1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7921.h"
7 #include "mt7921_trace.h"
8 #include "mcu.h"
9 #include "mac.h"
10 
11 struct mt7921_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7921_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7921_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7921_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MT_STA_BFER			BIT(0)
68 #define MT_STA_BFEE			BIT(1)
69 
70 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
71 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
72 #define FW_FEATURE_ENCRY_MODE		BIT(4)
73 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
74 
75 #define DL_MODE_ENCRYPT			BIT(0)
76 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
77 #define DL_MODE_RESET_SEC_IV		BIT(3)
78 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
79 #define DL_CONFIG_ENCRY_MODE_SEL	BIT(6)
80 #define DL_MODE_NEED_RSP		BIT(31)
81 
82 #define FW_START_OVERRIDE		BIT(0)
83 #define FW_START_WORKING_PDA_CR4	BIT(2)
84 
85 #define PATCH_SEC_NOT_SUPPORT		GENMASK(31, 0)
86 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
87 #define PATCH_SEC_TYPE_INFO		0x2
88 
89 #define PATCH_SEC_ENC_TYPE_MASK		GENMASK(31, 24)
90 #define PATCH_SEC_ENC_TYPE_PLAIN		0x00
91 #define PATCH_SEC_ENC_TYPE_AES			0x01
92 #define PATCH_SEC_ENC_TYPE_SCRAMBLE		0x02
93 #define PATCH_SEC_ENC_SCRAMBLE_INFO_MASK	GENMASK(15, 0)
94 #define PATCH_SEC_ENC_AES_KEY_MASK		GENMASK(7, 0)
95 
96 static enum mcu_cipher_type
97 mt7921_mcu_get_cipher(int cipher)
98 {
99 	switch (cipher) {
100 	case WLAN_CIPHER_SUITE_WEP40:
101 		return MCU_CIPHER_WEP40;
102 	case WLAN_CIPHER_SUITE_WEP104:
103 		return MCU_CIPHER_WEP104;
104 	case WLAN_CIPHER_SUITE_TKIP:
105 		return MCU_CIPHER_TKIP;
106 	case WLAN_CIPHER_SUITE_AES_CMAC:
107 		return MCU_CIPHER_BIP_CMAC_128;
108 	case WLAN_CIPHER_SUITE_CCMP:
109 		return MCU_CIPHER_AES_CCMP;
110 	case WLAN_CIPHER_SUITE_CCMP_256:
111 		return MCU_CIPHER_CCMP_256;
112 	case WLAN_CIPHER_SUITE_GCMP:
113 		return MCU_CIPHER_GCMP;
114 	case WLAN_CIPHER_SUITE_GCMP_256:
115 		return MCU_CIPHER_GCMP_256;
116 	case WLAN_CIPHER_SUITE_SMS4:
117 		return MCU_CIPHER_WAPI;
118 	default:
119 		return MCU_CIPHER_NONE;
120 	}
121 }
122 
123 static u8 mt7921_mcu_chan_bw(struct cfg80211_chan_def *chandef)
124 {
125 	static const u8 width_to_bw[] = {
126 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
127 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
128 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
129 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
130 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
131 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
132 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
133 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
134 	};
135 
136 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
137 		return 0;
138 
139 	return width_to_bw[chandef->width];
140 }
141 
142 static int
143 mt7921_mcu_parse_eeprom(struct mt76_dev *dev, struct sk_buff *skb)
144 {
145 	struct mt7921_mcu_eeprom_info *res;
146 	u8 *buf;
147 
148 	if (!skb)
149 		return -EINVAL;
150 
151 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
152 
153 	res = (struct mt7921_mcu_eeprom_info *)skb->data;
154 	buf = dev->eeprom.data + le32_to_cpu(res->addr);
155 	memcpy(buf, res->data, 16);
156 
157 	return 0;
158 }
159 
160 int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
161 			      struct sk_buff *skb, int seq)
162 {
163 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
164 	struct mt7921_mcu_rxd *rxd;
165 	int ret = 0;
166 
167 	if (!skb) {
168 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
169 			cmd, seq);
170 		mt7921_reset(mdev);
171 
172 		return -ETIMEDOUT;
173 	}
174 
175 	rxd = (struct mt7921_mcu_rxd *)skb->data;
176 	if (seq != rxd->seq)
177 		return -EAGAIN;
178 
179 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
180 		skb_pull(skb, sizeof(*rxd) - 4);
181 		ret = *skb->data;
182 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
183 		skb_pull(skb, sizeof(*rxd) + 4);
184 		ret = le32_to_cpu(*(__le32 *)skb->data);
185 	} else if (cmd == MCU_EXT_CMD(EFUSE_ACCESS)) {
186 		ret = mt7921_mcu_parse_eeprom(mdev, skb);
187 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
188 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
189 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
190 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
191 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
192 		   cmd == MCU_UNI_CMD(SUSPEND)) {
193 		struct mt7921_mcu_uni_event *event;
194 
