drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 struct mt7615_patch_hdr {
  15         char build_date[16];
  16         char platform[4];
  17         __be32 hw_sw_ver;
  18         __be32 patch_ver;
  19         __be16 checksum;
  20 } __packed;
  21
  22 struct mt7615_fw_trailer {
  23         __le32 addr;
  24         u8 chip_id;
  25         u8 feature_set;
  26         u8 eco_code;
  27         char fw_ver[10];
  28         char build_date[15];
  29         __le32 len;
  30 } __packed;
  31
  32 #define MCU_PATCH_ADDRESS               0x80000
  33
  34 #define N9_REGION_NUM                   2
  35 #define CR4_REGION_NUM                  1
  36
  37 #define IMG_CRC_LEN                     4
  38
  39 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  40 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  41
  42 #define DL_MODE_ENCRYPT                 BIT(0)
  43 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  44 #define DL_MODE_RESET_SEC_IV            BIT(3)
  45 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  46 #define DL_MODE_NEED_RSP                BIT(31)
  47
  48 #define FW_START_OVERRIDE               BIT(0)
  49 #define FW_START_WORKING_PDA_CR4        BIT(2)
  50
  51 static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
  52                                  int cmd, int *wait_seq)
  53 {
  54         struct mt7615_mcu_txd *mcu_txd;
  55         u8 seq, q_idx, pkt_fmt;
  56         enum mt76_txq_id qid;
  57         u32 val;
  58         __le32 *txd;
  59
  60         seq = ++dev->mt76.mmio.mcu.msg_seq & 0xf;
  61         if (!seq)
  62                 seq = ++dev->mt76.mmio.mcu.msg_seq & 0xf;
  63
  64         mcu_txd = (struct mt7615_mcu_txd *)skb_push(skb,
  65                    sizeof(struct mt7615_mcu_txd));
  66         memset(mcu_txd, 0, sizeof(struct mt7615_mcu_txd));
  67
  68         if (cmd != -MCU_CMD_FW_SCATTER) {
  69                 q_idx = MT_TX_MCU_PORT_RX_Q0;
  70                 pkt_fmt = MT_TX_TYPE_CMD;
  71         } else {
  72                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
  73                 pkt_fmt = MT_TX_TYPE_FW;
  74         }
  75
  76         txd = mcu_txd->txd;
  77
  78         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
  79               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
  80               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
  81         txd[0] = cpu_to_le32(val);
  82
  83         val = MT_TXD1_LONG_FORMAT |
  84               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
  85               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
  86         txd[1] = cpu_to_le32(val);
  87
  88         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
  89         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
  90         mcu_txd->pkt_type = MCU_PKT_ID;
  91         mcu_txd->seq = seq;
  92
  93         if (cmd < 0) {
  94                 mcu_txd->set_query = MCU_Q_NA;
  95                 mcu_txd->cid = -cmd;
  96         } else {
  97                 mcu_txd->cid = MCU_CMD_EXT_CID;
  98                 mcu_txd->set_query = MCU_Q_SET;
  99                 mcu_txd->ext_cid = cmd;
 100                 mcu_txd->ext_cid_ack = 1;
 101         }
 102         mcu_txd->s2d_index = MCU_S2D_H2N;
 103
 104         if (wait_seq)
 105                 *wait_seq = seq;
 106
 107         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 108                 qid = MT_TXQ_MCU;
 109         else
 110                 qid = MT_TXQ_FWDL;
 111
 112         return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
 113 }
 114
 115 static int
 116 mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
 117                           struct sk_buff *skb, int seq)
 118 {
 119         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 120         int ret = 0;
 121
 122         if (seq != rxd->seq)
 123                 return -EAGAIN;
 124
 125         switch (cmd) {
 126         case -MCU_CMD_PATCH_SEM_CONTROL:
 127                 skb_pull(skb, sizeof(*rxd) - 4);
 128                 ret = *skb->data;
 129                 break;
 130         case MCU_EXT_CMD_GET_TEMP:
 131                 skb_pull(skb, sizeof(*rxd));
 132                 ret = le32_to_cpu(*(__le32 *)skb->data);
 133                 break;
 134         default:
 135                 break;
 136         }
 137         dev_kfree_skb(skb);
 138
 139         return ret;
 140 }
 141
 142 static int
 143 mt7615_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
 144                     int len, bool wait_resp)
 145 {
 146         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 147         unsigned long expires = jiffies + 10 * HZ;
 148         struct sk_buff *skb;
 149         int ret, seq;
 150
 151         skb = mt7615_mcu_msg_alloc(data, len);
 152         if (!skb)
 153                 return -ENOMEM;
 154
 155         mutex_lock(&mdev->mmio.mcu.mutex);
 156
 157         ret = __mt7615_mcu_msg_send(dev, skb, cmd, &seq);
 158         if (ret)
 159                 goto out;
 160
 161         while (wait_resp) {
 162                 skb = mt76_mcu_get_response(mdev, expires);
 163                 if (!skb) {
 164                         dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
 165                                 cmd, seq);
 166                         ret = -ETIMEDOUT;
 167                         break;
 168                 }
 169
 170                 ret = mt7615_mcu_parse_response(dev, cmd, skb, seq);
 171                 if (ret != -EAGAIN)
 172                         break;
 173         }
 174
 175 out:
 176         mutex_unlock(&mdev->mmio.mcu.mutex);
 177
 178         return ret;
 179 }
 180
 181 static void
 182 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 183 {
 184         if (vif->csa_active)
 185                 ieee80211_csa_finish(vif);
 186 }
 187
 188 static void
 189 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 190 {
 191         struct mt76_phy *mphy = &dev->mt76.phy;
 192         struct mt7615_mcu_rdd_report *r;
 193
 194         r = (struct mt7615_mcu_rdd_report *)skb->data;
 195
 196         if (r->idx && dev->mt76.phy2)
 197                 mphy = dev->mt76.phy2;
 198
 199         ieee80211_radar_detected(mphy->hw);
 200         dev->hw_pattern++;
 201 }
 202
 203 static void
 204 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 205 {
 206         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 207
 208         switch (rxd->ext_eid) {
 209         case MCU_EXT_EVENT_RDD_REPORT:
 210                 mt7615_mcu_rx_radar_detected(dev, skb);
 211                 break;
 212         case MCU_EXT_EVENT_CSA_NOTIFY:
 213                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 214                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 215                                 mt7615_mcu_csa_finish, dev);
 216                 break;
 217         default:
 218                 break;
 219         }
 220 }
 221
 222 static void
 223 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 224 {
 225         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 226
 227         switch (rxd->eid) {
 228         case MCU_EVENT_EXT:
 229                 mt7615_mcu_rx_ext_event(dev, skb);
 230                 break;
 231         default:
 232                 break;
 233         }
 234         dev_kfree_skb(skb);
 235 }
 236
 237 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 238 {
 239         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 240
