drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 static bool prefer_offload_fw = true;
  15 module_param(prefer_offload_fw, bool, 0644);
  16 MODULE_PARM_DESC(prefer_offload_fw,
  17                  "Prefer client mode offload firmware (MT7663)");
  18
  19 struct mt7615_patch_hdr {
  20         char build_date[16];
  21         char platform[4];
  22         __be32 hw_sw_ver;
  23         __be32 patch_ver;
  24         __be16 checksum;
  25 } __packed;
  26
  27 struct mt7615_fw_trailer {
  28         __le32 addr;
  29         u8 chip_id;
  30         u8 feature_set;
  31         u8 eco_code;
  32         char fw_ver[10];
  33         char build_date[15];
  34         __le32 len;
  35 } __packed;
  36
  37 #define FW_V3_COMMON_TAILER_SIZE        36
  38 #define FW_V3_REGION_TAILER_SIZE        40
  39 #define FW_START_OVERRIDE               BIT(0)
  40 #define FW_START_DLYCAL                 BIT(1)
  41 #define FW_START_WORKING_PDA_CR4        BIT(2)
  42
  43 struct mt7663_fw_trailer {
  44         u8 chip_id;
  45         u8 eco_code;
  46         u8 n_region;
  47         u8 format_ver;
  48         u8 format_flag;
  49         u8 reserv[2];
  50         char fw_ver[10];
  51         char build_date[15];
  52         __le32 crc;
  53 } __packed;
  54
  55 struct mt7663_fw_buf {
  56         __le32 crc;
  57         __le32 d_img_size;
  58         __le32 block_size;
  59         u8 rsv[4];
  60         __le32 img_dest_addr;
  61         __le32 img_size;
  62         u8 feature_set;
  63 };
  64
  65 #define MT7615_PATCH_ADDRESS            0x80000
  66 #define MT7622_PATCH_ADDRESS            0x9c000
  67 #define MT7663_PATCH_ADDRESS            0xdc000
  68
  69 #define N9_REGION_NUM                   2
  70 #define CR4_REGION_NUM                  1
  71
  72 #define IMG_CRC_LEN                     4
  73
  74 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  75 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  76
  77 #define DL_MODE_ENCRYPT                 BIT(0)
  78 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  79 #define DL_MODE_RESET_SEC_IV            BIT(3)
  80 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
  82 #define DL_MODE_NEED_RSP                BIT(31)
  83
  84 #define FW_START_OVERRIDE               BIT(0)
  85 #define FW_START_WORKING_PDA_CR4        BIT(2)
  86
  87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
  88                          int cmd, int *wait_seq)
  89 {
  90         int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
  91         struct mt7615_uni_txd *uni_txd;
  92         struct mt7615_mcu_txd *mcu_txd;
  93         u8 seq, q_idx, pkt_fmt;
  94         __le32 *txd;
  95         u32 val;
  96
  97         /* TODO: make dynamic based on msg type */
  98         dev->mt76.mcu.timeout = 20 * HZ;
  99
 100         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 101         if (!seq)
 102                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 103         if (wait_seq)
 104                 *wait_seq = seq;
 105
 106         txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 107         txd = (__le32 *)skb_push(skb, txd_len);
 108
 109         if (cmd != MCU_CMD_FW_SCATTER) {
 110                 q_idx = MT_TX_MCU_PORT_RX_Q0;
 111                 pkt_fmt = MT_TX_TYPE_CMD;
 112         } else {
 113                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
 114                 pkt_fmt = MT_TX_TYPE_FW;
 115         }
 116
 117         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 118               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
 119               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
 120         txd[0] = cpu_to_le32(val);
 121
 122         val = MT_TXD1_LONG_FORMAT |
 123               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
 124               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
 125         txd[1] = cpu_to_le32(val);
 126
 127         if (cmd & MCU_UNI_PREFIX) {
 128                 uni_txd = (struct mt7615_uni_txd *)txd;
 129                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 130                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 131                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 132                 uni_txd->s2d_index = MCU_S2D_H2N;
 133                 uni_txd->pkt_type = MCU_PKT_ID;
 134                 uni_txd->seq = seq;
 135
 136                 return;
 137         }
 138
 139         mcu_txd = (struct mt7615_mcu_txd *)txd;
 140         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 141         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
 142         mcu_txd->s2d_index = MCU_S2D_H2N;
 143         mcu_txd->pkt_type = MCU_PKT_ID;
 144         mcu_txd->seq = seq;
 145
 146         switch (cmd & ~MCU_CMD_MASK) {
 147         case MCU_FW_PREFIX:
 148                 mcu_txd->set_query = MCU_Q_NA;
 149                 mcu_txd->cid = mcu_cmd;
 150                 break;
 151         case MCU_CE_PREFIX:
 152                 if (cmd & MCU_QUERY_MASK)
 153                         mcu_txd->set_query = MCU_Q_QUERY;
 154                 else
 155                         mcu_txd->set_query = MCU_Q_SET;
 156                 mcu_txd->cid = mcu_cmd;
 157                 break;
 158         default:
 159                 mcu_txd->cid = MCU_CMD_EXT_CID;
 160                 if (cmd & MCU_QUERY_PREFIX)
 161                         mcu_txd->set_query = MCU_Q_QUERY;
 162                 else
 163                         mcu_txd->set_query = MCU_Q_SET;
 164                 mcu_txd->ext_cid = mcu_cmd;
 165                 mcu_txd->ext_cid_ack = 1;
 166                 break;
 167         }
 168 }
 169 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
 170
 171 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 172                               struct sk_buff *skb, int seq)
 173 {
 174         struct mt7615_mcu_rxd *rxd;
 175         int ret = 0;
 176
 177         if (!skb) {
 178                 dev_err(mdev->dev, "Message %ld (seq %d) timeout\n",
 179                         cmd & MCU_CMD_MASK, seq);
 180                 return -ETIMEDOUT;
 181         }
 182
 183         rxd = (struct mt7615_mcu_rxd *)skb->data;
 184         if (seq != rxd->seq)
 185                 return -EAGAIN;
 186
 187         switch (cmd) {
 188         case MCU_CMD_PATCH_SEM_CONTROL:
 189                 skb_pull(skb, sizeof(*rxd) - 4);
 190                 ret = *skb->data;
 191                 break;
 192         case MCU_EXT_CMD_GET_TEMP:
 193                 skb_pull(skb, sizeof(*rxd));
 194                 ret = le32_to_cpu(*(__le32 *)skb->data);
 195                 break;
 196         case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
 197                 skb_pull(skb, sizeof(*rxd));
 198                 ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
 199                 break;
 200         case MCU_UNI_CMD_DEV_INFO_UPDATE:
 201         case MCU_UNI_CMD_BSS_INFO_UPDATE:
 202         case MCU_UNI_CMD_STA_REC_UPDATE:
 203         case MCU_UNI_CMD_HIF_CTRL:
 204         case MCU_UNI_CMD_OFFLOAD:
 205         case MCU_UNI_CMD_SUSPEND: {
 206                 struct mt7615_mcu_uni_event *event;
 207
 208                 skb_pull(skb, sizeof(*rxd));
 209                 event = (struct mt7615_mcu_uni_event *)skb->data;
 210                 ret = le32_to_cpu(event->status);
 211                 break;
 212         }
 213         case MCU_CMD_REG_READ: {
 214                 struct mt7615_mcu_reg_event *event;
 215
 216                 skb_pull(skb, sizeof(*rxd));
 217                 event = (struct mt7615_mcu_reg_event *)skb->data;
 218                 ret = (int)le32_to_cpu(event->val);
 219                 break;
 220         }
 221         default:
 222                 break;
 223         }
 224
 225         return ret;
 226 }
 227 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
 228
 229 static int
 230 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 231                         int cmd, int *seq)
 232 {
 233         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 234         enum mt76_txq_id qid;
 235
 236         mt7615_mcu_fill_msg(dev, skb, cmd, seq);
 237         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 238                 qid = MT_MCUQ_WM;
 239         else
 240                 qid = MT_MCUQ_FWDL;
 241
 242         return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
 243 }
 244
 245 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
 246 {
 247         struct {
 248                 __le32 wifi_stream;
 249                 __le32 address;
 250                 __le32 data;
 251         } req = {
 252                 .wifi_stream = cpu_to_le32(wf),
 253                 .address = cpu_to_le32(reg),
 254         };
 255
 256         return mt76_mcu_send_msg(&dev->mt76,
 257                                  MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
 258                                  &req, sizeof(req), true);
 259 }
 260
 261 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
 262 {
 263         struct {
 264                 __le32 wifi_stream;
 265                 __le32 address;
 266                 __le32 data;
 267         } req = {
 268                 .wifi_stream = cpu_to_le32(wf),
 269                 .address = cpu_to_le32(reg),
 270                 .data = cpu_to_le32(val),
 271         };
 272
 273         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
 274                                  sizeof(req), false);
 275 }
 276
 277 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
 278 {
 279         if (!is_mt7622(&dev->mt76))
 280                 return;
 281
 282         regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
 283                            MT_INFRACFG_MISC_AP2CONN_WAKE,
 284                            !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
 285 }
 286
 287 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
 288 {
 289         struct mt76_phy *mphy = &dev->mt76.phy;
 290         struct mt76_dev *mdev = &dev->mt76;
 291         u32 addr;
 292         int err;
 293
 294         addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
 295         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
 296
 297         mt7622_trigger_hif_int(dev, true);
 298
 299         addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 300         err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 301
 302         mt7622_trigger_hif_int(dev, false);
 303
 304         if (err) {
 305                 dev_err(mdev->dev, "driver own failed\n");
 306                 return -ETIMEDOUT;
 307         }
 308
 309         clear_bit(MT76_STATE_PM, &mphy->state);
 310
 311         return 0;
 312 }
 313
 314 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
 315 {
 316         struct mt76_phy *mphy = &dev->mt76.phy;
 317         int i;
 318
 319         if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
 320                 goto out;
 321
 322         for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
 323                 mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 324                 if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
 325                                    MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
 326                         break;
 327         }
 328
 329         if (i == MT7615_DRV_OWN_RETRY_COUNT) {
 330                 dev_err(dev->mt76.dev, "driver own failed\n");
 331                 set_bit(MT76_STATE_PM, &mphy->state);
 332                 return -EIO;
 333         }
 334
 335 out:
 336         dev->pm.last_activity = jiffies;
 337
 338         return 0;
 339 }
 340
 341 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
 342 {
 343         struct mt76_phy *mphy = &dev->mt76.phy;
 344         int err = 0;
 345         u32 addr;
 346
 347         if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
 348                 return 0;
 349
 350         mt7622_trigger_hif_int(dev, true);
 351
 352         addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 353         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
 354
 355         if (is_mt7622(&dev->mt76) &&
 356             !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
 357                             MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
 358                 dev_err(dev->mt76.dev, "Timeout for firmware own\n");
 359                 clear_bit(MT76_STATE_PM, &mphy->state);
 360                 err = -EIO;
 361         }
 362
 363         mt7622_trigger_hif_int(dev, false);
 364
 365         return err;
 366 }
 367
 368 static void
 369 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 370 {
 371         if (vif->csa_active)
 372                 ieee80211_csa_finish(vif);
 373 }
 374
 375 static void
 376 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 377 {
 378         struct mt76_phy *mphy = &dev->mt76.phy;
 379         struct mt7615_mcu_rdd_report *r;
 380
 381         r = (struct mt7615_mcu_rdd_report *)skb->data;
 382
 383         if (r->idx && dev->mt76.phy2)
 384                 mphy = dev->mt76.phy2;
 385
 386         ieee80211_radar_detected(mphy->hw);
 387         dev->hw_pattern++;
 388 }
 389
 390 static void
 391 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
 392 {
 393         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 394         const char *data = (char *)&rxd[1];
 395         const char *type;
 396
 397         switch (rxd->s2d_index) {
 398         case 0:
 399                 type = "N9";
 400                 break;
 401         case 2:
 402                 type = "CR4";
 403                 break;
 404         default:
 405                 type = "unknown";
 406                 break;
 407         }
 408
 409         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 410 }
 411
 412 static void
 413 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 414 {
 415         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 416
 417         switch (rxd->ext_eid) {
 418         case MCU_EXT_EVENT_RDD_REPORT:
 419                 mt7615_mcu_rx_radar_detected(dev, skb);
 420                 break;
 421         case MCU_EXT_EVENT_CSA_NOTIFY:
 422                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 423                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 424                                 mt7615_mcu_csa_finish, dev);
 425                 break;
 426         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 427                 mt7615_mcu_rx_log_message(dev, skb);
 428                 break;
 429         default:
 430                 break;
 431         }
 432 }
 433
 434 static void
 435 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
 436 {
 437         u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
 438         struct mt7615_phy *phy;
 439         struct mt76_phy *mphy;
 440
 441         if (*seq_num & BIT(7) && dev->mt76.phy2)
 442                 mphy = dev->mt76.phy2;
 443         else
 444                 mphy = &dev->mt76.phy;
 445
 446         phy = (struct mt7615_phy *)mphy->priv;
 447
 448         spin_lock_bh(&dev->mt76.lock);
 449         __skb_queue_tail(&phy->scan_event_list, skb);
 450         spin_unlock_bh(&dev->mt76.lock);
 451
 452         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 453                                      MT7615_HW_SCAN_TIMEOUT);
 454 }
 455
 456 static void
 457 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
 458 {
 459         struct mt7615_roc_tlv *event;
 460         struct mt7615_phy *phy;
 461         struct mt76_phy *mphy;
 462         int duration;
 463
 464         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 465         event = (struct mt7615_roc_tlv *)skb->data;
 466
 467         if (event->dbdc_band && dev->mt76.phy2)
 468                 mphy = dev->mt76.phy2;
 469         else
 470                 mphy = &dev->mt76.phy;
 471
 472         ieee80211_ready_on_channel(mphy->hw);
 473
 474         phy = (struct mt7615_phy *)mphy->priv;
 475         phy->roc_grant = true;
 476         wake_up(&phy->roc_wait);
 477
 478         duration = le32_to_cpu(event->max_interval);
 479         mod_timer(&phy->roc_timer,
 480                   round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
 481 }
 482
 483 static void
 484 mt7615_mcu_beacon_loss_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
 485 {
 486         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 487         struct mt7615_beacon_loss_event *event = priv;
 488
 489         if (mvif->idx != event->bss_idx)
 490                 return;
 491
 492         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
 493                 return;
 494
 495         ieee80211_beacon_loss(vif);
 496 }
 497
 498 static void
 499 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 500 {
 501         struct mt7615_beacon_loss_event *event;
 502         struct mt76_phy *mphy;
 503         u8 band_idx = 0; /* DBDC support */
 504
 505         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 506         event = (struct mt7615_beacon_loss_event *)skb->data;
 507         if (band_idx && dev->mt76.phy2)
 508                 mphy = dev->mt76.phy2;
 509         else
 510                 mphy = &dev->mt76.phy;
 511
 512         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 513                                         IEEE80211_IFACE_ITER_RESUME_ALL,
 514                                         mt7615_mcu_beacon_loss_iter, event);
 515 }
 516
 517 static void
 518 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 519 {
 520         struct mt7615_mcu_bss_event *event;
 521         struct mt76_phy *mphy;
 522         u8 band_idx = 0; /* DBDC support */
 523
 524         event = (struct mt7615_mcu_bss_event *)(skb->data +
 525                                                 sizeof(struct mt7615_mcu_rxd));
 526
 527         if (band_idx && dev->mt76.phy2)
 528                 mphy = dev->mt76.phy2;
 529         else
 530                 mphy = &dev->mt76.phy;
 531
 532         if (event->is_absent)
 533                 ieee80211_stop_queues(mphy->hw);
 534         else
 535                 ieee80211_wake_queues(mphy->hw);
 536 }
 537
 538 static void
 539 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 540 {
 541         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 542
 543         switch (rxd->eid) {
 544         case MCU_EVENT_EXT:
 545                 mt7615_mcu_rx_ext_event(dev, skb);
 546                 break;
 547         case MCU_EVENT_BSS_BEACON_LOSS:
