drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 static bool prefer_offload_fw = true;
  15 module_param(prefer_offload_fw, bool, 0644);
  16 MODULE_PARM_DESC(prefer_offload_fw,
  17                  "Prefer client mode offload firmware (MT7663)");
  18
  19 struct mt7615_patch_hdr {
  20         char build_date[16];
  21         char platform[4];
  22         __be32 hw_sw_ver;
  23         __be32 patch_ver;
  24         __be16 checksum;
  25 } __packed;
  26
  27 struct mt7615_fw_trailer {
  28         __le32 addr;
  29         u8 chip_id;
  30         u8 feature_set;
  31         u8 eco_code;
  32         char fw_ver[10];
  33         char build_date[15];
  34         __le32 len;
  35 } __packed;
  36
  37 #define FW_V3_COMMON_TAILER_SIZE        36
  38 #define FW_V3_REGION_TAILER_SIZE        40
  39 #define FW_START_OVERRIDE               BIT(0)
  40 #define FW_START_DLYCAL                 BIT(1)
  41 #define FW_START_WORKING_PDA_CR4        BIT(2)
  42
  43 struct mt7663_fw_trailer {
  44         u8 chip_id;
  45         u8 eco_code;
  46         u8 n_region;
  47         u8 format_ver;
  48         u8 format_flag;
  49         u8 reserv[2];
  50         char fw_ver[10];
  51         char build_date[15];
  52         __le32 crc;
  53 } __packed;
  54
  55 struct mt7663_fw_buf {
  56         __le32 crc;
  57         __le32 d_img_size;
  58         __le32 block_size;
  59         u8 rsv[4];
  60         __le32 img_dest_addr;
  61         __le32 img_size;
  62         u8 feature_set;
  63 };
  64
  65 #define MT7615_PATCH_ADDRESS            0x80000
  66 #define MT7622_PATCH_ADDRESS            0x9c000
  67 #define MT7663_PATCH_ADDRESS            0xdc000
  68
  69 #define N9_REGION_NUM                   2
  70 #define CR4_REGION_NUM                  1
  71
  72 #define IMG_CRC_LEN                     4
  73
  74 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  75 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  76
  77 #define DL_MODE_ENCRYPT                 BIT(0)
  78 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  79 #define DL_MODE_RESET_SEC_IV            BIT(3)
  80 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
  82 #define DL_MODE_NEED_RSP                BIT(31)
  83
  84 #define FW_START_OVERRIDE               BIT(0)
  85 #define FW_START_WORKING_PDA_CR4        BIT(2)
  86
  87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
  88                          int cmd, int *wait_seq)
  89 {
  90         int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
  91         struct mt7615_uni_txd *uni_txd;
  92         struct mt7615_mcu_txd *mcu_txd;
  93         u8 seq, q_idx, pkt_fmt;
  94         __le32 *txd;
  95         u32 val;
  96
  97         seq = ++dev->mt76.mcu.msg_seq & 0xf;
  98         if (!seq)
  99                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 100         if (wait_seq)
 101                 *wait_seq = seq;
 102
 103         txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 104         txd = (__le32 *)skb_push(skb, txd_len);
 105
 106         if (cmd != MCU_CMD_FW_SCATTER) {
 107                 q_idx = MT_TX_MCU_PORT_RX_Q0;
 108                 pkt_fmt = MT_TX_TYPE_CMD;
 109         } else {
 110                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
 111                 pkt_fmt = MT_TX_TYPE_FW;
 112         }
 113
 114         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 115               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
 116               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
 117         txd[0] = cpu_to_le32(val);
 118
 119         val = MT_TXD1_LONG_FORMAT |
 120               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
 121               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
 122         txd[1] = cpu_to_le32(val);
 123
 124         if (cmd & MCU_UNI_PREFIX) {
 125                 uni_txd = (struct mt7615_uni_txd *)txd;
 126                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 127                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 128                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 129                 uni_txd->s2d_index = MCU_S2D_H2N;
 130                 uni_txd->pkt_type = MCU_PKT_ID;
 131                 uni_txd->seq = seq;
 132
 133                 return;
 134         }
 135
 136         mcu_txd = (struct mt7615_mcu_txd *)txd;
 137         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 138         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
 139         mcu_txd->s2d_index = MCU_S2D_H2N;
 140         mcu_txd->pkt_type = MCU_PKT_ID;
 141         mcu_txd->seq = seq;
 142
 143         switch (cmd & ~MCU_CMD_MASK) {
 144         case MCU_FW_PREFIX:
 145                 mcu_txd->set_query = MCU_Q_NA;
 146                 mcu_txd->cid = mcu_cmd;
 147                 break;
 148         case MCU_CE_PREFIX:
 149                 if (cmd & MCU_QUERY_MASK)
 150                         mcu_txd->set_query = MCU_Q_QUERY;
 151                 else
 152                         mcu_txd->set_query = MCU_Q_SET;
 153                 mcu_txd->cid = mcu_cmd;
 154                 break;
 155         default:
 156                 mcu_txd->cid = MCU_CMD_EXT_CID;
 157                 if (cmd & MCU_QUERY_PREFIX)
 158                         mcu_txd->set_query = MCU_Q_QUERY;
 159                 else
 160                         mcu_txd->set_query = MCU_Q_SET;
 161                 mcu_txd->ext_cid = mcu_cmd;
 162                 mcu_txd->ext_cid_ack = 1;
 163                 break;
 164         }
 165 }
 166 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
 167
 168 static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
 169                                  int cmd, int *wait_seq)
 170 {
 171         enum mt76_txq_id qid;
 172
 173         mt7615_mcu_fill_msg(dev, skb, cmd, wait_seq);
 174         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 175                 qid = MT_TXQ_MCU;
 176         else
 177                 qid = MT_TXQ_FWDL;
 178
 179         return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
 180 }
 181
 182 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 183                               struct sk_buff *skb, int seq)
 184 {
 185         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 186         int ret = 0;
 187
 188         if (seq != rxd->seq)
 189                 return -EAGAIN;
 190
 191         switch (cmd) {
 192         case MCU_CMD_PATCH_SEM_CONTROL:
 193                 skb_pull(skb, sizeof(*rxd) - 4);
 194                 ret = *skb->data;
 195                 break;
 196         case MCU_EXT_CMD_GET_TEMP:
 197                 skb_pull(skb, sizeof(*rxd));
 198                 ret = le32_to_cpu(*(__le32 *)skb->data);
 199                 break;
 200         case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
 201                 skb_pull(skb, sizeof(*rxd));
 202                 ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
 203                 break;
 204         case MCU_UNI_CMD_DEV_INFO_UPDATE:
 205         case MCU_UNI_CMD_BSS_INFO_UPDATE:
 206         case MCU_UNI_CMD_STA_REC_UPDATE:
 207         case MCU_UNI_CMD_HIF_CTRL:
 208         case MCU_UNI_CMD_OFFLOAD:
 209         case MCU_UNI_CMD_SUSPEND: {
 210                 struct mt7615_mcu_uni_event *event;
 211
 212                 skb_pull(skb, sizeof(*rxd));
 213                 event = (struct mt7615_mcu_uni_event *)skb->data;
 214                 ret = le32_to_cpu(event->status);
 215                 break;
 216         }
 217         case MCU_CMD_REG_READ: {
 218                 struct mt7615_mcu_reg_event *event;
 219
 220                 skb_pull(skb, sizeof(*rxd));
 221                 event = (struct mt7615_mcu_reg_event *)skb->data;
 222                 ret = (int)le32_to_cpu(event->val);
 223                 break;
 224         }
 225         default:
 226                 break;
 227         }
 228
 229         return ret;
 230 }
 231 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
 232
 233 int mt7615_mcu_wait_response(struct mt7615_dev *dev, int cmd, int seq)
 234 {
 235         unsigned long expires = jiffies + 20 * HZ;
 236         struct sk_buff *skb;
 237         int ret = 0;
 238
 239         while (true) {
 240                 skb = mt76_mcu_get_response(&dev->mt76, expires);
 241                 if (!skb) {
 242                         dev_err(dev->mt76.dev, "Message %ld (seq %d) timeout\n",
 243                                 cmd & MCU_CMD_MASK, seq);
 244                         return -ETIMEDOUT;
 245                 }
 246
 247                 ret = mt7615_mcu_parse_response(&dev->mt76, cmd, skb, seq);
 248                 dev_kfree_skb(skb);
 249                 if (ret != -EAGAIN)
 250                         break;
 251         }
 252
 253         return ret;
 254 }
 255 EXPORT_SYMBOL_GPL(mt7615_mcu_wait_response);
 256
 257 static int
 258 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 259                         int cmd, bool wait_resp)
 260 {
 261         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 262         int ret, seq;
 263
 264         mutex_lock(&mdev->mcu.mutex);
 265
 266         ret = __mt7615_mcu_msg_send(dev, skb, cmd, &seq);
 267         if (ret)
 268                 goto out;
 269
 270         if (wait_resp)
 271                 ret = mt7615_mcu_wait_response(dev, cmd, seq);
 272
 273 out:
 274         mutex_unlock(&mdev->mcu.mutex);
 275
 276         return ret;
 277 }
 278
 279 int mt7615_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
 280                         int len, bool wait_resp)
 281 {
 282         struct sk_buff *skb;
 283
 284         skb = mt76_mcu_msg_alloc(mdev, data, len);
 285         if (!skb)
 286                 return -ENOMEM;
 287
 288         return mt76_mcu_skb_send_msg(mdev, skb, cmd, wait_resp);
 289 }
 290 EXPORT_SYMBOL_GPL(mt7615_mcu_msg_send);
 291
 292 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
 293 {
 294         struct {
 295                 __le32 wifi_stream;
 296                 __le32 address;
 297                 __le32 data;
 298         } req = {
 299                 .wifi_stream = cpu_to_le32(wf),
 300                 .address = cpu_to_le32(reg),
 301         };
 302
 303         return mt76_mcu_send_msg(&dev->mt76,
 304                                  MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
 305                                  &req, sizeof(req), true);
 306 }
 307
 308 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
 309 {
 310         struct {
 311                 __le32 wifi_stream;
 312                 __le32 address;
 313                 __le32 data;
 314         } req = {
 315                 .wifi_stream = cpu_to_le32(wf),
 316                 .address = cpu_to_le32(reg),
 317                 .data = cpu_to_le32(val),
 318         };
 319
 320         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
 321                                  sizeof(req), false);
 322 }
 323
 324 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
 325 {
 326         if (!is_mt7622(&dev->mt76))
 327                 return;
 328
 329         regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
 330                            MT_INFRACFG_MISC_AP2CONN_WAKE,
 331                            !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
 332 }
 333
 334 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
 335 {
 336         struct mt76_phy *mphy = &dev->mt76.phy;
 337         struct mt76_dev *mdev = &dev->mt76;
 338         u32 addr;
 339         int err;
 340
 341         addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
 342         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
 343
 344         mt7622_trigger_hif_int(dev, true);
 345
 346         addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 347         err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 348
 349         mt7622_trigger_hif_int(dev, false);
 350
 351         if (err) {
 352                 dev_err(mdev->dev, "driver own failed\n");
 353                 return -ETIMEDOUT;
 354         }
 355
 356         clear_bit(MT76_STATE_PM, &mphy->state);
 357
 358         return 0;
 359 }
 360
 361 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
 362 {
 363         struct mt76_phy *mphy = &dev->mt76.phy;
 364         int i;
 365
 366         if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
 367                 goto out;
 368
 369         for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
 370                 mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 371                 if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
 372                                    MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
 373                         break;
 374         }
 375
 376         if (i == MT7615_DRV_OWN_RETRY_COUNT) {
 377                 dev_err(dev->mt76.dev, "driver own failed\n");
 378                 set_bit(MT76_STATE_PM, &mphy->state);
 379                 return -EIO;
 380         }
 381
 382 out:
 383         dev->pm.last_activity = jiffies;
 384
 385         return 0;
 386 }
 387
 388 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
 389 {
 390         struct mt76_phy *mphy = &dev->mt76.phy;
 391         int err = 0;
 392         u32 addr;
 393
 394         if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
 395                 return 0;
 396
 397         mt7622_trigger_hif_int(dev, true);
 398
 399         addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 400         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
 401
 402         if (is_mt7622(&dev->mt76) &&
 403             !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
 404                             MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
 405                 dev_err(dev->mt76.dev, "Timeout for firmware own\n");
 406                 clear_bit(MT76_STATE_PM, &mphy->state);
 407                 err = -EIO;
 408         }
 409
 410         mt7622_trigger_hif_int(dev, false);
 411
 412         return err;
 413 }
 414
 415 static void
 416 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 417 {
 418         if (vif->csa_active)
 419                 ieee80211_csa_finish(vif);
 420 }
 421
 422 static void
 423 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 424 {
 425         struct mt76_phy *mphy = &dev->mt76.phy;
 426         struct mt7615_mcu_rdd_report *r;
 427
 428         r = (struct mt7615_mcu_rdd_report *)skb->data;
 429
 430         if (r->idx && dev->mt76.phy2)
 431                 mphy = dev->mt76.phy2;
 432
 433         ieee80211_radar_detected(mphy->hw);
 434         dev->hw_pattern++;
 435 }
 436
 437 static void
 438 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
 439 {
 440         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 441         const char *data = (char *)&rxd[1];
 442         const char *type;
 443
 444         switch (rxd->s2d_index) {
 445         case 0:
 446                 type = "N9";
 447                 break;
 448         case 2:
 449                 type = "CR4";
 450                 break;
 451         default:
 452                 type = "unknown";
 453                 break;
 454         }
 455
 456         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 457 }
 458
 459 static void
 460 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 461 {
 462         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 463
 464         switch (rxd->ext_eid) {
 465         case MCU_EXT_EVENT_RDD_REPORT:
 466                 mt7615_mcu_rx_radar_detected(dev, skb);
 467                 break;
 468         case MCU_EXT_EVENT_CSA_NOTIFY:
 469                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 470                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 471                                 mt7615_mcu_csa_finish, dev);
 472                 break;
 473         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 474                 mt7615_mcu_rx_log_message(dev, skb);
 475                 break;
 476         default:
 477                 break;
 478         }
 479 }
 480
 481 static void
 482 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
 483 {
 484         u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
 485         struct mt7615_phy *phy;
 486         struct mt76_phy *mphy;
 487
 488         if (*seq_num & BIT(7) && dev->mt76.phy2)
 489                 mphy = dev->mt76.phy2;
 490         else
 491                 mphy = &dev->mt76.phy;
 492
 493         phy = (struct mt7615_phy *)mphy->priv;
 494
 495         spin_lock_bh(&dev->mt76.lock);
 496         __skb_queue_tail(&phy->scan_event_list, skb);
 497         spin_unlock_bh(&dev->mt76.lock);
 498
 499         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 500                                      MT7615_HW_SCAN_TIMEOUT);
 501 }
 502
 503 static void
 504 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
 505 {
 506         struct mt7615_roc_tlv *event;
 507         struct mt7615_phy *phy;
 508         struct mt76_phy *mphy;
 509         int duration;
 510
 511         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 512         event = (struct mt7615_roc_tlv *)skb->data;
 513
 514         if (event->dbdc_band && dev->mt76.phy2)
 515                 mphy = dev->mt76.phy2;
 516         else
 517                 mphy = &dev->mt76.phy;
 518
 519         ieee80211_ready_on_channel(mphy->hw);
 520
 521         phy = (struct mt7615_phy *)mphy->priv;
 522         phy->roc_grant = true;
 523         wake_up(&phy->roc_wait);
 524
 525         duration = le32_to_cpu(event->max_interval);
 526         mod_timer(&phy->roc_timer,
 527                   round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
 528 }
 529
 530 static void
 531 mt7615_mcu_beacon_loss_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
 532 {
 533         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 534         struct mt7615_beacon_loss_event *event = priv;
 535
 536         if (mvif->idx != event->bss_idx)
 537                 return;
 538
 539         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
 540                 return;
 541
 542         ieee80211_beacon_loss(vif);
 543 }
 544
 545 static void
 546 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 547 {
