xref: /linux/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c (revision 5472240245793c13e9986c61dd34c697296deed4)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7921.h"
7 #include "mt7921_trace.h"
8 #include "mcu.h"
9 #include "mac.h"
10 
11 struct mt7921_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7921_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7921_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7921_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MT_STA_BFER			BIT(0)
68 #define MT_STA_BFEE			BIT(1)
69 
70 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
71 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
72 #define FW_FEATURE_ENCRY_MODE		BIT(4)
73 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
74 
75 #define DL_MODE_ENCRYPT			BIT(0)
76 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
77 #define DL_MODE_RESET_SEC_IV		BIT(3)
78 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
79 #define DL_CONFIG_ENCRY_MODE_SEL	BIT(6)
80 #define DL_MODE_NEED_RSP		BIT(31)
81 
82 #define FW_START_OVERRIDE		BIT(0)
83 #define FW_START_WORKING_PDA_CR4	BIT(2)
84 
85 #define PATCH_SEC_NOT_SUPPORT		GENMASK(31, 0)
86 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
87 #define PATCH_SEC_TYPE_INFO		0x2
88 
89 #define PATCH_SEC_ENC_TYPE_MASK		GENMASK(31, 24)
90 #define PATCH_SEC_ENC_TYPE_PLAIN		0x00
91 #define PATCH_SEC_ENC_TYPE_AES			0x01
92 #define PATCH_SEC_ENC_TYPE_SCRAMBLE		0x02
93 #define PATCH_SEC_ENC_SCRAMBLE_INFO_MASK	GENMASK(15, 0)
94 #define PATCH_SEC_ENC_AES_KEY_MASK		GENMASK(7, 0)
95 
96 #define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
97 #define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
98 
99 static enum mcu_cipher_type
100 mt7921_mcu_get_cipher(int cipher)
101 {
102 	switch (cipher) {
103 	case WLAN_CIPHER_SUITE_WEP40:
104 		return MCU_CIPHER_WEP40;
105 	case WLAN_CIPHER_SUITE_WEP104:
106 		return MCU_CIPHER_WEP104;
107 	case WLAN_CIPHER_SUITE_TKIP:
108 		return MCU_CIPHER_TKIP;
109 	case WLAN_CIPHER_SUITE_AES_CMAC:
110 		return MCU_CIPHER_BIP_CMAC_128;
111 	case WLAN_CIPHER_SUITE_CCMP:
112 		return MCU_CIPHER_AES_CCMP;
113 	case WLAN_CIPHER_SUITE_CCMP_256:
114 		return MCU_CIPHER_CCMP_256;
115 	case WLAN_CIPHER_SUITE_GCMP:
116 		return MCU_CIPHER_GCMP;
117 	case WLAN_CIPHER_SUITE_GCMP_256:
118 		return MCU_CIPHER_GCMP_256;
119 	case WLAN_CIPHER_SUITE_SMS4:
120 		return MCU_CIPHER_WAPI;
121 	default:
122 		return MCU_CIPHER_NONE;
123 	}
124 }
125 
126 static u8 mt7921_mcu_chan_bw(struct cfg80211_chan_def *chandef)
127 {
128 	static const u8 width_to_bw[] = {
129 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
130 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
131 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
132 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
133 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
134 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
135 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
136 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
137 	};
138 
139 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
140 		return 0;
141 
142 	return width_to_bw[chandef->width];
143 }
144 
145 static int
146 mt7921_mcu_parse_eeprom(struct mt76_dev *dev, struct sk_buff *skb)
147 {
148 	struct mt7921_mcu_eeprom_info *res;
149 	u8 *buf;
150 
151 	if (!skb)
152 		return -EINVAL;
153 
154 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
155 
156 	res = (struct mt7921_mcu_eeprom_info *)skb->data;
157 	buf = dev->eeprom.data + le32_to_cpu(res->addr);
158 	memcpy(buf, res->data, 16);
159 
160 	return 0;
161 }
162 
163 int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
164 			      struct sk_buff *skb, int seq)
165 {
166 	struct mt7921_mcu_rxd *rxd;
167 	int mcu_cmd = cmd & MCU_CMD_MASK;
168 	int ret = 0;
169 
170 	if (!skb) {
171 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
172 			cmd, seq);
173 		mt7921_reset(mdev);
174 
175 		return -ETIMEDOUT;
176 	}
177 
178 	rxd = (struct mt7921_mcu_rxd *)skb->data;
179 	if (seq != rxd->seq)
180 		return -EAGAIN;
181 
182 	if (cmd == MCU_CMD_PATCH_SEM_CONTROL) {
183 		skb_pull(skb, sizeof(*rxd) - 4);
184 		ret = *skb->data;
185 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
186 		skb_pull(skb, sizeof(*rxd) + 4);
187 		ret = le32_to_cpu(*(__le32 *)skb->data);
188 	} else if (cmd == MCU_EXT_CMD(EFUSE_ACCESS)) {
189 		ret = mt7921_mcu_parse_eeprom(mdev, skb);
190 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
191 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
192 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
