367 out:
368 	spin_unlock(&rtwdev->h2c.lock);
369 }
370 
371 void rtw_fw_h2c_cmd_dbg(struct rtw_dev *rtwdev, u8 *h2c)
372 {
373 	rtw_fw_send_h2c_command(rtwdev, h2c);
374 }
375 
376 static void rtw_fw_send_h2c_packet(struct rtw_dev *rtwdev, u8 *h2c_pkt)
377 {
378 	int ret;
379 
380 	spin_lock(&rtwdev->h2c.lock);
381 
382 	FW_OFFLOAD_H2C_SET_SEQ_NUM(h2c_pkt, rtwdev->h2c.seq);
383 	ret = rtw_hci_write_data_h2c(rtwdev, h2c_pkt, H2C_PKT_SIZE);
384 	if (ret)
385 		rtw_err(rtwdev, "failed to send h2c packet\n");
386 	rtwdev->h2c.seq++;
387 
388 	spin_unlock(&rtwdev->h2c.lock);
389 }
390 
391 void
392 rtw_fw_send_general_info(struct rtw_dev *rtwdev)
393 {
394 	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
395 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
396 	u16 total_size = H2C_PKT_HDR_SIZE + 4;
397 
398 	if (rtw_chip_wcpu_11n(rtwdev))
399 		return;
400 
401 	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_GENERAL_INFO);
402 
403 	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
404 
405 	GENERAL_INFO_SET_FW_TX_BOUNDARY(h2c_pkt,
406 					fifo->rsvd_fw_txbuf_addr -
407 					fifo->rsvd_boundary);
408 
409 	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
410 }
411 
412 void
413 rtw_fw_send_phydm_info(struct rtw_dev *rtwdev)
414 {
415 	struct rtw_hal *hal = &rtwdev->hal;
416 	struct rtw_efuse *efuse = &rtwdev->efuse;
417 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
418 	u16 total_size = H2C_PKT_HDR_SIZE + 8;
419 	u8 fw_rf_type = 0;
420 
421 	if (rtw_chip_wcpu_11n(rtwdev))
422 		return;
423 
424 	if (hal->rf_type == RF_1T1R)
425 		fw_rf_type = FW_RF_1T1R;
426 	else if (hal->rf_type == RF_2T2R)
427 		fw_rf_type = FW_RF_2T2R;
428 
429 	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_PHYDM_INFO);
430 
431 	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
432 	PHYDM_INFO_SET_REF_TYPE(h2c_pkt, efuse->rfe_option);
433 	PHYDM_INFO_SET_RF_TYPE(h2c_pkt, fw_rf_type);
434 	PHYDM_INFO_SET_CUT_VER(h2c_pkt, hal->cut_version);
435 	PHYDM_INFO_SET_RX_ANT_STATUS(h2c_pkt, hal->antenna_tx);
436 	PHYDM_INFO_SET_TX_ANT_STATUS(h2c_pkt, hal->antenna_rx);
437 
438 	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
439 }
440 
441 void rtw_fw_do_iqk(struct rtw_dev *rtwdev, struct rtw_iqk_para *para)
442 {
443 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
444 	u16 total_size = H2C_PKT_HDR_SIZE + 1;
445 
446 	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_IQK);
447 	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
448 	IQK_SET_CLEAR(h2c_pkt, para->clear);
449 	IQK_SET_SEGMENT_IQK(h2c_pkt, para->segment_iqk);
450 
451 	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
452 }
453 EXPORT_SYMBOL(rtw_fw_do_iqk);
454 
455 void rtw_fw_inform_rfk_status(struct rtw_dev *rtwdev, bool start)
456 {
457 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
458 
459 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_WIFI_CALIBRATION);
460 
461 	RFK_SET_INFORM_START(h2c_pkt, start);
462 
463 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
464 }
465 EXPORT_SYMBOL(rtw_fw_inform_rfk_status);
466 
467 void rtw_fw_query_bt_info(struct rtw_dev *rtwdev)
468 {
469 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
470 
471 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_QUERY_BT_INFO);
472 
473 	SET_QUERY_BT_INFO(h2c_pkt, true);
474 
475 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
476 }
477 
478 void rtw_fw_wl_ch_info(struct rtw_dev *rtwdev, u8 link, u8 ch, u8 bw)
479 {
480 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
481 
482 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_WL_CH_INFO);
483 
484 	SET_WL_CH_INFO_LINK(h2c_pkt, link);
485 	SET_WL_CH_INFO_CHNL(h2c_pkt, ch);
486 	SET_WL_CH_INFO_BW(h2c_pkt, bw);
487 
488 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
489 }
490 
491 void rtw_fw_query_bt_mp_info(struct rtw_dev *rtwdev,
492 			     struct rtw_coex_info_req *req)
493 {
494 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
495 
496 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_QUERY_BT_MP_INFO);
497 
498 	SET_BT_MP_INFO_SEQ(h2c_pkt, req->seq);
499 	SET_BT_MP_INFO_OP_CODE(h2c_pkt, req->op_code);
500 	SET_BT_MP_INFO_PARA1(h2c_pkt, req->para1);
501 	SET_BT_MP_INFO_PARA2(h2c_pkt, req->para2);
502 	SET_BT_MP_INFO_PARA3(h2c_pkt, req->para3);
503 
504 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
505 }
506 
507 void rtw_fw_force_bt_tx_power(struct rtw_dev *rtwdev, u8 bt_pwr_dec_lvl)
508 {
509 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
510 	u8 index = 0 - bt_pwr_dec_lvl;
511 
512 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_FORCE_BT_TX_POWER);
513 
514 	SET_BT_TX_POWER_INDEX(h2c_pkt, index);
515 
516 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
517 }
518 
519 void rtw_fw_bt_ignore_wlan_action(struct rtw_dev *rtwdev, bool enable)
520 {
521 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
522 
523 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_IGNORE_WLAN_ACTION);
524 
525 	SET_IGNORE_WLAN_ACTION_EN(h2c_pkt, enable);
526 
527 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
528 }
529 
530 void rtw_fw_coex_tdma_type(struct rtw_dev *rtwdev,
531 			   u8 para1, u8 para2, u8 para3, u8 para4, u8 para5)
532 {
533 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
534 
535 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_COEX_TDMA_TYPE);
536 
537 	SET_COEX_TDMA_TYPE_PARA1(h2c_pkt, para1);
538 	SET_COEX_TDMA_TYPE_PARA2(h2c_pkt, para2);
539 	SET_COEX_TDMA_TYPE_PARA3(h2c_pkt, para3);
540 	SET_COEX_TDMA_TYPE_PARA4(h2c_pkt, para4);
541 	SET_COEX_TDMA_TYPE_PARA5(h2c_pkt, para5);
542 
543 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
544 }
545 
546 void rtw_fw_coex_query_hid_info(struct rtw_dev *rtwdev, u8 sub_id, u8 data)
547 {
548 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
549 
550 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_QUERY_BT_HID_INFO);
551 
552 	SET_COEX_QUERY_HID_INFO_SUBID(h2c_pkt, sub_id);
553 	SET_COEX_QUERY_HID_INFO_DATA1(h2c_pkt, data);
554 
555 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
556 }
557 
558 void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
559 {
560 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
561 
562 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_BT_WIFI_CONTROL);
563 
564 	SET_BT_WIFI_CONTROL_OP_CODE(h2c_pkt, op_code);
565 
566 	SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
567 	SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
568 	SET_BT_WIFI_CONTROL_DATA3(h2c_pkt, *(data + 2));
569 	SET_BT_WIFI_CONTROL_DATA4(h2c_pkt, *(data + 3));
570 	SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));
571 
572 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
573 }
574 
575 void rtw_fw_send_rssi_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
576 {
577 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
578 	u8 rssi = ewma_rssi_read(&si->avg_rssi);
579 	bool stbc_en = si->stbc_en ? true : false;
580 
581 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RSSI_MONITOR);
582 
583 	SET_RSSI_INFO_MACID(h2c_pkt, si->mac_id);
584 	SET_RSSI_INFO_RSSI(h2c_pkt, rssi);
585 	SET_RSSI_INFO_STBC(h2c_pkt, stbc_en);
586 
587 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
588 }
589 
590 void rtw_fw_send_ra_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si,
591 			 bool reset_ra_mask)
592 {
593 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
594 	bool disable_pt = true;
595 
596 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RA_INFO);
597 
598 	SET_RA_INFO_MACID(h2c_pkt, si->mac_id);
599 	SET_RA_INFO_RATE_ID(h2c_pkt, si->rate_id);
600 	SET_RA_INFO_INIT_RA_LVL(h2c_pkt, si->init_ra_lv);
601 	SET_RA_INFO_SGI_EN(h2c_pkt, si->sgi_enable);
602 	SET_RA_INFO_BW_MODE(h2c_pkt, si->bw_mode);
603 	SET_RA_INFO_LDPC(h2c_pkt, !!si->ldpc_en);
604 	SET_RA_INFO_NO_UPDATE(h2c_pkt, !reset_ra_mask);
605 	SET_RA_INFO_VHT_EN(h2c_pkt, si->vht_enable);
606 	SET_RA_INFO_DIS_PT(h2c_pkt, disable_pt);
607 	SET_RA_INFO_RA_MASK0(h2c_pkt, (si->ra_mask & 0xff));
