xref: /linux/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c (revision 6e7fd890f1d6ac83805409e9c346240de2705584)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_buf {
44 	__le32 crc;
45 	__le32 d_img_size;
46 	__le32 block_size;
47 	u8 rsv[4];
48 	__le32 img_dest_addr;
49 	__le32 img_size;
50 	u8 feature_set;
51 };
52 
53 #define MT7615_PATCH_ADDRESS		0x80000
54 #define MT7622_PATCH_ADDRESS		0x9c000
55 #define MT7663_PATCH_ADDRESS		0xdc000
56 
57 #define N9_REGION_NUM			2
58 #define CR4_REGION_NUM			1
59 
60 #define IMG_CRC_LEN			4
61 
62 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
63 			 int cmd, int *wait_seq)
64 {
65 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
66 	struct mt7615_uni_txd *uni_txd;
67 	struct mt7615_mcu_txd *mcu_txd;
68 	u8 seq, q_idx, pkt_fmt;
69 	__le32 *txd;
70 	u32 val;
71 
72 	/* TODO: make dynamic based on msg type */
73 	dev->mt76.mcu.timeout = 20 * HZ;
74 
75 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
76 	if (!seq)
77 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
78 	if (wait_seq)
79 		*wait_seq = seq;
80 
81 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
82 	txd = (__le32 *)skb_push(skb, txd_len);
83 
84 	if (cmd != MCU_CMD(FW_SCATTER)) {
85 		q_idx = MT_TX_MCU_PORT_RX_Q0;
86 		pkt_fmt = MT_TX_TYPE_CMD;
87 	} else {
88 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
89 		pkt_fmt = MT_TX_TYPE_FW;
90 	}
91 
92 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
93 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
94 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
95 	txd[0] = cpu_to_le32(val);
96 
97 	val = MT_TXD1_LONG_FORMAT |
98 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
99 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
100 	txd[1] = cpu_to_le32(val);
101 
102 	if (cmd & __MCU_CMD_FIELD_UNI) {
103 		uni_txd = (struct mt7615_uni_txd *)txd;
104 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
105 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
106 		uni_txd->cid = cpu_to_le16(mcu_cmd);
107 		uni_txd->s2d_index = MCU_S2D_H2N;
108 		uni_txd->pkt_type = MCU_PKT_ID;
109 		uni_txd->seq = seq;
110 
111 		return;
112 	}
113 
114 	mcu_txd = (struct mt7615_mcu_txd *)txd;
115 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
116 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
117 	mcu_txd->s2d_index = MCU_S2D_H2N;
118 	mcu_txd->pkt_type = MCU_PKT_ID;
119 	mcu_txd->seq = seq;
120 	mcu_txd->cid = mcu_cmd;
121 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
122 
123 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
124 		if (cmd & __MCU_CMD_FIELD_QUERY)
125 			mcu_txd->set_query = MCU_Q_QUERY;
126 		else
127 			mcu_txd->set_query = MCU_Q_SET;
128 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
129 	} else {
130 		mcu_txd->set_query = MCU_Q_NA;
131 	}
132 }
133 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
134 
135 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
136 			      struct sk_buff *skb, int seq)
137 {
138 	struct mt7615_mcu_rxd *rxd;
139 	int ret = 0;
140 
141 	if (!skb) {
142 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
143 			cmd, seq);
144 		return -ETIMEDOUT;
145 	}
146 
147 	rxd = (struct mt7615_mcu_rxd *)skb->data;
148 	if (seq != rxd->seq)
149 		return -EAGAIN;
150 
151 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
152 		skb_pull(skb, sizeof(*rxd) - 4);
153 		ret = *skb->data;
154 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
155 		skb_pull(skb, sizeof(*rxd));
156 		ret = le32_to_cpu(*(__le32 *)skb->data);
157 	} else if (cmd == MCU_EXT_QUERY(RF_REG_ACCESS)) {
158 		skb_pull(skb, sizeof(*rxd));
159 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
160 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
161 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
162 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
163 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
164 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
165 		   cmd == MCU_UNI_CMD(SUSPEND)) {
166 		struct mt76_connac_mcu_uni_event *event;
167 
168 		skb_pull(skb, sizeof(*rxd));
169 		event = (struct mt76_connac_mcu_uni_event *)skb->data;
170 		ret = le32_to_cpu(event->status);
171 	} else if (cmd == MCU_CE_QUERY(REG_READ)) {
172 		struct mt76_connac_mcu_reg_event *event;
173 
174 		skb_pull(skb, sizeof(*rxd));
175 		event = (struct mt76_connac_mcu_reg_event *)skb->data;
176 		ret = (int)le32_to_cpu(event->val);
177 	}
178 
179 	return ret;
180 }
181 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
182 
183 static int
184 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
185 			int cmd, int *seq)
186 {
187 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
188 	enum mt76_mcuq_id qid;
189 
190 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
191 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
192 		qid = MT_MCUQ_WM;
193 	else
194 		qid = MT_MCUQ_FWDL;
195 
196 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
197 }
198 
199 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
200 {
201 	struct {
202 		__le32 wifi_stream;
203 		__le32 address;
204 		__le32 data;
205 	} req = {
206 		.wifi_stream = cpu_to_le32(wf),
207 		.address = cpu_to_le32(reg),
208 	};
209 
210 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
211 				 &req, sizeof(req), true);
212 }
213 
214 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
215 {
216 	struct {
217 		__le32 wifi_stream;
218 		__le32 address;
219 		__le32 data;
220 	} req = {
221 		.wifi_stream = cpu_to_le32(wf),
222 		.address = cpu_to_le32(reg),
223 		.data = cpu_to_le32(val),
224 	};
225 
226 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
227 				 &req, sizeof(req), false);
228 }
229 
230 void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
231 {
232 	if (!is_mt7622(&dev->mt76))
233 		return;
234 
235 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
236 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
237 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
238 }
239 EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
240 
241 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
242 {
243 	struct mt76_phy *mphy = &dev->mt76.phy;
244 	struct mt76_connac_pm *pm = &dev->pm;
245 	struct mt76_dev *mdev = &dev->mt76;
246 	u32 addr;
247 	int err;
248 
249 	if (is_mt7663(mdev)) {
250 		/* Clear firmware own via N9 eint */
251 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
252 		mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
253 
254 		addr = MT_CONN_HIF_ON_LPCTL;
255 	} else {
256 		addr = MT_CFG_LPCR_HOST;
257 	}
258 
259 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
260 
261 	mt7622_trigger_hif_int(dev, true);
262 
263 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
264 
265 	mt7622_trigger_hif_int(dev, false);
266 
267 	if (err) {
268 		dev_err(mdev->dev, "driver own failed\n");
269 		return -ETIMEDOUT;
270 	}
271 
272 	clear_bit(MT76_STATE_PM, &mphy->state);
273 
274 	pm->stats.last_wake_event = jiffies;
275 	pm->stats.doze_time += pm->stats.last_wake_event -
276 			       pm->stats.last_doze_event;
277 
278 	return 0;
279 }
280 
281 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
282 {
283 	struct mt76_phy *mphy = &dev->mt76.phy;
284 	struct mt76_connac_pm *pm = &dev->pm;
285 	int i, err = 0;
286 
287 	mutex_lock(&pm->mutex);
288 
289 	if (!test_bit(MT76_STATE_PM, &mphy->state))
290 		goto out;
291 
292 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
293 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
294 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
295 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
296 			break;
297 	}
298 
299 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
300 		dev_err(dev->mt76.dev, "driver own failed\n");
301 		err = -EIO;
