xref: /openbmc/linux/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c (revision f97cee494dc92395a668445bcd24d34c89f4ff8c)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
75 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
76 
77 #define DL_MODE_ENCRYPT			BIT(0)
78 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
79 #define DL_MODE_RESET_SEC_IV		BIT(3)
80 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
82 #define DL_MODE_NEED_RSP		BIT(31)
83 
84 #define FW_START_OVERRIDE		BIT(0)
85 #define FW_START_WORKING_PDA_CR4	BIT(2)
86 
87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
88 			 int cmd, int *wait_seq)
89 {
90 	int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
91 	struct mt7615_uni_txd *uni_txd;
92 	struct mt7615_mcu_txd *mcu_txd;
93 	u8 seq, q_idx, pkt_fmt;
94 	__le32 *txd;
95 	u32 val;
96 
97 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
98 	if (!seq)
99 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
100 	if (wait_seq)
101 		*wait_seq = seq;
102 
103 	txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
104 	txd = (__le32 *)skb_push(skb, txd_len);
105 
106 	if (cmd != MCU_CMD_FW_SCATTER) {
107 		q_idx = MT_TX_MCU_PORT_RX_Q0;
108 		pkt_fmt = MT_TX_TYPE_CMD;
109 	} else {
110 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
111 		pkt_fmt = MT_TX_TYPE_FW;
112 	}
113 
114 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
115 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
116 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
117 	txd[0] = cpu_to_le32(val);
118 
119 	val = MT_TXD1_LONG_FORMAT |
120 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
121 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
122 	txd[1] = cpu_to_le32(val);
123 
124 	if (cmd & MCU_UNI_PREFIX) {
125 		uni_txd = (struct mt7615_uni_txd *)txd;
126 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
127 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
128 		uni_txd->cid = cpu_to_le16(mcu_cmd);
129 		uni_txd->s2d_index = MCU_S2D_H2N;
130 		uni_txd->pkt_type = MCU_PKT_ID;
131 		uni_txd->seq = seq;
132 
133 		return;
134 	}
135 
136 	mcu_txd = (struct mt7615_mcu_txd *)txd;
137 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
138 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
139 	mcu_txd->s2d_index = MCU_S2D_H2N;
140 	mcu_txd->pkt_type = MCU_PKT_ID;
141 	mcu_txd->seq = seq;
142 
143 	switch (cmd & ~MCU_CMD_MASK) {
144 	case MCU_FW_PREFIX:
145 		mcu_txd->set_query = MCU_Q_NA;
146 		mcu_txd->cid = mcu_cmd;
147 		break;
148 	case MCU_CE_PREFIX:
149 		if (cmd & MCU_QUERY_MASK)
150 			mcu_txd->set_query = MCU_Q_QUERY;
151 		else
152 			mcu_txd->set_query = MCU_Q_SET;
153 		mcu_txd->cid = mcu_cmd;
154 		break;
155 	default:
156 		mcu_txd->cid = MCU_CMD_EXT_CID;
157 		if (cmd & MCU_QUERY_PREFIX)
158 			mcu_txd->set_query = MCU_Q_QUERY;
159 		else
160 			mcu_txd->set_query = MCU_Q_SET;
161 		mcu_txd->ext_cid = mcu_cmd;
162 		mcu_txd->ext_cid_ack = 1;
163 		break;
164 	}
165 }
166 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
167 
168 static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
169 				 int cmd, int *wait_seq)
170 {
171 	enum mt76_txq_id qid;
172 
173 	mt7615_mcu_fill_msg(dev, skb, cmd, wait_seq);
174 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
175 		qid = MT_TXQ_MCU;
176 	else
177 		qid = MT_TXQ_FWDL;
178 
179 	return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
180 }
181 
182 static int
183 mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
184 			  struct sk_buff *skb, int seq)
185 {
186 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
187 	int ret = 0;
188 
189 	if (seq != rxd->seq) {
190 		ret = -EAGAIN;
191 		goto out;
192 	}
193 
194 	switch (cmd) {
195 	case MCU_CMD_PATCH_SEM_CONTROL:
196 		skb_pull(skb, sizeof(*rxd) - 4);
197 		ret = *skb->data;
198 		break;
199 	case MCU_EXT_CMD_GET_TEMP:
200 		skb_pull(skb, sizeof(*rxd));
201 		ret = le32_to_cpu(*(__le32 *)skb->data);
202 		break;
203 	case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
204 		skb_pull(skb, sizeof(*rxd));
205 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
206 		break;
207 	case MCU_UNI_CMD_DEV_INFO_UPDATE:
208 	case MCU_UNI_CMD_BSS_INFO_UPDATE:
209 	case MCU_UNI_CMD_STA_REC_UPDATE:
210 	case MCU_UNI_CMD_HIF_CTRL:
211 	case MCU_UNI_CMD_OFFLOAD:
212 	case MCU_UNI_CMD_SUSPEND: {
213 		struct mt7615_mcu_uni_event *event;
214 
215 		skb_pull(skb, sizeof(*rxd));
216 		event = (struct mt7615_mcu_uni_event *)skb->data;
217 		ret = le32_to_cpu(event->status);
218 		break;
219 	}
220 	case MCU_CMD_REG_READ: {
221 		struct mt7615_mcu_reg_event *event;
222 
223 		skb_pull(skb, sizeof(*rxd));
224 		event = (struct mt7615_mcu_reg_event *)skb->data;
225 		ret = (int)le32_to_cpu(event->val);
226 		break;
227 	}
228 	default:
229 		break;
230 	}
231 out:
232 	dev_kfree_skb(skb);
233 
234 	return ret;
235 }
236 
237 int mt7615_mcu_wait_response(struct mt7615_dev *dev, int cmd, int seq)
238 {
239 	unsigned long expires = jiffies + 20 * HZ;
240 	struct sk_buff *skb;
241 	int ret = 0;
242 
243 	while (true) {
244 		skb = mt76_mcu_get_response(&dev->mt76, expires);
245 		if (!skb) {
246 			dev_err(dev->mt76.dev, "Message %ld (seq %d) timeout\n",
247 				cmd & MCU_CMD_MASK, seq);
248 			return -ETIMEDOUT;
249 		}
250 
251 		ret = mt7615_mcu_parse_response(dev, cmd, skb, seq);
252 		if (ret != -EAGAIN)
253 			break;
254 	}
255 
256 	return ret;
257 }
258 EXPORT_SYMBOL_GPL(mt7615_mcu_wait_response);
259 
260 static int
261 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
262 			int cmd, bool wait_resp)
263 {
264 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
265 	int ret, seq;
266 
267 	mutex_lock(&mdev->mcu.mutex);
268 
269 	ret = __mt7615_mcu_msg_send(dev, skb, cmd, &seq);
270 	if (ret)
271 		goto out;
272 
273 	if (wait_resp)
274 		ret = mt7615_mcu_wait_response(dev, cmd, seq);
275 
276 out:
277 	mutex_unlock(&mdev->mcu.mutex);
278 
279 	return ret;
280 }
281 
282 int mt7615_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
283 			int len, bool wait_resp)
284 {
285 	struct sk_buff *skb;
286 
287 	skb = mt76_mcu_msg_alloc(mdev, data, len);
288 	if (!skb)
289 		return -ENOMEM;
290 
291 	return __mt76_mcu_skb_send_msg(mdev, skb, cmd, wait_resp);
292 }
293 EXPORT_SYMBOL_GPL(mt7615_mcu_msg_send);
294 
295 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
296 {
297 	struct {
298 		__le32 wifi_stream;
299 		__le32 address;
300 		__le32 data;
301 	} req = {
302 		.wifi_stream = cpu_to_le32(wf),
303 		.address = cpu_to_le32(reg),
304 	};
305 
306 	return __mt76_mcu_send_msg(&dev->mt76,
307 				   MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
308 				   &req, sizeof(req), true);
309 }
310 
311 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
312 {
313 	struct {
314 		__le32 wifi_stream;
315 		__le32 address;
316 		__le32 data;
317 	} req = {
318 		.wifi_stream = cpu_to_le32(wf),
319 		.address = cpu_to_le32(reg),
320 		.data = cpu_to_le32(val),
321 	};
322 
323 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
324 				   sizeof(req), false);
325 }
326 
327 static void
328 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
329 {
330 	if (vif->csa_active)
331 		ieee80211_csa_finish(vif);
332 }
333 
334 static void
335 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
336 {
337 	struct mt76_phy *mphy = &dev->mt76.phy;
338 	struct mt7615_mcu_rdd_report *r;
339 
340 	r = (struct mt7615_mcu_rdd_report *)skb->data;
341 
342 	if (r->idx && dev->mt76.phy2)
343 		mphy = dev->mt76.phy2;
344 
345 	ieee80211_radar_detected(mphy->hw);
346 	dev->hw_pattern++;
347 }
348 
349 static void
350 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
351 {
352 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
353 	const char *data = (char *)&rxd[1];
354 	const char *type;
355 
356 	switch (rxd->s2d_index) {
357 	case 0:
358 		type = "N9";
359 		break;
360 	case 2:
361 		type = "CR4";
362 		break;
363 	default:
364 		type = "unknown";
365 		break;
366 	}
367 
368 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
369 }
370 
371 static void
372 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
373 {
374 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
375 
376 	switch (rxd->ext_eid) {
377 	case MCU_EXT_EVENT_RDD_REPORT:
378 		mt7615_mcu_rx_radar_detected(dev, skb);
379 		break;
380 	case MCU_EXT_EVENT_CSA_NOTIFY:
381 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
382 				IEEE80211_IFACE_ITER_RESUME_ALL,
383 				mt7615_mcu_csa_finish, dev);
384 		break;
385 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
386 		mt7615_mcu_rx_log_message(dev, skb);
387 		break;
388 	default:
389 		break;
390 	}
391 }
392 
393 static void
394 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
395 {
396 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
397 	struct mt7615_phy *phy;
398 	struct mt76_phy *mphy;
399 
400 	if (*seq_num & BIT(7) && dev->mt76.phy2)
401 		mphy = dev->mt76.phy2;
402 	else
403 		mphy = &dev->mt76.phy;
404 
405 	phy = (struct mt7615_phy *)mphy->priv;
406 
407 	spin_lock_bh(&dev->mt76.lock);
408 	__skb_queue_tail(&phy->scan_event_list, skb);
409 	spin_unlock_bh(&dev->mt76.lock);
410 
411 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
412 				     MT7615_HW_SCAN_TIMEOUT);
413 }
414 
415 static void
416 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
417 {
418 	struct mt7615_roc_tlv *event;
419 	struct mt7615_phy *phy;
420 	struct mt76_phy *mphy;
421 	int duration;
422 
423 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
424 	event = (struct mt7615_roc_tlv *)skb->data;
425 
426 	if (event->dbdc_band && dev->mt76.phy2)
427 		mphy = dev->mt76.phy2;
428 	else
429 		mphy = &dev->mt76.phy;
430 
431 	ieee80211_ready_on_channel(mphy->hw);
432 
433 	phy = (struct mt7615_phy *)mphy->priv;
434 	phy->roc_grant = true;
435 	wake_up(&phy->roc_wait);
436 
437 	duration = le32_to_cpu(event->max_interval);
438 	mod_timer(&phy->roc_timer,
439 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
440 }
441 
442 static void
443 mt7615_mcu_beacon_loss_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
444 {
445 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
446 	struct mt7615_beacon_loss_event *event = priv;
447 
448 	if (mvif->idx != event->bss_idx)
449 		return;
450 
451 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
452 		return;
453 
454 	ieee80211_beacon_loss(vif);
455 }
456 
457 static void
458 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
459 {
460 	struct mt7615_beacon_loss_event *event;
461 	struct mt76_phy *mphy;
462 	u8 band_idx = 0; /* DBDC support */
463 
464 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
465 	event = (struct mt7615_beacon_loss_event *)skb->data;
466 	if (band_idx && dev->mt76.phy2)
467 		mphy = dev->mt76.phy2;
468 	else
469 		mphy = &dev->mt76.phy;
470 
471 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
472 					IEEE80211_IFACE_ITER_RESUME_ALL,
473 					mt7615_mcu_beacon_loss_iter, event);
474 }
475 
476 static void
477 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
478 {
479 	struct mt7615_mcu_bss_event *event;
480 	struct mt76_phy *mphy;
481 	u8 band_idx = 0; /* DBDC support */
482 
483 	event = (struct mt7615_mcu_bss_event *)(skb->data +
484 						sizeof(struct mt7615_mcu_rxd));
485 
486 	if (band_idx && dev->mt76.phy2)
487 		mphy = dev->mt76.phy2;
488 	else
489 		mphy = &dev->mt76.phy;
490 
491 	if (event->is_absent)
492 		ieee80211_stop_queues(mphy->hw);
493 	else
494 		ieee80211_wake_queues(mphy->hw);
495 }
496 
497 static void
498 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
499 {
500 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
501 
502 	switch (rxd->eid) {
503 	case MCU_EVENT_EXT:
504 		mt7615_mcu_rx_ext_event(dev, skb);
505 		break;
506 	case MCU_EVENT_BSS_BEACON_LOSS:
507 		mt7615_mcu_beacon_loss_event(dev, skb);
508 		break;
509 	case MCU_EVENT_ROC:
510 		mt7615_mcu_roc_event(dev, skb);
511 		break;
512 	case MCU_EVENT_SCHED_SCAN_DONE:
513 	case MCU_EVENT_SCAN_DONE:
514 		mt7615_mcu_scan_event(dev, skb);
515 		return;
516 	case MCU_EVENT_BSS_ABSENCE:
517 		mt7615_mcu_bss_event(dev, skb);
518 		break;
519 	default:
520 		break;
521 	}
522 	dev_kfree_skb(skb);
523 }
524 
525 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
526 {
527 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
528 
529 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
530 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
531 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
532 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
533 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
534 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
535 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
536 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
537 	    rxd->eid == MCU_EVENT_ROC ||
538 	    !rxd->seq)
539 		mt7615_mcu_rx_unsolicited_event(dev, skb);
540 	else
541 		mt76_mcu_rx_event(&dev->mt76, skb);
542 }
543 
544 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
545 				    u32 len, u32 mode)
546 {
547 	struct {
548 		__le32 addr;
549 		__le32 len;
550 		__le32 mode;
551 	} req = {
552 		.addr = cpu_to_le32(addr),
553 		.len = cpu_to_le32(len),
554 		.mode = cpu_to_le32(mode),
555 	};
556 
557 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TARGET_ADDRESS_LEN_REQ,
558 				   &req, sizeof(req), true);
559 }
560 
561 static int
562 mt7615_mcu_add_dev(struct mt7615_dev *dev, struct ieee80211_vif *vif,
563 		   bool enable)
564 {
565 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
566 	struct {
567 		struct req_hdr {
568 			u8 omac_idx;
569 			u8 band_idx;
570 			__le16 tlv_num;
571 			u8 is_tlv_append;
572 			u8 rsv[3];
573 		} __packed hdr;
574 		struct req_tlv {
575 			__le16 tag;
576 			__le16 len;
577 			u8 active;
578 			u8 band_idx;
579 			u8 omac_addr[ETH_ALEN];
580 		} __packed tlv;
581 	} data = {
582 		.hdr = {