608 	SET_RA_INFO_RA_MASK1(h2c_pkt, (si->ra_mask & 0xff00) >> 8);
609 	SET_RA_INFO_RA_MASK2(h2c_pkt, (si->ra_mask & 0xff0000) >> 16);
610 	SET_RA_INFO_RA_MASK3(h2c_pkt, (si->ra_mask & 0xff000000) >> 24);
611 
612 	si->init_ra_lv = 0;
613 
614 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
615 }
616 
617 void rtw_fw_media_status_report(struct rtw_dev *rtwdev, u8 mac_id, bool connect)
618 {
619 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
620 
621 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_MEDIA_STATUS_RPT);
622 	MEDIA_STATUS_RPT_SET_OP_MODE(h2c_pkt, connect);
623 	MEDIA_STATUS_RPT_SET_MACID(h2c_pkt, mac_id);
624 
625 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
626 }
627 
628 void rtw_fw_update_wl_phy_info(struct rtw_dev *rtwdev)
629 {
630 	struct rtw_traffic_stats *stats = &rtwdev->stats;
631 	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
632 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
633 
634 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_WL_PHY_INFO);
635 	SET_WL_PHY_INFO_TX_TP(h2c_pkt, stats->tx_throughput);
636 	SET_WL_PHY_INFO_RX_TP(h2c_pkt, stats->rx_throughput);
637 	SET_WL_PHY_INFO_TX_RATE_DESC(h2c_pkt, dm_info->tx_rate);
638 	SET_WL_PHY_INFO_RX_RATE_DESC(h2c_pkt, dm_info->curr_rx_rate);
639 	SET_WL_PHY_INFO_RX_EVM(h2c_pkt, dm_info->rx_evm_dbm[RF_PATH_A]);
640 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
641 }
642 
643 void rtw_fw_beacon_filter_config(struct rtw_dev *rtwdev, bool connect,
644 				 struct ieee80211_vif *vif)
645 {
646 	struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
647 	struct ieee80211_sta *sta = ieee80211_find_sta(vif, bss_conf->bssid);
648 	static const u8 rssi_min = 0, rssi_max = 100, rssi_offset = 100;
649 	struct rtw_sta_info *si =
650 		sta ? (struct rtw_sta_info *)sta->drv_priv : NULL;
651 	s32 threshold = bss_conf->cqm_rssi_thold + rssi_offset;
652 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
653 
654 	if (!rtw_fw_feature_check(&rtwdev->fw, FW_FEATURE_BCN_FILTER))
655 		return;
656 
657 	if (!connect) {
658 		SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_BCN_FILTER_OFFLOAD_P1);
659 		SET_BCN_FILTER_OFFLOAD_P1_ENABLE(h2c_pkt, connect);
660 		rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
661 
662 		return;
663 	}
664 
665 	if (!si)
666 		return;
667 
668 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_BCN_FILTER_OFFLOAD_P0);
669 	ether_addr_copy(&h2c_pkt[1], bss_conf->bssid);
670 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
671 
672 	memset(h2c_pkt, 0, sizeof(h2c_pkt));
673 	threshold = clamp_t(s32, threshold, rssi_min, rssi_max);
674 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_BCN_FILTER_OFFLOAD_P1);
675 	SET_BCN_FILTER_OFFLOAD_P1_ENABLE(h2c_pkt, connect);
676 	SET_BCN_FILTER_OFFLOAD_P1_OFFLOAD_MODE(h2c_pkt,
677 					       BCN_FILTER_OFFLOAD_MODE_DEFAULT);
678 	SET_BCN_FILTER_OFFLOAD_P1_THRESHOLD(h2c_pkt, (u8)threshold);
679 	SET_BCN_FILTER_OFFLOAD_P1_BCN_LOSS_CNT(h2c_pkt, BCN_LOSS_CNT);
680 	SET_BCN_FILTER_OFFLOAD_P1_MACID(h2c_pkt, si->mac_id);
681 	SET_BCN_FILTER_OFFLOAD_P1_HYST(h2c_pkt, bss_conf->cqm_rssi_hyst);
682 	SET_BCN_FILTER_OFFLOAD_P1_BCN_INTERVAL(h2c_pkt, bss_conf->beacon_int);
683 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
684 }
685 
686 void rtw_fw_set_pwr_mode(struct rtw_dev *rtwdev)
687 {
688 	struct rtw_lps_conf *conf = &rtwdev->lps_conf;
689 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
690 
691 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_SET_PWR_MODE);
692 
693 	SET_PWR_MODE_SET_MODE(h2c_pkt, conf->mode);
694 	SET_PWR_MODE_SET_RLBM(h2c_pkt, conf->rlbm);
695 	SET_PWR_MODE_SET_SMART_PS(h2c_pkt, conf->smart_ps);
696 	SET_PWR_MODE_SET_AWAKE_INTERVAL(h2c_pkt, conf->awake_interval);
697 	SET_PWR_MODE_SET_PORT_ID(h2c_pkt, conf->port_id);
698 	SET_PWR_MODE_SET_PWR_STATE(h2c_pkt, conf->state);
699 
700 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
701 }
702 
703 void rtw_fw_set_keep_alive_cmd(struct rtw_dev *rtwdev, bool enable)
704 {
705 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
706 	struct rtw_fw_wow_keep_alive_para mode = {
707 		.adopt = true,
708 		.pkt_type = KEEP_ALIVE_NULL_PKT,
709 		.period = 5,
710 	};
711 
712 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_KEEP_ALIVE);
713 	SET_KEEP_ALIVE_ENABLE(h2c_pkt, enable);
714 	SET_KEEP_ALIVE_ADOPT(h2c_pkt, mode.adopt);
715 	SET_KEEP_ALIVE_PKT_TYPE(h2c_pkt, mode.pkt_type);
716 	SET_KEEP_ALIVE_CHECK_PERIOD(h2c_pkt, mode.period);
717 
718 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
719 }
720 
721 void rtw_fw_set_disconnect_decision_cmd(struct rtw_dev *rtwdev, bool enable)
722 {
723 	struct rtw_wow_param *rtw_wow = &rtwdev->wow;
724 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
725 	struct rtw_fw_wow_disconnect_para mode = {
726 		.adopt = true,
727 		.period = 30,
728 		.retry_count = 5,
729 	};
730 
731 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_DISCONNECT_DECISION);
732 
733 	if (test_bit(RTW_WOW_FLAG_EN_DISCONNECT, rtw_wow->flags)) {
734 		SET_DISCONNECT_DECISION_ENABLE(h2c_pkt, enable);
735 		SET_DISCONNECT_DECISION_ADOPT(h2c_pkt, mode.adopt);
736 		SET_DISCONNECT_DECISION_CHECK_PERIOD(h2c_pkt, mode.period);
737 		SET_DISCONNECT_DECISION_TRY_PKT_NUM(h2c_pkt, mode.retry_count);
738 	}
739 
740 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
741 }
742 
743 void rtw_fw_set_wowlan_ctrl_cmd(struct rtw_dev *rtwdev, bool enable)
744 {
745 	struct rtw_wow_param *rtw_wow = &rtwdev->wow;
746 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
747 
748 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_WOWLAN);
749 
750 	SET_WOWLAN_FUNC_ENABLE(h2c_pkt, enable);
751 	if (rtw_wow_mgd_linked(rtwdev)) {
752 		if (test_bit(RTW_WOW_FLAG_EN_MAGIC_PKT, rtw_wow->flags))
753 			SET_WOWLAN_MAGIC_PKT_ENABLE(h2c_pkt, enable);
754 		if (test_bit(RTW_WOW_FLAG_EN_DISCONNECT, rtw_wow->flags))
755 			SET_WOWLAN_DEAUTH_WAKEUP_ENABLE(h2c_pkt, enable);
756 		if (test_bit(RTW_WOW_FLAG_EN_REKEY_PKT, rtw_wow->flags))
757 			SET_WOWLAN_REKEY_WAKEUP_ENABLE(h2c_pkt, enable);
758 		if (rtw_wow->pattern_cnt)
759 			SET_WOWLAN_PATTERN_MATCH_ENABLE(h2c_pkt, enable);
760 	}
761 
762 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
763 }
764 
765 void rtw_fw_set_aoac_global_info_cmd(struct rtw_dev *rtwdev,
766 				     u8 pairwise_key_enc,
767 				     u8 group_key_enc)
768 {
769 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
770 
771 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_AOAC_GLOBAL_INFO);
772 
773 	SET_AOAC_GLOBAL_INFO_PAIRWISE_ENC_ALG(h2c_pkt, pairwise_key_enc);
774 	SET_AOAC_GLOBAL_INFO_GROUP_ENC_ALG(h2c_pkt, group_key_enc);
775 
776 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
777 }
778 
779 void rtw_fw_set_remote_wake_ctrl_cmd(struct rtw_dev *rtwdev, bool enable)
780 {
781 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
782 
783 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_REMOTE_WAKE_CTRL);
784 
785 	SET_REMOTE_WAKECTRL_ENABLE(h2c_pkt, enable);
786 
787 	if (rtw_wow_no_link(rtwdev))
788 		SET_REMOTE_WAKE_CTRL_NLO_OFFLOAD_EN(h2c_pkt, enable);
789 
790 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
791 }
792 
793 static u8 rtw_get_rsvd_page_location(struct rtw_dev *rtwdev,
794 				     enum rtw_rsvd_packet_type type)
795 {
796 	struct rtw_rsvd_page *rsvd_pkt;
797 	u8 location = 0;
798 
799 	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
800 		if (type == rsvd_pkt->type)
801 			location = rsvd_pkt->page;
802 	}
803 
804 	return location;
805 }
806 
807 void rtw_fw_set_nlo_info(struct rtw_dev *rtwdev, bool enable)
808 {
809 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
810 	u8 loc_nlo;
811 
812 	loc_nlo = rtw_get_rsvd_page_location(rtwdev, RSVD_NLO_INFO);
813 
814 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_NLO_INFO);
815 
816 	SET_NLO_FUN_EN(h2c_pkt, enable);
817 	if (enable) {
818 		if (rtw_get_lps_deep_mode(rtwdev) != LPS_DEEP_MODE_NONE)
819 			SET_NLO_PS_32K(h2c_pkt, enable);
820 		SET_NLO_IGNORE_SECURITY(h2c_pkt, enable);
821 		SET_NLO_LOC_NLO_INFO(h2c_pkt, loc_nlo);