302 		goto out;
303 	}
304 	clear_bit(MT76_STATE_PM, &mphy->state);
305 
306 	pm->stats.last_wake_event = jiffies;
307 	pm->stats.doze_time += pm->stats.last_wake_event -
308 			       pm->stats.last_doze_event;
309 out:
310 	mutex_unlock(&pm->mutex);
311 
312 	return err;
313 }
314 
315 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
316 {
317 	struct mt76_phy *mphy = &dev->mt76.phy;
318 	struct mt76_connac_pm *pm = &dev->pm;
319 	int err = 0;
320 	u32 addr;
321 
322 	mutex_lock(&pm->mutex);
323 
324 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
325 		goto out;
326 
327 	mt7622_trigger_hif_int(dev, true);
328 
329 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
330 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
331 
332 	if (is_mt7622(&dev->mt76) &&
333 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
334 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
335 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
336 		clear_bit(MT76_STATE_PM, &mphy->state);
337 		err = -EIO;
338 	}
339 
340 	mt7622_trigger_hif_int(dev, false);
341 	if (!err) {
342 		pm->stats.last_doze_event = jiffies;
343 		pm->stats.awake_time += pm->stats.last_doze_event -
344 					pm->stats.last_wake_event;
345 	}
346 out:
347 	mutex_unlock(&pm->mutex);
348 
349 	return err;
350 }
351 
352 static void
353 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
354 {
355 	if (vif->bss_conf.csa_active)
356 		ieee80211_csa_finish(vif, 0);
357 }
358 
359 static void
360 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
361 {
362 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
363 	struct mt76_phy *mphy = &dev->mt76.phy;
364 	struct mt7615_mcu_csa_notify *c;
365 
366 	c = (struct mt7615_mcu_csa_notify *)skb->data;
367 
368 	if (c->omac_idx > EXT_BSSID_MAX)
369 		return;
370 
371 	if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
372 		mphy = dev->mt76.phys[MT_BAND1];
373 
374 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
375 			IEEE80211_IFACE_ITER_RESUME_ALL,
376 			mt7615_mcu_csa_finish, mphy->hw);
377 }
378 
379 static void
380 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
381 {
382 	struct mt76_phy *mphy = &dev->mt76.phy;
383 	struct mt7615_mcu_rdd_report *r;
384 
385 	r = (struct mt7615_mcu_rdd_report *)skb->data;
386 
387 	if (!dev->radar_pattern.n_pulses && !r->long_detected &&
388 	    !r->constant_prf_detected && !r->staggered_prf_detected)
389 		return;
390 
391 	if (r->band_idx && dev->mt76.phys[MT_BAND1])
392 		mphy = dev->mt76.phys[MT_BAND1];
393 
394 	if (mt76_phy_dfs_state(mphy) < MT_DFS_STATE_CAC)
395 		return;
396 
397 	ieee80211_radar_detected(mphy->hw);
398 	dev->hw_pattern++;
399 }
400 
401 static void
402 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
403 {
404 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
405 	const char *data = (char *)&rxd[1];
406 	const char *type;
407 
408 	switch (rxd->s2d_index) {
409 	case 0:
410 		type = "N9";
411 		break;
412 	case 2:
413 		type = "CR4";
414 		break;
415 	default:
416 		type = "unknown";
417 		break;
418 	}
419 
420 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
421 		   (int)(skb->len - sizeof(*rxd)), data);
422 }
423 
424 static void
425 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
426 {
427 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
428 
429 	switch (rxd->ext_eid) {
430 	case MCU_EXT_EVENT_RDD_REPORT:
431 		mt7615_mcu_rx_radar_detected(dev, skb);
432 		break;
433 	case MCU_EXT_EVENT_CSA_NOTIFY:
434 		mt7615_mcu_rx_csa_notify(dev, skb);
435 		break;
436 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
437 		mt7615_mcu_rx_log_message(dev, skb);
438 		break;
439 	default:
440 		break;
441 	}
442 }
443 
444 static void
445 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
446 {
447 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
448 	struct mt7615_phy *phy;
449 	struct mt76_phy *mphy;
450 
451 	if (*seq_num & BIT(7) && dev->mt76.phys[MT_BAND1])
452 		mphy = dev->mt76.phys[MT_BAND1];
453 	else
454 		mphy = &dev->mt76.phy;
455 
456 	phy = mphy->priv;
457 
458 	spin_lock_bh(&dev->mt76.lock);
459 	__skb_queue_tail(&phy->scan_event_list, skb);
460 	spin_unlock_bh(&dev->mt76.lock);
461 
462 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
463 				     MT7615_HW_SCAN_TIMEOUT);
464 }
465 
466 static void
467 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
468 {
469 	struct mt7615_roc_tlv *event;
470 	struct mt7615_phy *phy;
471 	struct mt76_phy *mphy;
472 	int duration;
473 
474 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
475 	event = (struct mt7615_roc_tlv *)skb->data;
476 
477 	if (event->dbdc_band && dev->mt76.phys[MT_BAND1])
478 		mphy = dev->mt76.phys[MT_BAND1];
479 	else
480 		mphy = &dev->mt76.phy;
481 
482 	ieee80211_ready_on_channel(mphy->hw);
483 
484 	phy = mphy->priv;
485 	phy->roc_grant = true;
486 	wake_up(&phy->roc_wait);
487 
488 	duration = le32_to_cpu(event->max_interval);
489 	mod_timer(&phy->roc_timer,
490 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
491 }
492 
493 static void
494 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
495 {
496 	struct mt76_connac_beacon_loss_event *event;
497 	struct mt76_phy *mphy;
498 	u8 band_idx = 0; /* DBDC support */
499 
500 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
501 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
502 	if (band_idx && dev->mt76.phys[MT_BAND1])
503 		mphy = dev->mt76.phys[MT_BAND1];
504 	else
505 		mphy = &dev->mt76.phy;
506 
507 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
508 					IEEE80211_IFACE_ITER_RESUME_ALL,
509 					mt76_connac_mcu_beacon_loss_iter,
510 					event);
511 }
512 
513 static void
514 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
515 {
516 	struct mt76_connac_mcu_bss_event *event;
517 	struct mt76_phy *mphy;
518 	u8 band_idx = 0; /* DBDC support */
519 
520 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
521 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
522 
523 	if (band_idx && dev->mt76.phys[MT_BAND1])
524 		mphy = dev->mt76.phys[MT_BAND1];
525 	else
526 		mphy = &dev->mt76.phy;
527 
528 	if (event->is_absent)
529 		ieee80211_stop_queues(mphy->hw);
530 	else
531 		ieee80211_wake_queues(mphy->hw);
532 }
533 
534 static void
535 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
536 {
537 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
538 
539 	switch (rxd->eid) {
540 	case MCU_EVENT_EXT:
541 		mt7615_mcu_rx_ext_event(dev, skb);
542 		break;
543 	case MCU_EVENT_BSS_BEACON_LOSS:
544 		mt7615_mcu_beacon_loss_event(dev, skb);
545 		break;
546 	case MCU_EVENT_ROC:
547 		mt7615_mcu_roc_event(dev, skb);
548 		break;
549 	case MCU_EVENT_SCHED_SCAN_DONE:
550 	case MCU_EVENT_SCAN_DONE:
551 		mt7615_mcu_scan_event(dev, skb);
552 		return;
553 	case MCU_EVENT_BSS_ABSENCE:
554 		mt7615_mcu_bss_event(dev, skb);
555 		break;
556 	case MCU_EVENT_COREDUMP:
557 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
558 					       &dev->coredump);
559 		return;
560 	default:
561 		break;
562 	}
563 	dev_kfree_skb(skb);
564 }
565 
566 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
567 {
568 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
569 
570 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
571 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
572 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
573 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
574 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
575 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
576 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
577 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
578 	    rxd->eid == MCU_EVENT_COREDUMP ||
579 	    rxd->eid == MCU_EVENT_ROC ||
580 	    !rxd->seq)
581 		mt7615_mcu_rx_unsolicited_event(dev, skb);
582 	else