 548                 mt7615_mcu_beacon_loss_event(dev, skb);
 549                 break;
 550         case MCU_EVENT_ROC:
 551                 mt7615_mcu_roc_event(dev, skb);
 552                 break;
 553         case MCU_EVENT_SCHED_SCAN_DONE:
 554         case MCU_EVENT_SCAN_DONE:
 555                 mt7615_mcu_scan_event(dev, skb);
 556                 return;
 557         case MCU_EVENT_BSS_ABSENCE:
 558                 mt7615_mcu_bss_event(dev, skb);
 559                 break;
 560         default:
 561                 break;
 562         }
 563         dev_kfree_skb(skb);
 564 }
 565
 566 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 567 {
 568         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 569
 570         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 571             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 572             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 573             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 574             rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 575             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 576             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 577             rxd->eid == MCU_EVENT_SCAN_DONE ||
 578             rxd->eid == MCU_EVENT_ROC ||
 579             !rxd->seq)
 580                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 581         else
 582                 mt76_mcu_rx_event(&dev->mt76, skb);
 583 }
 584
 585 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
 586                                     u32 len, u32 mode)
 587 {
 588         struct {
 589                 __le32 addr;
 590                 __le32 len;
 591                 __le32 mode;
 592         } req = {
 593                 .addr = cpu_to_le32(addr),
 594                 .len = cpu_to_le32(len),
 595                 .mode = cpu_to_le32(mode),
 596         };
 597
 598         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TARGET_ADDRESS_LEN_REQ,
 599                                  &req, sizeof(req), true);
 600 }
 601
 602 static int
 603 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 604                        bool bssid, bool enable)
 605 {
 606         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 607         u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
 608         u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
 609         const u8 *addr = vif->addr;
 610         struct {
 611                 u8 mode;
 612                 u8 force_clear;
 613                 u8 clear_bitmap[8];
 614                 u8 entry_count;
 615                 u8 write;
 616
 617                 u8 index;
 618                 u8 bssid;
 619                 u8 addr[ETH_ALEN];
 620         } __packed req = {
 621                 .mode = !!mask || enable,
 622                 .entry_count = 1,
 623                 .write = 1,
 624
 625                 .index = idx * 2 + bssid,
 626         };
 627
 628         if (bssid)
 629                 addr = vif->bss_conf.bssid;
 630
 631         if (enable)
 632                 ether_addr_copy(req.addr, addr);
 633
 634         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
 635                                  sizeof(req), true);
 636 }
 637
 638 static int
 639 mt7615_mcu_add_dev(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 640                    bool enable)
 641 {
 642         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 643         struct {
 644                 struct req_hdr {
 645                         u8 omac_idx;
 646                         u8 band_idx;
 647                         __le16 tlv_num;
 648                         u8 is_tlv_append;
 649                         u8 rsv[3];
 650                 } __packed hdr;
 651                 struct req_tlv {
 652                         __le16 tag;
 653                         __le16 len;
 654                         u8 active;
 655                         u8 band_idx;
 656                         u8 omac_addr[ETH_ALEN];
 657                 } __packed tlv;
 658         } data = {
 659                 .hdr = {
 660                         .omac_idx = mvif->omac_idx,
 661                         .band_idx = mvif->band_idx,
 662                         .tlv_num = cpu_to_le16(1),
 663                         .is_tlv_append = 1,
 664                 },
 665                 .tlv = {
 666                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 667                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 668                         .active = enable,
 669                         .band_idx = mvif->band_idx,
 670                 },
 671         };
 672
 673         if (mvif->omac_idx >= REPEATER_BSSID_START)
 674                 return mt7615_mcu_muar_config(dev, vif, false, enable);
 675
 676         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 677         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 678                                  &data, sizeof(data), true);
 679 }
 680
 681 static int
 682 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
 683                               struct ieee80211_hw *hw,
 684                               struct ieee80211_vif *vif, bool enable)
 685 {
 686         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 687         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
 688         struct ieee80211_mutable_offsets offs;
 689         struct ieee80211_tx_info *info;
 690         struct req {
 691                 u8 omac_idx;
 692                 u8 enable;
 693                 u8 wlan_idx;
 694                 u8 band_idx;
 695                 u8 pkt_type;
 696                 u8 need_pre_tbtt_int;
 697                 __le16 csa_ie_pos;
 698                 __le16 pkt_len;
 699                 __le16 tim_ie_pos;
 700                 u8 pkt[512];
 701                 u8 csa_cnt;
 702                 /* bss color change */
 703                 u8 bcc_cnt;
 704                 __le16 bcc_ie_pos;
 705         } __packed req = {
 706                 .omac_idx = mvif->omac_idx,
 707                 .enable = enable,
 708                 .wlan_idx = wcid->idx,
 709                 .band_idx = mvif->band_idx,
 710         };
 711         struct sk_buff *skb;
 712
 713         skb = ieee80211_beacon_get_template(hw, vif, &offs);
 714         if (!skb)
 715                 return -EINVAL;
 716
 717         if (skb->len > 512 - MT_TXD_SIZE) {
 718                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
 719                 dev_kfree_skb(skb);
 720                 return -EINVAL;
 721         }
 722
 723         if (mvif->band_idx) {
 724                 info = IEEE80211_SKB_CB(skb);
 725                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
 726         }
 727
 728         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
 729                               0, NULL, true);
 730         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
 731         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 732         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
 733         if (offs.cntdwn_counter_offs[0]) {
 734                 u16 csa_offs;
 735
 736                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
 737                 req.csa_ie_pos = cpu_to_le16(csa_offs);
 738                 req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
 739         }
 740         dev_kfree_skb(skb);
 741
 742         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
 743                                  sizeof(req), true);
 744 }
 745
 746 static int
 747 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
 748 {
 749 #define ENTER_PM_STATE  1
 750 #define EXIT_PM_STATE   2
 751         struct {
 752                 u8 pm_number;
 753                 u8 pm_state;
 754                 u8 bssid[ETH_ALEN];
 755                 u8 dtim_period;
 756                 u8 wlan_idx;
 757                 __le16 bcn_interval;
 758                 __le32 aid;
 759                 __le32 rx_filter;
 760                 u8 band_idx;
 761                 u8 rsv[3];
 762                 __le32 feature;
 763                 u8 omac_idx;
 764                 u8 wmm_idx;
 765                 u8 bcn_loss_cnt;
 766                 u8 bcn_sp_duration;
 767         } __packed req = {
 768                 .pm_number = 5,
 769                 .pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
 770                 .band_idx = band,
 771         };
 772
 773         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
 774                                  sizeof(req), true);
 775 }
 776
 777 static struct sk_buff *
 778 mt7615_mcu_alloc_sta_req(struct mt7615_dev *dev, struct mt7615_vif *mvif,
 779                          struct mt7615_sta *msta)
 780 {
 781         struct sta_req_hdr hdr = {
 782                 .bss_idx = mvif->idx,
 783                 .wlan_idx = msta ? msta->wcid.idx : 0,
 784                 .muar_idx = msta ? mvif->omac_idx : 0,
 785                 .is_tlv_append = 1,
 786         };
 787         struct sk_buff *skb;
 788
 789         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7615_STA_UPDATE_MAX_SIZE);
 790         if (!skb)
 791                 return ERR_PTR(-ENOMEM);
 792
 793         skb_put_data(skb, &hdr, sizeof(hdr));
 794
 795         return skb;
 796 }
 797
 798 static struct wtbl_req_hdr *
 799 mt7615_mcu_alloc_wtbl_req(struct mt7615_dev *dev, struct mt7615_sta *msta,
 800                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 801 {
 802         struct tlv *sta_hdr = sta_wtbl;
 803         struct wtbl_req_hdr hdr = {
 804                 .wlan_idx = msta->wcid.idx,
 805                 .operation = cmd,
 806         };
 807         struct sk_buff *nskb = *skb;
 808
 809         if (!nskb) {
 810                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 811                                           MT7615_WTBL_UPDATE_BA_SIZE);
 812                 if (!nskb)
 813                         return ERR_PTR(-ENOMEM);
 814
 815                 *skb = nskb;
 816         }
 817
 818         if (sta_hdr)
 819                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 820
 821         return skb_put_data(nskb, &hdr, sizeof(hdr));
 822 }
 823
 824 static struct tlv *
 825 mt7615_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 826                           void *sta_ntlv, void *sta_wtbl)
 827 {
 828         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 829         struct tlv *sta_hdr = sta_wtbl;
 830         struct tlv *ptlv, tlv = {
 831                 .tag = cpu_to_le16(tag),
 832                 .len = cpu_to_le16(len),
 833         };
 834         u16 ntlv;
 835
 836         ptlv = skb_put(skb, len);
 837         memcpy(ptlv, &tlv, sizeof(tlv));
 838
 839         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 840         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 841
 842         if (sta_hdr) {
 843                 u16 size = le16_to_cpu(sta_hdr->len);
 844
 845                 sta_hdr->len = cpu_to_le16(size + len);
 846         }
 847
 848         return ptlv;
 849 }
 850
 851 static struct tlv *
 852 mt7615_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 853 {
 854         return mt7615_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 855 }
 856
 857 static int
 858 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 859                          struct ieee80211_sta *sta, bool enable)
 860 {
 861         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 862         u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
 863         struct bss_info_basic *bss;
 864         u8 wlan_idx = mvif->sta.wcid.idx;
 865         struct tlv *tlv;
 866
 867         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 868
 869         switch (vif->type) {
 870         case NL80211_IFTYPE_MESH_POINT:
 871         case NL80211_IFTYPE_AP:
 872                 break;
 873         case NL80211_IFTYPE_STATION:
 874                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 875                 if (enable && sta) {
 876                         struct mt7615_sta *msta;
 877
 878                         msta = (struct mt7615_sta *)sta->drv_priv;
 879                         wlan_idx = msta->wcid.idx;
 880                 }
 881                 break;
 882         case NL80211_IFTYPE_ADHOC:
 883                 type = NETWORK_IBSS;
 884                 break;
 885         default:
 886                 WARN_ON(1);
 887                 break;
 888         }
 889
 890         bss = (struct bss_info_basic *)tlv;
 891         memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 892         bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 893         bss->network_type = cpu_to_le32(type);
 894         bss->dtim_period = vif->bss_conf.dtim_period;
 895         bss->bmc_tx_wlan_idx = wlan_idx;
 896         bss->wmm_idx = mvif->wmm_idx;
 897         bss->active = enable;
 898
 899         return 0;
 900 }
 901
 902 static void
 903 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 904 {
 905         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 906         struct bss_info_omac *omac;
 907         struct tlv *tlv;
 908         u32 type = 0;
 909         u8 idx;
 910
 911         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 912
 913         switch (vif->type) {
 914         case NL80211_IFTYPE_MESH_POINT:
 915         case NL80211_IFTYPE_AP:
 916                 if (vif->p2p)
 917                         type = CONNECTION_P2P_GO;
 918                 else
 919                         type = CONNECTION_INFRA_AP;
 920                 break;
 921         case NL80211_IFTYPE_STATION:
 922                 if (vif->p2p)
 923                         type = CONNECTION_P2P_GC;
 924                 else
 925                         type = CONNECTION_INFRA_STA;
 926                 break;
 927         case NL80211_IFTYPE_ADHOC:
 928                 type = CONNECTION_IBSS_ADHOC;
 929                 break;
 930         default:
 931                 WARN_ON(1);
 932                 break;
 933         }
 934
 935         omac = (struct bss_info_omac *)tlv;
 936         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 937         omac->conn_type = cpu_to_le32(type);
 938         omac->omac_idx = mvif->omac_idx;
 939         omac->band_idx = mvif->band_idx;
 940         omac->hw_bss_idx = idx;
 941 }
 942
 943 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 944 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 945 static void
 946 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
 947 {
 948         struct bss_info_ext_bss *ext;
 949         int ext_bss_idx, tsf_offset;
 950         struct tlv *tlv;
 951
 952         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 953         if (ext_bss_idx < 0)
 954                 return;
 955
 956         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 957
 958         ext = (struct bss_info_ext_bss *)tlv;
 959         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 960         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 961 }
 962
 963 static void
 964 mt7615_mcu_sta_ba_tlv(struct sk_buff *skb,
 965                       struct ieee80211_ampdu_params *params,
 966                       bool enable, bool tx)
 967 {
 968         struct sta_rec_ba *ba;
 969         struct tlv *tlv;
 970
 971         tlv = mt7615_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
 972
 973         ba = (struct sta_rec_ba *)tlv;
 974         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
 975         ba->winsize = cpu_to_le16(params->buf_size);
 976         ba->ssn = cpu_to_le16(params->ssn);
 977         ba->ba_en = enable << params->tid;
 978         ba->amsdu = params->amsdu;
 979         ba->tid = params->tid;
 980 }
 981
 982 static void
 983 mt7615_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 984                          struct ieee80211_sta *sta, bool enable)
 985 {
 986         struct sta_rec_basic *basic;
 987         struct tlv *tlv;
 988         int conn_type;
 989
 990         tlv = mt7615_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
 991
 992         basic = (struct sta_rec_basic *)tlv;
 993         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
 994
 995         if (enable) {
 996                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
 997                 basic->conn_state = CONN_STATE_PORT_SECURE;
 998         } else {
 999                 basic->conn_state = CONN_STATE_DISCONNECT;
1000         }
1001
1002         if (!sta) {
1003                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1004                 eth_broadcast_addr(basic->peer_addr);
1005                 return;
1006         }
1007
1008         switch (vif->type) {
1009         case NL80211_IFTYPE_MESH_POINT:
1010         case NL80211_IFTYPE_AP:
1011                 if (vif->p2p)
1012                         conn_type = CONNECTION_P2P_GC;
1013                 else
1014                         conn_type = CONNECTION_INFRA_STA;
1015                 basic->conn_type = cpu_to_le32(conn_type);
1016                 basic->aid = cpu_to_le16(sta->aid);
1017                 break;
1018         case NL80211_IFTYPE_STATION:
1019                 if (vif->p2p)
1020                         conn_type = CONNECTION_P2P_GO;
1021                 else
1022                         conn_type = CONNECTION_INFRA_AP;
1023                 basic->conn_type = cpu_to_le32(conn_type);
1024                 basic->aid = cpu_to_le16(vif->bss_conf.aid);
1025                 break;
1026         case NL80211_IFTYPE_ADHOC:
1027                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1028                 basic->aid = cpu_to_le16(sta->aid);
1029                 break;
1030         default:
1031                 WARN_ON(1);
1032                 break;
1033         }
1034
1035         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1036         basic->qos = sta->wme;
1037 }
1038
1039 static void
1040 mt7615_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1041 {
1042         struct tlv *tlv;
1043
1044         if (sta->ht_cap.ht_supported) {
1045                 struct sta_rec_ht *ht;
1046
1047                 tlv = mt7615_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1048                 ht = (struct sta_rec_ht *)tlv;
1049                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1050         }
1051         if (sta->vht_cap.vht_supported) {
1052                 struct sta_rec_vht *vht;
