1	// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2	/* Copyright(c) 2018-2019 Realtek Corporation
3	*/
4
5	#include <linux/iopoll.h>
6
7	#include "main.h"
8	#include "coex.h"
9	#include "fw.h"
10	#include "tx.h"
11	#include "reg.h"
12	#include "sec.h"
13	#include "debug.h"
14	#include "util.h"
15	#include "wow.h"
16	#include "ps.h"
17	#include "phy.h"
18	#include "mac.h"
19
20	static const struct rtw_hw_reg_desc fw_h2c_regs[] = {
21	{REG_FWIMR, MASKDWORD, "FWIMR"},
22	{REG_FWIMR, BIT_FS_H2CCMD_INT_EN, "FWIMR enable"},
23	{REG_FWISR, MASKDWORD, "FWISR"},
24	{REG_FWISR, BIT_FS_H2CCMD_INT, "FWISR enable"},
25	{REG_HMETFR, BIT_INT_BOX_ALL, "BoxBitMap"},
26	{REG_HMEBOX0, MASKDWORD, "MSG 0"},
27	{REG_HMEBOX0_EX, MASKDWORD, "MSG_EX 0"},
28	{REG_HMEBOX1, MASKDWORD, "MSG 1"},
29	{REG_HMEBOX1_EX, MASKDWORD, "MSG_EX 1"},
30	{REG_HMEBOX2, MASKDWORD, "MSG 2"},
31	{REG_HMEBOX2_EX, MASKDWORD, "MSG_EX 2"},
32	{REG_HMEBOX3, MASKDWORD, "MSG 3"},
33	{REG_HMEBOX3_EX, MASKDWORD, "MSG_EX 3"},
34	{REG_FT1IMR, MASKDWORD, "FT1IMR"},
35	{REG_FT1IMR, BIT_FS_H2C_CMD_OK_INT_EN, "FT1IMR enable"},
36	{REG_FT1ISR, MASKDWORD, "FT1ISR"},
37	{REG_FT1ISR, BIT_FS_H2C_CMD_OK_INT, "FT1ISR enable "},
38	};
39
40	static const struct rtw_hw_reg_desc fw_c2h_regs[] = {
41	{REG_FWIMR, MASKDWORD, "FWIMR"},
42	{REG_FWIMR, BIT_FS_H2CCMD_INT_EN, "CPWM"},
43	{REG_FWIMR, BIT_FS_HRCV_INT_EN, "HRECV"},
44	{REG_FWISR, MASKDWORD, "FWISR"},
45	{REG_FWISR, BIT_FS_H2CCMD_INT, "CPWM"},
46	{REG_FWISR, BIT_FS_HRCV_INT, "HRECV"},
47	{REG_CPWM, MASKDWORD, "REG_CPWM"},
48	};
49
50	static const struct rtw_hw_reg_desc fw_core_regs[] = {
51	{REG_ARFR2_V1, MASKDWORD, "EPC"},
52	{REG_ARFRH2_V1, MASKDWORD, "BADADDR"},
53	{REG_ARFR3_V1, MASKDWORD, "CAUSE"},
54	{REG_ARFR3_V1, BIT_EXC_CODE, "ExcCode"},
55	{REG_ARFRH3_V1, MASKDWORD, "Status"},
56	{REG_ARFR4, MASKDWORD, "SP"},
57	{REG_ARFRH4, MASKDWORD, "RA"},
58	{REG_FW_DBG6, MASKDWORD, "DBG 6"},
59	{REG_FW_DBG7, MASKDWORD, "DBG 7"},
60	};
61
62	static void _rtw_fw_dump_dbg_info(struct rtw_dev *rtwdev,
63	const struct rtw_hw_reg_desc regs[], u32 size)
64	{
65	const struct rtw_hw_reg_desc *reg;
66	u32 val;
67	int i;
68
69	for (i = 0; i < size; i++) {
70	reg = &regs[i];
71	val = rtw_read32_mask(rtwdev, addr: reg->addr, mask: reg->mask);
72
73	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "[%s]addr:0x%x mask:0x%x value:0x%x\n",
74	reg->desc, reg->addr, reg->mask, val);
75	}
76	}
77
78	void rtw_fw_dump_dbg_info(struct rtw_dev *rtwdev)
79	{
80	int i;
81
82	if (!rtw_dbg_is_enabled(rtwdev, mask: RTW_DBG_FW))
83	return;
84
85	_rtw_fw_dump_dbg_info(rtwdev, regs: fw_h2c_regs, ARRAY_SIZE(fw_h2c_regs));
86	_rtw_fw_dump_dbg_info(rtwdev, regs: fw_c2h_regs, ARRAY_SIZE(fw_c2h_regs));
87	for (i = 0 ; i < RTW_DEBUG_DUMP_TIMES; i++) {
88	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "Firmware Coredump %dth\n", i + 1);
89	_rtw_fw_dump_dbg_info(rtwdev, regs: fw_core_regs, ARRAY_SIZE(fw_core_regs));
90	}
91	}
92
93	static void rtw_fw_c2h_cmd_handle_ext(struct rtw_dev *rtwdev,
94	struct sk_buff *skb)
95	{
96	struct rtw_c2h_cmd *c2h;
97	u8 sub_cmd_id;
98
99	c2h = get_c2h_from_skb(skb);
100	sub_cmd_id = c2h->payload[0];
101
102	switch (sub_cmd_id) {
103	case C2H_CCX_RPT:
104	rtw_tx_report_handle(rtwdev, skb, src: C2H_CCX_RPT);
105	break;
106	case C2H_SCAN_STATUS_RPT:
107	rtw_hw_scan_status_report(rtwdev, skb);
108	break;
109	case C2H_CHAN_SWITCH:
110	rtw_hw_scan_chan_switch(rtwdev, skb);
111	break;
112	default:
113	break;
114	}
115	}
116
117	static u16 get_max_amsdu_len(u32 bit_rate)
118	{
119	/* lower than ofdm, do not aggregate */
120	if (bit_rate < 550)
121	return 1;
122
123	/* lower than 20M 2ss mcs8, make it small */
124	if (bit_rate < 1800)
125	return 1200;
126
127	/* lower than 40M 2ss mcs9, make it medium */
128	if (bit_rate < 4000)
129	return 2600;
130
131	/* not yet 80M 2ss mcs8/9, make it twice regular packet size */
132	if (bit_rate < 7000)
133	return 3500;
134
135	/* unlimited */
136	return 0;
137	}
138
139	struct rtw_fw_iter_ra_data {
140	struct rtw_dev *rtwdev;
141	u8 *payload;
142	};
143
144	static void rtw_fw_ra_report_iter(void *data, struct ieee80211_sta *sta)
145	{
146	struct rtw_fw_iter_ra_data *ra_data = data;
147	struct rtw_sta_info *si = (struct rtw_sta_info *)sta->drv_priv;
148	u8 mac_id, rate, sgi, bw;
149	u8 mcs, nss;
150	u32 bit_rate;
151
152	mac_id = GET_RA_REPORT_MACID(ra_data->payload);
153	if (si->mac_id != mac_id)
154	return;
155
156	si->ra_report.txrate.flags = 0;
157
158	rate = GET_RA_REPORT_RATE(ra_data->payload);
159	sgi = GET_RA_REPORT_SGI(ra_data->payload);
160	bw = GET_RA_REPORT_BW(ra_data->payload);
161
162	if (rate < DESC_RATEMCS0) {
163	si->ra_report.txrate.legacy = rtw_desc_to_bitrate(desc_rate: rate);
164	goto legacy;
165	}
166
167	rtw_desc_to_mcsrate(rate, mcs: &mcs, nss: &nss);
168	if (rate >= DESC_RATEVHT1SS_MCS0)
169	si->ra_report.txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
170	else if (rate >= DESC_RATEMCS0)
171	si->ra_report.txrate.flags |= RATE_INFO_FLAGS_MCS;
172
173	if (rate >= DESC_RATEMCS0) {
174	si->ra_report.txrate.mcs = mcs;
175	si->ra_report.txrate.nss = nss;
176	}
177
178	if (sgi)
179	si->ra_report.txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
180
181	if (bw == RTW_CHANNEL_WIDTH_80)
182	si->ra_report.txrate.bw = RATE_INFO_BW_80;
183	else if (bw == RTW_CHANNEL_WIDTH_40)
184	si->ra_report.txrate.bw = RATE_INFO_BW_40;
185	else
186	si->ra_report.txrate.bw = RATE_INFO_BW_20;
187
188	legacy:
189	bit_rate = cfg80211_calculate_bitrate(rate: &si->ra_report.txrate);
190
191	si->ra_report.desc_rate = rate;
192	si->ra_report.bit_rate = bit_rate;
193
194	sta->deflink.agg.max_rc_amsdu_len = get_max_amsdu_len(bit_rate);
195	}
196
197	static void rtw_fw_ra_report_handle(struct rtw_dev *rtwdev, u8 *payload,
198	u8 length)
199	{
200	struct rtw_fw_iter_ra_data ra_data;
201
202	if (WARN(length < 7, "invalid ra report c2h length\n"))
203	return;
204
205	rtwdev->dm_info.tx_rate = GET_RA_REPORT_RATE(payload);
206	ra_data.rtwdev = rtwdev;
207	ra_data.payload = payload;
208	rtw_iterate_stas_atomic(rtwdev, rtw_fw_ra_report_iter, &ra_data);
209	}
210
211	struct rtw_beacon_filter_iter_data {
212	struct rtw_dev *rtwdev;
213	u8 *payload;
214	};
215
216	static void rtw_fw_bcn_filter_notify_vif_iter(void *data,
217	struct ieee80211_vif *vif)
218	{
219	struct rtw_beacon_filter_iter_data *iter_data = data;
220	struct rtw_dev *rtwdev = iter_data->rtwdev;
221	u8 *payload = iter_data->payload;
222	u8 type = GET_BCN_FILTER_NOTIFY_TYPE(payload);
223	u8 event = GET_BCN_FILTER_NOTIFY_EVENT(payload);
224	s8 sig = (s8)GET_BCN_FILTER_NOTIFY_RSSI(payload);
225
226	switch (type) {
227	case BCN_FILTER_NOTIFY_SIGNAL_CHANGE:
228	event = event ? NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH :
229	NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW;
230	ieee80211_cqm_rssi_notify(vif, rssi_event: event, rssi_level: sig, GFP_KERNEL);
231	break;
232	case BCN_FILTER_CONNECTION_LOSS:
233	ieee80211_connection_loss(vif);
234	break;
235	case BCN_FILTER_CONNECTED:
236	rtwdev->beacon_loss = false;
237	break;
238	case BCN_FILTER_NOTIFY_BEACON_LOSS:
239	rtwdev->beacon_loss = true;
240	rtw_leave_lps(rtwdev);
241	break;
242	}
243	}
244
245	static void rtw_fw_bcn_filter_notify(struct rtw_dev *rtwdev, u8 *payload,
246	u8 length)
247	{
248	struct rtw_beacon_filter_iter_data dev_iter_data;
249
250	dev_iter_data.rtwdev = rtwdev;
251	dev_iter_data.payload = payload;
252	rtw_iterate_vifs(rtwdev, iterator: rtw_fw_bcn_filter_notify_vif_iter,
253	data: &dev_iter_data);
254	}
255
256	static void rtw_fw_scan_result(struct rtw_dev *rtwdev, u8 *payload,
257	u8 length)
258	{
259	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
260
261	dm_info->scan_density = payload[0];
262
263	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "scan.density = %x\n",
264	dm_info->scan_density);
265	}
266
267	static void rtw_fw_adaptivity_result(struct rtw_dev *rtwdev, u8 *payload,
268	u8 length)
269	{
270	struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
271	struct rtw_c2h_adaptivity *result = (struct rtw_c2h_adaptivity *)payload;
272
273	rtw_dbg(rtwdev, mask: RTW_DBG_ADAPTIVITY,
274	fmt: "Adaptivity: density %x igi %x l2h_th_init %x l2h %x h2l %x option %x\n",
275	result->density, result->igi, result->l2h_th_init, result->l2h,
276	result->h2l, result->option);
277
278	rtw_dbg(rtwdev, mask: RTW_DBG_ADAPTIVITY, fmt: "Reg Setting: L2H %x H2L %x\n",
279	rtw_read32_mask(rtwdev, addr: edcca_th[EDCCA_TH_L2H_IDX].hw_reg.addr,
280	mask: edcca_th[EDCCA_TH_L2H_IDX].hw_reg.mask),
281	rtw_read32_mask(rtwdev, addr: edcca_th[EDCCA_TH_H2L_IDX].hw_reg.addr,
282	mask: edcca_th[EDCCA_TH_H2L_IDX].hw_reg.mask));
283
284	rtw_dbg(rtwdev, mask: RTW_DBG_ADAPTIVITY, fmt: "EDCCA Flag %s\n",
285	rtw_read32_mask(rtwdev, REG_EDCCA_REPORT, BIT_EDCCA_FLAG) ?