 548         struct mt7615_beacon_loss_event *event;
 549         struct mt76_phy *mphy;
 550         u8 band_idx = 0; /* DBDC support */
 551
 552         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 553         event = (struct mt7615_beacon_loss_event *)skb->data;
 554         if (band_idx && dev->mt76.phy2)
 555                 mphy = dev->mt76.phy2;
 556         else
 557                 mphy = &dev->mt76.phy;
 558
 559         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 560                                         IEEE80211_IFACE_ITER_RESUME_ALL,
 561                                         mt7615_mcu_beacon_loss_iter, event);
 562 }
 563
 564 static void
 565 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 566 {
 567         struct mt7615_mcu_bss_event *event;
 568         struct mt76_phy *mphy;
 569         u8 band_idx = 0; /* DBDC support */
 570
 571         event = (struct mt7615_mcu_bss_event *)(skb->data +
 572                                                 sizeof(struct mt7615_mcu_rxd));
 573
 574         if (band_idx && dev->mt76.phy2)
 575                 mphy = dev->mt76.phy2;
 576         else
 577                 mphy = &dev->mt76.phy;
 578
 579         if (event->is_absent)
 580                 ieee80211_stop_queues(mphy->hw);
 581         else
 582                 ieee80211_wake_queues(mphy->hw);
 583 }
 584
 585 static void
 586 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 587 {
 588         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 589
 590         switch (rxd->eid) {
 591         case MCU_EVENT_EXT:
 592                 mt7615_mcu_rx_ext_event(dev, skb);
 593                 break;
 594         case MCU_EVENT_BSS_BEACON_LOSS:
 595                 mt7615_mcu_beacon_loss_event(dev, skb);
 596                 break;
 597         case MCU_EVENT_ROC:
 598                 mt7615_mcu_roc_event(dev, skb);
 599                 break;
 600         case MCU_EVENT_SCHED_SCAN_DONE:
 601         case MCU_EVENT_SCAN_DONE:
 602                 mt7615_mcu_scan_event(dev, skb);
 603                 return;
 604         case MCU_EVENT_BSS_ABSENCE:
 605                 mt7615_mcu_bss_event(dev, skb);
 606                 break;
 607         default:
 608                 break;
 609         }
 610         dev_kfree_skb(skb);
 611 }
 612
 613 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 614 {
 615         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 616
 617         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 618             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 619             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 620             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 621             rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 622             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 623             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 624             rxd->eid == MCU_EVENT_SCAN_DONE ||
 625             rxd->eid == MCU_EVENT_ROC ||
 626             !rxd->seq)
 627                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 628         else
 629                 mt76_mcu_rx_event(&dev->mt76, skb);
 630 }
 631
 632 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
 633                                     u32 len, u32 mode)
 634 {
 635         struct {
 636                 __le32 addr;
 637                 __le32 len;
 638                 __le32 mode;
 639         } req = {
 640                 .addr = cpu_to_le32(addr),
 641                 .len = cpu_to_le32(len),
 642                 .mode = cpu_to_le32(mode),
 643         };
 644
 645         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TARGET_ADDRESS_LEN_REQ,
 646                                  &req, sizeof(req), true);
 647 }
 648
 649 static int
 650 mt7615_mcu_add_dev(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 651                    bool enable)
 652 {
 653         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 654         struct {
 655                 struct req_hdr {
 656                         u8 omac_idx;
 657                         u8 band_idx;
 658                         __le16 tlv_num;
 659                         u8 is_tlv_append;
 660                         u8 rsv[3];
 661                 } __packed hdr;
 662                 struct req_tlv {
 663                         __le16 tag;
 664                         __le16 len;
 665                         u8 active;
 666                         u8 band_idx;
 667                         u8 omac_addr[ETH_ALEN];
 668                 } __packed tlv;
 669         } data = {
 670                 .hdr = {
 671                         .omac_idx = mvif->omac_idx,
 672                         .band_idx = mvif->band_idx,
 673                         .tlv_num = cpu_to_le16(1),
 674                         .is_tlv_append = 1,
 675                 },
 676                 .tlv = {
 677                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 678                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 679                         .active = enable,
 680                         .band_idx = mvif->band_idx,
 681                 },
 682         };
 683
 684         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 685         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 686                                  &data, sizeof(data), true);
 687 }
 688
 689 static int
 690 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
 691                               struct ieee80211_hw *hw,
 692                               struct ieee80211_vif *vif, bool enable)
 693 {
 694         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 695         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
 696         struct ieee80211_mutable_offsets offs;
 697         struct ieee80211_tx_info *info;
 698         struct req {
 699                 u8 omac_idx;
 700                 u8 enable;
 701                 u8 wlan_idx;
 702                 u8 band_idx;
 703                 u8 pkt_type;
 704                 u8 need_pre_tbtt_int;
 705                 __le16 csa_ie_pos;
 706                 __le16 pkt_len;
 707                 __le16 tim_ie_pos;
 708                 u8 pkt[512];
 709                 u8 csa_cnt;
 710                 /* bss color change */
 711                 u8 bcc_cnt;
 712                 __le16 bcc_ie_pos;
 713         } __packed req = {
 714                 .omac_idx = mvif->omac_idx,
 715                 .enable = enable,
 716                 .wlan_idx = wcid->idx,
 717                 .band_idx = mvif->band_idx,
 718         };
 719         struct sk_buff *skb;
 720
 721         skb = ieee80211_beacon_get_template(hw, vif, &offs);
 722         if (!skb)
 723                 return -EINVAL;
 724
 725         if (skb->len > 512 - MT_TXD_SIZE) {
 726                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
 727                 dev_kfree_skb(skb);
 728                 return -EINVAL;
 729         }
 730
 731         if (mvif->band_idx) {
 732                 info = IEEE80211_SKB_CB(skb);
 733                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
 734         }
 735
 736         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
 737                               0, NULL, true);
 738         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
 739         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 740         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
 741         if (offs.cntdwn_counter_offs[0]) {
 742                 u16 csa_offs;
 743
 744                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
 745                 req.csa_ie_pos = cpu_to_le16(csa_offs);
 746                 req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
 747         }
 748         dev_kfree_skb(skb);
 749
 750         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
 751                                  sizeof(req), true);
 752 }
 753
 754 static int
 755 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
 756 {
 757 #define ENTER_PM_STATE  1
 758 #define EXIT_PM_STATE   2
 759         struct {
 760                 u8 pm_number;
 761                 u8 pm_state;
 762                 u8 bssid[ETH_ALEN];
 763                 u8 dtim_period;
 764                 u8 wlan_idx;
 765                 __le16 bcn_interval;
 766                 __le32 aid;
 767                 __le32 rx_filter;
 768                 u8 band_idx;
 769                 u8 rsv[3];
 770                 __le32 feature;
 771                 u8 omac_idx;
 772                 u8 wmm_idx;
 773                 u8 bcn_loss_cnt;
 774                 u8 bcn_sp_duration;
 775         } __packed req = {
 776                 .pm_number = 5,
 777                 .pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
 778                 .band_idx = band,
 779         };
 780
 781         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
 782                                  sizeof(req), true);
 783 }
 784
 785 static struct sk_buff *
 786 mt7615_mcu_alloc_sta_req(struct mt7615_dev *dev, struct mt7615_vif *mvif,
 787                          struct mt7615_sta *msta)
 788 {
 789         struct sta_req_hdr hdr = {
 790                 .bss_idx = mvif->idx,
 791                 .wlan_idx = msta ? msta->wcid.idx : 0,
 792                 .muar_idx = msta ? mvif->omac_idx : 0,
 793                 .is_tlv_append = 1,
 794         };
 795         struct sk_buff *skb;
 796
 797         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7615_STA_UPDATE_MAX_SIZE);
 798         if (!skb)
 799                 return ERR_PTR(-ENOMEM);
 800
 801         skb_put_data(skb, &hdr, sizeof(hdr));
 802
 803         return skb;
 804 }
 805
 806 static struct wtbl_req_hdr *
 807 mt7615_mcu_alloc_wtbl_req(struct mt7615_dev *dev, struct mt7615_sta *msta,
 808                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 809 {
 810         struct tlv *sta_hdr = sta_wtbl;
 811         struct wtbl_req_hdr hdr = {
 812                 .wlan_idx = msta->wcid.idx,
 813                 .operation = cmd,
 814         };
 815         struct sk_buff *nskb = *skb;
 816
 817         if (!nskb) {
 818                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 819                                           MT7615_WTBL_UPDATE_BA_SIZE);
 820                 if (!nskb)
 821                         return ERR_PTR(-ENOMEM);
 822
 823                 *skb = nskb;
 824         }
 825
 826         if (sta_hdr)
 827                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 828
 829         return skb_put_data(nskb, &hdr, sizeof(hdr));
 830 }
 831
 832 static struct tlv *
 833 mt7615_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 834                           void *sta_ntlv, void *sta_wtbl)
 835 {
 836         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 837         struct tlv *sta_hdr = sta_wtbl;
 838         struct tlv *ptlv, tlv = {
 839                 .tag = cpu_to_le16(tag),
 840                 .len = cpu_to_le16(len),
 841         };
 842         u16 ntlv;
 843
 844         ptlv = skb_put(skb, len);
 845         memcpy(ptlv, &tlv, sizeof(tlv));
 846
 847         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 848         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 849
 850         if (sta_hdr) {
 851                 u16 size = le16_to_cpu(sta_hdr->len);
 852
 853                 sta_hdr->len = cpu_to_le16(size + len);
 854         }
 855
 856         return ptlv;
 857 }
 858
 859 static struct tlv *
 860 mt7615_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 861 {
 862         return mt7615_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 863 }
 864
 865 static int
 866 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 867                          struct ieee80211_sta *sta, bool enable)
 868 {
 869         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 870         u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
 871         struct bss_info_basic *bss;
 872         u8 wlan_idx = mvif->sta.wcid.idx;
 873         struct tlv *tlv;
 874
 875         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 876
 877         switch (vif->type) {
 878         case NL80211_IFTYPE_MESH_POINT:
 879         case NL80211_IFTYPE_AP:
 880                 break;
 881         case NL80211_IFTYPE_STATION:
 882                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 883                 if (enable && sta) {
 884                         struct mt7615_sta *msta;
 885
 886                         msta = (struct mt7615_sta *)sta->drv_priv;
 887                         wlan_idx = msta->wcid.idx;
 888                 }
 889                 break;
 890         case NL80211_IFTYPE_ADHOC:
 891                 type = NETWORK_IBSS;
 892                 break;
 893         default:
 894                 WARN_ON(1);
 895                 break;
 896         }
 897
 898         bss = (struct bss_info_basic *)tlv;
 899         memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 900         bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 901         bss->network_type = cpu_to_le32(type);
 902         bss->dtim_period = vif->bss_conf.dtim_period;
 903         bss->bmc_tx_wlan_idx = wlan_idx;
 904         bss->wmm_idx = mvif->wmm_idx;
 905         bss->active = enable;
 906
 907         return 0;
 908 }
 909
 910 static void
 911 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 912 {
 913         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 914         struct bss_info_omac *omac;
 915         struct tlv *tlv;
 916         u32 type = 0;
 917         u8 idx;
 918
 919         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 920
 921         switch (vif->type) {
 922         case NL80211_IFTYPE_MESH_POINT:
 923         case NL80211_IFTYPE_AP:
 924                 if (vif->p2p)
 925                         type = CONNECTION_P2P_GO;
 926                 else
 927                         type = CONNECTION_INFRA_AP;
 928                 break;
 929         case NL80211_IFTYPE_STATION:
 930                 if (vif->p2p)
 931                         type = CONNECTION_P2P_GC;
 932                 else
 933                         type = CONNECTION_INFRA_STA;
 934                 break;
 935         case NL80211_IFTYPE_ADHOC:
 936                 type = CONNECTION_IBSS_ADHOC;
 937                 break;
 938         default:
 939                 WARN_ON(1);
 940                 break;
 941         }
 942
 943         omac = (struct bss_info_omac *)tlv;
 944         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 945         omac->conn_type = cpu_to_le32(type);
 946         omac->omac_idx = mvif->omac_idx;
 947         omac->band_idx = mvif->band_idx;
 948         omac->hw_bss_idx = idx;
 949 }
 950
 951 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 952 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 953 static void
 954 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
 955 {
 956         struct bss_info_ext_bss *ext;
 957         int ext_bss_idx, tsf_offset;
 958         struct tlv *tlv;
 959
 960         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 961         if (ext_bss_idx < 0)
 962                 return;
 963
 964         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 965
 966         ext = (struct bss_info_ext_bss *)tlv;
 967         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 968         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 969 }
 970
 971 static void
 972 mt7615_mcu_sta_ba_tlv(struct sk_buff *skb,
 973                       struct ieee80211_ampdu_params *params,
 974                       bool enable, bool tx)
 975 {
 976         struct sta_rec_ba *ba;
 977         struct tlv *tlv;
 978
 979         tlv = mt7615_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
 980
 981         ba = (struct sta_rec_ba *)tlv;
 982         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
 983         ba->winsize = cpu_to_le16(params->buf_size);
 984         ba->ssn = cpu_to_le16(params->ssn);
 985         ba->ba_en = enable << params->tid;
 986         ba->amsdu = params->amsdu;
 987         ba->tid = params->tid;
 988 }
 989
 990 static void
 991 mt7615_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 992                          struct ieee80211_sta *sta, bool enable)
 993 {
 994         struct sta_rec_basic *basic;
 995         struct tlv *tlv;
 996         int conn_type;
 997
 998         tlv = mt7615_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
 999
1000         basic = (struct sta_rec_basic *)tlv;
1001         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1002
1003         if (enable) {
1004                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1005                 basic->conn_state = CONN_STATE_PORT_SECURE;
1006         } else {
1007                 basic->conn_state = CONN_STATE_DISCONNECT;
1008         }
1009
1010         if (!sta) {
1011                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1012                 eth_broadcast_addr(basic->peer_addr);
1013                 return;
1014         }
1015
1016         switch (vif->type) {
1017         case NL80211_IFTYPE_MESH_POINT:
1018         case NL80211_IFTYPE_AP:
1019                 if (vif->p2p)
1020                         conn_type = CONNECTION_P2P_GC;
1021                 else
1022                         conn_type = CONNECTION_INFRA_STA;
1023                 basic->conn_type = cpu_to_le32(conn_type);
1024                 basic->aid = cpu_to_le16(sta->aid);
1025                 break;
1026         case NL80211_IFTYPE_STATION:
1027                 if (vif->p2p)
1028                         conn_type = CONNECTION_P2P_GO;
1029                 else
1030                         conn_type = CONNECTION_INFRA_AP;
1031                 basic->conn_type = cpu_to_le32(conn_type);
1032                 basic->aid = cpu_to_le16(vif->bss_conf.aid);
1033                 break;
1034         case NL80211_IFTYPE_ADHOC:
1035                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1036                 basic->aid = cpu_to_le16(sta->aid);
1037                 break;
1038         default:
1039                 WARN_ON(1);
1040                 break;
1041         }
1042