1053
1054                 tlv = mt7615_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1055                 vht = (struct sta_rec_vht *)tlv;
1056                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1057                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1058                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1059         }
1060 }
1061
1062 static void
1063 mt7615_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,
1064                      struct ieee80211_sta *sta)
1065 {
1066         struct sta_rec_uapsd *uapsd;
1067         struct tlv *tlv;
1068
1069         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1070                 return;
1071
1072         tlv = mt7615_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1073         uapsd = (struct sta_rec_uapsd *)tlv;
1074
1075         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1076                 uapsd->dac_map |= BIT(3);
1077                 uapsd->tac_map |= BIT(3);
1078         }
1079         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1080                 uapsd->dac_map |= BIT(2);
1081                 uapsd->tac_map |= BIT(2);
1082         }
1083         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1084                 uapsd->dac_map |= BIT(1);
1085                 uapsd->tac_map |= BIT(1);
1086         }
1087         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1088                 uapsd->dac_map |= BIT(0);
1089                 uapsd->tac_map |= BIT(0);
1090         }
1091         uapsd->max_sp = sta->max_sp;
1092 }
1093
1094 static void
1095 mt7615_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1096                        struct ieee80211_ampdu_params *params,
1097                        bool enable, bool tx, void *sta_wtbl,
1098                        void *wtbl_tlv)
1099 {
1100         struct wtbl_ba *ba;
1101         struct tlv *tlv;
1102
1103         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1104                                         wtbl_tlv, sta_wtbl);
1105
1106         ba = (struct wtbl_ba *)tlv;
1107         ba->tid = params->tid;
1108
1109         if (tx) {
1110                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1111                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1112                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1113                 ba->ba_en = enable;
1114         } else {
1115                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1116                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1117                 ba->rst_ba_tid = params->tid;
1118                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1119                 ba->rst_ba_sb = 1;
1120         }
1121
1122         if (enable && tx) {
1123                 u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1124                 int i;
1125
1126                 for (i = 7; i > 0; i--) {
1127                         if (params->buf_size >= ba_range[i])
1128                                 break;
1129                 }
1130                 ba->ba_winsize_idx = i;
1131         }
1132 }
1133
1134 static void
1135 mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1136                             struct ieee80211_sta *sta, void *sta_wtbl,
1137                             void *wtbl_tlv)
1138 {
1139         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1140         struct wtbl_generic *generic;
1141         struct wtbl_rx *rx;
1142         struct wtbl_spe *spe;
1143         struct tlv *tlv;
1144
1145         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1146                                         wtbl_tlv, sta_wtbl);
1147
1148         generic = (struct wtbl_generic *)tlv;
1149
1150         if (sta) {
1151                 if (vif->type == NL80211_IFTYPE_STATION)
1152                         generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
1153                 else
1154                         generic->partial_aid = cpu_to_le16(sta->aid);
1155                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1156                 generic->muar_idx = mvif->omac_idx;
1157                 generic->qos = sta->wme;
1158         } else {
1159                 eth_broadcast_addr(generic->peer_addr);
1160                 generic->muar_idx = 0xe;
1161         }
1162
1163         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1164                                         wtbl_tlv, sta_wtbl);
1165
1166         rx = (struct wtbl_rx *)tlv;
1167         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1168         rx->rca2 = 1;
1169         rx->rv = 1;
1170
1171         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
1172                                         wtbl_tlv, sta_wtbl);
1173         spe = (struct wtbl_spe *)tlv;
1174         spe->spe_idx = 24;
1175 }
1176
1177 static void
1178 mt7615_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1179                        void *sta_wtbl, void *wtbl_tlv)
1180 {
1181         struct tlv *tlv;
1182         struct wtbl_ht *ht = NULL;
1183         u32 flags = 0;
1184
1185         if (sta->ht_cap.ht_supported) {
1186                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1187                                                 wtbl_tlv, sta_wtbl);
1188                 ht = (struct wtbl_ht *)tlv;
1189                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1190                 ht->af = sta->ht_cap.ampdu_factor;
1191                 ht->mm = sta->ht_cap.ampdu_density;
1192                 ht->ht = 1;
1193
1194                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1195                         flags |= MT_WTBL_W5_SHORT_GI_20;
1196                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1197                         flags |= MT_WTBL_W5_SHORT_GI_40;
1198         }
1199
1200         if (sta->vht_cap.vht_supported) {
1201                 struct wtbl_vht *vht;
1202                 u8 af;
1203
1204                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1205                                                 wtbl_tlv, sta_wtbl);
1206                 vht = (struct wtbl_vht *)tlv;
1207                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1208                 vht->vht = 1;
1209
1210                 af = (sta->vht_cap.cap &
1211                       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
1212                       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
1213
1214                 if (ht)
1215                     ht->af = max(ht->af, af);
1216
1217                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1218                         flags |= MT_WTBL_W5_SHORT_GI_80;
1219                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1220                         flags |= MT_WTBL_W5_SHORT_GI_160;
1221         }
1222
1223         /* wtbl smps */
1224         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1225                 struct wtbl_smps *smps;
1226
1227                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1228                                                 wtbl_tlv, sta_wtbl);
1229                 smps = (struct wtbl_smps *)tlv;
1230                 smps->smps = 1;
1231         }
1232
1233         if (sta->ht_cap.ht_supported) {
1234                 /* sgi */
1235                 u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1236                           MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1237                 struct wtbl_raw *raw;
1238
1239                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
1240                                                 sizeof(*raw), wtbl_tlv,
1241                                                 sta_wtbl);
1242                 raw = (struct wtbl_raw *)tlv;
1243                 raw->val = cpu_to_le32(flags);
1244                 raw->msk = cpu_to_le32(~msk);
1245                 raw->wtbl_idx = 1;
1246                 raw->dw = 5;
1247         }
1248 }
1249
1250 static int
1251 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1252                    struct ieee80211_sta *sta, bool enable)
1253 {
1254         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1255         struct mt7615_dev *dev = phy->dev;
1256         struct sk_buff *skb;
1257
1258         if (mvif->omac_idx >= REPEATER_BSSID_START)
1259                 mt7615_mcu_muar_config(dev, vif, true, enable);
1260
1261         skb = mt7615_mcu_alloc_sta_req(dev, mvif, NULL);
1262         if (IS_ERR(skb))
1263                 return PTR_ERR(skb);
1264
1265         if (enable)
1266                 mt7615_mcu_bss_omac_tlv(skb, vif);
1267
1268         mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
1269
1270         if (enable && mvif->omac_idx >= EXT_BSSID_START &&
1271             mvif->omac_idx < REPEATER_BSSID_START)
1272                 mt7615_mcu_bss_ext_tlv(skb, mvif);
1273
1274         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1275                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1276 }
1277
1278 static int
1279 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
1280                       struct ieee80211_ampdu_params *params,
1281                       bool enable)
1282 {
1283         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1284         struct mt7615_vif *mvif = msta->vif;
1285         struct wtbl_req_hdr *wtbl_hdr;
1286         struct sk_buff *skb = NULL;
1287         int err;
1288
1289         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1290         if (IS_ERR(wtbl_hdr))
1291                 return PTR_ERR(wtbl_hdr);
1292
1293         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, NULL, wtbl_hdr);
1294
1295         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1296                                     true);
1297         if (err < 0)
1298                 return err;
1299
1300         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1301         if (IS_ERR(skb))
1302                 return PTR_ERR(skb);
1303
1304         mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1305
1306         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1307                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1308 }
1309
1310 static int
1311 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
1312                       struct ieee80211_ampdu_params *params,
1313                       bool enable)
1314 {
1315         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1316         struct mt7615_vif *mvif = msta->vif;
1317         struct wtbl_req_hdr *wtbl_hdr;
1318         struct sk_buff *skb;
1319         int err;
1320
1321         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1322         if (IS_ERR(skb))
1323                 return PTR_ERR(skb);
1324
1325         mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1326
1327         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1328                                     MCU_EXT_CMD_STA_REC_UPDATE, true);
1329         if (err < 0 || !enable)
1330                 return err;
1331
1332         skb = NULL;
1333         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1334         if (IS_ERR(wtbl_hdr))
1335                 return PTR_ERR(wtbl_hdr);
1336
1337         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, NULL, wtbl_hdr);
1338
1339         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1340                                      true);
1341 }
1342
1343 static int
1344 mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1345                         struct ieee80211_sta *sta, bool enable)
1346 {
1347         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1348         struct sk_buff *skb, *sskb, *wskb = NULL;
1349         struct wtbl_req_hdr *wtbl_hdr;
1350         struct mt7615_sta *msta;
1351         int cmd, err;
1352
1353         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1354
1355         sskb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1356         if (IS_ERR(sskb))
1357                 return PTR_ERR(sskb);
1358
1359         mt7615_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1360         if (enable && sta) {
1361                 mt7615_mcu_sta_ht_tlv(sskb, sta);
1362                 mt7615_mcu_sta_uapsd(sskb, vif, sta);
1363         }
1364
1365         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1366                                              NULL, &wskb);
1367         if (IS_ERR(wtbl_hdr))
1368                 return PTR_ERR(wtbl_hdr);
1369
1370         if (enable) {
1371                 mt7615_mcu_wtbl_generic_tlv(wskb, vif, sta, NULL, wtbl_hdr);
1372                 if (sta)
1373                         mt7615_mcu_wtbl_ht_tlv(wskb, sta, NULL, wtbl_hdr);
1374         }
1375
1376         cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1377         skb = enable ? wskb : sskb;
1378
1379         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1380         if (err < 0) {
1381                 skb = enable ? sskb : wskb;
1382                 dev_kfree_skb(skb);
1383
1384                 return err;
1385         }
1386
1387         cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1388         skb = enable ? sskb : wskb;
1389
1390         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1391 }
1392
1393 static const struct mt7615_mcu_ops wtbl_update_ops = {
1394         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1395         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1396         .add_dev_info = mt7615_mcu_add_dev,
1397         .add_bss_info = mt7615_mcu_add_bss,
1398         .add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1399         .add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1400         .sta_add = mt7615_mcu_wtbl_sta_add,
1401         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1402         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1403 };
1404
1405 static int
1406 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1407                   struct ieee80211_ampdu_params *params,
1408                   bool enable, bool tx)
1409 {
1410         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1411         struct mt7615_vif *mvif = msta->vif;
1412         struct wtbl_req_hdr *wtbl_hdr;
1413         struct tlv *sta_wtbl;
1414         struct sk_buff *skb;
1415
1416         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1417         if (IS_ERR(skb))
1418                 return PTR_ERR(skb);
1419
1420         mt7615_mcu_sta_ba_tlv(skb, params, enable, tx);
1421
1422         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1423
1424         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1425                                              &skb);
1426         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1427
1428         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1429                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1430 }
1431
1432 static int
1433 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1434                      struct ieee80211_ampdu_params *params,
1435                      bool enable)
1436 {
1437         return mt7615_mcu_sta_ba(dev, params, enable, true);
1438 }
1439
1440 static int
1441 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1442                      struct ieee80211_ampdu_params *params,
1443                      bool enable)
1444 {
1445         return mt7615_mcu_sta_ba(dev, params, enable, false);
1446 }
1447
1448 static int
1449 mt7615_mcu_add_sta_cmd(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1450                        struct ieee80211_sta *sta, bool enable, int cmd)
1451 {
1452         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1453         struct wtbl_req_hdr *wtbl_hdr;
1454         struct mt7615_sta *msta;
1455         struct tlv *sta_wtbl;
1456         struct sk_buff *skb;
1457
1458         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1459
1460         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1461         if (IS_ERR(skb))
1462                 return PTR_ERR(skb);
1463
1464         mt7615_mcu_sta_basic_tlv(skb, vif, sta, enable);
1465         if (enable && sta) {
1466                 mt7615_mcu_sta_ht_tlv(skb, sta);
1467                 mt7615_mcu_sta_uapsd(skb, vif, sta);
1468         }
1469
1470         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1471
1472         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1473                                              sta_wtbl, &skb);
1474         if (enable) {
1475                 mt7615_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
1476                 if (sta)
1477                         mt7615_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1478         }
1479
1480         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1481 }
1482
1483 static int
1484 mt7615_mcu_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1485                    struct ieee80211_sta *sta, bool enable)
1486 {
1487         return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1488                                       MCU_EXT_CMD_STA_REC_UPDATE);
1489 }
1490
1491 static const struct mt7615_mcu_ops sta_update_ops = {
1492         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1493         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1494         .add_dev_info = mt7615_mcu_add_dev,
1495         .add_bss_info = mt7615_mcu_add_bss,
1496         .add_tx_ba = mt7615_mcu_sta_tx_ba,
1497         .add_rx_ba = mt7615_mcu_sta_rx_ba,
1498         .sta_add = mt7615_mcu_add_sta,
1499         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1500         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1501 };
1502
1503 static int
1504 mt7615_mcu_uni_add_dev(struct mt7615_dev *dev,
1505                        struct ieee80211_vif *vif, bool enable)
1506 {
1507         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1508         struct {
1509                 struct {
1510                         u8 omac_idx;
1511                         u8 band_idx;
1512                         __le16 pad;
1513                 } __packed hdr;
1514                 struct req_tlv {
1515                         __le16 tag;
1516                         __le16 len;
1517                         u8 active;
1518                         u8 pad;
1519                         u8 omac_addr[ETH_ALEN];
1520                 } __packed tlv;
1521         } dev_req = {
1522                 .hdr = {
1523                         .omac_idx = mvif->omac_idx,
