1 /* 2 * (c) Copyright 2002-2010, Ralink Technology, Inc. 3 * Copyright (C) 2014 Felix Fietkau <nbd@openwrt.org> 4 * Copyright (C) 2015 Jakub Kicinski <kubakici@wp.pl> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 8 * as published by the Free Software Foundation 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 */ 15 16 #include <linux/kernel.h> 17 #include <linux/firmware.h> 18 #include <linux/delay.h> 19 #include <linux/usb.h> 20 #include <linux/skbuff.h> 21 22 #include "mt7601u.h" 23 #include "dma.h" 24 #include "mcu.h" 25 #include "usb.h" 26 #include "trace.h" 27 28 #define MCU_FW_URB_MAX_PAYLOAD 0x3800 29 #define MCU_FW_URB_SIZE (MCU_FW_URB_MAX_PAYLOAD + 12) 30 #define MCU_RESP_URB_SIZE 1024 31 32 static inline int firmware_running(struct mt7601u_dev *dev) 33 { 34 return mt7601u_rr(dev, MT_MCU_COM_REG0) == 1; 35 } 36 37 static inline void skb_put_le32(struct sk_buff *skb, u32 val) 38 { 39 put_unaligned_le32(val, skb_put(skb, 4)); 40 } 41 42 static inline void mt7601u_dma_skb_wrap_cmd(struct sk_buff *skb, 43 u8 seq, enum mcu_cmd cmd) 44 { 45 WARN_ON(mt7601u_dma_skb_wrap(skb, CPU_TX_PORT, DMA_COMMAND, 46 FIELD_PREP(MT_TXD_CMD_INFO_SEQ, seq) | 47 FIELD_PREP(MT_TXD_CMD_INFO_TYPE, cmd))); 48 } 49 50 static inline void trace_mt_mcu_msg_send_cs(struct mt7601u_dev *dev, 51 struct sk_buff *skb, bool need_resp) 52 { 53 u32 i, csum = 0; 54 55 for (i = 0; i < skb->len / 4; i++) 56 csum ^= get_unaligned_le32(skb->data + i * 4); 57 58 trace_mt_mcu_msg_send(dev, skb, csum, need_resp); 59 } 60 61 static struct sk_buff *mt7601u_mcu_msg_alloc(const void *data, int len) 62 { 63 struct sk_buff *skb; 64 65 WARN_ON(len % 4); /* if length is not divisible by 4 we need to pad */ 66 67 skb = alloc_skb(len + MT_DMA_HDR_LEN + 4, GFP_KERNEL); 68 if (skb) { 69 skb_reserve(skb, MT_DMA_HDR_LEN); 70 skb_put_data(skb, data, len); 71 } 72 73 return skb; 74 } 75 76 static int mt7601u_mcu_wait_resp(struct mt7601u_dev *dev, u8 seq) 77 { 78 struct urb *urb = dev->mcu.resp.urb; 79 u32 rxfce; 80 int urb_status, ret, i = 5; 81 82 while (i--) { 83 if (!wait_for_completion_timeout(&dev->mcu.resp_cmpl, 84 msecs_to_jiffies(300))) { 85 dev_warn(dev->dev, "Warning: %s retrying\n", __func__); 86 continue; 87 } 88 89 /* Make copies of important data before reusing the urb */ 90 rxfce = get_unaligned_le32(dev->mcu.resp.buf); 91 urb_status = urb->status * mt7601u_urb_has_error(urb); 92 93 ret = mt7601u_usb_submit_buf(dev, USB_DIR_IN, MT_EP_IN_CMD_RESP, 94 &dev->mcu.resp, GFP_KERNEL, 95 mt7601u_complete_urb, 96 &dev->mcu.resp_cmpl); 97 if (ret) 98 return ret; 99 100 if (urb_status) 101 dev_err(dev->dev, "Error: MCU resp urb failed:%d\n", 102 urb_status); 103 104 if (FIELD_GET(MT_RXD_CMD_INFO_CMD_SEQ, rxfce) == seq && 105 FIELD_GET(MT_RXD_CMD_INFO_EVT_TYPE, rxfce) == CMD_DONE) 106 return 0; 107 108 dev_err(dev->dev, "Error: MCU resp evt:%lx seq:%hhx-%lx!