1043         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1044         basic->qos = sta->wme;
1045 }
1046
1047 static void
1048 mt7615_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1049 {
1050         struct tlv *tlv;
1051
1052         if (sta->ht_cap.ht_supported) {
1053                 struct sta_rec_ht *ht;
1054
1055                 tlv = mt7615_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1056                 ht = (struct sta_rec_ht *)tlv;
1057                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1058         }
1059         if (sta->vht_cap.vht_supported) {
1060                 struct sta_rec_vht *vht;
1061
1062                 tlv = mt7615_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1063                 vht = (struct sta_rec_vht *)tlv;
1064                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1065                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1066                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1067         }
1068 }
1069
1070 static void
1071 mt7615_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,
1072                      struct ieee80211_sta *sta)
1073 {
1074         struct sta_rec_uapsd *uapsd;
1075         struct tlv *tlv;
1076
1077         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1078                 return;
1079
1080         tlv = mt7615_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1081         uapsd = (struct sta_rec_uapsd *)tlv;
1082
1083         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1084                 uapsd->dac_map |= BIT(3);
1085                 uapsd->tac_map |= BIT(3);
1086         }
1087         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1088                 uapsd->dac_map |= BIT(2);
1089                 uapsd->tac_map |= BIT(2);
1090         }
1091         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1092                 uapsd->dac_map |= BIT(1);
1093                 uapsd->tac_map |= BIT(1);
1094         }
1095         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1096                 uapsd->dac_map |= BIT(0);
1097                 uapsd->tac_map |= BIT(0);
1098         }
1099         uapsd->max_sp = sta->max_sp;
1100 }
1101
1102 static void
1103 mt7615_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1104                        struct ieee80211_ampdu_params *params,
1105                        bool enable, bool tx, void *sta_wtbl,
1106                        void *wtbl_tlv)
1107 {
1108         struct wtbl_ba *ba;
1109         struct tlv *tlv;
1110
1111         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1112                                         wtbl_tlv, sta_wtbl);
1113
1114         ba = (struct wtbl_ba *)tlv;
1115         ba->tid = params->tid;
1116
1117         if (tx) {
1118                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1119                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1120                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1121                 ba->ba_en = enable;
1122         } else {
1123                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1124                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1125                 ba->rst_ba_tid = params->tid;
1126                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1127                 ba->rst_ba_sb = 1;
1128         }
1129
1130         if (enable && tx) {
1131                 u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1132                 int i;
1133
1134                 for (i = 7; i > 0; i--) {
1135                         if (params->buf_size >= ba_range[i])
1136                                 break;
1137                 }
1138                 ba->ba_winsize_idx = i;
1139         }
1140 }
1141
1142 static void
1143 mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1144                             struct ieee80211_sta *sta, void *sta_wtbl,
1145                             void *wtbl_tlv)
1146 {
1147         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1148         struct wtbl_generic *generic;
1149         struct wtbl_rx *rx;
1150         struct wtbl_spe *spe;
1151         struct tlv *tlv;
1152
1153         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1154                                         wtbl_tlv, sta_wtbl);
1155
1156         generic = (struct wtbl_generic *)tlv;
1157
1158         if (sta) {
1159                 if (vif->type == NL80211_IFTYPE_STATION)
1160                         generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
1161                 else
1162                         generic->partial_aid = cpu_to_le16(sta->aid);
1163                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1164                 generic->muar_idx = mvif->omac_idx;
1165                 generic->qos = sta->wme;
1166         } else {
1167                 eth_broadcast_addr(generic->peer_addr);
1168                 generic->muar_idx = 0xe;
1169         }
1170
1171         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1172                                         wtbl_tlv, sta_wtbl);
1173
1174         rx = (struct wtbl_rx *)tlv;
1175         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1176         rx->rca2 = 1;
1177         rx->rv = 1;
1178
1179         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
1180                                         wtbl_tlv, sta_wtbl);
1181         spe = (struct wtbl_spe *)tlv;
1182         spe->spe_idx = 24;
1183 }
1184
1185 static void
1186 mt7615_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1187                        void *sta_wtbl, void *wtbl_tlv)
1188 {
1189         struct tlv *tlv;
1190         struct wtbl_ht *ht = NULL;
1191         u32 flags = 0;
1192
1193         if (sta->ht_cap.ht_supported) {
1194                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1195                                                 wtbl_tlv, sta_wtbl);
1196                 ht = (struct wtbl_ht *)tlv;
1197                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1198                 ht->af = sta->ht_cap.ampdu_factor;
1199                 ht->mm = sta->ht_cap.ampdu_density;
1200                 ht->ht = 1;
1201
1202                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1203                         flags |= MT_WTBL_W5_SHORT_GI_20;
1204                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1205                         flags |= MT_WTBL_W5_SHORT_GI_40;
1206         }
1207
1208         if (sta->vht_cap.vht_supported) {
1209                 struct wtbl_vht *vht;
1210                 u8 af;
1211
1212                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1213                                                 wtbl_tlv, sta_wtbl);
1214                 vht = (struct wtbl_vht *)tlv;
1215                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1216                 vht->vht = 1;
1217
1218                 af = (sta->vht_cap.cap &
1219                       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
1220                       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
1221
1222                 if (ht)
1223                     ht->af = max(ht->af, af);
1224
1225                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1226                         flags |= MT_WTBL_W5_SHORT_GI_80;
1227                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1228                         flags |= MT_WTBL_W5_SHORT_GI_160;
1229         }
1230
1231         /* wtbl smps */
1232         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1233                 struct wtbl_smps *smps;
1234
1235                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1236                                                 wtbl_tlv, sta_wtbl);
1237                 smps = (struct wtbl_smps *)tlv;
1238                 smps->smps = 1;
1239         }
1240
1241         if (sta->ht_cap.ht_supported) {
1242                 /* sgi */
1243                 u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1244                           MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1245                 struct wtbl_raw *raw;
1246
1247                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
1248                                                 sizeof(*raw), wtbl_tlv,
1249                                                 sta_wtbl);
1250                 raw = (struct wtbl_raw *)tlv;
1251                 raw->val = cpu_to_le32(flags);
1252                 raw->msk = cpu_to_le32(~msk);
1253                 raw->wtbl_idx = 1;
1254                 raw->dw = 5;
1255         }
1256 }
1257
1258 static int
1259 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1260                    struct ieee80211_sta *sta, bool enable)
1261 {
1262         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1263         struct mt7615_dev *dev = phy->dev;
1264         struct sk_buff *skb;
1265
1266         skb = mt7615_mcu_alloc_sta_req(dev, mvif, NULL);
1267         if (IS_ERR(skb))
1268                 return PTR_ERR(skb);
1269
1270         if (enable)
1271                 mt7615_mcu_bss_omac_tlv(skb, vif);
1272
1273         mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
1274
1275         if (enable && mvif->omac_idx > EXT_BSSID_START)
1276                 mt7615_mcu_bss_ext_tlv(skb, mvif);
1277
1278         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1279                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1280 }
1281
1282 static int
1283 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
1284                       struct ieee80211_ampdu_params *params,
1285                       bool enable)
1286 {
1287         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1288         struct mt7615_vif *mvif = msta->vif;
1289         struct wtbl_req_hdr *wtbl_hdr;
1290         struct sk_buff *skb = NULL;
1291         int err;
1292
1293         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1294         if (IS_ERR(wtbl_hdr))
1295                 return PTR_ERR(wtbl_hdr);
1296
1297         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, NULL, wtbl_hdr);
1298
1299         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1300                                     true);
1301         if (err < 0)
1302                 return err;
1303
1304         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1305         if (IS_ERR(skb))
1306                 return PTR_ERR(skb);
1307
1308         mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1309
1310         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1311                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1312 }
1313
1314 static int
1315 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
1316                       struct ieee80211_ampdu_params *params,
1317                       bool enable)
1318 {
1319         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1320         struct mt7615_vif *mvif = msta->vif;
1321         struct wtbl_req_hdr *wtbl_hdr;
1322         struct sk_buff *skb;
1323         int err;
1324
1325         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1326         if (IS_ERR(skb))
1327                 return PTR_ERR(skb);
1328
1329         mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1330
1331         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1332                                     MCU_EXT_CMD_STA_REC_UPDATE, true);
1333         if (err < 0 || !enable)
1334                 return err;
1335
1336         skb = NULL;
1337         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1338         if (IS_ERR(wtbl_hdr))
1339                 return PTR_ERR(wtbl_hdr);
1340
1341         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, NULL, wtbl_hdr);
1342
1343         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1344                                      true);
1345 }
1346
1347 static int
1348 mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1349                         struct ieee80211_sta *sta, bool enable)
1350 {
1351         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1352         struct sk_buff *skb, *sskb, *wskb = NULL;
1353         struct wtbl_req_hdr *wtbl_hdr;
1354         struct mt7615_sta *msta;
1355         int cmd, err;
1356
1357         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1358
1359         sskb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1360         if (IS_ERR(sskb))
1361                 return PTR_ERR(sskb);
1362
1363         mt7615_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1364         if (enable && sta) {
1365                 mt7615_mcu_sta_ht_tlv(sskb, sta);
1366                 mt7615_mcu_sta_uapsd(sskb, vif, sta);
1367         }
1368
1369         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1370                                              NULL, &wskb);
1371         if (IS_ERR(wtbl_hdr))
1372                 return PTR_ERR(wtbl_hdr);
1373
1374         if (enable) {
1375                 mt7615_mcu_wtbl_generic_tlv(wskb, vif, sta, NULL, wtbl_hdr);
1376                 if (sta)
1377                         mt7615_mcu_wtbl_ht_tlv(wskb, sta, NULL, wtbl_hdr);
1378         }
1379
1380         cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1381         skb = enable ? wskb : sskb;
1382
1383         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1384         if (err < 0) {
1385                 skb = enable ? sskb : wskb;
1386                 dev_kfree_skb(skb);
1387
1388                 return err;
1389         }
1390
1391         cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1392         skb = enable ? sskb : wskb;
1393
1394         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1395 }
1396
1397 static const struct mt7615_mcu_ops wtbl_update_ops = {
1398         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1399         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1400         .add_dev_info = mt7615_mcu_add_dev,
1401         .add_bss_info = mt7615_mcu_add_bss,
1402         .add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1403         .add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1404         .sta_add = mt7615_mcu_wtbl_sta_add,
1405         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1406         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1407 };
1408
1409 static int
1410 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1411                   struct ieee80211_ampdu_params *params,
1412                   bool enable, bool tx)
1413 {
1414         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1415         struct mt7615_vif *mvif = msta->vif;
1416         struct wtbl_req_hdr *wtbl_hdr;
1417         struct tlv *sta_wtbl;
1418         struct sk_buff *skb;
1419
1420         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1421         if (IS_ERR(skb))
1422                 return PTR_ERR(skb);
1423
1424         mt7615_mcu_sta_ba_tlv(skb, params, enable, tx);
1425
1426         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1427
1428         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1429                                              &skb);
1430         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1431
1432         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1433                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1434 }
1435
1436 static int
1437 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1438                      struct ieee80211_ampdu_params *params,
1439                      bool enable)
1440 {
1441         return mt7615_mcu_sta_ba(dev, params, enable, true);
1442 }
1443
1444 static int
1445 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1446                      struct ieee80211_ampdu_params *params,
1447                      bool enable)
1448 {
1449         return mt7615_mcu_sta_ba(dev, params, enable, false);
1450 }
1451
1452 static int
1453 mt7615_mcu_add_sta_cmd(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1454                        struct ieee80211_sta *sta, bool enable, int cmd)
1455 {
1456         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1457         struct wtbl_req_hdr *wtbl_hdr;
1458         struct mt7615_sta *msta;
1459         struct tlv *sta_wtbl;
1460         struct sk_buff *skb;
1461
1462         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1463
1464         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1465         if (IS_ERR(skb))
1466                 return PTR_ERR(skb);
1467
1468         mt7615_mcu_sta_basic_tlv(skb, vif, sta, enable);
1469         if (enable && sta) {
1470                 mt7615_mcu_sta_ht_tlv(skb, sta);
1471                 mt7615_mcu_sta_uapsd(skb, vif, sta);
1472         }
1473
1474         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1475
1476         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1477                                              sta_wtbl, &skb);
1478         if (enable) {
1479                 mt7615_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
1480                 if (sta)
1481                         mt7615_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1482         }
1483
1484         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1485 }
1486
1487 static int
1488 mt7615_mcu_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1489                    struct ieee80211_sta *sta, bool enable)
1490 {
1491         return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1492                                       MCU_EXT_CMD_STA_REC_UPDATE);
1493 }
1494
1495 static const struct mt7615_mcu_ops sta_update_ops = {
1496         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1497         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1498         .add_dev_info = mt7615_mcu_add_dev,
1499         .add_bss_info = mt7615_mcu_add_bss,
1500         .add_tx_ba = mt7615_mcu_sta_tx_ba,
1501         .add_rx_ba = mt7615_mcu_sta_rx_ba,
1502         .sta_add = mt7615_mcu_add_sta,
1503         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1504         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1505 };
1506
1507 static int
1508 mt7615_mcu_uni_add_dev(struct mt7615_dev *dev,
1509                        struct ieee80211_vif *vif, bool enable)
1510 {
