drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 static bool prefer_offload_fw = true;
  15 module_param(prefer_offload_fw, bool, 0644);
  16 MODULE_PARM_DESC(prefer_offload_fw,
  17                  "Prefer client mode offload firmware (MT7663)");
  18
  19 struct mt7615_patch_hdr {
  20         char build_date[16];
  21         char platform[4];
  22         __be32 hw_sw_ver;
  23         __be32 patch_ver;
  24         __be16 checksum;
  25 } __packed;
  26
  27 struct mt7615_fw_trailer {
  28         __le32 addr;
  29         u8 chip_id;
  30         u8 feature_set;
  31         u8 eco_code;
  32         char fw_ver[10];
  33         char build_date[15];
  34         __le32 len;
  35 } __packed;
  36
  37 #define FW_V3_COMMON_TAILER_SIZE        36
  38 #define FW_V3_REGION_TAILER_SIZE        40
  39 #define FW_START_OVERRIDE               BIT(0)
  40 #define FW_START_DLYCAL                 BIT(1)
  41 #define FW_START_WORKING_PDA_CR4        BIT(2)
  42
  43 struct mt7663_fw_trailer {
  44         u8 chip_id;
  45         u8 eco_code;
  46         u8 n_region;
  47         u8 format_ver;
  48         u8 format_flag;
  49         u8 reserv[2];
  50         char fw_ver[10];
  51         char build_date[15];
  52         __le32 crc;
  53 } __packed;
  54
  55 struct mt7663_fw_buf {
  56         __le32 crc;
  57         __le32 d_img_size;
  58         __le32 block_size;
  59         u8 rsv[4];
  60         __le32 img_dest_addr;
  61         __le32 img_size;
  62         u8 feature_set;
  63 };
  64
  65 #define MT7615_PATCH_ADDRESS            0x80000
  66 #define MT7622_PATCH_ADDRESS            0x9c000
  67 #define MT7663_PATCH_ADDRESS            0xdc000
  68
  69 #define N9_REGION_NUM                   2
  70 #define CR4_REGION_NUM                  1
  71
  72 #define IMG_CRC_LEN                     4
  73
  74 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  75 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  76
  77 #define DL_MODE_ENCRYPT                 BIT(0)
  78 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  79 #define DL_MODE_RESET_SEC_IV            BIT(3)
  80 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
  82 #define DL_MODE_NEED_RSP                BIT(31)
  83
  84 #define FW_START_OVERRIDE               BIT(0)
  85 #define FW_START_WORKING_PDA_CR4        BIT(2)
  86
  87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
  88                          int cmd, int *wait_seq)
  89 {
  90         int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
  91         struct mt7615_uni_txd *uni_txd;
  92         struct mt7615_mcu_txd *mcu_txd;
  93         u8 seq, q_idx, pkt_fmt;
  94         __le32 *txd;
  95         u32 val;
  96
  97         /* TODO: make dynamic based on msg type */
  98         dev->mt76.mcu.timeout = 20 * HZ;
  99
 100         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 101         if (!seq)
 102                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 103         if (wait_seq)
 104                 *wait_seq = seq;
 105
 106         txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 107         txd = (__le32 *)skb_push(skb, txd_len);
 108
 109         if (cmd != MCU_CMD_FW_SCATTER) {
 110                 q_idx = MT_TX_MCU_PORT_RX_Q0;
 111                 pkt_fmt = MT_TX_TYPE_CMD;
 112         } else {
 113                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
 114                 pkt_fmt = MT_TX_TYPE_FW;
 115         }
 116
 117         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 118               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
 119               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
 120         txd[0] = cpu_to_le32(val);
 121
 122         val = MT_TXD1_LONG_FORMAT |
 123               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
 124               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
 125         txd[1] = cpu_to_le32(val);
 126
 127         if (cmd & MCU_UNI_PREFIX) {
 128                 uni_txd = (struct mt7615_uni_txd *)txd;
 129                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 130                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 131                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 132                 uni_txd->s2d_index = MCU_S2D_H2N;
 133                 uni_txd->pkt_type = MCU_PKT_ID;
 134                 uni_txd->seq = seq;
 135
 136                 return;
 137         }
 138
 139         mcu_txd = (struct mt7615_mcu_txd *)txd;
 140         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 141         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
 142         mcu_txd->s2d_index = MCU_S2D_H2N;
 143         mcu_txd->pkt_type = MCU_PKT_ID;
 144         mcu_txd->seq = seq;
 145
 146         switch (cmd & ~MCU_CMD_MASK) {
 147         case MCU_FW_PREFIX:
 148                 mcu_txd->set_query = MCU_Q_NA;
 149                 mcu_txd->cid = mcu_cmd;
 150                 break;
 151         case MCU_CE_PREFIX:
 152                 if (cmd & MCU_QUERY_MASK)
 153                         mcu_txd->set_query = MCU_Q_QUERY;
 154                 else
 155                         mcu_txd->set_query = MCU_Q_SET;
 156                 mcu_txd->cid = mcu_cmd;
 157                 break;
 158         default:
 159                 mcu_txd->cid = MCU_CMD_EXT_CID;
 160                 if (cmd & MCU_QUERY_PREFIX)
 161                         mcu_txd->set_query = MCU_Q_QUERY;
 162                 else
 163                         mcu_txd->set_query = MCU_Q_SET;
 164                 mcu_txd->ext_cid = mcu_cmd;
 165                 mcu_txd->ext_cid_ack = 1;
 166                 break;
 167         }
 168 }
 169 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
 170
 171 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 172                               struct sk_buff *skb, int seq)
 173 {
 174         struct mt7615_mcu_rxd *rxd;
 175         int ret = 0;
 176
 177         if (!skb) {
 178                 dev_err(mdev->dev, "Message %ld (seq %d) timeout\n",
 179                         cmd & MCU_CMD_MASK, seq);
 180                 return -ETIMEDOUT;
 181         }
 182
 183         rxd = (struct mt7615_mcu_rxd *)skb->data;
 184         if (seq != rxd->seq)
 185                 return -EAGAIN;
 186
 187         switch (cmd) {
 188         case MCU_CMD_PATCH_SEM_CONTROL:
 189                 skb_pull(skb, sizeof(*rxd) - 4);
 190                 ret = *skb->data;
 191                 break;
 192         case MCU_EXT_CMD_GET_TEMP:
 193                 skb_pull(skb, sizeof(*rxd));
 194                 ret = le32_to_cpu(*(__le32 *)skb->data);
 195                 break;
 196         case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
 197                 skb_pull(skb, sizeof(*rxd));
 198                 ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
 199                 break;
 200         case MCU_UNI_CMD_DEV_INFO_UPDATE:
 201         case MCU_UNI_CMD_BSS_INFO_UPDATE:
 202         case MCU_UNI_CMD_STA_REC_UPDATE:
 203         case MCU_UNI_CMD_HIF_CTRL:
 204         case MCU_UNI_CMD_OFFLOAD:
 205         case MCU_UNI_CMD_SUSPEND: {
 206                 struct mt7615_mcu_uni_event *event;
 207
 208                 skb_pull(skb, sizeof(*rxd));
 209                 event = (struct mt7615_mcu_uni_event *)skb->data;
 210                 ret = le32_to_cpu(event->status);
 211                 break;
 212         }
 213         case MCU_CMD_REG_READ: {
 214                 struct mt7615_mcu_reg_event *event;
 215
 216                 skb_pull(skb, sizeof(*rxd));
 217                 event = (struct mt7615_mcu_reg_event *)skb->data;
 218                 ret = (int)le32_to_cpu(event->val);
 219                 break;
 220         }
 221         default:
 222                 break;
 223         }
 224
 225         return ret;
 226 }
 227 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
 228
 229 static int
 230 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 231                         int cmd, int *seq)
 232 {
 233         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 234         enum mt76_txq_id qid;
 235
 236         mt7615_mcu_fill_msg(dev, skb, cmd, seq);
 237         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 238                 qid = MT_TXQ_MCU;
 239         else
 240                 qid = MT_TXQ_FWDL;
 241
 242         return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
 243 }
 244
 245 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
 246 {
 247         struct {
 248                 __le32 wifi_stream;
 249                 __le32 address;
 250                 __le32 data;
 251         } req = {
 252                 .wifi_stream = cpu_to_le32(wf),
 253                 .address = cpu_to_le32(reg),
 254         };
 255
 256         return mt76_mcu_send_msg(&dev->mt76,
 257                                  MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
 258                                  &req, sizeof(req), true);
 259 }
 260
 261 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
 262 {
 263         struct {
 264                 __le32 wifi_stream;
 265                 __le32 address;
 266                 __le32 data;
 267         } req = {
 268                 .wifi_stream = cpu_to_le32(wf),
 269                 .address = cpu_to_le32(reg),
 270                 .data = cpu_to_le32(val),
 271         };
 272
 273         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
 274                                  sizeof(req), false);
 275 }
 276
 277 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
 278 {
 279         if (!is_mt7622(&dev->mt76))
 280                 return;
 281
 282         regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
 283                            MT_INFRACFG_MISC_AP2CONN_WAKE,
 284                            !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
 285 }
 286
 287 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
 288 {
 289         struct mt76_phy *mphy = &dev->mt76.phy;
 290         struct mt76_dev *mdev = &dev->mt76;
 291         u32 addr;
 292         int err;
 293
 294         addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
 295         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
 296
 297         mt7622_trigger_hif_int(dev, true);
 298
 299         addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 300         err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 301
 302         mt7622_trigger_hif_int(dev, false);
 303
 304         if (err) {
 305                 dev_err(mdev->dev, "driver own failed\n");
 306                 return -ETIMEDOUT;
 307         }
 308
 309         clear_bit(MT76_STATE_PM, &mphy->state);
 310
 311         return 0;
 312 }
 313
 314 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
 315 {
 316         struct mt76_phy *mphy = &dev->mt76.phy;
 317         int i;
 318
 319         if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
 320                 goto out;
 321
 322         for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
 323                 mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 324                 if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
 325                                    MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
 326                         break;
 327         }
 328
 329         if (i == MT7615_DRV_OWN_RETRY_COUNT) {
 330                 dev_err(dev->mt76.dev, "driver own failed\n");
 331                 set_bit(MT76_STATE_PM, &mphy->state);
 332                 return -EIO;
 333         }
 334
 335 out:
 336         dev->pm.last_activity = jiffies;
 337
 338         return 0;
 339 }
 340
 341 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
 342 {
 343         struct mt76_phy *mphy = &dev->mt76.phy;
 344         int err = 0;
 345         u32 addr;
 346
 347         if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
 348                 return 0;
 349
 350         mt7622_trigger_hif_int(dev, true);
 351
 352         addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 353         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
 354
 355         if (is_mt7622(&dev->mt76) &&
 356             !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
 357                             MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
 358                 dev_err(dev->mt76.dev, "Timeout for firmware own\n");
 359                 clear_bit(MT76_STATE_PM, &mphy->state);
 360                 err = -EIO;
 361         }
 362
 363         mt7622_trigger_hif_int(dev, false);
 364
 365         return err;
 366 }
 367
 368 static void
 369 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 370 {
 371         if (vif->csa_active)
 372                 ieee80211_csa_finish(vif);
 373 }
 374
 375 static void
 376 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 377 {
 378         struct mt76_phy *mphy = &dev->mt76.phy;
 379         struct mt7615_mcu_rdd_report *r;
 380
 381         r = (struct mt7615_mcu_rdd_report *)skb->data;
 382
 383         if (r->idx && dev->mt76.phy2)
 384                 mphy = dev->mt76.phy2;
 385
 386         ieee80211_radar_detected(mphy->hw);
 387         dev->hw_pattern++;
 388 }
 389
 390 static void
 391 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
 392 {
 393         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 394         const char *data = (char *)&rxd[1];
 395         const char *type;
 396
 397         switch (rxd->s2d_index) {
 398         case 0:
 399                 type = "N9";
 400                 break;
 401         case 2:
 402                 type = "CR4";
 403                 break;
 404         default:
 405                 type = "unknown";
 406                 break;
 407         }
 408
 409         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 410 }
 411
 412 static void
 413 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 414 {
 415         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 416
 417         switch (rxd->ext_eid) {
 418         case MCU_EXT_EVENT_RDD_REPORT:
 419                 mt7615_mcu_rx_radar_detected(dev, skb);
 420                 break;
 421         case MCU_EXT_EVENT_CSA_NOTIFY:
 422                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 423                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 424                                 mt7615_mcu_csa_finish, dev);
 425                 break;
 426         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 427                 mt7615_mcu_rx_log_message(dev, skb);
 428                 break;
 429         default:
 430                 break;
 431         }
 432 }
 433
 434 static void
 435 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
 436 {
 437         u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
 438         struct mt7615_phy *phy;
 439         struct mt76_phy *mphy;
 440
 441         if (*seq_num & BIT(7) && dev->mt76.phy2)
 442                 mphy = dev->mt76.phy2;
 443         else
 444                 mphy = &dev->mt76.phy;
 445
 446         phy = (struct mt7615_phy *)mphy->priv;
 447
 448         spin_lock_bh(&dev->mt76.lock);
 449         __skb_queue_tail(&phy->scan_event_list, skb);
 450         spin_unlock_bh(&dev->mt76.lock);
 451
 452         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 453                                      MT7615_HW_SCAN_TIMEOUT);
 454 }
 455
 456 static void
 457 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
 458 {
 459         struct mt7615_roc_tlv *event;
 460         struct mt7615_phy *phy;
 461         struct mt76_phy *mphy;
 462         int duration;
 463
 464         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 465         event = (struct mt7615_roc_tlv *)skb->data;
 466
 467         if (event->dbdc_band && dev->mt76.phy2)
 468                 mphy = dev->mt76.phy2;
 469         else
 470                 mphy = &dev->mt76.phy;
 471
 472         ieee80211_ready_on_channel(mphy->hw);
 473
 474         phy = (struct mt7615_phy *)mphy->priv;
 475         phy->roc_grant = true;
 476         wake_up(&phy->roc_wait);
 477
 478         duration = le32_to_cpu(event->max_interval);
 479         mod_timer(&phy->roc_timer,
 480                   round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
 481 }
 482
 483 static void
 484 mt7615_mcu_beacon_loss_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
 485 {
 486         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 487         struct mt7615_beacon_loss_event *event = priv;
 488
 489         if (mvif->idx != event->bss_idx)
 490                 return;
 491
 492         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
 493                 return;
 494
 495         ieee80211_beacon_loss(vif);
 496 }
 497
 498 static void
 499 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 500 {
 501         struct mt7615_beacon_loss_event *event;
 502         struct mt76_phy *mphy;
 503         u8 band_idx = 0; /* DBDC support */
 504
 505         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 506         event = (struct mt7615_beacon_loss_event *)skb->data;
 507         if (band_idx && dev->mt76.phy2)
 508                 mphy = dev->mt76.phy2;
 509         else
 510                 mphy = &dev->mt76.phy;
 511
 512         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 513                                         IEEE80211_IFACE_ITER_RESUME_ALL,
 514                                         mt7615_mcu_beacon_loss_iter, event);
 515 }
 516
 517 static void
 518 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 519 {
 520         struct mt7615_mcu_bss_event *event;
 521         struct mt76_phy *mphy;
 522         u8 band_idx = 0; /* DBDC support */
 523
 524         event = (struct mt7615_mcu_bss_event *)(skb->data +
 525                                                 sizeof(struct mt7615_mcu_rxd));
 526
 527         if (band_idx && dev->mt76.phy2)
 528                 mphy = dev->mt76.phy2;
 529         else
 530                 mphy = &dev->mt76.phy;
 531
 532         if (event->is_absent)
 533                 ieee80211_stop_queues(mphy->hw);
