drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 struct mt7615_patch_hdr {
  15         char build_date[16];
  16         char platform[4];
  17         __be32 hw_sw_ver;
  18         __be32 patch_ver;
  19         __be16 checksum;
  20 } __packed;
  21
  22 struct mt7615_fw_trailer {
  23         __le32 addr;
  24         u8 chip_id;
  25         u8 feature_set;
  26         u8 eco_code;
  27         char fw_ver[10];
  28         char build_date[15];
  29         __le32 len;
  30 } __packed;
  31
  32 #define MCU_PATCH_ADDRESS               0x80000
  33
  34 #define N9_REGION_NUM                   2
  35 #define CR4_REGION_NUM                  1
  36
  37 #define IMG_CRC_LEN                     4
  38
  39 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  40 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  41
  42 #define DL_MODE_ENCRYPT                 BIT(0)
  43 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  44 #define DL_MODE_RESET_SEC_IV            BIT(3)
  45 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  46 #define DL_MODE_NEED_RSP                BIT(31)
  47
  48 #define FW_START_OVERRIDE               BIT(0)
  49 #define FW_START_WORKING_PDA_CR4        BIT(2)
  50
  51 static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
  52                                  int cmd, int *wait_seq)
  53 {
  54         struct mt7615_mcu_txd *mcu_txd;
  55         u8 seq, q_idx, pkt_fmt;
  56         enum mt76_txq_id qid;
  57         u32 val;
  58         __le32 *txd;
  59
  60         seq = ++dev->mt76.mmio.mcu.msg_seq & 0xf;
  61         if (!seq)
  62                 seq = ++dev->mt76.mmio.mcu.msg_seq & 0xf;
  63
  64         mcu_txd = (struct mt7615_mcu_txd *)skb_push(skb,
  65                    sizeof(struct mt7615_mcu_txd));
  66         memset(mcu_txd, 0, sizeof(struct mt7615_mcu_txd));
  67
  68         if (cmd != -MCU_CMD_FW_SCATTER) {
  69                 q_idx = MT_TX_MCU_PORT_RX_Q0;
  70                 pkt_fmt = MT_TX_TYPE_CMD;
  71         } else {
  72                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
  73                 pkt_fmt = MT_TX_TYPE_FW;
  74         }
  75
  76         txd = mcu_txd->txd;
  77
  78         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
  79               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
  80               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
  81         txd[0] = cpu_to_le32(val);
  82
  83         val = MT_TXD1_LONG_FORMAT |
  84               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
  85               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
  86         txd[1] = cpu_to_le32(val);
  87
  88         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
  89         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
  90         mcu_txd->pkt_type = MCU_PKT_ID;
  91         mcu_txd->seq = seq;
  92
  93         if (cmd < 0) {
  94                 mcu_txd->set_query = MCU_Q_NA;
  95                 mcu_txd->cid = -cmd;
  96         } else {
  97                 mcu_txd->cid = MCU_CMD_EXT_CID;
  98                 mcu_txd->set_query = MCU_Q_SET;
  99                 mcu_txd->ext_cid = cmd;
 100                 mcu_txd->ext_cid_ack = 1;
 101         }
 102         mcu_txd->s2d_index = MCU_S2D_H2N;
 103
 104         if (wait_seq)
 105                 *wait_seq = seq;
 106
 107         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mt76.state))
 108                 qid = MT_TXQ_MCU;
 109         else
 110                 qid = MT_TXQ_FWDL;
 111
 112         return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
 113 }
 114
 115 static int
 116 mt7615_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
 117                     int len, bool wait_resp)
 118 {
 119         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 120         unsigned long expires = jiffies + 10 * HZ;
 121         struct mt7615_mcu_rxd *rxd;
 122         struct sk_buff *skb;
 123         int ret, seq;
 124
 125         skb = mt7615_mcu_msg_alloc(data, len);
 126         if (!skb)
 127                 return -ENOMEM;
 128
 129         mutex_lock(&mdev->mmio.mcu.mutex);
 130
 131         ret = __mt7615_mcu_msg_send(dev, skb, cmd, &seq);
 132         if (ret)
 133                 goto out;
 134
 135         while (wait_resp) {
 136                 skb = mt76_mcu_get_response(mdev, expires);
 137                 if (!skb) {
 138                         dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
 139                                 cmd, seq);
 140                         ret = -ETIMEDOUT;
 141                         break;
 142                 }
 143
 144                 rxd = (struct mt7615_mcu_rxd *)skb->data;
 145                 if (seq != rxd->seq)
 146                         continue;
 147
 148                 if (cmd == -MCU_CMD_PATCH_SEM_CONTROL) {
 149                         skb_pull(skb, sizeof(*rxd) - 4);
 150                         ret = *skb->data;
 151                 }
 152                 dev_kfree_skb(skb);
 153                 break;
 154         }
 155
 156 out:
 157         mutex_unlock(&mdev->mmio.mcu.mutex);
 158
 159         return ret;
 160 }
 161
 162 static void
 163 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 164 {
 165         if (vif->csa_active)
 166                 ieee80211_csa_finish(vif);
 167 }
 168
 169 static void
 170 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 171 {
 172         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 173
 174         switch (rxd->ext_eid) {
 175         case MCU_EXT_EVENT_RDD_REPORT:
 176                 ieee80211_radar_detected(dev->mt76.hw);
 177                 dev->hw_pattern++;
 178                 break;
 179         case MCU_EXT_EVENT_CSA_NOTIFY:
 180                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 181                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 182                                 mt7615_mcu_csa_finish, dev);
 183                 break;
 184         default:
 185                 break;
 186         }
 187 }
 188
 189 static void
 190 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 191 {
 192         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 193
 194         switch (rxd->eid) {
 195         case MCU_EVENT_EXT:
 196                 mt7615_mcu_rx_ext_event(dev, skb);
 197                 break;
 198         default:
 199                 break;
 200         }
 201         dev_kfree_skb(skb);
 202 }
 203
 204 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 205 {
 206         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 207
 208         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 209             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 210             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 211             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 212             !rxd->seq)
 213                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 214         else
 215                 mt76_mcu_rx_event(&dev->mt76, skb);
 216 }
 217
 218 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
 219                                     u32 len, u32 mode)
 220 {
 221         struct {
 222                 __le32 addr;
 223                 __le32 len;
 224                 __le32 mode;
 225         } req = {
 226                 .addr = cpu_to_le32(addr),
 227                 .len = cpu_to_le32(len),
 228                 .mode = cpu_to_le32(mode),
 229         };
 230
 231         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_TARGET_ADDRESS_LEN_REQ,
 232                                    &req, sizeof(req), true);
 233 }
 234
 235 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
 236                                     int len)
 237 {
 238         int ret = 0, cur_len;
 239
 240         while (len > 0) {
 241                 cur_len = min_t(int, 4096 - sizeof(struct mt7615_mcu_txd),
 242                                 len);
 243
 244                 ret = __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_SCATTER,
 245                                           data, cur_len, false);
