drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 static bool prefer_offload_fw = true;
  15 module_param(prefer_offload_fw, bool, 0644);
  16 MODULE_PARM_DESC(prefer_offload_fw,
  17                  "Prefer client mode offload firmware (MT7663)");
  18
  19 struct mt7615_patch_hdr {
  20         char build_date[16];
  21         char platform[4];
  22         __be32 hw_sw_ver;
  23         __be32 patch_ver;
  24         __be16 checksum;
  25 } __packed;
  26
  27 struct mt7615_fw_trailer {
  28         __le32 addr;
  29         u8 chip_id;
  30         u8 feature_set;
  31         u8 eco_code;
  32         char fw_ver[10];
  33         char build_date[15];
  34         __le32 len;
  35 } __packed;
  36
  37 #define FW_V3_COMMON_TAILER_SIZE        36
  38 #define FW_V3_REGION_TAILER_SIZE        40
  39 #define FW_START_OVERRIDE               BIT(0)
  40 #define FW_START_DLYCAL                 BIT(1)
  41 #define FW_START_WORKING_PDA_CR4        BIT(2)
  42
  43 struct mt7663_fw_trailer {
  44         u8 chip_id;
  45         u8 eco_code;
  46         u8 n_region;
  47         u8 format_ver;
  48         u8 format_flag;
  49         u8 reserv[2];
  50         char fw_ver[10];
  51         char build_date[15];
  52         __le32 crc;
  53 } __packed;
  54
  55 struct mt7663_fw_buf {
  56         __le32 crc;
  57         __le32 d_img_size;
  58         __le32 block_size;
  59         u8 rsv[4];
  60         __le32 img_dest_addr;
  61         __le32 img_size;
  62         u8 feature_set;
  63 };
  64
  65 #define MT7615_PATCH_ADDRESS            0x80000
  66 #define MT7622_PATCH_ADDRESS            0x9c000
  67 #define MT7663_PATCH_ADDRESS            0xdc000
  68
  69 #define N9_REGION_NUM                   2
  70 #define CR4_REGION_NUM                  1
  71
  72 #define IMG_CRC_LEN                     4
  73
  74 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  75 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  76
  77 #define DL_MODE_ENCRYPT                 BIT(0)
  78 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  79 #define DL_MODE_RESET_SEC_IV            BIT(3)
  80 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
  82 #define DL_MODE_NEED_RSP                BIT(31)
  83
  84 #define FW_START_OVERRIDE               BIT(0)
  85 #define FW_START_WORKING_PDA_CR4        BIT(2)
  86
  87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
  88                          int cmd, int *wait_seq)
  89 {
  90         int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
  91         struct mt7615_uni_txd *uni_txd;
  92         struct mt7615_mcu_txd *mcu_txd;
  93         u8 seq, q_idx, pkt_fmt;
  94         __le32 *txd;
  95         u32 val;
  96
  97         /* TODO: make dynamic based on msg type */
  98         dev->mt76.mcu.timeout = 20 * HZ;
  99
 100         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 101         if (!seq)
 102                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 103         if (wait_seq)
 104                 *wait_seq = seq;
 105
 106         txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 107         txd = (__le32 *)skb_push(skb, txd_len);
 108
 109         if (cmd != MCU_CMD_FW_SCATTER) {
 110                 q_idx = MT_TX_MCU_PORT_RX_Q0;
 111                 pkt_fmt = MT_TX_TYPE_CMD;
 112         } else {
 113                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
 114                 pkt_fmt = MT_TX_TYPE_FW;
 115         }
 116
 117         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 118               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
 119               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
 120         txd[0] = cpu_to_le32(val);
 121
 122         val = MT_TXD1_LONG_FORMAT |
 123               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
 124               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
 125         txd[1] = cpu_to_le32(val);
 126
 127         if (cmd & MCU_UNI_PREFIX) {
 128                 uni_txd = (struct mt7615_uni_txd *)txd;
 129                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 130                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 131                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 132                 uni_txd->s2d_index = MCU_S2D_H2N;
 133                 uni_txd->pkt_type = MCU_PKT_ID;
 134                 uni_txd->seq = seq;
 135
 136                 return;
 137         }
 138
 139         mcu_txd = (struct mt7615_mcu_txd *)txd;
 140         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 141         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
 142         mcu_txd->s2d_index = MCU_S2D_H2N;
 143         mcu_txd->pkt_type = MCU_PKT_ID;
 144         mcu_txd->seq = seq;
 145
 146         switch (cmd & ~MCU_CMD_MASK) {
 147         case MCU_FW_PREFIX:
 148                 mcu_txd->set_query = MCU_Q_NA;
 149                 mcu_txd->cid = mcu_cmd;
 150                 break;
 151         case MCU_CE_PREFIX:
 152                 if (cmd & MCU_QUERY_MASK)
 153                         mcu_txd->set_query = MCU_Q_QUERY;
 154                 else
 155                         mcu_txd->set_query = MCU_Q_SET;
 156                 mcu_txd->cid = mcu_cmd;
 157                 break;
 158         default:
 159                 mcu_txd->cid = MCU_CMD_EXT_CID;
 160                 if (cmd & MCU_QUERY_PREFIX)
 161                         mcu_txd->set_query = MCU_Q_QUERY;
 162                 else
 163                         mcu_txd->set_query = MCU_Q_SET;
 164                 mcu_txd->ext_cid = mcu_cmd;
 165                 mcu_txd->ext_cid_ack = 1;
 166                 break;
 167         }
 168 }
 169 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
 170
 171 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 172                               struct sk_buff *skb, int seq)
 173 {
 174         struct mt7615_mcu_rxd *rxd;
 175         int ret = 0;
 176
 177         if (!skb) {
 178                 dev_err(mdev->dev, "Message %ld (seq %d) timeout\n",
 179                         cmd & MCU_CMD_MASK, seq);
 180                 return -ETIMEDOUT;
 181         }
 182
 183         rxd = (struct mt7615_mcu_rxd *)skb->data;
 184         if (seq != rxd->seq)
 185                 return -EAGAIN;
 186
 187         switch (cmd) {
 188         case MCU_CMD_PATCH_SEM_CONTROL:
 189                 skb_pull(skb, sizeof(*rxd) - 4);
 190                 ret = *skb->data;
 191                 break;
 192         case MCU_EXT_CMD_GET_TEMP:
 193                 skb_pull(skb, sizeof(*rxd));
 194                 ret = le32_to_cpu(*(__le32 *)skb->data);
 195                 break;
 196         case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
 197                 skb_pull(skb, sizeof(*rxd));
 198                 ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
 199                 break;
 200         case MCU_UNI_CMD_DEV_INFO_UPDATE:
 201         case MCU_UNI_CMD_BSS_INFO_UPDATE:
 202         case MCU_UNI_CMD_STA_REC_UPDATE:
 203         case MCU_UNI_CMD_HIF_CTRL:
 204         case MCU_UNI_CMD_OFFLOAD:
 205         case MCU_UNI_CMD_SUSPEND: {
 206                 struct mt7615_mcu_uni_event *event;
 207
 208                 skb_pull(skb, sizeof(*rxd));
 209                 event = (struct mt7615_mcu_uni_event *)skb->data;
 210                 ret = le32_to_cpu(event->status);
 211                 break;
 212         }
 213         case MCU_CMD_REG_READ: {
 214                 struct mt7615_mcu_reg_event *event;
 215
 216                 skb_pull(skb, sizeof(*rxd));
 217                 event = (struct mt7615_mcu_reg_event *)skb->data;
 218                 ret = (int)le32_to_cpu(event->val);
 219                 break;
 220         }
 221         default:
 222                 break;
 223         }
 224
 225         return ret;
 226 }
 227 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
 228
 229 static int
 230 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 231                         int cmd, int *seq)
 232 {
 233         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 234         enum mt76_txq_id qid;
 235
 236         mt7615_mcu_fill_msg(dev, skb, cmd, seq);
 237         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 238                 qid = MT_MCUQ_WM;
 239         else
 240                 qid = MT_MCUQ_FWDL;
 241
 242         return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
 243 }
 244
 245 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
 246 {
 247         struct {
 248                 __le32 wifi_stream;
 249                 __le32 address;
 250                 __le32 data;
 251         } req = {
 252                 .wifi_stream = cpu_to_le32(wf),
 253                 .address = cpu_to_le32(reg),
 254         };
 255
 256         return mt76_mcu_send_msg(&dev->mt76,
 257                                  MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
 258                                  &req, sizeof(req), true);
 259 }
 260
 261 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
 262 {
 263         struct {
 264                 __le32 wifi_stream;
 265                 __le32 address;
 266                 __le32 data;
 267         } req = {
 268                 .wifi_stream = cpu_to_le32(wf),
 269                 .address = cpu_to_le32(reg),
 270                 .data = cpu_to_le32(val),
 271         };
 272
 273         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
 274                                  sizeof(req), false);
 275 }
 276
 277 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
 278 {
 279         if (!is_mt7622(&dev->mt76))
 280                 return;
 281
 282         regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
 283                            MT_INFRACFG_MISC_AP2CONN_WAKE,
 284                            !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
 285 }
 286
 287 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
 288 {
 289         struct mt76_phy *mphy = &dev->mt76.phy;
 290         struct mt76_dev *mdev = &dev->mt76;
 291         u32 addr;
 292         int err;
 293
 294         addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
 295         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
 296
 297         mt7622_trigger_hif_int(dev, true);
 298
 299         addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 300         err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 301
 302         mt7622_trigger_hif_int(dev, false);
 303
 304         if (err) {
 305                 dev_err(mdev->dev, "driver own failed\n");
 306                 return -ETIMEDOUT;
 307         }
 308
 309         clear_bit(MT76_STATE_PM, &mphy->state);
 310
 311         return 0;
 312 }
 313
 314 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
 315 {
 316         struct mt76_phy *mphy = &dev->mt76.phy;
 317         int i;
 318
 319         if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
 320                 goto out;
 321
 322         for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
 323                 mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 324                 if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
 325                                    MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
 326                         break;
 327         }
 328
 329         if (i == MT7615_DRV_OWN_RETRY_COUNT) {
 330                 dev_err(dev->mt76.dev, "driver own failed\n");
 331                 set_bit(MT76_STATE_PM, &mphy->state);
 332                 return -EIO;
 333         }
 334
 335 out:
 336         dev->pm.last_activity = jiffies;
 337
 338         return 0;
 339 }
 340
 341 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
 342 {
 343         struct mt76_phy *mphy = &dev->mt76.phy;
 344         int err = 0;
 345         u32 addr;
 346
 347         if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
 348                 return 0;
 349
 350         mt7622_trigger_hif_int(dev, true);
 351
 352         addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 353         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
 354
 355         if (is_mt7622(&dev->mt76) &&
 356             !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
 357                             MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
 358                 dev_err(dev->mt76.dev, "Timeout for firmware own\n");
 359                 clear_bit(MT76_STATE_PM, &mphy->state);
 360                 err = -EIO;
 361         }
 362
 363         mt7622_trigger_hif_int(dev, false);
 364
 365         return err;
 366 }
 367
 368 static void
 369 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 370 {
 371         if (vif->csa_active)
 372                 ieee80211_csa_finish(vif);
 373 }
 374
 375 static void
 376 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 377 {
 378         struct mt76_phy *mphy = &dev->mt76.phy;
 379         struct mt7615_mcu_rdd_report *r;
 380
 381         r = (struct mt7615_mcu_rdd_report *)skb->data;
 382
 383         if (r->idx && dev->mt76.phy2)
 384                 mphy = dev->mt76.phy2;
 385
 386         ieee80211_radar_detected(mphy->hw);
 387         dev->hw_pattern++;
 388 }
 389
 390 static void
 391 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
 392 {
 393         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 394         const char *data = (char *)&rxd[1];
 395         const char *type;
 396
 397         switch (rxd->s2d_index) {
 398         case 0:
 399                 type = "N9";
 400                 break;
 401         case 2:
 402                 type = "CR4";