286	"Set" : "Unset");
287	}
288
289	void rtw_fw_c2h_cmd_handle(struct rtw_dev *rtwdev, struct sk_buff *skb)
290	{
291	struct rtw_c2h_cmd *c2h;
292	u32 pkt_offset;
293	u8 len;
294
295	pkt_offset = *((u32 *)skb->cb);
296	c2h = (struct rtw_c2h_cmd *)(skb->data + pkt_offset);
297	len = skb->len - pkt_offset - 2;
298
299	mutex_lock(&rtwdev->mutex);
300
301	if (!test_bit(RTW_FLAG_RUNNING, rtwdev->flags))
302	goto unlock;
303
304	switch (c2h->id) {
305	case C2H_CCX_TX_RPT:
306	rtw_tx_report_handle(rtwdev, skb, src: C2H_CCX_TX_RPT);
307	break;
308	case C2H_BT_INFO:
309	rtw_coex_bt_info_notify(rtwdev, buf: c2h->payload, length: len);
310	break;
311	case C2H_BT_HID_INFO:
312	rtw_coex_bt_hid_info_notify(rtwdev, buf: c2h->payload, length: len);
313	break;
314	case C2H_WLAN_INFO:
315	rtw_coex_wl_fwdbginfo_notify(rtwdev, buf: c2h->payload, length: len);
316	break;
317	case C2H_BCN_FILTER_NOTIFY:
318	rtw_fw_bcn_filter_notify(rtwdev, payload: c2h->payload, length: len);
319	break;
320	case C2H_HALMAC:
321	rtw_fw_c2h_cmd_handle_ext(rtwdev, skb);
322	break;
323	case C2H_RA_RPT:
324	rtw_fw_ra_report_handle(rtwdev, payload: c2h->payload, length: len);
325	break;
326	default:
327	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "C2H 0x%x isn't handled\n", c2h->id);
328	break;
329	}
330
331	unlock:
332	mutex_unlock(lock: &rtwdev->mutex);
333	}
334
335	void rtw_fw_c2h_cmd_rx_irqsafe(struct rtw_dev *rtwdev, u32 pkt_offset,
336	struct sk_buff *skb)
337	{
338	struct rtw_c2h_cmd *c2h;
339	u8 len;
340
341	c2h = (struct rtw_c2h_cmd *)(skb->data + pkt_offset);
342	len = skb->len - pkt_offset - 2;
343	*((u32 *)skb->cb) = pkt_offset;
344
345	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "recv C2H, id=0x%02x, seq=0x%02x, len=%d\n",
346	c2h->id, c2h->seq, len);
347
348	switch (c2h->id) {
349	case C2H_BT_MP_INFO:
350	rtw_coex_info_response(rtwdev, skb);
351	break;
352	case C2H_WLAN_RFON:
353	complete(&rtwdev->lps_leave_check);
354	dev_kfree_skb_any(skb);
355	break;
356	case C2H_SCAN_RESULT:
357	complete(&rtwdev->fw_scan_density);
358	rtw_fw_scan_result(rtwdev, payload: c2h->payload, length: len);
359	dev_kfree_skb_any(skb);
360	break;
361	case C2H_ADAPTIVITY:
362	rtw_fw_adaptivity_result(rtwdev, payload: c2h->payload, length: len);
363	dev_kfree_skb_any(skb);
364	break;
365	default:
366	/* pass offset for further operation */
367	*((u32 *)skb->cb) = pkt_offset;
368	skb_queue_tail(list: &rtwdev->c2h_queue, newsk: skb);
369	ieee80211_queue_work(hw: rtwdev->hw, work: &rtwdev->c2h_work);
370	break;
371	}
372	}
373	EXPORT_SYMBOL(rtw_fw_c2h_cmd_rx_irqsafe);
374
375	void rtw_fw_c2h_cmd_isr(struct rtw_dev *rtwdev)
376	{
377	if (rtw_read8(rtwdev, REG_MCU_TST_CFG) == VAL_FW_TRIGGER)
378	rtw_fw_recovery(rtwdev);
379	else
380	rtw_warn(rtwdev, "unhandled firmware c2h interrupt\n");
381	}
382	EXPORT_SYMBOL(rtw_fw_c2h_cmd_isr);
383
384	static void rtw_fw_send_h2c_command_register(struct rtw_dev *rtwdev,
385	struct rtw_h2c_register *h2c)
386	{
387	u32 box_reg, box_ex_reg;
388	u8 box_state, box;
389	int ret;
390
391	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "send H2C content %08x %08x\n", h2c->w0,
392	h2c->w1);
393
394	lockdep_assert_held(&rtwdev->mutex);
395
396	box = rtwdev->h2c.last_box_num;
397	switch (box) {
398	case 0:
399	box_reg = REG_HMEBOX0;
400	box_ex_reg = REG_HMEBOX0_EX;
401	break;
402	case 1:
403	box_reg = REG_HMEBOX1;
404	box_ex_reg = REG_HMEBOX1_EX;
405	break;
406	case 2:
407	box_reg = REG_HMEBOX2;
408	box_ex_reg = REG_HMEBOX2_EX;
409	break;
410	case 3:
411	box_reg = REG_HMEBOX3;
412	box_ex_reg = REG_HMEBOX3_EX;
413	break;
414	default:
415	WARN(1, "invalid h2c mail box number\n");
416	return;
417	}
418
419	ret = read_poll_timeout_atomic(rtw_read8, box_state,
420	!((box_state >> box) & 0x1), 100, 3000,
421	false, rtwdev, REG_HMETFR);
422
423	if (ret) {
424	rtw_err(rtwdev, "failed to send h2c command\n");
425	rtw_fw_dump_dbg_info(rtwdev);
426	return;
427	}
428
429	rtw_write32(rtwdev, addr: box_ex_reg, val: h2c->w1);
430	rtw_write32(rtwdev, addr: box_reg, val: h2c->w0);
431
432	if (++rtwdev->h2c.last_box_num >= 4)
433	rtwdev->h2c.last_box_num = 0;
434	}
435
436	static void rtw_fw_send_h2c_command(struct rtw_dev *rtwdev,
437	u8 *h2c)
438	{
439	struct rtw_h2c_cmd *h2c_cmd = (struct rtw_h2c_cmd *)h2c;
440	u8 box;
441	u8 box_state;
442	u32 box_reg, box_ex_reg;
443	int ret;
444
445	rtw_dbg(rtwdev, mask: RTW_DBG_FW,
446	fmt: "send H2C content %02x%02x%02x%02x %02x%02x%02x%02x\n",
447	h2c[3], h2c[2], h2c[1], h2c[0],
448	h2c[7], h2c[6], h2c[5], h2c[4]);
449
450	lockdep_assert_held(&rtwdev->mutex);
451
452	box = rtwdev->h2c.last_box_num;
453	switch (box) {
454	case 0:
455	box_reg = REG_HMEBOX0;
456	box_ex_reg = REG_HMEBOX0_EX;
457	break;
458	case 1:
459	box_reg = REG_HMEBOX1;
460	box_ex_reg = REG_HMEBOX1_EX;
461	break;
462	case 2:
463	box_reg = REG_HMEBOX2;
464	box_ex_reg = REG_HMEBOX2_EX;
465	break;
466	case 3:
467	box_reg = REG_HMEBOX3;
468	box_ex_reg = REG_HMEBOX3_EX;
469	break;
470	default:
471	WARN(1, "invalid h2c mail box number\n");
472	return;
473	}
474
475	ret = read_poll_timeout_atomic(rtw_read8, box_state,
476	!((box_state >> box) & 0x1), 100, 3000,
477	false, rtwdev, REG_HMETFR);
478
479	if (ret) {
480	rtw_err(rtwdev, "failed to send h2c command\n");
481	return;
482	}
483
484	rtw_write32(rtwdev, addr: box_ex_reg, le32_to_cpu(h2c_cmd->msg_ext));
485	rtw_write32(rtwdev, addr: box_reg, le32_to_cpu(h2c_cmd->msg));
486
487	if (++rtwdev->h2c.last_box_num >= 4)
488	rtwdev->h2c.last_box_num = 0;
489	}
490
491	void rtw_fw_h2c_cmd_dbg(struct rtw_dev *rtwdev, u8 *h2c)
492	{
493	rtw_fw_send_h2c_command(rtwdev, h2c);
494	}
495
496	static void rtw_fw_send_h2c_packet(struct rtw_dev *rtwdev, u8 *h2c_pkt)
497	{
498	int ret;
499
500	lockdep_assert_held(&rtwdev->mutex);
501
502	FW_OFFLOAD_H2C_SET_SEQ_NUM(h2c_pkt, rtwdev->h2c.seq);
503	ret = rtw_hci_write_data_h2c(rtwdev, buf: h2c_pkt, H2C_PKT_SIZE);
504	if (ret)
505	rtw_err(rtwdev, "failed to send h2c packet\n");
506	rtwdev->h2c.seq++;
507	}
508
509	void
510	rtw_fw_send_general_info(struct rtw_dev *rtwdev)
511	{
512	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
513	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
514	u16 total_size = H2C_PKT_HDR_SIZE + 4;
515
516	if (rtw_chip_wcpu_11n(rtwdev))
517	return;
518
519	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_GENERAL_INFO);
520
521	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
522
523	GENERAL_INFO_SET_FW_TX_BOUNDARY(h2c_pkt,
524	fifo->rsvd_fw_txbuf_addr -
525	fifo->rsvd_boundary);
526
527	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
528	}
529
530	void
531	rtw_fw_send_phydm_info(struct rtw_dev *rtwdev)
532	{
533	struct rtw_hal *hal = &rtwdev->hal;
534	struct rtw_efuse *efuse = &rtwdev->efuse;
535	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
536	u16 total_size = H2C_PKT_HDR_SIZE + 8;
537	u8 fw_rf_type = 0;
538
539	if (rtw_chip_wcpu_11n(rtwdev))
540	return;
541
542	if (hal->rf_type == RF_1T1R)
543	fw_rf_type = FW_RF_1T1R;
544	else if (hal->rf_type == RF_2T2R)
545	fw_rf_type = FW_RF_2T2R;
546
547	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_PHYDM_INFO);
548
549	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
550	PHYDM_INFO_SET_REF_TYPE(h2c_pkt, efuse->rfe_option);
551	PHYDM_INFO_SET_RF_TYPE(h2c_pkt, fw_rf_type);
552	PHYDM_INFO_SET_CUT_VER(h2c_pkt, hal->cut_version);
553	PHYDM_INFO_SET_RX_ANT_STATUS(h2c_pkt, hal->antenna_tx);
554	PHYDM_INFO_SET_TX_ANT_STATUS(h2c_pkt, hal->antenna_rx);
555
556	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
557	}
558
559	void rtw_fw_do_iqk(struct rtw_dev *rtwdev, struct rtw_iqk_para *para)
560	{
561	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
562	u16 total_size = H2C_PKT_HDR_SIZE + 1;
563
564	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_IQK);
565	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
566	IQK_SET_CLEAR(h2c_pkt, para->clear);
567	IQK_SET_SEGMENT_IQK(h2c_pkt, para->segment_iqk);
568
569	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
570	}
571	EXPORT_SYMBOL(rtw_fw_do_iqk);
572
573	void rtw_fw_inform_rfk_status(struct rtw_dev *rtwdev, bool start)
574	{
575	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
576
577	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_WIFI_CALIBRATION);
578
579	RFK_SET_INFORM_START(h2c_pkt, start);
580
581	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
582	}
583	EXPORT_SYMBOL(rtw_fw_inform_rfk_status);
584
585	void rtw_fw_query_bt_info(struct rtw_dev *rtwdev)
586	{
587	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
588
589	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_QUERY_BT_INFO);
590
591	SET_QUERY_BT_INFO(h2c_pkt, true);
592
593	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
594	}
595
596	void rtw_fw_default_port(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif)
597	{
598	struct rtw_h2c_register h2c = {};
599
600	if (rtwvif->net_type != RTW_NET_MGD_LINKED)
601	return;
602
603	/* Leave LPS before default port H2C so FW timer is correct */
604	rtw_leave_lps(rtwdev);
605
606	h2c.w0 = u32_encode_bits(H2C_CMD_DEFAULT_PORT, RTW_H2C_W0_CMDID) |
607	u32_encode_bits(v: rtwvif->port, RTW_H2C_DEFAULT_PORT_W0_PORTID) |
608	u32_encode_bits(v: rtwvif->mac_id, RTW_H2C_DEFAULT_PORT_W0_MACID);
609
610	rtw_fw_send_h2c_command_register(rtwdev, h2c: &h2c);
611	}
612
613	void rtw_fw_wl_ch_info(struct rtw_dev *rtwdev, u8 link, u8 ch, u8 bw)
614	{
615	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
616
617	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_WL_CH_INFO);
618
619	SET_WL_CH_INFO_LINK(h2c_pkt, link);
620	SET_WL_CH_INFO_CHNL(h2c_pkt, ch);
621	SET_WL_CH_INFO_BW(h2c_pkt, bw);
622
623	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
624	}
625
626	void rtw_fw_query_bt_mp_info(struct rtw_dev *rtwdev,
627	struct rtw_coex_info_req *req)
628	{
629	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
630
631	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_QUERY_BT_MP_INFO);
632
633	SET_BT_MP_INFO_SEQ(h2c_pkt, req->seq);
634	SET_BT_MP_INFO_OP_CODE(h2c_pkt, req->op_code);
635	SET_BT_MP_INFO_PARA1(h2c_pkt, req->para1);
636	SET_BT_MP_INFO_PARA2(h2c_pkt, req->para2);
637	SET_BT_MP_INFO_PARA3(h2c_pkt, req->para3);
638
639	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
640	}
641
642	void rtw_fw_force_bt_tx_power(struct rtw_dev *rtwdev, u8 bt_pwr_dec_lvl)
643	{
644	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
645	u8 index = 0 - bt_pwr_dec_lvl;
646
647	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_FORCE_BT_TX_POWER);