822 	}
823 
824 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
825 }
826 
827 void rtw_fw_set_pg_info(struct rtw_dev *rtwdev)
828 {
829 	struct rtw_lps_conf *conf = &rtwdev->lps_conf;
830 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
831 	u8 loc_pg, loc_dpk;
832 
833 	loc_pg = rtw_get_rsvd_page_location(rtwdev, RSVD_LPS_PG_INFO);
834 	loc_dpk = rtw_get_rsvd_page_location(rtwdev, RSVD_LPS_PG_DPK);
835 
836 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_LPS_PG_INFO);
837 
838 	LPS_PG_INFO_LOC(h2c_pkt, loc_pg);
839 	LPS_PG_DPK_LOC(h2c_pkt, loc_dpk);
840 	LPS_PG_SEC_CAM_EN(h2c_pkt, conf->sec_cam_backup);
841 	LPS_PG_PATTERN_CAM_EN(h2c_pkt, conf->pattern_cam_backup);
842 
843 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
844 }
845 
846 static u8 rtw_get_rsvd_page_probe_req_location(struct rtw_dev *rtwdev,
847 					       struct cfg80211_ssid *ssid)
848 {
849 	struct rtw_rsvd_page *rsvd_pkt;
850 	u8 location = 0;
851 
852 	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
853 		if (rsvd_pkt->type != RSVD_PROBE_REQ)
854 			continue;
855 		if ((!ssid && !rsvd_pkt->ssid) ||
856 		    rtw_ssid_equal(rsvd_pkt->ssid, ssid))
857 			location = rsvd_pkt->page;
858 	}
859 
860 	return location;
861 }
862 
863 static u16 rtw_get_rsvd_page_probe_req_size(struct rtw_dev *rtwdev,
864 					    struct cfg80211_ssid *ssid)
865 {
866 	struct rtw_rsvd_page *rsvd_pkt;
867 	u16 size = 0;
868 
869 	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
870 		if (rsvd_pkt->type != RSVD_PROBE_REQ)
871 			continue;
872 		if ((!ssid && !rsvd_pkt->ssid) ||
873 		    rtw_ssid_equal(rsvd_pkt->ssid, ssid))
874 			size = rsvd_pkt->probe_req_size;
875 	}
876 
877 	return size;
878 }
879 
880 void rtw_send_rsvd_page_h2c(struct rtw_dev *rtwdev)
881 {
882 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
883 	u8 location = 0;
884 
885 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RSVD_PAGE);
886 
887 	location = rtw_get_rsvd_page_location(rtwdev, RSVD_PROBE_RESP);
888 	*(h2c_pkt + 1) = location;
889 	rtw_dbg(rtwdev, RTW_DBG_FW, "RSVD_PROBE_RESP loc: %d\n", location);
890 
891 	location = rtw_get_rsvd_page_location(rtwdev, RSVD_PS_POLL);
892 	*(h2c_pkt + 2) = location;
893 	rtw_dbg(rtwdev, RTW_DBG_FW, "RSVD_PS_POLL loc: %d\n", location);
894 
895 	location = rtw_get_rsvd_page_location(rtwdev, RSVD_NULL);
896 	*(h2c_pkt + 3) = location;
897 	rtw_dbg(rtwdev, RTW_DBG_FW, "RSVD_NULL loc: %d\n", location);
898 
899 	location = rtw_get_rsvd_page_location(rtwdev, RSVD_QOS_NULL);
900 	*(h2c_pkt + 4) = location;
901 	rtw_dbg(rtwdev, RTW_DBG_FW, "RSVD_QOS_NULL loc: %d\n", location);
902 
903 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
904 }
905 
906 static struct sk_buff *rtw_nlo_info_get(struct ieee80211_hw *hw)
907 {
908 	struct rtw_dev *rtwdev = hw->priv;
909 	const struct rtw_chip_info *chip = rtwdev->chip;
910 	struct rtw_pno_request *pno_req = &rtwdev->wow.pno_req;
911 	struct rtw_nlo_info_hdr *nlo_hdr;
912 	struct cfg80211_ssid *ssid;
913 	struct sk_buff *skb;
914 	u8 *pos, loc;
915 	u32 size;
916 	int i;
917 
918 	if (!pno_req->inited || !pno_req->match_set_cnt)
919 		return NULL;
920 
921 	size = sizeof(struct rtw_nlo_info_hdr) + pno_req->match_set_cnt *
922 		      IEEE80211_MAX_SSID_LEN + chip->tx_pkt_desc_sz;
923 
924 	skb = alloc_skb(size, GFP_KERNEL);
925 	if (!skb)
926 		return NULL;
927 
928 	skb_reserve(skb, chip->tx_pkt_desc_sz);
929 
930 	nlo_hdr = skb_put_zero(skb, sizeof(struct rtw_nlo_info_hdr));
931 
932 	nlo_hdr->nlo_count = pno_req->match_set_cnt;
933 	nlo_hdr->hidden_ap_count = pno_req->match_set_cnt;
934 
935 	/* pattern check for firmware */
936 	memset(nlo_hdr->pattern_check, 0xA5, FW_NLO_INFO_CHECK_SIZE);
937 
938 	for (i = 0; i < pno_req->match_set_cnt; i++)
939 		nlo_hdr->ssid_len[i] = pno_req->match_sets[i].ssid.ssid_len;
940 
941 	for (i = 0; i < pno_req->match_set_cnt; i++) {
942 		ssid = &pno_req->match_sets[i].ssid;
943 		loc  = rtw_get_rsvd_page_probe_req_location(rtwdev, ssid);
944 		if (!loc) {
945 			rtw_err(rtwdev, "failed to get probe req rsvd loc\n");
946 			kfree_skb(skb);
947 			return NULL;
948 		}
949 		nlo_hdr->location[i] = loc;
950 	}
951 
952 	for (i = 0; i < pno_req->match_set_cnt; i++) {
953 		pos = skb_put_zero(skb, IEEE80211_MAX_SSID_LEN);
954 		memcpy(pos, pno_req->match_sets[i].ssid.ssid,
955 		       pno_req->match_sets[i].ssid.ssid_len);
956 	}
957 
958 	return skb;
959 }
960 
961 static struct sk_buff *rtw_cs_channel_info_get(struct ieee80211_hw *hw)
962 {
963 	struct rtw_dev *rtwdev = hw->priv;
964 	const struct rtw_chip_info *chip = rtwdev->chip;
965 	struct rtw_pno_request *pno_req = &rtwdev->wow.pno_req;
966 	struct ieee80211_channel *channels = pno_req->channels;
967 	struct sk_buff *skb;
968 	int count =  pno_req->channel_cnt;
969 	u8 *pos;
970 	int i = 0;
971 
972 	skb = alloc_skb(4 * count + chip->tx_pkt_desc_sz, GFP_KERNEL);
973 	if (!skb)
974 		return NULL;
975 
976 	skb_reserve(skb, chip->tx_pkt_desc_sz);
977 
978 	for (i = 0; i < count; i++) {
979 		pos = skb_put_zero(skb, 4);
980 
981 		CHSW_INFO_SET_CH(pos, channels[i].hw_value);
982 
983 		if (channels[i].flags & IEEE80211_CHAN_RADAR)
984 			CHSW_INFO_SET_ACTION_ID(pos, 0);
985 		else
986 			CHSW_INFO_SET_ACTION_ID(pos, 1);
987 		CHSW_INFO_SET_TIMEOUT(pos, 1);
988 		CHSW_INFO_SET_PRI_CH_IDX(pos, 1);
989 		CHSW_INFO_SET_BW(pos, 0);
990 	}
991 
992 	return skb;
993 }
994 
995 static struct sk_buff *rtw_lps_pg_dpk_get(struct ieee80211_hw *hw)
996 {
997 	struct rtw_dev *rtwdev = hw->priv;
998 	const struct rtw_chip_info *chip = rtwdev->chip;
999 	struct rtw_dpk_info *dpk_info = &rtwdev->dm_info.dpk_info;
1000 	struct rtw_lps_pg_dpk_hdr *dpk_hdr;
1001 	struct sk_buff *skb;
1002 	u32 size;
1003 
1004 	size = chip->tx_pkt_desc_sz + sizeof(*dpk_hdr);
1005 	skb = alloc_skb(size, GFP_KERNEL);
1006 	if (!skb)
1007 		return NULL;
1008 
1009 	skb_reserve(skb, chip->tx_pkt_desc_sz);
1010 	dpk_hdr = skb_put_zero(skb, sizeof(*dpk_hdr));
1011 	dpk_hdr->dpk_ch = dpk_info->dpk_ch;
1012 	dpk_hdr->dpk_path_ok = dpk_info->dpk_path_ok[0];
1013 	memcpy(dpk_hdr->dpk_txagc, dpk_info->dpk_txagc, 2);
1014 	memcpy(dpk_hdr->dpk_gs, dpk_info->dpk_gs, 4);
1015 	memcpy(dpk_hdr->coef, dpk_info->coef, 160);
1016 
1017 	return skb;
1018 }
1019 
1020 static struct sk_buff *rtw_lps_pg_info_get(struct ieee80211_hw *hw)
1021 {
1022 	struct rtw_dev *rtwdev = hw->priv;
1023 	const struct rtw_chip_info *chip = rtwdev->chip;
1024 	struct rtw_lps_conf *conf = &rtwdev->lps_conf;
1025 	struct rtw_lps_pg_info_hdr *pg_info_hdr;
1026 	struct rtw_wow_param *rtw_wow = &rtwdev->wow;
1027 	struct sk_buff *skb;
1028 	u32 size;
1029 
1030 	size = chip->tx_pkt_desc_sz + sizeof(*pg_info_hdr);
1031 	skb = alloc_skb(size, GFP_KERNEL);
1032 	if (!skb)
1033 		return NULL;
1034 
1035 	skb_reserve(skb, chip->tx_pkt_desc_sz);
1036 	pg_info_hdr = skb_put_zero(skb, sizeof(*pg_info_hdr));
1037 	pg_info_hdr->tx_bu_page_count = rtwdev->fifo.rsvd_drv_pg_num;
1038 	pg_info_hdr->macid = find_first_bit(rtwdev->mac_id_map, RTW_MAX_MAC_ID_NUM);
1039 	pg_info_hdr->sec_cam_count =
1040 		rtw_sec_cam_pg_backup(rtwdev, pg_info_hdr->sec_cam);
1041 	pg_info_hdr->pattern_count = rtw_wow->pattern_cnt;
1042 
1043 	conf->sec_cam_backup = pg_info_hdr->sec_cam_count != 0;
1044 	conf->pattern_cam_backup = rtw_wow->pattern_cnt != 0;
1045 
1046 	return skb;
1047 }
1048 
1049 static struct sk_buff *rtw_get_rsvd_page_skb(struct ieee80211_hw *hw,
1050 					     struct rtw_rsvd_page *rsvd_pkt)
1051 {
1052 	struct ieee80211_vif *vif;
1053 	struct rtw_vif *rtwvif;
1054 	struct sk_buff *skb_new;
1055 	struct cfg80211_ssid *ssid;
1056 	u16 tim_offset = 0;
1057 
1058 	if (rsvd_pkt->type == RSVD_DUMMY) {
1059 		skb_new = alloc_skb(1, GFP_KERNEL);
1060 		if (!skb_new)
1061 			return NULL;
1062 
1063 		skb_put(skb_new, 1);
1064 		return skb_new;
1065 	}
1066 
1067 	rtwvif = rsvd_pkt->rtwvif;
1068 	if (!rtwvif)
1069 		return NULL;
1070 
1071 	vif = rtwvif_to_vif(rtwvif);
1072 
1073 	switch (rsvd_pkt->type) {
1074 	case RSVD_BEACON:
1075 		skb_new = ieee80211_beacon_get_tim(hw, vif, &tim_offset, NULL, 0);