583 		mt76_mcu_rx_event(&dev->mt76, skb);
584 }
585 
586 static int
587 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
588 		       bool bssid, bool enable)
589 {
590 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
591 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
592 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
593 	const u8 *addr = vif->addr;
594 	struct {
595 		u8 mode;
596 		u8 force_clear;
597 		u8 clear_bitmap[8];
598 		u8 entry_count;
599 		u8 write;
600 
601 		u8 index;
602 		u8 bssid;
603 		u8 addr[ETH_ALEN];
604 	} __packed req = {
605 		.mode = !!mask || enable,
606 		.entry_count = 1,
607 		.write = 1,
608 
609 		.index = idx * 2 + bssid,
610 	};
611 
612 	if (bssid)
613 		addr = vif->bss_conf.bssid;
614 
615 	if (enable)
616 		ether_addr_copy(req.addr, addr);
617 
618 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE),
619 				 &req, sizeof(req), true);
620 }
621 
622 static int
623 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
624 		   bool enable)
625 {
626 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
627 	struct mt7615_dev *dev = phy->dev;
628 	struct {
629 		struct req_hdr {
630 			u8 omac_idx;
631 			u8 band_idx;
632 			__le16 tlv_num;
633 			u8 is_tlv_append;
634 			u8 rsv[3];
635 		} __packed hdr;
636 		struct req_tlv {
637 			__le16 tag;
638 			__le16 len;
639 			u8 active;
640 			u8 band_idx;
641 			u8 omac_addr[ETH_ALEN];
642 		} __packed tlv;
643 	} data = {
644 		.hdr = {
645 			.omac_idx = mvif->mt76.omac_idx,
646 			.band_idx = mvif->mt76.band_idx,
647 			.tlv_num = cpu_to_le16(1),
648 			.is_tlv_append = 1,
649 		},
650 		.tlv = {
651 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
652 			.len = cpu_to_le16(sizeof(struct req_tlv)),
653 			.active = enable,
654 			.band_idx = mvif->mt76.band_idx,
655 		},
656 	};
657 
658 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
659 		return mt7615_mcu_muar_config(dev, vif, false, enable);
660 
661 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
662 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
663 				 &data, sizeof(data), true);
664 }
665 
666 static int
667 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
668 			      struct ieee80211_hw *hw,
669 			      struct ieee80211_vif *vif, bool enable)
670 {
671 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
672 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
673 	struct ieee80211_mutable_offsets offs;
674 	struct ieee80211_tx_info *info;
675 	struct req {
676 		u8 omac_idx;
677 		u8 enable;
678 		u8 wlan_idx;
679 		u8 band_idx;
680 		u8 pkt_type;
681 		u8 need_pre_tbtt_int;
682 		__le16 csa_ie_pos;
683 		__le16 pkt_len;
684 		__le16 tim_ie_pos;
685 		u8 pkt[512];
686 		u8 csa_cnt;
687 		/* bss color change */
688 		u8 bcc_cnt;
689 		__le16 bcc_ie_pos;
690 	} __packed req = {
691 		.omac_idx = mvif->mt76.omac_idx,
692 		.enable = enable,
693 		.wlan_idx = wcid->idx,
694 		.band_idx = mvif->mt76.band_idx,
695 	};
696 	struct sk_buff *skb;
697 
698 	if (!enable)
699 		goto out;
700 
701 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
702 	if (!skb)
703 		return -EINVAL;
704 
705 	if (skb->len > 512 - MT_TXD_SIZE) {
706 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
707 		dev_kfree_skb(skb);
708 		return -EINVAL;
709 	}
710 
711 	info = IEEE80211_SKB_CB(skb);
712 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, mvif->mt76.band_idx);
713 
714 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
715 			      0, NULL, 0, true);
716 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
717 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
718 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
719 	if (offs.cntdwn_counter_offs[0]) {
720 		u16 csa_offs;
721 
722 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
723 		req.csa_ie_pos = cpu_to_le16(csa_offs);
724 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
725 	}
726 	dev_kfree_skb(skb);
727 
728 out:
729 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(BCN_OFFLOAD), &req,
730 				 sizeof(req), true);
731 }
732 
733 static int
734 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
735 {
736 	return mt76_connac_mcu_set_pm(&dev->mt76, band, state);
737 }
738 
739 static int
740 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
741 		   struct ieee80211_sta *sta, bool enable)
742 {
743 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
744 	struct mt7615_dev *dev = phy->dev;
745 	struct sk_buff *skb;
746 
747 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
748 		mt7615_mcu_muar_config(dev, vif, true, enable);
749 
750 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
751 	if (IS_ERR(skb))
752 		return PTR_ERR(skb);
753 
754 	if (enable)
755 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
756 
757 	mt76_connac_mcu_bss_basic_tlv(skb, vif, sta, phy->mt76,
758 				      mvif->sta.wcid.idx, enable);
759 
760 	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
761 	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
762 		mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
763 
764 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
765 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
766 }
767 
768 static int
769 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
770 		      struct ieee80211_ampdu_params *params,
771 		      bool enable)
772 {
773 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
774 	struct mt7615_vif *mvif = msta->vif;
775 	struct wtbl_req_hdr *wtbl_hdr;
776 	struct sk_buff *skb = NULL;
777 	int err;
778 
779 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
780 						  WTBL_SET, NULL, &skb);
781 	if (IS_ERR(wtbl_hdr))
782 		return PTR_ERR(wtbl_hdr);
783 
784 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
785 				    NULL, wtbl_hdr);
786 
787 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
788 				    MCU_EXT_CMD(WTBL_UPDATE), true);
789 	if (err < 0)
790 		return err;
791 
792 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
793 					    &msta->wcid);
794 	if (IS_ERR(skb))
795 		return PTR_ERR(skb);
796 
797 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
798 
799 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
800 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
801 }
802 
803 static int
804 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
805 		      struct ieee80211_ampdu_params *params,
806 		      bool enable)
807 {
808 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
809 	struct mt7615_vif *mvif = msta->vif;
810 	struct wtbl_req_hdr *wtbl_hdr;
811 	struct sk_buff *skb;
812 	int err;
813 
814 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
815 					    &msta->wcid);
816 	if (IS_ERR(skb))
817 		return PTR_ERR(skb);
818 
819 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
820 
821 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
822 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
823 	if (err < 0 || !enable)
824 		return err;
825 
826 	skb = NULL;
827 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
828 						  WTBL_SET, NULL, &skb);
829 	if (IS_ERR(wtbl_hdr))
830 		return PTR_ERR(wtbl_hdr);
831 
832 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
833 				    NULL, wtbl_hdr);
834 
835 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
836 				     MCU_EXT_CMD(WTBL_UPDATE), true);
837 }
838 
839 static int
840 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
841 			struct ieee80211_sta *sta, bool enable)
842 {
843 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
844 	struct sk_buff *skb, *sskb, *wskb = NULL;
845 	struct ieee80211_link_sta *link_sta;
846 	struct mt7615_dev *dev = phy->dev;
847 	struct wtbl_req_hdr *wtbl_hdr;
848 	struct mt7615_sta *msta;
849 	bool new_entry = true;
850 	int cmd, err;
851 
852 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
