1 /* SPDX-License-Identifier: ISC */ 2 3 #include <linux/firmware.h> 4 #include "mt7603.h" 5 #include "mcu.h" 6 #include "eeprom.h" 7 8 #define MCU_SKB_RESERVE 8 9 10 struct mt7603_fw_trailer { 11 char fw_ver[10]; 12 char build_date[15]; 13 __le32 dl_len; 14 } __packed; 15 16 static int 17 __mt7603_mcu_msg_send(struct mt7603_dev *dev, struct sk_buff *skb, int cmd, 18 int query, int *wait_seq) 19 { 20 int hdrlen = dev->mcu_running ? sizeof(struct mt7603_mcu_txd) : 12; 21 struct mt76_dev *mdev = &dev->mt76; 22 struct mt7603_mcu_txd *txd; 23 u8 seq; 24 25 if (!skb) 26 return -EINVAL; 27 28 seq = ++mdev->mmio.mcu.msg_seq & 0xf; 29 if (!seq) 30 seq = ++mdev->mmio.mcu.msg_seq & 0xf; 31 32 txd = (struct mt7603_mcu_txd *)skb_push(skb, hdrlen); 33 memset(txd, 0, hdrlen); 34 35 txd->len = cpu_to_le16(skb->len); 36 if (cmd == -MCU_CMD_FW_SCATTER) 37 txd->pq_id = cpu_to_le16(MCU_PORT_QUEUE_FW); 38 else 39 txd->pq_id = cpu_to_le16(MCU_PORT_QUEUE); 40 txd->pkt_type = MCU_PKT_ID; 41 txd->seq = seq; 42 43 if (cmd < 0) { 44 txd->cid = -cmd; 45 } else { 46 txd->cid = MCU_CMD_EXT_CID; 47 txd->ext_cid = cmd; 48 if (query != MCU_Q_NA) 49 txd->ext_cid_ack = 1; 50 } 51 52 txd->set_query = query; 53 54 if (wait_seq) 55 *wait_seq = seq; 56 57 return mt76_tx_queue_skb_raw(dev, MT_TXQ_MCU, skb, 0); 58 } 59 60 static int 61 mt7603_mcu_msg_send(struct mt7603_dev *dev, struct sk_buff *skb, int cmd, 62 int query) 63 { 64 struct mt76_dev *mdev = &dev->mt76; 65 unsigned long expires = jiffies + 3 * HZ; 66 struct mt7603_mcu_rxd *rxd; 67 int ret, seq; 68 69 mutex_lock(&mdev->mmio.mcu.mutex); 70 71 ret = __mt7603_mcu_msg_send(dev, skb, cmd, query, &seq); 72 if (ret) 73 goto out; 74 75 while (1) { 76 bool check_seq = false; 77 78 skb = mt76_mcu_get_response(&dev->mt76, expires); 79 if (!skb) { 80 dev_err(mdev->dev, 81 "MCU message %d (seq %d) timed out\n", 82 cmd, seq); 83 dev->mcu_hang = MT7603_WATCHDOG_TIMEOUT; 84 ret = -ETIMEDOUT; 85 break; 86 } 87 88 rxd = (struct mt7603_mcu_rxd *)skb->data; 89 if (seq == rxd->seq) 90 check_seq = true; 91 92 dev_kfree_skb(skb); 93 94 if (check_seq) 95 break; 96 } 97 98 out: 99 mutex_unlock(&mdev->mmio.mcu.mutex); 100 101 return ret; 102 } 103 104 static int 105 mt7603_mcu_init_download(struct mt7603_dev *dev, u32 addr, u32 len) 106 { 107 struct { 108 __le32 addr; 109 __le32 len; 110 __le32 mode; 111 } req = { 112 .addr = cpu_to_le32(addr), 113 .len = cpu_to_le32(len), 114 .mode = cpu_to_le32(BIT(31)), 115 }; 116 struct sk_buff *skb = mt7603_mcu_msg_alloc(&req, sizeof(req)); 117 118 return mt7603_mcu_msg_send(dev, skb, -MCU_CMD_TARGET_ADDRESS_LEN_REQ, 119 MCU_Q_NA); 120 } 121 122 static int 123 mt7603_mcu_send_firmware(struct mt7603_dev *dev, const void *data, int len) 124 { 125 struct sk_buff *skb; 126 int ret = 0; 127 128 while (len > 0) { 129 int cur_len = min_t(int, 4096 - sizeof(struct mt7603_mcu_txd), 130 len); 131 132 skb = mt7603_mcu_msg_alloc(data, cur_len); 133 if (!skb) 134 return -ENOMEM; 135 136 ret = __mt7603_mcu_msg_send(dev, skb, -MCU_CMD_FW_SCATTER, 137 MCU_Q_NA, NULL); 138 if (ret) 139 break; 140 141 data += cur_len; 142 len -= cur_len; 143 } 144 145 return ret; 146 } 147 148 static int 149 mt7603_mcu_start_firmware(struct mt7603_dev *dev, u32 addr) 150 { 151 struct { 152 __le32 override; 153 __le32 addr; 154 } req = { 155 .override = cpu_to_le32(addr ? 