xref: /linux/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c (revision 5e0266f0e5f57617472d5aac4013f58a3ef264ac)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_buf {
44 	__le32 crc;
45 	__le32 d_img_size;
46 	__le32 block_size;
47 	u8 rsv[4];
48 	__le32 img_dest_addr;
49 	__le32 img_size;
50 	u8 feature_set;
51 };
52 
53 #define MT7615_PATCH_ADDRESS		0x80000
54 #define MT7622_PATCH_ADDRESS		0x9c000
55 #define MT7663_PATCH_ADDRESS		0xdc000
56 
57 #define N9_REGION_NUM			2
58 #define CR4_REGION_NUM			1
59 
60 #define IMG_CRC_LEN			4
61 
62 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
63 			 int cmd, int *wait_seq)
64 {
65 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
66 	struct mt7615_uni_txd *uni_txd;
67 	struct mt7615_mcu_txd *mcu_txd;
68 	u8 seq, q_idx, pkt_fmt;
69 	__le32 *txd;
70 	u32 val;
71 
72 	/* TODO: make dynamic based on msg type */
73 	dev->mt76.mcu.timeout = 20 * HZ;
74 
75 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
76 	if (!seq)
77 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
78 	if (wait_seq)
79 		*wait_seq = seq;
80 
81 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
82 	txd = (__le32 *)skb_push(skb, txd_len);
83 
84 	if (cmd != MCU_CMD(FW_SCATTER)) {
85 		q_idx = MT_TX_MCU_PORT_RX_Q0;
86 		pkt_fmt = MT_TX_TYPE_CMD;
87 	} else {
88 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
89 		pkt_fmt = MT_TX_TYPE_FW;
90 	}
91 
92 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
93 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
94 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
95 	txd[0] = cpu_to_le32(val);
96 
97 	val = MT_TXD1_LONG_FORMAT |
98 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
99 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
100 	txd[1] = cpu_to_le32(val);
101 
102 	if (cmd & __MCU_CMD_FIELD_UNI) {
103 		uni_txd = (struct mt7615_uni_txd *)txd;
104 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
105 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
106 		uni_txd->cid = cpu_to_le16(mcu_cmd);
107 		uni_txd->s2d_index = MCU_S2D_H2N;
108 		uni_txd->pkt_type = MCU_PKT_ID;
109 		uni_txd->seq = seq;
110 
111 		return;
112 	}
113 
114 	mcu_txd = (struct mt7615_mcu_txd *)txd;
115 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
116 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
117 	mcu_txd->s2d_index = MCU_S2D_H2N;
118 	mcu_txd->pkt_type = MCU_PKT_ID;
119 	mcu_txd->seq = seq;
120 	mcu_txd->cid = mcu_cmd;
121 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
122 
123 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
124 		if (cmd & __MCU_CMD_FIELD_QUERY)
125 			mcu_txd->set_query = MCU_Q_QUERY;
126 		else
127 			mcu_txd->set_query = MCU_Q_SET;
128 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
129 	} else {
130 		mcu_txd->set_query = MCU_Q_NA;
131 	}
132 }
133 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
134 
135 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
136 			      struct sk_buff *skb, int seq)
137 {
138 	struct mt7615_mcu_rxd *rxd;
139 	int ret = 0;
140 
141 	if (!skb) {
142 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
143 			cmd, seq);
144 		return -ETIMEDOUT;
145 	}
146 
147 	rxd = (struct mt7615_mcu_rxd *)skb->data;
148 	if (seq != rxd->seq)
149 		return -EAGAIN;
150 
151 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
152 		skb_pull(skb, sizeof(*rxd) - 4);
153 		ret = *skb->data;
154 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
155 		skb_pull(skb, sizeof(*rxd));
156 		ret = le32_to_cpu(*(__le32 *)skb->data);
157 	} else if (cmd == MCU_EXT_QUERY(RF_REG_ACCESS)) {
158 		skb_pull(skb, sizeof(*rxd));
159 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
160 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
161 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
162 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
163 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
164 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
165 		   cmd == MCU_UNI_CMD(SUSPEND)) {
166 		struct mt7615_mcu_uni_event *event;
167 
168 		skb_pull(skb, sizeof(*rxd));
169 		event = (struct mt7615_mcu_uni_event *)skb->data;
170 		ret = le32_to_cpu(event->status);
171 	} else if (cmd == MCU_CE_QUERY(REG_READ)) {
172 		struct mt7615_mcu_reg_event *event;
173 
174 		skb_pull(skb, sizeof(*rxd));
175 		event = (struct mt7615_mcu_reg_event *)skb->data;
176 		ret = (int)le32_to_cpu(event->val);
177 	}
178 
179 	return ret;
180 }
181 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
182 
183 static int
184 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
185 			int cmd, int *seq)
186 {
187 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
188 	enum mt76_mcuq_id qid;
189 
190 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
191 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
192 		qid = MT_MCUQ_WM;
193 	else
194 		qid = MT_MCUQ_FWDL;
195 
196 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
197 }
198 
199 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
200 {
201 	struct {
202 		__le32 wifi_stream;
203 		__le32 address;
204 		__le32 data;
205 	} req = {
206 		.wifi_stream = cpu_to_le32(wf),
207 		.address = cpu_to_le32(reg),
208 	};
209 
210 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
211 				 &req, sizeof(req), true);
212 }
213 
214 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
215 {
216 	struct {
217 		__le32 wifi_stream;
218 		__le32 address;
219 		__le32 data;
220 	} req = {
221 		.wifi_stream = cpu_to_le32(wf),
222 		.address = cpu_to_le32(reg),
223 		.data = cpu_to_le32(val),
224 	};
225 
226 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
227 				 &req, sizeof(req), false);
228 }
229 
230 void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
231 {
232 	if (!is_mt7622(&dev->mt76))
233 		return;
234 
235 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
236 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
237 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
238 }
239 EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
240 
241 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
242 {
243 	struct mt76_phy *mphy = &dev->mt76.phy;
244 	struct mt76_connac_pm *pm = &dev->pm;
245 	struct mt76_dev *mdev = &dev->mt76;
246 	u32 addr;
247 	int err;
248 
249 	if (is_mt7663(mdev)) {
250 		/* Clear firmware own via N9 eint */
251 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
252 		mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
253 
254 		addr = MT_CONN_HIF_ON_LPCTL;
255 	} else {
256 		addr = MT_CFG_LPCR_HOST;
257 	}
258 
259 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
260 
261 	mt7622_trigger_hif_int(dev, true);
262 
263 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
264 
265 	mt7622_trigger_hif_int(dev, false);
266 
267 	if (err) {
268 		dev_err(mdev->dev, "driver own failed\n");
269 		return -ETIMEDOUT;
270 	}
271 
272 	clear_bit(MT76_STATE_PM, &mphy->state);
273 
274 	pm->stats.last_wake_event = jiffies;
275 	pm->stats.doze_time += pm->stats.last_wake_event -
276 			       pm->stats.last_doze_event;
277 
278 	return 0;
279 }
280 
281 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
282 {
283 	struct mt76_phy *mphy = &dev->mt76.phy;
284 	struct mt76_connac_pm *pm = &dev->pm;
285 	int i, err = 0;
286 
287 	mutex_lock(&pm->mutex);
288 
289 	if (!test_bit(MT76_STATE_PM, &mphy->state))
290 		goto out;
291 
292 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
293 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
294 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
295 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
296 			break;
297 	}
298 
299 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
300 		dev_err(dev->mt76.dev, "driver own failed\n");
301 		err = -EIO;
302 		goto out;
303 	}
304 	clear_bit(MT76_STATE_PM, &mphy->state);
305 
306 	pm->stats.last_wake_event = jiffies;
307 	pm->stats.doze_time += pm->stats.last_wake_event -
308 			       pm->stats.last_doze_event;
309 out:
310 	mutex_unlock(&pm->mutex);
311 
312 	return err;
313 }
314 
315 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
316 {
317 	struct mt76_phy *mphy = &dev->mt76.phy;
318 	struct mt76_connac_pm *pm = &dev->pm;
319 	int err = 0;
320 	u32 addr;
321 
322 	mutex_lock(&pm->mutex);
323 
324 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
325 		goto out;
326 
327 	mt7622_trigger_hif_int(dev, true);
328 
329 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
330 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
331 
332 	if (is_mt7622(&dev->mt76) &&
333 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
334 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
335 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
336 		clear_bit(MT76_STATE_PM, &mphy->state);
337 		err = -EIO;
338 	}
339 
340 	mt7622_trigger_hif_int(dev, false);
341 	if (!err) {
342 		pm->stats.last_doze_event = jiffies;
343 		pm->stats.awake_time += pm->stats.last_doze_event -
344 					pm->stats.last_wake_event;
345 	}
346 out:
347 	mutex_unlock(&pm->mutex);
348 