193 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
194 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
195 		   cmd == MCU_UNI_CMD(SUSPEND)) {
196 		struct mt7921_mcu_uni_event *event;
197 
198 		skb_pull(skb, sizeof(*rxd));
199 		event = (struct mt7921_mcu_uni_event *)skb->data;
200 		ret = le32_to_cpu(event->status);
201 		/* skip invalid event */
202 		if (mcu_cmd != event->cid)
203 			ret = -EAGAIN;
204 	} else if (cmd == MCU_CMD_REG_READ) {
205 		struct mt7921_mcu_reg_event *event;
206 
207 		skb_pull(skb, sizeof(*rxd));
208 		event = (struct mt7921_mcu_reg_event *)skb->data;
209 		ret = (int)le32_to_cpu(event->val);
210 	} else {
211 		skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
212 	}
213 
214 	return ret;
215 }
216 EXPORT_SYMBOL_GPL(mt7921_mcu_parse_response);
217 
218 int mt7921_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
219 			    int cmd, int *wait_seq)
220 {
221 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
222 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
223 	struct mt7921_uni_txd *uni_txd;
224 	struct mt7921_mcu_txd *mcu_txd;
225 	__le32 *txd;
226 	u32 val;
227 	u8 seq;
228 
229 	if (cmd == MCU_UNI_CMD(HIF_CTRL) ||
230 	    cmd == MCU_UNI_CMD(SUSPEND) ||
231 	    cmd == MCU_UNI_CMD(OFFLOAD))
232 		mdev->mcu.timeout = HZ / 3;
233 	else
234 		mdev->mcu.timeout = 3 * HZ;
235 
236 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
237 	if (!seq)
238 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
239 
240 	if (cmd == MCU_CMD_FW_SCATTER)
241 		goto exit;
242 
243 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
244 	txd = (__le32 *)skb_push(skb, txd_len);
245 
246 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
247 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
248 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
249 	txd[0] = cpu_to_le32(val);
250 
251 	val = MT_TXD1_LONG_FORMAT |
252 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
253 	txd[1] = cpu_to_le32(val);
254 
255 	if (cmd & __MCU_CMD_FIELD_UNI) {
256 		uni_txd = (struct mt7921_uni_txd *)txd;
257 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
258 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
259 		uni_txd->cid = cpu_to_le16(mcu_cmd);
260 		uni_txd->s2d_index = MCU_S2D_H2N;
261 		uni_txd->pkt_type = MCU_PKT_ID;
262 		uni_txd->seq = seq;
263 
264 		goto exit;
265 	}
266 
267 	mcu_txd = (struct mt7921_mcu_txd *)txd;
268 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
269 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
270 					       MT_TX_MCU_PORT_RX_Q0));
271 	mcu_txd->pkt_type = MCU_PKT_ID;
272 	mcu_txd->seq = seq;
273 	mcu_txd->cid = mcu_cmd;
274 	mcu_txd->s2d_index = MCU_S2D_H2N;
275 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
276 
277 	if (mcu_txd->ext_cid || (cmd & MCU_CE_PREFIX)) {
278 		if (cmd & __MCU_CMD_FIELD_QUERY)
279 			mcu_txd->set_query = MCU_Q_QUERY;
280 		else
281 			mcu_txd->set_query = MCU_Q_SET;
282 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
283 	} else {
284 		mcu_txd->set_query = MCU_Q_NA;
285 	}
286 
287 exit:
288 	if (wait_seq)
289 		*wait_seq = seq;
290 
291 	return 0;
292 }
293 EXPORT_SYMBOL_GPL(mt7921_mcu_fill_message);
294 
295 static void
296 mt7921_mcu_scan_event(struct mt7921_dev *dev, struct sk_buff *skb)
297 {
298 	struct mt76_phy *mphy = &dev->mt76.phy;
299 	struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
300 
301 	spin_lock_bh(&dev->mt76.lock);
302 	__skb_queue_tail(&phy->scan_event_list, skb);
303 	spin_unlock_bh(&dev->mt76.lock);
304 
305 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
306 				     MT7921_HW_SCAN_TIMEOUT);
307 }
308 
309 static void
310 mt7921_mcu_connection_loss_iter(void *priv, u8 *mac,
311 				struct ieee80211_vif *vif)
312 {
313 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
314 	struct mt76_connac_beacon_loss_event *event = priv;
315 
316 	if (mvif->idx != event->bss_idx)
317 		return;
318 
319 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
320 		return;
321 
322 	ieee80211_connection_loss(vif);
323 }
324 
325 static void
326 mt7921_mcu_connection_loss_event(struct mt7921_dev *dev, struct sk_buff *skb)
327 {
328 	struct mt76_connac_beacon_loss_event *event;
329 	struct mt76_phy *mphy = &dev->mt76.phy;
330 
331 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
332 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
333 
334 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
335 					IEEE80211_IFACE_ITER_RESUME_ALL,
336 					mt7921_mcu_connection_loss_iter, event);
337 }
338 
339 static void
340 mt7921_mcu_bss_event(struct mt7921_dev *dev, struct sk_buff *skb)
