drivers/net/wireless/mediatek/mt76-6e-usb/mt7921/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7921.h"
   7 #include "mt7921_trace.h"
   8 #include "mcu.h"
   9 #include "mac.h"
  10
  11 struct mt7921_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7921_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7921_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7921_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MT_STA_BFER                     BIT(0)
  68 #define MT_STA_BFEE                     BIT(1)
  69
  70 #define PATCH_SEC_ENC_TYPE_MASK         GENMASK(31, 24)
  71 #define PATCH_SEC_ENC_TYPE_PLAIN                0x00
  72 #define PATCH_SEC_ENC_TYPE_AES                  0x01
  73 #define PATCH_SEC_ENC_TYPE_SCRAMBLE             0x02
  74 #define PATCH_SEC_ENC_SCRAMBLE_INFO_MASK        GENMASK(15, 0)
  75 #define PATCH_SEC_ENC_AES_KEY_MASK              GENMASK(7, 0)
  76
  77 static int
  78 mt7921_mcu_parse_eeprom(struct mt76_dev *dev, struct sk_buff *skb)
  79 {
  80         struct mt7921_mcu_eeprom_info *res;
  81         u8 *buf;
  82
  83         if (!skb)
  84                 return -EINVAL;
  85
  86         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
  87
  88         res = (struct mt7921_mcu_eeprom_info *)skb->data;
  89         buf = dev->eeprom.data + le32_to_cpu(res->addr);
  90         memcpy(buf, res->data, 16);
  91
  92         return 0;
  93 }
  94
  95 int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
  96                               struct sk_buff *skb, int seq)
  97 {
  98         int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
  99         struct mt7921_mcu_rxd *rxd;
 100         int ret = 0;
 101
 102         if (!skb) {
 103                 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 104                         cmd, seq);
 105                 mt7921_reset(mdev);
 106
 107                 return -ETIMEDOUT;
 108         }
 109
 110         rxd = (struct mt7921_mcu_rxd *)skb->data;
 111         if (seq != rxd->seq)
 112                 return -EAGAIN;
 113
 114         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 115                 skb_pull(skb, sizeof(*rxd) - 4);
 116                 ret = *skb->data;
 117         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 118                 skb_pull(skb, sizeof(*rxd) + 4);
 119                 ret = le32_to_cpu(*(__le32 *)skb->data);
 120         } else if (cmd == MCU_EXT_CMD(EFUSE_ACCESS)) {
 121                 ret = mt7921_mcu_parse_eeprom(mdev, skb);
 122         } else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
 123                    cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
 124                    cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
 125                    cmd == MCU_UNI_CMD(HIF_CTRL) ||
 126                    cmd == MCU_UNI_CMD(OFFLOAD) ||
 127                    cmd == MCU_UNI_CMD(SUSPEND)) {
 128                 struct mt7921_mcu_uni_event *event;
 129
 130                 skb_pull(skb, sizeof(*rxd));
 131                 event = (struct mt7921_mcu_uni_event *)skb->data;
 132                 ret = le32_to_cpu(event->status);
 133                 /* skip invalid event */
 134                 if (mcu_cmd != event->cid)
 135                         ret = -EAGAIN;
 136         } else if (cmd == MCU_CE_QUERY(REG_READ)) {
 137                 struct mt7921_mcu_reg_event *event;
 138
 139                 skb_pull(skb, sizeof(*rxd));
 140                 event = (struct mt7921_mcu_reg_event *)skb->data;
 141                 ret = (int)le32_to_cpu(event->val);
 142         } else {
 143                 skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 144         }
 145
 146         return ret;
 147 }
 148 EXPORT_SYMBOL_GPL(mt7921_mcu_parse_response);
 149
 150 int mt7921_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
 151                             int cmd, int *wait_seq)
 152 {
 153         struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
 154         int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 155         struct mt7921_uni_txd *uni_txd;
 156         struct mt7921_mcu_txd *mcu_txd;
 157         __le32 *txd;
 158         u32 val;
 159         u8 seq;
 160
 161         if (cmd == MCU_UNI_CMD(HIF_CTRL) ||
 162             cmd == MCU_UNI_CMD(SUSPEND) ||
 163             cmd == MCU_UNI_CMD(OFFLOAD))
 164                 mdev->mcu.timeout = HZ;
 165         else
 166                 mdev->mcu.timeout = 3 * HZ;
 167
 168         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 169         if (!seq)
 170                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 171
 172         if (cmd == MCU_CMD(FW_SCATTER))
 173                 goto exit;
 174
 175         txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 176         txd = (__le32 *)skb_push(skb, txd_len);
 177
 178         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 179               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 180               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 181         txd[0] = cpu_to_le32(val);
 182
 183         val = MT_TXD1_LONG_FORMAT |
 184               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 185         txd[1] = cpu_to_le32(val);
 186
 187         if (cmd & __MCU_CMD_FIELD_UNI) {
 188                 uni_txd = (struct mt7921_uni_txd *)txd;
 189                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 190                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 191                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 192                 uni_txd->s2d_index = MCU_S2D_H2N;