195 		skb_pull(skb, sizeof(*rxd));
196 		event = (struct mt7921_mcu_uni_event *)skb->data;
197 		ret = le32_to_cpu(event->status);
198 		/* skip invalid event */
199 		if (mcu_cmd != event->cid)
200 			ret = -EAGAIN;
201 	} else if (cmd == MCU_CE_QUERY(REG_READ)) {
202 		struct mt7921_mcu_reg_event *event;
203 
204 		skb_pull(skb, sizeof(*rxd));
205 		event = (struct mt7921_mcu_reg_event *)skb->data;
206 		ret = (int)le32_to_cpu(event->val);
207 	} else {
208 		skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
209 	}
210 
211 	return ret;
212 }
213 EXPORT_SYMBOL_GPL(mt7921_mcu_parse_response);
214 
215 int mt7921_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
216 			    int cmd, int *wait_seq)
217 {
218 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
219 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
220 	struct mt7921_uni_txd *uni_txd;
221 	struct mt7921_mcu_txd *mcu_txd;
222 	__le32 *txd;
223 	u32 val;
224 	u8 seq;
225 
226 	if (cmd == MCU_UNI_CMD(HIF_CTRL) ||
227 	    cmd == MCU_UNI_CMD(SUSPEND) ||
228 	    cmd == MCU_UNI_CMD(OFFLOAD))
229 		mdev->mcu.timeout = HZ;
230 	else
231 		mdev->mcu.timeout = 3 * HZ;
232 
233 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
234 	if (!seq)
235 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
236 
237 	if (cmd == MCU_CMD(FW_SCATTER))
238 		goto exit;
239 
240 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
241 	txd = (__le32 *)skb_push(skb, txd_len);
242 
243 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
244 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
245 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
246 	txd[0] = cpu_to_le32(val);
247 
248 	val = MT_TXD1_LONG_FORMAT |
249 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
250 	txd[1] = cpu_to_le32(val);
251 
252 	if (cmd & __MCU_CMD_FIELD_UNI) {
253 		uni_txd = (struct mt7921_uni_txd *)txd;
254 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
255 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
256 		uni_txd->cid = cpu_to_le16(mcu_cmd);
257 		uni_txd->s2d_index = MCU_S2D_H2N;
258 		uni_txd->pkt_type = MCU_PKT_ID;
259 		uni_txd->seq = seq;
260 
261 		goto exit;
262 	}
263 
264 	mcu_txd = (struct mt7921_mcu_txd *)txd;
265 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
266 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
267 					       MT_TX_MCU_PORT_RX_Q0));
268 	mcu_txd->pkt_type = MCU_PKT_ID;
269 	mcu_txd->seq = seq;
270 	mcu_txd->cid = mcu_cmd;
271 	mcu_txd->s2d_index = MCU_S2D_H2N;
272 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
273 
274 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
275 		if (cmd & __MCU_CMD_FIELD_QUERY)
276 			mcu_txd->set_query = MCU_Q_QUERY;
277 		else
278 			mcu_txd->set_query = MCU_Q_SET;
279 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
280 	} else {
281 		mcu_txd->set_query = MCU_Q_NA;
282 	}
283 
284 exit:
285 	if (wait_seq)
286 		*wait_seq = seq;
287 
288 	return 0;
289 }
290 EXPORT_SYMBOL_GPL(mt7921_mcu_fill_message);
291 
292 static void
293 mt7921_mcu_scan_event(struct mt7921_dev *dev, struct sk_buff *skb)
294 {
295 	struct mt76_phy *mphy = &dev->mt76.phy;
296 	struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
297 
298 	spin_lock_bh(&dev->mt76.lock);
299 	__skb_queue_tail(&phy->scan_event_list, skb);
300 	spin_unlock_bh(&dev->mt76.lock);
301 
302 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
303 				     MT7921_HW_SCAN_TIMEOUT);
304 }
305 
306 static void
307 mt7921_mcu_connection_loss_iter(void *priv, u8 *mac,
308 				struct ieee80211_vif *vif)
309 {
310 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
311 	struct mt76_connac_beacon_loss_event *event = priv;
312 
313 	if (mvif->idx != event->bss_idx)
314 		return;
315 
316 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
317 		return;
318 
319 	ieee80211_connection_loss(vif);
320 }
321 
322 static void
323 mt7921_mcu_connection_loss_event(struct mt7921_dev *dev, struct sk_buff *skb)
324 {
325 	struct mt76_connac_beacon_loss_event *event;
326 	struct mt76_phy *mphy = &dev->mt76.phy;
327 
328 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
329 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
330 
331 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
332 					IEEE80211_IFACE_ITER_RESUME_ALL,
333 					mt7921_mcu_connection_loss_iter, event);
334 }
335 
336 static void
337 mt7921_mcu_bss_event(struct mt7921_dev *dev, struct sk_buff *skb)
338 {
339 	struct mt76_phy *mphy = &dev->mt76.phy;
340 	struct mt76_connac_mcu_bss_event *event;
341 
342 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
