drivers/net/wireless/ath/wil6210/wmi.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
   4  * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
   5  */
   6
   7 #include <linux/moduleparam.h>
   8 #include <linux/etherdevice.h>
   9 #include <linux/if_arp.h>
  10
  11 #include "wil6210.h"
  12 #include "txrx.h"
  13 #include "wmi.h"
  14 #include "trace.h"
  15
  16 /* set the default max assoc sta to max supported by driver */
  17 uint max_assoc_sta = WIL6210_MAX_CID;
  18 module_param(max_assoc_sta, uint, 0444);
  19 MODULE_PARM_DESC(max_assoc_sta, " Max number of stations associated to the AP");
  20
  21 int agg_wsize; /* = 0; */
  22 module_param(agg_wsize, int, 0644);
  23 MODULE_PARM_DESC(agg_wsize, " Window size for Tx Block Ack after connect;"
  24                  " 0 - use default; < 0 - don't auto-establish");
  25
  26 u8 led_id = WIL_LED_INVALID_ID;
  27 module_param(led_id, byte, 0444);
  28 MODULE_PARM_DESC(led_id,
  29                  " 60G device led enablement. Set the led ID (0-2) to enable");
  30
  31 #define WIL_WAIT_FOR_SUSPEND_RESUME_COMP 200
  32 #define WIL_WMI_PCP_STOP_TO_MS 5000
  33
  34 /**
  35  * DOC: WMI event receiving - theory of operations
  36  *
  37  * When firmware about to report WMI event, it fills memory area
  38  * in the mailbox and raises misc. IRQ. Thread interrupt handler invoked for
  39  * the misc IRQ, function @wmi_recv_cmd called by thread IRQ handler.
  40  *
  41  * @wmi_recv_cmd reads event, allocates memory chunk  and attaches it to the
  42  * event list @wil->pending_wmi_ev. Then, work queue @wil->wmi_wq wakes up
  43  * and handles events within the @wmi_event_worker. Every event get detached
  44  * from list, processed and deleted.
  45  *
  46  * Purpose for this mechanism is to release IRQ thread; otherwise,
  47  * if WMI event handling involves another WMI command flow, this 2-nd flow
  48  * won't be completed because of blocked IRQ thread.
  49  */
  50
  51 /**
  52  * DOC: Addressing - theory of operations
  53  *
  54  * There are several buses present on the WIL6210 card.
  55  * Same memory areas are visible at different address on
  56  * the different busses. There are 3 main bus masters:
  57  *  - MAC CPU (ucode)
  58  *  - User CPU (firmware)
  59  *  - AHB (host)
  60  *
  61  * On the PCI bus, there is one BAR (BAR0) of 2Mb size, exposing
  62  * AHB addresses starting from 0x880000
  63  *
  64  * Internally, firmware uses addresses that allow faster access but
  65  * are invisible from the host. To read from these addresses, alternative
  66  * AHB address must be used.
  67  */
  68
  69 /* sparrow_fw_mapping provides memory remapping table for sparrow
  70  *
  71  * array size should be in sync with the declaration in the wil6210.h
  72  *
  73  * Sparrow memory mapping:
  74  * Linker address         PCI/Host address
  75  *                        0x880000 .. 0xa80000  2Mb BAR0
  76  * 0x800000 .. 0x808000   0x900000 .. 0x908000  32k DCCM
  77  * 0x840000 .. 0x860000   0x908000 .. 0x928000  128k PERIPH
  78  */
  79 const struct fw_map sparrow_fw_mapping[] = {
  80         /* FW code RAM 256k */
  81         {0x000000, 0x040000, 0x8c0000, "fw_code", true, true},
  82         /* FW data RAM 32k */
  83         {0x800000, 0x808000, 0x900000, "fw_data", true, true},
  84         /* periph data 128k */
  85         {0x840000, 0x860000, 0x908000, "fw_peri", true, true},
  86         /* various RGF 40k */
  87         {0x880000, 0x88a000, 0x880000, "rgf", true, true},
  88         /* AGC table   4k */
  89         {0x88a000, 0x88b000, 0x88a000, "AGC_tbl", true, true},
  90         /* Pcie_ext_rgf 4k */
  91         {0x88b000, 0x88c000, 0x88b000, "rgf_ext", true, true},
  92         /* mac_ext_rgf 512b */
  93         {0x88c000, 0x88c200, 0x88c000, "mac_rgf_ext", true, true},
  94         /* upper area 548k */
  95         {0x8c0000, 0x949000, 0x8c0000, "upper", true, true},
  96         /* UCODE areas - accessible by debugfs blobs but not by
  97          * wmi_addr_remap. UCODE areas MUST be added AFTER FW areas!
  98          */
  99         /* ucode code RAM 128k */
 100         {0x000000, 0x020000, 0x920000, "uc_code", false, false},
 101         /* ucode data RAM 16k */
 102         {0x800000, 0x804000, 0x940000, "uc_data", false, false},
 103 };
 104
 105 /* sparrow_d0_mac_rgf_ext - mac_rgf_ext section for Sparrow D0
 106  * it is a bit larger to support extra features
 107  */
 108 const struct fw_map sparrow_d0_mac_rgf_ext = {
 109         0x88c000, 0x88c500, 0x88c000, "mac_rgf_ext", true, true
 110 };
 111
 112 /* talyn_fw_mapping provides memory remapping table for Talyn
 113  *
 114  * array size should be in sync with the declaration in the wil6210.h
 115  *
 116  * Talyn memory mapping:
 117  * Linker address         PCI/Host address
 118  *                        0x880000 .. 0xc80000  4Mb BAR0
 119  * 0x800000 .. 0x820000   0xa00000 .. 0xa20000  128k DCCM
 120  * 0x840000 .. 0x858000   0xa20000 .. 0xa38000  96k PERIPH
 121  */
 122 const struct fw_map talyn_fw_mapping[] = {
 123         /* FW code RAM 1M */
 124         {0x000000, 0x100000, 0x900000, "fw_code", true, true},
 125         /* FW data RAM 128k */
 126         {0x800000, 0x820000, 0xa00000, "fw_data", true, true},
 127         /* periph. data RAM 96k */
 128         {0x840000, 0x858000, 0xa20000, "fw_peri", true, true},
 129         /* various RGF 40k */
 130         {0x880000, 0x88a000, 0x880000, "rgf", true, true},
 131         /* AGC table 4k */
 132         {0x88a000, 0x88b000, 0x88a000, "AGC_tbl", true, true},
 133         /* Pcie_ext_rgf 4k */
 134         {0x88b000, 0x88c000, 0x88b000, "rgf_ext", true, true},
 135         /* mac_ext_rgf 1344b */
 136         {0x88c000, 0x88c540, 0x88c000, "mac_rgf_ext", true, true},
 137         /* ext USER RGF 4k */
 138         {0x88d000, 0x88e000, 0x88d000, "ext_user_rgf", true, true},
 139         /* OTP 4k */
 140         {0x8a0000, 0x8a1000, 0x8a0000, "otp", true, false},
 141         /* DMA EXT RGF 64k */
 142         {0x8b0000, 0x8c0000, 0x8b0000, "dma_ext_rgf", true, true},
 143         /* upper area 1536k */
 144         {0x900000, 0xa80000, 0x900000, "upper", true, true},
 145         /* UCODE areas - accessible by debugfs blobs but not by
 146          * wmi_addr_remap. UCODE areas MUST be added AFTER FW areas!
 147          */
 148         /* ucode code RAM 256k */
 149         {0x000000, 0x040000, 0xa38000, "uc_code", false, false},
 150         /* ucode data RAM 32k */
 151         {0x800000, 0x808000, 0xa78000, "uc_data", false, false},
 152 };
 153
 154 /* talyn_mb_fw_mapping provides memory remapping table for Talyn-MB
 155  *
 156  * array size should be in sync with the declaration in the wil6210.h
 157  *
 158  * Talyn MB memory mapping:
 159  * Linker address         PCI/Host address
 160  *                        0x880000 .. 0xc80000  4Mb BAR0
 161  * 0x800000 .. 0x820000   0xa00000 .. 0xa20000  128k DCCM
 162  * 0x840000 .. 0x858000   0xa20000 .. 0xa38000  96k PERIPH
 163  */
 164 const struct fw_map talyn_mb_fw_mapping[] = {
 165         /* FW code RAM 768k */
 166         {0x000000, 0x0c0000, 0x900000, "fw_code", true, true},
 167         /* FW data RAM 128k */
 168         {0x800000, 0x820000, 0xa00000, "fw_data", true, true},
 169         /* periph. data RAM 96k */
 170         {0x840000, 0x858000, 0xa20000, "fw_peri", true, true},
 171         /* various RGF 40k */
 172         {0x880000, 0x88a000, 0x880000, "rgf", true, true},
 173         /* AGC table 4k */
 174         {0x88a000, 0x88b000, 0x88a000, "AGC_tbl", true, true},
 175         /* Pcie_ext_rgf 4k */
 176         {0x88b000, 0x88c000, 0x88b000, "rgf_ext", true, true},
 177         /* mac_ext_rgf 2256b */
 178         {0x88c000, 0x88c8d0, 0x88c000, "mac_rgf_ext", true, true},
 179         /* ext USER RGF 4k */
 180         {0x88d000, 0x88e000, 0x88d000, "ext_user_rgf", true, true},
 181         /* SEC PKA 16k */
 182         {0x890000, 0x894000, 0x890000, "sec_pka", true, true},
 183         /* SEC KDF RGF 3096b */
 184         {0x898000, 0x898c18, 0x898000, "sec_kdf_rgf", true, true},
 185         /* SEC MAIN 2124b */
 186         {0x89a000, 0x89a84c, 0x89a000, "sec_main", true, true},
 187         /* OTP 4k */
 188         {0x8a0000, 0x8a1000, 0x8a0000, "otp", true, false},
 189         /* DMA EXT RGF 64k */
 190         {0x8b0000, 0x8c0000, 0x8b0000, "dma_ext_rgf", true, true},
 191         /* DUM USER RGF 528b */
 192         {0x8c0000, 0x8c0210, 0x8c0000, "dum_user_rgf", true, true},
 193         /* DMA OFU 296b */
 194         {0x8c2000, 0x8c2128, 0x8c2000, "dma_ofu", true, true},
 195         /* ucode debug 256b */
 196         {0x8c3000, 0x8c3100, 0x8c3000, "ucode_debug", true, true},
 197         /* upper area 1536k */
 198         {0x900000, 0xa80000, 0x900000, "upper", true, true},
 199         /* UCODE areas - accessible by debugfs blobs but not by
 200          * wmi_addr_remap. UCODE areas MUST be added AFTER FW areas!
 201          */
 202         /* ucode code RAM 256k */
 203         {0x000000, 0x040000, 0xa38000, "uc_code", false, false},
 204         /* ucode data RAM 32k */
 205         {0x800000, 0x808000, 0xa78000, "uc_data", false, false},
 206 };
 207
 208 struct fw_map fw_mapping[MAX_FW_MAPPING_TABLE_SIZE];
 209
 210 struct blink_on_off_time led_blink_time[] = {
 211         {WIL_LED_BLINK_ON_SLOW_MS, WIL_LED_BLINK_OFF_SLOW_MS},
 212         {WIL_LED_BLINK_ON_MED_MS, WIL_LED_BLINK_OFF_MED_MS},
 213         {WIL_LED_BLINK_ON_FAST_MS, WIL_LED_BLINK_OFF_FAST_MS},
 214 };
 215
 216 struct auth_no_hdr {
 217         __le16 auth_alg;
 218         __le16 auth_transaction;
 219         __le16 status_code;
 220         /* possibly followed by Challenge text */
 221         u8 variable[];
 222 } __packed;
 223
 224 u8 led_polarity = LED_POLARITY_LOW_ACTIVE;
 225
 226 /**
 227  * wmi_addr_remap - return AHB address for given firmware internal (linker) address
 228  * @x: internal address
 229  * If address have no valid AHB mapping, return 0
 230  */
 231 static u32 wmi_addr_remap(u32 x)
 232 {
 233         uint i;
 234
 235         for (i = 0; i < ARRAY_SIZE(fw_mapping); i++) {
 236                 if (fw_mapping[i].fw &&
 237                     ((x >= fw_mapping[i].from) && (x < fw_mapping[i].to)))
 238                         return x + fw_mapping[i].host - fw_mapping[i].from;
 239         }
 240
 241         return 0;
 242 }
 243
 244 /**
 245  * wil_find_fw_mapping - find fw_mapping entry by section name
 246  * @section: section name
 247  *
 248  * Return pointer to section or NULL if not found
 249  */
 250 struct fw_map *wil_find_fw_mapping(const char *section)
 251 {
 252         int i;
 253
 254         for (i = 0; i < ARRAY_SIZE(fw_mapping); i++)
 255                 if (fw_mapping[i].name &&
 256                     !strcmp(section, fw_mapping[i].name))
 257                         return &fw_mapping[i];
 258
 259         return NULL;
 260 }
 261
 262 /**
 263  * wmi_buffer_block - Check address validity for WMI buffer; remap if needed
 264  * @wil: driver data
 265  * @ptr_: internal (linker) fw/ucode address
 266  * @size: if non zero, validate the block does not
 267  *  exceed the device memory (bar)
 268  *
 269  * Valid buffer should be DWORD aligned
 270  *
 271  * return address for accessing buffer from the host;
 272  * if buffer is not valid, return NULL.
 273  */
 274 void __iomem *wmi_buffer_block(struct wil6210_priv *wil, __le32 ptr_, u32 size)
 275 {
 276         u32 off;
 277         u32 ptr = le32_to_cpu(ptr_);
 278
 279         if (ptr % 4)
 280                 return NULL;
 281
 282         ptr = wmi_addr_remap(ptr);
 283         if (ptr < WIL6210_FW_HOST_OFF)
 284                 return NULL;
 285
 286         off = HOSTADDR(ptr);
 287         if (off > wil->bar_size - 4)
 288                 return NULL;
 289         if (size && ((off + size > wil->bar_size) || (off + size < off)))
 290                 return NULL;
 291
 292         return wil->csr + off;
 293 }
 294
 295 void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr_)
 296 {
 297         return wmi_buffer_block(wil, ptr_, 0);
 298 }
 299
 300 /* Check address validity */
 301 void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr)
 302 {
 303         u32 off;
 304
 305         if (ptr % 4)
 306                 return NULL;
 307
 308         if (ptr < WIL6210_FW_HOST_OFF)
 309                 return NULL;
 310
 311         off = HOSTADDR(ptr);
 312         if (off > wil->bar_size - 4)
 313                 return NULL;
 314
 315         return wil->csr + off;
 316 }
 317
 318 int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
 319                  struct wil6210_mbox_hdr *hdr)
 320 {
 321         void __iomem *src = wmi_buffer(wil, ptr);
 322
 323         if (!src)
 324                 return -EINVAL;
 325
 326         wil_memcpy_fromio_32(hdr, src, sizeof(*hdr));
 327
 328         return 0;
 329 }
 330
 331 static const char *cmdid2name(u16 cmdid)
 332 {
 333         switch (cmdid) {
 334         case WMI_NOTIFY_REQ_CMDID:
 335                 return "WMI_NOTIFY_REQ_CMD";
 336         case WMI_START_SCAN_CMDID:
 337                 return "WMI_START_SCAN_CMD";
 338         case WMI_CONNECT_CMDID:
 339                 return "WMI_CONNECT_CMD";
 340         case WMI_DISCONNECT_CMDID:
 341                 return "WMI_DISCONNECT_CMD";
 342         case WMI_SW_TX_REQ_CMDID:
 343                 return "WMI_SW_TX_REQ_CMD";
 344         case WMI_GET_RF_SECTOR_PARAMS_CMDID:
 345                 return "WMI_GET_RF_SECTOR_PARAMS_CMD";
 346         case WMI_SET_RF_SECTOR_PARAMS_CMDID:
 347                 return "WMI_SET_RF_SECTOR_PARAMS_CMD";
 348         case WMI_GET_SELECTED_RF_SECTOR_INDEX_CMDID:
 349                 return "WMI_GET_SELECTED_RF_SECTOR_INDEX_CMD";
 350         case WMI_SET_SELECTED_RF_SECTOR_INDEX_CMDID:
 351                 return "WMI_SET_SELECTED_RF_SECTOR_INDEX_CMD";
 352         case WMI_BRP_SET_ANT_LIMIT_CMDID:
 353                 return "WMI_BRP_SET_ANT_LIMIT_CMD";
 354         case WMI_TOF_SESSION_START_CMDID:
 355                 return "WMI_TOF_SESSION_START_CMD";
 356         case WMI_AOA_MEAS_CMDID:
 357                 return "WMI_AOA_MEAS_CMD";
 358         case WMI_PMC_CMDID:
 359                 return "WMI_PMC_CMD";
 360         case WMI_TOF_GET_TX_RX_OFFSET_CMDID:
 361                 return "WMI_TOF_GET_TX_RX_OFFSET_CMD";
 362         case WMI_TOF_SET_TX_RX_OFFSET_CMDID:
 363                 return "WMI_TOF_SET_TX_RX_OFFSET_CMD";
 364         case WMI_VRING_CFG_CMDID:
 365                 return "WMI_VRING_CFG_CMD";
 366         case WMI_BCAST_VRING_CFG_CMDID:
 367                 return "WMI_BCAST_VRING_CFG_CMD";
 368         case WMI_TRAFFIC_SUSPEND_CMDID:
 369                 return "WMI_TRAFFIC_SUSPEND_CMD";
 370         case WMI_TRAFFIC_RESUME_CMDID:
 371                 return "WMI_TRAFFIC_RESUME_CMD";
 372         case WMI_ECHO_CMDID:
 373                 return "WMI_ECHO_CMD";
 374         case WMI_SET_MAC_ADDRESS_CMDID:
 375                 return "WMI_SET_MAC_ADDRESS_CMD";
 376         case WMI_LED_CFG_CMDID:
 377                 return "WMI_LED_CFG_CMD";
 378         case WMI_PCP_START_CMDID:
 379                 return "WMI_PCP_START_CMD";
 380         case WMI_PCP_STOP_CMDID:
 381                 return "WMI_PCP_STOP_CMD";
 382         case WMI_SET_SSID_CMDID:
 383                 return "WMI_SET_SSID_CMD";
 384         case WMI_GET_SSID_CMDID:
 385                 return "WMI_GET_SSID_CMD";
 386         case WMI_SET_PCP_CHANNEL_CMDID:
 387                 return "WMI_SET_PCP_CHANNEL_CMD";
 388         case WMI_GET_PCP_CHANNEL_CMDID:
 389                 return "WMI_GET_PCP_CHANNEL_CMD";
 390         case WMI_P2P_CFG_CMDID:
 391                 return "WMI_P2P_CFG_CMD";
 392         case WMI_PORT_ALLOCATE_CMDID:
 393                 return "WMI_PORT_ALLOCATE_CMD";
 394         case WMI_PORT_DELETE_CMDID:
 395                 return "WMI_PORT_DELETE_CMD";
 396         case WMI_START_LISTEN_CMDID:
 397                 return "WMI_START_LISTEN_CMD";
 398         case WMI_START_SEARCH_CMDID:
 399                 return "WMI_START_SEARCH_CMD";
 400         case WMI_DISCOVERY_STOP_CMDID:
 401                 return "WMI_DISCOVERY_STOP_CMD";
 402         case WMI_DELETE_CIPHER_KEY_CMDID:
 403                 return "WMI_DELETE_CIPHER_KEY_CMD";
 404         case WMI_ADD_CIPHER_KEY_CMDID:
 405                 return "WMI_ADD_CIPHER_KEY_CMD";
 406         case WMI_SET_APPIE_CMDID:
 407                 return "WMI_SET_APPIE_CMD";
 408         case WMI_CFG_RX_CHAIN_CMDID:
 409                 return "WMI_CFG_RX_CHAIN_CMD";
 410         case WMI_TEMP_SENSE_CMDID:
 411                 return "WMI_TEMP_SENSE_CMD";
 412         case WMI_DEL_STA_CMDID:
 413                 return "WMI_DEL_STA_CMD";
 414         case WMI_DISCONNECT_STA_CMDID:
 415                 return "WMI_DISCONNECT_STA_CMD";
 416         case WMI_RING_BA_EN_CMDID:
 417                 return "WMI_RING_BA_EN_CMD";
 418         case WMI_RING_BA_DIS_CMDID:
 419                 return "WMI_RING_BA_DIS_CMD";
 420         case WMI_RCP_DELBA_CMDID:
 421                 return "WMI_RCP_DELBA_CMD";
 422         case WMI_RCP_ADDBA_RESP_CMDID:
 423                 return "WMI_RCP_ADDBA_RESP_CMD";
 424         case WMI_RCP_ADDBA_RESP_EDMA_CMDID:
 425                 return "WMI_RCP_ADDBA_RESP_EDMA_CMD";
 426         case WMI_PS_DEV_PROFILE_CFG_CMDID:
 427                 return "WMI_PS_DEV_PROFILE_CFG_CMD";
 428         case WMI_SET_MGMT_RETRY_LIMIT_CMDID:
 429                 return "WMI_SET_MGMT_RETRY_LIMIT_CMD";
 430         case WMI_GET_MGMT_RETRY_LIMIT_CMDID:
 431                 return "WMI_GET_MGMT_RETRY_LIMIT_CMD";
 432         case WMI_ABORT_SCAN_CMDID:
 433                 return "WMI_ABORT_SCAN_CMD";
 434         case WMI_NEW_STA_CMDID:
 435                 return "WMI_NEW_STA_CMD";
 436         case WMI_SET_THERMAL_THROTTLING_CFG_CMDID:
 437                 return "WMI_SET_THERMAL_THROTTLING_CFG_CMD";
 438         case WMI_GET_THERMAL_THROTTLING_CFG_CMDID:
 439                 return "WMI_GET_THERMAL_THROTTLING_CFG_CMD";
 440         case WMI_LINK_MAINTAIN_CFG_WRITE_CMDID:
 441                 return "WMI_LINK_MAINTAIN_CFG_WRITE_CMD";
 442         case WMI_LO_POWER_CALIB_FROM_OTP_CMDID:
 443                 return "WMI_LO_POWER_CALIB_FROM_OTP_CMD";
 444         case WMI_START_SCHED_SCAN_CMDID:
 445                 return "WMI_START_SCHED_SCAN_CMD";
 446         case WMI_STOP_SCHED_SCAN_CMDID:
 447                 return "WMI_STOP_SCHED_SCAN_CMD";
 448         case WMI_TX_STATUS_RING_ADD_CMDID:
 449                 return "WMI_TX_STATUS_RING_ADD_CMD";
 450         case WMI_RX_STATUS_RING_ADD_CMDID:
 451                 return "WMI_RX_STATUS_RING_ADD_CMD";
 452         case WMI_TX_DESC_RING_ADD_CMDID:
 453                 return "WMI_TX_DESC_RING_ADD_CMD";
 454         case WMI_RX_DESC_RING_ADD_CMDID:
 455                 return "WMI_RX_DESC_RING_ADD_CMD";
 456         case WMI_BCAST_DESC_RING_ADD_CMDID:
 457                 return "WMI_BCAST_DESC_RING_ADD_CMD";
 458         case WMI_CFG_DEF_RX_OFFLOAD_CMDID:
 459                 return "WMI_CFG_DEF_RX_OFFLOAD_CMD";
 460         case WMI_LINK_STATS_CMDID:
 461                 return "WMI_LINK_STATS_CMD";
 462         case WMI_SW_TX_REQ_EXT_CMDID:
 463                 return "WMI_SW_TX_REQ_EXT_CMDID";
 464         case WMI_FT_AUTH_CMDID:
 465                 return "WMI_FT_AUTH_CMD";
 466         case WMI_FT_REASSOC_CMDID:
 467                 return "WMI_FT_REASSOC_CMD";
 468         case WMI_UPDATE_FT_IES_CMDID:
 469                 return "WMI_UPDATE_FT_IES_CMD";
 470         case WMI_RBUFCAP_CFG_CMDID:
 471                 return "WMI_RBUFCAP_CFG_CMD";
 472         case WMI_TEMP_SENSE_ALL_CMDID:
 473                 return "WMI_TEMP_SENSE_ALL_CMDID";
 474         case WMI_SET_LINK_MONITOR_CMDID:
 475                 return "WMI_SET_LINK_MONITOR_CMD";
 476         default:
 477                 return "Untracked CMD";
 478         }
 479 }
 480
 481 static const char *eventid2name(u16 eventid)
 482 {
 483         switch (eventid) {
 484         case WMI_NOTIFY_REQ_DONE_EVENTID:
 485                 return "WMI_NOTIFY_REQ_DONE_EVENT";
 486         case WMI_DISCONNECT_EVENTID:
 487                 return "WMI_DISCONNECT_EVENT";
 488         case WMI_SW_TX_COMPLETE_EVENTID:
 489                 return "WMI_SW_TX_COMPLETE_EVENT";
 490         case WMI_GET_RF_SECTOR_PARAMS_DONE_EVENTID:
 491                 return "WMI_GET_RF_SECTOR_PARAMS_DONE_EVENT";
 492         case WMI_SET_RF_SECTOR_PARAMS_DONE_EVENTID:
 493                 return "WMI_SET_RF_SECTOR_PARAMS_DONE_EVENT";
 494         case WMI_GET_SELECTED_RF_SECTOR_INDEX_DONE_EVENTID:
 495                 return "WMI_GET_SELECTED_RF_SECTOR_INDEX_DONE_EVENT";
 496         case WMI_SET_SELECTED_RF_SECTOR_INDEX_DONE_EVENTID:
 497                 return "WMI_SET_SELECTED_RF_SECTOR_INDEX_DONE_EVENT";
 498         case WMI_BRP_SET_ANT_LIMIT_EVENTID:
 499                 return "WMI_BRP_SET_ANT_LIMIT_EVENT";
 500         case WMI_FW_READY_EVENTID:
 501                 return "WMI_FW_READY_EVENT";
 502         case WMI_TRAFFIC_RESUME_EVENTID:
 503                 return "WMI_TRAFFIC_RESUME_EVENT";
 504         case WMI_TOF_GET_TX_RX_OFFSET_EVENTID:
 505                 return "WMI_TOF_GET_TX_RX_OFFSET_EVENT";
 506         case WMI_TOF_SET_TX_RX_OFFSET_EVENTID:
 507                 return "WMI_TOF_SET_TX_RX_OFFSET_EVENT";
 508         case WMI_VRING_CFG_DONE_EVENTID:
 509                 return "WMI_VRING_CFG_DONE_EVENT";
 510         case WMI_READY_EVENTID:
 511                 return "WMI_READY_EVENT";
 512         case WMI_RX_MGMT_PACKET_EVENTID:
 513                 return "WMI_RX_MGMT_PACKET_EVENT";
 514         case WMI_TX_MGMT_PACKET_EVENTID:
 515                 return "WMI_TX_MGMT_PACKET_EVENT";
 516         case WMI_SCAN_COMPLETE_EVENTID:
 517                 return "WMI_SCAN_COMPLETE_EVENT";
 518         case WMI_ACS_PASSIVE_SCAN_COMPLETE_EVENTID:
 519                 return "WMI_ACS_PASSIVE_SCAN_COMPLETE_EVENT";
 520         case WMI_CONNECT_EVENTID:
 521                 return "WMI_CONNECT_EVENT";
 522         case WMI_EAPOL_RX_EVENTID:
 523                 return "WMI_EAPOL_RX_EVENT";
 524         case WMI_BA_STATUS_EVENTID:
 525                 return "WMI_BA_STATUS_EVENT";
 526         case WMI_RCP_ADDBA_REQ_EVENTID:
 527                 return "WMI_RCP_ADDBA_REQ_EVENT";
 528         case WMI_DELBA_EVENTID:
 529                 return "WMI_DELBA_EVENT";
 530         case WMI_RING_EN_EVENTID:
 531                 return "WMI_RING_EN_EVENT";
 532         case WMI_DATA_PORT_OPEN_EVENTID:
 533                 return "WMI_DATA_PORT_OPEN_EVENT";
 534         case WMI_AOA_MEAS_EVENTID:
 535                 return "WMI_AOA_MEAS_EVENT";
 536         case WMI_TOF_SESSION_END_EVENTID:
 537                 return "WMI_TOF_SESSION_END_EVENT";
 538         case WMI_TOF_GET_CAPABILITIES_EVENTID:
 539                 return "WMI_TOF_GET_CAPABILITIES_EVENT";
 540         case WMI_TOF_SET_LCR_EVENTID:
 541                 return "WMI_TOF_SET_LCR_EVENT";
 542         case WMI_TOF_SET_LCI_EVENTID:
 543                 return "WMI_TOF_SET_LCI_EVENT";
 544         case WMI_TOF_FTM_PER_DEST_RES_EVENTID:
 545                 return "WMI_TOF_FTM_PER_DEST_RES_EVENT";
 546         case WMI_TOF_CHANNEL_INFO_EVENTID:
 547                 return "WMI_TOF_CHANNEL_INFO_EVENT";
 548         case WMI_TRAFFIC_SUSPEND_EVENTID:
 549                 return "WMI_TRAFFIC_SUSPEND_EVENT";
 550         case WMI_ECHO_RSP_EVENTID:
 551                 return "WMI_ECHO_RSP_EVENT";
 552         case WMI_LED_CFG_DONE_EVENTID:
 553                 return "WMI_LED_CFG_DONE_EVENT";
 554         case WMI_PCP_STARTED_EVENTID:
 555                 return "WMI_PCP_STARTED_EVENT";
 556         case WMI_PCP_STOPPED_EVENTID:
 557                 return "WMI_PCP_STOPPED_EVENT";
 558         case WMI_GET_SSID_EVENTID:
 559                 return "WMI_GET_SSID_EVENT";
 560         case WMI_GET_PCP_CHANNEL_EVENTID:
 561                 return "WMI_GET_PCP_CHANNEL_EVENT";
 562         case WMI_P2P_CFG_DONE_EVENTID:
 563                 return "WMI_P2P_CFG_DONE_EVENT";
 564         case WMI_PORT_ALLOCATED_EVENTID:
 565                 return "WMI_PORT_ALLOCATED_EVENT";
 566         case WMI_PORT_DELETED_EVENTID:
 567                 return "WMI_PORT_DELETED_EVENT";
 568         case WMI_LISTEN_STARTED_EVENTID:
 569                 return "WMI_LISTEN_STARTED_EVENT";
 570         case WMI_SEARCH_STARTED_EVENTID:
 571                 return "WMI_SEARCH_STARTED_EVENT";
 572         case WMI_DISCOVERY_STOPPED_EVENTID:
 573                 return "WMI_DISCOVERY_STOPPED_EVENT";
 574         case WMI_CFG_RX_CHAIN_DONE_EVENTID:
 575                 return "WMI_CFG_RX_CHAIN_DONE_EVENT";
 576         case WMI_TEMP_SENSE_DONE_EVENTID:
 577                 return "WMI_TEMP_SENSE_DONE_EVENT";
 578         case WMI_RCP_ADDBA_RESP_SENT_EVENTID:
 579                 return "WMI_RCP_ADDBA_RESP_SENT_EVENT";
 580         case WMI_PS_DEV_PROFILE_CFG_EVENTID:
 581                 return "WMI_PS_DEV_PROFILE_CFG_EVENT";
 582         case WMI_SET_MGMT_RETRY_LIMIT_EVENTID:
 583                 return "WMI_SET_MGMT_RETRY_LIMIT_EVENT";
 584         case WMI_GET_MGMT_RETRY_LIMIT_EVENTID:
 585                 return "WMI_GET_MGMT_RETRY_LIMIT_EVENT";
 586         case WMI_SET_THERMAL_THROTTLING_CFG_EVENTID:
 587                 return "WMI_SET_THERMAL_THROTTLING_CFG_EVENT";
 588         case WMI_GET_THERMAL_THROTTLING_CFG_EVENTID:
 589                 return "WMI_GET_THERMAL_THROTTLING_CFG_EVENT";
 590         case WMI_LINK_MAINTAIN_CFG_WRITE_DONE_EVENTID:
 591                 return "WMI_LINK_MAINTAIN_CFG_WRITE_DONE_EVENT";
 592         case WMI_LO_POWER_CALIB_FROM_OTP_EVENTID:
 593                 return "WMI_LO_POWER_CALIB_FROM_OTP_EVENT";
 594         case WMI_START_SCHED_SCAN_EVENTID:
 595                 return "WMI_START_SCHED_SCAN_EVENT";
 596         case WMI_STOP_SCHED_SCAN_EVENTID:
 597                 return "WMI_STOP_SCHED_SCAN_EVENT";
 598         case WMI_SCHED_SCAN_RESULT_EVENTID:
 599                 return "WMI_SCHED_SCAN_RESULT_EVENT";
 600         case WMI_TX_STATUS_RING_CFG_DONE_EVENTID:
 601                 return "WMI_TX_STATUS_RING_CFG_DONE_EVENT";
 602         case WMI_RX_STATUS_RING_CFG_DONE_EVENTID:
 603                 return "WMI_RX_STATUS_RING_CFG_DONE_EVENT";
 604         case WMI_TX_DESC_RING_CFG_DONE_EVENTID:
 605                 return "WMI_TX_DESC_RING_CFG_DONE_EVENT";
 606         case WMI_RX_DESC_RING_CFG_DONE_EVENTID:
 607                 return "WMI_RX_DESC_RING_CFG_DONE_EVENT";
 608         case WMI_CFG_DEF_RX_OFFLOAD_DONE_EVENTID:
 609                 return "WMI_CFG_DEF_RX_OFFLOAD_DONE_EVENT";
 610         case WMI_LINK_STATS_CONFIG_DONE_EVENTID:
 611                 return "WMI_LINK_STATS_CONFIG_DONE_EVENT";
 612         case WMI_LINK_STATS_EVENTID:
 613                 return "WMI_LINK_STATS_EVENT";
 614         case WMI_COMMAND_NOT_SUPPORTED_EVENTID:
 615                 return "WMI_COMMAND_NOT_SUPPORTED_EVENT";
 616         case WMI_FT_AUTH_STATUS_EVENTID:
 617                 return "WMI_FT_AUTH_STATUS_EVENT";
 618         case WMI_FT_REASSOC_STATUS_EVENTID:
 619                 return "WMI_FT_REASSOC_STATUS_EVENT";
 620         case WMI_RBUFCAP_CFG_EVENTID:
 621                 return "WMI_RBUFCAP_CFG_EVENT";
 622         case WMI_TEMP_SENSE_ALL_DONE_EVENTID:
 623                 return "WMI_TEMP_SENSE_ALL_DONE_EVENTID";
 624         case WMI_SET_LINK_MONITOR_EVENTID:
 625                 return "WMI_SET_LINK_MONITOR_EVENT";
 626         case WMI_LINK_MONITOR_EVENTID:
 627                 return "WMI_LINK_MONITOR_EVENT";
 628         default:
 629                 return "Untracked EVENT";
 630         }
 631 }
 632
 633 static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, u8 mid,
 634                       void *buf, u16 len)
 635 {
 636         struct {
 637                 struct wil6210_mbox_hdr hdr;
 638                 struct wmi_cmd_hdr wmi;
 639         } __packed cmd = {
 640                 .hdr = {
 641                         .type = WIL_MBOX_HDR_TYPE_WMI,
 642                         .flags = 0,
 643                         .len = cpu_to_le16(sizeof(cmd.wmi) + len),
 644                 },
 645                 .wmi = {
 646                         .mid = mid,
 647                         .command_id = cpu_to_le16(cmdid),
 648                 },
 649         };
 650         struct wil6210_mbox_ring *r = &wil->mbox_ctl.tx;
 651         struct wil6210_mbox_ring_desc d_head;
 652         u32 next_head;
 653         void __iomem *dst;
 654         void __iomem *head = wmi_addr(wil, r->head);
 655         uint retry;
 656         int rc = 0;
 657
 658         if (len > r->entry_size - sizeof(cmd)) {
 659                 wil_err(wil, "WMI size too large: %d bytes, max is %d\n",
 660                         (int)(sizeof(cmd) + len), r->entry_size);
 661                 return -ERANGE;
 662         }
 663
 664         might_sleep();
 665
 666         if (!test_bit(wil_status_fwready, wil->status)) {
 667                 wil_err(wil, "WMI: cannot send command while FW not ready\n");
 668                 return -EAGAIN;
 669         }
 670
 671         /* Allow sending only suspend / resume commands during susepnd flow */
 672         if ((test_bit(wil_status_suspending, wil->status) ||
 673              test_bit(wil_status_suspended, wil->status) ||
 674              test_bit(wil_status_resuming, wil->status)) &&
 675              ((cmdid != WMI_TRAFFIC_SUSPEND_CMDID) &&
 676               (cmdid != WMI_TRAFFIC_RESUME_CMDID))) {
 677                 wil_err(wil, "WMI: reject send_command during suspend\n");
 678                 return -EINVAL;
 679         }
 680
 681         if (!head) {
 682                 wil_err(wil, "WMI head is garbage: 0x%08x\n", r->head);
 683                 return -EINVAL;
 684         }
 685
 686         wil_halp_vote(wil);
 687
 688         /* read Tx head till it is not busy */
 689         for (retry = 5; retry > 0; retry--) {
 690                 wil_memcpy_fromio_32(&d_head, head, sizeof(d_head));
 691                 if (d_head.sync == 0)
 692                         break;
 693                 msleep(20);
 694         }
 695         if (d_head.sync != 0) {
 696                 wil_err(wil, "WMI head busy\n");
 697                 rc = -EBUSY;
 698                 goto out;
 699         }
 700         /* next head */
 701         next_head = r->base + ((r->head - r->base + sizeof(d_head)) % r->size);
 702         wil_dbg_wmi(wil, "Head 0x%08x -> 0x%08x\n", r->head, next_head);
 703         /* wait till FW finish with previous command */
 704         for (retry = 5; retry > 0; retry--) {
 705                 if (!test_bit(wil_status_fwready, wil->status)) {
 706                         wil_err(wil, "WMI: cannot send command while FW not ready\n");
 707                         rc = -EAGAIN;
 708                         goto out;
 709                 }
 710                 r->tail = wil_r(wil, RGF_MBOX +
 711                                 offsetof(struct wil6210_mbox_ctl, tx.tail));
 712                 if (next_head != r->tail)
 713                         break;
 714                 msleep(20);
 715         }
 716         if (next_head == r->tail) {
 717                 wil_err(wil, "WMI ring full\n");
 718                 rc = -EBUSY;
 719                 goto out;
 720         }
 721         dst = wmi_buffer(wil, d_head.addr);
 722         if (!dst) {
 723                 wil_err(wil, "invalid WMI buffer: 0x%08x\n",
 724                         le32_to_cpu(d_head.addr));
 725                 rc = -EAGAIN;
 726                 goto out;
 727         }
 728         cmd.hdr.seq = cpu_to_le16(++wil->wmi_seq);
 729         /* set command */
 730         wil_dbg_wmi(wil, "sending %s (0x%04x) [%d] mid %d\n",
 731                     cmdid2name(cmdid), cmdid, len, mid);
 732         wil_hex_dump_wmi("Cmd ", DUMP_PREFIX_OFFSET, 16, 1, &cmd,
 733                          sizeof(cmd), true);
 734         wil_hex_dump_wmi("cmd ", DUMP_PREFIX_OFFSET, 16, 1, buf,
 735                          len, true);
 736         wil_memcpy_toio_32(dst, &cmd, sizeof(cmd));
 737         wil_memcpy_toio_32(dst + sizeof(cmd), buf, len);
 738         /* mark entry as full */
 739         wil_w(wil, r->head + offsetof(struct wil6210_mbox_ring_desc, sync), 1);
 740         /* advance next ptr */
 741         wil_w(wil, RGF_MBOX + offsetof(struct wil6210_mbox_ctl, tx.head),
 742               r->head = next_head);
 743
 744         trace_wil6210_wmi_cmd(&cmd.wmi, buf, len);
 745
 746         /* interrupt to FW */
 747         wil_w(wil, RGF_USER_USER_ICR + offsetof(struct RGF_ICR, ICS),
 748               SW_INT_MBOX);
 749
 750 out:
 751         wil_halp_unvote(wil);
 752         return rc;
 753 }
 754
 755 int wmi_send(struct wil6210_priv *wil, u16 cmdid, u8 mid, void *buf, u16 len)
 756 {
 757         int rc;
 758
 759         mutex_lock(&wil->wmi_mutex);
 760         rc = __wmi_send(wil, cmdid, mid, buf, len);
 761         mutex_unlock(&wil->wmi_mutex);
 762
 763         return rc;
 764 }
 765
 766 /*=== Event handlers ===*/
 767 static void wmi_evt_ready(struct wil6210_vif *vif, int id, void *d, int len)
 768 {
 769         struct wil6210_priv *wil = vif_to_wil(vif);
 770         struct wiphy *wiphy = wil_to_wiphy(wil);
 771         struct wmi_ready_event *evt = d;
 772         u8 fw_max_assoc_sta;
 773
 774         wil_info(wil, "FW ver. %s(SW %d); MAC %pM; %d MID's\n",
 775                  wil->fw_version, le32_to_cpu(evt->sw_version),
 776                  evt->mac, evt->numof_additional_mids);
 777         if (evt->numof_additional_mids + 1 < wil->max_vifs) {
 778                 wil_err(wil, "FW does not support enough MIDs (need %d)",
 779                         wil->max_vifs - 1);
 780                 return; /* FW load will fail after timeout */
 781         }
 782         /* ignore MAC address, we already have it from the boot loader */
 783         strscpy(wiphy->fw_version, wil->fw_version, sizeof(wiphy->fw_version));
 784
 785         if (len > offsetof(struct wmi_ready_event, rfc_read_calib_result)) {
 786                 wil_dbg_wmi(wil, "rfc calibration result %d\n",
 787                             evt->rfc_read_calib_result);
 788                 wil->fw_calib_result = evt->rfc_read_calib_result;
 789         }
 790
 791         fw_max_assoc_sta = WIL6210_RX_DESC_MAX_CID;
 792         if (len > offsetof(struct wmi_ready_event, max_assoc_sta) &&
 793             evt->max_assoc_sta > 0) {
 794                 fw_max_assoc_sta = evt->max_assoc_sta;
 795                 wil_dbg_wmi(wil, "fw reported max assoc sta %d\n",
 796                             fw_max_assoc_sta);
 797
 798                 if (fw_max_assoc_sta > WIL6210_MAX_CID) {
 799                         wil_dbg_wmi(wil,
 800                                     "fw max assoc sta %d exceeds max driver supported %d\n",
 801                                     fw_max_assoc_sta, WIL6210_MAX_CID);
 802                         fw_max_assoc_sta = WIL6210_MAX_CID;
 803                 }
 804         }
 805
 806         wil->max_assoc_sta = min_t(uint, max_assoc_sta, fw_max_assoc_sta);
 807         wil_dbg_wmi(wil, "setting max assoc sta to %d\n", wil->max_assoc_sta);
 808
 809         wil_set_recovery_state(wil, fw_recovery_idle);
 810         set_bit(wil_status_fwready, wil->status);
 811         /* let the reset sequence continue */
 812         complete(&wil->wmi_ready);
 813 }
 814
 815 static void wmi_evt_rx_mgmt(struct wil6210_vif *vif, int id, void *d, int len)
 816 {
 817         struct wil6210_priv *wil = vif_to_wil(vif);
 818         struct wmi_rx_mgmt_packet_event *data = d;
 819         struct wiphy *wiphy = wil_to_wiphy(wil);
 820         struct ieee80211_mgmt *rx_mgmt_frame =
 821                         (struct ieee80211_mgmt *)data->payload;
 822         int flen = len - offsetof(struct wmi_rx_mgmt_packet_event, payload);
 823         int ch_no;
 824         u32 freq;
 825         struct ieee80211_channel *channel;
 826         s32 signal;
 827         __le16 fc;
 828         u32 d_len;
 829         u16 d_status;
 830
 831         if (flen < 0) {
 832                 wil_err(wil, "MGMT Rx: short event, len %d\n", len);
 833                 return;
 834         }
 835
 836         d_len = le32_to_cpu(data->info.len);
 837         if (d_len != flen) {
 838                 wil_err(wil,
 839                         "MGMT Rx: length mismatch, d_len %d should be %d\n",
 840                         d_len, flen);
 841                 return;
 842         }
 843
 844         ch_no = data->info.channel + 1;
 845         freq = ieee80211_channel_to_frequency(ch_no, NL80211_BAND_60GHZ);
 846         channel = ieee80211_get_channel(wiphy, freq);
 847         if (test_bit(WMI_FW_CAPABILITY_RSSI_REPORTING, wil->fw_capabilities))