349 	return err;
350 }
351 
352 static void
353 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
354 {
355 	if (vif->bss_conf.csa_active)
356 		ieee80211_csa_finish(vif);
357 }
358 
359 static void
360 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
361 {
362 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
363 	struct mt76_phy *mphy = &dev->mt76.phy;
364 	struct mt7615_mcu_csa_notify *c;
365 
366 	c = (struct mt7615_mcu_csa_notify *)skb->data;
367 
368 	if (c->omac_idx > EXT_BSSID_MAX)
369 		return;
370 
371 	if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
372 		mphy = dev->mt76.phys[MT_BAND1];
373 
374 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
375 			IEEE80211_IFACE_ITER_RESUME_ALL,
376 			mt7615_mcu_csa_finish, mphy->hw);
377 }
378 
379 static void
380 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
381 {
382 	struct mt76_phy *mphy = &dev->mt76.phy;
383 	struct mt7615_mcu_rdd_report *r;
384 
385 	r = (struct mt7615_mcu_rdd_report *)skb->data;
386 
387 	if (!dev->radar_pattern.n_pulses && !r->long_detected &&
388 	    !r->constant_prf_detected && !r->staggered_prf_detected)
389 		return;
390 
391 	if (r->band_idx && dev->mt76.phys[MT_BAND1])
392 		mphy = dev->mt76.phys[MT_BAND1];
393 
394 	if (mt76_phy_dfs_state(mphy) < MT_DFS_STATE_CAC)
395 		return;
396 
397 	ieee80211_radar_detected(mphy->hw);
398 	dev->hw_pattern++;
399 }
400 
401 static void
402 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
403 {
404 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
405 	const char *data = (char *)&rxd[1];
406 	const char *type;
407 
408 	switch (rxd->s2d_index) {
409 	case 0:
410 		type = "N9";
411 		break;
412 	case 2:
413 		type = "CR4";
414 		break;
415 	default:
416 		type = "unknown";
417 		break;
418 	}
419 
420 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
421 		   (int)(skb->len - sizeof(*rxd)), data);
422 }
423 
424 static void
425 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
426 {
427 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
428 
429 	switch (rxd->ext_eid) {
430 	case MCU_EXT_EVENT_RDD_REPORT:
431 		mt7615_mcu_rx_radar_detected(dev, skb);
432 		break;
433 	case MCU_EXT_EVENT_CSA_NOTIFY:
434 		mt7615_mcu_rx_csa_notify(dev, skb);
435 		break;
436 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
437 		mt7615_mcu_rx_log_message(dev, skb);
438 		break;
439 	default:
440 		break;
441 	}
442 }
443 
444 static void
445 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
446 {
447 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
448 	struct mt7615_phy *phy;
449 	struct mt76_phy *mphy;
450 
451 	if (*seq_num & BIT(7) && dev->mt76.phys[MT_BAND1])
452 		mphy = dev->mt76.phys[MT_BAND1];
453 	else
454 		mphy = &dev->mt76.phy;
455 
456 	phy = (struct mt7615_phy *)mphy->priv;
457 
458 	spin_lock_bh(&dev->mt76.lock);
459 	__skb_queue_tail(&phy->scan_event_list, skb);
460 	spin_unlock_bh(&dev->mt76.lock);
461 
462 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
463 				     MT7615_HW_SCAN_TIMEOUT);
464 }
465 
466 static void
467 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
468 {
469 	struct mt7615_roc_tlv *event;
470 	struct mt7615_phy *phy;
471 	struct mt76_phy *mphy;
472 	int duration;
473 
474 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
475 	event = (struct mt7615_roc_tlv *)skb->data;
476 
477 	if (event->dbdc_band && dev->mt76.phys[MT_BAND1])
478 		mphy = dev->mt76.phys[MT_BAND1];
479 	else
480 		mphy = &dev->mt76.phy;
481 
482 	ieee80211_ready_on_channel(mphy->hw);
483 
484 	phy = (struct mt7615_phy *)mphy->priv;
485 	phy->roc_grant = true;
486 	wake_up(&phy->roc_wait);
487 
488 	duration = le32_to_cpu(event->max_interval);
489 	mod_timer(&phy->roc_timer,
490 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
491 }
492 
493 static void
494 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
495 {
496 	struct mt76_connac_beacon_loss_event *event;
497 	struct mt76_phy *mphy;
498 	u8 band_idx = 0; /* DBDC support */
499 
500 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
501 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
502 	if (band_idx && dev->mt76.phys[MT_BAND1])
503 		mphy = dev->mt76.phys[MT_BAND1];
504 	else
505 		mphy = &dev->mt76.phy;
506 
507 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
508 					IEEE80211_IFACE_ITER_RESUME_ALL,
509 					mt76_connac_mcu_beacon_loss_iter,
510 					event);
511 }
512 
513 static void
514 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
515 {
516 	struct mt76_connac_mcu_bss_event *event;
517 	struct mt76_phy *mphy;
518 	u8 band_idx = 0; /* DBDC support */
519 
520 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
521 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
522 
523 	if (band_idx && dev->mt76.phys[MT_BAND1])
524 		mphy = dev->mt76.phys[MT_BAND1];
525 	else
526 		mphy = &dev->mt76.phy;
527 
528 	if (event->is_absent)
529 		ieee80211_stop_queues(mphy->hw);
530 	else
531 		ieee80211_wake_queues(mphy->hw);
532 }
533 
534 static void
535 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
536 {
537 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
538 
539 	switch (rxd->eid) {
540 	case MCU_EVENT_EXT:
541 		mt7615_mcu_rx_ext_event(dev, skb);
542 		break;
543 	case MCU_EVENT_BSS_BEACON_LOSS:
544 		mt7615_mcu_beacon_loss_event(dev, skb);
545 		break;
546 	case MCU_EVENT_ROC:
547 		mt7615_mcu_roc_event(dev, skb);
548 		break;
549 	case MCU_EVENT_SCHED_SCAN_DONE:
550 	case MCU_EVENT_SCAN_DONE:
551 		mt7615_mcu_scan_event(dev, skb);
552 		return;
553 	case MCU_EVENT_BSS_ABSENCE:
554 		mt7615_mcu_bss_event(dev, skb);
555 		break;
556 	case MCU_EVENT_COREDUMP:
557 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
558 					       &dev->coredump);
559 		return;
560 	default:
561 		break;
562 	}
563 	dev_kfree_skb(skb);
564 }
565 
566 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
567 {
568 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
569 
570 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
571 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
572 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
573 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
574 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
575 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
576 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
577 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
578 	    rxd->eid == MCU_EVENT_COREDUMP ||
579 	    rxd->eid == MCU_EVENT_ROC ||
580 	    !rxd->seq)
581 		mt7615_mcu_rx_unsolicited_event(dev, skb);
582 	else
583 		mt76_mcu_rx_event(&dev->mt76, skb);
584 }
585 
586 static int
587 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
588 		       bool bssid, bool enable)
589 {
590 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
591 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
592 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
593 	const u8 *addr = vif->addr;
594 	struct {
595 		u8 mode;
596 		u8 force_clear;
597 		u8 clear_bitmap[8];
598 		u8 entry_count;
599 		u8 write;
600 
601 		u8 index;
602 		u8 bssid;
603 		u8 addr[ETH_ALEN];
604 	} __packed req = {
605 		.mode = !!mask || enable,
606 		.entry_count = 1,
607 		.write = 1,
608 
609 		.index = idx * 2 + bssid,
610 	};
611 
612 	if (bssid)
613 		addr = vif->bss_conf.bssid;
614 
615 	if (enable)
616 		ether_addr_copy(req.addr, addr);
617 
618 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE),
619 				 &req, sizeof(req), true);
620 }
621 
622 static int
623 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
624 		   bool enable)
625 {
626 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
627 	struct mt7615_dev *dev = phy->dev;
628 	struct {
629 		struct req_hdr {
630 			u8 omac_idx;
631 			u8 band_idx;
632 			__le16 tlv_num;
633 			u8 is_tlv_append;
634 			u8 rsv[3];
635 		} __packed hdr;
636 		struct req_tlv {
637 			__le16 tag;
638 			__le16 len;
639 			u8 active;
640 			u8 band_idx;
641 			u8 omac_addr[ETH_ALEN];
642 		} __packed tlv;
643 	} data = {
644 		.hdr = {
645 			.omac_idx = mvif->mt76.omac_idx,
646 			.band_idx = mvif->mt76.band_idx,
647 			.tlv_num = cpu_to_le16(1),
648 			.is_tlv_append = 1,
649 		},
650 		.tlv = {
651 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
652 			.len = cpu_to_le16(sizeof(struct req_tlv)),
653 			.active = enable,
654 			.band_idx = mvif->mt76.band_idx,
655 		},
656 	};
657 
658 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
659 		return mt7615_mcu_muar_config(dev, vif, false, enable);
660 
661 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
662 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
663 				 &data, sizeof(data), true);
664 }
665 
666 static int
667 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
668 			      struct ieee80211_hw *hw,
669 			      struct ieee80211_vif *vif, bool enable)
670 {
671 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
672 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
673 	struct ieee80211_mutable_offsets offs;
674 	struct ieee80211_tx_info *info;
675 	struct req {
676 		u8 omac_idx;
