1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
75 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
76 
77 #define DL_MODE_ENCRYPT			BIT(0)
78 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
79 #define DL_MODE_RESET_SEC_IV		BIT(3)
80 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
82 #define DL_MODE_NEED_RSP		BIT(31)
83 
84 #define FW_START_OVERRIDE		BIT(0)
85 #define FW_START_WORKING_PDA_CR4	BIT(2)
86 
87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
88 			 int cmd, int *wait_seq)
89 {
90 	int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
91 	struct mt7615_uni_txd *uni_txd;
92 	struct mt7615_mcu_txd *mcu_txd;
93 	u8 seq, q_idx, pkt_fmt;
94 	__le32 *txd;
95 	u32 val;
96 
97 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
98 	if (!seq)
99 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
100 	if (wait_seq)
101 		*wait_seq = seq;
102 
103 	txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
104 	txd = (__le32 *)skb_push(skb, txd_len);
105 
106 	if (cmd != MCU_CMD_FW_SCATTER) {
107 		q_idx = MT_TX_MCU_PORT_RX_Q0;
108 		pkt_fmt = MT_TX_TYPE_CMD;
109 	} else {
110 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
111 		pkt_fmt = MT_TX_TYPE_FW;
112 	}
113 
114 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
115 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
116 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
117 	txd[0] = cpu_to_le32(val);
118 
119 	val = MT_TXD1_LONG_FORMAT |
120 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
121 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
122 	txd[1] = cpu_to_le32(val);
123 
124 	if (cmd & MCU_UNI_PREFIX) {
125 		uni_txd = (struct mt7615_uni_txd *)txd;
126 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
127 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
128 		uni_txd->cid = cpu_to_le16(mcu_cmd);
129 		uni_txd->s2d_index = MCU_S2D_H2N;
130 		uni_txd->pkt_type = MCU_PKT_ID;
131 		uni_txd->seq = seq;
132 
133 		return;
134 	}
135 
136 	mcu_txd = (struct mt7615_mcu_txd *)txd;
137 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
138 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
139 	mcu_txd->s2d_index = MCU_S2D_H2N;
140 	mcu_txd->pkt_type = MCU_PKT_ID;
141 	mcu_txd->seq = seq;
142 
143 	switch (cmd & ~MCU_CMD_MASK) {
144 	case MCU_FW_PREFIX:
145 		mcu_txd->set_query = MCU_Q_NA;
146 		mcu_txd->cid = mcu_cmd;
147 		break;
148 	case MCU_CE_PREFIX:
149 		mcu_txd->set_query = MCU_Q_SET;
150 		mcu_txd->cid = mcu_cmd;
151 		break;
152 	default:
153 		mcu_txd->cid = MCU_CMD_EXT_CID;
154 		mcu_txd->set_query = MCU_Q_SET;
155 		mcu_txd->ext_cid = cmd;
156 		mcu_txd->ext_cid_ack = 1;
157 		break;
158 	}
159 }
160 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
161 
162 static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
163 				 int cmd, int *wait_seq)
164 {
165 	enum mt76_txq_id qid;
166 
167 	mt7615_mcu_fill_msg(dev, skb, cmd, wait_seq);
168 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
169 		qid = MT_TXQ_MCU;
170 	else
171 		qid = MT_TXQ_FWDL;
172 
173 	return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
174 }
175 
176 static int
177 mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
178 			  struct sk_buff *skb, int seq)
179 {
180 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
181 	int ret = 0;
182 
183 	if (seq != rxd->seq)
184 		return -EAGAIN;
185 
186 	switch (cmd) {
187 	case MCU_CMD_PATCH_SEM_CONTROL:
188 		skb_pull(skb, sizeof(*rxd) - 4);
189 		ret = *skb->data;
190 		break;
191 	case MCU_EXT_CMD_GET_TEMP:
192 		skb_pull(skb, sizeof(*rxd));
193 		ret = le32_to_cpu(*(__le32 *)skb->data);
194 		break;
195 	case MCU_UNI_CMD_DEV_INFO_UPDATE:
196 	case MCU_UNI_CMD_BSS_INFO_UPDATE:
197 	case MCU_UNI_CMD_STA_REC_UPDATE:
198 	case MCU_UNI_CMD_HIF_CTRL:
199 	case MCU_UNI_CMD_OFFLOAD:
200 	case MCU_UNI_CMD_SUSPEND: {
201 		struct mt7615_mcu_uni_event *event;
202 
203 		skb_pull(skb, sizeof(*rxd));
204 		event = (struct mt7615_mcu_uni_event *)skb->data;
205 		ret = le32_to_cpu(event->status);
206 		break;
207 	}
208 	default:
209 		break;
210 	}
211 	dev_kfree_skb(skb);
212 
213 	return ret;
214 }
215 
216 int mt7615_mcu_wait_response(struct mt7615_dev *dev, int cmd, int seq)
217 {
218 	unsigned long expires = jiffies + 20 * HZ;
219 	struct sk_buff *skb;
220 	int ret = 0;
221 
222 	while (true) {
223 		skb = mt76_mcu_get_response(&dev->mt76, expires);
224 		if (!skb) {
225 			dev_err(dev->mt76.dev, "Message %ld (seq %d) timeout\n",
226 				cmd & MCU_CMD_MASK, seq);
227 			return -ETIMEDOUT;
228 		}
229 
230 		ret = mt7615_mcu_parse_response(dev, cmd, skb, seq);
231 		if (ret != -EAGAIN)
232 			break;
233 	}
234 
235 	return ret;
236 }
237 EXPORT_SYMBOL_GPL(mt7615_mcu_wait_response);
238 
239 static int
240 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
241 			int cmd, bool wait_resp)
242 {
243 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
244 	int ret, seq;
245 
246 	mutex_lock(&mdev->mcu.mutex);
247 
248 	ret = __mt7615_mcu_msg_send(dev, skb, cmd, &seq);
249 	if (ret)
250 		goto out;
251 
252 	if (wait_resp)
253 		ret = mt7615_mcu_wait_response(dev, cmd, seq);
254 
255 out:
256 	mutex_unlock(&mdev->mcu.mutex);
257 
258 	return ret;
259 }
260 
261 int mt7615_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
262 			int len, bool wait_resp)
263 {
264 	struct sk_buff *skb;
265 
266 	skb = mt76_mcu_msg_alloc(mdev, data, len);
267 	if (!skb)
268 		return -ENOMEM;
269 
270 	return __mt76_mcu_skb_send_msg(mdev, skb, cmd, wait_resp);
271 }
272 EXPORT_SYMBOL_GPL(mt7615_mcu_msg_send);
273 
274 static void
275 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
276 {
277 	if (vif->csa_active)
278 		ieee80211_csa_finish(vif);
279 }
280 
281 static void
282 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
283 {
284 	struct mt76_phy *mphy = &dev->mt76.phy;
285 	struct mt7615_mcu_rdd_report *r;
286 
287 	r = (struct mt7615_mcu_rdd_report *)skb->data;
288 
289 	if (r->idx && dev->mt76.phy2)
290 		mphy = dev->mt76.phy2;
291 
292 	ieee80211_radar_detected(mphy->hw);
293 	dev->hw_pattern++;
294 }
295 
296 static void
297 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
298 {
299 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
300 	const char *data = (char *)&rxd[1];
301 	const char *type;
302 
303 	switch (rxd->s2d_index) {
304 	case 0:
305 		type = "N9";
306 		break;
307 	case 2:
308 		type = "CR4";
309 		break;
310 	default:
311 		type = "unknown";
312 		break;
313 	}
314 
315 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
316 }
317 
318 static void
319 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
320 {
321 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
322 
323 	switch (rxd->ext_eid) {
324 	case MCU_EXT_EVENT_RDD_REPORT:
325 		mt7615_mcu_rx_radar_detected(dev, skb);
326 		break;
327 	case MCU_EXT_EVENT_CSA_NOTIFY:
328 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
329 				IEEE80211_IFACE_ITER_RESUME_ALL,
330 				mt7615_mcu_csa_finish, dev);
331 		break;
332 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
333 		mt7615_mcu_rx_log_message(dev, skb);
334 		break;
335 	default:
336 		break;
337 	}
338 }
339 
340 static void
341 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
342 {
343 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
344 	struct mt7615_phy *phy;
345 	struct mt76_phy *mphy;
346 
347 	if (*seq_num & BIT(7) && dev->mt76.phy2)
348 		mphy = dev->mt76.phy2;
349 	else
350 		mphy = &dev->mt76.phy;
351 
352 	phy = (struct mt7615_phy *)mphy->priv;
353 
354 	spin_lock_bh(&dev->mt76.lock);
355 	__skb_queue_tail(&phy->scan_event_list, skb);
356 	spin_unlock_bh(&dev->mt76.lock);
357 
358 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
359 				     MT7615_HW_SCAN_TIMEOUT);
360 }
361 
362 static void
363 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
364 {
365 	struct mt7615_roc_tlv *event;
366 	struct mt7615_phy *phy;
367 	struct mt76_phy *mphy;
368 	int duration;
369 
370 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
371 	event = (struct mt7615_roc_tlv *)skb->data;
372 
373 	if (event->dbdc_band && dev->mt76.phy2)
374 		mphy = dev->mt76.phy2;
375 	else
376 		mphy = &dev->mt76.phy;
377 
378 	ieee80211_ready_on_channel(mphy->hw);
379 
380 	phy = (struct mt7615_phy *)mphy->priv;
381 	phy->roc_grant = true;
382 	wake_up(&phy->roc_wait);
383 
384 	duration = le32_to_cpu(event->max_interval);
385 	mod_timer(&phy->roc_timer,
386 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
387 }
388 
389 static void
390 mt7615_mcu_beacon_loss_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
391 {
392 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
393 	struct mt7615_beacon_loss_event *event = priv;
394 
395 	if (mvif->idx != event->bss_idx)
396 		return;
397 
398 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
399 		return;
400 
401 	ieee80211_beacon_loss(vif);
402 }
403 
404 static void
405 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
406 {
407 	struct mt7615_beacon_loss_event *event;
408 	struct mt76_phy *mphy;
409 	u8 band_idx = 0; /* DBDC support */
410 
411 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
412 	event = (struct mt7615_beacon_loss_event *)skb->data;
413 	if (band_idx && dev->mt76.phy2)
414 		mphy = dev->mt76.phy2;
415 	else
416 		mphy = &dev->mt76.phy;
417 
418 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
419 					IEEE80211_IFACE_ITER_RESUME_ALL,
420 					mt7615_mcu_beacon_loss_iter, event);
421 }
422 
423 static void
424 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
425 {
426 	struct mt7615_mcu_bss_event *event;
427 	struct mt76_phy *mphy;
428 	u8 band_idx = 0; /* DBDC support */
429 
430 	event = (struct mt7615_mcu_bss_event *)(skb->data +
431 						sizeof(struct mt7615_mcu_rxd));
432 
433 	if (band_idx && dev->mt76.phy2)
434 		mphy = dev->mt76.phy2;
435 	else
436 		mphy = &dev->mt76.phy;
437 
438 	if (event->is_absent)
439 		ieee80211_stop_queues(mphy->hw);
440 	else
441 		ieee80211_wake_queues(mphy->hw);
442 }
443 
444 static void
445 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
446 {
447 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
448 
449 	switch (rxd->eid) {
450 	case MCU_EVENT_EXT:
451 		mt7615_mcu_rx_ext_event(dev, skb);
452 		break;
453 	case MCU_EVENT_BSS_BEACON_LOSS:
454 		mt7615_mcu_beacon_loss_event(dev, skb);
455 		break;
456 	case MCU_EVENT_ROC:
457 		mt7615_mcu_roc_event(dev, skb);
458 		break;
459 	case MCU_EVENT_SCHED_SCAN_DONE:
460 	case MCU_EVENT_SCAN_DONE:
461 		mt7615_mcu_scan_event(dev, skb);
462 		return;
463 	case MCU_EVENT_BSS_ABSENCE:
464 		mt7615_mcu_bss_event(dev, skb);
465 		break;
466 	default:
467 		break;
468 	}
469 	dev_kfree_skb(skb);
470 }
471 
472 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
473 {
474 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
475 
476 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
477 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
478 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
479 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
480 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
481 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
482 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
483 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
484 	    rxd->eid == MCU_EVENT_ROC ||
485 	    !rxd->seq)
486 		mt7615_mcu_rx_unsolicited_event(dev, skb);
487 	else
488 		mt76_mcu_rx_event(&dev->mt76, skb);
489 }
490 
491 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
492 				    u32 len, u32 mode)
493 {
494 	struct {
495 		__le32 addr;
496 		__le32 len;
497 		__le32 mode;
498 	} req = {
499 		.addr = cpu_to_le32(addr),
500 		.len = cpu_to_le32(len),
501 		.mode = cpu_to_le32(mode),
502 	};
503 
504 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TARGET_ADDRESS_LEN_REQ,
505 				   &req, sizeof(req), true);
506 }
507 
508 static int
509 mt7615_mcu_add_dev(struct mt7615_dev *dev, struct ieee80211_vif *vif,
510 		   bool enable)
511 {
512 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
513 	struct {
514 		struct req_hdr {
515 			u8 omac_idx;
516 			u8 band_idx;
517 			__le16 tlv_num;
518 			u8 is_tlv_append;
519 			u8 rsv[3];
520 		} __packed hdr;
521 		struct req_tlv {
522 			__le16 tag;
523 			__le16 len;
524 			u8 active;
525 			u8 band_idx;
526 			u8 omac_addr[ETH_ALEN];
527 		} __packed tlv;
528 	} data = {
529 		.hdr = {
530 			.omac_idx = mvif->omac_idx,
531 			.band_idx = mvif->band_idx,
532 			.tlv_num = cpu_to_le16(1),
533 			.is_tlv_append = 1,
534 		},
535 		.tlv = {
536 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
537 			.len = cpu_to_le16(sizeof(struct req_tlv)),
538 			.active = enable,
539 			.band_idx = mvif->band_idx,
540 		},
541 	};
542 
543 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
544 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
545 				   &data, sizeof(data), true);
546 }
547 
548 static int
549 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
550 			      struct ieee80211_hw *hw,