648
649	SET_BT_TX_POWER_INDEX(h2c_pkt, index);
650
651	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
652	}
653
654	void rtw_fw_bt_ignore_wlan_action(struct rtw_dev *rtwdev, bool enable)
655	{
656	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
657
658	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_IGNORE_WLAN_ACTION);
659
660	SET_IGNORE_WLAN_ACTION_EN(h2c_pkt, enable);
661
662	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
663	}
664
665	void rtw_fw_coex_tdma_type(struct rtw_dev *rtwdev,
666	u8 para1, u8 para2, u8 para3, u8 para4, u8 para5)
667	{
668	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
669
670	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_COEX_TDMA_TYPE);
671
672	SET_COEX_TDMA_TYPE_PARA1(h2c_pkt, para1);
673	SET_COEX_TDMA_TYPE_PARA2(h2c_pkt, para2);
674	SET_COEX_TDMA_TYPE_PARA3(h2c_pkt, para3);
675	SET_COEX_TDMA_TYPE_PARA4(h2c_pkt, para4);
676	SET_COEX_TDMA_TYPE_PARA5(h2c_pkt, para5);
677
678	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
679	}
680
681	void rtw_fw_coex_query_hid_info(struct rtw_dev *rtwdev, u8 sub_id, u8 data)
682	{
683	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
684
685	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_QUERY_BT_HID_INFO);
686
687	SET_COEX_QUERY_HID_INFO_SUBID(h2c_pkt, sub_id);
688	SET_COEX_QUERY_HID_INFO_DATA1(h2c_pkt, data);
689
690	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
691	}
692
693	void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
694	{
695	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
696
697	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_BT_WIFI_CONTROL);
698
699	SET_BT_WIFI_CONTROL_OP_CODE(h2c_pkt, op_code);
700
701	SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
702	SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
703	SET_BT_WIFI_CONTROL_DATA3(h2c_pkt, *(data + 2));
704	SET_BT_WIFI_CONTROL_DATA4(h2c_pkt, *(data + 3));
705	SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));
706
707	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
708	}
709
710	void rtw_fw_send_rssi_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
711	{
712	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
713	u8 rssi = ewma_rssi_read(e: &si->avg_rssi);
714	bool stbc_en = si->stbc_en ? true : false;
715
716	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RSSI_MONITOR);
717
718	SET_RSSI_INFO_MACID(h2c_pkt, si->mac_id);
719	SET_RSSI_INFO_RSSI(h2c_pkt, rssi);
720	SET_RSSI_INFO_STBC(h2c_pkt, stbc_en);
721
722	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
723	}
724
725	void rtw_fw_send_ra_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si,
726	bool reset_ra_mask)
727	{
728	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
729	bool disable_pt = true;
730
731	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RA_INFO);
732
733	SET_RA_INFO_MACID(h2c_pkt, si->mac_id);
734	SET_RA_INFO_RATE_ID(h2c_pkt, si->rate_id);
735	SET_RA_INFO_INIT_RA_LVL(h2c_pkt, si->init_ra_lv);
736	SET_RA_INFO_SGI_EN(h2c_pkt, si->sgi_enable);
737	SET_RA_INFO_BW_MODE(h2c_pkt, si->bw_mode);
738	SET_RA_INFO_LDPC(h2c_pkt, !!si->ldpc_en);
739	SET_RA_INFO_NO_UPDATE(h2c_pkt, !reset_ra_mask);
740	SET_RA_INFO_VHT_EN(h2c_pkt, si->vht_enable);
741	SET_RA_INFO_DIS_PT(h2c_pkt, disable_pt);
742	SET_RA_INFO_RA_MASK0(h2c_pkt, (si->ra_mask & 0xff));
743	SET_RA_INFO_RA_MASK1(h2c_pkt, (si->ra_mask & 0xff00) >> 8);
744	SET_RA_INFO_RA_MASK2(h2c_pkt, (si->ra_mask & 0xff0000) >> 16);
745	SET_RA_INFO_RA_MASK3(h2c_pkt, (si->ra_mask & 0xff000000) >> 24);
746
747	si->init_ra_lv = 0;
748
749	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
750	}
751
752	void rtw_fw_media_status_report(struct rtw_dev *rtwdev, u8 mac_id, bool connect)
753	{
754	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
755
756	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_MEDIA_STATUS_RPT);
757	MEDIA_STATUS_RPT_SET_OP_MODE(h2c_pkt, connect);
758	MEDIA_STATUS_RPT_SET_MACID(h2c_pkt, mac_id);
759
760	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
761	}
762
763	void rtw_fw_update_wl_phy_info(struct rtw_dev *rtwdev)
764	{
765	struct rtw_traffic_stats *stats = &rtwdev->stats;
766	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
767	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
768
769	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_WL_PHY_INFO);
770	SET_WL_PHY_INFO_TX_TP(h2c_pkt, stats->tx_throughput);
771	SET_WL_PHY_INFO_RX_TP(h2c_pkt, stats->rx_throughput);
772	SET_WL_PHY_INFO_TX_RATE_DESC(h2c_pkt, dm_info->tx_rate);
773	SET_WL_PHY_INFO_RX_RATE_DESC(h2c_pkt, dm_info->curr_rx_rate);
774	SET_WL_PHY_INFO_RX_EVM(h2c_pkt, dm_info->rx_evm_dbm[RF_PATH_A]);
775	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
776	}
777
778	void rtw_fw_beacon_filter_config(struct rtw_dev *rtwdev, bool connect,
779	struct ieee80211_vif *vif)
780	{
781	struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
782	struct ieee80211_sta *sta = ieee80211_find_sta(vif, addr: bss_conf->bssid);
783	static const u8 rssi_min = 0, rssi_max = 100, rssi_offset = 100;
784	struct rtw_sta_info *si =
785	sta ? (struct rtw_sta_info *)sta->drv_priv : NULL;
786	s32 threshold = bss_conf->cqm_rssi_thold + rssi_offset;
787	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
788
789	if (!rtw_fw_feature_check(fw: &rtwdev->fw, feature: FW_FEATURE_BCN_FILTER))
790	return;
791
792	if (!connect) {
793	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_BCN_FILTER_OFFLOAD_P1);
794	SET_BCN_FILTER_OFFLOAD_P1_ENABLE(h2c_pkt, connect);
795	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
796
797	return;
798	}
799
800	if (!si)
801	return;
802
803	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_BCN_FILTER_OFFLOAD_P0);
804	ether_addr_copy(dst: &h2c_pkt[1], src: bss_conf->bssid);
805	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
806
807	memset(h2c_pkt, 0, sizeof(h2c_pkt));
808	threshold = clamp_t(s32, threshold, rssi_min, rssi_max);
809	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_BCN_FILTER_OFFLOAD_P1);
810	SET_BCN_FILTER_OFFLOAD_P1_ENABLE(h2c_pkt, connect);
811	SET_BCN_FILTER_OFFLOAD_P1_OFFLOAD_MODE(h2c_pkt,
812	BCN_FILTER_OFFLOAD_MODE_DEFAULT);
813	SET_BCN_FILTER_OFFLOAD_P1_THRESHOLD(h2c_pkt, (u8)threshold);
814	SET_BCN_FILTER_OFFLOAD_P1_BCN_LOSS_CNT(h2c_pkt, BCN_LOSS_CNT);
815	SET_BCN_FILTER_OFFLOAD_P1_MACID(h2c_pkt, si->mac_id);
816	SET_BCN_FILTER_OFFLOAD_P1_HYST(h2c_pkt, bss_conf->cqm_rssi_hyst);
817	SET_BCN_FILTER_OFFLOAD_P1_BCN_INTERVAL(h2c_pkt, bss_conf->beacon_int);
818	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
819	}
820
821	void rtw_fw_set_pwr_mode(struct rtw_dev *rtwdev)
822	{
823	struct rtw_lps_conf *conf = &rtwdev->lps_conf;
824	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
825
826	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_SET_PWR_MODE);
827
828	SET_PWR_MODE_SET_MODE(h2c_pkt, conf->mode);
829	SET_PWR_MODE_SET_RLBM(h2c_pkt, conf->rlbm);
830	SET_PWR_MODE_SET_SMART_PS(h2c_pkt, conf->smart_ps);
831	SET_PWR_MODE_SET_AWAKE_INTERVAL(h2c_pkt, conf->awake_interval);
832	SET_PWR_MODE_SET_PORT_ID(h2c_pkt, conf->port_id);
833	SET_PWR_MODE_SET_PWR_STATE(h2c_pkt, conf->state);
834
835	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
836	}
837
838	void rtw_fw_set_keep_alive_cmd(struct rtw_dev *rtwdev, bool enable)
839	{
840	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
841	struct rtw_fw_wow_keep_alive_para mode = {
842	.adopt = true,
843	.pkt_type = KEEP_ALIVE_NULL_PKT,
844	.period = 5,
845	};
846
847	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_KEEP_ALIVE);
848	SET_KEEP_ALIVE_ENABLE(h2c_pkt, enable);
849	SET_KEEP_ALIVE_ADOPT(h2c_pkt, mode.adopt);
850	SET_KEEP_ALIVE_PKT_TYPE(h2c_pkt, mode.pkt_type);
851	SET_KEEP_ALIVE_CHECK_PERIOD(h2c_pkt, mode.period);
852
853	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
854	}
855
856	void rtw_fw_set_disconnect_decision_cmd(struct rtw_dev *rtwdev, bool enable)
857	{
858	struct rtw_wow_param *rtw_wow = &rtwdev->wow;
859	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
860	struct rtw_fw_wow_disconnect_para mode = {
861	.adopt = true,
862	.period = 30,
863	.retry_count = 5,
864	};
865
866	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_DISCONNECT_DECISION);
867
868	if (test_bit(RTW_WOW_FLAG_EN_DISCONNECT, rtw_wow->flags)) {
869	SET_DISCONNECT_DECISION_ENABLE(h2c_pkt, enable);
870	SET_DISCONNECT_DECISION_ADOPT(h2c_pkt, mode.adopt);
871	SET_DISCONNECT_DECISION_CHECK_PERIOD(h2c_pkt, mode.period);
872	SET_DISCONNECT_DECISION_TRY_PKT_NUM(h2c_pkt, mode.retry_count);
873	}
874
875	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
876	}
877
878	void rtw_fw_set_wowlan_ctrl_cmd(struct rtw_dev *rtwdev, bool enable)
879	{
880	struct rtw_wow_param *rtw_wow = &rtwdev->wow;
881	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
882
883	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_WOWLAN);
884
885	SET_WOWLAN_FUNC_ENABLE(h2c_pkt, enable);
886	if (rtw_wow_mgd_linked(rtwdev)) {
887	if (test_bit(RTW_WOW_FLAG_EN_MAGIC_PKT, rtw_wow->flags))
888	SET_WOWLAN_MAGIC_PKT_ENABLE(h2c_pkt, enable);
889	if (test_bit(RTW_WOW_FLAG_EN_DISCONNECT, rtw_wow->flags))
890	SET_WOWLAN_DEAUTH_WAKEUP_ENABLE(h2c_pkt, enable);
891	if (test_bit(RTW_WOW_FLAG_EN_REKEY_PKT, rtw_wow->flags))
892	SET_WOWLAN_REKEY_WAKEUP_ENABLE(h2c_pkt, enable);
893	if (rtw_wow->pattern_cnt)
894	SET_WOWLAN_PATTERN_MATCH_ENABLE(h2c_pkt, enable);
895	}
896
897	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
898	}
899
900	void rtw_fw_set_aoac_global_info_cmd(struct rtw_dev *rtwdev,
901	u8 pairwise_key_enc,
902	u8 group_key_enc)
903	{
904	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
905
906	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_AOAC_GLOBAL_INFO);
907
908	SET_AOAC_GLOBAL_INFO_PAIRWISE_ENC_ALG(h2c_pkt, pairwise_key_enc);
909	SET_AOAC_GLOBAL_INFO_GROUP_ENC_ALG(h2c_pkt, group_key_enc);
910
911	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
912	}
913
914	void rtw_fw_set_remote_wake_ctrl_cmd(struct rtw_dev *rtwdev, bool enable)
915	{
916	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
917
918	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_REMOTE_WAKE_CTRL);
919
920	SET_REMOTE_WAKECTRL_ENABLE(h2c_pkt, enable);
921
922	if (rtw_wow_no_link(rtwdev))
923	SET_REMOTE_WAKE_CTRL_NLO_OFFLOAD_EN(h2c_pkt, enable);
924
925	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
926	}
927
928	static u8 rtw_get_rsvd_page_location(struct rtw_dev *rtwdev,
929	enum rtw_rsvd_packet_type type)
930	{
931	struct rtw_rsvd_page *rsvd_pkt;
932	u8 location = 0;