 534         else
 535                 ieee80211_wake_queues(mphy->hw);
 536 }
 537
 538 static void
 539 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 540 {
 541         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 542
 543         switch (rxd->eid) {
 544         case MCU_EVENT_EXT:
 545                 mt7615_mcu_rx_ext_event(dev, skb);
 546                 break;
 547         case MCU_EVENT_BSS_BEACON_LOSS:
 548                 mt7615_mcu_beacon_loss_event(dev, skb);
 549                 break;
 550         case MCU_EVENT_ROC:
 551                 mt7615_mcu_roc_event(dev, skb);
 552                 break;
 553         case MCU_EVENT_SCHED_SCAN_DONE:
 554         case MCU_EVENT_SCAN_DONE:
 555                 mt7615_mcu_scan_event(dev, skb);
 556                 return;
 557         case MCU_EVENT_BSS_ABSENCE:
 558                 mt7615_mcu_bss_event(dev, skb);
 559                 break;
 560         default:
 561                 break;
 562         }
 563         dev_kfree_skb(skb);
 564 }
 565
 566 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 567 {
 568         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 569
 570         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 571             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 572             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 573             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 574             rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 575             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 576             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 577             rxd->eid == MCU_EVENT_SCAN_DONE ||
 578             rxd->eid == MCU_EVENT_ROC ||
 579             !rxd->seq)
 580                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 581         else
 582                 mt76_mcu_rx_event(&dev->mt76, skb);
 583 }
 584
 585 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
 586                                     u32 len, u32 mode)
 587 {
 588         struct {
 589                 __le32 addr;
 590                 __le32 len;
 591                 __le32 mode;
 592         } req = {
 593                 .addr = cpu_to_le32(addr),
 594                 .len = cpu_to_le32(len),
 595                 .mode = cpu_to_le32(mode),
 596         };
 597
 598         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TARGET_ADDRESS_LEN_REQ,
 599                                  &req, sizeof(req), true);
 600 }
 601
 602 static int
 603 mt7615_mcu_add_dev(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 604                    bool enable)
 605 {
 606         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 607         struct {
 608                 struct req_hdr {
 609                         u8 omac_idx;
 610                         u8 band_idx;
 611                         __le16 tlv_num;
 612                         u8 is_tlv_append;
 613                         u8 rsv[3];
 614                 } __packed hdr;
 615                 struct req_tlv {
 616                         __le16 tag;
 617                         __le16 len;
 618                         u8 active;
 619                         u8 band_idx;
 620                         u8 omac_addr[ETH_ALEN];
 621                 } __packed tlv;
 622         } data = {
 623                 .hdr = {
 624                         .omac_idx = mvif->omac_idx,
 625                         .band_idx = mvif->band_idx,
 626                         .tlv_num = cpu_to_le16(1),
 627                         .is_tlv_append = 1,
 628                 },
 629                 .tlv = {
 630                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 631                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 632                         .active = enable,
 633                         .band_idx = mvif->band_idx,
 634                 },
 635         };
 636
 637         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 638         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 639                                  &data, sizeof(data), true);
 640 }
 641
 642 static int
 643 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
 644                               struct ieee80211_hw *hw,
 645                               struct ieee80211_vif *vif, bool enable)
 646 {
 647         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 648         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
 649         struct ieee80211_mutable_offsets offs;
 650         struct ieee80211_tx_info *info;
 651         struct req {
 652                 u8 omac_idx;
 653                 u8 enable;
 654                 u8 wlan_idx;
 655                 u8 band_idx;
 656                 u8 pkt_type;
 657                 u8 need_pre_tbtt_int;
 658                 __le16 csa_ie_pos;
 659                 __le16 pkt_len;
 660                 __le16 tim_ie_pos;
 661                 u8 pkt[512];
 662                 u8 csa_cnt;
 663                 /* bss color change */
 664                 u8 bcc_cnt;
 665                 __le16 bcc_ie_pos;
 666         } __packed req = {
 667                 .omac_idx = mvif->omac_idx,
 668                 .enable = enable,
 669                 .wlan_idx = wcid->idx,
 670                 .band_idx = mvif->band_idx,
 671         };
 672         struct sk_buff *skb;
 673
 674         skb = ieee80211_beacon_get_template(hw, vif, &offs);
 675         if (!skb)
 676                 return -EINVAL;
 677
 678         if (skb->len > 512 - MT_TXD_SIZE) {
 679                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
 680                 dev_kfree_skb(skb);
 681                 return -EINVAL;
 682         }
 683
 684         if (mvif->band_idx) {
 685                 info = IEEE80211_SKB_CB(skb);
 686                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
 687         }
 688
 689         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
 690                               0, NULL, true);
 691         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
 692         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 693         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
 694         if (offs.cntdwn_counter_offs[0]) {
 695                 u16 csa_offs;
 696
 697                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
 698                 req.csa_ie_pos = cpu_to_le16(csa_offs);
 699                 req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
 700         }
 701         dev_kfree_skb(skb);
 702
 703         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
 704                                  sizeof(req), true);
 705 }
 706
 707 static int
 708 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
 709 {
 710 #define ENTER_PM_STATE  1
 711 #define EXIT_PM_STATE   2
 712         struct {
 713                 u8 pm_number;
 714                 u8 pm_state;
 715                 u8 bssid[ETH_ALEN];
 716                 u8 dtim_period;
 717                 u8 wlan_idx;
 718                 __le16 bcn_interval;
 719                 __le32 aid;
 720                 __le32 rx_filter;
 721                 u8 band_idx;
 722                 u8 rsv[3];
 723                 __le32 feature;
 724                 u8 omac_idx;
 725                 u8 wmm_idx;
 726                 u8 bcn_loss_cnt;
 727                 u8 bcn_sp_duration;
 728         } __packed req = {
 729                 .pm_number = 5,
 730                 .pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
 731                 .band_idx = band,
 732         };
 733
 734         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
 735                                  sizeof(req), true);
 736 }
 737
 738 static struct sk_buff *
 739 mt7615_mcu_alloc_sta_req(struct mt7615_dev *dev, struct mt7615_vif *mvif,
 740                          struct mt7615_sta *msta)
 741 {
 742         struct sta_req_hdr hdr = {
 743                 .bss_idx = mvif->idx,
 744                 .wlan_idx = msta ? msta->wcid.idx : 0,
 745                 .muar_idx = msta ? mvif->omac_idx : 0,
 746                 .is_tlv_append = 1,
 747         };
 748         struct sk_buff *skb;
 749
 750         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7615_STA_UPDATE_MAX_SIZE);
 751         if (!skb)
 752                 return ERR_PTR(-ENOMEM);
 753
 754         skb_put_data(skb, &hdr, sizeof(hdr));
 755
 756         return skb;
 757 }
 758
 759 static struct wtbl_req_hdr *
 760 mt7615_mcu_alloc_wtbl_req(struct mt7615_dev *dev, struct mt7615_sta *msta,
 761                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 762 {
 763         struct tlv *sta_hdr = sta_wtbl;
 764         struct wtbl_req_hdr hdr = {
 765                 .wlan_idx = msta->wcid.idx,
 766                 .operation = cmd,
 767         };
 768         struct sk_buff *nskb = *skb;
 769
 770         if (!nskb) {
 771                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 772                                           MT7615_WTBL_UPDATE_BA_SIZE);
 773                 if (!nskb)
 774                         return ERR_PTR(-ENOMEM);
 775
 776                 *skb = nskb;
 777         }
 778
 779         if (sta_hdr)
 780                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 781
 782         return skb_put_data(nskb, &hdr, sizeof(hdr));
 783 }
 784
 785 static struct tlv *
 786 mt7615_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 787                           void *sta_ntlv, void *sta_wtbl)
 788 {
 789         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 790         struct tlv *sta_hdr = sta_wtbl;
 791         struct tlv *ptlv, tlv = {
 792                 .tag = cpu_to_le16(tag),
 793                 .len = cpu_to_le16(len),
 794         };
 795         u16 ntlv;
 796
 797         ptlv = skb_put(skb, len);
 798         memcpy(ptlv, &tlv, sizeof(tlv));
 799
 800         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 801         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 802
 803         if (sta_hdr) {
 804                 u16 size = le16_to_cpu(sta_hdr->len);
 805
 806                 sta_hdr->len = cpu_to_le16(size + len);
 807         }
 808
 809         return ptlv;
 810 }
 811
 812 static struct tlv *
 813 mt7615_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 814 {
 815         return mt7615_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 816 }
 817
 818 static int
 819 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 820                          struct ieee80211_sta *sta, bool enable)
 821 {
 822         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 823         u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
 824         struct bss_info_basic *bss;
 825         u8 wlan_idx = mvif->sta.wcid.idx;
 826         struct tlv *tlv;
 827
 828         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 829
 830         switch (vif->type) {
 831         case NL80211_IFTYPE_MESH_POINT:
 832         case NL80211_IFTYPE_AP:
 833                 break;
 834         case NL80211_IFTYPE_STATION:
 835                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 836                 if (enable && sta) {
 837                         struct mt7615_sta *msta;
 838
 839                         msta = (struct mt7615_sta *)sta->drv_priv;
 840                         wlan_idx = msta->wcid.idx;
 841                 }
 842                 break;
 843         case NL80211_IFTYPE_ADHOC:
 844                 type = NETWORK_IBSS;
 845                 break;
 846         default:
 847                 WARN_ON(1);
 848                 break;
 849         }
 850
 851         bss = (struct bss_info_basic *)tlv;
 852         memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 853         bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 854         bss->network_type = cpu_to_le32(type);
 855         bss->dtim_period = vif->bss_conf.dtim_period;
 856         bss->bmc_tx_wlan_idx = wlan_idx;
 857         bss->wmm_idx = mvif->wmm_idx;
 858         bss->active = enable;
 859
 860         return 0;
 861 }
 862
 863 static void
 864 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 865 {
 866         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 867         struct bss_info_omac *omac;
 868         struct tlv *tlv;
 869         u32 type = 0;
 870         u8 idx;
 871
 872         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 873
 874         switch (vif->type) {
 875         case NL80211_IFTYPE_MESH_POINT:
 876         case NL80211_IFTYPE_AP:
 877                 if (vif->p2p)
 878                         type = CONNECTION_P2P_GO;
 879                 else
 880                         type = CONNECTION_INFRA_AP;
 881                 break;
 882         case NL80211_IFTYPE_STATION:
 883                 if (vif->p2p)
 884                         type = CONNECTION_P2P_GC;
 885                 else
 886                         type = CONNECTION_INFRA_STA;
 887                 break;
 888         case NL80211_IFTYPE_ADHOC:
 889                 type = CONNECTION_IBSS_ADHOC;
 890                 break;
 891         default:
 892                 WARN_ON(1);
 893                 break;
 894         }
 895
 896         omac = (struct bss_info_omac *)tlv;
 897         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 898         omac->conn_type = cpu_to_le32(type);
 899         omac->omac_idx = mvif->omac_idx;
 900         omac->band_idx = mvif->band_idx;
 901         omac->hw_bss_idx = idx;
 902 }
 903
 904 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 905 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 906 static void
 907 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
 908 {
 909         struct bss_info_ext_bss *ext;
 910         int ext_bss_idx, tsf_offset;
 911         struct tlv *tlv;
 912
 913         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 914         if (ext_bss_idx < 0)
 915                 return;
 916
 917         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 918
 919         ext = (struct bss_info_ext_bss *)tlv;
 920         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 921         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 922 }
 923
 924 static void
 925 mt7615_mcu_sta_ba_tlv(struct sk_buff *skb,
 926                       struct ieee80211_ampdu_params *params,
 927                       bool enable, bool tx)
 928 {
 929         struct sta_rec_ba *ba;
 930         struct tlv *tlv;
 931
 932         tlv = mt7615_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
 933
 934         ba = (struct sta_rec_ba *)tlv;
 935         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
 936         ba->winsize = cpu_to_le16(params->buf_size);
 937         ba->ssn = cpu_to_le16(params->ssn);
 938         ba->ba_en = enable << params->tid;
 939         ba->amsdu = params->amsdu;
 940         ba->tid = params->tid;
 941 }
 942
 943 static void
 944 mt7615_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 945                          struct ieee80211_sta *sta, bool enable)
 946 {
 947         struct sta_rec_basic *basic;
 948         struct tlv *tlv;
 949         int conn_type;
 950
 951         tlv = mt7615_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
 952
 953         basic = (struct sta_rec_basic *)tlv;
 954         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
 955
 956         if (enable) {
 957                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
 958                 basic->conn_state = CONN_STATE_PORT_SECURE;
 959         } else {
 960                 basic->conn_state = CONN_STATE_DISCONNECT;
 961         }
 962
 963         if (!sta) {
 964                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
 965                 eth_broadcast_addr(basic->peer_addr);
 966                 return;
 967         }
 968
 969         switch (vif->type) {
 970         case NL80211_IFTYPE_MESH_POINT:
 971         case NL80211_IFTYPE_AP:
 972                 if (vif->p2p)
 973                         conn_type = CONNECTION_P2P_GC;
 974                 else
 975                         conn_type = CONNECTION_INFRA_STA;
 976                 basic->conn_type = cpu_to_le32(conn_type);
 977                 basic->aid = cpu_to_le16(sta->aid);
 978                 break;
 979         case NL80211_IFTYPE_STATION:
 980                 if (vif->p2p)
 981                         conn_type = CONNECTION_P2P_GO;
 982                 else
 983                         conn_type = CONNECTION_INFRA_AP;
 984                 basic->conn_type = cpu_to_le32(conn_type);
 985                 basic->aid = cpu_to_le16(vif->bss_conf.aid);
 986                 break;
 987         case NL80211_IFTYPE_ADHOC:
 988                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
 989                 basic->aid = cpu_to_le16(sta->aid);
 990                 break;
 991         default:
 992                 WARN_ON(1);
 993                 break;
 994         }
 995
 996         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
 997         basic->qos = sta->wme;
 998 }
 999
1000 static void
1001 mt7615_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1002 {
1003         struct tlv *tlv;
1004
1005         if (sta->ht_cap.ht_supported) {
1006                 struct sta_rec_ht *ht;
1007
1008                 tlv = mt7615_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1009                 ht = (struct sta_rec_ht *)tlv;
1010                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1011         }
1012         if (sta->vht_cap.vht_supported) {
1013                 struct sta_rec_vht *vht;
1014
1015                 tlv = mt7615_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1016                 vht = (struct sta_rec_vht *)tlv;
1017                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1018                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1019                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1020         }
1021 }
1022
1023 static void
1024 mt7615_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,