1076 		rsvd_pkt->tim_offset = tim_offset;
1077 		break;
1078 	case RSVD_PS_POLL:
1079 		skb_new = ieee80211_pspoll_get(hw, vif);
1080 		break;
1081 	case RSVD_PROBE_RESP:
1082 		skb_new = ieee80211_proberesp_get(hw, vif);
1083 		break;
1084 	case RSVD_NULL:
1085 		skb_new = ieee80211_nullfunc_get(hw, vif, -1, false);
1086 		break;
1087 	case RSVD_QOS_NULL:
1088 		skb_new = ieee80211_nullfunc_get(hw, vif, -1, true);
1089 		break;
1090 	case RSVD_LPS_PG_DPK:
1091 		skb_new = rtw_lps_pg_dpk_get(hw);
1092 		break;
1093 	case RSVD_LPS_PG_INFO:
1094 		skb_new = rtw_lps_pg_info_get(hw);
1095 		break;
1096 	case RSVD_PROBE_REQ:
1097 		ssid = (struct cfg80211_ssid *)rsvd_pkt->ssid;
1098 		if (ssid)
1099 			skb_new = ieee80211_probereq_get(hw, vif->addr,
1100 							 ssid->ssid,
1101 							 ssid->ssid_len, 0);
1102 		else
1103 			skb_new = ieee80211_probereq_get(hw, vif->addr, NULL, 0, 0);
1104 		if (skb_new)
1105 			rsvd_pkt->probe_req_size = (u16)skb_new->len;
1106 		break;
1107 	case RSVD_NLO_INFO:
1108 		skb_new = rtw_nlo_info_get(hw);
1109 		break;
1110 	case RSVD_CH_INFO:
1111 		skb_new = rtw_cs_channel_info_get(hw);
1112 		break;
1113 	default:
1114 		return NULL;
1115 	}
1116 
1117 	if (!skb_new)
1118 		return NULL;
1119 
1120 	return skb_new;
1121 }
1122 
1123 static void rtw_fill_rsvd_page_desc(struct rtw_dev *rtwdev, struct sk_buff *skb,
1124 				    enum rtw_rsvd_packet_type type)
1125 {
1126 	struct rtw_tx_pkt_info pkt_info = {0};
1127 	const struct rtw_chip_info *chip = rtwdev->chip;
1128 	u8 *pkt_desc;
1129 
1130 	rtw_tx_rsvd_page_pkt_info_update(rtwdev, &pkt_info, skb, type);
1131 	pkt_desc = skb_push(skb, chip->tx_pkt_desc_sz);
1132 	memset(pkt_desc, 0, chip->tx_pkt_desc_sz);
1133 	rtw_tx_fill_tx_desc(&pkt_info, skb);
1134 }
1135 
1136 static inline u8 rtw_len_to_page(unsigned int len, u8 page_size)
1137 {
1138 	return DIV_ROUND_UP(len, page_size);
1139 }
1140 
1141 static void rtw_rsvd_page_list_to_buf(struct rtw_dev *rtwdev, u8 page_size,
1142 				      u8 page_margin, u32 page, u8 *buf,
1143 				      struct rtw_rsvd_page *rsvd_pkt)
1144 {
1145 	struct sk_buff *skb = rsvd_pkt->skb;
1146 
1147 	if (page >= 1)
1148 		memcpy(buf + page_margin + page_size * (page - 1),
1149 		       skb->data, skb->len);
1150 	else
1151 		memcpy(buf, skb->data, skb->len);
1152 }
1153 
1154 static struct rtw_rsvd_page *rtw_alloc_rsvd_page(struct rtw_dev *rtwdev,
1155 						 enum rtw_rsvd_packet_type type,
1156 						 bool txdesc)
1157 {
1158 	struct rtw_rsvd_page *rsvd_pkt = NULL;
1159 
1160 	rsvd_pkt = kzalloc(sizeof(*rsvd_pkt), GFP_KERNEL);
1161 
1162 	if (!rsvd_pkt)
1163 		return NULL;
1164 
1165 	INIT_LIST_HEAD(&rsvd_pkt->vif_list);
1166 	INIT_LIST_HEAD(&rsvd_pkt->build_list);
1167 	rsvd_pkt->type = type;
1168 	rsvd_pkt->add_txdesc = txdesc;
1169 
1170 	return rsvd_pkt;
1171 }
1172 
1173 static void rtw_insert_rsvd_page(struct rtw_dev *rtwdev,
1174 				 struct rtw_vif *rtwvif,
1175 				 struct rtw_rsvd_page *rsvd_pkt)
1176 {
1177 	lockdep_assert_held(&rtwdev->mutex);
1178 
1179 	list_add_tail(&rsvd_pkt->vif_list, &rtwvif->rsvd_page_list);
1180 }
1181 
1182 static void rtw_add_rsvd_page(struct rtw_dev *rtwdev,
1183 			      struct rtw_vif *rtwvif,
1184 			      enum rtw_rsvd_packet_type type,
1185 			      bool txdesc)
1186 {
1187 	struct rtw_rsvd_page *rsvd_pkt;
1188 
1189 	rsvd_pkt = rtw_alloc_rsvd_page(rtwdev, type, txdesc);
1190 	if (!rsvd_pkt) {
1191 		rtw_err(rtwdev, "failed to alloc rsvd page %d\n", type);
1192 		return;
1193 	}
1194 
1195 	rsvd_pkt->rtwvif = rtwvif;
1196 	rtw_insert_rsvd_page(rtwdev, rtwvif, rsvd_pkt);
1197 }
1198 
1199 static void rtw_add_rsvd_page_probe_req(struct rtw_dev *rtwdev,
1200 					struct rtw_vif *rtwvif,
1201 					struct cfg80211_ssid *ssid)
1202 {
1203 	struct rtw_rsvd_page *rsvd_pkt;
1204 
1205 	rsvd_pkt = rtw_alloc_rsvd_page(rtwdev, RSVD_PROBE_REQ, true);
1206 	if (!rsvd_pkt) {
1207 		rtw_err(rtwdev, "failed to alloc probe req rsvd page\n");
1208 		return;
1209 	}
1210 
1211 	rsvd_pkt->rtwvif = rtwvif;
1212 	rsvd_pkt->ssid = ssid;
1213 	rtw_insert_rsvd_page(rtwdev, rtwvif, rsvd_pkt);
1214 }
1215 
1216 void rtw_remove_rsvd_page(struct rtw_dev *rtwdev,
1217 			  struct rtw_vif *rtwvif)
1218 {
1219 	struct rtw_rsvd_page *rsvd_pkt, *tmp;
1220 
1221 	lockdep_assert_held(&rtwdev->mutex);
1222 
1223 	/* remove all of the rsvd pages for vif */
1224 	list_for_each_entry_safe(rsvd_pkt, tmp, &rtwvif->rsvd_page_list,
1225 				 vif_list) {
1226 		list_del(&rsvd_pkt->vif_list);
1227 		if (!list_empty(&rsvd_pkt->build_list))
1228 			list_del(&rsvd_pkt->build_list);
1229 		kfree(rsvd_pkt);
1230 	}
1231 }
1232 
1233 void rtw_add_rsvd_page_bcn(struct rtw_dev *rtwdev,
1234 			   struct rtw_vif *rtwvif)
1235 {
1236 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
1237 
1238 	if (vif->type != NL80211_IFTYPE_AP &&
1239 	    vif->type != NL80211_IFTYPE_ADHOC &&
1240 	    vif->type != NL80211_IFTYPE_MESH_POINT) {
1241 		rtw_warn(rtwdev, "Cannot add beacon rsvd page for %d\n",
1242 			 vif->type);
1243 		return;
1244 	}
1245 
1246 	rtw_add_rsvd_page(rtwdev, rtwvif, RSVD_BEACON, false);
1247 }
1248 
1249 void rtw_add_rsvd_page_pno(struct rtw_dev *rtwdev,
1250 			   struct rtw_vif *rtwvif)
1251 {
1252 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
1253 	struct rtw_wow_param *rtw_wow = &rtwdev->wow;
1254 	struct rtw_pno_request *rtw_pno_req = &rtw_wow->pno_req;
1255 	struct cfg80211_ssid *ssid;
1256 	int i;
1257 
1258 	if (vif->type != NL80211_IFTYPE_STATION) {
1259 		rtw_warn(rtwdev, "Cannot add PNO rsvd page for %d\n",
1260 			 vif->type);
1261 		return;
1262 	}
1263 
1264 	for (i = 0 ; i < rtw_pno_req->match_set_cnt; i++) {
1265 		ssid = &rtw_pno_req->match_sets[i].ssid;
1266 		rtw_add_rsvd_page_probe_req(rtwdev, rtwvif, ssid);
1267 	}
1268 
1269 	rtw_add_rsvd_page_probe_req(rtwdev, rtwvif, NULL);
1270 	rtw_add_rsvd_page(rtwdev, rtwvif, RSVD_NLO_INFO, false);
1271 	rtw_add_rsvd_page(rtwdev, rtwvif, RSVD_CH_INFO, true);
1272 }
1273 
1274 void rtw_add_rsvd_page_sta(struct rtw_dev *rtwdev,
1275 			   struct rtw_vif *rtwvif)
1276 {
1277 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
1278 
1279 	if (vif->type != NL80211_IFTYPE_STATION) {
1280 		rtw_warn(rtwdev, "Cannot add sta rsvd page for %d\n",
1281 			 vif->type);
1282 		return;
1283 	}
1284 
1285 	rtw_add_rsvd_page(rtwdev, rtwvif, RSVD_PS_POLL, true);
1286 	rtw_add_rsvd_page(rtwdev, rtwvif, RSVD_QOS_NULL, true);
1287 	rtw_add_rsvd_page(rtwdev, rtwvif, RSVD_NULL, true);
1288 	rtw_add_rsvd_page(rtwdev, rtwvif, RSVD_LPS_PG_DPK, true);
1289 	rtw_add_rsvd_page(rtwdev, rtwvif, RSVD_LPS_PG_INFO, true);
1290 }
1291 
1292 int rtw_fw_write_data_rsvd_page(struct rtw_dev *rtwdev, u16 pg_addr,
1293 				u8 *buf, u32 size)
1294 {
1295 	u8 bckp[2];
1296 	u8 val;
1297 	u16 rsvd_pg_head;
1298 	u32 bcn_valid_addr;
1299 	u32 bcn_valid_mask;
1300 	int ret;
1301 
1302 	lockdep_assert_held(&rtwdev->mutex);
1303 
1304 	if (!size)
1305 		return -EINVAL;
1306 
1307 	if (rtw_chip_wcpu_11n(rtwdev)) {
1308 		rtw_write32_set(rtwdev, REG_DWBCN0_CTRL, BIT_BCN_VALID);
1309 	} else {
1310 		pg_addr &= BIT_MASK_BCN_HEAD_1_V1;
1311 		pg_addr |= BIT_BCN_VALID_V1;
1312 		rtw_write16(rtwdev, REG_FIFOPAGE_CTRL_2, pg_addr);
1313 	}
1314 
1315 	val = rtw_read8(rtwdev, REG_CR + 1);
1316 	bckp[0] = val;
1317 	val |= BIT_ENSWBCN >> 8;
1318 	rtw_write8(rtwdev, REG_CR + 1, val);
1319 
1320 	val = rtw_read8(rtwdev, REG_FWHW_TXQ_CTRL + 2);
1321 	bckp[1] = val;
1322 	val &= ~(BIT_EN_BCNQ_DL >> 16);
1323 	rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, val);
1324 
1325 	ret = rtw_hci_write_data_rsvd_page(rtwdev, buf, size);
1326 	if (ret) {
1327 		rtw_err(rtwdev, "failed to write data to rsvd page\n");
1328 		goto restore;
1329 	}
1330 
1331 	if (rtw_chip_wcpu_11n(rtwdev)) {
1332 		bcn_valid_addr = REG_DWBCN0_CTRL;
1333 		bcn_valid_mask = BIT_BCN_VALID;
1334 	} else {
1335 		bcn_valid_addr = REG_FIFOPAGE_CTRL_2;
1336 		bcn_valid_mask = BIT_BCN_VALID_V1;
1337 	}
1338 
1339 	if (!check_hw_ready(rtwdev, bcn_valid_addr, bcn_valid_mask, 1)) {