853 	link_sta = sta ? &sta->deflink : NULL;
854 
855 	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
856 					     &msta->wcid);
857 	if (IS_ERR(sskb))
858 		return PTR_ERR(sskb);
859 
860 	if (!sta) {
861 		if (mvif->sta_added)
862 			new_entry = false;
863 		else
864 			mvif->sta_added = true;
865 	}
866 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, link_sta,
867 				      enable, new_entry);
868 	if (enable && sta)
869 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
870 					MT76_STA_INFO_STATE_ASSOC);
871 
872 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
873 						  WTBL_RESET_AND_SET, NULL,
874 						  &wskb);
875 	if (IS_ERR(wtbl_hdr))
876 		return PTR_ERR(wtbl_hdr);
877 
878 	if (enable) {
879 		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
880 						 NULL, wtbl_hdr);
881 		if (sta)
882 			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
883 						    NULL, wtbl_hdr, true, true);
884 		mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, vif, &msta->wcid,
885 						   NULL, wtbl_hdr);
886 	}
887 
888 	cmd = enable ? MCU_EXT_CMD(WTBL_UPDATE) : MCU_EXT_CMD(STA_REC_UPDATE);
889 	skb = enable ? wskb : sskb;
890 
891 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
892 	if (err < 0) {
893 		skb = enable ? sskb : wskb;
894 		dev_kfree_skb(skb);
895 
896 		return err;
897 	}
898 
899 	cmd = enable ? MCU_EXT_CMD(STA_REC_UPDATE) : MCU_EXT_CMD(WTBL_UPDATE);
900 	skb = enable ? sskb : wskb;
901 
902 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
903 }
904 
905 static int
906 mt7615_mcu_wtbl_update_hdr_trans(struct mt7615_dev *dev,
907 				 struct ieee80211_vif *vif,
908 				 struct ieee80211_sta *sta)
909 {
910 	return mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
911 }
912 
913 static const struct mt7615_mcu_ops wtbl_update_ops = {
914 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
915 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
916 	.add_dev_info = mt7615_mcu_add_dev,
917 	.add_bss_info = mt7615_mcu_add_bss,
918 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
919 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
920 	.sta_add = mt7615_mcu_wtbl_sta_add,
921 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
922 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
923 	.set_sta_decap_offload = mt7615_mcu_wtbl_update_hdr_trans,
924 };
925 
926 static int
927 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
928 		  struct ieee80211_ampdu_params *params,
929 		  bool enable, bool tx)
930 {
931 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
932 	struct mt7615_vif *mvif = msta->vif;
933 	struct wtbl_req_hdr *wtbl_hdr;
934 	struct tlv *sta_wtbl;
935 	struct sk_buff *skb;
936 
937 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
938 					    &msta->wcid);
939 	if (IS_ERR(skb))
940 		return PTR_ERR(skb);
941 
942 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
943 
944 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
945 
946 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
947 						  WTBL_SET, sta_wtbl, &skb);
948 	if (IS_ERR(wtbl_hdr))
949 		return PTR_ERR(wtbl_hdr);
950 
951 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
952 				    sta_wtbl, wtbl_hdr);
953 
954 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
955 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
956 }
957 
958 static int
959 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
960 		     struct ieee80211_ampdu_params *params,
961 		     bool enable)
962 {
963 	return mt7615_mcu_sta_ba(dev, params, enable, true);
964 }
965 
966 static int
967 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
968 		     struct ieee80211_ampdu_params *params,
969 		     bool enable)
970 {
971 	return mt7615_mcu_sta_ba(dev, params, enable, false);
972 }
973 
974 static int
975 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
976 		     struct ieee80211_sta *sta, bool enable, int cmd,
977 		     bool offload_fw)
978 {
979 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
980 	struct mt76_sta_cmd_info info = {
981 		.sta = sta,
982 		.vif = vif,
983 		.offload_fw = offload_fw,
984 		.enable = enable,
985 		.newly = true,
986 		.cmd = cmd,
987 	};
988 
989 	info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
990 	return mt76_connac_mcu_sta_cmd(phy, &info);
991 }
992 
993 static int
994 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
995 		   struct ieee80211_sta *sta, bool enable)
996 {
997 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
998 				    MCU_EXT_CMD(STA_REC_UPDATE), false);
999 }
1000 
1001 static int
1002 mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1003 				struct ieee80211_vif *vif,
1004 				struct ieee80211_sta *sta)
1005 {
1006 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1007 
1008 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1009 						    vif, &msta->wcid,
1010 						    MCU_EXT_CMD(STA_REC_UPDATE));
1011 }
1012 
1013 static const struct mt7615_mcu_ops sta_update_ops = {
1014 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1015 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1016 	.add_dev_info = mt7615_mcu_add_dev,
1017 	.add_bss_info = mt7615_mcu_add_bss,
1018 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1019 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1020 	.sta_add = mt7615_mcu_add_sta,
1021 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1022 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1023 	.set_sta_decap_offload = mt7615_mcu_sta_update_hdr_trans,
1024 };
1025 
1026 static int
1027 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1028 {
1029 	return 0;
1030 }
1031 
1032 static int
1033 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1034 				  struct ieee80211_hw *hw,
1035 				  struct ieee80211_vif *vif,
1036 				  bool enable)
1037 {
1038 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1039 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1040 	struct ieee80211_mutable_offsets offs;
1041 	struct {
1042 		struct req_hdr {
1043 			u8 bss_idx;
1044 			u8 pad[3];
1045 		} __packed hdr;
1046 		struct bcn_content_tlv {
1047 			__le16 tag;
1048 			__le16 len;
1049 			__le16 tim_ie_pos;
1050 			__le16 csa_ie_pos;
1051 			__le16 bcc_ie_pos;
1052 			/* 0: disable beacon offload
1053 			 * 1: enable beacon offload
1054 			 * 2: update probe respond offload
1055 			 */
1056 			u8 enable;
1057 			/* 0: legacy format (TXD + payload)
1058 			 * 1: only cap field IE
1059 			 */
1060 			u8 type;
1061 			__le16 pkt_len;
1062 			u8 pkt[512];
1063 		} __packed beacon_tlv;
1064 	} req = {
1065 		.hdr = {
1066 			.bss_idx = mvif->mt76.idx,
1067 		},
1068 		.beacon_tlv = {
1069 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1070 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1071 			.enable = enable,
1072 		},
1073 	};
1074 	struct sk_buff *skb;
1075 
1076 	if (!enable)
1077 		goto out;
1078 
1079 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
1080 	if (!skb)
1081 		return -EINVAL;
1082 
1083 	if (skb->len > 512 - MT_TXD_SIZE) {
1084 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1085 		dev_kfree_skb(skb);
1086 		return -EINVAL;
1087 	}
1088 
1089 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1090 			      wcid, NULL, 0, NULL, 0, true);
1091 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1092 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1093 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1094 
1095 	if (offs.cntdwn_counter_offs[0]) {
1096 		u16 csa_offs;
1097 
1098 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1099 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1100 	}
1101 	dev_kfree_skb(skb);
1102 
1103 out:
1104 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1105 				 &req, sizeof(req), true);
1106 }
1107 