 246                 if (ret)
 247                         break;
 248
 249                 data += cur_len;
 250                 len -= cur_len;
 251                 mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
 252         }
 253
 254         return ret;
 255 }
 256
 257 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
 258                                      u32 option)
 259 {
 260         struct {
 261                 __le32 option;
 262                 __le32 addr;
 263         } req = {
 264                 .option = cpu_to_le32(option),
 265                 .addr = cpu_to_le32(addr),
 266         };
 267
 268         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ,
 269                                    &req, sizeof(req), true);
 270 }
 271
 272 static int mt7615_mcu_restart(struct mt76_dev *dev)
 273 {
 274         return __mt76_mcu_send_msg(dev, -MCU_CMD_RESTART_DL_REQ, NULL,
 275                                    0, true);
 276 }
 277
 278 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
 279 {
 280         struct {
 281                 __le32 op;
 282         } req = {
 283                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
 284         };
 285
 286         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL,
 287                                    &req, sizeof(req), true);
 288 }
 289
 290 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
 291 {
 292         struct {
 293                 u8 check_crc;
 294                 u8 reserved[3];
 295         } req = {
 296                 .check_crc = 0,
 297         };
 298
 299         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ,
 300                                    &req, sizeof(req), true);
 301 }
 302
 303 static int mt7615_driver_own(struct mt7615_dev *dev)
 304 {
 305         mt76_wr(dev, MT_CFG_LPCR_HOST, MT_CFG_LPCR_HOST_DRV_OWN);
 306         if (!mt76_poll_msec(dev, MT_CFG_LPCR_HOST,
 307                             MT_CFG_LPCR_HOST_FW_OWN, 0, 500)) {
 308                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
 309                 return -EIO;
 310         }
 311
 312         return 0;
 313 }
 314
 315 static int mt7615_load_patch(struct mt7615_dev *dev)
 316 {
 317         const char *firmware = MT7615_ROM_PATCH;
 318         const struct mt7615_patch_hdr *hdr;
 319         const struct firmware *fw = NULL;
 320         int len, ret, sem;
 321
 322         sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
 323         switch (sem) {
 324         case PATCH_IS_DL:
 325                 return 0;
 326         case PATCH_NOT_DL_SEM_SUCCESS:
 327                 break;
 328         default:
 329                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
 330                 return -EAGAIN;
 331         }
 332
 333         ret = request_firmware(&fw, firmware, dev->mt76.dev);
 334         if (ret)
 335                 goto out;
 336
 337         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
 338                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 339                 ret = -EINVAL;
 340                 goto out;
 341         }
 342
 343         hdr = (const struct mt7615_patch_hdr *)(fw->data);
 344
 345         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
 346                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
 347
 348         len = fw->size - sizeof(*hdr);
 349
 350         ret = mt7615_mcu_init_download(dev, MCU_PATCH_ADDRESS, len,
 351                                        DL_MODE_NEED_RSP);
 352         if (ret) {
 353                 dev_err(dev->mt76.dev, "Download request failed\n");
 354                 goto out;
 355         }
 356
 357         ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
 358         if (ret) {
 359                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
 360                 goto out;
 361         }
 362
 363         ret = mt7615_mcu_start_patch(dev);
 364         if (ret)
 365                 dev_err(dev->mt76.dev, "Failed to start patch\n");
 366
 367 out:
 368         release_firmware(fw);
 369
 370         sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
 371         switch (sem) {
 372         case PATCH_REL_SEM_SUCCESS:
 373                 break;
 374         default:
 375                 ret = -EAGAIN;
 376                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
 377                 break;
 378         }
 379
 380         return ret;
 381 }
 382
 383 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
 384 {
 385         u32 ret = 0;
 386
 387         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
 388                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
 389         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
 390                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
 391         ret |= DL_MODE_NEED_RSP;
 392         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
 393
 394         return ret;
 395 }
 396
 397 static int
 398 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
 399                              const struct mt7615_fw_trailer *hdr,
 400                              const u8 *data, bool is_cr4)
 401 {
 402         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
 403         int err, i, offset = 0;
 404         u32 len, addr, mode;
 405
 406         for (i = 0; i < n_region; i++) {
 407                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
 408                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
 409                 addr = le32_to_cpu(hdr[i].addr);
 410
 411                 err = mt7615_mcu_init_download(dev, addr, len, mode);
 412                 if (err) {
 413                         dev_err(dev->mt76.dev, "Download request failed\n");
 414                         return err;
 415                 }
 416
 417                 err = mt7615_mcu_send_firmware(dev, data + offset, len);
 418                 if (err) {
 419                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
 420                         return err;
 421                 }
 422
 423                 offset += len;
 424         }
 425
 426         return 0;
 427 }
 428
 429 static int mt7615_load_ram(struct mt7615_dev *dev)
 430 {
 431         const struct firmware *fw;
 432         const struct mt7615_fw_trailer *hdr;
 433         const char *n9_firmware = MT7615_FIRMWARE_N9;
 434         const char *cr4_firmware = MT7615_FIRMWARE_CR4;
 435         int ret;
 436
 437         ret = request_firmware(&fw, n9_firmware, dev->mt76.dev);
 438         if (ret)
 439                 return ret;
 440
 441         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
 442                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 443                 ret = -EINVAL;
 444                 goto out;
 445         }
 446
 447         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
 448                                         N9_REGION_NUM * sizeof(*hdr));
 449
 450         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
 451                  hdr->fw_ver, hdr->build_date);
 452
 453         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
 454         if (ret)
 455                 goto out;
 456
 457         ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
 458                                         FW_START_OVERRIDE);
 459         if (ret) {
 460                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
 461                 goto out;
 462         }
 463
 464         release_firmware(fw);
 465
 466         ret = request_firmware(&fw, cr4_firmware, dev->mt76.dev);
 467         if (ret)
 468                 return ret;
 469
 470         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
 471                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 472                 ret = -EINVAL;
 473                 goto out;
 474         }
 475
 476         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
 477                                         CR4_REGION_NUM * sizeof(*hdr));
 478
 479         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
 480                  hdr->fw_ver, hdr->build_date);