551 			      struct ieee80211_vif *vif, bool enable)
552 {
553 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
554 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
555 	struct ieee80211_mutable_offsets offs;
556 	struct ieee80211_tx_info *info;
557 	struct req {
558 		u8 omac_idx;
559 		u8 enable;
560 		u8 wlan_idx;
561 		u8 band_idx;
562 		u8 pkt_type;
563 		u8 need_pre_tbtt_int;
564 		__le16 csa_ie_pos;
565 		__le16 pkt_len;
566 		__le16 tim_ie_pos;
567 		u8 pkt[512];
568 		u8 csa_cnt;
569 		/* bss color change */
570 		u8 bcc_cnt;
571 		__le16 bcc_ie_pos;
572 	} __packed req = {
573 		.omac_idx = mvif->omac_idx,
574 		.enable = enable,
575 		.wlan_idx = wcid->idx,
576 		.band_idx = mvif->band_idx,
577 	};
578 	struct sk_buff *skb;
579 
580 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
581 	if (!skb)
582 		return -EINVAL;
583 
584 	if (skb->len > 512 - MT_TXD_SIZE) {
585 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
586 		dev_kfree_skb(skb);
587 		return -EINVAL;
588 	}
589 
590 	if (mvif->band_idx) {
591 		info = IEEE80211_SKB_CB(skb);
592 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
593 	}
594 
595 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
596 			      0, NULL, true);
597 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
598 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
599 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
600 	if (offs.csa_counter_offs[0]) {
601 		u16 csa_offs;
602 
603 		csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
604 		req.csa_ie_pos = cpu_to_le16(csa_offs);
605 		req.csa_cnt = skb->data[offs.csa_counter_offs[0]];
606 	}
607 	dev_kfree_skb(skb);
608 
609 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD,
610 				   &req, sizeof(req), true);
611 }
612 
613 static int
614 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
615 {
616 #define ENTER_PM_STATE	1
617 #define EXIT_PM_STATE	2
618 	struct {
619 		u8 pm_number;
620 		u8 pm_state;
621 		u8 bssid[ETH_ALEN];
622 		u8 dtim_period;
623 		u8 wlan_idx;
624 		__le16 bcn_interval;
625 		__le32 aid;
626 		__le32 rx_filter;
627 		u8 band_idx;
628 		u8 rsv[3];
629 		__le32 feature;
630 		u8 omac_idx;
631 		u8 wmm_idx;
632 		u8 bcn_loss_cnt;
633 		u8 bcn_sp_duration;
634 	} __packed req = {
635 		.pm_number = 5,
636 		.pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
637 		.band_idx = band,
638 	};
639 
640 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
641 				   &req, sizeof(req), true);
642 }
643 
644 static struct sk_buff *
645 mt7615_mcu_alloc_sta_req(struct mt7615_dev *dev, struct mt7615_vif *mvif,
646 			 struct mt7615_sta *msta)
647 {
648 	struct sta_req_hdr hdr = {
649 		.bss_idx = mvif->idx,
650 		.wlan_idx = msta ? msta->wcid.idx : 0,
651 		.muar_idx = msta ? mvif->omac_idx : 0,
652 		.is_tlv_append = 1,
653 	};
654 	struct sk_buff *skb;
655 
656 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7615_STA_UPDATE_MAX_SIZE);
657 	if (!skb)
658 		return ERR_PTR(-ENOMEM);
659 
660 	skb_put_data(skb, &hdr, sizeof(hdr));
661 
662 	return skb;
663 }
664 
665 static struct wtbl_req_hdr *
666 mt7615_mcu_alloc_wtbl_req(struct mt7615_dev *dev, struct mt7615_sta *msta,
667 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
668 {
669 	struct tlv *sta_hdr = sta_wtbl;
670 	struct wtbl_req_hdr hdr = {
671 		.wlan_idx = msta->wcid.idx,
672 		.operation = cmd,
673 	};
674 	struct sk_buff *nskb = *skb;
675 
676 	if (!nskb) {
677 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
678 					  MT7615_WTBL_UPDATE_BA_SIZE);
679 		if (!nskb)
680 			return ERR_PTR(-ENOMEM);
681 
682 		*skb = nskb;
683 	}
684 
685 	if (sta_hdr)
686 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
687 
688 	return skb_put_data(nskb, &hdr, sizeof(hdr));
689 }
690 
691 static struct tlv *
692 mt7615_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
693 			  void *sta_ntlv, void *sta_wtbl)
694 {
695 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
696 	struct tlv *sta_hdr = sta_wtbl;
697 	struct tlv *ptlv, tlv = {
698 		.tag = cpu_to_le16(tag),
699 		.len = cpu_to_le16(len),
700 	};
701 	u16 ntlv;
702 
703 	ptlv = skb_put(skb, len);
704 	memcpy(ptlv, &tlv, sizeof(tlv));
705 
706 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
707 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
708 
709 	if (sta_hdr) {
710 		u16 size = le16_to_cpu(sta_hdr->len);
711 
712 		sta_hdr->len = cpu_to_le16(size + len);
713 	}
714 
715 	return ptlv;
716 }
717 
718 static struct tlv *
719 mt7615_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
720 {
721 	return mt7615_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
722 }
723 
724 static int
725 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
726 			 struct ieee80211_sta *sta, bool enable)
727 {
728 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
729 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
730 	struct bss_info_basic *bss;
731 	u8 wlan_idx = mvif->sta.wcid.idx;
732 	struct tlv *tlv;
733 
734 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
735 
736 	switch (vif->type) {
737 	case NL80211_IFTYPE_MESH_POINT:
738 	case NL80211_IFTYPE_AP:
739 		break;
740 	case NL80211_IFTYPE_STATION:
741 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
742 		if (enable && sta) {
743 			struct mt7615_sta *msta;
744 
745 			msta = (struct mt7615_sta *)sta->drv_priv;
746 			wlan_idx = msta->wcid.idx;
747 		}
748 		break;
749 	case NL80211_IFTYPE_ADHOC:
750 		type = NETWORK_IBSS;
751 		break;
752 	default:
753 		WARN_ON(1);
754 		break;
755 	}
756 
757 	bss = (struct bss_info_basic *)tlv;
758 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
759 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
760 	bss->network_type = cpu_to_le32(type);
761 	bss->dtim_period = vif->bss_conf.dtim_period;
762 	bss->bmc_tx_wlan_idx = wlan_idx;
763 	bss->wmm_idx = mvif->wmm_idx;
764 	bss->active = enable;
765 
766 	return 0;
767 }
768 
769 static void
770 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
771 {
772 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
773 	struct bss_info_omac *omac;
774 	struct tlv *tlv;
775 	u32 type = 0;
776 	u8 idx;
777 
778 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
779 
780 	switch (vif->type) {
781 	case NL80211_IFTYPE_MESH_POINT:
782 	case NL80211_IFTYPE_AP:
783 		if (vif->p2p)
784 			type = CONNECTION_P2P_GO;
785 		else
786 			type = CONNECTION_INFRA_AP;
787 		break;
788 	case NL80211_IFTYPE_STATION:
789 		if (vif->p2p)
790 			type = CONNECTION_P2P_GC;
791 		else
792 			type = CONNECTION_INFRA_STA;
793 		break;
794 	case NL80211_IFTYPE_ADHOC:
795 		type = CONNECTION_IBSS_ADHOC;
796 		break;
797 	default:
798 		WARN_ON(1);
799 		break;
800 	}
801 
802 	omac = (struct bss_info_omac *)tlv;
803 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
804 	omac->conn_type = cpu_to_le32(type);
805 	omac->omac_idx = mvif->omac_idx;
806 	omac->band_idx = mvif->band_idx;
807 	omac->hw_bss_idx = idx;
808 }
809 
810 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
811 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
812 static void
813 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
814 {
815 	struct bss_info_ext_bss *ext;
816 	int ext_bss_idx, tsf_offset;
817 	struct tlv *tlv;
818 
819 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
820 	if (ext_bss_idx < 0)
821 		return;
822 
823 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
824 
825 	ext = (struct bss_info_ext_bss *)tlv;
826 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
827 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
828 }
829 
830 static void
831 mt7615_mcu_sta_ba_tlv(struct sk_buff *skb,
832 		      struct ieee80211_ampdu_params *params,
833 		      bool enable, bool tx)
834 {
835 	struct sta_rec_ba *ba;
836 	struct tlv *tlv;
837 
838 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
839 
840 	ba = (struct sta_rec_ba *)tlv;
841 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
842 	ba->winsize = cpu_to_le16(params->buf_size);
843 	ba->ssn = cpu_to_le16(params->ssn);
844 	ba->ba_en = enable << params->tid;
845 	ba->amsdu = params->amsdu;
846 	ba->tid = params->tid;
847 }
848 
849 static void
850 mt7615_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
851 			 struct ieee80211_sta *sta, bool enable)
852 {
853 	struct sta_rec_basic *basic;
854 	struct tlv *tlv;
855 	int conn_type;
856 
857 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
858 
859 	basic = (struct sta_rec_basic *)tlv;
860 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
861 
862 	if (enable) {
863 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
864 		basic->conn_state = CONN_STATE_PORT_SECURE;
865 	} else {
866 		basic->conn_state = CONN_STATE_DISCONNECT;
867 	}
868 
869 	if (!sta) {
870 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
871 		eth_broadcast_addr(basic->peer_addr);
872 		return;
873 	}
874 
875 	switch (vif->type) {
876 	case NL80211_IFTYPE_MESH_POINT:
877 	case NL80211_IFTYPE_AP:
878 		if (vif->p2p)
879 			conn_type = CONNECTION_P2P_GC;
880 		else
881 			conn_type = CONNECTION_INFRA_STA;
882 		basic->conn_type = cpu_to_le32(conn_type);
883 		basic->aid = cpu_to_le16(sta->aid);
884 		break;
885 	case NL80211_IFTYPE_STATION:
886 		if (vif->p2p)
887 			conn_type = CONNECTION_P2P_GO;
888 		else
889 			conn_type = CONNECTION_INFRA_AP;
890 		basic->conn_type = cpu_to_le32(conn_type);
891 		basic->aid = cpu_to_le16(vif->bss_conf.aid);
892 		break;
893 	case NL80211_IFTYPE_ADHOC:
894 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
895 		basic->aid = cpu_to_le16(sta->aid);
896 		break;
897 	default:
898 		WARN_ON(1);
899 		break;
900 	}
901 
902 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
903 	basic->qos = sta->wme;
904 }
905 
906 static void
907 mt7615_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
908 {
909 	struct tlv *tlv;
910 
911 	if (sta->ht_cap.ht_supported) {
912 		struct sta_rec_ht *ht;
913 
914 		tlv = mt7615_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
915 		ht = (struct sta_rec_ht *)tlv;
916 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
917 	}
918 	if (sta->vht_cap.vht_supported) {
919 		struct sta_rec_vht *vht;
920 
921 		tlv = mt7615_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
922 		vht = (struct sta_rec_vht *)tlv;
923 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
924 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
925 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
926 	}
927 }
928 
929 static void
930 mt7615_mcu_wtbl_ba_tlv(struct sk_buff *skb,
931 		       struct ieee80211_ampdu_params *params,
932 		       bool enable, bool tx, void *sta_wtbl,
933 		       void *wtbl_tlv)
934 {
935 	struct wtbl_ba *ba;
936 	struct tlv *tlv;
937 
938 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
939 					wtbl_tlv, sta_wtbl);
940 
941 	ba = (struct wtbl_ba *)tlv;
942 	ba->tid = params->tid;
943 
944 	if (tx) {
945 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
946 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
947 		ba->ba_winsize = cpu_to_le16(params->buf_size);
948 		ba->ba_en = enable;
949 	} else {
950 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
951 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
952 		ba->rst_ba_tid = params->tid;
953 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
954 		ba->rst_ba_sb = 1;
955 	}
956 
957 	if (enable && tx) {
958 		u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
959 		int i;
960 
961 		for (i = 7; i > 0; i--) {
962 			if (params->buf_size >= ba_range[i])
963 				break;
964 		}
965 		ba->ba_winsize_idx = i;
966 	}
967 }
968 
969 static void
970 mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
971 			    struct ieee80211_sta *sta, void *sta_wtbl,
972 			    void *wtbl_tlv)
973 {
974 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
975 	struct wtbl_generic *generic;
976 	struct wtbl_rx *rx;
977 	struct wtbl_spe *spe;
978 	struct tlv *tlv;
979 
980 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
981 					wtbl_tlv, sta_wtbl);
982 
983 	generic = (struct wtbl_generic *)tlv;
984 
985 	if (sta) {
986 		if (vif->type == NL80211_IFTYPE_STATION)
987 			generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
988 		else
989 			generic->partial_aid = cpu_to_le16(sta->aid);
990 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
991 		generic->muar_idx = mvif->omac_idx;
992 		generic->qos = sta->wme;
993 	} else {
994 		eth_broadcast_addr(generic->peer_addr);
995 		generic->muar_idx = 0xe;
996 	}
997 
998 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
999 					wtbl_tlv, sta_wtbl);
1000 
1001 	rx = (struct wtbl_rx *)tlv;
1002 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1003 	rx->rca2 = 1;
1004 	rx->rv = 1;
1005 
1006 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
1007 					wtbl_tlv, sta_wtbl);
1008 	spe = (struct wtbl_spe *)tlv;
1009 	spe->spe_idx = 24;
1010 }
1011 
1012 static void