1025                      struct ieee80211_sta *sta)
1026 {
1027         struct sta_rec_uapsd *uapsd;
1028         struct tlv *tlv;
1029
1030         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1031                 return;
1032
1033         tlv = mt7615_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1034         uapsd = (struct sta_rec_uapsd *)tlv;
1035
1036         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1037                 uapsd->dac_map |= BIT(3);
1038                 uapsd->tac_map |= BIT(3);
1039         }
1040         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1041                 uapsd->dac_map |= BIT(2);
1042                 uapsd->tac_map |= BIT(2);
1043         }
1044         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1045                 uapsd->dac_map |= BIT(1);
1046                 uapsd->tac_map |= BIT(1);
1047         }
1048         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1049                 uapsd->dac_map |= BIT(0);
1050                 uapsd->tac_map |= BIT(0);
1051         }
1052         uapsd->max_sp = sta->max_sp;
1053 }
1054
1055 static void
1056 mt7615_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1057                        struct ieee80211_ampdu_params *params,
1058                        bool enable, bool tx, void *sta_wtbl,
1059                        void *wtbl_tlv)
1060 {
1061         struct wtbl_ba *ba;
1062         struct tlv *tlv;
1063
1064         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1065                                         wtbl_tlv, sta_wtbl);
1066
1067         ba = (struct wtbl_ba *)tlv;
1068         ba->tid = params->tid;
1069
1070         if (tx) {
1071                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1072                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1073                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1074                 ba->ba_en = enable;
1075         } else {
1076                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1077                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1078                 ba->rst_ba_tid = params->tid;
1079                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1080                 ba->rst_ba_sb = 1;
1081         }
1082
1083         if (enable && tx) {
1084                 u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1085                 int i;
1086
1087                 for (i = 7; i > 0; i--) {
1088                         if (params->buf_size >= ba_range[i])
1089                                 break;
1090                 }
1091                 ba->ba_winsize_idx = i;
1092         }
1093 }
1094
1095 static void
1096 mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1097                             struct ieee80211_sta *sta, void *sta_wtbl,
1098                             void *wtbl_tlv)
1099 {
1100         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1101         struct wtbl_generic *generic;
1102         struct wtbl_rx *rx;
1103         struct wtbl_spe *spe;
1104         struct tlv *tlv;
1105
1106         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1107                                         wtbl_tlv, sta_wtbl);
1108
1109         generic = (struct wtbl_generic *)tlv;
1110
1111         if (sta) {
1112                 if (vif->type == NL80211_IFTYPE_STATION)
1113                         generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
1114                 else
1115                         generic->partial_aid = cpu_to_le16(sta->aid);
1116                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1117                 generic->muar_idx = mvif->omac_idx;
1118                 generic->qos = sta->wme;
1119         } else {
1120                 eth_broadcast_addr(generic->peer_addr);
1121                 generic->muar_idx = 0xe;
1122         }
1123
1124         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1125                                         wtbl_tlv, sta_wtbl);
1126
1127         rx = (struct wtbl_rx *)tlv;
1128         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1129         rx->rca2 = 1;
1130         rx->rv = 1;
1131
1132         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
1133                                         wtbl_tlv, sta_wtbl);
1134         spe = (struct wtbl_spe *)tlv;
1135         spe->spe_idx = 24;
1136 }
1137
1138 static void
1139 mt7615_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1140                        void *sta_wtbl, void *wtbl_tlv)
1141 {
1142         struct tlv *tlv;
1143         struct wtbl_ht *ht = NULL;
1144         u32 flags = 0;
1145
1146         if (sta->ht_cap.ht_supported) {
1147                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1148                                                 wtbl_tlv, sta_wtbl);
1149                 ht = (struct wtbl_ht *)tlv;
1150                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1151                 ht->af = sta->ht_cap.ampdu_factor;
1152                 ht->mm = sta->ht_cap.ampdu_density;
1153                 ht->ht = 1;
1154
1155                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1156                         flags |= MT_WTBL_W5_SHORT_GI_20;
1157                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1158                         flags |= MT_WTBL_W5_SHORT_GI_40;
1159         }
1160
1161         if (sta->vht_cap.vht_supported) {
1162                 struct wtbl_vht *vht;
1163                 u8 af;
1164
1165                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1166                                                 wtbl_tlv, sta_wtbl);
1167                 vht = (struct wtbl_vht *)tlv;
1168                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1169                 vht->vht = 1;
1170
1171                 af = (sta->vht_cap.cap &
1172                       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
1173                       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
1174
1175                 if (ht)
1176                     ht->af = max(ht->af, af);
1177
1178                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1179                         flags |= MT_WTBL_W5_SHORT_GI_80;
1180                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1181                         flags |= MT_WTBL_W5_SHORT_GI_160;
1182         }
1183
1184         /* wtbl smps */
1185         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1186                 struct wtbl_smps *smps;
1187
1188                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1189                                                 wtbl_tlv, sta_wtbl);
1190                 smps = (struct wtbl_smps *)tlv;
1191                 smps->smps = 1;
1192         }
1193
1194         if (sta->ht_cap.ht_supported) {
1195                 /* sgi */
1196                 u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1197                           MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1198                 struct wtbl_raw *raw;
1199
1200                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
1201                                                 sizeof(*raw), wtbl_tlv,
1202                                                 sta_wtbl);
1203                 raw = (struct wtbl_raw *)tlv;
1204                 raw->val = cpu_to_le32(flags);
1205                 raw->msk = cpu_to_le32(~msk);
1206                 raw->wtbl_idx = 1;
1207                 raw->dw = 5;
1208         }
1209 }
1210
1211 static int
1212 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1213                    struct ieee80211_sta *sta, bool enable)
1214 {
1215         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1216         struct mt7615_dev *dev = phy->dev;
1217         struct sk_buff *skb;
1218
1219         skb = mt7615_mcu_alloc_sta_req(dev, mvif, NULL);
1220         if (IS_ERR(skb))
1221                 return PTR_ERR(skb);
1222
1223         if (enable)
1224                 mt7615_mcu_bss_omac_tlv(skb, vif);
1225
1226         mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
1227
1228         if (enable && mvif->omac_idx > EXT_BSSID_START)
1229                 mt7615_mcu_bss_ext_tlv(skb, mvif);
1230
1231         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1232                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1233 }
1234
1235 static int
1236 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
1237                       struct ieee80211_ampdu_params *params,
1238                       bool enable)
1239 {
1240         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1241         struct mt7615_vif *mvif = msta->vif;
1242         struct wtbl_req_hdr *wtbl_hdr;
1243         struct sk_buff *skb = NULL;
1244         int err;
1245
1246         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1247         if (IS_ERR(wtbl_hdr))
1248                 return PTR_ERR(wtbl_hdr);
1249
1250         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, NULL, wtbl_hdr);
1251
1252         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1253                                     true);
1254         if (err < 0)
1255                 return err;
1256
1257         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1258         if (IS_ERR(skb))
1259                 return PTR_ERR(skb);
1260
1261         mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1262
1263         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1264                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1265 }
1266
1267 static int
1268 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
1269                       struct ieee80211_ampdu_params *params,
1270                       bool enable)
1271 {
1272         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1273         struct mt7615_vif *mvif = msta->vif;
1274         struct wtbl_req_hdr *wtbl_hdr;
1275         struct sk_buff *skb;
1276         int err;
1277
1278         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1279         if (IS_ERR(skb))
1280                 return PTR_ERR(skb);
1281
1282         mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1283
1284         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1285                                     MCU_EXT_CMD_STA_REC_UPDATE, true);
1286         if (err < 0 || !enable)
1287                 return err;
1288
1289         skb = NULL;
1290         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1291         if (IS_ERR(wtbl_hdr))
1292                 return PTR_ERR(wtbl_hdr);
1293
1294         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, NULL, wtbl_hdr);
1295
1296         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1297                                      true);
1298 }
1299
1300 static int
1301 mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1302                         struct ieee80211_sta *sta, bool enable)
1303 {
1304         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1305         struct sk_buff *skb, *sskb, *wskb = NULL;
1306         struct wtbl_req_hdr *wtbl_hdr;
1307         struct mt7615_sta *msta;
1308         int cmd, err;
1309
1310         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1311
1312         sskb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1313         if (IS_ERR(sskb))
1314                 return PTR_ERR(sskb);
1315
1316         mt7615_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1317         if (enable && sta) {
1318                 mt7615_mcu_sta_ht_tlv(sskb, sta);
1319                 mt7615_mcu_sta_uapsd(sskb, vif, sta);
1320         }
1321
1322         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1323                                              NULL, &wskb);
1324         if (IS_ERR(wtbl_hdr))
1325                 return PTR_ERR(wtbl_hdr);
1326
1327         if (enable) {
1328                 mt7615_mcu_wtbl_generic_tlv(wskb, vif, sta, NULL, wtbl_hdr);
1329                 if (sta)
1330                         mt7615_mcu_wtbl_ht_tlv(wskb, sta, NULL, wtbl_hdr);
1331         }
1332
1333         cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1334         skb = enable ? wskb : sskb;
1335
1336         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1337         if (err < 0) {
1338                 skb = enable ? sskb : wskb;
1339                 dev_kfree_skb(skb);
1340
1341                 return err;
1342         }
1343
1344         cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1345         skb = enable ? sskb : wskb;
1346
1347         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1348 }
1349
1350 static const struct mt7615_mcu_ops wtbl_update_ops = {
1351         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1352         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1353         .add_dev_info = mt7615_mcu_add_dev,
1354         .add_bss_info = mt7615_mcu_add_bss,
1355         .add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1356         .add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1357         .sta_add = mt7615_mcu_wtbl_sta_add,
1358         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1359         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1360 };
1361
1362 static int
1363 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1364                   struct ieee80211_ampdu_params *params,
1365                   bool enable, bool tx)
1366 {
1367         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1368         struct mt7615_vif *mvif = msta->vif;
1369         struct wtbl_req_hdr *wtbl_hdr;
1370         struct tlv *sta_wtbl;
1371         struct sk_buff *skb;
1372
1373         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1374         if (IS_ERR(skb))
1375                 return PTR_ERR(skb);
1376
1377         mt7615_mcu_sta_ba_tlv(skb, params, enable, tx);
1378
1379         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1380
1381         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1382                                              &skb);
1383         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1384
1385         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1386                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1387 }
1388
1389 static int
1390 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1391                      struct ieee80211_ampdu_params *params,
1392                      bool enable)
1393 {
1394         return mt7615_mcu_sta_ba(dev, params, enable, true);
1395 }
1396
1397 static int
1398 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1399                      struct ieee80211_ampdu_params *params,
1400                      bool enable)
1401 {
1402         return mt7615_mcu_sta_ba(dev, params, enable, false);
1403 }
1404
1405 static int
1406 mt7615_mcu_add_sta_cmd(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1407                        struct ieee80211_sta *sta, bool enable, int cmd)
1408 {
1409         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1410         struct wtbl_req_hdr *wtbl_hdr;
1411         struct mt7615_sta *msta;
1412         struct tlv *sta_wtbl;
1413         struct sk_buff *skb;
1414
1415         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1416
1417         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1418         if (IS_ERR(skb))
1419                 return PTR_ERR(skb);
1420
1421         mt7615_mcu_sta_basic_tlv(skb, vif, sta, enable);
1422         if (enable && sta) {
1423                 mt7615_mcu_sta_ht_tlv(skb, sta);
1424                 mt7615_mcu_sta_uapsd(skb, vif, sta);
1425         }
1426
1427         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1428
1429         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1430                                              sta_wtbl, &skb);
1431         if (enable) {
1432                 mt7615_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
1433                 if (sta)
1434                         mt7615_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1435         }
1436
1437         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1438 }
1439
1440 static int
1441 mt7615_mcu_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1442                    struct ieee80211_sta *sta, bool enable)
1443 {
1444         return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1445                                       MCU_EXT_CMD_STA_REC_UPDATE);
1446 }
1447
1448 static const struct mt7615_mcu_ops sta_update_ops = {
1449         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1450         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1451         .add_dev_info = mt7615_mcu_add_dev,
1452         .add_bss_info = mt7615_mcu_add_bss,
1453         .add_tx_ba = mt7615_mcu_sta_tx_ba,
1454         .add_rx_ba = mt7615_mcu_sta_rx_ba,
1455         .sta_add = mt7615_mcu_add_sta,
1456         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1457         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1458 };
1459
1460 static int
1461 mt7615_mcu_uni_add_dev(struct mt7615_dev *dev,
1462                        struct ieee80211_vif *vif, bool enable)
1463 {
1464         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1465         struct {
1466                 struct {
1467                         u8 omac_idx;
1468                         u8 band_idx;
1469                         __le16 pad;
1470                 } __packed hdr;
1471                 struct req_tlv {
1472                         __le16 tag;
1473                         __le16 len;
1474                         u8 active;
1475                         u8 pad;
1476                         u8 omac_addr[ETH_ALEN];
1477                 } __packed tlv;
1478         } dev_req = {
1479                 .hdr = {
1480                         .omac_idx = mvif->omac_idx,
1481                         .band_idx = mvif->band_idx,
1482                 },
1483                 .tlv = {
1484                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
1485                         .len = cpu_to_le16(sizeof(struct req_tlv)),