 241         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 242             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 243             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 244             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 245             !rxd->seq)
 246                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 247         else
 248                 mt76_mcu_rx_event(&dev->mt76, skb);
 249 }
 250
 251 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
 252                                     u32 len, u32 mode)
 253 {
 254         struct {
 255                 __le32 addr;
 256                 __le32 len;
 257                 __le32 mode;
 258         } req = {
 259                 .addr = cpu_to_le32(addr),
 260                 .len = cpu_to_le32(len),
 261                 .mode = cpu_to_le32(mode),
 262         };
 263
 264         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_TARGET_ADDRESS_LEN_REQ,
 265                                    &req, sizeof(req), true);
 266 }
 267
 268 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
 269                                     int len)
 270 {
 271         int ret = 0, cur_len;
 272
 273         while (len > 0) {
 274                 cur_len = min_t(int, 4096 - sizeof(struct mt7615_mcu_txd),
 275                                 len);
 276
 277                 ret = __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_SCATTER,
 278                                           data, cur_len, false);
 279                 if (ret)
 280                         break;
 281
 282                 data += cur_len;
 283                 len -= cur_len;
 284                 mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
 285         }
 286
 287         return ret;
 288 }
 289
 290 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
 291                                      u32 option)
 292 {
 293         struct {
 294                 __le32 option;
 295                 __le32 addr;
 296         } req = {
 297                 .option = cpu_to_le32(option),
 298                 .addr = cpu_to_le32(addr),
 299         };
 300
 301         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ,
 302                                    &req, sizeof(req), true);
 303 }
 304
 305 static int mt7615_mcu_restart(struct mt76_dev *dev)
 306 {
 307         return __mt76_mcu_send_msg(dev, -MCU_CMD_RESTART_DL_REQ, NULL,
 308                                    0, true);
 309 }
 310
 311 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
 312 {
 313         struct {
 314                 __le32 op;
 315         } req = {
 316                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
 317         };
 318
 319         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL,
 320                                    &req, sizeof(req), true);
 321 }
 322
 323 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
 324 {
 325         struct {
 326                 u8 check_crc;
 327                 u8 reserved[3];
 328         } req = {
 329                 .check_crc = 0,
 330         };
 331
 332         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ,
 333                                    &req, sizeof(req), true);
 334 }
 335
 336 static int mt7615_driver_own(struct mt7615_dev *dev)
 337 {
 338         mt76_wr(dev, MT_CFG_LPCR_HOST, MT_CFG_LPCR_HOST_DRV_OWN);
 339         if (!mt76_poll_msec(dev, MT_CFG_LPCR_HOST,
 340                             MT_CFG_LPCR_HOST_FW_OWN, 0, 500)) {
 341                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
 342                 return -EIO;
 343         }
 344
 345         return 0;
 346 }
 347
 348 static int mt7615_load_patch(struct mt7615_dev *dev)
 349 {
 350         const struct mt7615_patch_hdr *hdr;
 351         const struct firmware *fw = NULL;
 352         int len, ret, sem;
 353
 354         sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
 355         switch (sem) {
 356         case PATCH_IS_DL:
 357                 return 0;
 358         case PATCH_NOT_DL_SEM_SUCCESS:
 359                 break;
 360         default:
 361                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
 362                 return -EAGAIN;
 363         }
 364
 365         ret = request_firmware(&fw, MT7615_ROM_PATCH, dev->mt76.dev);
 366         if (ret)
 367                 goto out;
 368
 369         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
 370                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 371                 ret = -EINVAL;
 372                 goto out;
 373         }
 374
 375         hdr = (const struct mt7615_patch_hdr *)(fw->data);
 376
 377         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
 378                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
 379
 380         len = fw->size - sizeof(*hdr);
 381
 382         ret = mt7615_mcu_init_download(dev, MCU_PATCH_ADDRESS, len,
 383                                        DL_MODE_NEED_RSP);
 384         if (ret) {
 385                 dev_err(dev->mt76.dev, "Download request failed\n");
 386                 goto out;
 387         }
 388
 389         ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
 390         if (ret) {
 391                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
 392                 goto out;
 393         }
 394
 395         ret = mt7615_mcu_start_patch(dev);
 396         if (ret)
 397                 dev_err(dev->mt76.dev, "Failed to start patch\n");
 398
 399 out:
 400         release_firmware(fw);
 401
 402         sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
 403         switch (sem) {
 404         case PATCH_REL_SEM_SUCCESS:
 405                 break;
 406         default:
 407                 ret = -EAGAIN;
 408                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
 409                 break;
 410         }
 411
 412         return ret;
 413 }
 414
 415 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
 416 {
 417         u32 ret = 0;
 418
 419         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
 420                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
 421         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
 422                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
 423         ret |= DL_MODE_NEED_RSP;
 424         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
 425
 426         return ret;
 427 }
 428
 429 static int
 430 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
 431                              const struct mt7615_fw_trailer *hdr,
 432                              const u8 *data, bool is_cr4)
 433 {
 434         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
 435         int err, i, offset = 0;
 436         u32 len, addr, mode;
 437
 438         for (i = 0; i < n_region; i++) {
 439                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
 440                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
 441                 addr = le32_to_cpu(hdr[i].addr);
 442
 443                 err = mt7615_mcu_init_download(dev, addr, len, mode);
 444                 if (err) {
 445                         dev_err(dev->mt76.dev, "Download request failed\n");
 446                         return err;
 447                 }
 448
 449                 err = mt7615_mcu_send_firmware(dev, data + offset, len);
 450                 if (err) {
 451                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
 452                         return err;
 453                 }
 454
 455                 offset += len;
 456         }
 457
 458         return 0;
 459 }
 460
 461 static int mt7615_load_ram(struct mt7615_dev *dev)
 462 {
 463         const struct mt7615_fw_trailer *hdr;
