drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 struct mt7615_patch_hdr {
  15         char build_date[16];
  16         char platform[4];
  17         __be32 hw_sw_ver;
  18         __be32 patch_ver;
  19         __be16 checksum;
  20 } __packed;
  21
  22 struct mt7615_fw_trailer {
  23         __le32 addr;
  24         u8 chip_id;
  25         u8 feature_set;
  26         u8 eco_code;
  27         char fw_ver[10];
  28         char build_date[15];
  29         __le32 len;
  30 } __packed;
  31
  32 #define MCU_PATCH_ADDRESS               0x80000
  33
  34 #define N9_REGION_NUM                   2
  35 #define CR4_REGION_NUM                  1
  36
  37 #define IMG_CRC_LEN                     4
  38
  39 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  40 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  41
  42 #define DL_MODE_ENCRYPT                 BIT(0)
  43 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  44 #define DL_MODE_RESET_SEC_IV            BIT(3)
  45 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  46 #define DL_MODE_NEED_RSP                BIT(31)
  47
  48 #define FW_START_OVERRIDE               BIT(0)
  49 #define FW_START_WORKING_PDA_CR4        BIT(2)
  50
  51 static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
  52                                  int cmd, int *wait_seq)
  53 {
  54         struct mt7615_mcu_txd *mcu_txd;
  55         u8 seq, q_idx, pkt_fmt;
  56         enum mt76_txq_id qid;
  57         u32 val;
  58         __le32 *txd;
  59
  60         seq = ++dev->mt76.mmio.mcu.msg_seq & 0xf;
  61         if (!seq)
  62                 seq = ++dev->mt76.mmio.mcu.msg_seq & 0xf;
  63
  64         mcu_txd = (struct mt7615_mcu_txd *)skb_push(skb,
  65                    sizeof(struct mt7615_mcu_txd));
  66         memset(mcu_txd, 0, sizeof(struct mt7615_mcu_txd));
  67
  68         if (cmd != -MCU_CMD_FW_SCATTER) {
  69                 q_idx = MT_TX_MCU_PORT_RX_Q0;
  70                 pkt_fmt = MT_TX_TYPE_CMD;
  71         } else {
  72                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
  73                 pkt_fmt = MT_TX_TYPE_FW;
  74         }
  75
  76         txd = mcu_txd->txd;
  77
  78         val = FIELD_PREP(MT_TXD0_TX_BYTES, cpu_to_le16(skb->len)) |
  79               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
  80               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
  81         txd[0] = cpu_to_le32(val);
  82
  83         val = MT_TXD1_LONG_FORMAT |
  84               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
  85               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
  86         txd[1] = cpu_to_le32(val);
  87
  88         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
  89         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
  90         mcu_txd->pkt_type = MCU_PKT_ID;
  91         mcu_txd->seq = seq;
  92
  93         if (cmd < 0) {
  94                 mcu_txd->set_query = MCU_Q_NA;
  95                 mcu_txd->cid = -cmd;
  96         } else {
  97                 mcu_txd->cid = MCU_CMD_EXT_CID;
  98                 mcu_txd->set_query = MCU_Q_SET;
  99                 mcu_txd->ext_cid = cmd;
 100                 mcu_txd->ext_cid_ack = 1;
 101         }
 102         mcu_txd->s2d_index = MCU_S2D_H2N;
 103
 104         if (wait_seq)
 105                 *wait_seq = seq;
 106
 107         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mt76.state))
 108                 qid = MT_TXQ_MCU;
 109         else
 110                 qid = MT_TXQ_FWDL;
 111
 112         return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
 113 }
 114
 115 static int
 116 mt7615_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
 117                     int len, bool wait_resp)
 118 {
 119         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 120         unsigned long expires = jiffies + 10 * HZ;
 121         struct mt7615_mcu_rxd *rxd;
 122         struct sk_buff *skb;
 123         int ret, seq;
 124
 125         skb = mt7615_mcu_msg_alloc(data, len);
 126         if (!skb)
 127                 return -ENOMEM;
 128
 129         mutex_lock(&mdev->mmio.mcu.mutex);
 130
 131         ret = __mt7615_mcu_msg_send(dev, skb, cmd, &seq);
 132         if (ret)
 133                 goto out;
 134
 135         while (wait_resp) {
 136                 skb = mt76_mcu_get_response(mdev, expires);
 137                 if (!skb) {
 138                         dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
 139                                 cmd, seq);
 140                         ret = -ETIMEDOUT;
 141                         break;
 142                 }
 143
 144                 rxd = (struct mt7615_mcu_rxd *)skb->data;
 145                 if (seq != rxd->seq)
 146                         continue;
 147
 148                 if (cmd == -MCU_CMD_PATCH_SEM_CONTROL) {
 149                         skb_pull(skb, sizeof(*rxd) - 4);
 150                         ret = *skb->data;
 151                 }
 152                 dev_kfree_skb(skb);
 153                 break;
 154         }
 155
 156 out:
 157         mutex_unlock(&mdev->mmio.mcu.mutex);
 158
 159         return ret;
 160 }
 161
 162 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
 163                                     u32 len, u32 mode)
 164 {
 165         struct {
 166                 __le32 addr;
 167                 __le32 len;
 168                 __le32 mode;
 169         } req = {
 170                 .addr = cpu_to_le32(addr),
 171                 .len = cpu_to_le32(len),
 172                 .mode = cpu_to_le32(mode),
 173         };
 174
 175         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_TARGET_ADDRESS_LEN_REQ,
 176                                    &req, sizeof(req), true);
 177 }
 178
 179 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
 180                                     int len)
 181 {
 182         int ret = 0, cur_len;
 183
 184         while (len > 0) {
 185                 cur_len = min_t(int, 4096 - sizeof(struct mt7615_mcu_txd),
 186                                 len);
 187
 188                 ret = __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_SCATTER,
 189                                           data, cur_len, false);
 190                 if (ret)
 191                         break;
 192
 193                 data += cur_len;
 194                 len -= cur_len;
 195         }
 196
 197         return ret;
 198 }
 199
 200 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
 201                                      u32 option)
 202 {
 203         struct {
 204                 __le32 option;
 205                 __le32 addr;
 206         } req = {
 207                 .option = cpu_to_le32(option),
 208                 .addr = cpu_to_le32(addr),
 209         };
 210
 211         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ,
 212                                    &req, sizeof(req), true);
 213 }
 214
 215 static int mt7615_mcu_restart(struct mt76_dev *dev)
 216 {
 217         return __mt76_mcu_send_msg(dev, -MCU_CMD_RESTART_DL_REQ, NULL,
 218                                    0, true);
 219 }
 220
 221 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
 222 {
 223         struct {
 224                 __le32 op;
 225         } req = {
 226                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
 227         };
 228
 229         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL,
 230                                    &req, sizeof(req), true);
 231 }
 232
 233 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
 234 {
 235         struct {
 236                 u8 check_crc;