677 		u8 enable;
678 		u8 wlan_idx;
679 		u8 band_idx;
680 		u8 pkt_type;
681 		u8 need_pre_tbtt_int;
682 		__le16 csa_ie_pos;
683 		__le16 pkt_len;
684 		__le16 tim_ie_pos;
685 		u8 pkt[512];
686 		u8 csa_cnt;
687 		/* bss color change */
688 		u8 bcc_cnt;
689 		__le16 bcc_ie_pos;
690 	} __packed req = {
691 		.omac_idx = mvif->mt76.omac_idx,
692 		.enable = enable,
693 		.wlan_idx = wcid->idx,
694 		.band_idx = mvif->mt76.band_idx,
695 	};
696 	struct sk_buff *skb;
697 
698 	if (!enable)
699 		goto out;
700 
701 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
702 	if (!skb)
703 		return -EINVAL;
704 
705 	if (skb->len > 512 - MT_TXD_SIZE) {
706 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
707 		dev_kfree_skb(skb);
708 		return -EINVAL;
709 	}
710 
711 	info = IEEE80211_SKB_CB(skb);
712 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, mvif->mt76.band_idx);
713 
714 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
715 			      0, NULL, 0, true);
716 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
717 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
718 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
719 	if (offs.cntdwn_counter_offs[0]) {
720 		u16 csa_offs;
721 
722 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
723 		req.csa_ie_pos = cpu_to_le16(csa_offs);
724 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
725 	}
726 	dev_kfree_skb(skb);
727 
728 out:
729 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(BCN_OFFLOAD), &req,
730 				 sizeof(req), true);
731 }
732 
733 static int
734 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
735 {
736 	return mt76_connac_mcu_set_pm(&dev->mt76, band, state);
737 }
738 
739 static int
740 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
741 		   struct ieee80211_sta *sta, bool enable)
742 {
743 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
744 	struct mt7615_dev *dev = phy->dev;
745 	struct sk_buff *skb;
746 
747 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
748 		mt7615_mcu_muar_config(dev, vif, true, enable);
749 
750 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
751 	if (IS_ERR(skb))
752 		return PTR_ERR(skb);
753 
754 	if (enable)
755 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
756 
757 	mt76_connac_mcu_bss_basic_tlv(skb, vif, sta, phy->mt76,
758 				      mvif->sta.wcid.idx, enable);
759 
760 	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
761 	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
762 		mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
763 
764 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
765 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
766 }
767 
768 static int
769 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
770 		      struct ieee80211_ampdu_params *params,
771 		      bool enable)
772 {
773 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
774 	struct mt7615_vif *mvif = msta->vif;
775 	struct wtbl_req_hdr *wtbl_hdr;
776 	struct sk_buff *skb = NULL;
777 	int err;
778 
779 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
780 						  WTBL_SET, NULL, &skb);
781 	if (IS_ERR(wtbl_hdr))
782 		return PTR_ERR(wtbl_hdr);
783 
784 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
785 				    NULL, wtbl_hdr);
786 
787 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
788 				    MCU_EXT_CMD(WTBL_UPDATE), true);
789 	if (err < 0)
790 		return err;
791 
792 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
793 					    &msta->wcid);
794 	if (IS_ERR(skb))
795 		return PTR_ERR(skb);
796 
797 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
798 
799 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
800 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
801 }
802 
803 static int
804 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
805 		      struct ieee80211_ampdu_params *params,
806 		      bool enable)
807 {
808 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
809 	struct mt7615_vif *mvif = msta->vif;
810 	struct wtbl_req_hdr *wtbl_hdr;
811 	struct sk_buff *skb;
812 	int err;
813 
814 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
815 					    &msta->wcid);
816 	if (IS_ERR(skb))
817 		return PTR_ERR(skb);
818 
819 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
820 
821 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
822 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
823 	if (err < 0 || !enable)
824 		return err;
825 
826 	skb = NULL;
827 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
828 						  WTBL_SET, NULL, &skb);
829 	if (IS_ERR(wtbl_hdr))
830 		return PTR_ERR(wtbl_hdr);
831 
832 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
833 				    NULL, wtbl_hdr);
834 
835 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
836 				     MCU_EXT_CMD(WTBL_UPDATE), true);
837 }
838 
839 static int
840 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
841 			struct ieee80211_sta *sta, bool enable)
842 {
843 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
844 	struct sk_buff *skb, *sskb, *wskb = NULL;
845 	struct mt7615_dev *dev = phy->dev;
846 	struct wtbl_req_hdr *wtbl_hdr;
847 	struct mt7615_sta *msta;
848 	bool new_entry = true;
849 	int cmd, err;
850 
851 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
852 
853 	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
854 					     &msta->wcid);
855 	if (IS_ERR(sskb))
856 		return PTR_ERR(sskb);
857 
858 	if (!sta) {
859 		if (mvif->sta_added)
860 			new_entry = false;
861 		else
862 			mvif->sta_added = true;
863 	}
864 	mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable, new_entry);
865 	if (enable && sta)
866 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
867 					MT76_STA_INFO_STATE_ASSOC);
868 
869 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
870 						  WTBL_RESET_AND_SET, NULL,
871 						  &wskb);
872 	if (IS_ERR(wtbl_hdr))
873 		return PTR_ERR(wtbl_hdr);
874 
875 	if (enable) {
876 		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
877 						 NULL, wtbl_hdr);
878 		if (sta)
879 			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
880 						    NULL, wtbl_hdr, true, true);
881 		mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, vif, &msta->wcid,
882 						   NULL, wtbl_hdr);
883 	}
884 
885 	cmd = enable ? MCU_EXT_CMD(WTBL_UPDATE) : MCU_EXT_CMD(STA_REC_UPDATE);
886 	skb = enable ? wskb : sskb;
887 
888 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
889 	if (err < 0) {
890 		skb = enable ? sskb : wskb;
891 		dev_kfree_skb(skb);
892 
893 		return err;
894 	}
895 
896 	cmd = enable ? MCU_EXT_CMD(STA_REC_UPDATE) : MCU_EXT_CMD(WTBL_UPDATE);
897 	skb = enable ? sskb : wskb;
898 
899 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
900 }
901 
902 static int
903 mt7615_mcu_wtbl_update_hdr_trans(struct mt7615_dev *dev,
904 				 struct ieee80211_vif *vif,
905 				 struct ieee80211_sta *sta)
906 {
907 	return mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
908 }
909 
910 static const struct mt7615_mcu_ops wtbl_update_ops = {
911 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
912 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
913 	.add_dev_info = mt7615_mcu_add_dev,
914 	.add_bss_info = mt7615_mcu_add_bss,
915 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
916 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
917 	.sta_add = mt7615_mcu_wtbl_sta_add,
918 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
919 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
920 	.set_sta_decap_offload = mt7615_mcu_wtbl_update_hdr_trans,
921 };
922 
923 static int
924 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
925 		  struct ieee80211_ampdu_params *params,
926 		  bool enable, bool tx)
927 {
928 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
929 	struct mt7615_vif *mvif = msta->vif;
930 	struct wtbl_req_hdr *wtbl_hdr;
931 	struct tlv *sta_wtbl;
932 	struct sk_buff *skb;
933 
934 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
935 					    &msta->wcid);
936 	if (IS_ERR(skb))
937 		return PTR_ERR(skb);
938 
939 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
940 
941 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
942 
943 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
944 						  WTBL_SET, sta_wtbl, &skb);
945 	if (IS_ERR(wtbl_hdr))
946 		return PTR_ERR(wtbl_hdr);
947 
948 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
949 				    sta_wtbl, wtbl_hdr);
950 
951 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
952 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
953 }
954 
955 static int
956 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
957 		     struct ieee80211_ampdu_params *params,
958 		     bool enable)
959 {
960 	return mt7615_mcu_sta_ba(dev, params, enable, true);
961 }
962 
963 static int
964 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
965 		     struct ieee80211_ampdu_params *params,
966 		     bool enable)
967 {
968 	return mt7615_mcu_sta_ba(dev, params, enable, false);
969 }
970 
971 static int
972 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