 403                 break;
 404         default:
 405                 type = "unknown";
 406                 break;
 407         }
 408
 409         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 410 }
 411
 412 static void
 413 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 414 {
 415         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 416
 417         switch (rxd->ext_eid) {
 418         case MCU_EXT_EVENT_RDD_REPORT:
 419                 mt7615_mcu_rx_radar_detected(dev, skb);
 420                 break;
 421         case MCU_EXT_EVENT_CSA_NOTIFY:
 422                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 423                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 424                                 mt7615_mcu_csa_finish, dev);
 425                 break;
 426         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 427                 mt7615_mcu_rx_log_message(dev, skb);
 428                 break;
 429         default:
 430                 break;
 431         }
 432 }
 433
 434 static void
 435 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
 436 {
 437         u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
 438         struct mt7615_phy *phy;
 439         struct mt76_phy *mphy;
 440
 441         if (*seq_num & BIT(7) && dev->mt76.phy2)
 442                 mphy = dev->mt76.phy2;
 443         else
 444                 mphy = &dev->mt76.phy;
 445
 446         phy = (struct mt7615_phy *)mphy->priv;
 447
 448         spin_lock_bh(&dev->mt76.lock);
 449         __skb_queue_tail(&phy->scan_event_list, skb);
 450         spin_unlock_bh(&dev->mt76.lock);
 451
 452         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 453                                      MT7615_HW_SCAN_TIMEOUT);
 454 }
 455
 456 static void
 457 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
 458 {
 459         struct mt7615_roc_tlv *event;
 460         struct mt7615_phy *phy;
 461         struct mt76_phy *mphy;
 462         int duration;
 463
 464         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 465         event = (struct mt7615_roc_tlv *)skb->data;
 466
 467         if (event->dbdc_band && dev->mt76.phy2)
 468                 mphy = dev->mt76.phy2;
 469         else
 470                 mphy = &dev->mt76.phy;
 471
 472         ieee80211_ready_on_channel(mphy->hw);
 473
 474         phy = (struct mt7615_phy *)mphy->priv;
 475         phy->roc_grant = true;
 476         wake_up(&phy->roc_wait);
 477
 478         duration = le32_to_cpu(event->max_interval);
 479         mod_timer(&phy->roc_timer,
 480                   round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
 481 }
 482
 483 static void
 484 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 485 {
 486         struct mt76_connac_beacon_loss_event *event;
 487         struct mt76_phy *mphy;
 488         u8 band_idx = 0; /* DBDC support */
 489
 490         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 491         event = (struct mt76_connac_beacon_loss_event *)skb->data;
 492         if (band_idx && dev->mt76.phy2)
 493                 mphy = dev->mt76.phy2;
 494         else
 495                 mphy = &dev->mt76.phy;
 496
 497         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 498                                         IEEE80211_IFACE_ITER_RESUME_ALL,
 499                                         mt76_connac_mcu_beacon_loss_iter,
 500                                         event);
 501 }
 502
 503 static void
 504 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 505 {
 506         struct mt76_connac_mcu_bss_event *event;
 507         struct mt76_phy *mphy;
 508         u8 band_idx = 0; /* DBDC support */
 509
 510         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 511         event = (struct mt76_connac_mcu_bss_event *)skb->data;
 512
 513         if (band_idx && dev->mt76.phy2)
 514                 mphy = dev->mt76.phy2;
 515         else
 516                 mphy = &dev->mt76.phy;
 517
 518         if (event->is_absent)
 519                 ieee80211_stop_queues(mphy->hw);
 520         else
 521                 ieee80211_wake_queues(mphy->hw);
 522 }
 523
 524 static void
 525 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 526 {
 527         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 528
 529         switch (rxd->eid) {
 530         case MCU_EVENT_EXT:
 531                 mt7615_mcu_rx_ext_event(dev, skb);
 532                 break;
 533         case MCU_EVENT_BSS_BEACON_LOSS:
 534                 mt7615_mcu_beacon_loss_event(dev, skb);
 535                 break;
 536         case MCU_EVENT_ROC:
 537                 mt7615_mcu_roc_event(dev, skb);
 538                 break;
 539         case MCU_EVENT_SCHED_SCAN_DONE:
 540         case MCU_EVENT_SCAN_DONE:
 541                 mt7615_mcu_scan_event(dev, skb);
 542                 return;
 543         case MCU_EVENT_BSS_ABSENCE:
 544                 mt7615_mcu_bss_event(dev, skb);
 545                 break;
 546         default:
 547                 break;
 548         }
 549         dev_kfree_skb(skb);
 550 }
 551
 552 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 553 {
 554         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 555
 556         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 557             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 558             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 559             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 560             rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 561             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 562             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 563             rxd->eid == MCU_EVENT_SCAN_DONE ||
 564             rxd->eid == MCU_EVENT_ROC ||
 565             !rxd->seq)
 566                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 567         else
 568                 mt76_mcu_rx_event(&dev->mt76, skb);
 569 }
 570
 571 static int
 572 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 573                        bool bssid, bool enable)
 574 {
 575         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 576         u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
 577         u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
 578         const u8 *addr = vif->addr;
 579         struct {
 580                 u8 mode;
 581                 u8 force_clear;
 582                 u8 clear_bitmap[8];
 583                 u8 entry_count;
 584                 u8 write;
 585
 586                 u8 index;
 587                 u8 bssid;
 588                 u8 addr[ETH_ALEN];
 589         } __packed req = {
 590                 .mode = !!mask || enable,
 591                 .entry_count = 1,
 592                 .write = 1,
 593
 594                 .index = idx * 2 + bssid,
 595         };
 596
 597         if (bssid)
 598                 addr = vif->bss_conf.bssid;
 599
 600         if (enable)
 601                 ether_addr_copy(req.addr, addr);
 602
 603         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
 604                                  sizeof(req), true);
 605 }
 606
 607 static int
 608 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 609                    bool enable)
 610 {
 611         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 612         struct mt7615_dev *dev = phy->dev;
 613         struct {
 614                 struct req_hdr {
 615                         u8 omac_idx;
 616                         u8 band_idx;
 617                         __le16 tlv_num;
 618                         u8 is_tlv_append;
 619                         u8 rsv[3];
 620                 } __packed hdr;
 621                 struct req_tlv {
 622                         __le16 tag;
 623                         __le16 len;
 624                         u8 active;
 625                         u8 band_idx;
 626                         u8 omac_addr[ETH_ALEN];
 627                 } __packed tlv;
 628         } data = {
 629                 .hdr = {
 630                         .omac_idx = mvif->mt76.omac_idx,
 631                         .band_idx = mvif->mt76.band_idx,
 632                         .tlv_num = cpu_to_le16(1),
 633                         .is_tlv_append = 1,
 634                 },
 635                 .tlv = {
 636                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 637                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 638                         .active = enable,
 639                         .band_idx = mvif->mt76.band_idx,
 640                 },
 641         };
 642
 643         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
 644                 return mt7615_mcu_muar_config(dev, vif, false, enable);
 645
 646         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 647         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 648                                  &data, sizeof(data), true);
 649 }
 650
 651 static int
 652 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
 653                               struct ieee80211_hw *hw,
 654                               struct ieee80211_vif *vif, bool enable)
 655 {
 656         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 657         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
 658         struct ieee80211_mutable_offsets offs;
 659         struct ieee80211_tx_info *info;
 660         struct req {
 661                 u8 omac_idx;
 662                 u8 enable;
 663                 u8 wlan_idx;
 664                 u8 band_idx;
 665                 u8 pkt_type;
 666                 u8 need_pre_tbtt_int;
 667                 __le16 csa_ie_pos;
 668                 __le16 pkt_len;
 669                 __le16 tim_ie_pos;
 670                 u8 pkt[512];
 671                 u8 csa_cnt;
 672                 /* bss color change */
 673                 u8 bcc_cnt;
 674                 __le16 bcc_ie_pos;
 675         } __packed req = {
 676                 .omac_idx = mvif->mt76.omac_idx,
 677                 .enable = enable,
 678                 .wlan_idx = wcid->idx,
 679                 .band_idx = mvif->mt76.band_idx,
 680         };
 681         struct sk_buff *skb;
 682
 683         skb = ieee80211_beacon_get_template(hw, vif, &offs);
 684         if (!skb)
 685                 return -EINVAL;
 686
 687         if (skb->len > 512 - MT_TXD_SIZE) {
 688                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
 689                 dev_kfree_skb(skb);
 690                 return -EINVAL;
 691         }
 692
 693         if (mvif->mt76.band_idx) {
 694                 info = IEEE80211_SKB_CB(skb);
 695                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
 696         }
 697
 698         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
 699                               0, NULL, true);
 700         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
 701         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 702         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
 703         if (offs.cntdwn_counter_offs[0]) {
 704                 u16 csa_offs;
 705
 706                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
 707                 req.csa_ie_pos = cpu_to_le16(csa_offs);
 708                 req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
 709         }
 710         dev_kfree_skb(skb);
 711
 712         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
 713                                  sizeof(req), true);
 714 }
 715
 716 static int
 717 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
 718 {
 719 #define ENTER_PM_STATE  1
 720 #define EXIT_PM_STATE   2
 721         struct {
 722                 u8 pm_number;
 723                 u8 pm_state;
 724                 u8 bssid[ETH_ALEN];
 725                 u8 dtim_period;
 726                 u8 wlan_idx;
 727                 __le16 bcn_interval;
 728                 __le32 aid;
 729                 __le32 rx_filter;
 730                 u8 band_idx;
 731                 u8 rsv[3];
 732                 __le32 feature;
 733                 u8 omac_idx;
 734                 u8 wmm_idx;
 735                 u8 bcn_loss_cnt;
 736                 u8 bcn_sp_duration;
 737         } __packed req = {
 738                 .pm_number = 5,
 739                 .pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
 740                 .band_idx = band,
 741         };
 742
 743         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
 744                                  sizeof(req), true);
 745 }
 746
 747 static int
 748 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 749                          struct ieee80211_sta *sta, bool enable)
 750 {
 751         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 752         u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
 753         struct bss_info_basic *bss;
 754         u8 wlan_idx = mvif->sta.wcid.idx;
 755         struct tlv *tlv;
 756
 757         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 758
 759         switch (vif->type) {
 760         case NL80211_IFTYPE_MESH_POINT:
 761         case NL80211_IFTYPE_AP:
 762                 break;
 763         case NL80211_IFTYPE_STATION:
 764                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 765                 if (enable && sta) {
 766                         struct mt7615_sta *msta;
 767
 768                         msta = (struct mt7615_sta *)sta->drv_priv;
 769                         wlan_idx = msta->wcid.idx;
 770                 }