1108 static int
1109 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1110 		       bool enable)
1111 {
1112 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1113 
1114 	return mt76_connac_mcu_uni_add_dev(phy->mt76, &vif->bss_conf,
1115 					   &mvif->sta.wcid, enable);
1116 }
1117 
1118 static int
1119 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1120 		       struct ieee80211_sta *sta, bool enable)
1121 {
1122 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1123 
1124 	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1125 					   enable, NULL);
1126 }
1127 
1128 static inline int
1129 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1130 		       struct ieee80211_sta *sta, bool enable)
1131 {
1132 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1133 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1134 }
1135 
1136 static int
1137 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1138 		     struct ieee80211_ampdu_params *params,
1139 		     bool enable)
1140 {
1141 	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1142 
1143 	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1144 				      MCU_UNI_CMD(STA_REC_UPDATE), enable,
1145 				      true);
1146 }
1147 
1148 static int
1149 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1150 		     struct ieee80211_ampdu_params *params,
1151 		     bool enable)
1152 {
1153 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1154 	struct mt7615_vif *mvif = msta->vif;
1155 	struct wtbl_req_hdr *wtbl_hdr;
1156 	struct tlv *sta_wtbl;
1157 	struct sk_buff *skb;
1158 	int err;
1159 
1160 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1161 					    &msta->wcid);
1162 	if (IS_ERR(skb))
1163 		return PTR_ERR(skb);
1164 
1165 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1166 
1167 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1168 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1169 	if (err < 0 || !enable)
1170 		return err;
1171 
1172 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1173 					    &msta->wcid);
1174 	if (IS_ERR(skb))
1175 		return PTR_ERR(skb);
1176 
1177 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1178 					   sizeof(struct tlv));
1179 
1180 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1181 						  WTBL_SET, sta_wtbl, &skb);
1182 	if (IS_ERR(wtbl_hdr))
1183 		return PTR_ERR(wtbl_hdr);
1184 
1185 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1186 				    sta_wtbl, wtbl_hdr);
1187 
1188 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1189 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
1190 }
1191 
1192 static int
1193 mt7615_mcu_sta_uni_update_hdr_trans(struct mt7615_dev *dev,
1194 				    struct ieee80211_vif *vif,
1195 				    struct ieee80211_sta *sta)
1196 {
1197 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1198 
1199 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1200 						    vif, &msta->wcid,
1201 						    MCU_UNI_CMD(STA_REC_UPDATE));
1202 }
1203 
1204 static const struct mt7615_mcu_ops uni_update_ops = {
1205 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1206 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1207 	.add_dev_info = mt7615_mcu_uni_add_dev,
1208 	.add_bss_info = mt7615_mcu_uni_add_bss,
1209 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1210 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1211 	.sta_add = mt7615_mcu_uni_add_sta,
1212 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1213 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1214 	.set_sta_decap_offload = mt7615_mcu_sta_uni_update_hdr_trans,
1215 };
1216 
1217 int mt7615_mcu_restart(struct mt76_dev *dev)
1218 {
1219 	return mt76_mcu_send_msg(dev, MCU_CMD(RESTART_DL_REQ), NULL, 0, true);
1220 }
1221 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1222 
1223 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1224 {
1225 	const struct mt7615_patch_hdr *hdr;
1226 	const struct firmware *fw = NULL;
1227 	int len, ret, sem;
1228 
1229 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1230 	if (ret)
1231 		return ret;
1232 
1233 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1234 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1235 		ret = -EINVAL;
1236 		goto release_fw;
1237 	}
1238 
1239 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1240 	switch (sem) {
1241 	case PATCH_IS_DL:
1242 		goto release_fw;
1243 	case PATCH_NOT_DL_SEM_SUCCESS:
1244 		break;
1245 	default:
1246 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1247 		ret = -EAGAIN;
1248 		goto release_fw;
1249 	}
1250 
1251 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1252 
1253 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1254 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1255 
1256 	len = fw->size - sizeof(*hdr);
1257 
1258 	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1259 					    DL_MODE_NEED_RSP);
1260 	if (ret) {
1261 		dev_err(dev->mt76.dev, "Download request failed\n");
1262 		goto out;
1263 	}
1264 
1265 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1266 				     fw->data + sizeof(*hdr), len);
1267 	if (ret) {
1268 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1269 		goto out;
1270 	}
1271 
1272 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1273 	if (ret)
1274 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1275 
1276 out:
1277 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1278 	switch (sem) {
1279 	case PATCH_REL_SEM_SUCCESS:
1280 		break;
1281 	default:
1282 		ret = -EAGAIN;
1283 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1284 		break;
1285 	}
1286 
1287 release_fw:
1288 	release_firmware(fw);
1289 
1290 	return ret;
1291 }
1292 
1293 static int
1294 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1295 			     const struct mt7615_fw_trailer *hdr,
1296 			     const u8 *data, bool is_cr4)
1297 {
1298 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1299 	int err, i, offset = 0;
1300 	u32 len, addr, mode;
1301 
1302 	for (i = 0; i < n_region; i++) {
1303 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1304 						   hdr[i].feature_set, is_cr4);
1305 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1306 		addr = le32_to_cpu(hdr[i].addr);
1307 
1308 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1309 						    mode);
1310 		if (err) {
1311 			dev_err(dev->mt76.dev, "Download request failed\n");
1312 			return err;
1313 		}
1314 
1315 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1316 					     data + offset, len);
1317 		if (err) {
1318 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1319 			return err;
1320 		}
1321 
1322 		offset += len;
1323 	}
1324 
1325 	return 0;
1326 }
1327 
1328 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1329 {
1330 	const struct mt7615_fw_trailer *hdr;
1331 	const struct firmware *fw;
1332 	int ret;
1333 
1334 	ret = request_firmware(&fw, name, dev->mt76.dev);
1335 	if (ret)
1336 		return ret;
1337 
1338 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1339 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1340 		ret = -EINVAL;
1341 		goto out;
1342 	}
1343 
1344 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1345 					N9_REGION_NUM * sizeof(*hdr));
1346 
1347 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1348 		 hdr->fw_ver, hdr->build_date);
1349 
1350 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1351 	if (ret)
1352 		goto out;
1353 
1354 	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1355 					     le32_to_cpu(hdr->addr),
1356 					     FW_START_OVERRIDE);
1357 	if (ret) {
1358 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1359 		goto out;
1360 	}
1361 
1362 	snprintf(dev->mt76.hw->wiphy->fw_version,
1363 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1364 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1365 