 481
 482         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
 483         if (ret)
 484                 goto out;
 485
 486         ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
 487         if (ret)
 488                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
 489
 490 out:
 491         release_firmware(fw);
 492
 493         return ret;
 494 }
 495
 496 static int mt7615_load_firmware(struct mt7615_dev *dev)
 497 {
 498         int ret;
 499         u32 val;
 500
 501         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
 502
 503         if (val != FW_STATE_FW_DOWNLOAD) {
 504                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
 505                 return -EIO;
 506         }
 507
 508         ret = mt7615_load_patch(dev);
 509         if (ret)
 510                 return ret;
 511
 512         ret = mt7615_load_ram(dev);
 513         if (ret)
 514                 return ret;
 515
 516         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
 517                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
 518                                        FW_STATE_CR4_RDY), 500)) {
 519                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
 520                 return -EIO;
 521         }
 522
 523         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
 524
 525         dev_dbg(dev->mt76.dev, "Firmware init done\n");
 526
 527         return 0;
 528 }
 529
 530 int mt7615_mcu_init(struct mt7615_dev *dev)
 531 {
 532         static const struct mt76_mcu_ops mt7615_mcu_ops = {
 533                 .mcu_send_msg = mt7615_mcu_msg_send,
 534                 .mcu_restart = mt7615_mcu_restart,
 535         };
 536         int ret;
 537
 538         dev->mt76.mcu_ops = &mt7615_mcu_ops,
 539
 540         ret = mt7615_driver_own(dev);
 541         if (ret)
 542                 return ret;
 543
 544         ret = mt7615_load_firmware(dev);
 545         if (ret)
 546                 return ret;
 547
 548         set_bit(MT76_STATE_MCU_RUNNING, &dev->mt76.state);
 549
 550         return 0;
 551 }
 552
 553 void mt7615_mcu_exit(struct mt7615_dev *dev)
 554 {
 555         __mt76_mcu_restart(&dev->mt76);
 556         mt76_wr(dev, MT_CFG_LPCR_HOST, MT_CFG_LPCR_HOST_FW_OWN);
 557         skb_queue_purge(&dev->mt76.mmio.mcu.res_q);
 558 }
 559
 560 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
 561 {
 562         struct {
 563                 u8 buffer_mode;
 564                 u8 pad;
 565                 u16 len;
 566         } __packed req_hdr = {
 567                 .buffer_mode = 1,
 568                 .len = __MT_EE_MAX - MT_EE_NIC_CONF_0,
 569         };
 570         int ret, len = sizeof(req_hdr) + __MT_EE_MAX - MT_EE_NIC_CONF_0;
 571         u8 *req, *eep = (u8 *)dev->mt76.eeprom.data;
 572
 573         req = kzalloc(len, GFP_KERNEL);
 574         if (!req)
 575                 return -ENOMEM;
 576
 577         memcpy(req, &req_hdr, sizeof(req_hdr));
 578         memcpy(req + sizeof(req_hdr), eep + MT_EE_NIC_CONF_0,
 579                __MT_EE_MAX - MT_EE_NIC_CONF_0);
 580
 581         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
 582                                   req, len, true);
 583         kfree(req);
 584
 585         return ret;
 586 }
 587
 588 int mt7615_mcu_init_mac(struct mt7615_dev *dev)
 589 {
 590         struct {
 591                 u8 enable;
 592                 u8 band;
 593                 u8 rsv[2];
 594         } __packed req = {
 595                 .enable = 1,
 596                 .band = 0,
 597         };
 598
 599         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
 600                                    &req, sizeof(req), true);
 601 }
 602
 603 int mt7615_mcu_set_rts_thresh(struct mt7615_dev *dev, u32 val)
 604 {
 605         struct {
 606                 u8 prot_idx;
 607                 u8 band;
 608                 u8 rsv[2];
 609                 __le32 len_thresh;
 610                 __le32 pkt_thresh;
 611         } __packed req = {
 612                 .prot_idx = 1,
 613                 .band = 0,
 614                 .len_thresh = cpu_to_le32(val),
 615                 .pkt_thresh = cpu_to_le32(0x2),
 616         };
 617
 618         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
 619                                    &req, sizeof(req), true);
 620 }
 621
 622 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
 623                        const struct ieee80211_tx_queue_params *params)
 624 {
 625 #define WMM_AIFS_SET    BIT(0)
 626 #define WMM_CW_MIN_SET  BIT(1)
 627 #define WMM_CW_MAX_SET  BIT(2)
 628 #define WMM_TXOP_SET    BIT(3)
 629         struct req_data {
 630                 u8 number;
 631                 u8 rsv[3];
 632                 u8 queue;
 633                 u8 valid;
 634                 u8 aifs;
 635                 u8 cw_min;
 636                 __le16 cw_max;
 637                 __le16 txop;
 638         } __packed req = {
 639                 .number = 1,
 640                 .queue = queue,
 641                 .valid = WMM_AIFS_SET | WMM_TXOP_SET,
 642                 .aifs = params->aifs,
 643                 .txop = cpu_to_le16(params->txop),
 644         };
 645
 646         if (params->cw_min) {
 647                 req.valid |= WMM_CW_MIN_SET;
 648                 req.cw_min = params->cw_min;
 649         }
 650         if (params->cw_max) {
 651                 req.valid |= WMM_CW_MAX_SET;
 652                 req.cw_max = cpu_to_le16(params->cw_max);
 653         }
 654
 655         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
 656                                    &req, sizeof(req), true);
 657 }
 658
 659 int mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int enter)
 660 {
 661 #define ENTER_PM_STATE  1
 662 #define EXIT_PM_STATE   2
 663         struct {
 664                 u8 pm_number;
 665                 u8 pm_state;
 666                 u8 bssid[ETH_ALEN];
 667                 u8 dtim_period;
 668                 u8 wlan_idx;
 669                 __le16 bcn_interval;
 670                 __le32 aid;
 671                 __le32 rx_filter;
 672                 u8 band_idx;
 673                 u8 rsv[3];
 674                 __le32 feature;
 675                 u8 omac_idx;
 676                 u8 wmm_idx;
 677                 u8 bcn_loss_cnt;
 678                 u8 bcn_sp_duration;
 679         } __packed req = {
 680                 .pm_number = 5,
 681                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
 682                 .band_idx = 0,
 683         };
 684
 685         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
 686                                    &req, sizeof(req), true);
 687 }
 688
 689 int mt7615_mcu_set_dev_info(struct mt7615_dev *dev,
 690                             struct ieee80211_vif *vif, bool enable)
 691 {
 692         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 693         struct {
 694                 struct req_hdr {
 695                         u8 omac_idx;
 696                         u8 band_idx;
 697                         __le16 tlv_num;
 698                         u8 is_tlv_append;
 699                         u8 rsv[3];
 700                 } __packed hdr;
 701                 struct req_tlv {
 702                         __le16 tag;
 703                         __le16 len;
 704                         u8 active;
 705                         u8 band_idx;
 706                         u8 omac_addr[ETH_ALEN];
 707                 } __packed tlv;
 708         } data = {
 709                 .hdr = {
 710                         .omac_idx = mvif->omac_idx,
 711                         .band_idx = mvif->band_idx,
 712                         .tlv_num = cpu_to_le16(1),
 713                         .is_tlv_append = 1,
 714                 },
 715                 .tlv = {
 716                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 717                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 718                         .active = enable,
 719                         .band_idx = mvif->band_idx,
 720                 },
 721         };
 722