 771                 break;
 772         case NL80211_IFTYPE_ADHOC:
 773                 type = NETWORK_IBSS;
 774                 break;
 775         default:
 776                 WARN_ON(1);
 777                 break;
 778         }
 779
 780         bss = (struct bss_info_basic *)tlv;
 781         memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 782         bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 783         bss->network_type = cpu_to_le32(type);
 784         bss->dtim_period = vif->bss_conf.dtim_period;
 785         bss->bmc_tx_wlan_idx = wlan_idx;
 786         bss->wmm_idx = mvif->mt76.wmm_idx;
 787         bss->active = enable;
 788
 789         return 0;
 790 }
 791
 792 static void
 793 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 794 {
 795         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 796         u8 omac_idx = mvif->mt76.omac_idx;
 797         struct bss_info_omac *omac;
 798         struct tlv *tlv;
 799         u32 type = 0;
 800
 801         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 802
 803         switch (vif->type) {
 804         case NL80211_IFTYPE_MESH_POINT:
 805         case NL80211_IFTYPE_AP:
 806                 if (vif->p2p)
 807                         type = CONNECTION_P2P_GO;
 808                 else
 809                         type = CONNECTION_INFRA_AP;
 810                 break;
 811         case NL80211_IFTYPE_STATION:
 812                 if (vif->p2p)
 813                         type = CONNECTION_P2P_GC;
 814                 else
 815                         type = CONNECTION_INFRA_STA;
 816                 break;
 817         case NL80211_IFTYPE_ADHOC:
 818                 type = CONNECTION_IBSS_ADHOC;
 819                 break;
 820         default:
 821                 WARN_ON(1);
 822                 break;
 823         }
 824
 825         omac = (struct bss_info_omac *)tlv;
 826         omac->conn_type = cpu_to_le32(type);
 827         omac->omac_idx = mvif->mt76.omac_idx;
 828         omac->band_idx = mvif->mt76.band_idx;
 829         omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
 830 }
 831
 832 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 833 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 834 static void
 835 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
 836 {
 837         struct bss_info_ext_bss *ext;
 838         int ext_bss_idx, tsf_offset;
 839         struct tlv *tlv;
 840
 841         ext_bss_idx = mvif->mt76.omac_idx - EXT_BSSID_START;
 842         if (ext_bss_idx < 0)
 843                 return;
 844
 845         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 846
 847         ext = (struct bss_info_ext_bss *)tlv;
 848         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 849         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 850 }
 851
 852 static int
 853 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 854                    struct ieee80211_sta *sta, bool enable)
 855 {
 856         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 857         struct mt7615_dev *dev = phy->dev;
 858         struct sk_buff *skb;
 859
 860         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
 861                 mt7615_mcu_muar_config(dev, vif, true, enable);
 862
 863         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
 864         if (IS_ERR(skb))
 865                 return PTR_ERR(skb);
 866
 867         if (enable)
 868                 mt7615_mcu_bss_omac_tlv(skb, vif);
 869
 870         mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
 871
 872         if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
 873             mvif->mt76.omac_idx < REPEATER_BSSID_START)
 874                 mt7615_mcu_bss_ext_tlv(skb, mvif);
 875
 876         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 877                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
 878 }
 879
 880 static int
 881 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
 882                       struct ieee80211_ampdu_params *params,
 883                       bool enable)
 884 {
 885         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 886         struct mt7615_vif *mvif = msta->vif;
 887         struct wtbl_req_hdr *wtbl_hdr;
 888         struct sk_buff *skb = NULL;
 889         int err;
 890
 891         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 892                                                   WTBL_SET, NULL, &skb);
 893         if (IS_ERR(wtbl_hdr))
 894                 return PTR_ERR(wtbl_hdr);
 895
 896         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
 897                                     NULL, wtbl_hdr);
 898
 899         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
 900                                     true);
 901         if (err < 0)
 902                 return err;
 903
 904         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 905                                             &msta->wcid);
 906         if (IS_ERR(skb))
 907                 return PTR_ERR(skb);
 908
 909         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
 910
 911         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 912                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
 913 }
 914
 915 static int
 916 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
 917                       struct ieee80211_ampdu_params *params,
 918                       bool enable)
 919 {
 920         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 921         struct mt7615_vif *mvif = msta->vif;
 922         struct wtbl_req_hdr *wtbl_hdr;
 923         struct sk_buff *skb;
 924         int err;
 925
 926         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 927                                             &msta->wcid);
 928         if (IS_ERR(skb))
 929                 return PTR_ERR(skb);
 930
 931         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
 932
 933         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 934                                     MCU_EXT_CMD_STA_REC_UPDATE, true);
 935         if (err < 0 || !enable)
 936                 return err;
 937
 938         skb = NULL;
 939         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 940                                                   WTBL_SET, NULL, &skb);
 941         if (IS_ERR(wtbl_hdr))
 942                 return PTR_ERR(wtbl_hdr);
 943
 944         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
 945                                     NULL, wtbl_hdr);
 946
 947         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
 948                                      true);
 949 }
 950
 951 static int
 952 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 953                         struct ieee80211_sta *sta, bool enable)
 954 {
 955         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 956         struct sk_buff *skb, *sskb, *wskb = NULL;
 957         struct mt7615_dev *dev = phy->dev;
 958         struct wtbl_req_hdr *wtbl_hdr;
 959         struct mt7615_sta *msta;
 960         int cmd, err;
 961
 962         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
 963
 964         sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 965                                              &msta->wcid);
 966         if (IS_ERR(sskb))
 967                 return PTR_ERR(sskb);
 968
 969         mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable);
 970         if (enable && sta)
 971                 mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif);
 972
 973         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 974                                                   WTBL_RESET_AND_SET, NULL,
 975                                                   &wskb);
 976         if (IS_ERR(wtbl_hdr))
 977                 return PTR_ERR(wtbl_hdr);
 978
 979         if (enable) {
 980                 mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
 981                                                  NULL, wtbl_hdr);
 982                 if (sta)
 983                         mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
 984                                                     NULL, wtbl_hdr);
 985         }
 986
 987         cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
 988         skb = enable ? wskb : sskb;
 989
 990         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
 991         if (err < 0) {
 992                 skb = enable ? sskb : wskb;
 993                 dev_kfree_skb(skb);
 994
 995                 return err;
 996         }
 997
 998         cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
 999         skb = enable ? sskb : wskb;
1000
1001         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1002 }
1003
1004 static const struct mt7615_mcu_ops wtbl_update_ops = {
1005         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1006         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1007         .add_dev_info = mt7615_mcu_add_dev,
1008         .add_bss_info = mt7615_mcu_add_bss,
1009         .add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1010         .add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1011         .sta_add = mt7615_mcu_wtbl_sta_add,
1012         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1013         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1014 };
1015
1016 static int
1017 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1018                   struct ieee80211_ampdu_params *params,
1019                   bool enable, bool tx)
1020 {
1021         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1022         struct mt7615_vif *mvif = msta->vif;
1023         struct wtbl_req_hdr *wtbl_hdr;
1024         struct tlv *sta_wtbl;
1025         struct sk_buff *skb;
1026
1027         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1028                                             &msta->wcid);
1029         if (IS_ERR(skb))
1030                 return PTR_ERR(skb);
1031
1032         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1033
1034         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1035
1036         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1037                                                   WTBL_SET, sta_wtbl, &skb);
1038         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
1039                                     sta_wtbl, wtbl_hdr);
1040
1041         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1042                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1043 }
1044
1045 static int
1046 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1047                      struct ieee80211_ampdu_params *params,
1048                      bool enable)
1049 {
1050         return mt7615_mcu_sta_ba(dev, params, enable, true);
1051 }
1052
1053 static int
1054 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1055                      struct ieee80211_ampdu_params *params,
1056                      bool enable)
1057 {
1058         return mt7615_mcu_sta_ba(dev, params, enable, false);
1059 }
1060
1061 static int
1062 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
1063                      struct ieee80211_sta *sta, bool enable, int cmd)
1064 {
1065         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1066         struct mt76_wcid *wcid;
1067
1068         wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
1069         return mt76_connac_mcu_add_sta_cmd(phy, vif, sta, wcid, enable, cmd);
1070 }
1071
1072 static int
1073 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1074                    struct ieee80211_sta *sta, bool enable)
1075 {
1076         return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1077                                     MCU_EXT_CMD_STA_REC_UPDATE);
1078 }
1079
1080 static const struct mt7615_mcu_ops sta_update_ops = {
1081         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1082         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1083         .add_dev_info = mt7615_mcu_add_dev,
1084         .add_bss_info = mt7615_mcu_add_bss,
1085         .add_tx_ba = mt7615_mcu_sta_tx_ba,
1086         .add_rx_ba = mt7615_mcu_sta_rx_ba,
1087         .sta_add = mt7615_mcu_add_sta,
1088         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1089         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1090 };
1091
1092 static int
1093 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1094 {
1095         return 0;
1096 }
1097
1098 static int
1099 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1100                                   struct ieee80211_hw *hw,
1101                                   struct ieee80211_vif *vif,
1102                                   bool enable)
1103 {
1104         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1105         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1106         struct ieee80211_mutable_offsets offs;
1107         struct {
1108                 struct req_hdr {
1109                         u8 bss_idx;
1110                         u8 pad[3];
1111                 } __packed hdr;
1112                 struct bcn_content_tlv {
1113                         __le16 tag;
1114                         __le16 len;
1115                         __le16 tim_ie_pos;
1116                         __le16 csa_ie_pos;
1117                         __le16 bcc_ie_pos;
1118                         /* 0: enable beacon offload
1119                          * 1: disable beacon offload
1120                          * 2: update probe respond offload
1121                          */