 237                 u8 reserved[3];
 238         } req = {
 239                 .check_crc = 0,
 240         };
 241
 242         return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ,
 243                                    &req, sizeof(req), true);
 244 }
 245
 246 static int mt7615_driver_own(struct mt7615_dev *dev)
 247 {
 248         mt76_wr(dev, MT_CFG_LPCR_HOST, MT_CFG_LPCR_HOST_DRV_OWN);
 249         if (!mt76_poll_msec(dev, MT_CFG_LPCR_HOST,
 250                             MT_CFG_LPCR_HOST_FW_OWN, 0, 500)) {
 251                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
 252                 return -EIO;
 253         }
 254
 255         return 0;
 256 }
 257
 258 static int mt7615_load_patch(struct mt7615_dev *dev)
 259 {
 260         const struct firmware *fw;
 261         const struct mt7615_patch_hdr *hdr;
 262         const char *firmware = MT7615_ROM_PATCH;
 263         int len, ret, sem;
 264
 265         sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
 266         switch (sem) {
 267         case PATCH_IS_DL:
 268                 return 0;
 269         case PATCH_NOT_DL_SEM_SUCCESS:
 270                 break;
 271         default:
 272                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
 273                 return -EAGAIN;
 274         }
 275
 276         ret = request_firmware(&fw, firmware, dev->mt76.dev);
 277         if (ret)
 278                 return ret;
 279
 280         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
 281                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 282                 ret = -EINVAL;
 283                 goto out;
 284         }
 285
 286         hdr = (const struct mt7615_patch_hdr *)(fw->data);
 287
 288         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
 289                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
 290
 291         len = fw->size - sizeof(*hdr);
 292
 293         ret = mt7615_mcu_init_download(dev, MCU_PATCH_ADDRESS, len,
 294                                        DL_MODE_NEED_RSP);
 295         if (ret) {
 296                 dev_err(dev->mt76.dev, "Download request failed\n");
 297                 goto out;
 298         }
 299
 300         ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
 301         if (ret) {
 302                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
 303                 goto out;
 304         }
 305
 306         ret = mt7615_mcu_start_patch(dev);
 307         if (ret)
 308                 dev_err(dev->mt76.dev, "Failed to start patch\n");
 309
 310 out:
 311         release_firmware(fw);
 312
 313         sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
 314         switch (sem) {
 315         case PATCH_REL_SEM_SUCCESS:
 316                 break;
 317         default:
 318                 ret = -EAGAIN;
 319                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
 320                 break;
 321         }
 322
 323         return ret;
 324 }
 325
 326 static u32 gen_dl_mode(u8 feature_set, bool is_cr4)
 327 {
 328         u32 ret = 0;
 329
 330         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
 331                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
 332         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
 333                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
 334         ret |= DL_MODE_NEED_RSP;
 335         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
 336
 337         return ret;
 338 }
 339
 340 static int mt7615_load_ram(struct mt7615_dev *dev)
 341 {
 342         const struct firmware *fw;
 343         const struct mt7615_fw_trailer *hdr;
 344         const char *n9_firmware = MT7615_FIRMWARE_N9;
 345         const char *cr4_firmware = MT7615_FIRMWARE_CR4;
 346         u32 n9_ilm_addr, offset;
 347         int i, ret;
 348
 349         ret = request_firmware(&fw, n9_firmware, dev->mt76.dev);
 350         if (ret)
 351                 return ret;
 352
 353         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
 354                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 355                 ret = -EINVAL;
 356                 goto out;
 357         }
 358
 359         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
 360                                         N9_REGION_NUM * sizeof(*hdr));
 361
 362         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
 363                  hdr->fw_ver, hdr->build_date);
 364
 365         n9_ilm_addr = le32_to_cpu(hdr->addr);
 366
 367         for (offset = 0, i = 0; i < N9_REGION_NUM; i++) {
 368                 u32 len, addr, mode;
 369
 370                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
 371                 addr = le32_to_cpu(hdr[i].addr);
 372                 mode = gen_dl_mode(hdr[i].feature_set, false);
 373
 374                 ret = mt7615_mcu_init_download(dev, addr, len, mode);
 375                 if (ret) {
 376                         dev_err(dev->mt76.dev, "Download request failed\n");
 377                         goto out;
 378                 }
 379
 380                 ret = mt7615_mcu_send_firmware(dev, fw->data + offset, len);
 381                 if (ret) {
 382                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
 383                         goto out;
 384                 }
 385
 386                 offset += len;
 387         }
 388
 389         ret = mt7615_mcu_start_firmware(dev, n9_ilm_addr, FW_START_OVERRIDE);
 390         if (ret) {
 391                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
 392                 goto out;
 393         }
 394
 395         release_firmware(fw);
 396
 397         ret = request_firmware(&fw, cr4_firmware, dev->mt76.dev);
 398         if (ret)
 399                 return ret;
 400
 401         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
 402                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 403                 ret = -EINVAL;
 404                 goto out;
 405         }
 406
 407         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
 408                                         CR4_REGION_NUM * sizeof(*hdr));
 409
 410         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
 411                  hdr->fw_ver, hdr->build_date);
 412
 413         for (offset = 0, i = 0; i < CR4_REGION_NUM; i++) {
 414                 u32 len, addr, mode;
 415
 416                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
 417                 addr = le32_to_cpu(hdr[i].addr);
 418                 mode = gen_dl_mode(hdr[i].feature_set, true);
 419
 420                 ret = mt7615_mcu_init_download(dev, addr, len, mode);
 421                 if (ret) {
 422                         dev_err(dev->mt76.dev, "Download request failed\n");
 423                         goto out;
 424                 }
 425
 426                 ret = mt7615_mcu_send_firmware(dev, fw->data + offset, len);
 427                 if (ret) {
 428                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
 429                         goto out;
 430                 }
 431
 432                 offset += len;
 433         }
 434
 435         ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
 436         if (ret)
 437                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
 438
 439 out:
 440         release_firmware(fw);
 441
 442         return ret;
 443 }
 444
 445 static int mt7615_load_firmware(struct mt7615_dev *dev)
 446 {
 447         int ret;
 448         u32 val;
 449
 450         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
 451
 452         if (val != FW_STATE_FW_DOWNLOAD) {