583 			.omac_idx = mvif->omac_idx,
584 			.band_idx = mvif->band_idx,
585 			.tlv_num = cpu_to_le16(1),
586 			.is_tlv_append = 1,
587 		},
588 		.tlv = {
589 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
590 			.len = cpu_to_le16(sizeof(struct req_tlv)),
591 			.active = enable,
592 			.band_idx = mvif->band_idx,
593 		},
594 	};
595 
596 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
597 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
598 				   &data, sizeof(data), true);
599 }
600 
601 static int
602 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
603 			      struct ieee80211_hw *hw,
604 			      struct ieee80211_vif *vif, bool enable)
605 {
606 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
607 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
608 	struct ieee80211_mutable_offsets offs;
609 	struct ieee80211_tx_info *info;
610 	struct req {
611 		u8 omac_idx;
612 		u8 enable;
613 		u8 wlan_idx;
614 		u8 band_idx;
615 		u8 pkt_type;
616 		u8 need_pre_tbtt_int;
617 		__le16 csa_ie_pos;
618 		__le16 pkt_len;
619 		__le16 tim_ie_pos;
620 		u8 pkt[512];
621 		u8 csa_cnt;
622 		/* bss color change */
623 		u8 bcc_cnt;
624 		__le16 bcc_ie_pos;
625 	} __packed req = {
626 		.omac_idx = mvif->omac_idx,
627 		.enable = enable,
628 		.wlan_idx = wcid->idx,
629 		.band_idx = mvif->band_idx,
630 	};
631 	struct sk_buff *skb;
632 
633 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
634 	if (!skb)
635 		return -EINVAL;
636 
637 	if (skb->len > 512 - MT_TXD_SIZE) {
638 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
639 		dev_kfree_skb(skb);
640 		return -EINVAL;
641 	}
642 
643 	if (mvif->band_idx) {
644 		info = IEEE80211_SKB_CB(skb);
645 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
646 	}
647 
648 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
649 			      0, NULL, true);
650 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
651 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
652 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
653 	if (offs.csa_counter_offs[0]) {
654 		u16 csa_offs;
655 
656 		csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
657 		req.csa_ie_pos = cpu_to_le16(csa_offs);
658 		req.csa_cnt = skb->data[offs.csa_counter_offs[0]];
659 	}
660 	dev_kfree_skb(skb);
661 
662 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD,
663 				   &req, sizeof(req), true);
664 }
665 
666 static int
667 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
668 {
669 #define ENTER_PM_STATE	1
670 #define EXIT_PM_STATE	2
671 	struct {
672 		u8 pm_number;
673 		u8 pm_state;
674 		u8 bssid[ETH_ALEN];
675 		u8 dtim_period;
676 		u8 wlan_idx;
677 		__le16 bcn_interval;
678 		__le32 aid;
679 		__le32 rx_filter;
680 		u8 band_idx;
681 		u8 rsv[3];
682 		__le32 feature;
683 		u8 omac_idx;
684 		u8 wmm_idx;
685 		u8 bcn_loss_cnt;
686 		u8 bcn_sp_duration;
687 	} __packed req = {
688 		.pm_number = 5,
689 		.pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
690 		.band_idx = band,
691 	};
692 
693 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
694 				   &req, sizeof(req), true);
695 }
696 
697 static struct sk_buff *
698 mt7615_mcu_alloc_sta_req(struct mt7615_dev *dev, struct mt7615_vif *mvif,
699 			 struct mt7615_sta *msta)
700 {
701 	struct sta_req_hdr hdr = {
702 		.bss_idx = mvif->idx,
703 		.wlan_idx = msta ? msta->wcid.idx : 0,
704 		.muar_idx = msta ? mvif->omac_idx : 0,
705 		.is_tlv_append = 1,
706 	};
707 	struct sk_buff *skb;
708 
709 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7615_STA_UPDATE_MAX_SIZE);
710 	if (!skb)
711 		return ERR_PTR(-ENOMEM);
712 
713 	skb_put_data(skb, &hdr, sizeof(hdr));
714 
715 	return skb;
716 }
717 
718 static struct wtbl_req_hdr *
719 mt7615_mcu_alloc_wtbl_req(struct mt7615_dev *dev, struct mt7615_sta *msta,
720 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
721 {
722 	struct tlv *sta_hdr = sta_wtbl;
723 	struct wtbl_req_hdr hdr = {
724 		.wlan_idx = msta->wcid.idx,
725 		.operation = cmd,
726 	};
727 	struct sk_buff *nskb = *skb;
728 
729 	if (!nskb) {
730 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
731 					  MT7615_WTBL_UPDATE_BA_SIZE);
732 		if (!nskb)
733 			return ERR_PTR(-ENOMEM);
734 
735 		*skb = nskb;
736 	}
737 
738 	if (sta_hdr)
739 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
740 
741 	return skb_put_data(nskb, &hdr, sizeof(hdr));
742 }
743 
744 static struct tlv *
745 mt7615_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
746 			  void *sta_ntlv, void *sta_wtbl)
747 {
748 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
749 	struct tlv *sta_hdr = sta_wtbl;
750 	struct tlv *ptlv, tlv = {
751 		.tag = cpu_to_le16(tag),
752 		.len = cpu_to_le16(len),
753 	};
754 	u16 ntlv;
755 
756 	ptlv = skb_put(skb, len);
757 	memcpy(ptlv, &tlv, sizeof(tlv));
758 
759 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
760 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
761 
762 	if (sta_hdr) {
763 		u16 size = le16_to_cpu(sta_hdr->len);
764 
765 		sta_hdr->len = cpu_to_le16(size + len);
766 	}
767 
768 	return ptlv;
769 }
770 
771 static struct tlv *
772 mt7615_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
773 {
774 	return mt7615_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
775 }
776 
777 static int
778 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
779 			 struct ieee80211_sta *sta, bool enable)
780 {
781 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
782 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
783 	struct bss_info_basic *bss;
784 	u8 wlan_idx = mvif->sta.wcid.idx;
785 	struct tlv *tlv;
786 
787 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
788 
789 	switch (vif->type) {
790 	case NL80211_IFTYPE_MESH_POINT:
791 	case NL80211_IFTYPE_AP:
792 		break;
793 	case NL80211_IFTYPE_STATION:
794 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
795 		if (enable && sta) {
796 			struct mt7615_sta *msta;
797 
798 			msta = (struct mt7615_sta *)sta->drv_priv;
799 			wlan_idx = msta->wcid.idx;
800 		}
801 		break;
802 	case NL80211_IFTYPE_ADHOC:
803 		type = NETWORK_IBSS;
804 		break;
805 	default:
806 		WARN_ON(1);
807 		break;
808 	}
809 
810 	bss = (struct bss_info_basic *)tlv;
811 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
812 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
813 	bss->network_type = cpu_to_le32(type);
814 	bss->dtim_period = vif->bss_conf.dtim_period;
815 	bss->bmc_tx_wlan_idx = wlan_idx;
816 	bss->wmm_idx = mvif->wmm_idx;
817 	bss->active = enable;
818 
819 	return 0;
820 }
821 
822 static void
823 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
824 {
825 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
826 	struct bss_info_omac *omac;
827 	struct tlv *tlv;
828 	u32 type = 0;
829 	u8 idx;
830 
831 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
832 
833 	switch (vif->type) {
834 	case NL80211_IFTYPE_MESH_POINT:
835 	case NL80211_IFTYPE_AP:
836 		if (vif->p2p)
837 			type = CONNECTION_P2P_GO;
838 		else
839 			type = CONNECTION_INFRA_AP;
840 		break;
841 	case NL80211_IFTYPE_STATION:
842 		if (vif->p2p)
843 			type = CONNECTION_P2P_GC;
844 		else
845 			type = CONNECTION_INFRA_STA;
846 		break;
847 	case NL80211_IFTYPE_ADHOC:
848 		type = CONNECTION_IBSS_ADHOC;
849 		break;
850 	default:
851 		WARN_ON(1);
852 		break;
853 	}
854 
855 	omac = (struct bss_info_omac *)tlv;
856 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
857 	omac->conn_type = cpu_to_le32(type);
858 	omac->omac_idx = mvif->omac_idx;
859 	omac->band_idx = mvif->band_idx;
860 	omac->hw_bss_idx = idx;
861 }
862 
863 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
864 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
865 static void
866 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
867 {
868 	struct bss_info_ext_bss *ext;
869 	int ext_bss_idx, tsf_offset;
870 	struct tlv *tlv;
871 
872 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
873 	if (ext_bss_idx < 0)
874 		return;
875 
876 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
877 
878 	ext = (struct bss_info_ext_bss *)tlv;
879 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
880 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
881 }
882 
883 static void
884 mt7615_mcu_sta_ba_tlv(struct sk_buff *skb,
885 		      struct ieee80211_ampdu_params *params,
886 		      bool enable, bool tx)
887 {
888 	struct sta_rec_ba *ba;
889 	struct tlv *tlv;
890 
891 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
892 
893 	ba = (struct sta_rec_ba *)tlv;
894 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
895 	ba->winsize = cpu_to_le16(params->buf_size);
896 	ba->ssn = cpu_to_le16(params->ssn);
897 	ba->ba_en = enable << params->tid;
898 	ba->amsdu = params->amsdu;
899 	ba->tid = params->tid;
900 }
901 
902 static void
903 mt7615_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
904 			 struct ieee80211_sta *sta, bool enable)
905 {
906 	struct sta_rec_basic *basic;
907 	struct tlv *tlv;
908 	int conn_type;
909 
910 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
911 
912 	basic = (struct sta_rec_basic *)tlv;
913 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
914 
915 	if (enable) {
916 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
917 		basic->conn_state = CONN_STATE_PORT_SECURE;
918 	} else {
919 		basic->conn_state = CONN_STATE_DISCONNECT;
920 	}
921 
922 	if (!sta) {
923 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
924 		eth_broadcast_addr(basic->peer_addr);
925 		return;
926 	}
927 
928 	switch (vif->type) {
929 	case NL80211_IFTYPE_MESH_POINT:
930 	case NL80211_IFTYPE_AP:
931 		if (vif->p2p)
932 			conn_type = CONNECTION_P2P_GC;
933 		else
934 			conn_type = CONNECTION_INFRA_STA;
935 		basic->conn_type = cpu_to_le32(conn_type);
936 		basic->aid = cpu_to_le16(sta->aid);
937 		break;
938 	case NL80211_IFTYPE_STATION:
939 		if (vif->p2p)
940 			conn_type = CONNECTION_P2P_GO;
941 		else
942 			conn_type = CONNECTION_INFRA_AP;
943 		basic->conn_type = cpu_to_le32(conn_type);
944 		basic->aid = cpu_to_le16(vif->bss_conf.aid);
945 		break;
946 	case NL80211_IFTYPE_ADHOC:
947 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
948 		basic->aid = cpu_to_le16(sta->aid);
949 		break;
950 	default:
951 		WARN_ON(1);
952 		break;
953 	}
954 
955 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
956 	basic->qos = sta->wme;
957 }
958 
959 static void
960 mt7615_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
961 {
962 	struct tlv *tlv;
963 
964 	if (sta->ht_cap.ht_supported) {
965 		struct sta_rec_ht *ht;
966 
967 		tlv = mt7615_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
968 		ht = (struct sta_rec_ht *)tlv;
969 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
970 	}
971 	if (sta->vht_cap.vht_supported) {
972 		struct sta_rec_vht *vht;
973 
974 		tlv = mt7615_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
975 		vht = (struct sta_rec_vht *)tlv;
976 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
977 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
978 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
979 	}
980 }
981 
982 static void
983 mt7615_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,
984 		     struct ieee80211_sta *sta)
985 {
986 	struct sta_rec_uapsd *uapsd;
987 	struct tlv *tlv;
988 
989 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
990 		return;
991 
992 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
993 	uapsd = (struct sta_rec_uapsd *)tlv;
994 
995 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
996 		uapsd->dac_map |= BIT(3);
997 		uapsd->tac_map |= BIT(3);
998 	}
999 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1000 		uapsd->dac_map |= BIT(2);
1001 		uapsd->tac_map |= BIT(2);
1002 	}
1003 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1004 		uapsd->dac_map |= BIT(1);
1005 		uapsd->tac_map |= BIT(1);
1006 	}
1007 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1008 		uapsd->dac_map |= BIT(0);
1009 		uapsd->tac_map |= BIT(0);
1010 	}
1011 	uapsd->max_sp = sta->max_sp;
1012 }
1013 
1014 static void
1015 mt7615_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1016 		       struct ieee80211_ampdu_params *params,
1017 		       bool enable, bool tx, void *sta_wtbl,
1018 		       void *wtbl_tlv)
1019 {
1020 	struct wtbl_ba *ba;
1021 	struct tlv *tlv;
1022 
1023 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1024 					wtbl_tlv, sta_wtbl);
1025 
1026 	ba = (struct wtbl_ba *)tlv;
1027 	ba->tid = params->tid;
1028 
1029 	if (tx) {
1030 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1031 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1032 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1033 		ba->ba_en = enable;
1034 	} else {
1035 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1036 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1037 		ba->rst_ba_tid = params->tid;
1038 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1039 		ba->rst_ba_sb = 1;
1040 	}
1041 
1042 	if (enable && tx) {
1043 		u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1044 		int i;
1045 
1046 		for (i = 7; i > 0; i--) {
1047 			if (params->buf_size >= ba_range[i])
1048 				break;
1049 		}
1050 		ba->ba_winsize_idx = i;
1051 	}
1052 }
1053 
1054 static void
1055 mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1056 			    struct ieee80211_sta *sta, void *sta_wtbl,
1057 			    void *wtbl_tlv)
1058 {
1059 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1060 	struct wtbl_generic *generic;
1061 	struct wtbl_rx *rx;
1062 	struct wtbl_spe *spe;
1063 	struct tlv *tlv;
1064 
1065 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1066 					wtbl_tlv, sta_wtbl);
1067 
1068 	generic = (struct wtbl_generic *)tlv;
1069 
1070 	if (sta) {
1071 		if (vif->type == NL80211_IFTYPE_STATION)
1072 			generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
1073 		else
1074 			generic->partial_aid = cpu_to_le16(sta->aid);