 848                 signal = 100 * data->info.rssi;
 849         else
 850                 signal = data->info.sqi;
 851         d_status = le16_to_cpu(data->info.status);
 852         fc = rx_mgmt_frame->frame_control;
 853
 854         wil_dbg_wmi(wil, "MGMT Rx: channel %d MCS %s RSSI %d SQI %d%%\n",
 855                     data->info.channel, WIL_EXTENDED_MCS_CHECK(data->info.mcs),
 856                     data->info.rssi, data->info.sqi);
 857         wil_dbg_wmi(wil, "status 0x%04x len %d fc 0x%04x\n", d_status, d_len,
 858                     le16_to_cpu(fc));
 859         wil_dbg_wmi(wil, "qid %d mid %d cid %d\n",
 860                     data->info.qid, data->info.mid, data->info.cid);
 861         wil_hex_dump_wmi("MGMT Rx ", DUMP_PREFIX_OFFSET, 16, 1, rx_mgmt_frame,
 862                          d_len, true);
 863
 864         if (!channel) {
 865                 wil_err(wil, "Frame on unsupported channel\n");
 866                 return;
 867         }
 868
 869         if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
 870                 struct cfg80211_bss *bss;
 871                 struct cfg80211_inform_bss bss_data = {
 872                         .chan = channel,
 873                         .scan_width = NL80211_BSS_CHAN_WIDTH_20,
 874                         .signal = signal,
 875                         .boottime_ns = ktime_to_ns(ktime_get_boottime()),
 876                 };
 877                 u64 tsf = le64_to_cpu(rx_mgmt_frame->u.beacon.timestamp);
 878                 u16 cap = le16_to_cpu(rx_mgmt_frame->u.beacon.capab_info);
 879                 u16 bi = le16_to_cpu(rx_mgmt_frame->u.beacon.beacon_int);
 880                 const u8 *ie_buf = rx_mgmt_frame->u.beacon.variable;
 881                 size_t ie_len = d_len - offsetof(struct ieee80211_mgmt,
 882                                                  u.beacon.variable);
 883                 wil_dbg_wmi(wil, "Capability info : 0x%04x\n", cap);
 884                 wil_dbg_wmi(wil, "TSF : 0x%016llx\n", tsf);
 885                 wil_dbg_wmi(wil, "Beacon interval : %d\n", bi);
 886                 wil_hex_dump_wmi("IE ", DUMP_PREFIX_OFFSET, 16, 1, ie_buf,
 887                                  ie_len, true);
 888
 889                 wil_dbg_wmi(wil, "Capability info : 0x%04x\n", cap);
 890
 891                 bss = cfg80211_inform_bss_frame_data(wiphy, &bss_data,
 892                                                      rx_mgmt_frame,
 893                                                      d_len, GFP_KERNEL);
 894                 if (bss) {
 895                         wil_dbg_wmi(wil, "Added BSS %pM\n",
 896                                     rx_mgmt_frame->bssid);
 897                         cfg80211_put_bss(wiphy, bss);
 898                 } else {
 899                         wil_err(wil, "cfg80211_inform_bss_frame() failed\n");
 900                 }
 901         } else {
 902                 mutex_lock(&wil->vif_mutex);
 903                 cfg80211_rx_mgmt(vif_to_radio_wdev(wil, vif), freq, signal,
 904                                  (void *)rx_mgmt_frame, d_len, 0);
 905                 mutex_unlock(&wil->vif_mutex);
 906         }
 907 }
 908
 909 static void wmi_evt_tx_mgmt(struct wil6210_vif *vif, int id, void *d, int len)
 910 {
 911         struct wmi_tx_mgmt_packet_event *data = d;
 912         struct ieee80211_mgmt *mgmt_frame =
 913                         (struct ieee80211_mgmt *)data->payload;
 914         int flen = len - offsetof(struct wmi_tx_mgmt_packet_event, payload);
 915
 916         wil_hex_dump_wmi("MGMT Tx ", DUMP_PREFIX_OFFSET, 16, 1, mgmt_frame,
 917                          flen, true);
 918 }
 919
 920 static void wmi_evt_scan_complete(struct wil6210_vif *vif, int id,
 921                                   void *d, int len)
 922 {
 923         struct wil6210_priv *wil = vif_to_wil(vif);
 924
 925         mutex_lock(&wil->vif_mutex);
 926         if (vif->scan_request) {
 927                 struct wmi_scan_complete_event *data = d;
 928                 int status = le32_to_cpu(data->status);
 929                 struct cfg80211_scan_info info = {
 930                         .aborted = ((status != WMI_SCAN_SUCCESS) &&
 931                                 (status != WMI_SCAN_ABORT_REJECTED)),
 932                 };
 933
 934                 wil_dbg_wmi(wil, "SCAN_COMPLETE(0x%08x)\n", status);
 935                 wil_dbg_misc(wil, "Complete scan_request 0x%p aborted %d\n",
 936                              vif->scan_request, info.aborted);
 937                 del_timer_sync(&vif->scan_timer);
 938                 cfg80211_scan_done(vif->scan_request, &info);
 939                 if (vif->mid == 0)
 940                         wil->radio_wdev = wil->main_ndev->ieee80211_ptr;
 941                 vif->scan_request = NULL;
 942                 wake_up_interruptible(&wil->wq);
 943                 if (vif->p2p.pending_listen_wdev) {
 944                         wil_dbg_misc(wil, "Scheduling delayed listen\n");
 945                         schedule_work(&vif->p2p.delayed_listen_work);
 946                 }
 947         } else {
 948                 wil_err(wil, "SCAN_COMPLETE while not scanning\n");
 949         }
 950         mutex_unlock(&wil->vif_mutex);
 951 }
 952
 953 static void wmi_evt_connect(struct wil6210_vif *vif, int id, void *d, int len)
 954 {
 955         struct wil6210_priv *wil = vif_to_wil(vif);
 956         struct net_device *ndev = vif_to_ndev(vif);
 957         struct wireless_dev *wdev = vif_to_wdev(vif);
 958         struct wmi_connect_event *evt = d;
 959         int ch; /* channel number */
 960         struct station_info *sinfo;
 961         u8 *assoc_req_ie, *assoc_resp_ie;
 962         size_t assoc_req_ielen, assoc_resp_ielen;
 963         /* capinfo(u16) + listen_interval(u16) + IEs */
 964         const size_t assoc_req_ie_offset = sizeof(u16) * 2;
 965         /* capinfo(u16) + status_code(u16) + associd(u16) + IEs */
 966         const size_t assoc_resp_ie_offset = sizeof(u16) * 3;
 967         int rc;
 968
 969         if (len < sizeof(*evt)) {
 970                 wil_err(wil, "Connect event too short : %d bytes\n", len);
 971                 return;
 972         }
 973         if (len != sizeof(*evt) + evt->beacon_ie_len + evt->assoc_req_len +
 974                    evt->assoc_resp_len) {
 975                 wil_err(wil,
 976                         "Connect event corrupted : %d != %d + %d + %d + %d\n",
 977                         len, (int)sizeof(*evt), evt->beacon_ie_len,
 978                         evt->assoc_req_len, evt->assoc_resp_len);
 979                 return;
 980         }
 981         if (evt->cid >= wil->max_assoc_sta) {
 982                 wil_err(wil, "Connect CID invalid : %d\n", evt->cid);
 983                 return;
 984         }
 985
 986         ch = evt->channel + 1;
 987         wil_info(wil, "Connect %pM channel [%d] cid %d aid %d\n",
 988                  evt->bssid, ch, evt->cid, evt->aid);
 989         wil_hex_dump_wmi("connect AI : ", DUMP_PREFIX_OFFSET, 16, 1,
 990                          evt->assoc_info, len - sizeof(*evt), true);
 991
 992         /* figure out IE's */
 993         assoc_req_ie = &evt->assoc_info[evt->beacon_ie_len +
 994                                         assoc_req_ie_offset];
 995         assoc_req_ielen = evt->assoc_req_len - assoc_req_ie_offset;
 996         if (evt->assoc_req_len <= assoc_req_ie_offset) {
 997                 assoc_req_ie = NULL;
 998                 assoc_req_ielen = 0;
 999         }
1000
1001         assoc_resp_ie = &evt->assoc_info[evt->beacon_ie_len +
1002                                          evt->assoc_req_len +
1003                                          assoc_resp_ie_offset];
1004         assoc_resp_ielen = evt->assoc_resp_len - assoc_resp_ie_offset;
1005         if (evt->assoc_resp_len <= assoc_resp_ie_offset) {
1006                 assoc_resp_ie = NULL;
1007                 assoc_resp_ielen = 0;
1008         }
1009
1010         if (test_bit(wil_status_resetting, wil->status) ||
1011             !test_bit(wil_status_fwready, wil->status)) {
1012                 wil_err(wil, "status_resetting, cancel connect event, CID %d\n",
1013                         evt->cid);
1014                 /* no need for cleanup, wil_reset will do that */
1015                 return;
1016         }
1017
1018         mutex_lock(&wil->mutex);
1019
1020         if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
1021             (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
1022                 if (!test_bit(wil_vif_fwconnecting, vif->status)) {
1023                         wil_err(wil, "Not in connecting state\n");
1024                         mutex_unlock(&wil->mutex);
1025                         return;
1026                 }
1027                 del_timer_sync(&vif->connect_timer);
1028         } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
1029                    (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
1030                 if (wil->sta[evt->cid].status != wil_sta_unused) {
1031                         wil_err(wil, "AP: Invalid status %d for CID %d\n",
1032                                 wil->sta[evt->cid].status, evt->cid);
1033                         mutex_unlock(&wil->mutex);
1034                         return;
1035                 }
1036         }
1037
1038         ether_addr_copy(wil->sta[evt->cid].addr, evt->bssid);
1039         wil->sta[evt->cid].mid = vif->mid;
1040         wil->sta[evt->cid].status = wil_sta_conn_pending;
1041
1042         rc = wil_ring_init_tx(vif, evt->cid);
1043         if (rc) {
1044                 wil_err(wil, "config tx vring failed for CID %d, rc (%d)\n",
1045                         evt->cid, rc);
1046                 wmi_disconnect_sta(vif, wil->sta[evt->cid].addr,
1047                                    WLAN_REASON_UNSPECIFIED, false);
1048         } else {
1049                 wil_info(wil, "successful connection to CID %d\n", evt->cid);
1050         }
1051
1052         if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
1053             (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
1054                 if (rc) {
1055                         netif_carrier_off(ndev);
1056                         wil6210_bus_request(wil, WIL_DEFAULT_BUS_REQUEST_KBPS);
1057                         wil_err(wil, "cfg80211_connect_result with failure\n");
1058                         cfg80211_connect_result(ndev, evt->bssid, NULL, 0,
1059                                                 NULL, 0,
1060                                                 WLAN_STATUS_UNSPECIFIED_FAILURE,
1061                                                 GFP_KERNEL);
1062                         goto out;
1063                 } else {
1064                         struct wiphy *wiphy = wil_to_wiphy(wil);
1065
1066                         cfg80211_ref_bss(wiphy, vif->bss);
1067                         cfg80211_connect_bss(ndev, evt->bssid, vif->bss,
1068                                              assoc_req_ie, assoc_req_ielen,
1069                                              assoc_resp_ie, assoc_resp_ielen,
1070                                              WLAN_STATUS_SUCCESS, GFP_KERNEL,
1071                                              NL80211_TIMEOUT_UNSPECIFIED);
1072                 }
1073                 vif->bss = NULL;
1074         } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
1075                    (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
1076
1077                 if (rc) {
1078                         if (disable_ap_sme)
1079                                 /* notify new_sta has failed */
1080                                 cfg80211_del_sta(ndev, evt->bssid, GFP_KERNEL);
1081                         goto out;
1082                 }
1083
1084                 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
1085                 if (!sinfo) {
1086                         rc = -ENOMEM;
1087                         goto out;
1088                 }
1089
1090                 sinfo->generation = wil->sinfo_gen++;
1091
1092                 if (assoc_req_ie) {
1093                         sinfo->assoc_req_ies = assoc_req_ie;
1094                         sinfo->assoc_req_ies_len = assoc_req_ielen;
1095                 }
1096
1097                 cfg80211_new_sta(ndev, evt->bssid, sinfo, GFP_KERNEL);
1098
1099                 kfree(sinfo);
1100         } else {
1101                 wil_err(wil, "unhandled iftype %d for CID %d\n", wdev->iftype,
1102                         evt->cid);
1103                 goto out;
1104         }
1105
1106         wil->sta[evt->cid].status = wil_sta_connected;
1107         wil->sta[evt->cid].aid = evt->aid;
1108         if (!test_and_set_bit(wil_vif_fwconnected, vif->status))
1109                 atomic_inc(&wil->connected_vifs);
1110         wil_update_net_queues_bh(wil, vif, NULL, false);
1111
1112 out:
1113         if (rc) {
1114                 wil->sta[evt->cid].status = wil_sta_unused;
1115                 wil->sta[evt->cid].mid = U8_MAX;
1116         }
1117         clear_bit(wil_vif_fwconnecting, vif->status);
1118         mutex_unlock(&wil->mutex);
1119 }
1120
1121 static void wmi_evt_disconnect(struct wil6210_vif *vif, int id,
1122                                void *d, int len)
1123 {
1124         struct wil6210_priv *wil = vif_to_wil(vif);
1125         struct wmi_disconnect_event *evt = d;
1126         u16 reason_code = le16_to_cpu(evt->protocol_reason_status);
1127
1128         wil_info(wil, "Disconnect %pM reason [proto %d wmi %d]\n",
1129                  evt->bssid, reason_code, evt->disconnect_reason);
1130
1131         wil->sinfo_gen++;
1132
1133         if (test_bit(wil_status_resetting, wil->status) ||
1134             !test_bit(wil_status_fwready, wil->status)) {
1135                 wil_err(wil, "status_resetting, cancel disconnect event\n");
1136                 /* no need for cleanup, wil_reset will do that */
1137                 return;
1138         }
1139
1140         mutex_lock(&wil->mutex);
1141         wil6210_disconnect_complete(vif, evt->bssid, reason_code);
1142         if (disable_ap_sme) {
1143                 struct wireless_dev *wdev = vif_to_wdev(vif);
1144                 struct net_device *ndev = vif_to_ndev(vif);
1145
1146                 /* disconnect event in disable_ap_sme mode means link loss */
1147                 switch (wdev->iftype) {
1148                 /* AP-like interface */
1149                 case NL80211_IFTYPE_AP:
1150                 case NL80211_IFTYPE_P2P_GO:
1151                         /* notify hostapd about link loss */
1152                         cfg80211_cqm_pktloss_notify(ndev, evt->bssid, 0,
1153                                                     GFP_KERNEL);
1154                         break;
1155                 default:
1156                         break;
1157                 }
1158         }
1159         mutex_unlock(&wil->mutex);
1160 }
1161
1162 /*
1163  * Firmware reports EAPOL frame using WME event.
1164  * Reconstruct Ethernet frame and deliver it via normal Rx
1165  */
1166 static void wmi_evt_eapol_rx(struct wil6210_vif *vif, int id, void *d, int len)
1167 {
1168         struct wil6210_priv *wil = vif_to_wil(vif);
1169         struct net_device *ndev = vif_to_ndev(vif);
1170         struct wmi_eapol_rx_event *evt = d;
1171         u16 eapol_len = le16_to_cpu(evt->eapol_len);
1172         int sz = eapol_len + ETH_HLEN;
1173         struct sk_buff *skb;
1174         struct ethhdr *eth;
1175         int cid;
1176         struct wil_net_stats *stats = NULL;
1177
1178         wil_dbg_wmi(wil, "EAPOL len %d from %pM MID %d\n", eapol_len,
1179                     evt->src_mac, vif->mid);
1180
1181         cid = wil_find_cid(wil, vif->mid, evt->src_mac);
1182         if (cid >= 0)
1183                 stats = &wil->sta[cid].stats;
1184
1185         if (eapol_len > 196) { /* TODO: revisit size limit */
1186                 wil_err(wil, "EAPOL too large\n");
1187                 return;
1188         }
1189
1190         skb = alloc_skb(sz, GFP_KERNEL);
1191         if (!skb) {
1192                 wil_err(wil, "Failed to allocate skb\n");
1193                 return;
1194         }
1195
1196         eth = skb_put(skb, ETH_HLEN);
1197         ether_addr_copy(eth->h_dest, ndev->dev_addr);
1198         ether_addr_copy(eth->h_source, evt->src_mac);
1199         eth->h_proto = cpu_to_be16(ETH_P_PAE);
1200         skb_put_data(skb, evt->eapol, eapol_len);
1201         skb->protocol = eth_type_trans(skb, ndev);
1202         if (likely(netif_rx(skb) == NET_RX_SUCCESS)) {
1203                 ndev->stats.rx_packets++;
1204                 ndev->stats.rx_bytes += sz;
1205                 if (stats) {
1206                         stats->rx_packets++;
1207                         stats->rx_bytes += sz;
1208                 }
1209         } else {
1210                 ndev->stats.rx_dropped++;
1211                 if (stats)
1212                         stats->rx_dropped++;
1213         }
1214 }
1215
1216 static void wmi_evt_ring_en(struct wil6210_vif *vif, int id, void *d, int len)
1217 {
1218         struct wil6210_priv *wil = vif_to_wil(vif);
1219         struct wmi_ring_en_event *evt = d;
1220         u8 vri = evt->ring_index;
1221         struct wireless_dev *wdev = vif_to_wdev(vif);
1222         struct wil_sta_info *sta;
1223         u8 cid;
1224         struct key_params params;
1225
1226         wil_dbg_wmi(wil, "Enable vring %d MID %d\n", vri, vif->mid);
1227
1228         if (vri >= ARRAY_SIZE(wil->ring_tx)) {
1229                 wil_err(wil, "Enable for invalid vring %d\n", vri);
1230                 return;
1231         }
1232
1233         if (wdev->iftype != NL80211_IFTYPE_AP || !disable_ap_sme ||
1234             test_bit(wil_vif_ft_roam, vif->status))
1235                 /* in AP mode with disable_ap_sme that is not FT,
1236                  * this is done by wil_cfg80211_change_station()
1237                  */
1238                 wil->ring_tx_data[vri].dot1x_open = true;
1239         if (vri == vif->bcast_ring) /* no BA for bcast */
1240                 return;
1241
1242         cid = wil->ring2cid_tid[vri][0];
1243         if (!wil_cid_valid(wil, cid)) {
1244                 wil_err(wil, "invalid cid %d for vring %d\n", cid, vri);
1245                 return;
1246         }
1247
1248         /* In FT mode we get key but not store it as it is received
1249          * before WMI_CONNECT_EVENT received from FW.
