1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
75 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
76 
77 #define DL_MODE_ENCRYPT			BIT(0)
78 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
79 #define DL_MODE_RESET_SEC_IV		BIT(3)
80 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
82 #define DL_MODE_NEED_RSP		BIT(31)
83 
84 #define FW_START_OVERRIDE		BIT(0)
85 #define FW_START_WORKING_PDA_CR4	BIT(2)
86 
87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
88 			 int cmd, int *wait_seq)
89 {
90 	int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
91 	struct mt7615_uni_txd *uni_txd;
92 	struct mt7615_mcu_txd *mcu_txd;
93 	u8 seq, q_idx, pkt_fmt;
94 	__le32 *txd;
95 	u32 val;
96 
97 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
98 	if (!seq)
99 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
100 	if (wait_seq)
101 		*wait_seq = seq;
102 
103 	txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
104 	txd = (__le32 *)skb_push(skb, txd_len);
105 
106 	if (cmd != MCU_CMD_FW_SCATTER) {
107 		q_idx = MT_TX_MCU_PORT_RX_Q0;
108 		pkt_fmt = MT_TX_TYPE_CMD;
109 	} else {
110 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
111 		pkt_fmt = MT_TX_TYPE_FW;
112 	}
113 
114 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
115 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
116 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
117 	txd[0] = cpu_to_le32(val);
118 
119 	val = MT_TXD1_LONG_FORMAT |
120 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
121 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
122 	txd[1] = cpu_to_le32(val);
123 
124 	if (cmd & MCU_UNI_PREFIX) {
125 		uni_txd = (struct mt7615_uni_txd *)txd;
126 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
127 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
128 		uni_txd->cid = cpu_to_le16(mcu_cmd);
129 		uni_txd->s2d_index = MCU_S2D_H2N;
130 		uni_txd->pkt_type = MCU_PKT_ID;
131 		uni_txd->seq = seq;
132 
133 		return;
134 	}
135 
136 	mcu_txd = (struct mt7615_mcu_txd *)txd;
137 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
138 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
139 	mcu_txd->s2d_index = MCU_S2D_H2N;
140 	mcu_txd->pkt_type = MCU_PKT_ID;
141 	mcu_txd->seq = seq;
142 
143 	switch (cmd & ~MCU_CMD_MASK) {
144 	case MCU_FW_PREFIX:
145 		mcu_txd->set_query = MCU_Q_NA;
146 		mcu_txd->cid = mcu_cmd;
147 		break;
148 	case MCU_CE_PREFIX:
149 		if (cmd & MCU_QUERY_MASK)
150 			mcu_txd->set_query = MCU_Q_QUERY;
151 		else
152 			mcu_txd->set_query = MCU_Q_SET;
153 		mcu_txd->cid = mcu_cmd;
154 		break;
155 	default:
156 		mcu_txd->cid = MCU_CMD_EXT_CID;
157 		if (cmd & MCU_QUERY_PREFIX)
158 			mcu_txd->set_query = MCU_Q_QUERY;
159 		else
160 			mcu_txd->set_query = MCU_Q_SET;
161 		mcu_txd->ext_cid = mcu_cmd;
162 		mcu_txd->ext_cid_ack = 1;
163 		break;
164 	}
165 }
166 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
167 
168 static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
169 				 int cmd, int *wait_seq)
170 {
171 	enum mt76_txq_id qid;
172 
173 	mt7615_mcu_fill_msg(dev, skb, cmd, wait_seq);
174 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
175 		qid = MT_TXQ_MCU;
176 	else
177 		qid = MT_TXQ_FWDL;
178 
179 	return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
180 }
181 
182 static int
183 mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
184 			  struct sk_buff *skb, int seq)
185 {
186 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
187 	int ret = 0;
188 
189 	if (seq != rxd->seq) {
190 		ret = -EAGAIN;
191 		goto out;
192 	}
193 
194 	switch (cmd) {
195 	case MCU_CMD_PATCH_SEM_CONTROL:
196 		skb_pull(skb, sizeof(*rxd) - 4);
197 		ret = *skb->data;
198 		break;
199 	case MCU_EXT_CMD_GET_TEMP:
200 		skb_pull(skb, sizeof(*rxd));
201 		ret = le32_to_cpu(*(__le32 *)skb->data);
202 		break;
203 	case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
204 		skb_pull(skb, sizeof(*rxd));
205 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
206 		break;
207 	case MCU_UNI_CMD_DEV_INFO_UPDATE:
208 	case MCU_UNI_CMD_BSS_INFO_UPDATE:
209 	case MCU_UNI_CMD_STA_REC_UPDATE:
210 	case MCU_UNI_CMD_HIF_CTRL:
211 	case MCU_UNI_CMD_OFFLOAD:
212 	case MCU_UNI_CMD_SUSPEND: {
213 		struct mt7615_mcu_uni_event *event;
214 
215 		skb_pull(skb, sizeof(*rxd));
216 		event = (struct mt7615_mcu_uni_event *)skb->data;
217 		ret = le32_to_cpu(event->status);
218 		break;
219 	}
220 	case MCU_CMD_REG_READ: {
221 		struct mt7615_mcu_reg_event *event;
222 
223 		skb_pull(skb, sizeof(*rxd));
224 		event = (struct mt7615_mcu_reg_event *)skb->data;
225 		ret = (int)le32_to_cpu(event->val);
226 		break;
227 	}
228 	default:
229 		break;
230 	}
231 out:
232 	dev_kfree_skb(skb);
233 
234 	return ret;
235 }
236 
237 int mt7615_mcu_wait_response(struct mt7615_dev *dev, int cmd, int seq)
238 {
239 	unsigned long expires = jiffies + 20 * HZ;
240 	struct sk_buff *skb;
241 	int ret = 0;
242 
243 	while (true) {
244 		skb = mt76_mcu_get_response(&dev->mt76, expires);
245 		if (!skb) {
246 			dev_err(dev->mt76.dev, "Message %ld (seq %d) timeout\n",
247 				cmd & MCU_CMD_MASK, seq);
248 			return -ETIMEDOUT;
249 		}
250 
251 		ret = mt7615_mcu_parse_response(dev, cmd, skb, seq);
252 		if (ret != -EAGAIN)
253 			break;
254 	}
255 
256 	return ret;
257 }
258 EXPORT_SYMBOL_GPL(mt7615_mcu_wait_response);
259 
260 static int
261 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
262 			int cmd, bool wait_resp)
263 {
264 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
265 	int ret, seq;
266 
267 	mutex_lock(&mdev->mcu.mutex);
268 
269 	ret = __mt7615_mcu_msg_send(dev, skb, cmd, &seq);
270 	if (ret)
271 		goto out;
272 
273 	if (wait_resp)
274 		ret = mt7615_mcu_wait_response(dev, cmd, seq);
275 
276 out:
277 	mutex_unlock(&mdev->mcu.mutex);
278 
279 	return ret;
280 }
281 
282 int mt7615_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
283 			int len, bool wait_resp)
284 {
285 	struct sk_buff *skb;
286 
287 	skb = mt76_mcu_msg_alloc(mdev, data, len);
288 	if (!skb)
289 		return -ENOMEM;
290 
291 	return __mt76_mcu_skb_send_msg(mdev, skb, cmd, wait_resp);
292 }
293 EXPORT_SYMBOL_GPL(mt7615_mcu_msg_send);
294 
295 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
296 {
297 	struct {
298 		__le32 wifi_stream;
299 		__le32 address;
300 		__le32 data;
301 	} req = {
302 		.wifi_stream = cpu_to_le32(wf),
303 		.address = cpu_to_le32(reg),
304 	};
305 
306 	return __mt76_mcu_send_msg(&dev->mt76,
307 				   MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
308 				   &req, sizeof(req), true);
309 }
310 
311 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
312 {
313 	struct {
314 		__le32 wifi_stream;
315 		__le32 address;
316 		__le32 data;
317 	} req = {
318 		.wifi_stream = cpu_to_le32(wf),
319 		.address = cpu_to_le32(reg),
320 		.data = cpu_to_le32(val),
321 	};
322 
323 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
324 				   sizeof(req), false);
325 }
326 
327 static void
328 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
329 {
330 	if (vif->csa_active)
331 		ieee80211_csa_finish(vif);
332 }
333 
334 static void
335 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
336 {
337 	struct mt76_phy *mphy = &dev->mt76.phy;
338 	struct mt7615_mcu_rdd_report *r;
339 
340 	r = (struct mt7615_mcu_rdd_report *)skb->data;
341 
342 	if (r->idx && dev->mt76.phy2)
343 		mphy = dev->mt76.phy2;
344 
345 	ieee80211_radar_detected(mphy->hw);
346 	dev->hw_pattern++;
347 }
348 
349 static void
350 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
351 {
352 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
353 	const char *data = (char *)&rxd[1];
354 	const char *type;
355 
356 	switch (rxd->s2d_index) {
357 	case 0:
358 		type = "N9";
359 		break;
360 	case 2:
361 		type = "CR4";
362 		break;
363 	default:
364 		type = "unknown";
365 		break;
366 	}
367 
368 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
369 }
370 
371 static void
372 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
373 {
374 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
375 
376 	switch (rxd->ext_eid) {
377 	case MCU_EXT_EVENT_RDD_REPORT:
378 		mt7615_mcu_rx_radar_detected(dev, skb);
379 		break;
380 	case MCU_EXT_EVENT_CSA_NOTIFY:
381 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
382 				IEEE80211_IFACE_ITER_RESUME_ALL,
383 				mt7615_mcu_csa_finish, dev);
384 		break;
385 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
386 		mt7615_mcu_rx_log_message(dev, skb);
387 		break;
388 	default:
389 		break;
390 	}
391 }
392 
393 static void
394 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
395 {
396 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
397 	struct mt7615_phy *phy;
398 	struct mt76_phy *mphy;
399 
400 	if (*seq_num & BIT(7) && dev->mt76.phy2)
401 		mphy = dev->mt76.phy2;
402 	else
403 		mphy = &dev->mt76.phy;
404 
405 	phy = (struct mt7615_phy *)mphy->priv;
406 
407 	spin_lock_bh(&dev->mt76.lock);
408 	__skb_queue_tail(&phy->scan_event_list, skb);
409 	spin_unlock_bh(&dev->mt76.lock);
410 
411 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
412 				     MT7615_HW_SCAN_TIMEOUT);
413 }
414 
415 static void
416 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
417 {
418 	struct mt7615_roc_tlv *event;
419 	struct mt7615_phy *phy;
420 	struct mt76_phy *mphy;
421 	int duration;
422 
423 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
424 	event = (struct mt7615_roc_tlv *)skb->data;
425 
426 	if (event->dbdc_band && dev->mt76.phy2)
427 		mphy = dev->mt76.phy2;
428 	else
429 		mphy = &dev->mt76.phy;
430 
431 	ieee80211_ready_on_channel(mphy->hw);
432 
433 	phy = (struct mt7615_phy *)mphy->priv;
434 	phy->roc_grant = true;
435 	wake_up(&phy->roc_wait);
436 
437 	duration = le32_to_cpu(event->max_interval);
438 	mod_timer(&phy->roc_timer,
439 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
440 }
441 
442 static void
443 mt7615_mcu_beacon_loss_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
444 {
445 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
446 	struct mt7615_beacon_loss_event *event = priv;
447 
448 	if (mvif->idx != event->bss_idx)
449 		return;
450 
451 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
452 		return;
453 
454 	ieee80211_beacon_loss(vif);
455 }
456 
457 static void
458 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
459 {
460 	struct mt7615_beacon_loss_event *event;
461 	struct mt76_phy *mphy;
462 	u8 band_idx = 0; /* DBDC support */
463 
464 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
465 	event = (struct mt7615_beacon_loss_event *)skb->data;
466 	if (band_idx && dev->mt76.phy2)
467 		mphy = dev->mt76.phy2;
468 	else
469 		mphy = &dev->mt76.phy;
470 
471 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
472 					IEEE80211_IFACE_ITER_RESUME_ALL,
473 					mt7615_mcu_beacon_loss_iter, event);
474 }
475 
476 static void
477 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
478 {
479 	struct mt7615_mcu_bss_event *event;
480 	struct mt76_phy *mphy;
481 	u8 band_idx = 0; /* DBDC support */
482 
483 	event = (struct mt7615_mcu_bss_event *)(skb->data +
484 						sizeof(struct mt7615_mcu_rxd));
485 
486 	if (band_idx && dev->mt76.phy2)
487 		mphy = dev->mt76.phy2;
488 	else
489 		mphy = &dev->mt76.phy;
490 
491 	if (event->is_absent)
492 		ieee80211_stop_queues(mphy->hw);
493 	else
494 		ieee80211_wake_queues(mphy->hw);
495 }
496 
497 static void
498 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
499 {
500 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
501 
502 	switch (rxd->eid) {
503 	case MCU_EVENT_EXT:
504 		mt7615_mcu_rx_ext_event(dev, skb);
505 		break;
506 	case MCU_EVENT_BSS_BEACON_LOSS:
507 		mt7615_mcu_beacon_loss_event(dev, skb);
508 		break;
509 	case MCU_EVENT_ROC:
510 		mt7615_mcu_roc_event(dev, skb);
511 		break;
512 	case MCU_EVENT_SCHED_SCAN_DONE:
513 	case MCU_EVENT_SCAN_DONE:
514 		mt7615_mcu_scan_event(dev, skb);
515 		return;
516 	case MCU_EVENT_BSS_ABSENCE:
517 		mt7615_mcu_bss_event(dev, skb);
518 		break;
519 	default:
520 		break;
521 	}
522 	dev_kfree_skb(skb);
523 }
524 
525 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
526 {
527 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
528 
529 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
530 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
531 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
532 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
533 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
534 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
535 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
536 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
537 	    rxd->eid == MCU_EVENT_ROC ||
538 	    !rxd->seq)
539 		mt7615_mcu_rx_unsolicited_event(dev, skb);
540 	else
541 		mt76_mcu_rx_event(&dev->mt76, skb);
542 }
543 
544 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
545 				    u32 len, u32 mode)
546 {
547 	struct {
548 		__le32 addr;
549 		__le32 len;
550 		__le32 mode;
551 	} req = {
552 		.addr = cpu_to_le32(addr),
553 		.len = cpu_to_le32(len),
554 		.mode = cpu_to_le32(mode),
555 	};
556 
557 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TARGET_ADDRESS_LEN_REQ,
558 				   &req, sizeof(req), true);
559 }
560 
561 static int
562 mt7615_mcu_add_dev(struct mt7615_dev *dev, struct ieee80211_vif *vif,
563 		   bool enable)
564 {
565 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
566 	struct {
567 		struct req_hdr {
568 			u8 omac_idx;
569 			u8 band_idx;
570 			__le16 tlv_num;
571 			u8 is_tlv_append;
572 			u8 rsv[3];
573 		} __packed hdr;
574 		struct req_tlv {
575 			__le16 tag;
576 			__le16 len;
577 			u8 active;
578 			u8 band_idx;
579 			u8 omac_addr[ETH_ALEN];
580 		} __packed tlv;
581 	} data = {
582 		.hdr = {
583 			.omac_idx = mvif->omac_idx,
584 			.band_idx = mvif->band_idx,
585 			.tlv_num = cpu_to_le16(1),