973 		     struct ieee80211_sta *sta, bool enable, int cmd,
974 		     bool offload_fw)
975 {
976 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
977 	struct mt76_sta_cmd_info info = {
978 		.sta = sta,
979 		.vif = vif,
980 		.offload_fw = offload_fw,
981 		.enable = enable,
982 		.newly = true,
983 		.cmd = cmd,
984 	};
985 
986 	info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
987 	return mt76_connac_mcu_sta_cmd(phy, &info);
988 }
989 
990 static int
991 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
992 		   struct ieee80211_sta *sta, bool enable)
993 {
994 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
995 				    MCU_EXT_CMD(STA_REC_UPDATE), false);
996 }
997 
998 static int
999 mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1000 				struct ieee80211_vif *vif,
1001 				struct ieee80211_sta *sta)
1002 {
1003 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1004 
1005 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1006 						    vif, &msta->wcid,
1007 						    MCU_EXT_CMD(STA_REC_UPDATE));
1008 }
1009 
1010 static const struct mt7615_mcu_ops sta_update_ops = {
1011 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1012 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1013 	.add_dev_info = mt7615_mcu_add_dev,
1014 	.add_bss_info = mt7615_mcu_add_bss,
1015 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1016 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1017 	.sta_add = mt7615_mcu_add_sta,
1018 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1019 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1020 	.set_sta_decap_offload = mt7615_mcu_sta_update_hdr_trans,
1021 };
1022 
1023 static int
1024 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1025 {
1026 	return 0;
1027 }
1028 
1029 static int
1030 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1031 				  struct ieee80211_hw *hw,
1032 				  struct ieee80211_vif *vif,
1033 				  bool enable)
1034 {
1035 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1036 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1037 	struct ieee80211_mutable_offsets offs;
1038 	struct {
1039 		struct req_hdr {
1040 			u8 bss_idx;
1041 			u8 pad[3];
1042 		} __packed hdr;
1043 		struct bcn_content_tlv {
1044 			__le16 tag;
1045 			__le16 len;
1046 			__le16 tim_ie_pos;
1047 			__le16 csa_ie_pos;
1048 			__le16 bcc_ie_pos;
1049 			/* 0: disable beacon offload
1050 			 * 1: enable beacon offload
1051 			 * 2: update probe respond offload
1052 			 */
1053 			u8 enable;
1054 			/* 0: legacy format (TXD + payload)
1055 			 * 1: only cap field IE
1056 			 */
1057 			u8 type;
1058 			__le16 pkt_len;
1059 			u8 pkt[512];
1060 		} __packed beacon_tlv;
1061 	} req = {
1062 		.hdr = {
1063 			.bss_idx = mvif->mt76.idx,
1064 		},
1065 		.beacon_tlv = {
1066 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1067 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1068 			.enable = enable,
1069 		},
1070 	};
1071 	struct sk_buff *skb;
1072 
1073 	if (!enable)
1074 		goto out;
1075 
1076 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
1077 	if (!skb)
1078 		return -EINVAL;
1079 
1080 	if (skb->len > 512 - MT_TXD_SIZE) {
1081 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1082 		dev_kfree_skb(skb);
1083 		return -EINVAL;
1084 	}
1085 
1086 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1087 			      wcid, NULL, 0, NULL, 0, true);
1088 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1089 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1090 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1091 
1092 	if (offs.cntdwn_counter_offs[0]) {
1093 		u16 csa_offs;
1094 
1095 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1096 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1097 	}
1098 	dev_kfree_skb(skb);
1099 
1100 out:
1101 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1102 				 &req, sizeof(req), true);
1103 }
1104 
1105 static int
1106 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1107 		       bool enable)
1108 {
1109 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1110 
1111 	return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1112 					   enable);
1113 }
1114 
1115 static int
1116 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1117 		       struct ieee80211_sta *sta, bool enable)
1118 {
1119 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1120 
1121 	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1122 					   enable, NULL);
1123 }
1124 
1125 static inline int
1126 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1127 		       struct ieee80211_sta *sta, bool enable)
1128 {
1129 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1130 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1131 }
1132 
1133 static int
1134 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1135 		     struct ieee80211_ampdu_params *params,
1136 		     bool enable)
1137 {
1138 	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1139 
1140 	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1141 				      MCU_UNI_CMD(STA_REC_UPDATE), enable,
1142 				      true);
1143 }
1144 
1145 static int
1146 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1147 		     struct ieee80211_ampdu_params *params,
1148 		     bool enable)
1149 {
1150 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1151 	struct mt7615_vif *mvif = msta->vif;
1152 	struct wtbl_req_hdr *wtbl_hdr;
1153 	struct tlv *sta_wtbl;
1154 	struct sk_buff *skb;
1155 	int err;
1156 
1157 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1158 					    &msta->wcid);
1159 	if (IS_ERR(skb))
1160 		return PTR_ERR(skb);
1161 
1162 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1163 
1164 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1165 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1166 	if (err < 0 || !enable)
1167 		return err;
1168 
1169 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1170 					    &msta->wcid);
1171 	if (IS_ERR(skb))
1172 		return PTR_ERR(skb);
1173 
1174 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1175 					   sizeof(struct tlv));
1176 
1177 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1178 						  WTBL_SET, sta_wtbl, &skb);
1179 	if (IS_ERR(wtbl_hdr))
1180 		return PTR_ERR(wtbl_hdr);
1181 
1182 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1183 				    sta_wtbl, wtbl_hdr);
1184 
1185 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1186 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
1187 }
1188 
1189 static int
1190 mt7615_mcu_sta_uni_update_hdr_trans(struct mt7615_dev *dev,
1191 				    struct ieee80211_vif *vif,
1192 				    struct ieee80211_sta *sta)
1193 {
1194 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1195 
1196 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1197 						    vif, &msta->wcid,
1198 						    MCU_UNI_CMD(STA_REC_UPDATE));
1199 }
1200 
1201 static const struct mt7615_mcu_ops uni_update_ops = {
1202 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1203 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1204 	.add_dev_info = mt7615_mcu_uni_add_dev,
1205 	.add_bss_info = mt7615_mcu_uni_add_bss,
1206 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1207 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1208 	.sta_add = mt7615_mcu_uni_add_sta,
1209 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1210 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1211 	.set_sta_decap_offload = mt7615_mcu_sta_uni_update_hdr_trans,
1212 };
1213 
1214 int mt7615_mcu_restart(struct mt76_dev *dev)
1215 {
1216 	return mt76_mcu_send_msg(dev, MCU_CMD(RESTART_DL_REQ), NULL, 0, true);
1217 }
1218 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1219 
1220 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1221 {
1222 	const struct mt7615_patch_hdr *hdr;
1223 	const struct firmware *fw = NULL;
1224 	int len, ret, sem;
1225 
1226 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1227 	if (ret)
1228 		return ret;
1229 
1230 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1231 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1232 		ret = -EINVAL;
1233 		goto release_fw;
1234 	}
1235 
1236 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1237 	switch (sem) {
1238 	case PATCH_IS_DL:
1239 		goto release_fw;
1240 	case PATCH_NOT_DL_SEM_SUCCESS:
1241 		break;
1242 	default:
1243 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1244 		ret = -EAGAIN;
1245 		goto release_fw;
1246 	}
1247 
1248 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1249 
1250 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1251 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1252 
1253 	len = fw->size - sizeof(*hdr);
1254 
1255 	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1256 					    DL_MODE_NEED_RSP);
1257 	if (ret) {
1258 		dev_err(dev->mt76.dev, "Download request failed\n");
1259 		goto out;
1260 	}
1261 
1262 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1263 				     fw->data + sizeof(*hdr), len);
1264 	if (ret) {
1265 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1266 		goto out;