1340 		rtw_err(rtwdev, "error beacon valid\n");
1341 		ret = -EBUSY;
1342 	}
1343 
1344 restore:
1345 	rsvd_pg_head = rtwdev->fifo.rsvd_boundary;
1346 	rtw_write16(rtwdev, REG_FIFOPAGE_CTRL_2,
1347 		    rsvd_pg_head | BIT_BCN_VALID_V1);
1348 	rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, bckp[1]);
1349 	rtw_write8(rtwdev, REG_CR + 1, bckp[0]);
1350 
1351 	return ret;
1352 }
1353 
1354 static int rtw_download_drv_rsvd_page(struct rtw_dev *rtwdev, u8 *buf, u32 size)
1355 {
1356 	u32 pg_size;
1357 	u32 pg_num = 0;
1358 	u16 pg_addr = 0;
1359 
1360 	pg_size = rtwdev->chip->page_size;
1361 	pg_num = size / pg_size + ((size & (pg_size - 1)) ? 1 : 0);
1362 	if (pg_num > rtwdev->fifo.rsvd_drv_pg_num)
1363 		return -ENOMEM;
1364 
1365 	pg_addr = rtwdev->fifo.rsvd_drv_addr;
1366 
1367 	return rtw_fw_write_data_rsvd_page(rtwdev, pg_addr, buf, size);
1368 }
1369 
1370 static void __rtw_build_rsvd_page_reset(struct rtw_dev *rtwdev)
1371 {
1372 	struct rtw_rsvd_page *rsvd_pkt, *tmp;
1373 
1374 	list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
1375 				 build_list) {
1376 		list_del_init(&rsvd_pkt->build_list);
1377 
1378 		/* Don't free except for the dummy rsvd page,
1379 		 * others will be freed when removing vif
1380 		 */
1381 		if (rsvd_pkt->type == RSVD_DUMMY)
1382 			kfree(rsvd_pkt);
1383 	}
1384 }
1385 
1386 static void rtw_build_rsvd_page_iter(void *data, u8 *mac,
1387 				     struct ieee80211_vif *vif)
1388 {
1389 	struct rtw_dev *rtwdev = data;
1390 	struct rtw_vif *rtwvif = (struct rtw_vif *)vif->drv_priv;
1391 	struct rtw_rsvd_page *rsvd_pkt;
1392 
1393 	list_for_each_entry(rsvd_pkt, &rtwvif->rsvd_page_list, vif_list) {
1394 		if (rsvd_pkt->type == RSVD_BEACON)
1395 			list_add(&rsvd_pkt->build_list,
1396 				 &rtwdev->rsvd_page_list);
1397 		else
1398 			list_add_tail(&rsvd_pkt->build_list,
1399 				      &rtwdev->rsvd_page_list);
1400 	}
1401 }
1402 
1403 static int  __rtw_build_rsvd_page_from_vifs(struct rtw_dev *rtwdev)
1404 {
1405 	struct rtw_rsvd_page *rsvd_pkt;
1406 
1407 	__rtw_build_rsvd_page_reset(rtwdev);
1408 
1409 	/* gather rsvd page from vifs */
1410 	rtw_iterate_vifs_atomic(rtwdev, rtw_build_rsvd_page_iter, rtwdev);
1411 
1412 	rsvd_pkt = list_first_entry_or_null(&rtwdev->rsvd_page_list,
1413 					    struct rtw_rsvd_page, build_list);
1414 	if (!rsvd_pkt) {
1415 		WARN(1, "Should not have an empty reserved page\n");
1416 		return -EINVAL;
1417 	}
1418 
1419 	/* the first rsvd should be beacon, otherwise add a dummy one */
1420 	if (rsvd_pkt->type != RSVD_BEACON) {
1421 		struct rtw_rsvd_page *dummy_pkt;
1422 
1423 		dummy_pkt = rtw_alloc_rsvd_page(rtwdev, RSVD_DUMMY, false);
1424 		if (!dummy_pkt) {
1425 			rtw_err(rtwdev, "failed to alloc dummy rsvd page\n");
1426 			return -ENOMEM;
1427 		}
1428 
1429 		list_add(&dummy_pkt->build_list, &rtwdev->rsvd_page_list);
1430 	}
1431 
1432 	return 0;
1433 }
1434 
1435 static u8 *rtw_build_rsvd_page(struct rtw_dev *rtwdev, u32 *size)
1436 {
1437 	struct ieee80211_hw *hw = rtwdev->hw;
1438 	const struct rtw_chip_info *chip = rtwdev->chip;
1439 	struct sk_buff *iter;
1440 	struct rtw_rsvd_page *rsvd_pkt;
1441 	u32 page = 0;
1442 	u8 total_page = 0;
1443 	u8 page_size, page_margin, tx_desc_sz;
1444 	u8 *buf;
1445 	int ret;
1446 
1447 	page_size = chip->page_size;
1448 	tx_desc_sz = chip->tx_pkt_desc_sz;
1449 	page_margin = page_size - tx_desc_sz;
1450 
1451 	ret = __rtw_build_rsvd_page_from_vifs(rtwdev);
1452 	if (ret) {
1453 		rtw_err(rtwdev,
1454 			"failed to build rsvd page from vifs, ret %d\n", ret);
1455 		return NULL;
1456 	}
1457 
1458 	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
1459 		iter = rtw_get_rsvd_page_skb(hw, rsvd_pkt);
1460 		if (!iter) {
1461 			rtw_err(rtwdev, "failed to build rsvd packet\n");
1462 			goto release_skb;
1463 		}
1464 
1465 		/* Fill the tx_desc for the rsvd pkt that requires one.
1466 		 * And iter->len will be added with size of tx_desc_sz.
1467 		 */
1468 		if (rsvd_pkt->add_txdesc)
1469 			rtw_fill_rsvd_page_desc(rtwdev, iter, rsvd_pkt->type);
1470 
1471 		rsvd_pkt->skb = iter;
1472 		rsvd_pkt->page = total_page;
1473 
1474 		/* Reserved page is downloaded via TX path, and TX path will
1475 		 * generate a tx_desc at the header to describe length of
1476 		 * the buffer. If we are not counting page numbers with the
1477 		 * size of tx_desc added at the first rsvd_pkt (usually a
1478 		 * beacon, firmware default refer to the first page as the
1479 		 * content of beacon), we could generate a buffer which size
1480 		 * is smaller than the actual size of the whole rsvd_page
1481 		 */
1482 		if (total_page == 0) {
1483 			if (rsvd_pkt->type != RSVD_BEACON &&
1484 			    rsvd_pkt->type != RSVD_DUMMY) {
1485 				rtw_err(rtwdev, "first page should be a beacon\n");
1486 				goto release_skb;
1487 			}
1488 			total_page += rtw_len_to_page(iter->len + tx_desc_sz,
1489 						      page_size);
1490 		} else {
1491 			total_page += rtw_len_to_page(iter->len, page_size);
1492 		}
1493 	}
1494 
1495 	if (total_page > rtwdev->fifo.rsvd_drv_pg_num) {
1496 		rtw_err(rtwdev, "rsvd page over size: %d\n", total_page);
1497 		goto release_skb;
1498 	}
1499 
1500 	*size = (total_page - 1) * page_size + page_margin;
1501 	buf = kzalloc(*size, GFP_KERNEL);
1502 	if (!buf)
1503 		goto release_skb;
1504 
1505 	/* Copy the content of each rsvd_pkt to the buf, and they should
1506 	 * be aligned to the pages.
1507 	 *
1508 	 * Note that the first rsvd_pkt is a beacon no matter what vif->type.
1509 	 * And that rsvd_pkt does not require tx_desc because when it goes
1510 	 * through TX path, the TX path will generate one for it.
1511 	 */
1512 	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
1513 		rtw_rsvd_page_list_to_buf(rtwdev, page_size, page_margin,
1514 					  page, buf, rsvd_pkt);
1515 		if (page == 0)
1516 			page += rtw_len_to_page(rsvd_pkt->skb->len +
1517 						tx_desc_sz, page_size);
1518 		else
1519 			page += rtw_len_to_page(rsvd_pkt->skb->len, page_size);
1520 
1521 		kfree_skb(rsvd_pkt->skb);
1522 		rsvd_pkt->skb = NULL;
1523 	}
1524 
1525 	return buf;
1526 
1527 release_skb:
1528 	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
1529 		kfree_skb(rsvd_pkt->skb);
1530 		rsvd_pkt->skb = NULL;
1531 	}
1532 
1533 	return NULL;
1534 }
1535 
1536 static int rtw_download_beacon(struct rtw_dev *rtwdev)
1537 {
1538 	struct ieee80211_hw *hw = rtwdev->hw;
1539 	struct rtw_rsvd_page *rsvd_pkt;
1540 	struct sk_buff *skb;
1541 	int ret = 0;
1542 
1543 	rsvd_pkt = list_first_entry_or_null(&rtwdev->rsvd_page_list,
1544 					    struct rtw_rsvd_page, build_list);
1545 	if (!rsvd_pkt) {
1546 		rtw_err(rtwdev, "failed to get rsvd page from build list\n");
1547 		return -ENOENT;
1548 	}
1549 
1550 	if (rsvd_pkt->type != RSVD_BEACON &&
1551 	    rsvd_pkt->type != RSVD_DUMMY) {
1552 		rtw_err(rtwdev, "invalid rsvd page type %d, should be beacon or dummy\n",
1553 			rsvd_pkt->type);
1554 		return -EINVAL;
1555 	}
1556 
1557 	skb = rtw_get_rsvd_page_skb(hw, rsvd_pkt);
1558 	if (!skb) {
1559 		rtw_err(rtwdev, "failed to get beacon skb\n");
1560 		return -ENOMEM;
1561 	}
1562 
1563 	ret = rtw_download_drv_rsvd_page(rtwdev, skb->data, skb->len);
1564 	if (ret)
1565 		rtw_err(rtwdev, "failed to download drv rsvd page\n");
1566 
1567 	dev_kfree_skb(skb);
1568 
1569 	return ret;
1570 }
1571 
1572 int rtw_fw_download_rsvd_page(struct rtw_dev *rtwdev)
1573 {
1574 	u8 *buf;
1575 	u32 size;
1576 	int ret;
1577 
1578 	buf = rtw_build_rsvd_page(rtwdev, &size);
1579 	if (!buf) {
1580 		rtw_err(rtwdev, "failed to build rsvd page pkt\n");
1581 		return -ENOMEM;
1582 	}
1583 
1584 	ret = rtw_download_drv_rsvd_page(rtwdev, buf, size);
1585 	if (ret) {
1586 		rtw_err(rtwdev, "failed to download drv rsvd page\n");
1587 		goto free;
1588 	}
1589 
1590 	/* The last thing is to download the *ONLY* beacon again, because
1591 	 * the previous tx_desc is to describe the total rsvd page. Download
1592 	 * the beacon again to replace the TX desc header, and we will get
1593 	 * a correct tx_desc for the beacon in the rsvd page.