341 {
342 	struct mt76_phy *mphy = &dev->mt76.phy;
343 	struct mt76_connac_mcu_bss_event *event;
344 
345 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
346 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
347 	if (event->is_absent)
348 		ieee80211_stop_queues(mphy->hw);
349 	else
350 		ieee80211_wake_queues(mphy->hw);
351 }
352 
353 static void
354 mt7921_mcu_debug_msg_event(struct mt7921_dev *dev, struct sk_buff *skb)
355 {
356 	struct mt7921_debug_msg {
357 		__le16 id;
358 		u8 type;
359 		u8 flag;
360 		__le32 value;
361 		__le16 len;
362 		u8 content[512];
363 	} __packed * msg;
364 
365 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
366 	msg = (struct mt7921_debug_msg *)skb->data;
367 
368 	if (msg->type == 3) { /* fw log */
369 		u16 len = min_t(u16, le16_to_cpu(msg->len), 512);
370 		int i;
371 
372 		for (i = 0 ; i < len; i++) {
373 			if (!msg->content[i])
374 				msg->content[i] = ' ';
375 		}
376 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", len, msg->content);
377 	}
378 }
379 
380 static void
381 mt7921_mcu_low_power_event(struct mt7921_dev *dev, struct sk_buff *skb)
382 {
383 	struct mt7921_mcu_lp_event {
384 		u8 state;
385 		u8 reserved[3];
386 	} __packed * event;
387 
388 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
389 	event = (struct mt7921_mcu_lp_event *)skb->data;
390 
391 	trace_lp_event(dev, event->state);
392 }
393 
394 static void
395 mt7921_mcu_tx_done_event(struct mt7921_dev *dev, struct sk_buff *skb)
396 {
397 	struct mt7921_mcu_tx_done_event *event;
398 
399 	skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
400 	event = (struct mt7921_mcu_tx_done_event *)skb->data;
401 
402 	mt7921_mac_add_txs(dev, event->txs);
403 }
404 
405 static void
406 mt7921_mcu_rx_unsolicited_event(struct mt7921_dev *dev, struct sk_buff *skb)
407 {
408 	struct mt7921_mcu_rxd *rxd = (struct mt7921_mcu_rxd *)skb->data;
409 
410 	switch (rxd->eid) {
411 	case MCU_EVENT_BSS_BEACON_LOSS:
412 		mt7921_mcu_connection_loss_event(dev, skb);
413 		break;
414 	case MCU_EVENT_SCHED_SCAN_DONE:
415 	case MCU_EVENT_SCAN_DONE:
416 		mt7921_mcu_scan_event(dev, skb);
417 		return;
418 	case MCU_EVENT_BSS_ABSENCE:
419 		mt7921_mcu_bss_event(dev, skb);
420 		break;
421 	case MCU_EVENT_DBG_MSG:
422 		mt7921_mcu_debug_msg_event(dev, skb);
423 		break;
424 	case MCU_EVENT_COREDUMP:
425 		dev->fw_assert = true;
426 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
427 					       &dev->coredump);
428 		return;
429 	case MCU_EVENT_LP_INFO:
430 		mt7921_mcu_low_power_event(dev, skb);
431 		break;
432 	case MCU_EVENT_TX_DONE:
433 		mt7921_mcu_tx_done_event(dev, skb);
434 		break;
435 	default:
436 		break;
437 	}
438 	dev_kfree_skb(skb);
439 }
440 
441 void mt7921_mcu_rx_event(struct mt7921_dev *dev, struct sk_buff *skb)
442 {
443 	struct mt7921_mcu_rxd *rxd;
444 
445 	if (skb_linearize(skb))
446 		return;
447 
448 	rxd = (struct mt7921_mcu_rxd *)skb->data;
449 
450 	if (rxd->eid == 0x6) {
451 		mt76_mcu_rx_event(&dev->mt76, skb);
452 		return;
453 	}
454 
455 	if (rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
456 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
457 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
458 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
459 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
460 	    rxd->eid == MCU_EVENT_TX_DONE ||
461 	    rxd->eid == MCU_EVENT_DBG_MSG ||
462 	    rxd->eid == MCU_EVENT_COREDUMP ||
463 	    rxd->eid == MCU_EVENT_LP_INFO ||
464 	    !rxd->seq)
465 		mt7921_mcu_rx_unsolicited_event(dev, skb);
466 	else
467 		mt76_mcu_rx_event(&dev->mt76, skb);
468 }
469 
470 /** starec & wtbl **/
471 static int
472 mt7921_mcu_sta_key_tlv(struct mt7921_sta *msta, struct sk_buff *skb,
473 		       struct ieee80211_key_conf *key, enum set_key_cmd cmd)
474 {
475 	struct mt7921_sta_key_conf *bip = &msta->bip;
476 	struct sta_rec_sec *sec;
477 	struct tlv *tlv;
478 	u32 len = sizeof(*sec);
479 
480 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
481 
482 	sec = (struct sta_rec_sec *)tlv;
483 	sec->add = cmd;
484 
485 	if (cmd == SET_KEY) {
486 		struct sec_key *sec_key;
487 		u8 cipher;
488 
489 		cipher = mt7921_mcu_get_cipher(key->cipher);
490 		if (cipher == MCU_CIPHER_NONE)
491 			return -EOPNOTSUPP;
492 
493 		sec_key = &sec->key[0];
494 		sec_key->cipher_len = sizeof(*sec_key);
495 
496 		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
497 			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
498 			sec_key->key_id = bip->keyidx;
499 			sec_key->key_len = 16;
500 			memcpy(sec_key->key, bip->key, 16);
501 