1250          * wil_set_crypto_rx is called here to reset the security PN
1251          */
1252         sta = &wil->sta[cid];
1253         if (test_bit(wil_vif_ft_roam, vif->status)) {
1254                 memset(&params, 0, sizeof(params));
1255                 wil_set_crypto_rx(0, WMI_KEY_USE_PAIRWISE, sta, &params);
1256                 if (wdev->iftype != NL80211_IFTYPE_AP)
1257                         clear_bit(wil_vif_ft_roam, vif->status);
1258         }
1259
1260         if (agg_wsize >= 0)
1261                 wil_addba_tx_request(wil, vri, agg_wsize);
1262 }
1263
1264 static void wmi_evt_ba_status(struct wil6210_vif *vif, int id,
1265                               void *d, int len)
1266 {
1267         struct wil6210_priv *wil = vif_to_wil(vif);
1268         struct wmi_ba_status_event *evt = d;
1269         struct wil_ring_tx_data *txdata;
1270
1271         wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d AMSDU%s\n",
1272                     evt->ringid,
1273                     evt->status == WMI_BA_AGREED ? "OK" : "N/A",
1274                     evt->agg_wsize, __le16_to_cpu(evt->ba_timeout),
1275                     evt->amsdu ? "+" : "-");
1276
1277         if (evt->ringid >= WIL6210_MAX_TX_RINGS) {
1278                 wil_err(wil, "invalid ring id %d\n", evt->ringid);
1279                 return;
1280         }
1281
1282         if (evt->status != WMI_BA_AGREED) {
1283                 evt->ba_timeout = 0;
1284                 evt->agg_wsize = 0;
1285                 evt->amsdu = 0;
1286         }
1287
1288         txdata = &wil->ring_tx_data[evt->ringid];
1289
1290         txdata->agg_timeout = le16_to_cpu(evt->ba_timeout);
1291         txdata->agg_wsize = evt->agg_wsize;
1292         txdata->agg_amsdu = evt->amsdu;
1293         txdata->addba_in_progress = false;
1294 }
1295
1296 static void wmi_evt_addba_rx_req(struct wil6210_vif *vif, int id,
1297                                  void *d, int len)
1298 {
1299         struct wil6210_priv *wil = vif_to_wil(vif);
1300         u8 cid, tid;
1301         struct wmi_rcp_addba_req_event *evt = d;
1302
1303         if (evt->cidxtid != CIDXTID_EXTENDED_CID_TID) {
1304                 parse_cidxtid(evt->cidxtid, &cid, &tid);
1305         } else {
1306                 cid = evt->cid;
1307                 tid = evt->tid;
1308         }
1309         wil_addba_rx_request(wil, vif->mid, cid, tid, evt->dialog_token,
1310                              evt->ba_param_set, evt->ba_timeout,
1311                              evt->ba_seq_ctrl);
1312 }
1313
1314 static void wmi_evt_delba(struct wil6210_vif *vif, int id, void *d, int len)
1315 __acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
1316 {
1317         struct wil6210_priv *wil = vif_to_wil(vif);
1318         struct wmi_delba_event *evt = d;
1319         u8 cid, tid;
1320         u16 reason = __le16_to_cpu(evt->reason);
1321         struct wil_sta_info *sta;
1322         struct wil_tid_ampdu_rx *r;
1323
1324         might_sleep();
1325
1326         if (evt->cidxtid != CIDXTID_EXTENDED_CID_TID) {
1327                 parse_cidxtid(evt->cidxtid, &cid, &tid);
1328         } else {
1329                 cid = evt->cid;
1330                 tid = evt->tid;
1331         }
1332
1333         if (!wil_cid_valid(wil, cid)) {
1334                 wil_err(wil, "DELBA: Invalid CID %d\n", cid);
1335                 return;
1336         }
1337
1338         wil_dbg_wmi(wil, "DELBA MID %d CID %d TID %d from %s reason %d\n",
1339                     vif->mid, cid, tid,
1340                     evt->from_initiator ? "originator" : "recipient",
1341                     reason);
1342         if (!evt->from_initiator) {
1343                 int i;
1344                 /* find Tx vring it belongs to */
1345                 for (i = 0; i < ARRAY_SIZE(wil->ring2cid_tid); i++) {
1346                         if (wil->ring2cid_tid[i][0] == cid &&
1347                             wil->ring2cid_tid[i][1] == tid) {
1348                                 struct wil_ring_tx_data *txdata =
1349                                         &wil->ring_tx_data[i];
1350
1351                                 wil_dbg_wmi(wil, "DELBA Tx vring %d\n", i);
1352                                 txdata->agg_timeout = 0;
1353                                 txdata->agg_wsize = 0;
1354                                 txdata->addba_in_progress = false;
1355
1356                                 break; /* max. 1 matching ring */
1357                         }
1358                 }
1359                 if (i >= ARRAY_SIZE(wil->ring2cid_tid))
1360                         wil_err(wil, "DELBA: unable to find Tx vring\n");
1361                 return;
1362         }
1363
1364         sta = &wil->sta[cid];
1365
1366         spin_lock_bh(&sta->tid_rx_lock);
1367
1368         r = sta->tid_rx[tid];
1369         sta->tid_rx[tid] = NULL;
1370         wil_tid_ampdu_rx_free(wil, r);
1371
1372         spin_unlock_bh(&sta->tid_rx_lock);
1373 }
1374
1375 static void
1376 wmi_evt_sched_scan_result(struct wil6210_vif *vif, int id, void *d, int len)
1377 {
1378         struct wil6210_priv *wil = vif_to_wil(vif);
1379         struct wmi_sched_scan_result_event *data = d;
1380         struct wiphy *wiphy = wil_to_wiphy(wil);
1381         struct ieee80211_mgmt *rx_mgmt_frame =
1382                 (struct ieee80211_mgmt *)data->payload;
1383         int flen = len - offsetof(struct wmi_sched_scan_result_event, payload);
1384         int ch_no;
1385         u32 freq;
1386         struct ieee80211_channel *channel;
1387         s32 signal;
1388         __le16 fc;
1389         u32 d_len;
1390         struct cfg80211_bss *bss;
1391         struct cfg80211_inform_bss bss_data = {
1392                 .scan_width = NL80211_BSS_CHAN_WIDTH_20,
1393                 .boottime_ns = ktime_to_ns(ktime_get_boottime()),
1394         };
1395
1396         if (flen < 0) {
1397                 wil_err(wil, "sched scan result event too short, len %d\n",
1398                         len);
1399                 return;
1400         }
1401
1402         d_len = le32_to_cpu(data->info.len);
1403         if (d_len != flen) {
1404                 wil_err(wil,
1405                         "sched scan result length mismatch, d_len %d should be %d\n",
1406                         d_len, flen);
1407                 return;
1408         }
1409
1410         fc = rx_mgmt_frame->frame_control;
1411         if (!ieee80211_is_probe_resp(fc)) {
1412                 wil_err(wil, "sched scan result invalid frame, fc 0x%04x\n",
1413                         fc);
1414                 return;
1415         }
1416
1417         ch_no = data->info.channel + 1;
1418         freq = ieee80211_channel_to_frequency(ch_no, NL80211_BAND_60GHZ);
1419         channel = ieee80211_get_channel(wiphy, freq);
1420         if (test_bit(WMI_FW_CAPABILITY_RSSI_REPORTING, wil->fw_capabilities))
1421                 signal = 100 * data->info.rssi;
1422         else
1423                 signal = data->info.sqi;
1424
1425         wil_dbg_wmi(wil, "sched scan result: channel %d MCS %s RSSI %d\n",
1426                     data->info.channel, WIL_EXTENDED_MCS_CHECK(data->info.mcs),
1427                     data->info.rssi);
1428         wil_dbg_wmi(wil, "len %d qid %d mid %d cid %d\n",
1429                     d_len, data->info.qid, data->info.mid, data->info.cid);
1430         wil_hex_dump_wmi("PROBE ", DUMP_PREFIX_OFFSET, 16, 1, rx_mgmt_frame,
1431                          d_len, true);
1432
1433         if (!channel) {
1434                 wil_err(wil, "Frame on unsupported channel\n");
1435                 return;
1436         }
1437
1438         bss_data.signal = signal;
1439         bss_data.chan = channel;
1440         bss = cfg80211_inform_bss_frame_data(wiphy, &bss_data, rx_mgmt_frame,
1441                                              d_len, GFP_KERNEL);
1442         if (bss) {
1443                 wil_dbg_wmi(wil, "Added BSS %pM\n", rx_mgmt_frame->bssid);
1444                 cfg80211_put_bss(wiphy, bss);
1445         } else {
1446                 wil_err(wil, "cfg80211_inform_bss_frame() failed\n");
1447         }
1448
1449         cfg80211_sched_scan_results(wiphy, 0);
1450 }
1451
1452 static void wil_link_stats_store_basic(struct wil6210_vif *vif,
1453                                        struct wmi_link_stats_basic *basic)
1454 {
1455         struct wil6210_priv *wil = vif_to_wil(vif);
1456         u8 cid = basic->cid;
1457         struct wil_sta_info *sta;
1458
1459         if (cid >= wil->max_assoc_sta) {
1460                 wil_err(wil, "invalid cid %d\n", cid);
1461                 return;
1462         }
1463
1464         sta = &wil->sta[cid];
1465         sta->fw_stats_basic = *basic;
1466 }
1467
1468 static void wil_link_stats_store_global(struct wil6210_vif *vif,
1469                                         struct wmi_link_stats_global *global)
1470 {
1471         struct wil6210_priv *wil = vif_to_wil(vif);
1472
1473         wil->fw_stats_global.stats = *global;
1474 }
1475
1476 static void wmi_link_stats_parse(struct wil6210_vif *vif, u64 tsf,
1477                                  bool has_next, void *payload,
1478                                  size_t payload_size)
1479 {
1480         struct wil6210_priv *wil = vif_to_wil(vif);
1481         size_t hdr_size = sizeof(struct wmi_link_stats_record);
1482         size_t stats_size, record_size, expected_size;
1483         struct wmi_link_stats_record *hdr;
1484
1485         if (payload_size < hdr_size) {
1486                 wil_err(wil, "link stats wrong event size %zu\n", payload_size);
1487                 return;
1488         }
1489
1490         while (payload_size >= hdr_size) {
1491                 hdr = payload;
1492                 stats_size = le16_to_cpu(hdr->record_size);
1493                 record_size = hdr_size + stats_size;
1494
1495                 if (payload_size < record_size) {
1496                         wil_err(wil, "link stats payload ended unexpectedly, size %zu < %zu\n",
1497                                 payload_size, record_size);
1498                         return;
1499                 }
1500
1501                 switch (hdr->record_type_id) {
1502                 case WMI_LINK_STATS_TYPE_BASIC:
1503                         expected_size = sizeof(struct wmi_link_stats_basic);
1504                         if (stats_size < expected_size) {
1505                                 wil_err(wil, "link stats invalid basic record size %zu < %zu\n",
1506                                         stats_size, expected_size);
1507                                 return;
1508                         }
1509                         if (vif->fw_stats_ready) {
1510                                 /* clean old statistics */
1511                                 vif->fw_stats_tsf = 0;
1512                                 vif->fw_stats_ready = false;
1513                         }
1514
1515                         wil_link_stats_store_basic(vif, payload + hdr_size);
1516
1517                         if (!has_next) {
1518                                 vif->fw_stats_tsf = tsf;
1519                                 vif->fw_stats_ready = true;
1520                         }
1521
1522                         break;
1523                 case WMI_LINK_STATS_TYPE_GLOBAL:
1524                         expected_size = sizeof(struct wmi_link_stats_global);
1525                         if (stats_size < sizeof(struct wmi_link_stats_global)) {
1526                                 wil_err(wil, "link stats invalid global record size %zu < %zu\n",
1527                                         stats_size, expected_size);
1528                                 return;
1529                         }
1530
1531                         if (wil->fw_stats_global.ready) {
1532                                 /* clean old statistics */
1533                                 wil->fw_stats_global.tsf = 0;
1534                                 wil->fw_stats_global.ready = false;
1535                         }
1536
1537                         wil_link_stats_store_global(vif, payload + hdr_size);
1538
1539                         if (!has_next) {
1540                                 wil->fw_stats_global.tsf = tsf;
1541                                 wil->fw_stats_global.ready = true;
1542                         }
1543
1544                         break;
1545                 default:
1546                         break;
1547                 }
1548
1549                 /* skip to next record */
1550                 payload += record_size;
1551                 payload_size -= record_size;
1552         }
1553 }
1554
1555 static void
1556 wmi_evt_link_stats(struct wil6210_vif *vif, int id, void *d, int len)
1557 {
1558         struct wil6210_priv *wil = vif_to_wil(vif);
1559         struct wmi_link_stats_event *evt = d;
1560         size_t payload_size;
1561
1562         if (len < offsetof(struct wmi_link_stats_event, payload)) {
1563                 wil_err(wil, "stats event way too short %d\n", len);
1564                 return;
1565         }
1566         payload_size = le16_to_cpu(evt->payload_size);
1567         if (len < sizeof(struct wmi_link_stats_event) + payload_size) {
1568                 wil_err(wil, "stats event too short %d\n", len);
1569                 return;
1570         }
1571
1572         wmi_link_stats_parse(vif, le64_to_cpu(evt->tsf), evt->has_next,
1573                              evt->payload, payload_size);
1574 }
1575
1576 /* find cid and ringid for the station vif
1577  *
1578  * return error, if other interfaces are used or ring was not found
1579  */
1580 static int wil_find_cid_ringid_sta(struct wil6210_priv *wil,
1581                                    struct wil6210_vif *vif,
1582                                    int *cid,
1583                                    int *ringid)
1584 {
1585         struct wil_ring *ring;
1586         struct wil_ring_tx_data *txdata;
1587         int min_ring_id = wil_get_min_tx_ring_id(wil);
1588         int i;
1589         u8 lcid;
1590
1591         if (!(vif->wdev.iftype == NL80211_IFTYPE_STATION ||
1592               vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT)) {
1593                 wil_err(wil, "invalid interface type %d\n", vif->wdev.iftype);
1594                 return -EINVAL;
1595         }
1596
1597         /* In the STA mode, it is expected to have only one ring
1598          * for the AP we are connected to.
1599          * find it and return the cid associated with it.
1600          */
1601         for (i = min_ring_id; i < WIL6210_MAX_TX_RINGS; i++) {
1602                 ring = &wil->ring_tx[i];
1603                 txdata = &wil->ring_tx_data[i];
1604                 if (!ring->va || !txdata->enabled || txdata->mid != vif->mid)
1605                         continue;
1606
1607                 lcid = wil->ring2cid_tid[i][0];
1608                 if (lcid >= wil->max_assoc_sta) /* skip BCAST */
1609                         continue;
1610
1611                 wil_dbg_wmi(wil, "find sta -> ringid %d cid %d\n", i, lcid);
1612                 *cid = lcid;
1613                 *ringid = i;
1614                 return 0;
1615         }
1616
1617         wil_dbg_wmi(wil, "find sta cid while no rings active?\n");
1618
1619         return -ENOENT;
1620 }
1621
1622 static void
1623 wmi_evt_auth_status(struct wil6210_vif *vif, int id, void *d, int len)
1624 {
1625         struct wil6210_priv *wil = vif_to_wil(vif);
1626         struct net_device *ndev = vif_to_ndev(vif);
1627         struct wmi_ft_auth_status_event *data = d;
1628         int ie_len = len - offsetof(struct wmi_ft_auth_status_event, ie_info);
1629         int rc, cid = 0, ringid = 0;
1630         struct cfg80211_ft_event_params ft;
1631         u16 d_len;
1632         /* auth_alg(u16) + auth_transaction(u16) + status_code(u16) */
1633         const size_t auth_ie_offset = sizeof(u16) * 3;
1634         struct auth_no_hdr *auth = (struct auth_no_hdr *)data->ie_info;
1635
1636         /* check the status */
1637         if (ie_len >= 0 && data->status != WMI_FW_STATUS_SUCCESS) {
1638                 wil_err(wil, "FT: auth failed. status %d\n", data->status);
1639                 goto fail;
1640         }
1641
1642         if (ie_len < auth_ie_offset) {
1643                 wil_err(wil, "FT: auth event too short, len %d\n", len);
1644                 goto fail;
1645         }
1646
1647         d_len = le16_to_cpu(data->ie_len);
1648         if (d_len != ie_len) {
1649                 wil_err(wil,
1650                         "FT: auth ie length mismatch, d_len %d should be %d\n",
1651                         d_len, ie_len);
1652                 goto fail;
1653         }
1654
1655         if (!test_bit(wil_vif_ft_roam, wil->status)) {
1656                 wil_err(wil, "FT: Not in roaming state\n");
1657                 goto fail;
1658         }
1659
1660         if (le16_to_cpu(auth->auth_transaction) != 2) {
1661                 wil_err(wil, "FT: auth error. auth_transaction %d\n",
1662                         le16_to_cpu(auth->auth_transaction));
1663                 goto fail;
1664         }
1665
1666         if (le16_to_cpu(auth->auth_alg) != WLAN_AUTH_FT) {
1667                 wil_err(wil, "FT: auth error. auth_alg %d\n",
1668                         le16_to_cpu(auth->auth_alg));
1669                 goto fail;
1670         }
1671
1672         wil_dbg_wmi(wil, "FT: Auth to %pM successfully\n", data->mac_addr);
1673         wil_hex_dump_wmi("FT Auth ies : ", DUMP_PREFIX_OFFSET, 16, 1,
1674                          data->ie_info, d_len, true);
1675
1676         /* find cid and ringid */
1677         rc = wil_find_cid_ringid_sta(wil, vif, &cid, &ringid);
1678         if (rc) {
1679                 wil_err(wil, "No valid cid found\n");
1680                 goto fail;
1681         }
1682
1683         if (vif->privacy) {
1684                 /* For secure assoc, remove old keys */
1685                 rc = wmi_del_cipher_key(vif, 0, wil->sta[cid].addr,
1686                                         WMI_KEY_USE_PAIRWISE);
1687                 if (rc) {
1688                         wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD(PTK) failed\n");
1689                         goto fail;
1690                 }
1691                 rc = wmi_del_cipher_key(vif, 0, wil->sta[cid].addr,
1692                                         WMI_KEY_USE_RX_GROUP);
1693                 if (rc) {
1694                         wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD(GTK) failed\n");
1695                         goto fail;
1696                 }
1697         }
1698
1699         memset(&ft, 0, sizeof(ft));
1700         ft.ies = data->ie_info + auth_ie_offset;
1701         ft.ies_len = d_len - auth_ie_offset;
1702         ft.target_ap = data->mac_addr;
1703         cfg80211_ft_event(ndev, &ft);
1704
1705         return;
1706
1707 fail:
1708         wil6210_disconnect(vif, NULL, WLAN_REASON_PREV_AUTH_NOT_VALID);
1709 }
1710
1711 static void
1712 wmi_evt_reassoc_status(struct wil6210_vif *vif, int id, void *d, int len)
1713 {
1714         struct wil6210_priv *wil = vif_to_wil(vif);
1715         struct net_device *ndev = vif_to_ndev(vif);
1716         struct wiphy *wiphy = wil_to_wiphy(wil);
1717         struct wmi_ft_reassoc_status_event *data = d;
1718         int ies_len = len - offsetof(struct wmi_ft_reassoc_status_event,
1719                                      ie_info);
1720         int rc = -ENOENT, cid = 0, ringid = 0;
1721         int ch; /* channel number (primary) */
1722         size_t assoc_req_ie_len = 0, assoc_resp_ie_len = 0;
1723         u8 *assoc_req_ie = NULL, *assoc_resp_ie = NULL;
1724         /* capinfo(u16) + listen_interval(u16) + current_ap mac addr + IEs */
1725         const size_t assoc_req_ie_offset = sizeof(u16) * 2 + ETH_ALEN;
1726         /* capinfo(u16) + status_code(u16) + associd(u16) + IEs */
1727         const size_t assoc_resp_ie_offset = sizeof(u16) * 3;
1728         u16 d_len;
1729         int freq;
1730         struct cfg80211_roam_info info;
1731
1732         if (ies_len < 0) {
1733                 wil_err(wil, "ft reassoc event too short, len %d\n", len);
1734                 goto fail;
1735         }
1736
1737         wil_dbg_wmi(wil, "Reasoc Status event: status=%d, aid=%d",
1738                     data->status, data->aid);
1739         wil_dbg_wmi(wil, "    mac_addr=%pM, beacon_ie_len=%d",
1740                     data->mac_addr, data->beacon_ie_len);
1741         wil_dbg_wmi(wil, "    reassoc_req_ie_len=%d, reassoc_resp_ie_len=%d",
1742                     le16_to_cpu(data->reassoc_req_ie_len),
1743                     le16_to_cpu(data->reassoc_resp_ie_len));
1744
1745         d_len = le16_to_cpu(data->beacon_ie_len) +
1746                 le16_to_cpu(data->reassoc_req_ie_len) +
1747                 le16_to_cpu(data->reassoc_resp_ie_len);
1748         if (d_len != ies_len) {
1749                 wil_err(wil,
1750                         "ft reassoc ie length mismatch, d_len %d should be %d\n",
1751                         d_len, ies_len);
1752                 goto fail;
1753         }
1754
1755         /* check the status */
1756         if (data->status != WMI_FW_STATUS_SUCCESS) {
1757                 wil_err(wil, "ft reassoc failed. status %d\n", data->status);
1758                 goto fail;
1759         }
1760
1761         /* find cid and ringid */
1762         rc = wil_find_cid_ringid_sta(wil, vif, &cid, &ringid);
1763         if (rc) {
1764                 wil_err(wil, "No valid cid found\n");
1765                 goto fail;
1766         }
1767
1768         ch = data->channel + 1;
1769         wil_info(wil, "FT: Roam %pM channel [%d] cid %d aid %d\n",
1770                  data->mac_addr, ch, cid, data->aid);
1771
1772         wil_hex_dump_wmi("reassoc AI : ", DUMP_PREFIX_OFFSET, 16, 1,
1773                          data->ie_info, len - sizeof(*data), true);
1774
1775         /* figure out IE's */
1776         if (le16_to_cpu(data->reassoc_req_ie_len) > assoc_req_ie_offset) {
1777                 assoc_req_ie = &data->ie_info[assoc_req_ie_offset];
1778                 assoc_req_ie_len = le16_to_cpu(data->reassoc_req_ie_len) -
1779                         assoc_req_ie_offset;
1780         }
1781         if (le16_to_cpu(data->reassoc_resp_ie_len) <= assoc_resp_ie_offset) {
1782                 wil_err(wil, "FT: reassoc resp ie len is too short, len %d\n",
1783                         le16_to_cpu(data->reassoc_resp_ie_len));
1784                 goto fail;
1785         }
1786
1787         assoc_resp_ie = &data->ie_info[le16_to_cpu(data->reassoc_req_ie_len) +
1788                 assoc_resp_ie_offset];
1789         assoc_resp_ie_len = le16_to_cpu(data->reassoc_resp_ie_len) -
1790                 assoc_resp_ie_offset;
1791
1792         if (test_bit(wil_status_resetting, wil->status) ||
1793             !test_bit(wil_status_fwready, wil->status)) {
1794                 wil_err(wil, "FT: status_resetting, cancel reassoc event\n");
1795                 /* no need for cleanup, wil_reset will do that */
1796                 return;
1797         }
1798
1799         mutex_lock(&wil->mutex);
1800
1801         /* ring modify to set the ring for the roamed AP settings */
1802         wil_dbg_wmi(wil,
1803                     "ft modify tx config for connection CID %d ring %d\n",
1804                     cid, ringid);
1805
1806         rc = wil->txrx_ops.tx_ring_modify(vif, ringid, cid, 0);
1807         if (rc) {
1808                 wil_err(wil, "modify TX for CID %d MID %d ring %d failed (%d)\n",
1809                         cid, vif->mid, ringid, rc);
1810                 mutex_unlock(&wil->mutex);
1811                 goto fail;
1812         }
1813
1814         /* Update the driver STA members with the new bss */
1815         wil->sta[cid].aid = data->aid;
1816         wil->sta[cid].stats.ft_roams++;
1817         ether_addr_copy(wil->sta[cid].addr, vif->bss->bssid);
1818         mutex_unlock(&wil->mutex);
1819         del_timer_sync(&vif->connect_timer);
1820
1821         cfg80211_ref_bss(wiphy, vif->bss);
1822         freq = ieee80211_channel_to_frequency(ch, NL80211_BAND_60GHZ);
1823
1824         memset(&info, 0, sizeof(info));
1825         info.links[0].channel = ieee80211_get_channel(wiphy, freq);
1826         info.links[0].bss = vif->bss;
1827         info.req_ie = assoc_req_ie;
1828         info.req_ie_len = assoc_req_ie_len;
1829         info.resp_ie = assoc_resp_ie;
1830         info.resp_ie_len = assoc_resp_ie_len;
1831         cfg80211_roamed(ndev, &info, GFP_KERNEL);
1832         vif->bss = NULL;
1833
1834         return;
1835
1836 fail:
1837         wil6210_disconnect(vif, NULL, WLAN_REASON_PREV_AUTH_NOT_VALID);
1838 }
1839
1840 static void
1841 wmi_evt_link_monitor(struct wil6210_vif *vif, int id, void *d, int len)
1842 {
1843         struct wil6210_priv *wil = vif_to_wil(vif);
1844         struct net_device *ndev = vif_to_ndev(vif);
1845         struct wmi_link_monitor_event *evt = d;
1846         enum nl80211_cqm_rssi_threshold_event event_type;
1847
1848         if (len < sizeof(*evt)) {
1849                 wil_err(wil, "link monitor event too short %d\n", len);
1850                 return;
1851         }
1852
1853         wil_dbg_wmi(wil, "link monitor event, type %d rssi %d (stored %d)\n",
1854                     evt->type, evt->rssi_level, wil->cqm_rssi_thold);
1855
1856         if (evt->type != WMI_LINK_MONITOR_NOTIF_RSSI_THRESHOLD_EVT)
1857                 /* ignore */
1858                 return;
1859
1860         event_type = (evt->rssi_level > wil->cqm_rssi_thold ?