 193                 uni_txd->pkt_type = MCU_PKT_ID;
 194                 uni_txd->seq = seq;
 195
 196                 goto exit;
 197         }
 198
 199         mcu_txd = (struct mt7921_mcu_txd *)txd;
 200         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 201         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 202                                                MT_TX_MCU_PORT_RX_Q0));
 203         mcu_txd->pkt_type = MCU_PKT_ID;
 204         mcu_txd->seq = seq;
 205         mcu_txd->cid = mcu_cmd;
 206         mcu_txd->s2d_index = MCU_S2D_H2N;
 207         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 208
 209         if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
 210                 if (cmd & __MCU_CMD_FIELD_QUERY)
 211                         mcu_txd->set_query = MCU_Q_QUERY;
 212                 else
 213                         mcu_txd->set_query = MCU_Q_SET;
 214                 mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
 215         } else {
 216                 mcu_txd->set_query = MCU_Q_NA;
 217         }
 218
 219 exit:
 220         if (wait_seq)
 221                 *wait_seq = seq;
 222
 223         return 0;
 224 }
 225 EXPORT_SYMBOL_GPL(mt7921_mcu_fill_message);
 226
 227 static void
 228 mt7921_mcu_scan_event(struct mt7921_dev *dev, struct sk_buff *skb)
 229 {
 230         struct mt76_phy *mphy = &dev->mt76.phy;
 231         struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
 232
 233         spin_lock_bh(&dev->mt76.lock);
 234         __skb_queue_tail(&phy->scan_event_list, skb);
 235         spin_unlock_bh(&dev->mt76.lock);
 236
 237         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 238                                      MT7921_HW_SCAN_TIMEOUT);
 239 }
 240
 241 static void
 242 mt7921_mcu_connection_loss_iter(void *priv, u8 *mac,
 243                                 struct ieee80211_vif *vif)
 244 {
 245         struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
 246         struct mt76_connac_beacon_loss_event *event = priv;
 247
 248         if (mvif->idx != event->bss_idx)
 249                 return;
 250
 251         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
 252             vif->type != NL80211_IFTYPE_STATION)
 253                 return;
 254
 255         ieee80211_connection_loss(vif);
 256 }
 257
 258 static void
 259 mt7921_mcu_connection_loss_event(struct mt7921_dev *dev, struct sk_buff *skb)
 260 {
 261         struct mt76_connac_beacon_loss_event *event;
 262         struct mt76_phy *mphy = &dev->mt76.phy;
 263
 264         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 265         event = (struct mt76_connac_beacon_loss_event *)skb->data;
 266
 267         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 268                                         IEEE80211_IFACE_ITER_RESUME_ALL,
 269                                         mt7921_mcu_connection_loss_iter, event);
 270 }
 271
 272 static void
 273 mt7921_mcu_bss_event(struct mt7921_dev *dev, struct sk_buff *skb)
 274 {
 275         struct mt76_phy *mphy = &dev->mt76.phy;
 276         struct mt76_connac_mcu_bss_event *event;
 277
 278         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 279         event = (struct mt76_connac_mcu_bss_event *)skb->data;
 280         if (event->is_absent)
 281                 ieee80211_stop_queues(mphy->hw);
 282         else
 283                 ieee80211_wake_queues(mphy->hw);
 284 }
 285
 286 static void
 287 mt7921_mcu_debug_msg_event(struct mt7921_dev *dev, struct sk_buff *skb)
 288 {
 289         struct mt7921_debug_msg {
 290                 __le16 id;
 291                 u8 type;
 292                 u8 flag;
 293                 __le32 value;
 294                 __le16 len;
 295                 u8 content[512];
 296         } __packed * msg;
 297
 298         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 299         msg = (struct mt7921_debug_msg *)skb->data;
 300
 301         if (msg->type == 3) { /* fw log */
 302                 u16 len = min_t(u16, le16_to_cpu(msg->len), 512);
 303                 int i;
 304
 305                 for (i = 0 ; i < len; i++) {
 306                         if (!msg->content[i])
 307                                 msg->content[i] = ' ';
 308                 }
 309                 wiphy_info(mt76_hw(dev)->wiphy, "%.*s", len, msg->content);
 310         }
 311 }
 312
 313 static void
 314 mt7921_mcu_low_power_event(struct mt7921_dev *dev, struct sk_buff *skb)
 315 {
 316         struct mt7921_mcu_lp_event {
 317                 u8 state;
 318                 u8 reserved[3];
 319         } __packed * event;
 320
 321         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 322         event = (struct mt7921_mcu_lp_event *)skb->data;
 323
 324         trace_lp_event(dev, event->state);
 325 }
 326
 327 static void
 328 mt7921_mcu_tx_done_event(struct mt7921_dev *dev, struct sk_buff *skb)
 329 {
 330         struct mt7921_mcu_tx_done_event *event;
 331
 332         skb_pull(skb, sizeof(struct mt7921_mcu_rxd));
 333         event = (struct mt7921_mcu_tx_done_event *)skb->data;
 334
 335         mt7921_mac_add_txs(dev, event->txs);
 336 }
 337
 338 static void
 339 mt7921_mcu_rx_unsolicited_event(struct mt7921_dev *dev, struct sk_buff *skb)
 340 {
 341         struct mt7921_mcu_rxd *rxd = (struct mt7921_mcu_rxd *)skb->data;
 342
 343         switch (rxd->eid) {
 344         case MCU_EVENT_BSS_BEACON_LOSS:
 345                 mt7921_mcu_connection_loss_event(dev, skb);
 346                 break;
 347         case MCU_EVENT_SCHED_SCAN_DONE:
 348         case MCU_EVENT_SCAN_DONE:
 349                 mt7921_mcu_scan_event(dev, skb);
 350                 return;
 351         case MCU_EVENT_BSS_ABSENCE:
 352                 mt7921_mcu_bss_event(dev, skb);
 353                 break;
 354         case MCU_EVENT_DBG_MSG:
 355                 mt7921_mcu_debug_msg_event(dev, skb);
 356                 break;
 357         case MCU_EVENT_COREDUMP:
 358                 dev->fw_assert = true;
 359                 mt76_connac_mcu_coredump_event(&dev->mt76, skb,
 360                                                &dev->coredump);
 361                 return;
 362         case MCU_EVENT_LP_INFO:
 363                 mt7921_mcu_low_power_event(dev, skb);
 364                 break;
 365         case MCU_EVENT_TX_DONE:
 366                 mt7921_mcu_tx_done_event(dev, skb);
 367                 break;
 368         default:
 369                 break;
 370         }
 371         dev_kfree_skb(skb);
 372 }
 373
 374 void mt7921_mcu_rx_event(struct mt7921_dev *dev, struct sk_buff *skb)
 375 {
 376         struct mt7921_mcu_rxd *rxd;
 377
 378         if (skb_linearize(skb))
 379                 return;
 380
 381         rxd = (struct mt7921_mcu_rxd *)skb->data;
 382
 383         if (rxd->eid == 0x6) {
 384                 mt76_mcu_rx_event(&dev->mt76, skb);
 385                 return;
 386         }
 387
 388         if (rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 389             rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 390             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 391             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 392             rxd->eid == MCU_EVENT_SCAN_DONE ||
 393             rxd->eid == MCU_EVENT_TX_DONE ||
 394             rxd->eid == MCU_EVENT_DBG_MSG ||
 395             rxd->eid == MCU_EVENT_COREDUMP ||
 396             rxd->eid == MCU_EVENT_LP_INFO ||
 397             !rxd->seq)
 398                 mt7921_mcu_rx_unsolicited_event(dev, skb);
 399         else
 400                 mt76_mcu_rx_event(&dev->mt76, skb);
 401 }
 402
 403 /** starec & wtbl **/
 404 int mt7921_mcu_uni_tx_ba(struct mt7921_dev *dev,
 405                          struct ieee80211_ampdu_params *params,
 406                          bool enable)
 407 {
 408         struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
 409
 410         if (enable && !params->amsdu)
 411                 msta->wcid.amsdu = false;
 412
 413         return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
 414                                       MCU_UNI_CMD(STA_REC_UPDATE),
 415                                       enable, true);
 416 }
 417
 418 int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
 419                          struct ieee80211_ampdu_params *params,
 420                          bool enable)
 421 {
 422         struct mt7921_sta *msta = (struct mt7921_sta *)params->sta->drv_priv;
 423
 424         return mt76_connac_mcu_sta_ba(&dev->mt76, &msta->vif->mt76, params,
 425                                       MCU_UNI_CMD(STA_REC_UPDATE),
 426                                       enable, false);
 427 }
 428
 429 static u32 mt7921_get_data_mode(struct mt7921_dev *dev, u32 info)
 430 {
 431         u32 mode = DL_MODE_NEED_RSP;
 432
 433         if (info == PATCH_SEC_NOT_SUPPORT)
 434                 return mode;
 435
 436         switch (FIELD_GET(PATCH_SEC_ENC_TYPE_MASK, info)) {
 437         case PATCH_SEC_ENC_TYPE_PLAIN:
 438                 break;
 439         case PATCH_SEC_ENC_TYPE_AES:
 440                 mode |= DL_MODE_ENCRYPT;
 441                 mode |= FIELD_PREP(DL_MODE_KEY_IDX,
 442                                 (info & PATCH_SEC_ENC_AES_KEY_MASK)) & DL_MODE_KEY_IDX;
 443                 mode |= DL_MODE_RESET_SEC_IV;
 444                 break;
 445         case PATCH_SEC_ENC_TYPE_SCRAMBLE:
 446                 mode |= DL_MODE_ENCRYPT;
 447                 mode |= DL_CONFIG_ENCRY_MODE_SEL;
 448                 mode |= DL_MODE_RESET_SEC_IV;
 449                 break;
 450         default:
 451                 dev_err(dev->mt76.dev, "Encryption type not support!\n");
 452         }
 453
 454         return mode;
 455 }
 456
 457 static char *mt7921_patch_name(struct mt7921_dev *dev)
 458 {
 459         char *ret;
 460
 461         if (is_mt7922(&dev->mt76))
 462                 ret = MT7922_ROM_PATCH;
 463         else
 464                 ret = MT7921_ROM_PATCH;
 465
 466         return ret;
 467 }
 468
 469 static int mt7921_load_patch(struct mt7921_dev *dev)
 470 {
 471         const struct mt7921_patch_hdr *hdr;
 472         const struct firmware *fw = NULL;
 473         int i, ret, sem, max_len;
 474
 475         max_len = mt76_is_sdio(&dev->mt76) ? 2048 : 4096;
 476
 477         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
 478         switch (sem) {
 479         case PATCH_IS_DL:
 480                 return 0;
 481         case PATCH_NOT_DL_SEM_SUCCESS:
 482                 break;
 483         default:
 484                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
 485                 return -EAGAIN;
 486         }
 487
 488         ret = request_firmware(&fw, mt7921_patch_name(dev), dev->mt76.dev);
 489         if (ret)
 490                 goto out;
 491
 492         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
 493                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 494                 ret = -EINVAL;