933
934	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
935	if (type == rsvd_pkt->type)
936	location = rsvd_pkt->page;
937	}
938
939	return location;
940	}
941
942	void rtw_fw_set_nlo_info(struct rtw_dev *rtwdev, bool enable)
943	{
944	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
945	u8 loc_nlo;
946
947	loc_nlo = rtw_get_rsvd_page_location(rtwdev, type: RSVD_NLO_INFO);
948
949	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_NLO_INFO);
950
951	SET_NLO_FUN_EN(h2c_pkt, enable);
952	if (enable) {
953	if (rtw_get_lps_deep_mode(rtwdev) != LPS_DEEP_MODE_NONE)
954	SET_NLO_PS_32K(h2c_pkt, enable);
955	SET_NLO_IGNORE_SECURITY(h2c_pkt, enable);
956	SET_NLO_LOC_NLO_INFO(h2c_pkt, loc_nlo);
957	}
958
959	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
960	}
961
962	void rtw_fw_set_recover_bt_device(struct rtw_dev *rtwdev)
963	{
964	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
965
966	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RECOVER_BT_DEV);
967	SET_RECOVER_BT_DEV_EN(h2c_pkt, 1);
968
969	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
970	}
971
972	void rtw_fw_set_pg_info(struct rtw_dev *rtwdev)
973	{
974	struct rtw_lps_conf *conf = &rtwdev->lps_conf;
975	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
976	u8 loc_pg, loc_dpk;
977
978	loc_pg = rtw_get_rsvd_page_location(rtwdev, type: RSVD_LPS_PG_INFO);
979	loc_dpk = rtw_get_rsvd_page_location(rtwdev, type: RSVD_LPS_PG_DPK);
980
981	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_LPS_PG_INFO);
982
983	LPS_PG_INFO_LOC(h2c_pkt, loc_pg);
984	LPS_PG_DPK_LOC(h2c_pkt, loc_dpk);
985	LPS_PG_SEC_CAM_EN(h2c_pkt, conf->sec_cam_backup);
986	LPS_PG_PATTERN_CAM_EN(h2c_pkt, conf->pattern_cam_backup);
987
988	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
989	}
990
991	static u8 rtw_get_rsvd_page_probe_req_location(struct rtw_dev *rtwdev,
992	struct cfg80211_ssid *ssid)
993	{
994	struct rtw_rsvd_page *rsvd_pkt;
995	u8 location = 0;
996
997	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
998	if (rsvd_pkt->type != RSVD_PROBE_REQ)
999	continue;
1000	if ((!ssid && !rsvd_pkt->ssid) ||
1001	cfg80211_ssid_eq(a: rsvd_pkt->ssid, b: ssid))
1002	location = rsvd_pkt->page;
1003	}
1004
1005	return location;
1006	}
1007
1008	static u16 rtw_get_rsvd_page_probe_req_size(struct rtw_dev *rtwdev,
1009	struct cfg80211_ssid *ssid)
1010	{
1011	struct rtw_rsvd_page *rsvd_pkt;
1012	u16 size = 0;
1013
1014	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
1015	if (rsvd_pkt->type != RSVD_PROBE_REQ)
1016	continue;
1017	if ((!ssid && !rsvd_pkt->ssid) ||
1018	cfg80211_ssid_eq(a: rsvd_pkt->ssid, b: ssid))
1019	size = rsvd_pkt->probe_req_size;
1020	}
1021
1022	return size;
1023	}
1024
1025	void rtw_send_rsvd_page_h2c(struct rtw_dev *rtwdev)
1026	{
1027	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1028	u8 location = 0;
1029
1030	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RSVD_PAGE);
1031
1032	location = rtw_get_rsvd_page_location(rtwdev, type: RSVD_PROBE_RESP);
1033	*(h2c_pkt + 1) = location;
1034	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "RSVD_PROBE_RESP loc: %d\n", location);
1035
1036	location = rtw_get_rsvd_page_location(rtwdev, type: RSVD_PS_POLL);
1037	*(h2c_pkt + 2) = location;
1038	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "RSVD_PS_POLL loc: %d\n", location);
1039
1040	location = rtw_get_rsvd_page_location(rtwdev, type: RSVD_NULL);
1041	*(h2c_pkt + 3) = location;
1042	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "RSVD_NULL loc: %d\n", location);
1043
1044	location = rtw_get_rsvd_page_location(rtwdev, type: RSVD_QOS_NULL);
1045	*(h2c_pkt + 4) = location;
1046	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "RSVD_QOS_NULL loc: %d\n", location);
1047
1048	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
1049	}
1050
1051	static struct sk_buff *rtw_nlo_info_get(struct ieee80211_hw *hw)
1052	{
1053	struct rtw_dev *rtwdev = hw->priv;
1054	const struct rtw_chip_info *chip = rtwdev->chip;
1055	struct rtw_pno_request *pno_req = &rtwdev->wow.pno_req;
1056	struct rtw_nlo_info_hdr *nlo_hdr;
1057	struct cfg80211_ssid *ssid;
1058	struct sk_buff *skb;
1059	u8 *pos, loc;
1060	u32 size;
1061	int i;
1062
1063	if (!pno_req->inited || !pno_req->match_set_cnt)
1064	return NULL;
1065
1066	size = sizeof(struct rtw_nlo_info_hdr) + pno_req->match_set_cnt *
1067	IEEE80211_MAX_SSID_LEN + chip->tx_pkt_desc_sz;
1068
1069	skb = alloc_skb(size, GFP_KERNEL);
1070	if (!skb)
1071	return NULL;
1072
1073	skb_reserve(skb, len: chip->tx_pkt_desc_sz);
1074
1075	nlo_hdr = skb_put_zero(skb, len: sizeof(struct rtw_nlo_info_hdr));
1076
1077	nlo_hdr->nlo_count = pno_req->match_set_cnt;
1078	nlo_hdr->hidden_ap_count = pno_req->match_set_cnt;
1079
1080	/* pattern check for firmware */
1081	memset(nlo_hdr->pattern_check, 0xA5, FW_NLO_INFO_CHECK_SIZE);
1082
1083	for (i = 0; i < pno_req->match_set_cnt; i++)
1084	nlo_hdr->ssid_len[i] = pno_req->match_sets[i].ssid.ssid_len;
1085
1086	for (i = 0; i < pno_req->match_set_cnt; i++) {
1087	ssid = &pno_req->match_sets[i].ssid;
1088	loc = rtw_get_rsvd_page_probe_req_location(rtwdev, ssid);
1089	if (!loc) {
1090	rtw_err(rtwdev, "failed to get probe req rsvd loc\n");
1091	kfree_skb(skb);
1092	return NULL;
1093	}
1094	nlo_hdr->location[i] = loc;
1095	}
1096
1097	for (i = 0; i < pno_req->match_set_cnt; i++) {
1098	pos = skb_put_zero(skb, IEEE80211_MAX_SSID_LEN);
1099	memcpy(pos, pno_req->match_sets[i].ssid.ssid,
1100	pno_req->match_sets[i].ssid.ssid_len);
1101	}
1102
1103	return skb;
1104	}
1105
1106	static struct sk_buff *rtw_cs_channel_info_get(struct ieee80211_hw *hw)
1107	{
1108	struct rtw_dev *rtwdev = hw->priv;
1109	const struct rtw_chip_info *chip = rtwdev->chip;
1110	struct rtw_pno_request *pno_req = &rtwdev->wow.pno_req;
1111	struct ieee80211_channel *channels = pno_req->channels;
1112	struct sk_buff *skb;
1113	int count = pno_req->channel_cnt;
1114	u8 *pos;
1115	int i = 0;
1116
1117	skb = alloc_skb(size: 4 * count + chip->tx_pkt_desc_sz, GFP_KERNEL);
1118	if (!skb)
1119	return NULL;
1120
1121	skb_reserve(skb, len: chip->tx_pkt_desc_sz);
1122
1123	for (i = 0; i < count; i++) {
1124	pos = skb_put_zero(skb, len: 4);
1125
1126	CHSW_INFO_SET_CH(pos, channels[i].hw_value);
1127
1128	if (channels[i].flags & IEEE80211_CHAN_RADAR)
1129	CHSW_INFO_SET_ACTION_ID(pos, 0);
1130	else
1131	CHSW_INFO_SET_ACTION_ID(pos, 1);
1132	CHSW_INFO_SET_TIMEOUT(pos, 1);
1133	CHSW_INFO_SET_PRI_CH_IDX(pos, 1);
1134	CHSW_INFO_SET_BW(pos, 0);
1135	}
1136
1137	return skb;
1138	}
1139
1140	static struct sk_buff *rtw_lps_pg_dpk_get(struct ieee80211_hw *hw)
1141	{
1142	struct rtw_dev *rtwdev = hw->priv;
1143	const struct rtw_chip_info *chip = rtwdev->chip;
1144	struct rtw_dpk_info *dpk_info = &rtwdev->dm_info.dpk_info;
1145	struct rtw_lps_pg_dpk_hdr *dpk_hdr;
1146	struct sk_buff *skb;
1147	u32 size;
1148
1149	size = chip->tx_pkt_desc_sz + sizeof(*dpk_hdr);
1150	skb = alloc_skb(size, GFP_KERNEL);
1151	if (!skb)
1152	return NULL;
1153
1154	skb_reserve(skb, len: chip->tx_pkt_desc_sz);
1155	dpk_hdr = skb_put_zero(skb, len: sizeof(*dpk_hdr));
1156	dpk_hdr->dpk_ch = dpk_info->dpk_ch;
1157	dpk_hdr->dpk_path_ok = dpk_info->dpk_path_ok[0];
1158	memcpy(dpk_hdr->dpk_txagc, dpk_info->dpk_txagc, 2);
1159	memcpy(dpk_hdr->dpk_gs, dpk_info->dpk_gs, 4);
1160	memcpy(dpk_hdr->coef, dpk_info->coef, 160);
1161
1162	return skb;
1163	}
1164
1165	static struct sk_buff *rtw_lps_pg_info_get(struct ieee80211_hw *hw)
1166	{
1167	struct rtw_dev *rtwdev = hw->priv;
1168	const struct rtw_chip_info *chip = rtwdev->chip;
1169	struct rtw_lps_conf *conf = &rtwdev->lps_conf;
1170	struct rtw_lps_pg_info_hdr *pg_info_hdr;
1171	struct rtw_wow_param *rtw_wow = &rtwdev->wow;
1172	struct sk_buff *skb;
1173	u32 size;
1174
1175	size = chip->tx_pkt_desc_sz + sizeof(*pg_info_hdr);
1176	skb = alloc_skb(size, GFP_KERNEL);
1177	if (!skb)
1178	return NULL;
1179
1180	skb_reserve(skb, len: chip->tx_pkt_desc_sz);
1181	pg_info_hdr = skb_put_zero(skb, len: sizeof(*pg_info_hdr));
1182	pg_info_hdr->tx_bu_page_count = rtwdev->fifo.rsvd_drv_pg_num;
1183	pg_info_hdr->macid = find_first_bit(addr: rtwdev->mac_id_map, RTW_MAX_MAC_ID_NUM);
1184	pg_info_hdr->sec_cam_count =
1185	rtw_sec_cam_pg_backup(rtwdev, used_cam: pg_info_hdr->sec_cam);
1186	pg_info_hdr->pattern_count = rtw_wow->pattern_cnt;
1187
1188	conf->sec_cam_backup = pg_info_hdr->sec_cam_count != 0;
1189	conf->pattern_cam_backup = rtw_wow->pattern_cnt != 0;
1190
1191	return skb;
1192	}
1193
1194	static struct sk_buff *rtw_get_rsvd_page_skb(struct ieee80211_hw *hw,
1195	struct rtw_rsvd_page *rsvd_pkt)
1196	{
1197	struct ieee80211_vif *vif;
1198	struct rtw_vif *rtwvif;
1199	struct sk_buff *skb_new;
1200	struct cfg80211_ssid *ssid;
1201	u16 tim_offset = 0;
1202
1203	if (rsvd_pkt->type == RSVD_DUMMY) {
1204	skb_new = alloc_skb(size: 1, GFP_KERNEL);
1205	if (!skb_new)
1206	return NULL;
1207
1208	skb_put(skb: skb_new, len: 1);
1209	return skb_new;
1210	}
1211
1212	rtwvif = rsvd_pkt->rtwvif;
1213	if (!rtwvif)
1214	return NULL;
1215
1216	vif = rtwvif_to_vif(rtwvif);
1217
1218	switch (rsvd_pkt->type) {
1219	case RSVD_BEACON:
1220	skb_new = ieee80211_beacon_get_tim(hw, vif, tim_offset: &tim_offset, NULL, link_id: 0);
1221	rsvd_pkt->tim_offset = tim_offset;
1222	break;
1223	case RSVD_PS_POLL:
1224	skb_new = ieee80211_pspoll_get(hw, vif);
1225	break;
1226	case RSVD_PROBE_RESP:
1227	skb_new = ieee80211_proberesp_get(hw, vif);
1228	break;
1229	case RSVD_NULL:
1230	skb_new = ieee80211_nullfunc_get(hw, vif, link_id: -1, qos_ok: false);
1231	break;
1232	case RSVD_QOS_NULL:
1233	skb_new = ieee80211_nullfunc_get(hw, vif, link_id: -1, qos_ok: true);
1234	break;
1235	case RSVD_LPS_PG_DPK:
1236	skb_new = rtw_lps_pg_dpk_get(hw);
1237	break;
1238	case RSVD_LPS_PG_INFO:
1239	skb_new = rtw_lps_pg_info_get(hw);
1240	break;
1241	case RSVD_PROBE_REQ:
1242	ssid = (struct cfg80211_ssid *)rsvd_pkt->ssid;
1243	if (ssid)
1244	skb_new = ieee80211_probereq_get(hw, src_addr: vif->addr,
1245	ssid: ssid->ssid,
1246	ssid_len: ssid->ssid_len, tailroom: 0);
1247	else
1248	skb_new = ieee80211_probereq_get(hw, src_addr: vif->addr, NULL, ssid_len: 0, tailroom: 0);
1249	if (skb_new)
1250	rsvd_pkt->probe_req_size = (u16)skb_new->len;
1251	break;
1252	case RSVD_NLO_INFO:
1253	skb_new = rtw_nlo_info_get(hw);
1254	break;
1255	case RSVD_CH_INFO:
1256	skb_new = rtw_cs_channel_info_get(hw);
1257	break;
1258	default:
1259	return NULL;
1260	}
1261
1262	if (!skb_new)
1263	return NULL;
1264
1265	return skb_new;
1266	}
1267