1 : 0), 156 .addr = cpu_to_le32(addr), 157 }; 158 struct sk_buff *skb = mt7603_mcu_msg_alloc(&req, sizeof(req)); 159 160 return mt7603_mcu_msg_send(dev, skb, -MCU_CMD_FW_START_REQ, 161 MCU_Q_NA); 162 } 163 164 static int 165 mt7603_mcu_restart(struct mt7603_dev *dev) 166 { 167 struct sk_buff *skb = mt7603_mcu_msg_alloc(NULL, 0); 168 169 return mt7603_mcu_msg_send(dev, skb, -MCU_CMD_RESTART_DL_REQ, 170 MCU_Q_NA); 171 } 172 173 static int 174 mt7603_load_firmware(struct mt7603_dev *dev) 175 { 176 const struct firmware *fw; 177 const struct mt7603_fw_trailer *hdr; 178 const char *firmware; 179 int dl_len; 180 u32 addr, val; 181 int ret; 182 183 if (is_mt7628(dev)) { 184 if (mt76xx_rev(dev) == MT7628_REV_E1) 185 firmware = MT7628_FIRMWARE_E1; 186 else 187 firmware = MT7628_FIRMWARE_E2; 188 } else { 189 if (mt76xx_rev(dev) < MT7603_REV_E2) 190 firmware = MT7603_FIRMWARE_E1; 191 else 192 firmware = MT7603_FIRMWARE_E2; 193 } 194 195 ret = request_firmware(&fw, firmware, dev->mt76.dev); 196 if (ret) 197 return ret; 198 199 if (!fw || !fw->data || fw->size < sizeof(*hdr)) { 200 dev_err(dev->mt76.dev, "Invalid firmware\n"); 201 ret = -EINVAL; 202 goto out; 203 } 204 205 hdr = (const struct mt7603_fw_trailer *)(fw->data + fw->size - 206 sizeof(*hdr)); 207 208 dev_info(dev->mt76.dev, "Firmware Version: %.10s\n", hdr->fw_ver); 209 dev_info(dev->mt76.dev, "Build Time: %.15s\n", hdr->build_date); 210 211 addr = mt7603_reg_map(dev, 0x50012498); 212 mt76_wr(dev, addr, 0x5); 213 mt76_wr(dev, addr, 0x5); 214 udelay(1); 215 216 /* switch to bypass mode */ 217 mt76_rmw(dev, MT_SCH_4, MT_SCH_4_FORCE_QID, 218 MT_SCH_4_BYPASS | FIELD_PREP(MT_SCH_4_FORCE_QID, 5)); 219 220 val = mt76_rr(dev, MT_TOP_MISC2); 221 if (val & BIT(1)) { 222 dev_info(dev->mt76.dev, "Firmware already running...\n"); 223 goto running; 224 } 225 226 if (!mt76_poll_msec(dev, MT_TOP_MISC2, BIT(0) | BIT(1), BIT(0), 500)) { 227 dev_err(dev->mt76.dev, "Timeout waiting for ROM code to become ready\n"); 228 ret = -EIO; 229 goto out; 230 } 231 232 dl_len = le32_to_cpu(hdr->dl_len) + 4; 233 ret = mt7603_mcu_init_download(dev, MCU_FIRMWARE_ADDRESS, dl_len); 234 if (ret) { 235 dev_err(dev->mt76.dev, "Download request failed\n"); 236 goto out; 237 } 238 239 ret = mt7603_mcu_send_firmware(dev, fw->data, dl_len); 240 if (ret) { 241 dev_err(dev->mt76.dev, "Failed to send firmware to device\n"); 242 goto out; 243 } 244 245 ret = mt7603_mcu_start_firmware(dev, MCU_FIRMWARE_ADDRESS); 246 if (ret) { 247 dev_err(dev->mt76.dev, "Failed to start firmware\n"); 248 goto out; 249 } 250 251 if (!mt76_poll_msec(dev, MT_TOP_MISC2, BIT(1), BIT(1), 500)) { 252 dev_err(dev->mt76.dev, "Timeout waiting for firmware to initialize\n"); 253 ret = -EIO; 254 goto out; 255 } 256 257 running: 258 mt76_clear(dev, MT_SCH_4, MT_SCH_4_FORCE_QID | MT_SCH_4_BYPASS); 259 260 mt76_set(dev, MT_SCH_4, BIT(8)); 261 mt76_clear(dev, MT_SCH_4, BIT(8)); 262 263 dev->mcu_running = true; 264 dev_info(dev->mt76.dev, "firmware init done\n"); 265 266 out: 267 release_firmware(fw); 268 269 return ret; 270 } 271 272 int mt7603_mcu_init(struct mt7603_dev *dev) 273 { 274 mutex_init(&dev->mt76.mmio.mcu.mutex); 275 276 return mt7603_load_firmware(dev); 277 } 278 279 void mt7603_mcu_exit(struct mt7603_dev *dev) 280 { 281 mt7603_mcu_restart(dev); 282 skb_queue_purge(&dev->mt76.mmio.mcu.res_q); 283 } 284 285 int mt7603_mcu_set_eeprom(struct mt7603_dev *dev) 286 { 287 static const u16 req_fields[] = { 288 #define WORD(_start) \ 289 _start, \ 290 _start + 1 291 #define GROUP_2G(_start) \ 292 WORD(_start), \ 293 WORD(_start + 2), \ 294 WORD(_start + 4) 295 296 MT_EE_NIC_CONF_0 + 1, 297 WORD(MT_EE_NIC_CONF_1), 298 MT_EE_WIFI_RF_SETTING, 299 MT_EE_TX_POWER_DELTA_BW40, 300 MT_EE_TX_POWER_DELTA_BW80 + 1, 301 MT_EE_TX_POWER_EXT_PA_5G, 302 MT_EE_TEMP_SENSOR_CAL, 303 GROUP_2G(MT_EE_TX_POWER_0_START_2G), 304 GROUP_2G(MT_EE_TX_POWER_1_START_2G), 305 WORD(MT_EE_TX_POWER_CCK), 306 WORD(MT_EE_TX_POWER_OFDM_2G_6M), 307 WORD(MT_EE_TX_POWER_OFDM_2G_24M), 308 WORD(MT_EE_TX_POWER_OFDM_2G_54M), 309 WORD(MT_EE_TX_POWER_HT_BPSK_QPSK), 310 WORD(MT_EE_TX_POWER_HT_16_64_QAM), 311 WORD(MT_EE_TX_POWER_HT_64_QAM), 312 MT_EE_ELAN_RX_MODE_GAIN, 313 MT_EE_ELAN_RX_MODE_NF, 314 MT_EE_ELAN_RX_MODE_P1DB, 315 MT_EE_ELAN_BYPASS_MODE_GAIN, 316 MT_EE_ELAN_BYPASS_MODE_NF, 317 MT_EE_ELAN_BYPASS_MODE_P1DB, 318 WORD(MT_EE_STEP_NUM_NEG_6_7), 319 WORD(MT_EE_STEP_NUM_NEG_4_5), 320 WORD(MT_EE_STEP_NUM_NEG_2_3), 321 WORD(MT_EE_STEP_NUM_NEG_0_1), 322 WORD(MT_EE_REF_STEP_24G), 323 WORD(MT_EE_STEP_NUM_PLUS_1_2), 324 WORD(MT_EE_STEP_NUM_PLUS_3_4), 325 WORD(MT_EE_STEP_NUM_PLUS_5_6), 326 MT_EE_STEP_NUM_PLUS_7, 327 MT_EE_XTAL_FREQ_OFFSET, 328 MT_EE_XTAL_TRIM_2_COMP, 329 MT_EE_XTAL_TRIM_3_COMP, 330 MT_EE_XTAL_WF_RFCAL, 331 332 /* unknown fields below */ 333 WORD(0x24), 334 0x34, 335 0x39, 336 0x3b, 337 WORD(0x42), 338 WORD(0x9e), 339 0xf2, 340 WORD(0xf8), 341 0xfa, 342 0x12e, 343 WORD(0x130), WORD(0x132), WORD(0x134), WORD(0x136), 344 WORD(0x138), WORD(0x13a), WORD(0x13c), WORD(0x13e), 345 346 #undef GROUP_2G 347 #undef WORD 348 349 }; 350 struct req_data { 351 u16 addr; 352 u8 val; 353 u8 pad; 354 } __packed; 355 struct { 356 u8 buffer_mode; 357 u8 len; 358 u8 pad[2]; 359 } req_hdr = { 360 .buffer_mode = 1, 361 .len = ARRAY_SIZE(req_fields) - 1, 362 }; 363 struct sk_buff *skb; 364 struct req_data *data; 365 const int size = 0xff * sizeof(struct req_data); 366 u8 *eep = (u8 *)dev->mt76.eeprom.data; 367 int i; 368 369 BUILD_BUG_ON(ARRAY_SIZE(req_fields) * sizeof(*data) > size); 370 371 skb = mt7603_mcu_msg_alloc(NULL, size + sizeof(req_hdr)); 372 memcpy(skb_put(skb, sizeof(req_hdr)), &req_hdr, sizeof(req_hdr)); 373 data = (struct req_data *)skb_put(skb, size); 374 memset(data, 0, size); 375 376 