1861                       NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH :
1862                       NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW);
1863         cfg80211_cqm_rssi_notify(ndev, event_type, evt->rssi_level, GFP_KERNEL);
1864 }
1865
1866 /* Some events are ignored for purpose; and need not be interpreted as
1867  * "unhandled events"
1868  */
1869 static void wmi_evt_ignore(struct wil6210_vif *vif, int id, void *d, int len)
1870 {
1871         struct wil6210_priv *wil = vif_to_wil(vif);
1872
1873         wil_dbg_wmi(wil, "Ignore event 0x%04x len %d\n", id, len);
1874 }
1875
1876 static const struct {
1877         int eventid;
1878         void (*handler)(struct wil6210_vif *vif,
1879                         int eventid, void *data, int data_len);
1880 } wmi_evt_handlers[] = {
1881         {WMI_READY_EVENTID,             wmi_evt_ready},
1882         {WMI_FW_READY_EVENTID,                  wmi_evt_ignore},
1883         {WMI_RX_MGMT_PACKET_EVENTID,    wmi_evt_rx_mgmt},
1884         {WMI_TX_MGMT_PACKET_EVENTID,            wmi_evt_tx_mgmt},
1885         {WMI_SCAN_COMPLETE_EVENTID,     wmi_evt_scan_complete},
1886         {WMI_CONNECT_EVENTID,           wmi_evt_connect},
1887         {WMI_DISCONNECT_EVENTID,        wmi_evt_disconnect},
1888         {WMI_EAPOL_RX_EVENTID,          wmi_evt_eapol_rx},
1889         {WMI_BA_STATUS_EVENTID,         wmi_evt_ba_status},
1890         {WMI_RCP_ADDBA_REQ_EVENTID,     wmi_evt_addba_rx_req},
1891         {WMI_DELBA_EVENTID,             wmi_evt_delba},
1892         {WMI_RING_EN_EVENTID,           wmi_evt_ring_en},
1893         {WMI_DATA_PORT_OPEN_EVENTID,            wmi_evt_ignore},
1894         {WMI_SCHED_SCAN_RESULT_EVENTID,         wmi_evt_sched_scan_result},
1895         {WMI_LINK_STATS_EVENTID,                wmi_evt_link_stats},
1896         {WMI_FT_AUTH_STATUS_EVENTID,            wmi_evt_auth_status},
1897         {WMI_FT_REASSOC_STATUS_EVENTID,         wmi_evt_reassoc_status},
1898         {WMI_LINK_MONITOR_EVENTID,              wmi_evt_link_monitor},
1899 };
1900
1901 /*
1902  * Run in IRQ context
1903  * Extract WMI command from mailbox. Queue it to the @wil->pending_wmi_ev
1904  * that will be eventually handled by the @wmi_event_worker in the thread
1905  * context of thread "wil6210_wmi"
1906  */
1907 void wmi_recv_cmd(struct wil6210_priv *wil)
1908 {
1909         struct wil6210_mbox_ring_desc d_tail;
1910         struct wil6210_mbox_hdr hdr;
1911         struct wil6210_mbox_ring *r = &wil->mbox_ctl.rx;
1912         struct pending_wmi_event *evt;
1913         u8 *cmd;
1914         void __iomem *src;
1915         ulong flags;
1916         unsigned n;
1917         unsigned int num_immed_reply = 0;
1918
1919         if (!test_bit(wil_status_mbox_ready, wil->status)) {
1920                 wil_err(wil, "Reset in progress. Cannot handle WMI event\n");
1921                 return;
1922         }
1923
1924         if (test_bit(wil_status_suspended, wil->status)) {
1925                 wil_err(wil, "suspended. cannot handle WMI event\n");
1926                 return;
1927         }
1928
1929         for (n = 0;; n++) {
1930                 u16 len;
1931                 bool q;
1932                 bool immed_reply = false;
1933
1934                 r->head = wil_r(wil, RGF_MBOX +
1935                                 offsetof(struct wil6210_mbox_ctl, rx.head));
1936                 if (r->tail == r->head)
1937                         break;
1938
1939                 wil_dbg_wmi(wil, "Mbox head %08x tail %08x\n",
1940                             r->head, r->tail);
1941                 /* read cmd descriptor from tail */
1942                 wil_memcpy_fromio_32(&d_tail, wil->csr + HOSTADDR(r->tail),
1943                                      sizeof(struct wil6210_mbox_ring_desc));
1944                 if (d_tail.sync == 0) {
1945                         wil_err(wil, "Mbox evt not owned by FW?\n");
1946                         break;
1947                 }
1948
1949                 /* read cmd header from descriptor */
1950                 if (0 != wmi_read_hdr(wil, d_tail.addr, &hdr)) {
1951                         wil_err(wil, "Mbox evt at 0x%08x?\n",
1952                                 le32_to_cpu(d_tail.addr));
1953                         break;
1954                 }
1955                 len = le16_to_cpu(hdr.len);
1956                 wil_dbg_wmi(wil, "Mbox evt %04x %04x %04x %02x\n",
1957                             le16_to_cpu(hdr.seq), len, le16_to_cpu(hdr.type),
1958                             hdr.flags);
1959
1960                 /* read cmd buffer from descriptor */
1961                 src = wmi_buffer(wil, d_tail.addr) +
1962                       sizeof(struct wil6210_mbox_hdr);
1963                 evt = kmalloc(ALIGN(offsetof(struct pending_wmi_event,
1964                                              event.wmi) + len, 4),
1965                               GFP_KERNEL);
1966                 if (!evt)
1967                         break;
1968
1969                 evt->event.hdr = hdr;
1970                 cmd = (void *)&evt->event.wmi;
1971                 wil_memcpy_fromio_32(cmd, src, len);
1972                 /* mark entry as empty */
1973                 wil_w(wil, r->tail +
1974                       offsetof(struct wil6210_mbox_ring_desc, sync), 0);
1975                 /* indicate */
1976                 if ((hdr.type == WIL_MBOX_HDR_TYPE_WMI) &&
1977                     (len >= sizeof(struct wmi_cmd_hdr))) {
1978                         struct wmi_cmd_hdr *wmi = &evt->event.wmi;
1979                         u16 id = le16_to_cpu(wmi->command_id);
1980                         u8 mid = wmi->mid;
1981                         u32 tstamp = le32_to_cpu(wmi->fw_timestamp);
1982                         if (test_bit(wil_status_resuming, wil->status)) {
1983                                 if (id == WMI_TRAFFIC_RESUME_EVENTID)
1984                                         clear_bit(wil_status_resuming,
1985                                                   wil->status);
1986                                 else
1987                                         wil_err(wil,
1988                                                 "WMI evt %d while resuming\n",
1989                                                 id);
1990                         }
1991                         spin_lock_irqsave(&wil->wmi_ev_lock, flags);
1992                         if (wil->reply_id && wil->reply_id == id &&
1993                             wil->reply_mid == mid) {
1994                                 if (wil->reply_buf) {
1995                                         memcpy(wil->reply_buf, wmi,
1996                                                min(len, wil->reply_size));
1997                                         immed_reply = true;
1998                                 }
1999                                 if (id == WMI_TRAFFIC_SUSPEND_EVENTID) {
2000                                         wil_dbg_wmi(wil,
2001                                                     "set suspend_resp_rcvd\n");
2002                                         wil->suspend_resp_rcvd = true;
2003                                 }
2004                         }
2005                         spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
2006
2007                         wil_dbg_wmi(wil, "recv %s (0x%04x) MID %d @%d msec\n",
2008                                     eventid2name(id), id, wmi->mid, tstamp);
2009                         trace_wil6210_wmi_event(wmi, &wmi[1],
2010                                                 len - sizeof(*wmi));
2011                 }
2012                 wil_hex_dump_wmi("evt ", DUMP_PREFIX_OFFSET, 16, 1,
2013                                  &evt->event.hdr, sizeof(hdr) + len, true);
2014
2015                 /* advance tail */
2016                 r->tail = r->base + ((r->tail - r->base +
2017                           sizeof(struct wil6210_mbox_ring_desc)) % r->size);
2018                 wil_w(wil, RGF_MBOX +
2019                       offsetof(struct wil6210_mbox_ctl, rx.tail), r->tail);
2020
2021                 if (immed_reply) {
2022                         wil_dbg_wmi(wil, "recv_cmd: Complete WMI 0x%04x\n",
2023                                     wil->reply_id);
2024                         kfree(evt);
2025                         num_immed_reply++;
2026                         complete(&wil->wmi_call);
2027                 } else {
2028                         /* add to the pending list */
2029                         spin_lock_irqsave(&wil->wmi_ev_lock, flags);
2030                         list_add_tail(&evt->list, &wil->pending_wmi_ev);
2031                         spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
2032                         q = queue_work(wil->wmi_wq, &wil->wmi_event_worker);
2033                         wil_dbg_wmi(wil, "queue_work -> %d\n", q);
2034                 }
2035         }
2036         /* normally, 1 event per IRQ should be processed */
2037         wil_dbg_wmi(wil, "recv_cmd: -> %d events queued, %d completed\n",
2038                     n - num_immed_reply, num_immed_reply);
2039 }
2040
2041 int wmi_call(struct wil6210_priv *wil, u16 cmdid, u8 mid, void *buf, u16 len,
2042              u16 reply_id, void *reply, u16 reply_size, int to_msec)
2043 {
2044         int rc;
2045         unsigned long remain;
2046         ulong flags;
2047
2048         mutex_lock(&wil->wmi_mutex);
2049
2050         spin_lock_irqsave(&wil->wmi_ev_lock, flags);
2051         wil->reply_id = reply_id;
2052         wil->reply_mid = mid;
2053         wil->reply_buf = reply;
2054         wil->reply_size = reply_size;
2055         reinit_completion(&wil->wmi_call);
2056         spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
2057
2058         rc = __wmi_send(wil, cmdid, mid, buf, len);
2059         if (rc)
2060                 goto out;
2061
2062         remain = wait_for_completion_timeout(&wil->wmi_call,
2063                                              msecs_to_jiffies(to_msec));
2064         if (0 == remain) {
2065                 wil_err(wil, "wmi_call(0x%04x->0x%04x) timeout %d msec\n",
2066                         cmdid, reply_id, to_msec);
2067                 rc = -ETIME;
2068         } else {
2069                 wil_dbg_wmi(wil,
2070                             "wmi_call(0x%04x->0x%04x) completed in %d msec\n",
2071                             cmdid, reply_id,
2072                             to_msec - jiffies_to_msecs(remain));
2073         }
2074
2075 out:
2076         spin_lock_irqsave(&wil->wmi_ev_lock, flags);
2077         wil->reply_id = 0;
2078         wil->reply_mid = U8_MAX;
2079         wil->reply_buf = NULL;
2080         wil->reply_size = 0;
2081         spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
2082
2083         mutex_unlock(&wil->wmi_mutex);
2084
2085         return rc;
2086 }
2087
2088 int wmi_echo(struct wil6210_priv *wil)
2089 {
2090         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2091         struct wmi_echo_cmd cmd = {
2092                 .value = cpu_to_le32(0x12345678),
2093         };
2094
2095         return wmi_call(wil, WMI_ECHO_CMDID, vif->mid, &cmd, sizeof(cmd),
2096                         WMI_ECHO_RSP_EVENTID, NULL, 0,
2097                         WIL_WMI_CALL_GENERAL_TO_MS);
2098 }
2099
2100 int wmi_set_mac_address(struct wil6210_priv *wil, const void *addr)
2101 {
2102         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2103         struct wmi_set_mac_address_cmd cmd;
2104
2105         ether_addr_copy(cmd.mac, addr);
2106
2107         wil_dbg_wmi(wil, "Set MAC %pM\n", addr);
2108
2109         return wmi_send(wil, WMI_SET_MAC_ADDRESS_CMDID, vif->mid,
2110                         &cmd, sizeof(cmd));
2111 }
2112
2113 int wmi_led_cfg(struct wil6210_priv *wil, bool enable)
2114 {
2115         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2116         int rc = 0;
2117         struct wmi_led_cfg_cmd cmd = {
2118                 .led_mode = enable,
2119                 .id = led_id,
2120                 .slow_blink_cfg.blink_on =
2121                         cpu_to_le32(led_blink_time[WIL_LED_TIME_SLOW].on_ms),
2122                 .slow_blink_cfg.blink_off =
2123                         cpu_to_le32(led_blink_time[WIL_LED_TIME_SLOW].off_ms),
2124                 .medium_blink_cfg.blink_on =
2125                         cpu_to_le32(led_blink_time[WIL_LED_TIME_MED].on_ms),
2126                 .medium_blink_cfg.blink_off =
2127                         cpu_to_le32(led_blink_time[WIL_LED_TIME_MED].off_ms),
2128                 .fast_blink_cfg.blink_on =
2129                         cpu_to_le32(led_blink_time[WIL_LED_TIME_FAST].on_ms),
2130                 .fast_blink_cfg.blink_off =
2131                         cpu_to_le32(led_blink_time[WIL_LED_TIME_FAST].off_ms),
2132                 .led_polarity = led_polarity,
2133         };
2134         struct {
2135                 struct wmi_cmd_hdr wmi;
2136                 struct wmi_led_cfg_done_event evt;
2137         } __packed reply = {
2138                 .evt = {.status = cpu_to_le32(WMI_FW_STATUS_FAILURE)},
2139         };
2140
2141         if (led_id == WIL_LED_INVALID_ID)
2142                 goto out;
2143
2144         if (led_id > WIL_LED_MAX_ID) {
2145                 wil_err(wil, "Invalid led id %d\n", led_id);
2146                 rc = -EINVAL;
2147                 goto out;
2148         }
2149
2150         wil_dbg_wmi(wil,
2151                     "%s led %d\n",
2152                     enable ? "enabling" : "disabling", led_id);
2153
2154         rc = wmi_call(wil, WMI_LED_CFG_CMDID, vif->mid, &cmd, sizeof(cmd),
2155                       WMI_LED_CFG_DONE_EVENTID, &reply, sizeof(reply),
2156                       WIL_WMI_CALL_GENERAL_TO_MS);
2157         if (rc)
2158                 goto out;
2159
2160         if (reply.evt.status) {
2161                 wil_err(wil, "led %d cfg failed with status %d\n",
2162                         led_id, le32_to_cpu(reply.evt.status));
2163                 rc = -EINVAL;
2164         }
2165
2166 out:
2167         return rc;
2168 }
2169
2170 int wmi_rbufcap_cfg(struct wil6210_priv *wil, bool enable, u16 threshold)
2171 {
2172         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2173         int rc;
2174
2175         struct wmi_rbufcap_cfg_cmd cmd = {
2176                 .enable = enable,
2177                 .rx_desc_threshold = cpu_to_le16(threshold),
2178         };
2179         struct {
2180                 struct wmi_cmd_hdr wmi;
2181                 struct wmi_rbufcap_cfg_event evt;
2182         } __packed reply = {
2183                 .evt = {.status = WMI_FW_STATUS_FAILURE},
2184         };
2185
2186         rc = wmi_call(wil, WMI_RBUFCAP_CFG_CMDID, vif->mid, &cmd, sizeof(cmd),
2187                       WMI_RBUFCAP_CFG_EVENTID, &reply, sizeof(reply),
2188                       WIL_WMI_CALL_GENERAL_TO_MS);
2189         if (rc)
2190                 return rc;
2191
2192         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
2193                 wil_err(wil, "RBUFCAP_CFG failed. status %d\n",
2194                         reply.evt.status);
2195                 rc = -EINVAL;
2196         }
2197
2198         return rc;
2199 }
2200
2201 int wmi_pcp_start(struct wil6210_vif *vif, int bi, u8 wmi_nettype,
2202                   u8 chan, u8 wmi_edmg_chan, u8 hidden_ssid, u8 is_go)
2203 {
2204         struct wil6210_priv *wil = vif_to_wil(vif);
2205         int rc;
2206
2207         struct wmi_pcp_start_cmd cmd = {
2208                 .bcon_interval = cpu_to_le16(bi),
2209                 .network_type = wmi_nettype,
2210                 .disable_sec_offload = 1,
2211                 .channel = chan - 1,
2212                 .edmg_channel = wmi_edmg_chan,
2213                 .pcp_max_assoc_sta = wil->max_assoc_sta,
2214                 .hidden_ssid = hidden_ssid,
2215                 .is_go = is_go,
2216                 .ap_sme_offload_mode = disable_ap_sme ?
2217                                        WMI_AP_SME_OFFLOAD_PARTIAL :
2218                                        WMI_AP_SME_OFFLOAD_FULL,
2219                 .abft_len = wil->abft_len,
2220         };
2221         struct {
2222                 struct wmi_cmd_hdr wmi;
2223                 struct wmi_pcp_started_event evt;
2224         } __packed reply = {
2225                 .evt = {.status = WMI_FW_STATUS_FAILURE},
2226         };
2227
2228         if (!vif->privacy)
2229                 cmd.disable_sec = 1;
2230
2231         if ((cmd.pcp_max_assoc_sta > WIL6210_MAX_CID) ||
2232             (cmd.pcp_max_assoc_sta <= 0)) {
2233                 wil_err(wil, "unexpected max_assoc_sta %d\n",
2234                         cmd.pcp_max_assoc_sta);
2235                 return -EOPNOTSUPP;
2236         }
2237
2238         if (disable_ap_sme &&
2239             !test_bit(WMI_FW_CAPABILITY_AP_SME_OFFLOAD_PARTIAL,
2240                       wil->fw_capabilities)) {
2241                 wil_err(wil, "disable_ap_sme not supported by FW\n");
2242                 return -EOPNOTSUPP;
2243         }
2244
2245         /*
2246          * Processing time may be huge, in case of secure AP it takes about
2247          * 3500ms for FW to start AP
2248          */
2249         rc = wmi_call(wil, WMI_PCP_START_CMDID, vif->mid, &cmd, sizeof(cmd),
2250                       WMI_PCP_STARTED_EVENTID, &reply, sizeof(reply), 5000);
2251         if (rc)
2252                 return rc;
2253
2254         if (reply.evt.status != WMI_FW_STATUS_SUCCESS)
2255                 rc = -EINVAL;
2256
2257         if (wmi_nettype != WMI_NETTYPE_P2P)
2258                 /* Don't fail due to error in the led configuration */
2259                 wmi_led_cfg(wil, true);
2260
2261         return rc;
2262 }
2263
2264 int wmi_pcp_stop(struct wil6210_vif *vif)
2265 {
2266         struct wil6210_priv *wil = vif_to_wil(vif);
2267         int rc;
2268
2269         rc = wmi_led_cfg(wil, false);
2270         if (rc)
2271                 return rc;
2272
2273         return wmi_call(wil, WMI_PCP_STOP_CMDID, vif->mid, NULL, 0,
2274                         WMI_PCP_STOPPED_EVENTID, NULL, 0,
2275                         WIL_WMI_PCP_STOP_TO_MS);
2276 }
2277
2278 int wmi_set_ssid(struct wil6210_vif *vif, u8 ssid_len, const void *ssid)
2279 {
2280         struct wil6210_priv *wil = vif_to_wil(vif);
2281         struct wmi_set_ssid_cmd cmd = {
2282                 .ssid_len = cpu_to_le32(ssid_len),
2283         };
2284
2285         if (ssid_len > sizeof(cmd.ssid))
2286                 return -EINVAL;
2287
2288         memcpy(cmd.ssid, ssid, ssid_len);
2289
2290         return wmi_send(wil, WMI_SET_SSID_CMDID, vif->mid, &cmd, sizeof(cmd));
2291 }
2292
2293 int wmi_get_ssid(struct wil6210_vif *vif, u8 *ssid_len, void *ssid)
2294 {
2295         struct wil6210_priv *wil = vif_to_wil(vif);
2296         int rc;
2297         struct {
2298                 struct wmi_cmd_hdr wmi;
2299                 struct wmi_set_ssid_cmd cmd;
2300         } __packed reply;
2301         int len; /* reply.cmd.ssid_len in CPU order */
2302
2303         memset(&reply, 0, sizeof(reply));
2304
2305         rc = wmi_call(wil, WMI_GET_SSID_CMDID, vif->mid, NULL, 0,
2306                       WMI_GET_SSID_EVENTID, &reply, sizeof(reply),
2307                       WIL_WMI_CALL_GENERAL_TO_MS);
2308         if (rc)
2309                 return rc;
2310
2311         len = le32_to_cpu(reply.cmd.ssid_len);
2312         if (len > sizeof(reply.cmd.ssid))
2313                 return -EINVAL;
2314
2315         *ssid_len = len;
2316         memcpy(ssid, reply.cmd.ssid, len);
2317
2318         return 0;
2319 }
2320
2321 int wmi_set_channel(struct wil6210_priv *wil, int channel)
2322 {
2323         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2324         struct wmi_set_pcp_channel_cmd cmd = {
2325                 .channel = channel - 1,
2326         };
2327
2328         return wmi_send(wil, WMI_SET_PCP_CHANNEL_CMDID, vif->mid,
2329                         &cmd, sizeof(cmd));
2330 }
2331
2332 int wmi_get_channel(struct wil6210_priv *wil, int *channel)
2333 {
2334         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2335         int rc;
2336         struct {
2337                 struct wmi_cmd_hdr wmi;
2338                 struct wmi_set_pcp_channel_cmd cmd;
2339         } __packed reply;
2340
2341         memset(&reply, 0, sizeof(reply));
2342
2343         rc = wmi_call(wil, WMI_GET_PCP_CHANNEL_CMDID, vif->mid, NULL, 0,
2344                       WMI_GET_PCP_CHANNEL_EVENTID, &reply, sizeof(reply),
2345                       WIL_WMI_CALL_GENERAL_TO_MS);
2346         if (rc)
2347                 return rc;
2348
2349         if (reply.cmd.channel > 3)
2350                 return -EINVAL;
2351
2352         *channel = reply.cmd.channel + 1;
2353
2354         return 0;
2355 }
2356
2357 int wmi_p2p_cfg(struct wil6210_vif *vif, int channel, int bi)
2358 {
2359         struct wil6210_priv *wil = vif_to_wil(vif);
2360         int rc;
2361         struct wmi_p2p_cfg_cmd cmd = {
2362                 .discovery_mode = WMI_DISCOVERY_MODE_PEER2PEER,
2363                 .bcon_interval = cpu_to_le16(bi),
2364                 .channel = channel - 1,
2365         };
2366         struct {
2367                 struct wmi_cmd_hdr wmi;
2368                 struct wmi_p2p_cfg_done_event evt;
2369         } __packed reply = {
2370                 .evt = {.status = WMI_FW_STATUS_FAILURE},
2371         };
2372
2373         wil_dbg_wmi(wil, "sending WMI_P2P_CFG_CMDID\n");
2374
2375         rc = wmi_call(wil, WMI_P2P_CFG_CMDID, vif->mid, &cmd, sizeof(cmd),
2376                       WMI_P2P_CFG_DONE_EVENTID, &reply, sizeof(reply), 300);
2377         if (!rc && reply.evt.status != WMI_FW_STATUS_SUCCESS) {
2378                 wil_err(wil, "P2P_CFG failed. status %d\n", reply.evt.status);
2379                 rc = -EINVAL;
2380         }
2381
2382         return rc;
2383 }
2384
2385 int wmi_start_listen(struct wil6210_vif *vif)
2386 {
2387         struct wil6210_priv *wil = vif_to_wil(vif);
2388         int rc;
2389         struct {
2390                 struct wmi_cmd_hdr wmi;
2391                 struct wmi_listen_started_event evt;
2392         } __packed reply = {
2393                 .evt = {.status = WMI_FW_STATUS_FAILURE},
2394         };
2395
2396         wil_dbg_wmi(wil, "sending WMI_START_LISTEN_CMDID\n");
2397
2398         rc = wmi_call(wil, WMI_START_LISTEN_CMDID, vif->mid, NULL, 0,
2399                       WMI_LISTEN_STARTED_EVENTID, &reply, sizeof(reply), 300);
2400         if (!rc && reply.evt.status != WMI_FW_STATUS_SUCCESS) {
2401                 wil_err(wil, "device failed to start listen. status %d\n",
2402                         reply.evt.status);
2403                 rc = -EINVAL;
2404         }
2405
2406         return rc;
2407 }
2408
2409 int wmi_start_search(struct wil6210_vif *vif)
2410 {
2411         struct wil6210_priv *wil = vif_to_wil(vif);
2412         int rc;
2413         struct {
2414                 struct wmi_cmd_hdr wmi;
2415                 struct wmi_search_started_event evt;
2416         } __packed reply = {
2417                 .evt = {.status = WMI_FW_STATUS_FAILURE},
2418         };
2419
2420         wil_dbg_wmi(wil, "sending WMI_START_SEARCH_CMDID\n");
2421
2422         rc = wmi_call(wil, WMI_START_SEARCH_CMDID, vif->mid, NULL, 0,
2423                       WMI_SEARCH_STARTED_EVENTID, &reply, sizeof(reply), 300);
2424         if (!rc && reply.evt.status != WMI_FW_STATUS_SUCCESS) {
2425                 wil_err(wil, "device failed to start search. status %d\n",
2426                         reply.evt.status);
2427                 rc = -EINVAL;
2428         }
2429
2430         return rc;
2431 }
2432
2433 int wmi_stop_discovery(struct wil6210_vif *vif)
2434 {
2435         struct wil6210_priv *wil = vif_to_wil(vif);
2436         int rc;
2437
2438         wil_dbg_wmi(wil, "sending WMI_DISCOVERY_STOP_CMDID\n");
2439
2440         rc = wmi_call(wil, WMI_DISCOVERY_STOP_CMDID, vif->mid, NULL, 0,
2441                       WMI_DISCOVERY_STOPPED_EVENTID, NULL, 0,
2442                       WIL_WMI_CALL_GENERAL_TO_MS);
2443
2444         if (rc)
2445                 wil_err(wil, "Failed to stop discovery\n");
2446
2447         return rc;
2448 }
2449
2450 int wmi_del_cipher_key(struct wil6210_vif *vif, u8 key_index,
2451                        const void *mac_addr, int key_usage)
2452 {
2453         struct wil6210_priv *wil = vif_to_wil(vif);
2454         struct wmi_delete_cipher_key_cmd cmd = {
2455                 .key_index = key_index,
2456         };
2457
2458         if (mac_addr)
2459                 memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
2460
2461         return wmi_send(wil, WMI_DELETE_CIPHER_KEY_CMDID, vif->mid,
2462                         &cmd, sizeof(cmd));
2463 }
2464
2465 int wmi_add_cipher_key(struct wil6210_vif *vif, u8 key_index,
2466                        const void *mac_addr, int key_len, const void *key,
2467                        int key_usage)
2468 {
2469         struct wil6210_priv *wil = vif_to_wil(vif);
2470         struct wmi_add_cipher_key_cmd cmd = {
2471                 .key_index = key_index,
2472                 .key_usage = key_usage,
2473                 .key_len = key_len,
2474         };
2475
2476         if (key_len > sizeof(cmd.key))
2477                 return -EINVAL;
2478
2479         /* key len = 0 is allowed only for usage of WMI_KEY_USE_APPLY */
2480         if ((key_len == 0 || !key) &&
2481             key_usage != WMI_KEY_USE_APPLY_PTK)
2482                 return -EINVAL;
2483
2484         if (key)
2485                 memcpy(cmd.key, key, key_len);
2486
2487         if (mac_addr)
2488                 memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
2489
2490         return wmi_send(wil, WMI_ADD_CIPHER_KEY_CMDID, vif->mid,
2491                         &cmd, sizeof(cmd));
2492 }
2493
2494 int wmi_set_ie(struct wil6210_vif *vif, u8 type, u16 ie_len, const void *ie)
2495 {
2496         struct wil6210_priv *wil = vif_to_wil(vif);
2497         static const char *const names[] = {
2498                 [WMI_FRAME_BEACON]      = "BEACON",
2499                 [WMI_FRAME_PROBE_REQ]   = "PROBE_REQ",
2500                 [WMI_FRAME_PROBE_RESP]  = "WMI_FRAME_PROBE_RESP",
2501                 [WMI_FRAME_ASSOC_REQ]   = "WMI_FRAME_ASSOC_REQ",
2502                 [WMI_FRAME_ASSOC_RESP]  = "WMI_FRAME_ASSOC_RESP",
2503         };
2504         int rc;
2505         u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len;
2506         struct wmi_set_appie_cmd *cmd;
2507
2508         if (len < ie_len) {
2509                 rc = -EINVAL;
2510                 goto out;
2511         }
2512
2513         cmd = kzalloc(len, GFP_KERNEL);
2514         if (!cmd) {
2515                 rc = -ENOMEM;
2516                 goto out;
2517         }
2518         if (!ie)
2519                 ie_len = 0;
2520
2521         cmd->mgmt_frm_type = type;
2522         /* BUG: FW API define ieLen as u8. Will fix FW */
2523         cmd->ie_len = cpu_to_le16(ie_len);
2524         if (ie_len)
2525                 memcpy(cmd->ie_info, ie, ie_len);
2526         rc = wmi_send(wil, WMI_SET_APPIE_CMDID, vif->mid, cmd, len);
2527         kfree(cmd);
2528 out:
2529         if (rc) {
2530                 const char *name = type < ARRAY_SIZE(names) ?