1366 	if (!is_mt7615(&dev->mt76)) {
1367 		dev->fw_ver = MT7615_FIRMWARE_V2;
1368 		dev->mcu_ops = &sta_update_ops;
1369 	} else {
1370 		dev->fw_ver = MT7615_FIRMWARE_V1;
1371 		dev->mcu_ops = &wtbl_update_ops;
1372 	}
1373 
1374 out:
1375 	release_firmware(fw);
1376 	return ret;
1377 }
1378 
1379 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1380 {
1381 	const struct mt7615_fw_trailer *hdr;
1382 	const struct firmware *fw;
1383 	int ret;
1384 
1385 	ret = request_firmware(&fw, name, dev->mt76.dev);
1386 	if (ret)
1387 		return ret;
1388 
1389 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1390 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1391 		ret = -EINVAL;
1392 		goto out;
1393 	}
1394 
1395 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1396 					CR4_REGION_NUM * sizeof(*hdr));
1397 
1398 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1399 		 hdr->fw_ver, hdr->build_date);
1400 
1401 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1402 	if (ret)
1403 		goto out;
1404 
1405 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1406 					     FW_START_WORKING_PDA_CR4);
1407 	if (ret) {
1408 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1409 		goto out;
1410 	}
1411 
1412 out:
1413 	release_firmware(fw);
1414 
1415 	return ret;
1416 }
1417 
1418 static int mt7615_load_ram(struct mt7615_dev *dev)
1419 {
1420 	int ret;
1421 
1422 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1423 	if (ret)
1424 		return ret;
1425 
1426 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1427 }
1428 
1429 static int mt7615_load_firmware(struct mt7615_dev *dev)
1430 {
1431 	int ret;
1432 	u32 val;
1433 
1434 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1435 
1436 	if (val != FW_STATE_FW_DOWNLOAD) {
1437 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1438 		return -EIO;
1439 	}
1440 
1441 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1442 	if (ret)
1443 		return ret;
1444 
1445 	ret = mt7615_load_ram(dev);
1446 	if (ret)
1447 		return ret;
1448 
1449 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1450 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1451 				       FW_STATE_RDY), 500)) {
1452 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1453 		return -EIO;
1454 	}
1455 
1456 	return 0;
1457 }
1458 
1459 static int mt7622_load_firmware(struct mt7615_dev *dev)
1460 {
1461 	int ret;
1462 	u32 val;
1463 
1464 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1465 
1466 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1467 	if (val != FW_STATE_FW_DOWNLOAD) {
1468 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1469 		return -EIO;
1470 	}
1471 
1472 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1473 	if (ret)
1474 		return ret;
1475 
1476 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1477 	if (ret)
1478 		return ret;
1479 
1480 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1481 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1482 				       FW_STATE_NORMAL_TRX), 1500)) {
1483 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1484 		return -EIO;
1485 	}
1486 
1487 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1488 
1489 	return 0;
1490 }
1491 
1492 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1493 {
1494 	struct {
1495 		u8 ctrl_val;
1496 		u8 pad[3];
1497 	} data = {
1498 		.ctrl_val = ctrl
1499 	};
1500 
1501 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST),
1502 				 &data, sizeof(data), true);
1503 }
1504 
1505 static int mt7615_mcu_cal_cache_apply(struct mt7615_dev *dev)
1506 {
1507 	struct {
1508 		bool cache_enable;
1509 		u8 pad[3];
1510 	} data = {
1511 		.cache_enable = true
1512 	};
1513 
1514 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CAL_CACHE), &data,
1515 				 sizeof(data), false);
1516 }
1517 
1518 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1519 {
1520 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1521 	const struct mt76_connac2_fw_trailer *hdr;
1522 	const struct mt7663_fw_buf *buf;
1523 	const struct firmware *fw;
1524 	const u8 *base_addr;
1525 	int i, ret;
1526 
1527 	ret = request_firmware(&fw, name, dev->mt76.dev);
1528 	if (ret)
1529 		return ret;
1530 
1531 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1532 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1533 		ret = -EINVAL;
1534 		goto out;
1535 	}
1536 
1537 	hdr = (const void *)(fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE);
1538 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1539 		 hdr->fw_ver, hdr->build_date);
1540 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1541 
1542 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1543 	for (i = 0; i < hdr->n_region; i++) {
1544 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1545 		u32 len, addr, mode;
1546 
1547 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1548 
1549 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1550 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1551 						   buf->feature_set, false);
1552 		addr = le32_to_cpu(buf->img_dest_addr);
1553 		len = le32_to_cpu(buf->img_size);
1554 
1555 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1556 						    mode);
1557 		if (ret) {
1558 			dev_err(dev->mt76.dev, "Download request failed\n");
1559 			goto out;
1560 		}
1561 
1562 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1563 					     fw->data + offset, len);
1564 		if (ret) {
1565 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1566 			goto out;
1567 		}
1568 
1569 		offset += le32_to_cpu(buf->img_size);
1570 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1571 			override_addr = le32_to_cpu(buf->img_dest_addr);
1572 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1573 				 i, override_addr);
1574 		}
1575 	}
1576 
1577 	if (override_addr)
1578 		flag |= FW_START_OVERRIDE;
1579 
1580 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1581 		 override_addr, flag);
1582 
1583 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1584 	if (ret) {
1585 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1586 		goto out;
1587 	}
1588 
1589 	snprintf(dev->mt76.hw->wiphy->fw_version,
1590 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1591 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1592 
1593 out:
1594 	release_firmware(fw);
1595 
1596 	return ret;
1597 }
1598 
1599 static int
1600 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1601 {
1602 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1603 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1604 	int ret;
1605 
1606 	if (!prefer_offload_fw) {
1607 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1608 		primary_rom = MT7663_ROM_PATCH;
1609 	}
1610 	selected_rom = primary_rom;
1611 
1612 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1613 	if (ret) {
1614 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1615 			 primary_rom, secondary_rom);
1616 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1617 					secondary_rom);
1618 		if (ret) {
1619 			dev_err(dev->mt76.dev, "failed to load %s",
1620 				secondary_rom);
1621 			return ret;
1622 		}
1623 		selected_rom = secondary_rom;
1624 	}
1625 
1626 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1627 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1628 		dev->fw_ver = MT7615_FIRMWARE_V3;
1629 		dev->mcu_ops = &uni_update_ops;
1630 	} else {
1631 		*n9_firmware = MT7663_FIRMWARE_N9;
1632 		dev->fw_ver = MT7615_FIRMWARE_V2;
1633 		dev->mcu_ops = &sta_update_ops;
1634 	}
1635 
1636 	return 0;
1637 }
1638 
1639 int __mt7663_load_firmware(struct mt7615_dev *dev)
1640 {
1641 	const char *n9_firmware;
1642 	int ret;
1643 
1644 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1645 	if (ret) {
1646 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1647 		return -EIO;