\n", 109 FIELD_GET(MT_RXD_CMD_INFO_EVT_TYPE, rxfce), 110 seq, FIELD_GET(MT_RXD_CMD_INFO_CMD_SEQ, rxfce)); 111 } 112 113 dev_err(dev->dev, "Error: %s timed out\n", __func__); 114 return -ETIMEDOUT; 115 } 116 117 static int 118 mt7601u_mcu_msg_send(struct mt7601u_dev *dev, struct sk_buff *skb, 119 enum mcu_cmd cmd, bool wait_resp) 120 { 121 struct usb_device *usb_dev = mt7601u_to_usb_dev(dev); 122 unsigned cmd_pipe = usb_sndbulkpipe(usb_dev, 123 dev->out_eps[MT_EP_OUT_INBAND_CMD]); 124 int sent, ret; 125 u8 seq = 0; 126 127 if (test_bit(MT7601U_STATE_REMOVED, &dev->state)) 128 return 0; 129 130 mutex_lock(&dev->mcu.mutex); 131 132 if (wait_resp) 133 while (!seq) 134 seq = ++dev->mcu.msg_seq & 0xf; 135 136 mt7601u_dma_skb_wrap_cmd(skb, seq, cmd); 137 138 if (dev->mcu.resp_cmpl.done) 139 dev_err(dev->dev, "Error: MCU response pre-completed!\n"); 140 141 trace_mt_mcu_msg_send_cs(dev, skb, wait_resp); 142 trace_mt_submit_urb_sync(dev, cmd_pipe, skb->len); 143 ret = usb_bulk_msg(usb_dev, cmd_pipe, skb->data, skb->len, &sent, 500); 144 if (ret) { 145 dev_err(dev->dev, "Error: send MCU cmd failed:%d\n", ret); 146 goto out; 147 } 148 if (sent != skb->len) 149 dev_err(dev->dev, "Error: %s sent != skb->len\n", __func__); 150 151 if (wait_resp) 152 ret = mt7601u_mcu_wait_resp(dev, seq); 153 out: 154 mutex_unlock(&dev->mcu.mutex); 155 156 consume_skb(skb); 157 158 return ret; 159 } 160 161 static int mt7601u_mcu_function_select(struct mt7601u_dev *dev, 162 enum mcu_function func, u32 val) 163 { 164 struct sk_buff *skb; 165 struct { 166 __le32 id; 167 __le32 value; 168 } __packed __aligned(4) msg = { 169 .id = cpu_to_le32(func), 170 .value = cpu_to_le32(val), 171 }; 172 173 skb = mt7601u_mcu_msg_alloc(&msg, sizeof(msg)); 174 if (!skb) 175 return -ENOMEM; 176 return mt7601u_mcu_msg_send(dev, skb, CMD_FUN_SET_OP, func == 5); 177 } 178 179 int mt7601u_mcu_tssi_read_kick(struct mt7601u_dev *dev, int use_hvga) 180 { 181 int ret; 182 183 if (!test_bit(MT7601U_STATE_MCU_RUNNING, &dev->state)) 184 return 0; 185 186 ret = mt7601u_mcu_function_select(dev, ATOMIC_TSSI_SETTING, 187 use_hvga); 188 if (ret) { 189 dev_warn(dev->dev, "Warning: MCU TSSI read kick failed\n"); 190 return ret; 191 } 192 193 dev->tssi_read_trig = true; 194 195 return 0; 196 } 197 198 int 199 mt7601u_mcu_calibrate(struct mt7601u_dev *dev, enum mcu_calibrate cal, u32 val) 200 { 201 struct sk_buff *skb; 202 struct { 203 __le32 id; 204 __le32 value; 205 } __packed __aligned(4) msg = { 206 .id = cpu_to_le32(cal), 207 .value = cpu_to_le32(val), 208 }; 209 210 skb = mt7601u_mcu_msg_alloc(&msg, sizeof(msg)); 211 if (!skb) 212 return -ENOMEM; 213 return mt7601u_mcu_msg_send(dev, skb, CMD_CALIBRATION_OP, true); 214 } 215 216 int mt7601u_write_reg_pairs(struct mt7601u_dev *dev, u32 base, 217 const