2531                                    names[type] : "??";
2532                 wil_err(wil, "set_ie(%d %s) failed : %d\n", type, name, rc);
2533         }
2534
2535         return rc;
2536 }
2537
2538 int wmi_update_ft_ies(struct wil6210_vif *vif, u16 ie_len, const void *ie)
2539 {
2540         struct wil6210_priv *wil = vif_to_wil(vif);
2541         u16 len;
2542         struct wmi_update_ft_ies_cmd *cmd;
2543         int rc;
2544
2545         if (!ie)
2546                 ie_len = 0;
2547
2548         len = sizeof(struct wmi_update_ft_ies_cmd) + ie_len;
2549         if (len < ie_len) {
2550                 wil_err(wil, "wraparound. ie len %d\n", ie_len);
2551                 return -EINVAL;
2552         }
2553
2554         cmd = kzalloc(len, GFP_KERNEL);
2555         if (!cmd) {
2556                 rc = -ENOMEM;
2557                 goto out;
2558         }
2559
2560         cmd->ie_len = cpu_to_le16(ie_len);
2561         if (ie_len)
2562                 memcpy(cmd->ie_info, ie, ie_len);
2563         rc = wmi_send(wil, WMI_UPDATE_FT_IES_CMDID, vif->mid, cmd, len);
2564         kfree(cmd);
2565
2566 out:
2567         if (rc)
2568                 wil_err(wil, "update ft ies failed : %d\n", rc);
2569
2570         return rc;
2571 }
2572
2573 /**
2574  * wmi_rxon - turn radio on/off
2575  * @wil:        driver data
2576  * @on:         turn on if true, off otherwise
2577  *
2578  * Only switch radio. Channel should be set separately.
2579  * No timeout for rxon - radio turned on forever unless some other call
2580  * turns it off
2581  */
2582 int wmi_rxon(struct wil6210_priv *wil, bool on)
2583 {
2584         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2585         int rc;
2586         struct {
2587                 struct wmi_cmd_hdr wmi;
2588                 struct wmi_listen_started_event evt;
2589         } __packed reply = {
2590                 .evt = {.status = WMI_FW_STATUS_FAILURE},
2591         };
2592
2593         wil_info(wil, "(%s)\n", on ? "on" : "off");
2594
2595         if (on) {
2596                 rc = wmi_call(wil, WMI_START_LISTEN_CMDID, vif->mid, NULL, 0,
2597                               WMI_LISTEN_STARTED_EVENTID,
2598                               &reply, sizeof(reply),
2599                               WIL_WMI_CALL_GENERAL_TO_MS);
2600                 if ((rc == 0) && (reply.evt.status != WMI_FW_STATUS_SUCCESS))
2601                         rc = -EINVAL;
2602         } else {
2603                 rc = wmi_call(wil, WMI_DISCOVERY_STOP_CMDID, vif->mid, NULL, 0,
2604                               WMI_DISCOVERY_STOPPED_EVENTID, NULL, 0,
2605                               WIL_WMI_CALL_GENERAL_TO_MS);
2606         }
2607
2608         return rc;
2609 }
2610
2611 int wmi_rx_chain_add(struct wil6210_priv *wil, struct wil_ring *vring)
2612 {
2613         struct net_device *ndev = wil->main_ndev;
2614         struct wireless_dev *wdev = ndev->ieee80211_ptr;
2615         struct wil6210_vif *vif = ndev_to_vif(ndev);
2616         struct wmi_cfg_rx_chain_cmd cmd = {
2617                 .action = WMI_RX_CHAIN_ADD,
2618                 .rx_sw_ring = {
2619                         .max_mpdu_size = cpu_to_le16(
2620                                 wil_mtu2macbuf(wil->rx_buf_len)),
2621                         .ring_mem_base = cpu_to_le64(vring->pa),
2622                         .ring_size = cpu_to_le16(vring->size),
2623                 },
2624                 .mid = 0, /* TODO - what is it? */
2625                 .decap_trans_type = WMI_DECAP_TYPE_802_3,
2626                 .reorder_type = WMI_RX_SW_REORDER,
2627                 .host_thrsh = cpu_to_le16(rx_ring_overflow_thrsh),
2628         };
2629         struct {
2630                 struct wmi_cmd_hdr wmi;
2631                 struct wmi_cfg_rx_chain_done_event evt;
2632         } __packed evt;
2633         int rc;
2634
2635         memset(&evt, 0, sizeof(evt));
2636
2637         if (wdev->iftype == NL80211_IFTYPE_MONITOR) {
2638                 struct ieee80211_channel *ch = wil->monitor_chandef.chan;
2639
2640                 cmd.sniffer_cfg.mode = cpu_to_le32(WMI_SNIFFER_ON);
2641                 if (ch)
2642                         cmd.sniffer_cfg.channel = ch->hw_value - 1;
2643                 cmd.sniffer_cfg.phy_info_mode =
2644                         cpu_to_le32(WMI_SNIFFER_PHY_INFO_DISABLED);
2645                 cmd.sniffer_cfg.phy_support =
2646                         cpu_to_le32((wil->monitor_flags & MONITOR_FLAG_CONTROL)
2647                                     ? WMI_SNIFFER_CP : WMI_SNIFFER_BOTH_PHYS);
2648         } else {
2649                 /* Initialize offload (in non-sniffer mode).
2650                  * Linux IP stack always calculates IP checksum
2651                  * HW always calculate TCP/UDP checksum
2652                  */
2653                 cmd.l3_l4_ctrl |= (1 << L3_L4_CTRL_TCPIP_CHECKSUM_EN_POS);
2654         }
2655
2656         if (rx_align_2)
2657                 cmd.l2_802_3_offload_ctrl |=
2658                                 L2_802_3_OFFLOAD_CTRL_SNAP_KEEP_MSK;
2659
2660         /* typical time for secure PCP is 840ms */
2661         rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, vif->mid, &cmd, sizeof(cmd),
2662                       WMI_CFG_RX_CHAIN_DONE_EVENTID, &evt, sizeof(evt), 2000);
2663         if (rc)
2664                 return rc;
2665
2666         if (le32_to_cpu(evt.evt.status) != WMI_CFG_RX_CHAIN_SUCCESS)
2667                 rc = -EINVAL;
2668
2669         vring->hwtail = le32_to_cpu(evt.evt.rx_ring_tail_ptr);
2670
2671         wil_dbg_misc(wil, "Rx init: status %d tail 0x%08x\n",
2672                      le32_to_cpu(evt.evt.status), vring->hwtail);
2673
2674         return rc;
2675 }
2676
2677 int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_bb, u32 *t_rf)
2678 {
2679         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2680         int rc;
2681         struct wmi_temp_sense_cmd cmd = {
2682                 .measure_baseband_en = cpu_to_le32(!!t_bb),
2683                 .measure_rf_en = cpu_to_le32(!!t_rf),
2684                 .measure_mode = cpu_to_le32(TEMPERATURE_MEASURE_NOW),
2685         };
2686         struct {
2687                 struct wmi_cmd_hdr wmi;
2688                 struct wmi_temp_sense_done_event evt;
2689         } __packed reply;
2690
2691         memset(&reply, 0, sizeof(reply));
2692
2693         rc = wmi_call(wil, WMI_TEMP_SENSE_CMDID, vif->mid, &cmd, sizeof(cmd),
2694                       WMI_TEMP_SENSE_DONE_EVENTID, &reply, sizeof(reply),
2695                       WIL_WMI_CALL_GENERAL_TO_MS);
2696         if (rc)
2697                 return rc;
2698
2699         if (t_bb)
2700                 *t_bb = le32_to_cpu(reply.evt.baseband_t1000);
2701         if (t_rf)
2702                 *t_rf = le32_to_cpu(reply.evt.rf_t1000);
2703
2704         return 0;
2705 }
2706
2707 int wmi_get_all_temperatures(struct wil6210_priv *wil,
2708                              struct wmi_temp_sense_all_done_event
2709                              *sense_all_evt)
2710 {
2711         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2712         int rc;
2713         struct wmi_temp_sense_all_cmd cmd = {
2714                 .measure_baseband_en = true,
2715                 .measure_rf_en = true,
2716                 .measure_mode = TEMPERATURE_MEASURE_NOW,
2717         };
2718         struct {
2719                 struct wmi_cmd_hdr wmi;
2720                 struct wmi_temp_sense_all_done_event evt;
2721         } __packed reply;
2722
2723         if (!sense_all_evt) {
2724                 wil_err(wil, "Invalid sense_all_evt value\n");
2725                 return -EINVAL;
2726         }
2727
2728         memset(&reply, 0, sizeof(reply));
2729         reply.evt.status = WMI_FW_STATUS_FAILURE;
2730         rc = wmi_call(wil, WMI_TEMP_SENSE_ALL_CMDID, vif->mid, &cmd,
2731                       sizeof(cmd), WMI_TEMP_SENSE_ALL_DONE_EVENTID,
2732                       &reply, sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
2733         if (rc)
2734                 return rc;
2735
2736         if (reply.evt.status == WMI_FW_STATUS_FAILURE) {
2737                 wil_err(wil, "Failed getting TEMP_SENSE_ALL\n");
2738                 return -EINVAL;
2739         }
2740
2741         memcpy(sense_all_evt, &reply.evt, sizeof(reply.evt));
2742         return 0;
2743 }
2744
2745 int wmi_disconnect_sta(struct wil6210_vif *vif, const u8 *mac, u16 reason,
2746                        bool del_sta)
2747 {
2748         struct wil6210_priv *wil = vif_to_wil(vif);
2749         int rc;
2750         struct wmi_disconnect_sta_cmd disc_sta_cmd = {
2751                 .disconnect_reason = cpu_to_le16(reason),
2752         };
2753         struct wmi_del_sta_cmd del_sta_cmd = {
2754                 .disconnect_reason = cpu_to_le16(reason),
2755         };
2756         struct {
2757                 struct wmi_cmd_hdr wmi;
2758                 struct wmi_disconnect_event evt;
2759         } __packed reply;
2760
2761         wil_dbg_wmi(wil, "disconnect_sta: (%pM, reason %d)\n", mac, reason);
2762
2763         memset(&reply, 0, sizeof(reply));
2764         vif->locally_generated_disc = true;
2765         if (del_sta) {
2766                 ether_addr_copy(del_sta_cmd.dst_mac, mac);
2767                 rc = wmi_call(wil, WMI_DEL_STA_CMDID, vif->mid, &del_sta_cmd,
2768                               sizeof(del_sta_cmd), WMI_DISCONNECT_EVENTID,
2769                               &reply, sizeof(reply), 1000);
2770         } else {
2771                 ether_addr_copy(disc_sta_cmd.dst_mac, mac);
2772                 rc = wmi_call(wil, WMI_DISCONNECT_STA_CMDID, vif->mid,
2773                               &disc_sta_cmd, sizeof(disc_sta_cmd),
2774                               WMI_DISCONNECT_EVENTID,
2775                               &reply, sizeof(reply), 1000);
2776         }
2777         /* failure to disconnect in reasonable time treated as FW error */
2778         if (rc) {
2779                 wil_fw_error_recovery(wil);
2780                 return rc;
2781         }
2782         wil->sinfo_gen++;
2783
2784         return 0;
2785 }
2786
2787 int wmi_addba(struct wil6210_priv *wil, u8 mid,
2788               u8 ringid, u8 size, u16 timeout)
2789 {
2790         u8 amsdu = wil->use_enhanced_dma_hw && wil->use_rx_hw_reordering &&
2791                 test_bit(WMI_FW_CAPABILITY_AMSDU, wil->fw_capabilities) &&
2792                 wil->amsdu_en;
2793         struct wmi_ring_ba_en_cmd cmd = {
2794                 .ring_id = ringid,
2795                 .agg_max_wsize = size,
2796                 .ba_timeout = cpu_to_le16(timeout),
2797                 .amsdu = amsdu,
2798         };
2799
2800         wil_dbg_wmi(wil, "addba: (ring %d size %d timeout %d amsdu %d)\n",
2801                     ringid, size, timeout, amsdu);
2802
2803         return wmi_send(wil, WMI_RING_BA_EN_CMDID, mid, &cmd, sizeof(cmd));
2804 }
2805
2806 int wmi_delba_tx(struct wil6210_priv *wil, u8 mid, u8 ringid, u16 reason)
2807 {
2808         struct wmi_ring_ba_dis_cmd cmd = {
2809                 .ring_id = ringid,
2810                 .reason = cpu_to_le16(reason),
2811         };
2812
2813         wil_dbg_wmi(wil, "delba_tx: (ring %d reason %d)\n", ringid, reason);
2814
2815         return wmi_send(wil, WMI_RING_BA_DIS_CMDID, mid, &cmd, sizeof(cmd));
2816 }
2817
2818 int wmi_delba_rx(struct wil6210_priv *wil, u8 mid, u8 cid, u8 tid, u16 reason)
2819 {
2820         struct wmi_rcp_delba_cmd cmd = {
2821                 .reason = cpu_to_le16(reason),
2822         };
2823
2824         if (cid >= WIL6210_RX_DESC_MAX_CID) {
2825                 cmd.cidxtid = CIDXTID_EXTENDED_CID_TID;
2826                 cmd.cid = cid;
2827                 cmd.tid = tid;
2828         } else {
2829                 cmd.cidxtid = mk_cidxtid(cid, tid);
2830         }
2831
2832         wil_dbg_wmi(wil, "delba_rx: (CID %d TID %d reason %d)\n", cid,
2833                     tid, reason);
2834
2835         return wmi_send(wil, WMI_RCP_DELBA_CMDID, mid, &cmd, sizeof(cmd));
2836 }
2837
2838 int wmi_addba_rx_resp(struct wil6210_priv *wil,
2839                       u8 mid, u8 cid, u8 tid, u8 token,
2840                       u16 status, bool amsdu, u16 agg_wsize, u16 timeout)
2841 {
2842         int rc;
2843         struct wmi_rcp_addba_resp_cmd cmd = {
2844                 .dialog_token = token,
2845                 .status_code = cpu_to_le16(status),
2846                 /* bit 0: A-MSDU supported
2847                  * bit 1: policy (controlled by FW)
2848                  * bits 2..5: TID
2849                  * bits 6..15: buffer size
2850                  */
2851                 .ba_param_set = cpu_to_le16((amsdu ? 1 : 0) | (tid << 2) |
2852                                             (agg_wsize << 6)),
2853                 .ba_timeout = cpu_to_le16(timeout),
2854         };
2855         struct {
2856                 struct wmi_cmd_hdr wmi;
2857                 struct wmi_rcp_addba_resp_sent_event evt;
2858         } __packed reply = {
2859                 .evt = {.status = cpu_to_le16(WMI_FW_STATUS_FAILURE)},
2860         };
2861
2862         if (cid >= WIL6210_RX_DESC_MAX_CID) {
2863                 cmd.cidxtid = CIDXTID_EXTENDED_CID_TID;
2864                 cmd.cid = cid;
2865                 cmd.tid = tid;
2866         } else {
2867                 cmd.cidxtid = mk_cidxtid(cid, tid);
2868         }
2869
2870         wil_dbg_wmi(wil,
2871                     "ADDBA response for MID %d CID %d TID %d size %d timeout %d status %d AMSDU%s\n",
2872                     mid, cid, tid, agg_wsize,
2873                     timeout, status, amsdu ? "+" : "-");
2874
2875         rc = wmi_call(wil, WMI_RCP_ADDBA_RESP_CMDID, mid, &cmd, sizeof(cmd),
2876                       WMI_RCP_ADDBA_RESP_SENT_EVENTID, &reply, sizeof(reply),
2877                       WIL_WMI_CALL_GENERAL_TO_MS);
2878         if (rc)
2879                 return rc;
2880
2881         if (reply.evt.status) {
2882                 wil_err(wil, "ADDBA response failed with status %d\n",
2883                         le16_to_cpu(reply.evt.status));
2884                 rc = -EINVAL;
2885         }
2886
2887         return rc;
2888 }
2889
2890 int wmi_addba_rx_resp_edma(struct wil6210_priv *wil, u8 mid, u8 cid, u8 tid,
2891                            u8 token, u16 status, bool amsdu, u16 agg_wsize,
2892                            u16 timeout)
2893 {
2894         int rc;
2895         struct wmi_rcp_addba_resp_edma_cmd cmd = {
2896                 .cid = cid,
2897                 .tid = tid,
2898                 .dialog_token = token,
2899                 .status_code = cpu_to_le16(status),
2900                 /* bit 0: A-MSDU supported
2901                  * bit 1: policy (controlled by FW)
2902                  * bits 2..5: TID
2903                  * bits 6..15: buffer size
2904                  */
2905                 .ba_param_set = cpu_to_le16((amsdu ? 1 : 0) | (tid << 2) |
2906                                             (agg_wsize << 6)),
2907                 .ba_timeout = cpu_to_le16(timeout),
2908                 /* route all the connections to status ring 0 */
2909                 .status_ring_id = WIL_DEFAULT_RX_STATUS_RING_ID,
2910         };
2911         struct {
2912                 struct wmi_cmd_hdr wmi;
2913                 struct wmi_rcp_addba_resp_sent_event evt;
2914         } __packed reply = {
2915                 .evt = {.status = cpu_to_le16(WMI_FW_STATUS_FAILURE)},
2916         };
2917
2918         wil_dbg_wmi(wil,
2919                     "ADDBA response for CID %d TID %d size %d timeout %d status %d AMSDU%s, sring_id %d\n",
2920                     cid, tid, agg_wsize, timeout, status, amsdu ? "+" : "-",
2921                     WIL_DEFAULT_RX_STATUS_RING_ID);
2922
2923         rc = wmi_call(wil, WMI_RCP_ADDBA_RESP_EDMA_CMDID, mid, &cmd,
2924                       sizeof(cmd), WMI_RCP_ADDBA_RESP_SENT_EVENTID, &reply,
2925                       sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
2926         if (rc)
2927                 return rc;
2928
2929         if (reply.evt.status) {
2930                 wil_err(wil, "ADDBA response failed with status %d\n",
2931                         le16_to_cpu(reply.evt.status));