586 			.is_tlv_append = 1,
587 		},
588 		.tlv = {
589 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
590 			.len = cpu_to_le16(sizeof(struct req_tlv)),
591 			.active = enable,
592 			.band_idx = mvif->band_idx,
593 		},
594 	};
595 
596 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
597 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
598 				   &data, sizeof(data), true);
599 }
600 
601 static int
602 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
603 			      struct ieee80211_hw *hw,
604 			      struct ieee80211_vif *vif, bool enable)
605 {
606 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
607 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
608 	struct ieee80211_mutable_offsets offs;
609 	struct ieee80211_tx_info *info;
610 	struct req {
611 		u8 omac_idx;
612 		u8 enable;
613 		u8 wlan_idx;
614 		u8 band_idx;
615 		u8 pkt_type;
616 		u8 need_pre_tbtt_int;
617 		__le16 csa_ie_pos;
618 		__le16 pkt_len;
619 		__le16 tim_ie_pos;
620 		u8 pkt[512];
621 		u8 csa_cnt;
622 		/* bss color change */
623 		u8 bcc_cnt;
624 		__le16 bcc_ie_pos;
625 	} __packed req = {
626 		.omac_idx = mvif->omac_idx,
627 		.enable = enable,
628 		.wlan_idx = wcid->idx,
629 		.band_idx = mvif->band_idx,
630 	};
631 	struct sk_buff *skb;
632 
633 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
634 	if (!skb)
635 		return -EINVAL;
636 
637 	if (skb->len > 512 - MT_TXD_SIZE) {
638 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
639 		dev_kfree_skb(skb);
640 		return -EINVAL;
641 	}
642 
643 	if (mvif->band_idx) {
644 		info = IEEE80211_SKB_CB(skb);
645 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
646 	}
647 
648 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
649 			      0, NULL, true);
650 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
651 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
652 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
653 	if (offs.csa_counter_offs[0]) {
654 		u16 csa_offs;
655 
656 		csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
657 		req.csa_ie_pos = cpu_to_le16(csa_offs);
658 		req.csa_cnt = skb->data[offs.csa_counter_offs[0]];
659 	}
660 	dev_kfree_skb(skb);
661 
662 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD,
663 				   &req, sizeof(req), true);
664 }
665 
666 static int
667 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
668 {
669 #define ENTER_PM_STATE	1
670 #define EXIT_PM_STATE	2
671 	struct {
672 		u8 pm_number;
673 		u8 pm_state;
674 		u8 bssid[ETH_ALEN];
675 		u8 dtim_period;
676 		u8 wlan_idx;
677 		__le16 bcn_interval;
678 		__le32 aid;
679 		__le32 rx_filter;
680 		u8 band_idx;
681 		u8 rsv[3];
682 		__le32 feature;
683 		u8 omac_idx;
684 		u8 wmm_idx;
685 		u8 bcn_loss_cnt;
686 		u8 bcn_sp_duration;
687 	} __packed req = {
688 		.pm_number = 5,
689 		.pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
690 		.band_idx = band,
691 	};
692 
693 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
694 				   &req, sizeof(req), true);
695 }
696 
697 static struct sk_buff *
698 mt7615_mcu_alloc_sta_req(struct mt7615_dev *dev, struct mt7615_vif *mvif,
699 			 struct mt7615_sta *msta)
700 {
701 	struct sta_req_hdr hdr = {
702 		.bss_idx = mvif->idx,
703 		.wlan_idx = msta ? msta->wcid.idx : 0,
704 		.muar_idx = msta ? mvif->omac_idx : 0,
705 		.is_tlv_append = 1,
706 	};
707 	struct sk_buff *skb;
708 
709 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7615_STA_UPDATE_MAX_SIZE);
710 	if (!skb)
711 		return ERR_PTR(-ENOMEM);
712 
713 	skb_put_data(skb, &hdr, sizeof(hdr));
714 
715 	return skb;
716 }
717 
718 static struct wtbl_req_hdr *
719 mt7615_mcu_alloc_wtbl_req(struct mt7615_dev *dev, struct mt7615_sta *msta,
720 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
721 {
722 	struct tlv *sta_hdr = sta_wtbl;
723 	struct wtbl_req_hdr hdr = {
724 		.wlan_idx = msta->wcid.idx,
725 		.operation = cmd,
726 	};
727 	struct sk_buff *nskb = *skb;
728 
729 	if (!nskb) {
730 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
731 					  MT7615_WTBL_UPDATE_BA_SIZE);
732 		if (!nskb)
733 			return ERR_PTR(-ENOMEM);
734 
735 		*skb = nskb;
736 	}
737 
738 	if (sta_hdr)
739 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
740 
741 	return skb_put_data(nskb, &hdr, sizeof(hdr));
742 }
743 
744 static struct tlv *
745 mt7615_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
746 			  void *sta_ntlv, void *sta_wtbl)
747 {
748 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
749 	struct tlv *sta_hdr = sta_wtbl;
750 	struct tlv *ptlv, tlv = {
751 		.tag = cpu_to_le16(tag),
752 		.len = cpu_to_le16(len),
753 	};
754 	u16 ntlv;
755 
756 	ptlv = skb_put(skb, len);
757 	memcpy(ptlv, &tlv, sizeof(tlv));
758 
759 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
760 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
761 
762 	if (sta_hdr) {
763 		u16 size = le16_to_cpu(sta_hdr->len);
764 
765 		sta_hdr->len = cpu_to_le16(size + len);
766 	}
767 
768 	return ptlv;
769 }
770 
771 static struct tlv *
772 mt7615_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
773 {
774 	return mt7615_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
775 }
776 
777 static int
778 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
779 			 struct ieee80211_sta *sta, bool enable)
780 {
781 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
782 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
783 	struct bss_info_basic *bss;
784 	u8 wlan_idx = mvif->sta.wcid.idx;
785 	struct tlv *tlv;
786 
787 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
788 
789 	switch (vif->type) {
790 	case NL80211_IFTYPE_MESH_POINT:
791 	case NL80211_IFTYPE_AP:
792 		break;
793 	case NL80211_IFTYPE_STATION:
794 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
795 		if (enable && sta) {
796 			struct mt7615_sta *msta;
797 
798 			msta = (struct mt7615_sta *)sta->drv_priv;
799 			wlan_idx = msta->wcid.idx;
800 		}
801 		break;
802 	case NL80211_IFTYPE_ADHOC:
803 		type = NETWORK_IBSS;
804 		break;
805 	default:
806 		WARN_ON(1);
807 		break;
808 	}
809 
810 	bss = (struct bss_info_basic *)tlv;
811 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
812 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
813 	bss->network_type = cpu_to_le32(type);
814 	bss->dtim_period = vif->bss_conf.dtim_period;
815 	bss->bmc_tx_wlan_idx = wlan_idx;
816 	bss->wmm_idx = mvif->wmm_idx;
817 	bss->active = enable;
818 
819 	return 0;
820 }
821 
822 static void
823 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
824 {
825 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
826 	struct bss_info_omac *omac;
827 	struct tlv *tlv;
828 	u32 type = 0;
829 	u8 idx;
830 
831 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
832 
833 	switch (vif->type) {
834 	case NL80211_IFTYPE_MESH_POINT:
835 	case NL80211_IFTYPE_AP:
836 		if (vif->p2p)
837 			type = CONNECTION_P2P_GO;
838 		else
839 			type = CONNECTION_INFRA_AP;
840 		break;
841 	case NL80211_IFTYPE_STATION:
842 		if (vif->p2p)
843 			type = CONNECTION_P2P_GC;
844 		else
845 			type = CONNECTION_INFRA_STA;
846 		break;
847 	case NL80211_IFTYPE_ADHOC:
848 		type = CONNECTION_IBSS_ADHOC;
849 		break;
850 	default:
851 		WARN_ON(1);
852 		break;
853 	}
854 
855 	omac = (struct bss_info_omac *)tlv;
856 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
857 	omac->conn_type = cpu_to_le32(type);
858 	omac->omac_idx = mvif->omac_idx;
859 	omac->band_idx = mvif->band_idx;
860 	omac->hw_bss_idx = idx;
861 }
862 
863 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
864 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
865 static void
866 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
867 {
868 	struct bss_info_ext_bss *ext;
869 	int ext_bss_idx, tsf_offset;
870 	struct tlv *tlv;
871 
872 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
873 	if (ext_bss_idx < 0)
874 		return;
875 
876 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
877 
878 	ext = (struct bss_info_ext_bss *)tlv;
879 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
880 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
881 }
882 
883 static void
884 mt7615_mcu_sta_ba_tlv(struct sk_buff *skb,
885 		      struct ieee80211_ampdu_params *params,
886 		      bool enable, bool tx)
887 {
888 	struct sta_rec_ba *ba;
889 	struct tlv *tlv;
890 
891 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
892 
893 	ba = (struct sta_rec_ba *)tlv;
894 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
895 	ba->winsize = cpu_to_le16(params->buf_size);
896 	ba->ssn = cpu_to_le16(params->ssn);
897 	ba->ba_en = enable << params->tid;
898 	ba->amsdu = params->amsdu;
899 	ba->tid = params->tid;
900 }
901 
902 static void
903 mt7615_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
904 			 struct ieee80211_sta *sta, bool enable)
905 {
906 	struct sta_rec_basic *basic;
907 	struct tlv *tlv;
908 	int conn_type;
909 
910 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
911 
912 	basic = (struct sta_rec_basic *)tlv;
913 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
914 
915 	if (enable) {
916 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
917 		basic->conn_state = CONN_STATE_PORT_SECURE;
918 	} else {
919 		basic->conn_state = CONN_STATE_DISCONNECT;
920 	}
921 
922 	if (!sta) {
923 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
924 		eth_broadcast_addr(basic->peer_addr);
925 		return;
926 	}
927 
928 	switch (vif->type) {
929 	case NL80211_IFTYPE_MESH_POINT:
930 	case NL80211_IFTYPE_AP:
931 		if (vif->p2p)
932 			conn_type = CONNECTION_P2P_GC;
933 		else
934 			conn_type = CONNECTION_INFRA_STA;
935 		basic->conn_type = cpu_to_le32(conn_type);
936 		basic->aid = cpu_to_le16(sta->aid);
937 		break;
938 	case NL80211_IFTYPE_STATION:
939 		if (vif->p2p)
940 			conn_type = CONNECTION_P2P_GO;
941 		else
942 			conn_type = CONNECTION_INFRA_AP;
943 		basic->conn_type = cpu_to_le32(conn_type);
944 		basic->aid = cpu_to_le16(vif->bss_conf.aid);
945 		break;
946 	case NL80211_IFTYPE_ADHOC:
947 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
948 		basic->aid = cpu_to_le16(sta->aid);
949 		break;
950 	default:
951 		WARN_ON(1);
952 		break;
953 	}
954 
955 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
956 	basic->qos = sta->wme;
957 }
958 
959 static void
960 mt7615_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
961 {
962 	struct tlv *tlv;
963 
964 	if (sta->ht_cap.ht_supported) {
965 		struct sta_rec_ht *ht;
966 
967 		tlv = mt7615_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
968 		ht = (struct sta_rec_ht *)tlv;
969 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
970 	}
971 	if (sta->vht_cap.vht_supported) {
972 		struct sta_rec_vht *vht;
973 
974 		tlv = mt7615_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
975 		vht = (struct sta_rec_vht *)tlv;
976 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
977 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
978 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
979 	}
980 }
981 
982 static void
983 mt7615_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,
984 		     struct ieee80211_sta *sta)
985 {
986 	struct sta_rec_uapsd *uapsd;
987 	struct tlv *tlv;
988 
989 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
990 		return;
991 
992 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
993 	uapsd = (struct sta_rec_uapsd *)tlv;
994 
995 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
996 		uapsd->dac_map |= BIT(3);
997 		uapsd->tac_map |= BIT(3);
998 	}
999 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1000 		uapsd->dac_map |= BIT(2);
1001 		uapsd->tac_map |= BIT(2);
1002 	}
1003 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1004 		uapsd->dac_map |= BIT(1);
1005 		uapsd->tac_map |= BIT(1);
1006 	}
1007 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1008 		uapsd->dac_map |= BIT(0);
1009 		uapsd->tac_map |= BIT(0);
1010 	}
1011 	uapsd->max_sp = sta->max_sp;
1012 }
1013 
1014 static void
1015 mt7615_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1016 		       struct ieee80211_ampdu_params *params,
1017 		       bool enable, bool tx, void *sta_wtbl,
1018 		       void *wtbl_tlv)
1019 {
1020 	struct wtbl_ba *ba;
1021 	struct tlv *tlv;
1022 
1023 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1024 					wtbl_tlv, sta_wtbl);
1025 
1026 	ba = (struct wtbl_ba *)tlv;
1027 	ba->tid = params->tid;
1028 
1029 	if (tx) {
1030 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1031 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1032 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1033 		ba->ba_en = enable;
1034 	} else {
1035 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1036 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1037 		ba->rst_ba_tid = params->tid;
1038 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1039 		ba->rst_ba_sb = 1;
1040 	}
1041 
1042 	if (enable && tx) {
1043 		u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1044 		int i;
1045 
1046 		for (i = 7; i > 0; i--) {
1047 			if (params->buf_size >= ba_range[i])
1048 				break;
1049 		}
1050 		ba->ba_winsize_idx = i;
1051 	}
1052 }
1053 
1054 static void
1055 mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1056 			    struct ieee80211_sta *sta, void *sta_wtbl,
1057 			    void *wtbl_tlv)
1058 {
1059 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1060 	struct wtbl_generic *generic;
1061 	struct wtbl_rx *rx;
1062 	struct wtbl_spe *spe;
1063 	struct tlv *tlv;
1064 
1065 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1066 					wtbl_tlv, sta_wtbl);
1067 
1068 	generic = (struct wtbl_generic *)tlv;
1069 
1070 	if (sta) {
1071 		if (vif->type == NL80211_IFTYPE_STATION)
1072 			generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
1073 		else
1074 			generic->partial_aid = cpu_to_le16(sta->aid);
1075 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1076 		generic->muar_idx = mvif->omac_idx;