1486                         .active = enable,
1487                 },
1488         };
1489         struct {
1490                 struct {
1491                         u8 bss_idx;
1492                         u8 pad[3];
1493                 } __packed hdr;
1494                 struct mt7615_bss_basic_tlv basic;
1495         } basic_req = {
1496                 .hdr = {
1497                         .bss_idx = mvif->idx,
1498                 },
1499                 .basic = {
1500                         .tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1501                         .len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1502                         .omac_idx = mvif->omac_idx,
1503                         .band_idx = mvif->band_idx,
1504                         .wmm_idx = mvif->wmm_idx,
1505                         .active = enable,
1506                         .bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx),
1507                         .sta_idx = cpu_to_le16(mvif->sta.wcid.idx),
1508                         .conn_state = 1,
1509                 },
1510         };
1511         int err, idx, cmd, len;
1512         void *data;
1513
1514         switch (vif->type) {
1515         case NL80211_IFTYPE_MESH_POINT:
1516         case NL80211_IFTYPE_AP:
1517                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1518                 break;
1519         case NL80211_IFTYPE_STATION:
1520                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1521                 break;
1522         case NL80211_IFTYPE_ADHOC:
1523                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1524                 break;
1525         default:
1526                 WARN_ON(1);
1527                 break;
1528         }
1529
1530         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1531         basic_req.basic.hw_bss_idx = idx;
1532
1533         memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1534
1535         cmd = enable ? MCU_UNI_CMD_DEV_INFO_UPDATE : MCU_UNI_CMD_BSS_INFO_UPDATE;
1536         data = enable ? (void *)&dev_req : (void *)&basic_req;
1537         len = enable ? sizeof(dev_req) : sizeof(basic_req);
1538
1539         err = mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1540         if (err < 0)
1541                 return err;
1542
1543         cmd = enable ? MCU_UNI_CMD_BSS_INFO_UPDATE : MCU_UNI_CMD_DEV_INFO_UPDATE;
1544         data = enable ? (void *)&basic_req : (void *)&dev_req;
1545         len = enable ? sizeof(basic_req) : sizeof(dev_req);
1546
1547         return mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1548 }
1549
1550 static int
1551 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1552 {
1553         return 0;
1554 }
1555
1556 static int
1557 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1558                        struct ieee80211_sta *sta, bool enable)
1559 {
1560         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1561         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1562         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1563         struct mt7615_dev *dev = phy->dev;
1564         struct {
1565                 struct {
1566                         u8 bss_idx;
1567                         u8 pad[3];
1568                 } __packed hdr;
1569                 struct mt7615_bss_basic_tlv basic;
1570                 struct mt7615_bss_qos_tlv qos;
1571         } basic_req = {
1572                 .hdr = {
1573                         .bss_idx = mvif->idx,
1574                 },
1575                 .basic = {
1576                         .tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1577                         .len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1578                         .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1579                         .dtim_period = vif->bss_conf.dtim_period,
1580                         .omac_idx = mvif->omac_idx,
1581                         .band_idx = mvif->band_idx,
1582                         .wmm_idx = mvif->wmm_idx,
1583                         .active = true, /* keep bss deactivated */
1584                         .phymode = 0x38,
1585                 },
1586                 .qos = {
1587                         .tag = cpu_to_le16(UNI_BSS_INFO_QBSS),
1588                         .len = cpu_to_le16(sizeof(struct mt7615_bss_qos_tlv)),
1589                         .qos = vif->bss_conf.qos,
1590                 },
1591         };
1592         struct {
1593                 struct {
1594                         u8 bss_idx;
1595                         u8 pad[3];
1596                 } __packed hdr;
1597                 struct rlm_tlv {
1598                         __le16 tag;
1599                         __le16 len;
1600                         u8 control_channel;
1601                         u8 center_chan;
1602                         u8 center_chan2;
1603                         u8 bw;
1604                         u8 tx_streams;
1605                         u8 rx_streams;
1606                         u8 short_st;
1607                         u8 ht_op_info;
1608                         u8 sco;
1609                         u8 pad[3];
1610                 } __packed rlm;
1611         } __packed rlm_req = {
1612                 .hdr = {
1613                         .bss_idx = mvif->idx,
1614                 },
1615                 .rlm = {
1616                         .tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1617                         .len = cpu_to_le16(sizeof(struct rlm_tlv)),
1618                         .control_channel = chandef->chan->hw_value,
1619                         .center_chan = ieee80211_frequency_to_channel(freq1),
1620                         .center_chan2 = ieee80211_frequency_to_channel(freq2),
1621                         .tx_streams = hweight8(phy->mt76->antenna_mask),
1622                         .rx_streams = phy->chainmask,
1623                         .short_st = true,
1624                 },
1625         };
1626         int err, conn_type;
1627         u8 idx;
1628
1629         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1630         basic_req.basic.hw_bss_idx = idx;
1631
1632         switch (vif->type) {
1633         case NL80211_IFTYPE_MESH_POINT:
1634         case NL80211_IFTYPE_AP:
1635                 if (vif->p2p)
1636                         conn_type = CONNECTION_P2P_GO;
1637                 else
1638                         conn_type = CONNECTION_INFRA_AP;
1639                 basic_req.basic.conn_type = cpu_to_le32(conn_type);
1640                 break;
1641         case NL80211_IFTYPE_STATION:
1642                 if (vif->p2p)
1643                         conn_type = CONNECTION_P2P_GC;
1644                 else
1645                         conn_type = CONNECTION_INFRA_STA;
1646                 basic_req.basic.conn_type = cpu_to_le32(conn_type);
1647                 break;
1648         case NL80211_IFTYPE_ADHOC:
1649                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1650                 break;
1651         default:
1652                 WARN_ON(1);
1653                 break;
1654         }
1655
1656         memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1657         basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx);
1658         basic_req.basic.sta_idx = cpu_to_le16(mvif->sta.wcid.idx);
1659         basic_req.basic.conn_state = !enable;
1660
1661         err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1662                                 &basic_req, sizeof(basic_req), true);
1663         if (err < 0)
1664                 return err;
1665
1666         switch (chandef->width) {
1667         case NL80211_CHAN_WIDTH_40:
1668                 rlm_req.rlm.bw = CMD_CBW_40MHZ;
1669                 break;
1670         case NL80211_CHAN_WIDTH_80:
1671                 rlm_req.rlm.bw = CMD_CBW_80MHZ;
1672                 break;
1673         case NL80211_CHAN_WIDTH_80P80:
1674                 rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1675                 break;
1676         case NL80211_CHAN_WIDTH_160:
1677                 rlm_req.rlm.bw = CMD_CBW_160MHZ;
1678                 break;
1679         case NL80211_CHAN_WIDTH_5:
1680                 rlm_req.rlm.bw = CMD_CBW_5MHZ;
1681                 break;
1682         case NL80211_CHAN_WIDTH_10:
1683                 rlm_req.rlm.bw = CMD_CBW_10MHZ;
1684                 break;
1685         case NL80211_CHAN_WIDTH_20_NOHT:
1686         case NL80211_CHAN_WIDTH_20:
1687         default:
1688                 rlm_req.rlm.bw = CMD_CBW_20MHZ;
1689                 break;
1690         }
1691
1692         if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1693                 rlm_req.rlm.sco = 1; /* SCA */
1694         else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1695                 rlm_req.rlm.sco = 3; /* SCB */
1696
1697         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1698                                  &rlm_req, sizeof(rlm_req), true);
1699 }
1700
1701 static int
1702 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1703                                   struct ieee80211_hw *hw,
1704                                   struct ieee80211_vif *vif,
1705                                   bool enable)
1706 {
1707         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1708         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1709         struct ieee80211_mutable_offsets offs;
1710         struct {
1711                 struct req_hdr {
1712                         u8 bss_idx;
1713                         u8 pad[3];
1714                 } __packed hdr;
1715                 struct bcn_content_tlv {
1716                         __le16 tag;
1717                         __le16 len;
1718                         __le16 tim_ie_pos;
1719                         __le16 csa_ie_pos;
1720                         __le16 bcc_ie_pos;
1721                         /* 0: enable beacon offload
1722                          * 1: disable beacon offload
1723                          * 2: update probe respond offload
1724                          */
1725                         u8 enable;
1726                         /* 0: legacy format (TXD + payload)
1727                          * 1: only cap field IE
1728                          */
1729                         u8 type;
1730                         __le16 pkt_len;
1731                         u8 pkt[512];
1732                 } __packed beacon_tlv;
1733         } req = {
1734                 .hdr = {
1735                         .bss_idx = mvif->idx,
1736                 },
1737                 .beacon_tlv = {
1738                         .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1739                         .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1740                         .enable = enable,
1741                 },
1742         };
1743         struct sk_buff *skb;
1744
1745         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1746         if (!skb)
1747                 return -EINVAL;
1748
1749         if (skb->len > 512 - MT_TXD_SIZE) {
1750                 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1751                 dev_kfree_skb(skb);
1752                 return -EINVAL;
1753         }
1754
1755         mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1756                               wcid, NULL, 0, NULL, true);
1757         memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1758         req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1759         req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1760
1761         if (offs.cntdwn_counter_offs[0]) {
1762                 u16 csa_offs;
1763
1764                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1765                 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1766         }
1767         dev_kfree_skb(skb);
1768
1769         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1770                                  &req, sizeof(req), true);
1771 }
1772
1773 static int
1774 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1775                      struct ieee80211_ampdu_params *params,
1776                      bool enable)
1777 {
1778         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1779         struct mt7615_vif *mvif = msta->vif;
1780         struct wtbl_req_hdr *wtbl_hdr;
1781         struct tlv *sta_wtbl;
1782         struct sk_buff *skb;
1783         int err;
1784
1785         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1786         if (IS_ERR(skb))
1787                 return PTR_ERR(skb);
1788
1789         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1790
1791         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1792                                              &skb);
1793         if (IS_ERR(wtbl_hdr))
1794                 return PTR_ERR(wtbl_hdr);
1795
1796         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, sta_wtbl,
1797                                wtbl_hdr);
1798
1799         err =  mt76_mcu_skb_send_msg(&dev->mt76, skb,
1800                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1801         if (err < 0)
1802                 return err;
1803
1804         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1805         if (IS_ERR(skb))
1806                 return PTR_ERR(skb);
1807
1808         mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1809
1810         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1811                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1812 }
1813
1814 static int
1815 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1816                      struct ieee80211_ampdu_params *params,
1817                      bool enable)
1818 {
1819         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1820         struct mt7615_vif *mvif = msta->vif;
1821         struct wtbl_req_hdr *wtbl_hdr;
1822         struct tlv *sta_wtbl;
1823         struct sk_buff *skb;
1824         int err;
1825
1826         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1827         if (IS_ERR(skb))
1828                 return PTR_ERR(skb);
1829
1830         mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1831
1832         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1833                                     MCU_UNI_CMD_STA_REC_UPDATE, true);
1834         if (err < 0 || !enable)
1835                 return err;
1836
1837         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1838         if (IS_ERR(skb))
1839                 return PTR_ERR(skb);
1840
1841         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1842
1843         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1844                                              &skb);
1845         if (IS_ERR(wtbl_hdr))
1846                 return PTR_ERR(wtbl_hdr);
1847
1848         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, sta_wtbl,
1849                                wtbl_hdr);
1850
1851         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1852                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1853 }
1854
1855 static int
1856 mt7615_mcu_uni_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1857                        struct ieee80211_sta *sta, bool enable)
1858 {
1859         return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1860                                       MCU_UNI_CMD_STA_REC_UPDATE);
1861 }
1862
1863 static const struct mt7615_mcu_ops uni_update_ops = {
1864         .add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1865         .set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1866         .add_dev_info = mt7615_mcu_uni_add_dev,
1867         .add_bss_info = mt7615_mcu_uni_add_bss,
1868         .add_tx_ba = mt7615_mcu_uni_tx_ba,
1869         .add_rx_ba = mt7615_mcu_uni_rx_ba,
1870         .sta_add = mt7615_mcu_uni_add_sta,
1871         .set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1872         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1873 };
1874
1875 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
1876                                     int len)
1877 {
1878         int ret = 0, cur_len;
1879
1880         while (len > 0) {
1881                 cur_len = min_t(int, 4096 - dev->mt76.mcu_ops->headroom, len);
1882
1883                 ret = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_SCATTER, data,
1884                                         cur_len, false);
1885                 if (ret)
1886                         break;
1887
1888                 data += cur_len;
1889                 len -= cur_len;
1890
1891                 if (mt76_is_mmio(&dev->mt76))
1892                         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
1893         }
1894
1895         return ret;
1896 }
1897
1898 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
1899                                      u32 option)
1900 {
1901         struct {
1902                 __le32 option;
1903                 __le32 addr;
1904         } req = {
1905                 .option = cpu_to_le32(option),
1906                 .addr = cpu_to_le32(addr),
1907         };
1908
1909         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_START_REQ, &req,
1910                                  sizeof(req), true);
1911 }
1912
1913 int mt7615_mcu_restart(struct mt76_dev *dev)
1914 {
1915         return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1916 }
1917 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1918
1919 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
1920 {
1921         struct {
1922                 __le32 op;
1923         } req = {
1924                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
1925         };
1926
1927         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_SEM_CONTROL, &req,
1928                                  sizeof(req), true);
1929 }
1930
1931 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
1932 {
1933         struct {
1934                 u8 check_crc;
1935                 u8 reserved[3];
1936         } req = {
1937                 .check_crc = 0,
1938         };