1511         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1512         struct {
1513                 struct {
1514                         u8 omac_idx;
1515                         u8 band_idx;
1516                         __le16 pad;
1517                 } __packed hdr;
1518                 struct req_tlv {
1519                         __le16 tag;
1520                         __le16 len;
1521                         u8 active;
1522                         u8 pad;
1523                         u8 omac_addr[ETH_ALEN];
1524                 } __packed tlv;
1525         } dev_req = {
1526                 .hdr = {
1527                         .omac_idx = mvif->omac_idx,
1528                         .band_idx = mvif->band_idx,
1529                 },
1530                 .tlv = {
1531                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
1532                         .len = cpu_to_le16(sizeof(struct req_tlv)),
1533                         .active = enable,
1534                 },
1535         };
1536         struct {
1537                 struct {
1538                         u8 bss_idx;
1539                         u8 pad[3];
1540                 } __packed hdr;
1541                 struct mt7615_bss_basic_tlv basic;
1542         } basic_req = {
1543                 .hdr = {
1544                         .bss_idx = mvif->idx,
1545                 },
1546                 .basic = {
1547                         .tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1548                         .len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1549                         .omac_idx = mvif->omac_idx,
1550                         .band_idx = mvif->band_idx,
1551                         .wmm_idx = mvif->wmm_idx,
1552                         .active = enable,
1553                         .bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx),
1554                         .sta_idx = cpu_to_le16(mvif->sta.wcid.idx),
1555                         .conn_state = 1,
1556                 },
1557         };
1558         int err, idx, cmd, len;
1559         void *data;
1560
1561         switch (vif->type) {
1562         case NL80211_IFTYPE_MESH_POINT:
1563         case NL80211_IFTYPE_AP:
1564                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1565                 break;
1566         case NL80211_IFTYPE_STATION:
1567                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1568                 break;
1569         case NL80211_IFTYPE_ADHOC:
1570                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1571                 break;
1572         default:
1573                 WARN_ON(1);
1574                 break;
1575         }
1576
1577         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1578         basic_req.basic.hw_bss_idx = idx;
1579
1580         memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1581
1582         cmd = enable ? MCU_UNI_CMD_DEV_INFO_UPDATE : MCU_UNI_CMD_BSS_INFO_UPDATE;
1583         data = enable ? (void *)&dev_req : (void *)&basic_req;
1584         len = enable ? sizeof(dev_req) : sizeof(basic_req);
1585
1586         err = mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1587         if (err < 0)
1588                 return err;
1589
1590         cmd = enable ? MCU_UNI_CMD_BSS_INFO_UPDATE : MCU_UNI_CMD_DEV_INFO_UPDATE;
1591         data = enable ? (void *)&basic_req : (void *)&dev_req;
1592         len = enable ? sizeof(basic_req) : sizeof(dev_req);
1593
1594         return mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1595 }
1596
1597 static int
1598 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1599 {
1600         return 0;
1601 }
1602
1603 static int
1604 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1605                        struct ieee80211_sta *sta, bool enable)
1606 {
1607         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1608         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1609         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1610         struct mt7615_dev *dev = phy->dev;
1611         struct {
1612                 struct {
1613                         u8 bss_idx;
1614                         u8 pad[3];
1615                 } __packed hdr;
1616                 struct mt7615_bss_basic_tlv basic;
1617                 struct mt7615_bss_qos_tlv qos;
1618         } basic_req = {
1619                 .hdr = {
1620                         .bss_idx = mvif->idx,
1621                 },
1622                 .basic = {
1623                         .tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1624                         .len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1625                         .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1626                         .dtim_period = vif->bss_conf.dtim_period,
1627                         .omac_idx = mvif->omac_idx,
1628                         .band_idx = mvif->band_idx,
1629                         .wmm_idx = mvif->wmm_idx,
1630                         .active = true, /* keep bss deactivated */
1631                         .phymode = 0x38,
1632                 },
1633                 .qos = {
1634                         .tag = cpu_to_le16(UNI_BSS_INFO_QBSS),
1635                         .len = cpu_to_le16(sizeof(struct mt7615_bss_qos_tlv)),
1636                         .qos = vif->bss_conf.qos,
1637                 },
1638         };
1639         struct {
1640                 struct {
1641                         u8 bss_idx;
1642                         u8 pad[3];
1643                 } __packed hdr;
1644                 struct rlm_tlv {
1645                         __le16 tag;
1646                         __le16 len;
1647                         u8 control_channel;
1648                         u8 center_chan;
1649                         u8 center_chan2;
1650                         u8 bw;
1651                         u8 tx_streams;
1652                         u8 rx_streams;
1653                         u8 short_st;
1654                         u8 ht_op_info;
1655                         u8 sco;
1656                         u8 pad[3];
1657                 } __packed rlm;
1658         } __packed rlm_req = {
1659                 .hdr = {
1660                         .bss_idx = mvif->idx,
1661                 },
1662                 .rlm = {
1663                         .tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1664                         .len = cpu_to_le16(sizeof(struct rlm_tlv)),
1665                         .control_channel = chandef->chan->hw_value,
1666                         .center_chan = ieee80211_frequency_to_channel(freq1),
1667                         .center_chan2 = ieee80211_frequency_to_channel(freq2),
1668                         .tx_streams = hweight8(phy->mt76->antenna_mask),
1669                         .rx_streams = phy->chainmask,
1670                         .short_st = true,
1671                 },
1672         };
1673         int err, conn_type;
1674         u8 idx;
1675
1676         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1677         basic_req.basic.hw_bss_idx = idx;
1678
1679         switch (vif->type) {
1680         case NL80211_IFTYPE_MESH_POINT:
1681         case NL80211_IFTYPE_AP:
1682                 if (vif->p2p)
1683                         conn_type = CONNECTION_P2P_GO;
1684                 else
1685                         conn_type = CONNECTION_INFRA_AP;
1686                 basic_req.basic.conn_type = cpu_to_le32(conn_type);
1687                 break;
1688         case NL80211_IFTYPE_STATION:
1689                 if (vif->p2p)
1690                         conn_type = CONNECTION_P2P_GC;
1691                 else
1692                         conn_type = CONNECTION_INFRA_STA;
1693                 basic_req.basic.conn_type = cpu_to_le32(conn_type);
1694                 break;
1695         case NL80211_IFTYPE_ADHOC:
1696                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1697                 break;
1698         default:
1699                 WARN_ON(1);
1700                 break;
1701         }
1702
1703         memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1704         basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx);
1705         basic_req.basic.sta_idx = cpu_to_le16(mvif->sta.wcid.idx);
1706         basic_req.basic.conn_state = !enable;
1707
1708         err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1709                                 &basic_req, sizeof(basic_req), true);
1710         if (err < 0)
1711                 return err;
1712
1713         switch (chandef->width) {
1714         case NL80211_CHAN_WIDTH_40:
1715                 rlm_req.rlm.bw = CMD_CBW_40MHZ;
1716                 break;
1717         case NL80211_CHAN_WIDTH_80:
1718                 rlm_req.rlm.bw = CMD_CBW_80MHZ;
1719                 break;
1720         case NL80211_CHAN_WIDTH_80P80:
1721                 rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1722                 break;
1723         case NL80211_CHAN_WIDTH_160:
1724                 rlm_req.rlm.bw = CMD_CBW_160MHZ;
1725                 break;
1726         case NL80211_CHAN_WIDTH_5:
1727                 rlm_req.rlm.bw = CMD_CBW_5MHZ;
1728                 break;
1729         case NL80211_CHAN_WIDTH_10:
1730                 rlm_req.rlm.bw = CMD_CBW_10MHZ;
1731                 break;
1732         case NL80211_CHAN_WIDTH_20_NOHT:
1733         case NL80211_CHAN_WIDTH_20:
1734         default:
1735                 rlm_req.rlm.bw = CMD_CBW_20MHZ;
1736                 break;
1737         }
1738
1739         if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1740                 rlm_req.rlm.sco = 1; /* SCA */
1741         else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1742                 rlm_req.rlm.sco = 3; /* SCB */
1743
1744         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1745                                  &rlm_req, sizeof(rlm_req), true);
1746 }
1747
1748 static int
1749 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1750                                   struct ieee80211_hw *hw,
1751                                   struct ieee80211_vif *vif,
1752                                   bool enable)
1753 {
1754         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1755         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1756         struct ieee80211_mutable_offsets offs;
1757         struct {
1758                 struct req_hdr {
1759                         u8 bss_idx;
1760                         u8 pad[3];
1761                 } __packed hdr;
1762                 struct bcn_content_tlv {
1763                         __le16 tag;
1764                         __le16 len;
1765                         __le16 tim_ie_pos;
1766                         __le16 csa_ie_pos;
1767                         __le16 bcc_ie_pos;
1768                         /* 0: enable beacon offload
1769                          * 1: disable beacon offload
1770                          * 2: update probe respond offload
1771                          */
1772                         u8 enable;
1773                         /* 0: legacy format (TXD + payload)
1774                          * 1: only cap field IE
1775                          */
1776                         u8 type;
1777                         __le16 pkt_len;
1778                         u8 pkt[512];
1779                 } __packed beacon_tlv;
1780         } req = {
1781                 .hdr = {
1782                         .bss_idx = mvif->idx,
1783                 },
1784                 .beacon_tlv = {
1785                         .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1786                         .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1787                         .enable = enable,
1788                 },
1789         };
1790         struct sk_buff *skb;
1791
1792         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1793         if (!skb)
1794                 return -EINVAL;
1795
1796         if (skb->len > 512 - MT_TXD_SIZE) {
1797                 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1798                 dev_kfree_skb(skb);
1799                 return -EINVAL;
1800         }
1801
1802         mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1803                               wcid, NULL, 0, NULL, true);
1804         memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1805         req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1806         req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1807
1808         if (offs.cntdwn_counter_offs[0]) {
1809                 u16 csa_offs;
1810
1811                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1812                 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1813         }
1814         dev_kfree_skb(skb);
1815
1816         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1817                                  &req, sizeof(req), true);
1818 }
1819
1820 static int
1821 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1822                      struct ieee80211_ampdu_params *params,
1823                      bool enable)
1824 {
1825         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1826         struct mt7615_vif *mvif = msta->vif;
1827         struct wtbl_req_hdr *wtbl_hdr;
1828         struct tlv *sta_wtbl;
1829         struct sk_buff *skb;
1830         int err;
1831
1832         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1833         if (IS_ERR(skb))
1834                 return PTR_ERR(skb);
1835
1836         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1837
1838         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1839                                              &skb);
1840         if (IS_ERR(wtbl_hdr))
1841                 return PTR_ERR(wtbl_hdr);
1842
1843         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, sta_wtbl,
1844                                wtbl_hdr);
1845
1846         err =  mt76_mcu_skb_send_msg(&dev->mt76, skb,
1847                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1848         if (err < 0)
1849                 return err;
1850
1851         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1852         if (IS_ERR(skb))
1853                 return PTR_ERR(skb);
1854
1855         mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1856
1857         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1858                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1859 }
1860
1861 static int
1862 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1863                      struct ieee80211_ampdu_params *params,
1864                      bool enable)
1865 {
1866         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1867         struct mt7615_vif *mvif = msta->vif;
1868         struct wtbl_req_hdr *wtbl_hdr;
1869         struct tlv *sta_wtbl;
1870         struct sk_buff *skb;
1871         int err;
1872
1873         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1874         if (IS_ERR(skb))
1875                 return PTR_ERR(skb);
1876
1877         mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1878
1879         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1880                                     MCU_UNI_CMD_STA_REC_UPDATE, true);
1881         if (err < 0 || !enable)
1882                 return err;
1883
1884         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1885         if (IS_ERR(skb))
1886                 return PTR_ERR(skb);
1887
1888         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1889
1890         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1891                                              &skb);
1892         if (IS_ERR(wtbl_hdr))
1893                 return PTR_ERR(wtbl_hdr);
1894
1895         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, sta_wtbl,
1896                                wtbl_hdr);
1897
1898         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1899                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1900 }
1901
1902 static int
1903 mt7615_mcu_uni_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1904                        struct ieee80211_sta *sta, bool enable)
1905 {
1906         return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1907                                       MCU_UNI_CMD_STA_REC_UPDATE);
1908 }
1909
1910 static const struct mt7615_mcu_ops uni_update_ops = {
1911         .add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1912         .set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1913         .add_dev_info = mt7615_mcu_uni_add_dev,
1914         .add_bss_info = mt7615_mcu_uni_add_bss,
1915         .add_tx_ba = mt7615_mcu_uni_tx_ba,
1916         .add_rx_ba = mt7615_mcu_uni_rx_ba,
1917         .sta_add = mt7615_mcu_uni_add_sta,
1918         .set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1919         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1920 };
1921
1922 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
1923                                     int len)
1924 {
1925         int ret = 0, cur_len;
1926
1927         while (len > 0) {
1928                 cur_len = min_t(int, 4096 - dev->mt76.mcu_ops->headroom, len);
1929
1930                 ret = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_SCATTER, data,
1931                                         cur_len, false);
1932                 if (ret)
1933                         break;
1934
1935                 data += cur_len;
1936                 len -= cur_len;
1937
1938                 if (mt76_is_mmio(&dev->mt76))
1939                         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
1940         }
1941
1942         return ret;
1943 }
1944
1945 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
1946                                      u32 option)
1947 {
1948         struct {
1949                 __le32 option;
1950                 __le32 addr;
1951         } req = {
1952                 .option = cpu_to_le32(option),
1953                 .addr = cpu_to_le32(addr),
1954         };
1955
1956         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_START_REQ, &req,
1957                                  sizeof(req), true);
1958 }
1959
1960 int mt7615_mcu_restart(struct mt76_dev *dev)
1961 {
1962         return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1963 }