1075 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1076 		generic->muar_idx = mvif->omac_idx;
1077 		generic->qos = sta->wme;
1078 	} else {
1079 		eth_broadcast_addr(generic->peer_addr);
1080 		generic->muar_idx = 0xe;
1081 	}
1082 
1083 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1084 					wtbl_tlv, sta_wtbl);
1085 
1086 	rx = (struct wtbl_rx *)tlv;
1087 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1088 	rx->rca2 = 1;
1089 	rx->rv = 1;
1090 
1091 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
1092 					wtbl_tlv, sta_wtbl);
1093 	spe = (struct wtbl_spe *)tlv;
1094 	spe->spe_idx = 24;
1095 }
1096 
1097 static void
1098 mt7615_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1099 		       void *sta_wtbl, void *wtbl_tlv)
1100 {
1101 	struct tlv *tlv;
1102 	struct wtbl_ht *ht = NULL;
1103 	u32 flags = 0;
1104 
1105 	if (sta->ht_cap.ht_supported) {
1106 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1107 						wtbl_tlv, sta_wtbl);
1108 		ht = (struct wtbl_ht *)tlv;
1109 		ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
1110 		ht->af = sta->ht_cap.ampdu_factor;
1111 		ht->mm = sta->ht_cap.ampdu_density;
1112 		ht->ht = 1;
1113 
1114 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1115 			flags |= MT_WTBL_W5_SHORT_GI_20;
1116 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1117 			flags |= MT_WTBL_W5_SHORT_GI_40;
1118 	}
1119 
1120 	if (sta->vht_cap.vht_supported) {
1121 		struct wtbl_vht *vht;
1122 		u8 af;
1123 
1124 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1125 						wtbl_tlv, sta_wtbl);
1126 		vht = (struct wtbl_vht *)tlv;
1127 		vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC,
1128 		vht->vht = 1;
1129 
1130 		af = (sta->vht_cap.cap &
1131 		      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
1132 		      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
1133 
1134 		if (ht)
1135 		    ht->af = max(ht->af, af);
1136 
1137 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1138 			flags |= MT_WTBL_W5_SHORT_GI_80;
1139 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1140 			flags |= MT_WTBL_W5_SHORT_GI_160;
1141 	}
1142 
1143 	/* wtbl smps */
1144 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1145 		struct wtbl_smps *smps;
1146 
1147 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1148 						wtbl_tlv, sta_wtbl);
1149 		smps = (struct wtbl_smps *)tlv;
1150 		smps->smps = 1;
1151 	}
1152 
1153 	if (sta->ht_cap.ht_supported) {
1154 		/* sgi */
1155 		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1156 			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1157 		struct wtbl_raw *raw;
1158 
1159 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
1160 						sizeof(*raw), wtbl_tlv,
1161 						sta_wtbl);
1162 		raw = (struct wtbl_raw *)tlv;
1163 		raw->val = cpu_to_le32(flags);
1164 		raw->msk = cpu_to_le32(~msk);
1165 		raw->wtbl_idx = 1;
1166 		raw->dw = 5;
1167 	}
1168 }
1169 
1170 static int
1171 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1172 		   struct ieee80211_sta *sta, bool enable)
1173 {
1174 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1175 	struct mt7615_dev *dev = phy->dev;
1176 	struct sk_buff *skb;
1177 
1178 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, NULL);
1179 	if (IS_ERR(skb))
1180 		return PTR_ERR(skb);
1181 
1182 	if (enable)
1183 		mt7615_mcu_bss_omac_tlv(skb, vif);
1184 
1185 	mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
1186 
1187 	if (enable && mvif->omac_idx > EXT_BSSID_START)
1188 		mt7615_mcu_bss_ext_tlv(skb, mvif);
1189 
1190 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1191 				       MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1192 }
1193 
1194 static int
1195 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
1196 		      struct ieee80211_ampdu_params *params,
1197 		      bool enable)
1198 {
1199 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1200 	struct mt7615_vif *mvif = msta->vif;
1201 	struct wtbl_req_hdr *wtbl_hdr;
1202 	struct sk_buff *skb = NULL;
1203 	int err;
1204 
1205 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1206 	if (IS_ERR(wtbl_hdr))
1207 		return PTR_ERR(wtbl_hdr);
1208 
1209 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, NULL, wtbl_hdr);
1210 
1211 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1212 				      MCU_EXT_CMD_WTBL_UPDATE, true);
1213 	if (err < 0)
1214 		return err;
1215 
1216 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1217 	if (IS_ERR(skb))
1218 		return PTR_ERR(skb);
1219 
1220 	mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1221 
1222 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1223 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1224 }
1225 
1226 static int
1227 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
1228 		      struct ieee80211_ampdu_params *params,
1229 		      bool enable)
1230 {
1231 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1232 	struct mt7615_vif *mvif = msta->vif;
1233 	struct wtbl_req_hdr *wtbl_hdr;
1234 	struct sk_buff *skb;
1235 	int err;
1236 
1237 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1238 	if (IS_ERR(skb))
1239 		return PTR_ERR(skb);
1240 
1241 	mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1242 
1243 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1244 				      MCU_EXT_CMD_STA_REC_UPDATE, true);
1245 	if (err < 0 || !enable)
1246 		return err;
1247 
1248 	skb = NULL;
1249 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1250 	if (IS_ERR(wtbl_hdr))
1251 		return PTR_ERR(wtbl_hdr);
1252 
1253 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, NULL, wtbl_hdr);
1254 
1255 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1256 				       MCU_EXT_CMD_WTBL_UPDATE, true);
1257 }
1258 
1259 static int
1260 mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1261 			struct ieee80211_sta *sta, bool enable)
1262 {
1263 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1264 	struct sk_buff *skb, *sskb, *wskb = NULL;
1265 	struct wtbl_req_hdr *wtbl_hdr;
1266 	struct mt7615_sta *msta;
1267 	int cmd, err;
1268 
1269 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1270 
1271 	sskb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1272 	if (IS_ERR(sskb))
1273 		return PTR_ERR(sskb);
1274 
1275 	mt7615_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1276 	if (enable && sta) {
1277 		mt7615_mcu_sta_ht_tlv(sskb, sta);
1278 		mt7615_mcu_sta_uapsd(sskb, vif, sta);
1279 	}
1280 
1281 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1282 					     NULL, &wskb);
1283 	if (IS_ERR(wtbl_hdr))
1284 		return PTR_ERR(wtbl_hdr);
1285 
1286 	if (enable) {
1287 		mt7615_mcu_wtbl_generic_tlv(wskb, vif, sta, NULL, wtbl_hdr);
1288 		if (sta)
1289 			mt7615_mcu_wtbl_ht_tlv(wskb, sta, NULL, wtbl_hdr);
1290 	}
1291 
1292 	cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1293 	skb = enable ? wskb : sskb;
1294 
1295 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1296 	if (err < 0) {
1297 		skb = enable ? sskb : wskb;
1298 		dev_kfree_skb(skb);
1299 
1300 		return err;
1301 	}
1302 
1303 	cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1304 	skb = enable ? sskb : wskb;
1305 
1306 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1307 }
1308 
1309 static const struct mt7615_mcu_ops wtbl_update_ops = {
1310 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1311 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1312 	.add_dev_info = mt7615_mcu_add_dev,
1313 	.add_bss_info = mt7615_mcu_add_bss,
1314 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1315 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1316 	.sta_add = mt7615_mcu_wtbl_sta_add,
1317 };
1318 
1319 static int
1320 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1321 		  struct ieee80211_ampdu_params *params,
1322 		  bool enable, bool tx)
1323 {
1324 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1325 	struct mt7615_vif *mvif = msta->vif;
1326 	struct wtbl_req_hdr *wtbl_hdr;
1327 	struct tlv *sta_wtbl;
1328 	struct sk_buff *skb;
1329 
1330 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1331 	if (IS_ERR(skb))
1332 		return PTR_ERR(skb);
1333 
1334 	mt7615_mcu_sta_ba_tlv(skb, params, enable, tx);
1335 
1336 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1337 
1338 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1339 					     &skb);
1340 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1341 
1342 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1343 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1344 }
1345 
1346 static int
1347 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1348 		     struct ieee80211_ampdu_params *params,
1349 		     bool enable)
1350 {
1351 	return mt7615_mcu_sta_ba(dev, params, enable, true);
1352 }
1353 
1354 static int
1355 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1356 		     struct ieee80211_ampdu_params *params,
1357 		     bool enable)
1358 {
1359 	return mt7615_mcu_sta_ba(dev, params, enable, false);
1360 }
1361 
1362 static int
1363 mt7615_mcu_add_sta_cmd(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1364 		       struct ieee80211_sta *sta, bool enable, int cmd)
1365 {
1366 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1367 	struct wtbl_req_hdr *wtbl_hdr;
1368 	struct mt7615_sta *msta;
1369 	struct tlv *sta_wtbl;
1370 	struct sk_buff *skb;
1371 
1372 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1373 
1374 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1375 	if (IS_ERR(skb))
1376 		return PTR_ERR(skb);
1377 
1378 	mt7615_mcu_sta_basic_tlv(skb, vif, sta, enable);
1379 	if (enable && sta) {
1380 		mt7615_mcu_sta_ht_tlv(skb, sta);
1381 		mt7615_mcu_sta_uapsd(skb, vif, sta);
1382 	}
1383 
1384 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1385 
1386 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1387 					     sta_wtbl, &skb);
1388 	if (enable) {
1389 		mt7615_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
1390 		if (sta)
1391 			mt7615_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1392 	}
1393 
1394 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1395 }
1396 
1397 static int
1398 mt7615_mcu_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1399 		   struct ieee80211_sta *sta, bool enable)
1400 {
1401 	return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1402 				      MCU_EXT_CMD_STA_REC_UPDATE);
1403 }
1404 
1405 static const struct mt7615_mcu_ops sta_update_ops = {
1406 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1407 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1408 	.add_dev_info = mt7615_mcu_add_dev,
1409 	.add_bss_info = mt7615_mcu_add_bss,
1410 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1411 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1412 	.sta_add = mt7615_mcu_add_sta,
1413 };
1414 
1415 static int
1416 mt7615_mcu_uni_add_dev(struct mt7615_dev *dev,
1417 		       struct ieee80211_vif *vif, bool enable)
1418 {
1419 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1420 	struct {
1421 		struct {
1422 			u8 omac_idx;
1423 			u8 band_idx;
1424 			__le16 pad;
1425 		} __packed hdr;
1426 		struct req_tlv {
1427 			__le16 tag;
1428 			__le16 len;
1429 			u8 active;
1430 			u8 pad;
1431 			u8 omac_addr[ETH_ALEN];
1432 		} __packed tlv;
1433 	} dev_req = {
1434 		.hdr = {
1435 			.omac_idx = mvif->omac_idx,
1436 			.band_idx = mvif->band_idx,
1437 		},
1438 		.tlv = {
1439 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1440 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1441 			.active = enable,
1442 		},
1443 	};
1444 	struct {
1445 		struct {
1446 			u8 bss_idx;
1447 			u8 pad[3];
1448 		} __packed hdr;
1449 		struct mt7615_bss_basic_tlv basic;
1450 	} basic_req = {
1451 		.hdr = {
1452 			.bss_idx = mvif->idx,
1453 		},
1454 		.basic = {
1455 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1456 			.len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1457 			.omac_idx = mvif->omac_idx,
1458 			.band_idx = mvif->band_idx,
1459 			.wmm_idx = mvif->wmm_idx,
1460 			.active = enable,
1461 			.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx),
1462 			.sta_idx = cpu_to_le16(mvif->sta.wcid.idx),
1463 			.conn_state = 1,
1464 		},
1465 	};
1466 	int err, idx, cmd, len;
1467 	void *data;
1468 
1469 	switch (vif->type) {
1470 	case NL80211_IFTYPE_MESH_POINT:
1471 	case NL80211_IFTYPE_AP:
1472 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1473 		break;
1474 	case NL80211_IFTYPE_STATION:
1475 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1476 		break;
1477 	case NL80211_IFTYPE_ADHOC:
1478 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1479 		break;
1480 	default:
1481 		WARN_ON(1);
1482 		break;
1483 	}
1484 
1485 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1486 	basic_req.basic.hw_bss_idx = idx;
1487 
1488 	memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1489 
1490 	cmd = enable ? MCU_UNI_CMD_DEV_INFO_UPDATE : MCU_UNI_CMD_BSS_INFO_UPDATE;
1491 	data = enable ? (void *)&dev_req : (void *)&basic_req;
1492 	len = enable ? sizeof(dev_req) : sizeof(basic_req);
1493 
1494 	err = __mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1495 	if (err < 0)
1496 		return err;
1497 
1498 	cmd = enable ? MCU_UNI_CMD_BSS_INFO_UPDATE : MCU_UNI_CMD_DEV_INFO_UPDATE;
1499 	data = enable ? (void *)&basic_req : (void *)&dev_req;
1500 	len = enable ? sizeof(basic_req) : sizeof(dev_req);
1501 
1502 	return __mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1503 }
1504 
1505 static int
1506 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1507 {
1508 	return 0;
1509 }
1510 
1511 static int
1512 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1513 		       struct ieee80211_sta *sta, bool enable)
1514 {
1515 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1516 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1517 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1518 	struct mt7615_dev *dev = phy->dev;