1939
1940         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_FINISH_REQ, &req,
1941                                  sizeof(req), true);
1942 }
1943
1944 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1945 {
1946         const struct mt7615_patch_hdr *hdr;
1947         const struct firmware *fw = NULL;
1948         int len, ret, sem;
1949
1950         sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
1951         switch (sem) {
1952         case PATCH_IS_DL:
1953                 return 0;
1954         case PATCH_NOT_DL_SEM_SUCCESS:
1955                 break;
1956         default:
1957                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1958                 return -EAGAIN;
1959         }
1960
1961         ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1962         if (ret)
1963                 goto out;
1964
1965         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1966                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1967                 ret = -EINVAL;
1968                 goto out;
1969         }
1970
1971         hdr = (const struct mt7615_patch_hdr *)(fw->data);
1972
1973         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1974                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1975
1976         len = fw->size - sizeof(*hdr);
1977
1978         ret = mt7615_mcu_init_download(dev, addr, len, DL_MODE_NEED_RSP);
1979         if (ret) {
1980                 dev_err(dev->mt76.dev, "Download request failed\n");
1981                 goto out;
1982         }
1983
1984         ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
1985         if (ret) {
1986                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1987                 goto out;
1988         }
1989
1990         ret = mt7615_mcu_start_patch(dev);
1991         if (ret)
1992                 dev_err(dev->mt76.dev, "Failed to start patch\n");
1993
1994 out:
1995         release_firmware(fw);
1996
1997         sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
1998         switch (sem) {
1999         case PATCH_REL_SEM_SUCCESS:
2000                 break;
2001         default:
2002                 ret = -EAGAIN;
2003                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2004                 break;
2005         }
2006
2007         return ret;
2008 }
2009
2010 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
2011 {
2012         u32 ret = 0;
2013
2014         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2015                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2016         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2017                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2018         ret |= DL_MODE_NEED_RSP;
2019         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
2020
2021         return ret;
2022 }
2023
2024 static int
2025 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
2026                              const struct mt7615_fw_trailer *hdr,
2027                              const u8 *data, bool is_cr4)
2028 {
2029         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
2030         int err, i, offset = 0;
2031         u32 len, addr, mode;
2032
2033         for (i = 0; i < n_region; i++) {
2034                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
2035                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
2036                 addr = le32_to_cpu(hdr[i].addr);
2037
2038                 err = mt7615_mcu_init_download(dev, addr, len, mode);
2039                 if (err) {
2040                         dev_err(dev->mt76.dev, "Download request failed\n");
2041                         return err;
2042                 }
2043
2044                 err = mt7615_mcu_send_firmware(dev, data + offset, len);
2045                 if (err) {
2046                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2047                         return err;
2048                 }
2049
2050                 offset += len;
2051         }
2052
2053         return 0;
2054 }
2055
2056 static const struct wiphy_wowlan_support mt7615_wowlan_support = {
2057         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
2058                  WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
2059         .n_patterns = 1,
2060         .pattern_min_len = 1,
2061         .pattern_max_len = MT7615_WOW_PATTEN_MAX_LEN,
2062         .max_nd_match_sets = 10,
2063 };
2064
2065 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
2066 {
2067         const struct mt7615_fw_trailer *hdr;
2068         const struct firmware *fw;
2069         int ret;
2070
2071         ret = request_firmware(&fw, name, dev->mt76.dev);
2072         if (ret)
2073                 return ret;
2074
2075         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
2076                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2077                 ret = -EINVAL;
2078                 goto out;
2079         }
2080
2081         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2082                                         N9_REGION_NUM * sizeof(*hdr));
2083
2084         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2085                  hdr->fw_ver, hdr->build_date);
2086
2087         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2088         if (ret)
2089                 goto out;
2090
2091         ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
2092                                         FW_START_OVERRIDE);
2093         if (ret) {
2094                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2095                 goto out;
2096         }
2097
2098         snprintf(dev->mt76.hw->wiphy->fw_version,
2099                  sizeof(dev->mt76.hw->wiphy->fw_version),
2100                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2101
2102         if (!is_mt7615(&dev->mt76) &&
2103             !strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
2104                 dev->fw_ver = MT7615_FIRMWARE_V2;
2105                 dev->mcu_ops = &sta_update_ops;
2106         } else {
2107                 dev->fw_ver = MT7615_FIRMWARE_V1;
2108                 dev->mcu_ops = &wtbl_update_ops;
2109         }
2110
2111 out:
2112         release_firmware(fw);
2113         return ret;
2114 }
2115
2116 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
2117 {
2118         const struct mt7615_fw_trailer *hdr;
2119         const struct firmware *fw;
2120         int ret;
2121
2122         ret = request_firmware(&fw, name, dev->mt76.dev);
2123         if (ret)
2124                 return ret;
2125
2126         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
2127                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2128                 ret = -EINVAL;
2129                 goto out;
2130         }
2131
2132         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2133                                         CR4_REGION_NUM * sizeof(*hdr));
2134
2135         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
2136                  hdr->fw_ver, hdr->build_date);
2137
2138         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2139         if (ret)
2140                 goto out;
2141
2142         ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
2143         if (ret) {
2144                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
2145                 goto out;
2146         }
2147
2148 out:
2149         release_firmware(fw);
2150
2151         return ret;
2152 }
2153
2154 static int mt7615_load_ram(struct mt7615_dev *dev)
2155 {
2156         int ret;
2157
2158         ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
2159         if (ret)
2160                 return ret;
2161
2162         return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
2163 }
2164
2165 static int mt7615_load_firmware(struct mt7615_dev *dev)
2166 {
2167         int ret;
2168         u32 val;
2169
2170         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
2171
2172         if (val != FW_STATE_FW_DOWNLOAD) {
2173                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2174                 return -EIO;
2175         }
2176
2177         ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
2178         if (ret)
2179                 return ret;
2180
2181         ret = mt7615_load_ram(dev);
2182         if (ret)
2183                 return ret;
2184
2185         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
2186                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
2187                                        FW_STATE_CR4_RDY), 500)) {
2188                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2189                 return -EIO;
2190         }
2191
2192         return 0;
2193 }
2194
2195 static int mt7622_load_firmware(struct mt7615_dev *dev)
2196 {
2197         int ret;
2198         u32 val;
2199
2200         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2201
2202         val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
2203         if (val != FW_STATE_FW_DOWNLOAD) {
2204                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2205                 return -EIO;
2206         }
2207
2208         ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
2209         if (ret)
2210                 return ret;
2211
2212         ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
2213         if (ret)
2214                 return ret;
2215
2216         if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
2217                             FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
2218                                        FW_STATE_NORMAL_TRX), 1500)) {
2219                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2220                 return -EIO;
2221         }
2222
2223         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2224
2225         return 0;
2226 }
2227
2228 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
2229 {
2230         struct {
2231                 u8 ctrl_val;
2232                 u8 pad[3];
2233         } data = {
2234                 .ctrl_val = ctrl
2235         };
2236
2237         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
2238                                  sizeof(data), true);
2239 }
2240
2241 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
2242 {
2243         u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
2244         const struct mt7663_fw_trailer *hdr;
2245         const struct mt7663_fw_buf *buf;
2246         const struct firmware *fw;
2247         const u8 *base_addr;
2248         int i, ret;
2249
2250         ret = request_firmware(&fw, name, dev->mt76.dev);
2251         if (ret)
2252                 return ret;
2253
2254         if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
2255                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2256                 ret = -EINVAL;
2257                 goto out;
2258         }
2259
2260         hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
2261                                                  FW_V3_COMMON_TAILER_SIZE);
2262
2263         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2264                  hdr->fw_ver, hdr->build_date);
2265         dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
2266
2267         base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
2268         for (i = 0; i < hdr->n_region; i++) {
2269                 u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
2270                 u32 len, addr, mode;
2271
2272                 dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
2273
2274                 buf = (const struct mt7663_fw_buf *)(base_addr - shift);
2275                 mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
2276                 addr = le32_to_cpu(buf->img_dest_addr);
2277                 len = le32_to_cpu(buf->img_size);
2278
2279                 ret = mt7615_mcu_init_download(dev, addr, len, mode);
2280                 if (ret) {
2281                         dev_err(dev->mt76.dev, "Download request failed\n");
2282                         goto out;
2283                 }
2284
2285                 ret = mt7615_mcu_send_firmware(dev, fw->data + offset, len);
2286                 if (ret) {
2287                         dev_err(dev->mt76.dev, "Failed to send firmware\n");
2288                         goto out;
2289                 }
2290
2291                 offset += le32_to_cpu(buf->img_size);
2292                 if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
2293                         override_addr = le32_to_cpu(buf->img_dest_addr);
2294                         dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
2295                                  i, override_addr);
2296                 }
2297         }
2298
2299         if (override_addr)
2300                 flag |= FW_START_OVERRIDE;
2301
2302         dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
2303                  override_addr, flag);
2304
2305         ret = mt7615_mcu_start_firmware(dev, override_addr, flag);
2306         if (ret) {
2307                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2308                 goto out;
2309         }
2310
2311         snprintf(dev->mt76.hw->wiphy->fw_version,
2312                  sizeof(dev->mt76.hw->wiphy->fw_version),
2313                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2314
2315 out:
2316         release_firmware(fw);
2317
2318         return ret;
2319 }
2320
2321 static int
2322 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
2323 {
2324         const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
2325         const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
2326         int ret;
2327
2328         if (!prefer_offload_fw) {
2329                 secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
2330                 primary_rom = MT7663_ROM_PATCH;
2331         }
2332         selected_rom = primary_rom;
2333
2334         ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
2335         if (ret) {
2336                 dev_info(dev->mt76.dev, "%s not found, switching to %s",
2337                          primary_rom, secondary_rom);
2338                 ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
2339                                         secondary_rom);
2340                 if (ret) {
2341                         dev_err(dev->mt76.dev, "failed to load %s",
2342                                 secondary_rom);
2343                         return ret;
2344                 }
2345                 selected_rom = secondary_rom;
2346         }
2347
2348         if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
2349                 *n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
2350                 dev->fw_ver = MT7615_FIRMWARE_V3;
2351                 dev->mcu_ops = &uni_update_ops;
2352         } else {
2353                 *n9_firmware = MT7663_FIRMWARE_N9;
2354                 dev->fw_ver = MT7615_FIRMWARE_V2;
2355                 dev->mcu_ops = &sta_update_ops;
2356         }
2357
2358         return 0;
2359 }
2360
2361 int __mt7663_load_firmware(struct mt7615_dev *dev)
2362 {
2363         const char *n9_firmware;
2364         int ret;
2365
2366         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
2367         if (ret) {
2368                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
2369                 return -EIO;
2370         }
2371
2372         ret = mt7663_load_rom_patch(dev, &n9_firmware);
2373         if (ret)
2374                 return ret;
2375
2376         ret = mt7663_load_n9(dev, n9_firmware);
2377         if (ret)
2378                 return ret;
2379
2380         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
2381                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
2382                 ret = mt76_get_field(dev, MT_CONN_ON_MISC,
2383                                      MT7663_TOP_MISC2_FW_STATE);
2384                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2385                 return -EIO;
2386         }
2387
2388 #ifdef CONFIG_PM
2389         if (mt7615_firmware_offload(dev))
2390                 dev->mt76.hw->wiphy->wowlan = &mt7615_wowlan_support;
2391 #endif /* CONFIG_PM */
2392
2393         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2394
2395         return 0;
2396 }
2397 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
2398
2399 static int mt7663_load_firmware(struct mt7615_dev *dev)
2400 {
2401         int ret;
2402
2403         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2404
2405         ret = __mt7663_load_firmware(dev);
2406         if (ret)
2407                 return ret;
2408
2409         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2410
2411         return 0;
2412 }
2413
2414 int mt7615_mcu_init(struct mt7615_dev *dev)
2415 {
2416         static const struct mt76_mcu_ops mt7615_mcu_ops = {
2417                 .headroom = sizeof(struct mt7615_mcu_txd),
2418                 .mcu_skb_send_msg = mt7615_mcu_send_message,
2419                 .mcu_parse_response = mt7615_mcu_parse_response,
2420                 .mcu_restart = mt7615_mcu_restart,
2421         };
2422         int ret;
2423
2424         dev->mt76.mcu_ops = &mt7615_mcu_ops,
2425
2426         ret = mt7615_mcu_drv_pmctrl(dev);
2427         if (ret)
2428                 return ret;
2429
2430         switch (mt76_chip(&dev->mt76)) {
2431         case 0x7622:
2432                 ret = mt7622_load_firmware(dev);
2433                 break;
2434         case 0x7663:
2435                 ret = mt7663_load_firmware(dev);
2436                 break;
2437         default:
2438                 ret = mt7615_load_firmware(dev);
2439                 break;
2440         }
2441         if (ret)
2442                 return ret;
2443
2444         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2445         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2446         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2447         mt7615_mcu_fw_log_2_host(dev, 0);
2448
2449         return 0;
2450 }