343 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
344 	if (event->is_absent)
345 		ieee80211_stop_queues(mphy->hw);
346 	else
347 		ieee80211_wake_queues(mphy->hw);
348 }
349 
350 static void
351 mt7921_mcu_debug_msg_event(struct mt7921_dev *dev, struct sk_buff *skb)
352 {
353 	struct mt7921_debug_msg {
354 		__le16 id;
355 		u8 type;
356 		u8 flag;
357 		__le32 value;
358 		__le16 len;
359 		u8 content[512];
360 	} __packed * msg;
361 
362 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
363 	msg = (struct mt7921_debug_msg *)skb->data;
364 
365 	if (msg->type == 3) { /* fw log */
366 		u16 len = min_t(u16, le16_to_cpu(msg->len), 512);
367 		int i;
368 
369 		for (i = 0 ; i < len; i++) {
370 			if (!msg->content[i])
371 				msg->content[i] = ' ';
372 		}
373 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", len, msg->content);
374 	}
375 }
376 
377 static void
378 mt7921_mcu_low_power_event(struct mt7921_dev *dev, struct sk_buff *skb)
379 {
380 	struct mt7921_mcu_lp_event {
381 		u8 state;
382 		u8 reserved[3];
383 	} __packed * event;
384 
385 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
386 	event = (struct mt7921_mcu_lp_event *)skb->data;
387 
388 	trace_lp_event(dev, event->state);
389 }
390 
391 static void
392 mt7921_mcu_tx_done_event(struct mt7921_dev *dev, struct sk_buff *skb)
393 {
394 	struct mt7921_mcu_tx_done_event *event;
395 
396 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
397 	event = (struct mt7921_mcu_tx_done_event *)skb->data;
398 
399 	mt7921_mac_add_txs(dev, event->txs);
400 }
401 
402 static void
403 mt7921_mcu_rx_unsolicited_event(struct mt7921_dev *dev, struct sk_buff *skb)
404 {
405 	struct mt7921_mcu_rxd *rxd = (struct mt7921_mcu_rxd *)skb->data;
406 
407 	switch (rxd->eid) {
408 	case MCU_EVENT_BSS_BEACON_LOSS:
409 		mt7921_mcu_connection_loss_event(dev, skb);
410 		break;
411 	case MCU_EVENT_SCHED_SCAN_DONE:
412 	case MCU_EVENT_SCAN_DONE:
413 		mt7921_mcu_scan_event(dev, skb);
414 		return;
415 	case MCU_EVENT_BSS_ABSENCE:
416 		mt7921_mcu_bss_event(dev, skb);
417 		break;
418 	case MCU_EVENT_DBG_MSG:
419 		mt7921_mcu_debug_msg_event(dev, skb);
420 		break;
421 	case MCU_EVENT_COREDUMP:
422 		dev->fw_assert = true;
423 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
424 					       &dev->coredump);
425 		return;
426 	case MCU_EVENT_LP_INFO:
427 		mt7921_mcu_low_power_event(dev, skb);
428 		break;
429 	case MCU_EVENT_TX_DONE:
430 		mt7921_mcu_tx_done_event(dev, skb);
431 		break;
432 	default:
433 		break;
434 	}
435 	dev_kfree_skb(skb);
436 }
437 
438 void mt7921_mcu_rx_event(struct mt7921_dev *dev, struct sk_buff *skb)
439 {
440 	struct mt7921_mcu_rxd *rxd;
441 
442 	if (skb_linearize(skb))
443 		return;
444 
445 	rxd = (struct mt7921_mcu_rxd *)skb->data;
446 
447 	if (rxd->eid == 0x6) {
448 		mt76_mcu_rx_event(&dev->mt76, skb);
449 		return;
450 	}
451 
452 	if (rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
453 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
454 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
455 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
456 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
457 	    rxd->eid == MCU_EVENT_TX_DONE ||
458 	    rxd->eid == MCU_EVENT_DBG_MSG ||
459 	    rxd->eid == MCU_EVENT_COREDUMP ||
460 	    rxd->eid == MCU_EVENT_LP_INFO ||
461 	    !rxd->seq)
462 		mt7921_mcu_rx_unsolicited_event(dev, skb);
463 	else
464 		mt76_mcu_rx_event(&dev->mt76, skb);
465 }
466 
467 /** starec & wtbl **/
468 static int
469 mt7921_mcu_sta_key_tlv(struct mt7921_sta *msta, struct sk_buff *skb,
470 		       struct ieee80211_key_conf *key, enum set_key_cmd cmd)
471 {
472 	struct mt7921_sta_key_conf *bip = &msta->bip;
473 	struct sta_rec_sec *sec;
474 	struct tlv *tlv;
475 	u32 len = sizeof(*sec);
476 
477 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
478 
479 	sec = (struct sta_rec_sec *)tlv;
480 	sec->add = cmd;
481 
482 	if (cmd == SET_KEY) {
483 		struct sec_key *sec_key;
484 		u8 cipher;
485 
486 		cipher = mt7921_mcu_get_cipher(key->cipher);
487 		if (cipher == MCU_CIPHER_NONE)
488 			return -EOPNOTSUPP;
489 
490 		sec_key = &sec->key[0];
491 		sec_key->cipher_len = sizeof(*sec_key);
492 
493 		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
494 			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
495 			sec_key->key_id = bip->keyidx;
496 			sec_key->key_len = 16;
497 			memcpy(sec_key->key, bip->key, 16);
498 
499 			sec_key = &sec->key[1];
500 			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
501 			sec_key->cipher_len = sizeof(*sec_key);