1648 	}
1649 
1650 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1651 	if (ret)
1652 		return ret;
1653 
1654 	ret = mt7663_load_n9(dev, n9_firmware);
1655 	if (ret)
1656 		return ret;
1657 
1658 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1659 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1660 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1661 				     MT7663_TOP_MISC2_FW_STATE);
1662 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1663 		return -EIO;
1664 	}
1665 
1666 #ifdef CONFIG_PM
1667 	if (mt7615_firmware_offload(dev))
1668 		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1669 #endif /* CONFIG_PM */
1670 
1671 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1672 
1673 	return 0;
1674 }
1675 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1676 
1677 static int mt7663_load_firmware(struct mt7615_dev *dev)
1678 {
1679 	int ret;
1680 
1681 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1682 
1683 	ret = __mt7663_load_firmware(dev);
1684 	if (ret)
1685 		return ret;
1686 
1687 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1688 
1689 	return 0;
1690 }
1691 
1692 int mt7615_mcu_init(struct mt7615_dev *dev)
1693 {
1694 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1695 		.headroom = sizeof(struct mt7615_mcu_txd),
1696 		.mcu_skb_send_msg = mt7615_mcu_send_message,
1697 		.mcu_parse_response = mt7615_mcu_parse_response,
1698 	};
1699 	int ret;
1700 
1701 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
1702 
1703 	ret = mt7615_mcu_drv_pmctrl(dev);
1704 	if (ret)
1705 		return ret;
1706 
1707 	switch (mt76_chip(&dev->mt76)) {
1708 	case 0x7622:
1709 		ret = mt7622_load_firmware(dev);
1710 		break;
1711 	case 0x7663:
1712 		ret = mt7663_load_firmware(dev);
1713 		break;
1714 	default:
1715 		ret = mt7615_load_firmware(dev);
1716 		break;
1717 	}
1718 	if (ret)
1719 		return ret;
1720 
1721 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1722 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1723 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1724 
1725 	if (dev->dbdc_support) {
1726 		ret = mt7615_mcu_cal_cache_apply(dev);
1727 		if (ret)
1728 			return ret;
1729 	}
1730 
1731 	return mt7615_mcu_fw_log_2_host(dev, 0);
1732 }
1733 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1734 
1735 void mt7615_mcu_exit(struct mt7615_dev *dev)
1736 {
1737 	mt7615_mcu_restart(&dev->mt76);
1738 	mt7615_mcu_set_fw_ctrl(dev);
1739 	skb_queue_purge(&dev->mt76.mcu.res_q);
1740 }
1741 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1742 
1743 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1744 {
1745 	struct {
1746 		u8 buffer_mode;
1747 		u8 content_format;
1748 		__le16 len;
1749 	} __packed req_hdr = {
1750 		.buffer_mode = 1,
1751 	};
1752 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1753 	struct sk_buff *skb;
1754 	int eep_len, offset;
1755 
1756 	switch (mt76_chip(&dev->mt76)) {
1757 	case 0x7622:
1758 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1759 		offset = MT_EE_NIC_CONF_0;
1760 		break;
1761 	case 0x7663:
1762 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1763 		req_hdr.content_format = 1;
1764 		offset = MT_EE_CHIP_ID;
1765 		break;
1766 	default:
1767 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1768 		offset = MT_EE_NIC_CONF_0;
1769 		break;
1770 	}
1771 
1772 	req_hdr.len = cpu_to_le16(eep_len);
1773 
1774 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1775 	if (!skb)
1776 		return -ENOMEM;
1777 
1778 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1779 	skb_put_data(skb, eep + offset, eep_len);
1780 
1781 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1782 				     MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
1783 }
1784 
1785 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1786 		       const struct ieee80211_tx_queue_params *params)
1787 {
1788 #define WMM_AIFS_SET	BIT(0)
1789 #define WMM_CW_MIN_SET	BIT(1)
1790 #define WMM_CW_MAX_SET	BIT(2)
1791 #define WMM_TXOP_SET	BIT(3)
1792 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1793 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1794 	struct req_data {
1795 		u8 number;
1796 		u8 rsv[3];
1797 		u8 queue;
1798 		u8 valid;
1799 		u8 aifs;
1800 		u8 cw_min;
1801 		__le16 cw_max;
1802 		__le16 txop;
1803 	} __packed req = {
1804 		.number = 1,
1805 		.queue = queue,
1806 		.valid = WMM_PARAM_SET,
1807 		.aifs = params->aifs,
1808 		.cw_min = 5,
1809 		.cw_max = cpu_to_le16(10),
1810 		.txop = cpu_to_le16(params->txop),
1811 	};
1812 
1813 	if (params->cw_min)
1814 		req.cw_min = fls(params->cw_min);
1815 	if (params->cw_max)
1816 		req.cw_max = cpu_to_le16(fls(params->cw_max));
1817 
1818 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
1819 				 &req, sizeof(req), true);
1820 }
1821 
1822 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1823 {
1824 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1825 	struct dbdc_entry {
1826 		u8 type;
1827 		u8 index;
1828 		u8 band;
1829 		u8 _rsv;
1830 	};
1831 	struct {
1832 		u8 enable;
1833 		u8 num;
1834 		u8 _rsv[2];
1835 		struct dbdc_entry entry[64];
1836 	} req = {
1837 		.enable = !!ext_phy,
1838 	};
1839 	int i;
1840 
1841 	if (!ext_phy)
1842 		goto out;
1843 
1844 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
1845 	do { \
1846 		req.entry[req.num].type = _type;		\
1847 		req.entry[req.num].index = _idx;		\
1848 		req.entry[req.num++].band = _band;		\
1849 	} while (0)
1850 
1851 	for (i = 0; i < 4; i++) {
1852 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1853 
1854 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1855 	}
1856 
1857 	for (i = 0; i < 14; i++) {
1858 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1859 
1860 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1861 	}
1862 
1863 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1864 
1865 	for (i = 0; i < 3; i++)
1866 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
1867 
1868 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
1869 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
1870 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
1871 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
1872 
1873 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
1874 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
1875 
1876 out:
1877 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DBDC_CTRL), &req,
1878 				 sizeof(req), true);
1879 }
1880 
1881 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1882 {
1883 	struct wtbl_req_hdr req = {
1884 		.operation = WTBL_RESET_ALL,
1885 	};
1886 
1887 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(WTBL_UPDATE),
1888 				 &req, sizeof(req), true);
1889 }
1890 
1891 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
1892 {
1893 	struct {
1894 		__le16 tag;
1895 		__le16 min_lpn;
1896 	} req = {
1897 		.tag = cpu_to_le16(0x1),
1898 		.min_lpn = cpu_to_le16(val),
1899 	};
1900 
1901 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1902 				 &req, sizeof(req), true);
1903 }
1904 
1905 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
1906 			    const struct mt7615_dfs_pulse *pulse)
1907 {
1908 	struct {
1909 		__le16 tag;
1910 		__le32 max_width;	/* us */
1911 		__le32 max_pwr;		/* dbm */
1912 		__le32 min_pwr;		/* dbm */
1913 		__le32 min_stgr_pri;	/* us */
1914 		__le32 max_stgr_pri;	/* us */
1915 		__le32 min_cr_pri;	/* us */
1916 		__le32 max_cr_pri;	/* us */
1917 	} req = {
1918 		.tag = cpu_to_le16(0x3),
1919 #define __req_field(field) .field = cpu_to_le32(pulse->field)
1920 		__req_field(max_width),
1921 		__req_field(max_pwr),
1922 		__req_field(min_pwr),
1923 		__req_field(min_stgr_pri),
1924 		__req_field(max_stgr_pri),
1925 		__req_field(min_cr_pri),
1926 		__req_field(max_cr_pri),
1927 #undef  __req_field
1928 	};
1929 