 464         const struct firmware *fw;
 465         int ret;
 466
 467         ret = request_firmware(&fw, MT7615_FIRMWARE_N9, dev->mt76.dev);
 468         if (ret)
 469                 return ret;
 470
 471         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
 472                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 473                 ret = -EINVAL;
 474                 goto out;
 475         }
 476
 477         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
 478                                         N9_REGION_NUM * sizeof(*hdr));
 479
 480         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
 481                  hdr->fw_ver, hdr->build_date);
 482
 483         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
 484         if (ret)
 485                 goto out;
 486
 487         ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
 488                                         FW_START_OVERRIDE);
 489         if (ret) {
 490                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
 491                 goto out;
 492         }
 493
 494         release_firmware(fw);
 495
 496         ret = request_firmware(&fw, MT7615_FIRMWARE_CR4, dev->mt76.dev);
 497         if (ret)
 498                 return ret;
 499
 500         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
 501                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 502                 ret = -EINVAL;
 503                 goto out;
 504         }
 505
 506         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
 507                                         CR4_REGION_NUM * sizeof(*hdr));
 508
 509         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
 510                  hdr->fw_ver, hdr->build_date);
 511
 512         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
 513         if (ret)
 514                 goto out;
 515
 516         ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
 517         if (ret)
 518                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
 519
 520 out:
 521         release_firmware(fw);
 522
 523         return ret;
 524 }
 525
 526 static int mt7615_load_firmware(struct mt7615_dev *dev)
 527 {
 528         int ret;
 529         u32 val;
 530
 531         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
 532
 533         if (val != FW_STATE_FW_DOWNLOAD) {
 534                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
 535                 return -EIO;
 536         }
 537
 538         ret = mt7615_load_patch(dev);
 539         if (ret)
 540                 return ret;
 541
 542         ret = mt7615_load_ram(dev);
 543         if (ret)
 544                 return ret;
 545
 546         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
 547                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
 548                                        FW_STATE_CR4_RDY), 500)) {
 549                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
 550                 return -EIO;
 551         }
 552
 553         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
 554
 555         dev_dbg(dev->mt76.dev, "Firmware init done\n");
 556
 557         return 0;
 558 }
 559
 560 int mt7615_mcu_init(struct mt7615_dev *dev)
 561 {
 562         static const struct mt76_mcu_ops mt7615_mcu_ops = {
 563                 .mcu_send_msg = mt7615_mcu_msg_send,
 564                 .mcu_restart = mt7615_mcu_restart,
 565         };
 566         int ret;
 567
 568         dev->mt76.mcu_ops = &mt7615_mcu_ops,
 569
 570         ret = mt7615_driver_own(dev);
 571         if (ret)
 572                 return ret;
 573
 574         ret = mt7615_load_firmware(dev);
 575         if (ret)
 576                 return ret;
 577
 578         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
 579
 580         return 0;
 581 }
 582
 583 void mt7615_mcu_exit(struct mt7615_dev *dev)
 584 {
 585         __mt76_mcu_restart(&dev->mt76);
 586         mt76_wr(dev, MT_CFG_LPCR_HOST, MT_CFG_LPCR_HOST_FW_OWN);
 587         skb_queue_purge(&dev->mt76.mmio.mcu.res_q);
 588 }
 589
 590 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
 591 {
 592         struct {
 593                 u8 buffer_mode;
 594                 u8 pad;
 595                 u16 len;
 596         } __packed req_hdr = {
 597                 .buffer_mode = 1,
 598                 .len = __MT_EE_MAX - MT_EE_NIC_CONF_0,
 599         };
 600         int ret, len = sizeof(req_hdr) + __MT_EE_MAX - MT_EE_NIC_CONF_0;
 601         u8 *req, *eep = (u8 *)dev->mt76.eeprom.data;
 602
 603         req = kzalloc(len, GFP_KERNEL);
 604         if (!req)
 605                 return -ENOMEM;
 606
 607         memcpy(req, &req_hdr, sizeof(req_hdr));
 608         memcpy(req + sizeof(req_hdr), eep + MT_EE_NIC_CONF_0,
 609                __MT_EE_MAX - MT_EE_NIC_CONF_0);
 610
 611         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
 612                                   req, len, true);
 613         kfree(req);
 614
 615         return ret;
 616 }
 617
 618 int mt7615_mcu_init_mac(struct mt7615_dev *dev)
 619 {
 620         struct {
 621                 u8 enable;
 622                 u8 band;
 623                 u8 rsv[2];
 624         } __packed req = {
 625                 .enable = 1,
 626                 .band = 0,
 627         };
 628
 629         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
 630                                    &req, sizeof(req), true);
 631 }
 632
 633 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
 634 {
 635         struct mt7615_dev *dev = phy->dev;
 636         struct {
 637                 u8 prot_idx;
 638                 u8 band;
 639                 u8 rsv[2];
 640                 __le32 len_thresh;
 641                 __le32 pkt_thresh;
 642         } __packed req = {
 643                 .prot_idx = 1,
 644                 .band = phy != &dev->phy,
 645                 .len_thresh = cpu_to_le32(val),
 646                 .pkt_thresh = cpu_to_le32(0x2),
 647         };
 648
 649         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
 650                                    &req, sizeof(req), true);
 651 }
 652
 653 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
 654                        const struct ieee80211_tx_queue_params *params)
 655 {
 656 #define WMM_AIFS_SET    BIT(0)
 657 #define WMM_CW_MIN_SET  BIT(1)
 658 #define WMM_CW_MAX_SET  BIT(2)
 659 #define WMM_TXOP_SET    BIT(3)
 660 #define WMM_PARAM_SET   (WMM_AIFS_SET | WMM_CW_MIN_SET | \
 661                          WMM_CW_MAX_SET | WMM_TXOP_SET)
 662         struct req_data {
 663                 u8 number;
 664                 u8 rsv[3];
 665                 u8 queue;
 666                 u8 valid;
 667                 u8 aifs;
 668                 u8 cw_min;
 669                 __le16 cw_max;
 670                 __le16 txop;
 671         } __packed req = {
 672                 .number = 1,
 673                 .queue = queue,
 674                 .valid = WMM_PARAM_SET,
 675                 .aifs = params->aifs,
 676                 .cw_min = 5,
 677                 .cw_max = cpu_to_le16(10),
 678                 .txop = cpu_to_le16(params->txop),
 679         };
 680
 681         if (params->cw_min)
 682                 req.cw_min = fls(params->cw_min);
 683         if (params->cw_max)
 684                 req.cw_max = cpu_to_le16(fls(params->cw_max));
 685
 686         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
 687                                    &req, sizeof(req), true);
 688 }
 689
 690 int mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int enter)