 495                 goto out;
 496         }
 497
 498         hdr = (const struct mt7921_patch_hdr *)(fw->data);
 499
 500         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
 501                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
 502
 503         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
 504                 struct mt7921_patch_sec *sec;
 505                 const u8 *dl;
 506                 u32 len, addr, mode;
 507                 u32 sec_info = 0;
 508
 509                 sec = (struct mt7921_patch_sec *)(fw->data + sizeof(*hdr) +
 510                                                   i * sizeof(*sec));
 511                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
 512                     PATCH_SEC_TYPE_INFO) {
 513                         ret = -EINVAL;
 514                         goto out;
 515                 }
 516
 517                 addr = be32_to_cpu(sec->info.addr);
 518                 len = be32_to_cpu(sec->info.len);
 519                 dl = fw->data + be32_to_cpu(sec->offs);
 520                 sec_info = be32_to_cpu(sec->info.sec_key_idx);
 521                 mode = mt7921_get_data_mode(dev, sec_info);
 522
 523                 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
 524                                                     mode);
 525                 if (ret) {
 526                         dev_err(dev->mt76.dev, "Download request failed\n");
 527                         goto out;
 528                 }
 529
 530                 ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
 531                                                dl, len, max_len);
 532                 if (ret) {
 533                         dev_err(dev->mt76.dev, "Failed to send patch\n");
 534                         goto out;
 535                 }
 536         }
 537
 538         ret = mt76_connac_mcu_start_patch(&dev->mt76);
 539         if (ret)
 540                 dev_err(dev->mt76.dev, "Failed to start patch\n");
 541
 542 out:
 543         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
 544         switch (sem) {
 545         case PATCH_REL_SEM_SUCCESS:
 546                 break;
 547         default:
 548                 ret = -EAGAIN;
 549                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
 550                 break;
 551         }
 552
 553         if (!ret && mt76_is_sdio(&dev->mt76)) {
 554                 /* activate again */
 555                 ret = __mt7921_mcu_fw_pmctrl(dev);
 556                 if (!ret)
 557                         ret = __mt7921_mcu_drv_pmctrl(dev);
 558         }
 559
 560         release_firmware(fw);
 561
 562         return ret;
 563 }
 564
 565 static int
 566 mt7921_mcu_send_ram_firmware(struct mt7921_dev *dev,
 567                              const struct mt7921_fw_trailer *hdr,
 568                              const u8 *data, bool is_wa)
 569 {
 570         int i, offset = 0, max_len;
 571         u32 override = 0, option = 0;
 572
 573         max_len = mt76_is_sdio(&dev->mt76) ? 2048 : 4096;
 574
 575         for (i = 0; i < hdr->n_region; i++) {
 576                 const struct mt7921_fw_region *region;
 577                 int err;
 578                 u32 len, addr, mode;
 579
 580                 region = (const struct mt7921_fw_region *)((const u8 *)hdr -
 581                          (hdr->n_region - i) * sizeof(*region));
 582                 mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
 583                                                    region->feature_set, is_wa);
 584                 len = le32_to_cpu(region->len);
 585                 addr = le32_to_cpu(region->addr);
 586
 587                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
 588                         override = addr;
 589
 590                 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
 591                                                     mode);
 592                 if (err) {
 593                         dev_err(dev->mt76.dev, "Download request failed\n");
 594                         return err;
 595                 }
 596
 597                 err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
 598                                                data + offset, len, max_len);
 599                 if (err) {
 600                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
 601                         return err;
 602                 }
 603
 604                 offset += len;
 605         }
 606
 607         if (override)
 608                 option |= FW_START_OVERRIDE;
 609
 610         if (is_wa)
 611                 option |= FW_START_WORKING_PDA_CR4;
 612
 613         return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
 614 }
 615
 616 static char *mt7921_ram_name(struct mt7921_dev *dev)
 617 {
 618         char *ret;
 619
 620         if (is_mt7922(&dev->mt76))
 621                 ret = MT7922_FIRMWARE_WM;
 622         else
 623                 ret = MT7921_FIRMWARE_WM;
 624
 625         return ret;
 626 }
 627
 628 static int mt7921_load_ram(struct mt7921_dev *dev)
 629 {
 630         const struct mt7921_fw_trailer *hdr;
 631         const struct firmware *fw;
 632         int ret;
 633
 634         ret = request_firmware(&fw, mt7921_ram_name(dev), dev->mt76.dev);
 635         if (ret)
 636                 return ret;
 637
 638         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
 639                 dev_err(dev->mt76.dev, "Invalid firmware\n");
 640                 ret = -EINVAL;
 641                 goto out;