1524                         .band_idx = mvif->band_idx,
1525                 },
1526                 .tlv = {
1527                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
1528                         .len = cpu_to_le16(sizeof(struct req_tlv)),
1529                         .active = enable,
1530                 },
1531         };
1532         struct {
1533                 struct {
1534                         u8 bss_idx;
1535                         u8 pad[3];
1536                 } __packed hdr;
1537                 struct mt7615_bss_basic_tlv basic;
1538         } basic_req = {
1539                 .hdr = {
1540                         .bss_idx = mvif->idx,
1541                 },
1542                 .basic = {
1543                         .tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1544                         .len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1545                         .omac_idx = mvif->omac_idx,
1546                         .band_idx = mvif->band_idx,
1547                         .wmm_idx = mvif->wmm_idx,
1548                         .active = enable,
1549                         .bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx),
1550                         .sta_idx = cpu_to_le16(mvif->sta.wcid.idx),
1551                         .conn_state = 1,
1552                 },
1553         };
1554         int err, idx, cmd, len;
1555         void *data;
1556
1557         switch (vif->type) {
1558         case NL80211_IFTYPE_MESH_POINT:
1559         case NL80211_IFTYPE_AP:
1560                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1561                 break;
1562         case NL80211_IFTYPE_STATION:
1563                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1564                 break;
1565         case NL80211_IFTYPE_ADHOC:
1566                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1567                 break;
1568         default:
1569                 WARN_ON(1);
1570                 break;
1571         }
1572
1573         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1574         basic_req.basic.hw_bss_idx = idx;
1575
1576         memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1577
1578         cmd = enable ? MCU_UNI_CMD_DEV_INFO_UPDATE : MCU_UNI_CMD_BSS_INFO_UPDATE;
1579         data = enable ? (void *)&dev_req : (void *)&basic_req;
1580         len = enable ? sizeof(dev_req) : sizeof(basic_req);
1581
1582         err = mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1583         if (err < 0)
1584                 return err;
1585
1586         cmd = enable ? MCU_UNI_CMD_BSS_INFO_UPDATE : MCU_UNI_CMD_DEV_INFO_UPDATE;
1587         data = enable ? (void *)&basic_req : (void *)&dev_req;
1588         len = enable ? sizeof(basic_req) : sizeof(dev_req);
1589
1590         return mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1591 }
1592
1593 static int
1594 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1595 {
1596         return 0;
1597 }
1598
1599 static int
1600 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1601                        struct ieee80211_sta *sta, bool enable)
1602 {
1603         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1604         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1605         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1606         struct mt7615_dev *dev = phy->dev;
1607         struct {
1608                 struct {
1609                         u8 bss_idx;
1610                         u8 pad[3];
1611                 } __packed hdr;
1612                 struct mt7615_bss_basic_tlv basic;
1613                 struct mt7615_bss_qos_tlv qos;
1614         } basic_req = {
1615                 .hdr = {
1616                         .bss_idx = mvif->idx,
1617                 },
1618                 .basic = {
1619                         .tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1620                         .len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1621                         .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1622                         .dtim_period = vif->bss_conf.dtim_period,
1623                         .omac_idx = mvif->omac_idx,
1624                         .band_idx = mvif->band_idx,
1625                         .wmm_idx = mvif->wmm_idx,
1626                         .active = true, /* keep bss deactivated */
1627                         .phymode = 0x38,
1628                 },
1629                 .qos = {
1630                         .tag = cpu_to_le16(UNI_BSS_INFO_QBSS),
1631                         .len = cpu_to_le16(sizeof(struct mt7615_bss_qos_tlv)),
1632                         .qos = vif->bss_conf.qos,
1633                 },
1634         };
1635         struct {
1636                 struct {
1637                         u8 bss_idx;
1638                         u8 pad[3];
1639                 } __packed hdr;
1640                 struct rlm_tlv {
1641                         __le16 tag;
1642                         __le16 len;
1643                         u8 control_channel;
1644                         u8 center_chan;
1645                         u8 center_chan2;
1646                         u8 bw;
1647                         u8 tx_streams;
1648                         u8 rx_streams;
1649                         u8 short_st;
1650                         u8 ht_op_info;
1651                         u8 sco;
1652                         u8 pad[3];
1653                 } __packed rlm;
1654         } __packed rlm_req = {
1655                 .hdr = {
1656                         .bss_idx = mvif->idx,
1657                 },
1658                 .rlm = {
1659                         .tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1660                         .len = cpu_to_le16(sizeof(struct rlm_tlv)),
1661                         .control_channel = chandef->chan->hw_value,
1662                         .center_chan = ieee80211_frequency_to_channel(freq1),
1663                         .center_chan2 = ieee80211_frequency_to_channel(freq2),
1664                         .tx_streams = hweight8(phy->mt76->antenna_mask),
1665                         .rx_streams = phy->chainmask,
1666                         .short_st = true,
1667                 },
1668         };
1669         int err, conn_type;
1670         u8 idx;
1671
1672         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1673         basic_req.basic.hw_bss_idx = idx;
1674
1675         switch (vif->type) {
1676         case NL80211_IFTYPE_MESH_POINT:
1677         case NL80211_IFTYPE_AP:
1678                 if (vif->p2p)
1679                         conn_type = CONNECTION_P2P_GO;
1680                 else
1681                         conn_type = CONNECTION_INFRA_AP;
1682                 basic_req.basic.conn_type = cpu_to_le32(conn_type);
1683                 break;
1684         case NL80211_IFTYPE_STATION:
1685                 if (vif->p2p)
1686                         conn_type = CONNECTION_P2P_GC;
1687                 else
1688                         conn_type = CONNECTION_INFRA_STA;
1689                 basic_req.basic.conn_type = cpu_to_le32(conn_type);
1690                 break;
1691         case NL80211_IFTYPE_ADHOC:
1692                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1693                 break;
1694         default:
1695                 WARN_ON(1);
1696                 break;
1697         }
1698
1699         memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1700         basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx);
1701         basic_req.basic.sta_idx = cpu_to_le16(mvif->sta.wcid.idx);
1702         basic_req.basic.conn_state = !enable;
1703
1704         err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1705                                 &basic_req, sizeof(basic_req), true);
1706         if (err < 0)
1707                 return err;
1708
1709         switch (chandef->width) {
1710         case NL80211_CHAN_WIDTH_40:
1711                 rlm_req.rlm.bw = CMD_CBW_40MHZ;
1712                 break;
1713         case NL80211_CHAN_WIDTH_80:
1714                 rlm_req.rlm.bw = CMD_CBW_80MHZ;
1715                 break;
1716         case NL80211_CHAN_WIDTH_80P80:
1717                 rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1718                 break;
1719         case NL80211_CHAN_WIDTH_160:
1720                 rlm_req.rlm.bw = CMD_CBW_160MHZ;
1721                 break;
1722         case NL80211_CHAN_WIDTH_5:
1723                 rlm_req.rlm.bw = CMD_CBW_5MHZ;
1724                 break;
1725         case NL80211_CHAN_WIDTH_10:
1726                 rlm_req.rlm.bw = CMD_CBW_10MHZ;
1727                 break;
1728         case NL80211_CHAN_WIDTH_20_NOHT:
1729         case NL80211_CHAN_WIDTH_20:
1730         default:
1731                 rlm_req.rlm.bw = CMD_CBW_20MHZ;
1732                 break;
1733         }
1734
1735         if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1736                 rlm_req.rlm.sco = 1; /* SCA */
1737         else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1738                 rlm_req.rlm.sco = 3; /* SCB */
1739
1740         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1741                                  &rlm_req, sizeof(rlm_req), true);
1742 }
1743
1744 static int
1745 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1746                                   struct ieee80211_hw *hw,
1747                                   struct ieee80211_vif *vif,
1748                                   bool enable)
1749 {
1750         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1751         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1752         struct ieee80211_mutable_offsets offs;
1753         struct {
1754                 struct req_hdr {
1755                         u8 bss_idx;
1756                         u8 pad[3];
1757                 } __packed hdr;
1758                 struct bcn_content_tlv {
1759                         __le16 tag;
1760                         __le16 len;
1761                         __le16 tim_ie_pos;
1762                         __le16 csa_ie_pos;
1763                         __le16 bcc_ie_pos;
1764                         /* 0: enable beacon offload
1765                          * 1: disable beacon offload
1766                          * 2: update probe respond offload
1767                          */
1768                         u8 enable;
1769                         /* 0: legacy format (TXD + payload)
1770                          * 1: only cap field IE
1771                          */
1772                         u8 type;
1773                         __le16 pkt_len;
1774                         u8 pkt[512];
1775                 } __packed beacon_tlv;
1776         } req = {
1777                 .hdr = {
1778                         .bss_idx = mvif->idx,
1779                 },
1780                 .beacon_tlv = {
1781                         .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1782                         .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1783                         .enable = enable,
1784                 },
1785         };
1786         struct sk_buff *skb;
1787
1788         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1789         if (!skb)
1790                 return -EINVAL;
1791
1792         if (skb->len > 512 - MT_TXD_SIZE) {
1793                 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1794                 dev_kfree_skb(skb);
1795                 return -EINVAL;
1796         }
1797
1798         mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1799                               wcid, NULL, 0, NULL, true);
1800         memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1801         req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1802         req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1803
1804         if (offs.cntdwn_counter_offs[0]) {
1805                 u16 csa_offs;
1806
1807                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1808                 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1809         }
1810         dev_kfree_skb(skb);
1811
1812         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1813                                  &req, sizeof(req), true);
1814 }
1815
1816 static int
1817 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1818                      struct ieee80211_ampdu_params *params,
1819                      bool enable)
1820 {
1821         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1822         struct mt7615_vif *mvif = msta->vif;
1823         struct wtbl_req_hdr *wtbl_hdr;
1824         struct tlv *sta_wtbl;
1825         struct sk_buff *skb;
1826         int err;
1827
1828         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1829         if (IS_ERR(skb))
1830                 return PTR_ERR(skb);
1831
1832         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1833
1834         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1835                                              &skb);
1836         if (IS_ERR(wtbl_hdr))
1837                 return PTR_ERR(wtbl_hdr);
1838
1839         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, sta_wtbl,
1840                                wtbl_hdr);
1841
1842         err =  mt76_mcu_skb_send_msg(&dev->mt76, skb,
1843                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1844         if (err < 0)
1845                 return err;
1846
1847         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1848         if (IS_ERR(skb))
1849                 return PTR_ERR(skb);
1850
1851         mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1852
1853         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1854                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1855 }
1856
1857 static int
1858 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1859                      struct ieee80211_ampdu_params *params,
1860                      bool enable)
1861 {
1862         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1863         struct mt7615_vif *mvif = msta->vif;
1864         struct wtbl_req_hdr *wtbl_hdr;
1865         struct tlv *sta_wtbl;
1866         struct sk_buff *skb;
1867         int err;
1868
1869         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1870         if (IS_ERR(skb))
1871                 return PTR_ERR(skb);
1872
1873         mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1874
1875         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1876                                     MCU_UNI_CMD_STA_REC_UPDATE, true);
1877         if (err < 0 || !enable)
1878                 return err;
1879
1880         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1881         if (IS_ERR(skb))
1882                 return PTR_ERR(skb);
1883
1884         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1885
1886         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1887                                              &skb);
1888         if (IS_ERR(wtbl_hdr))
1889                 return PTR_ERR(wtbl_hdr);
1890
1891         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, sta_wtbl,
1892                                wtbl_hdr);
1893
1894         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1895                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1896 }
1897
1898 static int
1899 mt7615_mcu_uni_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1900                        struct ieee80211_sta *sta, bool enable)
1901 {
1902         return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1903                                       MCU_UNI_CMD_STA_REC_UPDATE);
1904 }
1905
1906 static const struct mt7615_mcu_ops uni_update_ops = {
1907         .add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1908         .set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1909         .add_dev_info = mt7615_mcu_uni_add_dev,
1910         .add_bss_info = mt7615_mcu_uni_add_bss,
1911         .add_tx_ba = mt7615_mcu_uni_tx_ba,
1912         .add_rx_ba = mt7615_mcu_uni_rx_ba,
1913         .sta_add = mt7615_mcu_uni_add_sta,
1914         .set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1915         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1916 };
1917
1918 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
1919                                      u32 option)
1920 {
1921         struct {
1922                 __le32 option;
1923                 __le32 addr;
1924         } req = {
1925                 .option = cpu_to_le32(option),
1926                 .addr = cpu_to_le32(addr),
1927         };
1928
1929         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_START_REQ, &req,
1930                                  sizeof(req), true);
1931 }
1932
1933 int mt7615_mcu_restart(struct mt76_dev *dev)
1934 {
1935         return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1936 }
1937 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1938
1939 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
1940 {
1941         struct {
1942                 __le32 op;
1943         } req = {
1944                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
1945         };
1946
1947         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_SEM_CONTROL, &req,
1948                                  sizeof(req), true);
1949 }
1950
1951 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
1952 {
1953         struct {
1954                 u8 check_crc;
1955                 u8 reserved[3];
1956         } req = {
1957                 .check_crc = 0,
1958         };
1959
1960         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_FINISH_REQ, &req,
1961                                  sizeof(req), true);
1962 }
1963
1964 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1965 {
1966         const struct mt7615_patch_hdr *hdr;
1967         const struct firmware *fw = NULL;
1968         int len, ret, sem;
1969
1970         sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
1971         switch (sem) {
1972         case PATCH_IS_DL:
1973                 return 0;
1974         case PATCH_NOT_DL_SEM_SUCCESS:
1975                 break;
1976         default:
1977                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1978                 return -EAGAIN;
1979         }
1980
1981         ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1982         if (ret)
1983                 goto out;
1984
1985         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1986                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1987                 ret = -EINVAL;