1267 	}
1268 
1269 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1270 	if (ret)
1271 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1272 
1273 out:
1274 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1275 	switch (sem) {
1276 	case PATCH_REL_SEM_SUCCESS:
1277 		break;
1278 	default:
1279 		ret = -EAGAIN;
1280 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1281 		break;
1282 	}
1283 
1284 release_fw:
1285 	release_firmware(fw);
1286 
1287 	return ret;
1288 }
1289 
1290 static int
1291 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1292 			     const struct mt7615_fw_trailer *hdr,
1293 			     const u8 *data, bool is_cr4)
1294 {
1295 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1296 	int err, i, offset = 0;
1297 	u32 len, addr, mode;
1298 
1299 	for (i = 0; i < n_region; i++) {
1300 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1301 						   hdr[i].feature_set, is_cr4);
1302 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1303 		addr = le32_to_cpu(hdr[i].addr);
1304 
1305 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1306 						    mode);
1307 		if (err) {
1308 			dev_err(dev->mt76.dev, "Download request failed\n");
1309 			return err;
1310 		}
1311 
1312 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1313 					     data + offset, len);
1314 		if (err) {
1315 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1316 			return err;
1317 		}
1318 
1319 		offset += len;
1320 	}
1321 
1322 	return 0;
1323 }
1324 
1325 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1326 {
1327 	const struct mt7615_fw_trailer *hdr;
1328 	const struct firmware *fw;
1329 	int ret;
1330 
1331 	ret = request_firmware(&fw, name, dev->mt76.dev);
1332 	if (ret)
1333 		return ret;
1334 
1335 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1336 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1337 		ret = -EINVAL;
1338 		goto out;
1339 	}
1340 
1341 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1342 					N9_REGION_NUM * sizeof(*hdr));
1343 
1344 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1345 		 hdr->fw_ver, hdr->build_date);
1346 
1347 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1348 	if (ret)
1349 		goto out;
1350 
1351 	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1352 					     le32_to_cpu(hdr->addr),
1353 					     FW_START_OVERRIDE);
1354 	if (ret) {
1355 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1356 		goto out;
1357 	}
1358 
1359 	snprintf(dev->mt76.hw->wiphy->fw_version,
1360 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1361 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1362 
1363 	if (!is_mt7615(&dev->mt76)) {
1364 		dev->fw_ver = MT7615_FIRMWARE_V2;
1365 		dev->mcu_ops = &sta_update_ops;
1366 	} else {
1367 		dev->fw_ver = MT7615_FIRMWARE_V1;
1368 		dev->mcu_ops = &wtbl_update_ops;
1369 	}
1370 
1371 out:
1372 	release_firmware(fw);
1373 	return ret;
1374 }
1375 
1376 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1377 {
1378 	const struct mt7615_fw_trailer *hdr;
1379 	const struct firmware *fw;
1380 	int ret;
1381 
1382 	ret = request_firmware(&fw, name, dev->mt76.dev);
1383 	if (ret)
1384 		return ret;
1385 
1386 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1387 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1388 		ret = -EINVAL;
1389 		goto out;
1390 	}
1391 
1392 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1393 					CR4_REGION_NUM * sizeof(*hdr));
1394 
1395 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1396 		 hdr->fw_ver, hdr->build_date);
1397 
1398 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1399 	if (ret)
1400 		goto out;
1401 
1402 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1403 					     FW_START_WORKING_PDA_CR4);
1404 	if (ret) {
1405 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1406 		goto out;
1407 	}
1408 
1409 out:
1410 	release_firmware(fw);
1411 
1412 	return ret;
1413 }
1414 
1415 static int mt7615_load_ram(struct mt7615_dev *dev)
1416 {
1417 	int ret;
1418 
1419 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1420 	if (ret)
1421 		return ret;
1422 
1423 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1424 }
1425 
1426 static int mt7615_load_firmware(struct mt7615_dev *dev)
1427 {
1428 	int ret;
1429 	u32 val;
1430 
1431 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1432 
1433 	if (val != FW_STATE_FW_DOWNLOAD) {
1434 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1435 		return -EIO;
1436 	}
1437 
1438 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1439 	if (ret)
1440 		return ret;
1441 
1442 	ret = mt7615_load_ram(dev);
1443 	if (ret)
1444 		return ret;
1445 
1446 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1447 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1448 				       FW_STATE_RDY), 500)) {
1449 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1450 		return -EIO;
1451 	}
1452 
1453 	return 0;
1454 }
1455 
1456 static int mt7622_load_firmware(struct mt7615_dev *dev)
1457 {
1458 	int ret;
1459 	u32 val;
1460 
1461 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1462 
1463 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1464 	if (val != FW_STATE_FW_DOWNLOAD) {
1465 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1466 		return -EIO;
1467 	}
1468 
1469 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1470 	if (ret)
1471 		return ret;
1472 
1473 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1474 	if (ret)
1475 		return ret;
1476 
1477 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1478 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1479 				       FW_STATE_NORMAL_TRX), 1500)) {
1480 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1481 		return -EIO;
1482 	}
1483 
1484 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1485 
1486 	return 0;
1487 }
1488 
1489 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1490 {
1491 	struct {
1492 		u8 ctrl_val;
1493 		u8 pad[3];
1494 	} data = {
1495 		.ctrl_val = ctrl
1496 	};
1497 
1498 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST),
1499 				 &data, sizeof(data), true);
1500 }
1501 
1502 static int mt7615_mcu_cal_cache_apply(struct mt7615_dev *dev)
1503 {
1504 	struct {
1505 		bool cache_enable;
1506 		u8 pad[3];
1507 	} data = {
1508 		.cache_enable = true
1509 	};
1510 
1511 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CAL_CACHE), &data,
1512 				 sizeof(data), false);
1513 }
1514 
1515 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1516 {
1517 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1518 	const struct mt76_connac2_fw_trailer *hdr;
1519 	const struct mt7663_fw_buf *buf;
1520 	const struct firmware *fw;
1521 	const u8 *base_addr;
1522 	int i, ret;
1523 
1524 	ret = request_firmware(&fw, name, dev->mt76.dev);
1525 	if (ret)
1526 		return ret;
1527 
1528 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1529 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1530 		ret = -EINVAL;
1531 		goto out;
1532 	}
1533 
1534 	hdr = (const void *)(fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE);
1535 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1536 		 hdr->fw_ver, hdr->build_date);
1537 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1538 
1539 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1540 	for (i = 0; i < hdr->n_region; i++) {
1541 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1542 		u32 len, addr, mode;
1543 
1544 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1545 
1546 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1547 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1548 						   buf->feature_set, false);
1549 		addr = le32_to_cpu(buf->img_dest_addr);
1550 		len = le32_to_cpu(buf->img_size);
1551 
1552 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1553 						    mode);
1554 		if (ret) {
1555 			dev_err(dev->mt76.dev, "Download request failed\n");
1556 			goto out;
1557 		}
1558 
1559 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1560 					     fw->data + offset, len);
1561 		if (ret) {
1562 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1563 			goto out;
1564 		}
1565 
1566 		offset += le32_to_cpu(buf->img_size);
1567 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1568 			override_addr = le32_to_cpu(buf->img_dest_addr);
1569 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1570 				 i, override_addr);
1571 		}
1572 	}
1573 
1574 	if (override_addr)
1575 		flag |= FW_START_OVERRIDE;
1576 
1577 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1578 		 override_addr, flag);
1579 
1580 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1581 	if (ret) {
1582 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1583 		goto out;
1584 	}
1585 
1586 	snprintf(dev->mt76.hw->wiphy->fw_version,
1587 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1588 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1589 
1590 out:
1591 	release_firmware(fw);
1592 
1593 	return ret;
1594 }
1595 
1596 static int
1597 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1598 {