 642         }
 643
 644         hdr = (const struct mt7921_fw_trailer *)(fw->data + fw->size -
 645                                         sizeof(*hdr));
 646
 647         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
 648                  hdr->fw_ver, hdr->build_date);
 649
 650         ret = mt7921_mcu_send_ram_firmware(dev, hdr, fw->data, false);
 651         if (ret) {
 652                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
 653                 goto out;
 654         }
 655
 656         snprintf(dev->mt76.hw->wiphy->fw_version,
 657                  sizeof(dev->mt76.hw->wiphy->fw_version),
 658                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
 659
 660 out:
 661         release_firmware(fw);
 662
 663         return ret;
 664 }
 665
 666 static int mt7921_load_firmware(struct mt7921_dev *dev)
 667 {
 668         int ret;
 669
 670         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
 671         if (ret && mt76_is_mmio(&dev->mt76)) {
 672                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
 673                 goto fw_loaded;
 674         }
 675
 676         ret = mt7921_load_patch(dev);
 677         if (ret)
 678                 return ret;
 679
 680         ret = mt7921_load_ram(dev);
 681         if (ret)
 682                 return ret;
 683
 684         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
 685                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
 686                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
 687
 688                 return -EIO;
 689         }
 690
 691 fw_loaded:
 692
 693 #ifdef CONFIG_PM
 694         dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
 695 #endif /* CONFIG_PM */
 696
 697         dev_dbg(dev->mt76.dev, "Firmware init done\n");
 698
 699         return 0;
 700 }
 701
 702 int mt7921_mcu_fw_log_2_host(struct mt7921_dev *dev, u8 ctrl)
 703 {
 704         struct {
 705                 u8 ctrl_val;
 706                 u8 pad[3];
 707         } data = {
 708                 .ctrl_val = ctrl
 709         };
 710
 711         return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(FWLOG_2_HOST),
 712                                  &data, sizeof(data), false);
 713 }
 714
 715 int mt7921_run_firmware(struct mt7921_dev *dev)
 716 {
 717         int err;
 718
 719         err = mt7921_load_firmware(dev);
 720         if (err)
 721                 return err;
 722
 723         err = mt76_connac_mcu_get_nic_capability(&dev->mphy);
 724         if (err)
 725                 return err;
 726
 727         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
 728         return mt7921_mcu_fw_log_2_host(dev, 1);
 729 }
 730 EXPORT_SYMBOL_GPL(mt7921_run_firmware);
 731
 732 void mt7921_mcu_exit(struct mt7921_dev *dev)
 733 {
 734         skb_queue_purge(&dev->mt76.mcu.res_q);
 735 }
 736 EXPORT_SYMBOL_GPL(mt7921_mcu_exit);
 737
 738 int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif)
 739 {
 740         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
 741         struct edca {
 742                 __le16 cw_min;
 743                 __le16 cw_max;
 744                 __le16 txop;
 745                 __le16 aifs;
 746                 u8 guardtime;
 747                 u8 acm;
 748         } __packed;
 749         struct mt7921_mcu_tx {
 750                 struct edca edca[IEEE80211_NUM_ACS];
 751                 u8 bss_idx;
 752                 u8 qos;
 753                 u8 wmm_idx;
 754                 u8 pad;
 755         } __packed req = {
 756                 .bss_idx = mvif->mt76.idx,
 757                 .qos = vif->bss_conf.qos,
 758                 .wmm_idx = mvif->mt76.wmm_idx,
 759         };
 760         struct mu_edca {
 761                 u8 cw_min;
 762                 u8 cw_max;
 763                 u8 aifsn;
 764                 u8 acm;
 765                 u8 timer;
 766                 u8 padding[3];
 767         };
 768         struct mt7921_mcu_mu_tx {
 769                 u8 ver;
 770                 u8 pad0;
 771                 __le16 len;
 772                 u8 bss_idx;
 773                 u8 qos;
 774                 u8 wmm_idx;
 775                 u8 pad1;
 776                 struct mu_edca edca[IEEE80211_NUM_ACS];
 777                 u8 pad3[32];
 778         } __packed req_mu = {
 779                 .bss_idx = mvif->mt76.idx,
 780                 .qos = vif->bss_conf.qos,
 781                 .wmm_idx = mvif->mt76.wmm_idx,
 782         };
 783         static const int to_aci[] = { 1, 0, 2, 3 };
 784         int ac, ret;
 785
 786         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 787                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
 788                 struct edca *e = &req.edca[to_aci[ac]];
 789
 790                 e->aifs = cpu_to_le16(q->aifs);
 791                 e->txop = cpu_to_le16(q->txop);
 792
 793                 if (q->cw_min)
 794                         e->cw_min = cpu_to_le16(q->cw_min);
 795                 else
 796                         e->cw_min = cpu_to_le16(5);
 797
 798                 if (q->cw_max)
 799                         e->cw_max = cpu_to_le16(q->cw_max);
 800                 else
 801                         e->cw_max = cpu_to_le16(10);
 802         }
 803
 804         ret = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_EDCA_PARMS), &req,
 805                                 sizeof(req), false);
 806         if (ret)
 807                 return ret;
 808
 809         if (!vif->bss_conf.he_support)