2451 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
2452
2453 void mt7615_mcu_exit(struct mt7615_dev *dev)
2454 {
2455         __mt76_mcu_restart(&dev->mt76);
2456         mt7615_mcu_set_fw_ctrl(dev);
2457         skb_queue_purge(&dev->mt76.mcu.res_q);
2458 }
2459 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
2460
2461 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
2462 {
2463         struct {
2464                 u8 buffer_mode;
2465                 u8 content_format;
2466                 __le16 len;
2467         } __packed req_hdr = {
2468                 .buffer_mode = 1,
2469         };
2470         u8 *eep = (u8 *)dev->mt76.eeprom.data;
2471         struct sk_buff *skb;
2472         int eep_len, offset;
2473
2474         switch (mt76_chip(&dev->mt76)) {
2475         case 0x7622:
2476                 eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
2477                 offset = MT_EE_NIC_CONF_0;
2478                 break;
2479         case 0x7663:
2480                 eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
2481                 req_hdr.content_format = 1;
2482                 offset = MT_EE_CHIP_ID;
2483                 break;
2484         default:
2485                 eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
2486                 offset = MT_EE_NIC_CONF_0;
2487                 break;
2488         }
2489
2490         req_hdr.len = cpu_to_le16(eep_len);
2491
2492         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
2493         if (!skb)
2494                 return -ENOMEM;
2495
2496         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2497         skb_put_data(skb, eep + offset, eep_len);
2498
2499         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2500                                      MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
2501 }
2502 EXPORT_SYMBOL_GPL(mt7615_mcu_set_eeprom);
2503
2504 int mt7615_mcu_set_mac_enable(struct mt7615_dev *dev, int band, bool enable)
2505 {
2506         struct {
2507                 u8 enable;
2508                 u8 band;
2509                 u8 rsv[2];
2510         } __packed req = {
2511                 .enable = enable,
2512                 .band = band,
2513         };
2514
2515         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL, &req,
2516                                  sizeof(req), true);
2517 }
2518
2519 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
2520 {
2521         struct mt7615_dev *dev = phy->dev;
2522         struct {
2523                 u8 prot_idx;
2524                 u8 band;
2525                 u8 rsv[2];
2526                 __le32 len_thresh;
2527                 __le32 pkt_thresh;
2528         } __packed req = {
2529                 .prot_idx = 1,
2530                 .band = phy != &dev->phy,
2531                 .len_thresh = cpu_to_le32(val),
2532                 .pkt_thresh = cpu_to_le32(0x2),
2533         };
2534
2535         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL, &req,
2536                                  sizeof(req), true);
2537 }
2538
2539 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
2540                        const struct ieee80211_tx_queue_params *params)
2541 {
2542 #define WMM_AIFS_SET    BIT(0)
2543 #define WMM_CW_MIN_SET  BIT(1)
2544 #define WMM_CW_MAX_SET  BIT(2)
2545 #define WMM_TXOP_SET    BIT(3)
2546 #define WMM_PARAM_SET   (WMM_AIFS_SET | WMM_CW_MIN_SET | \
2547                          WMM_CW_MAX_SET | WMM_TXOP_SET)
2548         struct req_data {
2549                 u8 number;
2550                 u8 rsv[3];
2551                 u8 queue;
2552                 u8 valid;
2553                 u8 aifs;
2554                 u8 cw_min;
2555                 __le16 cw_max;
2556                 __le16 txop;
2557         } __packed req = {
2558                 .number = 1,
2559                 .queue = queue,
2560                 .valid = WMM_PARAM_SET,
2561                 .aifs = params->aifs,
2562                 .cw_min = 5,
2563                 .cw_max = cpu_to_le16(10),
2564                 .txop = cpu_to_le16(params->txop),
2565         };
2566
2567         if (params->cw_min)
2568                 req.cw_min = fls(params->cw_min);
2569         if (params->cw_max)
2570                 req.cw_max = cpu_to_le16(fls(params->cw_max));
2571
2572         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
2573                                  sizeof(req), true);
2574 }
2575
2576 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
2577 {
2578         struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2579         struct dbdc_entry {
2580                 u8 type;
2581                 u8 index;
2582                 u8 band;
2583                 u8 _rsv;
2584         };
2585         struct {
2586                 u8 enable;
2587                 u8 num;
2588                 u8 _rsv[2];
2589                 struct dbdc_entry entry[64];
2590         } req = {
2591                 .enable = !!ext_phy,
2592         };
2593         int i;
2594
2595         if (!ext_phy)
2596                 goto out;
2597
2598 #define ADD_DBDC_ENTRY(_type, _idx, _band)              \
2599         do { \
2600                 req.entry[req.num].type = _type;                \
2601                 req.entry[req.num].index = _idx;                \
2602                 req.entry[req.num++].band = _band;              \
2603         } while (0)
2604
2605         for (i = 0; i < 4; i++) {
2606                 bool band = !!(ext_phy->omac_mask & BIT(i));
2607
2608                 ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2609         }
2610
2611         for (i = 0; i < 14; i++) {
2612                 bool band = !!(ext_phy->omac_mask & BIT(0x11 + i));
2613
2614                 ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2615         }
2616
2617         ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2618
2619         for (i = 0; i < 3; i++)
2620                 ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2621
2622         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2623         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2624         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2625         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2626
2627         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2628         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2629
2630 out:
2631         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
2632                                  sizeof(req), true);
2633 }
2634
2635 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2636 {
2637         struct wtbl_req_hdr req = {
2638                 .operation = WTBL_RESET_ALL,
2639         };
2640
2641         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
2642                                  sizeof(req), true);
2643 }
2644 EXPORT_SYMBOL_GPL(mt7615_mcu_del_wtbl_all);
2645
2646 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2647                        enum mt7615_rdd_cmd cmd, u8 index,
2648                        u8 rx_sel, u8 val)
2649 {
2650         struct {
2651                 u8 ctrl;
2652                 u8 rdd_idx;
2653                 u8 rdd_rx_sel;
2654                 u8 val;
2655                 u8 rsv[4];
2656         } req = {
2657                 .ctrl = cmd,
2658                 .rdd_idx = index,
2659                 .rdd_rx_sel = rx_sel,
2660                 .val = val,
2661         };
2662
2663         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
2664                                  sizeof(req), true);
2665 }
2666
2667 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2668 {
2669         struct {
2670                 u16 tag;
2671                 u16 min_lpn;
2672         } req = {
2673                 .tag = 0x1,
2674                 .min_lpn = val,
2675         };
2676
2677         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2678                                  sizeof(req), true);
2679 }
2680
2681 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2682                             const struct mt7615_dfs_pulse *pulse)
2683 {
2684         struct {
2685                 u16 tag;
2686                 struct mt7615_dfs_pulse pulse;
2687         } req = {
2688                 .tag = 0x3,
2689         };
2690
2691         memcpy(&req.pulse, pulse, sizeof(*pulse));
2692
2693         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2694                                  sizeof(req), true);
2695 }
2696
2697 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2698                             const struct mt7615_dfs_pattern *pattern)
2699 {
2700         struct {
2701                 u16 tag;
2702                 u16 radar_type;
2703                 struct mt7615_dfs_pattern pattern;
2704         } req = {
2705                 .tag = 0x2,
2706                 .radar_type = index,
2707         };
2708
2709         memcpy(&req.pattern, pattern, sizeof(*pattern));
2710
2711         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2712                                  sizeof(req), true);
2713 }
2714
2715 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2716 {
2717         struct {
2718                 u8 pulse_num;
2719                 u8 rsv[3];
2720                 struct {
2721                         u32 start_time;
2722                         u16 width;
2723                         s16 power;
2724                 } pattern[32];
2725         } req = {
2726                 .pulse_num = dev->radar_pattern.n_pulses,
2727         };
2728         u32 start_time = ktime_to_ms(ktime_get_boottime());
2729         int i;
2730
2731         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2732                 return -EINVAL;
2733
2734         /* TODO: add some noise here */
2735         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2736                 req.pattern[i].width = dev->radar_pattern.width;
2737                 req.pattern[i].power = dev->radar_pattern.power;
2738                 req.pattern[i].start_time = start_time +
2739                                             i * dev->radar_pattern.period;
2740         }
2741
2742         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2743                                  &req, sizeof(req), false);
2744 }
2745
2746 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2747 {
2748         struct mt76_phy *mphy = phy->mt76;
2749         struct ieee80211_hw *hw = mphy->hw;
2750         int n_chains = hweight8(mphy->antenna_mask);
2751         int tx_power;
2752         int i;
2753
2754         tx_power = hw->conf.power_level * 2 -
2755                    mt76_tx_power_nss_delta(n_chains);
2756         mphy->txpower_cur = tx_power;
2757
2758         for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2759                 sku[i] = tx_power;
2760
2761         for (i = 0; i < 4; i++) {
2762                 int delta = 0;
2763
2764                 if (i < n_chains - 1)
2765                         delta = mt76_tx_power_nss_delta(n_chains) -
2766                                 mt76_tx_power_nss_delta(i + 1);
2767                 sku[MT_SKU_1SS_DELTA + i] = delta;
2768         }
2769 }
2770
2771 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2772 {
2773         static const u8 width_to_bw[] = {
2774                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2775                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2776                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2777                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2778                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2779                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2780                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2781                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2782         };
2783
2784         if (chandef->width >= ARRAY_SIZE(width_to_bw))
2785                 return 0;
2786
2787         return width_to_bw[chandef->width];
2788 }
2789
2790 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2791 {
2792         struct mt7615_dev *dev = phy->dev;
2793         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2794         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2795         struct {
2796                 u8 control_chan;
2797                 u8 center_chan;
2798                 u8 bw;
2799                 u8 tx_streams;
2800                 u8 rx_streams_mask;
2801                 u8 switch_reason;
2802                 u8 band_idx;
2803                 /* for 80+80 only */
2804                 u8 center_chan2;
2805                 __le16 cac_case;
2806                 u8 channel_band;
2807                 u8 rsv0;
2808                 __le32 outband_freq;
2809                 u8 txpower_drop;
2810                 u8 rsv1[3];
2811                 u8 txpower_sku[53];
2812                 u8 rsv2[3];
2813         } req = {
2814                 .control_chan = chandef->chan->hw_value,
2815                 .center_chan = ieee80211_frequency_to_channel(freq1),
2816                 .tx_streams = hweight8(phy->mt76->antenna_mask),
2817                 .rx_streams_mask = phy->chainmask,
2818                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
2819         };
2820
2821         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2822                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2823         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2824                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2825                 req.switch_reason = CH_SWITCH_DFS;
2826         else
2827                 req.switch_reason = CH_SWITCH_NORMAL;
2828
2829         req.band_idx = phy != &dev->phy;
2830         req.bw = mt7615_mcu_chan_bw(chandef);
2831
2832         if (mt76_testmode_enabled(&dev->mt76))
2833                 memset(req.txpower_sku, 0x3f, 49);
2834         else
2835                 mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2836
2837         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2838 }
2839
2840 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2841 {
2842         struct {
2843                 u8 action;
2844                 u8 rsv[3];
2845         } req = {
2846                 .action = index,
2847         };
2848
2849         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2850                                  sizeof(req), true);
2851 }
2852
2853 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2854                               u32 val)
2855 {
2856         struct {
2857                 u8 test_mode_en;
2858                 u8 param_idx;
2859                 u8 _rsv[2];
2860
2861                 __le32 value;
2862
2863                 u8 pad[8];
2864         } req = {
2865                 .test_mode_en = test_mode,
2866                 .param_idx = param,
2867                 .value = cpu_to_le32(val),
2868         };
2869
2870         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2871                                  sizeof(req), false);
2872 }
2873
2874 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2875 {
2876         struct mt7615_dev *dev = phy->dev;
2877         struct {
2878                 u8 format_id;
2879                 u8 sku_enable;
2880                 u8 band_idx;
2881                 u8 rsv;
2882         } req = {
2883                 .format_id = 0,
2884                 .band_idx = phy != &dev->phy,
2885                 .sku_enable = enable,
2886         };
2887
2888         return mt76_mcu_send_msg(&dev->mt76,
2889                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2890                                  sizeof(req), true);
2891 }
2892
2893 int mt7615_mcu_set_vif_ps(struct mt7615_dev *dev, struct ieee80211_vif *vif)
2894 {
2895         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2896         struct {
2897                 u8 bss_idx;
2898                 u8 ps_state; /* 0: device awake
2899                               * 1: static power save
2900                               * 2: dynamic power saving
2901                               */
2902         } req = {
2903                 .bss_idx = mvif->idx,
2904                 .ps_state = vif->bss_conf.ps ? 2 : 0,
2905         };
2906
2907         if (vif->type != NL80211_IFTYPE_STATION)
2908                 return -ENOTSUPP;
2909
2910         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_PS_PROFILE, &req,
2911                                  sizeof(req), false);
2912 }
2913
2914 int mt7615_mcu_set_channel_domain(struct mt7615_phy *phy)
2915 {
2916         struct mt76_phy *mphy = phy->mt76;
2917         struct mt7615_dev *dev = phy->dev;
2918         struct mt7615_mcu_channel_domain {
2919                 __le32 country_code; /* regulatory_request.alpha2 */
2920                 u8 bw_2g; /* BW_20_40M          0
2921                            * BW_20M             1
2922                            * BW_20_40_80M       2
2923                            * BW_20_40_80_160M   3
2924                            * BW_20_40_80_8080M  4
2925                            */
2926                 u8 bw_5g;
2927                 __le16 pad;
2928                 u8 n_2ch;
2929                 u8 n_5ch;
2930                 __le16 pad2;
2931         } __packed hdr = {
2932                 .bw_2g = 0,
2933                 .bw_5g = 3,
2934                 .n_2ch = mphy->sband_2g.sband.n_channels,
2935                 .n_5ch = mphy->sband_5g.sband.n_channels,
2936         };
2937         struct mt7615_mcu_chan {
2938                 __le16 hw_value;
2939                 __le16 pad;
2940                 __le32 flags;
2941         } __packed;
2942         int i, n_channels = hdr.n_2ch + hdr.n_5ch;
2943         int len = sizeof(hdr) + n_channels * sizeof(struct mt7615_mcu_chan);
2944         struct sk_buff *skb;
2945
2946         if (!mt7615_firmware_offload(dev))
2947                 return 0;
2948
2949         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
2950         if (!skb)
2951                 return -ENOMEM;
2952
2953         skb_put_data(skb, &hdr, sizeof(hdr));
2954
2955         for (i = 0; i < n_channels; i++) {