502 			sec_key = &sec->key[1];
503 			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
504 			sec_key->cipher_len = sizeof(*sec_key);
505 			sec_key->key_len = 16;
506 			memcpy(sec_key->key, key->key, 16);
507 
508 			sec->n_cipher = 2;
509 		} else {
510 			sec_key->cipher_id = cipher;
511 			sec_key->key_id = key->keyidx;
512 			sec_key->key_len = key->keylen;
513 			memcpy(sec_key->key, key->key, key->keylen);
514 
515 			if (cipher == MCU_CIPHER_TKIP) {
516 				/* Rx/Tx MIC keys are swapped */
517 				memcpy(sec_key->key + 16, key->key + 24, 8);
518 				memcpy(sec_key->key + 24, key->key + 16, 8);
519 			}
520 
521 			/* store key_conf for BIP batch update */
522 			if (cipher == MCU_CIPHER_AES_CCMP) {
523 				memcpy(bip->key, key->key, key->keylen);
524 				bip->keyidx = key->keyidx;
525 			}
526 
527 			len -= sizeof(*sec_key);
528 			sec->n_cipher = 1;
529 		}
530 	} else {
531 		len -= sizeof(sec->key);
532 		sec->n_cipher = 0;
533 	}
534 	sec->len = cpu_to_le16(len);
535 
536 	return 0;
537 }
538 
539 int mt7921_mcu_add_key(struct mt7921_dev *dev, struct ieee80211_vif *vif,
540 		       struct mt7921_sta *msta, struct ieee80211_key_conf *key,
541 		       enum set_key_cmd cmd)
542 {
543 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
544 	struct sk_buff *skb;
545 	int ret;
546 
547 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
548 					    &msta->wcid);
549 	if (IS_ERR(skb))
550 		return PTR_ERR(skb);
551 
552 	ret = mt7921_mcu_sta_key_tlv(msta, skb, key, cmd);
553 	if (ret)
554 		return ret;
555 
556 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
557 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
558 }
559 
560 int mt7921_mcu_uni_tx_ba(struct mt7921_dev *dev,
561 			 struct ieee80211_ampdu_params *params,
562 			 bool enable)
563 {
564 	struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
565 
566 	if (enable && !params->amsdu)
567 		msta->wcid.amsdu = false;
568 
569 	return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
570 				      enable, true);
571 }
572 
573 int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
574 			 struct ieee80211_ampdu_params *params,
575 			 bool enable)
576 {
577 	struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
578 
579 	return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
580 				      enable, false);
581 }
582 
583 int mt7921_mcu_restart(struct mt76_dev *dev)
584 {
585 	struct {
586 		u8 power_mode;
587 		u8 rsv[3];
588 	} req = {
589 		.power_mode = 1,
590 	};
591 
592 	return mt76_mcu_send_msg(dev, MCU_CMD_NIC_POWER_CTRL, &req,
593 				 sizeof(req), false);
594 }
595 EXPORT_SYMBOL_GPL(mt7921_mcu_restart);
596 
597 static u32 mt7921_get_data_mode(struct mt7921_dev *dev, u32 info)
598 {
599 	u32 mode = DL_MODE_NEED_RSP;
600 
601 	if (info == PATCH_SEC_NOT_SUPPORT)
602 		return mode;
603 
604 	switch (FIELD_GET(PATCH_SEC_ENC_TYPE_MASK, info)) {
605 	case PATCH_SEC_ENC_TYPE_PLAIN:
606 		break;
607 	case PATCH_SEC_ENC_TYPE_AES:
608 		mode |= DL_MODE_ENCRYPT;
609 		mode |= FIELD_PREP(DL_MODE_KEY_IDX,
610 				(info & PATCH_SEC_ENC_AES_KEY_MASK)) & DL_MODE_KEY_IDX;
611 		mode |= DL_MODE_RESET_SEC_IV;
612 		break;
613 	case PATCH_SEC_ENC_TYPE_SCRAMBLE:
614 		mode |= DL_MODE_ENCRYPT;
615 		mode |= DL_CONFIG_ENCRY_MODE_SEL;
616 		mode |= DL_MODE_RESET_SEC_IV;
617 		break;
618 	default:
619 		dev_err(dev->mt76.dev, "Encryption type not support!\n");
620 	}
621 
622 	return mode;
623 }
624 
625 static char *mt7921_patch_name(struct mt7921_dev *dev)
626 {
627 	char *ret;
628 
629 	if (is_mt7922(&dev->mt76))
630 		ret = MT7922_ROM_PATCH;
631 	else
632 		ret = MT7921_ROM_PATCH;
633 
634 	return ret;
635 }
636 
637 static int mt7921_load_patch(struct mt7921_dev *dev)
638 {
639 	const struct mt7921_patch_hdr *hdr;
640 	const struct firmware *fw = NULL;
641 	int i, ret, sem, max_len;
642 
643 	max_len = mt76_is_sdio(&dev->mt76) ? 2048 : 4096;
644 
645 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
646 	switch (sem) {
647 	case PATCH_IS_DL:
648 		return 0;
649 	case PATCH_NOT_DL_SEM_SUCCESS:
650 		break;
651 	default:
652 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
653 		return -EAGAIN;
654 	}
655 
656 	ret = request_firmware(&fw, mt7921_patch_name(dev), dev->mt76.dev);
657 	if (ret)
658 		goto out;
659 
660 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
661 		dev_err(dev->mt76.dev, "Invalid firmware\n");
662 		ret = -EINVAL;
663 		goto out;
664 	}
665 
666 	hdr = (const struct mt7921_patch_hdr *)(fw->data);
667 
668 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
669 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