1519 	struct {
1520 		struct {
1521 			u8 bss_idx;
1522 			u8 pad[3];
1523 		} __packed hdr;
1524 		struct mt7615_bss_basic_tlv basic;
1525 		struct mt7615_bss_qos_tlv qos;
1526 	} basic_req = {
1527 		.hdr = {
1528 			.bss_idx = mvif->idx,
1529 		},
1530 		.basic = {
1531 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1532 			.len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1533 			.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1534 			.dtim_period = vif->bss_conf.dtim_period,
1535 			.omac_idx = mvif->omac_idx,
1536 			.band_idx = mvif->band_idx,
1537 			.wmm_idx = mvif->wmm_idx,
1538 			.active = true, /* keep bss deactivated */
1539 			.phymode = 0x38,
1540 		},
1541 		.qos = {
1542 			.tag = cpu_to_le16(UNI_BSS_INFO_QBSS),
1543 			.len = cpu_to_le16(sizeof(struct mt7615_bss_qos_tlv)),
1544 			.qos = vif->bss_conf.qos,
1545 		},
1546 	};
1547 	struct {
1548 		struct {
1549 			u8 bss_idx;
1550 			u8 pad[3];
1551 		} __packed hdr;
1552 		struct rlm_tlv {
1553 			__le16 tag;
1554 			__le16 len;
1555 			u8 control_channel;
1556 			u8 center_chan;
1557 			u8 center_chan2;
1558 			u8 bw;
1559 			u8 tx_streams;
1560 			u8 rx_streams;
1561 			u8 short_st;
1562 			u8 ht_op_info;
1563 			u8 sco;
1564 			u8 pad[3];
1565 		} __packed rlm;
1566 	} __packed rlm_req = {
1567 		.hdr = {
1568 			.bss_idx = mvif->idx,
1569 		},
1570 		.rlm = {
1571 			.tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1572 			.len = cpu_to_le16(sizeof(struct rlm_tlv)),
1573 			.control_channel = chandef->chan->hw_value,
1574 			.center_chan = ieee80211_frequency_to_channel(freq1),
1575 			.center_chan2 = ieee80211_frequency_to_channel(freq2),
1576 			.tx_streams = hweight8(phy->mt76->antenna_mask),
1577 			.rx_streams = phy->chainmask,
1578 			.short_st = true,
1579 		},
1580 	};
1581 	int err, conn_type;
1582 	u8 idx;
1583 
1584 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1585 	basic_req.basic.hw_bss_idx = idx;
1586 
1587 	switch (vif->type) {
1588 	case NL80211_IFTYPE_MESH_POINT:
1589 	case NL80211_IFTYPE_AP:
1590 		if (vif->p2p)
1591 			conn_type = CONNECTION_P2P_GO;
1592 		else
1593 			conn_type = CONNECTION_INFRA_AP;
1594 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1595 		break;
1596 	case NL80211_IFTYPE_STATION:
1597 		if (vif->p2p)
1598 			conn_type = CONNECTION_P2P_GC;
1599 		else
1600 			conn_type = CONNECTION_INFRA_STA;
1601 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1602 		break;
1603 	case NL80211_IFTYPE_ADHOC:
1604 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1605 		break;
1606 	default:
1607 		WARN_ON(1);
1608 		break;
1609 	}
1610 
1611 	memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1612 	basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx);
1613 	basic_req.basic.sta_idx = cpu_to_le16(mvif->sta.wcid.idx);
1614 	basic_req.basic.conn_state = !enable;
1615 
1616 	err = __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1617 				  &basic_req, sizeof(basic_req), true);
1618 	if (err < 0)
1619 		return err;
1620 
1621 	switch (chandef->width) {
1622 	case NL80211_CHAN_WIDTH_40:
1623 		rlm_req.rlm.bw = CMD_CBW_40MHZ;
1624 		break;
1625 	case NL80211_CHAN_WIDTH_80:
1626 		rlm_req.rlm.bw = CMD_CBW_80MHZ;
1627 		break;
1628 	case NL80211_CHAN_WIDTH_80P80:
1629 		rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1630 		break;
1631 	case NL80211_CHAN_WIDTH_160:
1632 		rlm_req.rlm.bw = CMD_CBW_160MHZ;
1633 		break;
1634 	case NL80211_CHAN_WIDTH_5:
1635 		rlm_req.rlm.bw = CMD_CBW_5MHZ;
1636 		break;
1637 	case NL80211_CHAN_WIDTH_10:
1638 		rlm_req.rlm.bw = CMD_CBW_10MHZ;
1639 		break;
1640 	case NL80211_CHAN_WIDTH_20_NOHT:
1641 	case NL80211_CHAN_WIDTH_20:
1642 	default:
1643 		rlm_req.rlm.bw = CMD_CBW_20MHZ;
1644 		break;
1645 	}
1646 
1647 	if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1648 		rlm_req.rlm.sco = 1; /* SCA */
1649 	else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1650 		rlm_req.rlm.sco = 3; /* SCB */
1651 
1652 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1653 				   &rlm_req, sizeof(rlm_req), true);
1654 }
1655 
1656 static int
1657 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1658 				  struct ieee80211_hw *hw,
1659 				  struct ieee80211_vif *vif,
1660 				  bool enable)
1661 {
1662 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1663 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1664 	struct ieee80211_mutable_offsets offs;
1665 	struct {
1666 		struct req_hdr {
1667 			u8 bss_idx;
1668 			u8 pad[3];
1669 		} __packed hdr;
1670 		struct bcn_content_tlv {
1671 			__le16 tag;
1672 			__le16 len;
1673 			__le16 tim_ie_pos;
1674 			__le16 csa_ie_pos;
1675 			__le16 bcc_ie_pos;
1676 			/* 0: enable beacon offload
1677 			 * 1: disable beacon offload
1678 			 * 2: update probe respond offload
1679 			 */
1680 			u8 enable;
1681 			/* 0: legacy format (TXD + payload)
1682 			 * 1: only cap field IE
1683 			 */
1684 			u8 type;
1685 			__le16 pkt_len;
1686 			u8 pkt[512];
1687 		} __packed beacon_tlv;
1688 	} req = {
1689 		.hdr = {
1690 			.bss_idx = mvif->idx,
1691 		},
1692 		.beacon_tlv = {
1693 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1694 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1695 			.enable = enable,
1696 		},
1697 	};
1698 	struct sk_buff *skb;
1699 
1700 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1701 	if (!skb)
1702 		return -EINVAL;
1703 
1704 	if (skb->len > 512 - MT_TXD_SIZE) {
1705 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1706 		dev_kfree_skb(skb);
1707 		return -EINVAL;
1708 	}
1709 
1710 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1711 			      wcid, NULL, 0, NULL, true);
1712 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1713 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1714 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1715 
1716 	if (offs.csa_counter_offs[0]) {
1717 		u16 csa_offs;
1718 
1719 		csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
1720 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1721 	}
1722 	dev_kfree_skb(skb);
1723 
1724 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1725 				   &req, sizeof(req), true);
1726 }
1727 
1728 static int
1729 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1730 		     struct ieee80211_ampdu_params *params,
1731 		     bool enable)
1732 {
1733 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1734 	struct mt7615_vif *mvif = msta->vif;
1735 	struct wtbl_req_hdr *wtbl_hdr;
1736 	struct tlv *sta_wtbl;
1737 	struct sk_buff *skb;
1738 	int err;
1739 
1740 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1741 	if (IS_ERR(skb))
1742 		return PTR_ERR(skb);
1743 
1744 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1745 
1746 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1747 					     &skb);
1748 	if (IS_ERR(wtbl_hdr))
1749 		return PTR_ERR(wtbl_hdr);
1750 
1751 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, sta_wtbl,
1752 			       wtbl_hdr);
1753 
1754 	err =  __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1755 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1756 	if (err < 0)
1757 		return err;
1758 
1759 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1760 	if (IS_ERR(skb))
1761 		return PTR_ERR(skb);
1762 
1763 	mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1764 
1765 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1766 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1767 }
1768 
1769 static int
1770 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1771 		     struct ieee80211_ampdu_params *params,
1772 		     bool enable)
1773 {
1774 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1775 	struct mt7615_vif *mvif = msta->vif;
1776 	struct wtbl_req_hdr *wtbl_hdr;
1777 	struct tlv *sta_wtbl;
1778 	struct sk_buff *skb;
1779 	int err;
1780 
1781 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1782 	if (IS_ERR(skb))
1783 		return PTR_ERR(skb);
1784 
1785 	mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1786 
1787 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1788 				      MCU_UNI_CMD_STA_REC_UPDATE, true);
1789 	if (err < 0 || !enable)
1790 		return err;
1791 
1792 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1793 	if (IS_ERR(skb))
1794 		return PTR_ERR(skb);
1795 
1796 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1797 
1798 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1799 					     &skb);
1800 	if (IS_ERR(wtbl_hdr))
1801 		return PTR_ERR(wtbl_hdr);
1802 
1803 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, sta_wtbl,
1804 			       wtbl_hdr);
1805 
1806 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1807 				       MCU_UNI_CMD_STA_REC_UPDATE, true);
1808 }
1809 
1810 static int
1811 mt7615_mcu_uni_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1812 		       struct ieee80211_sta *sta, bool enable)
1813 {
1814 	return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1815 				      MCU_UNI_CMD_STA_REC_UPDATE);
1816 }
1817 
1818 static const struct mt7615_mcu_ops uni_update_ops = {
1819 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1820 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1821 	.add_dev_info = mt7615_mcu_uni_add_dev,
1822 	.add_bss_info = mt7615_mcu_uni_add_bss,
1823 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1824 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1825 	.sta_add = mt7615_mcu_uni_add_sta,
1826 };
1827 
1828 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
1829 				    int len)
1830 {
1831 	int ret = 0, cur_len;
1832 
1833 	while (len > 0) {
1834 		cur_len = min_t(int, 4096 - dev->mt76.mcu_ops->headroom, len);
1835 
1836 		ret = __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_SCATTER,
1837 					  data, cur_len, false);
1838 		if (ret)
1839 			break;
1840 
1841 		data += cur_len;
1842 		len -= cur_len;
1843 
1844 		if (mt76_is_mmio(&dev->mt76))
1845 			mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
1846 	}
1847 
1848 	return ret;
1849 }
1850 
1851 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
1852 				     u32 option)
1853 {
1854 	struct {
1855 		__le32 option;
1856 		__le32 addr;
1857 	} req = {
1858 		.option = cpu_to_le32(option),
1859 		.addr = cpu_to_le32(addr),
1860 	};
1861 
1862 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_START_REQ,
1863 				   &req, sizeof(req), true);
1864 }
1865 
1866 int mt7615_mcu_restart(struct mt76_dev *dev)
1867 {
1868 	return __mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL,
1869 				   0, true);
1870 }
1871 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1872 
1873 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
1874 {
1875 	struct {
1876 		__le32 op;
1877 	} req = {
1878 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
1879 	};
1880 
1881 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_SEM_CONTROL,
1882 				   &req, sizeof(req), true);
1883 }
1884 
1885 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
1886 {
1887 	struct {
1888 		u8 check_crc;
1889 		u8 reserved[3];
1890 	} req = {
1891 		.check_crc = 0,
1892 	};
1893 
1894 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_FINISH_REQ,
1895 				   &req, sizeof(req), true);
1896 }
1897 
1898 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
1899 {
1900 	if (!is_mt7622(&dev->mt76))
1901 		return;
1902 
1903 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
1904 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
1905 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
1906 }
1907 
1908 int mt7615_driver_own(struct mt7615_dev *dev)
1909 {
1910 	struct mt76_phy *mphy = &dev->mt76.phy;
1911 	struct mt76_dev *mdev = &dev->mt76;
1912 	int i;
1913 
1914 	if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
1915 		goto out;
1916 
1917 	mt7622_trigger_hif_int(dev, true);
1918 
1919 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
1920 		u32 addr;
1921 
1922 		addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
1923 		mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
1924 
1925 		addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
1926 		if (mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
1927 			break;
1928 	}
1929 
1930 	mt7622_trigger_hif_int(dev, false);
1931 
1932 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
1933 		dev_err(mdev->dev, "driver own failed\n");
1934 		set_bit(MT76_STATE_PM, &mphy->state);
1935 		return -EIO;
1936 	}
1937 
1938 out:
1939 	dev->pm.last_activity = jiffies;
1940 
1941 	return 0;
1942 }
1943 EXPORT_SYMBOL_GPL(mt7615_driver_own);
1944 
1945 int mt7615_firmware_own(struct mt7615_dev *dev)
1946 {
1947 	struct mt76_phy *mphy = &dev->mt76.phy;
1948 	int err = 0;
1949 	u32 addr;
1950 
1951 	if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
1952 		return 0;
1953 
1954 	mt7622_trigger_hif_int(dev, true);
1955 
1956 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
1957 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
1958 
1959 	if (is_mt7622(&dev->mt76) &&
1960 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
1961 			    MT_CFG_LPCR_HOST_FW_OWN, 300)) {
1962 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
1963 		clear_bit(MT76_STATE_PM, &mphy->state);
1964 		err = -EIO;
1965 	}
1966 
1967 	mt7622_trigger_hif_int(dev, false);
1968 
1969 	return err;
1970 }
1971 EXPORT_SYMBOL_GPL(mt7615_firmware_own);
1972 
1973 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1974 {
1975 	const struct mt7615_patch_hdr *hdr;
1976 	const struct firmware *fw = NULL;
1977 	int len, ret, sem;
1978 
1979 	sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
1980 	switch (sem) {
1981 	case PATCH_IS_DL:
1982 		return 0;
1983 	case PATCH_NOT_DL_SEM_SUCCESS:
1984 		break;
1985 	default:
1986 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1987 		return -EAGAIN;
1988 	}
1989 
1990 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1991 	if (ret)
1992 		goto out;
1993 