1599 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1600 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1601 	int ret;
1602 
1603 	if (!prefer_offload_fw) {
1604 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1605 		primary_rom = MT7663_ROM_PATCH;
1606 	}
1607 	selected_rom = primary_rom;
1608 
1609 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1610 	if (ret) {
1611 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1612 			 primary_rom, secondary_rom);
1613 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1614 					secondary_rom);
1615 		if (ret) {
1616 			dev_err(dev->mt76.dev, "failed to load %s",
1617 				secondary_rom);
1618 			return ret;
1619 		}
1620 		selected_rom = secondary_rom;
1621 	}
1622 
1623 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1624 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1625 		dev->fw_ver = MT7615_FIRMWARE_V3;
1626 		dev->mcu_ops = &uni_update_ops;
1627 	} else {
1628 		*n9_firmware = MT7663_FIRMWARE_N9;
1629 		dev->fw_ver = MT7615_FIRMWARE_V2;
1630 		dev->mcu_ops = &sta_update_ops;
1631 	}
1632 
1633 	return 0;
1634 }
1635 
1636 int __mt7663_load_firmware(struct mt7615_dev *dev)
1637 {
1638 	const char *n9_firmware;
1639 	int ret;
1640 
1641 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1642 	if (ret) {
1643 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1644 		return -EIO;
1645 	}
1646 
1647 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1648 	if (ret)
1649 		return ret;
1650 
1651 	ret = mt7663_load_n9(dev, n9_firmware);
1652 	if (ret)
1653 		return ret;
1654 
1655 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1656 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1657 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1658 				     MT7663_TOP_MISC2_FW_STATE);
1659 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1660 		return -EIO;
1661 	}
1662 
1663 #ifdef CONFIG_PM
1664 	if (mt7615_firmware_offload(dev))
1665 		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1666 #endif /* CONFIG_PM */
1667 
1668 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1669 
1670 	return 0;
1671 }
1672 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1673 
1674 static int mt7663_load_firmware(struct mt7615_dev *dev)
1675 {
1676 	int ret;
1677 
1678 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1679 
1680 	ret = __mt7663_load_firmware(dev);
1681 	if (ret)
1682 		return ret;
1683 
1684 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1685 
1686 	return 0;
1687 }
1688 
1689 int mt7615_mcu_init(struct mt7615_dev *dev)
1690 {
1691 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1692 		.headroom = sizeof(struct mt7615_mcu_txd),
1693 		.mcu_skb_send_msg = mt7615_mcu_send_message,
1694 		.mcu_parse_response = mt7615_mcu_parse_response,
1695 	};
1696 	int ret;
1697 
1698 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
1699 
1700 	ret = mt7615_mcu_drv_pmctrl(dev);
1701 	if (ret)
1702 		return ret;
1703 
1704 	switch (mt76_chip(&dev->mt76)) {
1705 	case 0x7622:
1706 		ret = mt7622_load_firmware(dev);
1707 		break;
1708 	case 0x7663:
1709 		ret = mt7663_load_firmware(dev);
1710 		break;
1711 	default:
1712 		ret = mt7615_load_firmware(dev);
1713 		break;
1714 	}
1715 	if (ret)
1716 		return ret;
1717 
1718 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1719 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1720 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1721 
1722 	if (dev->dbdc_support) {
1723 		ret = mt7615_mcu_cal_cache_apply(dev);
1724 		if (ret)
1725 			return ret;
1726 	}
1727 
1728 	return mt7615_mcu_fw_log_2_host(dev, 0);
1729 }
1730 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1731 
1732 void mt7615_mcu_exit(struct mt7615_dev *dev)
1733 {
1734 	mt7615_mcu_restart(&dev->mt76);
1735 	mt7615_mcu_set_fw_ctrl(dev);
1736 	skb_queue_purge(&dev->mt76.mcu.res_q);
1737 }
1738 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1739 
1740 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1741 {
1742 	struct {
1743 		u8 buffer_mode;
1744 		u8 content_format;
1745 		__le16 len;
1746 	} __packed req_hdr = {
1747 		.buffer_mode = 1,
1748 	};
1749 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1750 	struct sk_buff *skb;
1751 	int eep_len, offset;
1752 
1753 	switch (mt76_chip(&dev->mt76)) {
1754 	case 0x7622:
1755 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1756 		offset = MT_EE_NIC_CONF_0;
1757 		break;
1758 	case 0x7663:
1759 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1760 		req_hdr.content_format = 1;
1761 		offset = MT_EE_CHIP_ID;
1762 		break;
1763 	default:
1764 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1765 		offset = MT_EE_NIC_CONF_0;
1766 		break;
1767 	}
1768 
1769 	req_hdr.len = cpu_to_le16(eep_len);
1770 
1771 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1772 	if (!skb)
1773 		return -ENOMEM;
1774 
1775 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1776 	skb_put_data(skb, eep + offset, eep_len);
1777 
1778 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1779 				     MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
1780 }
1781 
1782 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1783 		       const struct ieee80211_tx_queue_params *params)
1784 {
1785 #define WMM_AIFS_SET	BIT(0)
1786 #define WMM_CW_MIN_SET	BIT(1)
1787 #define WMM_CW_MAX_SET	BIT(2)
1788 #define WMM_TXOP_SET	BIT(3)
1789 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1790 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1791 	struct req_data {
1792 		u8 number;
1793 		u8 rsv[3];
1794 		u8 queue;
1795 		u8 valid;
1796 		u8 aifs;
1797 		u8 cw_min;
1798 		__le16 cw_max;
1799 		__le16 txop;
1800 	} __packed req = {
1801 		.number = 1,
1802 		.queue = queue,
1803 		.valid = WMM_PARAM_SET,
1804 		.aifs = params->aifs,
1805 		.cw_min = 5,
1806 		.cw_max = cpu_to_le16(10),
1807 		.txop = cpu_to_le16(params->txop),
1808 	};
1809 
1810 	if (params->cw_min)
1811 		req.cw_min = fls(params->cw_min);
1812 	if (params->cw_max)
1813 		req.cw_max = cpu_to_le16(fls(params->cw_max));
1814 
1815 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
1816 				 &req, sizeof(req), true);
1817 }
1818 
1819 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1820 {
1821 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1822 	struct dbdc_entry {
1823 		u8 type;
1824 		u8 index;
1825 		u8 band;
1826 		u8 _rsv;
1827 	};
1828 	struct {
1829 		u8 enable;
1830 		u8 num;
1831 		u8 _rsv[2];
1832 		struct dbdc_entry entry[64];
1833 	} req = {
1834 		.enable = !!ext_phy,
1835 	};
1836 	int i;
1837 
1838 	if (!ext_phy)
1839 		goto out;
1840 
1841 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
1842 	do { \
1843 		req.entry[req.num].type = _type;		\
1844 		req.entry[req.num].index = _idx;		\
1845 		req.entry[req.num++].band = _band;		\
1846 	} while (0)
1847 
1848 	for (i = 0; i < 4; i++) {
1849 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1850 
1851 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1852 	}
1853 
1854 	for (i = 0; i < 14; i++) {
1855 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1856 
1857 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1858 	}
1859 
1860 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1861 
1862 	for (i = 0; i < 3; i++)
1863 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
1864 
1865 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
1866 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
1867 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
1868 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
1869 
1870 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
1871 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
1872 
1873 out:
1874 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DBDC_CTRL), &req,
1875 				 sizeof(req), true);
1876 }
1877 
1878 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1879 {
1880 	struct wtbl_req_hdr req = {
1881 		.operation = WTBL_RESET_ALL,
1882 	};
1883 
1884 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(WTBL_UPDATE),
1885 				 &req, sizeof(req), true);
1886 }
1887 
1888 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
1889 {
1890 	struct {
1891 		__le16 tag;
1892 		__le16 min_lpn;
1893 	} req = {
1894 		.tag = cpu_to_le16(0x1),
1895 		.min_lpn = cpu_to_le16(val),
1896 	};
1897 
1898 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1899 				 &req, sizeof(req), true);
1900 }
1901 
1902 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
1903 			    const struct mt7615_dfs_pulse *pulse)
1904 {
1905 	struct {
1906 		__le16 tag;
1907 		__le32 max_width;	/* us */
1908 		__le32 max_pwr;		/* dbm */
1909 		__le32 min_pwr;		/* dbm */
1910 		__le32 min_stgr_pri;	/* us */
1911 		__le32 max_stgr_pri;	/* us */
1912 		__le32 min_cr_pri;	/* us */
1913 		__le32 max_cr_pri;	/* us */
1914 	} req = {
1915 		.tag = cpu_to_le16(0x3),
1916 #define __req_field(field) .field = cpu_to_le32(pulse->field)
1917 		__req_field(max_width),
1918 		__req_field(max_pwr),
1919 		__req_field(min_pwr),
1920 		__req_field(min_stgr_pri),