1988                 goto out;
1989         }
1990
1991         hdr = (const struct mt7615_patch_hdr *)(fw->data);
1992
1993         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1994                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1995
1996         len = fw->size - sizeof(*hdr);
1997
1998         ret = mt7615_mcu_init_download(dev, addr, len, DL_MODE_NEED_RSP);
1999         if (ret) {
2000                 dev_err(dev->mt76.dev, "Download request failed\n");
2001                 goto out;
2002         }
2003
2004         ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
2005                                      fw->data + sizeof(*hdr), len);
2006         if (ret) {
2007                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2008                 goto out;
2009         }
2010
2011         ret = mt7615_mcu_start_patch(dev);
2012         if (ret)
2013                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2014
2015 out:
2016         release_firmware(fw);
2017
2018         sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
2019         switch (sem) {
2020         case PATCH_REL_SEM_SUCCESS:
2021                 break;
2022         default:
2023                 ret = -EAGAIN;
2024                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2025                 break;
2026         }
2027
2028         return ret;
2029 }
2030
2031 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
2032 {
2033         u32 ret = 0;
2034
2035         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2036                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2037         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2038                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2039         ret |= DL_MODE_NEED_RSP;
2040         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
2041
2042         return ret;
2043 }
2044
2045 static int
2046 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
2047                              const struct mt7615_fw_trailer *hdr,
2048                              const u8 *data, bool is_cr4)
2049 {
2050         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
2051         int err, i, offset = 0;
2052         u32 len, addr, mode;
2053
2054         for (i = 0; i < n_region; i++) {
2055                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
2056                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
2057                 addr = le32_to_cpu(hdr[i].addr);
2058
2059                 err = mt7615_mcu_init_download(dev, addr, len, mode);
2060                 if (err) {
2061                         dev_err(dev->mt76.dev, "Download request failed\n");
2062                         return err;
2063                 }
2064
2065                 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
2066                                              data + offset, len);
2067                 if (err) {
2068                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2069                         return err;
2070                 }
2071
2072                 offset += len;
2073         }
2074
2075         return 0;
2076 }
2077
2078 static const struct wiphy_wowlan_support mt7615_wowlan_support = {
2079         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
2080                  WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
2081         .n_patterns = 1,
2082         .pattern_min_len = 1,
2083         .pattern_max_len = MT7615_WOW_PATTEN_MAX_LEN,
2084         .max_nd_match_sets = 10,
2085 };
2086
2087 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
2088 {
2089         const struct mt7615_fw_trailer *hdr;
2090         const struct firmware *fw;
2091         int ret;
2092
2093         ret = request_firmware(&fw, name, dev->mt76.dev);
2094         if (ret)
2095                 return ret;
2096
2097         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
2098                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2099                 ret = -EINVAL;
2100                 goto out;
2101         }
2102
2103         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2104                                         N9_REGION_NUM * sizeof(*hdr));
2105
2106         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2107                  hdr->fw_ver, hdr->build_date);
2108
2109         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2110         if (ret)
2111                 goto out;
2112
2113         ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
2114                                         FW_START_OVERRIDE);
2115         if (ret) {
2116                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2117                 goto out;
2118         }
2119
2120         snprintf(dev->mt76.hw->wiphy->fw_version,
2121                  sizeof(dev->mt76.hw->wiphy->fw_version),
2122                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2123
2124         if (!is_mt7615(&dev->mt76) &&
2125             !strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
2126                 dev->fw_ver = MT7615_FIRMWARE_V2;
2127                 dev->mcu_ops = &sta_update_ops;
2128         } else {
2129                 dev->fw_ver = MT7615_FIRMWARE_V1;
2130                 dev->mcu_ops = &wtbl_update_ops;
2131         }
2132
2133 out:
2134         release_firmware(fw);
2135         return ret;
2136 }
2137
2138 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
2139 {
2140         const struct mt7615_fw_trailer *hdr;
2141         const struct firmware *fw;
2142         int ret;
2143
2144         ret = request_firmware(&fw, name, dev->mt76.dev);
2145         if (ret)
2146                 return ret;
2147
2148         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
2149                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2150                 ret = -EINVAL;
2151                 goto out;
2152         }
2153
2154         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2155                                         CR4_REGION_NUM * sizeof(*hdr));
2156
2157         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
2158                  hdr->fw_ver, hdr->build_date);
2159
2160         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2161         if (ret)
2162                 goto out;
2163
2164         ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
2165         if (ret) {
2166                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
2167                 goto out;
2168         }
2169
2170 out:
2171         release_firmware(fw);
2172
2173         return ret;
2174 }
2175
2176 static int mt7615_load_ram(struct mt7615_dev *dev)
2177 {
2178         int ret;
2179
2180         ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
2181         if (ret)
2182                 return ret;
2183
2184         return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
2185 }
2186
2187 static int mt7615_load_firmware(struct mt7615_dev *dev)
2188 {
2189         int ret;
2190         u32 val;
2191
2192         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
2193
2194         if (val != FW_STATE_FW_DOWNLOAD) {
2195                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2196                 return -EIO;
2197         }
2198
2199         ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
2200         if (ret)
2201                 return ret;
2202
2203         ret = mt7615_load_ram(dev);
2204         if (ret)
2205                 return ret;
2206
2207         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
2208                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
2209                                        FW_STATE_CR4_RDY), 500)) {
2210                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2211                 return -EIO;
2212         }
2213
2214         return 0;
2215 }
2216
2217 static int mt7622_load_firmware(struct mt7615_dev *dev)
2218 {
2219         int ret;
2220         u32 val;
2221
2222         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2223
2224         val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
2225         if (val != FW_STATE_FW_DOWNLOAD) {
2226                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2227                 return -EIO;
2228         }
2229
2230         ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
2231         if (ret)
2232                 return ret;
2233
2234         ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
2235         if (ret)
2236                 return ret;
2237
2238         if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
2239                             FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
2240                                        FW_STATE_NORMAL_TRX), 1500)) {
2241                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2242                 return -EIO;
2243         }
2244
2245         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2246
2247         return 0;
2248 }
2249
2250 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
2251 {
2252         struct {
2253                 u8 ctrl_val;
2254                 u8 pad[3];
2255         } data = {
2256                 .ctrl_val = ctrl
2257         };
2258
2259         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
2260                                  sizeof(data), true);
2261 }
2262
2263 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
2264 {
2265         u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
2266         const struct mt7663_fw_trailer *hdr;
2267         const struct mt7663_fw_buf *buf;
2268         const struct firmware *fw;
2269         const u8 *base_addr;
2270         int i, ret;
2271
2272         ret = request_firmware(&fw, name, dev->mt76.dev);
2273         if (ret)
2274                 return ret;
2275
2276         if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
2277                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2278                 ret = -EINVAL;
2279                 goto out;
2280         }
2281
2282         hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
2283                                                  FW_V3_COMMON_TAILER_SIZE);
2284
2285         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2286                  hdr->fw_ver, hdr->build_date);
2287         dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
2288
2289         base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
2290         for (i = 0; i < hdr->n_region; i++) {
2291                 u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
2292                 u32 len, addr, mode;
2293
2294                 dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
2295
2296                 buf = (const struct mt7663_fw_buf *)(base_addr - shift);
2297                 mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
2298                 addr = le32_to_cpu(buf->img_dest_addr);
2299                 len = le32_to_cpu(buf->img_size);
2300
2301                 ret = mt7615_mcu_init_download(dev, addr, len, mode);
2302                 if (ret) {
2303                         dev_err(dev->mt76.dev, "Download request failed\n");
2304                         goto out;
2305                 }
2306
2307                 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
2308                                              fw->data + offset, len);
2309                 if (ret) {
2310                         dev_err(dev->mt76.dev, "Failed to send firmware\n");
2311                         goto out;
2312                 }
2313
2314                 offset += le32_to_cpu(buf->img_size);
2315                 if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
2316                         override_addr = le32_to_cpu(buf->img_dest_addr);
2317                         dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
2318                                  i, override_addr);
2319                 }
2320         }
2321
2322         if (override_addr)
2323                 flag |= FW_START_OVERRIDE;
2324
2325         dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
2326                  override_addr, flag);
2327
2328         ret = mt7615_mcu_start_firmware(dev, override_addr, flag);
2329         if (ret) {
2330                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2331                 goto out;
2332         }
2333
2334         snprintf(dev->mt76.hw->wiphy->fw_version,
2335                  sizeof(dev->mt76.hw->wiphy->fw_version),
2336                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2337
2338 out:
2339         release_firmware(fw);
2340
2341         return ret;
2342 }
2343
2344 static int
2345 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
2346 {
2347         const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
2348         const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
2349         int ret;
2350
2351         if (!prefer_offload_fw) {
2352                 secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
2353                 primary_rom = MT7663_ROM_PATCH;
2354         }
2355         selected_rom = primary_rom;
2356
2357         ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
2358         if (ret) {
2359                 dev_info(dev->mt76.dev, "%s not found, switching to %s",
2360                          primary_rom, secondary_rom);
2361                 ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
2362                                         secondary_rom);
2363                 if (ret) {
2364                         dev_err(dev->mt76.dev, "failed to load %s",
2365                                 secondary_rom);
2366                         return ret;
2367                 }
2368                 selected_rom = secondary_rom;
2369         }
2370
2371         if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
2372                 *n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
2373                 dev->fw_ver = MT7615_FIRMWARE_V3;
2374                 dev->mcu_ops = &uni_update_ops;
2375         } else {
2376                 *n9_firmware = MT7663_FIRMWARE_N9;
2377                 dev->fw_ver = MT7615_FIRMWARE_V2;
2378                 dev->mcu_ops = &sta_update_ops;
2379         }
2380
2381         return 0;
2382 }
2383
2384 int __mt7663_load_firmware(struct mt7615_dev *dev)
2385 {
2386         const char *n9_firmware;
2387         int ret;
2388
2389         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
2390         if (ret) {
2391                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
2392                 return -EIO;
2393         }
2394
2395         ret = mt7663_load_rom_patch(dev, &n9_firmware);
2396         if (ret)
2397                 return ret;
2398
2399         ret = mt7663_load_n9(dev, n9_firmware);
2400         if (ret)
2401                 return ret;
2402
2403         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
2404                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
2405                 ret = mt76_get_field(dev, MT_CONN_ON_MISC,
2406                                      MT7663_TOP_MISC2_FW_STATE);
2407                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2408                 return -EIO;
2409         }
2410
2411 #ifdef CONFIG_PM
2412         if (mt7615_firmware_offload(dev))
2413                 dev->mt76.hw->wiphy->wowlan = &mt7615_wowlan_support;
2414 #endif /* CONFIG_PM */
2415
2416         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2417
2418         return 0;
2419 }
2420 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
2421
2422 static int mt7663_load_firmware(struct mt7615_dev *dev)
2423 {
2424         int ret;
2425
2426         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2427
2428         ret = __mt7663_load_firmware(dev);
2429         if (ret)
2430                 return ret;
2431
2432         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2433
2434         return 0;
2435 }
2436
2437 int mt7615_mcu_init(struct mt7615_dev *dev)
2438 {
2439         static const struct mt76_mcu_ops mt7615_mcu_ops = {
2440                 .headroom = sizeof(struct mt7615_mcu_txd),
2441                 .mcu_skb_send_msg = mt7615_mcu_send_message,
2442                 .mcu_parse_response = mt7615_mcu_parse_response,
2443                 .mcu_restart = mt7615_mcu_restart,
2444         };
2445         int ret;
2446
2447         dev->mt76.mcu_ops = &mt7615_mcu_ops,
2448
2449         ret = mt7615_mcu_drv_pmctrl(dev);
2450         if (ret)
2451                 return ret;
2452
2453         switch (mt76_chip(&dev->mt76)) {
2454         case 0x7622:
2455                 ret = mt7622_load_firmware(dev);
2456                 break;
2457         case 0x7663:
2458                 ret = mt7663_load_firmware(dev);
2459                 break;
2460         default:
2461                 ret = mt7615_load_firmware(dev);
2462                 break;
2463         }
2464         if (ret)
2465                 return ret;
2466
2467         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2468         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2469         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2470         mt7615_mcu_fw_log_2_host(dev, 0);
2471
2472         return 0;
2473 }
2474 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
2475
2476 void mt7615_mcu_exit(struct mt7615_dev *dev)
2477 {
2478         __mt76_mcu_restart(&dev->mt76);
2479         mt7615_mcu_set_fw_ctrl(dev);
2480         skb_queue_purge(&dev->mt76.mcu.res_q);
2481 }
2482 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
2483
2484 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
2485 {
2486         struct {
2487                 u8 buffer_mode;
2488                 u8 content_format;
2489                 __le16 len;
2490         } __packed req_hdr = {
2491                 .buffer_mode = 1,
2492         };
2493         u8 *eep = (u8 *)dev->mt76.eeprom.data;
2494         struct sk_buff *skb;
2495         int eep_len, offset;
2496
2497         switch (mt76_chip(&dev->mt76)) {
2498         case 0x7622:
2499                 eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
2500                 offset = MT_EE_NIC_CONF_0;
2501                 break;
2502         case 0x7663:
2503                 eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
2504                 req_hdr.content_format = 1;
2505                 offset = MT_EE_CHIP_ID;
2506                 break;