1077 		generic->qos = sta->wme;
1078 	} else {
1079 		eth_broadcast_addr(generic->peer_addr);
1080 		generic->muar_idx = 0xe;
1081 	}
1082 
1083 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1084 					wtbl_tlv, sta_wtbl);
1085 
1086 	rx = (struct wtbl_rx *)tlv;
1087 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1088 	rx->rca2 = 1;
1089 	rx->rv = 1;
1090 
1091 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
1092 					wtbl_tlv, sta_wtbl);
1093 	spe = (struct wtbl_spe *)tlv;
1094 	spe->spe_idx = 24;
1095 }
1096 
1097 static void
1098 mt7615_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1099 		       void *sta_wtbl, void *wtbl_tlv)
1100 {
1101 	struct tlv *tlv;
1102 	struct wtbl_ht *ht = NULL;
1103 	u32 flags = 0;
1104 
1105 	if (sta->ht_cap.ht_supported) {
1106 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1107 						wtbl_tlv, sta_wtbl);
1108 		ht = (struct wtbl_ht *)tlv;
1109 		ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
1110 		ht->af = sta->ht_cap.ampdu_factor;
1111 		ht->mm = sta->ht_cap.ampdu_density;
1112 		ht->ht = 1;
1113 
1114 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1115 			flags |= MT_WTBL_W5_SHORT_GI_20;
1116 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1117 			flags |= MT_WTBL_W5_SHORT_GI_40;
1118 	}
1119 
1120 	if (sta->vht_cap.vht_supported) {
1121 		struct wtbl_vht *vht;
1122 		u8 af;
1123 
1124 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1125 						wtbl_tlv, sta_wtbl);
1126 		vht = (struct wtbl_vht *)tlv;
1127 		vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC,
1128 		vht->vht = 1;
1129 
1130 		af = (sta->vht_cap.cap &
1131 		      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
1132 		      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
1133 
1134 		if (ht)
1135 		    ht->af = max(ht->af, af);
1136 
1137 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1138 			flags |= MT_WTBL_W5_SHORT_GI_80;
1139 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1140 			flags |= MT_WTBL_W5_SHORT_GI_160;
1141 	}
1142 
1143 	/* wtbl smps */
1144 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1145 		struct wtbl_smps *smps;
1146 
1147 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1148 						wtbl_tlv, sta_wtbl);
1149 		smps = (struct wtbl_smps *)tlv;
1150 		smps->smps = 1;
1151 	}
1152 
1153 	if (sta->ht_cap.ht_supported) {
1154 		/* sgi */
1155 		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1156 			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1157 		struct wtbl_raw *raw;
1158 
1159 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
1160 						sizeof(*raw), wtbl_tlv,
1161 						sta_wtbl);
1162 		raw = (struct wtbl_raw *)tlv;
1163 		raw->val = cpu_to_le32(flags);
1164 		raw->msk = cpu_to_le32(~msk);
1165 		raw->wtbl_idx = 1;
1166 		raw->dw = 5;
1167 	}
1168 }
1169 
1170 static int
1171 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1172 		   struct ieee80211_sta *sta, bool enable)
1173 {
1174 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1175 	struct mt7615_dev *dev = phy->dev;
1176 	struct sk_buff *skb;
1177 
1178 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, NULL);
1179 	if (IS_ERR(skb))
1180 		return PTR_ERR(skb);
1181 
1182 	if (enable)
1183 		mt7615_mcu_bss_omac_tlv(skb, vif);
1184 
1185 	mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
1186 
1187 	if (enable && mvif->omac_idx > EXT_BSSID_START)
1188 		mt7615_mcu_bss_ext_tlv(skb, mvif);
1189 
1190 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1191 				       MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1192 }
1193 
1194 static int
1195 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
1196 		      struct ieee80211_ampdu_params *params,
1197 		      bool enable)
1198 {
1199 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1200 	struct mt7615_vif *mvif = msta->vif;
1201 	struct wtbl_req_hdr *wtbl_hdr;
1202 	struct sk_buff *skb = NULL;
1203 	int err;
1204 
1205 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1206 	if (IS_ERR(wtbl_hdr))
1207 		return PTR_ERR(wtbl_hdr);
1208 
1209 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, NULL, wtbl_hdr);
1210 
1211 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1212 				      MCU_EXT_CMD_WTBL_UPDATE, true);
1213 	if (err < 0)
1214 		return err;
1215 
1216 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1217 	if (IS_ERR(skb))
1218 		return PTR_ERR(skb);
1219 
1220 	mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1221 
1222 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1223 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1224 }
1225 
1226 static int
1227 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
1228 		      struct ieee80211_ampdu_params *params,
1229 		      bool enable)
1230 {
1231 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1232 	struct mt7615_vif *mvif = msta->vif;
1233 	struct wtbl_req_hdr *wtbl_hdr;
1234 	struct sk_buff *skb;
1235 	int err;
1236 
1237 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1238 	if (IS_ERR(skb))
1239 		return PTR_ERR(skb);
1240 
1241 	mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1242 
1243 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1244 				      MCU_EXT_CMD_STA_REC_UPDATE, true);
1245 	if (err < 0 || !enable)
1246 		return err;
1247 
1248 	skb = NULL;
1249 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1250 	if (IS_ERR(wtbl_hdr))
1251 		return PTR_ERR(wtbl_hdr);
1252 
1253 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, NULL, wtbl_hdr);
1254 
1255 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1256 				       MCU_EXT_CMD_WTBL_UPDATE, true);
1257 }
1258 
1259 static int
1260 mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1261 			struct ieee80211_sta *sta, bool enable)
1262 {
1263 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1264 	struct sk_buff *skb, *sskb, *wskb = NULL;
1265 	struct wtbl_req_hdr *wtbl_hdr;
1266 	struct mt7615_sta *msta;
1267 	int cmd, err;
1268 
1269 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1270 
1271 	sskb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1272 	if (IS_ERR(sskb))
1273 		return PTR_ERR(sskb);
1274 
1275 	mt7615_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1276 	if (enable && sta) {
1277 		mt7615_mcu_sta_ht_tlv(sskb, sta);
1278 		mt7615_mcu_sta_uapsd(sskb, vif, sta);
1279 	}
1280 
1281 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1282 					     NULL, &wskb);
1283 	if (IS_ERR(wtbl_hdr))
1284 		return PTR_ERR(wtbl_hdr);
1285 
1286 	if (enable) {
1287 		mt7615_mcu_wtbl_generic_tlv(wskb, vif, sta, NULL, wtbl_hdr);
1288 		if (sta)
1289 			mt7615_mcu_wtbl_ht_tlv(wskb, sta, NULL, wtbl_hdr);
1290 	}
1291 
1292 	cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1293 	skb = enable ? wskb : sskb;
1294 
1295 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1296 	if (err < 0) {
1297 		skb = enable ? sskb : wskb;
1298 		dev_kfree_skb(skb);
1299 
1300 		return err;
1301 	}
1302 
1303 	cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1304 	skb = enable ? sskb : wskb;
1305 
1306 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1307 }
1308 
1309 static const struct mt7615_mcu_ops wtbl_update_ops = {
1310 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1311 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1312 	.add_dev_info = mt7615_mcu_add_dev,
1313 	.add_bss_info = mt7615_mcu_add_bss,
1314 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1315 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1316 	.sta_add = mt7615_mcu_wtbl_sta_add,
1317 };
1318 
1319 static int
1320 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1321 		  struct ieee80211_ampdu_params *params,
1322 		  bool enable, bool tx)
1323 {
1324 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1325 	struct mt7615_vif *mvif = msta->vif;
1326 	struct wtbl_req_hdr *wtbl_hdr;
1327 	struct tlv *sta_wtbl;
1328 	struct sk_buff *skb;
1329 
1330 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1331 	if (IS_ERR(skb))
1332 		return PTR_ERR(skb);
1333 
1334 	mt7615_mcu_sta_ba_tlv(skb, params, enable, tx);
1335 
1336 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1337 
1338 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1339 					     &skb);
1340 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1341 
1342 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1343 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1344 }
1345 
1346 static int
1347 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1348 		     struct ieee80211_ampdu_params *params,
1349 		     bool enable)
1350 {
1351 	return mt7615_mcu_sta_ba(dev, params, enable, true);
1352 }
1353 
1354 static int
1355 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1356 		     struct ieee80211_ampdu_params *params,
1357 		     bool enable)
1358 {
1359 	return mt7615_mcu_sta_ba(dev, params, enable, false);
1360 }
1361 
1362 static int
1363 mt7615_mcu_add_sta_cmd(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1364 		       struct ieee80211_sta *sta, bool enable, int cmd)
1365 {
1366 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1367 	struct wtbl_req_hdr *wtbl_hdr;
1368 	struct mt7615_sta *msta;
1369 	struct tlv *sta_wtbl;
1370 	struct sk_buff *skb;
1371 
1372 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1373 
1374 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1375 	if (IS_ERR(skb))
1376 		return PTR_ERR(skb);
1377 
1378 	mt7615_mcu_sta_basic_tlv(skb, vif, sta, enable);
1379 	if (enable && sta) {
1380 		mt7615_mcu_sta_ht_tlv(skb, sta);
1381 		mt7615_mcu_sta_uapsd(skb, vif, sta);
1382 	}
1383 
1384 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1385 
1386 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1387 					     sta_wtbl, &skb);
1388 	if (enable) {
1389 		mt7615_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
1390 		if (sta)
1391 			mt7615_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1392 	}
1393 
1394 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1395 }
1396 
1397 static int
1398 mt7615_mcu_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1399 		   struct ieee80211_sta *sta, bool enable)
1400 {
1401 	return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1402 				      MCU_EXT_CMD_STA_REC_UPDATE);
1403 }
1404 
1405 static const struct mt7615_mcu_ops sta_update_ops = {
1406 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1407 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1408 	.add_dev_info = mt7615_mcu_add_dev,
1409 	.add_bss_info = mt7615_mcu_add_bss,
1410 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1411 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1412 	.sta_add = mt7615_mcu_add_sta,
1413 };
1414 
1415 static int
1416 mt7615_mcu_uni_add_dev(struct mt7615_dev *dev,
1417 		       struct ieee80211_vif *vif, bool enable)
1418 {
1419 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1420 	struct {
1421 		struct {
1422 			u8 omac_idx;
1423 			u8 band_idx;
1424 			__le16 pad;
1425 		} __packed hdr;
1426 		struct req_tlv {
1427 			__le16 tag;
1428 			__le16 len;
1429 			u8 active;
1430 			u8 pad;
1431 			u8 omac_addr[ETH_ALEN];
1432 		} __packed tlv;
1433 	} dev_req = {
1434 		.hdr = {
1435 			.omac_idx = mvif->omac_idx,
1436 			.band_idx = mvif->band_idx,
1437 		},
1438 		.tlv = {
1439 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1440 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1441 			.active = enable,
1442 		},
1443 	};
1444 	struct {
1445 		struct {
1446 			u8 bss_idx;
1447 			u8 pad[3];
1448 		} __packed hdr;
1449 		struct mt7615_bss_basic_tlv basic;
1450 	} basic_req = {
1451 		.hdr = {
1452 			.bss_idx = mvif->idx,
1453 		},
1454 		.basic = {
1455 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1456 			.len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1457 			.omac_idx = mvif->omac_idx,
1458 			.band_idx = mvif->band_idx,
1459 			.wmm_idx = mvif->wmm_idx,
1460 			.active = enable,
1461 			.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx),
1462 			.sta_idx = cpu_to_le16(mvif->sta.wcid.idx),
1463 			.conn_state = 1,
1464 		},
1465 	};
1466 	int err, idx, cmd, len;
1467 	void *data;
1468 
1469 	switch (vif->type) {
1470 	case NL80211_IFTYPE_MESH_POINT:
1471 	case NL80211_IFTYPE_AP:
1472 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1473 		break;
1474 	case NL80211_IFTYPE_STATION:
1475 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1476 		break;
1477 	case NL80211_IFTYPE_ADHOC:
1478 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1479 		break;
1480 	default:
1481 		WARN_ON(1);
1482 		break;
1483 	}
1484 
1485 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1486 	basic_req.basic.hw_bss_idx = idx;
1487 
1488 	memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1489 
1490 	cmd = enable ? MCU_UNI_CMD_DEV_INFO_UPDATE : MCU_UNI_CMD_BSS_INFO_UPDATE;
1491 	data = enable ? (void *)&dev_req : (void *)&basic_req;
1492 	len = enable ? sizeof(dev_req) : sizeof(basic_req);
1493 
1494 	err = __mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1495 	if (err < 0)
1496 		return err;
1497 
1498 	cmd = enable ? MCU_UNI_CMD_BSS_INFO_UPDATE : MCU_UNI_CMD_DEV_INFO_UPDATE;
1499 	data = enable ? (void *)&basic_req : (void *)&dev_req;
1500 	len = enable ? sizeof(basic_req) : sizeof(dev_req);
1501 
1502 	return __mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1503 }
1504 
1505 static int
1506 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1507 {
1508 	return 0;
1509 }
1510 
1511 static int
1512 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1513 		       struct ieee80211_sta *sta, bool enable)
1514 {
1515 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1516 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1517 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1518 	struct mt7615_dev *dev = phy->dev;
1519 	struct {
1520 		struct {
1521 			u8 bss_idx;