1921 		__req_field(max_stgr_pri),
1922 		__req_field(min_cr_pri),
1923 		__req_field(max_cr_pri),
1924 #undef  __req_field
1925 	};
1926 
1927 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1928 				 &req, sizeof(req), true);
1929 }
1930 
1931 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
1932 			    const struct mt7615_dfs_pattern *pattern)
1933 {
1934 	struct {
1935 		__le16 tag;
1936 		__le16 radar_type;
1937 		u8 enb;
1938 		u8 stgr;
1939 		u8 min_crpn;
1940 		u8 max_crpn;
1941 		u8 min_crpr;
1942 		u8 min_pw;
1943 		u8 max_pw;
1944 		__le32 min_pri;
1945 		__le32 max_pri;
1946 		u8 min_crbn;
1947 		u8 max_crbn;
1948 		u8 min_stgpn;
1949 		u8 max_stgpn;
1950 		u8 min_stgpr;
1951 	} req = {
1952 		.tag = cpu_to_le16(0x2),
1953 		.radar_type = cpu_to_le16(index),
1954 #define __req_field_u8(field) .field = pattern->field
1955 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
1956 		__req_field_u8(enb),
1957 		__req_field_u8(stgr),
1958 		__req_field_u8(min_crpn),
1959 		__req_field_u8(max_crpn),
1960 		__req_field_u8(min_crpr),
1961 		__req_field_u8(min_pw),
1962 		__req_field_u8(max_pw),
1963 		__req_field_u32(min_pri),
1964 		__req_field_u32(max_pri),
1965 		__req_field_u8(min_crbn),
1966 		__req_field_u8(max_crbn),
1967 		__req_field_u8(min_stgpn),
1968 		__req_field_u8(max_stgpn),
1969 		__req_field_u8(min_stgpr),
1970 #undef __req_field_u8
1971 #undef __req_field_u32
1972 	};
1973 
1974 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1975 				 &req, sizeof(req), true);
1976 }
1977 
1978 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
1979 {
1980 	struct {
1981 		u8 pulse_num;
1982 		u8 rsv[3];
1983 		struct {
1984 			__le32 start_time;
1985 			__le16 width;
1986 			__le16 power;
1987 		} pattern[32];
1988 	} req = {
1989 		.pulse_num = dev->radar_pattern.n_pulses,
1990 	};
1991 	u32 start_time = ktime_to_ms(ktime_get_boottime());
1992 	int i;
1993 
1994 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
1995 		return -EINVAL;
1996 
1997 	/* TODO: add some noise here */
1998 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
1999 		u32 ts = start_time + i * dev->radar_pattern.period;
2000 
2001 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2002 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2003 		req.pattern[i].start_time = cpu_to_le32(ts);
2004 	}
2005 
2006 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_PATTERN),
2007 				 &req, sizeof(req), false);
2008 }
2009 
2010 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2011 {
2012 	struct mt76_phy *mphy = phy->mt76;
2013 	struct ieee80211_hw *hw = mphy->hw;
2014 	struct mt76_power_limits limits;
2015 	s8 *limits_array = (s8 *)&limits;
2016 	int n_chains = hweight8(mphy->antenna_mask);
2017 	int tx_power = hw->conf.power_level * 2;
2018 	int i;
2019 	static const u8 sku_mapping[] = {
2020 #define SKU_FIELD(_type, _field) \
2021 		[MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2022 		SKU_FIELD(CCK_1_2, cck[0]),
2023 		SKU_FIELD(CCK_55_11, cck[2]),
2024 		SKU_FIELD(OFDM_6_9, ofdm[0]),
2025 		SKU_FIELD(OFDM_12_18, ofdm[2]),
2026 		SKU_FIELD(OFDM_24_36, ofdm[4]),
2027 		SKU_FIELD(OFDM_48, ofdm[6]),
2028 		SKU_FIELD(OFDM_54, ofdm[7]),
2029 		SKU_FIELD(HT20_0_8, mcs[0][0]),
2030 		SKU_FIELD(HT20_32, ofdm[0]),
2031 		SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2032 		SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2033 		SKU_FIELD(HT20_5_13, mcs[0][5]),
2034 		SKU_FIELD(HT20_6_14, mcs[0][6]),
2035 		SKU_FIELD(HT20_7_15, mcs[0][7]),
2036 		SKU_FIELD(HT40_0_8, mcs[1][0]),
2037 		SKU_FIELD(HT40_32, ofdm[0]),
2038 		SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2039 		SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2040 		SKU_FIELD(HT40_5_13, mcs[1][5]),
2041 		SKU_FIELD(HT40_6_14, mcs[1][6]),
2042 		SKU_FIELD(HT40_7_15, mcs[1][7]),
2043 		SKU_FIELD(VHT20_0, mcs[0][0]),
2044 		SKU_FIELD(VHT20_1_2, mcs[0][1]),
2045 		SKU_FIELD(VHT20_3_4, mcs[0][3]),
2046 		SKU_FIELD(VHT20_5_6, mcs[0][5]),
2047 		SKU_FIELD(VHT20_7, mcs[0][7]),
2048 		SKU_FIELD(VHT20_8, mcs[0][8]),
2049 		SKU_FIELD(VHT20_9, mcs[0][9]),
2050 		SKU_FIELD(VHT40_0, mcs[1][0]),
2051 		SKU_FIELD(VHT40_1_2, mcs[1][1]),
2052 		SKU_FIELD(VHT40_3_4, mcs[1][3]),
2053 		SKU_FIELD(VHT40_5_6, mcs[1][5]),
2054 		SKU_FIELD(VHT40_7, mcs[1][7]),
2055 		SKU_FIELD(VHT40_8, mcs[1][8]),
2056 		SKU_FIELD(VHT40_9, mcs[1][9]),
2057 		SKU_FIELD(VHT80_0, mcs[2][0]),
2058 		SKU_FIELD(VHT80_1_2, mcs[2][1]),
2059 		SKU_FIELD(VHT80_3_4, mcs[2][3]),
2060 		SKU_FIELD(VHT80_5_6, mcs[2][5]),
2061 		SKU_FIELD(VHT80_7, mcs[2][7]),
2062 		SKU_FIELD(VHT80_8, mcs[2][8]),
2063 		SKU_FIELD(VHT80_9, mcs[2][9]),
2064 		SKU_FIELD(VHT160_0, mcs[3][0]),
2065 		SKU_FIELD(VHT160_1_2, mcs[3][1]),
2066 		SKU_FIELD(VHT160_3_4, mcs[3][3]),
2067 		SKU_FIELD(VHT160_5_6, mcs[3][5]),
2068 		SKU_FIELD(VHT160_7, mcs[3][7]),
2069 		SKU_FIELD(VHT160_8, mcs[3][8]),
2070 		SKU_FIELD(VHT160_9, mcs[3][9]),
2071 #undef SKU_FIELD
2072 	};
2073 
2074 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan, tx_power);
2075 	tx_power -= mt76_tx_power_nss_delta(n_chains);
2076 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2077 					      &limits, tx_power);
2078 	mphy->txpower_cur = tx_power;
2079 
2080 	if (is_mt7663(mphy->dev)) {
2081 		memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2082 		return;
2083 	}
2084 
2085 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2086 		sku[i] = limits_array[sku_mapping[i]];
2087 
2088 	for (i = 0; i < 4; i++) {
2089 		int delta = 0;
2090 
2091 		if (i < n_chains - 1)
2092 			delta = mt76_tx_power_nss_delta(n_chains) -
2093 				mt76_tx_power_nss_delta(i + 1);
2094 		sku[MT_SKU_1SS_DELTA + i] = delta;
2095 	}
2096 }
2097 
2098 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2099 {
2100 	static const u8 width_to_bw[] = {
2101 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2102 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2103 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2104 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2105 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2106 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2107 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2108 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2109 	};
2110 
2111 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2112 		return 0;
2113 
2114 	return width_to_bw[chandef->width];
2115 }
2116 
2117 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2118 {
2119 	struct mt7615_dev *dev = phy->dev;
2120 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2121 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2122 	struct {
2123 		u8 control_chan;
2124 		u8 center_chan;
2125 		u8 bw;
2126 		u8 tx_streams;
2127 		u8 rx_streams_mask;
2128 		u8 switch_reason;
2129 		u8 band_idx;
2130 		/* for 80+80 only */
2131 		u8 center_chan2;
2132 		__le16 cac_case;
2133 		u8 channel_band;
2134 		u8 rsv0;
2135 		__le32 outband_freq;
2136 		u8 txpower_drop;
2137 		u8 rsv1[3];
2138 		u8 txpower_sku[53];
2139 		u8 rsv2[3];
2140 	} req = {
2141 		.control_chan = chandef->chan->hw_value,
2142 		.center_chan = ieee80211_frequency_to_channel(freq1),
2143 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2144 		.rx_streams_mask = phy->mt76->chainmask,
2145 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2146 	};
2147 
2148 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2149 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2150 		req.switch_reason = CH_SWITCH_NORMAL;
2151 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2152 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2153 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2154 					  NL80211_IFTYPE_AP))
2155 		req.switch_reason = CH_SWITCH_DFS;
2156 	else
2157 		req.switch_reason = CH_SWITCH_NORMAL;
2158 
2159 	req.band_idx = phy != &dev->phy;
2160 	req.bw = mt7615_mcu_chan_bw(chandef);
2161 
2162 	if (mt76_testmode_enabled(phy->mt76))
2163 		memset(req.txpower_sku, 0x3f, 49);
2164 	else
2165 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2166 
2167 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2168 }
2169 
2170 int mt7615_mcu_get_temperature(struct mt7615_dev *dev)
2171 {
2172 	struct {
2173 		u8 action;
2174 		u8 rsv[3];
2175 	} req = {};
2176 
2177 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL),
2178 				 &req, sizeof(req), true);
2179 }
2180 
2181 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2182 			      u32 val)
2183 {
2184 	struct {
2185 		u8 test_mode_en;
2186 		u8 param_idx;
2187 		u8 _rsv[2];
2188 
2189 		__le32 value;
2190 
2191 		u8 pad[8];
2192 	} req = {
2193 		.test_mode_en = test_mode,
2194 		.param_idx = param,
2195 		.value = cpu_to_le32(val),
2196 	};
2197 
2198 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
2199 				 &req, sizeof(req), false);
2200 }
2201 
2202 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2203 {
2204 	struct mt7615_dev *dev = phy->dev;
2205 	struct {
2206 		u8 format_id;
2207 		u8 sku_enable;
2208 		u8 band_idx;
2209 		u8 rsv;
2210 	} req = {
2211 		.format_id = 0,