2507         default:
2508                 eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
2509                 offset = MT_EE_NIC_CONF_0;
2510                 break;
2511         }
2512
2513         req_hdr.len = cpu_to_le16(eep_len);
2514
2515         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
2516         if (!skb)
2517                 return -ENOMEM;
2518
2519         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2520         skb_put_data(skb, eep + offset, eep_len);
2521
2522         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2523                                      MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
2524 }
2525 EXPORT_SYMBOL_GPL(mt7615_mcu_set_eeprom);
2526
2527 int mt7615_mcu_set_mac_enable(struct mt7615_dev *dev, int band, bool enable)
2528 {
2529         struct {
2530                 u8 enable;
2531                 u8 band;
2532                 u8 rsv[2];
2533         } __packed req = {
2534                 .enable = enable,
2535                 .band = band,
2536         };
2537
2538         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL, &req,
2539                                  sizeof(req), true);
2540 }
2541
2542 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
2543 {
2544         struct mt7615_dev *dev = phy->dev;
2545         struct {
2546                 u8 prot_idx;
2547                 u8 band;
2548                 u8 rsv[2];
2549                 __le32 len_thresh;
2550                 __le32 pkt_thresh;
2551         } __packed req = {
2552                 .prot_idx = 1,
2553                 .band = phy != &dev->phy,
2554                 .len_thresh = cpu_to_le32(val),
2555                 .pkt_thresh = cpu_to_le32(0x2),
2556         };
2557
2558         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL, &req,
2559                                  sizeof(req), true);
2560 }
2561
2562 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
2563                        const struct ieee80211_tx_queue_params *params)
2564 {
2565 #define WMM_AIFS_SET    BIT(0)
2566 #define WMM_CW_MIN_SET  BIT(1)
2567 #define WMM_CW_MAX_SET  BIT(2)
2568 #define WMM_TXOP_SET    BIT(3)
2569 #define WMM_PARAM_SET   (WMM_AIFS_SET | WMM_CW_MIN_SET | \
2570                          WMM_CW_MAX_SET | WMM_TXOP_SET)
2571         struct req_data {
2572                 u8 number;
2573                 u8 rsv[3];
2574                 u8 queue;
2575                 u8 valid;
2576                 u8 aifs;
2577                 u8 cw_min;
2578                 __le16 cw_max;
2579                 __le16 txop;
2580         } __packed req = {
2581                 .number = 1,
2582                 .queue = queue,
2583                 .valid = WMM_PARAM_SET,
2584                 .aifs = params->aifs,
2585                 .cw_min = 5,
2586                 .cw_max = cpu_to_le16(10),
2587                 .txop = cpu_to_le16(params->txop),
2588         };
2589
2590         if (params->cw_min)
2591                 req.cw_min = fls(params->cw_min);
2592         if (params->cw_max)
2593                 req.cw_max = cpu_to_le16(fls(params->cw_max));
2594
2595         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
2596                                  sizeof(req), true);
2597 }
2598
2599 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
2600 {
2601         struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2602         struct dbdc_entry {
2603                 u8 type;
2604                 u8 index;
2605                 u8 band;
2606                 u8 _rsv;
2607         };
2608         struct {
2609                 u8 enable;
2610                 u8 num;
2611                 u8 _rsv[2];
2612                 struct dbdc_entry entry[64];
2613         } req = {
2614                 .enable = !!ext_phy,
2615         };
2616         int i;
2617
2618         if (!ext_phy)
2619                 goto out;
2620
2621 #define ADD_DBDC_ENTRY(_type, _idx, _band)              \
2622         do { \
2623                 req.entry[req.num].type = _type;                \
2624                 req.entry[req.num].index = _idx;                \
2625                 req.entry[req.num++].band = _band;              \
2626         } while (0)
2627
2628         for (i = 0; i < 4; i++) {
2629                 bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
2630
2631                 ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2632         }
2633
2634         for (i = 0; i < 14; i++) {
2635                 bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
2636
2637                 ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2638         }
2639
2640         ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2641
2642         for (i = 0; i < 3; i++)
2643                 ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2644
2645         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2646         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2647         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2648         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2649
2650         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2651         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2652
2653 out:
2654         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
2655                                  sizeof(req), true);
2656 }
2657
2658 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2659 {
2660         struct wtbl_req_hdr req = {
2661                 .operation = WTBL_RESET_ALL,
2662         };
2663
2664         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
2665                                  sizeof(req), true);
2666 }
2667 EXPORT_SYMBOL_GPL(mt7615_mcu_del_wtbl_all);
2668
2669 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2670                        enum mt7615_rdd_cmd cmd, u8 index,
2671                        u8 rx_sel, u8 val)
2672 {
2673         struct {
2674                 u8 ctrl;
2675                 u8 rdd_idx;
2676                 u8 rdd_rx_sel;
2677                 u8 val;
2678                 u8 rsv[4];
2679         } req = {
2680                 .ctrl = cmd,
2681                 .rdd_idx = index,
2682                 .rdd_rx_sel = rx_sel,
2683                 .val = val,
2684         };
2685
2686         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
2687                                  sizeof(req), true);
2688 }
2689
2690 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2691 {
2692         struct {
2693                 __le16 tag;
2694                 __le16 min_lpn;
2695         } req = {
2696                 .tag = cpu_to_le16(0x1),
2697                 .min_lpn = cpu_to_le16(val),
2698         };
2699
2700         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2701                                  sizeof(req), true);
2702 }
2703
2704 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2705                             const struct mt7615_dfs_pulse *pulse)
2706 {
2707         struct {
2708                 __le16 tag;
2709                 __le32 max_width;       /* us */
2710                 __le32 max_pwr;         /* dbm */
2711                 __le32 min_pwr;         /* dbm */
2712                 __le32 min_stgr_pri;    /* us */
2713                 __le32 max_stgr_pri;    /* us */
2714                 __le32 min_cr_pri;      /* us */
2715                 __le32 max_cr_pri;      /* us */
2716         } req = {
2717                 .tag = cpu_to_le16(0x3),
2718 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2719                 __req_field(max_width),
2720                 __req_field(max_pwr),
2721                 __req_field(min_pwr),
2722                 __req_field(min_stgr_pri),
2723                 __req_field(max_stgr_pri),
2724                 __req_field(min_cr_pri),
2725                 __req_field(max_cr_pri),
2726 #undef  __req_field
2727         };
2728
2729         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2730                                  sizeof(req), true);
2731 }
2732
2733 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2734                             const struct mt7615_dfs_pattern *pattern)
2735 {
2736         struct {
2737                 __le16 tag;
2738                 __le16 radar_type;
2739                 u8 enb;
2740                 u8 stgr;
2741                 u8 min_crpn;
2742                 u8 max_crpn;
2743                 u8 min_crpr;
2744                 u8 min_pw;
2745                 u8 max_pw;
2746                 __le32 min_pri;
2747                 __le32 max_pri;
2748                 u8 min_crbn;
2749                 u8 max_crbn;
2750                 u8 min_stgpn;
2751                 u8 max_stgpn;
2752                 u8 min_stgpr;
2753         } req = {
2754                 .tag = cpu_to_le16(0x2),
2755                 .radar_type = cpu_to_le16(index),
2756 #define __req_field_u8(field) .field = pattern->field
2757 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2758                 __req_field_u8(enb),
2759                 __req_field_u8(stgr),
2760                 __req_field_u8(min_crpn),
2761                 __req_field_u8(max_crpn),
2762                 __req_field_u8(min_crpr),
2763                 __req_field_u8(min_pw),
2764                 __req_field_u8(max_pw),
2765                 __req_field_u32(min_pri),
2766                 __req_field_u32(max_pri),
2767                 __req_field_u8(min_crbn),
2768                 __req_field_u8(max_crbn),
2769                 __req_field_u8(min_stgpn),
2770                 __req_field_u8(max_stgpn),
2771                 __req_field_u8(min_stgpr),
2772 #undef __req_field_u8
2773 #undef __req_field_u32
2774         };
2775
2776         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2777                                  sizeof(req), true);
2778 }
2779
2780 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2781 {
2782         struct {
2783                 u8 pulse_num;
2784                 u8 rsv[3];
2785                 struct {
2786                         __le32 start_time;
2787                         __le16 width;
2788                         __le16 power;
2789                 } pattern[32];
2790         } req = {
2791                 .pulse_num = dev->radar_pattern.n_pulses,
2792         };
2793         u32 start_time = ktime_to_ms(ktime_get_boottime());
2794         int i;
2795
2796         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2797                 return -EINVAL;
2798
2799         /* TODO: add some noise here */
2800         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2801                 u32 ts = start_time + i * dev->radar_pattern.period;
2802
2803                 req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2804                 req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2805                 req.pattern[i].start_time = cpu_to_le32(ts);
2806         }
2807
2808         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2809                                  &req, sizeof(req), false);
2810 }
2811
2812 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2813 {
2814         struct mt76_phy *mphy = phy->mt76;
2815         struct ieee80211_hw *hw = mphy->hw;
2816         int n_chains = hweight8(mphy->antenna_mask);
2817         int tx_power;
2818         int i;
2819
2820         tx_power = hw->conf.power_level * 2 -
2821                    mt76_tx_power_nss_delta(n_chains);
2822         mphy->txpower_cur = tx_power;
2823
2824         for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2825                 sku[i] = tx_power;
2826
2827         for (i = 0; i < 4; i++) {
2828                 int delta = 0;
2829
2830                 if (i < n_chains - 1)
2831                         delta = mt76_tx_power_nss_delta(n_chains) -
2832                                 mt76_tx_power_nss_delta(i + 1);
2833                 sku[MT_SKU_1SS_DELTA + i] = delta;
2834         }
2835 }
2836
2837 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2838 {
2839         static const u8 width_to_bw[] = {
2840                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2841                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2842                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2843                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2844                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2845                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2846                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2847                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2848         };
2849
2850         if (chandef->width >= ARRAY_SIZE(width_to_bw))
2851                 return 0;
2852
2853         return width_to_bw[chandef->width];
2854 }
2855
2856 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2857 {
2858         struct mt7615_dev *dev = phy->dev;
2859         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2860         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2861         struct {
2862                 u8 control_chan;
2863                 u8 center_chan;
2864                 u8 bw;
2865                 u8 tx_streams;
2866                 u8 rx_streams_mask;
2867                 u8 switch_reason;
2868                 u8 band_idx;
2869                 /* for 80+80 only */
2870                 u8 center_chan2;
2871                 __le16 cac_case;
2872                 u8 channel_band;
2873                 u8 rsv0;
2874                 __le32 outband_freq;
2875                 u8 txpower_drop;
2876                 u8 rsv1[3];
2877                 u8 txpower_sku[53];
2878                 u8 rsv2[3];
2879         } req = {
2880                 .control_chan = chandef->chan->hw_value,
2881                 .center_chan = ieee80211_frequency_to_channel(freq1),
2882                 .tx_streams = hweight8(phy->mt76->antenna_mask),
2883                 .rx_streams_mask = phy->chainmask,
2884                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
2885         };
2886
2887         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2888                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2889         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2890                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2891                 req.switch_reason = CH_SWITCH_DFS;
2892         else
2893                 req.switch_reason = CH_SWITCH_NORMAL;
2894
2895         req.band_idx = phy != &dev->phy;
2896         req.bw = mt7615_mcu_chan_bw(chandef);
2897
2898         if (mt76_testmode_enabled(&dev->mt76))
2899                 memset(req.txpower_sku, 0x3f, 49);
2900         else
2901                 mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2902
2903         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2904 }
2905
2906 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2907 {
2908         struct {
2909                 u8 action;
2910                 u8 rsv[3];
2911         } req = {
2912                 .action = index,
2913         };
2914
2915         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2916                                  sizeof(req), true);
2917 }
2918
2919 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2920                               u32 val)
2921 {
2922         struct {
2923                 u8 test_mode_en;
2924                 u8 param_idx;
2925                 u8 _rsv[2];
2926
2927                 __le32 value;
2928
2929                 u8 pad[8];
2930         } req = {
2931                 .test_mode_en = test_mode,
2932                 .param_idx = param,
2933                 .value = cpu_to_le32(val),
2934         };
2935
2936         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2937                                  sizeof(req), false);
2938 }
2939
2940 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2941 {
2942         struct mt7615_dev *dev = phy->dev;
2943         struct {
2944                 u8 format_id;
2945                 u8 sku_enable;
2946                 u8 band_idx;
2947                 u8 rsv;
2948         } req = {
2949                 .format_id = 0,
2950                 .band_idx = phy != &dev->phy,
2951                 .sku_enable = enable,
2952         };
2953
2954         return mt76_mcu_send_msg(&dev->mt76,
2955                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2956                                  sizeof(req), true);
2957 }
2958
2959 int mt7615_mcu_set_vif_ps(struct mt7615_dev *dev, struct ieee80211_vif *vif)
2960 {
2961         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2962         struct {
2963                 u8 bss_idx;
2964                 u8 ps_state; /* 0: device awake
2965                               * 1: static power save
2966                               * 2: dynamic power saving
2967                               */
2968         } req = {
2969                 .bss_idx = mvif->idx,
2970                 .ps_state = vif->bss_conf.ps ? 2 : 0,
2971         };
2972
2973         if (vif->type != NL80211_IFTYPE_STATION)
2974                 return -ENOTSUPP;
2975
2976         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_PS_PROFILE, &req,
2977                                  sizeof(req), false);
2978 }
2979
2980 int mt7615_mcu_set_channel_domain(struct mt7615_phy *phy)
2981 {
2982         struct mt76_phy *mphy = phy->mt76;
2983         struct mt7615_dev *dev = phy->dev;
2984         struct mt7615_mcu_channel_domain {
2985                 __le32 country_code; /* regulatory_request.alpha2 */
2986                 u8 bw_2g; /* BW_20_40M          0
2987                            * BW_20M             1
2988                            * BW_20_40_80M       2
2989                            * BW_20_40_80_160M   3
2990                            * BW_20_40_80_8080M  4
2991                            */
2992                 u8 bw_5g;
2993                 __le16 pad;
2994                 u8 n_2ch;
2995                 u8 n_5ch;
2996                 __le16 pad2;
2997         } __packed hdr = {
2998                 .bw_2g = 0,
2999                 .bw_5g = 3,
3000                 .n_2ch = mphy->sband_2g.sband.n_channels,
3001                 .n_5ch = mphy->sband_5g.sband.n_channels,
3002         };
3003         struct mt7615_mcu_chan {
3004                 __le16 hw_value;
3005                 __le16 pad;
3006                 __le32 flags;
3007         } __packed;
3008         int i, n_channels = hdr.n_2ch + hdr.n_5ch;
3009         int len = sizeof(hdr) + n_channels * sizeof(struct mt7615_mcu_chan);