1964 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1965
1966 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
1967 {
1968         struct {
1969                 __le32 op;
1970         } req = {
1971                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
1972         };
1973
1974         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_SEM_CONTROL, &req,
1975                                  sizeof(req), true);
1976 }
1977
1978 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
1979 {
1980         struct {
1981                 u8 check_crc;
1982                 u8 reserved[3];
1983         } req = {
1984                 .check_crc = 0,
1985         };
1986
1987         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_FINISH_REQ, &req,
1988                                  sizeof(req), true);
1989 }
1990
1991 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1992 {
1993         const struct mt7615_patch_hdr *hdr;
1994         const struct firmware *fw = NULL;
1995         int len, ret, sem;
1996
1997         sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
1998         switch (sem) {
1999         case PATCH_IS_DL:
2000                 return 0;
2001         case PATCH_NOT_DL_SEM_SUCCESS:
2002                 break;
2003         default:
2004                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2005                 return -EAGAIN;
2006         }
2007
2008         ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
2009         if (ret)
2010                 goto out;
2011
2012         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2013                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2014                 ret = -EINVAL;
2015                 goto out;
2016         }
2017
2018         hdr = (const struct mt7615_patch_hdr *)(fw->data);
2019
2020         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2021                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2022
2023         len = fw->size - sizeof(*hdr);
2024
2025         ret = mt7615_mcu_init_download(dev, addr, len, DL_MODE_NEED_RSP);
2026         if (ret) {
2027                 dev_err(dev->mt76.dev, "Download request failed\n");
2028                 goto out;
2029         }
2030
2031         ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
2032         if (ret) {
2033                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2034                 goto out;
2035         }
2036
2037         ret = mt7615_mcu_start_patch(dev);
2038         if (ret)
2039                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2040
2041 out:
2042         release_firmware(fw);
2043
2044         sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
2045         switch (sem) {
2046         case PATCH_REL_SEM_SUCCESS:
2047                 break;
2048         default:
2049                 ret = -EAGAIN;
2050                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2051                 break;
2052         }
2053
2054         return ret;
2055 }
2056
2057 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
2058 {
2059         u32 ret = 0;
2060
2061         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2062                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2063         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2064                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2065         ret |= DL_MODE_NEED_RSP;
2066         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
2067
2068         return ret;
2069 }
2070
2071 static int
2072 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
2073                              const struct mt7615_fw_trailer *hdr,
2074                              const u8 *data, bool is_cr4)
2075 {
2076         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
2077         int err, i, offset = 0;
2078         u32 len, addr, mode;
2079
2080         for (i = 0; i < n_region; i++) {
2081                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
2082                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
2083                 addr = le32_to_cpu(hdr[i].addr);
2084
2085                 err = mt7615_mcu_init_download(dev, addr, len, mode);
2086                 if (err) {
2087                         dev_err(dev->mt76.dev, "Download request failed\n");
2088                         return err;
2089                 }
2090
2091                 err = mt7615_mcu_send_firmware(dev, data + offset, len);
2092                 if (err) {
2093                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2094                         return err;
2095                 }
2096
2097                 offset += len;
2098         }
2099
2100         return 0;
2101 }
2102
2103 static const struct wiphy_wowlan_support mt7615_wowlan_support = {
2104         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
2105                  WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
2106         .n_patterns = 1,
2107         .pattern_min_len = 1,
2108         .pattern_max_len = MT7615_WOW_PATTEN_MAX_LEN,
2109         .max_nd_match_sets = 10,
2110 };
2111
2112 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
2113 {
2114         const struct mt7615_fw_trailer *hdr;
2115         const struct firmware *fw;
2116         int ret;
2117
2118         ret = request_firmware(&fw, name, dev->mt76.dev);
2119         if (ret)
2120                 return ret;
2121
2122         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
2123                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2124                 ret = -EINVAL;
2125                 goto out;
2126         }
2127
2128         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2129                                         N9_REGION_NUM * sizeof(*hdr));
2130
2131         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2132                  hdr->fw_ver, hdr->build_date);
2133
2134         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2135         if (ret)
2136                 goto out;
2137
2138         ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
2139                                         FW_START_OVERRIDE);
2140         if (ret) {
2141                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2142                 goto out;
2143         }
2144
2145         snprintf(dev->mt76.hw->wiphy->fw_version,
2146                  sizeof(dev->mt76.hw->wiphy->fw_version),
2147                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2148
2149         if (!is_mt7615(&dev->mt76) &&
2150             !strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
2151                 dev->fw_ver = MT7615_FIRMWARE_V2;
2152                 dev->mcu_ops = &sta_update_ops;
2153         } else {
2154                 dev->fw_ver = MT7615_FIRMWARE_V1;
2155                 dev->mcu_ops = &wtbl_update_ops;
2156         }
2157
2158 out:
2159         release_firmware(fw);
2160         return ret;
2161 }
2162
2163 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
2164 {
2165         const struct mt7615_fw_trailer *hdr;
2166         const struct firmware *fw;
2167         int ret;
2168
2169         ret = request_firmware(&fw, name, dev->mt76.dev);
2170         if (ret)
2171                 return ret;
2172
2173         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
2174                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2175                 ret = -EINVAL;
2176                 goto out;
2177         }
2178
2179         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2180                                         CR4_REGION_NUM * sizeof(*hdr));
2181
2182         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
2183                  hdr->fw_ver, hdr->build_date);
2184
2185         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2186         if (ret)
2187                 goto out;
2188
2189         ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
2190         if (ret) {
2191                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
2192                 goto out;
2193         }
2194
2195 out:
2196         release_firmware(fw);
2197
2198         return ret;
2199 }
2200
2201 static int mt7615_load_ram(struct mt7615_dev *dev)
2202 {
2203         int ret;
2204
2205         ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
2206         if (ret)
2207                 return ret;
2208
2209         return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
2210 }
2211
2212 static int mt7615_load_firmware(struct mt7615_dev *dev)
2213 {
2214         int ret;
2215         u32 val;
2216
2217         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
2218
2219         if (val != FW_STATE_FW_DOWNLOAD) {
2220                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2221                 return -EIO;
2222         }
2223
2224         ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
2225         if (ret)
2226                 return ret;
2227
2228         ret = mt7615_load_ram(dev);
2229         if (ret)
2230                 return ret;
2231
2232         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
2233                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
2234                                        FW_STATE_CR4_RDY), 500)) {
2235                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2236                 return -EIO;
2237         }
2238
2239         return 0;
2240 }
2241
2242 static int mt7622_load_firmware(struct mt7615_dev *dev)
2243 {
2244         int ret;
2245         u32 val;
2246
2247         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2248
2249         val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
2250         if (val != FW_STATE_FW_DOWNLOAD) {
2251                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2252                 return -EIO;
2253         }
2254
2255         ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
2256         if (ret)
2257                 return ret;
2258
2259         ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
2260         if (ret)
2261                 return ret;
2262
2263         if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
2264                             FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
2265                                        FW_STATE_NORMAL_TRX), 1500)) {
2266                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2267                 return -EIO;
2268         }
2269
2270         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2271
2272         return 0;
2273 }
2274
2275 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
2276 {
2277         struct {
2278                 u8 ctrl_val;
2279                 u8 pad[3];
2280         } data = {
2281                 .ctrl_val = ctrl
2282         };
2283
2284         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
2285                                  sizeof(data), true);
2286 }
2287
2288 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
2289 {
2290         u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
2291         const struct mt7663_fw_trailer *hdr;
2292         const struct mt7663_fw_buf *buf;
2293         const struct firmware *fw;
2294         const u8 *base_addr;
2295         int i, ret;
2296
2297         ret = request_firmware(&fw, name, dev->mt76.dev);
2298         if (ret)
2299                 return ret;
2300
2301         if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
2302                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2303                 ret = -EINVAL;
2304                 goto out;
2305         }
2306
2307         hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
2308                                                  FW_V3_COMMON_TAILER_SIZE);
2309
2310         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2311                  hdr->fw_ver, hdr->build_date);
2312         dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
2313
2314         base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
2315         for (i = 0; i < hdr->n_region; i++) {
2316                 u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
2317                 u32 len, addr, mode;
2318
2319                 dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
2320
2321                 buf = (const struct mt7663_fw_buf *)(base_addr - shift);
2322                 mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
2323                 addr = le32_to_cpu(buf->img_dest_addr);
2324                 len = le32_to_cpu(buf->img_size);
2325
2326                 ret = mt7615_mcu_init_download(dev, addr, len, mode);
2327                 if (ret) {
2328                         dev_err(dev->mt76.dev, "Download request failed\n");
2329                         goto out;
2330                 }
2331
2332                 ret = mt7615_mcu_send_firmware(dev, fw->data + offset, len);
2333                 if (ret) {
2334                         dev_err(dev->mt76.dev, "Failed to send firmware\n");
2335                         goto out;
2336                 }
2337
2338                 offset += le32_to_cpu(buf->img_size);
2339                 if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
2340                         override_addr = le32_to_cpu(buf->img_dest_addr);
2341                         dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
2342                                  i, override_addr);
2343                 }
2344         }
2345
2346         if (override_addr)
2347                 flag |= FW_START_OVERRIDE;
2348
2349         dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
2350                  override_addr, flag);
2351
2352         ret = mt7615_mcu_start_firmware(dev, override_addr, flag);
2353         if (ret) {
2354                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2355                 goto out;
2356         }
2357
2358         snprintf(dev->mt76.hw->wiphy->fw_version,
2359                  sizeof(dev->mt76.hw->wiphy->fw_version),
2360                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2361
2362 out:
2363         release_firmware(fw);
2364
2365         return ret;
2366 }
2367
2368 static int
2369 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
2370 {
2371         const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
2372         const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
2373         int ret;
2374
2375         if (!prefer_offload_fw) {
2376                 secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
2377                 primary_rom = MT7663_ROM_PATCH;
2378         }
2379         selected_rom = primary_rom;
2380
2381         ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
2382         if (ret) {
2383                 dev_info(dev->mt76.dev, "%s not found, switching to %s",
2384                          primary_rom, secondary_rom);
2385                 ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
2386                                         secondary_rom);
2387                 if (ret) {
2388                         dev_err(dev->mt76.dev, "failed to load %s",
2389                                 secondary_rom);
2390                         return ret;
2391                 }
2392                 selected_rom = secondary_rom;
2393         }
2394
2395         if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
2396                 *n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
2397                 dev->fw_ver = MT7615_FIRMWARE_V3;
2398                 dev->mcu_ops = &uni_update_ops;
2399         } else {
2400                 *n9_firmware = MT7663_FIRMWARE_N9;
2401                 dev->fw_ver = MT7615_FIRMWARE_V2;
2402                 dev->mcu_ops = &sta_update_ops;
2403         }
2404
2405         return 0;
2406 }
2407
2408 int __mt7663_load_firmware(struct mt7615_dev *dev)
2409 {
2410         const char *n9_firmware;
2411         int ret;
2412
2413         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
2414         if (ret) {
2415                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
2416                 return -EIO;
2417         }
2418
2419         ret = mt7663_load_rom_patch(dev, &n9_firmware);
2420         if (ret)
2421                 return ret;
2422
2423         ret = mt7663_load_n9(dev, n9_firmware);
2424         if (ret)
2425                 return ret;
2426
2427         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
2428                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
2429                 ret = mt76_get_field(dev, MT_CONN_ON_MISC,
2430                                      MT7663_TOP_MISC2_FW_STATE);
2431                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2432                 return -EIO;
2433         }
2434
2435 #ifdef CONFIG_PM
2436         if (mt7615_firmware_offload(dev))
2437                 dev->mt76.hw->wiphy->wowlan = &mt7615_wowlan_support;
2438 #endif /* CONFIG_PM */
2439
2440         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2441
2442         return 0;
2443 }
2444 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
2445
2446 static int mt7663_load_firmware(struct mt7615_dev *dev)
2447 {
2448         int ret;
2449
2450         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2451
2452         ret = __mt7663_load_firmware(dev);
2453         if (ret)
2454                 return ret;
2455
2456         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2457
2458         return 0;
2459 }
2460
2461 int mt7615_mcu_init(struct mt7615_dev *dev)
2462 {
2463         static const struct mt76_mcu_ops mt7615_mcu_ops = {
2464                 .headroom = sizeof(struct mt7615_mcu_txd),
2465                 .mcu_skb_send_msg = mt7615_mcu_send_message,
2466                 .mcu_send_msg = mt7615_mcu_msg_send,
2467                 .mcu_parse_response = mt7615_mcu_parse_response,
2468                 .mcu_restart = mt7615_mcu_restart,
2469         };
2470         int ret;
2471
2472         dev->mt76.mcu_ops = &mt7615_mcu_ops,
2473
2474         ret = mt7615_mcu_drv_pmctrl(dev);
2475         if (ret)
2476                 return ret;
2477
2478         switch (mt76_chip(&dev->mt76)) {
2479         case 0x7622:
2480                 ret = mt7622_load_firmware(dev);
2481                 break;
2482         case 0x7663:
2483                 ret = mt7663_load_firmware(dev);
2484                 break;
2485         default:
2486                 ret = mt7615_load_firmware(dev);
2487                 break;
2488         }
2489         if (ret)
2490                 return ret;
2491
2492         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2493         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2494         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2495         mt7615_mcu_fw_log_2_host(dev, 0);
2496
2497         return 0;
2498 }
2499 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
2500
2501 void mt7615_mcu_exit(struct mt7615_dev *dev)
2502 {
2503         __mt76_mcu_restart(&dev->mt76);
2504         mt7615_mcu_set_fw_ctrl(dev);
2505         skb_queue_purge(&dev->mt76.mcu.res_q);
2506 }
2507 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
2508
2509 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
2510 {
2511         struct {
2512                 u8 buffer_mode;
2513                 u8 content_format;
2514                 __le16 len;
2515         } __packed req_hdr = {
2516                 .buffer_mode = 1,
2517         };
2518         u8 *eep = (u8 *)dev->mt76.eeprom.data;
2519         struct sk_buff *skb;
2520         int eep_len, offset;
2521
2522         switch (mt76_chip(&dev->mt76)) {
2523         case 0x7622:
2524                 eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
2525                 offset = MT_EE_NIC_CONF_0;
2526                 break;
2527         case 0x7663:
2528                 eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
2529                 req_hdr.content_format = 1;
2530                 offset = MT_EE_CHIP_ID;
2531                 break;
2532         default:
2533                 eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
2534                 offset = MT_EE_NIC_CONF_0;
2535                 break;
2536         }
2537
2538         req_hdr.len = cpu_to_le16(eep_len);
2539
2540         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
2541         if (!skb)
2542                 return -ENOMEM;
2543
2544         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2545         skb_put_data(skb, eep + offset, eep_len);
2546
2547         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2548                                      MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
2549 }
2550 EXPORT_SYMBOL_GPL(mt7615_mcu_set_eeprom);
2551
2552 int mt7615_mcu_set_mac_enable(struct mt7615_dev *dev, int band, bool enable)
2553 {
2554         struct {
2555                 u8 enable;
2556                 u8 band;
2557                 u8 rsv[2];
2558         } __packed req = {
2559                 .enable = enable,
2560                 .band = band,
2561         };
2562
2563         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL, &req,
2564                                  sizeof(req), true);
2565 }
2566
2567 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
2568 {
2569         struct mt7615_dev *dev = phy->dev;
2570         struct {
2571                 u8 prot_idx;
2572                 u8 band;
2573                 u8 rsv[2];
2574                 __le32 len_thresh;
2575                 __le32 pkt_thresh;
2576         } __packed req = {
2577                 .prot_idx = 1,
2578                 .band = phy != &dev->phy,
2579                 .len_thresh = cpu_to_le32(val),
2580                 .pkt_thresh = cpu_to_le32(0x2),
2581         };
2582
2583         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL, &req,
2584                                  sizeof(req), true);
2585 }
2586
2587 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
2588                        const struct ieee80211_tx_queue_params *params)
2589 {
2590 #define WMM_AIFS_SET    BIT(0)
2591 #define WMM_CW_MIN_SET  BIT(1)
2592 #define WMM_CW_MAX_SET  BIT(2)
2593 #define WMM_TXOP_SET    BIT(3)
2594 #define WMM_PARAM_SET   (WMM_AIFS_SET | WMM_CW_MIN_SET | \
2595                          WMM_CW_MAX_SET | WMM_TXOP_SET)
2596         struct req_data {
2597                 u8 number;
2598                 u8 rsv[3];
2599                 u8 queue;
2600                 u8 valid;
2601                 u8 aifs;
2602                 u8 cw_min;
2603                 __le16 cw_max;
2604                 __le16 txop;
2605         } __packed req = {
2606                 .number = 1,
2607                 .queue = queue,
2608                 .valid = WMM_PARAM_SET,
2609                 .aifs = params->aifs,
2610                 .cw_min = 5,
2611                 .cw_max = cpu_to_le16(10),
2612                 .txop = cpu_to_le16(params->txop),
2613         };
2614
2615         if (params->cw_min)
2616                 req.cw_min = fls(params->cw_min);
2617         if (params->cw_max)
2618                 req.cw_max = cpu_to_le16(fls(params->cw_max));
2619
2620         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
2621                                  sizeof(req), true);
2622 }
2623
2624 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
2625 {
2626         struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2627         struct dbdc_entry {
2628                 u8 type;
2629                 u8 index;
2630                 u8 band;
2631                 u8 _rsv;
2632         };
2633         struct {
2634                 u8 enable;
2635                 u8 num;
2636                 u8 _rsv[2];
2637                 struct dbdc_entry entry[64];
2638         } req = {
2639                 .enable = !!ext_phy,
2640         };
2641         int i;
2642
2643         if (!ext_phy)
2644                 goto out;
2645
2646 #define ADD_DBDC_ENTRY(_type, _idx, _band)              \
2647         do { \
2648                 req.entry[req.num].type = _type;                \
2649                 req.entry[req.num].index = _idx;                \
2650                 req.entry[req.num++].band = _band;              \
2651         } while (0)
2652
2653         for (i = 0; i < 4; i++) {
2654                 bool band = !!(ext_phy->omac_mask & BIT(i));
2655
2656                 ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2657         }
2658
2659         for (i = 0; i < 14; i++) {
2660                 bool band = !!(ext_phy->omac_mask & BIT(0x11 + i));
2661
2662                 ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2663         }
2664
2665         ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2666
2667         for (i = 0; i < 3; i++)
2668                 ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2669
2670         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2671         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2672         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2673         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2674
2675         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2676         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2677
2678 out:
2679         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
2680                                  sizeof(req), true);
2681 }
2682
2683 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2684 {
2685         struct wtbl_req_hdr req = {
2686                 .operation = WTBL_RESET_ALL,
2687         };
2688
2689         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
2690                                  sizeof(req), true);
2691 }
2692 EXPORT_SYMBOL_GPL(mt7615_mcu_del_wtbl_all);
2693
2694 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2695                        enum mt7615_rdd_cmd cmd, u8 index,
2696                        u8 rx_sel, u8 val)
2697 {
2698         struct {
2699                 u8 ctrl;
2700                 u8 rdd_idx;
2701                 u8 rdd_rx_sel;
2702                 u8 val;
2703                 u8 rsv[4];
2704         } req = {
2705                 .ctrl = cmd,
2706                 .rdd_idx = index,
2707                 .rdd_rx_sel = rx_sel,
2708                 .val = val,
2709         };
2710
2711         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
2712                                  sizeof(req), true);
2713 }
2714
2715 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2716 {
2717         struct {
2718                 u16 tag;
2719                 u16 min_lpn;
2720         } req = {
2721                 .tag = 0x1,
2722                 .min_lpn = val,
2723         };
2724
2725         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2726                                  sizeof(req), true);
2727 }
2728
2729 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2730                             const struct mt7615_dfs_pulse *pulse)
2731 {
2732         struct {
2733                 u16 tag;
2734                 struct mt7615_dfs_pulse pulse;
2735         } req = {
2736                 .tag = 0x3,
2737         };
2738
2739         memcpy(&req.pulse, pulse, sizeof(*pulse));
2740
2741         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2742                                  sizeof(req), true);
2743 }
2744
2745 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2746                             const struct mt7615_dfs_pattern *pattern)
2747 {
2748         struct {
2749                 u16 tag;
2750                 u16 radar_type;
2751                 struct mt7615_dfs_pattern pattern;
2752         } req = {
2753                 .tag = 0x2,
2754                 .radar_type = index,
2755         };
2756
2757         memcpy(&req.pattern, pattern, sizeof(*pattern));
2758
2759         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2760                                  sizeof(req), true);
2761 }
2762
2763 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2764 {
2765         struct {
2766                 u8 pulse_num;
2767                 u8 rsv[3];
2768                 struct {
2769                         u32 start_time;
2770                         u16 width;
2771                         s16 power;
2772                 } pattern[32];
2773         } req = {
2774                 .pulse_num = dev->radar_pattern.n_pulses,
2775         };
2776         u32 start_time = ktime_to_ms(ktime_get_boottime());
2777         int i;
2778
2779         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2780                 return -EINVAL;
2781
2782         /* TODO: add some noise here */
2783         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2784                 req.pattern[i].width = dev->radar_pattern.width;
2785                 req.pattern[i].power = dev->radar_pattern.power;
2786                 req.pattern[i].start_time = start_time +
2787                                             i * dev->radar_pattern.period;
2788         }
2789
2790         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2791                                  &req, sizeof(req), false);
2792 }
2793
2794 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2795 {
2796         struct mt76_phy *mphy = phy->mt76;
2797         struct ieee80211_hw *hw = mphy->hw;
2798         int n_chains = hweight8(mphy->antenna_mask);
2799         int tx_power;
2800         int i;
2801
2802         tx_power = hw->conf.power_level * 2 -
2803                    mt76_tx_power_nss_delta(n_chains);
2804         mphy->txpower_cur = tx_power;
2805
2806         for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2807                 sku[i] = tx_power;
2808
2809         for (i = 0; i < 4; i++) {
2810                 int delta = 0;
2811
2812                 if (i < n_chains - 1)
2813                         delta = mt76_tx_power_nss_delta(n_chains) -
2814                                 mt76_tx_power_nss_delta(i + 1);
2815                 sku[MT_SKU_1SS_DELTA + i] = delta;
2816         }
2817 }
2818
2819 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2820 {
2821         static const u8 width_to_bw[] = {
2822                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2823                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2824                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2825                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2826                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2827                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2828                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2829                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2830         };
2831
2832         if (chandef->width >= ARRAY_SIZE(width_to_bw))
2833                 return 0;
2834
2835         return width_to_bw[chandef->width];
2836 }
2837
2838 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2839 {
2840         struct mt7615_dev *dev = phy->dev;
2841         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2842         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2843         struct {
2844                 u8 control_chan;
2845                 u8 center_chan;
2846                 u8 bw;
2847                 u8 tx_streams;
2848                 u8 rx_streams_mask;
2849                 u8 switch_reason;
2850                 u8 band_idx;
2851                 /* for 80+80 only */
2852                 u8 center_chan2;
2853                 __le16 cac_case;
2854                 u8 channel_band;
2855                 u8 rsv0;
2856                 __le32 outband_freq;
2857                 u8 txpower_drop;
2858                 u8 rsv1[3];
2859                 u8 txpower_sku[53];
2860                 u8 rsv2[3];
2861         } req = {
2862                 .control_chan = chandef->chan->hw_value,
2863                 .center_chan = ieee80211_frequency_to_channel(freq1),
2864                 .tx_streams = hweight8(phy->mt76->antenna_mask),
2865                 .rx_streams_mask = phy->chainmask,
2866                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
2867         };
2868
2869         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2870                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2871         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2872                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2873                 req.switch_reason = CH_SWITCH_DFS;
2874         else
2875                 req.switch_reason = CH_SWITCH_NORMAL;
2876
2877         req.band_idx = phy != &dev->phy;
2878         req.bw = mt7615_mcu_chan_bw(chandef);
2879
2880         if (mt76_testmode_enabled(&dev->mt76))
2881                 memset(req.txpower_sku, 0x3f, 49);
2882         else
2883                 mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2884
2885         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2886 }
2887
2888 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2889 {
2890         struct {
2891                 u8 action;
2892                 u8 rsv[3];
2893         } req = {
2894                 .action = index,
2895         };
2896
2897         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2898                                  sizeof(req), true);
2899 }
2900
2901 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2902                               u32 val)
2903 {
2904         struct {
2905                 u8 test_mode_en;
2906                 u8 param_idx;
2907                 u8 _rsv[2];
2908
2909                 __le32 value;
2910
2911                 u8 pad[8];
2912         } req = {
2913                 .test_mode_en = test_mode,
2914                 .param_idx = param,
2915                 .value = cpu_to_le32(val),
2916         };
2917
2918         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2919                                  sizeof(req), false);
2920 }
2921
2922 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2923 {
2924         struct mt7615_dev *dev = phy->dev;
2925         struct {
2926                 u8 format_id;
2927                 u8 sku_enable;
2928                 u8 band_idx;
2929                 u8 rsv;
2930         } req = {
2931                 .format_id = 0,
2932                 .band_idx = phy != &dev->phy,
2933                 .sku_enable = enable,
2934         };
2935
2936         return mt76_mcu_send_msg(&dev->mt76,
2937                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2938                                  sizeof(req), true);
2939 }
2940
2941 int mt7615_mcu_set_vif_ps(struct mt7615_dev *dev, struct ieee80211_vif *vif)
2942 {
2943         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2944         struct {
2945                 u8 bss_idx;
2946                 u8 ps_state; /* 0: device awake
2947                               * 1: static power save
2948                               * 2: dynamic power saving
2949                               */
2950         } req = {
2951                 .bss_idx = mvif->idx,
2952                 .ps_state = vif->bss_conf.ps ? 2 : 0,
2953         };
2954
2955         if (vif->type != NL80211_IFTYPE_STATION)
2956                 return -ENOTSUPP;
2957
2958         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_PS_PROFILE, &req,
2959                                  sizeof(req), false);
2960 }
2961
2962 int mt7615_mcu_set_channel_domain(struct mt7615_phy *phy)
2963 {
2964         struct mt76_phy *mphy = phy->mt76;
2965         struct mt7615_dev *dev = phy->dev;
2966         struct mt7615_mcu_channel_domain {
2967                 __le32 country_code; /* regulatory_request.alpha2 */
2968                 u8 bw_2g; /* BW_20_40M          0
2969                            * BW_20M             1
2970                            * BW_20_40_80M       2
2971                            * BW_20_40_80_160M   3
2972                            * BW_20_40_80_8080M  4
2973                            */
2974                 u8 bw_5g;
2975                 __le16 pad;
2976                 u8 n_2ch;
2977                 u8 n_5ch;
2978                 __le16 pad2;
2979         } __packed hdr = {
2980                 .bw_2g = 0,
2981                 .bw_5g = 3,
2982                 .n_2ch = mphy->sband_2g.sband.n_channels,
2983                 .n_5ch = mphy->sband_5g.sband.n_channels,
2984         };
2985         struct mt7615_mcu_chan {
2986                 __le16 hw_value;
2987                 __le16 pad;
2988                 __le32 flags;
2989         } __packed;
2990         int i, n_channels = hdr.n_2ch + hdr.n_5ch;
2991         int len = sizeof(hdr) + n_channels * sizeof(struct mt7615_mcu_chan);