 453                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
 454                 return -EIO;
 455         }
 456
 457         ret = mt7615_load_patch(dev);
 458         if (ret)
 459                 return ret;
 460
 461         ret = mt7615_load_ram(dev);
 462         if (ret)
 463                 return ret;
 464
 465         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
 466                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
 467                                        FW_STATE_CR4_RDY), 500)) {
 468                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
 469                 return -EIO;
 470         }
 471
 472         dev_dbg(dev->mt76.dev, "Firmware init done\n");
 473
 474         return 0;
 475 }
 476
 477 int mt7615_mcu_init(struct mt7615_dev *dev)
 478 {
 479         static const struct mt76_mcu_ops mt7615_mcu_ops = {
 480                 .mcu_send_msg = mt7615_mcu_msg_send,
 481                 .mcu_restart = mt7615_mcu_restart,
 482         };
 483         int ret;
 484
 485         dev->mt76.mcu_ops = &mt7615_mcu_ops,
 486
 487         ret = mt7615_driver_own(dev);
 488         if (ret)
 489                 return ret;
 490
 491         ret = mt7615_load_firmware(dev);
 492         if (ret)
 493                 return ret;
 494
 495         set_bit(MT76_STATE_MCU_RUNNING, &dev->mt76.state);
 496
 497         return 0;
 498 }
 499
 500 void mt7615_mcu_exit(struct mt7615_dev *dev)
 501 {
 502         __mt76_mcu_restart(&dev->mt76);
 503         mt76_wr(dev, MT_CFG_LPCR_HOST, MT_CFG_LPCR_HOST_FW_OWN);
 504         skb_queue_purge(&dev->mt76.mmio.mcu.res_q);
 505 }
 506
 507 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
 508 {
 509         struct {
 510                 u8 buffer_mode;
 511                 u8 pad;
 512                 u16 len;
 513         } __packed req_hdr = {
 514                 .buffer_mode = 1,
 515                 .len = __MT_EE_MAX - MT_EE_NIC_CONF_0,
 516         };
 517         int ret, len = sizeof(req_hdr) + __MT_EE_MAX - MT_EE_NIC_CONF_0;
 518         u8 *req, *eep = (u8 *)dev->mt76.eeprom.data;
 519
 520         req = kzalloc(len, GFP_KERNEL);
 521         if (!req)
 522                 return -ENOMEM;
 523
 524         memcpy(req, &req_hdr, sizeof(req_hdr));
 525         memcpy(req + sizeof(req_hdr), eep + MT_EE_NIC_CONF_0,
 526                __MT_EE_MAX - MT_EE_NIC_CONF_0);
 527
 528         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
 529                                   req, len, true);
 530         kfree(req);
 531
 532         return ret;
 533 }
 534
 535 int mt7615_mcu_init_mac(struct mt7615_dev *dev)
 536 {
 537         struct {
 538                 u8 enable;
 539                 u8 band;
 540                 u8 rsv[2];
 541         } __packed req = {
 542                 .enable = 1,
 543                 .band = 0,
 544         };
 545
 546         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
 547                                    &req, sizeof(req), true);
 548 }
 549
 550 int mt7615_mcu_set_rts_thresh(struct mt7615_dev *dev, u32 val)
 551 {
 552         struct {
 553                 u8 prot_idx;
 554                 u8 band;
 555                 u8 rsv[2];
 556                 __le32 len_thresh;
 557                 __le32 pkt_thresh;
 558         } __packed req = {
 559                 .prot_idx = 1,
 560                 .band = 0,
 561                 .len_thresh = cpu_to_le32(val),
 562                 .pkt_thresh = cpu_to_le32(0x2),
 563         };
 564
 565         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
 566                                    &req, sizeof(req), true);
 567 }
 568
 569 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
 570                        const struct ieee80211_tx_queue_params *params)
 571 {
 572 #define WMM_AIFS_SET    BIT(0)
 573 #define WMM_CW_MIN_SET  BIT(1)
 574 #define WMM_CW_MAX_SET  BIT(2)
 575 #define WMM_TXOP_SET    BIT(3)
 576         struct req_data {
 577                 u8 number;
 578                 u8 rsv[3];
 579                 u8 queue;
 580                 u8 valid;
 581                 u8 aifs;
 582                 u8 cw_min;
 583                 __le16 cw_max;
 584                 __le16 txop;
 585         } __packed req = {
 586                 .number = 1,
 587                 .queue = queue,
 588                 .valid = WMM_AIFS_SET | WMM_TXOP_SET,
 589                 .aifs = params->aifs,
 590                 .txop = cpu_to_le16(params->txop),
 591         };
 592
 593         if (params->cw_min) {
 594                 req.valid |= WMM_CW_MIN_SET;
 595                 req.cw_min = params->cw_min;
 596         }
 597         if (params->cw_max) {
 598                 req.valid |= WMM_CW_MAX_SET;
 599                 req.cw_max = cpu_to_le16(params->cw_max);
 600         }
 601
 602         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
 603                                    &req, sizeof(req), true);
 604 }
 605
 606 int mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int enter)
 607 {
 608 #define ENTER_PM_STATE  1
 609 #define EXIT_PM_STATE   2
 610         struct {
 611                 u8 pm_number;
 612                 u8 pm_state;
 613                 u8 bssid[ETH_ALEN];
 614                 u8 dtim_period;
 615                 u8 wlan_idx;
 616                 __le16 bcn_interval;
 617                 __le32 aid;
 618                 __le32 rx_filter;
 619                 u8 band_idx;
 620                 u8 rsv[3];
 621                 __le32 feature;
 622                 u8 omac_idx;
 623                 u8 wmm_idx;
 624                 u8 bcn_loss_cnt;
 625                 u8 bcn_sp_duration;
 626         } __packed req = {
 627                 .pm_number = 5,
 628                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
 629                 .band_idx = 0,
 630         };
 631
 632         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
 633                                    &req, sizeof(req), true);
 634 }
 635
 636 int mt7615_mcu_set_dev_info(struct mt7615_dev *dev,
 637                             struct ieee80211_vif *vif, bool enable)
 638 {
 639         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 640         struct {
 641                 struct req_hdr {
 642                         u8 omac_idx;
 643                         u8 band_idx;
 644                         __le16 tlv_num;
 645                         u8 is_tlv_append;
 646                         u8 rsv[3];
 647                 } __packed hdr;
 648                 struct req_tlv {
 649                         __le16 tag;
 650                         __le16 len;
 651                         u8 active;
 652                         u8 band_idx;
 653                         u8 omac_addr[ETH_ALEN];
 654                 } __packed tlv;
 655         } data = {
 656                 .hdr = {
 657                         .omac_idx = mvif->omac_idx,
 658                         .band_idx = mvif->band_idx,
 659                         .tlv_num = cpu_to_le16(1),
 660                         .is_tlv_append = 1,
 661                 },
 662                 .tlv = {
 663                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 664                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 665                         .active = enable,
 666                         .band_idx = mvif->band_idx,
 667                 },
 668         };
 669
 670         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 671         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 672                                    &data, sizeof(data), true);