 810                 return 0;
 811
 812         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 813                 struct ieee80211_he_mu_edca_param_ac_rec *q;
 814                 struct mu_edca *e;
 815
 816                 if (!mvif->queue_params[ac].mu_edca)
 817                         break;
 818
 819                 q = &mvif->queue_params[ac].mu_edca_param_rec;
 820                 e = &(req_mu.edca[to_aci[ac]]);
 821
 822                 e->cw_min = q->ecw_min_max & 0xf;
 823                 e->cw_max = (q->ecw_min_max & 0xf0) >> 4;
 824                 e->aifsn = q->aifsn;
 825                 e->timer = q->mu_edca_timer;
 826         }
 827
 828         return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_MU_EDCA_PARMS),
 829                                  &req_mu, sizeof(req_mu), false);
 830 }
 831
 832 int mt7921_mcu_set_chan_info(struct mt7921_phy *phy, int cmd)
 833 {
 834         struct mt7921_dev *dev = phy->dev;
 835         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 836         int freq1 = chandef->center_freq1;
 837         struct {
 838                 u8 control_ch;
 839                 u8 center_ch;
 840                 u8 bw;
 841                 u8 tx_streams_num;
 842                 u8 rx_streams;  /* mask or num */
 843                 u8 switch_reason;
 844                 u8 band_idx;
 845                 u8 center_ch2;  /* for 80+80 only */
 846                 __le16 cac_case;
 847                 u8 channel_band;
 848                 u8 rsv0;
 849                 __le32 outband_freq;
 850                 u8 txpower_drop;
 851                 u8 ap_bw;
 852                 u8 ap_center_ch;
 853                 u8 rsv1[57];
 854         } __packed req = {
 855                 .control_ch = chandef->chan->hw_value,
 856                 .center_ch = ieee80211_frequency_to_channel(freq1),
 857                 .bw = mt76_connac_chan_bw(chandef),
 858                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
 859                 .rx_streams = phy->mt76->antenna_mask,
 860                 .band_idx = phy != &dev->phy,
 861         };
 862
 863         if (chandef->chan->band == NL80211_BAND_6GHZ)
 864                 req.channel_band = 2;
 865         else
 866                 req.channel_band = chandef->chan->band;
 867
 868         if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
 869             dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
 870                 req.switch_reason = CH_SWITCH_NORMAL;
 871         else if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
 872                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
 873         else if (!cfg80211_reg_can_beacon(dev->mt76.hw->wiphy, chandef,
 874                                           NL80211_IFTYPE_AP))
 875                 req.switch_reason = CH_SWITCH_DFS;
 876         else
 877                 req.switch_reason = CH_SWITCH_NORMAL;
 878
 879         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
 880                 req.rx_streams = hweight8(req.rx_streams);
 881
 882         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 883                 int freq2 = chandef->center_freq2;
 884
 885                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
 886         }
 887
 888         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
 889 }
 890
 891 int mt7921_mcu_set_eeprom(struct mt7921_dev *dev)
 892 {
 893         struct req_hdr {
 894                 u8 buffer_mode;
 895                 u8 format;
 896                 __le16 len;
 897         } __packed req = {
 898                 .buffer_mode = EE_MODE_EFUSE,
 899                 .format = EE_FORMAT_WHOLE,
 900         };
 901
 902         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 903                                  &req, sizeof(req), true);
 904 }
 905 EXPORT_SYMBOL_GPL(mt7921_mcu_set_eeprom);
 906
 907 int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif)
 908 {
 909         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
 910         struct {
 911                 struct {
 912                         u8 bss_idx;
 913                         u8 pad[3];
 914                 } __packed hdr;
 915                 struct ps_tlv {
 916                         __le16 tag;
 917                         __le16 len;
 918                         u8 ps_state; /* 0: device awake
 919                                       * 1: static power save
 920                                       * 2: dynamic power saving
 921                                       * 3: enter TWT power saving
 922                                       * 4: leave TWT power saving
 923                                       */
 924                         u8 pad[3];
 925                 } __packed ps;
 926         } __packed ps_req = {
 927                 .hdr = {
 928                         .bss_idx = mvif->mt76.idx,
 929                 },
 930                 .ps = {
 931                         .tag = cpu_to_le16(UNI_BSS_INFO_PS),
 932                         .len = cpu_to_le16(sizeof(struct ps_tlv)),
 933                         .ps_state = vif->bss_conf.ps ? 2 : 0,
 934                 },
 935         };
 936
 937         if (vif->type != NL80211_IFTYPE_STATION)
 938                 return -EOPNOTSUPP;
 939
 940         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
 941                                  &ps_req, sizeof(ps_req), true);
 942 }
 943
 944 static int
 945 mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
 946                          bool enable)