for (i = 0; i < ARRAY_SIZE(req_fields); i++) { 377 data[i].addr = cpu_to_le16(req_fields[i]); 378 data[i].val = eep[req_fields[i]]; 379 data[i].pad = 0; 380 } 381 382 return mt7603_mcu_msg_send(dev, skb, MCU_EXT_CMD_EFUSE_BUFFER_MODE, 383 MCU_Q_SET); 384 } 385 386 static int mt7603_mcu_set_tx_power(struct mt7603_dev *dev) 387 { 388 struct { 389 u8 center_channel; 390 u8 tssi; 391 u8 temp_comp; 392 u8 target_power[2]; 393 u8 rate_power_delta[14]; 394 u8 bw_power_delta; 395 u8 ch_power_delta[6]; 396 u8 temp_comp_power[17]; 397 u8 reserved; 398 } req = { 399 .center_channel = dev->mt76.chandef.chan->hw_value, 400 #define EEP_VAL(n) ((u8 *)dev->mt76.eeprom.data)[n] 401 .tssi = EEP_VAL(MT_EE_NIC_CONF_1 + 1), 402 .temp_comp = EEP_VAL(MT_EE_NIC_CONF_1), 403 .target_power = { 404 EEP_VAL(MT_EE_TX_POWER_0_START_2G + 2), 405 EEP_VAL(MT_EE_TX_POWER_1_START_2G + 2) 406 }, 407 .bw_power_delta = EEP_VAL(MT_EE_TX_POWER_DELTA_BW40), 408 .ch_power_delta = { 409 EEP_VAL(MT_EE_TX_POWER_0_START_2G + 3), 410 EEP_VAL(MT_EE_TX_POWER_0_START_2G + 4), 411 EEP_VAL(MT_EE_TX_POWER_0_START_2G + 5), 412 EEP_VAL(MT_EE_TX_POWER_1_START_2G + 3), 413 EEP_VAL(MT_EE_TX_POWER_1_START_2G + 4), 414 EEP_VAL(MT_EE_TX_POWER_1_START_2G + 5) 415 }, 416 #undef EEP_VAL 417 }; 418 struct sk_buff *skb; 419 u8 *eep = (u8 *)dev->mt76.eeprom.data; 420 421 memcpy(req.rate_power_delta, eep + MT_EE_TX_POWER_CCK, 422 sizeof(req.rate_power_delta)); 423 424 memcpy(req.temp_comp_power, eep + MT_EE_STEP_NUM_NEG_6_7, 425 sizeof(req.temp_comp_power)); 426 427 skb = mt7603_mcu_msg_alloc(&req, sizeof(req)); 428 return mt7603_mcu_msg_send(dev, skb, MCU_EXT_CMD_SET_TX_POWER_CTRL, 429 MCU_Q_SET); 430 } 431 432 int mt7603_mcu_set_channel(struct mt7603_dev *dev) 433 { 434 struct cfg80211_chan_def *chandef = &dev->mt76.chandef; 435 struct ieee80211_hw *hw = mt76_hw(dev); 436 int n_chains = __sw_hweight8(dev->mt76.antenna_mask); 437 struct { 438 u8 control_chan; 439 u8 center_chan; 440 u8 bw; 441 u8 tx_streams; 442 u8 rx_streams; 443 u8 _res0[7]; 444 u8 txpower[21]; 445 u8 _res1[3]; 446 } req = { 447 .control_chan = chandef->chan->hw_value, 448 .center_chan = chandef->chan->hw_value, 449 .bw = MT_BW_20, 450 .tx_streams = n_chains, 451 .rx_streams = n_chains, 452 }; 453 struct sk_buff *skb; 454 s8 tx_power; 455 int ret; 456 int i; 457 458 if (dev->mt76.chandef.width == NL80211_CHAN_WIDTH_40) { 459 req.bw = MT_BW_40; 460 if (chandef->center_freq1 > chandef->chan->center_freq) 461 req.center_chan += 2; 462 else 463 req.center_chan -= 2; 464 } 465 466 tx_power = hw->conf.power_level * 2; 467 if (dev->mt76.antenna_mask == 3) 468 tx_power -= 6; 469 tx_power = min(tx_power, dev->tx_power_limit); 470 471 dev->mt76.txpower_cur = tx_power; 472 473 for (i = 0; i < ARRAY_SIZE(req.txpower); i++) 474 req.txpower[i] = tx_power; 475 476 skb = mt7603_mcu_msg_alloc(&req, sizeof(req)); 477 ret = mt7603_mcu_msg_send(dev, skb, MCU_EXT_CMD_CHANNEL_SWITCH, 478 MCU_Q_SET); 479 if (ret) 480 return ret; 481 482 return mt7603_mcu_set_tx_power(dev); 483 } 484