1122                         u8 enable;
1123                         /* 0: legacy format (TXD + payload)
1124                          * 1: only cap field IE
1125                          */
1126                         u8 type;
1127                         __le16 pkt_len;
1128                         u8 pkt[512];
1129                 } __packed beacon_tlv;
1130         } req = {
1131                 .hdr = {
1132                         .bss_idx = mvif->mt76.idx,
1133                 },
1134                 .beacon_tlv = {
1135                         .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1136                         .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1137                         .enable = enable,
1138                 },
1139         };
1140         struct sk_buff *skb;
1141
1142         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1143         if (!skb)
1144                 return -EINVAL;
1145
1146         if (skb->len > 512 - MT_TXD_SIZE) {
1147                 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1148                 dev_kfree_skb(skb);
1149                 return -EINVAL;
1150         }
1151
1152         mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1153                               wcid, NULL, 0, NULL, true);
1154         memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1155         req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1156         req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1157
1158         if (offs.cntdwn_counter_offs[0]) {
1159                 u16 csa_offs;
1160
1161                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1162                 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1163         }
1164         dev_kfree_skb(skb);
1165
1166         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1167                                  &req, sizeof(req), true);
1168 }
1169
1170 static int
1171 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1172                        bool enable)
1173 {
1174         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1175
1176         return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1177                                            enable);
1178 }
1179
1180 static int
1181 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1182                        struct ieee80211_sta *sta, bool enable)
1183 {
1184         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1185
1186         return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1187                                            enable);
1188 }
1189
1190 static inline int
1191 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1192                        struct ieee80211_sta *sta, bool enable)
1193 {
1194         return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1195                                     MCU_UNI_CMD_STA_REC_UPDATE);
1196 }
1197
1198 static int
1199 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1200                      struct ieee80211_ampdu_params *params,
1201                      bool enable)
1202 {
1203         struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1204
1205         return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1206                                       enable, true);
1207 }
1208
1209 static int
1210 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1211                      struct ieee80211_ampdu_params *params,
1212                      bool enable)
1213 {
1214         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1215         struct mt7615_vif *mvif = msta->vif;
1216         struct wtbl_req_hdr *wtbl_hdr;
1217         struct tlv *sta_wtbl;
1218         struct sk_buff *skb;
1219         int err;
1220
1221         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1222                                             &msta->wcid);
1223         if (IS_ERR(skb))
1224                 return PTR_ERR(skb);
1225
1226         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1227
1228         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1229                                     MCU_UNI_CMD_STA_REC_UPDATE, true);
1230         if (err < 0 || !enable)
1231                 return err;
1232
1233         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1234                                             &msta->wcid);
1235         if (IS_ERR(skb))
1236                 return PTR_ERR(skb);
1237
1238         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1239                                            sizeof(struct tlv));
1240
1241         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1242                                                   WTBL_SET, sta_wtbl, &skb);
1243         if (IS_ERR(wtbl_hdr))
1244                 return PTR_ERR(wtbl_hdr);
1245
1246         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1247                                     sta_wtbl, wtbl_hdr);
1248
1249         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1250                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1251 }
1252
1253 static const struct mt7615_mcu_ops uni_update_ops = {
1254         .add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1255         .set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1256         .add_dev_info = mt7615_mcu_uni_add_dev,
1257         .add_bss_info = mt7615_mcu_uni_add_bss,
1258         .add_tx_ba = mt7615_mcu_uni_tx_ba,
1259         .add_rx_ba = mt7615_mcu_uni_rx_ba,
1260         .sta_add = mt7615_mcu_uni_add_sta,
1261         .set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1262         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1263 };
1264
1265 int mt7615_mcu_restart(struct mt76_dev *dev)
1266 {
1267         return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1268 }
1269 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1270
1271 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1272 {
1273         const struct mt7615_patch_hdr *hdr;
1274         const struct firmware *fw = NULL;
1275         int len, ret, sem;
1276
1277         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1278         switch (sem) {
1279         case PATCH_IS_DL:
1280                 return 0;
1281         case PATCH_NOT_DL_SEM_SUCCESS:
1282                 break;
1283         default:
1284                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1285                 return -EAGAIN;
1286         }
1287
1288         ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1289         if (ret)
1290                 goto out;
1291
1292         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1293                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1294                 ret = -EINVAL;
1295                 goto out;
1296         }
1297
1298         hdr = (const struct mt7615_patch_hdr *)(fw->data);
1299
1300         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1301                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1302
1303         len = fw->size - sizeof(*hdr);
1304
1305         ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1306                                             DL_MODE_NEED_RSP);
1307         if (ret) {
1308                 dev_err(dev->mt76.dev, "Download request failed\n");
1309                 goto out;
1310         }
1311
1312         ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1313                                      fw->data + sizeof(*hdr), len);
1314         if (ret) {
1315                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1316                 goto out;
1317         }
1318
1319         ret = mt76_connac_mcu_start_patch(&dev->mt76);
1320         if (ret)
1321                 dev_err(dev->mt76.dev, "Failed to start patch\n");
1322
1323 out:
1324         release_firmware(fw);
1325
1326         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1327         switch (sem) {
1328         case PATCH_REL_SEM_SUCCESS:
1329                 break;
1330         default:
1331                 ret = -EAGAIN;
1332                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1333                 break;
1334         }
1335
1336         return ret;
1337 }
1338
1339 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1340 {
1341         u32 ret = 0;
1342
1343         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1344                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1345         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1346                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1347         ret |= DL_MODE_NEED_RSP;
1348         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1349
1350         return ret;
1351 }
1352
1353 static int
1354 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1355                              const struct mt7615_fw_trailer *hdr,
1356                              const u8 *data, bool is_cr4)
1357 {
1358         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1359         int err, i, offset = 0;
1360         u32 len, addr, mode;
1361
1362         for (i = 0; i < n_region; i++) {
1363                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1364                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1365                 addr = le32_to_cpu(hdr[i].addr);
1366
1367                 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1368                                                     mode);
1369                 if (err) {
1370                         dev_err(dev->mt76.dev, "Download request failed\n");
1371                         return err;
1372                 }
1373
1374                 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1375                                              data + offset, len);
1376                 if (err) {
1377                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1378                         return err;
1379                 }
1380
1381                 offset += len;
1382         }
1383
1384         return 0;
1385 }
1386
1387 static const struct wiphy_wowlan_support mt7615_wowlan_support = {
1388         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
1389                  WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
1390         .n_patterns = 1,
1391         .pattern_min_len = 1,
1392         .pattern_max_len = MT7615_WOW_PATTEN_MAX_LEN,
1393         .max_nd_match_sets = 10,
1394 };
1395
1396 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1397 {
1398         const struct mt7615_fw_trailer *hdr;
1399         const struct firmware *fw;
1400         int ret;
1401
1402         ret = request_firmware(&fw, name, dev->mt76.dev);
1403         if (ret)
1404                 return ret;
1405
1406         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1407                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1408                 ret = -EINVAL;
1409                 goto out;
1410         }
1411
1412         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1413                                         N9_REGION_NUM * sizeof(*hdr));
1414
1415         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1416                  hdr->fw_ver, hdr->build_date);
1417
1418         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1419         if (ret)
1420                 goto out;
1421
1422         ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1423                                              le32_to_cpu(hdr->addr),
1424                                              FW_START_OVERRIDE);
1425         if (ret) {
1426                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1427                 goto out;
1428         }
1429
1430         snprintf(dev->mt76.hw->wiphy->fw_version,
1431                  sizeof(dev->mt76.hw->wiphy->fw_version),
1432                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1433
1434         if (!is_mt7615(&dev->mt76) &&
1435             !strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
1436                 dev->fw_ver = MT7615_FIRMWARE_V2;
1437                 dev->mcu_ops = &sta_update_ops;
1438         } else {
1439                 dev->fw_ver = MT7615_FIRMWARE_V1;
1440                 dev->mcu_ops = &wtbl_update_ops;
1441         }
1442
1443 out:
1444         release_firmware(fw);
1445         return ret;
1446 }
1447
1448 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1449 {
1450         const struct mt7615_fw_trailer *hdr;
1451         const struct firmware *fw;
1452         int ret;
1453
1454         ret = request_firmware(&fw, name, dev->mt76.dev);
1455         if (ret)
1456                 return ret;
1457
1458         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1459                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1460                 ret = -EINVAL;
1461                 goto out;
1462         }
1463
1464         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1465                                         CR4_REGION_NUM * sizeof(*hdr));
1466
1467         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1468                  hdr->fw_ver, hdr->build_date);
1469
1470         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1471         if (ret)
1472                 goto out;
1473
1474         ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1475                                              FW_START_WORKING_PDA_CR4);
1476         if (ret) {
1477                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1478                 goto out;
1479         }
1480
1481 out:
1482         release_firmware(fw);
1483
1484         return ret;