 723         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 724         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 725                                    &data, sizeof(data), true);
 726 }
 727
 728 static void
 729 mt7615_mcu_bss_info_omac_header(struct mt7615_vif *mvif, u8 *data,
 730                                 u32 conn_type)
 731 {
 732         struct bss_info_omac *hdr = (struct bss_info_omac *)data;
 733         u8 idx;
 734
 735         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 736         hdr->tag = cpu_to_le16(BSS_INFO_OMAC);
 737         hdr->len = cpu_to_le16(sizeof(struct bss_info_omac));
 738         hdr->hw_bss_idx = idx;
 739         hdr->omac_idx = mvif->omac_idx;
 740         hdr->band_idx = mvif->band_idx;
 741         hdr->conn_type = cpu_to_le32(conn_type);
 742 }
 743
 744 static void
 745 mt7615_mcu_bss_info_basic_header(struct ieee80211_vif *vif, u8 *data,
 746                                  u32 net_type, u8 tx_wlan_idx,
 747                                  bool enable)
 748 {
 749         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 750         struct bss_info_basic *hdr = (struct bss_info_basic *)data;
 751
 752         hdr->tag = cpu_to_le16(BSS_INFO_BASIC);
 753         hdr->len = cpu_to_le16(sizeof(struct bss_info_basic));
 754         hdr->network_type = cpu_to_le32(net_type);
 755         hdr->active = enable;
 756         hdr->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 757         memcpy(hdr->bssid, vif->bss_conf.bssid, ETH_ALEN);
 758         hdr->wmm_idx = mvif->wmm_idx;
 759         hdr->dtim_period = vif->bss_conf.dtim_period;
 760         hdr->bmc_tx_wlan_idx = tx_wlan_idx;
 761 }
 762
 763 static void
 764 mt7615_mcu_bss_info_ext_header(struct mt7615_vif *mvif, u8 *data)
 765 {
 766 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 767 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 768         struct bss_info_ext_bss *hdr = (struct bss_info_ext_bss *)data;
 769         int ext_bss_idx, tsf_offset;
 770
 771         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 772         if (ext_bss_idx < 0)
 773                 return;
 774
 775         hdr->tag = cpu_to_le16(BSS_INFO_EXT_BSS);
 776         hdr->len = cpu_to_le16(sizeof(struct bss_info_ext_bss));
 777         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 778         hdr->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 779 }
 780
 781 int mt7615_mcu_set_bss_info(struct mt7615_dev *dev,
 782                             struct ieee80211_vif *vif, int en)
 783 {
 784         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 785         struct req_hdr {
 786                 u8 bss_idx;
 787                 u8 rsv0;
 788                 __le16 tlv_num;
 789                 u8 is_tlv_append;
 790                 u8 rsv1[3];
 791         } __packed;
 792         int len = sizeof(struct req_hdr) + sizeof(struct bss_info_basic);
 793         int ret, i, features = BIT(BSS_INFO_BASIC), ntlv = 1;
 794         u32 conn_type = 0, net_type = NETWORK_INFRA;
 795         u8 *buf, *data, tx_wlan_idx = 0;
 796         struct req_hdr *hdr;
 797
 798         if (en) {
 799                 len += sizeof(struct bss_info_omac);
 800                 features |= BIT(BSS_INFO_OMAC);
 801                 if (mvif->omac_idx > EXT_BSSID_START) {
 802                         len += sizeof(struct bss_info_ext_bss);
 803                         features |= BIT(BSS_INFO_EXT_BSS);
 804                         ntlv++;
 805                 }
 806                 ntlv++;
 807         }
 808
 809         switch (vif->type) {
 810         case NL80211_IFTYPE_AP:
 811         case NL80211_IFTYPE_MESH_POINT:
 812                 tx_wlan_idx = mvif->sta.wcid.idx;
 813                 conn_type = CONNECTION_INFRA_AP;
 814                 break;
 815         case NL80211_IFTYPE_STATION: {
 816                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 817                 if (en) {
 818                         struct ieee80211_sta *sta;
 819                         struct mt7615_sta *msta;
 820
 821                         rcu_read_lock();
 822                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 823                         if (!sta) {
 824                                 rcu_read_unlock();
 825                                 return -EINVAL;
 826                         }
 827
 828                         msta = (struct mt7615_sta *)sta->drv_priv;
 829                         tx_wlan_idx = msta->wcid.idx;
 830                         rcu_read_unlock();
 831                 }
 832                 conn_type = CONNECTION_INFRA_STA;
 833                 break;
 834         }
 835         default:
 836                 WARN_ON(1);
 837                 break;
 838         }
 839
 840         buf = kzalloc(len, GFP_KERNEL);
 841         if (!buf)
 842                 return -ENOMEM;
 843
 844         hdr = (struct req_hdr *)buf;
 845         hdr->bss_idx = mvif->idx;
 846         hdr->tlv_num = cpu_to_le16(ntlv);
 847         hdr->is_tlv_append = 1;
 848
 849         data = buf + sizeof(*hdr);
 850         for (i = 0; i < BSS_INFO_MAX_NUM; i++) {
 851                 int tag = ffs(features & BIT(i)) - 1;
 852
 853                 switch (tag) {
 854                 case BSS_INFO_OMAC:
 855                         mt7615_mcu_bss_info_omac_header(mvif, data,
 856                                                         conn_type);
 857                         data += sizeof(struct bss_info_omac);
 858                         break;
 859                 case BSS_INFO_BASIC:
 860                         mt7615_mcu_bss_info_basic_header(vif, data, net_type,
 861                                                          tx_wlan_idx, en);
 862                         data += sizeof(struct bss_info_basic);
 863                         break;
 864                 case BSS_INFO_EXT_BSS:
 865                         mt7615_mcu_bss_info_ext_header(mvif, data);
 866                         data += sizeof(struct bss_info_ext_bss);
 867                         break;
 868                 default:
 869                         break;
 870                 }
 871         }
 872
 873         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BSS_INFO_UPDATE,
 874                                   buf, len, true);
 875         kfree(buf);
 876
 877         return ret;
 878 }
 879
 880 static enum mt7615_cipher_type
 881 mt7615_get_key_info(struct ieee80211_key_conf *key, u8 *key_data)
 882 {
 883         if (!key || key->keylen > 32)
 884                 return MT_CIPHER_NONE;
 885
 886         memcpy(key_data, key->key, key->keylen);
 887
 888         switch (key->cipher) {
 889         case WLAN_CIPHER_SUITE_WEP40:
 890                 return MT_CIPHER_WEP40;
 891         case WLAN_CIPHER_SUITE_WEP104:
 892                 return MT_CIPHER_WEP104;
 893         case WLAN_CIPHER_SUITE_TKIP:
 894                 /* Rx/Tx MIC keys are swapped */
 895                 memcpy(key_data + 16, key->key + 24, 8);
 896                 memcpy(key_data + 24, key->key + 16, 8);
 897                 return MT_CIPHER_TKIP;
 898         case WLAN_CIPHER_SUITE_CCMP:
 899                 return MT_CIPHER_AES_CCMP;
 900         case WLAN_CIPHER_SUITE_CCMP_256:
 901                 return MT_CIPHER_CCMP_256;
 902         case WLAN_CIPHER_SUITE_GCMP:
 903                 return MT_CIPHER_GCMP;
 904         case WLAN_CIPHER_SUITE_GCMP_256:
 905                 return MT_CIPHER_GCMP_256;
 906         case WLAN_CIPHER_SUITE_SMS4:
 907                 return MT_CIPHER_WAPI;
 908         default:
 909                 return MT_CIPHER_NONE;
 910         }
 911 }
 912
 913 int mt7615_mcu_set_wtbl_key(struct mt7615_dev *dev, int wcid,
 914                             struct ieee80211_key_conf *key,
 915                             enum set_key_cmd cmd)
 916 {
 917         struct {
 918                 struct wtbl_req_hdr hdr;
 919                 struct wtbl_sec_key key;
 920         } req = {
 921                 .hdr = {
 922                         .wlan_idx = wcid,
 923                         .operation = WTBL_SET,
 924                         .tlv_num = cpu_to_le16(1),