502 			sec_key->key_len = 16;
503 			memcpy(sec_key->key, key->key, 16);
504 
505 			sec->n_cipher = 2;
506 		} else {
507 			sec_key->cipher_id = cipher;
508 			sec_key->key_id = key->keyidx;
509 			sec_key->key_len = key->keylen;
510 			memcpy(sec_key->key, key->key, key->keylen);
511 
512 			if (cipher == MCU_CIPHER_TKIP) {
513 				/* Rx/Tx MIC keys are swapped */
514 				memcpy(sec_key->key + 16, key->key + 24, 8);
515 				memcpy(sec_key->key + 24, key->key + 16, 8);
516 			}
517 
518 			/* store key_conf for BIP batch update */
519 			if (cipher == MCU_CIPHER_AES_CCMP) {
520 				memcpy(bip->key, key->key, key->keylen);
521 				bip->keyidx = key->keyidx;
522 			}
523 
524 			len -= sizeof(*sec_key);
525 			sec->n_cipher = 1;
526 		}
527 	} else {
528 		len -= sizeof(sec->key);
529 		sec->n_cipher = 0;
530 	}
531 	sec->len = cpu_to_le16(len);
532 
533 	return 0;
534 }
535 
536 int mt7921_mcu_add_key(struct mt7921_dev *dev, struct ieee80211_vif *vif,
537 		       struct mt7921_sta *msta, struct ieee80211_key_conf *key,
538 		       enum set_key_cmd cmd)
539 {
540 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
541 	struct sk_buff *skb;
542 	int ret;
543 
544 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
545 					    &msta->wcid);
546 	if (IS_ERR(skb))
547 		return PTR_ERR(skb);
548 
549 	ret = mt7921_mcu_sta_key_tlv(msta, skb, key, cmd);
550 	if (ret)
551 		return ret;
552 
553 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
554 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
555 }
556 
557 int mt7921_mcu_uni_tx_ba(struct mt7921_dev *dev,
558 			 struct ieee80211_ampdu_params *params,
559 			 bool enable)
560 {
561 	struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
562 
563 	if (enable && !params->amsdu)
564 		msta->wcid.amsdu = false;
565 
566 	return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
567 				      enable, true);
568 }
569 
570 int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
571 			 struct ieee80211_ampdu_params *params,
572 			 bool enable)
573 {
574 	struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
575 
576 	return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
577 				      enable, false);
578 }
579 
580 int mt7921_mcu_restart(struct mt76_dev *dev)
581 {
582 	struct {
583 		u8 power_mode;
584 		u8 rsv[3];
585 	} req = {
586 		.power_mode = 1,
587 	};
588 
589 	return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
590 				 sizeof(req), false);
591 }
592 EXPORT_SYMBOL_GPL(mt7921_mcu_restart);
593 
594 static u32 mt7921_get_data_mode(struct mt7921_dev *dev, u32 info)
595 {
596 	u32 mode = DL_MODE_NEED_RSP;
597 
598 	if (info == PATCH_SEC_NOT_SUPPORT)
599 		return mode;
600 
601 	switch (FIELD_GET(PATCH_SEC_ENC_TYPE_MASK, info)) {
602 	case PATCH_SEC_ENC_TYPE_PLAIN:
603 		break;
604 	case PATCH_SEC_ENC_TYPE_AES:
605 		mode |= DL_MODE_ENCRYPT;
606 		mode |= FIELD_PREP(DL_MODE_KEY_IDX,
607 				(info & PATCH_SEC_ENC_AES_KEY_MASK)) & DL_MODE_KEY_IDX;
608 		mode |= DL_MODE_RESET_SEC_IV;
609 		break;
610 	case PATCH_SEC_ENC_TYPE_SCRAMBLE:
611 		mode |= DL_MODE_ENCRYPT;
612 		mode |= DL_CONFIG_ENCRY_MODE_SEL;
613 		mode |= DL_MODE_RESET_SEC_IV;
614 		break;
615 	default:
616 		dev_err(dev->mt76.dev, "Encryption type not support!\n");
617 	}
618 
619 	return mode;
620 }
621 
622 static char *mt7921_patch_name(struct mt7921_dev *dev)
623 {
624 	char *ret;
625 
626 	if (is_mt7922(&dev->mt76))
627 		ret = MT7922_ROM_PATCH;
628 	else
629 		ret = MT7921_ROM_PATCH;
630 
631 	return ret;
632 }
633 
634 static int mt7921_load_patch(struct mt7921_dev *dev)
635 {
636 	const struct mt7921_patch_hdr *hdr;
637 	const struct firmware *fw = NULL;
638 	int i, ret, sem, max_len;
639 
640 	max_len = mt76_is_sdio(&dev->mt76) ? 2048 : 4096;
641 
642 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
643 	switch (sem) {
644 	case PATCH_IS_DL:
645 		return 0;
646 	case PATCH_NOT_DL_SEM_SUCCESS:
647 		break;
648 	default:
649 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
650 		return -EAGAIN;
651 	}
652 
653 	ret = request_firmware(&fw, mt7921_patch_name(dev), dev->mt76.dev);
654 	if (ret)
655 		goto out;
656 
657 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
658 		dev_err(dev->mt76.dev, "Invalid firmware\n");
659 		ret = -EINVAL;
660 		goto out;
661 	}
662 
663 	hdr = (const struct mt7921_patch_hdr *)(fw->data);
664 
665 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
666 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
667 
668 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
669 		struct mt7921_patch_sec *sec;
670 		const u8 *dl;