1013 mt7615_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1014 		       void *sta_wtbl, void *wtbl_tlv)
1015 {
1016 	struct tlv *tlv;
1017 	struct wtbl_ht *ht = NULL;
1018 	u32 flags = 0;
1019 
1020 	if (sta->ht_cap.ht_supported) {
1021 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1022 						wtbl_tlv, sta_wtbl);
1023 		ht = (struct wtbl_ht *)tlv;
1024 		ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
1025 		ht->af = sta->ht_cap.ampdu_factor;
1026 		ht->mm = sta->ht_cap.ampdu_density;
1027 		ht->ht = 1;
1028 
1029 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1030 			flags |= MT_WTBL_W5_SHORT_GI_20;
1031 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1032 			flags |= MT_WTBL_W5_SHORT_GI_40;
1033 	}
1034 
1035 	if (sta->vht_cap.vht_supported) {
1036 		struct wtbl_vht *vht;
1037 		u8 af;
1038 
1039 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1040 						wtbl_tlv, sta_wtbl);
1041 		vht = (struct wtbl_vht *)tlv;
1042 		vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC,
1043 		vht->vht = 1;
1044 
1045 		af = (sta->vht_cap.cap &
1046 		      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
1047 		      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
1048 
1049 		if (ht)
1050 		    ht->af = max(ht->af, af);
1051 
1052 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1053 			flags |= MT_WTBL_W5_SHORT_GI_80;
1054 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1055 			flags |= MT_WTBL_W5_SHORT_GI_160;
1056 	}
1057 
1058 	/* wtbl smps */
1059 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1060 		struct wtbl_smps *smps;
1061 
1062 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1063 						wtbl_tlv, sta_wtbl);
1064 		smps = (struct wtbl_smps *)tlv;
1065 		smps->smps = 1;
1066 	}
1067 
1068 	if (sta->ht_cap.ht_supported) {
1069 		/* sgi */
1070 		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1071 			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1072 		struct wtbl_raw *raw;
1073 
1074 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
1075 						sizeof(*raw), wtbl_tlv,
1076 						sta_wtbl);
1077 		raw = (struct wtbl_raw *)tlv;
1078 		raw->val = cpu_to_le32(flags);
1079 		raw->msk = cpu_to_le32(~msk);
1080 		raw->wtbl_idx = 1;
1081 		raw->dw = 5;
1082 	}
1083 }
1084 
1085 static int
1086 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1087 		   struct ieee80211_sta *sta, bool enable)
1088 {
1089 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1090 	struct mt7615_dev *dev = phy->dev;
1091 	struct sk_buff *skb;
1092 
1093 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, NULL);
1094 	if (IS_ERR(skb))
1095 		return PTR_ERR(skb);
1096 
1097 	if (enable)
1098 		mt7615_mcu_bss_omac_tlv(skb, vif);
1099 
1100 	mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
1101 
1102 	if (enable && mvif->omac_idx > EXT_BSSID_START)
1103 		mt7615_mcu_bss_ext_tlv(skb, mvif);
1104 
1105 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1106 				       MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1107 }
1108 
1109 static int
1110 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
1111 		      struct ieee80211_ampdu_params *params,
1112 		      bool enable)
1113 {
1114 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1115 	struct mt7615_vif *mvif = msta->vif;
1116 	struct wtbl_req_hdr *wtbl_hdr;
1117 	struct sk_buff *skb = NULL;
1118 	int err;
1119 
1120 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1121 	if (IS_ERR(wtbl_hdr))
1122 		return PTR_ERR(wtbl_hdr);
1123 
1124 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, NULL, wtbl_hdr);
1125 
1126 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1127 				      MCU_EXT_CMD_WTBL_UPDATE, true);
1128 	if (err < 0)
1129 		return err;
1130 
1131 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1132 	if (IS_ERR(skb))
1133 		return PTR_ERR(skb);
1134 
1135 	mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1136 
1137 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1138 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1139 }
1140 
1141 static int
1142 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
1143 		      struct ieee80211_ampdu_params *params,
1144 		      bool enable)
1145 {
1146 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1147 	struct mt7615_vif *mvif = msta->vif;
1148 	struct wtbl_req_hdr *wtbl_hdr;
1149 	struct sk_buff *skb;
1150 	int err;
1151 
1152 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1153 	if (IS_ERR(skb))
1154 		return PTR_ERR(skb);
1155 
1156 	mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1157 
1158 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1159 				      MCU_EXT_CMD_STA_REC_UPDATE, true);
1160 	if (err < 0 || !enable)
1161 		return err;
1162 
1163 	skb = NULL;
1164 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1165 	if (IS_ERR(wtbl_hdr))
1166 		return PTR_ERR(wtbl_hdr);
1167 
1168 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, NULL, wtbl_hdr);
1169 
1170 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1171 				       MCU_EXT_CMD_WTBL_UPDATE, true);
1172 }
1173 
1174 static int
1175 mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1176 			struct ieee80211_sta *sta, bool enable)
1177 {
1178 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1179 	struct sk_buff *skb, *sskb, *wskb = NULL;
1180 	struct wtbl_req_hdr *wtbl_hdr;
1181 	struct mt7615_sta *msta;
1182 	int cmd, err;
1183 
1184 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1185 
1186 	sskb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1187 	if (IS_ERR(sskb))
1188 		return PTR_ERR(sskb);
1189 
1190 	mt7615_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1191 	if (enable && sta)
1192 		mt7615_mcu_sta_ht_tlv(sskb, sta);
1193 
1194 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1195 					     NULL, &wskb);
1196 	if (IS_ERR(wtbl_hdr))
1197 		return PTR_ERR(wtbl_hdr);
1198 
1199 	if (enable) {
1200 		mt7615_mcu_wtbl_generic_tlv(wskb, vif, sta, NULL, wtbl_hdr);
1201 		if (sta)
1202 			mt7615_mcu_wtbl_ht_tlv(wskb, sta, NULL, wtbl_hdr);
1203 	}
1204 
1205 	cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1206 	skb = enable ? wskb : sskb;
1207 
1208 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1209 	if (err < 0)
1210 		return err;
1211 
1212 	cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1213 	skb = enable ? sskb : wskb;
1214 
1215 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1216 }
1217 
1218 static const struct mt7615_mcu_ops wtbl_update_ops = {
1219 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1220 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1221 	.add_dev_info = mt7615_mcu_add_dev,
1222 	.add_bss_info = mt7615_mcu_add_bss,
1223 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1224 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1225 	.sta_add = mt7615_mcu_wtbl_sta_add,
1226 };
1227 
1228 static int
1229 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1230 		  struct ieee80211_ampdu_params *params,
1231 		  bool enable, bool tx)
1232 {
1233 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1234 	struct mt7615_vif *mvif = msta->vif;
1235 	struct wtbl_req_hdr *wtbl_hdr;
1236 	struct tlv *sta_wtbl;
1237 	struct sk_buff *skb;
1238 
1239 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1240 	if (IS_ERR(skb))
1241 		return PTR_ERR(skb);
1242 
1243 	mt7615_mcu_sta_ba_tlv(skb, params, enable, tx);
1244 
1245 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1246 
1247 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1248 					     &skb);
1249 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1250 
1251 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1252 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1253 }
1254 
1255 static int
1256 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1257 		     struct ieee80211_ampdu_params *params,
1258 		     bool enable)
1259 {
1260 	return mt7615_mcu_sta_ba(dev, params, enable, true);
1261 }
1262 
1263 static int
1264 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1265 		     struct ieee80211_ampdu_params *params,
1266 		     bool enable)
1267 {
1268 	return mt7615_mcu_sta_ba(dev, params, enable, false);
1269 }
1270 
1271 static int
1272 mt7615_mcu_add_sta_cmd(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1273 		       struct ieee80211_sta *sta, bool enable, int cmd)
1274 {
1275 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1276 	struct wtbl_req_hdr *wtbl_hdr;
1277 	struct mt7615_sta *msta;
1278 	struct tlv *sta_wtbl;
1279 	struct sk_buff *skb;
1280 
1281 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1282 
1283 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1284 	if (IS_ERR(skb))
1285 		return PTR_ERR(skb);
1286 
1287 	mt7615_mcu_sta_basic_tlv(skb, vif, sta, enable);
1288 	if (enable && sta)
1289 		mt7615_mcu_sta_ht_tlv(skb, sta);
1290 
1291 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1292 
1293 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1294 					     sta_wtbl, &skb);
1295 	if (enable) {
1296 		mt7615_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
1297 		if (sta)
1298 			mt7615_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1299 	}
1300 
1301 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1302 }
1303 
1304 static int
1305 mt7615_mcu_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1306 		   struct ieee80211_sta *sta, bool enable)
1307 {
1308 	return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1309 				      MCU_EXT_CMD_STA_REC_UPDATE);
1310 }
1311 
1312 static const struct mt7615_mcu_ops sta_update_ops = {
1313 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1314 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1315 	.add_dev_info = mt7615_mcu_add_dev,
1316 	.add_bss_info = mt7615_mcu_add_bss,
1317 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1318 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1319 	.sta_add = mt7615_mcu_add_sta,
1320 };
1321 
1322 static int
1323 mt7615_mcu_uni_add_dev(struct mt7615_dev *dev,
1324 		       struct ieee80211_vif *vif, bool enable)
1325 {
1326 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1327 	struct {
1328 		struct {
1329 			u8 omac_idx;
1330 			u8 band_idx;
1331 			__le16 pad;
1332 		} __packed hdr;
1333 		struct req_tlv {
1334 			__le16 tag;
1335 			__le16 len;
1336 			u8 active;
1337 			u8 pad;
1338 			u8 omac_addr[ETH_ALEN];
1339 		} __packed tlv;
1340 	} dev_req = {
1341 		.hdr = {
1342 			.omac_idx = mvif->omac_idx,
1343 			.band_idx = mvif->band_idx,
1344 		},
1345 		.tlv = {
1346 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1347 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1348 			.active = enable,
1349 		},
1350 	};
1351 	struct {
1352 		struct {
1353 			u8 bss_idx;
1354 			u8 pad[3];
1355 		} __packed hdr;
1356 		struct mt7615_bss_basic_tlv basic;
1357 	} basic_req = {
1358 		.hdr = {
1359 			.bss_idx = mvif->idx,
1360 		},
1361 		.basic = {
1362 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1363 			.len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1364 			.omac_idx = mvif->omac_idx,
1365 			.band_idx = mvif->band_idx,
1366 			.wmm_idx = mvif->wmm_idx,
1367 			.active = enable,
1368 			.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx),
1369 			.sta_idx = cpu_to_le16(mvif->sta.wcid.idx),
1370 			.conn_state = 1,
1371 		},
1372 	};
1373 	int err, idx, cmd, len;
1374 	void *data;
1375 
1376 	switch (vif->type) {
1377 	case NL80211_IFTYPE_MESH_POINT:
1378 	case NL80211_IFTYPE_AP:
1379 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1380 		break;
1381 	case NL80211_IFTYPE_STATION:
1382 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1383 		break;
1384 	case NL80211_IFTYPE_ADHOC:
1385 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1386 		break;
1387 	default:
1388 		WARN_ON(1);
1389 		break;
1390 	}
1391 
1392 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1393 	basic_req.basic.hw_bss_idx = idx;
1394 
1395 	memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1396 
1397 	cmd = enable ? MCU_UNI_CMD_DEV_INFO_UPDATE : MCU_UNI_CMD_BSS_INFO_UPDATE;
1398 	data = enable ? (void *)&dev_req : (void *)&basic_req;
1399 	len = enable ? sizeof(dev_req) : sizeof(basic_req);
1400 
1401 	err = __mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1402 	if (err < 0)
1403 		return err;
1404 
1405 	cmd = enable ? MCU_UNI_CMD_BSS_INFO_UPDATE : MCU_UNI_CMD_DEV_INFO_UPDATE;
1406 	data = enable ? (void *)&basic_req : (void *)&dev_req;
1407 	len = enable ? sizeof(basic_req) : sizeof(dev_req);
1408 
1409 	return __mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1410 }
1411 
1412 static int
1413 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1414 {
1415 	return 0;
1416 }
1417 
1418 static int
1419 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1420 		       struct ieee80211_sta *sta, bool enable)
1421 {
1422 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1423 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1424 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1425 	struct mt7615_dev *dev = phy->dev;