670 
671 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
672 		struct mt7921_patch_sec *sec;
673 		const u8 *dl;
674 		u32 len, addr, mode;
675 		u32 sec_info = 0;
676 
677 		sec = (struct mt7921_patch_sec *)(fw->data + sizeof(*hdr) +
678 						  i * sizeof(*sec));
679 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
680 		    PATCH_SEC_TYPE_INFO) {
681 			ret = -EINVAL;
682 			goto out;
683 		}
684 
685 		addr = be32_to_cpu(sec->info.addr);
686 		len = be32_to_cpu(sec->info.len);
687 		dl = fw->data + be32_to_cpu(sec->offs);
688 		sec_info = be32_to_cpu(sec->info.sec_key_idx);
689 		mode = mt7921_get_data_mode(dev, sec_info);
690 
691 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
692 						    mode);
693 		if (ret) {
694 			dev_err(dev->mt76.dev, "Download request failed\n");
695 			goto out;
696 		}
697 
698 		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
699 					       dl, len, max_len);
700 		if (ret) {
701 			dev_err(dev->mt76.dev, "Failed to send patch\n");
702 			goto out;
703 		}
704 	}
705 
706 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
707 	if (ret)
708 		dev_err(dev->mt76.dev, "Failed to start patch\n");
709 
710 	if (mt76_is_sdio(&dev->mt76)) {
711 		/* activate again */
712 		ret = __mt7921_mcu_fw_pmctrl(dev);
713 		if (ret)
714 			return ret;
715 
716 		ret = __mt7921_mcu_drv_pmctrl(dev);
717 		if (ret)
718 			return ret;
719 	}
720 
721 out:
722 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
723 	switch (sem) {
724 	case PATCH_REL_SEM_SUCCESS:
725 		break;
726 	default:
727 		ret = -EAGAIN;
728 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
729 		break;
730 	}
731 	release_firmware(fw);
732 
733 	return ret;
734 }
735 
736 static u32 mt7921_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
737 {
738 	u32 ret = 0;
739 
740 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
741 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
742 	ret |= (feature_set & FW_FEATURE_ENCRY_MODE) ?
743 	       DL_CONFIG_ENCRY_MODE_SEL : 0;
744 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
745 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
746 	ret |= DL_MODE_NEED_RSP;
747 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
748 
749 	return ret;
750 }
751 
752 static int
753 mt7921_mcu_send_ram_firmware(struct mt7921_dev *dev,
754 			     const struct mt7921_fw_trailer *hdr,
755 			     const u8 *data, bool is_wa)
756 {
757 	int i, offset = 0, max_len;
758 	u32 override = 0, option = 0;
759 
760 	max_len = mt76_is_sdio(&dev->mt76) ? 2048 : 4096;
761 
762 	for (i = 0; i < hdr->n_region; i++) {
763 		const struct mt7921_fw_region *region;
764 		int err;
765 		u32 len, addr, mode;
766 
767 		region = (const struct mt7921_fw_region *)((const u8 *)hdr -
768 			 (hdr->n_region - i) * sizeof(*region));
769 		mode = mt7921_mcu_gen_dl_mode(region->feature_set, is_wa);
770 		len = le32_to_cpu(region->len);
771 		addr = le32_to_cpu(region->addr);
772 
773 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
774 			override = addr;
775 
776 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
777 						    mode);
778 		if (err) {
779 			dev_err(dev->mt76.dev, "Download request failed\n");
780 			return err;
781 		}
782 
783 		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
784 					       data + offset, len, max_len);
785 		if (err) {
786 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
787 			return err;
788 		}
789 
790 		offset += len;
791 	}
792 
793 	if (override)
794 		option |= FW_START_OVERRIDE;
795 
796 	if (is_wa)
797 		option |= FW_START_WORKING_PDA_CR4;
798 
799 	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
800 }
801 
802 static char *mt7921_ram_name(struct mt7921_dev *dev)
803 {
804 	char *ret;
805 
806 	if (is_mt7922(&dev->mt76))
807 		ret = MT7922_FIRMWARE_WM;
808 	else
809 		ret = MT7921_FIRMWARE_WM;
810 
811 	return ret;
812 }
813 
814 static int mt7921_load_ram(struct mt7921_dev *dev)
815 {
816 	const struct mt7921_fw_trailer *hdr;
817 	const struct firmware *fw;
818 	int ret;
819 
820 	ret = request_firmware(&fw, mt7921_ram_name(dev), dev->mt76.dev);
821 	if (ret)
822 		return ret;
823 
824 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
825 		dev_err(dev->mt76.dev, "Invalid firmware\n");
826 		ret = -EINVAL;
827 		goto out;
828 	}
829 
830 	hdr = (const struct mt7921_fw_trailer *)(fw->data + fw->size -
831 					sizeof(*hdr));
832 
833 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
834 		 hdr->fw_ver, hdr->build_date);
835 
836 	ret = mt7921_mcu_send_ram_firmware(dev, hdr, fw->data, false);
837 	if (ret) {