 673 }
 674
 675 static void
 676 mt7615_mcu_bss_info_omac_header(struct mt7615_vif *mvif, u8 *data,
 677                                 u32 conn_type)
 678 {
 679         struct bss_info_omac *hdr = (struct bss_info_omac *)data;
 680         u8 idx;
 681
 682         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 683         hdr->tag = cpu_to_le16(BSS_INFO_OMAC);
 684         hdr->len = cpu_to_le16(sizeof(struct bss_info_omac));
 685         hdr->hw_bss_idx = idx;
 686         hdr->omac_idx = mvif->omac_idx;
 687         hdr->band_idx = mvif->band_idx;
 688         hdr->conn_type = cpu_to_le32(conn_type);
 689 }
 690
 691 static void
 692 mt7615_mcu_bss_info_basic_header(struct ieee80211_vif *vif, u8 *data,
 693                                  u32 net_type, u8 tx_wlan_idx,
 694                                  bool enable)
 695 {
 696         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 697         struct bss_info_basic *hdr = (struct bss_info_basic *)data;
 698
 699         hdr->tag = cpu_to_le16(BSS_INFO_BASIC);
 700         hdr->len = cpu_to_le16(sizeof(struct bss_info_basic));
 701         hdr->network_type = cpu_to_le32(net_type);
 702         hdr->active = enable;
 703         hdr->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 704         memcpy(hdr->bssid, vif->bss_conf.bssid, ETH_ALEN);
 705         hdr->wmm_idx = mvif->wmm_idx;
 706         hdr->dtim_period = vif->bss_conf.dtim_period;
 707         hdr->bmc_tx_wlan_idx = tx_wlan_idx;
 708 }
 709
 710 static void
 711 mt7615_mcu_bss_info_ext_header(struct mt7615_vif *mvif, u8 *data)
 712 {
 713 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 714 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 715         struct bss_info_ext_bss *hdr = (struct bss_info_ext_bss *)data;
 716         int ext_bss_idx, tsf_offset;
 717
 718         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 719         if (ext_bss_idx < 0)
 720                 return;
 721
 722         hdr->tag = cpu_to_le16(BSS_INFO_EXT_BSS);
 723         hdr->len = cpu_to_le16(sizeof(struct bss_info_ext_bss));
 724         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 725         hdr->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 726 }
 727
 728 int mt7615_mcu_set_bss_info(struct mt7615_dev *dev,
 729                             struct ieee80211_vif *vif, int en)
 730 {
 731         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 732         struct req_hdr {
 733                 u8 bss_idx;
 734                 u8 rsv0;
 735                 __le16 tlv_num;
 736                 u8 is_tlv_append;
 737                 u8 rsv1[3];
 738         } __packed;
 739         int len = sizeof(struct req_hdr) + sizeof(struct bss_info_basic);
 740         int ret, i, features = BIT(BSS_INFO_BASIC), ntlv = 1;
 741         u32 conn_type = 0, net_type = NETWORK_INFRA;
 742         u8 *buf, *data, tx_wlan_idx = 0;
 743         struct req_hdr *hdr;
 744
 745         if (en) {
 746                 len += sizeof(struct bss_info_omac);
 747                 features |= BIT(BSS_INFO_OMAC);
 748                 if (mvif->omac_idx > EXT_BSSID_START) {
 749                         len += sizeof(struct bss_info_ext_bss);
 750                         features |= BIT(BSS_INFO_EXT_BSS);
 751                         ntlv++;
 752                 }
 753                 ntlv++;
 754         }
 755
 756         switch (vif->type) {
 757         case NL80211_IFTYPE_AP:
 758         case NL80211_IFTYPE_MESH_POINT:
 759                 tx_wlan_idx = mvif->sta.wcid.idx;
 760                 conn_type = CONNECTION_INFRA_AP;
 761                 break;
 762         case NL80211_IFTYPE_STATION: {
 763                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 764                 if (en) {
 765                         struct ieee80211_sta *sta;
 766                         struct mt7615_sta *msta;
 767
 768                         rcu_read_lock();
 769                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 770                         if (!sta) {
 771                                 rcu_read_unlock();
 772                                 return -EINVAL;
 773                         }
 774
 775                         msta = (struct mt7615_sta *)sta->drv_priv;
 776                         tx_wlan_idx = msta->wcid.idx;
 777                         rcu_read_unlock();
 778                 }
 779                 conn_type = CONNECTION_INFRA_STA;
 780                 break;
 781         }
 782         default:
 783                 WARN_ON(1);
 784                 break;
 785         }
 786
 787         buf = kzalloc(len, GFP_KERNEL);
 788         if (!buf)
 789                 return -ENOMEM;
 790
 791         hdr = (struct req_hdr *)buf;
 792         hdr->bss_idx = mvif->idx;
 793         hdr->tlv_num = cpu_to_le16(ntlv);
 794         hdr->is_tlv_append = 1;
 795
 796         data = buf + sizeof(*hdr);
 797         for (i = 0; i < BSS_INFO_MAX_NUM; i++) {
 798                 int tag = ffs(features & BIT(i)) - 1;
 799
 800                 switch (tag) {
 801                 case BSS_INFO_OMAC:
 802                         mt7615_mcu_bss_info_omac_header(mvif, data,
 803                                                         conn_type);
 804                         data += sizeof(struct bss_info_omac);
 805                         break;
 806                 case BSS_INFO_BASIC:
 807                         mt7615_mcu_bss_info_basic_header(vif, data, net_type,
 808                                                          tx_wlan_idx, en);
 809                         data += sizeof(struct bss_info_basic);
 810                         break;
 811                 case BSS_INFO_EXT_BSS:
 812                         mt7615_mcu_bss_info_ext_header(mvif, data);
 813                         data += sizeof(struct bss_info_ext_bss);
 814                         break;
 815                 default:
 816                         break;
 817                 }
 818         }
 819
 820         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BSS_INFO_UPDATE,
 821                                   buf, len, true);
 822         kfree(buf);
 823
 824         return ret;
 825 }
 826
 827 static enum mt7615_cipher_type
 828 mt7615_get_key_info(struct ieee80211_key_conf *key, u8 *key_data)
 829 {
 830         if (!key || key->keylen > 32)
 831                 return MT_CIPHER_NONE;
 832
 833         memcpy(key_data, key->key, key->keylen);
 834
 835         switch (key->cipher) {
 836         case WLAN_CIPHER_SUITE_WEP40:
 837                 return MT_CIPHER_WEP40;
 838         case WLAN_CIPHER_SUITE_WEP104:
 839                 return MT_CIPHER_WEP104;
 840         case WLAN_CIPHER_SUITE_TKIP:
 841                 /* Rx/Tx MIC keys are swapped */
 842                 memcpy(key_data + 16, key->key + 24, 8);
 843                 memcpy(key_data + 24, key->key + 16, 8);
 844                 return MT_CIPHER_TKIP;
 845         case WLAN_CIPHER_SUITE_CCMP:
 846                 return MT_CIPHER_AES_CCMP;
 847         case WLAN_CIPHER_SUITE_CCMP_256:
 848                 return MT_CIPHER_CCMP_256;
 849         case WLAN_CIPHER_SUITE_GCMP:
 850                 return MT_CIPHER_GCMP;
 851         case WLAN_CIPHER_SUITE_GCMP_256:
 852                 return MT_CIPHER_GCMP_256;
 853         case WLAN_CIPHER_SUITE_SMS4:
 854                 return MT_CIPHER_WAPI;
 855         default:
 856                 return MT_CIPHER_NONE;
 857         }
 858 }
 859
 860 int mt7615_mcu_set_wtbl_key(struct mt7615_dev *dev, int wcid,
 861                             struct ieee80211_key_conf *key,
 862                             enum set_key_cmd cmd)