1426 	struct {
1427 		struct {
1428 			u8 bss_idx;
1429 			u8 pad[3];
1430 		} __packed hdr;
1431 		struct mt7615_bss_basic_tlv basic;
1432 	} basic_req = {
1433 		.hdr = {
1434 			.bss_idx = mvif->idx,
1435 		},
1436 		.basic = {
1437 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1438 			.len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1439 			.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1440 			.dtim_period = vif->bss_conf.dtim_period,
1441 			.omac_idx = mvif->omac_idx,
1442 			.band_idx = mvif->band_idx,
1443 			.wmm_idx = mvif->wmm_idx,
1444 			.active = true, /* keep bss deactivated */
1445 			.phymode = 0x38,
1446 		},
1447 	};
1448 	struct {
1449 		struct {
1450 			u8 bss_idx;
1451 			u8 pad[3];
1452 		} __packed hdr;
1453 		struct rlm_tlv {
1454 			__le16 tag;
1455 			__le16 len;
1456 			u8 control_channel;
1457 			u8 center_chan;
1458 			u8 center_chan2;
1459 			u8 bw;
1460 			u8 tx_streams;
1461 			u8 rx_streams;
1462 			u8 short_st;
1463 			u8 ht_op_info;
1464 			u8 sco;
1465 			u8 pad[3];
1466 		} __packed rlm;
1467 	} __packed rlm_req = {
1468 		.hdr = {
1469 			.bss_idx = mvif->idx,
1470 		},
1471 		.rlm = {
1472 			.tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1473 			.len = cpu_to_le16(sizeof(struct rlm_tlv)),
1474 			.control_channel = chandef->chan->hw_value,
1475 			.center_chan = ieee80211_frequency_to_channel(freq1),
1476 			.center_chan2 = ieee80211_frequency_to_channel(freq2),
1477 			.tx_streams = hweight8(phy->mt76->antenna_mask),
1478 			.rx_streams = phy->chainmask,
1479 			.short_st = true,
1480 		},
1481 	};
1482 	int err, conn_type;
1483 	u8 idx;
1484 
1485 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1486 	basic_req.basic.hw_bss_idx = idx;
1487 
1488 	switch (vif->type) {
1489 	case NL80211_IFTYPE_MESH_POINT:
1490 	case NL80211_IFTYPE_AP:
1491 		if (vif->p2p)
1492 			conn_type = CONNECTION_P2P_GO;
1493 		else
1494 			conn_type = CONNECTION_INFRA_AP;
1495 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1496 		break;
1497 	case NL80211_IFTYPE_STATION:
1498 		if (vif->p2p)
1499 			conn_type = CONNECTION_P2P_GC;
1500 		else
1501 			conn_type = CONNECTION_INFRA_STA;
1502 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1503 		break;
1504 	case NL80211_IFTYPE_ADHOC:
1505 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1506 		break;
1507 	default:
1508 		WARN_ON(1);
1509 		break;
1510 	}
1511 
1512 	memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1513 	basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx);
1514 	basic_req.basic.sta_idx = cpu_to_le16(mvif->sta.wcid.idx);
1515 	basic_req.basic.conn_state = !enable;
1516 
1517 	err = __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1518 				  &basic_req, sizeof(basic_req), true);
1519 	if (err < 0)
1520 		return err;
1521 
1522 	switch (chandef->width) {
1523 	case NL80211_CHAN_WIDTH_40:
1524 		rlm_req.rlm.bw = CMD_CBW_40MHZ;
1525 		break;
1526 	case NL80211_CHAN_WIDTH_80:
1527 		rlm_req.rlm.bw = CMD_CBW_80MHZ;
1528 		break;
1529 	case NL80211_CHAN_WIDTH_80P80:
1530 		rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1531 		break;
1532 	case NL80211_CHAN_WIDTH_160:
1533 		rlm_req.rlm.bw = CMD_CBW_160MHZ;
1534 		break;
1535 	case NL80211_CHAN_WIDTH_5:
1536 		rlm_req.rlm.bw = CMD_CBW_5MHZ;
1537 		break;
1538 	case NL80211_CHAN_WIDTH_10:
1539 		rlm_req.rlm.bw = CMD_CBW_10MHZ;
1540 		break;
1541 	case NL80211_CHAN_WIDTH_20_NOHT:
1542 	case NL80211_CHAN_WIDTH_20:
1543 	default:
1544 		rlm_req.rlm.bw = CMD_CBW_20MHZ;
1545 		break;
1546 	}
1547 
1548 	if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1549 		rlm_req.rlm.sco = 1; /* SCA */
1550 	else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1551 		rlm_req.rlm.sco = 3; /* SCB */
1552 
1553 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1554 				   &rlm_req, sizeof(rlm_req), true);
1555 }
1556 
1557 static int
1558 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1559 				  struct ieee80211_hw *hw,
1560 				  struct ieee80211_vif *vif,
1561 				  bool enable)
1562 {
1563 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1564 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1565 	struct ieee80211_mutable_offsets offs;
1566 	struct {
1567 		struct req_hdr {
1568 			u8 bss_idx;
1569 			u8 pad[3];
1570 		} __packed hdr;
1571 		struct bcn_content_tlv {
1572 			__le16 tag;
1573 			__le16 len;
1574 			__le16 tim_ie_pos;
1575 			__le16 csa_ie_pos;
1576 			__le16 bcc_ie_pos;
1577 			/* 0: enable beacon offload
1578 			 * 1: disable beacon offload
1579 			 * 2: update probe respond offload
1580 			 */
1581 			u8 enable;
1582 			/* 0: legacy format (TXD + payload)
1583 			 * 1: only cap field IE
1584 			 */
1585 			u8 type;
1586 			__le16 pkt_len;
1587 			u8 pkt[512];
1588 		} __packed beacon_tlv;
1589 	} req = {
1590 		.hdr = {
1591 			.bss_idx = mvif->idx,
1592 		},
1593 		.beacon_tlv = {
1594 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1595 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1596 			.enable = enable,
1597 		},
1598 	};
1599 	struct sk_buff *skb;
1600 
1601 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1602 	if (!skb)
1603 		return -EINVAL;
1604 
1605 	if (skb->len > 512 - MT_TXD_SIZE) {
1606 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1607 		dev_kfree_skb(skb);
1608 		return -EINVAL;
1609 	}
1610 
1611 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1612 			      wcid, NULL, 0, NULL, true);
1613 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1614 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1615 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1616 
1617 	if (offs.csa_counter_offs[0]) {
1618 		u16 csa_offs;
1619 
1620 		csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
1621 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1622 	}
1623 	dev_kfree_skb(skb);
1624 
1625 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1626 				   &req, sizeof(req), true);
1627 }
1628 
1629 static int
1630 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1631 		     struct ieee80211_ampdu_params *params,
1632 		     bool enable)
1633 {
1634 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1635 	struct mt7615_vif *mvif = msta->vif;
1636 	struct wtbl_req_hdr *wtbl_hdr;
1637 	struct tlv *sta_wtbl;
1638 	struct sk_buff *skb;
1639 	int err;
1640 
1641 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1642 	if (IS_ERR(skb))
1643 		return PTR_ERR(skb);
1644 
1645 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1646 
1647 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1648 					     &skb);
1649 	if (IS_ERR(wtbl_hdr))
1650 		return PTR_ERR(wtbl_hdr);
1651 
1652 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, sta_wtbl,
1653 			       wtbl_hdr);
1654 
1655 	err =  __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1656 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1657 	if (err < 0)
1658 		return err;
1659 
1660 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1661 	if (IS_ERR(skb))
1662 		return PTR_ERR(skb);
1663 
1664 	mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1665 
1666 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1667 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1668 }
1669 
1670 static int
1671 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1672 		     struct ieee80211_ampdu_params *params,
1673 		     bool enable)
1674 {
1675 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1676 	struct mt7615_vif *mvif = msta->vif;
1677 	struct wtbl_req_hdr *wtbl_hdr;
1678 	struct tlv *sta_wtbl;
1679 	struct sk_buff *skb;
1680 	int err;
1681 
1682 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1683 	if (IS_ERR(skb))
1684 		return PTR_ERR(skb);
1685 
1686 	mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1687 
1688 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1689 				      MCU_UNI_CMD_STA_REC_UPDATE, true);
1690 	if (err < 0 || !enable)
1691 		return err;
1692 
1693 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1694 	if (IS_ERR(skb))
1695 		return PTR_ERR(skb);
1696 
1697 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1698 
1699 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1700 					     &skb);
1701 	if (IS_ERR(wtbl_hdr))
1702 		return PTR_ERR(wtbl_hdr);
1703 
1704 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, sta_wtbl,
1705 			       wtbl_hdr);
1706 
1707 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1708 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1709 }
1710 
1711 static int
1712 mt7615_mcu_uni_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1713 		       struct ieee80211_sta *sta, bool enable)
1714 {
1715 	return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1716 				      MCU_UNI_CMD_STA_REC_UPDATE);
1717 }
1718 
1719 static const struct mt7615_mcu_ops uni_update_ops = {
1720 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1721 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1722 	.add_dev_info = mt7615_mcu_uni_add_dev,
1723 	.add_bss_info = mt7615_mcu_uni_add_bss,
1724 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1725 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1726 	.sta_add = mt7615_mcu_uni_add_sta,
1727 };
1728 
1729 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
1730 				    int len)
1731 {
1732 	int ret = 0, cur_len;
1733 
1734 	while (len > 0) {
1735 		cur_len = min_t(int, 4096 - dev->mt76.mcu_ops->headroom, len);
1736 
1737 		ret = __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_SCATTER,
1738 					  data, cur_len, false);
1739 		if (ret)
1740 			break;
1741 
1742 		data += cur_len;
1743 		len -= cur_len;
1744 
1745 		if (mt76_is_mmio(&dev->mt76))
1746 			mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
1747 	}
1748 
1749 	return ret;
1750 }
1751 
1752 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
1753 				     u32 option)
1754 {
1755 	struct {
1756 		__le32 option;
1757 		__le32 addr;
1758 	} req = {
1759 		.option = cpu_to_le32(option),
1760 		.addr = cpu_to_le32(addr),
1761 	};
1762 
1763 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_START_REQ,
1764 				   &req, sizeof(req), true);
1765 }
1766 
1767 int mt7615_mcu_restart(struct mt76_dev *dev)
1768 {
1769 	return __mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL,
1770 				   0, true);
1771 }
1772 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1773 
1774 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
1775 {
1776 	struct {
1777 		__le32 op;
1778 	} req = {
1779 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
1780 	};
1781 
1782 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_SEM_CONTROL,
1783 				   &req, sizeof(req), true);
1784 }
1785 
1786 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
1787 {
1788 	struct {
1789 		u8 check_crc;
1790 		u8 reserved[3];
1791 	} req = {
1792 		.check_crc = 0,
1793 	};
1794 
1795 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_FINISH_REQ,
1796 				   &req, sizeof(req), true);
1797 }
1798 
1799 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
1800 {
1801 	if (!is_mt7622(&dev->mt76))
1802 		return;
1803 
1804 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
1805 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
1806 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
1807 }
1808 
1809 int mt7615_driver_own(struct mt7615_dev *dev)
1810 {
1811 	struct mt76_dev *mdev = &dev->mt76;
1812 	u32 addr;
1813 
1814 	addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
1815 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
1816 
1817 	mt7622_trigger_hif_int(dev, true);
1818 
1819 	addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
1820 	if (!mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000)) {
1821 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
1822 		return -EIO;
1823 	}
1824 
1825 	mt7622_trigger_hif_int(dev, false);
1826 
1827 	return 0;
1828 }
1829 EXPORT_SYMBOL_GPL(mt7615_driver_own);
1830 
1831 int mt7615_firmware_own(struct mt7615_dev *dev)
1832 {
1833 	u32 addr;
1834 
1835 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
1836 	mt7622_trigger_hif_int(dev, true);
1837 
1838 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
1839 
1840 	if (!is_mt7615(&dev->mt76) &&
1841 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
1842 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
1843 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
1844 		return -EIO;
1845 	}
1846 	mt7622_trigger_hif_int(dev, false);
1847 
1848 	return 0;
1849 }
1850 EXPORT_SYMBOL_GPL(mt7615_firmware_own);
1851 
1852 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1853 {
1854 	const struct mt7615_patch_hdr *hdr;
1855 	const struct firmware *fw = NULL;
1856 	int len, ret, sem;
1857 
1858 	sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
1859 	switch (sem) {
1860 	case PATCH_IS_DL:
1861 		return 0;
1862 	case PATCH_NOT_DL_SEM_SUCCESS:
1863 		break;
1864 	default:
1865 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1866 		return -EAGAIN;
1867 	}
1868 
1869 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1870 	if (ret)
1871 		goto out;
1872 
1873 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1874 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1875 		ret = -EINVAL;
1876 		goto out;
1877 	}
1878 
1879 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1880 
1881 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1882 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1883 
1884 	len = fw->size - sizeof(*hdr);
1885 
1886 	ret = mt7615_mcu_init_download(dev, addr, len, DL_MODE_NEED_RSP);
1887 	if (ret) {
1888 		dev_err(dev->mt76.dev, "Download request failed\n");
1889 		goto out;
1890 	}
1891 
1892 	ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
1893 	if (ret) {
1894 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1895 		goto out;
1896 	}
1897 
1898 	ret = mt7615_mcu_start_patch(dev);
1899 	if (ret)
1900 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1901 
1902 out:
1903 	release_firmware(fw);
1904 
1905 	sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
1906 	switch (sem) {
1907 	case PATCH_REL_SEM_SUCCESS:
1908 		break;
1909 	default:
1910 		ret = -EAGAIN;
1911 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1912 		break;
1913 	}
1914 
1915 	return ret;
1916 }
1917 
1918 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1919 {
1920 	u32 ret = 0;
1921 
1922 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1923 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1924 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1925 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1926 	ret |= DL_MODE_NEED_RSP;
1927 	ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1928 
1929 	return ret;
1930 }
1931 
1932 static int
1933 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1934 			     const struct mt7615_fw_trailer *hdr,
1935 			     const u8 *data, bool is_cr4)
1936 {
1937 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1938 	int err, i, offset = 0;
1939 	u32 len, addr, mode;
1940 
1941 	for (i = 0; i < n_region; i++) {
1942 		mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1943 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1944 		addr = le32_to_cpu(hdr[i].addr);
1945 
1946 		err = mt7615_mcu_init_download(dev, addr, len, mode);
1947 		if (err) {
1948 			dev_err(dev->mt76.dev, "Download request failed\n");
1949 			return err;
1950 		}
1951 
1952 		err = mt7615_mcu_send_firmware(dev, data + offset, len);
1953 		if (err) {
1954 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1955 			return err;
1956 		}
1957 
1958 		offset += len;
1959 	}
1960 
1961 	return 0;
1962 }
1963 
1964 static const struct wiphy_wowlan_support mt7615_wowlan_support = {
1965 	.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
1966 		 WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
1967 	.n_patterns = 1,
1968 	.pattern_min_len = 1,
1969 	.pattern_max_len = MT7615_WOW_PATTEN_MAX_LEN,
1970 	.max_nd_match_sets = 10,
1971 };
1972 
1973 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1974 {
1975 	const struct mt7615_fw_trailer *hdr;
1976 	const struct firmware *fw;
1977 	int ret;
1978 
1979 	ret = request_firmware(&fw, name, dev->mt76.dev);
1980 	if (ret)
1981 		return ret;
1982 
1983 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1984 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1985 		ret = -EINVAL;
1986 		goto out;
1987 	}
1988 
1989 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1990 					N9_REGION_NUM * sizeof(*hdr));
1991 
1992 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1993 		 hdr->fw_ver, hdr->build_date);
1994 
1995 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1996 	if (ret)
1997 		goto out;
1998 
1999 	ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
2000 					FW_START_OVERRIDE);
2001 	if (ret) {
2002 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2003 		goto out;
2004 	}
2005 
2006 	snprintf(dev->mt76.hw->wiphy->fw_version,
2007 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2008 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2009 
2010 	if (!strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
2011 		dev->fw_ver = MT7615_FIRMWARE_V2;
2012 		dev->mcu_ops = &sta_update_ops;
2013 	} else {
2014 		dev->fw_ver = MT7615_FIRMWARE_V1;
2015 		dev->mcu_ops = &wtbl_update_ops;
2016 	}
2017 
2018 out:
2019 	release_firmware(fw);
2020 	return ret;
2021 }
2022 
2023 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
2024 {
2025 	const struct mt7615_fw_trailer *hdr;
2026 	const struct firmware *fw;
2027 	int ret;
2028 
2029 	ret = request_firmware(&fw, name, dev->mt76.dev);
2030 	if (ret)
2031 		return ret;
2032 
2033 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
2034 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2035 		ret = -EINVAL;
2036 		goto out;
2037 	}
2038 
2039 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2040 					CR4_REGION_NUM * sizeof(*hdr));
2041 
2042 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
2043 		 hdr->fw_ver, hdr->build_date);
2044 
2045 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2046 	if (ret)
2047 		goto out;
2048 
2049 	ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
2050 	if (ret) {
2051 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
2052 		goto out;
2053 	}
2054 
2055 out:
2056 	release_firmware(fw);
2057 
2058 	return ret;
2059 }
2060 
2061 static int mt7615_load_ram(struct mt7615_dev *dev)
2062 {
2063 	int ret;
2064 
2065 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
2066 	if (ret)
2067 		return ret;
2068 
2069 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
2070 }
2071 
2072 static int mt7615_load_firmware(struct mt7615_dev *dev)
2073 {
2074 	int ret;
2075 	u32 val;
2076 
2077 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
2078 
2079 	if (val != FW_STATE_FW_DOWNLOAD) {
2080 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2081 		return -EIO;
2082 	}
2083 
2084 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
2085 	if (ret)
2086 		return ret;
2087 
2088 	ret = mt7615_load_ram(dev);
2089 	if (ret)
2090 		return ret;
2091 
2092 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
2093 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
2094 				       FW_STATE_CR4_RDY), 500)) {
2095 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2096 		return -EIO;
2097 	}
2098 
2099 	return 0;
2100 }
2101 
2102 static int mt7622_load_firmware(struct mt7615_dev *dev)
2103 {
2104 	int ret;
2105 	u32 val;
2106 
2107 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2108 
2109 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
2110 	if (val != FW_STATE_FW_DOWNLOAD) {
2111 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2112 		return -EIO;
2113 	}
2114 
2115 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
2116 	if (ret)
2117 		return ret;
2118 
2119 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
2120 	if (ret)
2121 		return ret;
2122 
2123 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
2124 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
2125 				       FW_STATE_NORMAL_TRX), 1500)) {
2126 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2127 		return -EIO;
2128 	}
2129 
2130 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2131 
2132 	return 0;
2133 }
2134 
2135 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
2136 {
2137 	struct {
2138 		u8 ctrl_val;
2139 		u8 pad[3];
2140 	} data = {
2141 		.ctrl_val = ctrl
2142 	};
2143 
2144 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST,
2145 				   &data, sizeof(data), true);
2146 }
2147 
2148 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
2149 {
2150 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
2151 	const struct mt7663_fw_trailer *hdr;
2152 	const struct mt7663_fw_buf *buf;
2153 	const struct firmware *fw;
2154 	const u8 *base_addr;
2155 	int i, ret;
2156 
2157 	ret = request_firmware(&fw, name, dev->mt76.dev);
2158 	if (ret)
2159 		return ret;
2160 
2161 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
2162 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2163 		ret = -EINVAL;
2164 		goto out;
2165 	}
2166 
2167 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
2168 						 FW_V3_COMMON_TAILER_SIZE);
2169 
2170 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2171 		 hdr->fw_ver, hdr->build_date);
2172 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
2173 
2174 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
2175 	for (i = 0; i < hdr->n_region; i++) {
2176 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
2177 		u32 len, addr, mode;
2178 
2179 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
2180 
2181 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
2182 		mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
2183 		addr = le32_to_cpu(buf->img_dest_addr);
2184 		len = le32_to_cpu(buf->img_size);
2185 
2186 		ret = mt7615_mcu_init_download(dev, addr, len, mode);
2187 		if (ret) {
2188 			dev_err(dev->mt76.dev, "Download request failed\n");
2189 			goto out;
2190 		}
2191 
2192 		ret = mt7615_mcu_send_firmware(dev, fw->data + offset, len);
2193 		if (ret) {
2194 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
2195 			goto out;
2196 		}
2197 
2198 		offset += le32_to_cpu(buf->img_size);
2199 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
2200 			override_addr = le32_to_cpu(buf->img_dest_addr);
2201 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
2202 				 i, override_addr);
2203 		}
2204 	}
2205 
2206 	if (override_addr)
2207 		flag |= FW_START_OVERRIDE;
2208 
2209 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
2210 		 override_addr, flag);
2211 
2212 	ret = mt7615_mcu_start_firmware(dev, override_addr, flag);
2213 	if (ret) {
2214 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2215 		goto out;
2216 	}
2217 
2218 	snprintf(dev->mt76.hw->wiphy->fw_version,
2219 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2220 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2221 
2222 out:
2223 	release_firmware(fw);
2224 
2225 	return ret;
2226 }
2227 
2228 static int
2229 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
2230 {
2231 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
2232 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
2233 	int ret;
2234 
2235 	if (!prefer_offload_fw) {
2236 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
2237 		primary_rom = MT7663_ROM_PATCH;
2238 	}
2239 	selected_rom = primary_rom;
2240 
2241 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
2242 	if (ret) {
2243 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
2244 			 primary_rom, secondary_rom);
2245 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
2246 					secondary_rom);
2247 		if (ret) {
2248 			dev_err(dev->mt76.dev, "failed to load %s",
2249 				secondary_rom);
2250 			return ret;
2251 		}
2252 		selected_rom = secondary_rom;
2253 	}
2254 
2255 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
2256 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
2257 		dev->fw_ver = MT7615_FIRMWARE_V3;
2258 		dev->mcu_ops = &uni_update_ops;
2259 	} else {
2260 		*n9_firmware = MT7663_FIRMWARE_N9;
2261 		dev->fw_ver = MT7615_FIRMWARE_V2;
2262 		dev->mcu_ops = &sta_update_ops;
2263 	}
2264 
2265 	return 0;
2266 }
2267 
2268 int __mt7663_load_firmware(struct mt7615_dev *dev)
2269 {
2270 	const char *n9_firmware;
2271 	int ret;
2272 
2273 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
2274 	if (ret) {
2275 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
2276 		return -EIO;
2277 	}
2278 
2279 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
2280 	if (ret)
2281 		return ret;
2282 
2283 	ret = mt7663_load_n9(dev, n9_firmware);
2284 	if (ret)
2285 		return ret;
2286 
2287 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
2288 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
2289 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
2290 				     MT7663_TOP_MISC2_FW_STATE);
2291 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2292 		return -EIO;
2293 	}
2294 
2295 #ifdef CONFIG_PM
2296 	if (mt7615_firmware_offload(dev))
2297 		dev->mt76.hw->wiphy->wowlan = &mt7615_wowlan_support;
2298 #endif /* CONFIG_PM */
2299 
2300 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2301 
2302 	return 0;
2303 }
2304 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
2305 
2306 static int mt7663_load_firmware(struct mt7615_dev *dev)
2307 {
2308 	int ret;
2309 
2310 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2311 
2312 	ret = __mt7663_load_firmware(dev);
2313 	if (ret)
2314 		return ret;
2315 
2316 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2317 
2318 	return 0;
2319 }
2320 
2321 int mt7615_mcu_init(struct mt7615_dev *dev)
2322 {
2323 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
2324 		.headroom = sizeof(struct mt7615_mcu_txd),
2325 		.mcu_skb_send_msg = mt7615_mcu_send_message,