2992         struct sk_buff *skb;
2993
2994         if (!mt7615_firmware_offload(dev))
2995                 return 0;
2996
2997         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
2998         if (!skb)
2999                 return -ENOMEM;
3000
3001         skb_put_data(skb, &hdr, sizeof(hdr));
3002
3003         for (i = 0; i < n_channels; i++) {
3004                 struct ieee80211_channel *chan;
3005                 struct mt7615_mcu_chan channel;
3006
3007                 if (i < hdr.n_2ch)
3008                         chan = &mphy->sband_2g.sband.channels[i];
3009                 else
3010                         chan = &mphy->sband_5g.sband.channels[i - hdr.n_2ch];
3011
3012                 channel.hw_value = cpu_to_le16(chan->hw_value);
3013                 channel.flags = cpu_to_le32(chan->flags);
3014                 channel.pad = 0;
3015
3016                 skb_put_data(skb, &channel, sizeof(channel));
3017         }
3018
3019         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_SET_CHAN_DOMAIN,
3020                                      false);
3021 }
3022
3023 #define MT7615_SCAN_CHANNEL_TIME        60
3024 int mt7615_mcu_hw_scan(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3025                        struct ieee80211_scan_request *scan_req)
3026 {
3027         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3028         struct cfg80211_scan_request *sreq = &scan_req->req;
3029         int n_ssids = 0, err, i, duration = MT7615_SCAN_CHANNEL_TIME;
3030         int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
3031         struct ieee80211_channel **scan_list = sreq->channels;
3032         struct mt7615_dev *dev = phy->dev;
3033         bool ext_phy = phy != &dev->phy;
3034         struct mt7615_mcu_scan_channel *chan;
3035         struct mt7615_hw_scan_req *req;
3036         struct sk_buff *skb;
3037
3038         /* fall-back to sw-scan */
3039         if (!mt7615_firmware_offload(dev))
3040                 return 1;
3041
3042         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(*req));
3043         if (!skb)
3044                 return -ENOMEM;
3045
3046         set_bit(MT76_HW_SCANNING, &phy->mt76->state);
3047         mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3048
3049         req = (struct mt7615_hw_scan_req *)skb_put(skb, sizeof(*req));
3050
3051         req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3052         req->bss_idx = mvif->idx;
3053         req->scan_type = sreq->n_ssids ? 1 : 0;
3054         req->probe_req_num = sreq->n_ssids ? 2 : 0;
3055         req->version = 1;
3056
3057         for (i = 0; i < sreq->n_ssids; i++) {
3058                 if (!sreq->ssids[i].ssid_len)
3059                         continue;
3060
3061                 req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
3062                 memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
3063                        sreq->ssids[i].ssid_len);
3064                 n_ssids++;
3065         }
3066         req->ssid_type = n_ssids ? BIT(2) : BIT(0);
3067         req->ssid_type_ext = n_ssids ? BIT(0) : 0;
3068         req->ssids_num = n_ssids;
3069
3070         /* increase channel time for passive scan */
3071         if (!sreq->n_ssids)
3072                 duration *= 2;
3073         req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
3074         req->channel_min_dwell_time = cpu_to_le16(duration);
3075         req->channel_dwell_time = cpu_to_le16(duration);
3076
3077         req->channels_num = min_t(u8, sreq->n_channels, 32);
3078         req->ext_channels_num = min_t(u8, ext_channels_num, 32);
3079         for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
3080                 if (i >= 32)
3081                         chan = &req->ext_channels[i - 32];
3082                 else
3083                         chan = &req->channels[i];
3084
3085                 chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3086                 chan->channel_num = scan_list[i]->hw_value;
3087         }
3088         req->channel_type = sreq->n_channels ? 4 : 0;
3089
3090         if (sreq->ie_len > 0) {
3091                 memcpy(req->ies, sreq->ie, sreq->ie_len);
3092                 req->ies_len = cpu_to_le16(sreq->ie_len);
3093         }
3094
3095         memcpy(req->bssid, sreq->bssid, ETH_ALEN);
3096         if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3097                 get_random_mask_addr(req->random_mac, sreq->mac_addr,
3098                                      sreq->mac_addr_mask);
3099                 req->scan_func = 1;
3100         }
3101
3102         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_START_HW_SCAN,
3103                                     false);
3104         if (err < 0)
3105                 clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
3106
3107         return err;
3108 }
3109
3110 int mt7615_mcu_cancel_hw_scan(struct mt7615_phy *phy,
3111                               struct ieee80211_vif *vif)
3112 {
3113         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3114         struct mt7615_dev *dev = phy->dev;
3115         struct {
3116                 u8 seq_num;
3117                 u8 is_ext_channel;
3118                 u8 rsv[2];
3119         } __packed req = {
3120                 .seq_num = mvif->scan_seq_num,
3121         };
3122
3123         if (test_and_clear_bit(MT76_HW_SCANNING, &phy->mt76->state)) {
3124                 struct cfg80211_scan_info info = {
3125                         .aborted = true,
3126                 };
3127
3128                 ieee80211_scan_completed(phy->mt76->hw, &info);
3129         }
3130
3131         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_CANCEL_HW_SCAN, &req,
3132                                  sizeof(req), false);
3133 }
3134
3135 int mt7615_mcu_sched_scan_req(struct mt7615_phy *phy,
3136                               struct ieee80211_vif *vif,
3137                               struct cfg80211_sched_scan_request *sreq)
3138 {
3139         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3140         struct ieee80211_channel **scan_list = sreq->channels;
3141         struct mt7615_dev *dev = phy->dev;
3142         bool ext_phy = phy != &dev->phy;
3143         struct mt7615_mcu_scan_channel *chan;
3144         struct mt7615_sched_scan_req *req;
3145         struct cfg80211_match_set *match;
3146         struct cfg80211_ssid *ssid;
3147         struct sk_buff *skb;
3148         int i;
3149
3150         if (!mt7615_firmware_offload(dev))
3151                 return -ENOTSUPP;
3152
3153         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3154                                  sizeof(*req) + sreq->ie_len);
3155         if (!skb)
3156                 return -ENOMEM;
3157
3158         mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3159
3160         req = (struct mt7615_sched_scan_req *)skb_put(skb, sizeof(*req));
3161         req->version = 1;
3162         req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3163
3164         if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3165                 get_random_mask_addr(req->random_mac, sreq->mac_addr,
3166                                      sreq->mac_addr_mask);
3167                 req->scan_func = 1;
3168         }
3169
3170         req->ssids_num = sreq->n_ssids;
3171         for (i = 0; i < req->ssids_num; i++) {
3172                 ssid = &sreq->ssids[i];
3173                 memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
3174                 req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
3175         }
3176
3177         req->match_num = sreq->n_match_sets;
3178         for (i = 0; i < req->match_num; i++) {
3179                 match = &sreq->match_sets[i];
3180                 memcpy(req->match[i].ssid, match->ssid.ssid,
3181                        match->ssid.ssid_len);
3182                 req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
3183                 req->match[i].ssid_len = match->ssid.ssid_len;
3184         }
3185
3186         req->channel_type = sreq->n_channels ? 4 : 0;
3187         req->channels_num = min_t(u8, sreq->n_channels, 64);
3188         for (i = 0; i < req->channels_num; i++) {
3189                 chan = &req->channels[i];
3190                 chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3191                 chan->channel_num = scan_list[i]->hw_value;
3192         }
3193
3194         req->intervals_num = sreq->n_scan_plans;
3195         for (i = 0; i < req->intervals_num; i++)
3196                 req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3197
3198         if (sreq->ie_len > 0) {
3199                 req->ie_len = cpu_to_le16(sreq->ie_len);
3200                 memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
3201         }
3202
3203         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_SCHED_SCAN_REQ,
3204                                      false);
3205 }
3206
3207 int mt7615_mcu_sched_scan_enable(struct mt7615_phy *phy,
3208                                  struct ieee80211_vif *vif,
3209                                  bool enable)
3210 {
3211         struct mt7615_dev *dev = phy->dev;
3212         struct {
3213                 u8 active; /* 0: enabled 1: disabled */
3214                 u8 rsv[3];
3215         } __packed req = {
3216                 .active = !enable,
3217         };
3218
3219         if (!mt7615_firmware_offload(dev))
3220                 return -ENOTSUPP;
3221
3222         if (enable)
3223                 set_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3224         else
3225                 clear_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3226
3227         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SCHED_SCAN_ENABLE, &req,
3228                                  sizeof(req), false);
3229 }
3230
3231 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3232 {
3233         int i;
3234
3235         for (i = 0; i < n_freqs; i++)
3236                 if (cur == freqs[i])
3237                         return i;
3238
3239         return -1;
3240 }
3241
3242 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
3243 {
3244         static const u16 freq_list[] = {
3245                 4980, 5805, 5905, 5190,
3246                 5230, 5270, 5310, 5350,
3247                 5390, 5430, 5470, 5510,
3248                 5550, 5590, 5630, 5670,
3249                 5710, 5755, 5795, 5835,
3250                 5875, 5210, 5290, 5370,
3251                 5450, 5530, 5610, 5690,
3252                 5775, 5855
3253         };
3254         static const u16 freq_bw40[] = {
3255                 5190, 5230, 5270, 5310,
3256                 5350, 5390, 5430, 5470,
3257                 5510, 5550, 5590, 5630,
3258                 5670, 5710, 5755, 5795,
3259                 5835, 5875
3260         };
3261         int offset_2g = ARRAY_SIZE(freq_list);
3262         int idx;
3263
3264         if (freq < 4000) {
3265                 if (freq < 2427)
3266                         return offset_2g;
3267                 if (freq < 2442)
3268                         return offset_2g + 1;
3269                 if (freq < 2457)
3270                         return offset_2g + 2;
3271
3272                 return offset_2g + 3;
3273         }
3274
3275         switch (bw) {
3276         case NL80211_CHAN_WIDTH_80:
3277         case NL80211_CHAN_WIDTH_80P80:
3278         case NL80211_CHAN_WIDTH_160:
3279                 break;
3280         default:
3281                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3282                                            freq + 10);
3283                 if (idx >= 0) {
3284                         freq = freq_bw40[idx];
3285                         break;
3286                 }
3287
3288                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3289                                            freq - 10);
3290                 if (idx >= 0) {
3291                         freq = freq_bw40[idx];
3292                         break;
3293                 }
3294                 fallthrough;
3295         case NL80211_CHAN_WIDTH_40:
3296                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3297                                            freq);
3298                 if (idx >= 0)
3299                         break;
3300
3301                 return -1;
3302
3303         }
3304
3305         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3306 }
3307
3308 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
3309 {
3310         struct mt7615_dev *dev = phy->dev;
3311         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3312         int freq2 = chandef->center_freq2;
3313         int ret;
3314         struct {
3315                 u8 direction;
3316                 u8 runtime_calibration;
3317                 u8 _rsv[2];
3318
3319                 __le16 center_freq;
3320                 u8 bw;
3321                 u8 band;
3322                 u8 is_freq2;
3323                 u8 success;
3324                 u8 dbdc_en;
3325
3326                 u8 _rsv2;
3327
3328                 struct {
3329                         __le32 sx0_i_lna[4];
3330                         __le32 sx0_q_lna[4];
3331
3332                         __le32 sx2_i_lna[4];
3333                         __le32 sx2_q_lna[4];
3334                 } dcoc_data[4];
3335         } req = {
3336                 .direction = 1,
3337
3338                 .bw = mt7615_mcu_chan_bw(chandef),
3339                 .band = chandef->center_freq1 > 4000,
3340                 .dbdc_en = !!dev->mt76.phy2,
3341         };
3342         u16 center_freq = chandef->center_freq1;
3343         int freq_idx;
3344         u8 *eep = dev->mt76.eeprom.data;
3345
3346         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
3347                 return 0;
3348
3349         if (chandef->width == NL80211_CHAN_WIDTH_160) {
3350                 freq2 = center_freq + 40;
3351                 center_freq -= 40;
3352         }
3353
3354 again:
3355         req.runtime_calibration = 1;
3356         freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
3357         if (freq_idx < 0)
3358                 goto out;
3359
3360         memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
3361                               freq_idx * MT7615_EEPROM_DCOC_SIZE,
3362                sizeof(req.dcoc_data));
3363         req.runtime_calibration = 0;
3364
3365 out:
3366         req.center_freq = cpu_to_le16(center_freq);
3367         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
3368                                 sizeof(req), true);
3369
3370         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3371              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3372                 req.is_freq2 = true;
3373                 center_freq = freq2;
3374                 goto again;
3375         }
3376
3377         return ret;
3378 }
3379
3380 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
3381 {
3382         static const u16 freq_list[] = {
3383                 4920, 4940, 4960, 4980,
3384                 5040, 5060, 5080, 5180,
3385                 5200, 5220, 5240, 5260,
3386                 5280, 5300, 5320, 5340,
3387                 5360, 5380, 5400, 5420,
3388                 5440, 5460, 5480, 5500,
3389                 5520, 5540, 5560, 5580,
3390                 5600, 5620, 5640, 5660,
3391                 5680, 5700, 5720, 5745,
3392                 5765, 5785, 5805, 5825,
3393                 5845, 5865, 5885, 5905
3394         };
3395         int offset_2g = ARRAY_SIZE(freq_list);
3396         int idx;
3397
3398         if (freq < 4000) {
3399                 if (freq < 2432)
3400                         return offset_2g;
3401                 if (freq < 2457)
3402                         return offset_2g + 1;
3403
3404                 return offset_2g + 2;
3405         }
3406
3407         if (bw != NL80211_CHAN_WIDTH_20) {
3408                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3409                                            freq + 10);
3410                 if (idx >= 0)
3411                         return idx;
3412
3413                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3414                                            freq - 10);
3415                 if (idx >= 0)
3416                         return idx;
3417         }
3418
3419         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3420 }
3421
3422
3423 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
3424 {
3425         struct mt7615_dev *dev = phy->dev;
3426         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3427         int freq2 = chandef->center_freq2;
3428         int ret;
3429         struct {
3430                 u8 direction;
3431                 u8 runtime_calibration;
3432                 u8 _rsv[2];
3433
3434                 __le16 center_freq;
3435                 u8 bw;
3436                 u8 band;
3437                 u8 is_freq2;
3438                 u8 success;
3439                 u8 dbdc_en;
3440
3441                 u8 _rsv2;
3442
3443                 struct {
3444                         struct {
3445                                 u32 dpd_g0;
3446                                 u8 data[32];
3447                         } wf0, wf1;
3448
3449                         struct {
3450                                 u32 dpd_g0_prim;
3451                                 u32 dpd_g0_sec;
3452                                 u8 data_prim[32];
3453                                 u8 data_sec[32];
3454                         } wf2, wf3;
3455                 } dpd_data;
3456         } req = {
3457                 .direction = 1,
3458
3459                 .bw = mt7615_mcu_chan_bw(chandef),
3460                 .band = chandef->center_freq1 > 4000,
3461                 .dbdc_en = !!dev->mt76.phy2,
3462         };
3463         u16 center_freq = chandef->center_freq1;
3464         int freq_idx;
3465         u8 *eep = dev->mt76.eeprom.data;
3466
3467         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
3468                 return 0;
3469
3470         if (chandef->width == NL80211_CHAN_WIDTH_160) {
3471                 freq2 = center_freq + 40;
3472                 center_freq -= 40;
3473         }
3474
3475 again:
3476         req.runtime_calibration = 1;
3477         freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