1994 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1995 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1996 		ret = -EINVAL;
1997 		goto out;
1998 	}
1999 
2000 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
2001 
2002 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2003 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2004 
2005 	len = fw->size - sizeof(*hdr);
2006 
2007 	ret = mt7615_mcu_init_download(dev, addr, len, DL_MODE_NEED_RSP);
2008 	if (ret) {
2009 		dev_err(dev->mt76.dev, "Download request failed\n");
2010 		goto out;
2011 	}
2012 
2013 	ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
2014 	if (ret) {
2015 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2016 		goto out;
2017 	}
2018 
2019 	ret = mt7615_mcu_start_patch(dev);
2020 	if (ret)
2021 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2022 
2023 out:
2024 	release_firmware(fw);
2025 
2026 	sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
2027 	switch (sem) {
2028 	case PATCH_REL_SEM_SUCCESS:
2029 		break;
2030 	default:
2031 		ret = -EAGAIN;
2032 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2033 		break;
2034 	}
2035 
2036 	return ret;
2037 }
2038 
2039 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
2040 {
2041 	u32 ret = 0;
2042 
2043 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2044 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2045 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2046 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2047 	ret |= DL_MODE_NEED_RSP;
2048 	ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
2049 
2050 	return ret;
2051 }
2052 
2053 static int
2054 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
2055 			     const struct mt7615_fw_trailer *hdr,
2056 			     const u8 *data, bool is_cr4)
2057 {
2058 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
2059 	int err, i, offset = 0;
2060 	u32 len, addr, mode;
2061 
2062 	for (i = 0; i < n_region; i++) {
2063 		mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
2064 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
2065 		addr = le32_to_cpu(hdr[i].addr);
2066 
2067 		err = mt7615_mcu_init_download(dev, addr, len, mode);
2068 		if (err) {
2069 			dev_err(dev->mt76.dev, "Download request failed\n");
2070 			return err;
2071 		}
2072 
2073 		err = mt7615_mcu_send_firmware(dev, data + offset, len);
2074 		if (err) {
2075 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2076 			return err;
2077 		}
2078 
2079 		offset += len;
2080 	}
2081 
2082 	return 0;
2083 }
2084 
2085 static const struct wiphy_wowlan_support mt7615_wowlan_support = {
2086 	.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
2087 		 WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
2088 	.n_patterns = 1,
2089 	.pattern_min_len = 1,
2090 	.pattern_max_len = MT7615_WOW_PATTEN_MAX_LEN,
2091 	.max_nd_match_sets = 10,
2092 };
2093 
2094 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
2095 {
2096 	const struct mt7615_fw_trailer *hdr;
2097 	const struct firmware *fw;
2098 	int ret;
2099 
2100 	ret = request_firmware(&fw, name, dev->mt76.dev);
2101 	if (ret)
2102 		return ret;
2103 
2104 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
2105 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2106 		ret = -EINVAL;
2107 		goto out;
2108 	}
2109 
2110 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2111 					N9_REGION_NUM * sizeof(*hdr));
2112 
2113 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2114 		 hdr->fw_ver, hdr->build_date);
2115 
2116 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2117 	if (ret)
2118 		goto out;
2119 
2120 	ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
2121 					FW_START_OVERRIDE);
2122 	if (ret) {
2123 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2124 		goto out;
2125 	}
2126 
2127 	snprintf(dev->mt76.hw->wiphy->fw_version,
2128 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2129 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2130 
2131 	if (!is_mt7615(&dev->mt76) &&
2132 	    !strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
2133 		dev->fw_ver = MT7615_FIRMWARE_V2;
2134 		dev->mcu_ops = &sta_update_ops;
2135 	} else {
2136 		dev->fw_ver = MT7615_FIRMWARE_V1;
2137 		dev->mcu_ops = &wtbl_update_ops;
2138 	}
2139 
2140 out:
2141 	release_firmware(fw);
2142 	return ret;
2143 }
2144 
2145 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
2146 {
2147 	const struct mt7615_fw_trailer *hdr;
2148 	const struct firmware *fw;
2149 	int ret;
2150 
2151 	ret = request_firmware(&fw, name, dev->mt76.dev);
2152 	if (ret)
2153 		return ret;
2154 
2155 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
2156 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2157 		ret = -EINVAL;
2158 		goto out;
2159 	}
2160 
2161 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2162 					CR4_REGION_NUM * sizeof(*hdr));
2163 
2164 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
2165 		 hdr->fw_ver, hdr->build_date);
2166 
2167 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2168 	if (ret)
2169 		goto out;
2170 
2171 	ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
2172 	if (ret) {
2173 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
2174 		goto out;
2175 	}
2176 
2177 out:
2178 	release_firmware(fw);
2179 
2180 	return ret;
2181 }
2182 
2183 static int mt7615_load_ram(struct mt7615_dev *dev)
2184 {
2185 	int ret;
2186 
2187 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
2188 	if (ret)
2189 		return ret;
2190 
2191 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
2192 }
2193 
2194 static int mt7615_load_firmware(struct mt7615_dev *dev)
2195 {
2196 	int ret;
2197 	u32 val;
2198 
2199 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
2200 
2201 	if (val != FW_STATE_FW_DOWNLOAD) {
2202 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2203 		return -EIO;
2204 	}
2205 
2206 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
2207 	if (ret)
2208 		return ret;
2209 
2210 	ret = mt7615_load_ram(dev);
2211 	if (ret)
2212 		return ret;
2213 
2214 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
2215 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
2216 				       FW_STATE_CR4_RDY), 500)) {
2217 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2218 		return -EIO;
2219 	}
2220 
2221 	return 0;
2222 }
2223 
2224 static int mt7622_load_firmware(struct mt7615_dev *dev)
2225 {
2226 	int ret;
2227 	u32 val;
2228 
2229 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2230 
2231 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
2232 	if (val != FW_STATE_FW_DOWNLOAD) {
2233 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2234 		return -EIO;
2235 	}
2236 
2237 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
2238 	if (ret)
2239 		return ret;
2240 
2241 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
2242 	if (ret)
2243 		return ret;
2244 
2245 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
2246 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
2247 				       FW_STATE_NORMAL_TRX), 1500)) {
2248 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2249 		return -EIO;
2250 	}
2251 
2252 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2253 
2254 	return 0;
2255 }
2256 
2257 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
2258 {
2259 	struct {
2260 		u8 ctrl_val;
2261 		u8 pad[3];
2262 	} data = {
2263 		.ctrl_val = ctrl
2264 	};
2265 
2266 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST,
2267 				   &data, sizeof(data), true);
2268 }
2269 
2270 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
2271 {
2272 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
2273 	const struct mt7663_fw_trailer *hdr;
2274 	const struct mt7663_fw_buf *buf;
2275 	const struct firmware *fw;
2276 	const u8 *base_addr;
2277 	int i, ret;
2278 
2279 	ret = request_firmware(&fw, name, dev->mt76.dev);
2280 	if (ret)
2281 		return ret;
2282 
2283 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
2284 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2285 		ret = -EINVAL;
2286 		goto out;
2287 	}
2288 
2289 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
2290 						 FW_V3_COMMON_TAILER_SIZE);
2291 
2292 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2293 		 hdr->fw_ver, hdr->build_date);
2294 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
2295 
2296 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
2297 	for (i = 0; i < hdr->n_region; i++) {
2298 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
2299 		u32 len, addr, mode;
2300 
2301 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
2302 
2303 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
2304 		mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
2305 		addr = le32_to_cpu(buf->img_dest_addr);
2306 		len = le32_to_cpu(buf->img_size);
2307 
2308 		ret = mt7615_mcu_init_download(dev, addr, len, mode);
2309 		if (ret) {
2310 			dev_err(dev->mt76.dev, "Download request failed\n");
2311 			goto out;
2312 		}
2313 
2314 		ret = mt7615_mcu_send_firmware(dev, fw->data + offset, len);
2315 		if (ret) {
2316 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
2317 			goto out;
2318 		}
2319 
2320 		offset += le32_to_cpu(buf->img_size);
2321 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
2322 			override_addr = le32_to_cpu(buf->img_dest_addr);
2323 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
2324 				 i, override_addr);
2325 		}
2326 	}
2327 
2328 	if (override_addr)
2329 		flag |= FW_START_OVERRIDE;
2330 
2331 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
2332 		 override_addr, flag);
2333 
2334 	ret = mt7615_mcu_start_firmware(dev, override_addr, flag);
2335 	if (ret) {
2336 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2337 		goto out;
2338 	}
2339 
2340 	snprintf(dev->mt76.hw->wiphy->fw_version,
2341 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2342 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2343 
2344 out:
2345 	release_firmware(fw);
2346 
2347 	return ret;
2348 }
2349 
2350 static int
2351 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
2352 {
2353 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
2354 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
2355 	int ret;
2356 
2357 	if (!prefer_offload_fw) {
2358 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
2359 		primary_rom = MT7663_ROM_PATCH;
2360 	}
2361 	selected_rom = primary_rom;
2362 
2363 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
2364 	if (ret) {
2365 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
2366 			 primary_rom, secondary_rom);
2367 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
2368 					secondary_rom);
2369 		if (ret) {
2370 			dev_err(dev->mt76.dev, "failed to load %s",
2371 				secondary_rom);
2372 			return ret;
2373 		}
2374 		selected_rom = secondary_rom;
2375 	}
2376 
2377 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
2378 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
2379 		dev->fw_ver = MT7615_FIRMWARE_V3;
2380 		dev->mcu_ops = &uni_update_ops;
2381 	} else {
2382 		*n9_firmware = MT7663_FIRMWARE_N9;
2383 		dev->fw_ver = MT7615_FIRMWARE_V2;
2384 		dev->mcu_ops = &sta_update_ops;
2385 	}
2386 
2387 	return 0;
2388 }
2389 
2390 int __mt7663_load_firmware(struct mt7615_dev *dev)
2391 {
2392 	const char *n9_firmware;
2393 	int ret;
2394 
2395 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
2396 	if (ret) {
2397 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
2398 		return -EIO;
2399 	}
2400 
2401 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
2402 	if (ret)
2403 		return ret;
2404 
2405 	ret = mt7663_load_n9(dev, n9_firmware);
2406 	if (ret)
2407 		return ret;
2408 
2409 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
2410 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
2411 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
2412 				     MT7663_TOP_MISC2_FW_STATE);
2413 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2414 		return -EIO;
2415 	}
2416 
2417 #ifdef CONFIG_PM
2418 	if (mt7615_firmware_offload(dev))
2419 		dev->mt76.hw->wiphy->wowlan = &mt7615_wowlan_support;
2420 #endif /* CONFIG_PM */
2421 
2422 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2423 
2424 	return 0;
2425 }
2426 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
2427 
2428 static int mt7663_load_firmware(struct mt7615_dev *dev)
2429 {
2430 	int ret;
2431 
2432 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2433 
2434 	ret = __mt7663_load_firmware(dev);
2435 	if (ret)
2436 		return ret;
2437 
2438 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2439 
2440 	return 0;
2441 }
2442 
2443 int mt7615_mcu_init(struct mt7615_dev *dev)
2444 {
2445 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
2446 		.headroom = sizeof(struct mt7615_mcu_txd),
2447 		.mcu_skb_send_msg = mt7615_mcu_send_message,
2448 		.mcu_send_msg = mt7615_mcu_msg_send,
2449 		.mcu_restart = mt7615_mcu_restart,
2450 	};
2451 	int ret;
2452 
2453 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
2454 
2455 	ret = mt7615_driver_own(dev);
2456 	if (ret)
2457 		return ret;
2458 
2459 	switch (mt76_chip(&dev->mt76)) {
2460 	case 0x7622:
2461 		ret = mt7622_load_firmware(dev);
2462 		break;
2463 	case 0x7663:
2464 		ret = mt7663_load_firmware(dev);
2465 		break;
2466 	default:
2467 		ret = mt7615_load_firmware(dev);
2468 		break;
2469 	}
2470 	if (ret)
2471 		return ret;
2472 
2473 	mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2474 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2475 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2476 	mt7615_mcu_fw_log_2_host(dev, 0);
2477 
2478 	return 0;
2479 }
2480 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
2481 
2482 void mt7615_mcu_exit(struct mt7615_dev *dev)
2483 {
2484 	__mt76_mcu_restart(&dev->mt76);
2485 	mt7615_firmware_own(dev);
2486 	skb_queue_purge(&dev->mt76.mcu.res_q);