1522 			u8 pad[3];
1523 		} __packed hdr;
1524 		struct mt7615_bss_basic_tlv basic;
1525 		struct mt7615_bss_qos_tlv qos;
1526 	} basic_req = {
1527 		.hdr = {
1528 			.bss_idx = mvif->idx,
1529 		},
1530 		.basic = {
1531 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1532 			.len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1533 			.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1534 			.dtim_period = vif->bss_conf.dtim_period,
1535 			.omac_idx = mvif->omac_idx,
1536 			.band_idx = mvif->band_idx,
1537 			.wmm_idx = mvif->wmm_idx,
1538 			.active = true, /* keep bss deactivated */
1539 			.phymode = 0x38,
1540 		},
1541 		.qos = {
1542 			.tag = cpu_to_le16(UNI_BSS_INFO_QBSS),
1543 			.len = cpu_to_le16(sizeof(struct mt7615_bss_qos_tlv)),
1544 			.qos = vif->bss_conf.qos,
1545 		},
1546 	};
1547 	struct {
1548 		struct {
1549 			u8 bss_idx;
1550 			u8 pad[3];
1551 		} __packed hdr;
1552 		struct rlm_tlv {
1553 			__le16 tag;
1554 			__le16 len;
1555 			u8 control_channel;
1556 			u8 center_chan;
1557 			u8 center_chan2;
1558 			u8 bw;
1559 			u8 tx_streams;
1560 			u8 rx_streams;
1561 			u8 short_st;
1562 			u8 ht_op_info;
1563 			u8 sco;
1564 			u8 pad[3];
1565 		} __packed rlm;
1566 	} __packed rlm_req = {
1567 		.hdr = {
1568 			.bss_idx = mvif->idx,
1569 		},
1570 		.rlm = {
1571 			.tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1572 			.len = cpu_to_le16(sizeof(struct rlm_tlv)),
1573 			.control_channel = chandef->chan->hw_value,
1574 			.center_chan = ieee80211_frequency_to_channel(freq1),
1575 			.center_chan2 = ieee80211_frequency_to_channel(freq2),
1576 			.tx_streams = hweight8(phy->mt76->antenna_mask),
1577 			.rx_streams = phy->chainmask,
1578 			.short_st = true,
1579 		},
1580 	};
1581 	int err, conn_type;
1582 	u8 idx;
1583 
1584 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1585 	basic_req.basic.hw_bss_idx = idx;
1586 
1587 	switch (vif->type) {
1588 	case NL80211_IFTYPE_MESH_POINT:
1589 	case NL80211_IFTYPE_AP:
1590 		if (vif->p2p)
1591 			conn_type = CONNECTION_P2P_GO;
1592 		else
1593 			conn_type = CONNECTION_INFRA_AP;
1594 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1595 		break;
1596 	case NL80211_IFTYPE_STATION:
1597 		if (vif->p2p)
1598 			conn_type = CONNECTION_P2P_GC;
1599 		else
1600 			conn_type = CONNECTION_INFRA_STA;
1601 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1602 		break;
1603 	case NL80211_IFTYPE_ADHOC:
1604 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1605 		break;
1606 	default:
1607 		WARN_ON(1);
1608 		break;
1609 	}
1610 
1611 	memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1612 	basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx);
1613 	basic_req.basic.sta_idx = cpu_to_le16(mvif->sta.wcid.idx);
1614 	basic_req.basic.conn_state = !enable;
1615 
1616 	err = __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1617 				  &basic_req, sizeof(basic_req), true);
1618 	if (err < 0)
1619 		return err;
1620 
1621 	switch (chandef->width) {
1622 	case NL80211_CHAN_WIDTH_40:
1623 		rlm_req.rlm.bw = CMD_CBW_40MHZ;
1624 		break;
1625 	case NL80211_CHAN_WIDTH_80:
1626 		rlm_req.rlm.bw = CMD_CBW_80MHZ;
1627 		break;
1628 	case NL80211_CHAN_WIDTH_80P80:
1629 		rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1630 		break;
1631 	case NL80211_CHAN_WIDTH_160:
1632 		rlm_req.rlm.bw = CMD_CBW_160MHZ;
1633 		break;
1634 	case NL80211_CHAN_WIDTH_5:
1635 		rlm_req.rlm.bw = CMD_CBW_5MHZ;
1636 		break;
1637 	case NL80211_CHAN_WIDTH_10:
1638 		rlm_req.rlm.bw = CMD_CBW_10MHZ;
1639 		break;
1640 	case NL80211_CHAN_WIDTH_20_NOHT:
1641 	case NL80211_CHAN_WIDTH_20:
1642 	default:
1643 		rlm_req.rlm.bw = CMD_CBW_20MHZ;
1644 		break;
1645 	}
1646 
1647 	if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1648 		rlm_req.rlm.sco = 1; /* SCA */
1649 	else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1650 		rlm_req.rlm.sco = 3; /* SCB */
1651 
1652 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1653 				   &rlm_req, sizeof(rlm_req), true);
1654 }
1655 
1656 static int
1657 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1658 				  struct ieee80211_hw *hw,
1659 				  struct ieee80211_vif *vif,
1660 				  bool enable)
1661 {
1662 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1663 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1664 	struct ieee80211_mutable_offsets offs;
1665 	struct {
1666 		struct req_hdr {
1667 			u8 bss_idx;
1668 			u8 pad[3];
1669 		} __packed hdr;
1670 		struct bcn_content_tlv {
1671 			__le16 tag;
1672 			__le16 len;
1673 			__le16 tim_ie_pos;
1674 			__le16 csa_ie_pos;
1675 			__le16 bcc_ie_pos;
1676 			/* 0: enable beacon offload
1677 			 * 1: disable beacon offload
1678 			 * 2: update probe respond offload
1679 			 */
1680 			u8 enable;
1681 			/* 0: legacy format (TXD + payload)
1682 			 * 1: only cap field IE
1683 			 */
1684 			u8 type;
1685 			__le16 pkt_len;
1686 			u8 pkt[512];
1687 		} __packed beacon_tlv;
1688 	} req = {
1689 		.hdr = {
1690 			.bss_idx = mvif->idx,
1691 		},
1692 		.beacon_tlv = {
1693 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1694 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1695 			.enable = enable,
1696 		},
1697 	};
1698 	struct sk_buff *skb;
1699 
1700 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1701 	if (!skb)
1702 		return -EINVAL;
1703 
1704 	if (skb->len > 512 - MT_TXD_SIZE) {
1705 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1706 		dev_kfree_skb(skb);
1707 		return -EINVAL;
1708 	}
1709 
1710 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1711 			      wcid, NULL, 0, NULL, true);
1712 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1713 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1714 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1715 
1716 	if (offs.csa_counter_offs[0]) {
1717 		u16 csa_offs;
1718 
1719 		csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
1720 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1721 	}
1722 	dev_kfree_skb(skb);
1723 
1724 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1725 				   &req, sizeof(req), true);
1726 }
1727 
1728 static int
1729 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1730 		     struct ieee80211_ampdu_params *params,
1731 		     bool enable)
1732 {
1733 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1734 	struct mt7615_vif *mvif = msta->vif;
1735 	struct wtbl_req_hdr *wtbl_hdr;
1736 	struct tlv *sta_wtbl;
1737 	struct sk_buff *skb;
1738 	int err;
1739 
1740 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1741 	if (IS_ERR(skb))
1742 		return PTR_ERR(skb);
1743 
1744 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1745 
1746 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1747 					     &skb);
1748 	if (IS_ERR(wtbl_hdr))
1749 		return PTR_ERR(wtbl_hdr);
1750 
1751 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, sta_wtbl,
1752 			       wtbl_hdr);
1753 
1754 	err =  __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1755 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1756 	if (err < 0)
1757 		return err;
1758 
1759 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1760 	if (IS_ERR(skb))
1761 		return PTR_ERR(skb);
1762 
1763 	mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1764 
1765 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1766 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1767 }
1768 
1769 static int
1770 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1771 		     struct ieee80211_ampdu_params *params,
1772 		     bool enable)
1773 {
1774 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1775 	struct mt7615_vif *mvif = msta->vif;
1776 	struct wtbl_req_hdr *wtbl_hdr;
1777 	struct tlv *sta_wtbl;
1778 	struct sk_buff *skb;
1779 	int err;
1780 
1781 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1782 	if (IS_ERR(skb))
1783 		return PTR_ERR(skb);
1784 
1785 	mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1786 
1787 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1788 				      MCU_UNI_CMD_STA_REC_UPDATE, true);
1789 	if (err < 0 || !enable)
1790 		return err;
1791 
1792 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1793 	if (IS_ERR(skb))
1794 		return PTR_ERR(skb);
1795 
1796 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1797 
1798 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1799 					     &skb);
1800 	if (IS_ERR(wtbl_hdr))
1801 		return PTR_ERR(wtbl_hdr);
1802 
1803 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, sta_wtbl,
1804 			       wtbl_hdr);
1805 
1806 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1807 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1808 }
1809 
1810 static int
1811 mt7615_mcu_uni_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1812 		       struct ieee80211_sta *sta, bool enable)
1813 {
1814 	return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1815 				      MCU_UNI_CMD_STA_REC_UPDATE);
1816 }
1817 
1818 static const struct mt7615_mcu_ops uni_update_ops = {
1819 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1820 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1821 	.add_dev_info = mt7615_mcu_uni_add_dev,
1822 	.add_bss_info = mt7615_mcu_uni_add_bss,
1823 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1824 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1825 	.sta_add = mt7615_mcu_uni_add_sta,
1826 };
1827 
1828 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
1829 				    int len)
1830 {
1831 	int ret = 0, cur_len;
1832 
1833 	while (len > 0) {
1834 		cur_len = min_t(int, 4096 - dev->mt76.mcu_ops->headroom, len);
1835 
1836 		ret = __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_SCATTER,
1837 					  data, cur_len, false);
1838 		if (ret)
1839 			break;
1840 
1841 		data += cur_len;
1842 		len -= cur_len;
1843 
1844 		if (mt76_is_mmio(&dev->mt76))
1845 			mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
1846 	}
1847 
1848 	return ret;
1849 }
1850 
1851 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
1852 				     u32 option)
1853 {
1854 	struct {
1855 		__le32 option;
1856 		__le32 addr;
1857 	} req = {
1858 		.option = cpu_to_le32(option),
1859 		.addr = cpu_to_le32(addr),
1860 	};
1861 
1862 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_START_REQ,
1863 				   &req, sizeof(req), true);
1864 }
1865 
1866 int mt7615_mcu_restart(struct mt76_dev *dev)
1867 {
1868 	return __mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL,
1869 				   0, true);
1870 }
1871 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1872 
1873 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
1874 {
1875 	struct {
1876 		__le32 op;
1877 	} req = {
1878 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
1879 	};
1880 
1881 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_SEM_CONTROL,
1882 				   &req, sizeof(req), true);
1883 }
1884 
1885 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
1886 {
1887 	struct {
1888 		u8 check_crc;
1889 		u8 reserved[3];
1890 	} req = {
1891 		.check_crc = 0,
1892 	};
1893 
1894 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_FINISH_REQ,
1895 				   &req, sizeof(req), true);
1896 }
1897 
1898 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
1899 {
1900 	if (!is_mt7622(&dev->mt76))
1901 		return;
1902 
1903 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
1904 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
1905 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
1906 }
1907 
1908 int mt7615_driver_own(struct mt7615_dev *dev)
1909 {
1910 	struct mt76_phy *mphy = &dev->mt76.phy;
1911 	struct mt76_dev *mdev = &dev->mt76;
1912 	int i;
1913 
1914 	if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
1915 		goto out;
1916 
1917 	mt7622_trigger_hif_int(dev, true);
1918 
1919 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
1920 		u32 addr;
1921 
1922 		addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
1923 		mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
1924 
1925 		addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
1926 		if (mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
1927 			break;
1928 	}
1929 
1930 	mt7622_trigger_hif_int(dev, false);
1931 
1932 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
1933 		dev_err(mdev->dev, "driver own failed\n");
1934 		set_bit(MT76_STATE_PM, &mphy->state);
1935 		return -EIO;
1936 	}
1937 
1938 out:
1939 	dev->pm.last_activity = jiffies;
1940 
1941 	return 0;
1942 }
1943 EXPORT_SYMBOL_GPL(mt7615_driver_own);
1944 
1945 int mt7615_firmware_own(struct mt7615_dev *dev)
1946 {
1947 	struct mt76_phy *mphy = &dev->mt76.phy;
1948 	int err = 0;
1949 	u32 addr;
1950 
1951 	if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
1952 		return 0;
1953 
1954 	mt7622_trigger_hif_int(dev, true);
1955 
1956 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
1957 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
1958 
1959 	if (is_mt7622(&dev->mt76) &&
1960 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
1961 			    MT_CFG_LPCR_HOST_FW_OWN, 300)) {
1962 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
1963 		clear_bit(MT76_STATE_PM, &mphy->state);
1964 		err = -EIO;
1965 	}
1966 
1967 	mt7622_trigger_hif_int(dev, false);
1968 
1969 	return err;
1970 }
1971 EXPORT_SYMBOL_GPL(mt7615_firmware_own);
1972 
1973 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1974 {
1975 	const struct mt7615_patch_hdr *hdr;
1976 	const struct firmware *fw = NULL;
1977 	int len, ret, sem;
1978 
1979 	sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
1980 	switch (sem) {
1981 	case PATCH_IS_DL:
1982 		return 0;
1983 	case PATCH_NOT_DL_SEM_SUCCESS:
1984 		break;
1985 	default:
1986 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1987 		return -EAGAIN;
1988 	}
1989 
1990 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1991 	if (ret)
1992 		goto out;
1993 