 925                 },
 926                 .key = {
 927                         .tag = cpu_to_le16(WTBL_SEC_KEY),
 928                         .len = cpu_to_le16(sizeof(struct wtbl_sec_key)),
 929                         .add = cmd,
 930                 },
 931         };
 932
 933         if (cmd == SET_KEY) {
 934                 u8 cipher;
 935
 936                 cipher = mt7615_get_key_info(key, req.key.key_material);
 937                 if (cipher == MT_CIPHER_NONE)
 938                         return -EOPNOTSUPP;
 939
 940                 req.key.rkv = 1;
 941                 req.key.cipher_id = cipher;
 942                 req.key.key_id = key->keyidx;
 943                 req.key.key_len = key->keylen;
 944         } else {
 945                 req.key.key_len = sizeof(req.key.key_material);
 946         }
 947
 948         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 949                                    &req, sizeof(req), true);
 950 }
 951
 952 static int
 953 mt7615_mcu_add_wtbl_bmc(struct mt7615_dev *dev,
 954                         struct mt7615_vif *mvif)
 955 {
 956         struct {
 957                 struct wtbl_req_hdr hdr;
 958                 struct wtbl_generic g_wtbl;
 959                 struct wtbl_rx rx_wtbl;
 960         } req = {
 961                 .hdr = {
 962                         .wlan_idx = mvif->sta.wcid.idx,
 963                         .operation = WTBL_RESET_AND_SET,
 964                         .tlv_num = cpu_to_le16(2),
 965                 },
 966                 .g_wtbl = {
 967                         .tag = cpu_to_le16(WTBL_GENERIC),
 968                         .len = cpu_to_le16(sizeof(struct wtbl_generic)),
 969                         .muar_idx = 0xe,
 970                 },
 971                 .rx_wtbl = {
 972                         .tag = cpu_to_le16(WTBL_RX),
 973                         .len = cpu_to_le16(sizeof(struct wtbl_rx)),
 974                         .rca1 = 1,
 975                         .rca2 = 1,
 976                         .rv = 1,
 977                 },
 978         };
 979         eth_broadcast_addr(req.g_wtbl.peer_addr);
 980
 981         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 982                                    &req, sizeof(req), true);
 983 }
 984
 985 int mt7615_mcu_wtbl_bmc(struct mt7615_dev *dev,
 986                         struct ieee80211_vif *vif, bool enable)
 987 {
 988         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 989
 990         if (!enable) {
 991                 struct wtbl_req_hdr req = {
 992                         .wlan_idx = mvif->sta.wcid.idx,
 993                         .operation = WTBL_RESET_AND_SET,
 994                 };
 995
 996                 return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 997                                            &req, sizeof(req), true);
 998         }
 999
1000         return mt7615_mcu_add_wtbl_bmc(dev, mvif);
1001 }
1002
1003 int mt7615_mcu_add_wtbl(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1004                         struct ieee80211_sta *sta)
1005 {
1006         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1007         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1008         struct {
1009                 struct wtbl_req_hdr hdr;
1010                 struct wtbl_generic g_wtbl;
1011                 struct wtbl_rx rx_wtbl;
1012         } req = {
1013                 .hdr = {
1014                         .wlan_idx = msta->wcid.idx,
1015                         .operation = WTBL_RESET_AND_SET,
1016                         .tlv_num = cpu_to_le16(2),
1017                 },
1018                 .g_wtbl = {
1019                         .tag = cpu_to_le16(WTBL_GENERIC),
1020                         .len = cpu_to_le16(sizeof(struct wtbl_generic)),
1021                         .muar_idx = mvif->omac_idx,
1022                         .qos = sta->wme,
1023                         .partial_aid = cpu_to_le16(sta->aid),
1024                 },
1025                 .rx_wtbl = {
1026                         .tag = cpu_to_le16(WTBL_RX),
1027                         .len = cpu_to_le16(sizeof(struct wtbl_rx)),
1028                         .rca1 = vif->type != NL80211_IFTYPE_AP,
1029                         .rca2 = 1,
1030                         .rv = 1,
1031                 },
1032         };
1033         memcpy(req.g_wtbl.peer_addr, sta->addr, ETH_ALEN);
1034
1035         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1036                                    &req, sizeof(req), true);
1037 }
1038
1039 int mt7615_mcu_del_wtbl(struct mt7615_dev *dev,
1040                         struct ieee80211_sta *sta)
1041 {
1042         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1043         struct wtbl_req_hdr req = {
1044                 .wlan_idx = msta->wcid.idx,
1045                 .operation = WTBL_RESET_AND_SET,
1046         };
1047
1048         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1049                                    &req, sizeof(req), true);
1050 }
1051
1052 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1053 {
1054         struct wtbl_req_hdr req = {
1055                 .operation = WTBL_RESET_ALL,
1056         };
1057
1058         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1059                                    &req, sizeof(req), true);
1060 }
1061
1062 int mt7615_mcu_set_sta_rec_bmc(struct mt7615_dev *dev,
1063                                struct ieee80211_vif *vif, bool en)
1064 {
1065         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1066         struct {
1067                 struct sta_req_hdr hdr;
1068                 struct sta_rec_basic basic;
1069         } req = {
1070                 .hdr = {
1071                         .bss_idx = mvif->idx,
1072                         .wlan_idx = mvif->sta.wcid.idx,
1073                         .tlv_num = cpu_to_le16(1),
1074                         .is_tlv_append = 1,
1075                         .muar_idx = mvif->omac_idx,
1076                 },
1077                 .basic = {
1078                         .tag = cpu_to_le16(STA_REC_BASIC),
1079                         .len = cpu_to_le16(sizeof(struct sta_rec_basic)),
1080                         .conn_type = cpu_to_le32(CONNECTION_INFRA_BC),
1081                 },
1082         };
1083         eth_broadcast_addr(req.basic.peer_addr);
1084
1085         if (en) {
1086                 req.basic.conn_state = CONN_STATE_PORT_SECURE;
1087                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER |
1088                                                    EXTRA_INFO_NEW);
1089         } else {
1090                 req.basic.conn_state = CONN_STATE_DISCONNECT;
1091                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER);
1092         }
1093
1094         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1095                                    &req, sizeof(req), true);
1096 }
1097
1098 int mt7615_mcu_set_sta_rec(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1099                            struct ieee80211_sta *sta, bool en)
1100 {
1101         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1102         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1103
1104         struct {
1105                 struct sta_req_hdr hdr;
1106                 struct sta_rec_basic basic;
1107         } req = {
1108                 .hdr = {
1109                         .bss_idx = mvif->idx,
1110                         .wlan_idx = msta->wcid.idx,
1111                         .tlv_num = cpu_to_le16(1),
1112                         .is_tlv_append = 1,
1113                         .muar_idx = mvif->omac_idx,
1114                 },
1115                 .basic = {
1116                         .tag = cpu_to_le16(STA_REC_BASIC),
1117                         .len = cpu_to_le16(sizeof(struct sta_rec_basic)),
1118                         .qos = sta->wme,
1119                         .aid = cpu_to_le16(sta->aid),
1120                 },
1121         };
1122         memcpy(req.basic.peer_addr, sta->addr, ETH_ALEN);
1123
1124         switch (vif->type) {
1125         case NL80211_IFTYPE_AP:
1126         case NL80211_IFTYPE_MESH_POINT:
1127                 req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1128                 break;
1129         case NL80211_IFTYPE_STATION:
1130                 req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1131                 break;
1132         default:
1133                 WARN_ON(1);
1134                 break;
1135         };
1136
1137         if (en) {
1138                 req.basic.conn_state = CONN_STATE_PORT_SECURE;
1139                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER |
1140                                                    EXTRA_INFO_NEW);
1141         } else {
1142                 req.basic.conn_state = CONN_STATE_DISCONNECT;
1143                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER);
1144         }
1145
1146         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1147                                    &req, sizeof(req), true);
1148 }
1149
1150 int mt7615_mcu_set_bcn(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1151                        int en)
1152 {
1153         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1154         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1155         struct ieee80211_mutable_offsets offs;
1156         struct req {
1157                 u8 omac_idx;
1158                 u8 enable;
1159                 u8 wlan_idx;
1160                 u8 band_idx;
1161                 u8 pkt_type;
1162                 u8 need_pre_tbtt_int;
1163                 __le16 csa_ie_pos;
1164                 __le16 pkt_len;
1165                 __le16 tim_ie_pos;
1166                 u8 pkt[512];
1167                 u8 csa_cnt;
1168                 /* bss color change */
1169                 u8 bcc_cnt;
1170                 __le16 bcc_ie_pos;
1171         } __packed req = {
1172                 .omac_idx = mvif->omac_idx,
1173                 .enable = en,
1174                 .wlan_idx = wcid->idx,
1175                 .band_idx = mvif->band_idx,
1176         };
1177         struct sk_buff *skb;
1178
1179         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1180         if (!skb)
1181                 return -EINVAL;
1182
1183         if (skb->len > 512 - MT_TXD_SIZE) {
1184                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
1185                 dev_kfree_skb(skb);
1186                 return -EINVAL;
1187         }
1188
1189         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
1190                               0, NULL);
1191         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
1192         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1193         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1194         if (offs.csa_counter_offs[0]) {
1195                 u16 csa_offs;
1196
1197                 csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
1198                 req.csa_ie_pos = cpu_to_le16(csa_offs);
1199                 req.csa_cnt = skb->data[offs.csa_counter_offs[0]];
1200         }
1201         dev_kfree_skb(skb);
1202
1203         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD,
1204                                    &req, sizeof(req), true);
1205 }
1206
1207 int mt7615_mcu_set_tx_power(struct mt7615_dev *dev)
1208 {
1209         int i, ret, n_chains = hweight8(dev->mt76.antenna_mask);
1210         struct cfg80211_chan_def *chandef = &dev->mt76.chandef;
1211         int freq = chandef->center_freq1, len, target_chains;
1212         u8 *req, *data, *eep = (u8 *)dev->mt76.eeprom.data;
1213         enum nl80211_band band = chandef->chan->band;
1214         struct ieee80211_hw *hw = mt76_hw(dev);
1215         struct {
1216                 u8 center_chan;
1217                 u8 dbdc_idx;
1218                 u8 band;
1219                 u8 rsv;
1220         } __packed req_hdr = {
1221                 .center_chan = ieee80211_frequency_to_channel(freq),
1222                 .band = band,
1223         };
1224         s8 tx_power;
1225
1226         len = sizeof(req_hdr) + __MT_EE_MAX - MT_EE_NIC_CONF_0;
1227         req = kzalloc(len, GFP_KERNEL);
1228         if (!req)
1229                 return -ENOMEM;
1230
1231         memcpy(req, &req_hdr, sizeof(req_hdr));
1232         data = req + sizeof(req_hdr);
1233         memcpy(data, eep + MT_EE_NIC_CONF_0,
1234                __MT_EE_MAX - MT_EE_NIC_CONF_0);
1235
1236         tx_power = hw->conf.power_level * 2;
1237         switch (n_chains) {
1238         case 4:
1239                 tx_power -= 12;
1240                 break;
1241         case 3:
1242                 tx_power -= 8;
1243                 break;
1244         case 2:
1245                 tx_power -= 6;
1246                 break;
1247         default:
1248                 break;
1249         }
1250         tx_power = max_t(s8, tx_power, 0);
1251         dev->mt76.txpower_cur = tx_power;
1252
1253         target_chains = mt7615_ext_pa_enabled(dev, band) ? 1 : n_chains;
1254         for (i = 0; i < target_chains; i++) {
1255                 int index = -MT_EE_NIC_CONF_0;
1256
1257                 ret = mt7615_eeprom_get_power_index(dev, chandef->chan, i);
1258                 if (ret < 0)
1259                         goto out;
1260
1261                 index += ret;
1262                 data[index] = min_t(u8, data[index], tx_power);
1263         }
1264
1265         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_TX_POWER_CTRL,
1266                                   req, len, true);
1267 out:
1268         kfree(req);
1269
1270         return ret;
1271 }
1272
1273 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
1274                        enum mt7615_rdd_cmd cmd, u8 index,
1275                        u8 rx_sel, u8 val)
1276 {
1277         struct {
1278                 u8 ctrl;
1279                 u8 rdd_idx;
1280                 u8 rdd_rx_sel;
1281                 u8 val;
1282                 u8 rsv[4];
1283         } req = {
1284                 .ctrl = cmd,
1285                 .rdd_idx = index,
1286                 .rdd_rx_sel = rx_sel,
1287                 .val = val,
1288         };
1289
1290         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL,
1291                                    &req, sizeof(req), true);
1292 }
1293
1294 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
1295 {
1296         struct {
1297                 u8 pulse_num;
1298                 u8 rsv[3];
1299                 struct {
1300                         u32 start_time;
1301                         u16 width;
1302                         s16 power;
1303                 } pattern[32];
1304         } req = {
1305                 .pulse_num = dev->radar_pattern.n_pulses,
1306         };
1307         u32 start_time = ktime_to_ms(ktime_get_boottime());
1308         int i;
1309
1310         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
1311                 return -EINVAL;
1312
1313         /* TODO: add some noise here */
1314         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
1315                 req.pattern[i].width = dev->radar_pattern.width;
1316                 req.pattern[i].power = dev->radar_pattern.power;
1317                 req.pattern[i].start_time = start_time +
1318                                             i * dev->radar_pattern.period;
1319         }
1320
1321         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
1322                                    &req, sizeof(req), false);
1323 }
1324
1325 int mt7615_mcu_set_channel(struct mt7615_dev *dev)
1326 {
1327         struct cfg80211_chan_def *chandef = &dev->mt76.chandef;
1328         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1329         struct {
1330                 u8 control_chan;
1331                 u8 center_chan;
1332                 u8 bw;
1333                 u8 tx_streams;
1334                 u8 rx_streams_mask;
1335                 u8 switch_reason;
1336                 u8 band_idx;
1337                 /* for 80+80 only */
1338                 u8 center_chan2;
1339                 __le16 cac_case;
1340                 u8 channel_band;
1341                 u8 rsv0;
1342                 __le32 outband_freq;