671 		u32 len, addr, mode;
672 		u32 sec_info = 0;
673 
674 		sec = (struct mt7921_patch_sec *)(fw->data + sizeof(*hdr) +
675 						  i * sizeof(*sec));
676 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
677 		    PATCH_SEC_TYPE_INFO) {
678 			ret = -EINVAL;
679 			goto out;
680 		}
681 
682 		addr = be32_to_cpu(sec->info.addr);
683 		len = be32_to_cpu(sec->info.len);
684 		dl = fw->data + be32_to_cpu(sec->offs);
685 		sec_info = be32_to_cpu(sec->info.sec_key_idx);
686 		mode = mt7921_get_data_mode(dev, sec_info);
687 
688 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
689 						    mode);
690 		if (ret) {
691 			dev_err(dev->mt76.dev, "Download request failed\n");
692 			goto out;
693 		}
694 
695 		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
696 					       dl, len, max_len);
697 		if (ret) {
698 			dev_err(dev->mt76.dev, "Failed to send patch\n");
699 			goto out;
700 		}
701 	}
702 
703 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
704 	if (ret)
705 		dev_err(dev->mt76.dev, "Failed to start patch\n");
706 
707 	if (mt76_is_sdio(&dev->mt76)) {
708 		/* activate again */
709 		ret = __mt7921_mcu_fw_pmctrl(dev);
710 		if (ret)
711 			return ret;
712 
713 		ret = __mt7921_mcu_drv_pmctrl(dev);
714 		if (ret)
715 			return ret;
716 	}
717 
718 out:
719 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
720 	switch (sem) {
721 	case PATCH_REL_SEM_SUCCESS:
722 		break;
723 	default:
724 		ret = -EAGAIN;
725 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
726 		break;
727 	}
728 	release_firmware(fw);
729 
730 	return ret;
731 }
732 
733 static u32 mt7921_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
734 {
735 	u32 ret = 0;
736 
737 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
738 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
739 	ret |= (feature_set & FW_FEATURE_ENCRY_MODE) ?
740 	       DL_CONFIG_ENCRY_MODE_SEL : 0;
741 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
742 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
743 	ret |= DL_MODE_NEED_RSP;
744 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
745 
746 	return ret;
747 }
748 
749 static int
750 mt7921_mcu_send_ram_firmware(struct mt7921_dev *dev,
751 			     const struct mt7921_fw_trailer *hdr,
752 			     const u8 *data, bool is_wa)
753 {
754 	int i, offset = 0, max_len;
755 	u32 override = 0, option = 0;
756 
757 	max_len = mt76_is_sdio(&dev->mt76) ? 2048 : 4096;
758 
759 	for (i = 0; i < hdr->n_region; i++) {
760 		const struct mt7921_fw_region *region;
761 		int err;
762 		u32 len, addr, mode;
763 
764 		region = (const struct mt7921_fw_region *)((const u8 *)hdr -
765 			 (hdr->n_region - i) * sizeof(*region));
766 		mode = mt7921_mcu_gen_dl_mode(region->feature_set, is_wa);
767 		len = le32_to_cpu(region->len);
768 		addr = le32_to_cpu(region->addr);
769 
770 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
771 			override = addr;
772 
773 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
774 						    mode);
775 		if (err) {
776 			dev_err(dev->mt76.dev, "Download request failed\n");
777 			return err;
778 		}
779 
780 		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
781 					       data + offset, len, max_len);
782 		if (err) {
783 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
784 			return err;
785 		}
786 
787 		offset += len;
788 	}
789 
790 	if (override)
791 		option |= FW_START_OVERRIDE;
792 
793 	if (is_wa)
794 		option |= FW_START_WORKING_PDA_CR4;
795 
796 	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
797 }
798 
799 static char *mt7921_ram_name(struct mt7921_dev *dev)
800 {
801 	char *ret;
802 
803 	if (is_mt7922(&dev->mt76))
804 		ret = MT7922_FIRMWARE_WM;
805 	else
806 		ret = MT7921_FIRMWARE_WM;
807 
808 	return ret;
809 }
810 
811 static int mt7921_load_ram(struct mt7921_dev *dev)
812 {
813 	const struct mt7921_fw_trailer *hdr;
814 	const struct firmware *fw;
815 	int ret;
816 
817 	ret = request_firmware(&fw, mt7921_ram_name(dev), dev->mt76.dev);
818 	if (ret)
819 		return ret;
820 
821 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
822 		dev_err(dev->mt76.dev, "Invalid firmware\n");
823 		ret = -EINVAL;
824 		goto out;
825 	}
826 
827 	hdr = (const struct mt7921_fw_trailer *)(fw->data + fw->size -
828 					sizeof(*hdr));
829 
830 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
831 		 hdr->fw_ver, hdr->build_date);
832 
833 	ret = mt7921_mcu_send_ram_firmware(dev, hdr, fw->data, false);
834 	if (ret) {
835 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
836 		goto out;
837 	}
838 
839 	snprintf(dev->mt76.hw->wiphy->fw_version,