1994 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1995 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1996 		ret = -EINVAL;
1997 		goto out;
1998 	}
1999 
2000 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
2001 
2002 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2003 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2004 
2005 	len = fw->size - sizeof(*hdr);
2006 
2007 	ret = mt7615_mcu_init_download(dev, addr, len, DL_MODE_NEED_RSP);
2008 	if (ret) {
2009 		dev_err(dev->mt76.dev, "Download request failed\n");
2010 		goto out;
2011 	}
2012 
2013 	ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
2014 	if (ret) {
2015 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2016 		goto out;
2017 	}
2018 
2019 	ret = mt7615_mcu_start_patch(dev);
2020 	if (ret)
2021 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2022 
2023 out:
2024 	release_firmware(fw);
2025 
2026 	sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
2027 	switch (sem) {
2028 	case PATCH_REL_SEM_SUCCESS:
2029 		break;
2030 	default:
2031 		ret = -EAGAIN;
2032 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2033 		break;
2034 	}
2035 
2036 	return ret;
2037 }
2038 
2039 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
2040 {
2041 	u32 ret = 0;
2042 
2043 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2044 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2045 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2046 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2047 	ret |= DL_MODE_NEED_RSP;
2048 	ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
2049 
2050 	return ret;
2051 }
2052 
2053 static int
2054 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
2055 			     const struct mt7615_fw_trailer *hdr,
2056 			     const u8 *data, bool is_cr4)
2057 {
2058 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
2059 	int err, i, offset = 0;
2060 	u32 len, addr, mode;
2061 
2062 	for (i = 0; i < n_region; i++) {
2063 		mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
2064 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
2065 		addr = le32_to_cpu(hdr[i].addr);
2066 
2067 		err = mt7615_mcu_init_download(dev, addr, len, mode);
2068 		if (err) {
2069 			dev_err(dev->mt76.dev, "Download request failed\n");
2070 			return err;
2071 		}
2072 
2073 		err = mt7615_mcu_send_firmware(dev, data + offset, len);
2074 		if (err) {
2075 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2076 			return err;
2077 		}
2078 
2079 		offset += len;
2080 	}
2081 
2082 	return 0;
2083 }
2084 
2085 static const struct wiphy_wowlan_support mt7615_wowlan_support = {
2086 	.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
2087 		 WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
2088 	.n_patterns = 1,
2089 	.pattern_min_len = 1,
2090 	.pattern_max_len = MT7615_WOW_PATTEN_MAX_LEN,
2091 	.max_nd_match_sets = 10,
2092 };
2093 
2094 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
2095 {
2096 	const struct mt7615_fw_trailer *hdr;
2097 	const struct firmware *fw;
2098 	int ret;
2099 
2100 	ret = request_firmware(&fw, name, dev->mt76.dev);
2101 	if (ret)
2102 		return ret;
2103 
2104 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
2105 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2106 		ret = -EINVAL;
2107 		goto out;
2108 	}
2109 
2110 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2111 					N9_REGION_NUM * sizeof(*hdr));
2112 
2113 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2114 		 hdr->fw_ver, hdr->build_date);
2115 
2116 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2117 	if (ret)
2118 		goto out;
2119 
2120 	ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
2121 					FW_START_OVERRIDE);
2122 	if (ret) {
2123 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2124 		goto out;
2125 	}
2126 
2127 	snprintf(dev->mt76.hw->wiphy->fw_version,
2128 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2129 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2130 
2131 	if (!strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
2132 		dev->fw_ver = MT7615_FIRMWARE_V2;
2133 		dev->mcu_ops = &sta_update_ops;
2134 	} else {
2135 		dev->fw_ver = MT7615_FIRMWARE_V1;
2136 		dev->mcu_ops = &wtbl_update_ops;
2137 	}
2138 
2139 out:
2140 	release_firmware(fw);
2141 	return ret;
2142 }
2143 
2144 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
2145 {
2146 	const struct mt7615_fw_trailer *hdr;
2147 	const struct firmware *fw;
2148 	int ret;
2149 
2150 	ret = request_firmware(&fw, name, dev->mt76.dev);
2151 	if (ret)
2152 		return ret;
2153 
2154 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
2155 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2156 		ret = -EINVAL;
2157 		goto out;
2158 	}
2159 
2160 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2161 					CR4_REGION_NUM * sizeof(*hdr));
2162 
2163 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
2164 		 hdr->fw_ver, hdr->build_date);
2165 
2166 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2167 	if (ret)
2168 		goto out;
2169 
2170 	ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
2171 	if (ret) {
2172 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
2173 		goto out;
2174 	}
2175 
2176 out:
2177 	release_firmware(fw);
2178 
2179 	return ret;
2180 }
2181 
2182 static int mt7615_load_ram(struct mt7615_dev *dev)
2183 {
2184 	int ret;
2185 
2186 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
2187 	if (ret)
2188 		return ret;
2189 
2190 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
2191 }
2192 
2193 static int mt7615_load_firmware(struct mt7615_dev *dev)
2194 {
2195 	int ret;
2196 	u32 val;
2197 
2198 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
2199 
2200 	if (val != FW_STATE_FW_DOWNLOAD) {
2201 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2202 		return -EIO;
2203 	}
2204 
2205 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
2206 	if (ret)
2207 		return ret;
2208 
2209 	ret = mt7615_load_ram(dev);
2210 	if (ret)
2211 		return ret;
2212 
2213 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
2214 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
2215 				       FW_STATE_CR4_RDY), 500)) {
2216 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2217 		return -EIO;
2218 	}
2219 
2220 	return 0;
2221 }
2222 
2223 static int mt7622_load_firmware(struct mt7615_dev *dev)
2224 {
2225 	int ret;
2226 	u32 val;
2227 
2228 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2229 
2230 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
2231 	if (val != FW_STATE_FW_DOWNLOAD) {
2232 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2233 		return -EIO;
2234 	}
2235 
2236 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
2237 	if (ret)
2238 		return ret;
2239 
2240 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
2241 	if (ret)
2242 		return ret;
2243 
2244 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
2245 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
2246 				       FW_STATE_NORMAL_TRX), 1500)) {
2247 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2248 		return -EIO;
2249 	}
2250 
2251 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2252 
2253 	return 0;
2254 }
2255 
2256 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
2257 {
2258 	struct {
2259 		u8 ctrl_val;
2260 		u8 pad[3];
2261 	} data = {
2262 		.ctrl_val = ctrl
2263 	};
2264 
2265 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST,
2266 				   &data, sizeof(data), true);
2267 }
2268 
2269 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
2270 {
2271 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
2272 	const struct mt7663_fw_trailer *hdr;
2273 	const struct mt7663_fw_buf *buf;
2274 	const struct firmware *fw;
2275 	const u8 *base_addr;
2276 	int i, ret;
2277 
2278 	ret = request_firmware(&fw, name, dev->mt76.dev);
2279 	if (ret)
2280 		return ret;
2281 
2282 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
2283 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2284 		ret = -EINVAL;
2285 		goto out;
2286 	}
2287 
2288 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
2289 						 FW_V3_COMMON_TAILER_SIZE);
2290 
2291 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2292 		 hdr->fw_ver, hdr->build_date);
2293 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
2294 
2295 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
2296 	for (i = 0; i < hdr->n_region; i++) {
2297 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
2298 		u32 len, addr, mode;
2299 
2300 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
2301 
2302 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
2303 		mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
2304 		addr = le32_to_cpu(buf->img_dest_addr);
2305 		len = le32_to_cpu(buf->img_size);
2306 
2307 		ret = mt7615_mcu_init_download(dev, addr, len, mode);
2308 		if (ret) {
2309 			dev_err(dev->mt76.dev, "Download request failed\n");
2310 			goto out;
2311 		}
2312 
2313 		ret = mt7615_mcu_send_firmware(dev, fw->data + offset, len);
2314 		if (ret) {
2315 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
2316 			goto out;
2317 		}
2318 
2319 		offset += le32_to_cpu(buf->img_size);
2320 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
2321 			override_addr = le32_to_cpu(buf->img_dest_addr);
2322 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
2323 				 i, override_addr);
2324 		}
2325 	}
2326 
2327 	if (override_addr)
2328 		flag |= FW_START_OVERRIDE;
2329 
2330 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
2331 		 override_addr, flag);
2332 
2333 	ret = mt7615_mcu_start_firmware(dev, override_addr, flag);
2334 	if (ret) {
2335 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2336 		goto out;
2337 	}
2338 
2339 	snprintf(dev->mt76.hw->wiphy->fw_version,
2340 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2341 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2342 
2343 out:
2344 	release_firmware(fw);
2345 
2346 	return ret;
2347 }
2348 
2349 static int
2350 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
2351 {
2352 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
2353 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
2354 	int ret;
2355 
2356 	if (!prefer_offload_fw) {
2357 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
2358 		primary_rom = MT7663_ROM_PATCH;
2359 	}
2360 	selected_rom = primary_rom;
2361 
2362 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
2363 	if (ret) {
2364 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
2365 			 primary_rom, secondary_rom);
2366 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
2367 					secondary_rom);
2368 		if (ret) {
2369 			dev_err(dev->mt76.dev, "failed to load %s",
2370 				secondary_rom);
2371 			return ret;
2372 		}
2373 		selected_rom = secondary_rom;
2374 	}
2375 
2376 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
2377 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
2378 		dev->fw_ver = MT7615_FIRMWARE_V3;
2379 		dev->mcu_ops = &uni_update_ops;
2380 	} else {
2381 		*n9_firmware = MT7663_FIRMWARE_N9;
2382 		dev->fw_ver = MT7615_FIRMWARE_V2;
2383 		dev->mcu_ops = &sta_update_ops;
2384 	}
2385 
2386 	return 0;
2387 }
2388 
2389 int __mt7663_load_firmware(struct mt7615_dev *dev)
2390 {
2391 	const char *n9_firmware;
2392 	int ret;
2393 
2394 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
2395 	if (ret) {
2396 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
2397 		return -EIO;
2398 	}
2399 
2400 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
2401 	if (ret)
2402 		return ret;
2403 
2404 	ret = mt7663_load_n9(dev, n9_firmware);
2405 	if (ret)
2406 		return ret;
2407 
2408 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
2409 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
2410 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
2411 				     MT7663_TOP_MISC2_FW_STATE);
2412 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2413 		return -EIO;
2414 	}
2415 
2416 #ifdef CONFIG_PM
2417 	if (mt7615_firmware_offload(dev))
2418 		dev->mt76.hw->wiphy->wowlan = &mt7615_wowlan_support;
2419 #endif /* CONFIG_PM */
2420 
2421 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2422 
2423 	return 0;
2424 }
2425 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
2426 
2427 static int mt7663_load_firmware(struct mt7615_dev *dev)
2428 {
2429 	int ret;
2430 
2431 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2432 
2433 	ret = __mt7663_load_firmware(dev);
2434 	if (ret)
2435 		return ret;
2436 
2437 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2438 
2439 	return 0;
2440 }
2441 
2442 int mt7615_mcu_init(struct mt7615_dev *dev)
2443 {
2444 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
2445 		.headroom = sizeof(struct mt7615_mcu_txd),
2446 		.mcu_skb_send_msg = mt7615_mcu_send_message,
2447 		.mcu_send_msg = mt7615_mcu_msg_send,
2448 		.mcu_restart = mt7615_mcu_restart,
2449 	};
2450 	int ret;
2451 
2452 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
2453 
2454 	ret = mt7615_driver_own(dev);
2455 	if (ret)
2456 		return ret;
2457 
2458 	switch (mt76_chip(&dev->mt76)) {
2459 	case 0x7622:
2460 		ret = mt7622_load_firmware(dev);
2461 		break;
2462 	case 0x7663:
2463 		ret = mt7663_load_firmware(dev);
2464 		break;
2465 	default:
2466 		ret = mt7615_load_firmware(dev);
2467 		break;
2468 	}
2469 	if (ret)
2470 		return ret;
2471 
2472 	mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2473 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2474 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2475 	mt7615_mcu_fw_log_2_host(dev, 0);
2476 
2477 	return 0;
2478 }
2479 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
2480 
2481 void mt7615_mcu_exit(struct mt7615_dev *dev)
2482 {
2483 	__mt76_mcu_restart(&dev->mt76);
2484 	mt7615_firmware_own(dev);
2485 	skb_queue_purge(&dev->mt76.mcu.res_q);
2486 }
2487 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