2326 		.mcu_send_msg = mt7615_mcu_msg_send,
2327 		.mcu_restart = mt7615_mcu_restart,
2328 	};
2329 	int ret;
2330 
2331 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
2332 
2333 	ret = mt7615_driver_own(dev);
2334 	if (ret)
2335 		return ret;
2336 
2337 	switch (mt76_chip(&dev->mt76)) {
2338 	case 0x7622:
2339 		ret = mt7622_load_firmware(dev);
2340 		break;
2341 	case 0x7663:
2342 		ret = mt7663_load_firmware(dev);
2343 		break;
2344 	default:
2345 		ret = mt7615_load_firmware(dev);
2346 		break;
2347 	}
2348 	if (ret)
2349 		return ret;
2350 
2351 	mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2352 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2353 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2354 	mt7615_mcu_fw_log_2_host(dev, 0);
2355 
2356 	return 0;
2357 }
2358 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
2359 
2360 void mt7615_mcu_exit(struct mt7615_dev *dev)
2361 {
2362 	__mt76_mcu_restart(&dev->mt76);
2363 	mt7615_firmware_own(dev);
2364 	skb_queue_purge(&dev->mt76.mcu.res_q);
2365 }
2366 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
2367 
2368 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
2369 {
2370 	struct {
2371 		u8 buffer_mode;
2372 		u8 content_format;
2373 		__le16 len;
2374 	} __packed req_hdr = {
2375 		.buffer_mode = 1,
2376 	};
2377 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2378 	struct sk_buff *skb;
2379 	int eep_len, offset;
2380 
2381 	switch (mt76_chip(&dev->mt76)) {
2382 	case 0x7622:
2383 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
2384 		offset = MT_EE_NIC_CONF_0;
2385 		break;
2386 	case 0x7663:
2387 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
2388 		req_hdr.content_format = 1;
2389 		offset = MT_EE_CHIP_ID;
2390 		break;
2391 	default:
2392 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
2393 		offset = MT_EE_NIC_CONF_0;
2394 		break;
2395 	}
2396 
2397 	req_hdr.len = cpu_to_le16(eep_len);
2398 
2399 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
2400 	if (!skb)
2401 		return -ENOMEM;
2402 
2403 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2404 	skb_put_data(skb, eep + offset, eep_len);
2405 
2406 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2407 				       MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
2408 }
2409 EXPORT_SYMBOL_GPL(mt7615_mcu_set_eeprom);
2410 
2411 int mt7615_mcu_set_mac_enable(struct mt7615_dev *dev, int band, bool enable)
2412 {
2413 	struct {
2414 		u8 enable;
2415 		u8 band;
2416 		u8 rsv[2];
2417 	} __packed req = {
2418 		.enable = enable,
2419 		.band = band,
2420 	};
2421 
2422 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2423 				   &req, sizeof(req), true);
2424 }
2425 
2426 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
2427 {
2428 	struct mt7615_dev *dev = phy->dev;
2429 	struct {
2430 		u8 prot_idx;
2431 		u8 band;
2432 		u8 rsv[2];
2433 		__le32 len_thresh;
2434 		__le32 pkt_thresh;
2435 	} __packed req = {
2436 		.prot_idx = 1,
2437 		.band = phy != &dev->phy,
2438 		.len_thresh = cpu_to_le32(val),
2439 		.pkt_thresh = cpu_to_le32(0x2),
2440 	};
2441 
2442 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
2443 				   &req, sizeof(req), true);
2444 }
2445 
2446 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
2447 		       const struct ieee80211_tx_queue_params *params)
2448 {
2449 #define WMM_AIFS_SET	BIT(0)
2450 #define WMM_CW_MIN_SET	BIT(1)
2451 #define WMM_CW_MAX_SET	BIT(2)
2452 #define WMM_TXOP_SET	BIT(3)
2453 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
2454 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
2455 	struct req_data {
2456 		u8 number;
2457 		u8 rsv[3];
2458 		u8 queue;
2459 		u8 valid;
2460 		u8 aifs;
2461 		u8 cw_min;
2462 		__le16 cw_max;
2463 		__le16 txop;
2464 	} __packed req = {
2465 		.number = 1,
2466 		.queue = queue,
2467 		.valid = WMM_PARAM_SET,
2468 		.aifs = params->aifs,
2469 		.cw_min = 5,
2470 		.cw_max = cpu_to_le16(10),
2471 		.txop = cpu_to_le16(params->txop),
2472 	};
2473 
2474 	if (params->cw_min)
2475 		req.cw_min = fls(params->cw_min);
2476 	if (params->cw_max)
2477 		req.cw_max = cpu_to_le16(fls(params->cw_max));
2478 
2479 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
2480 				   &req, sizeof(req), true);
2481 }
2482 
2483 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
2484 {
2485 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2486 	struct dbdc_entry {
2487 		u8 type;
2488 		u8 index;
2489 		u8 band;
2490 		u8 _rsv;
2491 	};
2492 	struct {
2493 		u8 enable;
2494 		u8 num;
2495 		u8 _rsv[2];
2496 		struct dbdc_entry entry[64];
2497 	} req = {
2498 		.enable = !!ext_phy,
2499 	};
2500 	int i;
2501 
2502 	if (!ext_phy)
2503 		goto out;
2504 
2505 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
2506 	do { \
2507 		req.entry[req.num].type = _type;		\
2508 		req.entry[req.num].index = _idx;		\
2509 		req.entry[req.num++].band = _band;		\
2510 	} while (0)
2511 
2512 	for (i = 0; i < 4; i++) {
2513 		bool band = !!(ext_phy->omac_mask & BIT(i));
2514 
2515 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2516 	}
2517 
2518 	for (i = 0; i < 14; i++) {
2519 		bool band = !!(ext_phy->omac_mask & BIT(0x11 + i));
2520 
2521 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2522 	}
2523 
2524 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2525 
2526 	for (i = 0; i < 3; i++)
2527 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2528 
2529 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2530 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2531 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2532 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2533 
2534 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2535 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2536 
2537 out:
2538 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL,
2539 				   &req, sizeof(req), true);
2540 }
2541 
2542 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2543 {
2544 	struct wtbl_req_hdr req = {
2545 		.operation = WTBL_RESET_ALL,
2546 	};
2547 
2548 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
2549 				   &req, sizeof(req), true);
2550 }
2551 EXPORT_SYMBOL_GPL(mt7615_mcu_del_wtbl_all);
2552 
2553 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2554 		       enum mt7615_rdd_cmd cmd, u8 index,
2555 		       u8 rx_sel, u8 val)
2556 {
2557 	struct {
2558 		u8 ctrl;
2559 		u8 rdd_idx;
2560 		u8 rdd_rx_sel;
2561 		u8 val;
2562 		u8 rsv[4];
2563 	} req = {
2564 		.ctrl = cmd,
2565 		.rdd_idx = index,
2566 		.rdd_rx_sel = rx_sel,
2567 		.val = val,
2568 	};
2569 
2570 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL,
2571 				   &req, sizeof(req), true);
2572 }
2573 
2574 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2575 {
2576 	struct {
2577 		u16 tag;
2578 		u16 min_lpn;
2579 	} req = {
2580 		.tag = 0x1,
2581 		.min_lpn = val,
2582 	};
2583 
2584 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2585 				   &req, sizeof(req), true);
2586 }
2587 
2588 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2589 			    const struct mt7615_dfs_pulse *pulse)
2590 {
2591 	struct {
2592 		u16 tag;
2593 		struct mt7615_dfs_pulse pulse;
2594 	} req = {
2595 		.tag = 0x3,
2596 	};
2597 
2598 	memcpy(&req.pulse, pulse, sizeof(*pulse));
2599 
2600 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2601 				   &req, sizeof(req), true);
2602 }
2603 
2604 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2605 			    const struct mt7615_dfs_pattern *pattern)
2606 {
2607 	struct {
2608 		u16 tag;
2609 		u16 radar_type;
2610 		struct mt7615_dfs_pattern pattern;
2611 	} req = {
2612 		.tag = 0x2,
2613 		.radar_type = index,
2614 	};
2615 
2616 	memcpy(&req.pattern, pattern, sizeof(*pattern));
2617 
2618 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2619 				   &req, sizeof(req), true);
2620 }
2621 
2622 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2623 {
2624 	struct {
2625 		u8 pulse_num;
2626 		u8 rsv[3];
2627 		struct {
2628 			u32 start_time;
2629 			u16 width;
2630 			s16 power;
2631 		} pattern[32];
2632 	} req = {
2633 		.pulse_num = dev->radar_pattern.n_pulses,
2634 	};
2635 	u32 start_time = ktime_to_ms(ktime_get_boottime());
2636 	int i;
2637 
2638 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2639 		return -EINVAL;
2640 
2641 	/* TODO: add some noise here */
2642 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2643 		req.pattern[i].width = dev->radar_pattern.width;
2644 		req.pattern[i].power = dev->radar_pattern.power;
2645 		req.pattern[i].start_time = start_time +
2646 					    i * dev->radar_pattern.period;
2647 	}
2648 
2649 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2650 				   &req, sizeof(req), false);
2651 }
2652 
2653 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2654 {
2655 	struct mt76_phy *mphy = phy->mt76;
2656 	struct ieee80211_hw *hw = mphy->hw;
2657 	int n_chains = hweight8(mphy->antenna_mask);
2658 	int tx_power;
2659 	int i;
2660 
2661 	tx_power = hw->conf.power_level * 2 -
2662 		   mt76_tx_power_nss_delta(n_chains);
2663 	mphy->txpower_cur = tx_power;
2664 
2665 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2666 		sku[i] = tx_power;
2667 
2668 	for (i = 0; i < 4; i++) {
2669 		int delta = 0;
2670 
2671 		if (i < n_chains - 1)
2672 			delta = mt76_tx_power_nss_delta(n_chains) -
2673 				mt76_tx_power_nss_delta(i + 1);
2674 		sku[MT_SKU_1SS_DELTA + i] = delta;
2675 	}
2676 }
2677 
2678 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2679 {
2680 	static const u8 width_to_bw[] = {
2681 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2682 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2683 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2684 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2685 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2686 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2687 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2688 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2689 	};
2690 
2691 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2692 		return 0;
2693 
2694 	return width_to_bw[chandef->width];
2695 }
2696 
2697 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2698 {
2699 	struct mt7615_dev *dev = phy->dev;
2700 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2701 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2702 	struct {
2703 		u8 control_chan;
2704 		u8 center_chan;
2705 		u8 bw;
2706 		u8 tx_streams;
2707 		u8 rx_streams_mask;
2708 		u8 switch_reason;
2709 		u8 band_idx;
2710 		/* for 80+80 only */
2711 		u8 center_chan2;
2712 		__le16 cac_case;
2713 		u8 channel_band;
2714 		u8 rsv0;
2715 		__le32 outband_freq;
2716 		u8 txpower_drop;
2717 		u8 rsv1[3];
2718 		u8 txpower_sku[53];
2719 		u8 rsv2[3];
2720 	} req = {
2721 		.control_chan = chandef->chan->hw_value,
2722 		.center_chan = ieee80211_frequency_to_channel(freq1),
2723 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2724 		.rx_streams_mask = phy->chainmask,
2725 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2726 	};
2727 
2728 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2729 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2730 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2731 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2732 		req.switch_reason = CH_SWITCH_DFS;
2733 	else
2734 		req.switch_reason = CH_SWITCH_NORMAL;
2735 
2736 	req.band_idx = phy != &dev->phy;
2737 	req.bw = mt7615_mcu_chan_bw(chandef);
2738 
2739 	mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2740 
2741 	return __mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2742 }
2743 
2744 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2745 {
2746 	struct {
2747 		u8 action;
2748 		u8 rsv[3];
2749 	} req = {
2750 		.action = index,
2751 	};
2752 
2753 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2754 				   sizeof(req), true);
2755 }
2756 
2757 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2758 {
2759 	struct mt7615_dev *dev = phy->dev;
2760 	struct {
2761 		u8 format_id;
2762 		u8 sku_enable;
2763 		u8 band_idx;
2764 		u8 rsv;
2765 	} req = {
2766 		.format_id = 0,
2767 		.band_idx = phy != &dev->phy,
2768 		.sku_enable = enable,
2769 	};
2770 
2771 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2772 				   sizeof(req), true);
2773 }
2774 
2775 int mt7615_mcu_set_vif_ps(struct mt7615_dev *dev, struct ieee80211_vif *vif)
2776 {
2777 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2778 	struct {
2779 		u8 bss_idx;
2780 		u8 ps_state; /* 0: device awake
2781 			      * 1: static power save
2782 			      * 2: dynamic power saving
2783 			      */
2784 	} req = {
2785 		.bss_idx = mvif->idx,
2786 		.ps_state = vif->bss_conf.ps ? 2 : 0,
2787 	};
2788 
2789 	if (vif->type != NL80211_IFTYPE_STATION)
2790 		return -ENOTSUPP;
2791 
2792 	return __mt76_mcu_send_msg(&dev->mt76,  MCU_CMD_SET_PS_PROFILE,
2793 				   &req, sizeof(req), false);
2794 }
2795 
2796 int mt7615_mcu_set_channel_domain(struct mt7615_phy *phy)