2932                 rc = -EINVAL;
2933         }
2934
2935         return rc;
2936 }
2937
2938 int wmi_ps_dev_profile_cfg(struct wil6210_priv *wil,
2939                            enum wmi_ps_profile_type ps_profile)
2940 {
2941         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2942         int rc;
2943         struct wmi_ps_dev_profile_cfg_cmd cmd = {
2944                 .ps_profile = ps_profile,
2945         };
2946         struct {
2947                 struct wmi_cmd_hdr wmi;
2948                 struct wmi_ps_dev_profile_cfg_event evt;
2949         } __packed reply = {
2950                 .evt = {.status = cpu_to_le32(WMI_PS_CFG_CMD_STATUS_ERROR)},
2951         };
2952         u32 status;
2953
2954         wil_dbg_wmi(wil, "Setting ps dev profile %d\n", ps_profile);
2955
2956         rc = wmi_call(wil, WMI_PS_DEV_PROFILE_CFG_CMDID, vif->mid,
2957                       &cmd, sizeof(cmd),
2958                       WMI_PS_DEV_PROFILE_CFG_EVENTID, &reply, sizeof(reply),
2959                       WIL_WMI_CALL_GENERAL_TO_MS);
2960         if (rc)
2961                 return rc;
2962
2963         status = le32_to_cpu(reply.evt.status);
2964
2965         if (status != WMI_PS_CFG_CMD_STATUS_SUCCESS) {
2966                 wil_err(wil, "ps dev profile cfg failed with status %d\n",
2967                         status);
2968                 rc = -EINVAL;
2969         }
2970
2971         return rc;
2972 }
2973
2974 int wmi_set_mgmt_retry(struct wil6210_priv *wil, u8 retry_short)
2975 {
2976         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
2977         int rc;
2978         struct wmi_set_mgmt_retry_limit_cmd cmd = {
2979                 .mgmt_retry_limit = retry_short,
2980         };
2981         struct {
2982                 struct wmi_cmd_hdr wmi;
2983                 struct wmi_set_mgmt_retry_limit_event evt;
2984         } __packed reply = {
2985                 .evt = {.status = WMI_FW_STATUS_FAILURE},
2986         };
2987
2988         wil_dbg_wmi(wil, "Setting mgmt retry short %d\n", retry_short);
2989
2990         if (!test_bit(WMI_FW_CAPABILITY_MGMT_RETRY_LIMIT, wil->fw_capabilities))
2991                 return -ENOTSUPP;
2992
2993         rc = wmi_call(wil, WMI_SET_MGMT_RETRY_LIMIT_CMDID, vif->mid,
2994                       &cmd, sizeof(cmd),
2995                       WMI_SET_MGMT_RETRY_LIMIT_EVENTID, &reply, sizeof(reply),
2996                       WIL_WMI_CALL_GENERAL_TO_MS);
2997         if (rc)
2998                 return rc;
2999
3000         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3001                 wil_err(wil, "set mgmt retry limit failed with status %d\n",
3002                         reply.evt.status);
3003                 rc = -EINVAL;
3004         }
3005
3006         return rc;
3007 }
3008
3009 int wmi_get_mgmt_retry(struct wil6210_priv *wil, u8 *retry_short)
3010 {
3011         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
3012         int rc;
3013         struct {
3014                 struct wmi_cmd_hdr wmi;
3015                 struct wmi_get_mgmt_retry_limit_event evt;
3016         } __packed reply;
3017
3018         wil_dbg_wmi(wil, "getting mgmt retry short\n");
3019
3020         if (!test_bit(WMI_FW_CAPABILITY_MGMT_RETRY_LIMIT, wil->fw_capabilities))
3021                 return -ENOTSUPP;
3022
3023         memset(&reply, 0, sizeof(reply));
3024         rc = wmi_call(wil, WMI_GET_MGMT_RETRY_LIMIT_CMDID, vif->mid, NULL, 0,
3025                       WMI_GET_MGMT_RETRY_LIMIT_EVENTID, &reply, sizeof(reply),
3026                       WIL_WMI_CALL_GENERAL_TO_MS);
3027         if (rc)
3028                 return rc;
3029
3030         if (retry_short)
3031                 *retry_short = reply.evt.mgmt_retry_limit;
3032
3033         return 0;
3034 }
3035
3036 int wmi_abort_scan(struct wil6210_vif *vif)
3037 {
3038         struct wil6210_priv *wil = vif_to_wil(vif);
3039         int rc;
3040
3041         wil_dbg_wmi(wil, "sending WMI_ABORT_SCAN_CMDID\n");
3042
3043         rc = wmi_send(wil, WMI_ABORT_SCAN_CMDID, vif->mid, NULL, 0);
3044         if (rc)
3045                 wil_err(wil, "Failed to abort scan (%d)\n", rc);
3046
3047         return rc;
3048 }
3049
3050 int wmi_new_sta(struct wil6210_vif *vif, const u8 *mac, u8 aid)
3051 {
3052         struct wil6210_priv *wil = vif_to_wil(vif);
3053         int rc;
3054         struct wmi_new_sta_cmd cmd = {
3055                 .aid = aid,
3056         };
3057
3058         wil_dbg_wmi(wil, "new sta %pM, aid %d\n", mac, aid);
3059
3060         ether_addr_copy(cmd.dst_mac, mac);
3061
3062         rc = wmi_send(wil, WMI_NEW_STA_CMDID, vif->mid, &cmd, sizeof(cmd));
3063         if (rc)
3064                 wil_err(wil, "Failed to send new sta (%d)\n", rc);
3065
3066         return rc;
3067 }
3068
3069 void wmi_event_flush(struct wil6210_priv *wil)
3070 {
3071         ulong flags;
3072         struct pending_wmi_event *evt, *t;
3073
3074         wil_dbg_wmi(wil, "event_flush\n");
3075
3076         spin_lock_irqsave(&wil->wmi_ev_lock, flags);
3077
3078         list_for_each_entry_safe(evt, t, &wil->pending_wmi_ev, list) {
3079                 list_del(&evt->list);
3080                 kfree(evt);
3081         }
3082
3083         spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
3084 }
3085
3086 static const char *suspend_status2name(u8 status)
3087 {
3088         switch (status) {
3089         case WMI_TRAFFIC_SUSPEND_REJECTED_LINK_NOT_IDLE:
3090                 return "LINK_NOT_IDLE";
3091         case WMI_TRAFFIC_SUSPEND_REJECTED_DISCONNECT:
3092                 return "DISCONNECT";
3093         case WMI_TRAFFIC_SUSPEND_REJECTED_OTHER:
3094                 return "OTHER";
3095         default:
3096                 return "Untracked status";
3097         }
3098 }
3099
3100 int wmi_suspend(struct wil6210_priv *wil)
3101 {
3102         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
3103         int rc;
3104         struct wmi_traffic_suspend_cmd cmd = {
3105                 .wakeup_trigger = wil->wakeup_trigger,
3106         };
3107         struct {
3108                 struct wmi_cmd_hdr wmi;
3109                 struct wmi_traffic_suspend_event evt;
3110         } __packed reply = {
3111                 .evt = {.status = WMI_TRAFFIC_SUSPEND_REJECTED_LINK_NOT_IDLE},
3112         };
3113
3114         u32 suspend_to = WIL_WAIT_FOR_SUSPEND_RESUME_COMP;
3115
3116         wil->suspend_resp_rcvd = false;
3117         wil->suspend_resp_comp = false;
3118
3119         rc = wmi_call(wil, WMI_TRAFFIC_SUSPEND_CMDID, vif->mid,
3120                       &cmd, sizeof(cmd),
3121                       WMI_TRAFFIC_SUSPEND_EVENTID, &reply, sizeof(reply),
3122                       suspend_to);
3123         if (rc) {
3124                 wil_err(wil, "wmi_call for suspend req failed, rc=%d\n", rc);
3125                 if (rc == -ETIME)
3126                         /* wmi_call TO */
3127                         wil->suspend_stats.rejected_by_device++;
3128                 else
3129                         wil->suspend_stats.rejected_by_host++;
3130                 goto out;
3131         }
3132
3133         wil_dbg_wmi(wil, "waiting for suspend_response_completed\n");
3134
3135         rc = wait_event_interruptible_timeout(wil->wq,
3136                                               wil->suspend_resp_comp,
3137                                               msecs_to_jiffies(suspend_to));
3138         if (rc == 0) {
3139                 wil_err(wil, "TO waiting for suspend_response_completed\n");
3140                 if (wil->suspend_resp_rcvd)
3141                         /* Device responded but we TO due to another reason */
3142                         wil->suspend_stats.rejected_by_host++;
3143                 else
3144                         wil->suspend_stats.rejected_by_device++;
3145                 rc = -EBUSY;
3146                 goto out;
3147         }
3148
3149         wil_dbg_wmi(wil, "suspend_response_completed rcvd\n");
3150         if (reply.evt.status != WMI_TRAFFIC_SUSPEND_APPROVED) {
3151                 wil_dbg_pm(wil, "device rejected the suspend, %s\n",
3152                            suspend_status2name(reply.evt.status));
3153                 wil->suspend_stats.rejected_by_device++;
3154         }
3155         rc = reply.evt.status;
3156
3157 out:
3158         wil->suspend_resp_rcvd = false;
3159         wil->suspend_resp_comp = false;
3160
3161         return rc;
3162 }
3163
3164 static void resume_triggers2string(u32 triggers, char *string, int str_size)
3165 {
3166         string[0] = '\0';
3167
3168         if (!triggers) {
3169                 strlcat(string, " UNKNOWN", str_size);
3170                 return;
3171         }
3172
3173         if (triggers & WMI_RESUME_TRIGGER_HOST)
3174                 strlcat(string, " HOST", str_size);
3175
3176         if (triggers & WMI_RESUME_TRIGGER_UCAST_RX)
3177                 strlcat(string, " UCAST_RX", str_size);
3178
3179         if (triggers & WMI_RESUME_TRIGGER_BCAST_RX)
3180                 strlcat(string, " BCAST_RX", str_size);
3181
3182         if (triggers & WMI_RESUME_TRIGGER_WMI_EVT)
3183                 strlcat(string, " WMI_EVT", str_size);
3184
3185         if (triggers & WMI_RESUME_TRIGGER_DISCONNECT)
3186                 strlcat(string, " DISCONNECT", str_size);
3187 }
3188
3189 int wmi_resume(struct wil6210_priv *wil)
3190 {
3191         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
3192         int rc;
3193         char string[100];
3194         struct {
3195                 struct wmi_cmd_hdr wmi;
3196                 struct wmi_traffic_resume_event evt;
3197         } __packed reply = {
3198                 .evt = {.status = WMI_TRAFFIC_RESUME_FAILED,
3199                         .resume_triggers =
3200                                 cpu_to_le32(WMI_RESUME_TRIGGER_UNKNOWN)},
3201         };
3202
3203         rc = wmi_call(wil, WMI_TRAFFIC_RESUME_CMDID, vif->mid, NULL, 0,
3204                       WMI_TRAFFIC_RESUME_EVENTID, &reply, sizeof(reply),
3205                       WIL_WAIT_FOR_SUSPEND_RESUME_COMP);
3206         if (rc)
3207                 return rc;
3208         resume_triggers2string(le32_to_cpu(reply.evt.resume_triggers), string,
3209                                sizeof(string));
3210         wil_dbg_pm(wil, "device resume %s, resume triggers:%s (0x%x)\n",
3211                    reply.evt.status ? "failed" : "passed", string,
3212                    le32_to_cpu(reply.evt.resume_triggers));
3213
3214         return reply.evt.status;
3215 }
3216
3217 int wmi_port_allocate(struct wil6210_priv *wil, u8 mid,
3218                       const u8 *mac, enum nl80211_iftype iftype)
3219 {
3220         int rc;
3221         struct wmi_port_allocate_cmd cmd = {
3222                 .mid = mid,
3223         };
3224         struct {
3225                 struct wmi_cmd_hdr wmi;
3226                 struct wmi_port_allocated_event evt;
3227         } __packed reply = {
3228                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3229         };
3230
3231         wil_dbg_misc(wil, "port allocate, mid %d iftype %d, mac %pM\n",
3232                      mid, iftype, mac);
3233
3234         ether_addr_copy(cmd.mac, mac);
3235         switch (iftype) {
3236         case NL80211_IFTYPE_STATION:
3237                 cmd.port_role = WMI_PORT_STA;
3238                 break;
3239         case NL80211_IFTYPE_AP:
3240                 cmd.port_role = WMI_PORT_AP;
3241                 break;
3242         case NL80211_IFTYPE_P2P_CLIENT:
3243                 cmd.port_role = WMI_PORT_P2P_CLIENT;
3244                 break;
3245         case NL80211_IFTYPE_P2P_GO:
3246                 cmd.port_role = WMI_PORT_P2P_GO;
3247                 break;
3248         /* what about monitor??? */
3249         default:
3250                 wil_err(wil, "unsupported iftype: %d\n", iftype);
3251                 return -EINVAL;
3252         }
3253
3254         rc = wmi_call(wil, WMI_PORT_ALLOCATE_CMDID, mid,
3255                       &cmd, sizeof(cmd),
3256                       WMI_PORT_ALLOCATED_EVENTID, &reply,
3257                       sizeof(reply), 300);
3258         if (rc) {
3259                 wil_err(wil, "failed to allocate port, status %d\n", rc);
3260                 return rc;
3261         }
3262         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3263                 wil_err(wil, "WMI_PORT_ALLOCATE returned status %d\n",
3264                         reply.evt.status);
3265                 return -EINVAL;
3266         }
3267
3268         return 0;
3269 }
3270
3271 int wmi_port_delete(struct wil6210_priv *wil, u8 mid)
3272 {
3273         int rc;
3274         struct wmi_port_delete_cmd cmd = {
3275                 .mid = mid,
3276         };
3277         struct {
3278                 struct wmi_cmd_hdr wmi;
3279                 struct wmi_port_deleted_event evt;
3280         } __packed reply = {
3281                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3282         };
3283
3284         wil_dbg_misc(wil, "port delete, mid %d\n", mid);
3285
3286         rc = wmi_call(wil, WMI_PORT_DELETE_CMDID, mid,
3287                       &cmd, sizeof(cmd),
3288                       WMI_PORT_DELETED_EVENTID, &reply,
3289                       sizeof(reply), 2000);
3290         if (rc) {
3291                 wil_err(wil, "failed to delete port, status %d\n", rc);
3292                 return rc;
3293         }
3294         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3295                 wil_err(wil, "WMI_PORT_DELETE returned status %d\n",
3296                         reply.evt.status);
3297                 return -EINVAL;
3298         }
3299
3300         return 0;
3301 }
3302
3303 static bool wmi_evt_call_handler(struct wil6210_vif *vif, int id,
3304                                  void *d, int len)
3305 {
3306         uint i;
3307
3308         for (i = 0; i < ARRAY_SIZE(wmi_evt_handlers); i++) {
3309                 if (wmi_evt_handlers[i].eventid == id) {
3310                         wmi_evt_handlers[i].handler(vif, id, d, len);
3311                         return true;
3312                 }
3313         }
3314
3315         return false;
3316 }
3317
3318 static void wmi_event_handle(struct wil6210_priv *wil,
3319                              struct wil6210_mbox_hdr *hdr)
3320 {
3321         u16 len = le16_to_cpu(hdr->len);
3322         struct wil6210_vif *vif;
3323
3324         if ((hdr->type == WIL_MBOX_HDR_TYPE_WMI) &&
3325             (len >= sizeof(struct wmi_cmd_hdr))) {
3326                 struct wmi_cmd_hdr *wmi = (void *)(&hdr[1]);
3327                 void *evt_data = (void *)(&wmi[1]);
3328                 u16 id = le16_to_cpu(wmi->command_id);
3329                 u8 mid = wmi->mid;
3330
3331                 wil_dbg_wmi(wil, "Handle %s (0x%04x) (reply_id 0x%04x,%d)\n",
3332                             eventid2name(id), id, wil->reply_id,
3333                             wil->reply_mid);
3334
3335                 if (mid == MID_BROADCAST)
3336                         mid = 0;
3337                 if (mid >= GET_MAX_VIFS(wil)) {
3338                         wil_dbg_wmi(wil, "invalid mid %d, event skipped\n",
3339                                     mid);
3340                         return;
3341                 }
3342                 vif = wil->vifs[mid];
3343                 if (!vif) {
3344                         wil_dbg_wmi(wil, "event for empty VIF(%d), skipped\n",
3345                                     mid);
3346                         return;
3347                 }
3348
3349                 /* check if someone waits for this event */
3350                 if (wil->reply_id && wil->reply_id == id &&
3351                     wil->reply_mid == mid) {
3352                         if (wil->reply_buf) {
3353                                 /* event received while wmi_call is waiting
3354                                  * with a buffer. Such event should be handled
3355                                  * in wmi_recv_cmd function. Handling the event
3356                                  * here means a previous wmi_call was timeout.
3357                                  * Drop the event and do not handle it.