2488 
2489 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
2490 {
2491 	struct {
2492 		u8 buffer_mode;
2493 		u8 content_format;
2494 		__le16 len;
2495 	} __packed req_hdr = {
2496 		.buffer_mode = 1,
2497 	};
2498 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2499 	struct sk_buff *skb;
2500 	int eep_len, offset;
2501 
2502 	switch (mt76_chip(&dev->mt76)) {
2503 	case 0x7622:
2504 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
2505 		offset = MT_EE_NIC_CONF_0;
2506 		break;
2507 	case 0x7663:
2508 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
2509 		req_hdr.content_format = 1;
2510 		offset = MT_EE_CHIP_ID;
2511 		break;
2512 	default:
2513 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
2514 		offset = MT_EE_NIC_CONF_0;
2515 		break;
2516 	}
2517 
2518 	req_hdr.len = cpu_to_le16(eep_len);
2519 
2520 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
2521 	if (!skb)
2522 		return -ENOMEM;
2523 
2524 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2525 	skb_put_data(skb, eep + offset, eep_len);
2526 
2527 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2528 				       MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
2529 }
2530 EXPORT_SYMBOL_GPL(mt7615_mcu_set_eeprom);
2531 
2532 int mt7615_mcu_set_mac_enable(struct mt7615_dev *dev, int band, bool enable)
2533 {
2534 	struct {
2535 		u8 enable;
2536 		u8 band;
2537 		u8 rsv[2];
2538 	} __packed req = {
2539 		.enable = enable,
2540 		.band = band,
2541 	};
2542 
2543 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2544 				   &req, sizeof(req), true);
2545 }
2546 
2547 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
2548 {
2549 	struct mt7615_dev *dev = phy->dev;
2550 	struct {
2551 		u8 prot_idx;
2552 		u8 band;
2553 		u8 rsv[2];
2554 		__le32 len_thresh;
2555 		__le32 pkt_thresh;
2556 	} __packed req = {
2557 		.prot_idx = 1,
2558 		.band = phy != &dev->phy,
2559 		.len_thresh = cpu_to_le32(val),
2560 		.pkt_thresh = cpu_to_le32(0x2),
2561 	};
2562 
2563 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
2564 				   &req, sizeof(req), true);
2565 }
2566 
2567 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
2568 		       const struct ieee80211_tx_queue_params *params)
2569 {
2570 #define WMM_AIFS_SET	BIT(0)
2571 #define WMM_CW_MIN_SET	BIT(1)
2572 #define WMM_CW_MAX_SET	BIT(2)
2573 #define WMM_TXOP_SET	BIT(3)
2574 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
2575 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
2576 	struct req_data {
2577 		u8 number;
2578 		u8 rsv[3];
2579 		u8 queue;
2580 		u8 valid;
2581 		u8 aifs;
2582 		u8 cw_min;
2583 		__le16 cw_max;
2584 		__le16 txop;
2585 	} __packed req = {
2586 		.number = 1,
2587 		.queue = queue,
2588 		.valid = WMM_PARAM_SET,
2589 		.aifs = params->aifs,
2590 		.cw_min = 5,
2591 		.cw_max = cpu_to_le16(10),
2592 		.txop = cpu_to_le16(params->txop),
2593 	};
2594 
2595 	if (params->cw_min)
2596 		req.cw_min = fls(params->cw_min);
2597 	if (params->cw_max)
2598 		req.cw_max = cpu_to_le16(fls(params->cw_max));
2599 
2600 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
2601 				   &req, sizeof(req), true);
2602 }
2603 
2604 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
2605 {
2606 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2607 	struct dbdc_entry {
2608 		u8 type;
2609 		u8 index;
2610 		u8 band;
2611 		u8 _rsv;
2612 	};
2613 	struct {
2614 		u8 enable;
2615 		u8 num;
2616 		u8 _rsv[2];
2617 		struct dbdc_entry entry[64];
2618 	} req = {
2619 		.enable = !!ext_phy,
2620 	};
2621 	int i;
2622 
2623 	if (!ext_phy)
2624 		goto out;
2625 
2626 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
2627 	do { \
2628 		req.entry[req.num].type = _type;		\
2629 		req.entry[req.num].index = _idx;		\
2630 		req.entry[req.num++].band = _band;		\
2631 	} while (0)
2632 
2633 	for (i = 0; i < 4; i++) {
2634 		bool band = !!(ext_phy->omac_mask & BIT(i));
2635 
2636 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2637 	}
2638 
2639 	for (i = 0; i < 14; i++) {
2640 		bool band = !!(ext_phy->omac_mask & BIT(0x11 + i));
2641 
2642 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2643 	}
2644 
2645 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2646 
2647 	for (i = 0; i < 3; i++)
2648 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2649 
2650 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2651 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2652 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2653 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2654 
2655 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2656 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2657 
2658 out:
2659 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL,
2660 				   &req, sizeof(req), true);
2661 }
2662 
2663 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2664 {
2665 	struct wtbl_req_hdr req = {
2666 		.operation = WTBL_RESET_ALL,
2667 	};
2668 
2669 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
2670 				   &req, sizeof(req), true);
2671 }
2672 EXPORT_SYMBOL_GPL(mt7615_mcu_del_wtbl_all);
2673 
2674 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2675 		       enum mt7615_rdd_cmd cmd, u8 index,
2676 		       u8 rx_sel, u8 val)
2677 {
2678 	struct {
2679 		u8 ctrl;
2680 		u8 rdd_idx;
2681 		u8 rdd_rx_sel;
2682 		u8 val;
2683 		u8 rsv[4];
2684 	} req = {
2685 		.ctrl = cmd,
2686 		.rdd_idx = index,
2687 		.rdd_rx_sel = rx_sel,
2688 		.val = val,
2689 	};
2690 
2691 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL,
2692 				   &req, sizeof(req), true);
2693 }
2694 
2695 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2696 {
2697 	struct {
2698 		u16 tag;
2699 		u16 min_lpn;
2700 	} req = {
2701 		.tag = 0x1,
2702 		.min_lpn = val,
2703 	};
2704 
2705 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2706 				   &req, sizeof(req), true);
2707 }
2708 
2709 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2710 			    const struct mt7615_dfs_pulse *pulse)
2711 {
2712 	struct {
2713 		u16 tag;
2714 		struct mt7615_dfs_pulse pulse;
2715 	} req = {
2716 		.tag = 0x3,
2717 	};
2718 
2719 	memcpy(&req.pulse, pulse, sizeof(*pulse));
2720 
2721 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2722 				   &req, sizeof(req), true);
2723 }
2724 
2725 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2726 			    const struct mt7615_dfs_pattern *pattern)
2727 {
2728 	struct {
2729 		u16 tag;
2730 		u16 radar_type;
2731 		struct mt7615_dfs_pattern pattern;
2732 	} req = {
2733 		.tag = 0x2,
2734 		.radar_type = index,
2735 	};
2736 
2737 	memcpy(&req.pattern, pattern, sizeof(*pattern));
2738 
2739 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2740 				   &req, sizeof(req), true);
2741 }
2742 
2743 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2744 {
2745 	struct {
2746 		u8 pulse_num;
2747 		u8 rsv[3];
2748 		struct {
2749 			u32 start_time;
2750 			u16 width;
2751 			s16 power;
2752 		} pattern[32];
2753 	} req = {
2754 		.pulse_num = dev->radar_pattern.n_pulses,
2755 	};
2756 	u32 start_time = ktime_to_ms(ktime_get_boottime());
2757 	int i;
2758 
2759 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2760 		return -EINVAL;
2761 
2762 	/* TODO: add some noise here */
2763 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2764 		req.pattern[i].width = dev->radar_pattern.width;
2765 		req.pattern[i].power = dev->radar_pattern.power;
2766 		req.pattern[i].start_time = start_time +
2767 					    i * dev->radar_pattern.period;
2768 	}
2769 
2770 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2771 				   &req, sizeof(req), false);
2772 }
2773 
2774 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2775 {
2776 	struct mt76_phy *mphy = phy->mt76;
2777 	struct ieee80211_hw *hw = mphy->hw;
2778 	int n_chains = hweight8(mphy->antenna_mask);
2779 	int tx_power;
2780 	int i;
2781 
2782 	tx_power = hw->conf.power_level * 2 -
2783 		   mt76_tx_power_nss_delta(n_chains);
2784 	mphy->txpower_cur = tx_power;
2785 
2786 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2787 		sku[i] = tx_power;
2788 
2789 	for (i = 0; i < 4; i++) {
2790 		int delta = 0;
2791 
2792 		if (i < n_chains - 1)
2793 			delta = mt76_tx_power_nss_delta(n_chains) -
2794 				mt76_tx_power_nss_delta(i + 1);
2795 		sku[MT_SKU_1SS_DELTA + i] = delta;
2796 	}
2797 }
2798 
2799 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2800 {
2801 	static const u8 width_to_bw[] = {
2802 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2803 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2804 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2805 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2806 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2807 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2808 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2809 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2810 	};
2811 
2812 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2813 		return 0;
2814 
2815 	return width_to_bw[chandef->width];
2816 }
2817 
2818 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2819 {
2820 	struct mt7615_dev *dev = phy->dev;
2821 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2822 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2823 	struct {
2824 		u8 control_chan;
2825 		u8 center_chan;
2826 		u8 bw;
2827 		u8 tx_streams;
2828 		u8 rx_streams_mask;
2829 		u8 switch_reason;
2830 		u8 band_idx;
2831 		/* for 80+80 only */
2832 		u8 center_chan2;
2833 		__le16 cac_case;
2834 		u8 channel_band;
2835 		u8 rsv0;
2836 		__le32 outband_freq;
2837 		u8 txpower_drop;
2838 		u8 rsv1[3];
2839 		u8 txpower_sku[53];
2840 		u8 rsv2[3];
2841 	} req = {
2842 		.control_chan = chandef->chan->hw_value,
2843 		.center_chan = ieee80211_frequency_to_channel(freq1),
2844 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2845 		.rx_streams_mask = phy->chainmask,
2846 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2847 	};
2848 
2849 #ifdef CONFIG_NL80211_TESTMODE
2850 	if (dev->mt76.test.state == MT76_TM_STATE_TX_FRAMES &&
2851 	    dev->mt76.test.tx_antenna_mask) {
2852 		req.tx_streams = hweight8(dev->mt76.test.tx_antenna_mask);
2853 		req.rx_streams_mask = dev->mt76.test.tx_antenna_mask;
2854 	}
2855 #endif
2856 
2857 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2858 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2859 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2860 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2861 		req.switch_reason = CH_SWITCH_DFS;
2862 	else
2863 		req.switch_reason = CH_SWITCH_NORMAL;
2864 
2865 	req.band_idx = phy != &dev->phy;
2866 	req.bw = mt7615_mcu_chan_bw(chandef);
2867 
2868 	if (mt76_testmode_enabled(&dev->mt76))
2869 		memset(req.txpower_sku, 0x3f, 49);
2870 	else
2871 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2872 
2873 	return __mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2874 }
2875 
2876 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2877 {
2878 	struct {
2879 		u8 action;
2880 		u8 rsv[3];
2881 	} req = {
2882 		.action = index,
2883 	};
2884 
2885 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2886 				   sizeof(req), true);
2887 }
2888 
2889 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2890 			      u32 val)
2891 {
2892 	struct {
2893 		u8 test_mode_en;
2894 		u8 param_idx;
2895 		u8 _rsv[2];
2896 
2897 		__le32 value;
2898 
2899 		u8 pad[8];
2900 	} req = {
2901 		.test_mode_en = test_mode,
2902 		.param_idx = param,
2903 		.value = cpu_to_le32(val),
2904 	};
2905 
2906 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2907 				   sizeof(req), false);
2908 }
2909 
2910 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2911 {
2912 	struct mt7615_dev *dev = phy->dev;
2913 	struct {
2914 		u8 format_id;
2915 		u8 sku_enable;
2916 		u8 band_idx;
2917 		u8 rsv;
2918 	} req = {
2919 		.format_id = 0,
2920 		.band_idx = phy != &dev->phy,
2921 		.sku_enable = enable,
2922 	};
2923 
2924 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2925 				   sizeof(req), true);
2926 }
2927 
2928 int mt7615_mcu_set_vif_ps(struct mt7615_dev *dev, struct ieee80211_vif *vif)
2929 {
2930 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2931 	struct {
2932 		u8 bss_idx;
2933 		u8 ps_state; /* 0: device awake
2934 			      * 1: static power save
2935 			      * 2: dynamic power saving
2936 			      */
2937 	} req = {
2938 		.bss_idx = mvif->idx,
2939 		.ps_state = vif->bss_conf.ps ? 2 : 0,
2940 	};
2941 
2942 	if (vif->type != NL80211_IFTYPE_STATION)
2943 		return -ENOTSUPP;
2944 
2945 	return __mt76_mcu_send_msg(&dev->mt76,  MCU_CMD_SET_PS_PROFILE,
2946 				   &req, sizeof(req), false);
2947 }
2948 
2949 int mt7615_mcu_set_channel_domain(struct mt7615_phy *phy)
2950 {
2951 	struct mt76_phy *mphy = phy->mt76;
2952 	struct mt7615_dev *dev = phy->dev;
2953 	struct mt7615_mcu_channel_domain {
2954 		__le32 country_code; /* regulatory_request.alpha2 */
2955 		u8 bw_2g; /* BW_20_40M		0
2956 			   * BW_20M		1
2957 			   * BW_20_40_80M	2
2958 			   * BW_20_40_80_160M	3
2959 			   * BW_20_40_80_8080M	4
2960 			   */
2961 		u8 bw_5g;
2962 		__le16 pad;
2963 		u8 n_2ch;
2964 		u8 n_5ch;
2965 		__le16 pad2;
2966 	} __packed hdr = {
2967 		.bw_2g = 0,
2968 		.bw_5g = 3,
2969 		.n_2ch = mphy->sband_2g.sband.n_channels,
2970 		.n_5ch = mphy->sband_5g.sband.n_channels,
2971 	};
2972 	struct mt7615_mcu_chan {
2973 		__le16 hw_value;
2974 		__le16 pad;
2975 		__le32 flags;
2976 	} __packed;
2977 	int i, n_channels = hdr.n_2ch + hdr.n_5ch;
2978 	int len = sizeof(hdr) + n_channels * sizeof(struct mt7615_mcu_chan);
2979 	struct sk_buff *skb;
2980 
2981 	if (!mt7615_firmware_offload(dev))
2982 		return 0;
2983 
2984 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
2985 	if (!skb)
2986 		return -ENOMEM;
2987 
2988 	skb_put_data(skb, &hdr, sizeof(hdr));
2989 