2797 {
2798 	struct mt76_phy *mphy = phy->mt76;
2799 	struct mt7615_dev *dev = phy->dev;
2800 	struct mt7615_mcu_channel_domain {
2801 		__le32 country_code; /* regulatory_request.alpha2 */
2802 		u8 bw_2g; /* BW_20_40M		0
2803 			   * BW_20M		1
2804 			   * BW_20_40_80M	2
2805 			   * BW_20_40_80_160M	3
2806 			   * BW_20_40_80_8080M	4
2807 			   */
2808 		u8 bw_5g;
2809 		__le16 pad;
2810 		u8 n_2ch;
2811 		u8 n_5ch;
2812 		__le16 pad2;
2813 	} __packed hdr = {
2814 		.bw_2g = 0,
2815 		.bw_5g = 3,
2816 		.n_2ch = mphy->sband_2g.sband.n_channels,
2817 		.n_5ch = mphy->sband_5g.sband.n_channels,
2818 	};
2819 	struct mt7615_mcu_chan {
2820 		__le16 hw_value;
2821 		__le16 pad;
2822 		__le32 flags;
2823 	} __packed;
2824 	int i, n_channels = hdr.n_2ch + hdr.n_5ch;
2825 	int len = sizeof(hdr) + n_channels * sizeof(struct mt7615_mcu_chan);
2826 	struct sk_buff *skb;
2827 
2828 	if (!mt7615_firmware_offload(dev))
2829 		return 0;
2830 
2831 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
2832 	if (!skb)
2833 		return -ENOMEM;
2834 
2835 	skb_put_data(skb, &hdr, sizeof(hdr));
2836 
2837 	for (i = 0; i < n_channels; i++) {
2838 		struct ieee80211_channel *chan;
2839 		struct mt7615_mcu_chan channel;
2840 
2841 		if (i < hdr.n_2ch)
2842 			chan = &mphy->sband_2g.sband.channels[i];
2843 		else
2844 			chan = &mphy->sband_5g.sband.channels[i - hdr.n_2ch];
2845 
2846 		channel.hw_value = cpu_to_le16(chan->hw_value);
2847 		channel.flags = cpu_to_le32(chan->flags);
2848 		channel.pad = 0;
2849 
2850 		skb_put_data(skb, &channel, sizeof(channel));
2851 	}
2852 
2853 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2854 				       MCU_CMD_SET_CHAN_DOMAIN, false);
2855 }
2856 
2857 #define MT7615_SCAN_CHANNEL_TIME	60
2858 int mt7615_mcu_hw_scan(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2859 		       struct ieee80211_scan_request *scan_req)
2860 {
2861 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2862 	struct cfg80211_scan_request *sreq = &scan_req->req;
2863 	int n_ssids = 0, err, i, duration = MT7615_SCAN_CHANNEL_TIME;
2864 	int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
2865 	struct ieee80211_channel **scan_list = sreq->channels;
2866 	struct mt7615_dev *dev = phy->dev;
2867 	bool ext_phy = phy != &dev->phy;
2868 	struct mt7615_mcu_scan_channel *chan;
2869 	struct mt7615_hw_scan_req *req;
2870 	struct sk_buff *skb;
2871 
2872 	/* fall-back to sw-scan */
2873 	if (!mt7615_firmware_offload(dev))
2874 		return 1;
2875 
2876 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(*req));
2877 	if (!skb)
2878 		return -ENOMEM;
2879 
2880 	set_bit(MT76_HW_SCANNING, &phy->mt76->state);
2881 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2882 
2883 	req = (struct mt7615_hw_scan_req *)skb_put(skb, sizeof(*req));
2884 
2885 	req->seq_num = mvif->scan_seq_num | ext_phy << 7;
2886 	req->bss_idx = mvif->idx;
2887 	req->scan_type = sreq->n_ssids ? 1 : 0;
2888 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2889 	req->version = 1;
2890 
2891 	for (i = 0; i < sreq->n_ssids; i++) {
2892 		if (!sreq->ssids[i].ssid_len)
2893 			continue;
2894 
2895 		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2896 		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
2897 		       sreq->ssids[i].ssid_len);
2898 		n_ssids++;
2899 	}
2900 	req->ssid_type = n_ssids ? BIT(2) : BIT(0);
2901 	req->ssid_type_ext = n_ssids ? BIT(0) : 0;
2902 	req->ssids_num = n_ssids;
2903 
2904 	/* increase channel time for passive scan */
2905 	if (!sreq->n_ssids)
2906 		duration *= 2;
2907 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
2908 	req->channel_min_dwell_time = cpu_to_le16(duration);
2909 	req->channel_dwell_time = cpu_to_le16(duration);
2910 
2911 	req->channels_num = min_t(u8, sreq->n_channels, 32);
2912 	req->ext_channels_num = min_t(u8, ext_channels_num, 32);
2913 	for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
2914 		if (i >= 32)
2915 			chan = &req->ext_channels[i - 32];
2916 		else
2917 			chan = &req->channels[i];
2918 
2919 		chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
2920 		chan->channel_num = scan_list[i]->hw_value;
2921 	}
2922 	req->channel_type = sreq->n_channels ? 4 : 0;
2923 
2924 	if (sreq->ie_len > 0) {
2925 		memcpy(req->ies, sreq->ie, sreq->ie_len);
2926 		req->ies_len = cpu_to_le16(sreq->ie_len);
2927 	}
2928 
2929 	memcpy(req->bssid, sreq->bssid, ETH_ALEN);
2930 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2931 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
2932 				     sreq->mac_addr_mask);
2933 		req->scan_func = 1;
2934 	}
2935 
2936 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_START_HW_SCAN,
2937 				      false);
2938 	if (err < 0)
2939 		clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
2940 
2941 	return err;
2942 }
2943 
2944 int mt7615_mcu_cancel_hw_scan(struct mt7615_phy *phy,
2945 			      struct ieee80211_vif *vif)
2946 {
2947 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2948 	struct mt7615_dev *dev = phy->dev;
2949 	struct {
2950 		u8 seq_num;
2951 		u8 is_ext_channel;
2952 		u8 rsv[2];
2953 	} __packed req = {
2954 		.seq_num = mvif->scan_seq_num,
2955 	};
2956 
2957 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->mt76->state)) {
2958 		struct cfg80211_scan_info info = {
2959 			.aborted = true,
2960 		};
2961 
2962 		ieee80211_scan_completed(phy->mt76->hw, &info);
2963 	}
2964 
2965 	return __mt76_mcu_send_msg(&dev->mt76,  MCU_CMD_CANCEL_HW_SCAN, &req,
2966 				   sizeof(req), false);
2967 }
2968 
2969 int mt7615_mcu_sched_scan_req(struct mt7615_phy *phy,
2970 			      struct ieee80211_vif *vif,
2971 			      struct cfg80211_sched_scan_request *sreq)
2972 {
2973 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2974 	struct ieee80211_channel **scan_list = sreq->channels;
2975 	struct mt7615_dev *dev = phy->dev;
2976 	bool ext_phy = phy != &dev->phy;
2977 	struct mt7615_mcu_scan_channel *chan;
2978 	struct mt7615_sched_scan_req *req;
2979 	struct cfg80211_match_set *match;
2980 	struct cfg80211_ssid *ssid;
2981 	struct sk_buff *skb;
2982 	int i;
2983 
2984 	if (!mt7615_firmware_offload(dev))
2985 		return -ENOTSUPP;
2986 
2987 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2988 				 sizeof(*req) + sreq->ie_len);
2989 	if (!skb)
2990 		return -ENOMEM;
2991 
2992 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2993 
2994 	req = (struct mt7615_sched_scan_req *)skb_put(skb, sizeof(*req));
2995 	req->version = 1;
2996 	req->seq_num = mvif->scan_seq_num | ext_phy << 7;
2997 
2998 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2999 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
3000 				     sreq->mac_addr_mask);
3001 		req->scan_func = 1;
3002 	}
3003 
3004 	req->ssids_num = sreq->n_ssids;
3005 	for (i = 0; i < req->ssids_num; i++) {
3006 		ssid = &sreq->ssids[i];
3007 		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
3008 		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
3009 	}
3010 
3011 	req->match_num = sreq->n_match_sets;
3012 	for (i = 0; i < req->match_num; i++) {
3013 		match = &sreq->match_sets[i];
3014 		memcpy(req->match[i].ssid, match->ssid.ssid,
3015 		       match->ssid.ssid_len);
3016 		req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
3017 		req->match[i].ssid_len = match->ssid.ssid_len;
3018 	}
3019 
3020 	req->channel_type = sreq->n_channels ? 4 : 0;
3021 	req->channels_num = min_t(u8, sreq->n_channels, 64);
3022 	for (i = 0; i < req->channels_num; i++) {
3023 		chan = &req->channels[i];
3024 		chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3025 		chan->channel_num = scan_list[i]->hw_value;
3026 	}
3027 
3028 	req->intervals_num = sreq->n_scan_plans;
3029 	for (i = 0; i < req->intervals_num; i++)
3030 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3031 
3032 	if (sreq->ie_len > 0) {
3033 		req->ie_len = cpu_to_le16(sreq->ie_len);
3034 		memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
3035 	}
3036 
3037 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3038 				       MCU_CMD_SCHED_SCAN_REQ, false);
3039 }
3040 
3041 int mt7615_mcu_sched_scan_enable(struct mt7615_phy *phy,
3042 				 struct ieee80211_vif *vif,
3043 				 bool enable)
3044 {
3045 	struct mt7615_dev *dev = phy->dev;
3046 	struct {
3047 		u8 active; /* 0: enabled 1: disabled */
3048 		u8 rsv[3];
3049 	} __packed req = {
3050 		.active = !enable,
3051 	};
3052 
3053 	if (!mt7615_firmware_offload(dev))
3054 		return -ENOTSUPP;
3055 
3056 	if (enable)
3057 		set_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3058 	else
3059 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3060 
3061 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SCHED_SCAN_ENABLE,
3062 				   &req, sizeof(req), false);
3063 }
3064 
3065 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3066 {
3067 	int i;
3068 
3069 	for (i = 0; i < n_freqs; i++)
3070 		if (cur == freqs[i])
3071 			return i;
3072 
3073 	return -1;
3074 }
3075 
3076 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
3077 {
3078 	static const u16 freq_list[] = {
3079 		4980, 5805, 5905, 5190,
3080 		5230, 5270, 5310, 5350,
3081 		5390, 5430, 5470, 5510,
3082 		5550, 5590, 5630, 5670,
3083 		5710, 5755, 5795, 5835,
3084 		5875, 5210, 5290, 5370,
3085 		5450, 5530, 5610, 5690,
3086 		5775, 5855
3087 	};
3088 	static const u16 freq_bw40[] = {
3089 		5190, 5230, 5270, 5310,
3090 		5350, 5390, 5430, 5470,
3091 		5510, 5550, 5590, 5630,
3092 		5670, 5710, 5755, 5795,
3093 		5835, 5875
3094 	};
3095 	int offset_2g = ARRAY_SIZE(freq_list);
3096 	int idx;
3097 
3098 	if (freq < 4000) {
3099 		if (freq < 2427)
3100 			return offset_2g;
3101 		if (freq < 2442)
3102 			return offset_2g + 1;
3103 		if (freq < 2457)
3104 			return offset_2g + 2;
3105 
3106 		return offset_2g + 3;
3107 	}
3108 
3109 	switch (bw) {
3110 	case NL80211_CHAN_WIDTH_80:
3111 	case NL80211_CHAN_WIDTH_80P80:
3112 	case NL80211_CHAN_WIDTH_160:
3113 		break;
3114 	default:
3115 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3116 					   freq + 10);
3117 		if (idx >= 0) {
3118 			freq = freq_bw40[idx];
3119 			break;
3120 		}
3121 
3122 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3123 					   freq - 10);
3124 		if (idx >= 0) {
3125 			freq = freq_bw40[idx];
3126 			break;
3127 		}
3128 		/* fall through */
3129 	case NL80211_CHAN_WIDTH_40:
3130 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3131 					   freq);
3132 		if (idx >= 0)
3133 			break;
3134 
3135 		return -1;
3136 
3137 	}
3138 
3139 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3140 }
3141 
3142 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
3143 {
3144 	struct mt7615_dev *dev = phy->dev;
3145 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3146 	int freq2 = chandef->center_freq2;
3147 	int ret;
3148 	struct {
3149 		u8 direction;
3150 		u8 runtime_calibration;
3151 		u8 _rsv[2];
3152 
3153 		__le16 center_freq;
3154 		u8 bw;
3155 		u8 band;
3156 		u8 is_freq2;
3157 		u8 success;
3158 		u8 dbdc_en;
3159 
3160 		u8 _rsv2;
3161 
3162 		struct {
3163 			__le32 sx0_i_lna[4];
3164 			__le32 sx0_q_lna[4];
3165 
3166 			__le32 sx2_i_lna[4];
3167 			__le32 sx2_q_lna[4];
3168 		} dcoc_data[4];
3169 	} req = {
3170 		.direction = 1,
3171 
3172 		.bw = mt7615_mcu_chan_bw(chandef),
3173 		.band = chandef->center_freq1 > 4000,
3174 		.dbdc_en = !!dev->mt76.phy2,
3175 	};
3176 	u16 center_freq = chandef->center_freq1;
3177 	int freq_idx;
3178 	u8 *eep = dev->mt76.eeprom.data;
3179 
3180 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
3181 		return 0;
3182 
3183 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
3184 		freq2 = center_freq + 40;
3185 		center_freq -= 40;
3186 	}
3187 
3188 again:
3189 	req.runtime_calibration = 1;
3190 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
3191 	if (freq_idx < 0)
3192 		goto out;
3193 
3194 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
3195 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
3196 	       sizeof(req.dcoc_data));
3197 	req.runtime_calibration = 0;
3198 
3199 out:
3200 	req.center_freq = cpu_to_le16(center_freq);
3201 	ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
3202 				  sizeof(req), true);
3203 
3204 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3205 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3206 		req.is_freq2 = true;
3207 		center_freq = freq2;
3208 		goto again;
3209 	}
3210 
3211 	return ret;
3212 }
3213 
3214 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
3215 {
3216 	static const u16 freq_list[] = {
3217 		4920, 4940, 4960, 4980,
3218 		5040, 5060, 5080, 5180,
3219 		5200, 5220, 5240, 5260,
3220 		5280, 5300, 5320, 5340,
3221 		5360, 5380, 5400, 5420,
3222 		5440, 5460, 5480, 5500,
3223 		5520, 5540, 5560, 5580,
3224 		5600, 5620, 5640, 5660,
3225 		5680, 5700, 5720, 5745,
3226 		5765, 5785, 5805, 5825,
3227 		5845, 5865, 5885, 5905
3228 	};
3229 	int offset_2g = ARRAY_SIZE(freq_list);
3230 	int idx;
3231 
3232 	if (freq < 4000) {
3233 		if (freq < 2432)
3234 			return offset_2g;