struct mt76_reg_pair *data, int n) 218 { 219 const int max_vals_per_cmd = INBAND_PACKET_MAX_LEN / 8; 220 struct sk_buff *skb; 221 int cnt, i, ret; 222 223 if (!n) 224 return 0; 225 226 cnt = min(max_vals_per_cmd, n); 227 228 skb = alloc_skb(cnt * 8 + MT_DMA_HDR_LEN + 4, GFP_KERNEL); 229 if (!skb) 230 return -ENOMEM; 231 skb_reserve(skb, MT_DMA_HDR_LEN); 232 233 for (i = 0; i < cnt; i++) { 234 skb_put_le32(skb, base + data[i].reg); 235 skb_put_le32(skb, data[i].value); 236 } 237 238 ret = mt7601u_mcu_msg_send(dev, skb, CMD_RANDOM_WRITE, cnt == n); 239 if (ret) 240 return ret; 241 242 return mt7601u_write_reg_pairs(dev, base, data + cnt, n - cnt); 243 } 244 245 int mt7601u_burst_write_regs(struct mt7601u_dev *dev, u32 offset, 246 const u32 *data, int n) 247 { 248 const int max_regs_per_cmd = INBAND_PACKET_MAX_LEN / 4 - 1; 249 struct sk_buff *skb; 250 int cnt, i, ret; 251 252 if (!n) 253 return 0; 254 255 cnt = min(max_regs_per_cmd, n); 256 257 skb = alloc_skb(cnt * 4 + MT_DMA_HDR_LEN + 4, GFP_KERNEL); 258 if (!skb) 259 return -ENOMEM; 260 skb_reserve(skb, MT_DMA_HDR_LEN); 261 262 skb_put_le32(skb, MT_MCU_MEMMAP_WLAN + offset); 263 for (i = 0; i < cnt; i++) 264 skb_put_le32(skb, data[i]); 265 266 ret = mt7601u_mcu_msg_send(dev, skb, CMD_BURST_WRITE, cnt == n); 267 if (ret) 268 return ret; 269 270 return mt7601u_burst_write_regs(dev, offset + cnt * 4, 271 data + cnt, n - cnt); 272 } 273 274 struct mt76_fw_header { 275 __le32 ilm_len; 276 __le32 dlm_len; 277 __le16 build_ver; 278 __le16 fw_ver; 279 u8 pad[4]; 280 char build_time[16]; 281 }; 282 283 struct mt76_fw { 284 struct mt76_fw_header hdr; 285 u8 ivb[MT_MCU_IVB_SIZE]; 286 u8 ilm[]; 287 }; 288 289 static int __mt7601u_dma_fw(struct mt7601u_dev *dev, 290 const struct mt7601u_dma_buf *dma_buf, 291 const void *data, u32 len, u32 dst_addr) 292 { 293 DECLARE_COMPLETION_ONSTACK(cmpl); 294 struct mt7601u_dma_buf buf = *dma_buf; /* we need to fake length */ 295 __le32 reg; 296 u32 val; 297 int ret; 298 299 reg = cpu_to_le32(FIELD_PREP(MT_TXD_INFO_TYPE, DMA_PACKET) | 300 FIELD_PREP(MT_TXD_INFO_D_PORT, CPU_TX_PORT) | 301 FIELD_PREP(MT_TXD_INFO_LEN, len)); 302 memcpy(buf.buf, ®, sizeof(reg)); 303 memcpy(buf.buf + sizeof(reg), data, len); 304 memset(buf.buf + sizeof(reg) + len, 0, 8); 305 306 ret = mt7601u_vendor_single_wr(dev, MT_VEND_WRITE_FCE, 307 MT_FCE_DMA_ADDR, dst_addr); 308 if (ret) 309 return ret; 310 len = roundup(len, 4); 311 ret = mt7601u_vendor_single_wr(dev, MT_VEND_WRITE_FCE, 312 MT_FCE_DMA_LEN, len << 16); 313 if (ret) 314 return ret; 315 316 buf.len = MT_DMA_HDR_LEN + len + 4; 317 ret = mt7601u_usb_submit_buf(dev, USB_DIR_OUT, MT_EP_OUT_INBAND_CMD, 318 &buf, GFP_KERNEL, 319 mt7601u_complete_urb, &cmpl); 320 if (ret) 321 return ret; 322 323 if (!wait_for_completion_timeout(&cmpl, msecs_to_jiffies(1000))) { 324 dev_err(dev->dev, "Error: firmware upload timed out\n"); 325 usb_kill_urb(buf.urb); 326 return -ETIMEDOUT; 327 } 328 if (mt7601u_urb_has_error(buf.urb)) { 329 dev_err(dev->dev, "Error: firmware upload urb failed:%d\n", 330 buf.urb->status); 331 return buf.urb->status; 332 } 333 334 val = mt7601u_rr(dev, MT_TX_CPU_FROM_FCE_CPU_DESC_IDX); 335 val++; 336 mt7601u_wr(dev, MT_TX_CPU_FROM_FCE_CPU_DESC_IDX, val); 337 338 return 0; 339 } 340 341 static int 342 mt7601u_dma_fw(struct mt7601u_dev *dev, struct mt7601u_dma_buf *dma_buf, 343 const void *data, int len, u32 dst_addr) 344 { 345 int n, ret; 346 347 if (len == 0) 348 return 0; 349 350 n = min(MCU_FW_URB_MAX_PAYLOAD, len); 351 ret = __mt7601u_dma_fw(dev, dma_buf, data, n, dst_addr); 352 if (ret) 353 return ret; 354 355 if (!mt76_poll_msec(dev, MT_MCU_COM_REG1, BIT(31), BIT(31), 500)) 356 return -ETIMEDOUT; 357 358 return mt7601u_dma_fw(dev, dma_buf, data + n, len - n, dst_addr + n); 359 } 360 361 static int 362 mt7601u_upload_firmware(struct mt7601u_dev *dev, const struct mt76_fw *fw) 363 { 364 struct mt7601u_dma_buf dma_buf; 365 void *ivb; 366 u32 ilm_len, dlm_len; 367 int i, ret; 368 369 ivb = kmemdup(fw->ivb, sizeof(fw->ivb), GFP_KERNEL); 370 if (!ivb) 371 return -ENOMEM; 372 if (mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf)) { 373 ret = -ENOMEM; 374 goto error; 375 } 376 377 ilm_len = le32_to_cpu(fw->hdr.ilm_len) - sizeof(fw->ivb); 378 dev_dbg(dev->dev, "loading FW - ILM %u + IVB %zu\n", 379 ilm_len, sizeof(fw->ivb)); 380 ret = mt7601u_dma_fw(dev, &dma_buf, fw->ilm, ilm_len, sizeof(fw->ivb)); 381 if (ret) 382 goto error; 383 384 dlm_len = le32_to_cpu(fw->hdr.dlm_len); 385 dev_dbg(dev->dev, "loading FW - DLM %u\n", dlm_len); 386 ret = mt7601u_dma_fw(dev, &dma_buf, fw->ilm + ilm_len, 387 dlm_len, MT_MCU_DLM_OFFSET); 388 if (ret) 389 goto error; 390 391 ret = mt7601u_vendor_request(dev, MT_VEND_DEV_MODE, USB_DIR_OUT, 392 0x12, 0, ivb, sizeof(fw->ivb)); 393 if (ret < 0) 394 goto error; 395 ret = 0; 396 397 for (i = 100; i && !firmware_running(dev); i--) 398 msleep(10); 399 if (!i) { 400 ret = -ETIMEDOUT; 401 goto error; 402 } 403 404 dev_dbg(dev->dev, "Firmware running!\n"); 405 error: 406 kfree(ivb); 407 mt7601u_usb_free_buf(dev, &dma_buf); 408 409 return ret; 410 } 411 412 static int mt7601u_load_firmware(struct mt7601u_dev *dev) 413 { 414 const struct firmware *fw; 415 const struct mt76_fw_header *hdr; 416 int len, ret; 417 u32 val; 418 419 mt7601u_wr(dev, MT_USB_DMA_CFG, (MT_USB_DMA_CFG_RX_BULK_EN | 420 MT_USB_DMA_CFG_TX_BULK_EN)); 421 422 if (firmware_running(dev)) 423 return firmware_request_cache(dev->dev, MT7601U_FIRMWARE); 424 425 ret = request_firmware(&fw, MT7601U_FIRMWARE, dev->dev); 426 if (ret) 427 return ret; 428 429 if (!fw || !fw->data || fw->size < sizeof(*hdr)) 430 goto err_inv_fw; 431 432 hdr = (const struct mt76_fw_header *) fw->data; 433 434 if (le32_to_cpu(hdr->ilm_len) <= MT_MCU_IVB_SIZE) 435 goto err_inv_fw; 436 437 len = sizeof(*hdr); 438 len += le32_to_cpu(hdr->ilm_len); 439 len += le32_to_cpu(hdr->dlm_len); 440 441 if (fw->size != len) 442 goto err_inv_fw; 443 444 val = le16_to_cpu(hdr->fw_ver); 445 dev_info(dev->dev, 446 "Firmware Version: %d.