 947 {
 948         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
 949         struct {
 950                 struct {
 951                         u8 bss_idx;
 952                         u8 pad[3];
 953                 } __packed hdr;
 954                 struct bcnft_tlv {
 955                         __le16 tag;
 956                         __le16 len;
 957                         __le16 bcn_interval;
 958                         u8 dtim_period;
 959                         u8 pad;
 960                 } __packed bcnft;
 961         } __packed bcnft_req = {
 962                 .hdr = {
 963                         .bss_idx = mvif->mt76.idx,
 964                 },
 965                 .bcnft = {
 966                         .tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
 967                         .len = cpu_to_le16(sizeof(struct bcnft_tlv)),
 968                         .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
 969                         .dtim_period = vif->bss_conf.dtim_period,
 970                 },
 971         };
 972
 973         if (vif->type != NL80211_IFTYPE_STATION)
 974                 return 0;
 975
 976         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
 977                                  &bcnft_req, sizeof(bcnft_req), true);
 978 }
 979
 980 static int
 981 mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
 982                       bool enable)
 983 {
 984         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
 985         struct {
 986                 u8 bss_idx;
 987                 u8 dtim_period;
 988                 __le16 aid;
 989                 __le16 bcn_interval;
 990                 __le16 atim_window;
 991                 u8 uapsd;
 992                 u8 bmc_delivered_ac;
 993                 u8 bmc_triggered_ac;
 994                 u8 pad;
 995         } req = {
 996                 .bss_idx = mvif->mt76.idx,
 997                 .aid = cpu_to_le16(vif->bss_conf.aid),
 998                 .dtim_period = vif->bss_conf.dtim_period,
 999                 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1000         };
1001         struct {
1002                 u8 bss_idx;
1003                 u8 pad[3];
1004         } req_hdr = {
1005                 .bss_idx = mvif->mt76.idx,
1006         };
1007         int err;
1008
1009         if (vif->type != NL80211_IFTYPE_STATION)
1010                 return 0;
1011
1012         err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
1013                                 &req_hdr, sizeof(req_hdr), false);
1014         if (err < 0 || !enable)
1015                 return err;
1016
1017         return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
1018                                  &req, sizeof(req), false);
1019 }
1020
1021 int mt7921_mcu_sta_update(struct mt7921_dev *dev, struct ieee80211_sta *sta,
1022                           struct ieee80211_vif *vif, bool enable,
1023                           enum mt76_sta_info_state state)
1024 {
1025         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1026         int rssi = -ewma_rssi_read(&mvif->rssi);
1027         struct mt76_sta_cmd_info info = {
1028                 .sta = sta,
1029                 .vif = vif,
1030                 .enable = enable,
1031                 .cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1032                 .state = state,
1033                 .offload_fw = true,
1034                 .rcpi = to_rcpi(rssi),
1035         };
1036         struct mt7921_sta *msta;
1037
1038         msta = sta ? (struct mt7921_sta *)sta->drv_priv : NULL;
1039         info.wcid = msta ? &msta->wcid : &mvif->sta.wcid;
1040         info.newly = msta ? state != MT76_STA_INFO_STATE_ASSOC : true;
1041
1042         return mt76_connac_mcu_sta_cmd(&dev->mphy, &info);
1043 }
1044
1045 int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
1046 {
1047         struct mt76_phy *mphy = &dev->mt76.phy;
1048         struct mt76_connac_pm *pm = &dev->pm;
1049         int err = 0;
1050
1051         mutex_lock(&pm->mutex);
1052
1053         if (!test_bit(MT76_STATE_PM, &mphy->state))
1054                 goto out;
1055
1056         err = __mt7921_mcu_drv_pmctrl(dev);
1057 out:
1058         mutex_unlock(&pm->mutex);
1059
1060         if (err)
1061                 mt7921_reset(&dev->mt76);
1062
1063         return err;
1064 }
1065 EXPORT_SYMBOL_GPL(mt7921_mcu_drv_pmctrl);
1066
1067 int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev)
1068 {
1069         struct mt76_phy *mphy = &dev->mt76.phy;
1070         struct mt76_connac_pm *pm = &dev->pm;
1071         int err = 0;
1072
1073         mutex_lock(&pm->mutex);
1074
1075         if (mt76_connac_skip_fw_pmctrl(mphy, pm))
1076                 goto out;
1077
1078         err = __mt7921_mcu_fw_pmctrl(dev);
1079 out:
1080         mutex_unlock(&pm->mutex);
1081
1082         if (err)
1083                 mt7921_reset(&dev->mt76);
1084
1085         return err;
1086 }
1087 EXPORT_SYMBOL_GPL(mt7921_mcu_fw_pmctrl);
1088
1089 int mt7921_mcu_set_beacon_filter(struct mt7921_dev *dev,
1090                                  struct ieee80211_vif *vif,
1091                                  bool enable)
1092 {
1093         struct ieee80211_hw *hw = mt76_hw(dev);
1094         int err;
1095
1096         if (enable) {
1097                 err = mt7921_mcu_uni_bss_bcnft(dev, vif, true);
1098                 if (err)
1099                         return err;
1100
1101                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