1594 	 */
1595 	ret = rtw_download_beacon(rtwdev);
1596 	if (ret) {
1597 		rtw_err(rtwdev, "failed to download beacon\n");
1598 		goto free;
1599 	}
1600 
1601 free:
1602 	kfree(buf);
1603 
1604 	return ret;
1605 }
1606 
1607 void rtw_fw_update_beacon_work(struct work_struct *work)
1608 {
1609 	struct rtw_dev *rtwdev = container_of(work, struct rtw_dev,
1610 					      update_beacon_work);
1611 
1612 	mutex_lock(&rtwdev->mutex);
1613 	rtw_fw_download_rsvd_page(rtwdev);
1614 	mutex_unlock(&rtwdev->mutex);
1615 }
1616 
1617 static void rtw_fw_read_fifo_page(struct rtw_dev *rtwdev, u32 offset, u32 size,
1618 				  u32 *buf, u32 residue, u16 start_pg)
1619 {
1620 	u32 i;
1621 	u16 idx = 0;
1622 	u16 ctl;
1623 
1624 	ctl = rtw_read16(rtwdev, REG_PKTBUF_DBG_CTRL) & 0xf000;
1625 	/* disable rx clock gate */
1626 	rtw_write32_set(rtwdev, REG_RCR, BIT_DISGCLK);
1627 
1628 	do {
1629 		rtw_write16(rtwdev, REG_PKTBUF_DBG_CTRL, start_pg | ctl);
1630 
1631 		for (i = FIFO_DUMP_ADDR + residue;
1632 		     i < FIFO_DUMP_ADDR + FIFO_PAGE_SIZE; i += 4) {
1633 			buf[idx++] = rtw_read32(rtwdev, i);
1634 			size -= 4;
1635 			if (size == 0)
1636 				goto out;
1637 		}
1638 
1639 		residue = 0;
1640 		start_pg++;
1641 	} while (size);
1642 
1643 out:
1644 	rtw_write16(rtwdev, REG_PKTBUF_DBG_CTRL, ctl);
1645 	/* restore rx clock gate */
1646 	rtw_write32_clr(rtwdev, REG_RCR, BIT_DISGCLK);
1647 }
1648 
1649 static void rtw_fw_read_fifo(struct rtw_dev *rtwdev, enum rtw_fw_fifo_sel sel,
1650 			     u32 offset, u32 size, u32 *buf)
1651 {
1652 	const struct rtw_chip_info *chip = rtwdev->chip;
1653 	u32 start_pg, residue;
1654 
1655 	if (sel >= RTW_FW_FIFO_MAX) {
1656 		rtw_dbg(rtwdev, RTW_DBG_FW, "wrong fw fifo sel\n");
1657 		return;
1658 	}
1659 	if (sel == RTW_FW_FIFO_SEL_RSVD_PAGE)
1660 		offset += rtwdev->fifo.rsvd_boundary << TX_PAGE_SIZE_SHIFT;
1661 	residue = offset & (FIFO_PAGE_SIZE - 1);
1662 	start_pg = (offset >> FIFO_PAGE_SIZE_SHIFT) + chip->fw_fifo_addr[sel];
1663 
1664 	rtw_fw_read_fifo_page(rtwdev, offset, size, buf, residue, start_pg);
1665 }
1666 
1667 static bool rtw_fw_dump_check_size(struct rtw_dev *rtwdev,
1668 				   enum rtw_fw_fifo_sel sel,
1669 				   u32 start_addr, u32 size)
1670 {
1671 	switch (sel) {
1672 	case RTW_FW_FIFO_SEL_TX:
1673 	case RTW_FW_FIFO_SEL_RX:
1674 		if ((start_addr + size) > rtwdev->chip->fw_fifo_addr[sel])
1675 			return false;
1676 		fallthrough;
1677 	default:
1678 		return true;
1679 	}
1680 }
1681 
1682 int rtw_fw_dump_fifo(struct rtw_dev *rtwdev, u8 fifo_sel, u32 addr, u32 size,
1683 		     u32 *buffer)
1684 {
1685 	if (!rtwdev->chip->fw_fifo_addr[0]) {
1686 		rtw_dbg(rtwdev, RTW_DBG_FW, "chip not support dump fw fifo\n");
1687 		return -ENOTSUPP;
1688 	}
1689 
1690 	if (size == 0 || !buffer)
1691 		return -EINVAL;
1692 
1693 	if (size & 0x3) {
1694 		rtw_dbg(rtwdev, RTW_DBG_FW, "not 4byte alignment\n");
1695 		return -EINVAL;
1696 	}
1697 
1698 	if (!rtw_fw_dump_check_size(rtwdev, fifo_sel, addr, size)) {
1699 		rtw_dbg(rtwdev, RTW_DBG_FW, "fw fifo dump size overflow\n");
1700 		return -EINVAL;
1701 	}
1702 
1703 	rtw_fw_read_fifo(rtwdev, fifo_sel, addr, size, buffer);
1704 
1705 	return 0;
1706 }
1707 
1708 static void __rtw_fw_update_pkt(struct rtw_dev *rtwdev, u8 pkt_id, u16 size,
1709 				u8 location)
1710 {
1711 	const struct rtw_chip_info *chip = rtwdev->chip;
1712 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1713 	u16 total_size = H2C_PKT_HDR_SIZE + H2C_PKT_UPDATE_PKT_LEN;
1714 
1715 	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_UPDATE_PKT);
1716 
1717 	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
1718 	UPDATE_PKT_SET_PKT_ID(h2c_pkt, pkt_id);
1719 	UPDATE_PKT_SET_LOCATION(h2c_pkt, location);
1720 
1721 	/* include txdesc size */
1722 	size += chip->tx_pkt_desc_sz;
1723 	UPDATE_PKT_SET_SIZE(h2c_pkt, size);
1724 
1725 	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
1726 }
1727 
1728 void rtw_fw_update_pkt_probe_req(struct rtw_dev *rtwdev,
1729 				 struct cfg80211_ssid *ssid)
1730 {
1731 	u8 loc;
1732 	u16 size;
1733 
1734 	loc = rtw_get_rsvd_page_probe_req_location(rtwdev, ssid);
1735 	if (!loc) {
1736 		rtw_err(rtwdev, "failed to get probe_req rsvd loc\n");
1737 		return;
1738 	}
1739 
1740 	size = rtw_get_rsvd_page_probe_req_size(rtwdev, ssid);
1741 	if (!size) {
1742 		rtw_err(rtwdev, "failed to get probe_req rsvd size\n");
1743 		return;
1744 	}
1745 
1746 	__rtw_fw_update_pkt(rtwdev, RTW_PACKET_PROBE_REQ, size, loc);
1747 }
1748 
1749 void rtw_fw_channel_switch(struct rtw_dev *rtwdev, bool enable)
1750 {
1751 	struct rtw_pno_request *rtw_pno_req = &rtwdev->wow.pno_req;
1752 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1753 	u16 total_size = H2C_PKT_HDR_SIZE + H2C_PKT_CH_SWITCH_LEN;
1754 	u8 loc_ch_info;
1755 	const struct rtw_ch_switch_option cs_option = {
1756 		.dest_ch_en = 1,
1757 		.dest_ch = 1,
1758 		.periodic_option = 2,
1759 		.normal_period = 5,
1760 		.normal_period_sel = 0,
1761 		.normal_cycle = 10,
1762 		.slow_period = 1,
1763 		.slow_period_sel = 1,
1764 	};
1765 
1766 	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_CH_SWITCH);
1767 	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
1768 
1769 	CH_SWITCH_SET_START(h2c_pkt, enable);
1770 	CH_SWITCH_SET_DEST_CH_EN(h2c_pkt, cs_option.dest_ch_en);
1771 	CH_SWITCH_SET_DEST_CH(h2c_pkt, cs_option.dest_ch);
1772 	CH_SWITCH_SET_NORMAL_PERIOD(h2c_pkt, cs_option.normal_period);
1773 	CH_SWITCH_SET_NORMAL_PERIOD_SEL(h2c_pkt, cs_option.normal_period_sel);
1774 	CH_SWITCH_SET_SLOW_PERIOD(h2c_pkt, cs_option.slow_period);
1775 	CH_SWITCH_SET_SLOW_PERIOD_SEL(h2c_pkt, cs_option.slow_period_sel);
1776 	CH_SWITCH_SET_NORMAL_CYCLE(h2c_pkt, cs_option.normal_cycle);
1777 	CH_SWITCH_SET_PERIODIC_OPT(h2c_pkt, cs_option.periodic_option);
1778 
1779 	CH_SWITCH_SET_CH_NUM(h2c_pkt, rtw_pno_req->channel_cnt);
1780 	CH_SWITCH_SET_INFO_SIZE(h2c_pkt, rtw_pno_req->channel_cnt * 4);
1781 
1782 	loc_ch_info = rtw_get_rsvd_page_location(rtwdev, RSVD_CH_INFO);
1783 	CH_SWITCH_SET_INFO_LOC(h2c_pkt, loc_ch_info);
1784 
1785 	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
1786 }
1787 
1788 void rtw_fw_adaptivity(struct rtw_dev *rtwdev)
1789 {
1790 	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
1791 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1792 
1793 	if (!rtw_edcca_enabled) {
1794 		dm_info->edcca_mode = RTW_EDCCA_NORMAL;
1795 		rtw_dbg(rtwdev, RTW_DBG_ADAPTIVITY,
1796 			"EDCCA disabled by debugfs\n");
1797 	}
1798 
1799 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_ADAPTIVITY);
1800 	SET_ADAPTIVITY_MODE(h2c_pkt, dm_info->edcca_mode);
1801 	SET_ADAPTIVITY_OPTION(h2c_pkt, 1);
1802 	SET_ADAPTIVITY_IGI(h2c_pkt, dm_info->igi_history[0]);
1803 	SET_ADAPTIVITY_L2H(h2c_pkt, dm_info->l2h_th_ini);
1804 	SET_ADAPTIVITY_DENSITY(h2c_pkt, dm_info->scan_density);
1805 
1806 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
1807 }
1808 
1809 void rtw_fw_scan_notify(struct rtw_dev *rtwdev, bool start)
1810 {
1811 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1812 
1813 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_SCAN);
1814 	SET_SCAN_START(h2c_pkt, start);
1815 