1485 }
1486
1487 static int mt7615_load_ram(struct mt7615_dev *dev)
1488 {
1489         int ret;
1490
1491         ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1492         if (ret)
1493                 return ret;
1494
1495         return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1496 }
1497
1498 static int mt7615_load_firmware(struct mt7615_dev *dev)
1499 {
1500         int ret;
1501         u32 val;
1502
1503         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1504
1505         if (val != FW_STATE_FW_DOWNLOAD) {
1506                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1507                 return -EIO;
1508         }
1509
1510         ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1511         if (ret)
1512                 return ret;
1513
1514         ret = mt7615_load_ram(dev);
1515         if (ret)
1516                 return ret;
1517
1518         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1519                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1520                                        FW_STATE_CR4_RDY), 500)) {
1521                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1522                 return -EIO;
1523         }
1524
1525         return 0;
1526 }
1527
1528 static int mt7622_load_firmware(struct mt7615_dev *dev)
1529 {
1530         int ret;
1531         u32 val;
1532
1533         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1534
1535         val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1536         if (val != FW_STATE_FW_DOWNLOAD) {
1537                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1538                 return -EIO;
1539         }
1540
1541         ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1542         if (ret)
1543                 return ret;
1544
1545         ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1546         if (ret)
1547                 return ret;
1548
1549         if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1550                             FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1551                                        FW_STATE_NORMAL_TRX), 1500)) {
1552                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1553                 return -EIO;
1554         }
1555
1556         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1557
1558         return 0;
1559 }
1560
1561 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1562 {
1563         struct {
1564                 u8 ctrl_val;
1565                 u8 pad[3];
1566         } data = {
1567                 .ctrl_val = ctrl
1568         };
1569
1570         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
1571                                  sizeof(data), true);
1572 }
1573
1574 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1575 {
1576         u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1577         const struct mt7663_fw_trailer *hdr;
1578         const struct mt7663_fw_buf *buf;
1579         const struct firmware *fw;
1580         const u8 *base_addr;
1581         int i, ret;
1582
1583         ret = request_firmware(&fw, name, dev->mt76.dev);
1584         if (ret)
1585                 return ret;
1586
1587         if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1588                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1589                 ret = -EINVAL;
1590                 goto out;
1591         }
1592
1593         hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
1594                                                  FW_V3_COMMON_TAILER_SIZE);
1595
1596         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1597                  hdr->fw_ver, hdr->build_date);
1598         dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1599
1600         base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1601         for (i = 0; i < hdr->n_region; i++) {
1602                 u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1603                 u32 len, addr, mode;
1604
1605                 dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1606
1607                 buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1608                 mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
1609                 addr = le32_to_cpu(buf->img_dest_addr);
1610                 len = le32_to_cpu(buf->img_size);
1611
1612                 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1613                                                     mode);
1614                 if (ret) {
1615                         dev_err(dev->mt76.dev, "Download request failed\n");
1616                         goto out;
1617                 }
1618
1619                 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1620                                              fw->data + offset, len);
1621                 if (ret) {
1622                         dev_err(dev->mt76.dev, "Failed to send firmware\n");
1623                         goto out;
1624                 }
1625
1626                 offset += le32_to_cpu(buf->img_size);
1627                 if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1628                         override_addr = le32_to_cpu(buf->img_dest_addr);
1629                         dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1630                                  i, override_addr);
1631                 }
1632         }
1633
1634         if (override_addr)
1635                 flag |= FW_START_OVERRIDE;
1636
1637         dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1638                  override_addr, flag);
1639
1640         ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1641         if (ret) {
1642                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1643                 goto out;
1644         }
1645
1646         snprintf(dev->mt76.hw->wiphy->fw_version,
1647                  sizeof(dev->mt76.hw->wiphy->fw_version),
1648                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1649
1650 out:
1651         release_firmware(fw);
1652
1653         return ret;
1654 }
1655
1656 static int
1657 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1658 {
1659         const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1660         const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1661         int ret;
1662
1663         if (!prefer_offload_fw) {
1664                 secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1665                 primary_rom = MT7663_ROM_PATCH;
1666         }
1667         selected_rom = primary_rom;
1668
1669         ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1670         if (ret) {
1671                 dev_info(dev->mt76.dev, "%s not found, switching to %s",
1672                          primary_rom, secondary_rom);
1673                 ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1674                                         secondary_rom);
1675                 if (ret) {
1676                         dev_err(dev->mt76.dev, "failed to load %s",
1677                                 secondary_rom);
1678                         return ret;
1679                 }
1680                 selected_rom = secondary_rom;
1681         }
1682
1683         if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1684                 *n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1685                 dev->fw_ver = MT7615_FIRMWARE_V3;
1686                 dev->mcu_ops = &uni_update_ops;
1687         } else {
1688                 *n9_firmware = MT7663_FIRMWARE_N9;
1689                 dev->fw_ver = MT7615_FIRMWARE_V2;
1690                 dev->mcu_ops = &sta_update_ops;
1691         }
1692
1693         return 0;
1694 }
1695
1696 int __mt7663_load_firmware(struct mt7615_dev *dev)
1697 {
1698         const char *n9_firmware;
1699         int ret;
1700
1701         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1702         if (ret) {
1703                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1704                 return -EIO;
1705         }
1706
1707         ret = mt7663_load_rom_patch(dev, &n9_firmware);
1708         if (ret)
1709                 return ret;
1710
1711         ret = mt7663_load_n9(dev, n9_firmware);
1712         if (ret)
1713                 return ret;
1714
1715         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1716                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1717                 ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1718                                      MT7663_TOP_MISC2_FW_STATE);
1719                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1720                 return -EIO;
1721         }
1722
1723 #ifdef CONFIG_PM
1724         if (mt7615_firmware_offload(dev))
1725                 dev->mt76.hw->wiphy->wowlan = &mt7615_wowlan_support;
1726 #endif /* CONFIG_PM */
1727
1728         dev_dbg(dev->mt76.dev, "Firmware init done\n");
1729
1730         return 0;
1731 }
1732 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1733
1734 static int mt7663_load_firmware(struct mt7615_dev *dev)
1735 {
1736         int ret;
1737
1738         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1739
1740         ret = __mt7663_load_firmware(dev);
1741         if (ret)
1742                 return ret;
1743
1744         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1745
1746         return 0;
1747 }
1748
1749 int mt7615_mcu_init(struct mt7615_dev *dev)
1750 {
1751         static const struct mt76_mcu_ops mt7615_mcu_ops = {
1752                 .headroom = sizeof(struct mt7615_mcu_txd),
1753                 .mcu_skb_send_msg = mt7615_mcu_send_message,
1754                 .mcu_parse_response = mt7615_mcu_parse_response,
1755                 .mcu_restart = mt7615_mcu_restart,
1756         };
1757         int ret;
1758
1759         dev->mt76.mcu_ops = &mt7615_mcu_ops,
1760
1761         ret = mt7615_mcu_drv_pmctrl(dev);
1762         if (ret)
1763                 return ret;
1764
1765         switch (mt76_chip(&dev->mt76)) {
1766         case 0x7622:
1767                 ret = mt7622_load_firmware(dev);
1768                 break;
1769         case 0x7663:
1770                 ret = mt7663_load_firmware(dev);
1771                 break;
1772         default:
1773                 ret = mt7615_load_firmware(dev);
1774                 break;
1775         }
1776         if (ret)
1777                 return ret;
1778
1779         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1780         dev_dbg(dev->mt76.dev, "Firmware init done\n");
1781         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1782         mt7615_mcu_fw_log_2_host(dev, 0);
1783
1784         return 0;
1785 }
1786 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1787
1788 void mt7615_mcu_exit(struct mt7615_dev *dev)
1789 {
1790         __mt76_mcu_restart(&dev->mt76);
1791         mt7615_mcu_set_fw_ctrl(dev);
1792         skb_queue_purge(&dev->mt76.mcu.res_q);
1793 }
1794 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1795
1796 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1797 {
1798         struct {
1799                 u8 buffer_mode;
1800                 u8 content_format;
1801                 __le16 len;
1802         } __packed req_hdr = {
1803                 .buffer_mode = 1,
1804         };
1805         u8 *eep = (u8 *)dev->mt76.eeprom.data;
1806         struct sk_buff *skb;
1807         int eep_len, offset;
1808
1809         switch (mt76_chip(&dev->mt76)) {
1810         case 0x7622:
1811                 eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1812                 offset = MT_EE_NIC_CONF_0;
1813                 break;
1814         case 0x7663:
1815                 eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1816                 req_hdr.content_format = 1;
1817                 offset = MT_EE_CHIP_ID;
1818                 break;
1819         default:
1820                 eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1821                 offset = MT_EE_NIC_CONF_0;
1822                 break;
1823         }
1824
1825         req_hdr.len = cpu_to_le16(eep_len);
1826
1827         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1828         if (!skb)
1829                 return -ENOMEM;
1830
1831         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1832         skb_put_data(skb, eep + offset, eep_len);
1833
1834         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1835                                      MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
1836 }
1837
1838 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1839                        const struct ieee80211_tx_queue_params *params)
1840 {
1841 #define WMM_AIFS_SET    BIT(0)
1842 #define WMM_CW_MIN_SET  BIT(1)
1843 #define WMM_CW_MAX_SET  BIT(2)
1844 #define WMM_TXOP_SET    BIT(3)
1845 #define WMM_PARAM_SET   (WMM_AIFS_SET | WMM_CW_MIN_SET | \
1846                          WMM_CW_MAX_SET | WMM_TXOP_SET)
1847         struct req_data {
1848                 u8 number;
1849                 u8 rsv[3];
1850                 u8 queue;
1851                 u8 valid;
1852                 u8 aifs;
1853                 u8 cw_min;
1854                 __le16 cw_max;
1855                 __le16 txop;
1856         } __packed req = {
1857                 .number = 1,
1858                 .queue = queue,
1859                 .valid = WMM_PARAM_SET,
1860                 .aifs = params->aifs,
1861                 .cw_min = 5,
1862                 .cw_max = cpu_to_le16(10),
1863                 .txop = cpu_to_le16(params->txop),
1864         };
1865
1866         if (params->cw_min)