840 		 sizeof(dev->mt76.hw->wiphy->fw_version),
841 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
842 
843 out:
844 	release_firmware(fw);
845 
846 	return ret;
847 }
848 
849 static int mt7921_load_firmware(struct mt7921_dev *dev)
850 {
851 	int ret;
852 
853 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
854 	if (ret && mt76_is_mmio(&dev->mt76)) {
855 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
856 		goto fw_loaded;
857 	}
858 
859 	ret = mt7921_load_patch(dev);
860 	if (ret)
861 		return ret;
862 
863 	ret = mt7921_load_ram(dev);
864 	if (ret)
865 		return ret;
866 
867 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
868 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
869 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
870 
871 		return -EIO;
872 	}
873 
874 fw_loaded:
875 
876 #ifdef CONFIG_PM
877 	dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
878 #endif /* CONFIG_PM */
879 
880 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
881 
882 	return 0;
883 }
884 
885 int mt7921_mcu_fw_log_2_host(struct mt7921_dev *dev, u8 ctrl)
886 {
887 	struct {
888 		u8 ctrl_val;
889 		u8 pad[3];
890 	} data = {
891 		.ctrl_val = ctrl
892 	};
893 
894 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(FWLOG_2_HOST),
895 				 &data, sizeof(data), false);
896 }
897 
898 int mt7921_run_firmware(struct mt7921_dev *dev)
899 {
900 	int err;
901 
902 	err = mt7921_load_firmware(dev);
903 	if (err)
904 		return err;
905 
906 	err = mt76_connac_mcu_get_nic_capability(&dev->mphy);
907 	if (err)
908 		return err;
909 
910 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
911 	return mt7921_mcu_fw_log_2_host(dev, 1);
912 }
913 EXPORT_SYMBOL_GPL(mt7921_run_firmware);
914 
915 void mt7921_mcu_exit(struct mt7921_dev *dev)
916 {
917 	skb_queue_purge(&dev->mt76.mcu.res_q);
918 }
919 EXPORT_SYMBOL_GPL(mt7921_mcu_exit);
920 
921 int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif)
922 {
923 #define WMM_AIFS_SET		BIT(0)
924 #define WMM_CW_MIN_SET		BIT(1)
925 #define WMM_CW_MAX_SET		BIT(2)
926 #define WMM_TXOP_SET		BIT(3)
927 #define WMM_PARAM_SET		GENMASK(3, 0)
928 #define TX_CMD_MODE		1
929 	struct edca {
930 		u8 queue;
931 		u8 set;
932 		u8 aifs;
933 		u8 cw_min;
934 		__le16 cw_max;
935 		__le16 txop;
936 	};
937 	struct mt7921_mcu_tx {
938 		u8 total;
939 		u8 action;
940 		u8 valid;
941 		u8 mode;
942 
943 		struct edca edca[IEEE80211_NUM_ACS];
944 	} __packed req = {
945 		.valid = true,
946 		.mode = TX_CMD_MODE,
947 		.total = IEEE80211_NUM_ACS,
948 	};
949 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
950 	struct mu_edca {
951 		u8 cw_min;
952 		u8 cw_max;
953 		u8 aifsn;
954 		u8 acm;
955 		u8 timer;
956 		u8 padding[3];
957 	};
958 	struct mt7921_mcu_mu_tx {
959 		u8 ver;
960 		u8 pad0;
961 		__le16 len;
962 		u8 bss_idx;
963 		u8 qos;
964 		u8 wmm_idx;
965 		u8 pad1;
966 		struct mu_edca edca[IEEE80211_NUM_ACS];
967 		u8 pad3[32];
968 	} __packed req_mu = {
969 		.bss_idx = mvif->mt76.idx,
970 		.qos = vif->bss_conf.qos,
971 		.wmm_idx = mvif->mt76.wmm_idx,
972 	};
973 	int ac, ret;
974 
975 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
976 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
977 		struct edca *e = &req.edca[ac];
978 
979 		e->set = WMM_PARAM_SET;
980 		e->queue = ac + mvif->mt76.wmm_idx * MT7921_MAX_WMM_SETS;
981 		e->aifs = q->aifs;
982 		e->txop = cpu_to_le16(q->txop);
983 
984 		if (q->cw_min)
985 			e->cw_min = fls(q->cw_min);
986 		else
987 			e->cw_min = 5;
988 
989 		if (q->cw_max)
990 			e->cw_max = cpu_to_le16(fls(q->cw_max));
991 		else
992 			e->cw_max = cpu_to_le16(10);
993 	}
994 
995 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
996 				&req, sizeof(req), true);
997 	if (ret)
998 		return ret;
999 
1000 	if (!vif->bss_conf.he_support)
1001 		return 0;
1002 
1003 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1004 		struct ieee80211_he_mu_edca_param_ac_rec *q;
1005 		struct mu_edca *e;
1006 		int to_aci[] = {1, 0, 2, 3};
1007 
1008 		if (!mvif->queue_params[ac].mu_edca)
1009 			break;
1010 
1011 		q = &mvif->queue_params[ac].mu_edca_param_rec;
1012 		e = &(req_mu.edca[to_aci[ac]]);
1013 
1014 		e->cw_min = q->ecw_min_max & 0xf;
1015 		e->cw_max = (q->ecw_min_max & 0xf0) >> 4;
1016 		e->aifsn = q->aifsn;
1017 		e->timer = q->mu_edca_timer;
1018 	}
1019 
1020 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_MU_EDCA_PARMS),
1021 				 &req_mu, sizeof(req_mu), false);
1022 }
1023 
1024 int mt7921_mcu_set_chan_info(struct mt7921_phy *phy, int cmd)
1025 {
1026 	struct mt7921_dev *dev = phy->dev;