1816 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
1817 }
1818 
1819 static int rtw_append_probe_req_ie(struct rtw_dev *rtwdev, struct sk_buff *skb,
1820 				   struct sk_buff_head *list, u8 *bands,
1821 				   struct rtw_vif *rtwvif)
1822 {
1823 	const struct rtw_chip_info *chip = rtwdev->chip;
1824 	struct ieee80211_scan_ies *ies = rtwvif->scan_ies;
1825 	struct sk_buff *new;
1826 	u8 idx;
1827 
1828 	for (idx = NL80211_BAND_2GHZ; idx < NUM_NL80211_BANDS; idx++) {
1829 		if (!(BIT(idx) & chip->band))
1830 			continue;
1831 		new = skb_copy(skb, GFP_KERNEL);
1832 		if (!new)
1833 			return -ENOMEM;
1834 		skb_put_data(new, ies->ies[idx], ies->len[idx]);
1835 		skb_put_data(new, ies->common_ies, ies->common_ie_len);
1836 		skb_queue_tail(list, new);
1837 		(*bands)++;
1838 	}
1839 
1840 	return 0;
1841 }
1842 
1843 static int _rtw_hw_scan_update_probe_req(struct rtw_dev *rtwdev, u8 num_probes,
1844 					 struct sk_buff_head *probe_req_list)
1845 {
1846 	const struct rtw_chip_info *chip = rtwdev->chip;
1847 	struct sk_buff *skb, *tmp;
1848 	u8 page_offset = 1, *buf, page_size = chip->page_size;
1849 	u16 pg_addr = rtwdev->fifo.rsvd_h2c_info_addr, loc;
1850 	u16 buf_offset = page_size * page_offset;
1851 	u8 tx_desc_sz = chip->tx_pkt_desc_sz;
1852 	u8 page_cnt, pages;
1853 	unsigned int pkt_len;
1854 	int ret;
1855 
1856 	if (rtw_fw_feature_ext_check(&rtwdev->fw, FW_FEATURE_EXT_OLD_PAGE_NUM))
1857 		page_cnt = RTW_OLD_PROBE_PG_CNT;
1858 	else
1859 		page_cnt = RTW_PROBE_PG_CNT;
1860 
1861 	pages = page_offset + num_probes * page_cnt;
1862 
1863 	buf = kzalloc(page_size * pages, GFP_KERNEL);
1864 	if (!buf)
1865 		return -ENOMEM;
1866 
1867 	buf_offset -= tx_desc_sz;
1868 	skb_queue_walk_safe(probe_req_list, skb, tmp) {
1869 		skb_unlink(skb, probe_req_list);
1870 		rtw_fill_rsvd_page_desc(rtwdev, skb, RSVD_PROBE_REQ);
1871 		if (skb->len > page_size * page_cnt) {
1872 			ret = -EINVAL;
1873 			goto out;
1874 		}
1875 
1876 		memcpy(buf + buf_offset, skb->data, skb->len);
1877 		pkt_len = skb->len - tx_desc_sz;
1878 		loc = pg_addr - rtwdev->fifo.rsvd_boundary + page_offset;
1879 		__rtw_fw_update_pkt(rtwdev, RTW_PACKET_PROBE_REQ, pkt_len, loc);
1880 
1881 		buf_offset += page_cnt * page_size;
1882 		page_offset += page_cnt;
1883 		kfree_skb(skb);
1884 	}
1885 
1886 	ret = rtw_fw_write_data_rsvd_page(rtwdev, pg_addr, buf, buf_offset);
1887 	if (ret) {
1888 		rtw_err(rtwdev, "Download probe request to firmware failed\n");
1889 		goto out;
1890 	}
1891 
1892 	rtwdev->scan_info.probe_pg_size = page_offset;
1893 out:
1894 	kfree(buf);
1895 	skb_queue_walk_safe(probe_req_list, skb, tmp)
1896 		kfree_skb(skb);
1897 
1898 	return ret;
1899 }
1900 
1901 static int rtw_hw_scan_update_probe_req(struct rtw_dev *rtwdev,
1902 					struct rtw_vif *rtwvif)
1903 {
1904 	struct cfg80211_scan_request *req = rtwvif->scan_req;
1905 	struct sk_buff_head list;
1906 	struct sk_buff *skb, *tmp;
1907 	u8 num = req->n_ssids, i, bands = 0;
1908 	int ret;
1909 
1910 	skb_queue_head_init(&list);
1911 	for (i = 0; i < num; i++) {
1912 		skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr,
1913 					     req->ssids[i].ssid,
1914 					     req->ssids[i].ssid_len,
1915 					     req->ie_len);
1916 		if (!skb) {
1917 			ret = -ENOMEM;
1918 			goto out;
1919 		}
1920 		ret = rtw_append_probe_req_ie(rtwdev, skb, &list, &bands,
1921 					      rtwvif);
1922 		if (ret)
1923 			goto out;
1924 
1925 		kfree_skb(skb);
1926 	}
1927 
1928 	return _rtw_hw_scan_update_probe_req(rtwdev, num * bands, &list);
1929 
1930 out:
1931 	skb_queue_walk_safe(&list, skb, tmp)
1932 		kfree_skb(skb);
1933 
1934 	return ret;
1935 }
1936 
1937 static int rtw_add_chan_info(struct rtw_dev *rtwdev, struct rtw_chan_info *info,
1938 			     struct rtw_chan_list *list, u8 *buf)
1939 {
1940 	u8 *chan = &buf[list->size];
1941 	u8 info_size = RTW_CH_INFO_SIZE;
1942 
1943 	if (list->size > list->buf_size)
1944 		return -ENOMEM;
1945 
1946 	CH_INFO_SET_CH(chan, info->channel);
1947 	CH_INFO_SET_PRI_CH_IDX(chan, info->pri_ch_idx);
1948 	CH_INFO_SET_BW(chan, info->bw);
1949 	CH_INFO_SET_TIMEOUT(chan, info->timeout);
1950 	CH_INFO_SET_ACTION_ID(chan, info->action_id);
1951 	CH_INFO_SET_EXTRA_INFO(chan, info->extra_info);
1952 	if (info->extra_info) {
1953 		EXTRA_CH_INFO_SET_ID(chan, RTW_SCAN_EXTRA_ID_DFS);
1954 		EXTRA_CH_INFO_SET_INFO(chan, RTW_SCAN_EXTRA_ACTION_SCAN);
1955 		EXTRA_CH_INFO_SET_SIZE(chan, RTW_EX_CH_INFO_SIZE -
1956 				       RTW_EX_CH_INFO_HDR_SIZE);
1957 		EXTRA_CH_INFO_SET_DFS_EXT_TIME(chan, RTW_DFS_CHAN_TIME);
1958 		info_size += RTW_EX_CH_INFO_SIZE;
1959 	}
1960 	list->size += info_size;
1961 	list->ch_num++;
1962 
1963 	return 0;
1964 }
1965 
1966 static int rtw_add_chan_list(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif,
1967 			     struct rtw_chan_list *list, u8 *buf)
1968 {
1969 	struct cfg80211_scan_request *req = rtwvif->scan_req;
1970 	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
1971 	struct ieee80211_channel *channel;
1972 	int i, ret = 0;
1973 
1974 	for (i = 0; i < req->n_channels; i++) {
1975 		struct rtw_chan_info ch_info = {0};
1976 
1977 		channel = req->channels[i];
1978 		ch_info.channel = channel->hw_value;
1979 		ch_info.bw = RTW_SCAN_WIDTH;
1980 		ch_info.pri_ch_idx = RTW_PRI_CH_IDX;
1981 		ch_info.timeout = req->duration_mandatory ?
1982 				  req->duration : RTW_CHANNEL_TIME;
1983 
1984 		if (channel->flags & (IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IR)) {
1985 			ch_info.action_id = RTW_CHANNEL_RADAR;
1986 			ch_info.extra_info = 1;
1987 			/* Overwrite duration for passive scans if necessary */
1988 			ch_info.timeout = ch_info.timeout > RTW_PASS_CHAN_TIME ?
1989 					  ch_info.timeout : RTW_PASS_CHAN_TIME;
1990 		} else {
1991 			ch_info.action_id = RTW_CHANNEL_ACTIVE;
1992 		}
1993 
1994 		ret = rtw_add_chan_info(rtwdev, &ch_info, list, buf);
1995 		if (ret)
1996 			return ret;
1997 	}
1998 
1999 	if (list->size > fifo->rsvd_pg_num << TX_PAGE_SIZE_SHIFT) {
2000 		rtw_err(rtwdev, "List exceeds rsvd page total size\n");
2001 		return -EINVAL;
2002 	}
2003 
2004 	list->addr = fifo->rsvd_h2c_info_addr + rtwdev->scan_info.probe_pg_size;
2005 	ret = rtw_fw_write_data_rsvd_page(rtwdev, list->addr, buf, list->size);
2006 	if (ret)
2007 		rtw_err(rtwdev, "Download channel list failed\n");
2008 
2009 	return ret;
2010 }
2011 
2012 static void rtw_fw_set_scan_offload(struct rtw_dev *rtwdev,
2013 				    struct rtw_ch_switch_option *opt,
2014 				    struct rtw_vif *rtwvif,
2015 				    struct rtw_chan_list *list)
2016 {
2017 	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2018 	struct cfg80211_scan_request *req = rtwvif->scan_req;
2019 	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
2020 	/* reserve one dummy page at the beginning for tx descriptor */
2021 	u8 pkt_loc = fifo->rsvd_h2c_info_addr - fifo->rsvd_boundary + 1;
2022 	bool random_seq = req->flags & NL80211_SCAN_FLAG_RANDOM_SN;
2023 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
2024 
2025 	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_SCAN_OFFLOAD);
2026 	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, H2C_PKT_CH_SWITCH_LEN);