 691 {
 692 #define ENTER_PM_STATE  1
 693 #define EXIT_PM_STATE   2
 694         struct {
 695                 u8 pm_number;
 696                 u8 pm_state;
 697                 u8 bssid[ETH_ALEN];
 698                 u8 dtim_period;
 699                 u8 wlan_idx;
 700                 __le16 bcn_interval;
 701                 __le32 aid;
 702                 __le32 rx_filter;
 703                 u8 band_idx;
 704                 u8 rsv[3];
 705                 __le32 feature;
 706                 u8 omac_idx;
 707                 u8 wmm_idx;
 708                 u8 bcn_loss_cnt;
 709                 u8 bcn_sp_duration;
 710         } __packed req = {
 711                 .pm_number = 5,
 712                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
 713                 .band_idx = band,
 714         };
 715
 716         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
 717                                    &req, sizeof(req), true);
 718 }
 719
 720 int mt7615_mcu_set_dev_info(struct mt7615_dev *dev,
 721                             struct ieee80211_vif *vif, bool enable)
 722 {
 723         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 724         struct {
 725                 struct req_hdr {
 726                         u8 omac_idx;
 727                         u8 band_idx;
 728                         __le16 tlv_num;
 729                         u8 is_tlv_append;
 730                         u8 rsv[3];
 731                 } __packed hdr;
 732                 struct req_tlv {
 733                         __le16 tag;
 734                         __le16 len;
 735                         u8 active;
 736                         u8 band_idx;
 737                         u8 omac_addr[ETH_ALEN];
 738                 } __packed tlv;
 739         } data = {
 740                 .hdr = {
 741                         .omac_idx = mvif->omac_idx,
 742                         .band_idx = mvif->band_idx,
 743                         .tlv_num = cpu_to_le16(1),
 744                         .is_tlv_append = 1,
 745                 },
 746                 .tlv = {
 747                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 748                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 749                         .active = enable,
 750                         .band_idx = mvif->band_idx,
 751                 },
 752         };
 753
 754         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 755         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 756                                    &data, sizeof(data), true);
 757 }
 758
 759 static void
 760 mt7615_mcu_bss_info_omac_header(struct mt7615_vif *mvif, u8 *data,
 761                                 u32 conn_type)
 762 {
 763         struct bss_info_omac *hdr = (struct bss_info_omac *)data;
 764         u8 idx;
 765
 766         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 767         hdr->tag = cpu_to_le16(BSS_INFO_OMAC);
 768         hdr->len = cpu_to_le16(sizeof(struct bss_info_omac));
 769         hdr->hw_bss_idx = idx;
 770         hdr->omac_idx = mvif->omac_idx;
 771         hdr->band_idx = mvif->band_idx;
 772         hdr->conn_type = cpu_to_le32(conn_type);
 773 }
 774
 775 static void
 776 mt7615_mcu_bss_info_basic_header(struct ieee80211_vif *vif, u8 *data,
 777                                  u32 net_type, u8 tx_wlan_idx,
 778                                  bool enable)
 779 {
 780         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 781         struct bss_info_basic *hdr = (struct bss_info_basic *)data;
 782
 783         hdr->tag = cpu_to_le16(BSS_INFO_BASIC);
 784         hdr->len = cpu_to_le16(sizeof(struct bss_info_basic));
 785         hdr->network_type = cpu_to_le32(net_type);
 786         hdr->active = enable;
 787         hdr->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 788         memcpy(hdr->bssid, vif->bss_conf.bssid, ETH_ALEN);
 789         hdr->wmm_idx = mvif->wmm_idx;
 790         hdr->dtim_period = vif->bss_conf.dtim_period;
 791         hdr->bmc_tx_wlan_idx = tx_wlan_idx;
 792 }
 793
 794 static void
 795 mt7615_mcu_bss_info_ext_header(struct mt7615_vif *mvif, u8 *data)
 796 {
 797 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 798 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 799         struct bss_info_ext_bss *hdr = (struct bss_info_ext_bss *)data;
 800         int ext_bss_idx, tsf_offset;
 801
 802         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 803         if (ext_bss_idx < 0)
 804                 return;
 805
 806         hdr->tag = cpu_to_le16(BSS_INFO_EXT_BSS);
 807         hdr->len = cpu_to_le16(sizeof(struct bss_info_ext_bss));
 808         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 809         hdr->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 810 }
 811
 812 int mt7615_mcu_set_bss_info(struct mt7615_dev *dev,
 813                             struct ieee80211_vif *vif, int en)
 814 {
 815         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 816         struct req_hdr {
 817                 u8 bss_idx;
 818                 u8 rsv0;
 819                 __le16 tlv_num;
 820                 u8 is_tlv_append;
 821                 u8 rsv1[3];
 822         } __packed;
 823         int len = sizeof(struct req_hdr) + sizeof(struct bss_info_basic);
 824         int ret, i, features = BIT(BSS_INFO_BASIC), ntlv = 1;
 825         u32 conn_type = 0, net_type = NETWORK_INFRA;
 826         u8 *buf, *data, tx_wlan_idx = 0;
 827         struct req_hdr *hdr;
 828
 829         if (en) {
 830                 len += sizeof(struct bss_info_omac);
 831                 features |= BIT(BSS_INFO_OMAC);
 832                 if (mvif->omac_idx > EXT_BSSID_START) {
 833                         len += sizeof(struct bss_info_ext_bss);
 834                         features |= BIT(BSS_INFO_EXT_BSS);
 835                         ntlv++;
 836                 }
 837                 ntlv++;
 838         }
 839
 840         switch (vif->type) {
 841         case NL80211_IFTYPE_AP:
 842         case NL80211_IFTYPE_MESH_POINT:
 843                 tx_wlan_idx = mvif->sta.wcid.idx;
 844                 conn_type = CONNECTION_INFRA_AP;
 845                 break;
 846         case NL80211_IFTYPE_STATION: {
 847                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 848                 if (en) {
 849                         struct ieee80211_sta *sta;
 850                         struct mt7615_sta *msta;
 851
 852                         rcu_read_lock();
 853                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 854                         if (!sta) {
 855                                 rcu_read_unlock();
 856                                 return -EINVAL;
 857                         }
 858
 859                         msta = (struct mt7615_sta *)sta->drv_priv;
 860                         tx_wlan_idx = msta->wcid.idx;
 861                         rcu_read_unlock();
 862                 }
 863                 conn_type = CONNECTION_INFRA_STA;
 864                 break;
 865         }
 866         case NL80211_IFTYPE_ADHOC:
 867                 conn_type = CONNECTION_IBSS_ADHOC;
 868                 tx_wlan_idx = mvif->sta.wcid.idx;
 869                 net_type = NETWORK_IBSS;
 870                 break;
 871         default:
 872                 WARN_ON(1);
 873                 break;
 874         }
 875
 876         buf = kzalloc(len, GFP_KERNEL);
 877         if (!buf)
 878                 return -ENOMEM;
 879
 880         hdr = (struct req_hdr *)buf;
 881         hdr->bss_idx = mvif->idx;
 882         hdr->tlv_num = cpu_to_le16(ntlv);