2990 	for (i = 0; i < n_channels; i++) {
2991 		struct ieee80211_channel *chan;
2992 		struct mt7615_mcu_chan channel;
2993 
2994 		if (i < hdr.n_2ch)
2995 			chan = &mphy->sband_2g.sband.channels[i];
2996 		else
2997 			chan = &mphy->sband_5g.sband.channels[i - hdr.n_2ch];
2998 
2999 		channel.hw_value = cpu_to_le16(chan->hw_value);
3000 		channel.flags = cpu_to_le32(chan->flags);
3001 		channel.pad = 0;
3002 
3003 		skb_put_data(skb, &channel, sizeof(channel));
3004 	}
3005 
3006 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3007 				       MCU_CMD_SET_CHAN_DOMAIN, false);
3008 }
3009 
3010 #define MT7615_SCAN_CHANNEL_TIME	60
3011 int mt7615_mcu_hw_scan(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3012 		       struct ieee80211_scan_request *scan_req)
3013 {
3014 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3015 	struct cfg80211_scan_request *sreq = &scan_req->req;
3016 	int n_ssids = 0, err, i, duration = MT7615_SCAN_CHANNEL_TIME;
3017 	int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
3018 	struct ieee80211_channel **scan_list = sreq->channels;
3019 	struct mt7615_dev *dev = phy->dev;
3020 	bool ext_phy = phy != &dev->phy;
3021 	struct mt7615_mcu_scan_channel *chan;
3022 	struct mt7615_hw_scan_req *req;
3023 	struct sk_buff *skb;
3024 
3025 	/* fall-back to sw-scan */
3026 	if (!mt7615_firmware_offload(dev))
3027 		return 1;
3028 
3029 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(*req));
3030 	if (!skb)
3031 		return -ENOMEM;
3032 
3033 	set_bit(MT76_HW_SCANNING, &phy->mt76->state);
3034 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3035 
3036 	req = (struct mt7615_hw_scan_req *)skb_put(skb, sizeof(*req));
3037 
3038 	req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3039 	req->bss_idx = mvif->idx;
3040 	req->scan_type = sreq->n_ssids ? 1 : 0;
3041 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
3042 	req->version = 1;
3043 
3044 	for (i = 0; i < sreq->n_ssids; i++) {
3045 		if (!sreq->ssids[i].ssid_len)
3046 			continue;
3047 
3048 		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
3049 		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
3050 		       sreq->ssids[i].ssid_len);
3051 		n_ssids++;
3052 	}
3053 	req->ssid_type = n_ssids ? BIT(2) : BIT(0);
3054 	req->ssid_type_ext = n_ssids ? BIT(0) : 0;
3055 	req->ssids_num = n_ssids;
3056 
3057 	/* increase channel time for passive scan */
3058 	if (!sreq->n_ssids)
3059 		duration *= 2;
3060 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
3061 	req->channel_min_dwell_time = cpu_to_le16(duration);
3062 	req->channel_dwell_time = cpu_to_le16(duration);
3063 
3064 	req->channels_num = min_t(u8, sreq->n_channels, 32);
3065 	req->ext_channels_num = min_t(u8, ext_channels_num, 32);
3066 	for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
3067 		if (i >= 32)
3068 			chan = &req->ext_channels[i - 32];
3069 		else
3070 			chan = &req->channels[i];
3071 
3072 		chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3073 		chan->channel_num = scan_list[i]->hw_value;
3074 	}
3075 	req->channel_type = sreq->n_channels ? 4 : 0;
3076 
3077 	if (sreq->ie_len > 0) {
3078 		memcpy(req->ies, sreq->ie, sreq->ie_len);
3079 		req->ies_len = cpu_to_le16(sreq->ie_len);
3080 	}
3081 
3082 	memcpy(req->bssid, sreq->bssid, ETH_ALEN);
3083 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3084 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
3085 				     sreq->mac_addr_mask);
3086 		req->scan_func = 1;
3087 	}
3088 
3089 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_START_HW_SCAN,
3090 				      false);
3091 	if (err < 0)
3092 		clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
3093 
3094 	return err;
3095 }
3096 
3097 int mt7615_mcu_cancel_hw_scan(struct mt7615_phy *phy,
3098 			      struct ieee80211_vif *vif)
3099 {
3100 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3101 	struct mt7615_dev *dev = phy->dev;
3102 	struct {
3103 		u8 seq_num;
3104 		u8 is_ext_channel;
3105 		u8 rsv[2];
3106 	} __packed req = {
3107 		.seq_num = mvif->scan_seq_num,
3108 	};
3109 
3110 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->mt76->state)) {
3111 		struct cfg80211_scan_info info = {
3112 			.aborted = true,
3113 		};
3114 
3115 		ieee80211_scan_completed(phy->mt76->hw, &info);
3116 	}
3117 
3118 	return __mt76_mcu_send_msg(&dev->mt76,  MCU_CMD_CANCEL_HW_SCAN, &req,
3119 				   sizeof(req), false);
3120 }
3121 
3122 int mt7615_mcu_sched_scan_req(struct mt7615_phy *phy,
3123 			      struct ieee80211_vif *vif,
3124 			      struct cfg80211_sched_scan_request *sreq)
3125 {
3126 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3127 	struct ieee80211_channel **scan_list = sreq->channels;
3128 	struct mt7615_dev *dev = phy->dev;
3129 	bool ext_phy = phy != &dev->phy;
3130 	struct mt7615_mcu_scan_channel *chan;
3131 	struct mt7615_sched_scan_req *req;
3132 	struct cfg80211_match_set *match;
3133 	struct cfg80211_ssid *ssid;
3134 	struct sk_buff *skb;
3135 	int i;
3136 
3137 	if (!mt7615_firmware_offload(dev))
3138 		return -ENOTSUPP;
3139 
3140 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3141 				 sizeof(*req) + sreq->ie_len);
3142 	if (!skb)
3143 		return -ENOMEM;
3144 
3145 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3146 
3147 	req = (struct mt7615_sched_scan_req *)skb_put(skb, sizeof(*req));
3148 	req->version = 1;
3149 	req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3150 
3151 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3152 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
3153 				     sreq->mac_addr_mask);
3154 		req->scan_func = 1;
3155 	}
3156 
3157 	req->ssids_num = sreq->n_ssids;
3158 	for (i = 0; i < req->ssids_num; i++) {
3159 		ssid = &sreq->ssids[i];
3160 		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
3161 		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
3162 	}
3163 
3164 	req->match_num = sreq->n_match_sets;
3165 	for (i = 0; i < req->match_num; i++) {
3166 		match = &sreq->match_sets[i];
3167 		memcpy(req->match[i].ssid, match->ssid.ssid,
3168 		       match->ssid.ssid_len);
3169 		req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
3170 		req->match[i].ssid_len = match->ssid.ssid_len;
3171 	}
3172 
3173 	req->channel_type = sreq->n_channels ? 4 : 0;
3174 	req->channels_num = min_t(u8, sreq->n_channels, 64);
3175 	for (i = 0; i < req->channels_num; i++) {
3176 		chan = &req->channels[i];
3177 		chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3178 		chan->channel_num = scan_list[i]->hw_value;
3179 	}
3180 
3181 	req->intervals_num = sreq->n_scan_plans;
3182 	for (i = 0; i < req->intervals_num; i++)
3183 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3184 
3185 	if (sreq->ie_len > 0) {
3186 		req->ie_len = cpu_to_le16(sreq->ie_len);
3187 		memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
3188 	}
3189 
3190 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3191 				       MCU_CMD_SCHED_SCAN_REQ, false);
3192 }
3193 
3194 int mt7615_mcu_sched_scan_enable(struct mt7615_phy *phy,
3195 				 struct ieee80211_vif *vif,
3196 				 bool enable)
3197 {
3198 	struct mt7615_dev *dev = phy->dev;
3199 	struct {
3200 		u8 active; /* 0: enabled 1: disabled */
3201 		u8 rsv[3];
3202 	} __packed req = {
3203 		.active = !enable,
3204 	};
3205 
3206 	if (!mt7615_firmware_offload(dev))
3207 		return -ENOTSUPP;
3208 
3209 	if (enable)
3210 		set_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3211 	else
3212 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3213 
3214 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SCHED_SCAN_ENABLE,
3215 				   &req, sizeof(req), false);
3216 }
3217 
3218 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3219 {
3220 	int i;
3221 
3222 	for (i = 0; i < n_freqs; i++)
3223 		if (cur == freqs[i])
3224 			return i;
3225 
3226 	return -1;
3227 }
3228 
3229 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
3230 {
3231 	static const u16 freq_list[] = {
3232 		4980, 5805, 5905, 5190,
3233 		5230, 5270, 5310, 5350,
3234 		5390, 5430, 5470, 5510,
3235 		5550, 5590, 5630, 5670,
3236 		5710, 5755, 5795, 5835,
3237 		5875, 5210, 5290, 5370,
3238 		5450, 5530, 5610, 5690,
3239 		5775, 5855
3240 	};
3241 	static const u16 freq_bw40[] = {
3242 		5190, 5230, 5270, 5310,
3243 		5350, 5390, 5430, 5470,
3244 		5510, 5550, 5590, 5630,
3245 		5670, 5710, 5755, 5795,
3246 		5835, 5875
3247 	};
3248 	int offset_2g = ARRAY_SIZE(freq_list);
3249 	int idx;
3250 
3251 	if (freq < 4000) {
3252 		if (freq < 2427)
3253 			return offset_2g;
3254 		if (freq < 2442)
3255 			return offset_2g + 1;
3256 		if (freq < 2457)
3257 			return offset_2g + 2;
3258 
3259 		return offset_2g + 3;
3260 	}
3261 
3262 	switch (bw) {
3263 	case NL80211_CHAN_WIDTH_80:
3264 	case NL80211_CHAN_WIDTH_80P80:
3265 	case NL80211_CHAN_WIDTH_160:
3266 		break;
3267 	default:
3268 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3269 					   freq + 10);
3270 		if (idx >= 0) {
3271 			freq = freq_bw40[idx];
3272 			break;
3273 		}
3274 
3275 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3276 					   freq - 10);
3277 		if (idx >= 0) {
3278 			freq = freq_bw40[idx];
3279 			break;
3280 		}
3281 		/* fall through */
3282 	case NL80211_CHAN_WIDTH_40:
3283 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3284 					   freq);
3285 		if (idx >= 0)
3286 			break;
3287 
3288 		return -1;
3289 
3290 	}
3291 
3292 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3293 }
3294 
3295 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
3296 {
3297 	struct mt7615_dev *dev = phy->dev;
3298 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3299 	int freq2 = chandef->center_freq2;
3300 	int ret;
3301 	struct {
3302 		u8 direction;
3303 		u8 runtime_calibration;
3304 		u8 _rsv[2];
3305 
3306 		__le16 center_freq;
3307 		u8 bw;
3308 		u8 band;
3309 		u8 is_freq2;
3310 		u8 success;
3311 		u8 dbdc_en;
3312 
3313 		u8 _rsv2;
3314 
3315 		struct {
3316 			__le32 sx0_i_lna[4];
3317 			__le32 sx0_q_lna[4];
3318 
3319 			__le32 sx2_i_lna[4];
3320 			__le32 sx2_q_lna[4];
3321 		} dcoc_data[4];
3322 	} req = {
3323 		.direction = 1,
3324 
3325 		.bw = mt7615_mcu_chan_bw(chandef),
3326 		.band = chandef->center_freq1 > 4000,
3327 		.dbdc_en = !!dev->mt76.phy2,
3328 	};
3329 	u16 center_freq = chandef->center_freq1;
3330 	int freq_idx;
3331 	u8 *eep = dev->mt76.eeprom.data;
3332 
3333 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
3334 		return 0;
3335 
3336 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
3337 		freq2 = center_freq + 40;
3338 		center_freq -= 40;
3339 	}
3340 
3341 again:
3342 	req.runtime_calibration = 1;
3343 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
3344 	if (freq_idx < 0)
3345 		goto out;
3346 
3347 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
3348 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
3349 	       sizeof(req.dcoc_data));
3350 	req.runtime_calibration = 0;
3351 
3352 out:
3353 	req.center_freq = cpu_to_le16(center_freq);
3354 	ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
3355 				  sizeof(req), true);
3356 
3357 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3358 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3359 		req.is_freq2 = true;
3360 		center_freq = freq2;
3361 		goto again;
3362 	}
3363 
3364 	return ret;
3365 }
3366 
3367 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
3368 {
3369 	static const u16 freq_list[] = {
3370 		4920, 4940, 4960, 4980,
3371 		5040, 5060, 5080, 5180,
3372 		5200, 5220, 5240, 5260,
3373 		5280, 5300, 5320, 5340,
3374 		5360, 5380, 5400, 5420,
3375 		5440, 5460, 5480, 5500,
3376 		5520, 5540, 5560, 5580,
3377 		5600, 5620, 5640, 5660,
3378 		5680, 5700, 5720, 5745,
3379 		5765, 5785, 5805, 5825,
3380 		5845, 5865, 5885, 5905
3381 	};
3382 	int offset_2g = ARRAY_SIZE(freq_list);
3383 	int idx;
3384 
3385 	if (freq < 4000) {
3386 		if (freq < 2432)
3387 			return offset_2g;
3388 		if (freq < 2457)
3389 			return offset_2g + 1;
3390 
3391 		return offset_2g + 2;
3392 	}
3393 
3394 	if (bw != NL80211_CHAN_WIDTH_20) {
3395 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3396 					   freq + 10);
3397 		if (idx >= 0)
3398 			return idx;
3399 
3400 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3401 					   freq - 10);
3402 		if (idx >= 0)
3403 			return idx;
3404 	}
3405 
3406 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3407 }
3408 
3409 
3410 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
3411 {
3412 	struct mt7615_dev *dev = phy->dev;
3413 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3414 	int freq2 = chandef->center_freq2;
3415 	int ret;
3416 	struct {
3417 		u8 direction;
3418 		u8 runtime_calibration;
3419 		u8 _rsv[2];
3420 
3421 		__le16 center_freq;
3422 		u8 bw;
3423 		u8 band;
3424 		u8 is_freq2;
3425 		u8 success;
3426 		u8 dbdc_en;
3427 
3428 		u8 _rsv2;
3429 
3430 		struct {
3431 			struct {
3432 				u32 dpd_g0;
3433 				u8 data[32];
3434 			} wf0, wf1;
3435 
3436 			struct {
3437 				u32 dpd_g0_prim;
3438 				u32 dpd_g0_sec;
3439 				u8 data_prim[32];
3440 				u8 data_sec[32];
3441 			} wf2, wf3;
3442 		} dpd_data;
3443 	} req = {
3444 		.direction = 1,
3445 
3446 		.bw = mt7615_mcu_chan_bw(chandef),
3447 		.band = chandef->center_freq1 > 4000,
3448 		.dbdc_en = !!dev->mt76.phy2,
3449 	};
3450 	u16 center_freq = chandef->center_freq1;
3451 	int freq_idx;
3452 	u8 *eep = dev->mt76.eeprom.data;
3453 
3454 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
3455 		return 0;
3456 
3457 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
3458 		freq2 = center_freq + 40;
3459 		center_freq -= 40;
3460 	}
3461 
3462 again:
3463 	req.runtime_calibration = 1;
3464 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
3465 	if (freq_idx < 0)
3466 		goto out;
3467 
3468 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
3469 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
3470 	       sizeof(req.dpd_data));