1343                 u8 txpower_drop;
1344                 u8 rsv1[3];
1345                 u8 txpower_sku[53];
1346                 u8 rsv2[3];
1347         } req = {
1348                 .control_chan = chandef->chan->hw_value,
1349                 .center_chan = ieee80211_frequency_to_channel(freq1),
1350                 .tx_streams = (dev->mt76.chainmask >> 8) & 0xf,
1351                 .rx_streams_mask = dev->mt76.antenna_mask,
1352                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
1353         };
1354         int ret;
1355
1356         if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
1357             chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
1358                 req.switch_reason = CH_SWITCH_DFS;
1359         else
1360                 req.switch_reason = CH_SWITCH_NORMAL;
1361
1362         switch (dev->mt76.chandef.width) {
1363         case NL80211_CHAN_WIDTH_40:
1364                 req.bw = CMD_CBW_40MHZ;
1365                 break;
1366         case NL80211_CHAN_WIDTH_80:
1367                 req.bw = CMD_CBW_80MHZ;
1368                 break;
1369         case NL80211_CHAN_WIDTH_80P80:
1370                 req.bw = CMD_CBW_8080MHZ;
1371                 break;
1372         case NL80211_CHAN_WIDTH_160:
1373                 req.bw = CMD_CBW_160MHZ;
1374                 break;
1375         case NL80211_CHAN_WIDTH_5:
1376                 req.bw = CMD_CBW_5MHZ;
1377                 break;
1378         case NL80211_CHAN_WIDTH_10:
1379                 req.bw = CMD_CBW_10MHZ;
1380                 break;
1381         case NL80211_CHAN_WIDTH_20_NOHT:
1382         case NL80211_CHAN_WIDTH_20:
1383         default:
1384                 req.bw = CMD_CBW_20MHZ;
1385                 break;
1386         }
1387         memset(req.txpower_sku, 0x3f, 49);
1388
1389         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_CHANNEL_SWITCH,
1390                                   &req, sizeof(req), true);
1391         if (ret)
1392                 return ret;
1393
1394         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RX_PATH,
1395                                    &req, sizeof(req), true);
1396 }
1397
1398 int mt7615_mcu_set_ht_cap(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1399                           struct ieee80211_sta *sta)
1400 {
1401         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1402         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1403         struct wtbl_req_hdr *wtbl_hdr;
1404         struct sta_req_hdr *sta_hdr;
1405         struct wtbl_raw *wtbl_raw;
1406         struct sta_rec_ht *sta_ht;
1407         struct wtbl_ht *wtbl_ht;
1408         int buf_len, ret, ntlv = 2;
1409         u32 msk, val = 0;
1410         u8 *buf;
1411
1412         buf = kzalloc(MT7615_WTBL_UPDATE_MAX_SIZE, GFP_KERNEL);
1413         if (!buf)
1414                 return -ENOMEM;
1415
1416         wtbl_hdr = (struct wtbl_req_hdr *)buf;
1417         wtbl_hdr->wlan_idx = msta->wcid.idx;
1418         wtbl_hdr->operation = WTBL_SET;
1419         buf_len = sizeof(*wtbl_hdr);
1420
1421         /* ht basic */
1422         wtbl_ht = (struct wtbl_ht *)(buf + buf_len);
1423         wtbl_ht->tag = cpu_to_le16(WTBL_HT);
1424         wtbl_ht->len = cpu_to_le16(sizeof(*wtbl_ht));
1425         wtbl_ht->ht = 1;
1426         wtbl_ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
1427         wtbl_ht->af = sta->ht_cap.ampdu_factor;
1428         wtbl_ht->mm = sta->ht_cap.ampdu_density;
1429         buf_len += sizeof(*wtbl_ht);
1430
1431         if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1432                 val |= MT_WTBL_W5_SHORT_GI_20;
1433         if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1434                 val |= MT_WTBL_W5_SHORT_GI_40;
1435
1436         /* vht basic */
1437         if (sta->vht_cap.vht_supported) {
1438                 struct wtbl_vht *wtbl_vht;
1439
1440                 wtbl_vht = (struct wtbl_vht *)(buf + buf_len);
1441                 buf_len += sizeof(*wtbl_vht);
1442                 wtbl_vht->tag = cpu_to_le16(WTBL_VHT);
1443                 wtbl_vht->len = cpu_to_le16(sizeof(*wtbl_vht));
1444                 wtbl_vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC;
1445                 wtbl_vht->vht = 1;
1446                 ntlv++;
1447
1448                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1449                         val |= MT_WTBL_W5_SHORT_GI_80;
1450                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1451                         val |= MT_WTBL_W5_SHORT_GI_160;
1452         }
1453
1454         /* smps */
1455         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1456                 struct wtbl_smps *wtbl_smps;
1457
1458                 wtbl_smps = (struct wtbl_smps *)(buf + buf_len);
1459                 buf_len += sizeof(*wtbl_smps);
1460                 wtbl_smps->tag = cpu_to_le16(WTBL_SMPS);
1461                 wtbl_smps->len = cpu_to_le16(sizeof(*wtbl_smps));
1462                 wtbl_smps->smps = 1;
1463                 ntlv++;
1464         }
1465
1466         /* sgi */
1467         msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1468               MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1469
1470         wtbl_raw = (struct wtbl_raw *)(buf + buf_len);
1471         buf_len += sizeof(*wtbl_raw);
1472         wtbl_raw->tag = cpu_to_le16(WTBL_RAW_DATA);
1473         wtbl_raw->len = cpu_to_le16(sizeof(*wtbl_raw));
1474         wtbl_raw->wtbl_idx = 1;
1475         wtbl_raw->dw = 5;
1476         wtbl_raw->msk = cpu_to_le32(~msk);
1477         wtbl_raw->val = cpu_to_le32(val);
1478
1479         wtbl_hdr->tlv_num = cpu_to_le16(ntlv);
1480         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1481                                   buf, buf_len, true);
1482         if (ret)
1483                 goto out;
1484
1485         memset(buf, 0, MT7615_WTBL_UPDATE_MAX_SIZE);
1486
1487         sta_hdr = (struct sta_req_hdr *)buf;
1488         sta_hdr->bss_idx = mvif->idx;
1489         sta_hdr->wlan_idx = msta->wcid.idx;
1490         sta_hdr->is_tlv_append = 1;
1491         ntlv = sta->vht_cap.vht_supported ? 2 : 1;
1492         sta_hdr->tlv_num = cpu_to_le16(ntlv);
1493         sta_hdr->muar_idx = mvif->omac_idx;
1494         buf_len = sizeof(*sta_hdr);
1495
1496         sta_ht = (struct sta_rec_ht *)(buf + buf_len);
1497         sta_ht->tag = cpu_to_le16(STA_REC_HT);
1498         sta_ht->len = cpu_to_le16(sizeof(*sta_ht));
1499         sta_ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1500         buf_len += sizeof(*sta_ht);
1501
1502         if (sta->vht_cap.vht_supported) {
1503                 struct sta_rec_vht *sta_vht;
1504
1505                 sta_vht = (struct sta_rec_vht *)(buf + buf_len);
1506                 buf_len += sizeof(*sta_vht);
1507                 sta_vht->tag = cpu_to_le16(STA_REC_VHT);
1508                 sta_vht->len = cpu_to_le16(sizeof(*sta_vht));
1509                 sta_vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1510                 sta_vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1511                 sta_vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1512         }
1513
1514         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1515                                   buf, buf_len, true);
1516 out:
1517         kfree(buf);
1518
1519         return ret;
1520 }
1521
1522 int mt7615_mcu_set_tx_ba(struct mt7615_dev *dev,
1523                          struct ieee80211_ampdu_params *params,
1524                          bool add)
1525 {
1526         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1527         struct mt7615_vif *mvif = msta->vif;
1528         struct {
1529                 struct wtbl_req_hdr hdr;
1530                 struct wtbl_ba ba;
1531         } wtbl_req = {
1532                 .hdr = {
1533                         .wlan_idx = msta->wcid.idx,
1534                         .operation = WTBL_SET,
1535                         .tlv_num = cpu_to_le16(1),
1536                 },
1537                 .ba = {
1538                         .tag = cpu_to_le16(WTBL_BA),
1539                         .len = cpu_to_le16(sizeof(struct wtbl_ba)),