1867                 req.cw_min = fls(params->cw_min);
1868         if (params->cw_max)
1869                 req.cw_max = cpu_to_le16(fls(params->cw_max));
1870
1871         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
1872                                  sizeof(req), true);
1873 }
1874
1875 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1876 {
1877         struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1878         struct dbdc_entry {
1879                 u8 type;
1880                 u8 index;
1881                 u8 band;
1882                 u8 _rsv;
1883         };
1884         struct {
1885                 u8 enable;
1886                 u8 num;
1887                 u8 _rsv[2];
1888                 struct dbdc_entry entry[64];
1889         } req = {
1890                 .enable = !!ext_phy,
1891         };
1892         int i;
1893
1894         if (!ext_phy)
1895                 goto out;
1896
1897 #define ADD_DBDC_ENTRY(_type, _idx, _band)              \
1898         do { \
1899                 req.entry[req.num].type = _type;                \
1900                 req.entry[req.num].index = _idx;                \
1901                 req.entry[req.num++].band = _band;              \
1902         } while (0)
1903
1904         for (i = 0; i < 4; i++) {
1905                 bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1906
1907                 ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1908         }
1909
1910         for (i = 0; i < 14; i++) {
1911                 bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1912
1913                 ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1914         }
1915
1916         ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1917
1918         for (i = 0; i < 3; i++)
1919                 ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
1920
1921         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
1922         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
1923         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
1924         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
1925
1926         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
1927         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
1928
1929 out:
1930         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
1931                                  sizeof(req), true);
1932 }
1933
1934 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1935 {
1936         struct wtbl_req_hdr req = {
1937                 .operation = WTBL_RESET_ALL,
1938         };
1939
1940         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
1941                                  sizeof(req), true);
1942 }
1943
1944 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
1945                        enum mt7615_rdd_cmd cmd, u8 index,
1946                        u8 rx_sel, u8 val)
1947 {
1948         struct {
1949                 u8 ctrl;
1950                 u8 rdd_idx;
1951                 u8 rdd_rx_sel;
1952                 u8 val;
1953                 u8 rsv[4];
1954         } req = {
1955                 .ctrl = cmd,
1956                 .rdd_idx = index,
1957                 .rdd_rx_sel = rx_sel,
1958                 .val = val,
1959         };
1960
1961         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
1962                                  sizeof(req), true);
1963 }
1964
1965 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
1966 {
1967         struct {
1968                 __le16 tag;
1969                 __le16 min_lpn;
1970         } req = {
1971                 .tag = cpu_to_le16(0x1),
1972                 .min_lpn = cpu_to_le16(val),
1973         };
1974
1975         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
1976                                  sizeof(req), true);
1977 }
1978
1979 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
1980                             const struct mt7615_dfs_pulse *pulse)
1981 {
1982         struct {
1983                 __le16 tag;
1984                 __le32 max_width;       /* us */
1985                 __le32 max_pwr;         /* dbm */
1986                 __le32 min_pwr;         /* dbm */
1987                 __le32 min_stgr_pri;    /* us */
1988                 __le32 max_stgr_pri;    /* us */
1989                 __le32 min_cr_pri;      /* us */
1990                 __le32 max_cr_pri;      /* us */
1991         } req = {
1992                 .tag = cpu_to_le16(0x3),
1993 #define __req_field(field) .field = cpu_to_le32(pulse->field)
1994                 __req_field(max_width),
1995                 __req_field(max_pwr),
1996                 __req_field(min_pwr),
1997                 __req_field(min_stgr_pri),
1998                 __req_field(max_stgr_pri),
1999                 __req_field(min_cr_pri),
2000                 __req_field(max_cr_pri),
2001 #undef  __req_field
2002         };
2003
2004         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2005                                  sizeof(req), true);
2006 }
2007
2008 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2009                             const struct mt7615_dfs_pattern *pattern)
2010 {
2011         struct {
2012                 __le16 tag;
2013                 __le16 radar_type;
2014                 u8 enb;
2015                 u8 stgr;
2016                 u8 min_crpn;
2017                 u8 max_crpn;
2018                 u8 min_crpr;
2019                 u8 min_pw;
2020                 u8 max_pw;
2021                 __le32 min_pri;
2022                 __le32 max_pri;
2023                 u8 min_crbn;
2024                 u8 max_crbn;
2025                 u8 min_stgpn;
2026                 u8 max_stgpn;
2027                 u8 min_stgpr;
2028         } req = {
2029                 .tag = cpu_to_le16(0x2),
2030                 .radar_type = cpu_to_le16(index),
2031 #define __req_field_u8(field) .field = pattern->field
2032 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2033                 __req_field_u8(enb),
2034                 __req_field_u8(stgr),
2035                 __req_field_u8(min_crpn),
2036                 __req_field_u8(max_crpn),
2037                 __req_field_u8(min_crpr),
2038                 __req_field_u8(min_pw),
2039                 __req_field_u8(max_pw),
2040                 __req_field_u32(min_pri),
2041                 __req_field_u32(max_pri),
2042                 __req_field_u8(min_crbn),
2043                 __req_field_u8(max_crbn),
2044                 __req_field_u8(min_stgpn),
2045                 __req_field_u8(max_stgpn),
2046                 __req_field_u8(min_stgpr),
2047 #undef __req_field_u8
2048 #undef __req_field_u32
2049         };
2050
2051         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2052                                  sizeof(req), true);
2053 }
2054
2055 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2056 {
2057         struct {
2058                 u8 pulse_num;
2059                 u8 rsv[3];
2060                 struct {
2061                         __le32 start_time;
2062                         __le16 width;
2063                         __le16 power;
2064                 } pattern[32];
2065         } req = {
2066                 .pulse_num = dev->radar_pattern.n_pulses,
2067         };
2068         u32 start_time = ktime_to_ms(ktime_get_boottime());
2069         int i;
2070
2071         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2072                 return -EINVAL;
2073
2074         /* TODO: add some noise here */
2075         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2076                 u32 ts = start_time + i * dev->radar_pattern.period;
2077
2078                 req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2079                 req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2080                 req.pattern[i].start_time = cpu_to_le32(ts);
2081         }
2082
2083         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2084                                  &req, sizeof(req), false);
2085 }
2086
2087 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2088 {
2089         struct mt76_phy *mphy = phy->mt76;
2090         struct ieee80211_hw *hw = mphy->hw;
2091         int n_chains = hweight8(mphy->antenna_mask);
2092         int tx_power;
2093         int i;
2094
2095         tx_power = hw->conf.power_level * 2 -
2096                    mt76_tx_power_nss_delta(n_chains);
2097         mphy->txpower_cur = tx_power;
2098
2099         for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2100                 sku[i] = tx_power;
2101
2102         for (i = 0; i < 4; i++) {
2103                 int delta = 0;
2104
2105                 if (i < n_chains - 1)
2106                         delta = mt76_tx_power_nss_delta(n_chains) -
2107                                 mt76_tx_power_nss_delta(i + 1);
2108                 sku[MT_SKU_1SS_DELTA + i] = delta;
2109         }
2110 }
2111
2112 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2113 {
2114         static const u8 width_to_bw[] = {
2115                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2116                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2117                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2118                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2119                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2120                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2121                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2122                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2123         };
2124
2125         if (chandef->width >= ARRAY_SIZE(width_to_bw))
2126                 return 0;
2127
2128         return width_to_bw[chandef->width];
2129 }
2130
2131 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2132 {
2133         struct mt7615_dev *dev = phy->dev;
2134         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2135         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2136         struct {
2137                 u8 control_chan;
2138                 u8 center_chan;
2139                 u8 bw;
2140                 u8 tx_streams;
2141                 u8 rx_streams_mask;
2142                 u8 switch_reason;
2143                 u8 band_idx;
2144                 /* for 80+80 only */
2145                 u8 center_chan2;
2146                 __le16 cac_case;
2147                 u8 channel_band;
2148                 u8 rsv0;
2149                 __le32 outband_freq;
2150                 u8 txpower_drop;
2151                 u8 rsv1[3];
2152                 u8 txpower_sku[53];
2153                 u8 rsv2[3];
2154         } req = {
2155                 .control_chan = chandef->chan->hw_value,
2156                 .center_chan = ieee80211_frequency_to_channel(freq1),
2157                 .tx_streams = hweight8(phy->mt76->antenna_mask),
2158                 .rx_streams_mask = phy->mt76->chainmask,
2159                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
2160         };
2161
2162         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2163                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2164         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2165                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2166                 req.switch_reason = CH_SWITCH_DFS;
2167         else
2168                 req.switch_reason = CH_SWITCH_NORMAL;
2169
2170         req.band_idx = phy != &dev->phy;
2171         req.bw = mt7615_mcu_chan_bw(chandef);
2172
2173         if (mt76_testmode_enabled(phy->mt76))
2174                 memset(req.txpower_sku, 0x3f, 49);
2175         else
2176                 mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2177
2178         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2179 }
2180
2181 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2182 {
2183         struct {
2184                 u8 action;
2185                 u8 rsv[3];
2186         } req = {
2187                 .action = index,
2188         };
2189
2190         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2191                                  sizeof(req), true);
2192 }
2193
2194 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2195                               u32 val)
2196 {
2197         struct {
2198                 u8 test_mode_en;
2199                 u8 param_idx;
2200                 u8 _rsv[2];
2201
2202                 __le32 value;
2203
2204                 u8 pad[8];
2205         } req = {
2206                 .test_mode_en = test_mode,
2207                 .param_idx = param,
2208                 .value = cpu_to_le32(val),
2209         };
2210
2211         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2212                                  sizeof(req), false);
2213 }
2214
2215 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2216 {
2217         struct mt7615_dev *dev = phy->dev;
2218         struct {
2219                 u8 format_id;
2220                 u8 sku_enable;
2221                 u8 band_idx;
2222                 u8 rsv;
2223         } req = {
2224                 .format_id = 0,
2225                 .band_idx = phy != &dev->phy,
2226                 .sku_enable = enable,
2227         };
2228
2229         return mt76_mcu_send_msg(&dev->mt76,
2230                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2231                                  sizeof(req), true);
2232 }
2233
2234 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2235 {
2236         int i;
2237
2238         for (i = 0; i < n_freqs; i++)
2239                 if (cur == freqs[i])