2212 		.band_idx = phy != &dev->phy,
2213 		.sku_enable = enable,
2214 	};
2215 
2216 	return mt76_mcu_send_msg(&dev->mt76,
2217 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
2218 				 &req, sizeof(req), true);
2219 }
2220 
2221 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2222 {
2223 	int i;
2224 
2225 	for (i = 0; i < n_freqs; i++)
2226 		if (cur == freqs[i])
2227 			return i;
2228 
2229 	return -1;
2230 }
2231 
2232 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2233 {
2234 	static const u16 freq_list[] = {
2235 		4980, 5805, 5905, 5190,
2236 		5230, 5270, 5310, 5350,
2237 		5390, 5430, 5470, 5510,
2238 		5550, 5590, 5630, 5670,
2239 		5710, 5755, 5795, 5835,
2240 		5875, 5210, 5290, 5370,
2241 		5450, 5530, 5610, 5690,
2242 		5775, 5855
2243 	};
2244 	static const u16 freq_bw40[] = {
2245 		5190, 5230, 5270, 5310,
2246 		5350, 5390, 5430, 5470,
2247 		5510, 5550, 5590, 5630,
2248 		5670, 5710, 5755, 5795,
2249 		5835, 5875
2250 	};
2251 	int offset_2g = ARRAY_SIZE(freq_list);
2252 	int idx;
2253 
2254 	if (freq < 4000) {
2255 		if (freq < 2427)
2256 			return offset_2g;
2257 		if (freq < 2442)
2258 			return offset_2g + 1;
2259 		if (freq < 2457)
2260 			return offset_2g + 2;
2261 
2262 		return offset_2g + 3;
2263 	}
2264 
2265 	switch (bw) {
2266 	case NL80211_CHAN_WIDTH_80:
2267 	case NL80211_CHAN_WIDTH_80P80:
2268 	case NL80211_CHAN_WIDTH_160:
2269 		break;
2270 	default:
2271 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2272 					   freq + 10);
2273 		if (idx >= 0) {
2274 			freq = freq_bw40[idx];
2275 			break;
2276 		}
2277 
2278 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2279 					   freq - 10);
2280 		if (idx >= 0) {
2281 			freq = freq_bw40[idx];
2282 			break;
2283 		}
2284 		fallthrough;
2285 	case NL80211_CHAN_WIDTH_40:
2286 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2287 					   freq);
2288 		if (idx >= 0)
2289 			break;
2290 
2291 		return -1;
2292 
2293 	}
2294 
2295 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2296 }
2297 
2298 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2299 {
2300 	struct mt7615_dev *dev = phy->dev;
2301 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2302 	int freq2 = chandef->center_freq2;
2303 	int ret;
2304 	struct {
2305 		u8 direction;
2306 		u8 runtime_calibration;
2307 		u8 _rsv[2];
2308 
2309 		__le16 center_freq;
2310 		u8 bw;
2311 		u8 band;
2312 		u8 is_freq2;
2313 		u8 success;
2314 		u8 dbdc_en;
2315 
2316 		u8 _rsv2;
2317 
2318 		struct {
2319 			__le32 sx0_i_lna[4];
2320 			__le32 sx0_q_lna[4];
2321 
2322 			__le32 sx2_i_lna[4];
2323 			__le32 sx2_q_lna[4];
2324 		} dcoc_data[4];
2325 	} req = {
2326 		.direction = 1,
2327 
2328 		.bw = mt7615_mcu_chan_bw(chandef),
2329 		.band = chandef->center_freq1 > 4000,
2330 		.dbdc_en = !!dev->mt76.phys[MT_BAND1],
2331 	};
2332 	u16 center_freq = chandef->center_freq1;
2333 	int freq_idx;
2334 	u8 *eep = dev->mt76.eeprom.data;
2335 
2336 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2337 		return 0;
2338 
2339 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2340 		freq2 = center_freq + 40;
2341 		center_freq -= 40;
2342 	}
2343 
2344 again:
2345 	req.runtime_calibration = 1;
2346 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2347 	if (freq_idx < 0)
2348 		goto out;
2349 
2350 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2351 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2352 	       sizeof(req.dcoc_data));
2353 	req.runtime_calibration = 0;
2354 
2355 out:
2356 	req.center_freq = cpu_to_le16(center_freq);
2357 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RXDCOC_CAL), &req,
2358 				sizeof(req), true);
2359 
2360 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2361 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2362 		req.is_freq2 = true;
2363 		center_freq = freq2;
2364 		goto again;
2365 	}
2366 
2367 	return ret;
2368 }
2369 
2370 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2371 {
2372 	static const u16 freq_list[] = {
2373 		4920, 4940, 4960, 4980,
2374 		5040, 5060, 5080, 5180,
2375 		5200, 5220, 5240, 5260,
2376 		5280, 5300, 5320, 5340,
2377 		5360, 5380, 5400, 5420,
2378 		5440, 5460, 5480, 5500,
2379 		5520, 5540, 5560, 5580,
2380 		5600, 5620, 5640, 5660,
2381 		5680, 5700, 5720, 5745,
2382 		5765, 5785, 5805, 5825,
2383 		5845, 5865, 5885, 5905
2384 	};
2385 	int offset_2g = ARRAY_SIZE(freq_list);
2386 	int idx;
2387 
2388 	if (freq < 4000) {
2389 		if (freq < 2432)
2390 			return offset_2g;
2391 		if (freq < 2457)
2392 			return offset_2g + 1;
2393 
2394 		return offset_2g + 2;
2395 	}
2396 
2397 	if (bw != NL80211_CHAN_WIDTH_20) {
2398 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2399 					   freq + 10);
2400 		if (idx >= 0)
2401 			return idx;
2402 
2403 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2404 					   freq - 10);
2405 		if (idx >= 0)
2406 			return idx;
2407 	}
2408 
2409 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2410 }
2411 
2412 
2413 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2414 {
2415 	struct mt7615_dev *dev = phy->dev;
2416 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2417 	int freq2 = chandef->center_freq2;
2418 	int ret;
2419 	struct {
2420 		u8 direction;
2421 		u8 runtime_calibration;
2422 		u8 _rsv[2];
2423 
2424 		__le16 center_freq;
2425 		u8 bw;
2426 		u8 band;
2427 		u8 is_freq2;
2428 		u8 success;
2429 		u8 dbdc_en;
2430 
2431 		u8 _rsv2;
2432 
2433 		struct {
2434 			struct {
2435 				u32 dpd_g0;
2436 				u8 data[32];
2437 			} wf0, wf1;
2438 
2439 			struct {
2440 				u32 dpd_g0_prim;
2441 				u32 dpd_g0_sec;
2442 				u8 data_prim[32];
2443 				u8 data_sec[32];
2444 			} wf2, wf3;
2445 		} dpd_data;
2446 	} req = {
2447 		.direction = 1,
2448 
2449 		.bw = mt7615_mcu_chan_bw(chandef),
2450 		.band = chandef->center_freq1 > 4000,
2451 		.dbdc_en = !!dev->mt76.phys[MT_BAND1],
2452 	};
2453 	u16 center_freq = chandef->center_freq1;
2454 	int freq_idx;
2455 	u8 *eep = dev->mt76.eeprom.data;
2456 
2457 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2458 		return 0;
2459 
2460 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2461 		freq2 = center_freq + 40;
2462 		center_freq -= 40;
2463 	}
2464 
2465 again:
2466 	req.runtime_calibration = 1;
2467 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2468 	if (freq_idx < 0)
2469 		goto out;
2470 
2471 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2472 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2473 	       sizeof(req.dpd_data));
2474 	req.runtime_calibration = 0;
2475 
2476 out:
2477 	req.center_freq = cpu_to_le16(center_freq);
2478 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXDPD_CAL),
2479 				&req, sizeof(req), true);
2480 
2481 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2482 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2483 		req.is_freq2 = true;
2484 		center_freq = freq2;
2485 		goto again;
2486 	}
2487 
2488 	return ret;
2489 }
2490 
2491 int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2492 {
2493 	struct {
2494 		u8 operation;
2495 		u8 count;
2496 		u8 _rsv[2];
2497 		u8 index;
2498 		u8 enable;
2499 		__le16 etype;
2500 	} req = {
2501 		.operation = 1,
2502 		.count = 1,
2503 		.enable = 1,
2504 		.etype = cpu_to_le16(ETH_P_PAE),
2505 	};
2506 
2507 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2508 				 &req, sizeof(req), false);
2509 }
2510 
2511 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2512 			  bool enable)
2513 {
2514 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2515 	struct {
2516 		u8 bss_idx;
2517 		u8 dtim_period;
2518 		__le16 aid;
2519 		__le16 bcn_interval;
2520 		__le16 atim_window;
2521 		u8 uapsd;
2522 		u8 bmc_delivered_ac;
2523 		u8 bmc_triggered_ac;
2524 		u8 pad;
2525 	} req = {
2526 		.bss_idx = mvif->mt76.idx,
2527 		.aid = cpu_to_le16(vif->cfg.aid),
2528 		.dtim_period = vif->bss_conf.dtim_period,
2529 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2530 	};
2531 	struct {
2532 		u8 bss_idx;
2533 		u8 pad[3];
2534 	} req_hdr = {
2535 		.bss_idx = mvif->mt76.idx,
2536 	};
2537 	int err;
2538 
2539 	if (vif->type != NL80211_IFTYPE_STATION)
2540 		return 0;
2541 
2542 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
2543 				&req_hdr, sizeof(req_hdr), false);
2544 	if (err < 0 || !enable)
2545 		return err;
2546 
2547 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
2548 				 &req, sizeof(req), false);
2549 }
2550 
2551 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2552 		       struct ieee80211_channel *chan, int duration)
2553 {
2554 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2555 	struct mt7615_dev *dev = phy->dev;
2556 	struct mt7615_roc_tlv req = {
2557 		.bss_idx = mvif->mt76.idx,
2558 		.active = !chan,
2559 		.max_interval = cpu_to_le32(duration),
2560 		.primary_chan = chan ? chan->hw_value : 0,
2561 		.band = chan ? chan->band : 0,
2562 		.req_type = 2,
2563 	};
2564 
2565 	phy->roc_grant = false;
2566 
2567 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC),
2568 				 &req, sizeof(req), false);
2569 }
2570