1102                 ieee80211_hw_set(hw, CONNECTION_MONITOR);
1103                 mt76_set(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1104
1105                 return 0;
1106         }
1107
1108         err = mt7921_mcu_set_bss_pm(dev, vif, false);
1109         if (err)
1110                 return err;
1111
1112         vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
1113         __clear_bit(IEEE80211_HW_CONNECTION_MONITOR, hw->flags);
1114         mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
1115
1116         return 0;
1117 }
1118
1119 int mt7921_get_txpwr_info(struct mt7921_dev *dev, struct mt7921_txpwr *txpwr)
1120 {
1121         struct mt7921_txpwr_event *event;
1122         struct mt7921_txpwr_req req = {
1123                 .dbdc_idx = 0,
1124         };
1125         struct sk_buff *skb;
1126         int ret;
1127
1128         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CE_CMD(GET_TXPWR),
1129                                         &req, sizeof(req), true, &skb);
1130         if (ret)
1131                 return ret;
1132
1133         event = (struct mt7921_txpwr_event *)skb->data;
1134         WARN_ON(skb->len != le16_to_cpu(event->len));
1135         memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1136
1137         dev_kfree_skb(skb);
1138
1139         return 0;
1140 }
1141
1142 int mt7921_mcu_set_sniffer(struct mt7921_dev *dev, struct ieee80211_vif *vif,
1143                            bool enable)
1144 {
1145         struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1146         struct {
1147                 struct {
1148                         u8 band_idx;
1149                         u8 pad[3];
1150                 } __packed hdr;
1151                 struct sniffer_enable_tlv {
1152                         __le16 tag;
1153                         __le16 len;
1154                         u8 enable;
1155                         u8 pad[3];
1156                 } __packed enable;
1157         } req = {
1158                 .hdr = {
1159                         .band_idx = mvif->band_idx,
1160                 },
1161                 .enable = {
1162                         .tag = cpu_to_le16(0),
1163                         .len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
1164                         .enable = enable,
1165                 },
1166         };
1167
1168         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
1169                                  true);
1170 }
1171
1172 int
1173 mt7921_mcu_uni_add_beacon_offload(struct mt7921_dev *dev,
1174                                   struct ieee80211_hw *hw,
1175                                   struct ieee80211_vif *vif,
1176                                   bool enable)
1177 {
1178         struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
1179         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1180         struct ieee80211_mutable_offsets offs;
1181         struct {
1182                 struct req_hdr {
1183                         u8 bss_idx;
1184                         u8 pad[3];
1185                 } __packed hdr;
1186                 struct bcn_content_tlv {
1187                         __le16 tag;
1188                         __le16 len;
1189                         __le16 tim_ie_pos;
1190                         __le16 csa_ie_pos;
1191                         __le16 bcc_ie_pos;
1192                         /* 0: disable beacon offload
1193                          * 1: enable beacon offload
1194                          * 2: update probe respond offload
1195                          */
1196                         u8 enable;
1197                         /* 0: legacy format (TXD + payload)
1198                          * 1: only cap field IE
1199                          */
1200                         u8 type;
1201                         __le16 pkt_len;
1202                         u8 pkt[512];
1203                 } __packed beacon_tlv;
1204         } req = {
1205                 .hdr = {
1206                         .bss_idx = mvif->mt76.idx,
1207                 },
1208                 .beacon_tlv = {
1209                         .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1210                         .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1211                         .enable = enable,
1212                 },
1213         };
1214         struct sk_buff *skb;
1215
1216         if (!enable)
1217                 goto out;
1218
1219         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1220         if (!skb)
1221                 return -EINVAL;
1222
1223         if (skb->len > 512 - MT_TXD_SIZE) {
1224                 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1225                 dev_kfree_skb(skb);
1226                 return -EINVAL;
1227         }
1228
1229         mt7921_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1230                               wcid, NULL, 0, true);
1231         memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1232         req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1233         req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1234
1235         if (offs.cntdwn_counter_offs[0]) {
1236                 u16 csa_offs;
1237
1238                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1239                 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1240         }
1241         dev_kfree_skb(skb);
1242
1243 out:
1244         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1245                                  &req, sizeof(req), true);
1246 }