 883         hdr->is_tlv_append = 1;
 884
 885         data = buf + sizeof(*hdr);
 886         for (i = 0; i < BSS_INFO_MAX_NUM; i++) {
 887                 int tag = ffs(features & BIT(i)) - 1;
 888
 889                 switch (tag) {
 890                 case BSS_INFO_OMAC:
 891                         mt7615_mcu_bss_info_omac_header(mvif, data,
 892                                                         conn_type);
 893                         data += sizeof(struct bss_info_omac);
 894                         break;
 895                 case BSS_INFO_BASIC:
 896                         mt7615_mcu_bss_info_basic_header(vif, data, net_type,
 897                                                          tx_wlan_idx, en);
 898                         data += sizeof(struct bss_info_basic);
 899                         break;
 900                 case BSS_INFO_EXT_BSS:
 901                         mt7615_mcu_bss_info_ext_header(mvif, data);
 902                         data += sizeof(struct bss_info_ext_bss);
 903                         break;
 904                 default:
 905                         break;
 906                 }
 907         }
 908
 909         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BSS_INFO_UPDATE,
 910                                   buf, len, true);
 911         kfree(buf);
 912
 913         return ret;
 914 }
 915
 916 static int
 917 mt7615_mcu_add_wtbl_bmc(struct mt7615_dev *dev,
 918                         struct mt7615_vif *mvif)
 919 {
 920         struct {
 921                 struct wtbl_req_hdr hdr;
 922                 struct wtbl_generic g_wtbl;
 923                 struct wtbl_rx rx_wtbl;
 924         } req = {
 925                 .hdr = {
 926                         .wlan_idx = mvif->sta.wcid.idx,
 927                         .operation = WTBL_RESET_AND_SET,
 928                         .tlv_num = cpu_to_le16(2),
 929                 },
 930                 .g_wtbl = {
 931                         .tag = cpu_to_le16(WTBL_GENERIC),
 932                         .len = cpu_to_le16(sizeof(struct wtbl_generic)),
 933                         .muar_idx = 0xe,
 934                 },
 935                 .rx_wtbl = {
 936                         .tag = cpu_to_le16(WTBL_RX),
 937                         .len = cpu_to_le16(sizeof(struct wtbl_rx)),
 938                         .rca1 = 1,
 939                         .rca2 = 1,
 940                         .rv = 1,
 941                 },
 942         };
 943         eth_broadcast_addr(req.g_wtbl.peer_addr);
 944
 945         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 946                                    &req, sizeof(req), true);
 947 }
 948
 949 int mt7615_mcu_wtbl_bmc(struct mt7615_dev *dev,
 950                         struct ieee80211_vif *vif, bool enable)
 951 {
 952         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 953
 954         if (!enable) {
 955                 struct wtbl_req_hdr req = {
 956                         .wlan_idx = mvif->sta.wcid.idx,
 957                         .operation = WTBL_RESET_AND_SET,
 958                 };
 959
 960                 return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 961                                            &req, sizeof(req), true);
 962         }
 963
 964         return mt7615_mcu_add_wtbl_bmc(dev, mvif);
 965 }
 966
 967 int mt7615_mcu_add_wtbl(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 968                         struct ieee80211_sta *sta)
 969 {
 970         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 971         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
 972         struct {
 973                 struct wtbl_req_hdr hdr;
 974                 struct wtbl_generic g_wtbl;
 975                 struct wtbl_rx rx_wtbl;
 976         } req = {
 977                 .hdr = {
 978                         .wlan_idx = msta->wcid.idx,
 979                         .operation = WTBL_RESET_AND_SET,
 980                         .tlv_num = cpu_to_le16(2),
 981                 },
 982                 .g_wtbl = {
 983                         .tag = cpu_to_le16(WTBL_GENERIC),
 984                         .len = cpu_to_le16(sizeof(struct wtbl_generic)),
 985                         .muar_idx = mvif->omac_idx,
 986                         .qos = sta->wme,
 987                         .partial_aid = cpu_to_le16(sta->aid),
 988                 },
 989                 .rx_wtbl = {
 990                         .tag = cpu_to_le16(WTBL_RX),
 991                         .len = cpu_to_le16(sizeof(struct wtbl_rx)),
 992                         .rca1 = vif->type != NL80211_IFTYPE_AP,
 993                         .rca2 = 1,
 994                         .rv = 1,
 995                 },
 996         };
 997         memcpy(req.g_wtbl.peer_addr, sta->addr, ETH_ALEN);
 998
 999         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1000                                    &req, sizeof(req), true);
1001 }
1002
1003 int mt7615_mcu_del_wtbl(struct mt7615_dev *dev,
1004                         struct ieee80211_sta *sta)
1005 {
1006         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1007         struct wtbl_req_hdr req = {
1008                 .wlan_idx = msta->wcid.idx,
1009                 .operation = WTBL_RESET_AND_SET,
1010         };
1011
1012         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1013                                    &req, sizeof(req), true);
1014 }
1015
1016 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1017 {
1018         struct wtbl_req_hdr req = {
1019                 .operation = WTBL_RESET_ALL,
1020         };
1021
1022         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1023                                    &req, sizeof(req), true);
1024 }
1025
1026 int mt7615_mcu_set_sta_rec_bmc(struct mt7615_dev *dev,
1027                                struct ieee80211_vif *vif, bool en)
1028 {
1029         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1030         struct {
1031                 struct sta_req_hdr hdr;
1032                 struct sta_rec_basic basic;
1033         } req = {
1034                 .hdr = {
1035                         .bss_idx = mvif->idx,
1036                         .wlan_idx = mvif->sta.wcid.idx,
1037                         .tlv_num = cpu_to_le16(1),
1038                         .is_tlv_append = 1,
1039                         .muar_idx = mvif->omac_idx,
1040                 },
1041                 .basic = {
1042                         .tag = cpu_to_le16(STA_REC_BASIC),
1043                         .len = cpu_to_le16(sizeof(struct sta_rec_basic)),
1044                         .conn_type = cpu_to_le32(CONNECTION_INFRA_BC),
1045                 },
1046         };
1047         eth_broadcast_addr(req.basic.peer_addr);
1048
1049         if (en) {
1050                 req.basic.conn_state = CONN_STATE_PORT_SECURE;
1051                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER |
1052                                                    EXTRA_INFO_NEW);
1053         } else {
1054                 req.basic.conn_state = CONN_STATE_DISCONNECT;
1055                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER);
1056         }
1057
1058         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1059                                    &req, sizeof(req), true);
1060 }
1061
1062 int mt7615_mcu_set_sta_rec(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1063                            struct ieee80211_sta *sta, bool en)
1064 {
1065         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1066         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1067
1068         struct {