1268	static void rtw_fill_rsvd_page_desc(struct rtw_dev *rtwdev, struct sk_buff *skb,
1269	enum rtw_rsvd_packet_type type)
1270	{
1271	struct rtw_tx_pkt_info pkt_info = {0};
1272	const struct rtw_chip_info *chip = rtwdev->chip;
1273	u8 *pkt_desc;
1274
1275	rtw_tx_rsvd_page_pkt_info_update(rtwdev, pkt_info: &pkt_info, skb, type);
1276	pkt_desc = skb_push(skb, len: chip->tx_pkt_desc_sz);
1277	memset(pkt_desc, 0, chip->tx_pkt_desc_sz);
1278	rtw_tx_fill_tx_desc(pkt_info: &pkt_info, skb);
1279	}
1280
1281	static inline u8 rtw_len_to_page(unsigned int len, u8 page_size)
1282	{
1283	return DIV_ROUND_UP(len, page_size);
1284	}
1285
1286	static void rtw_rsvd_page_list_to_buf(struct rtw_dev *rtwdev, u8 page_size,
1287	u8 page_margin, u32 page, u8 *buf,
1288	struct rtw_rsvd_page *rsvd_pkt)
1289	{
1290	struct sk_buff *skb = rsvd_pkt->skb;
1291
1292	if (page >= 1)
1293	memcpy(buf + page_margin + page_size * (page - 1),
1294	skb->data, skb->len);
1295	else
1296	memcpy(buf, skb->data, skb->len);
1297	}
1298
1299	static struct rtw_rsvd_page *rtw_alloc_rsvd_page(struct rtw_dev *rtwdev,
1300	enum rtw_rsvd_packet_type type,
1301	bool txdesc)
1302	{
1303	struct rtw_rsvd_page *rsvd_pkt = NULL;
1304
1305	rsvd_pkt = kzalloc(size: sizeof(*rsvd_pkt), GFP_KERNEL);
1306
1307	if (!rsvd_pkt)
1308	return NULL;
1309
1310	INIT_LIST_HEAD(list: &rsvd_pkt->vif_list);
1311	INIT_LIST_HEAD(list: &rsvd_pkt->build_list);
1312	rsvd_pkt->type = type;
1313	rsvd_pkt->add_txdesc = txdesc;
1314
1315	return rsvd_pkt;
1316	}
1317
1318	static void rtw_insert_rsvd_page(struct rtw_dev *rtwdev,
1319	struct rtw_vif *rtwvif,
1320	struct rtw_rsvd_page *rsvd_pkt)
1321	{
1322	lockdep_assert_held(&rtwdev->mutex);
1323
1324	list_add_tail(new: &rsvd_pkt->vif_list, head: &rtwvif->rsvd_page_list);
1325	}
1326
1327	static void rtw_add_rsvd_page(struct rtw_dev *rtwdev,
1328	struct rtw_vif *rtwvif,
1329	enum rtw_rsvd_packet_type type,
1330	bool txdesc)
1331	{
1332	struct rtw_rsvd_page *rsvd_pkt;
1333
1334	rsvd_pkt = rtw_alloc_rsvd_page(rtwdev, type, txdesc);
1335	if (!rsvd_pkt) {
1336	rtw_err(rtwdev, "failed to alloc rsvd page %d\n", type);
1337	return;
1338	}
1339
1340	rsvd_pkt->rtwvif = rtwvif;
1341	rtw_insert_rsvd_page(rtwdev, rtwvif, rsvd_pkt);
1342	}
1343
1344	static void rtw_add_rsvd_page_probe_req(struct rtw_dev *rtwdev,
1345	struct rtw_vif *rtwvif,
1346	struct cfg80211_ssid *ssid)
1347	{
1348	struct rtw_rsvd_page *rsvd_pkt;
1349
1350	rsvd_pkt = rtw_alloc_rsvd_page(rtwdev, type: RSVD_PROBE_REQ, txdesc: true);
1351	if (!rsvd_pkt) {
1352	rtw_err(rtwdev, "failed to alloc probe req rsvd page\n");
1353	return;
1354	}
1355
1356	rsvd_pkt->rtwvif = rtwvif;
1357	rsvd_pkt->ssid = ssid;
1358	rtw_insert_rsvd_page(rtwdev, rtwvif, rsvd_pkt);
1359	}
1360
1361	void rtw_remove_rsvd_page(struct rtw_dev *rtwdev,
1362	struct rtw_vif *rtwvif)
1363	{
1364	struct rtw_rsvd_page *rsvd_pkt, *tmp;
1365
1366	lockdep_assert_held(&rtwdev->mutex);
1367
1368	/* remove all of the rsvd pages for vif */
1369	list_for_each_entry_safe(rsvd_pkt, tmp, &rtwvif->rsvd_page_list,
1370	vif_list) {
1371	list_del(entry: &rsvd_pkt->vif_list);
1372	if (!list_empty(head: &rsvd_pkt->build_list))
1373	list_del(entry: &rsvd_pkt->build_list);
1374	kfree(objp: rsvd_pkt);
1375	}
1376	}
1377
1378	void rtw_add_rsvd_page_bcn(struct rtw_dev *rtwdev,
1379	struct rtw_vif *rtwvif)
1380	{
1381	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
1382
1383	if (vif->type != NL80211_IFTYPE_AP &&
1384	vif->type != NL80211_IFTYPE_ADHOC &&
1385	vif->type != NL80211_IFTYPE_MESH_POINT) {
1386	rtw_warn(rtwdev, "Cannot add beacon rsvd page for %d\n",
1387	vif->type);
1388	return;
1389	}
1390
1391	rtw_add_rsvd_page(rtwdev, rtwvif, type: RSVD_BEACON, txdesc: false);
1392	}
1393
1394	void rtw_add_rsvd_page_pno(struct rtw_dev *rtwdev,
1395	struct rtw_vif *rtwvif)
1396	{
1397	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
1398	struct rtw_wow_param *rtw_wow = &rtwdev->wow;
1399	struct rtw_pno_request *rtw_pno_req = &rtw_wow->pno_req;
1400	struct cfg80211_ssid *ssid;
1401	int i;
1402
1403	if (vif->type != NL80211_IFTYPE_STATION) {
1404	rtw_warn(rtwdev, "Cannot add PNO rsvd page for %d\n",
1405	vif->type);
1406	return;
1407	}
1408
1409	for (i = 0 ; i < rtw_pno_req->match_set_cnt; i++) {
1410	ssid = &rtw_pno_req->match_sets[i].ssid;
1411	rtw_add_rsvd_page_probe_req(rtwdev, rtwvif, ssid);
1412	}
1413
1414	rtw_add_rsvd_page_probe_req(rtwdev, rtwvif, NULL);
1415	rtw_add_rsvd_page(rtwdev, rtwvif, type: RSVD_NLO_INFO, txdesc: false);
1416	rtw_add_rsvd_page(rtwdev, rtwvif, type: RSVD_CH_INFO, txdesc: true);
1417	}
1418
1419	void rtw_add_rsvd_page_sta(struct rtw_dev *rtwdev,
1420	struct rtw_vif *rtwvif)
1421	{
1422	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
1423
1424	if (vif->type != NL80211_IFTYPE_STATION) {
1425	rtw_warn(rtwdev, "Cannot add sta rsvd page for %d\n",
1426	vif->type);
1427	return;
1428	}
1429
1430	rtw_add_rsvd_page(rtwdev, rtwvif, type: RSVD_PS_POLL, txdesc: true);
1431	rtw_add_rsvd_page(rtwdev, rtwvif, type: RSVD_QOS_NULL, txdesc: true);
1432	rtw_add_rsvd_page(rtwdev, rtwvif, type: RSVD_NULL, txdesc: true);
1433	rtw_add_rsvd_page(rtwdev, rtwvif, type: RSVD_LPS_PG_DPK, txdesc: true);
1434	rtw_add_rsvd_page(rtwdev, rtwvif, type: RSVD_LPS_PG_INFO, txdesc: true);
1435	}
1436
1437	int rtw_fw_write_data_rsvd_page(struct rtw_dev *rtwdev, u16 pg_addr,
1438	u8 *buf, u32 size)
1439	{
1440	u8 bckp[2];
1441	u8 val;
1442	u16 rsvd_pg_head;
1443	u32 bcn_valid_addr;
1444	u32 bcn_valid_mask;
1445	int ret;
1446
1447	lockdep_assert_held(&rtwdev->mutex);
1448
1449	if (!size)
1450	return -EINVAL;
1451
1452	if (rtw_chip_wcpu_11n(rtwdev)) {
1453	rtw_write32_set(rtwdev, REG_DWBCN0_CTRL, BIT_BCN_VALID);
1454	} else {
1455	pg_addr &= BIT_MASK_BCN_HEAD_1_V1;
1456	pg_addr |= BIT_BCN_VALID_V1;
1457	rtw_write16(rtwdev, REG_FIFOPAGE_CTRL_2, val: pg_addr);
1458	}
1459
1460	val = rtw_read8(rtwdev, REG_CR + 1);
1461	bckp[0] = val;
1462	val |= BIT_ENSWBCN >> 8;
1463	rtw_write8(rtwdev, REG_CR + 1, val);
1464
1465	val = rtw_read8(rtwdev, REG_FWHW_TXQ_CTRL + 2);
1466	bckp[1] = val;
1467	val &= ~(BIT_EN_BCNQ_DL >> 16);
1468	rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, val);
1469
1470	ret = rtw_hci_write_data_rsvd_page(rtwdev, buf, size);
1471	if (ret) {
1472	rtw_err(rtwdev, "failed to write data to rsvd page\n");
1473	goto restore;
1474	}
1475
1476	if (rtw_chip_wcpu_11n(rtwdev)) {
1477	bcn_valid_addr = REG_DWBCN0_CTRL;
1478	bcn_valid_mask = BIT_BCN_VALID;
1479	} else {
1480	bcn_valid_addr = REG_FIFOPAGE_CTRL_2;
1481	bcn_valid_mask = BIT_BCN_VALID_V1;
1482	}
1483
1484	if (!check_hw_ready(rtwdev, addr: bcn_valid_addr, mask: bcn_valid_mask, target: 1)) {
1485	rtw_err(rtwdev, "error beacon valid\n");
1486	ret = -EBUSY;
1487	}
1488
1489	restore:
1490	rsvd_pg_head = rtwdev->fifo.rsvd_boundary;
1491	rtw_write16(rtwdev, REG_FIFOPAGE_CTRL_2,
1492	val: rsvd_pg_head | BIT_BCN_VALID_V1);
1493	rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, val: bckp[1]);
1494	rtw_write8(rtwdev, REG_CR + 1, val: bckp[0]);
1495
1496	return ret;
1497	}
1498
1499	static int rtw_download_drv_rsvd_page(struct rtw_dev *rtwdev, u8 *buf, u32 size)
1500	{
1501	u32 pg_size;
1502	u32 pg_num = 0;
1503	u16 pg_addr = 0;
1504
1505	pg_size = rtwdev->chip->page_size;
1506	pg_num = size / pg_size + ((size & (pg_size - 1)) ? 1 : 0);
1507	if (pg_num > rtwdev->fifo.rsvd_drv_pg_num)
1508	return -ENOMEM;
1509
1510	pg_addr = rtwdev->fifo.rsvd_drv_addr;
1511
1512	return rtw_fw_write_data_rsvd_page(rtwdev, pg_addr, buf, size);
1513	}
1514
1515	static void __rtw_build_rsvd_page_reset(struct rtw_dev *rtwdev)
1516	{
1517	struct rtw_rsvd_page *rsvd_pkt, *tmp;
1518
1519	list_for_each_entry_safe(rsvd_pkt, tmp, &rtwdev->rsvd_page_list,
1520	build_list) {
1521	list_del_init(entry: &rsvd_pkt->build_list);
1522
1523	/* Don't free except for the dummy rsvd page,
1524	* others will be freed when removing vif
1525	*/
1526	if (rsvd_pkt->type == RSVD_DUMMY)
1527	kfree(objp: rsvd_pkt);
1528	}
1529	}
1530
1531	static void rtw_build_rsvd_page_iter(void *data, u8 *mac,
1532	struct ieee80211_vif *vif)
1533	{
1534	struct rtw_dev *rtwdev = data;
1535	struct rtw_vif *rtwvif = (struct rtw_vif *)vif->drv_priv;
1536	struct rtw_rsvd_page *rsvd_pkt;
1537
1538	/* AP not yet started, don't gather its rsvd pages */
1539	if (vif->type == NL80211_IFTYPE_AP && !rtwdev->ap_active)
1540	return;
1541
1542	list_for_each_entry(rsvd_pkt, &rtwvif->rsvd_page_list, vif_list) {
1543	if (rsvd_pkt->type == RSVD_BEACON)
1544	list_add(new: &rsvd_pkt->build_list,
1545	head: &rtwdev->rsvd_page_list);
1546	else
1547	list_add_tail(new: &rsvd_pkt->build_list,
1548	head: &rtwdev->rsvd_page_list);
1549	}
1550	}
1551
1552	static int __rtw_build_rsvd_page_from_vifs(struct rtw_dev *rtwdev)
1553	{
1554	struct rtw_rsvd_page *rsvd_pkt;
1555
1556	__rtw_build_rsvd_page_reset(rtwdev);
1557
1558	/* gather rsvd page from vifs */
1559	rtw_iterate_vifs_atomic(rtwdev, rtw_build_rsvd_page_iter, rtwdev);
1560
1561	rsvd_pkt = list_first_entry_or_null(&rtwdev->rsvd_page_list,
1562	struct rtw_rsvd_page, build_list);
1563	if (!rsvd_pkt) {
1564	WARN(1, "Should not have an empty reserved page\n");
1565	return -EINVAL;
1566	}
1567
1568	/* the first rsvd should be beacon, otherwise add a dummy one */
1569	if (rsvd_pkt->type != RSVD_BEACON) {
1570	struct rtw_rsvd_page *dummy_pkt;
1571
1572	dummy_pkt = rtw_alloc_rsvd_page(rtwdev, type: RSVD_DUMMY, txdesc: false);
1573	if (!dummy_pkt) {
1574	rtw_err(rtwdev, "failed to alloc dummy rsvd page\n");
1575	return -ENOMEM;
1576	}
1577
1578	list_add(new: &dummy_pkt->build_list, head: &rtwdev->rsvd_page_list);
1579	}
1580
1581	return 0;
1582	}
1583
1584	static u8 *rtw_build_rsvd_page(struct rtw_dev *rtwdev, u32 *size)
1585	{
1586	struct ieee80211_hw *hw = rtwdev->hw;
1587	const struct rtw_chip_info *chip = rtwdev->chip;
1588	struct sk_buff *iter;
1589	struct rtw_rsvd_page *rsvd_pkt;
1590	u32 page = 0;
1591	u8 total_page = 0;
1592	u8 page_size, page_margin, tx_desc_sz;
1593	u8 *buf;
1594	int ret;
1595
1596	page_size = chip->page_size;
1597	tx_desc_sz = chip->tx_pkt_desc_sz;
1598	page_margin = page_size - tx_desc_sz;
1599
1600	ret = __rtw_build_rsvd_page_from_vifs(rtwdev);
1601	if (ret) {
1602	rtw_err(rtwdev,
1603	"failed to build rsvd page from vifs, ret %d\n", ret);
1604	return NULL;
1605	}
1606
1607	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
1608	iter = rtw_get_rsvd_page_skb(hw, rsvd_pkt);
1609	if (!iter) {
1610	rtw_err(rtwdev, "failed to build rsvd packet\n");
1611	goto release_skb;
1612	}
1613
1614	/* Fill the tx_desc for the rsvd pkt that requires one.