3471 	req.runtime_calibration = 0;
3472 
3473 out:
3474 	req.center_freq = cpu_to_le16(center_freq);
3475 	ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
3476 				  sizeof(req), true);
3477 
3478 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3479 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3480 		req.is_freq2 = true;
3481 		center_freq = freq2;
3482 		goto again;
3483 	}
3484 
3485 	return ret;
3486 }
3487 
3488 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3489 			  bool enable)
3490 {
3491 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3492 	struct {
3493 		u8 bss_idx;
3494 		u8 dtim_period;
3495 		__le16 aid;
3496 		__le16 bcn_interval;
3497 		__le16 atim_window;
3498 		u8 uapsd;
3499 		u8 bmc_delivered_ac;
3500 		u8 bmc_triggered_ac;
3501 		u8 pad;
3502 	} req = {
3503 		.bss_idx = mvif->idx,
3504 		.aid = cpu_to_le16(vif->bss_conf.aid),
3505 		.dtim_period = vif->bss_conf.dtim_period,
3506 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
3507 	};
3508 	struct {
3509 		u8 bss_idx;
3510 		u8 pad[3];
3511 	} req_hdr = {
3512 		.bss_idx = mvif->idx,
3513 	};
3514 	int err;
3515 
3516 	if (vif->type != NL80211_IFTYPE_STATION ||
3517 	    !mt7615_firmware_offload(dev))
3518 		return -ENOTSUPP;
3519 
3520 	err = __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT,
3521 				  &req_hdr, sizeof(req_hdr), false);
3522 	if (err < 0 || !enable)
3523 		return err;
3524 
3525 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED,
3526 				   &req, sizeof(req), false);
3527 }
3528 
3529 #ifdef CONFIG_PM
3530 int mt7615_mcu_set_hif_suspend(struct mt7615_dev *dev, bool suspend)
3531 {
3532 	struct {
3533 		struct {
3534 			u8 hif_type; /* 0x0: HIF_SDIO
3535 				      * 0x1: HIF_USB
3536 				      * 0x2: HIF_PCIE
3537 				      */
3538 			u8 pad[3];
3539 		} __packed hdr;
3540 		struct hif_suspend_tlv {
3541 			__le16 tag;
3542 			__le16 len;
3543 			u8 suspend;
3544 		} __packed hif_suspend;
3545 	} req = {
3546 		.hif_suspend = {
3547 			.tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
3548 			.len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
3549 			.suspend = suspend,
3550 		},
3551 	};
3552 
3553 	if (mt76_is_mmio(&dev->mt76))
3554 		req.hdr.hif_type = 2;
3555 	else if (mt76_is_usb(&dev->mt76))
3556 		req.hdr.hif_type = 1;
3557 
3558 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_HIF_CTRL,
3559 				   &req, sizeof(req), true);
3560 }
3561 EXPORT_SYMBOL_GPL(mt7615_mcu_set_hif_suspend);
3562 
3563 static int
3564 mt7615_mcu_set_wow_ctrl(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3565 			bool suspend, struct cfg80211_wowlan *wowlan)
3566 {
3567 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3568 	struct mt7615_dev *dev = phy->dev;
3569 	struct {
3570 		struct {
3571 			u8 bss_idx;
3572 			u8 pad[3];
3573 		} __packed hdr;
3574 		struct mt7615_wow_ctrl_tlv wow_ctrl_tlv;
3575 	} req = {
3576 		.hdr = {
3577 			.bss_idx = mvif->idx,
3578 		},
3579 		.wow_ctrl_tlv = {
3580 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
3581 			.len = cpu_to_le16(sizeof(struct mt7615_wow_ctrl_tlv)),
3582 			.cmd = suspend ? 1 : 2,
3583 		},
3584 	};
3585 
3586 	if (wowlan->magic_pkt)
3587 		req.wow_ctrl_tlv.trigger |= BIT(0);
3588 	if (wowlan->disconnect)
3589 		req.wow_ctrl_tlv.trigger |= BIT(2);
3590 	if (wowlan->nd_config) {
3591 		mt7615_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
3592 		req.wow_ctrl_tlv.trigger |= BIT(5);
3593 		mt7615_mcu_sched_scan_enable(phy, vif, suspend);
3594 	}
3595 
3596 	if (mt76_is_mmio(&dev->mt76))
3597 		req.wow_ctrl_tlv.wakeup_hif = 2;
3598 	else if (mt76_is_usb(&dev->mt76))
3599 		req.wow_ctrl_tlv.wakeup_hif = 1;
3600 
3601 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND,
3602 				   &req, sizeof(req), true);
3603 }
3604 
3605 static int
3606 mt7615_mcu_set_wow_pattern(struct mt7615_dev *dev,
3607 			   struct ieee80211_vif *vif,
3608 			   u8 index, bool enable,
3609 			   struct cfg80211_pkt_pattern *pattern)
3610 {
3611 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3612 	struct mt7615_wow_pattern_tlv *ptlv;
3613 	struct sk_buff *skb;
3614 	struct req_hdr {
3615 		u8 bss_idx;
3616 		u8 pad[3];
3617 	} __packed hdr = {
3618 		.bss_idx = mvif->idx,
3619 	};
3620 
3621 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3622 				 sizeof(hdr) + sizeof(*ptlv));
3623 	if (!skb)
3624 		return -ENOMEM;
3625 
3626 	skb_put_data(skb, &hdr, sizeof(hdr));
3627 	ptlv = (struct mt7615_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
3628 	ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
3629 	ptlv->len = cpu_to_le16(sizeof(*ptlv));
3630 	ptlv->data_len = pattern->pattern_len;
3631 	ptlv->enable = enable;
3632 	ptlv->index = index;
3633 
3634 	memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
3635 	memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8);
3636 
3637 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3638 				       MCU_UNI_CMD_SUSPEND, true);
3639 }
3640 
3641 static int
3642 mt7615_mcu_set_suspend_mode(struct mt7615_dev *dev,
3643 			    struct ieee80211_vif *vif,
3644 			    bool enable, u8 mdtim, bool wow_suspend)
3645 {
3646 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3647 	struct {
3648 		struct {
3649 			u8 bss_idx;
3650 			u8 pad[3];
3651 		} __packed hdr;
3652 		struct mt7615_suspend_tlv suspend_tlv;
3653 	} req = {
3654 		.hdr = {
3655 			.bss_idx = mvif->idx,
3656 		},
3657 		.suspend_tlv = {
3658 			.tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
3659 			.len = cpu_to_le16(sizeof(struct mt7615_suspend_tlv)),
3660 			.enable = enable,
3661 			.mdtim = mdtim,
3662 			.wow_suspend = wow_suspend,
3663 		},
3664 	};
3665 
3666 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND,
3667 				   &req, sizeof(req), true);
3668 }
3669 
3670 static int
3671 mt7615_mcu_set_gtk_rekey(struct mt7615_dev *dev,
3672 			 struct ieee80211_vif *vif,
3673 			 bool suspend)
3674 {
3675 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3676 	struct {
3677 		struct {
3678 			u8 bss_idx;
3679 			u8 pad[3];
3680 		} __packed hdr;
3681 		struct mt7615_gtk_rekey_tlv gtk_tlv;
3682 	} __packed req = {
3683 		.hdr = {
3684 			.bss_idx = mvif->idx,
3685 		},
3686 		.gtk_tlv = {
3687 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
3688 			.len = cpu_to_le16(sizeof(struct mt7615_gtk_rekey_tlv)),
3689 			.rekey_mode = !suspend,
3690 		},
3691 	};
3692 
3693 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD,
3694 				   &req, sizeof(req), true);
3695 }
3696 
3697 static int
3698 mt7615_mcu_set_arp_filter(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3699 			  bool suspend)
3700 {
3701 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3702 	struct {
3703 		struct {
3704 			u8 bss_idx;
3705 			u8 pad[3];
3706 		} __packed hdr;
3707 		struct mt7615_arpns_tlv arpns;
3708 	} req = {
3709 		.hdr = {
3710 			.bss_idx = mvif->idx,
3711 		},
3712 		.arpns = {
3713 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3714 			.len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3715 			.mode = suspend,
3716 		},
3717 	};
3718 
3719 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD,
3720 				   &req, sizeof(req), true);
3721 }
3722 
3723 void mt7615_mcu_set_suspend_iter(void *priv, u8 *mac,
3724 				 struct ieee80211_vif *vif)
3725 {
3726 	struct mt7615_phy *phy = priv;
3727 	bool suspend = test_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
3728 	struct ieee80211_hw *hw = phy->mt76->hw;
3729 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
3730 	int i;
3731 
3732 	mt7615_mcu_set_bss_pm(phy->dev, vif, suspend);
3733 
3734 	mt7615_mcu_set_gtk_rekey(phy->dev, vif, suspend);
3735 	mt7615_mcu_set_arp_filter(phy->dev, vif, suspend);
3736 
3737 	mt7615_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
3738 
3739 	for (i = 0; i < wowlan->n_patterns; i++)
3740 		mt7615_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
3741 					   &wowlan->patterns[i]);
3742 	mt7615_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
3743 }
3744 
3745 static void
3746 mt7615_mcu_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3747 		    struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
3748 		    void *data)
3749 {
3750 	struct mt7615_gtk_rekey_tlv *gtk_tlv = data;
3751 	u32 cipher;
3752 
3753 	if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
3754 	    key->cipher != WLAN_CIPHER_SUITE_CCMP &&
3755 	    key->cipher != WLAN_CIPHER_SUITE_TKIP)
3756 		return;
3757 
3758 	if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
3759 		gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
3760 		cipher = BIT(3);
3761 	} else {
3762 		gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
3763 		cipher = BIT(4);
3764 	}
3765 
3766 	/* we are assuming here to have a single pairwise key */
3767 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3768 		gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
3769 		gtk_tlv->group_cipher = cpu_to_le32(cipher);
3770 		gtk_tlv->keyid = key->keyidx;
3771 	}
3772 }
3773 
3774 int mt7615_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
3775 				struct ieee80211_vif *vif,
3776 				struct cfg80211_gtk_rekey_data *key)
3777 {
3778 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3779 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3780 	struct mt7615_gtk_rekey_tlv *gtk_tlv;
3781 	struct sk_buff *skb;
3782 	struct {
3783 		u8 bss_idx;
3784 		u8 pad[3];
3785 	} __packed hdr = {
3786 		.bss_idx = mvif->idx,
3787 	};
3788 
3789 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3790 				 sizeof(hdr) + sizeof(*gtk_tlv));
3791 	if (!skb)
3792 		return -ENOMEM;
3793 
3794 	skb_put_data(skb, &hdr, sizeof(hdr));
3795 	gtk_tlv = (struct mt7615_gtk_rekey_tlv *)skb_put(skb,
3796 							 sizeof(*gtk_tlv));
3797 	gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
3798 	gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
3799 	gtk_tlv->rekey_mode = 2;
3800 	gtk_tlv->option = 1;
3801 
3802 	rcu_read_lock();
3803 	ieee80211_iter_keys_rcu(hw, vif, mt7615_mcu_key_iter, gtk_tlv);
3804 	rcu_read_unlock();
3805 
3806 	memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
3807 	memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
3808 	memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
3809 
3810 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3811 				       MCU_UNI_CMD_OFFLOAD, true);
3812 }
3813 #endif /* CONFIG_PM */
3814 
3815 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3816 		       struct ieee80211_channel *chan, int duration)
3817 {
3818 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3819 	struct mt7615_dev *dev = phy->dev;
3820 	struct mt7615_roc_tlv req = {
3821 		.bss_idx = mvif->idx,
3822 		.active = !chan,
3823 		.max_interval = cpu_to_le32(duration),
3824 		.primary_chan = chan ? chan->hw_value : 0,
3825 		.band = chan ? chan->band : 0,
3826 		.req_type = 2,
3827 	};
3828 
3829 	phy->roc_grant = false;
3830 
3831 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
3832 				   sizeof(req), false);
3833 }
3834 
3835 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
3836 				 struct ieee80211_vif *vif,
3837 				 struct ieee80211_bss_conf *info)
3838 {
3839 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3840 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3841 	struct sk_buff *skb;
3842 	int i, len = min_t(int, info->arp_addr_cnt,
3843 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
3844 	struct {
3845 		struct {
3846 			u8 bss_idx;
3847 			u8 pad[3];
3848 		} __packed hdr;
3849 		struct mt7615_arpns_tlv arp;
3850 	} req_hdr = {
3851 		.hdr = {
3852 			.bss_idx = mvif->idx,
3853 		},
3854 		.arp = {
3855 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3856 			.len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3857 			.ips_num = len,
3858 			.mode = 2,  /* update */
3859 			.option = 1,
3860 		},
3861 	};
3862 
3863 	if (!mt7615_firmware_offload(dev))
3864 		return 0;
3865 
3866 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3867 				 sizeof(req_hdr) + len * sizeof(__be32));
3868 	if (!skb)
3869 		return -ENOMEM;
3870 
3871 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
3872 	for (i = 0; i < len; i++) {
3873 		u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
3874 
3875 		memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
3876 	}
3877 
3878 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3879 				       MCU_UNI_CMD_OFFLOAD, true);
3880 }
3881 
3882 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
3883 			     struct ieee80211_vif *vif)
3884 {
3885 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3886 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
3887 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3888 	struct {
3889 		__le32 ct_win;
3890 		u8 bss_idx;
3891 		u8 rsv[3];
3892 	} __packed req = {
3893 		.ct_win = cpu_to_le32(ct_window),
3894 		.bss_idx = mvif->idx,
3895 	};
3896 
3897 	if (!mt7615_firmware_offload(dev))
3898 		return -ENOTSUPP;
3899 
3900 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS,
3901 				   &req, sizeof(req), false);
3902 }
3903 
3904 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
3905 {
3906 	struct {
3907 		__le32 addr;
3908 		__le32 val;
3909 	} __packed req = {
3910 		.addr = cpu_to_le32(offset),
3911 	};
3912 
3913 	return __mt76_mcu_send_msg(dev, MCU_CMD_REG_READ,
3914 				   &req, sizeof(req), true);
3915 }
3916 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
3917 
3918 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
3919 {
3920 	struct {
3921 		__le32 addr;
3922 		__le32 val;
3923 	} __packed req = {
3924 		.addr = cpu_to_le32(offset),
3925 		.val = cpu_to_le32(val),
3926 	};
3927 
3928 	__mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE,
3929 			    &req, sizeof(req), false);
3930 }
3931 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);
3932