2240                         return i;
2241
2242         return -1;
2243 }
2244
2245 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2246 {
2247         static const u16 freq_list[] = {
2248                 4980, 5805, 5905, 5190,
2249                 5230, 5270, 5310, 5350,
2250                 5390, 5430, 5470, 5510,
2251                 5550, 5590, 5630, 5670,
2252                 5710, 5755, 5795, 5835,
2253                 5875, 5210, 5290, 5370,
2254                 5450, 5530, 5610, 5690,
2255                 5775, 5855
2256         };
2257         static const u16 freq_bw40[] = {
2258                 5190, 5230, 5270, 5310,
2259                 5350, 5390, 5430, 5470,
2260                 5510, 5550, 5590, 5630,
2261                 5670, 5710, 5755, 5795,
2262                 5835, 5875
2263         };
2264         int offset_2g = ARRAY_SIZE(freq_list);
2265         int idx;
2266
2267         if (freq < 4000) {
2268                 if (freq < 2427)
2269                         return offset_2g;
2270                 if (freq < 2442)
2271                         return offset_2g + 1;
2272                 if (freq < 2457)
2273                         return offset_2g + 2;
2274
2275                 return offset_2g + 3;
2276         }
2277
2278         switch (bw) {
2279         case NL80211_CHAN_WIDTH_80:
2280         case NL80211_CHAN_WIDTH_80P80:
2281         case NL80211_CHAN_WIDTH_160:
2282                 break;
2283         default:
2284                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2285                                            freq + 10);
2286                 if (idx >= 0) {
2287                         freq = freq_bw40[idx];
2288                         break;
2289                 }
2290
2291                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2292                                            freq - 10);
2293                 if (idx >= 0) {
2294                         freq = freq_bw40[idx];
2295                         break;
2296                 }
2297                 fallthrough;
2298         case NL80211_CHAN_WIDTH_40:
2299                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2300                                            freq);
2301                 if (idx >= 0)
2302                         break;
2303
2304                 return -1;
2305
2306         }
2307
2308         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2309 }
2310
2311 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2312 {
2313         struct mt7615_dev *dev = phy->dev;
2314         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2315         int freq2 = chandef->center_freq2;
2316         int ret;
2317         struct {
2318                 u8 direction;
2319                 u8 runtime_calibration;
2320                 u8 _rsv[2];
2321
2322                 __le16 center_freq;
2323                 u8 bw;
2324                 u8 band;
2325                 u8 is_freq2;
2326                 u8 success;
2327                 u8 dbdc_en;
2328
2329                 u8 _rsv2;
2330
2331                 struct {
2332                         __le32 sx0_i_lna[4];
2333                         __le32 sx0_q_lna[4];
2334
2335                         __le32 sx2_i_lna[4];
2336                         __le32 sx2_q_lna[4];
2337                 } dcoc_data[4];
2338         } req = {
2339                 .direction = 1,
2340
2341                 .bw = mt7615_mcu_chan_bw(chandef),
2342                 .band = chandef->center_freq1 > 4000,
2343                 .dbdc_en = !!dev->mt76.phy2,
2344         };
2345         u16 center_freq = chandef->center_freq1;
2346         int freq_idx;
2347         u8 *eep = dev->mt76.eeprom.data;
2348
2349         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2350                 return 0;
2351
2352         if (chandef->width == NL80211_CHAN_WIDTH_160) {
2353                 freq2 = center_freq + 40;
2354                 center_freq -= 40;
2355         }
2356
2357 again:
2358         req.runtime_calibration = 1;
2359         freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2360         if (freq_idx < 0)
2361                 goto out;
2362
2363         memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2364                               freq_idx * MT7615_EEPROM_DCOC_SIZE,
2365                sizeof(req.dcoc_data));
2366         req.runtime_calibration = 0;
2367
2368 out:
2369         req.center_freq = cpu_to_le16(center_freq);
2370         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
2371                                 sizeof(req), true);
2372
2373         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2374              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2375                 req.is_freq2 = true;
2376                 center_freq = freq2;
2377                 goto again;
2378         }
2379
2380         return ret;
2381 }
2382
2383 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2384 {
2385         static const u16 freq_list[] = {
2386                 4920, 4940, 4960, 4980,
2387                 5040, 5060, 5080, 5180,
2388                 5200, 5220, 5240, 5260,
2389                 5280, 5300, 5320, 5340,
2390                 5360, 5380, 5400, 5420,
2391                 5440, 5460, 5480, 5500,
2392                 5520, 5540, 5560, 5580,
2393                 5600, 5620, 5640, 5660,
2394                 5680, 5700, 5720, 5745,
2395                 5765, 5785, 5805, 5825,
2396                 5845, 5865, 5885, 5905
2397         };
2398         int offset_2g = ARRAY_SIZE(freq_list);
2399         int idx;
2400
2401         if (freq < 4000) {
2402                 if (freq < 2432)
2403                         return offset_2g;
2404                 if (freq < 2457)
2405                         return offset_2g + 1;
2406
2407                 return offset_2g + 2;
2408         }
2409
2410         if (bw != NL80211_CHAN_WIDTH_20) {
2411                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2412                                            freq + 10);
2413                 if (idx >= 0)
2414                         return idx;
2415
2416                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2417                                            freq - 10);
2418                 if (idx >= 0)
2419                         return idx;
2420         }
2421
2422         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2423 }
2424
2425
2426 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2427 {
2428         struct mt7615_dev *dev = phy->dev;
2429         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2430         int freq2 = chandef->center_freq2;
2431         int ret;
2432         struct {
2433                 u8 direction;
2434                 u8 runtime_calibration;
2435                 u8 _rsv[2];
2436
2437                 __le16 center_freq;
2438                 u8 bw;
2439                 u8 band;
2440                 u8 is_freq2;
2441                 u8 success;
2442                 u8 dbdc_en;
2443
2444                 u8 _rsv2;
2445
2446                 struct {
2447                         struct {
2448                                 u32 dpd_g0;
2449                                 u8 data[32];
2450                         } wf0, wf1;
2451
2452                         struct {
2453                                 u32 dpd_g0_prim;
2454                                 u32 dpd_g0_sec;
2455                                 u8 data_prim[32];
2456                                 u8 data_sec[32];
2457                         } wf2, wf3;
2458                 } dpd_data;
2459         } req = {
2460                 .direction = 1,
2461
2462                 .bw = mt7615_mcu_chan_bw(chandef),
2463                 .band = chandef->center_freq1 > 4000,
2464                 .dbdc_en = !!dev->mt76.phy2,
2465         };
2466         u16 center_freq = chandef->center_freq1;
2467         int freq_idx;
2468         u8 *eep = dev->mt76.eeprom.data;
2469
2470         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2471                 return 0;
2472
2473         if (chandef->width == NL80211_CHAN_WIDTH_160) {
2474                 freq2 = center_freq + 40;
2475                 center_freq -= 40;
2476         }
2477
2478 again:
2479         req.runtime_calibration = 1;
2480         freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2481         if (freq_idx < 0)
2482                 goto out;
2483
2484         memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2485                               freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2486                sizeof(req.dpd_data));
2487         req.runtime_calibration = 0;
2488
2489 out:
2490         req.center_freq = cpu_to_le16(center_freq);
2491         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
2492                                 sizeof(req), true);
2493
2494         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2495              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2496                 req.is_freq2 = true;
2497                 center_freq = freq2;
2498                 goto again;
2499         }
2500
2501         return ret;
2502 }
2503
2504 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2505                           bool enable)
2506 {
2507         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2508         struct {
2509                 u8 bss_idx;
2510                 u8 dtim_period;
2511                 __le16 aid;
2512                 __le16 bcn_interval;
2513                 __le16 atim_window;
2514                 u8 uapsd;
2515                 u8 bmc_delivered_ac;
2516                 u8 bmc_triggered_ac;
2517                 u8 pad;
2518         } req = {
2519                 .bss_idx = mvif->mt76.idx,
2520                 .aid = cpu_to_le16(vif->bss_conf.aid),
2521                 .dtim_period = vif->bss_conf.dtim_period,
2522                 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2523         };
2524         struct {
2525                 u8 bss_idx;
2526                 u8 pad[3];
2527         } req_hdr = {
2528                 .bss_idx = mvif->mt76.idx,
2529         };
2530         int err;
2531
2532         if (vif->type != NL80211_IFTYPE_STATION)
2533                 return 0;
2534
2535         err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
2536                                 sizeof(req_hdr), false);
2537         if (err < 0 || !enable)
2538                 return err;
2539
2540         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
2541                                  sizeof(req), false);
2542 }
2543
2544 #ifdef CONFIG_PM
2545 int mt7615_mcu_set_hif_suspend(struct mt7615_dev *dev, bool suspend)
2546 {
2547         struct {
2548                 struct {
2549                         u8 hif_type; /* 0x0: HIF_SDIO
2550                                       * 0x1: HIF_USB
2551                                       * 0x2: HIF_PCIE
2552                                       */
2553                         u8 pad[3];
2554                 } __packed hdr;
2555                 struct hif_suspend_tlv {
2556                         __le16 tag;
2557                         __le16 len;
2558                         u8 suspend;
2559                 } __packed hif_suspend;
2560         } req = {
2561                 .hif_suspend = {
2562                         .tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
2563                         .len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
2564                         .suspend = suspend,
2565                 },
2566         };
2567
2568         if (mt76_is_mmio(&dev->mt76))
2569                 req.hdr.hif_type = 2;
2570         else if (mt76_is_usb(&dev->mt76))
2571                 req.hdr.hif_type = 1;
2572         else if (mt76_is_sdio(&dev->mt76))
2573                 req.hdr.hif_type = 0;
2574
2575         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_HIF_CTRL, &req,
2576                                  sizeof(req), true);
2577 }
2578 EXPORT_SYMBOL_GPL(mt7615_mcu_set_hif_suspend);
2579
2580 static int
2581 mt7615_mcu_set_wow_ctrl(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2582                         bool suspend, struct cfg80211_wowlan *wowlan)
2583 {
2584         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2585         struct mt7615_dev *dev = phy->dev;
2586         struct {
2587                 struct {
2588                         u8 bss_idx;
2589                         u8 pad[3];
2590                 } __packed hdr;
2591                 struct mt7615_wow_ctrl_tlv wow_ctrl_tlv;
2592                 struct mt7615_wow_gpio_param_tlv gpio_tlv;
2593         } req = {
2594                 .hdr = {
2595                         .bss_idx = mvif->mt76.idx,
2596                 },
2597                 .wow_ctrl_tlv = {
2598                         .tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
2599                         .len = cpu_to_le16(sizeof(struct mt7615_wow_ctrl_tlv)),
2600                         .cmd = suspend ? 1 : 2,
2601                 },
2602                 .gpio_tlv = {
2603                         .tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
2604                         .len = cpu_to_le16(sizeof(struct mt7615_wow_gpio_param_tlv)),
2605                         .gpio_pin = 0xff, /* follow fw about GPIO pin */
2606                 },
2607         };
2608
2609         if (wowlan->magic_pkt)
2610                 req.wow_ctrl_tlv.trigger |= BIT(0);
2611         if (wowlan->disconnect)
2612                 req.wow_ctrl_tlv.trigger |= BIT(2);
2613         if (wowlan->nd_config) {
2614                 mt76_connac_mcu_sched_scan_req(phy->mt76, vif,