1540                         .tid = params->tid,
1541                         .ba_type = MT_BA_TYPE_ORIGINATOR,
1542                         .sn = add ? cpu_to_le16(params->ssn) : 0,
1543                         .ba_en = add,
1544                 },
1545         };
1546         struct {
1547                 struct sta_req_hdr hdr;
1548                 struct sta_rec_ba ba;
1549         } sta_req = {
1550                 .hdr = {
1551                         .bss_idx = mvif->idx,
1552                         .wlan_idx = msta->wcid.idx,
1553                         .tlv_num = cpu_to_le16(1),
1554                         .is_tlv_append = 1,
1555                         .muar_idx = mvif->omac_idx,
1556                 },
1557                 .ba = {
1558                         .tag = cpu_to_le16(STA_REC_BA),
1559                         .len = cpu_to_le16(sizeof(struct sta_rec_ba)),
1560                         .tid = params->tid,
1561                         .ba_type = MT_BA_TYPE_ORIGINATOR,
1562                         .amsdu = params->amsdu,
1563                         .ba_en = add << params->tid,
1564                         .ssn = cpu_to_le16(params->ssn),
1565                         .winsize = cpu_to_le16(params->buf_size),
1566                 },
1567         };
1568         int ret;
1569
1570         if (add) {
1571                 u8 idx, ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1572
1573                 for (idx = 7; idx > 0; idx--) {
1574                         if (params->buf_size >= ba_range[idx])
1575                                 break;
1576                 }
1577
1578                 wtbl_req.ba.ba_winsize_idx = idx;
1579         }
1580
1581         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1582                                   &wtbl_req, sizeof(wtbl_req), true);
1583         if (ret)
1584                 return ret;
1585
1586         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1587                                    &sta_req, sizeof(sta_req), true);
1588 }
1589
1590 int mt7615_mcu_set_rx_ba(struct mt7615_dev *dev,
1591                          struct ieee80211_ampdu_params *params,
1592                          bool add)
1593 {
1594         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1595         struct mt7615_vif *mvif = msta->vif;
1596         struct {
1597                 struct wtbl_req_hdr hdr;
1598                 struct wtbl_ba ba;
1599         } wtbl_req = {
1600                 .hdr = {
1601                         .wlan_idx = msta->wcid.idx,
1602                         .operation = WTBL_SET,
1603                         .tlv_num = cpu_to_le16(1),
1604                 },
1605                 .ba = {
1606                         .tag = cpu_to_le16(WTBL_BA),
1607                         .len = cpu_to_le16(sizeof(struct wtbl_ba)),
1608                         .tid = params->tid,
1609                         .ba_type = MT_BA_TYPE_RECIPIENT,
1610                         .rst_ba_tid = params->tid,
1611                         .rst_ba_sel = RST_BA_MAC_TID_MATCH,
1612                         .rst_ba_sb = 1,
1613                 },
1614         };
1615         struct {
1616                 struct sta_req_hdr hdr;
1617                 struct sta_rec_ba ba;
1618         } sta_req = {
1619                 .hdr = {
1620                         .bss_idx = mvif->idx,
1621                         .wlan_idx = msta->wcid.idx,
1622                         .tlv_num = cpu_to_le16(1),
1623                         .is_tlv_append = 1,
1624                         .muar_idx = mvif->omac_idx,
1625                 },
1626                 .ba = {
1627                         .tag = cpu_to_le16(STA_REC_BA),
1628                         .len = cpu_to_le16(sizeof(struct sta_rec_ba)),
1629                         .tid = params->tid,
1630                         .ba_type = MT_BA_TYPE_RECIPIENT,
1631                         .amsdu = params->amsdu,
1632                         .ba_en = add << params->tid,
1633                         .ssn = cpu_to_le16(params->ssn),
1634                         .winsize = cpu_to_le16(params->buf_size),
1635                 },
1636         };
1637         int ret;
1638
1639         memcpy(wtbl_req.ba.peer_addr, params->sta->addr, ETH_ALEN);
1640
1641         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1642                                   &sta_req, sizeof(sta_req), true);
1643         if (ret || !add)
1644                 return ret;
1645
1646         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1647                                    &wtbl_req, sizeof(wtbl_req), true);
1648 }
1649
1650 void mt7615_mcu_set_rates(struct mt7615_dev *dev, struct mt7615_sta *sta,
1651                           struct ieee80211_tx_rate *probe_rate,
1652                           struct ieee80211_tx_rate *rates)
1653 {
1654         int wcid = sta->wcid.idx;
1655         u32 addr = MT_WTBL_BASE + wcid * MT_WTBL_ENTRY_SIZE;
1656         bool stbc = false;
1657         int n_rates = sta->n_rates;
1658         u8 bw, bw_prev, bw_idx = 0;
1659         u16 val[4];
1660         u16 probe_val;
1661         u32 w5, w27;
1662         int i;
1663
1664         if (!mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY, 0, 5000))
1665                 return;
1666
1667         for (i = n_rates; i < 4; i++)
1668                 rates[i] = rates[n_rates - 1];
1669
1670         val[0] = mt7615_mac_tx_rate_val(dev, &rates[0], stbc, &bw);
1671         bw_prev = bw;
1672
1673         if (probe_rate) {
1674                 probe_val = mt7615_mac_tx_rate_val(dev, probe_rate, stbc, &bw);
1675                 if (bw)
1676                         bw_idx = 1;
1677                 else
1678                         bw_prev = 0;
1679         } else {
1680                 probe_val = val[0];
1681         }
1682
1683         val[1] = mt7615_mac_tx_rate_val(dev, &rates[1], stbc, &bw);
1684         if (bw_prev) {
1685                 bw_idx = 3;
1686                 bw_prev = bw;
1687         }
1688
1689         val[2] = mt7615_mac_tx_rate_val(dev, &rates[2], stbc, &bw);
1690         if (bw_prev) {
1691                 bw_idx = 5;
1692                 bw_prev = bw;
1693         }
1694
1695         val[3] = mt7615_mac_tx_rate_val(dev, &rates[3], stbc, &bw);
1696         if (bw_prev)
1697                 bw_idx = 7;
1698
1699         w27 = mt76_rr(dev, addr + 27 * 4);
1700         w27 &= ~MT_WTBL_W27_CC_BW_SEL;
1701         w27 |= FIELD_PREP(MT_WTBL_W27_CC_BW_SEL, bw);
1702
1703         w5 = mt76_rr(dev, addr + 5 * 4);
1704         w5 &= ~(MT_WTBL_W5_BW_CAP | MT_WTBL_W5_CHANGE_BW_RATE);
1705         w5 |= FIELD_PREP(MT_WTBL_W5_BW_CAP, bw) |
1706               FIELD_PREP(MT_WTBL_W5_CHANGE_BW_RATE, bw_idx ? bw_idx - 1 : 7);
1707
1708         mt76_wr(dev, MT_WTBL_RIUCR0, w5);
1709
1710         mt76_wr(dev, MT_WTBL_RIUCR1,
1711                 FIELD_PREP(MT_WTBL_RIUCR1_RATE0, probe_val) |
1712                 FIELD_PREP(MT_WTBL_RIUCR1_RATE1, val[0]) |
1713                 FIELD_PREP(MT_WTBL_RIUCR1_RATE2_LO, val[0]));
1714
1715         mt76_wr(dev, MT_WTBL_RIUCR2,
1716                 FIELD_PREP(MT_WTBL_RIUCR2_RATE2_HI, val[0] >> 8) |
1717                 FIELD_PREP(MT_WTBL_RIUCR2_RATE3, val[1]) |
1718                 FIELD_PREP(MT_WTBL_RIUCR2_RATE4, val[1]) |
1719                 FIELD_PREP(MT_WTBL_RIUCR2_RATE5_LO, val[2]));
1720
1721         mt76_wr(dev, MT_WTBL_RIUCR3,
1722                 FIELD_PREP(MT_WTBL_RIUCR3_RATE5_HI, val[2] >> 4) |
1723                 FIELD_PREP(MT_WTBL_RIUCR3_RATE6, val[2]) |
1724                 FIELD_PREP(MT_WTBL_RIUCR3_RATE7, val[3]));
1725
1726         mt76_wr(dev, MT_WTBL_UPDATE,
1727                 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, wcid) |
1728                 MT_WTBL_UPDATE_RATE_UPDATE |
1729                 MT_WTBL_UPDATE_TX_COUNT_CLEAR);
1730
1731         mt76_wr(dev, addr + 27 * 4, w27);
1732
1733         if (!(sta->wcid.tx_info & MT_WCID_TX_INFO_SET))
1734                 mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY, 0, 5000);
1735
1736         sta->rate_count = 2 * MT7615_RATE_RETRY * n_rates;
1737         sta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
1738 }