3235 		if (freq < 2457)
3236 			return offset_2g + 1;
3237 
3238 		return offset_2g + 2;
3239 	}
3240 
3241 	if (bw != NL80211_CHAN_WIDTH_20) {
3242 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3243 					   freq + 10);
3244 		if (idx >= 0)
3245 			return idx;
3246 
3247 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3248 					   freq - 10);
3249 		if (idx >= 0)
3250 			return idx;
3251 	}
3252 
3253 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3254 }
3255 
3256 
3257 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
3258 {
3259 	struct mt7615_dev *dev = phy->dev;
3260 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3261 	int freq2 = chandef->center_freq2;
3262 	int ret;
3263 	struct {
3264 		u8 direction;
3265 		u8 runtime_calibration;
3266 		u8 _rsv[2];
3267 
3268 		__le16 center_freq;
3269 		u8 bw;
3270 		u8 band;
3271 		u8 is_freq2;
3272 		u8 success;
3273 		u8 dbdc_en;
3274 
3275 		u8 _rsv2;
3276 
3277 		struct {
3278 			struct {
3279 				u32 dpd_g0;
3280 				u8 data[32];
3281 			} wf0, wf1;
3282 
3283 			struct {
3284 				u32 dpd_g0_prim;
3285 				u32 dpd_g0_sec;
3286 				u8 data_prim[32];
3287 				u8 data_sec[32];
3288 			} wf2, wf3;
3289 		} dpd_data;
3290 	} req = {
3291 		.direction = 1,
3292 
3293 		.bw = mt7615_mcu_chan_bw(chandef),
3294 		.band = chandef->center_freq1 > 4000,
3295 		.dbdc_en = !!dev->mt76.phy2,
3296 	};
3297 	u16 center_freq = chandef->center_freq1;
3298 	int freq_idx;
3299 	u8 *eep = dev->mt76.eeprom.data;
3300 
3301 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
3302 		return 0;
3303 
3304 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
3305 		freq2 = center_freq + 40;
3306 		center_freq -= 40;
3307 	}
3308 
3309 again:
3310 	req.runtime_calibration = 1;
3311 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
3312 	if (freq_idx < 0)
3313 		goto out;
3314 
3315 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
3316 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
3317 	       sizeof(req.dpd_data));
3318 	req.runtime_calibration = 0;
3319 
3320 out:
3321 	req.center_freq = cpu_to_le16(center_freq);
3322 	ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
3323 				  sizeof(req), true);
3324 
3325 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3326 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3327 		req.is_freq2 = true;
3328 		center_freq = freq2;
3329 		goto again;
3330 	}
3331 
3332 	return ret;
3333 }
3334 
3335 #ifdef CONFIG_PM
3336 int mt7615_mcu_set_hif_suspend(struct mt7615_dev *dev, bool suspend)
3337 {
3338 	struct {
3339 		struct {
3340 			u8 hif_type; /* 0x0: HIF_SDIO
3341 				      * 0x1: HIF_USB
3342 				      * 0x2: HIF_PCIE
3343 				      */
3344 			u8 pad[3];
3345 		} __packed hdr;
3346 		struct hif_suspend_tlv {
3347 			__le16 tag;
3348 			__le16 len;
3349 			u8 suspend;
3350 		} __packed hif_suspend;
3351 	} req = {
3352 		.hif_suspend = {
3353 			.tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
3354 			.len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
3355 			.suspend = suspend,
3356 		},
3357 	};
3358 
3359 	if (mt76_is_mmio(&dev->mt76))
3360 		req.hdr.hif_type = 2;
3361 	else if (mt76_is_usb(&dev->mt76))
3362 		req.hdr.hif_type = 1;
3363 
3364 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_HIF_CTRL,
3365 				   &req, sizeof(req), true);
3366 }
3367 EXPORT_SYMBOL_GPL(mt7615_mcu_set_hif_suspend);
3368 
3369 static int
3370 mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3371 		      bool enable)
3372 {
3373 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3374 	struct {
3375 		u8 bss_idx;
3376 		u8 dtim_period;
3377 		__le16 aid;
3378 		__le16 bcn_interval;
3379 		__le16 atim_window;
3380 		u8 uapsd;
3381 		u8 bmc_delivered_ac;
3382 		u8 bmc_triggered_ac;
3383 		u8 pad;
3384 	} req = {
3385 		.bss_idx = mvif->idx,
3386 		.aid = cpu_to_le16(vif->bss_conf.aid),
3387 		.dtim_period = vif->bss_conf.dtim_period,
3388 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
3389 	};
3390 	struct {
3391 		u8 bss_idx;
3392 		u8 pad[3];
3393 	} req_hdr = {
3394 		.bss_idx = mvif->idx,
3395 	};
3396 	int err;
3397 
3398 	if (vif->type != NL80211_IFTYPE_STATION ||
3399 	    !mt7615_firmware_offload(dev))
3400 		return -ENOTSUPP;
3401 
3402 	err = __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT,
3403 				  &req_hdr, sizeof(req_hdr), false);
3404 	if (err < 0 || !enable)
3405 		return err;
3406 
3407 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED,
3408 				   &req, sizeof(req), false);
3409 }
3410 
3411 static int
3412 mt7615_mcu_set_wow_ctrl(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3413 			bool suspend, struct cfg80211_wowlan *wowlan)
3414 {
3415 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3416 	struct mt7615_dev *dev = phy->dev;
3417 	struct {
3418 		struct {
3419 			u8 bss_idx;
3420 			u8 pad[3];
3421 		} __packed hdr;
3422 		struct mt7615_wow_ctrl_tlv wow_ctrl_tlv;
3423 	} req = {
3424 		.hdr = {
3425 			.bss_idx = mvif->idx,
3426 		},
3427 		.wow_ctrl_tlv = {
3428 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
3429 			.len = cpu_to_le16(sizeof(struct mt7615_wow_ctrl_tlv)),
3430 			.cmd = suspend ? 1 : 2,
3431 		},
3432 	};
3433 
3434 	if (wowlan->magic_pkt)
3435 		req.wow_ctrl_tlv.trigger |= BIT(0);
3436 	if (wowlan->disconnect)
3437 		req.wow_ctrl_tlv.trigger |= BIT(2);
3438 	if (wowlan->nd_config) {
3439 		mt7615_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
3440 		req.wow_ctrl_tlv.trigger |= BIT(5);
3441 		mt7615_mcu_sched_scan_enable(phy, vif, suspend);
3442 	}
3443 
3444 	if (mt76_is_mmio(&dev->mt76))
3445 		req.wow_ctrl_tlv.wakeup_hif = 2;
3446 	else if (mt76_is_usb(&dev->mt76))
3447 		req.wow_ctrl_tlv.wakeup_hif = 1;
3448 
3449 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND,
3450 				   &req, sizeof(req), true);
3451 }
3452 
3453 static int
3454 mt7615_mcu_set_wow_pattern(struct mt7615_dev *dev,
3455 			   struct ieee80211_vif *vif,
3456 			   u8 index, bool enable,
3457 			   struct cfg80211_pkt_pattern *pattern)
3458 {
3459 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3460 	struct mt7615_wow_pattern_tlv *ptlv;
3461 	struct sk_buff *skb;
3462 	struct req_hdr {
3463 		u8 bss_idx;
3464 		u8 pad[3];
3465 	} __packed hdr = {
3466 		.bss_idx = mvif->idx,
3467 	};
3468 
3469 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3470 				 sizeof(hdr) + sizeof(*ptlv));
3471 	if (!skb)
3472 		return -ENOMEM;
3473 
3474 	skb_put_data(skb, &hdr, sizeof(hdr));
3475 	ptlv = (struct mt7615_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
3476 	ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
3477 	ptlv->len = cpu_to_le16(sizeof(*ptlv));
3478 	ptlv->data_len = pattern->pattern_len;
3479 	ptlv->enable = enable;
3480 	ptlv->index = index;
3481 
3482 	memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
3483 	memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8);
3484 
3485 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3486 				       MCU_UNI_CMD_SUSPEND, true);
3487 }
3488 
3489 static int
3490 mt7615_mcu_set_suspend_mode(struct mt7615_dev *dev,
3491 			    struct ieee80211_vif *vif,
3492 			    bool enable, u8 mdtim, bool wow_suspend)
3493 {
3494 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3495 	struct {
3496 		struct {
3497 			u8 bss_idx;
3498 			u8 pad[3];
3499 		} __packed hdr;
3500 		struct mt7615_suspend_tlv suspend_tlv;
3501 	} req = {
3502 		.hdr = {
3503 			.bss_idx = mvif->idx,
3504 		},
3505 		.suspend_tlv = {
3506 			.tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
3507 			.len = cpu_to_le16(sizeof(struct mt7615_suspend_tlv)),
3508 			.enable = enable,
3509 			.mdtim = mdtim,
3510 			.wow_suspend = wow_suspend,
3511 		},
3512 	};
3513 
3514 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND,
3515 				   &req, sizeof(req), true);
3516 }
3517 
3518 static int
3519 mt7615_mcu_set_gtk_rekey(struct mt7615_dev *dev,
3520 			 struct ieee80211_vif *vif,
3521 			 bool suspend)
3522 {
3523 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3524 	struct {
3525 		struct {
3526 			u8 bss_idx;
3527 			u8 pad[3];
3528 		} __packed hdr;
3529 		struct mt7615_gtk_rekey_tlv gtk_tlv;
3530 	} __packed req = {
3531 		.hdr = {
3532 			.bss_idx = mvif->idx,
3533 		},
3534 		.gtk_tlv = {
3535 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
3536 			.len = cpu_to_le16(sizeof(struct mt7615_gtk_rekey_tlv)),
3537 			.rekey_mode = !suspend,
3538 		},
3539 	};
3540 
3541 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD,
3542 				   &req, sizeof(req), true);
3543 }
3544 
3545 void mt7615_mcu_set_suspend_iter(void *priv, u8 *mac,
3546 				 struct ieee80211_vif *vif)
3547 {
3548 	struct mt7615_phy *phy = priv;
3549 	bool suspend = test_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
3550 	struct ieee80211_hw *hw = phy->mt76->hw;
3551 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
3552 	int i;
3553 
3554 	mt7615_mcu_set_bss_pm(phy->dev, vif, suspend);
3555 
3556 	mt7615_mcu_set_gtk_rekey(phy->dev, vif, suspend);
3557 
3558 	mt7615_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
3559 
3560 	for (i = 0; i < wowlan->n_patterns; i++)
3561 		mt7615_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
3562 					   &wowlan->patterns[i]);
3563 	mt7615_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
3564 }
3565 
3566 static void
3567 mt7615_mcu_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3568 		    struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
3569 		    void *data)
3570 {
3571 	struct mt7615_gtk_rekey_tlv *gtk_tlv = data;
3572 	u32 cipher;
3573 
3574 	if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
3575 	    key->cipher != WLAN_CIPHER_SUITE_CCMP &&
3576 	    key->cipher != WLAN_CIPHER_SUITE_TKIP)
3577 		return;
3578 
3579 	if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
3580 		gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
3581 		cipher = BIT(3);
3582 	} else {
3583 		gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
3584 		cipher = BIT(4);
3585 	}
3586 
3587 	/* we are assuming here to have a single pairwise key */
3588 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3589 		gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
3590 		gtk_tlv->group_cipher = cpu_to_le32(cipher);
3591 		gtk_tlv->keyid = key->keyidx;
3592 	}
3593 }
3594 
3595 int mt7615_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
3596 				struct ieee80211_vif *vif,
3597 				struct cfg80211_gtk_rekey_data *key)
3598 {
3599 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3600 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3601 	struct mt7615_gtk_rekey_tlv *gtk_tlv;
3602 	struct sk_buff *skb;
3603 	struct {
3604 		u8 bss_idx;
3605 		u8 pad[3];
3606 	} __packed hdr = {
3607 		.bss_idx = mvif->idx,
3608 	};
3609 
3610 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3611 				 sizeof(hdr) + sizeof(*gtk_tlv));
3612 	if (!skb)
3613 		return -ENOMEM;
3614 
3615 	skb_put_data(skb, &hdr, sizeof(hdr));
3616 	gtk_tlv = (struct mt7615_gtk_rekey_tlv *)skb_put(skb,
3617 							 sizeof(*gtk_tlv));
3618 	gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
3619 	gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
3620 	gtk_tlv->rekey_mode = 2;
3621 	gtk_tlv->option = 1;
3622 
3623 	rcu_read_lock();
3624 	ieee80211_iter_keys_rcu(hw, vif, mt7615_mcu_key_iter, gtk_tlv);
3625 	rcu_read_unlock();
3626 
3627 	memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
3628 	memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
3629 	memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
3630 
3631 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3632 				       MCU_UNI_CMD_OFFLOAD, true);
3633 }
3634 #endif /* CONFIG_PM */
3635 
3636 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3637 		       struct ieee80211_channel *chan, int duration)
3638 {
3639 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3640 	struct mt7615_dev *dev = phy->dev;
3641 	struct mt7615_roc_tlv req = {
3642 		.bss_idx = mvif->idx,
3643 		.active = !chan,
3644 		.max_interval = cpu_to_le32(duration),
3645 		.primary_chan = chan ? chan->hw_value : 0,
3646 		.band = chan ? chan->band : 0,
3647 		.req_type = 2,
3648 	};
3649 
3650 	phy->roc_grant = false;
3651 
3652 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
3653 				   sizeof(req), false);
3654 }
3655 
3656 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
3657 			     struct ieee80211_vif *vif)
3658 {
3659 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3660 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
3661 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3662 	struct {
3663 		__le32 ct_win;
3664 		u8 bss_idx;
3665 		u8 rsv[3];
3666 	} __packed req = {
3667 		.ct_win = cpu_to_le32(ct_window),
3668 		.bss_idx = mvif->idx,
3669 	};
3670 
3671 	if (!mt7615_firmware_offload(dev))
3672 		return -ENOTSUPP;
3673 
3674 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS,
3675 				   &req, sizeof(req), false);
3676 }
3677