2615                                                wowlan->nd_config);
2616                 req.wow_ctrl_tlv.trigger |= BIT(5);
2617                 mt76_connac_mcu_sched_scan_enable(phy->mt76, vif, suspend);
2618         }
2619
2620         if (mt76_is_mmio(&dev->mt76))
2621                 req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
2622         else if (mt76_is_usb(&dev->mt76))
2623                 req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
2624         else if (mt76_is_sdio(&dev->mt76))
2625                 req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
2626
2627         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
2628                                  sizeof(req), true);
2629 }
2630
2631 static int
2632 mt7615_mcu_set_wow_pattern(struct mt7615_dev *dev,
2633                            struct ieee80211_vif *vif,
2634                            u8 index, bool enable,
2635                            struct cfg80211_pkt_pattern *pattern)
2636 {
2637         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2638         struct mt7615_wow_pattern_tlv *ptlv;
2639         struct sk_buff *skb;
2640         struct req_hdr {
2641                 u8 bss_idx;
2642                 u8 pad[3];
2643         } __packed hdr = {
2644                 .bss_idx = mvif->mt76.idx,
2645         };
2646
2647         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2648                                  sizeof(hdr) + sizeof(*ptlv));
2649         if (!skb)
2650                 return -ENOMEM;
2651
2652         skb_put_data(skb, &hdr, sizeof(hdr));
2653         ptlv = (struct mt7615_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
2654         ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
2655         ptlv->len = cpu_to_le16(sizeof(*ptlv));
2656         ptlv->data_len = pattern->pattern_len;
2657         ptlv->enable = enable;
2658         ptlv->index = index;
2659
2660         memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
2661         memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8);
2662
2663         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_SUSPEND,
2664                                      true);
2665 }
2666
2667 static int
2668 mt7615_mcu_set_suspend_mode(struct mt7615_dev *dev,
2669                             struct ieee80211_vif *vif,
2670                             bool enable, u8 mdtim, bool wow_suspend)
2671 {
2672         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2673         struct {
2674                 struct {
2675                         u8 bss_idx;
2676                         u8 pad[3];
2677                 } __packed hdr;
2678                 struct mt7615_suspend_tlv suspend_tlv;
2679         } req = {
2680                 .hdr = {
2681                         .bss_idx = mvif->mt76.idx,
2682                 },
2683                 .suspend_tlv = {
2684                         .tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
2685                         .len = cpu_to_le16(sizeof(struct mt7615_suspend_tlv)),
2686                         .enable = enable,
2687                         .mdtim = mdtim,
2688                         .wow_suspend = wow_suspend,
2689                 },
2690         };
2691
2692         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
2693                                  sizeof(req), true);
2694 }
2695
2696 static int
2697 mt7615_mcu_set_gtk_rekey(struct mt7615_dev *dev,
2698                          struct ieee80211_vif *vif,
2699                          bool suspend)
2700 {
2701         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2702         struct {
2703                 struct {
2704                         u8 bss_idx;
2705                         u8 pad[3];
2706                 } __packed hdr;
2707                 struct mt7615_gtk_rekey_tlv gtk_tlv;
2708         } __packed req = {
2709                 .hdr = {
2710                         .bss_idx = mvif->mt76.idx,
2711                 },
2712                 .gtk_tlv = {
2713                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
2714                         .len = cpu_to_le16(sizeof(struct mt7615_gtk_rekey_tlv)),
2715                         .rekey_mode = !suspend,
2716                 },
2717         };
2718
2719         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
2720                                  sizeof(req), true);
2721 }
2722
2723 static int
2724 mt7615_mcu_set_arp_filter(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2725                           bool suspend)
2726 {
2727         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2728         struct {
2729                 struct {
2730                         u8 bss_idx;
2731                         u8 pad[3];
2732                 } __packed hdr;
2733                 struct mt7615_arpns_tlv arpns;
2734         } req = {
2735                 .hdr = {
2736                         .bss_idx = mvif->mt76.idx,
2737                 },
2738                 .arpns = {
2739                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
2740                         .len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
2741                         .mode = suspend,
2742                 },
2743         };
2744
2745         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
2746                                  sizeof(req), true);
2747 }
2748
2749 void mt7615_mcu_set_suspend_iter(void *priv, u8 *mac,
2750                                  struct ieee80211_vif *vif)
2751 {
2752         struct mt7615_phy *phy = priv;
2753         bool suspend = test_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
2754         struct ieee80211_hw *hw = phy->mt76->hw;
2755         struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
2756         int i;
2757
2758         mt7615_mcu_set_gtk_rekey(phy->dev, vif, suspend);
2759         mt7615_mcu_set_arp_filter(phy->dev, vif, suspend);
2760
2761         mt7615_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
2762
2763         for (i = 0; i < wowlan->n_patterns; i++)
2764                 mt7615_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
2765                                            &wowlan->patterns[i]);
2766         mt7615_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
2767 }
2768
2769 static void
2770 mt7615_mcu_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2771                     struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
2772                     void *data)
2773 {
2774         struct mt7615_gtk_rekey_tlv *gtk_tlv = data;
2775         u32 cipher;
2776
2777         if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
2778             key->cipher != WLAN_CIPHER_SUITE_CCMP &&
2779             key->cipher != WLAN_CIPHER_SUITE_TKIP)
2780                 return;
2781
2782         if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
2783                 gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
2784                 cipher = BIT(3);
2785         } else {
2786                 gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
2787                 cipher = BIT(4);
2788         }
2789
2790         /* we are assuming here to have a single pairwise key */
2791         if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
2792                 gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
2793                 gtk_tlv->group_cipher = cpu_to_le32(cipher);
2794                 gtk_tlv->keyid = key->keyidx;
2795         }
2796 }
2797
2798 int mt7615_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
2799                                 struct ieee80211_vif *vif,
2800                                 struct cfg80211_gtk_rekey_data *key)
2801 {
2802         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2803         struct mt7615_dev *dev = mt7615_hw_dev(hw);
2804         struct mt7615_gtk_rekey_tlv *gtk_tlv;
2805         struct sk_buff *skb;
2806         struct {
2807                 u8 bss_idx;
2808                 u8 pad[3];
2809         } __packed hdr = {
2810                 .bss_idx = mvif->mt76.idx,
2811         };
2812
2813         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2814                                  sizeof(hdr) + sizeof(*gtk_tlv));
2815         if (!skb)
2816                 return -ENOMEM;
2817
2818         skb_put_data(skb, &hdr, sizeof(hdr));
2819         gtk_tlv = (struct mt7615_gtk_rekey_tlv *)skb_put(skb,
2820                                                          sizeof(*gtk_tlv));
2821         gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
2822         gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
2823         gtk_tlv->rekey_mode = 2;
2824         gtk_tlv->option = 1;
2825
2826         rcu_read_lock();
2827         ieee80211_iter_keys_rcu(hw, vif, mt7615_mcu_key_iter, gtk_tlv);
2828         rcu_read_unlock();
2829
2830         memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
2831         memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
2832         memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
2833
2834         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
2835                                      true);
2836 }
2837 #endif /* CONFIG_PM */
2838
2839 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2840                        struct ieee80211_channel *chan, int duration)
2841 {
2842         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2843         struct mt7615_dev *dev = phy->dev;
2844         struct mt7615_roc_tlv req = {
2845                 .bss_idx = mvif->mt76.idx,
2846                 .active = !chan,
2847                 .max_interval = cpu_to_le32(duration),
2848                 .primary_chan = chan ? chan->hw_value : 0,
2849                 .band = chan ? chan->band : 0,
2850                 .req_type = 2,
2851         };
2852
2853         phy->roc_grant = false;
2854
2855         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
2856                                  sizeof(req), false);
2857 }
2858
2859 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
2860                                  struct ieee80211_vif *vif,
2861                                  struct ieee80211_bss_conf *info)
2862 {
2863         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2864         struct mt7615_dev *dev = mt7615_hw_dev(hw);
2865         struct sk_buff *skb;
2866         int i, len = min_t(int, info->arp_addr_cnt,
2867                            IEEE80211_BSS_ARP_ADDR_LIST_LEN);
2868         struct {
2869                 struct {
2870                         u8 bss_idx;
2871                         u8 pad[3];
2872                 } __packed hdr;
2873                 struct mt7615_arpns_tlv arp;
2874         } req_hdr = {
2875                 .hdr = {
2876                         .bss_idx = mvif->mt76.idx,
2877                 },
2878                 .arp = {
2879                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
2880                         .len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
2881                         .ips_num = len,
2882                         .mode = 2,  /* update */
2883                         .option = 1,
2884                 },
2885         };
2886
2887         if (!mt7615_firmware_offload(dev))
2888                 return 0;
2889
2890         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2891                                  sizeof(req_hdr) + len * sizeof(__be32));
2892         if (!skb)
2893                 return -ENOMEM;
2894
2895         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2896         for (i = 0; i < len; i++) {
2897                 u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
2898
2899                 memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
2900         }
2901
2902         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
2903                                      true);
2904 }
2905
2906 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
2907                              struct ieee80211_vif *vif)
2908 {
2909         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2910         int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
2911         struct mt7615_dev *dev = mt7615_hw_dev(hw);
2912         struct {
2913                 __le32 ct_win;
2914                 u8 bss_idx;
2915                 u8 rsv[3];
2916         } __packed req = {
2917                 .ct_win = cpu_to_le32(ct_window),
2918                 .bss_idx = mvif->mt76.idx,
2919         };
2920
2921         if (!mt7615_firmware_offload(dev))
2922                 return -ENOTSUPP;
2923
2924         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
2925                                  sizeof(req), false);
2926 }
2927
2928 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
2929 {
2930         struct {
2931                 __le32 addr;
2932                 __le32 val;
2933         } __packed req = {
2934                 .addr = cpu_to_le32(offset),
2935         };
2936
2937         return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
2938                                  true);
2939 }
2940 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
2941
2942 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
2943 {
2944         struct {
2945                 __le32 addr;
2946                 __le32 val;
2947         } __packed req = {
2948                 .addr = cpu_to_le32(offset),
2949                 .val = cpu_to_le32(val),
2950         };
2951
2952         mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
2953 }
2954 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);