1069                 struct sta_req_hdr hdr;
1070                 struct sta_rec_basic basic;
1071         } req = {
1072                 .hdr = {
1073                         .bss_idx = mvif->idx,
1074                         .wlan_idx = msta->wcid.idx,
1075                         .tlv_num = cpu_to_le16(1),
1076                         .is_tlv_append = 1,
1077                         .muar_idx = mvif->omac_idx,
1078                 },
1079                 .basic = {
1080                         .tag = cpu_to_le16(STA_REC_BASIC),
1081                         .len = cpu_to_le16(sizeof(struct sta_rec_basic)),
1082                         .qos = sta->wme,
1083                         .aid = cpu_to_le16(sta->aid),
1084                 },
1085         };
1086         memcpy(req.basic.peer_addr, sta->addr, ETH_ALEN);
1087
1088         switch (vif->type) {
1089         case NL80211_IFTYPE_AP:
1090         case NL80211_IFTYPE_MESH_POINT:
1091                 req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1092                 break;
1093         case NL80211_IFTYPE_STATION:
1094                 req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1095                 break;
1096         case NL80211_IFTYPE_ADHOC:
1097                 req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1098                 break;
1099         default:
1100                 WARN_ON(1);
1101                 break;
1102         }
1103
1104         if (en) {
1105                 req.basic.conn_state = CONN_STATE_PORT_SECURE;
1106                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER |
1107                                                    EXTRA_INFO_NEW);
1108         } else {
1109                 req.basic.conn_state = CONN_STATE_DISCONNECT;
1110                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER);
1111         }
1112
1113         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1114                                    &req, sizeof(req), true);
1115 }
1116
1117 int mt7615_mcu_set_bcn(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1118                        int en)
1119 {
1120         struct mt7615_dev *dev = mt7615_hw_dev(hw);
1121         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1122         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1123         struct ieee80211_mutable_offsets offs;
1124         struct ieee80211_tx_info *info;
1125         struct req {
1126                 u8 omac_idx;
1127                 u8 enable;
1128                 u8 wlan_idx;
1129                 u8 band_idx;
1130                 u8 pkt_type;
1131                 u8 need_pre_tbtt_int;
1132                 __le16 csa_ie_pos;
1133                 __le16 pkt_len;
1134                 __le16 tim_ie_pos;
1135                 u8 pkt[512];
1136                 u8 csa_cnt;
1137                 /* bss color change */
1138                 u8 bcc_cnt;
1139                 __le16 bcc_ie_pos;
1140         } __packed req = {
1141                 .omac_idx = mvif->omac_idx,
1142                 .enable = en,
1143                 .wlan_idx = wcid->idx,
1144                 .band_idx = mvif->band_idx,
1145         };
1146         struct sk_buff *skb;
1147
1148         skb = ieee80211_beacon_get_template(hw, vif, &offs);
1149         if (!skb)
1150                 return -EINVAL;
1151
1152         if (skb->len > 512 - MT_TXD_SIZE) {
1153                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
1154                 dev_kfree_skb(skb);
1155                 return -EINVAL;
1156         }
1157
1158         if (mvif->band_idx) {
1159                 info = IEEE80211_SKB_CB(skb);
1160                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
1161         }
1162
1163         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
1164                               0, NULL);
1165         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
1166         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1167         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1168         if (offs.csa_counter_offs[0]) {
1169                 u16 csa_offs;
1170
1171                 csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
1172                 req.csa_ie_pos = cpu_to_le16(csa_offs);
1173                 req.csa_cnt = skb->data[offs.csa_counter_offs[0]];
1174         }
1175         dev_kfree_skb(skb);
1176
1177         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD,
1178                                    &req, sizeof(req), true);
1179 }
1180
1181 int mt7615_mcu_set_tx_power(struct mt7615_phy *phy)
1182 {
1183         struct mt7615_dev *dev = phy->dev;
1184         struct mt76_phy *mphy = phy->mt76;
1185         int i, ret, n_chains = hweight8(mphy->antenna_mask);
1186         struct cfg80211_chan_def *chandef = &mphy->chandef;
1187         int freq = chandef->center_freq1, len, target_chains;
1188         u8 *req, *data, *eep = (u8 *)dev->mt76.eeprom.data;
1189         enum nl80211_band band = chandef->chan->band;
1190         struct ieee80211_hw *hw = mphy->hw;
1191         struct {
1192                 u8 center_chan;
1193                 u8 dbdc_idx;
1194                 u8 band;
1195                 u8 rsv;
1196         } __packed req_hdr = {
1197                 .center_chan = ieee80211_frequency_to_channel(freq),
1198                 .band = band,
1199                 .dbdc_idx = phy != &dev->phy,
1200         };
1201         s8 tx_power;
1202
1203         len = sizeof(req_hdr) + __MT_EE_MAX - MT_EE_NIC_CONF_0;
1204         req = kzalloc(len, GFP_KERNEL);
1205         if (!req)
1206                 return -ENOMEM;
1207
1208         memcpy(req, &req_hdr, sizeof(req_hdr));
1209         data = req + sizeof(req_hdr);
1210         memcpy(data, eep + MT_EE_NIC_CONF_0,
1211                __MT_EE_MAX - MT_EE_NIC_CONF_0);
1212
1213         tx_power = hw->conf.power_level * 2;
1214         switch (n_chains) {
1215         case 4:
1216                 tx_power -= 12;
1217                 break;
1218         case 3:
1219                 tx_power -= 8;
1220                 break;
1221         case 2:
1222                 tx_power -= 6;
1223                 break;
1224         default:
1225                 break;
1226         }
1227         tx_power = max_t(s8, tx_power, 0);
1228         mphy->txpower_cur = tx_power;
1229
1230         target_chains = mt7615_ext_pa_enabled(dev, band) ? 1 : n_chains;
1231         for (i = 0; i < target_chains; i++) {
1232                 int index = -MT_EE_NIC_CONF_0;
1233
1234                 ret = mt7615_eeprom_get_power_index(dev, chandef->chan, i);
1235                 if (ret < 0)
1236                         goto out;
1237
1238                 index += ret;
1239                 data[index] = min_t(u8, data[index], tx_power);
1240         }
1241
1242         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_TX_POWER_CTRL,
1243                                   req, len, true);
1244 out:
1245         kfree(req);
1246
1247         return ret;
1248 }
1249
1250 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
1251                        enum mt7615_rdd_cmd cmd, u8 index,
1252                        u8 rx_sel, u8 val)
1253 {
1254         struct {
1255                 u8 ctrl;
1256                 u8 rdd_idx;
1257                 u8 rdd_rx_sel;
1258                 u8 val;
1259                 u8 rsv[4];
1260         } req = {
1261                 .ctrl = cmd,
1262                 .rdd_idx = index,
1263                 .rdd_rx_sel = rx_sel,
1264                 .val = val,
1265         };
1266
1267         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL,
1268                                    &req, sizeof(req), true);