1027 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1028 	int freq1 = chandef->center_freq1;
1029 	struct {
1030 		u8 control_ch;
1031 		u8 center_ch;
1032 		u8 bw;
1033 		u8 tx_streams_num;
1034 		u8 rx_streams;	/* mask or num */
1035 		u8 switch_reason;
1036 		u8 band_idx;
1037 		u8 center_ch2;	/* for 80+80 only */
1038 		__le16 cac_case;
1039 		u8 channel_band;
1040 		u8 rsv0;
1041 		__le32 outband_freq;
1042 		u8 txpower_drop;
1043 		u8 ap_bw;
1044 		u8 ap_center_ch;
1045 		u8 rsv1[57];
1046 	} __packed req = {
1047 		.control_ch = chandef->chan->hw_value,
1048 		.center_ch = ieee80211_frequency_to_channel(freq1),
1049 		.bw = mt7921_mcu_chan_bw(chandef),
1050 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
1051 		.rx_streams = phy->mt76->antenna_mask,
1052 		.band_idx = phy != &dev->phy,
1053 	};
1054 
1055 	if (chandef->chan->band == NL80211_BAND_6GHZ)
1056 		req.channel_band = 2;
1057 	else
1058 		req.channel_band = chandef->chan->band;
1059 
1060 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
1061 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
1062 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
1063 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
1064 		req.switch_reason = CH_SWITCH_DFS;
1065 	else
1066 		req.switch_reason = CH_SWITCH_NORMAL;
1067 
1068 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
1069 		req.rx_streams = hweight8(req.rx_streams);
1070 
1071 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
1072 		int freq2 = chandef->center_freq2;
1073 
1074 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
1075 	}
1076 
1077 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
1078 }
1079 
1080 int mt7921_mcu_set_eeprom(struct mt7921_dev *dev)
1081 {
1082 	struct req_hdr {
1083 		u8 buffer_mode;
1084 		u8 format;
1085 		__le16 len;
1086 	} __packed req = {
1087 		.buffer_mode = EE_MODE_EFUSE,
1088 		.format = EE_FORMAT_WHOLE,
1089 	};
1090 
1091 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
1092 				 &req, sizeof(req), true);
1093 }
1094 EXPORT_SYMBOL_GPL(mt7921_mcu_set_eeprom);
1095 
1096 int mt7921_mcu_get_eeprom(struct mt7921_dev *dev, u32 offset)
1097 {
1098 	struct mt7921_mcu_eeprom_info req = {
1099 		.addr = cpu_to_le32(round_down(offset, 16)),
1100 	};
1101 	struct mt7921_mcu_eeprom_info *res;
1102 	struct sk_buff *skb;
1103 	int ret;
1104 	u8 *buf;
1105 
1106 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
1107 					MCU_EXT_QUERY(EFUSE_ACCESS),
1108 					&req, sizeof(req), true, &skb);
1109 	if (ret)
1110 		return ret;
1111 
1112 	res = (struct mt7921_mcu_eeprom_info *)skb->data;
1113 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
1114 	memcpy(buf, res->data, 16);
1115 	dev_kfree_skb(skb);
1116 
1117 	return 0;
1118 }
1119 
1120 int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif)
1121 {
1122 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1123 	struct {
1124 		struct {
1125 			u8 bss_idx;
1126 			u8 pad[3];
1127 		} __packed hdr;
1128 		struct ps_tlv {
1129 			__le16 tag;
1130 			__le16 len;
1131 			u8 ps_state; /* 0: device awake
1132 				      * 1: static power save
1133 				      * 2: dynamic power saving
1134 				      * 3: enter TWT power saving
1135 				      * 4: leave TWT power saving
1136 				      */
1137 			u8 pad[3];
1138 		} __packed ps;
1139 	} __packed ps_req = {
1140 		.hdr = {
1141 			.bss_idx = mvif->mt76.idx,
1142 		},
1143 		.ps = {
1144 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1145 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1146 			.ps_state = vif->bss_conf.ps ? 2 : 0,
1147 		},
1148 	};
1149 
1150 	if (vif->type != NL80211_IFTYPE_STATION)
1151 		return -EOPNOTSUPP;
1152 
1153 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1154 				 &ps_req, sizeof(ps_req), true);
1155 }
1156 
1157 static int
1158 mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
1159 			 bool enable)
1160 {
1161 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1162 	struct {
1163 		struct {
1164 			u8 bss_idx;
1165 			u8 pad[3];
1166 		} __packed hdr;
1167 		struct bcnft_tlv {
1168 			__le16 tag;
1169 			__le16 len;
1170 			__le16 bcn_interval;
1171 			u8 dtim_period;
1172 			u8 pad;
1173 		} __packed bcnft;
1174 	} __packed bcnft_req = {
1175 		.hdr = {
1176 			.bss_idx = mvif->mt76.idx,
1177 		},
1178 		.bcnft = {
1179 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1180 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1181 			.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1182 			.dtim_period = vif->bss_conf.dtim_period,
1183 		},
1184 	};
1185 