3010         struct sk_buff *skb;
3011
3012         if (!mt7615_firmware_offload(dev))
3013                 return 0;
3014
3015         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
3016         if (!skb)
3017                 return -ENOMEM;
3018
3019         skb_put_data(skb, &hdr, sizeof(hdr));
3020
3021         for (i = 0; i < n_channels; i++) {
3022                 struct ieee80211_channel *chan;
3023                 struct mt7615_mcu_chan channel;
3024
3025                 if (i < hdr.n_2ch)
3026                         chan = &mphy->sband_2g.sband.channels[i];
3027                 else
3028                         chan = &mphy->sband_5g.sband.channels[i - hdr.n_2ch];
3029
3030                 channel.hw_value = cpu_to_le16(chan->hw_value);
3031                 channel.flags = cpu_to_le32(chan->flags);
3032                 channel.pad = 0;
3033
3034                 skb_put_data(skb, &channel, sizeof(channel));
3035         }
3036
3037         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_SET_CHAN_DOMAIN,
3038                                      false);
3039 }
3040
3041 #define MT7615_SCAN_CHANNEL_TIME        60
3042 int mt7615_mcu_hw_scan(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3043                        struct ieee80211_scan_request *scan_req)
3044 {
3045         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3046         struct cfg80211_scan_request *sreq = &scan_req->req;
3047         int n_ssids = 0, err, i, duration = MT7615_SCAN_CHANNEL_TIME;
3048         int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
3049         struct ieee80211_channel **scan_list = sreq->channels;
3050         struct mt7615_dev *dev = phy->dev;
3051         bool ext_phy = phy != &dev->phy;
3052         struct mt7615_mcu_scan_channel *chan;
3053         struct mt7615_hw_scan_req *req;
3054         struct sk_buff *skb;
3055
3056         /* fall-back to sw-scan */
3057         if (!mt7615_firmware_offload(dev))
3058                 return 1;
3059
3060         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(*req));
3061         if (!skb)
3062                 return -ENOMEM;
3063
3064         set_bit(MT76_HW_SCANNING, &phy->mt76->state);
3065         mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3066
3067         req = (struct mt7615_hw_scan_req *)skb_put(skb, sizeof(*req));
3068
3069         req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3070         req->bss_idx = mvif->idx;
3071         req->scan_type = sreq->n_ssids ? 1 : 0;
3072         req->probe_req_num = sreq->n_ssids ? 2 : 0;
3073         req->version = 1;
3074
3075         for (i = 0; i < sreq->n_ssids; i++) {
3076                 if (!sreq->ssids[i].ssid_len)
3077                         continue;
3078
3079                 req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
3080                 memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
3081                        sreq->ssids[i].ssid_len);
3082                 n_ssids++;
3083         }
3084         req->ssid_type = n_ssids ? BIT(2) : BIT(0);
3085         req->ssid_type_ext = n_ssids ? BIT(0) : 0;
3086         req->ssids_num = n_ssids;
3087
3088         /* increase channel time for passive scan */
3089         if (!sreq->n_ssids)
3090                 duration *= 2;
3091         req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
3092         req->channel_min_dwell_time = cpu_to_le16(duration);
3093         req->channel_dwell_time = cpu_to_le16(duration);
3094
3095         req->channels_num = min_t(u8, sreq->n_channels, 32);
3096         req->ext_channels_num = min_t(u8, ext_channels_num, 32);
3097         for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
3098                 if (i >= 32)
3099                         chan = &req->ext_channels[i - 32];
3100                 else
3101                         chan = &req->channels[i];
3102
3103                 chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3104                 chan->channel_num = scan_list[i]->hw_value;
3105         }
3106         req->channel_type = sreq->n_channels ? 4 : 0;
3107
3108         if (sreq->ie_len > 0) {
3109                 memcpy(req->ies, sreq->ie, sreq->ie_len);
3110                 req->ies_len = cpu_to_le16(sreq->ie_len);
3111         }
3112
3113         memcpy(req->bssid, sreq->bssid, ETH_ALEN);
3114         if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3115                 get_random_mask_addr(req->random_mac, sreq->mac_addr,
3116                                      sreq->mac_addr_mask);
3117                 req->scan_func = 1;
3118         }
3119
3120         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_START_HW_SCAN,
3121                                     false);
3122         if (err < 0)
3123                 clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
3124
3125         return err;
3126 }
3127
3128 int mt7615_mcu_cancel_hw_scan(struct mt7615_phy *phy,
3129                               struct ieee80211_vif *vif)
3130 {
3131         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3132         struct mt7615_dev *dev = phy->dev;
3133         struct {
3134                 u8 seq_num;
3135                 u8 is_ext_channel;
3136                 u8 rsv[2];
3137         } __packed req = {
3138                 .seq_num = mvif->scan_seq_num,
3139         };
3140
3141         if (test_and_clear_bit(MT76_HW_SCANNING, &phy->mt76->state)) {
3142                 struct cfg80211_scan_info info = {
3143                         .aborted = true,
3144                 };
3145
3146                 ieee80211_scan_completed(phy->mt76->hw, &info);
3147         }
3148
3149         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_CANCEL_HW_SCAN, &req,
3150                                  sizeof(req), false);
3151 }
3152
3153 int mt7615_mcu_sched_scan_req(struct mt7615_phy *phy,
3154                               struct ieee80211_vif *vif,
3155                               struct cfg80211_sched_scan_request *sreq)
3156 {
3157         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3158         struct ieee80211_channel **scan_list = sreq->channels;
3159         struct mt7615_dev *dev = phy->dev;
3160         bool ext_phy = phy != &dev->phy;
3161         struct mt7615_mcu_scan_channel *chan;
3162         struct mt7615_sched_scan_req *req;
3163         struct cfg80211_match_set *match;
3164         struct cfg80211_ssid *ssid;
3165         struct sk_buff *skb;
3166         int i;
3167
3168         if (!mt7615_firmware_offload(dev))
3169                 return -ENOTSUPP;
3170
3171         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3172                                  sizeof(*req) + sreq->ie_len);
3173         if (!skb)
3174                 return -ENOMEM;
3175
3176         mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3177
3178         req = (struct mt7615_sched_scan_req *)skb_put(skb, sizeof(*req));
3179         req->version = 1;
3180         req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3181
3182         if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3183                 get_random_mask_addr(req->random_mac, sreq->mac_addr,
3184                                      sreq->mac_addr_mask);
3185                 req->scan_func = 1;
3186         }
3187
3188         req->ssids_num = sreq->n_ssids;
3189         for (i = 0; i < req->ssids_num; i++) {
3190                 ssid = &sreq->ssids[i];
3191                 memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
3192                 req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
3193         }
3194
3195         req->match_num = sreq->n_match_sets;
3196         for (i = 0; i < req->match_num; i++) {
3197                 match = &sreq->match_sets[i];
3198                 memcpy(req->match[i].ssid, match->ssid.ssid,
3199                        match->ssid.ssid_len);
3200                 req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
3201                 req->match[i].ssid_len = match->ssid.ssid_len;
3202         }
3203
3204         req->channel_type = sreq->n_channels ? 4 : 0;
3205         req->channels_num = min_t(u8, sreq->n_channels, 64);
3206         for (i = 0; i < req->channels_num; i++) {
3207                 chan = &req->channels[i];
3208                 chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3209                 chan->channel_num = scan_list[i]->hw_value;
3210         }
3211
3212         req->intervals_num = sreq->n_scan_plans;
3213         for (i = 0; i < req->intervals_num; i++)
3214                 req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3215
3216         if (sreq->ie_len > 0) {
3217                 req->ie_len = cpu_to_le16(sreq->ie_len);
3218                 memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
3219         }
3220
3221         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_SCHED_SCAN_REQ,
3222                                      false);
3223 }
3224
3225 int mt7615_mcu_sched_scan_enable(struct mt7615_phy *phy,
3226                                  struct ieee80211_vif *vif,
3227                                  bool enable)
3228 {
3229         struct mt7615_dev *dev = phy->dev;
3230         struct {
3231                 u8 active; /* 0: enabled 1: disabled */
3232                 u8 rsv[3];
3233         } __packed req = {
3234                 .active = !enable,
3235         };
3236
3237         if (!mt7615_firmware_offload(dev))
3238                 return -ENOTSUPP;
3239
3240         if (enable)
3241                 set_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3242         else
3243                 clear_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3244
3245         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SCHED_SCAN_ENABLE, &req,
3246                                  sizeof(req), false);
3247 }
3248
3249 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3250 {
3251         int i;
3252
3253         for (i = 0; i < n_freqs; i++)
3254                 if (cur == freqs[i])
3255                         return i;
3256
3257         return -1;
3258 }
3259
3260 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
3261 {
3262         static const u16 freq_list[] = {
3263                 4980, 5805, 5905, 5190,
3264                 5230, 5270, 5310, 5350,
3265                 5390, 5430, 5470, 5510,
3266                 5550, 5590, 5630, 5670,
3267                 5710, 5755, 5795, 5835,
3268                 5875, 5210, 5290, 5370,
3269                 5450, 5530, 5610, 5690,
3270                 5775, 5855
3271         };
3272         static const u16 freq_bw40[] = {
3273                 5190, 5230, 5270, 5310,
3274                 5350, 5390, 5430, 5470,
3275                 5510, 5550, 5590, 5630,
3276                 5670, 5710, 5755, 5795,
3277                 5835, 5875
3278         };
3279         int offset_2g = ARRAY_SIZE(freq_list);
3280         int idx;
3281
3282         if (freq < 4000) {
3283                 if (freq < 2427)
3284                         return offset_2g;
3285                 if (freq < 2442)
3286                         return offset_2g + 1;
3287                 if (freq < 2457)
3288                         return offset_2g + 2;
3289
3290                 return offset_2g + 3;
3291         }
3292
3293         switch (bw) {
3294         case NL80211_CHAN_WIDTH_80:
3295         case NL80211_CHAN_WIDTH_80P80:
3296         case NL80211_CHAN_WIDTH_160:
3297                 break;
3298         default:
3299                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3300                                            freq + 10);
3301                 if (idx >= 0) {
3302                         freq = freq_bw40[idx];
3303                         break;
3304                 }
3305
3306                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3307                                            freq - 10);
3308                 if (idx >= 0) {
3309                         freq = freq_bw40[idx];
3310                         break;
3311                 }
3312                 fallthrough;
3313         case NL80211_CHAN_WIDTH_40:
3314                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3315                                            freq);
3316                 if (idx >= 0)
3317                         break;
3318
3319                 return -1;
3320
3321         }
3322
3323         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3324 }
3325
3326 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
3327 {
3328         struct mt7615_dev *dev = phy->dev;
3329         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3330         int freq2 = chandef->center_freq2;
3331         int ret;
3332         struct {
3333                 u8 direction;
3334                 u8 runtime_calibration;
3335                 u8 _rsv[2];
3336
3337                 __le16 center_freq;
3338                 u8 bw;
3339                 u8 band;
3340                 u8 is_freq2;
3341                 u8 success;
3342                 u8 dbdc_en;
3343
3344                 u8 _rsv2;
3345
3346                 struct {
3347                         __le32 sx0_i_lna[4];
3348                         __le32 sx0_q_lna[4];
3349
3350                         __le32 sx2_i_lna[4];
3351                         __le32 sx2_q_lna[4];
3352                 } dcoc_data[4];
3353         } req = {
3354                 .direction = 1,
3355
3356                 .bw = mt7615_mcu_chan_bw(chandef),
3357                 .band = chandef->center_freq1 > 4000,
3358                 .dbdc_en = !!dev->mt76.phy2,
3359         };
3360         u16 center_freq = chandef->center_freq1;
3361         int freq_idx;
3362         u8 *eep = dev->mt76.eeprom.data;
3363
3364         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
3365                 return 0;
3366
3367         if (chandef->width == NL80211_CHAN_WIDTH_160) {
3368                 freq2 = center_freq + 40;
3369                 center_freq -= 40;
3370         }
3371
3372 again:
3373         req.runtime_calibration = 1;
3374         freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
3375         if (freq_idx < 0)
3376                 goto out;
3377
3378         memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
3379                               freq_idx * MT7615_EEPROM_DCOC_SIZE,
3380                sizeof(req.dcoc_data));
3381         req.runtime_calibration = 0;
3382
3383 out:
3384         req.center_freq = cpu_to_le16(center_freq);
3385         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
3386                                 sizeof(req), true);
3387
3388         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3389              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3390                 req.is_freq2 = true;
3391                 center_freq = freq2;
3392                 goto again;
3393         }
3394
3395         return ret;
3396 }
3397
3398 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
3399 {
3400         static const u16 freq_list[] = {
3401                 4920, 4940, 4960, 4980,
3402                 5040, 5060, 5080, 5180,
3403                 5200, 5220, 5240, 5260,
3404                 5280, 5300, 5320, 5340,
3405                 5360, 5380, 5400, 5420,
3406                 5440, 5460, 5480, 5500,
3407                 5520, 5540, 5560, 5580,
3408                 5600, 5620, 5640, 5660,
3409                 5680, 5700, 5720, 5745,
3410                 5765, 5785, 5805, 5825,
3411                 5845, 5865, 5885, 5905
3412         };
3413         int offset_2g = ARRAY_SIZE(freq_list);
3414         int idx;
3415
3416         if (freq < 4000) {
3417                 if (freq < 2432)
3418                         return offset_2g;
3419                 if (freq < 2457)
3420                         return offset_2g + 1;
3421
3422                 return offset_2g + 2;
3423         }
3424
3425         if (bw != NL80211_CHAN_WIDTH_20) {
3426                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3427                                            freq + 10);
3428                 if (idx >= 0)
3429                         return idx;
3430
3431                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3432                                            freq - 10);
3433                 if (idx >= 0)
3434                         return idx;
3435         }
3436
3437         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3438 }
3439
3440
3441 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
3442 {
3443         struct mt7615_dev *dev = phy->dev;
3444         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3445         int freq2 = chandef->center_freq2;
3446         int ret;
3447         struct {
3448                 u8 direction;
3449                 u8 runtime_calibration;
3450                 u8 _rsv[2];
3451
3452                 __le16 center_freq;
3453                 u8 bw;
3454                 u8 band;
3455                 u8 is_freq2;
3456                 u8 success;
3457                 u8 dbdc_en;
3458
3459                 u8 _rsv2;
3460
3461                 struct {
3462                         struct {
3463                                 u32 dpd_g0;
3464                                 u8 data[32];
3465                         } wf0, wf1;
3466
3467                         struct {
3468                                 u32 dpd_g0_prim;
3469                                 u32 dpd_g0_sec;
3470                                 u8 data_prim[32];
3471                                 u8 data_sec[32];
3472                         } wf2, wf3;
3473                 } dpd_data;
3474         } req = {
3475                 .direction = 1,
3476
3477                 .bw = mt7615_mcu_chan_bw(chandef),
3478                 .band = chandef->center_freq1 > 4000,
3479                 .dbdc_en = !!dev->mt76.phy2,
3480         };
3481         u16 center_freq = chandef->center_freq1;
3482         int freq_idx;
3483         u8 *eep = dev->mt76.eeprom.data;
3484
3485         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
3486                 return 0;
3487
3488         if (chandef->width == NL80211_CHAN_WIDTH_160) {
3489                 freq2 = center_freq + 40;
3490                 center_freq -= 40;
3491         }
3492
3493 again:
3494         req.runtime_calibration = 1;
3495         freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
3496         if (freq_idx < 0)
3497                 goto out;
3498
3499         memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
3500                               freq_idx * MT7615_EEPROM_TXDPD_SIZE,
3501                sizeof(req.dpd_data));