%d.%02d Build: %x Build time: %.16s\n", 447 (val >> 12) & 0xf, (val >> 8) & 0xf, val & 0xf, 448 le16_to_cpu(hdr->build_ver), hdr->build_time); 449 450 len = le32_to_cpu(hdr->ilm_len); 451 452 mt7601u_wr(dev, 0x94c, 0); 453 mt7601u_wr(dev, MT_FCE_PSE_CTRL, 0); 454 455 mt7601u_vendor_reset(dev); 456 msleep(5); 457 458 mt7601u_wr(dev, 0xa44, 0); 459 mt7601u_wr(dev, 0x230, 0x84210); 460 mt7601u_wr(dev, 0x400, 0x80c00); 461 mt7601u_wr(dev, 0x800, 1); 462 463 mt7601u_rmw(dev, MT_PBF_CFG, 0, (MT_PBF_CFG_TX0Q_EN | 464 MT_PBF_CFG_TX1Q_EN | 465 MT_PBF_CFG_TX2Q_EN | 466 MT_PBF_CFG_TX3Q_EN)); 467 468 mt7601u_wr(dev, MT_FCE_PSE_CTRL, 1); 469 470 mt7601u_wr(dev, MT_USB_DMA_CFG, (MT_USB_DMA_CFG_RX_BULK_EN | 471 MT_USB_DMA_CFG_TX_BULK_EN)); 472 val = mt76_set(dev, MT_USB_DMA_CFG, MT_USB_DMA_CFG_TX_CLR); 473 val &= ~MT_USB_DMA_CFG_TX_CLR; 474 mt7601u_wr(dev, MT_USB_DMA_CFG, val); 475 476 /* FCE tx_fs_base_ptr */ 477 mt7601u_wr(dev, MT_TX_CPU_FROM_FCE_BASE_PTR, 0x400230); 478 /* FCE tx_fs_max_cnt */ 479 mt7601u_wr(dev, MT_TX_CPU_FROM_FCE_MAX_COUNT, 1); 480 /* FCE pdma enable */ 481 mt7601u_wr(dev, MT_FCE_PDMA_GLOBAL_CONF, 0x44); 482 /* FCE skip_fs_en */ 483 mt7601u_wr(dev, MT_FCE_SKIP_FS, 3); 484 485 ret = mt7601u_upload_firmware(dev, (const struct mt76_fw *)fw->data); 486 487 release_firmware(fw); 488 489 return ret; 490 491 err_inv_fw: 492 dev_err(dev->dev, "Invalid firmware image\n"); 493 release_firmware(fw); 494 return -ENOENT; 495 } 496 497 int mt7601u_mcu_init(struct mt7601u_dev *dev) 498 { 499 int ret; 500 501 mutex_init(&dev->mcu.mutex); 502 503 ret = mt7601u_load_firmware(dev); 504 if (ret) 505 return ret; 506 507 set_bit(MT7601U_STATE_MCU_RUNNING, &dev->state); 508 509 return 0; 510 } 511 512 int mt7601u_mcu_cmd_init(struct mt7601u_dev *dev) 513 { 514 int ret; 515 516 ret = mt7601u_mcu_function_select(dev, Q_SELECT, 1); 517 if (ret) 518 return ret; 519 520 init_completion(&dev->mcu.resp_cmpl); 521 if (mt7601u_usb_alloc_buf(dev, MCU_RESP_URB_SIZE, &dev->mcu.resp)) { 522 mt7601u_usb_free_buf(dev, &dev->mcu.resp); 523 return -ENOMEM; 524 } 525 526 ret = mt7601u_usb_submit_buf(dev, USB_DIR_IN, MT_EP_IN_CMD_RESP, 527 &dev->mcu.resp, GFP_KERNEL, 528 mt7601u_complete_urb, &dev->mcu.resp_cmpl); 529 if (ret) { 530 mt7601u_usb_free_buf(dev, &dev->mcu.resp); 531 return ret; 532 } 533 534 return 0; 535 } 536 537 void mt7601u_mcu_cmd_deinit(struct mt7601u_dev *dev) 538 { 539 usb_kill_urb(dev->mcu.resp.urb); 540 mt7601u_usb_free_buf(dev, &dev->mcu.resp); 541 } 542