1269 }
1270
1271 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
1272 {
1273         struct {
1274                 u8 pulse_num;
1275                 u8 rsv[3];
1276                 struct {
1277                         u32 start_time;
1278                         u16 width;
1279                         s16 power;
1280                 } pattern[32];
1281         } req = {
1282                 .pulse_num = dev->radar_pattern.n_pulses,
1283         };
1284         u32 start_time = ktime_to_ms(ktime_get_boottime());
1285         int i;
1286
1287         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
1288                 return -EINVAL;
1289
1290         /* TODO: add some noise here */
1291         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
1292                 req.pattern[i].width = dev->radar_pattern.width;
1293                 req.pattern[i].power = dev->radar_pattern.power;
1294                 req.pattern[i].start_time = start_time +
1295                                             i * dev->radar_pattern.period;
1296         }
1297
1298         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
1299                                    &req, sizeof(req), false);
1300 }
1301
1302 int mt7615_mcu_set_channel(struct mt7615_phy *phy)
1303 {
1304         struct mt7615_dev *dev = phy->dev;
1305         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1306         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1307         struct {
1308                 u8 control_chan;
1309                 u8 center_chan;
1310                 u8 bw;
1311                 u8 tx_streams;
1312                 u8 rx_streams_mask;
1313                 u8 switch_reason;
1314                 u8 band_idx;
1315                 /* for 80+80 only */
1316                 u8 center_chan2;
1317                 __le16 cac_case;
1318                 u8 channel_band;
1319                 u8 rsv0;
1320                 __le32 outband_freq;
1321                 u8 txpower_drop;
1322                 u8 rsv1[3];
1323                 u8 txpower_sku[53];
1324                 u8 rsv2[3];
1325         } req = {
1326                 .control_chan = chandef->chan->hw_value,
1327                 .center_chan = ieee80211_frequency_to_channel(freq1),
1328                 .tx_streams = (dev->chainmask >> 8) & 0xf,
1329                 .rx_streams_mask = dev->mphy.antenna_mask,
1330                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
1331         };
1332         int ret;
1333
1334         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
1335                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
1336         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
1337                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
1338                 req.switch_reason = CH_SWITCH_DFS;
1339         else
1340                 req.switch_reason = CH_SWITCH_NORMAL;
1341
1342         req.band_idx = phy != &dev->phy;
1343
1344         switch (chandef->width) {
1345         case NL80211_CHAN_WIDTH_40:
1346                 req.bw = CMD_CBW_40MHZ;
1347                 break;
1348         case NL80211_CHAN_WIDTH_80:
1349                 req.bw = CMD_CBW_80MHZ;
1350                 break;
1351         case NL80211_CHAN_WIDTH_80P80:
1352                 req.bw = CMD_CBW_8080MHZ;
1353                 break;
1354         case NL80211_CHAN_WIDTH_160:
1355                 req.bw = CMD_CBW_160MHZ;
1356                 break;
1357         case NL80211_CHAN_WIDTH_5:
1358                 req.bw = CMD_CBW_5MHZ;
1359                 break;
1360         case NL80211_CHAN_WIDTH_10:
1361                 req.bw = CMD_CBW_10MHZ;
1362                 break;
1363         case NL80211_CHAN_WIDTH_20_NOHT:
1364         case NL80211_CHAN_WIDTH_20:
1365         default:
1366                 req.bw = CMD_CBW_20MHZ;
1367                 break;
1368         }
1369         memset(req.txpower_sku, 0x3f, 49);
1370
1371         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_CHANNEL_SWITCH,
1372                                   &req, sizeof(req), true);
1373         if (ret)
1374                 return ret;
1375
1376         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RX_PATH,
1377                                    &req, sizeof(req), true);
1378 }
1379
1380 int mt7615_mcu_set_ht_cap(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1381                           struct ieee80211_sta *sta)
1382 {
1383         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1384         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1385         struct wtbl_req_hdr *wtbl_hdr;
1386         struct sta_req_hdr *sta_hdr;
1387         struct wtbl_raw *wtbl_raw;
1388         struct sta_rec_ht *sta_ht;
1389         struct wtbl_ht *wtbl_ht;
1390         int buf_len, ret, ntlv = 2;
1391         u32 msk, val = 0;
1392         u8 *buf;
1393
1394         buf = kzalloc(MT7615_WTBL_UPDATE_MAX_SIZE, GFP_KERNEL);
1395         if (!buf)
1396                 return -ENOMEM;
1397
1398         wtbl_hdr = (struct wtbl_req_hdr *)buf;
1399         wtbl_hdr->wlan_idx = msta->wcid.idx;
1400         wtbl_hdr->operation = WTBL_SET;
1401         buf_len = sizeof(*wtbl_hdr);
1402
1403         /* ht basic */
1404         wtbl_ht = (struct wtbl_ht *)(buf + buf_len);
1405         wtbl_ht->tag = cpu_to_le16(WTBL_HT);
1406         wtbl_ht->len = cpu_to_le16(sizeof(*wtbl_ht));
1407         wtbl_ht->ht = 1;
1408         wtbl_ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
1409         wtbl_ht->af = sta->ht_cap.ampdu_factor;
1410         wtbl_ht->mm = sta->ht_cap.ampdu_density;
1411         buf_len += sizeof(*wtbl_ht);
1412
1413         if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1414                 val |= MT_WTBL_W5_SHORT_GI_20;
1415         if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1416                 val |= MT_WTBL_W5_SHORT_GI_40;
1417
1418         /* vht basic */
1419         if (sta->vht_cap.vht_supported) {
1420                 struct wtbl_vht *wtbl_vht;
1421
1422                 wtbl_vht = (struct wtbl_vht *)(buf + buf_len);
1423                 buf_len += sizeof(*wtbl_vht);
1424                 wtbl_vht->tag = cpu_to_le16(WTBL_VHT);
1425                 wtbl_vht->len = cpu_to_le16(sizeof(*wtbl_vht));
1426                 wtbl_vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC;
1427                 wtbl_vht->vht = 1;
1428                 ntlv++;
1429
1430                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1431                         val |= MT_WTBL_W5_SHORT_GI_80;
1432                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1433                         val |= MT_WTBL_W5_SHORT_GI_160;
1434         }
1435
1436         /* smps */
1437         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1438                 struct wtbl_smps *wtbl_smps;
1439
1440                 wtbl_smps = (struct wtbl_smps *)(buf + buf_len);
1441                 buf_len += sizeof(*wtbl_smps);
1442                 wtbl_smps->tag = cpu_to_le16(WTBL_SMPS);
1443                 wtbl_smps->len = cpu_to_le16(sizeof(*wtbl_smps));
1444                 wtbl_smps->smps = 1;
1445                 ntlv++;
1446         }
1447
1448         /* sgi */
1449         msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1450               MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1451
1452         wtbl_raw = (struct wtbl_raw *)(buf + buf_len);
1453         buf_len += sizeof(*wtbl_raw);
1454         wtbl_raw->tag = cpu_to_le16(WTBL_RAW_DATA);
1455         wtbl_raw->len = cpu_to_le16(sizeof(*wtbl_raw));
1456         wtbl_raw->wtbl_idx = 1;
1457         wtbl_raw->dw = 5;