2487 }
2488 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
2489 
2490 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
2491 {
2492 	struct {
2493 		u8 buffer_mode;
2494 		u8 content_format;
2495 		__le16 len;
2496 	} __packed req_hdr = {
2497 		.buffer_mode = 1,
2498 	};
2499 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2500 	struct sk_buff *skb;
2501 	int eep_len, offset;
2502 
2503 	switch (mt76_chip(&dev->mt76)) {
2504 	case 0x7622:
2505 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
2506 		offset = MT_EE_NIC_CONF_0;
2507 		break;
2508 	case 0x7663:
2509 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
2510 		req_hdr.content_format = 1;
2511 		offset = MT_EE_CHIP_ID;
2512 		break;
2513 	default:
2514 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
2515 		offset = MT_EE_NIC_CONF_0;
2516 		break;
2517 	}
2518 
2519 	req_hdr.len = cpu_to_le16(eep_len);
2520 
2521 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
2522 	if (!skb)
2523 		return -ENOMEM;
2524 
2525 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2526 	skb_put_data(skb, eep + offset, eep_len);
2527 
2528 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2529 				       MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
2530 }
2531 EXPORT_SYMBOL_GPL(mt7615_mcu_set_eeprom);
2532 
2533 int mt7615_mcu_set_mac_enable(struct mt7615_dev *dev, int band, bool enable)
2534 {
2535 	struct {
2536 		u8 enable;
2537 		u8 band;
2538 		u8 rsv[2];
2539 	} __packed req = {
2540 		.enable = enable,
2541 		.band = band,
2542 	};
2543 
2544 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2545 				   &req, sizeof(req), true);
2546 }
2547 
2548 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
2549 {
2550 	struct mt7615_dev *dev = phy->dev;
2551 	struct {
2552 		u8 prot_idx;
2553 		u8 band;
2554 		u8 rsv[2];
2555 		__le32 len_thresh;
2556 		__le32 pkt_thresh;
2557 	} __packed req = {
2558 		.prot_idx = 1,
2559 		.band = phy != &dev->phy,
2560 		.len_thresh = cpu_to_le32(val),
2561 		.pkt_thresh = cpu_to_le32(0x2),
2562 	};
2563 
2564 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
2565 				   &req, sizeof(req), true);
2566 }
2567 
2568 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
2569 		       const struct ieee80211_tx_queue_params *params)
2570 {
2571 #define WMM_AIFS_SET	BIT(0)
2572 #define WMM_CW_MIN_SET	BIT(1)
2573 #define WMM_CW_MAX_SET	BIT(2)
2574 #define WMM_TXOP_SET	BIT(3)
2575 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
2576 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
2577 	struct req_data {
2578 		u8 number;
2579 		u8 rsv[3];
2580 		u8 queue;
2581 		u8 valid;
2582 		u8 aifs;
2583 		u8 cw_min;
2584 		__le16 cw_max;
2585 		__le16 txop;
2586 	} __packed req = {
2587 		.number = 1,
2588 		.queue = queue,
2589 		.valid = WMM_PARAM_SET,
2590 		.aifs = params->aifs,
2591 		.cw_min = 5,
2592 		.cw_max = cpu_to_le16(10),
2593 		.txop = cpu_to_le16(params->txop),
2594 	};
2595 
2596 	if (params->cw_min)
2597 		req.cw_min = fls(params->cw_min);
2598 	if (params->cw_max)
2599 		req.cw_max = cpu_to_le16(fls(params->cw_max));
2600 
2601 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
2602 				   &req, sizeof(req), true);
2603 }
2604 
2605 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
2606 {
2607 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2608 	struct dbdc_entry {
2609 		u8 type;
2610 		u8 index;
2611 		u8 band;
2612 		u8 _rsv;
2613 	};
2614 	struct {
2615 		u8 enable;
2616 		u8 num;
2617 		u8 _rsv[2];
2618 		struct dbdc_entry entry[64];
2619 	} req = {
2620 		.enable = !!ext_phy,
2621 	};
2622 	int i;
2623 
2624 	if (!ext_phy)
2625 		goto out;
2626 
2627 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
2628 	do { \
2629 		req.entry[req.num].type = _type;		\
2630 		req.entry[req.num].index = _idx;		\
2631 		req.entry[req.num++].band = _band;		\
2632 	} while (0)
2633 
2634 	for (i = 0; i < 4; i++) {
2635 		bool band = !!(ext_phy->omac_mask & BIT(i));
2636 
2637 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2638 	}
2639 
2640 	for (i = 0; i < 14; i++) {
2641 		bool band = !!(ext_phy->omac_mask & BIT(0x11 + i));
2642 
2643 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2644 	}
2645 
2646 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2647 
2648 	for (i = 0; i < 3; i++)
2649 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2650 
2651 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2652 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2653 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2654 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2655 
2656 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2657 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2658 
2659 out:
2660 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL,
2661 				   &req, sizeof(req), true);
2662 }
2663 
2664 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2665 {
2666 	struct wtbl_req_hdr req = {
2667 		.operation = WTBL_RESET_ALL,
2668 	};
2669 
2670 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
2671 				   &req, sizeof(req), true);
2672 }
2673 EXPORT_SYMBOL_GPL(mt7615_mcu_del_wtbl_all);
2674 
2675 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2676 		       enum mt7615_rdd_cmd cmd, u8 index,
2677 		       u8 rx_sel, u8 val)
2678 {
2679 	struct {
2680 		u8 ctrl;
2681 		u8 rdd_idx;
2682 		u8 rdd_rx_sel;
2683 		u8 val;
2684 		u8 rsv[4];
2685 	} req = {
2686 		.ctrl = cmd,
2687 		.rdd_idx = index,
2688 		.rdd_rx_sel = rx_sel,
2689 		.val = val,
2690 	};
2691 
2692 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL,
2693 				   &req, sizeof(req), true);
2694 }
2695 
2696 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2697 {
2698 	struct {
2699 		u16 tag;
2700 		u16 min_lpn;
2701 	} req = {
2702 		.tag = 0x1,
2703 		.min_lpn = val,
2704 	};
2705 
2706 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2707 				   &req, sizeof(req), true);
2708 }
2709 
2710 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2711 			    const struct mt7615_dfs_pulse *pulse)
2712 {
2713 	struct {
2714 		u16 tag;
2715 		struct mt7615_dfs_pulse pulse;
2716 	} req = {
2717 		.tag = 0x3,
2718 	};
2719 
2720 	memcpy(&req.pulse, pulse, sizeof(*pulse));
2721 
2722 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2723 				   &req, sizeof(req), true);
2724 }
2725 
2726 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2727 			    const struct mt7615_dfs_pattern *pattern)
2728 {
2729 	struct {
2730 		u16 tag;
2731 		u16 radar_type;
2732 		struct mt7615_dfs_pattern pattern;
2733 	} req = {
2734 		.tag = 0x2,
2735 		.radar_type = index,
2736 	};
2737 
2738 	memcpy(&req.pattern, pattern, sizeof(*pattern));
2739 
2740 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2741 				   &req, sizeof(req), true);
2742 }
2743 
2744 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2745 {
2746 	struct {
2747 		u8 pulse_num;
2748 		u8 rsv[3];
2749 		struct {
2750 			u32 start_time;
2751 			u16 width;
2752 			s16 power;
2753 		} pattern[32];
2754 	} req = {
2755 		.pulse_num = dev->radar_pattern.n_pulses,
2756 	};
2757 	u32 start_time = ktime_to_ms(ktime_get_boottime());
2758 	int i;
2759 
2760 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2761 		return -EINVAL;
2762 
2763 	/* TODO: add some noise here */
2764 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2765 		req.pattern[i].width = dev->radar_pattern.width;
2766 		req.pattern[i].power = dev->radar_pattern.power;
2767 		req.pattern[i].start_time = start_time +
2768 					    i * dev->radar_pattern.period;
2769 	}
2770 
2771 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2772 				   &req, sizeof(req), false);
2773 }
2774 
2775 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2776 {
2777 	struct mt76_phy *mphy = phy->mt76;
2778 	struct ieee80211_hw *hw = mphy->hw;
2779 	int n_chains = hweight8(mphy->antenna_mask);
2780 	int tx_power;
2781 	int i;
2782 
2783 	tx_power = hw->conf.power_level * 2 -
2784 		   mt76_tx_power_nss_delta(n_chains);
2785 	mphy->txpower_cur = tx_power;
2786 
2787 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2788 		sku[i] = tx_power;
2789 
2790 	for (i = 0; i < 4; i++) {
2791 		int delta = 0;
2792 
2793 		if (i < n_chains - 1)
2794 			delta = mt76_tx_power_nss_delta(n_chains) -
2795 				mt76_tx_power_nss_delta(i + 1);
2796 		sku[MT_SKU_1SS_DELTA + i] = delta;
2797 	}
2798 }
2799 
2800 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2801 {
2802 	static const u8 width_to_bw[] = {
2803 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2804 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2805 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2806 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2807 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2808 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2809 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2810 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2811 	};
2812 
2813 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2814 		return 0;
2815 
2816 	return width_to_bw[chandef->width];
2817 }
2818 
2819 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2820 {
2821 	struct mt7615_dev *dev = phy->dev;
2822 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2823 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2824 	struct {
2825 		u8 control_chan;
2826 		u8 center_chan;
2827 		u8 bw;
2828 		u8 tx_streams;
2829 		u8 rx_streams_mask;
2830 		u8 switch_reason;
2831 		u8 band_idx;
2832 		/* for 80+80 only */
2833 		u8 center_chan2;
2834 		__le16 cac_case;
2835 		u8 channel_band;
2836 		u8 rsv0;
2837 		__le32 outband_freq;
2838 		u8 txpower_drop;
2839 		u8 rsv1[3];
2840 		u8 txpower_sku[53];
2841 		u8 rsv2[3];
2842 	} req = {
2843 		.control_chan = chandef->chan->hw_value,
2844 		.center_chan = ieee80211_frequency_to_channel(freq1),
2845 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2846 		.rx_streams_mask = phy->chainmask,
2847 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2848 	};
2849 
2850 #ifdef CONFIG_NL80211_TESTMODE
2851 	if (dev->mt76.test.state == MT76_TM_STATE_TX_FRAMES &&
2852 	    dev->mt76.test.tx_antenna_mask) {
2853 		req.tx_streams = hweight8(dev->mt76.test.tx_antenna_mask);
2854 		req.rx_streams_mask = dev->mt76.test.tx_antenna_mask;
2855 	}
2856 #endif
2857 
2858 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2859 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2860 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2861 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2862 		req.switch_reason = CH_SWITCH_DFS;
2863 	else
2864 		req.switch_reason = CH_SWITCH_NORMAL;
2865 
2866 	req.band_idx = phy != &dev->phy;
2867 	req.bw = mt7615_mcu_chan_bw(chandef);
2868 
2869 	if (mt76_testmode_enabled(&dev->mt76))
2870 		memset(req.txpower_sku, 0x3f, 49);
2871 	else
2872 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2873 
2874 	return __mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2875 }
2876 
2877 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2878 {
2879 	struct {
2880 		u8 action;
2881 		u8 rsv[3];
2882 	} req = {
2883 		.action = index,
2884 	};
2885 
2886 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2887 				   sizeof(req), true);
2888 }
2889 
2890 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2891 			      u32 val)
2892 {
2893 	struct {
2894 		u8 test_mode_en;
2895 		u8 param_idx;
2896 		u8 _rsv[2];
2897 
2898 		__le32 value;
2899 
2900 		u8 pad[8];
2901 	} req = {
2902 		.test_mode_en = test_mode,
2903 		.param_idx = param,
2904 		.value = cpu_to_le32(val),
2905 	};
2906 
2907 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2908 				   sizeof(req), false);
2909 }
2910 
2911 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2912 {
2913 	struct mt7615_dev *dev = phy->dev;
2914 	struct {
2915 		u8 format_id;
2916 		u8 sku_enable;
2917 		u8 band_idx;
2918 		u8 rsv;
2919 	} req = {
2920 		.format_id = 0,
2921 		.band_idx = phy != &dev->phy,
2922 		.sku_enable = enable,
2923 	};
2924 
2925 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2926 				   sizeof(req), true);
2927 }
2928 
2929 int mt7615_mcu_set_vif_ps(struct mt7615_dev *dev, struct ieee80211_vif *vif)
2930 {
2931 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2932 	struct {
2933 		u8 bss_idx;
2934 		u8 ps_state; /* 0: device awake
2935 			      * 1: static power save
2936 			      * 2: dynamic power saving
2937 			      */
2938 	} req = {
2939 		.bss_idx = mvif->idx,
2940 		.ps_state = vif->bss_conf.ps ? 2 : 0,
2941 	};
2942 
2943 	if (vif->type != NL80211_IFTYPE_STATION)
2944 		return -ENOTSUPP;
2945 
2946 	return __mt76_mcu_send_msg(&dev->mt76,  MCU_CMD_SET_PS_PROFILE,
2947 				   &req, sizeof(req), false);
2948 }
2949 
2950 int mt7615_mcu_set_channel_domain(struct mt7615_phy *phy)
2951 {
2952 	struct mt76_phy *mphy = phy->mt76;
2953 	struct mt7615_dev *dev = phy->dev;
2954 	struct mt7615_mcu_channel_domain {
2955 		__le32 country_code; /* regulatory_request.alpha2 */
2956 		u8 bw_2g; /* BW_20_40M		0
2957 			   * BW_20M		1
2958 			   * BW_20_40_80M	2
2959 			   * BW_20_40_80_160M	3
2960 			   * BW_20_40_80_8080M	4
2961 			   */
2962 		u8 bw_5g;
2963 		__le16 pad;
2964 		u8 n_2ch;
2965 		u8 n_5ch;
2966 		__le16 pad2;
2967 	} __packed hdr = {
2968 		.bw_2g = 0,
2969 		.bw_5g = 3,
2970 		.n_2ch = mphy->sband_2g.sband.n_channels,
2971 		.n_5ch = mphy->sband_5g.sband.n_channels,
2972 	};
2973 	struct mt7615_mcu_chan {
2974 		__le16 hw_value;
2975 		__le16 pad;
2976 		__le32 flags;
2977 	} __packed;
2978 	int i, n_channels = hdr.n_2ch + hdr.n_5ch;
2979 	int len = sizeof(hdr) + n_channels * sizeof(struct mt7615_mcu_chan);
2980 	struct sk_buff *skb;
2981 
2982 	if (!mt7615_firmware_offload(dev))
2983 		return 0;
2984 
2985 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
2986 	if (!skb)
2987 		return -ENOMEM;
2988 
2989 	skb_put_data(skb, &hdr, sizeof(hdr));