 863 {
 864         struct {
 865                 struct wtbl_req_hdr hdr;
 866                 struct wtbl_sec_key key;
 867         } req = {
 868                 .hdr = {
 869                         .wlan_idx = wcid,
 870                         .operation = WTBL_SET,
 871                         .tlv_num = cpu_to_le16(1),
 872                 },
 873                 .key = {
 874                         .tag = cpu_to_le16(WTBL_SEC_KEY),
 875                         .len = cpu_to_le16(sizeof(struct wtbl_sec_key)),
 876                         .add = cmd,
 877                 },
 878         };
 879
 880         if (cmd == SET_KEY) {
 881                 u8 cipher;
 882
 883                 cipher = mt7615_get_key_info(key, req.key.key_material);
 884                 if (cipher == MT_CIPHER_NONE)
 885                         return -EOPNOTSUPP;
 886
 887                 req.key.rkv = 1;
 888                 req.key.cipher_id = cipher;
 889                 req.key.key_id = key->keyidx;
 890                 req.key.key_len = key->keylen;
 891         } else {
 892                 req.key.key_len = sizeof(req.key.key_material);
 893         }
 894
 895         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 896                                    &req, sizeof(req), true);
 897 }
 898
 899 static int
 900 mt7615_mcu_add_wtbl_bmc(struct mt7615_dev *dev,
 901                         struct mt7615_vif *mvif)
 902 {
 903         struct {
 904                 struct wtbl_req_hdr hdr;
 905                 struct wtbl_generic g_wtbl;
 906                 struct wtbl_rx rx_wtbl;
 907         } req = {
 908                 .hdr = {
 909                         .wlan_idx = mvif->sta.wcid.idx,
 910                         .operation = WTBL_RESET_AND_SET,
 911                         .tlv_num = cpu_to_le16(2),
 912                 },
 913                 .g_wtbl = {
 914                         .tag = cpu_to_le16(WTBL_GENERIC),
 915                         .len = cpu_to_le16(sizeof(struct wtbl_generic)),
 916                         .muar_idx = 0xe,
 917                 },
 918                 .rx_wtbl = {
 919                         .tag = cpu_to_le16(WTBL_RX),
 920                         .len = cpu_to_le16(sizeof(struct wtbl_rx)),
 921                         .rca1 = 1,
 922                         .rca2 = 1,
 923                         .rv = 1,
 924                 },
 925         };
 926         eth_broadcast_addr(req.g_wtbl.peer_addr);
 927
 928         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 929                                    &req, sizeof(req), true);
 930 }
 931
 932 int mt7615_mcu_wtbl_bmc(struct mt7615_dev *dev,
 933                         struct ieee80211_vif *vif, bool enable)
 934 {
 935         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 936
 937         if (!enable) {
 938                 struct wtbl_req_hdr req = {
 939                         .wlan_idx = mvif->sta.wcid.idx,
 940                         .operation = WTBL_RESET_AND_SET,
 941                 };
 942
 943                 return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 944                                            &req, sizeof(req), true);
 945         }
 946
 947         return mt7615_mcu_add_wtbl_bmc(dev, mvif);
 948 }
 949
 950 int mt7615_mcu_add_wtbl(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 951                         struct ieee80211_sta *sta)
 952 {
 953         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 954         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
 955         struct {
 956                 struct wtbl_req_hdr hdr;
 957                 struct wtbl_generic g_wtbl;
 958                 struct wtbl_rx rx_wtbl;
 959         } req = {
 960                 .hdr = {
 961                         .wlan_idx = msta->wcid.idx,
 962                         .operation = WTBL_RESET_AND_SET,
 963                         .tlv_num = cpu_to_le16(2),
 964                 },
 965                 .g_wtbl = {
 966                         .tag = cpu_to_le16(WTBL_GENERIC),
 967                         .len = cpu_to_le16(sizeof(struct wtbl_generic)),
 968                         .muar_idx = mvif->omac_idx,
 969                         .qos = sta->wme,
 970                         .partial_aid = cpu_to_le16(sta->aid),
 971                 },
 972                 .rx_wtbl = {
 973                         .tag = cpu_to_le16(WTBL_RX),
 974                         .len = cpu_to_le16(sizeof(struct wtbl_rx)),
 975                         .rca1 = vif->type != NL80211_IFTYPE_AP,
 976                         .rca2 = 1,
 977                         .rv = 1,
 978                 },
 979         };
 980         memcpy(req.g_wtbl.peer_addr, sta->addr, ETH_ALEN);
 981
 982         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 983                                    &req, sizeof(req), true);
 984 }
 985
 986 int mt7615_mcu_del_wtbl(struct mt7615_dev *dev,
 987                         struct ieee80211_sta *sta)
 988 {
 989         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
 990         struct wtbl_req_hdr req = {
 991                 .wlan_idx = msta->wcid.idx,
 992                 .operation = WTBL_RESET_AND_SET,
 993         };
 994
 995         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
 996                                    &req, sizeof(req), true);
 997 }
 998
 999 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1000 {
1001         struct wtbl_req_hdr req = {
1002                 .operation = WTBL_RESET_ALL,
1003         };
1004
1005         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1006                                    &req, sizeof(req), true);
1007 }
1008
1009 int mt7615_mcu_set_sta_rec_bmc(struct mt7615_dev *dev,
1010                                struct ieee80211_vif *vif, bool en)
1011 {
1012         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1013         struct {
1014                 struct sta_req_hdr hdr;
1015                 struct sta_rec_basic basic;
1016         } req = {
1017                 .hdr = {
1018                         .bss_idx = mvif->idx,
1019                         .wlan_idx = mvif->sta.wcid.idx,
1020                         .tlv_num = cpu_to_le16(1),
1021                         .is_tlv_append = 1,
1022                         .muar_idx = mvif->omac_idx,
1023                 },
1024                 .basic = {
1025                         .tag = cpu_to_le16(STA_REC_BASIC),
1026                         .len = cpu_to_le16(sizeof(struct sta_rec_basic)),
1027                         .conn_type = cpu_to_le32(CONNECTION_INFRA_BC),
1028                 },
1029         };
1030         eth_broadcast_addr(req.basic.peer_addr);
1031
1032         if (en) {
1033                 req.basic.conn_state = CONN_STATE_PORT_SECURE;
1034                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER |
1035                                                    EXTRA_INFO_NEW);
1036         } else {
1037                 req.basic.conn_state = CONN_STATE_DISCONNECT;
1038                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER);
1039         }
1040
1041         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1042                                    &req, sizeof(req), true);
1043 }
1044
1045 int mt7615_mcu_set_sta_rec(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1046                            struct ieee80211_sta *sta, bool en)
1047 {
1048         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1049         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1050
1051         struct {
1052                 struct sta_req_hdr hdr;