838 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
839 		goto out;
840 	}
841 
842 	snprintf(dev->mt76.hw->wiphy->fw_version,
843 		 sizeof(dev->mt76.hw->wiphy->fw_version),
844 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
845 
846 out:
847 	release_firmware(fw);
848 
849 	return ret;
850 }
851 
852 static int mt7921_load_firmware(struct mt7921_dev *dev)
853 {
854 	int ret;
855 
856 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
857 	if (ret && mt76_is_mmio(&dev->mt76)) {
858 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
859 		goto fw_loaded;
860 	}
861 
862 	ret = mt7921_load_patch(dev);
863 	if (ret)
864 		return ret;
865 
866 	ret = mt7921_load_ram(dev);
867 	if (ret)
868 		return ret;
869 
870 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
871 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
872 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
873 
874 		return -EIO;
875 	}
876 
877 fw_loaded:
878 
879 #ifdef CONFIG_PM
880 	dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
881 #endif /* CONFIG_PM */
882 
883 	dev_err(dev->mt76.dev, "Firmware init done\n");
884 
885 	return 0;
886 }
887 
888 int mt7921_mcu_fw_log_2_host(struct mt7921_dev *dev, u8 ctrl)
889 {
890 	struct {
891 		u8 ctrl_val;
892 		u8 pad[3];
893 	} data = {
894 		.ctrl_val = ctrl
895 	};
896 
897 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FWLOG_2_HOST, &data,
898 				 sizeof(data), false);
899 }
900 
901 int mt7921_run_firmware(struct mt7921_dev *dev)
902 {
903 	int err;
904 
905 	err = mt7921_load_firmware(dev);
906 	if (err)
907 		return err;
908 
909 	err = mt76_connac_mcu_get_nic_capability(&dev->mphy);
910 	if (err)
911 		return err;
912 
913 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
914 	return mt7921_mcu_fw_log_2_host(dev, 1);
915 }
916 EXPORT_SYMBOL_GPL(mt7921_run_firmware);
917 
918 void mt7921_mcu_exit(struct mt7921_dev *dev)
919 {
920 	skb_queue_purge(&dev->mt76.mcu.res_q);
921 }
922 EXPORT_SYMBOL_GPL(mt7921_mcu_exit);
923 
924 int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif)
925 {
926 #define WMM_AIFS_SET		BIT(0)
927 #define WMM_CW_MIN_SET		BIT(1)
928 #define WMM_CW_MAX_SET		BIT(2)
929 #define WMM_TXOP_SET		BIT(3)
930 #define WMM_PARAM_SET		GENMASK(3, 0)
931 #define TX_CMD_MODE		1
932 	struct edca {
933 		u8 queue;
934 		u8 set;
935 		u8 aifs;
936 		u8 cw_min;
937 		__le16 cw_max;
938 		__le16 txop;
939 	};
940 	struct mt7921_mcu_tx {
941 		u8 total;
942 		u8 action;
943 		u8 valid;
944 		u8 mode;
945 
946 		struct edca edca[IEEE80211_NUM_ACS];
947 	} __packed req = {
948 		.valid = true,
949 		.mode = TX_CMD_MODE,
950 		.total = IEEE80211_NUM_ACS,
951 	};
952 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
953 	struct mu_edca {
954 		u8 cw_min;
955 		u8 cw_max;
956 		u8 aifsn;
957 		u8 acm;
958 		u8 timer;
959 		u8 padding[3];
960 	};
961 	struct mt7921_mcu_mu_tx {
962 		u8 ver;
963 		u8 pad0;
964 		__le16 len;
965 		u8 bss_idx;
966 		u8 qos;
967 		u8 wmm_idx;
968 		u8 pad1;
969 		struct mu_edca edca[IEEE80211_NUM_ACS];
970 		u8 pad3[32];
971 	} __packed req_mu = {
972 		.bss_idx = mvif->mt76.idx,
973 		.qos = vif->bss_conf.qos,
974 		.wmm_idx = mvif->mt76.wmm_idx,
975 	};
976 	int ac, ret;
977 
978 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
979 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
980 		struct edca *e = &req.edca[ac];
981 
982 		e->set = WMM_PARAM_SET;
983 		e->queue = ac + mvif->mt76.wmm_idx * MT7921_MAX_WMM_SETS;
984 		e->aifs = q->aifs;
985 		e->txop = cpu_to_le16(q->txop);
986 
987 		if (q->cw_min)
988 			e->cw_min = fls(q->cw_min);
989 		else
990 			e->cw_min = 5;
991 
992 		if (q->cw_max)
993 			e->cw_max = cpu_to_le16(fls(q->cw_max));
994 		else
995 			e->cw_max = cpu_to_le16(10);
996 	}
997 
998 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
999 				&req, sizeof(req), true);
1000 	if (ret)
1001 		return ret;
1002 
1003 	if (!vif->bss_conf.he_support)
1004 		return 0;
1005 
1006 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1007 		struct ieee80211_he_mu_edca_param_ac_rec *q;
1008 		struct mu_edca *e;
1009 		int to_aci[] = {1, 0, 2, 3};
1010 
1011 		if (!mvif->queue_params[ac].mu_edca)
1012 			break;
1013 
1014 		q = &mvif->queue_params[ac].mu_edca_param_rec;
1015 		e = &(req_mu.edca[to_aci[ac]]);
1016 
1017 		e->cw_min = q->ecw_min_max & 0xf;
1018 		e->cw_max = (q->ecw_min_max & 0xf0) >> 4;
1019 		e->aifsn = q->aifsn;
1020 		e->timer = q->mu_edca_timer;
1021 	}
1022 
1023 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_MU_EDCA_PARMS, &req_mu,
1024 				 sizeof(req_mu), false);
1025 }
1026 
1027 int mt7921_mcu_set_chan_info(struct mt7921_phy *phy, int cmd)