3478         if (freq_idx < 0)
3479                 goto out;
3480
3481         memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
3482                               freq_idx * MT7615_EEPROM_TXDPD_SIZE,
3483                sizeof(req.dpd_data));
3484         req.runtime_calibration = 0;
3485
3486 out:
3487         req.center_freq = cpu_to_le16(center_freq);
3488         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
3489                                 sizeof(req), true);
3490
3491         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3492              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3493                 req.is_freq2 = true;
3494                 center_freq = freq2;
3495                 goto again;
3496         }
3497
3498         return ret;
3499 }
3500
3501 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3502                           bool enable)
3503 {
3504         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3505         struct {
3506                 u8 bss_idx;
3507                 u8 dtim_period;
3508                 __le16 aid;
3509                 __le16 bcn_interval;
3510                 __le16 atim_window;
3511                 u8 uapsd;
3512                 u8 bmc_delivered_ac;
3513                 u8 bmc_triggered_ac;
3514                 u8 pad;
3515         } req = {
3516                 .bss_idx = mvif->idx,
3517                 .aid = cpu_to_le16(vif->bss_conf.aid),
3518                 .dtim_period = vif->bss_conf.dtim_period,
3519                 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
3520         };
3521         struct {
3522                 u8 bss_idx;
3523                 u8 pad[3];
3524         } req_hdr = {
3525                 .bss_idx = mvif->idx,
3526         };
3527         int err;
3528
3529         if (vif->type != NL80211_IFTYPE_STATION ||
3530             !mt7615_firmware_offload(dev))
3531                 return -ENOTSUPP;
3532
3533         err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
3534                                 sizeof(req_hdr), false);
3535         if (err < 0 || !enable)
3536                 return err;
3537
3538         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
3539                                  sizeof(req), false);
3540 }
3541
3542 #ifdef CONFIG_PM
3543 int mt7615_mcu_set_hif_suspend(struct mt7615_dev *dev, bool suspend)
3544 {
3545         struct {
3546                 struct {
3547                         u8 hif_type; /* 0x0: HIF_SDIO
3548                                       * 0x1: HIF_USB
3549                                       * 0x2: HIF_PCIE
3550                                       */
3551                         u8 pad[3];
3552                 } __packed hdr;
3553                 struct hif_suspend_tlv {
3554                         __le16 tag;
3555                         __le16 len;
3556                         u8 suspend;
3557                 } __packed hif_suspend;
3558         } req = {
3559                 .hif_suspend = {
3560                         .tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
3561                         .len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
3562                         .suspend = suspend,
3563                 },
3564         };
3565
3566         if (mt76_is_mmio(&dev->mt76))
3567                 req.hdr.hif_type = 2;
3568         else if (mt76_is_usb(&dev->mt76))
3569                 req.hdr.hif_type = 1;
3570
3571         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_HIF_CTRL, &req,
3572                                  sizeof(req), true);
3573 }
3574 EXPORT_SYMBOL_GPL(mt7615_mcu_set_hif_suspend);
3575
3576 static int
3577 mt7615_mcu_set_wow_ctrl(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3578                         bool suspend, struct cfg80211_wowlan *wowlan)
3579 {
3580         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3581         struct mt7615_dev *dev = phy->dev;
3582         struct {
3583                 struct {
3584                         u8 bss_idx;
3585                         u8 pad[3];
3586                 } __packed hdr;
3587                 struct mt7615_wow_ctrl_tlv wow_ctrl_tlv;
3588         } req = {
3589                 .hdr = {
3590                         .bss_idx = mvif->idx,
3591                 },
3592                 .wow_ctrl_tlv = {
3593                         .tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
3594                         .len = cpu_to_le16(sizeof(struct mt7615_wow_ctrl_tlv)),
3595                         .cmd = suspend ? 1 : 2,
3596                 },
3597         };
3598
3599         if (wowlan->magic_pkt)
3600                 req.wow_ctrl_tlv.trigger |= BIT(0);
3601         if (wowlan->disconnect)
3602                 req.wow_ctrl_tlv.trigger |= BIT(2);
3603         if (wowlan->nd_config) {
3604                 mt7615_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
3605                 req.wow_ctrl_tlv.trigger |= BIT(5);
3606                 mt7615_mcu_sched_scan_enable(phy, vif, suspend);
3607         }
3608
3609         if (mt76_is_mmio(&dev->mt76))
3610                 req.wow_ctrl_tlv.wakeup_hif = 2;
3611         else if (mt76_is_usb(&dev->mt76))
3612                 req.wow_ctrl_tlv.wakeup_hif = 1;
3613
3614         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
3615                                  sizeof(req), true);
3616 }
3617
3618 static int
3619 mt7615_mcu_set_wow_pattern(struct mt7615_dev *dev,
3620                            struct ieee80211_vif *vif,
3621                            u8 index, bool enable,
3622                            struct cfg80211_pkt_pattern *pattern)
3623 {
3624         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3625         struct mt7615_wow_pattern_tlv *ptlv;
3626         struct sk_buff *skb;
3627         struct req_hdr {
3628                 u8 bss_idx;
3629                 u8 pad[3];
3630         } __packed hdr = {
3631                 .bss_idx = mvif->idx,
3632         };
3633
3634         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3635                                  sizeof(hdr) + sizeof(*ptlv));
3636         if (!skb)
3637                 return -ENOMEM;
3638
3639         skb_put_data(skb, &hdr, sizeof(hdr));
3640         ptlv = (struct mt7615_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
3641         ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
3642         ptlv->len = cpu_to_le16(sizeof(*ptlv));
3643         ptlv->data_len = pattern->pattern_len;
3644         ptlv->enable = enable;
3645         ptlv->index = index;
3646
3647         memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
3648         memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8);
3649
3650         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_SUSPEND,
3651                                      true);
3652 }
3653
3654 static int
3655 mt7615_mcu_set_suspend_mode(struct mt7615_dev *dev,
3656                             struct ieee80211_vif *vif,
3657                             bool enable, u8 mdtim, bool wow_suspend)
3658 {
3659         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3660         struct {
3661                 struct {
3662                         u8 bss_idx;
3663                         u8 pad[3];
3664                 } __packed hdr;
3665                 struct mt7615_suspend_tlv suspend_tlv;
3666         } req = {
3667                 .hdr = {
3668                         .bss_idx = mvif->idx,
3669                 },
3670                 .suspend_tlv = {
3671                         .tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
3672                         .len = cpu_to_le16(sizeof(struct mt7615_suspend_tlv)),
3673                         .enable = enable,
3674                         .mdtim = mdtim,
3675                         .wow_suspend = wow_suspend,
3676                 },
3677         };
3678
3679         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
3680                                  sizeof(req), true);
3681 }
3682
3683 static int
3684 mt7615_mcu_set_gtk_rekey(struct mt7615_dev *dev,
3685                          struct ieee80211_vif *vif,
3686                          bool suspend)
3687 {
3688         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3689         struct {
3690                 struct {
3691                         u8 bss_idx;
3692                         u8 pad[3];
3693                 } __packed hdr;
3694                 struct mt7615_gtk_rekey_tlv gtk_tlv;
3695         } __packed req = {
3696                 .hdr = {
3697                         .bss_idx = mvif->idx,
3698                 },
3699                 .gtk_tlv = {
3700                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
3701                         .len = cpu_to_le16(sizeof(struct mt7615_gtk_rekey_tlv)),
3702                         .rekey_mode = !suspend,
3703                 },
3704         };
3705
3706         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
3707                                  sizeof(req), true);
3708 }
3709
3710 static int
3711 mt7615_mcu_set_arp_filter(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3712                           bool suspend)
3713 {
3714         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3715         struct {
3716                 struct {
3717                         u8 bss_idx;
3718                         u8 pad[3];
3719                 } __packed hdr;
3720                 struct mt7615_arpns_tlv arpns;
3721         } req = {
3722                 .hdr = {
3723                         .bss_idx = mvif->idx,
3724                 },
3725                 .arpns = {
3726                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3727                         .len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3728                         .mode = suspend,
3729                 },
3730         };
3731
3732         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
3733                                  sizeof(req), true);
3734 }
3735
3736 void mt7615_mcu_set_suspend_iter(void *priv, u8 *mac,
3737                                  struct ieee80211_vif *vif)
3738 {
3739         struct mt7615_phy *phy = priv;
3740         bool suspend = test_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
3741         struct ieee80211_hw *hw = phy->mt76->hw;
3742         struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
3743         int i;
3744
3745         mt7615_mcu_set_bss_pm(phy->dev, vif, suspend);
3746
3747         mt7615_mcu_set_gtk_rekey(phy->dev, vif, suspend);
3748         mt7615_mcu_set_arp_filter(phy->dev, vif, suspend);
3749
3750         mt7615_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
3751
3752         for (i = 0; i < wowlan->n_patterns; i++)
3753                 mt7615_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
3754                                            &wowlan->patterns[i]);
3755         mt7615_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
3756 }
3757
3758 static void
3759 mt7615_mcu_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3760                     struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
3761                     void *data)
3762 {
3763         struct mt7615_gtk_rekey_tlv *gtk_tlv = data;
3764         u32 cipher;
3765
3766         if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
3767             key->cipher != WLAN_CIPHER_SUITE_CCMP &&
3768             key->cipher != WLAN_CIPHER_SUITE_TKIP)
3769                 return;
3770
3771         if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
3772                 gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
3773                 cipher = BIT(3);
3774         } else {
3775                 gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
3776                 cipher = BIT(4);
3777         }
3778
3779         /* we are assuming here to have a single pairwise key */
3780         if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3781                 gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
3782                 gtk_tlv->group_cipher = cpu_to_le32(cipher);
3783                 gtk_tlv->keyid = key->keyidx;
3784         }
3785 }
3786
3787 int mt7615_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
3788                                 struct ieee80211_vif *vif,
3789                                 struct cfg80211_gtk_rekey_data *key)
3790 {
3791         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3792         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3793         struct mt7615_gtk_rekey_tlv *gtk_tlv;
3794         struct sk_buff *skb;
3795         struct {
3796                 u8 bss_idx;
3797                 u8 pad[3];
3798         } __packed hdr = {
3799                 .bss_idx = mvif->idx,
3800         };
3801
3802         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3803                                  sizeof(hdr) + sizeof(*gtk_tlv));
3804         if (!skb)
3805                 return -ENOMEM;
3806
3807         skb_put_data(skb, &hdr, sizeof(hdr));
3808         gtk_tlv = (struct mt7615_gtk_rekey_tlv *)skb_put(skb,
3809                                                          sizeof(*gtk_tlv));
3810         gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
3811         gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
3812         gtk_tlv->rekey_mode = 2;
3813         gtk_tlv->option = 1;
3814
3815         rcu_read_lock();
3816         ieee80211_iter_keys_rcu(hw, vif, mt7615_mcu_key_iter, gtk_tlv);
3817         rcu_read_unlock();
3818
3819         memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
3820         memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
3821         memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
3822
3823         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
3824                                      true);
3825 }
3826 #endif /* CONFIG_PM */
3827
3828 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3829                        struct ieee80211_channel *chan, int duration)
3830 {
3831         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3832         struct mt7615_dev *dev = phy->dev;
3833         struct mt7615_roc_tlv req = {
3834                 .bss_idx = mvif->idx,
3835                 .active = !chan,
3836                 .max_interval = cpu_to_le32(duration),
3837                 .primary_chan = chan ? chan->hw_value : 0,
3838                 .band = chan ? chan->band : 0,
3839                 .req_type = 2,
3840         };
3841
3842         phy->roc_grant = false;
3843
3844         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
3845                                  sizeof(req), false);
3846 }
3847
3848 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
3849                                  struct ieee80211_vif *vif,
3850                                  struct ieee80211_bss_conf *info)
3851 {
3852         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3853         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3854         struct sk_buff *skb;
3855         int i, len = min_t(int, info->arp_addr_cnt,
3856                            IEEE80211_BSS_ARP_ADDR_LIST_LEN);
3857         struct {
3858                 struct {
3859                         u8 bss_idx;
3860                         u8 pad[3];
3861                 } __packed hdr;
3862                 struct mt7615_arpns_tlv arp;
3863         } req_hdr = {
3864                 .hdr = {
3865                         .bss_idx = mvif->idx,
3866                 },
3867                 .arp = {
3868                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3869                         .len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3870                         .ips_num = len,
3871                         .mode = 2,  /* update */
3872                         .option = 1,
3873                 },
3874         };
3875
3876         if (!mt7615_firmware_offload(dev))
3877                 return 0;
3878
3879         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3880                                  sizeof(req_hdr) + len * sizeof(__be32));
3881         if (!skb)
3882                 return -ENOMEM;
3883
3884         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
3885         for (i = 0; i < len; i++) {
3886                 u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
3887
3888                 memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
3889         }
3890
3891         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
3892                                      true);
3893 }
3894
3895 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
3896                              struct ieee80211_vif *vif)
3897 {
3898         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3899         int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
3900         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3901         struct {
3902                 __le32 ct_win;
3903                 u8 bss_idx;
3904                 u8 rsv[3];
3905         } __packed req = {
3906                 .ct_win = cpu_to_le32(ct_window),
3907                 .bss_idx = mvif->idx,
3908         };
3909
3910         if (!mt7615_firmware_offload(dev))
3911                 return -ENOTSUPP;
3912
3913         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
3914                                  sizeof(req), false);
3915 }
3916
3917 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
3918 {
3919         struct {
3920                 __le32 addr;
3921                 __le32 val;
3922         } __packed req = {
3923                 .addr = cpu_to_le32(offset),
3924         };
3925
3926         return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
3927                                  true);
3928 }
3929 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
3930
3931 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
3932 {
3933         struct {
3934                 __le32 addr;
3935                 __le32 val;
3936         } __packed req = {
3937                 .addr = cpu_to_le32(offset),
3938                 .val = cpu_to_le32(val),
3939         };
3940
3941         mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
3942 }
3943 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);