1458         wtbl_raw->msk = cpu_to_le32(~msk);
1459         wtbl_raw->val = cpu_to_le32(val);
1460
1461         wtbl_hdr->tlv_num = cpu_to_le16(ntlv);
1462         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1463                                   buf, buf_len, true);
1464         if (ret)
1465                 goto out;
1466
1467         memset(buf, 0, MT7615_WTBL_UPDATE_MAX_SIZE);
1468
1469         sta_hdr = (struct sta_req_hdr *)buf;
1470         sta_hdr->bss_idx = mvif->idx;
1471         sta_hdr->wlan_idx = msta->wcid.idx;
1472         sta_hdr->is_tlv_append = 1;
1473         ntlv = sta->vht_cap.vht_supported ? 2 : 1;
1474         sta_hdr->tlv_num = cpu_to_le16(ntlv);
1475         sta_hdr->muar_idx = mvif->omac_idx;
1476         buf_len = sizeof(*sta_hdr);
1477
1478         sta_ht = (struct sta_rec_ht *)(buf + buf_len);
1479         sta_ht->tag = cpu_to_le16(STA_REC_HT);
1480         sta_ht->len = cpu_to_le16(sizeof(*sta_ht));
1481         sta_ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1482         buf_len += sizeof(*sta_ht);
1483
1484         if (sta->vht_cap.vht_supported) {
1485                 struct sta_rec_vht *sta_vht;
1486
1487                 sta_vht = (struct sta_rec_vht *)(buf + buf_len);
1488                 buf_len += sizeof(*sta_vht);
1489                 sta_vht->tag = cpu_to_le16(STA_REC_VHT);
1490                 sta_vht->len = cpu_to_le16(sizeof(*sta_vht));
1491                 sta_vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1492                 sta_vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1493                 sta_vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1494         }
1495
1496         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1497                                   buf, buf_len, true);
1498 out:
1499         kfree(buf);
1500
1501         return ret;
1502 }
1503
1504 int mt7615_mcu_set_tx_ba(struct mt7615_dev *dev,
1505                          struct ieee80211_ampdu_params *params,
1506                          bool add)
1507 {
1508         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1509         struct mt7615_vif *mvif = msta->vif;
1510         struct {
1511                 struct wtbl_req_hdr hdr;
1512                 struct wtbl_ba ba;
1513         } wtbl_req = {
1514                 .hdr = {
1515                         .wlan_idx = msta->wcid.idx,
1516                         .operation = WTBL_SET,
1517                         .tlv_num = cpu_to_le16(1),
1518                 },
1519                 .ba = {
1520                         .tag = cpu_to_le16(WTBL_BA),
1521                         .len = cpu_to_le16(sizeof(struct wtbl_ba)),
1522                         .tid = params->tid,
1523                         .ba_type = MT_BA_TYPE_ORIGINATOR,
1524                         .sn = add ? cpu_to_le16(params->ssn) : 0,
1525                         .ba_en = add,
1526                 },
1527         };
1528         struct {
1529                 struct sta_req_hdr hdr;
1530                 struct sta_rec_ba ba;
1531         } sta_req = {
1532                 .hdr = {
1533                         .bss_idx = mvif->idx,
1534                         .wlan_idx = msta->wcid.idx,
1535                         .tlv_num = cpu_to_le16(1),
1536                         .is_tlv_append = 1,
1537                         .muar_idx = mvif->omac_idx,
1538                 },
1539                 .ba = {
1540                         .tag = cpu_to_le16(STA_REC_BA),
1541                         .len = cpu_to_le16(sizeof(struct sta_rec_ba)),
1542                         .tid = params->tid,
1543                         .ba_type = MT_BA_TYPE_ORIGINATOR,
1544                         .amsdu = params->amsdu,
1545                         .ba_en = add << params->tid,
1546                         .ssn = cpu_to_le16(params->ssn),
1547                         .winsize = cpu_to_le16(params->buf_size),
1548                 },
1549         };
1550         int ret;
1551
1552         if (add) {
1553                 u8 idx, ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1554
1555                 for (idx = 7; idx > 0; idx--) {
1556                         if (params->buf_size >= ba_range[idx])
1557                                 break;
1558                 }
1559
1560                 wtbl_req.ba.ba_winsize_idx = idx;
1561         }
1562
1563         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1564                                   &wtbl_req, sizeof(wtbl_req), true);
1565         if (ret)
1566                 return ret;
1567
1568         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1569                                    &sta_req, sizeof(sta_req), true);
1570 }
1571
1572 int mt7615_mcu_set_rx_ba(struct mt7615_dev *dev,
1573                          struct ieee80211_ampdu_params *params,
1574                          bool add)
1575 {
1576         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1577         struct mt7615_vif *mvif = msta->vif;
1578         struct {
1579                 struct wtbl_req_hdr hdr;
1580                 struct wtbl_ba ba;
1581         } wtbl_req = {
1582                 .hdr = {
1583                         .wlan_idx = msta->wcid.idx,
1584                         .operation = WTBL_SET,
1585                         .tlv_num = cpu_to_le16(1),
1586                 },
1587                 .ba = {
1588                         .tag = cpu_to_le16(WTBL_BA),
1589                         .len = cpu_to_le16(sizeof(struct wtbl_ba)),
1590                         .tid = params->tid,
1591                         .ba_type = MT_BA_TYPE_RECIPIENT,
1592                         .rst_ba_tid = params->tid,
1593                         .rst_ba_sel = RST_BA_MAC_TID_MATCH,
1594                         .rst_ba_sb = 1,
1595                 },
1596         };
1597         struct {
1598                 struct sta_req_hdr hdr;
1599                 struct sta_rec_ba ba;
1600         } sta_req = {
1601                 .hdr = {
1602                         .bss_idx = mvif->idx,
1603                         .wlan_idx = msta->wcid.idx,
1604                         .tlv_num = cpu_to_le16(1),
1605                         .is_tlv_append = 1,
1606                         .muar_idx = mvif->omac_idx,
1607                 },
1608                 .ba = {
1609                         .tag = cpu_to_le16(STA_REC_BA),
1610                         .len = cpu_to_le16(sizeof(struct sta_rec_ba)),
1611                         .tid = params->tid,
1612                         .ba_type = MT_BA_TYPE_RECIPIENT,
1613                         .amsdu = params->amsdu,
1614                         .ba_en = add << params->tid,
1615                         .ssn = cpu_to_le16(params->ssn),
1616                         .winsize = cpu_to_le16(params->buf_size),
1617                 },
1618         };
1619         int ret;
1620
1621         memcpy(wtbl_req.ba.peer_addr, params->sta->addr, ETH_ALEN);
1622
1623         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1624                                   &sta_req, sizeof(sta_req), true);
1625         if (ret || !add)
1626                 return ret;
1627
1628         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1629                                    &wtbl_req, sizeof(wtbl_req), true);
1630 }
1631
1632 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
1633 {
1634         struct {
1635                 u8 action;
1636                 u8 rsv[3];
1637         } req = {
1638                 .action = index,
1639         };
1640
1641         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
1642                                    sizeof(req), true);
1643 }