1028 {
1029 	struct mt7921_dev *dev = phy->dev;
1030 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1031 	int freq1 = chandef->center_freq1;
1032 	struct {
1033 		u8 control_ch;
1034 		u8 center_ch;
1035 		u8 bw;
1036 		u8 tx_streams_num;
1037 		u8 rx_streams;	/* mask or num */
1038 		u8 switch_reason;
1039 		u8 band_idx;
1040 		u8 center_ch2;	/* for 80+80 only */
1041 		__le16 cac_case;
1042 		u8 channel_band;
1043 		u8 rsv0;
1044 		__le32 outband_freq;
1045 		u8 txpower_drop;
1046 		u8 ap_bw;
1047 		u8 ap_center_ch;
1048 		u8 rsv1[57];
1049 	} __packed req = {
1050 		.control_ch = chandef->chan->hw_value,
1051 		.center_ch = ieee80211_frequency_to_channel(freq1),
1052 		.bw = mt7921_mcu_chan_bw(chandef),
1053 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
1054 		.rx_streams = phy->mt76->antenna_mask,
1055 		.band_idx = phy != &dev->phy,
1056 	};
1057 
1058 	if (chandef->chan->band == NL80211_BAND_6GHZ)
1059 		req.channel_band = 2;
1060 	else
1061 		req.channel_band = chandef->chan->band;
1062 
1063 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
1064 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
1065 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
1066 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
1067 		req.switch_reason = CH_SWITCH_DFS;
1068 	else
1069 		req.switch_reason = CH_SWITCH_NORMAL;
1070 
1071 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
1072 		req.rx_streams = hweight8(req.rx_streams);
1073 
1074 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
1075 		int freq2 = chandef->center_freq2;
1076 
1077 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
1078 	}
1079 
1080 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
1081 }
1082 
1083 int mt7921_mcu_set_eeprom(struct mt7921_dev *dev)
1084 {
1085 	struct req_hdr {
1086 		u8 buffer_mode;
1087 		u8 format;
1088 		__le16 len;
1089 	} __packed req = {
1090 		.buffer_mode = EE_MODE_EFUSE,
1091 		.format = EE_FORMAT_WHOLE,
1092 	};
1093 
1094 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
1095 				 &req, sizeof(req), true);
1096 }
1097 EXPORT_SYMBOL_GPL(mt7921_mcu_set_eeprom);
1098 
1099 int mt7921_mcu_get_eeprom(struct mt7921_dev *dev, u32 offset)
1100 {
1101 	struct mt7921_mcu_eeprom_info req = {
1102 		.addr = cpu_to_le32(round_down(offset, 16)),
1103 	};
1104 	struct mt7921_mcu_eeprom_info *res;
1105 	struct sk_buff *skb;
1106 	int ret;
1107 	u8 *buf;
1108 
1109 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
1110 					MCU_EXT_QUERY(EFUSE_ACCESS),
1111 					&req, sizeof(req), true, &skb);
1112 	if (ret)
1113 		return ret;
1114 
1115 	res = (struct mt7921_mcu_eeprom_info *)skb->data;
1116 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
1117 	memcpy(buf, res->data, 16);
1118 	dev_kfree_skb(skb);
1119 
1120 	return 0;
1121 }
1122 
1123 int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif)
1124 {
1125 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1126 	struct {
1127 		struct {
1128 			u8 bss_idx;
1129 			u8 pad[3];
1130 		} __packed hdr;
1131 		struct ps_tlv {
1132 			__le16 tag;
1133 			__le16 len;
1134 			u8 ps_state; /* 0: device awake
1135 				      * 1: static power save
1136 				      * 2: dynamic power saving
1137 				      * 3: enter TWT power saving
1138 				      * 4: leave TWT power saving
1139 				      */
1140 			u8 pad[3];
1141 		} __packed ps;
1142 	} __packed ps_req = {
1143 		.hdr = {
1144 			.bss_idx = mvif->mt76.idx,
1145 		},
1146 		.ps = {
1147 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1148 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1149 			.ps_state = vif->bss_conf.ps ? 2 : 0,
1150 		},
1151 	};
1152 
1153 	if (vif->type != NL80211_IFTYPE_STATION)
1154 		return -EOPNOTSUPP;
1155 
1156 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1157 				 &ps_req, sizeof(ps_req), true);
1158 }
1159 
1160 static int
1161 mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
1162 			 bool enable)
1163 {
1164 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1165 	struct {
1166 		struct {
1167 			u8 bss_idx;
1168 			u8 pad[3];
1169 		} __packed hdr;
1170 		struct bcnft_tlv {
1171 			__le16 tag;
1172 			__le16 len;
1173 			__le16 bcn_interval;
1174 			u8 dtim_period;
1175 			u8 pad;
1176 		} __packed bcnft;
1177 	} __packed bcnft_req = {
1178 		.hdr = {
1179 			.bss_idx = mvif->mt76.idx,
1180 		},
1181 		.bcnft = {
1182 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1183 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1184 			.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1185 			.dtim_period = vif->bss_conf.dtim_period,