1053                 struct sta_rec_basic basic;
1054         } req = {
1055                 .hdr = {
1056                         .bss_idx = mvif->idx,
1057                         .wlan_idx = msta->wcid.idx,
1058                         .tlv_num = cpu_to_le16(1),
1059                         .is_tlv_append = 1,
1060                         .muar_idx = mvif->omac_idx,
1061                 },
1062                 .basic = {
1063                         .tag = cpu_to_le16(STA_REC_BASIC),
1064                         .len = cpu_to_le16(sizeof(struct sta_rec_basic)),
1065                         .qos = sta->wme,
1066                         .aid = cpu_to_le16(sta->aid),
1067                 },
1068         };
1069         memcpy(req.basic.peer_addr, sta->addr, ETH_ALEN);
1070
1071         switch (vif->type) {
1072         case NL80211_IFTYPE_AP:
1073         case NL80211_IFTYPE_MESH_POINT:
1074                 req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1075                 break;
1076         case NL80211_IFTYPE_STATION:
1077                 req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1078                 break;
1079         default:
1080                 WARN_ON(1);
1081                 break;
1082         };
1083
1084         if (en) {
1085                 req.basic.conn_state = CONN_STATE_PORT_SECURE;
1086                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER |
1087                                                    EXTRA_INFO_NEW);
1088         } else {
1089                 req.basic.conn_state = CONN_STATE_DISCONNECT;
1090                 req.basic.extra_info = cpu_to_le16(EXTRA_INFO_VER);
1091         }
1092
1093         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1094                                    &req, sizeof(req), true);
1095 }
1096
1097 int mt7615_mcu_set_bcn(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1098                        int en)
1099 {
1100         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1101         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1102         struct req {
1103                 u8 omac_idx;
1104                 u8 enable;
1105                 u8 wlan_idx;
1106                 u8 band_idx;
1107                 u8 pkt_type;
1108                 u8 need_pre_tbtt_int;
1109                 __le16 csa_ie_pos;
1110                 __le16 pkt_len;
1111                 __le16 tim_ie_pos;
1112                 u8 pkt[512];
1113                 u8 csa_cnt;
1114                 /* bss color change */
1115                 u8 bcc_cnt;
1116                 __le16 bcc_ie_pos;
1117         } __packed req = {
1118                 .omac_idx = mvif->omac_idx,
1119                 .enable = en,
1120                 .wlan_idx = wcid->idx,
1121                 .band_idx = mvif->band_idx,
1122                 /* pky_type: 0 for bcn, 1 for tim */
1123                 .pkt_type = 0,
1124         };
1125         struct sk_buff *skb;
1126         u16 tim_off;
1127
1128         skb = ieee80211_beacon_get_tim(mt76_hw(dev), vif, &tim_off, NULL);
1129         if (!skb)
1130                 return -EINVAL;
1131
1132         if (skb->len > 512 - MT_TXD_SIZE) {
1133                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
1134                 dev_kfree_skb(skb);
1135                 return -EINVAL;
1136         }
1137
1138         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
1139                               0, NULL);
1140         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
1141         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1142         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + tim_off);
1143
1144         dev_kfree_skb(skb);
1145
1146         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD,
1147                                    &req, sizeof(req), true);
1148 }
1149
1150 int mt7615_mcu_set_tx_power(struct mt7615_dev *dev)
1151 {
1152         int i, ret, n_chains = hweight8(dev->mt76.antenna_mask);
1153         struct cfg80211_chan_def *chandef = &dev->mt76.chandef;
1154         int freq = chandef->center_freq1, len, target_chains;
1155         u8 *req, *data, *eep = (u8 *)dev->mt76.eeprom.data;
1156         enum nl80211_band band = chandef->chan->band;
1157         struct ieee80211_hw *hw = mt76_hw(dev);
1158         struct {
1159                 u8 center_chan;
1160                 u8 dbdc_idx;
1161                 u8 band;
1162                 u8 rsv;
1163         } __packed req_hdr = {
1164                 .center_chan = ieee80211_frequency_to_channel(freq),
1165                 .band = band,
1166         };
1167         s8 tx_power;
1168
1169         len = sizeof(req_hdr) + __MT_EE_MAX - MT_EE_NIC_CONF_0;
1170         req = kzalloc(len, GFP_KERNEL);
1171         if (!req)
1172                 return -ENOMEM;
1173
1174         memcpy(req, &req_hdr, sizeof(req_hdr));
1175         data = req + sizeof(req_hdr);
1176         memcpy(data, eep + MT_EE_NIC_CONF_0,
1177                __MT_EE_MAX - MT_EE_NIC_CONF_0);
1178
1179         tx_power = hw->conf.power_level * 2;
1180         switch (n_chains) {
1181         case 4:
1182                 tx_power -= 12;
1183                 break;
1184         case 3:
1185                 tx_power -= 8;
1186                 break;
1187         case 2:
1188                 tx_power -= 6;
1189                 break;
1190         default:
1191                 break;
1192         }
1193         tx_power = max_t(s8, tx_power, 0);
1194         dev->mt76.txpower_cur = tx_power;
1195
1196         target_chains = mt7615_ext_pa_enabled(dev, band) ? 1 : n_chains;
1197         for (i = 0; i < target_chains; i++) {
1198                 int index = -MT_EE_NIC_CONF_0;
1199
1200                 ret = mt7615_eeprom_get_power_index(dev, chandef->chan, i);
1201                 if (ret < 0)
1202                         goto out;
1203
1204                 index += ret;
1205                 data[index] = min_t(u8, data[index], tx_power);
1206         }
1207
1208         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_TX_POWER_CTRL,
1209                                   req, len, true);
1210 out:
1211         kfree(req);
1212
1213         return ret;
1214 }
1215
1216 int mt7615_mcu_set_channel(struct mt7615_dev *dev)
1217 {
1218         struct cfg80211_chan_def *chdef = &dev->mt76.chandef;
1219         struct {
1220                 u8 control_chan;
1221                 u8 center_chan;
1222                 u8 bw;
1223                 u8 tx_streams;
1224                 u8 rx_streams_mask;
1225                 u8 switch_reason;
1226                 u8 band_idx;
1227                 /* for 80+80 only */
1228                 u8 center_chan2;
1229                 __le16 cac_case;
1230                 u8 channel_band;
1231                 u8 rsv0;
1232                 __le32 outband_freq;
1233                 u8 txpower_drop;
1234                 u8 rsv1[3];
1235                 u8 txpower_sku[53];
1236                 u8 rsv2[3];
1237         } req = {0};
1238         int ret;
1239
1240         req.control_chan = chdef->chan->hw_value;
1241         req.center_chan = ieee80211_frequency_to_channel(chdef->center_freq1);
1242         req.tx_streams = (dev->mt76.chainmask >> 8) & 0xf;
1243         req.rx_streams_mask = dev->mt76.antenna_mask;
1244         req.switch_reason = CH_SWITCH_NORMAL;
1245         req.band_idx = 0;
1246         req.center_chan2 = ieee80211_frequency_to_channel(chdef->center_freq2);
1247         req.txpower_drop = 0;
1248
1249         switch (dev->mt76.chandef.width) {
1250         case NL80211_CHAN_WIDTH_40:
1251                 req.bw = CMD_CBW_40MHZ;
1252                 break;
1253         case NL80211_CHAN_WIDTH_80:
1254                 req.bw = CMD_CBW_80MHZ;
1255                 break;
1256         case NL80211_CHAN_WIDTH_80P80:
1257                 req.bw = CMD_CBW_8080MHZ;
1258                 break;
1259         case NL80211_CHAN_WIDTH_160:
1260                 req.bw = CMD_CBW_160MHZ;
1261                 break;
1262         case NL80211_CHAN_WIDTH_5:
1263                 req.bw = CMD_CBW_5MHZ;
1264                 break;
1265         case NL80211_CHAN_WIDTH_10:
1266                 req.bw = CMD_CBW_10MHZ;
1267                 break;
1268         case NL80211_CHAN_WIDTH_20_NOHT:
1269         case NL80211_CHAN_WIDTH_20:
1270         default:
1271                 req.bw = CMD_CBW_20MHZ;
1272         }
1273         memset(req.txpower_sku, 0x3f, 49);
1274
1275         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_CHANNEL_SWITCH,
1276                                   &req, sizeof(req), true);
1277         if (ret)
1278                 return ret;
1279
1280         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RX_PATH,
1281                                    &req, sizeof(req), true);
1282 }
1283
1284 int mt7615_mcu_set_ht_cap(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1285                           struct ieee80211_sta *sta)
1286 {
1287         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1288         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1289         struct wtbl_req_hdr *wtbl_hdr;
1290         struct sta_req_hdr *sta_hdr;
1291         struct wtbl_raw *wtbl_raw;
1292         struct sta_rec_ht *sta_ht;
1293         struct wtbl_ht *wtbl_ht;
1294         int buf_len, ret, ntlv = 2;
1295         u32 msk, val = 0;
1296         u8 *buf;
1297
1298         buf = kzalloc(MT7615_WTBL_UPDATE_MAX_SIZE, GFP_KERNEL);
1299         if (!buf)
1300                 return -ENOMEM;
1301
1302         wtbl_hdr = (struct wtbl_req_hdr *)buf;
1303         wtbl_hdr->wlan_idx = msta->wcid.idx;
1304         wtbl_hdr->operation = WTBL_SET;
1305         buf_len = sizeof(*wtbl_hdr);
1306
1307         /* ht basic */
1308         wtbl_ht = (struct wtbl_ht *)(buf + buf_len);
1309         wtbl_ht->tag = cpu_to_le16(WTBL_HT);
1310         wtbl_ht->len = cpu_to_le16(sizeof(*wtbl_ht));
1311         wtbl_ht->ht = 1;
1312         wtbl_ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
1313         wtbl_ht->af = sta->ht_cap.ampdu_factor;
1314         wtbl_ht->mm = sta->ht_cap.ampdu_density;
1315         buf_len += sizeof(*wtbl_ht);
1316
1317         if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1318                 val |= MT_WTBL_W5_SHORT_GI_20;
1319         if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1320                 val |= MT_WTBL_W5_SHORT_GI_40;
1321
1322         /* vht basic */
1323         if (sta->vht_cap.vht_supported) {
1324                 struct wtbl_vht *wtbl_vht;
1325
1326                 wtbl_vht = (struct wtbl_vht *)(buf + buf_len);
1327                 buf_len += sizeof(*wtbl_vht);
1328                 wtbl_vht->tag = cpu_to_le16(WTBL_VHT);
1329                 wtbl_vht->len = cpu_to_le16(sizeof(*wtbl_vht));
1330                 wtbl_vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC;
1331                 wtbl_vht->vht = 1;
1332                 ntlv++;
1333
1334                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1335                         val |= MT_WTBL_W5_SHORT_GI_80;
1336                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1337                         val |= MT_WTBL_W5_SHORT_GI_160;
1338         }
1339
1340         /* smps */
1341         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1342                 struct wtbl_smps *wtbl_smps;
1343
1344                 wtbl_smps = (struct wtbl_smps *)(buf + buf_len);
1345                 buf_len += sizeof(*wtbl_smps);
1346                 wtbl_smps->tag = cpu_to_le16(WTBL_SMPS);
1347                 wtbl_smps->len = cpu_to_le16(sizeof(*wtbl_smps));
1348                 wtbl_smps->smps = 1;
1349                 ntlv++;
1350         }
1351
1352         /* sgi */
1353         msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1354               MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1355
1356         wtbl_raw = (struct wtbl_raw *)(buf + buf_len);
1357         buf_len += sizeof(*wtbl_raw);
1358         wtbl_raw->tag = cpu_to_le16(WTBL_RAW_DATA);
1359         wtbl_raw->len = cpu_to_le16(sizeof(*wtbl_raw));
1360         wtbl_raw->wtbl_idx = 1;
1361         wtbl_raw->dw = 5;
1362         wtbl_raw->msk = cpu_to_le32(~msk);
1363         wtbl_raw->val = cpu_to_le32(val);
1364
1365         wtbl_hdr->tlv_num = cpu_to_le16(ntlv);
1366         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1367                                   buf, buf_len, true);
1368         if (ret)
1369                 goto out;
1370
1371         memset(buf, 0, MT7615_WTBL_UPDATE_MAX_SIZE);
1372
1373         sta_hdr = (struct sta_req_hdr *)buf;
1374         sta_hdr->bss_idx = mvif->idx;
1375         sta_hdr->wlan_idx = msta->wcid.idx;
1376         sta_hdr->is_tlv_append = 1;
1377         ntlv = sta->vht_cap.vht_supported ? 2 : 1;
1378         sta_hdr->tlv_num = cpu_to_le16(ntlv);
1379         sta_hdr->muar_idx = mvif->omac_idx;
1380         buf_len = sizeof(*sta_hdr);
1381
1382         sta_ht = (struct sta_rec_ht *)(buf + buf_len);
1383         sta_ht->tag = cpu_to_le16(STA_REC_HT);
1384         sta_ht->len = cpu_to_le16(sizeof(*sta_ht));
1385         sta_ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1386         buf_len += sizeof(*sta_ht);
1387
1388         if (sta->vht_cap.vht_supported) {
1389                 struct sta_rec_vht *sta_vht;
1390
1391                 sta_vht = (struct sta_rec_vht *)(buf + buf_len);
1392                 buf_len += sizeof(*sta_vht);
1393                 sta_vht->tag = cpu_to_le16(STA_REC_VHT);
1394                 sta_vht->len = cpu_to_le16(sizeof(*sta_vht));
1395                 sta_vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1396                 sta_vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1397                 sta_vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1398         }
1399
1400         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1401                                   buf, buf_len, true);
1402 out:
1403         kfree(buf);
1404
1405         return ret;
1406 }
1407
1408 int mt7615_mcu_set_tx_ba(struct mt7615_dev *dev,
1409                          struct ieee80211_ampdu_params *params,
1410                          bool add)
1411 {
1412         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1413         struct mt7615_vif *mvif = msta->vif;
1414         struct {
1415                 struct wtbl_req_hdr hdr;
1416                 struct wtbl_ba ba;
1417         } wtbl_req = {
1418                 .hdr = {
1419                         .wlan_idx = msta->wcid.idx,
1420                         .operation = WTBL_SET,
1421                         .tlv_num = cpu_to_le16(1),
1422                 },
1423                 .ba = {
1424                         .tag = cpu_to_le16(WTBL_BA),
1425                         .len = cpu_to_le16(sizeof(struct wtbl_ba)),
1426                         .tid = params->tid,
1427                         .ba_type = MT_BA_TYPE_ORIGINATOR,
1428                         .sn = add ? cpu_to_le16(params->ssn) : 0,
1429                         .ba_en = add,
1430                 },
1431         };
1432         struct {
1433                 struct sta_req_hdr hdr;
1434                 struct sta_rec_ba ba;
1435         } sta_req = {
1436                 .hdr = {
1437                         .bss_idx = mvif->idx,
1438                         .wlan_idx = msta->wcid.idx,