2027 
2028 	SCAN_OFFLOAD_SET_START(h2c_pkt, opt->switch_en);
2029 	SCAN_OFFLOAD_SET_BACK_OP_EN(h2c_pkt, opt->back_op_en);
2030 	SCAN_OFFLOAD_SET_RANDOM_SEQ_EN(h2c_pkt, random_seq);
2031 	SCAN_OFFLOAD_SET_NO_CCK_EN(h2c_pkt, req->no_cck);
2032 	SCAN_OFFLOAD_SET_CH_NUM(h2c_pkt, list->ch_num);
2033 	SCAN_OFFLOAD_SET_CH_INFO_SIZE(h2c_pkt, list->size);
2034 	SCAN_OFFLOAD_SET_CH_INFO_LOC(h2c_pkt, list->addr - fifo->rsvd_boundary);
2035 	SCAN_OFFLOAD_SET_OP_CH(h2c_pkt, scan_info->op_chan);
2036 	SCAN_OFFLOAD_SET_OP_PRI_CH_IDX(h2c_pkt, scan_info->op_pri_ch_idx);
2037 	SCAN_OFFLOAD_SET_OP_BW(h2c_pkt, scan_info->op_bw);
2038 	SCAN_OFFLOAD_SET_OP_PORT_ID(h2c_pkt, rtwvif->port);
2039 	SCAN_OFFLOAD_SET_OP_DWELL_TIME(h2c_pkt, req->duration_mandatory ?
2040 				       req->duration : RTW_CHANNEL_TIME);
2041 	SCAN_OFFLOAD_SET_OP_GAP_TIME(h2c_pkt, RTW_OFF_CHAN_TIME);
2042 	SCAN_OFFLOAD_SET_SSID_NUM(h2c_pkt, req->n_ssids);
2043 	SCAN_OFFLOAD_SET_PKT_LOC(h2c_pkt, pkt_loc);
2044 
2045 	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
2046 }
2047 
2048 void rtw_hw_scan_start(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
2049 		       struct ieee80211_scan_request *scan_req)
2050 {
2051 	struct rtw_vif *rtwvif = (struct rtw_vif *)vif->drv_priv;
2052 	struct cfg80211_scan_request *req = &scan_req->req;
2053 	u8 mac_addr[ETH_ALEN];
2054 
2055 	rtwdev->scan_info.scanning_vif = vif;
2056 	rtwvif->scan_ies = &scan_req->ies;
2057 	rtwvif->scan_req = req;
2058 
2059 	ieee80211_stop_queues(rtwdev->hw);
2060 	rtw_leave_lps_deep(rtwdev);
2061 	rtw_hci_flush_all_queues(rtwdev, false);
2062 	rtw_mac_flush_all_queues(rtwdev, false);
2063 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2064 		get_random_mask_addr(mac_addr, req->mac_addr,
2065 				     req->mac_addr_mask);
2066 	else
2067 		ether_addr_copy(mac_addr, vif->addr);
2068 
2069 	rtw_core_scan_start(rtwdev, rtwvif, mac_addr, true);
2070 
2071 	rtwdev->hal.rcr &= ~BIT_CBSSID_BCN;
2072 	rtw_write32(rtwdev, REG_RCR, rtwdev->hal.rcr);
2073 }
2074 
2075 void rtw_hw_scan_complete(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
2076 			  bool aborted)
2077 {
2078 	struct cfg80211_scan_info info = {
2079 		.aborted = aborted,
2080 	};
2081 	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2082 	struct rtw_hal *hal = &rtwdev->hal;
2083 	struct rtw_vif *rtwvif;
2084 	u8 chan = scan_info->op_chan;
2085 
2086 	if (!vif)
2087 		return;
2088 
2089 	rtwdev->hal.rcr |= BIT_CBSSID_BCN;
2090 	rtw_write32(rtwdev, REG_RCR, rtwdev->hal.rcr);
2091 
2092 	rtw_core_scan_complete(rtwdev, vif, true);
2093 
2094 	rtwvif = (struct rtw_vif *)vif->drv_priv;
2095 	if (chan)
2096 		rtw_store_op_chan(rtwdev, false);
2097 	rtw_phy_set_tx_power_level(rtwdev, hal->current_channel);
2098 	ieee80211_wake_queues(rtwdev->hw);
2099 	ieee80211_scan_completed(rtwdev->hw, &info);
2100 
2101 	rtwvif->scan_req = NULL;
2102 	rtwvif->scan_ies = NULL;
2103 	rtwdev->scan_info.scanning_vif = NULL;
2104 }
2105 
2106 static int rtw_hw_scan_prehandle(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif,
2107 				 struct rtw_chan_list *list)
2108 {
2109 	struct cfg80211_scan_request *req = rtwvif->scan_req;
2110 	int size = req->n_channels * (RTW_CH_INFO_SIZE + RTW_EX_CH_INFO_SIZE);
2111 	u8 *buf;
2112 	int ret;
2113 
2114 	buf = kmalloc(size, GFP_KERNEL);
2115 	if (!buf)
2116 		return -ENOMEM;
2117 
2118 	ret = rtw_hw_scan_update_probe_req(rtwdev, rtwvif);
2119 	if (ret) {
2120 		rtw_err(rtwdev, "Update probe request failed\n");
2121 		goto out;
2122 	}
2123 
2124 	list->buf_size = size;
2125 	list->size = 0;
2126 	list->ch_num = 0;
2127 	ret = rtw_add_chan_list(rtwdev, rtwvif, list, buf);
2128 out:
2129 	kfree(buf);
2130 
2131 	return ret;
2132 }
2133 
2134 int rtw_hw_scan_offload(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
2135 			bool enable)
2136 {
2137 	struct rtw_vif *rtwvif = vif ? (struct rtw_vif *)vif->drv_priv : NULL;
2138 	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2139 	struct rtw_ch_switch_option cs_option = {0};
2140 	struct rtw_chan_list chan_list = {0};
2141 	int ret = 0;
2142 
2143 	if (!rtwvif)
2144 		return -EINVAL;
2145 
2146 	cs_option.switch_en = enable;
2147 	cs_option.back_op_en = scan_info->op_chan != 0;
2148 	if (enable) {
2149 		ret = rtw_hw_scan_prehandle(rtwdev, rtwvif, &chan_list);
2150 		if (ret)
2151 			goto out;
2152 	}
2153 	rtw_fw_set_scan_offload(rtwdev, &cs_option, rtwvif, &chan_list);
2154 out:
2155 	return ret;
2156 }
2157 
2158 void rtw_hw_scan_abort(struct rtw_dev *rtwdev, struct ieee80211_vif *vif)
2159 {
2160 	if (!rtw_fw_feature_check(&rtwdev->fw, FW_FEATURE_SCAN_OFFLOAD))
2161 		return;
2162 
2163 	rtw_hw_scan_offload(rtwdev, vif, false);
2164 	rtw_hw_scan_complete(rtwdev, vif, true);
2165 }
2166 
2167 void rtw_hw_scan_status_report(struct rtw_dev *rtwdev, struct sk_buff *skb)
2168 {
2169 	struct ieee80211_vif *vif = rtwdev->scan_info.scanning_vif;
2170 	struct rtw_c2h_cmd *c2h;
2171 	bool aborted;
2172 	u8 rc;
2173 
2174 	if (!test_bit(RTW_FLAG_SCANNING, rtwdev->flags))
2175 		return;
2176 
2177 	c2h = get_c2h_from_skb(skb);
2178 	rc = GET_SCAN_REPORT_RETURN_CODE(c2h->payload);
2179 	aborted = rc != RTW_SCAN_REPORT_SUCCESS;
2180 	rtw_hw_scan_complete(rtwdev, vif, aborted);
2181 
2182 	if (aborted)
2183 		rtw_dbg(rtwdev, RTW_DBG_HW_SCAN, "HW scan aborted with code: %d\n", rc);
2184 }
2185 
2186 void rtw_store_op_chan(struct rtw_dev *rtwdev, bool backup)
2187 {
2188 	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2189 	struct rtw_hal *hal = &rtwdev->hal;
2190 	u8 band;
2191 
2192 	if (backup) {
2193 		scan_info->op_chan = hal->current_channel;
2194 		scan_info->op_bw = hal->current_band_width;
2195 		scan_info->op_pri_ch_idx = hal->current_primary_channel_index;
2196 		scan_info->op_pri_ch = hal->primary_channel;
2197 	} else {
2198 		band = scan_info->op_chan > 14 ? RTW_BAND_5G : RTW_BAND_2G;
2199 		rtw_update_channel(rtwdev, scan_info->op_chan,
2200 				   scan_info->op_pri_ch,
2201 				   band, scan_info->op_bw);
2202 	}
2203 }
2204 
2205 void rtw_clear_op_chan(struct rtw_dev *rtwdev)
2206 {
2207 	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2208 
2209 	scan_info->op_chan = 0;
2210 	scan_info->op_bw = 0;
2211 	scan_info->op_pri_ch_idx = 0;
2212 	scan_info->op_pri_ch = 0;
2213 }
2214 
2215 static bool rtw_is_op_chan(struct rtw_dev *rtwdev, u8 channel)
2216 {
2217 	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2218 
2219 	return channel == scan_info->op_chan;
2220 }
2221 
2222 void rtw_hw_scan_chan_switch(struct rtw_dev *rtwdev, struct sk_buff *skb)
2223 {
2224 	struct rtw_hal *hal = &rtwdev->hal;
2225 	struct rtw_c2h_cmd *c2h;
2226 	enum rtw_scan_notify_id id;
2227 	u8 chan, band, status;
2228 
2229 	if (!test_bit(RTW_FLAG_SCANNING, rtwdev->flags))
2230 		return;
2231 
2232 	c2h = get_c2h_from_skb(skb);
2233 	chan = GET_CHAN_SWITCH_CENTRAL_CH(c2h->payload);
2234 	id = GET_CHAN_SWITCH_ID(c2h->payload);
2235 	status = GET_CHAN_SWITCH_STATUS(c2h->payload);
2236 
2237 	if (id == RTW_SCAN_NOTIFY_ID_POSTSWITCH) {
2238 		band = chan > 14 ? RTW_BAND_5G : RTW_BAND_2G;
2239 		rtw_update_channel(rtwdev, chan, chan, band,
2240 				   RTW_CHANNEL_WIDTH_20);
2241 		if (rtw_is_op_chan(rtwdev, chan)) {
2242 			rtw_store_op_chan(rtwdev, false);
2243 			ieee80211_wake_queues(rtwdev->hw);
2244 		}
2245 	} else if (id == RTW_SCAN_NOTIFY_ID_PRESWITCH) {
2246 		if (IS_CH_5G_BAND(chan)) {
2247 			rtw_coex_switchband_notify(rtwdev, COEX_SWITCH_TO_5G);
2248 		} else if (IS_CH_2G_BAND(chan)) {
2249 			u8 chan_type;
2250 
2251 			if (test_bit(RTW_FLAG_SCANNING, rtwdev->flags))
2252 				chan_type = COEX_SWITCH_TO_24G;
2253 			else
2254 				chan_type = COEX_SWITCH_TO_24G_NOFORSCAN;
2255 			rtw_coex_switchband_notify(rtwdev, chan_type);
2256 		}
2257 		/* The channel of C2H RTW_SCAN_NOTIFY_ID_PRESWITCH is next
2258 		 * channel that hardware will switch. We need to stop queue
2259 		 * if next channel is non-op channel.
2260 		 */
2261 		if (!rtw_is_op_chan(rtwdev, chan) &&
2262 		    rtw_is_op_chan(rtwdev, hal->current_channel))
2263 			ieee80211_stop_queues(rtwdev->hw);
2264 	}
2265 
2266 	rtw_dbg(rtwdev, RTW_DBG_HW_SCAN,
2267 		"Chan switch: %x, id: %x, status: %x\n", chan, id, status);
2268 }
2269