2990 
2991 	for (i = 0; i < n_channels; i++) {
2992 		struct ieee80211_channel *chan;
2993 		struct mt7615_mcu_chan channel;
2994 
2995 		if (i < hdr.n_2ch)
2996 			chan = &mphy->sband_2g.sband.channels[i];
2997 		else
2998 			chan = &mphy->sband_5g.sband.channels[i - hdr.n_2ch];
2999 
3000 		channel.hw_value = cpu_to_le16(chan->hw_value);
3001 		channel.flags = cpu_to_le32(chan->flags);
3002 		channel.pad = 0;
3003 
3004 		skb_put_data(skb, &channel, sizeof(channel));
3005 	}
3006 
3007 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3008 				       MCU_CMD_SET_CHAN_DOMAIN, false);
3009 }
3010 
3011 #define MT7615_SCAN_CHANNEL_TIME	60
3012 int mt7615_mcu_hw_scan(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3013 		       struct ieee80211_scan_request *scan_req)
3014 {
3015 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3016 	struct cfg80211_scan_request *sreq = &scan_req->req;
3017 	int n_ssids = 0, err, i, duration = MT7615_SCAN_CHANNEL_TIME;
3018 	int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
3019 	struct ieee80211_channel **scan_list = sreq->channels;
3020 	struct mt7615_dev *dev = phy->dev;
3021 	bool ext_phy = phy != &dev->phy;
3022 	struct mt7615_mcu_scan_channel *chan;
3023 	struct mt7615_hw_scan_req *req;
3024 	struct sk_buff *skb;
3025 
3026 	/* fall-back to sw-scan */
3027 	if (!mt7615_firmware_offload(dev))
3028 		return 1;
3029 
3030 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(*req));
3031 	if (!skb)
3032 		return -ENOMEM;
3033 
3034 	set_bit(MT76_HW_SCANNING, &phy->mt76->state);
3035 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3036 
3037 	req = (struct mt7615_hw_scan_req *)skb_put(skb, sizeof(*req));
3038 
3039 	req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3040 	req->bss_idx = mvif->idx;
3041 	req->scan_type = sreq->n_ssids ? 1 : 0;
3042 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
3043 	req->version = 1;
3044 
3045 	for (i = 0; i < sreq->n_ssids; i++) {
3046 		if (!sreq->ssids[i].ssid_len)
3047 			continue;
3048 
3049 		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
3050 		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
3051 		       sreq->ssids[i].ssid_len);
3052 		n_ssids++;
3053 	}
3054 	req->ssid_type = n_ssids ? BIT(2) : BIT(0);
3055 	req->ssid_type_ext = n_ssids ? BIT(0) : 0;
3056 	req->ssids_num = n_ssids;
3057 
3058 	/* increase channel time for passive scan */
3059 	if (!sreq->n_ssids)
3060 		duration *= 2;
3061 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
3062 	req->channel_min_dwell_time = cpu_to_le16(duration);
3063 	req->channel_dwell_time = cpu_to_le16(duration);
3064 
3065 	req->channels_num = min_t(u8, sreq->n_channels, 32);
3066 	req->ext_channels_num = min_t(u8, ext_channels_num, 32);
3067 	for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
3068 		if (i >= 32)
3069 			chan = &req->ext_channels[i - 32];
3070 		else
3071 			chan = &req->channels[i];
3072 
3073 		chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3074 		chan->channel_num = scan_list[i]->hw_value;
3075 	}
3076 	req->channel_type = sreq->n_channels ? 4 : 0;
3077 
3078 	if (sreq->ie_len > 0) {
3079 		memcpy(req->ies, sreq->ie, sreq->ie_len);
3080 		req->ies_len = cpu_to_le16(sreq->ie_len);
3081 	}
3082 
3083 	memcpy(req->bssid, sreq->bssid, ETH_ALEN);
3084 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3085 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
3086 				     sreq->mac_addr_mask);
3087 		req->scan_func = 1;
3088 	}
3089 
3090 	err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_START_HW_SCAN,
3091 				      false);
3092 	if (err < 0)
3093 		clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
3094 
3095 	return err;
3096 }
3097 
3098 int mt7615_mcu_cancel_hw_scan(struct mt7615_phy *phy,
3099 			      struct ieee80211_vif *vif)
3100 {
3101 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3102 	struct mt7615_dev *dev = phy->dev;
3103 	struct {
3104 		u8 seq_num;
3105 		u8 is_ext_channel;
3106 		u8 rsv[2];
3107 	} __packed req = {
3108 		.seq_num = mvif->scan_seq_num,
3109 	};
3110 
3111 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->mt76->state)) {
3112 		struct cfg80211_scan_info info = {
3113 			.aborted = true,
3114 		};
3115 
3116 		ieee80211_scan_completed(phy->mt76->hw, &info);
3117 	}
3118 
3119 	return __mt76_mcu_send_msg(&dev->mt76,  MCU_CMD_CANCEL_HW_SCAN, &req,
3120 				   sizeof(req), false);
3121 }
3122 
3123 int mt7615_mcu_sched_scan_req(struct mt7615_phy *phy,
3124 			      struct ieee80211_vif *vif,
3125 			      struct cfg80211_sched_scan_request *sreq)
3126 {
3127 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3128 	struct ieee80211_channel **scan_list = sreq->channels;
3129 	struct mt7615_dev *dev = phy->dev;
3130 	bool ext_phy = phy != &dev->phy;
3131 	struct mt7615_mcu_scan_channel *chan;
3132 	struct mt7615_sched_scan_req *req;
3133 	struct cfg80211_match_set *match;
3134 	struct cfg80211_ssid *ssid;
3135 	struct sk_buff *skb;
3136 	int i;
3137 
3138 	if (!mt7615_firmware_offload(dev))
3139 		return -ENOTSUPP;
3140 
3141 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3142 				 sizeof(*req) + sreq->ie_len);
3143 	if (!skb)
3144 		return -ENOMEM;
3145 
3146 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3147 
3148 	req = (struct mt7615_sched_scan_req *)skb_put(skb, sizeof(*req));
3149 	req->version = 1;
3150 	req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3151 
3152 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3153 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
3154 				     sreq->mac_addr_mask);
3155 		req->scan_func = 1;
3156 	}
3157 
3158 	req->ssids_num = sreq->n_ssids;
3159 	for (i = 0; i < req->ssids_num; i++) {
3160 		ssid = &sreq->ssids[i];
3161 		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
3162 		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
3163 	}
3164 
3165 	req->match_num = sreq->n_match_sets;
3166 	for (i = 0; i < req->match_num; i++) {
3167 		match = &sreq->match_sets[i];
3168 		memcpy(req->match[i].ssid, match->ssid.ssid,
3169 		       match->ssid.ssid_len);
3170 		req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
3171 		req->match[i].ssid_len = match->ssid.ssid_len;
3172 	}
3173 
3174 	req->channel_type = sreq->n_channels ? 4 : 0;
3175 	req->channels_num = min_t(u8, sreq->n_channels, 64);
3176 	for (i = 0; i < req->channels_num; i++) {
3177 		chan = &req->channels[i];
3178 		chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3179 		chan->channel_num = scan_list[i]->hw_value;
3180 	}
3181 
3182 	req->intervals_num = sreq->n_scan_plans;
3183 	for (i = 0; i < req->intervals_num; i++)
3184 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3185 
3186 	if (sreq->ie_len > 0) {
3187 		req->ie_len = cpu_to_le16(sreq->ie_len);
3188 		memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
3189 	}
3190 
3191 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3192 				       MCU_CMD_SCHED_SCAN_REQ, false);
3193 }
3194 
3195 int mt7615_mcu_sched_scan_enable(struct mt7615_phy *phy,
3196 				 struct ieee80211_vif *vif,
3197 				 bool enable)
3198 {
3199 	struct mt7615_dev *dev = phy->dev;
3200 	struct {
3201 		u8 active; /* 0: enabled 1: disabled */
3202 		u8 rsv[3];
3203 	} __packed req = {
3204 		.active = !enable,
3205 	};
3206 
3207 	if (!mt7615_firmware_offload(dev))
3208 		return -ENOTSUPP;
3209 
3210 	if (enable)
3211 		set_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3212 	else
3213 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3214 
3215 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SCHED_SCAN_ENABLE,
3216 				   &req, sizeof(req), false);
3217 }
3218 
3219 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3220 {
3221 	int i;
3222 
3223 	for (i = 0; i < n_freqs; i++)
3224 		if (cur == freqs[i])
3225 			return i;
3226 
3227 	return -1;
3228 }
3229 
3230 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
3231 {
3232 	static const u16 freq_list[] = {
3233 		4980, 5805, 5905, 5190,
3234 		5230, 5270, 5310, 5350,
3235 		5390, 5430, 5470, 5510,
3236 		5550, 5590, 5630, 5670,
3237 		5710, 5755, 5795, 5835,
3238 		5875, 5210, 5290, 5370,
3239 		5450, 5530, 5610, 5690,
3240 		5775, 5855
3241 	};
3242 	static const u16 freq_bw40[] = {
3243 		5190, 5230, 5270, 5310,
3244 		5350, 5390, 5430, 5470,
3245 		5510, 5550, 5590, 5630,
3246 		5670, 5710, 5755, 5795,
3247 		5835, 5875
3248 	};
3249 	int offset_2g = ARRAY_SIZE(freq_list);
3250 	int idx;
3251 
3252 	if (freq < 4000) {
3253 		if (freq < 2427)
3254 			return offset_2g;
3255 		if (freq < 2442)
3256 			return offset_2g + 1;
3257 		if (freq < 2457)
3258 			return offset_2g + 2;
3259 
3260 		return offset_2g + 3;
3261 	}
3262 
3263 	switch (bw) {
3264 	case NL80211_CHAN_WIDTH_80:
3265 	case NL80211_CHAN_WIDTH_80P80:
3266 	case NL80211_CHAN_WIDTH_160:
3267 		break;
3268 	default:
3269 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3270 					   freq + 10);
3271 		if (idx >= 0) {
3272 			freq = freq_bw40[idx];
3273 			break;
3274 		}
3275 
3276 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3277 					   freq - 10);
3278 		if (idx >= 0) {
3279 			freq = freq_bw40[idx];
3280 			break;
3281 		}
3282 		/* fall through */
3283 	case NL80211_CHAN_WIDTH_40:
3284 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3285 					   freq);
3286 		if (idx >= 0)
3287 			break;
3288 
3289 		return -1;
3290 
3291 	}
3292 
3293 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3294 }
3295 
3296 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
3297 {
3298 	struct mt7615_dev *dev = phy->dev;
3299 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3300 	int freq2 = chandef->center_freq2;
3301 	int ret;
3302 	struct {
3303 		u8 direction;
3304 		u8 runtime_calibration;
3305 		u8 _rsv[2];
3306 
3307 		__le16 center_freq;
3308 		u8 bw;
3309 		u8 band;
3310 		u8 is_freq2;
3311 		u8 success;
3312 		u8 dbdc_en;
3313 
3314 		u8 _rsv2;
3315 
3316 		struct {
3317 			__le32 sx0_i_lna[4];
3318 			__le32 sx0_q_lna[4];
3319 
3320 			__le32 sx2_i_lna[4];
3321 			__le32 sx2_q_lna[4];
3322 		} dcoc_data[4];
3323 	} req = {
3324 		.direction = 1,
3325 
3326 		.bw = mt7615_mcu_chan_bw(chandef),
3327 		.band = chandef->center_freq1 > 4000,
3328 		.dbdc_en = !!dev->mt76.phy2,
3329 	};
3330 	u16 center_freq = chandef->center_freq1;
3331 	int freq_idx;
3332 	u8 *eep = dev->mt76.eeprom.data;
3333 
3334 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
3335 		return 0;
3336 
3337 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
3338 		freq2 = center_freq + 40;
3339 		center_freq -= 40;
3340 	}
3341 
3342 again:
3343 	req.runtime_calibration = 1;
3344 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
3345 	if (freq_idx < 0)
3346 		goto out;
3347 
3348 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
3349 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
3350 	       sizeof(req.dcoc_data));
3351 	req.runtime_calibration = 0;
3352 
3353 out:
3354 	req.center_freq = cpu_to_le16(center_freq);
3355 	ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
3356 				  sizeof(req), true);
3357 
3358 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3359 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3360 		req.is_freq2 = true;
3361 		center_freq = freq2;
3362 		goto again;
3363 	}
3364 
3365 	return ret;
3366 }
3367 
3368 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
3369 {
3370 	static const u16 freq_list[] = {
3371 		4920, 4940, 4960, 4980,
3372 		5040, 5060, 5080, 5180,
3373 		5200, 5220, 5240, 5260,
3374 		5280, 5300, 5320, 5340,
3375 		5360, 5380, 5400, 5420,
3376 		5440, 5460, 5480, 5500,
3377 		5520, 5540, 5560, 5580,
3378 		5600, 5620, 5640, 5660,
3379 		5680, 5700, 5720, 5745,
3380 		5765, 5785, 5805, 5825,
3381 		5845, 5865, 5885, 5905
3382 	};
3383 	int offset_2g = ARRAY_SIZE(freq_list);
3384 	int idx;
3385 
3386 	if (freq < 4000) {
3387 		if (freq < 2432)
3388 			return offset_2g;
3389 		if (freq < 2457)
3390 			return offset_2g + 1;
3391 
3392 		return offset_2g + 2;
3393 	}
3394 
3395 	if (bw != NL80211_CHAN_WIDTH_20) {
3396 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3397 					   freq + 10);
3398 		if (idx >= 0)
3399 			return idx;
3400 
3401 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3402 					   freq - 10);
3403 		if (idx >= 0)
3404 			return idx;
3405 	}
3406 
3407 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3408 }
3409 
3410 
3411 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
3412 {
3413 	struct mt7615_dev *dev = phy->dev;
3414 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3415 	int freq2 = chandef->center_freq2;
3416 	int ret;
3417 	struct {
3418 		u8 direction;
3419 		u8 runtime_calibration;
3420 		u8 _rsv[2];
3421 
3422 		__le16 center_freq;
3423 		u8 bw;
3424 		u8 band;
3425 		u8 is_freq2;
3426 		u8 success;
3427 		u8 dbdc_en;
3428 
3429 		u8 _rsv2;
3430 
3431 		struct {
3432 			struct {
3433 				u32 dpd_g0;
3434 				u8 data[32];
3435 			} wf0, wf1;
3436 
3437 			struct {
3438 				u32 dpd_g0_prim;
3439 				u32 dpd_g0_sec;
3440 				u8 data_prim[32];
3441 				u8 data_sec[32];
3442 			} wf2, wf3;
3443 		} dpd_data;
3444 	} req = {
3445 		.direction = 1,
3446 
3447 		.bw = mt7615_mcu_chan_bw(chandef),
3448 		.band = chandef->center_freq1 > 4000,
3449 		.dbdc_en = !!dev->mt76.phy2,
3450 	};
3451 	u16 center_freq = chandef->center_freq1;
3452 	int freq_idx;
3453 	u8 *eep = dev->mt76.eeprom.data;
3454 
3455 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
3456 		return 0;
3457 
3458 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
3459 		freq2 = center_freq + 40;
3460 		center_freq -= 40;
3461 	}
3462 
3463 again:
3464 	req.runtime_calibration = 1;
3465 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
3466 	if (freq_idx < 0)
3467 		goto out;
3468 
3469 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
3470 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
3471 	       sizeof(req.dpd_data));