1615	* And iter->len will be added with size of tx_desc_sz.
1616	*/
1617	if (rsvd_pkt->add_txdesc)
1618	rtw_fill_rsvd_page_desc(rtwdev, skb: iter, type: rsvd_pkt->type);
1619
1620	rsvd_pkt->skb = iter;
1621	rsvd_pkt->page = total_page;
1622
1623	/* Reserved page is downloaded via TX path, and TX path will
1624	* generate a tx_desc at the header to describe length of
1625	* the buffer. If we are not counting page numbers with the
1626	* size of tx_desc added at the first rsvd_pkt (usually a
1627	* beacon, firmware default refer to the first page as the
1628	* content of beacon), we could generate a buffer which size
1629	* is smaller than the actual size of the whole rsvd_page
1630	*/
1631	if (total_page == 0) {
1632	if (rsvd_pkt->type != RSVD_BEACON &&
1633	rsvd_pkt->type != RSVD_DUMMY) {
1634	rtw_err(rtwdev, "first page should be a beacon\n");
1635	goto release_skb;
1636	}
1637	total_page += rtw_len_to_page(len: iter->len + tx_desc_sz,
1638	page_size);
1639	} else {
1640	total_page += rtw_len_to_page(len: iter->len, page_size);
1641	}
1642	}
1643
1644	if (total_page > rtwdev->fifo.rsvd_drv_pg_num) {
1645	rtw_err(rtwdev, "rsvd page over size: %d\n", total_page);
1646	goto release_skb;
1647	}
1648
1649	*size = (total_page - 1) * page_size + page_margin;
1650	buf = kzalloc(size: *size, GFP_KERNEL);
1651	if (!buf)
1652	goto release_skb;
1653
1654	/* Copy the content of each rsvd_pkt to the buf, and they should
1655	* be aligned to the pages.
1656	*
1657	* Note that the first rsvd_pkt is a beacon no matter what vif->type.
1658	* And that rsvd_pkt does not require tx_desc because when it goes
1659	* through TX path, the TX path will generate one for it.
1660	*/
1661	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
1662	rtw_rsvd_page_list_to_buf(rtwdev, page_size, page_margin,
1663	page, buf, rsvd_pkt);
1664	if (page == 0)
1665	page += rtw_len_to_page(len: rsvd_pkt->skb->len +
1666	tx_desc_sz, page_size);
1667	else
1668	page += rtw_len_to_page(len: rsvd_pkt->skb->len, page_size);
1669
1670	kfree_skb(skb: rsvd_pkt->skb);
1671	rsvd_pkt->skb = NULL;
1672	}
1673
1674	return buf;
1675
1676	release_skb:
1677	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, build_list) {
1678	kfree_skb(skb: rsvd_pkt->skb);
1679	rsvd_pkt->skb = NULL;
1680	}
1681
1682	return NULL;
1683	}
1684
1685	static int rtw_download_beacon(struct rtw_dev *rtwdev)
1686	{
1687	struct ieee80211_hw *hw = rtwdev->hw;
1688	struct rtw_rsvd_page *rsvd_pkt;
1689	struct sk_buff *skb;
1690	int ret = 0;
1691
1692	rsvd_pkt = list_first_entry_or_null(&rtwdev->rsvd_page_list,
1693	struct rtw_rsvd_page, build_list);
1694	if (!rsvd_pkt) {
1695	rtw_err(rtwdev, "failed to get rsvd page from build list\n");
1696	return -ENOENT;
1697	}
1698
1699	if (rsvd_pkt->type != RSVD_BEACON &&
1700	rsvd_pkt->type != RSVD_DUMMY) {
1701	rtw_err(rtwdev, "invalid rsvd page type %d, should be beacon or dummy\n",
1702	rsvd_pkt->type);
1703	return -EINVAL;
1704	}
1705
1706	skb = rtw_get_rsvd_page_skb(hw, rsvd_pkt);
1707	if (!skb) {
1708	rtw_err(rtwdev, "failed to get beacon skb\n");
1709	return -ENOMEM;
1710	}
1711
1712	ret = rtw_download_drv_rsvd_page(rtwdev, buf: skb->data, size: skb->len);
1713	if (ret)
1714	rtw_err(rtwdev, "failed to download drv rsvd page\n");
1715
1716	dev_kfree_skb(skb);
1717
1718	return ret;
1719	}
1720
1721	int rtw_fw_download_rsvd_page(struct rtw_dev *rtwdev)
1722	{
1723	u8 *buf;
1724	u32 size;
1725	int ret;
1726
1727	buf = rtw_build_rsvd_page(rtwdev, size: &size);
1728	if (!buf) {
1729	rtw_err(rtwdev, "failed to build rsvd page pkt\n");
1730	return -ENOMEM;
1731	}
1732
1733	ret = rtw_download_drv_rsvd_page(rtwdev, buf, size);
1734	if (ret) {
1735	rtw_err(rtwdev, "failed to download drv rsvd page\n");
1736	goto free;
1737	}
1738
1739	/* The last thing is to download the *ONLY* beacon again, because
1740	* the previous tx_desc is to describe the total rsvd page. Download
1741	* the beacon again to replace the TX desc header, and we will get
1742	* a correct tx_desc for the beacon in the rsvd page.
1743	*/
1744	ret = rtw_download_beacon(rtwdev);
1745	if (ret) {
1746	rtw_err(rtwdev, "failed to download beacon\n");
1747	goto free;
1748	}
1749
1750	free:
1751	kfree(objp: buf);
1752
1753	return ret;
1754	}
1755
1756	void rtw_fw_update_beacon_work(struct work_struct *work)
1757	{
1758	struct rtw_dev *rtwdev = container_of(work, struct rtw_dev,
1759	update_beacon_work);
1760
1761	mutex_lock(&rtwdev->mutex);
1762	rtw_fw_download_rsvd_page(rtwdev);
1763	rtw_send_rsvd_page_h2c(rtwdev);
1764	mutex_unlock(lock: &rtwdev->mutex);
1765	}
1766
1767	static void rtw_fw_read_fifo_page(struct rtw_dev *rtwdev, u32 offset, u32 size,
1768	u32 *buf, u32 residue, u16 start_pg)
1769	{
1770	u32 i;
1771	u16 idx = 0;
1772	u16 ctl;
1773
1774	ctl = rtw_read16(rtwdev, REG_PKTBUF_DBG_CTRL) & 0xf000;
1775	/* disable rx clock gate */
1776	rtw_write32_set(rtwdev, REG_RCR, BIT_DISGCLK);
1777
1778	do {
1779	rtw_write16(rtwdev, REG_PKTBUF_DBG_CTRL, val: start_pg | ctl);
1780
1781	for (i = FIFO_DUMP_ADDR + residue;
1782	i < FIFO_DUMP_ADDR + FIFO_PAGE_SIZE; i += 4) {
1783	buf[idx++] = rtw_read32(rtwdev, addr: i);
1784	size -= 4;
1785	if (size == 0)
1786	goto out;
1787	}
1788
1789	residue = 0;
1790	start_pg++;
1791	} while (size);
1792
1793	out:
1794	rtw_write16(rtwdev, REG_PKTBUF_DBG_CTRL, val: ctl);
1795	/* restore rx clock gate */
1796	rtw_write32_clr(rtwdev, REG_RCR, BIT_DISGCLK);
1797	}
1798
1799	static void rtw_fw_read_fifo(struct rtw_dev *rtwdev, enum rtw_fw_fifo_sel sel,
1800	u32 offset, u32 size, u32 *buf)
1801	{
1802	const struct rtw_chip_info *chip = rtwdev->chip;
1803	u32 start_pg, residue;
1804
1805	if (sel >= RTW_FW_FIFO_MAX) {
1806	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "wrong fw fifo sel\n");
1807	return;
1808	}
1809	if (sel == RTW_FW_FIFO_SEL_RSVD_PAGE)
1810	offset += rtwdev->fifo.rsvd_boundary << TX_PAGE_SIZE_SHIFT;
1811	residue = offset & (FIFO_PAGE_SIZE - 1);
1812	start_pg = (offset >> FIFO_PAGE_SIZE_SHIFT) + chip->fw_fifo_addr[sel];
1813
1814	rtw_fw_read_fifo_page(rtwdev, offset, size, buf, residue, start_pg);
1815	}
1816
1817	static bool rtw_fw_dump_check_size(struct rtw_dev *rtwdev,
1818	enum rtw_fw_fifo_sel sel,
1819	u32 start_addr, u32 size)
1820	{
1821	switch (sel) {
1822	case RTW_FW_FIFO_SEL_TX:
1823	case RTW_FW_FIFO_SEL_RX:
1824	if ((start_addr + size) > rtwdev->chip->fw_fifo_addr[sel])
1825	return false;
1826	fallthrough;
1827	default:
1828	return true;
1829	}
1830	}
1831
1832	int rtw_fw_dump_fifo(struct rtw_dev *rtwdev, u8 fifo_sel, u32 addr, u32 size,
1833	u32 *buffer)
1834	{
1835	if (!rtwdev->chip->fw_fifo_addr[0]) {
1836	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "chip not support dump fw fifo\n");
1837	return -ENOTSUPP;
1838	}
1839
1840	if (size == 0 || !buffer)
1841	return -EINVAL;
1842
1843	if (size & 0x3) {
1844	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "not 4byte alignment\n");
1845	return -EINVAL;
1846	}
1847
1848	if (!rtw_fw_dump_check_size(rtwdev, sel: fifo_sel, start_addr: addr, size)) {
1849	rtw_dbg(rtwdev, mask: RTW_DBG_FW, fmt: "fw fifo dump size overflow\n");
1850	return -EINVAL;
1851	}
1852
1853	rtw_fw_read_fifo(rtwdev, sel: fifo_sel, offset: addr, size, buf: buffer);
1854
1855	return 0;
1856	}
1857
1858	static void __rtw_fw_update_pkt(struct rtw_dev *rtwdev, u8 pkt_id, u16 size,
1859	u8 location)
1860	{
1861	const struct rtw_chip_info *chip = rtwdev->chip;
1862	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1863	u16 total_size = H2C_PKT_HDR_SIZE + H2C_PKT_UPDATE_PKT_LEN;
1864
1865	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_UPDATE_PKT);
1866
1867	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
1868	UPDATE_PKT_SET_PKT_ID(h2c_pkt, pkt_id);
1869	UPDATE_PKT_SET_LOCATION(h2c_pkt, location);
1870
1871	/* include txdesc size */
1872	size += chip->tx_pkt_desc_sz;
1873	UPDATE_PKT_SET_SIZE(h2c_pkt, size);
1874
1875	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
1876	}
1877
1878	void rtw_fw_update_pkt_probe_req(struct rtw_dev *rtwdev,
1879	struct cfg80211_ssid *ssid)
1880	{
1881	u8 loc;
1882	u16 size;
1883
1884	loc = rtw_get_rsvd_page_probe_req_location(rtwdev, ssid);
1885	if (!loc) {
1886	rtw_err(rtwdev, "failed to get probe_req rsvd loc\n");
1887	return;
1888	}
1889
1890	size = rtw_get_rsvd_page_probe_req_size(rtwdev, ssid);
1891	if (!size) {
1892	rtw_err(rtwdev, "failed to get probe_req rsvd size\n");