1439                         .tlv_num = cpu_to_le16(1),
1440                         .is_tlv_append = 1,
1441                         .muar_idx = mvif->omac_idx,
1442                 },
1443                 .ba = {
1444                         .tag = cpu_to_le16(STA_REC_BA),
1445                         .len = cpu_to_le16(sizeof(struct sta_rec_ba)),
1446                         .tid = params->tid,
1447                         .ba_type = MT_BA_TYPE_ORIGINATOR,
1448                         .amsdu = params->amsdu,
1449                         .ba_en = add << params->tid,
1450                         .ssn = cpu_to_le16(params->ssn),
1451                         .winsize = cpu_to_le16(params->buf_size),
1452                 },
1453         };
1454         int ret;
1455
1456         if (add) {
1457                 u8 idx, ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1458
1459                 for (idx = 7; idx > 0; idx--) {
1460                         if (params->buf_size >= ba_range[idx])
1461                                 break;
1462                 }
1463
1464                 wtbl_req.ba.ba_winsize_idx = idx;
1465         }
1466
1467         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1468                                   &wtbl_req, sizeof(wtbl_req), true);
1469         if (ret)
1470                 return ret;
1471
1472         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1473                                    &sta_req, sizeof(sta_req), true);
1474 }
1475
1476 int mt7615_mcu_set_rx_ba(struct mt7615_dev *dev,
1477                          struct ieee80211_ampdu_params *params,
1478                          bool add)
1479 {
1480         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1481         struct mt7615_vif *mvif = msta->vif;
1482         struct {
1483                 struct wtbl_req_hdr hdr;
1484                 struct wtbl_ba ba;
1485         } wtbl_req = {
1486                 .hdr = {
1487                         .wlan_idx = msta->wcid.idx,
1488                         .operation = WTBL_SET,
1489                         .tlv_num = cpu_to_le16(1),
1490                 },
1491                 .ba = {
1492                         .tag = cpu_to_le16(WTBL_BA),
1493                         .len = cpu_to_le16(sizeof(struct wtbl_ba)),
1494                         .tid = params->tid,
1495                         .ba_type = MT_BA_TYPE_RECIPIENT,
1496                         .rst_ba_tid = params->tid,
1497                         .rst_ba_sel = RST_BA_MAC_TID_MATCH,
1498                         .rst_ba_sb = 1,
1499                 },
1500         };
1501         struct {
1502                 struct sta_req_hdr hdr;
1503                 struct sta_rec_ba ba;
1504         } sta_req = {
1505                 .hdr = {
1506                         .bss_idx = mvif->idx,
1507                         .wlan_idx = msta->wcid.idx,
1508                         .tlv_num = cpu_to_le16(1),
1509                         .is_tlv_append = 1,
1510                         .muar_idx = mvif->omac_idx,
1511                 },
1512                 .ba = {
1513                         .tag = cpu_to_le16(STA_REC_BA),
1514                         .len = cpu_to_le16(sizeof(struct sta_rec_ba)),
1515                         .tid = params->tid,
1516                         .ba_type = MT_BA_TYPE_RECIPIENT,
1517                         .amsdu = params->amsdu,
1518                         .ba_en = add << params->tid,
1519                         .ssn = cpu_to_le16(params->ssn),
1520                         .winsize = cpu_to_le16(params->buf_size),
1521                 },
1522         };
1523         int ret;
1524
1525         memcpy(wtbl_req.ba.peer_addr, params->sta->addr, ETH_ALEN);
1526
1527         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_STA_REC_UPDATE,
1528                                   &sta_req, sizeof(sta_req), true);
1529         if (ret || !add)
1530                 return ret;
1531
1532         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
1533                                    &wtbl_req, sizeof(wtbl_req), true);
1534 }
1535
1536 void mt7615_mcu_set_rates(struct mt7615_dev *dev, struct mt7615_sta *sta,
1537                           struct ieee80211_tx_rate *probe_rate,
1538                           struct ieee80211_tx_rate *rates)
1539 {
1540         int wcid = sta->wcid.idx;
1541         u32 addr = MT_WTBL_BASE + wcid * MT_WTBL_ENTRY_SIZE;
1542         bool stbc = false;
1543         int n_rates = sta->n_rates;
1544         u8 bw, bw_prev, bw_idx = 0;
1545         u16 val[4];
1546         u16 probe_val;
1547         u32 w5, w27;
1548         int i;
1549
1550         if (!mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY, 0, 5000))
1551                 return;
1552
1553         for (i = n_rates; i < 4; i++)
1554                 rates[i] = rates[n_rates - 1];
1555
1556         val[0] = mt7615_mac_tx_rate_val(dev, &rates[0], stbc, &bw);
1557         bw_prev = bw;
1558
1559         if (probe_rate) {
1560                 probe_val = mt7615_mac_tx_rate_val(dev, probe_rate, stbc, &bw);
1561                 if (bw)
1562                         bw_idx = 1;
1563                 else
1564                         bw_prev = 0;
1565         } else {
1566                 probe_val = val[0];
1567         }
1568
1569         val[1] = mt7615_mac_tx_rate_val(dev, &rates[1], stbc, &bw);
1570         if (bw_prev) {
1571                 bw_idx = 3;
1572                 bw_prev = bw;
1573         }
1574
1575         val[2] = mt7615_mac_tx_rate_val(dev, &rates[2], stbc, &bw);
1576         if (bw_prev) {
1577                 bw_idx = 5;
1578                 bw_prev = bw;
1579         }
1580
1581         val[3] = mt7615_mac_tx_rate_val(dev, &rates[3], stbc, &bw);
1582         if (bw_prev)
1583                 bw_idx = 7;
1584
1585         w27 = mt76_rr(dev, addr + 27 * 4);
1586         w27 &= ~MT_WTBL_W27_CC_BW_SEL;
1587         w27 |= FIELD_PREP(MT_WTBL_W27_CC_BW_SEL, bw);
1588
1589         w5 = mt76_rr(dev, addr + 5 * 4);
1590         w5 &= ~(MT_WTBL_W5_BW_CAP | MT_WTBL_W5_CHANGE_BW_RATE);
1591         w5 |= FIELD_PREP(MT_WTBL_W5_BW_CAP, bw) |
1592               FIELD_PREP(MT_WTBL_W5_CHANGE_BW_RATE, bw_idx ? bw_idx - 1 : 7);
1593
1594         mt76_wr(dev, MT_WTBL_RIUCR0, w5);
1595
1596         mt76_wr(dev, MT_WTBL_RIUCR1,
1597                 FIELD_PREP(MT_WTBL_RIUCR1_RATE0, probe_val) |
1598                 FIELD_PREP(MT_WTBL_RIUCR1_RATE1, val[0]) |
1599                 FIELD_PREP(MT_WTBL_RIUCR1_RATE2_LO, val[0]));
1600
1601         mt76_wr(dev, MT_WTBL_RIUCR2,
1602                 FIELD_PREP(MT_WTBL_RIUCR2_RATE2_HI, val[0] >> 8) |
1603                 FIELD_PREP(MT_WTBL_RIUCR2_RATE3, val[1]) |
1604                 FIELD_PREP(MT_WTBL_RIUCR2_RATE4, val[1]) |
1605                 FIELD_PREP(MT_WTBL_RIUCR2_RATE5_LO, val[2]));
1606
1607         mt76_wr(dev, MT_WTBL_RIUCR3,
1608                 FIELD_PREP(MT_WTBL_RIUCR3_RATE5_HI, val[2] >> 4) |
1609                 FIELD_PREP(MT_WTBL_RIUCR3_RATE6, val[2]) |
1610                 FIELD_PREP(MT_WTBL_RIUCR3_RATE7, val[3]));
1611
1612         mt76_wr(dev, MT_WTBL_UPDATE,
1613                 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, wcid) |
1614                 MT_WTBL_UPDATE_RATE_UPDATE |
1615                 MT_WTBL_UPDATE_TX_COUNT_CLEAR);
1616
1617         mt76_wr(dev, addr + 27 * 4, w27);
1618
1619         if (!(sta->wcid.tx_info & MT_WCID_TX_INFO_SET))
1620                 mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY, 0, 5000);
1621
1622         sta->rate_count = 2 * MT7615_RATE_RETRY * n_rates;
1623         sta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
1624 }