3472 	req.runtime_calibration = 0;
3473 
3474 out:
3475 	req.center_freq = cpu_to_le16(center_freq);
3476 	ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
3477 				  sizeof(req), true);
3478 
3479 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3480 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3481 		req.is_freq2 = true;
3482 		center_freq = freq2;
3483 		goto again;
3484 	}
3485 
3486 	return ret;
3487 }
3488 
3489 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3490 			  bool enable)
3491 {
3492 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3493 	struct {
3494 		u8 bss_idx;
3495 		u8 dtim_period;
3496 		__le16 aid;
3497 		__le16 bcn_interval;
3498 		__le16 atim_window;
3499 		u8 uapsd;
3500 		u8 bmc_delivered_ac;
3501 		u8 bmc_triggered_ac;
3502 		u8 pad;
3503 	} req = {
3504 		.bss_idx = mvif->idx,
3505 		.aid = cpu_to_le16(vif->bss_conf.aid),
3506 		.dtim_period = vif->bss_conf.dtim_period,
3507 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
3508 	};
3509 	struct {
3510 		u8 bss_idx;
3511 		u8 pad[3];
3512 	} req_hdr = {
3513 		.bss_idx = mvif->idx,
3514 	};
3515 	int err;
3516 
3517 	if (vif->type != NL80211_IFTYPE_STATION ||
3518 	    !mt7615_firmware_offload(dev))
3519 		return -ENOTSUPP;
3520 
3521 	err = __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT,
3522 				  &req_hdr, sizeof(req_hdr), false);
3523 	if (err < 0 || !enable)
3524 		return err;
3525 
3526 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED,
3527 				   &req, sizeof(req), false);
3528 }
3529 
3530 #ifdef CONFIG_PM
3531 int mt7615_mcu_set_hif_suspend(struct mt7615_dev *dev, bool suspend)
3532 {
3533 	struct {
3534 		struct {
3535 			u8 hif_type; /* 0x0: HIF_SDIO
3536 				      * 0x1: HIF_USB
3537 				      * 0x2: HIF_PCIE
3538 				      */
3539 			u8 pad[3];
3540 		} __packed hdr;
3541 		struct hif_suspend_tlv {
3542 			__le16 tag;
3543 			__le16 len;
3544 			u8 suspend;
3545 		} __packed hif_suspend;
3546 	} req = {
3547 		.hif_suspend = {
3548 			.tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
3549 			.len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
3550 			.suspend = suspend,
3551 		},
3552 	};
3553 
3554 	if (mt76_is_mmio(&dev->mt76))
3555 		req.hdr.hif_type = 2;
3556 	else if (mt76_is_usb(&dev->mt76))
3557 		req.hdr.hif_type = 1;
3558 
3559 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_HIF_CTRL,
3560 				   &req, sizeof(req), true);
3561 }
3562 EXPORT_SYMBOL_GPL(mt7615_mcu_set_hif_suspend);
3563 
3564 static int
3565 mt7615_mcu_set_wow_ctrl(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3566 			bool suspend, struct cfg80211_wowlan *wowlan)
3567 {
3568 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3569 	struct mt7615_dev *dev = phy->dev;
3570 	struct {
3571 		struct {
3572 			u8 bss_idx;
3573 			u8 pad[3];
3574 		} __packed hdr;
3575 		struct mt7615_wow_ctrl_tlv wow_ctrl_tlv;
3576 	} req = {
3577 		.hdr = {
3578 			.bss_idx = mvif->idx,
3579 		},
3580 		.wow_ctrl_tlv = {
3581 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
3582 			.len = cpu_to_le16(sizeof(struct mt7615_wow_ctrl_tlv)),
3583 			.cmd = suspend ? 1 : 2,
3584 		},
3585 	};
3586 
3587 	if (wowlan->magic_pkt)
3588 		req.wow_ctrl_tlv.trigger |= BIT(0);
3589 	if (wowlan->disconnect)
3590 		req.wow_ctrl_tlv.trigger |= BIT(2);
3591 	if (wowlan->nd_config) {
3592 		mt7615_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
3593 		req.wow_ctrl_tlv.trigger |= BIT(5);
3594 		mt7615_mcu_sched_scan_enable(phy, vif, suspend);
3595 	}
3596 
3597 	if (mt76_is_mmio(&dev->mt76))
3598 		req.wow_ctrl_tlv.wakeup_hif = 2;
3599 	else if (mt76_is_usb(&dev->mt76))
3600 		req.wow_ctrl_tlv.wakeup_hif = 1;
3601 
3602 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND,
3603 				   &req, sizeof(req), true);
3604 }
3605 
3606 static int
3607 mt7615_mcu_set_wow_pattern(struct mt7615_dev *dev,
3608 			   struct ieee80211_vif *vif,
3609 			   u8 index, bool enable,
3610 			   struct cfg80211_pkt_pattern *pattern)
3611 {
3612 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3613 	struct mt7615_wow_pattern_tlv *ptlv;
3614 	struct sk_buff *skb;
3615 	struct req_hdr {
3616 		u8 bss_idx;
3617 		u8 pad[3];
3618 	} __packed hdr = {
3619 		.bss_idx = mvif->idx,
3620 	};
3621 
3622 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3623 				 sizeof(hdr) + sizeof(*ptlv));
3624 	if (!skb)
3625 		return -ENOMEM;
3626 
3627 	skb_put_data(skb, &hdr, sizeof(hdr));
3628 	ptlv = (struct mt7615_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
3629 	ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
3630 	ptlv->len = cpu_to_le16(sizeof(*ptlv));
3631 	ptlv->data_len = pattern->pattern_len;
3632 	ptlv->enable = enable;
3633 	ptlv->index = index;
3634 
3635 	memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
3636 	memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8);
3637 
3638 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3639 				       MCU_UNI_CMD_SUSPEND, true);
3640 }
3641 
3642 static int
3643 mt7615_mcu_set_suspend_mode(struct mt7615_dev *dev,
3644 			    struct ieee80211_vif *vif,
3645 			    bool enable, u8 mdtim, bool wow_suspend)
3646 {
3647 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3648 	struct {
3649 		struct {
3650 			u8 bss_idx;
3651 			u8 pad[3];
3652 		} __packed hdr;
3653 		struct mt7615_suspend_tlv suspend_tlv;
3654 	} req = {
3655 		.hdr = {
3656 			.bss_idx = mvif->idx,
3657 		},
3658 		.suspend_tlv = {
3659 			.tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
3660 			.len = cpu_to_le16(sizeof(struct mt7615_suspend_tlv)),
3661 			.enable = enable,
3662 			.mdtim = mdtim,
3663 			.wow_suspend = wow_suspend,
3664 		},
3665 	};
3666 
3667 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND,
3668 				   &req, sizeof(req), true);
3669 }
3670 
3671 static int
3672 mt7615_mcu_set_gtk_rekey(struct mt7615_dev *dev,
3673 			 struct ieee80211_vif *vif,
3674 			 bool suspend)
3675 {
3676 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3677 	struct {
3678 		struct {
3679 			u8 bss_idx;
3680 			u8 pad[3];
3681 		} __packed hdr;
3682 		struct mt7615_gtk_rekey_tlv gtk_tlv;
3683 	} __packed req = {
3684 		.hdr = {
3685 			.bss_idx = mvif->idx,
3686 		},
3687 		.gtk_tlv = {
3688 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
3689 			.len = cpu_to_le16(sizeof(struct mt7615_gtk_rekey_tlv)),
3690 			.rekey_mode = !suspend,
3691 		},
3692 	};
3693 
3694 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD,
3695 				   &req, sizeof(req), true);
3696 }
3697 
3698 static int
3699 mt7615_mcu_set_arp_filter(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3700 			  bool suspend)
3701 {
3702 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3703 	struct {
3704 		struct {
3705 			u8 bss_idx;
3706 			u8 pad[3];
3707 		} __packed hdr;
3708 		struct mt7615_arpns_tlv arpns;
3709 	} req = {
3710 		.hdr = {
3711 			.bss_idx = mvif->idx,
3712 		},
3713 		.arpns = {
3714 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3715 			.len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3716 			.mode = suspend,
3717 		},
3718 	};
3719 
3720 	return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD,
3721 				   &req, sizeof(req), true);
3722 }
3723 
3724 void mt7615_mcu_set_suspend_iter(void *priv, u8 *mac,
3725 				 struct ieee80211_vif *vif)
3726 {
3727 	struct mt7615_phy *phy = priv;
3728 	bool suspend = test_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
3729 	struct ieee80211_hw *hw = phy->mt76->hw;
3730 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
3731 	int i;
3732 
3733 	mt7615_mcu_set_bss_pm(phy->dev, vif, suspend);
3734 
3735 	mt7615_mcu_set_gtk_rekey(phy->dev, vif, suspend);
3736 	mt7615_mcu_set_arp_filter(phy->dev, vif, suspend);
3737 
3738 	mt7615_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
3739 
3740 	for (i = 0; i < wowlan->n_patterns; i++)
3741 		mt7615_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
3742 					   &wowlan->patterns[i]);
3743 	mt7615_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
3744 }
3745 
3746 static void
3747 mt7615_mcu_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3748 		    struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
3749 		    void *data)
3750 {
3751 	struct mt7615_gtk_rekey_tlv *gtk_tlv = data;
3752 	u32 cipher;
3753 
3754 	if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
3755 	    key->cipher != WLAN_CIPHER_SUITE_CCMP &&
3756 	    key->cipher != WLAN_CIPHER_SUITE_TKIP)
3757 		return;
3758 
3759 	if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
3760 		gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
3761 		cipher = BIT(3);
3762 	} else {
3763 		gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
3764 		cipher = BIT(4);
3765 	}
3766 
3767 	/* we are assuming here to have a single pairwise key */
3768 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3769 		gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
3770 		gtk_tlv->group_cipher = cpu_to_le32(cipher);
3771 		gtk_tlv->keyid = key->keyidx;
3772 	}
3773 }
3774 
3775 int mt7615_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
3776 				struct ieee80211_vif *vif,
3777 				struct cfg80211_gtk_rekey_data *key)
3778 {
3779 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3780 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3781 	struct mt7615_gtk_rekey_tlv *gtk_tlv;
3782 	struct sk_buff *skb;
3783 	struct {
3784 		u8 bss_idx;
3785 		u8 pad[3];
3786 	} __packed hdr = {
3787 		.bss_idx = mvif->idx,
3788 	};
3789 
3790 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3791 				 sizeof(hdr) + sizeof(*gtk_tlv));
3792 	if (!skb)
3793 		return -ENOMEM;
3794 
3795 	skb_put_data(skb, &hdr, sizeof(hdr));
3796 	gtk_tlv = (struct mt7615_gtk_rekey_tlv *)skb_put(skb,
3797 							 sizeof(*gtk_tlv));
3798 	gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
3799 	gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
3800 	gtk_tlv->rekey_mode = 2;
3801 	gtk_tlv->option = 1;
3802 
3803 	rcu_read_lock();
3804 	ieee80211_iter_keys_rcu(hw, vif, mt7615_mcu_key_iter, gtk_tlv);
3805 	rcu_read_unlock();
3806 
3807 	memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
3808 	memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
3809 	memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
3810 
3811 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3812 				       MCU_UNI_CMD_OFFLOAD, true);
3813 }
3814 #endif /* CONFIG_PM */
3815 
3816 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3817 		       struct ieee80211_channel *chan, int duration)
3818 {
3819 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3820 	struct mt7615_dev *dev = phy->dev;
3821 	struct mt7615_roc_tlv req = {
3822 		.bss_idx = mvif->idx,
3823 		.active = !chan,
3824 		.max_interval = cpu_to_le32(duration),
3825 		.primary_chan = chan ? chan->hw_value : 0,
3826 		.band = chan ? chan->band : 0,
3827 		.req_type = 2,
3828 	};
3829 
3830 	phy->roc_grant = false;
3831 
3832 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
3833 				   sizeof(req), false);
3834 }
3835 
3836 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
3837 				 struct ieee80211_vif *vif,
3838 				 struct ieee80211_bss_conf *info)
3839 {
3840 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3841 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3842 	struct sk_buff *skb;
3843 	int i, len = min_t(int, info->arp_addr_cnt,
3844 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
3845 	struct {
3846 		struct {
3847 			u8 bss_idx;
3848 			u8 pad[3];
3849 		} __packed hdr;
3850 		struct mt7615_arpns_tlv arp;
3851 	} req_hdr = {
3852 		.hdr = {
3853 			.bss_idx = mvif->idx,
3854 		},
3855 		.arp = {
3856 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3857 			.len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3858 			.ips_num = len,
3859 			.mode = 2,  /* update */
3860 			.option = 1,
3861 		},
3862 	};
3863 
3864 	if (!mt7615_firmware_offload(dev))
3865 		return 0;
3866 
3867 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3868 				 sizeof(req_hdr) + len * sizeof(__be32));
3869 	if (!skb)
3870 		return -ENOMEM;
3871 
3872 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
3873 	for (i = 0; i < len; i++) {
3874 		u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
3875 
3876 		memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
3877 	}
3878 
3879 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
3880 				       MCU_UNI_CMD_OFFLOAD, true);
3881 }
3882 
3883 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
3884 			     struct ieee80211_vif *vif)
3885 {
3886 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3887 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
3888 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3889 	struct {
3890 		__le32 ct_win;
3891 		u8 bss_idx;
3892 		u8 rsv[3];
3893 	} __packed req = {
3894 		.ct_win = cpu_to_le32(ct_window),
3895 		.bss_idx = mvif->idx,
3896 	};
3897 
3898 	if (!mt7615_firmware_offload(dev))
3899 		return -ENOTSUPP;
3900 
3901 	return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS,
3902 				   &req, sizeof(req), false);
3903 }
3904 
3905 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
3906 {
3907 	struct {
3908 		__le32 addr;
3909 		__le32 val;
3910 	} __packed req = {
3911 		.addr = cpu_to_le32(offset),
3912 	};
3913 
3914 	return __mt76_mcu_send_msg(dev, MCU_CMD_REG_READ,
3915 				   &req, sizeof(req), true);
3916 }
3917 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
3918 
3919 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
3920 {
3921 	struct {
3922 		__le32 addr;
3923 		__le32 val;
3924 	} __packed req = {
3925 		.addr = cpu_to_le32(offset),
3926 		.val = cpu_to_le32(val),
3927 	};
3928 
3929 	__mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE,
3930 			    &req, sizeof(req), false);
3931 }
3932 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);
3933