1186 	if (vif->type != NL80211_IFTYPE_STATION)
1187 		return 0;
1188 
1189 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1190 				 &bcnft_req, sizeof(bcnft_req), true);
1191 }
1192 
1193 static int
1194 mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
1195 		      bool enable)
1196 {
1197 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1198 	struct {
1199 		u8 bss_idx;
1200 		u8 dtim_period;
1201 		__le16 aid;
1202 		__le16 bcn_interval;
1203 		__le16 atim_window;
1204 		u8 uapsd;
1205 		u8 bmc_delivered_ac;
1206 		u8 bmc_triggered_ac;
1207 		u8 pad;
1208 	} req = {
1209 		.bss_idx = mvif->mt76.idx,
1210 		.aid = cpu_to_le16(vif->bss_conf.aid),
1211 		.dtim_period = vif->bss_conf.dtim_period,
1212 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1213 	};
1214 	struct {
1215 		u8 bss_idx;
1216 		u8 pad[3];
1217 	} req_hdr = {
1218 		.bss_idx = mvif->mt76.idx,
1219 	};
1220 	int err;
1221 
1222 	if (vif->type != NL80211_IFTYPE_STATION)
1223 		return 0;
1224 
1225 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
1226 				&req_hdr, sizeof(req_hdr), false);
1227 	if (err < 0 || !enable)
1228 		return err;
1229 
1230 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
1231 				 &req, sizeof(req), false);
1232 }
1233 
1234 int mt7921_mcu_sta_update(struct mt7921_dev *dev, struct ieee80211_sta *sta,
1235 			  struct ieee80211_vif *vif, bool enable,
1236 			  enum mt76_sta_info_state state)
1237 {
1238 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1239 	int rssi = -ewma_rssi_read(&mvif->rssi);
1240 	struct mt76_sta_cmd_info info = {
1241 		.sta = sta,
1242 		.vif = vif,
1243 		.enable = enable,
1244 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1245 		.state = state,
1246 		.offload_fw = true,
1247 		.rcpi = to_rcpi(rssi),
1248 	};
1249 	struct mt7921_sta *msta;
1250 
1251 	msta = sta ? (struct mt7921_sta *)sta->drv_priv : NULL;
1252 	info.wcid = msta ? &msta->wcid : &mvif->sta.wcid;
1253 	info.newly = msta ? state != MT76_STA_INFO_STATE_ASSOC : true;
1254 
1255 	return mt76_connac_mcu_sta_cmd(&dev->mphy, &info);
1256 }
1257 
1258 int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
1259 {
1260 	struct mt76_phy *mphy = &dev->mt76.phy;
1261 	struct mt76_connac_pm *pm = &dev->pm;
1262 	int err = 0;
1263 
1264 	mutex_lock(&pm->mutex);
1265 
1266 	if (!test_bit(MT76_STATE_PM, &mphy->state))
1267 		goto out;
1268 
1269 	err = __mt7921_mcu_drv_pmctrl(dev);
1270 out:
1271 	mutex_unlock(&pm->mutex);
1272 
1273 	if (err)
1274 		mt7921_reset(&dev->mt76);
1275 
1276 	return err;
1277 }
1278 EXPORT_SYMBOL_GPL(mt7921_mcu_drv_pmctrl);
1279 
1280 int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev)
1281 {
1282 	struct mt76_phy *mphy = &dev->mt76.phy;
1283 	struct mt76_connac_pm *pm = &dev->pm;
1284 	int err = 0;
1285 
1286 	mutex_lock(&pm->mutex);
1287 
1288 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
1289 		goto out;
1290 
1291 	err = __mt7921_mcu_fw_pmctrl(dev);
1292 out:
1293 	mutex_unlock(&pm->mutex);
1294 
1295 	if (err)
1296 		mt7921_reset(&dev->mt76);
1297 
1298 	return err;
1299 }
1300 EXPORT_SYMBOL_GPL(mt7921_mcu_fw_pmctrl);
1301 
1302 int mt7921_mcu_set_beacon_filter(struct mt7921_dev *dev,
1303 				 struct ieee80211_vif *vif,
1304 				 bool enable)
1305 {
1306 	struct ieee80211_hw *hw = mt76_hw(dev);
1307 	int err;
1308 
1309 	if (enable) {
1310 		err = mt7921_mcu_uni_bss_bcnft(dev, vif, true);
1311 		if (err)
1312 			return err;
1313 
1314 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
1315 		ieee80211_hw_set(hw, CONNECTION_MONITOR);
1316 		mt76_set(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1317 
1318 		return 0;
1319 	}
1320 
1321 	err = mt7921_mcu_set_bss_pm(dev, vif, false);
1322 	if (err)
1323 		return err;
1324 
1325 	vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
1326 	__clear_bit(IEEE80211_HW_CONNECTION_MONITOR, hw->flags);
1327 	mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1328 
1329 	return 0;
1330 }
1331 
1332 int mt7921_get_txpwr_info(struct mt7921_dev *dev, struct mt7921_txpwr *txpwr)
1333 {
1334 	struct mt7921_txpwr_event *event;
1335 	struct mt7921_txpwr_req req = {
1336 		.dbdc_idx = 0,
1337 	};
1338 	struct sk_buff *skb;
1339 	int ret;
1340 
1341 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CE_CMD(GET_TXPWR),
1342 					&req, sizeof(req), true, &skb);
1343 	if (ret)
1344 		return ret;
1345 
1346 	event = (struct mt7921_txpwr_event *)skb->data;
1347 	WARN_ON(skb->len != le16_to_cpu(event->len));
1348 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1349 
1350 	dev_kfree_skb(skb);
1351 
1352 	return 0;
1353 }
1354