1893	return;
1894	}
1895
1896	__rtw_fw_update_pkt(rtwdev, pkt_id: RTW_PACKET_PROBE_REQ, size, location: loc);
1897	}
1898
1899	void rtw_fw_channel_switch(struct rtw_dev *rtwdev, bool enable)
1900	{
1901	struct rtw_pno_request *rtw_pno_req = &rtwdev->wow.pno_req;
1902	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1903	u16 total_size = H2C_PKT_HDR_SIZE + H2C_PKT_CH_SWITCH_LEN;
1904	u8 loc_ch_info;
1905	const struct rtw_ch_switch_option cs_option = {
1906	.dest_ch_en = 1,
1907	.dest_ch = 1,
1908	.periodic_option = 2,
1909	.normal_period = 5,
1910	.normal_period_sel = 0,
1911	.normal_cycle = 10,
1912	.slow_period = 1,
1913	.slow_period_sel = 1,
1914	};
1915
1916	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_CH_SWITCH);
1917	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, total_size);
1918
1919	CH_SWITCH_SET_START(h2c_pkt, enable);
1920	CH_SWITCH_SET_DEST_CH_EN(h2c_pkt, cs_option.dest_ch_en);
1921	CH_SWITCH_SET_DEST_CH(h2c_pkt, cs_option.dest_ch);
1922	CH_SWITCH_SET_NORMAL_PERIOD(h2c_pkt, cs_option.normal_period);
1923	CH_SWITCH_SET_NORMAL_PERIOD_SEL(h2c_pkt, cs_option.normal_period_sel);
1924	CH_SWITCH_SET_SLOW_PERIOD(h2c_pkt, cs_option.slow_period);
1925	CH_SWITCH_SET_SLOW_PERIOD_SEL(h2c_pkt, cs_option.slow_period_sel);
1926	CH_SWITCH_SET_NORMAL_CYCLE(h2c_pkt, cs_option.normal_cycle);
1927	CH_SWITCH_SET_PERIODIC_OPT(h2c_pkt, cs_option.periodic_option);
1928
1929	CH_SWITCH_SET_CH_NUM(h2c_pkt, rtw_pno_req->channel_cnt);
1930	CH_SWITCH_SET_INFO_SIZE(h2c_pkt, rtw_pno_req->channel_cnt * 4);
1931
1932	loc_ch_info = rtw_get_rsvd_page_location(rtwdev, type: RSVD_CH_INFO);
1933	CH_SWITCH_SET_INFO_LOC(h2c_pkt, loc_ch_info);
1934
1935	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
1936	}
1937
1938	void rtw_fw_adaptivity(struct rtw_dev *rtwdev)
1939	{
1940	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
1941	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1942
1943	if (!rtw_edcca_enabled) {
1944	dm_info->edcca_mode = RTW_EDCCA_NORMAL;
1945	rtw_dbg(rtwdev, mask: RTW_DBG_ADAPTIVITY,
1946	fmt: "EDCCA disabled by debugfs\n");
1947	}
1948
1949	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_ADAPTIVITY);
1950	SET_ADAPTIVITY_MODE(h2c_pkt, dm_info->edcca_mode);
1951	SET_ADAPTIVITY_OPTION(h2c_pkt, 1);
1952	SET_ADAPTIVITY_IGI(h2c_pkt, dm_info->igi_history[0]);
1953	SET_ADAPTIVITY_L2H(h2c_pkt, dm_info->l2h_th_ini);
1954	SET_ADAPTIVITY_DENSITY(h2c_pkt, dm_info->scan_density);
1955
1956	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
1957	}
1958
1959	void rtw_fw_scan_notify(struct rtw_dev *rtwdev, bool start)
1960	{
1961	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
1962
1963	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_SCAN);
1964	SET_SCAN_START(h2c_pkt, start);
1965
1966	rtw_fw_send_h2c_command(rtwdev, h2c: h2c_pkt);
1967	}
1968
1969	static int rtw_append_probe_req_ie(struct rtw_dev *rtwdev, struct sk_buff *skb,
1970	struct sk_buff_head *list, u8 *bands,
1971	struct rtw_vif *rtwvif)
1972	{
1973	const struct rtw_chip_info *chip = rtwdev->chip;
1974	struct ieee80211_scan_ies *ies = rtwvif->scan_ies;
1975	struct sk_buff *new;
1976	u8 idx;
1977
1978	for (idx = NL80211_BAND_2GHZ; idx < NUM_NL80211_BANDS; idx++) {
1979	if (!(BIT(idx) & chip->band))
1980	continue;
1981	new = skb_copy(skb, GFP_KERNEL);
1982	if (!new)
1983	return -ENOMEM;
1984	skb_put_data(skb: new, data: ies->ies[idx], len: ies->len[idx]);
1985	skb_put_data(skb: new, data: ies->common_ies, len: ies->common_ie_len);
1986	skb_queue_tail(list, newsk: new);
1987	(*bands)++;
1988	}
1989
1990	return 0;
1991	}
1992
1993	static int _rtw_hw_scan_update_probe_req(struct rtw_dev *rtwdev, u8 num_probes,
1994	struct sk_buff_head *probe_req_list)
1995	{
1996	const struct rtw_chip_info *chip = rtwdev->chip;
1997	struct sk_buff *skb, *tmp;
1998	u8 page_offset = 1, *buf, page_size = chip->page_size;
1999	u16 pg_addr = rtwdev->fifo.rsvd_h2c_info_addr, loc;
2000	u16 buf_offset = page_size * page_offset;
2001	u8 tx_desc_sz = chip->tx_pkt_desc_sz;
2002	u8 page_cnt, pages;
2003	unsigned int pkt_len;
2004	int ret;
2005
2006	if (rtw_fw_feature_ext_check(fw: &rtwdev->fw, feature: FW_FEATURE_EXT_OLD_PAGE_NUM))
2007	page_cnt = RTW_OLD_PROBE_PG_CNT;
2008	else
2009	page_cnt = RTW_PROBE_PG_CNT;
2010
2011	pages = page_offset + num_probes * page_cnt;
2012
2013	buf = kzalloc(size: page_size * pages, GFP_KERNEL);
2014	if (!buf)
2015	return -ENOMEM;
2016
2017	buf_offset -= tx_desc_sz;
2018	skb_queue_walk_safe(probe_req_list, skb, tmp) {
2019	skb_unlink(skb, list: probe_req_list);
2020	rtw_fill_rsvd_page_desc(rtwdev, skb, type: RSVD_PROBE_REQ);
2021	if (skb->len > page_size * page_cnt) {
2022	ret = -EINVAL;
2023	goto out;
2024	}
2025
2026	memcpy(buf + buf_offset, skb->data, skb->len);
2027	pkt_len = skb->len - tx_desc_sz;
2028	loc = pg_addr - rtwdev->fifo.rsvd_boundary + page_offset;
2029	__rtw_fw_update_pkt(rtwdev, pkt_id: RTW_PACKET_PROBE_REQ, size: pkt_len, location: loc);
2030
2031	buf_offset += page_cnt * page_size;
2032	page_offset += page_cnt;
2033	kfree_skb(skb);
2034	}
2035
2036	ret = rtw_fw_write_data_rsvd_page(rtwdev, pg_addr, buf, size: buf_offset);
2037	if (ret) {
2038	rtw_err(rtwdev, "Download probe request to firmware failed\n");
2039	goto out;
2040	}
2041
2042	rtwdev->scan_info.probe_pg_size = page_offset;
2043	out:
2044	kfree(objp: buf);
2045	skb_queue_walk_safe(probe_req_list, skb, tmp)
2046	kfree_skb(skb);
2047
2048	return ret;
2049	}
2050
2051	static int rtw_hw_scan_update_probe_req(struct rtw_dev *rtwdev,
2052	struct rtw_vif *rtwvif)
2053	{
2054	struct cfg80211_scan_request *req = rtwvif->scan_req;
2055	struct sk_buff_head list;
2056	struct sk_buff *skb, *tmp;
2057	u8 num = req->n_ssids, i, bands = 0;
2058	int ret;
2059
2060	skb_queue_head_init(list: &list);
2061	for (i = 0; i < num; i++) {
2062	skb = ieee80211_probereq_get(hw: rtwdev->hw, src_addr: rtwvif->mac_addr,
2063	ssid: req->ssids[i].ssid,
2064	ssid_len: req->ssids[i].ssid_len,
2065	tailroom: req->ie_len);
2066	if (!skb) {
2067	ret = -ENOMEM;
2068	goto out;
2069	}
2070	ret = rtw_append_probe_req_ie(rtwdev, skb, list: &list, bands: &bands,
2071	rtwvif);
2072	if (ret)
2073	goto out;
2074
2075	kfree_skb(skb);
2076	}
2077
2078	return _rtw_hw_scan_update_probe_req(rtwdev, num_probes: num * bands, probe_req_list: &list);
2079
2080	out:
2081	skb_queue_walk_safe(&list, skb, tmp)
2082	kfree_skb(skb);
2083
2084	return ret;
2085	}
2086
2087	static int rtw_add_chan_info(struct rtw_dev *rtwdev, struct rtw_chan_info *info,
2088	struct rtw_chan_list *list, u8 *buf)
2089	{
2090	u8 *chan = &buf[list->size];
2091	u8 info_size = RTW_CH_INFO_SIZE;
2092
2093	if (list->size > list->buf_size)
2094	return -ENOMEM;
2095
2096	CH_INFO_SET_CH(chan, info->channel);
2097	CH_INFO_SET_PRI_CH_IDX(chan, info->pri_ch_idx);
2098	CH_INFO_SET_BW(chan, info->bw);
2099	CH_INFO_SET_TIMEOUT(chan, info->timeout);
2100	CH_INFO_SET_ACTION_ID(chan, info->action_id);
2101	CH_INFO_SET_EXTRA_INFO(chan, info->extra_info);
2102	if (info->extra_info) {
2103	EXTRA_CH_INFO_SET_ID(chan, RTW_SCAN_EXTRA_ID_DFS);
2104	EXTRA_CH_INFO_SET_INFO(chan, RTW_SCAN_EXTRA_ACTION_SCAN);
2105	EXTRA_CH_INFO_SET_SIZE(chan, RTW_EX_CH_INFO_SIZE -
2106	RTW_EX_CH_INFO_HDR_SIZE);
2107	EXTRA_CH_INFO_SET_DFS_EXT_TIME(chan, RTW_DFS_CHAN_TIME);
2108	info_size += RTW_EX_CH_INFO_SIZE;
2109	}
2110	list->size += info_size;
2111	list->ch_num++;
2112
2113	return 0;
2114	}
2115
2116	static int rtw_add_chan_list(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif,
2117	struct rtw_chan_list *list, u8 *buf)
2118	{
2119	struct cfg80211_scan_request *req = rtwvif->scan_req;
2120	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
2121	struct ieee80211_channel *channel;
2122	int i, ret = 0;
2123
2124	for (i = 0; i < req->n_channels; i++) {
2125	struct rtw_chan_info ch_info = {0};
2126
2127	channel = req->channels[i];
2128	ch_info.channel = channel->hw_value;
2129	ch_info.bw = RTW_SCAN_WIDTH;
2130	ch_info.pri_ch_idx = RTW_PRI_CH_IDX;
2131	ch_info.timeout = req->duration_mandatory ?
2132	req->duration : RTW_CHANNEL_TIME;
2133
2134	if (channel->flags & (IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IR)) {
2135	ch_info.action_id = RTW_CHANNEL_RADAR;
2136	ch_info.extra_info = 1;
2137	/* Overwrite duration for passive scans if necessary */
2138	ch_info.timeout = ch_info.timeout > RTW_PASS_CHAN_TIME ?