2956                 struct ieee80211_channel *chan;
2957                 struct mt7615_mcu_chan channel;
2958
2959                 if (i < hdr.n_2ch)
2960                         chan = &mphy->sband_2g.sband.channels[i];
2961                 else
2962                         chan = &mphy->sband_5g.sband.channels[i - hdr.n_2ch];
2963
2964                 channel.hw_value = cpu_to_le16(chan->hw_value);
2965                 channel.flags = cpu_to_le32(chan->flags);
2966                 channel.pad = 0;
2967
2968                 skb_put_data(skb, &channel, sizeof(channel));
2969         }
2970
2971         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_SET_CHAN_DOMAIN,
2972                                      false);
2973 }
2974
2975 #define MT7615_SCAN_CHANNEL_TIME        60
2976 int mt7615_mcu_hw_scan(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2977                        struct ieee80211_scan_request *scan_req)
2978 {
2979         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2980         struct cfg80211_scan_request *sreq = &scan_req->req;
2981         int n_ssids = 0, err, i, duration = MT7615_SCAN_CHANNEL_TIME;
2982         int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
2983         struct ieee80211_channel **scan_list = sreq->channels;
2984         struct mt7615_dev *dev = phy->dev;
2985         bool ext_phy = phy != &dev->phy;
2986         struct mt7615_mcu_scan_channel *chan;
2987         struct mt7615_hw_scan_req *req;
2988         struct sk_buff *skb;
2989
2990         /* fall-back to sw-scan */
2991         if (!mt7615_firmware_offload(dev))
2992                 return 1;
2993
2994         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(*req));
2995         if (!skb)
2996                 return -ENOMEM;
2997
2998         set_bit(MT76_HW_SCANNING, &phy->mt76->state);
2999         mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3000
3001         req = (struct mt7615_hw_scan_req *)skb_put(skb, sizeof(*req));
3002
3003         req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3004         req->bss_idx = mvif->idx;
3005         req->scan_type = sreq->n_ssids ? 1 : 0;
3006         req->probe_req_num = sreq->n_ssids ? 2 : 0;
3007         req->version = 1;
3008
3009         for (i = 0; i < sreq->n_ssids; i++) {
3010                 if (!sreq->ssids[i].ssid_len)
3011                         continue;
3012
3013                 req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
3014                 memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
3015                        sreq->ssids[i].ssid_len);
3016                 n_ssids++;
3017         }
3018         req->ssid_type = n_ssids ? BIT(2) : BIT(0);
3019         req->ssid_type_ext = n_ssids ? BIT(0) : 0;
3020         req->ssids_num = n_ssids;
3021
3022         /* increase channel time for passive scan */
3023         if (!sreq->n_ssids)
3024                 duration *= 2;
3025         req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
3026         req->channel_min_dwell_time = cpu_to_le16(duration);
3027         req->channel_dwell_time = cpu_to_le16(duration);
3028
3029         req->channels_num = min_t(u8, sreq->n_channels, 32);
3030         req->ext_channels_num = min_t(u8, ext_channels_num, 32);
3031         for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
3032                 if (i >= 32)
3033                         chan = &req->ext_channels[i - 32];
3034                 else
3035                         chan = &req->channels[i];
3036
3037                 chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3038                 chan->channel_num = scan_list[i]->hw_value;
3039         }
3040         req->channel_type = sreq->n_channels ? 4 : 0;
3041
3042         if (sreq->ie_len > 0) {
3043                 memcpy(req->ies, sreq->ie, sreq->ie_len);
3044                 req->ies_len = cpu_to_le16(sreq->ie_len);
3045         }
3046
3047         memcpy(req->bssid, sreq->bssid, ETH_ALEN);
3048         if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3049                 get_random_mask_addr(req->random_mac, sreq->mac_addr,
3050                                      sreq->mac_addr_mask);
3051                 req->scan_func = 1;
3052         }
3053
3054         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_START_HW_SCAN,
3055                                     false);
3056         if (err < 0)
3057                 clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
3058
3059         return err;
3060 }
3061
3062 int mt7615_mcu_cancel_hw_scan(struct mt7615_phy *phy,
3063                               struct ieee80211_vif *vif)
3064 {
3065         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3066         struct mt7615_dev *dev = phy->dev;
3067         struct {
3068                 u8 seq_num;
3069                 u8 is_ext_channel;
3070                 u8 rsv[2];
3071         } __packed req = {
3072                 .seq_num = mvif->scan_seq_num,
3073         };
3074
3075         if (test_and_clear_bit(MT76_HW_SCANNING, &phy->mt76->state)) {
3076                 struct cfg80211_scan_info info = {
3077                         .aborted = true,
3078                 };
3079
3080                 ieee80211_scan_completed(phy->mt76->hw, &info);
3081         }
3082
3083         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_CANCEL_HW_SCAN, &req,
3084                                  sizeof(req), false);
3085 }
3086
3087 int mt7615_mcu_sched_scan_req(struct mt7615_phy *phy,
3088                               struct ieee80211_vif *vif,
3089                               struct cfg80211_sched_scan_request *sreq)
3090 {
3091         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3092         struct ieee80211_channel **scan_list = sreq->channels;
3093         struct mt7615_dev *dev = phy->dev;
3094         bool ext_phy = phy != &dev->phy;
3095         struct mt7615_mcu_scan_channel *chan;
3096         struct mt7615_sched_scan_req *req;
3097         struct cfg80211_match_set *match;
3098         struct cfg80211_ssid *ssid;
3099         struct sk_buff *skb;
3100         int i;
3101
3102         if (!mt7615_firmware_offload(dev))
3103                 return -ENOTSUPP;
3104
3105         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3106                                  sizeof(*req) + sreq->ie_len);
3107         if (!skb)
3108                 return -ENOMEM;
3109
3110         mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3111
3112         req = (struct mt7615_sched_scan_req *)skb_put(skb, sizeof(*req));
3113         req->version = 1;
3114         req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3115
3116         if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3117                 get_random_mask_addr(req->random_mac, sreq->mac_addr,
3118                                      sreq->mac_addr_mask);
3119                 req->scan_func = 1;
3120         }
3121
3122         req->ssids_num = sreq->n_ssids;
3123         for (i = 0; i < req->ssids_num; i++) {
3124                 ssid = &sreq->ssids[i];
3125                 memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
3126                 req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
3127         }
3128
3129         req->match_num = sreq->n_match_sets;
3130         for (i = 0; i < req->match_num; i++) {
3131                 match = &sreq->match_sets[i];
3132                 memcpy(req->match[i].ssid, match->ssid.ssid,
3133                        match->ssid.ssid_len);
3134                 req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
3135                 req->match[i].ssid_len = match->ssid.ssid_len;
3136         }
3137
3138         req->channel_type = sreq->n_channels ? 4 : 0;
3139         req->channels_num = min_t(u8, sreq->n_channels, 64);
3140         for (i = 0; i < req->channels_num; i++) {
3141                 chan = &req->channels[i];
3142                 chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3143                 chan->channel_num = scan_list[i]->hw_value;
3144         }
3145
3146         req->intervals_num = sreq->n_scan_plans;
3147         for (i = 0; i < req->intervals_num; i++)
3148                 req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3149
3150         if (sreq->ie_len > 0) {
3151                 req->ie_len = cpu_to_le16(sreq->ie_len);
3152                 memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
3153         }
3154
3155         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_SCHED_SCAN_REQ,
3156                                      false);
3157 }
3158
3159 int mt7615_mcu_sched_scan_enable(struct mt7615_phy *phy,
3160                                  struct ieee80211_vif *vif,
3161                                  bool enable)
3162 {
3163         struct mt7615_dev *dev = phy->dev;
3164         struct {
3165                 u8 active; /* 0: enabled 1: disabled */
3166                 u8 rsv[3];
3167         } __packed req = {
3168                 .active = !enable,
3169         };
3170
3171         if (!mt7615_firmware_offload(dev))
3172                 return -ENOTSUPP;
3173
3174         if (enable)
3175                 set_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3176         else
3177                 clear_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3178
3179         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SCHED_SCAN_ENABLE, &req,
3180                                  sizeof(req), false);
3181 }
3182
3183 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3184 {
3185         int i;
3186
3187         for (i = 0; i < n_freqs; i++)
3188                 if (cur == freqs[i])
3189                         return i;
3190
3191         return -1;
3192 }
3193
3194 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
3195 {
3196         static const u16 freq_list[] = {
3197                 4980, 5805, 5905, 5190,
3198                 5230, 5270, 5310, 5350,
3199                 5390, 5430, 5470, 5510,
3200                 5550, 5590, 5630, 5670,
3201                 5710, 5755, 5795, 5835,
3202                 5875, 5210, 5290, 5370,
3203                 5450, 5530, 5610, 5690,
3204                 5775, 5855
3205         };
3206         static const u16 freq_bw40[] = {
3207                 5190, 5230, 5270, 5310,
3208                 5350, 5390, 5430, 5470,
3209                 5510, 5550, 5590, 5630,
3210                 5670, 5710, 5755, 5795,
3211                 5835, 5875
3212         };
3213         int offset_2g = ARRAY_SIZE(freq_list);
3214         int idx;
3215
3216         if (freq < 4000) {
3217                 if (freq < 2427)
3218                         return offset_2g;
3219                 if (freq < 2442)
3220                         return offset_2g + 1;
3221                 if (freq < 2457)
3222                         return offset_2g + 2;
3223
3224                 return offset_2g + 3;
3225         }
3226
3227         switch (bw) {
3228         case NL80211_CHAN_WIDTH_80:
3229         case NL80211_CHAN_WIDTH_80P80:
3230         case NL80211_CHAN_WIDTH_160:
3231                 break;
3232         default:
3233                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3234                                            freq + 10);
3235                 if (idx >= 0) {
3236                         freq = freq_bw40[idx];
3237                         break;
3238                 }
3239
3240                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3241                                            freq - 10);
3242                 if (idx >= 0) {
3243                         freq = freq_bw40[idx];
3244                         break;
3245                 }
3246                 fallthrough;
3247         case NL80211_CHAN_WIDTH_40:
3248                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3249                                            freq);
3250                 if (idx >= 0)
3251                         break;
3252
3253                 return -1;
3254
3255         }
3256
3257         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3258 }
3259
3260 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
3261 {
3262         struct mt7615_dev *dev = phy->dev;
3263         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3264         int freq2 = chandef->center_freq2;
3265         int ret;
3266         struct {
3267                 u8 direction;
3268                 u8 runtime_calibration;
3269                 u8 _rsv[2];
3270
3271                 __le16 center_freq;
3272                 u8 bw;
3273                 u8 band;
3274                 u8 is_freq2;
3275                 u8 success;
3276                 u8 dbdc_en;
3277
3278                 u8 _rsv2;
3279
3280                 struct {
3281                         __le32 sx0_i_lna[4];
3282                         __le32 sx0_q_lna[4];
3283
3284                         __le32 sx2_i_lna[4];
3285                         __le32 sx2_q_lna[4];
3286                 } dcoc_data[4];
3287         } req = {
3288                 .direction = 1,
3289
3290                 .bw = mt7615_mcu_chan_bw(chandef),
3291                 .band = chandef->center_freq1 > 4000,
3292                 .dbdc_en = !!dev->mt76.phy2,
3293         };
3294         u16 center_freq = chandef->center_freq1;
3295         int freq_idx;
3296         u8 *eep = dev->mt76.eeprom.data;
3297
3298         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
3299                 return 0;
3300
3301         if (chandef->width == NL80211_CHAN_WIDTH_160) {
3302                 freq2 = center_freq + 40;
3303                 center_freq -= 40;
3304         }
3305
3306 again:
3307         req.runtime_calibration = 1;
3308         freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
3309         if (freq_idx < 0)
3310                 goto out;
3311
3312         memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
3313                               freq_idx * MT7615_EEPROM_DCOC_SIZE,
3314                sizeof(req.dcoc_data));
3315         req.runtime_calibration = 0;
3316
3317 out:
3318         req.center_freq = cpu_to_le16(center_freq);
3319         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
3320                                 sizeof(req), true);
3321
3322         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3323              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3324                 req.is_freq2 = true;
3325                 center_freq = freq2;
3326                 goto again;
3327         }
3328
3329         return ret;
3330 }
3331
3332 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
3333 {
3334         static const u16 freq_list[] = {
3335                 4920, 4940, 4960, 4980,
3336                 5040, 5060, 5080, 5180,
3337                 5200, 5220, 5240, 5260,
3338                 5280, 5300, 5320, 5340,
3339                 5360, 5380, 5400, 5420,
3340                 5440, 5460, 5480, 5500,
3341                 5520, 5540, 5560, 5580,
3342                 5600, 5620, 5640, 5660,
3343                 5680, 5700, 5720, 5745,
3344                 5765, 5785, 5805, 5825,
3345                 5845, 5865, 5885, 5905
3346         };
3347         int offset_2g = ARRAY_SIZE(freq_list);
3348         int idx;
3349
3350         if (freq < 4000) {
3351                 if (freq < 2432)
3352                         return offset_2g;
3353                 if (freq < 2457)
3354                         return offset_2g + 1;
3355
3356                 return offset_2g + 2;
3357         }
3358
3359         if (bw != NL80211_CHAN_WIDTH_20) {
3360                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3361                                            freq + 10);
3362                 if (idx >= 0)
3363                         return idx;
3364
3365                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3366                                            freq - 10);
3367                 if (idx >= 0)
3368                         return idx;
3369         }
3370
3371         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3372 }
3373
3374
3375 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
3376 {
3377         struct mt7615_dev *dev = phy->dev;
3378         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3379         int freq2 = chandef->center_freq2;
3380         int ret;
3381         struct {
3382                 u8 direction;
3383                 u8 runtime_calibration;
3384                 u8 _rsv[2];
3385
3386                 __le16 center_freq;
3387                 u8 bw;
3388                 u8 band;
3389                 u8 is_freq2;
3390                 u8 success;
3391                 u8 dbdc_en;
3392
3393                 u8 _rsv2;
3394
3395                 struct {
3396                         struct {
3397                                 u32 dpd_g0;
3398                                 u8 data[32];
3399                         } wf0, wf1;
3400
3401                         struct {
3402                                 u32 dpd_g0_prim;
3403                                 u32 dpd_g0_sec;
3404                                 u8 data_prim[32];
3405                                 u8 data_sec[32];
3406                         } wf2, wf3;
3407                 } dpd_data;
3408         } req = {
3409                 .direction = 1,
3410
3411                 .bw = mt7615_mcu_chan_bw(chandef),
3412                 .band = chandef->center_freq1 > 4000,
3413                 .dbdc_en = !!dev->mt76.phy2,
3414         };
3415         u16 center_freq = chandef->center_freq1;
3416         int freq_idx;
3417         u8 *eep = dev->mt76.eeprom.data;
3418
3419         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
3420                 return 0;
3421
3422         if (chandef->width == NL80211_CHAN_WIDTH_160) {
3423                 freq2 = center_freq + 40;
3424                 center_freq -= 40;
3425         }
3426
3427 again:
3428         req.runtime_calibration = 1;
3429         freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
3430         if (freq_idx < 0)
3431                 goto out;
3432
3433         memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
3434                               freq_idx * MT7615_EEPROM_TXDPD_SIZE,