3358                                  */
3359                                 wil_err(wil,
3360                                         "Old event (%d, %s) while wmi_call is waiting. Drop it and Continue waiting\n",
3361                                         id, eventid2name(id));
3362                                 return;
3363                         }
3364
3365                         wmi_evt_call_handler(vif, id, evt_data,
3366                                              len - sizeof(*wmi));
3367                         wil_dbg_wmi(wil, "event_handle: Complete WMI 0x%04x\n",
3368                                     id);
3369                         complete(&wil->wmi_call);
3370                         return;
3371                 }
3372                 /* unsolicited event */
3373                 /* search for handler */
3374                 if (!wmi_evt_call_handler(vif, id, evt_data,
3375                                           len - sizeof(*wmi))) {
3376                         wil_info(wil, "Unhandled event 0x%04x\n", id);
3377                 }
3378         } else {
3379                 wil_err(wil, "Unknown event type\n");
3380                 print_hex_dump(KERN_ERR, "evt?? ", DUMP_PREFIX_OFFSET, 16, 1,
3381                                hdr, sizeof(*hdr) + len, true);
3382         }
3383 }
3384
3385 /*
3386  * Retrieve next WMI event from the pending list
3387  */
3388 static struct list_head *next_wmi_ev(struct wil6210_priv *wil)
3389 {
3390         ulong flags;
3391         struct list_head *ret = NULL;
3392
3393         spin_lock_irqsave(&wil->wmi_ev_lock, flags);
3394
3395         if (!list_empty(&wil->pending_wmi_ev)) {
3396                 ret = wil->pending_wmi_ev.next;
3397                 list_del(ret);
3398         }
3399
3400         spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
3401
3402         return ret;
3403 }
3404
3405 /*
3406  * Handler for the WMI events
3407  */
3408 void wmi_event_worker(struct work_struct *work)
3409 {
3410         struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
3411                                                  wmi_event_worker);
3412         struct pending_wmi_event *evt;
3413         struct list_head *lh;
3414
3415         wil_dbg_wmi(wil, "event_worker: Start\n");
3416         while ((lh = next_wmi_ev(wil)) != NULL) {
3417                 evt = list_entry(lh, struct pending_wmi_event, list);
3418                 wmi_event_handle(wil, &evt->event.hdr);
3419                 kfree(evt);
3420         }
3421         wil_dbg_wmi(wil, "event_worker: Finished\n");
3422 }
3423
3424 bool wil_is_wmi_idle(struct wil6210_priv *wil)
3425 {
3426         ulong flags;
3427         struct wil6210_mbox_ring *r = &wil->mbox_ctl.rx;
3428         bool rc = false;
3429
3430         spin_lock_irqsave(&wil->wmi_ev_lock, flags);
3431
3432         /* Check if there are pending WMI events in the events queue */
3433         if (!list_empty(&wil->pending_wmi_ev)) {
3434                 wil_dbg_pm(wil, "Pending WMI events in queue\n");
3435                 goto out;
3436         }
3437
3438         /* Check if there is a pending WMI call */
3439         if (wil->reply_id) {
3440                 wil_dbg_pm(wil, "Pending WMI call\n");
3441                 goto out;
3442         }
3443
3444         /* Check if there are pending RX events in mbox */
3445         r->head = wil_r(wil, RGF_MBOX +
3446                         offsetof(struct wil6210_mbox_ctl, rx.head));
3447         if (r->tail != r->head)
3448                 wil_dbg_pm(wil, "Pending WMI mbox events\n");
3449         else
3450                 rc = true;
3451
3452 out:
3453         spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
3454         return rc;
3455 }
3456
3457 static void
3458 wmi_sched_scan_set_ssids(struct wil6210_priv *wil,
3459                          struct wmi_start_sched_scan_cmd *cmd,
3460                          struct cfg80211_ssid *ssids, int n_ssids,
3461                          struct cfg80211_match_set *match_sets,
3462                          int n_match_sets)
3463 {
3464         int i;
3465
3466         if (n_match_sets > WMI_MAX_PNO_SSID_NUM) {
3467                 wil_dbg_wmi(wil, "too many match sets (%d), use first %d\n",
3468                             n_match_sets, WMI_MAX_PNO_SSID_NUM);
3469                 n_match_sets = WMI_MAX_PNO_SSID_NUM;
3470         }
3471         cmd->num_of_ssids = n_match_sets;
3472
3473         for (i = 0; i < n_match_sets; i++) {
3474                 struct wmi_sched_scan_ssid_match *wmi_match =
3475                         &cmd->ssid_for_match[i];
3476                 struct cfg80211_match_set *cfg_match = &match_sets[i];
3477                 int j;
3478
3479                 wmi_match->ssid_len = cfg_match->ssid.ssid_len;
3480                 memcpy(wmi_match->ssid, cfg_match->ssid.ssid,
3481                        min_t(u8, wmi_match->ssid_len, WMI_MAX_SSID_LEN));
3482                 wmi_match->rssi_threshold = S8_MIN;
3483                 if (cfg_match->rssi_thold >= S8_MIN &&
3484                     cfg_match->rssi_thold <= S8_MAX)
3485                         wmi_match->rssi_threshold = cfg_match->rssi_thold;
3486
3487                 for (j = 0; j < n_ssids; j++)
3488                         if (wmi_match->ssid_len == ssids[j].ssid_len &&
3489                             memcmp(wmi_match->ssid, ssids[j].ssid,
3490                                    wmi_match->ssid_len) == 0)
3491                                 wmi_match->add_ssid_to_probe = true;
3492         }
3493 }
3494
3495 static void
3496 wmi_sched_scan_set_channels(struct wil6210_priv *wil,
3497                             struct wmi_start_sched_scan_cmd *cmd,
3498                             u32 n_channels,
3499                             struct ieee80211_channel **channels)
3500 {
3501         int i;
3502
3503         if (n_channels > WMI_MAX_CHANNEL_NUM) {
3504                 wil_dbg_wmi(wil, "too many channels (%d), use first %d\n",
3505                             n_channels, WMI_MAX_CHANNEL_NUM);
3506                 n_channels = WMI_MAX_CHANNEL_NUM;
3507         }
3508         cmd->num_of_channels = n_channels;
3509
3510         for (i = 0; i < n_channels; i++) {
3511                 struct ieee80211_channel *cfg_chan = channels[i];
3512
3513                 cmd->channel_list[i] = cfg_chan->hw_value - 1;
3514         }
3515 }
3516
3517 static void
3518 wmi_sched_scan_set_plans(struct wil6210_priv *wil,
3519                          struct wmi_start_sched_scan_cmd *cmd,
3520                          struct cfg80211_sched_scan_plan *scan_plans,
3521                          int n_scan_plans)
3522 {
3523         int i;
3524
3525         if (n_scan_plans > WMI_MAX_PLANS_NUM) {
3526                 wil_dbg_wmi(wil, "too many plans (%d), use first %d\n",
3527                             n_scan_plans, WMI_MAX_PLANS_NUM);
3528                 n_scan_plans = WMI_MAX_PLANS_NUM;
3529         }
3530
3531         for (i = 0; i < n_scan_plans; i++) {
3532                 struct cfg80211_sched_scan_plan *cfg_plan = &scan_plans[i];
3533
3534                 cmd->scan_plans[i].interval_sec =
3535                         cpu_to_le16(cfg_plan->interval);
3536                 cmd->scan_plans[i].num_of_iterations =
3537                         cpu_to_le16(cfg_plan->iterations);
3538         }
3539 }
3540
3541 int wmi_start_sched_scan(struct wil6210_priv *wil,
3542                          struct cfg80211_sched_scan_request *request)
3543 {
3544         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
3545         int rc;
3546         struct wmi_start_sched_scan_cmd cmd = {
3547                 .min_rssi_threshold = S8_MIN,
3548                 .initial_delay_sec = cpu_to_le16(request->delay),
3549         };
3550         struct {
3551                 struct wmi_cmd_hdr wmi;
3552                 struct wmi_start_sched_scan_event evt;
3553         } __packed reply = {
3554                 .evt = {.result = WMI_PNO_REJECT},
3555         };
3556
3557         if (!test_bit(WMI_FW_CAPABILITY_PNO, wil->fw_capabilities))
3558                 return -ENOTSUPP;
3559
3560         if (request->min_rssi_thold >= S8_MIN &&
3561             request->min_rssi_thold <= S8_MAX)
3562                 cmd.min_rssi_threshold = request->min_rssi_thold;
3563
3564         wmi_sched_scan_set_ssids(wil, &cmd, request->ssids, request->n_ssids,
3565                                  request->match_sets, request->n_match_sets);
3566         wmi_sched_scan_set_channels(wil, &cmd,
3567                                     request->n_channels, request->channels);
3568         wmi_sched_scan_set_plans(wil, &cmd,
3569                                  request->scan_plans, request->n_scan_plans);
3570
3571         rc = wmi_call(wil, WMI_START_SCHED_SCAN_CMDID, vif->mid,
3572                       &cmd, sizeof(cmd),
3573                       WMI_START_SCHED_SCAN_EVENTID, &reply, sizeof(reply),
3574                       WIL_WMI_CALL_GENERAL_TO_MS);
3575         if (rc)
3576                 return rc;
3577
3578         if (reply.evt.result != WMI_PNO_SUCCESS) {
3579                 wil_err(wil, "start sched scan failed, result %d\n",
3580                         reply.evt.result);
3581                 return -EINVAL;
3582         }
3583
3584         return 0;
3585 }
3586
3587 int wmi_stop_sched_scan(struct wil6210_priv *wil)
3588 {
3589         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
3590         int rc;
3591         struct {
3592                 struct wmi_cmd_hdr wmi;
3593                 struct wmi_stop_sched_scan_event evt;
3594         } __packed reply = {
3595                 .evt = {.result = WMI_PNO_REJECT},
3596         };
3597
3598         if (!test_bit(WMI_FW_CAPABILITY_PNO, wil->fw_capabilities))
3599                 return -ENOTSUPP;
3600
3601         rc = wmi_call(wil, WMI_STOP_SCHED_SCAN_CMDID, vif->mid, NULL, 0,
3602                       WMI_STOP_SCHED_SCAN_EVENTID, &reply, sizeof(reply),
3603                       WIL_WMI_CALL_GENERAL_TO_MS);
3604         if (rc)
3605                 return rc;
3606
3607         if (reply.evt.result != WMI_PNO_SUCCESS) {
3608                 wil_err(wil, "stop sched scan failed, result %d\n",
3609                         reply.evt.result);
3610                 return -EINVAL;
3611         }
3612
3613         return 0;
3614 }
3615
3616 int wmi_mgmt_tx(struct wil6210_vif *vif, const u8 *buf, size_t len)
3617 {
3618         size_t total;
3619         struct wil6210_priv *wil = vif_to_wil(vif);
3620         struct ieee80211_mgmt *mgmt_frame = (void *)buf;
3621         struct wmi_sw_tx_req_cmd *cmd;
3622         struct {
3623                 struct wmi_cmd_hdr wmi;
3624                 struct wmi_sw_tx_complete_event evt;
3625         } __packed evt = {
3626                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3627         };
3628         int rc;
3629
3630         wil_dbg_misc(wil, "mgmt_tx mid %d\n", vif->mid);
3631         wil_hex_dump_misc("mgmt tx frame ", DUMP_PREFIX_OFFSET, 16, 1, buf,
3632                           len, true);
3633
3634         if (len < sizeof(struct ieee80211_hdr_3addr))
3635                 return -EINVAL;
3636
3637         total = sizeof(*cmd) + len;
3638         if (total < len) {
3639                 wil_err(wil, "mgmt_tx invalid len %zu\n", len);
3640                 return -EINVAL;
3641         }
3642
3643         cmd = kmalloc(total, GFP_KERNEL);
3644         if (!cmd)
3645                 return -ENOMEM;
3646
3647         memcpy(cmd->dst_mac, mgmt_frame->da, WMI_MAC_LEN);
3648         cmd->len = cpu_to_le16(len);
3649         memcpy(cmd->payload, buf, len);
3650
3651         rc = wmi_call(wil, WMI_SW_TX_REQ_CMDID, vif->mid, cmd, total,
3652                       WMI_SW_TX_COMPLETE_EVENTID, &evt, sizeof(evt), 2000);
3653         if (!rc && evt.evt.status != WMI_FW_STATUS_SUCCESS) {
3654                 wil_dbg_wmi(wil, "mgmt_tx failed with status %d\n",
3655                             evt.evt.status);
3656                 rc = -EAGAIN;
3657         }
3658
3659         kfree(cmd);
3660
3661         return rc;
3662 }
3663
3664 int wmi_mgmt_tx_ext(struct wil6210_vif *vif, const u8 *buf, size_t len,
3665                     u8 channel, u16 duration_ms)
3666 {
3667         size_t total;
3668         struct wil6210_priv *wil = vif_to_wil(vif);
3669         struct ieee80211_mgmt *mgmt_frame = (void *)buf;
3670         struct wmi_sw_tx_req_ext_cmd *cmd;
3671         struct {
3672                 struct wmi_cmd_hdr wmi;
3673                 struct wmi_sw_tx_complete_event evt;
3674         } __packed evt = {
3675                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3676         };
3677         int rc;
3678
3679         wil_dbg_wmi(wil, "mgmt_tx_ext mid %d channel %d duration %d\n",
3680                     vif->mid, channel, duration_ms);
3681         wil_hex_dump_wmi("mgmt_tx_ext frame ", DUMP_PREFIX_OFFSET, 16, 1, buf,
3682                          len, true);
3683
3684         if (len < sizeof(struct ieee80211_hdr_3addr)) {
3685                 wil_err(wil, "short frame. len %zu\n", len);
3686                 return -EINVAL;
3687         }
3688
3689         total = sizeof(*cmd) + len;
3690         if (total < len) {
3691                 wil_err(wil, "mgmt_tx_ext invalid len %zu\n", len);
3692                 return -EINVAL;
3693         }
3694
3695         cmd = kzalloc(total, GFP_KERNEL);
3696         if (!cmd)
3697                 return -ENOMEM;
3698
3699         memcpy(cmd->dst_mac, mgmt_frame->da, WMI_MAC_LEN);
3700         cmd->len = cpu_to_le16(len);
3701         memcpy(cmd->payload, buf, len);
3702         cmd->channel = channel - 1;
3703         cmd->duration_ms = cpu_to_le16(duration_ms);
3704
3705         rc = wmi_call(wil, WMI_SW_TX_REQ_EXT_CMDID, vif->mid, cmd, total,
3706                       WMI_SW_TX_COMPLETE_EVENTID, &evt, sizeof(evt), 2000);
3707         if (!rc && evt.evt.status != WMI_FW_STATUS_SUCCESS) {
3708                 wil_dbg_wmi(wil, "mgmt_tx_ext failed with status %d\n",
3709                             evt.evt.status);
3710                 rc = -EAGAIN;
3711         }
3712
3713         kfree(cmd);
3714
3715         return rc;
3716 }
3717
3718 int wil_wmi_tx_sring_cfg(struct wil6210_priv *wil, int ring_id)
3719 {
3720         int rc;
3721         struct wil6210_vif *vif = ndev_to_vif(wil->main_ndev);
3722         struct wil_status_ring *sring = &wil->srings[ring_id];
3723         struct wmi_tx_status_ring_add_cmd cmd = {
3724                 .ring_cfg = {
3725                         .ring_size = cpu_to_le16(sring->size),
3726                 },
3727                 .irq_index = WIL_TX_STATUS_IRQ_IDX
3728         };
3729         struct {
3730                 struct wmi_cmd_hdr hdr;
3731                 struct wmi_tx_status_ring_cfg_done_event evt;
3732         } __packed reply = {
3733                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3734         };
3735
3736         cmd.ring_cfg.ring_id = ring_id;
3737
3738         cmd.ring_cfg.ring_mem_base = cpu_to_le64(sring->pa);
3739         rc = wmi_call(wil, WMI_TX_STATUS_RING_ADD_CMDID, vif->mid, &cmd,
3740                       sizeof(cmd), WMI_TX_STATUS_RING_CFG_DONE_EVENTID,
3741                       &reply, sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
3742         if (rc) {
3743                 wil_err(wil, "TX_STATUS_RING_ADD_CMD failed, rc %d\n", rc);
3744                 return rc;
3745         }
3746
3747         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3748                 wil_err(wil, "TX_STATUS_RING_ADD_CMD failed, status %d\n",
3749                         reply.evt.status);
3750                 return -EINVAL;
3751         }
3752
3753         sring->hwtail = le32_to_cpu(reply.evt.ring_tail_ptr);
3754
3755         return 0;
3756 }
3757
3758 int wil_wmi_cfg_def_rx_offload(struct wil6210_priv *wil, u16 max_rx_pl_per_desc)
3759 {
3760         struct net_device *ndev = wil->main_ndev;
3761         struct wil6210_vif *vif = ndev_to_vif(ndev);
3762         int rc;
3763         struct wmi_cfg_def_rx_offload_cmd cmd = {
3764                 .max_msdu_size = cpu_to_le16(wil_mtu2macbuf(WIL_MAX_ETH_MTU)),
3765                 .max_rx_pl_per_desc = cpu_to_le16(max_rx_pl_per_desc),
3766                 .decap_trans_type = WMI_DECAP_TYPE_802_3,
3767                 .l2_802_3_offload_ctrl = 0,
3768                 .l3_l4_ctrl = 1 << L3_L4_CTRL_TCPIP_CHECKSUM_EN_POS,
3769         };
3770         struct {
3771                 struct wmi_cmd_hdr hdr;
3772                 struct wmi_cfg_def_rx_offload_done_event evt;
3773         } __packed reply = {
3774                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3775         };
3776
3777         rc = wmi_call(wil, WMI_CFG_DEF_RX_OFFLOAD_CMDID, vif->mid, &cmd,
3778                       sizeof(cmd), WMI_CFG_DEF_RX_OFFLOAD_DONE_EVENTID, &reply,
3779                       sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
3780         if (rc) {
3781                 wil_err(wil, "WMI_CFG_DEF_RX_OFFLOAD_CMD failed, rc %d\n", rc);
3782                 return rc;
3783         }
3784
3785         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3786                 wil_err(wil, "WMI_CFG_DEF_RX_OFFLOAD_CMD failed, status %d\n",
3787                         reply.evt.status);
3788                 return -EINVAL;
3789         }
3790
3791         return 0;
3792 }
3793
3794 int wil_wmi_rx_sring_add(struct wil6210_priv *wil, u16 ring_id)
3795 {
3796         struct net_device *ndev = wil->main_ndev;
3797         struct wil6210_vif *vif = ndev_to_vif(ndev);
3798         struct wil_status_ring *sring = &wil->srings[ring_id];
3799         int rc;
3800         struct wmi_rx_status_ring_add_cmd cmd = {
3801                 .ring_cfg = {
3802                         .ring_size = cpu_to_le16(sring->size),
3803                         .ring_id = ring_id,
3804                 },
3805                 .rx_msg_type = wil->use_compressed_rx_status ?
3806                         WMI_RX_MSG_TYPE_COMPRESSED :
3807                         WMI_RX_MSG_TYPE_EXTENDED,
3808                 .irq_index = WIL_RX_STATUS_IRQ_IDX,
3809         };
3810         struct {
3811                 struct wmi_cmd_hdr hdr;
3812                 struct wmi_rx_status_ring_cfg_done_event evt;
3813         } __packed reply = {
3814                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3815         };
3816
3817         cmd.ring_cfg.ring_mem_base = cpu_to_le64(sring->pa);
3818         rc = wmi_call(wil, WMI_RX_STATUS_RING_ADD_CMDID, vif->mid, &cmd,
3819                       sizeof(cmd), WMI_RX_STATUS_RING_CFG_DONE_EVENTID, &reply,
3820                       sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
3821         if (rc) {
3822                 wil_err(wil, "RX_STATUS_RING_ADD_CMD failed, rc %d\n", rc);
3823                 return rc;
3824         }
3825
3826         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3827                 wil_err(wil, "RX_STATUS_RING_ADD_CMD failed, status %d\n",
3828                         reply.evt.status);
3829                 return -EINVAL;
3830         }
3831
3832         sring->hwtail = le32_to_cpu(reply.evt.ring_tail_ptr);
3833
3834         return 0;
3835 }
3836
3837 int wil_wmi_rx_desc_ring_add(struct wil6210_priv *wil, int status_ring_id)
3838 {
3839         struct net_device *ndev = wil->main_ndev;
3840         struct wil6210_vif *vif = ndev_to_vif(ndev);
3841         struct wil_ring *ring = &wil->ring_rx;
3842         int rc;
3843         struct wmi_rx_desc_ring_add_cmd cmd = {
3844                 .ring_cfg = {
3845                         .ring_size = cpu_to_le16(ring->size),
3846                         .ring_id = WIL_RX_DESC_RING_ID,
3847                 },
3848                 .status_ring_id = status_ring_id,
3849                 .irq_index = WIL_RX_STATUS_IRQ_IDX,
3850         };
3851         struct {
3852                 struct wmi_cmd_hdr hdr;
3853                 struct wmi_rx_desc_ring_cfg_done_event evt;
3854         } __packed reply = {
3855                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3856         };
3857
3858         cmd.ring_cfg.ring_mem_base = cpu_to_le64(ring->pa);
3859         cmd.sw_tail_host_addr = cpu_to_le64(ring->edma_rx_swtail.pa);
3860         rc = wmi_call(wil, WMI_RX_DESC_RING_ADD_CMDID, vif->mid, &cmd,
3861                       sizeof(cmd), WMI_RX_DESC_RING_CFG_DONE_EVENTID, &reply,
3862                       sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
3863         if (rc) {
3864                 wil_err(wil, "WMI_RX_DESC_RING_ADD_CMD failed, rc %d\n", rc);
3865                 return rc;
3866         }
3867
3868         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3869                 wil_err(wil, "WMI_RX_DESC_RING_ADD_CMD failed, status %d\n",
3870                         reply.evt.status);
3871                 return -EINVAL;
3872         }
3873
3874         ring->hwtail = le32_to_cpu(reply.evt.ring_tail_ptr);
3875
3876         return 0;
3877 }
3878
3879 int wil_wmi_tx_desc_ring_add(struct wil6210_vif *vif, int ring_id, int cid,
3880                              int tid)
3881 {
3882         struct wil6210_priv *wil = vif_to_wil(vif);
3883         int sring_id = wil->tx_sring_idx; /* there is only one TX sring */
3884         int rc;
3885         struct wil_ring *ring = &wil->ring_tx[ring_id];
3886         struct wil_ring_tx_data *txdata = &wil->ring_tx_data[ring_id];
3887         struct wmi_tx_desc_ring_add_cmd cmd = {
3888                 .ring_cfg = {
3889                         .ring_size = cpu_to_le16(ring->size),
3890                         .ring_id = ring_id,
3891                 },
3892                 .status_ring_id = sring_id,
3893                 .cid = cid,
3894                 .tid = tid,
3895                 .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
3896                 .max_msdu_size = cpu_to_le16(wil_mtu2macbuf(mtu_max)),
3897                 .schd_params = {
3898                         .priority = cpu_to_le16(0),
3899                         .timeslot_us = cpu_to_le16(0xfff),
3900                 }
3901         };
3902         struct {
3903                 struct wmi_cmd_hdr hdr;
3904                 struct wmi_tx_desc_ring_cfg_done_event evt;
3905         } __packed reply = {
3906                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3907         };
3908
3909         cmd.ring_cfg.ring_mem_base = cpu_to_le64(ring->pa);
3910         rc = wmi_call(wil, WMI_TX_DESC_RING_ADD_CMDID, vif->mid, &cmd,
3911                       sizeof(cmd), WMI_TX_DESC_RING_CFG_DONE_EVENTID, &reply,
3912                       sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
3913         if (rc) {
3914                 wil_err(wil, "WMI_TX_DESC_RING_ADD_CMD failed, rc %d\n", rc);
3915                 return rc;
3916         }
3917
3918         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3919                 wil_err(wil, "WMI_TX_DESC_RING_ADD_CMD failed, status %d\n",
3920                         reply.evt.status);
3921                 return -EINVAL;
3922         }
3923
3924         spin_lock_bh(&txdata->lock);
3925         ring->hwtail = le32_to_cpu(reply.evt.ring_tail_ptr);
3926         txdata->mid = vif->mid;
3927         txdata->enabled = 1;
3928         spin_unlock_bh(&txdata->lock);
3929
3930         return 0;
3931 }
3932
3933 int wil_wmi_bcast_desc_ring_add(struct wil6210_vif *vif, int ring_id)
3934 {
3935         struct wil6210_priv *wil = vif_to_wil(vif);
3936         struct wil_ring *ring = &wil->ring_tx[ring_id];
3937         int rc;
3938         struct wmi_bcast_desc_ring_add_cmd cmd = {
3939                 .ring_cfg = {
3940                         .ring_size = cpu_to_le16(ring->size),
3941                         .ring_id = ring_id,
3942                 },
3943                 .max_msdu_size = cpu_to_le16(wil_mtu2macbuf(mtu_max)),
3944                 .status_ring_id = wil->tx_sring_idx,
3945                 .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
3946         };
3947         struct {
3948                 struct wmi_cmd_hdr hdr;
3949                 struct wmi_rx_desc_ring_cfg_done_event evt;
3950         } __packed reply = {
3951                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3952         };
3953         struct wil_ring_tx_data *txdata = &wil->ring_tx_data[ring_id];
3954
3955         cmd.ring_cfg.ring_mem_base = cpu_to_le64(ring->pa);
3956         rc = wmi_call(wil, WMI_BCAST_DESC_RING_ADD_CMDID, vif->mid, &cmd,
3957                       sizeof(cmd), WMI_TX_DESC_RING_CFG_DONE_EVENTID, &reply,
3958                       sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
3959         if (rc) {
3960                 wil_err(wil, "WMI_BCAST_DESC_RING_ADD_CMD failed, rc %d\n", rc);
3961                 return rc;
3962         }
3963
3964         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
3965                 wil_err(wil, "Broadcast Tx config failed, status %d\n",
3966                         reply.evt.status);
3967                 return -EINVAL;
3968         }
3969
3970         spin_lock_bh(&txdata->lock);
3971         ring->hwtail = le32_to_cpu(reply.evt.ring_tail_ptr);
3972         txdata->mid = vif->mid;
3973         txdata->enabled = 1;
3974         spin_unlock_bh(&txdata->lock);
3975
3976         return 0;
3977 }
3978
3979 int wmi_link_stats_cfg(struct wil6210_vif *vif, u32 type, u8 cid, u32 interval)
3980 {
3981         struct wil6210_priv *wil = vif_to_wil(vif);
3982         struct wmi_link_stats_cmd cmd = {
3983                 .record_type_mask = cpu_to_le32(type),
3984                 .cid = cid,
3985                 .action = WMI_LINK_STATS_SNAPSHOT,
3986                 .interval_msec = cpu_to_le32(interval),
3987         };
3988         struct {
3989                 struct wmi_cmd_hdr wmi;
3990                 struct wmi_link_stats_config_done_event evt;
3991         } __packed reply = {
3992                 .evt = {.status = WMI_FW_STATUS_FAILURE},
3993         };
3994         int rc;
3995
3996         rc = wmi_call(wil, WMI_LINK_STATS_CMDID, vif->mid, &cmd, sizeof(cmd),
3997                       WMI_LINK_STATS_CONFIG_DONE_EVENTID, &reply,
3998                       sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
3999         if (rc) {
4000                 wil_err(wil, "WMI_LINK_STATS_CMDID failed, rc %d\n", rc);
4001                 return rc;
4002         }
4003
4004         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
4005                 wil_err(wil, "Link statistics config failed, status %d\n",
4006                         reply.evt.status);
4007                 return -EINVAL;
4008         }
4009
4010         return 0;
4011 }
4012
4013 int wmi_set_cqm_rssi_config(struct wil6210_priv *wil,
4014                             s32 rssi_thold, u32 rssi_hyst)
4015 {
4016         struct net_device *ndev = wil->main_ndev;
4017         struct wil6210_vif *vif = ndev_to_vif(ndev);
4018         int rc;
4019         struct {
4020                 struct wmi_set_link_monitor_cmd cmd;
4021                 s8 rssi_thold;
4022         } __packed cmd = {
4023                 .cmd = {
4024                         .rssi_hyst = rssi_hyst,
4025                         .rssi_thresholds_list_size = 1,
4026                 },
4027                 .rssi_thold = rssi_thold,
4028         };
4029         struct {
4030                 struct wmi_cmd_hdr hdr;
4031                 struct wmi_set_link_monitor_event evt;
4032         } __packed reply = {
4033                 .evt = {.status = WMI_FW_STATUS_FAILURE},
4034         };
4035
4036         if (rssi_thold > S8_MAX || rssi_thold < S8_MIN || rssi_hyst > U8_MAX)
4037                 return -EINVAL;
4038
4039         rc = wmi_call(wil, WMI_SET_LINK_MONITOR_CMDID, vif->mid, &cmd,
4040                       sizeof(cmd), WMI_SET_LINK_MONITOR_EVENTID,
4041                       &reply, sizeof(reply), WIL_WMI_CALL_GENERAL_TO_MS);
4042         if (rc) {
4043                 wil_err(wil, "WMI_SET_LINK_MONITOR_CMDID failed, rc %d\n", rc);
4044                 return rc;
4045         }
4046
4047         if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
4048                 wil_err(wil, "WMI_SET_LINK_MONITOR_CMDID failed, status %d\n",
4049                         reply.evt.status);
4050                 return -EINVAL;
4051         }
4052
4053         return 0;
4054 }