2139	ch_info.timeout : RTW_PASS_CHAN_TIME;
2140	} else {
2141	ch_info.action_id = RTW_CHANNEL_ACTIVE;
2142	}
2143
2144	ret = rtw_add_chan_info(rtwdev, info: &ch_info, list, buf);
2145	if (ret)
2146	return ret;
2147	}
2148
2149	if (list->size > fifo->rsvd_pg_num << TX_PAGE_SIZE_SHIFT) {
2150	rtw_err(rtwdev, "List exceeds rsvd page total size\n");
2151	return -EINVAL;
2152	}
2153
2154	list->addr = fifo->rsvd_h2c_info_addr + rtwdev->scan_info.probe_pg_size;
2155	ret = rtw_fw_write_data_rsvd_page(rtwdev, pg_addr: list->addr, buf, size: list->size);
2156	if (ret)
2157	rtw_err(rtwdev, "Download channel list failed\n");
2158
2159	return ret;
2160	}
2161
2162	static void rtw_fw_set_scan_offload(struct rtw_dev *rtwdev,
2163	struct rtw_ch_switch_option *opt,
2164	struct rtw_vif *rtwvif,
2165	struct rtw_chan_list *list)
2166	{
2167	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2168	struct cfg80211_scan_request *req = rtwvif->scan_req;
2169	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
2170	/* reserve one dummy page at the beginning for tx descriptor */
2171	u8 pkt_loc = fifo->rsvd_h2c_info_addr - fifo->rsvd_boundary + 1;
2172	bool random_seq = req->flags & NL80211_SCAN_FLAG_RANDOM_SN;
2173	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
2174
2175	rtw_h2c_pkt_set_header(h2c_pkt, H2C_PKT_SCAN_OFFLOAD);
2176	SET_PKT_H2C_TOTAL_LEN(h2c_pkt, H2C_PKT_CH_SWITCH_LEN);
2177
2178	SCAN_OFFLOAD_SET_START(h2c_pkt, opt->switch_en);
2179	SCAN_OFFLOAD_SET_BACK_OP_EN(h2c_pkt, opt->back_op_en);
2180	SCAN_OFFLOAD_SET_RANDOM_SEQ_EN(h2c_pkt, random_seq);
2181	SCAN_OFFLOAD_SET_NO_CCK_EN(h2c_pkt, req->no_cck);
2182	SCAN_OFFLOAD_SET_CH_NUM(h2c_pkt, list->ch_num);
2183	SCAN_OFFLOAD_SET_CH_INFO_SIZE(h2c_pkt, list->size);
2184	SCAN_OFFLOAD_SET_CH_INFO_LOC(h2c_pkt, list->addr - fifo->rsvd_boundary);
2185	SCAN_OFFLOAD_SET_OP_CH(h2c_pkt, scan_info->op_chan);
2186	SCAN_OFFLOAD_SET_OP_PRI_CH_IDX(h2c_pkt, scan_info->op_pri_ch_idx);
2187	SCAN_OFFLOAD_SET_OP_BW(h2c_pkt, scan_info->op_bw);
2188	SCAN_OFFLOAD_SET_OP_PORT_ID(h2c_pkt, rtwvif->port);
2189	SCAN_OFFLOAD_SET_OP_DWELL_TIME(h2c_pkt, req->duration_mandatory ?
2190	req->duration : RTW_CHANNEL_TIME);
2191	SCAN_OFFLOAD_SET_OP_GAP_TIME(h2c_pkt, RTW_OFF_CHAN_TIME);
2192	SCAN_OFFLOAD_SET_SSID_NUM(h2c_pkt, req->n_ssids);
2193	SCAN_OFFLOAD_SET_PKT_LOC(h2c_pkt, pkt_loc);
2194
2195	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
2196	}
2197
2198	void rtw_hw_scan_start(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
2199	struct ieee80211_scan_request *scan_req)
2200	{
2201	struct rtw_vif *rtwvif = (struct rtw_vif *)vif->drv_priv;
2202	struct cfg80211_scan_request *req = &scan_req->req;
2203	u8 mac_addr[ETH_ALEN];
2204
2205	rtwdev->scan_info.scanning_vif = vif;
2206	rtwvif->scan_ies = &scan_req->ies;
2207	rtwvif->scan_req = req;
2208
2209	ieee80211_stop_queues(hw: rtwdev->hw);
2210	rtw_leave_lps_deep(rtwdev);
2211	rtw_hci_flush_all_queues(rtwdev, drop: false);
2212	rtw_mac_flush_all_queues(rtwdev, drop: false);
2213	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2214	get_random_mask_addr(buf: mac_addr, addr: req->mac_addr,
2215	mask: req->mac_addr_mask);
2216	else
2217	ether_addr_copy(dst: mac_addr, src: vif->addr);
2218
2219	rtw_core_scan_start(rtwdev, rtwvif, mac_addr, hw_scan: true);
2220
2221	rtwdev->hal.rcr &= ~BIT_CBSSID_BCN;
2222	rtw_write32(rtwdev, REG_RCR, val: rtwdev->hal.rcr);
2223	}
2224
2225	void rtw_hw_scan_complete(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
2226	bool aborted)
2227	{
2228	struct cfg80211_scan_info info = {
2229	.aborted = aborted,
2230	};
2231	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2232	struct rtw_hal *hal = &rtwdev->hal;
2233	struct rtw_vif *rtwvif;
2234	u8 chan = scan_info->op_chan;
2235
2236	if (!vif)
2237	return;
2238
2239	rtwdev->hal.rcr |= BIT_CBSSID_BCN;
2240	rtw_write32(rtwdev, REG_RCR, val: rtwdev->hal.rcr);
2241
2242	rtw_core_scan_complete(rtwdev, vif, hw_scan: true);
2243
2244	rtwvif = (struct rtw_vif *)vif->drv_priv;
2245	if (chan)
2246	rtw_store_op_chan(rtwdev, backup: false);
2247	rtw_phy_set_tx_power_level(rtwdev, channel: hal->current_channel);
2248	ieee80211_wake_queues(hw: rtwdev->hw);
2249	ieee80211_scan_completed(hw: rtwdev->hw, info: &info);
2250
2251	rtwvif->scan_req = NULL;
2252	rtwvif->scan_ies = NULL;
2253	rtwdev->scan_info.scanning_vif = NULL;
2254	}
2255
2256	static int rtw_hw_scan_prehandle(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif,
2257	struct rtw_chan_list *list)
2258	{
2259	struct cfg80211_scan_request *req = rtwvif->scan_req;
2260	int size = req->n_channels * (RTW_CH_INFO_SIZE + RTW_EX_CH_INFO_SIZE);
2261	u8 *buf;
2262	int ret;
2263
2264	buf = kmalloc(size, GFP_KERNEL);
2265	if (!buf)
2266	return -ENOMEM;
2267
2268	ret = rtw_hw_scan_update_probe_req(rtwdev, rtwvif);
2269	if (ret) {
2270	rtw_err(rtwdev, "Update probe request failed\n");
2271	goto out;
2272	}
2273
2274	list->buf_size = size;
2275	list->size = 0;
2276	list->ch_num = 0;
2277	ret = rtw_add_chan_list(rtwdev, rtwvif, list, buf);
2278	out:
2279	kfree(objp: buf);
2280
2281	return ret;
2282	}
2283
2284	int rtw_hw_scan_offload(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
2285	bool enable)
2286	{
2287	struct rtw_vif *rtwvif = vif ? (struct rtw_vif *)vif->drv_priv : NULL;
2288	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2289	struct rtw_ch_switch_option cs_option = {0};
2290	struct rtw_chan_list chan_list = {0};
2291	int ret = 0;
2292
2293	if (!rtwvif)
2294	return -EINVAL;
2295
2296	cs_option.switch_en = enable;
2297	cs_option.back_op_en = scan_info->op_chan != 0;
2298	if (enable) {
2299	ret = rtw_hw_scan_prehandle(rtwdev, rtwvif, list: &chan_list);
2300	if (ret)
2301	goto out;
2302	}
2303	rtw_fw_set_scan_offload(rtwdev, opt: &cs_option, rtwvif, list: &chan_list);
2304	out:
2305	if (rtwdev->ap_active) {
2306	ret = rtw_download_beacon(rtwdev);
2307	if (ret)
2308	rtw_err(rtwdev, "HW scan download beacon failed\n");
2309	}
2310
2311	return ret;
2312	}
2313
2314	void rtw_hw_scan_abort(struct rtw_dev *rtwdev)
2315	{
2316	struct ieee80211_vif *vif = rtwdev->scan_info.scanning_vif;
2317
2318	if (!rtw_fw_feature_check(fw: &rtwdev->fw, feature: FW_FEATURE_SCAN_OFFLOAD))
2319	return;
2320
2321	rtw_hw_scan_offload(rtwdev, vif, enable: false);
2322	rtw_hw_scan_complete(rtwdev, vif, aborted: true);
2323	}
2324
2325	void rtw_hw_scan_status_report(struct rtw_dev *rtwdev, struct sk_buff *skb)
2326	{
2327	struct ieee80211_vif *vif = rtwdev->scan_info.scanning_vif;
2328	struct rtw_c2h_cmd *c2h;
2329	bool aborted;
2330	u8 rc;
2331
2332	if (!test_bit(RTW_FLAG_SCANNING, rtwdev->flags))
2333	return;
2334
2335	c2h = get_c2h_from_skb(skb);
2336	rc = GET_SCAN_REPORT_RETURN_CODE(c2h->payload);
2337	aborted = rc != RTW_SCAN_REPORT_SUCCESS;
2338	rtw_hw_scan_complete(rtwdev, vif, aborted);
2339
2340	if (aborted)
2341	rtw_dbg(rtwdev, mask: RTW_DBG_HW_SCAN, fmt: "HW scan aborted with code: %d\n", rc);
2342	}
2343
2344	void rtw_store_op_chan(struct rtw_dev *rtwdev, bool backup)
2345	{
2346	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2347	struct rtw_hal *hal = &rtwdev->hal;
2348	u8 band;
2349
2350	if (backup) {
2351	scan_info->op_chan = hal->current_channel;
2352	scan_info->op_bw = hal->current_band_width;
2353	scan_info->op_pri_ch_idx = hal->current_primary_channel_index;
2354	scan_info->op_pri_ch = hal->primary_channel;
2355	} else {
2356	band = scan_info->op_chan > 14 ? RTW_BAND_5G : RTW_BAND_2G;
2357	rtw_update_channel(rtwdev, center_channel: scan_info->op_chan,
2358	primary_channel: scan_info->op_pri_ch,
2359	band, bandwidth: scan_info->op_bw);
2360	}
2361	}
2362
2363	void rtw_clear_op_chan(struct rtw_dev *rtwdev)
2364	{
2365	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2366
2367	scan_info->op_chan = 0;
2368	scan_info->op_bw = 0;
2369	scan_info->op_pri_ch_idx = 0;
2370	scan_info->op_pri_ch = 0;
2371	}
2372
2373	static bool rtw_is_op_chan(struct rtw_dev *rtwdev, u8 channel)
2374	{
2375	struct rtw_hw_scan_info *scan_info = &rtwdev->scan_info;
2376
2377	return channel == scan_info->op_chan;
2378	}
2379
2380	void rtw_hw_scan_chan_switch(struct rtw_dev *rtwdev, struct sk_buff *skb)
2381	{
2382	struct rtw_hal *hal = &rtwdev->hal;
2383	struct rtw_c2h_cmd *c2h;
2384	enum rtw_scan_notify_id id;
2385	u8 chan, band, status;
2386
2387	if (!test_bit(RTW_FLAG_SCANNING, rtwdev->flags))
2388	return;
2389
2390	c2h = get_c2h_from_skb(skb);
2391	chan = GET_CHAN_SWITCH_CENTRAL_CH(c2h->payload);
2392	id = GET_CHAN_SWITCH_ID(c2h->payload);
2393	status = GET_CHAN_SWITCH_STATUS(c2h->payload);
2394
2395	if (id == RTW_SCAN_NOTIFY_ID_POSTSWITCH) {
2396	band = chan > 14 ? RTW_BAND_5G : RTW_BAND_2G;
2397	rtw_update_channel(rtwdev, center_channel: chan, primary_channel: chan, band,
2398	bandwidth: RTW_CHANNEL_WIDTH_20);
2399	if (rtw_is_op_chan(rtwdev, channel: chan)) {
2400	rtw_store_op_chan(rtwdev, backup: false);
2401	ieee80211_wake_queues(hw: rtwdev->hw);
2402	rtw_core_enable_beacon(rtwdev, enable: true);
2403	}
2404	} else if (id == RTW_SCAN_NOTIFY_ID_PRESWITCH) {
2405	if (IS_CH_5G_BAND(chan)) {
2406	rtw_coex_switchband_notify(rtwdev, type: COEX_SWITCH_TO_5G);
2407	} else if (IS_CH_2G_BAND(chan)) {
2408	u8 chan_type;
2409
2410	if (test_bit(RTW_FLAG_SCANNING, rtwdev->flags))
2411	chan_type = COEX_SWITCH_TO_24G;
2412	else
2413	chan_type = COEX_SWITCH_TO_24G_NOFORSCAN;
2414	rtw_coex_switchband_notify(rtwdev, type: chan_type);
2415	}
2416	/* The channel of C2H RTW_SCAN_NOTIFY_ID_PRESWITCH is next
2417	* channel that hardware will switch. We need to stop queue
2418	* if next channel is non-op channel.
2419	*/
2420	if (!rtw_is_op_chan(rtwdev, channel: chan) &&
2421	rtw_is_op_chan(rtwdev, channel: hal->current_channel)) {
2422	rtw_core_enable_beacon(rtwdev, enable: false);
2423	ieee80211_stop_queues(hw: rtwdev->hw);
2424	}
2425	}
2426
2427	rtw_dbg(rtwdev, mask: RTW_DBG_HW_SCAN,
2428	fmt: "Chan switch: %x, id: %x, status: %x\n", chan, id, status);
2429	}
2430