3435                sizeof(req.dpd_data));
3436         req.runtime_calibration = 0;
3437
3438 out:
3439         req.center_freq = cpu_to_le16(center_freq);
3440         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
3441                                 sizeof(req), true);
3442
3443         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3444              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3445                 req.is_freq2 = true;
3446                 center_freq = freq2;
3447                 goto again;
3448         }
3449
3450         return ret;
3451 }
3452
3453 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3454                           bool enable)
3455 {
3456         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3457         struct {
3458                 u8 bss_idx;
3459                 u8 dtim_period;
3460                 __le16 aid;
3461                 __le16 bcn_interval;
3462                 __le16 atim_window;
3463                 u8 uapsd;
3464                 u8 bmc_delivered_ac;
3465                 u8 bmc_triggered_ac;
3466                 u8 pad;
3467         } req = {
3468                 .bss_idx = mvif->idx,
3469                 .aid = cpu_to_le16(vif->bss_conf.aid),
3470                 .dtim_period = vif->bss_conf.dtim_period,
3471                 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
3472         };
3473         struct {
3474                 u8 bss_idx;
3475                 u8 pad[3];
3476         } req_hdr = {
3477                 .bss_idx = mvif->idx,
3478         };
3479         int err;
3480
3481         if (vif->type != NL80211_IFTYPE_STATION ||
3482             !mt7615_firmware_offload(dev))
3483                 return -ENOTSUPP;
3484
3485         err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
3486                                 sizeof(req_hdr), false);
3487         if (err < 0 || !enable)
3488                 return err;
3489
3490         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
3491                                  sizeof(req), false);
3492 }
3493
3494 #ifdef CONFIG_PM
3495 int mt7615_mcu_set_hif_suspend(struct mt7615_dev *dev, bool suspend)
3496 {
3497         struct {
3498                 struct {
3499                         u8 hif_type; /* 0x0: HIF_SDIO
3500                                       * 0x1: HIF_USB
3501                                       * 0x2: HIF_PCIE
3502                                       */
3503                         u8 pad[3];
3504                 } __packed hdr;
3505                 struct hif_suspend_tlv {
3506                         __le16 tag;
3507                         __le16 len;
3508                         u8 suspend;
3509                 } __packed hif_suspend;
3510         } req = {
3511                 .hif_suspend = {
3512                         .tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
3513                         .len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
3514                         .suspend = suspend,
3515                 },
3516         };
3517
3518         if (mt76_is_mmio(&dev->mt76))
3519                 req.hdr.hif_type = 2;
3520         else if (mt76_is_usb(&dev->mt76))
3521                 req.hdr.hif_type = 1;
3522
3523         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_HIF_CTRL, &req,
3524                                  sizeof(req), true);
3525 }
3526 EXPORT_SYMBOL_GPL(mt7615_mcu_set_hif_suspend);
3527
3528 static int
3529 mt7615_mcu_set_wow_ctrl(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3530                         bool suspend, struct cfg80211_wowlan *wowlan)
3531 {
3532         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3533         struct mt7615_dev *dev = phy->dev;
3534         struct {
3535                 struct {
3536                         u8 bss_idx;
3537                         u8 pad[3];
3538                 } __packed hdr;
3539                 struct mt7615_wow_ctrl_tlv wow_ctrl_tlv;
3540         } req = {
3541                 .hdr = {
3542                         .bss_idx = mvif->idx,
3543                 },
3544                 .wow_ctrl_tlv = {
3545                         .tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
3546                         .len = cpu_to_le16(sizeof(struct mt7615_wow_ctrl_tlv)),
3547                         .cmd = suspend ? 1 : 2,
3548                 },
3549         };
3550
3551         if (wowlan->magic_pkt)
3552                 req.wow_ctrl_tlv.trigger |= BIT(0);
3553         if (wowlan->disconnect)
3554                 req.wow_ctrl_tlv.trigger |= BIT(2);
3555         if (wowlan->nd_config) {
3556                 mt7615_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
3557                 req.wow_ctrl_tlv.trigger |= BIT(5);
3558                 mt7615_mcu_sched_scan_enable(phy, vif, suspend);
3559         }
3560
3561         if (mt76_is_mmio(&dev->mt76))
3562                 req.wow_ctrl_tlv.wakeup_hif = 2;
3563         else if (mt76_is_usb(&dev->mt76))
3564                 req.wow_ctrl_tlv.wakeup_hif = 1;
3565
3566         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
3567                                  sizeof(req), true);
3568 }
3569
3570 static int
3571 mt7615_mcu_set_wow_pattern(struct mt7615_dev *dev,
3572                            struct ieee80211_vif *vif,
3573                            u8 index, bool enable,
3574                            struct cfg80211_pkt_pattern *pattern)
3575 {
3576         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3577         struct mt7615_wow_pattern_tlv *ptlv;
3578         struct sk_buff *skb;
3579         struct req_hdr {
3580                 u8 bss_idx;
3581                 u8 pad[3];
3582         } __packed hdr = {
3583                 .bss_idx = mvif->idx,
3584         };
3585
3586         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3587                                  sizeof(hdr) + sizeof(*ptlv));
3588         if (!skb)
3589                 return -ENOMEM;
3590
3591         skb_put_data(skb, &hdr, sizeof(hdr));
3592         ptlv = (struct mt7615_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
3593         ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
3594         ptlv->len = cpu_to_le16(sizeof(*ptlv));
3595         ptlv->data_len = pattern->pattern_len;
3596         ptlv->enable = enable;
3597         ptlv->index = index;
3598
3599         memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
3600         memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8);
3601
3602         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_SUSPEND,
3603                                      true);
3604 }
3605
3606 static int
3607 mt7615_mcu_set_suspend_mode(struct mt7615_dev *dev,
3608                             struct ieee80211_vif *vif,
3609                             bool enable, u8 mdtim, bool wow_suspend)
3610 {
3611         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3612         struct {
3613                 struct {
3614                         u8 bss_idx;
3615                         u8 pad[3];
3616                 } __packed hdr;
3617                 struct mt7615_suspend_tlv suspend_tlv;
3618         } req = {
3619                 .hdr = {
3620                         .bss_idx = mvif->idx,
3621                 },
3622                 .suspend_tlv = {
3623                         .tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
3624                         .len = cpu_to_le16(sizeof(struct mt7615_suspend_tlv)),
3625                         .enable = enable,
3626                         .mdtim = mdtim,
3627                         .wow_suspend = wow_suspend,
3628                 },
3629         };
3630
3631         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
3632                                  sizeof(req), true);
3633 }
3634
3635 static int
3636 mt7615_mcu_set_gtk_rekey(struct mt7615_dev *dev,
3637                          struct ieee80211_vif *vif,
3638                          bool suspend)
3639 {
3640         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3641         struct {
3642                 struct {
3643                         u8 bss_idx;
3644                         u8 pad[3];
3645                 } __packed hdr;
3646                 struct mt7615_gtk_rekey_tlv gtk_tlv;
3647         } __packed req = {
3648                 .hdr = {
3649                         .bss_idx = mvif->idx,
3650                 },
3651                 .gtk_tlv = {
3652                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
3653                         .len = cpu_to_le16(sizeof(struct mt7615_gtk_rekey_tlv)),
3654                         .rekey_mode = !suspend,
3655                 },
3656         };
3657
3658         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
3659                                  sizeof(req), true);
3660 }
3661
3662 static int
3663 mt7615_mcu_set_arp_filter(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3664                           bool suspend)
3665 {
3666         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3667         struct {
3668                 struct {
3669                         u8 bss_idx;
3670                         u8 pad[3];
3671                 } __packed hdr;
3672                 struct mt7615_arpns_tlv arpns;
3673         } req = {
3674                 .hdr = {
3675                         .bss_idx = mvif->idx,
3676                 },
3677                 .arpns = {
3678                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3679                         .len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3680                         .mode = suspend,
3681                 },
3682         };
3683
3684         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
3685                                  sizeof(req), true);
3686 }
3687
3688 void mt7615_mcu_set_suspend_iter(void *priv, u8 *mac,
3689                                  struct ieee80211_vif *vif)
3690 {
3691         struct mt7615_phy *phy = priv;
3692         bool suspend = test_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
3693         struct ieee80211_hw *hw = phy->mt76->hw;
3694         struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
3695         int i;
3696
3697         mt7615_mcu_set_bss_pm(phy->dev, vif, suspend);
3698
3699         mt7615_mcu_set_gtk_rekey(phy->dev, vif, suspend);
3700         mt7615_mcu_set_arp_filter(phy->dev, vif, suspend);
3701
3702         mt7615_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
3703
3704         for (i = 0; i < wowlan->n_patterns; i++)
3705                 mt7615_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
3706                                            &wowlan->patterns[i]);
3707         mt7615_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
3708 }
3709
3710 static void
3711 mt7615_mcu_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3712                     struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
3713                     void *data)
3714 {
3715         struct mt7615_gtk_rekey_tlv *gtk_tlv = data;
3716         u32 cipher;
3717
3718         if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
3719             key->cipher != WLAN_CIPHER_SUITE_CCMP &&
3720             key->cipher != WLAN_CIPHER_SUITE_TKIP)
3721                 return;
3722
3723         if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
3724                 gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
3725                 cipher = BIT(3);
3726         } else {
3727                 gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
3728                 cipher = BIT(4);
3729         }
3730
3731         /* we are assuming here to have a single pairwise key */
3732         if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3733                 gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
3734                 gtk_tlv->group_cipher = cpu_to_le32(cipher);
3735                 gtk_tlv->keyid = key->keyidx;
3736         }
3737 }
3738
3739 int mt7615_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
3740                                 struct ieee80211_vif *vif,
3741                                 struct cfg80211_gtk_rekey_data *key)
3742 {
3743         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3744         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3745         struct mt7615_gtk_rekey_tlv *gtk_tlv;
3746         struct sk_buff *skb;
3747         struct {
3748                 u8 bss_idx;
3749                 u8 pad[3];
3750         } __packed hdr = {
3751                 .bss_idx = mvif->idx,
3752         };
3753
3754         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3755                                  sizeof(hdr) + sizeof(*gtk_tlv));
3756         if (!skb)
3757                 return -ENOMEM;
3758
3759         skb_put_data(skb, &hdr, sizeof(hdr));
3760         gtk_tlv = (struct mt7615_gtk_rekey_tlv *)skb_put(skb,
3761                                                          sizeof(*gtk_tlv));
3762         gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
3763         gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
3764         gtk_tlv->rekey_mode = 2;
3765         gtk_tlv->option = 1;
3766
3767         rcu_read_lock();
3768         ieee80211_iter_keys_rcu(hw, vif, mt7615_mcu_key_iter, gtk_tlv);
3769         rcu_read_unlock();
3770
3771         memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
3772         memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
3773         memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
3774
3775         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
3776                                      true);
3777 }
3778 #endif /* CONFIG_PM */
3779
3780 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3781                        struct ieee80211_channel *chan, int duration)
3782 {
3783         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3784         struct mt7615_dev *dev = phy->dev;
3785         struct mt7615_roc_tlv req = {
3786                 .bss_idx = mvif->idx,
3787                 .active = !chan,
3788                 .max_interval = cpu_to_le32(duration),
3789                 .primary_chan = chan ? chan->hw_value : 0,
3790                 .band = chan ? chan->band : 0,
3791                 .req_type = 2,
3792         };
3793
3794         phy->roc_grant = false;
3795
3796         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
3797                                  sizeof(req), false);
3798 }
3799
3800 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
3801                                  struct ieee80211_vif *vif,
3802                                  struct ieee80211_bss_conf *info)
3803 {
3804         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3805         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3806         struct sk_buff *skb;
3807         int i, len = min_t(int, info->arp_addr_cnt,
3808                            IEEE80211_BSS_ARP_ADDR_LIST_LEN);
3809         struct {
3810                 struct {
3811                         u8 bss_idx;
3812                         u8 pad[3];
3813                 } __packed hdr;
3814                 struct mt7615_arpns_tlv arp;
3815         } req_hdr = {
3816                 .hdr = {
3817                         .bss_idx = mvif->idx,
3818                 },
3819                 .arp = {
3820                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3821                         .len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3822                         .ips_num = len,
3823                         .mode = 2,  /* update */
3824                         .option = 1,
3825                 },
3826         };
3827
3828         if (!mt7615_firmware_offload(dev))
3829                 return 0;
3830
3831         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3832                                  sizeof(req_hdr) + len * sizeof(__be32));
3833         if (!skb)
3834                 return -ENOMEM;
3835
3836         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
3837         for (i = 0; i < len; i++) {
3838                 u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
3839
3840                 memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
3841         }
3842
3843         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
3844                                      true);
3845 }
3846
3847 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
3848                              struct ieee80211_vif *vif)
3849 {
3850         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3851         int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
3852         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3853         struct {
3854                 __le32 ct_win;
3855                 u8 bss_idx;
3856                 u8 rsv[3];
3857         } __packed req = {
3858                 .ct_win = cpu_to_le32(ct_window),
3859                 .bss_idx = mvif->idx,
3860         };
3861
3862         if (!mt7615_firmware_offload(dev))
3863                 return -ENOTSUPP;
3864
3865         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
3866                                  sizeof(req), false);
3867 }
3868
3869 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
3870 {
3871         struct {
3872                 __le32 addr;
3873                 __le32 val;
3874         } __packed req = {
3875                 .addr = cpu_to_le32(offset),
3876         };
3877
3878         return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
3879                                  true);
3880 }
3881 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
3882
3883 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
3884 {
3885         struct {
3886                 __le32 addr;
3887                 __le32 val;
3888         } __packed req = {
3889                 .addr = cpu_to_le32(offset),
3890                 .val = cpu_to_le32(val),
3891         };
3892
3893         mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
3894 }
3895 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);