3502         req.runtime_calibration = 0;
3503
3504 out:
3505         req.center_freq = cpu_to_le16(center_freq);
3506         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
3507                                 sizeof(req), true);
3508
3509         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3510              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3511                 req.is_freq2 = true;
3512                 center_freq = freq2;
3513                 goto again;
3514         }
3515
3516         return ret;
3517 }
3518
3519 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3520                           bool enable)
3521 {
3522         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3523         struct {
3524                 u8 bss_idx;
3525                 u8 dtim_period;
3526                 __le16 aid;
3527                 __le16 bcn_interval;
3528                 __le16 atim_window;
3529                 u8 uapsd;
3530                 u8 bmc_delivered_ac;
3531                 u8 bmc_triggered_ac;
3532                 u8 pad;
3533         } req = {
3534                 .bss_idx = mvif->idx,
3535                 .aid = cpu_to_le16(vif->bss_conf.aid),
3536                 .dtim_period = vif->bss_conf.dtim_period,
3537                 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
3538         };
3539         struct {
3540                 u8 bss_idx;
3541                 u8 pad[3];
3542         } req_hdr = {
3543                 .bss_idx = mvif->idx,
3544         };
3545         int err;
3546
3547         if (vif->type != NL80211_IFTYPE_STATION)
3548                 return 0;
3549
3550         err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
3551                                 sizeof(req_hdr), false);
3552         if (err < 0 || !enable)
3553                 return err;
3554
3555         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
3556                                  sizeof(req), false);
3557 }
3558
3559 #ifdef CONFIG_PM
3560 int mt7615_mcu_set_hif_suspend(struct mt7615_dev *dev, bool suspend)
3561 {
3562         struct {
3563                 struct {
3564                         u8 hif_type; /* 0x0: HIF_SDIO
3565                                       * 0x1: HIF_USB
3566                                       * 0x2: HIF_PCIE
3567                                       */
3568                         u8 pad[3];
3569                 } __packed hdr;
3570                 struct hif_suspend_tlv {
3571                         __le16 tag;
3572                         __le16 len;
3573                         u8 suspend;
3574                 } __packed hif_suspend;
3575         } req = {
3576                 .hif_suspend = {
3577                         .tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
3578                         .len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
3579                         .suspend = suspend,
3580                 },
3581         };
3582
3583         if (mt76_is_mmio(&dev->mt76))
3584                 req.hdr.hif_type = 2;
3585         else if (mt76_is_usb(&dev->mt76))
3586                 req.hdr.hif_type = 1;
3587         else if (mt76_is_sdio(&dev->mt76))
3588                 req.hdr.hif_type = 0;
3589
3590         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_HIF_CTRL, &req,
3591                                  sizeof(req), true);
3592 }
3593 EXPORT_SYMBOL_GPL(mt7615_mcu_set_hif_suspend);
3594
3595 static int
3596 mt7615_mcu_set_wow_ctrl(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3597                         bool suspend, struct cfg80211_wowlan *wowlan)
3598 {
3599         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3600         struct mt7615_dev *dev = phy->dev;
3601         struct {
3602                 struct {
3603                         u8 bss_idx;
3604                         u8 pad[3];
3605                 } __packed hdr;
3606                 struct mt7615_wow_ctrl_tlv wow_ctrl_tlv;
3607                 struct mt7615_wow_gpio_param_tlv gpio_tlv;
3608         } req = {
3609                 .hdr = {
3610                         .bss_idx = mvif->idx,
3611                 },
3612                 .wow_ctrl_tlv = {
3613                         .tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
3614                         .len = cpu_to_le16(sizeof(struct mt7615_wow_ctrl_tlv)),
3615                         .cmd = suspend ? 1 : 2,
3616                 },
3617                 .gpio_tlv = {
3618                         .tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
3619                         .len = cpu_to_le16(sizeof(struct mt7615_wow_gpio_param_tlv)),
3620                         .gpio_pin = 0xff, /* follow fw about GPIO pin */
3621                 },
3622         };
3623
3624         if (wowlan->magic_pkt)
3625                 req.wow_ctrl_tlv.trigger |= BIT(0);
3626         if (wowlan->disconnect)
3627                 req.wow_ctrl_tlv.trigger |= BIT(2);
3628         if (wowlan->nd_config) {
3629                 mt7615_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
3630                 req.wow_ctrl_tlv.trigger |= BIT(5);
3631                 mt7615_mcu_sched_scan_enable(phy, vif, suspend);
3632         }
3633
3634         if (mt76_is_mmio(&dev->mt76))
3635                 req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
3636         else if (mt76_is_usb(&dev->mt76))
3637                 req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
3638         else if (mt76_is_sdio(&dev->mt76))
3639                 req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
3640
3641         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
3642                                  sizeof(req), true);
3643 }
3644
3645 static int
3646 mt7615_mcu_set_wow_pattern(struct mt7615_dev *dev,
3647                            struct ieee80211_vif *vif,
3648                            u8 index, bool enable,
3649                            struct cfg80211_pkt_pattern *pattern)
3650 {
3651         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3652         struct mt7615_wow_pattern_tlv *ptlv;
3653         struct sk_buff *skb;
3654         struct req_hdr {
3655                 u8 bss_idx;
3656                 u8 pad[3];
3657         } __packed hdr = {
3658                 .bss_idx = mvif->idx,
3659         };
3660
3661         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3662                                  sizeof(hdr) + sizeof(*ptlv));
3663         if (!skb)
3664                 return -ENOMEM;
3665
3666         skb_put_data(skb, &hdr, sizeof(hdr));
3667         ptlv = (struct mt7615_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
3668         ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
3669         ptlv->len = cpu_to_le16(sizeof(*ptlv));
3670         ptlv->data_len = pattern->pattern_len;
3671         ptlv->enable = enable;
3672         ptlv->index = index;
3673
3674         memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
3675         memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8);
3676
3677         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_SUSPEND,
3678                                      true);
3679 }
3680
3681 static int
3682 mt7615_mcu_set_suspend_mode(struct mt7615_dev *dev,
3683                             struct ieee80211_vif *vif,
3684                             bool enable, u8 mdtim, bool wow_suspend)
3685 {
3686         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3687         struct {
3688                 struct {
3689                         u8 bss_idx;
3690                         u8 pad[3];
3691                 } __packed hdr;
3692                 struct mt7615_suspend_tlv suspend_tlv;
3693         } req = {
3694                 .hdr = {
3695                         .bss_idx = mvif->idx,
3696                 },
3697                 .suspend_tlv = {
3698                         .tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
3699                         .len = cpu_to_le16(sizeof(struct mt7615_suspend_tlv)),
3700                         .enable = enable,
3701                         .mdtim = mdtim,
3702                         .wow_suspend = wow_suspend,
3703                 },
3704         };
3705
3706         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
3707                                  sizeof(req), true);
3708 }
3709
3710 static int
3711 mt7615_mcu_set_gtk_rekey(struct mt7615_dev *dev,
3712                          struct ieee80211_vif *vif,
3713                          bool suspend)
3714 {
3715         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3716         struct {
3717                 struct {
3718                         u8 bss_idx;
3719                         u8 pad[3];
3720                 } __packed hdr;
3721                 struct mt7615_gtk_rekey_tlv gtk_tlv;
3722         } __packed req = {
3723                 .hdr = {
3724                         .bss_idx = mvif->idx,
3725                 },
3726                 .gtk_tlv = {
3727                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
3728                         .len = cpu_to_le16(sizeof(struct mt7615_gtk_rekey_tlv)),
3729                         .rekey_mode = !suspend,
3730                 },
3731         };
3732
3733         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
3734                                  sizeof(req), true);
3735 }
3736
3737 static int
3738 mt7615_mcu_set_arp_filter(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3739                           bool suspend)
3740 {
3741         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3742         struct {
3743                 struct {
3744                         u8 bss_idx;
3745                         u8 pad[3];
3746                 } __packed hdr;
3747                 struct mt7615_arpns_tlv arpns;
3748         } req = {
3749                 .hdr = {
3750                         .bss_idx = mvif->idx,
3751                 },
3752                 .arpns = {
3753                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3754                         .len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3755                         .mode = suspend,
3756                 },
3757         };
3758
3759         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
3760                                  sizeof(req), true);
3761 }
3762
3763 void mt7615_mcu_set_suspend_iter(void *priv, u8 *mac,
3764                                  struct ieee80211_vif *vif)
3765 {
3766         struct mt7615_phy *phy = priv;
3767         bool suspend = test_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
3768         struct ieee80211_hw *hw = phy->mt76->hw;
3769         struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
3770         int i;
3771
3772         mt7615_mcu_set_gtk_rekey(phy->dev, vif, suspend);
3773         mt7615_mcu_set_arp_filter(phy->dev, vif, suspend);
3774
3775         mt7615_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
3776
3777         for (i = 0; i < wowlan->n_patterns; i++)
3778                 mt7615_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
3779                                            &wowlan->patterns[i]);
3780         mt7615_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
3781 }
3782
3783 static void
3784 mt7615_mcu_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3785                     struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
3786                     void *data)
3787 {
3788         struct mt7615_gtk_rekey_tlv *gtk_tlv = data;
3789         u32 cipher;
3790
3791         if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
3792             key->cipher != WLAN_CIPHER_SUITE_CCMP &&
3793             key->cipher != WLAN_CIPHER_SUITE_TKIP)
3794                 return;
3795
3796         if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
3797                 gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
3798                 cipher = BIT(3);
3799         } else {
3800                 gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
3801                 cipher = BIT(4);
3802         }
3803
3804         /* we are assuming here to have a single pairwise key */
3805         if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3806                 gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
3807                 gtk_tlv->group_cipher = cpu_to_le32(cipher);
3808                 gtk_tlv->keyid = key->keyidx;
3809         }
3810 }
3811
3812 int mt7615_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
3813                                 struct ieee80211_vif *vif,
3814                                 struct cfg80211_gtk_rekey_data *key)
3815 {
3816         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3817         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3818         struct mt7615_gtk_rekey_tlv *gtk_tlv;
3819         struct sk_buff *skb;
3820         struct {
3821                 u8 bss_idx;
3822                 u8 pad[3];
3823         } __packed hdr = {
3824                 .bss_idx = mvif->idx,
3825         };
3826
3827         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3828                                  sizeof(hdr) + sizeof(*gtk_tlv));
3829         if (!skb)
3830                 return -ENOMEM;
3831
3832         skb_put_data(skb, &hdr, sizeof(hdr));
3833         gtk_tlv = (struct mt7615_gtk_rekey_tlv *)skb_put(skb,
3834                                                          sizeof(*gtk_tlv));
3835         gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
3836         gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
3837         gtk_tlv->rekey_mode = 2;
3838         gtk_tlv->option = 1;
3839
3840         rcu_read_lock();
3841         ieee80211_iter_keys_rcu(hw, vif, mt7615_mcu_key_iter, gtk_tlv);
3842         rcu_read_unlock();
3843
3844         memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
3845         memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
3846         memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
3847
3848         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
3849                                      true);
3850 }
3851 #endif /* CONFIG_PM */
3852
3853 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3854                        struct ieee80211_channel *chan, int duration)
3855 {
3856         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3857         struct mt7615_dev *dev = phy->dev;
3858         struct mt7615_roc_tlv req = {
3859                 .bss_idx = mvif->idx,
3860                 .active = !chan,
3861                 .max_interval = cpu_to_le32(duration),
3862                 .primary_chan = chan ? chan->hw_value : 0,
3863                 .band = chan ? chan->band : 0,
3864                 .req_type = 2,
3865         };
3866
3867         phy->roc_grant = false;
3868
3869         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
3870                                  sizeof(req), false);
3871 }
3872
3873 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
3874                                  struct ieee80211_vif *vif,
3875                                  struct ieee80211_bss_conf *info)
3876 {
3877         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3878         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3879         struct sk_buff *skb;
3880         int i, len = min_t(int, info->arp_addr_cnt,
3881                            IEEE80211_BSS_ARP_ADDR_LIST_LEN);
3882         struct {
3883                 struct {
3884                         u8 bss_idx;
3885                         u8 pad[3];
3886                 } __packed hdr;
3887                 struct mt7615_arpns_tlv arp;
3888         } req_hdr = {
3889                 .hdr = {
3890                         .bss_idx = mvif->idx,
3891                 },
3892                 .arp = {
3893                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3894                         .len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3895                         .ips_num = len,
3896                         .mode = 2,  /* update */
3897                         .option = 1,
3898                 },
3899         };
3900
3901         if (!mt7615_firmware_offload(dev))
3902                 return 0;
3903
3904         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3905                                  sizeof(req_hdr) + len * sizeof(__be32));
3906         if (!skb)
3907                 return -ENOMEM;
3908
3909         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
3910         for (i = 0; i < len; i++) {
3911                 u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
3912
3913                 memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
3914         }
3915
3916         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
3917                                      true);
3918 }
3919
3920 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
3921                              struct ieee80211_vif *vif)
3922 {
3923         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3924         int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
3925         struct mt7615_dev *dev = mt7615_hw_dev(hw);
3926         struct {
3927                 __le32 ct_win;
3928                 u8 bss_idx;
3929                 u8 rsv[3];
3930         } __packed req = {
3931                 .ct_win = cpu_to_le32(ct_window),
3932                 .bss_idx = mvif->idx,
3933         };
3934
3935         if (!mt7615_firmware_offload(dev))
3936                 return -ENOTSUPP;
3937
3938         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
3939                                  sizeof(req), false);
3940 }
3941
3942 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
3943 {
3944         struct {
3945                 __le32 addr;
3946                 __le32 val;
3947         } __packed req = {
3948                 .addr = cpu_to_le32(offset),
3949         };
3950
3951         return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
3952                                  true);
3953 }
3954 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
3955
3956 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
3957 {
3958         struct {
3959                 __le32 addr;
3960                 __le32 val;
3961         } __packed req = {
3962                 .addr = cpu_to_le32(offset),
3963                 .val = cpu_to_le32(val),
3964         };
3965
3966         mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
3967 }
3968 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);