1186 		},
1187 	};
1188 
1189 	if (vif->type != NL80211_IFTYPE_STATION)
1190 		return 0;
1191 
1192 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1193 				 &bcnft_req, sizeof(bcnft_req), true);
1194 }
1195 
1196 static int
1197 mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
1198 		      bool enable)
1199 {
1200 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1201 	struct {
1202 		u8 bss_idx;
1203 		u8 dtim_period;
1204 		__le16 aid;
1205 		__le16 bcn_interval;
1206 		__le16 atim_window;
1207 		u8 uapsd;
1208 		u8 bmc_delivered_ac;
1209 		u8 bmc_triggered_ac;
1210 		u8 pad;
1211 	} req = {
1212 		.bss_idx = mvif->mt76.idx,
1213 		.aid = cpu_to_le16(vif->bss_conf.aid),
1214 		.dtim_period = vif->bss_conf.dtim_period,
1215 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1216 	};
1217 	struct {
1218 		u8 bss_idx;
1219 		u8 pad[3];
1220 	} req_hdr = {
1221 		.bss_idx = mvif->mt76.idx,
1222 	};
1223 	int err;
1224 
1225 	if (vif->type != NL80211_IFTYPE_STATION)
1226 		return 0;
1227 
1228 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
1229 				sizeof(req_hdr), false);
1230 	if (err < 0 || !enable)
1231 		return err;
1232 
1233 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
1234 				 sizeof(req), false);
1235 }
1236 
1237 int mt7921_mcu_sta_update(struct mt7921_dev *dev, struct ieee80211_sta *sta,
1238 			  struct ieee80211_vif *vif, bool enable,
1239 			  enum mt76_sta_info_state state)
1240 {
1241 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1242 	int rssi = -ewma_rssi_read(&mvif->rssi);
1243 	struct mt76_sta_cmd_info info = {
1244 		.sta = sta,
1245 		.vif = vif,
1246 		.enable = enable,
1247 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1248 		.state = state,
1249 		.offload_fw = true,
1250 		.rcpi = to_rcpi(rssi),
1251 	};
1252 	struct mt7921_sta *msta;
1253 
1254 	msta = sta ? (struct mt7921_sta *)sta->drv_priv : NULL;
1255 	info.wcid = msta ? &msta->wcid : &mvif->sta.wcid;
1256 	info.newly = msta ? state != MT76_STA_INFO_STATE_ASSOC : true;
1257 
1258 	return mt76_connac_mcu_sta_cmd(&dev->mphy, &info);
1259 }
1260 
1261 int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
1262 {
1263 	struct mt76_phy *mphy = &dev->mt76.phy;
1264 	struct mt76_connac_pm *pm = &dev->pm;
1265 	int err = 0;
1266 
1267 	mutex_lock(&pm->mutex);
1268 
1269 	if (!test_bit(MT76_STATE_PM, &mphy->state))
1270 		goto out;
1271 
1272 	err = __mt7921_mcu_drv_pmctrl(dev);
1273 out:
1274 	mutex_unlock(&pm->mutex);
1275 
1276 	if (err)
1277 		mt7921_reset(&dev->mt76);
1278 
1279 	return err;
1280 }
1281 EXPORT_SYMBOL_GPL(mt7921_mcu_drv_pmctrl);
1282 
1283 int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev)
1284 {
1285 	struct mt76_phy *mphy = &dev->mt76.phy;
1286 	struct mt76_connac_pm *pm = &dev->pm;
1287 	int err = 0;
1288 
1289 	mutex_lock(&pm->mutex);
1290 
1291 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
1292 		goto out;
1293 
1294 	err = __mt7921_mcu_fw_pmctrl(dev);
1295 out:
1296 	mutex_unlock(&pm->mutex);
1297 
1298 	if (err)
1299 		mt7921_reset(&dev->mt76);
1300 
1301 	return err;
1302 }
1303 EXPORT_SYMBOL_GPL(mt7921_mcu_fw_pmctrl);
1304 
1305 int mt7921_mcu_set_beacon_filter(struct mt7921_dev *dev,
1306 				 struct ieee80211_vif *vif,
1307 				 bool enable)
1308 {
1309 	struct ieee80211_hw *hw = mt76_hw(dev);
1310 	int err;
1311 
1312 	if (enable) {
1313 		err = mt7921_mcu_uni_bss_bcnft(dev, vif, true);
1314 		if (err)
1315 			return err;
1316 
1317 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
1318 		ieee80211_hw_set(hw, CONNECTION_MONITOR);
1319 		mt76_set(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1320 
1321 		return 0;
1322 	}
1323 
1324 	err = mt7921_mcu_set_bss_pm(dev, vif, false);
1325 	if (err)
1326 		return err;
1327 
1328 	vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
1329 	__clear_bit(IEEE80211_HW_CONNECTION_MONITOR, hw->flags);
1330 	mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1331 
1332 	return 0;
1333 }
1334 
1335 int mt7921_get_txpwr_info(struct mt7921_dev *dev, struct mt7921_txpwr *txpwr)
1336 {
1337 	struct mt7921_txpwr_event *event;
1338 	struct mt7921_txpwr_req req = {
1339 		.dbdc_idx = 0,
1340 	};
1341 	struct sk_buff *skb;
1342 	int ret;
1343 
1344 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CMD_GET_TXPWR,
1345 					&req, sizeof(req), true, &skb);
1346 	if (ret)
1347 		return ret;
1348 
1349 	event = (struct mt7921_txpwr_event *)skb->data;
1350 	WARN_ON(skb->len != le16_to_cpu(event->len));
1351 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1352 
1353 	dev_kfree_skb(skb);
1354 
1355 	return 0;
1356 }
1357