1930 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1931 				 &req, sizeof(req), true);
1932 }
1933 
1934 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
1935 			    const struct mt7615_dfs_pattern *pattern)
1936 {
1937 	struct {
1938 		__le16 tag;
1939 		__le16 radar_type;
1940 		u8 enb;
1941 		u8 stgr;
1942 		u8 min_crpn;
1943 		u8 max_crpn;
1944 		u8 min_crpr;
1945 		u8 min_pw;
1946 		u8 max_pw;
1947 		__le32 min_pri;
1948 		__le32 max_pri;
1949 		u8 min_crbn;
1950 		u8 max_crbn;
1951 		u8 min_stgpn;
1952 		u8 max_stgpn;
1953 		u8 min_stgpr;
1954 	} req = {
1955 		.tag = cpu_to_le16(0x2),
1956 		.radar_type = cpu_to_le16(index),
1957 #define __req_field_u8(field) .field = pattern->field
1958 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
1959 		__req_field_u8(enb),
1960 		__req_field_u8(stgr),
1961 		__req_field_u8(min_crpn),
1962 		__req_field_u8(max_crpn),
1963 		__req_field_u8(min_crpr),
1964 		__req_field_u8(min_pw),
1965 		__req_field_u8(max_pw),
1966 		__req_field_u32(min_pri),
1967 		__req_field_u32(max_pri),
1968 		__req_field_u8(min_crbn),
1969 		__req_field_u8(max_crbn),
1970 		__req_field_u8(min_stgpn),
1971 		__req_field_u8(max_stgpn),
1972 		__req_field_u8(min_stgpr),
1973 #undef __req_field_u8
1974 #undef __req_field_u32
1975 	};
1976 
1977 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1978 				 &req, sizeof(req), true);
1979 }
1980 
1981 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
1982 {
1983 	struct {
1984 		u8 pulse_num;
1985 		u8 rsv[3];
1986 		struct {
1987 			__le32 start_time;
1988 			__le16 width;
1989 			__le16 power;
1990 		} pattern[32];
1991 	} req = {
1992 		.pulse_num = dev->radar_pattern.n_pulses,
1993 	};
1994 	u32 start_time = ktime_to_ms(ktime_get_boottime());
1995 	int i;
1996 
1997 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
1998 		return -EINVAL;
1999 
2000 	/* TODO: add some noise here */
2001 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2002 		u32 ts = start_time + i * dev->radar_pattern.period;
2003 
2004 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2005 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2006 		req.pattern[i].start_time = cpu_to_le32(ts);
2007 	}
2008 
2009 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_PATTERN),
2010 				 &req, sizeof(req), false);
2011 }
2012 
2013 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2014 {
2015 	struct mt76_phy *mphy = phy->mt76;
2016 	struct ieee80211_hw *hw = mphy->hw;
2017 	struct mt76_power_limits limits;
2018 	s8 *limits_array = (s8 *)&limits;
2019 	int n_chains = hweight8(mphy->antenna_mask);
2020 	int tx_power = hw->conf.power_level * 2;
2021 	int i;
2022 	static const u8 sku_mapping[] = {
2023 #define SKU_FIELD(_type, _field) \
2024 		[MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2025 		SKU_FIELD(CCK_1_2, cck[0]),
2026 		SKU_FIELD(CCK_55_11, cck[2]),
2027 		SKU_FIELD(OFDM_6_9, ofdm[0]),
2028 		SKU_FIELD(OFDM_12_18, ofdm[2]),
2029 		SKU_FIELD(OFDM_24_36, ofdm[4]),
2030 		SKU_FIELD(OFDM_48, ofdm[6]),
2031 		SKU_FIELD(OFDM_54, ofdm[7]),
2032 		SKU_FIELD(HT20_0_8, mcs[0][0]),
2033 		SKU_FIELD(HT20_32, ofdm[0]),
2034 		SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2035 		SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2036 		SKU_FIELD(HT20_5_13, mcs[0][5]),
2037 		SKU_FIELD(HT20_6_14, mcs[0][6]),
2038 		SKU_FIELD(HT20_7_15, mcs[0][7]),
2039 		SKU_FIELD(HT40_0_8, mcs[1][0]),
2040 		SKU_FIELD(HT40_32, ofdm[0]),
2041 		SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2042 		SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2043 		SKU_FIELD(HT40_5_13, mcs[1][5]),
2044 		SKU_FIELD(HT40_6_14, mcs[1][6]),
2045 		SKU_FIELD(HT40_7_15, mcs[1][7]),
2046 		SKU_FIELD(VHT20_0, mcs[0][0]),
2047 		SKU_FIELD(VHT20_1_2, mcs[0][1]),
2048 		SKU_FIELD(VHT20_3_4, mcs[0][3]),
2049 		SKU_FIELD(VHT20_5_6, mcs[0][5]),
2050 		SKU_FIELD(VHT20_7, mcs[0][7]),
2051 		SKU_FIELD(VHT20_8, mcs[0][8]),
2052 		SKU_FIELD(VHT20_9, mcs[0][9]),
2053 		SKU_FIELD(VHT40_0, mcs[1][0]),
2054 		SKU_FIELD(VHT40_1_2, mcs[1][1]),
2055 		SKU_FIELD(VHT40_3_4, mcs[1][3]),
2056 		SKU_FIELD(VHT40_5_6, mcs[1][5]),
2057 		SKU_FIELD(VHT40_7, mcs[1][7]),
2058 		SKU_FIELD(VHT40_8, mcs[1][8]),
2059 		SKU_FIELD(VHT40_9, mcs[1][9]),
2060 		SKU_FIELD(VHT80_0, mcs[2][0]),
2061 		SKU_FIELD(VHT80_1_2, mcs[2][1]),
2062 		SKU_FIELD(VHT80_3_4, mcs[2][3]),
2063 		SKU_FIELD(VHT80_5_6, mcs[2][5]),
2064 		SKU_FIELD(VHT80_7, mcs[2][7]),
2065 		SKU_FIELD(VHT80_8, mcs[2][8]),
2066 		SKU_FIELD(VHT80_9, mcs[2][9]),
2067 		SKU_FIELD(VHT160_0, mcs[3][0]),
2068 		SKU_FIELD(VHT160_1_2, mcs[3][1]),
2069 		SKU_FIELD(VHT160_3_4, mcs[3][3]),
2070 		SKU_FIELD(VHT160_5_6, mcs[3][5]),
2071 		SKU_FIELD(VHT160_7, mcs[3][7]),
2072 		SKU_FIELD(VHT160_8, mcs[3][8]),
2073 		SKU_FIELD(VHT160_9, mcs[3][9]),
2074 #undef SKU_FIELD
2075 	};
2076 
2077 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan, tx_power);
2078 	tx_power -= mt76_tx_power_nss_delta(n_chains);
2079 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2080 					      &limits, tx_power);
2081 	mphy->txpower_cur = tx_power;
2082 
2083 	if (is_mt7663(mphy->dev)) {
2084 		memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2085 		return;
2086 	}
2087 
2088 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2089 		sku[i] = limits_array[sku_mapping[i]];
2090 
2091 	for (i = 0; i < 4; i++) {
2092 		int delta = 0;
2093 
2094 		if (i < n_chains - 1)
2095 			delta = mt76_tx_power_nss_delta(n_chains) -
2096 				mt76_tx_power_nss_delta(i + 1);
2097 		sku[MT_SKU_1SS_DELTA + i] = delta;
2098 	}
2099 }
2100 
2101 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2102 {
2103 	static const u8 width_to_bw[] = {
2104 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2105 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2106 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2107 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2108 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2109 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2110 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2111 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2112 	};
2113 
2114 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2115 		return 0;
2116 
2117 	return width_to_bw[chandef->width];
2118 }
2119 
2120 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2121 {
2122 	struct mt7615_dev *dev = phy->dev;
2123 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2124 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2125 	struct {
2126 		u8 control_chan;
2127 		u8 center_chan;
2128 		u8 bw;
2129 		u8 tx_streams;
2130 		u8 rx_streams_mask;
2131 		u8 switch_reason;
2132 		u8 band_idx;
2133 		/* for 80+80 only */
2134 		u8 center_chan2;
2135 		__le16 cac_case;
2136 		u8 channel_band;
2137 		u8 rsv0;
2138 		__le32 outband_freq;
2139 		u8 txpower_drop;
2140 		u8 rsv1[3];
2141 		u8 txpower_sku[53];
2142 		u8 rsv2[3];
2143 	} req = {
2144 		.control_chan = chandef->chan->hw_value,
2145 		.center_chan = ieee80211_frequency_to_channel(freq1),
2146 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2147 		.rx_streams_mask = phy->mt76->chainmask,
2148 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2149 	};
2150 
2151 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2152 	    phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
2153 		req.switch_reason = CH_SWITCH_NORMAL;
2154 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2155 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2156 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2157 					  NL80211_IFTYPE_AP))
2158 		req.switch_reason = CH_SWITCH_DFS;
2159 	else
2160 		req.switch_reason = CH_SWITCH_NORMAL;
2161 
2162 	req.band_idx = phy != &dev->phy;
2163 	req.bw = mt7615_mcu_chan_bw(chandef);
2164 
2165 	if (mt76_testmode_enabled(phy->mt76))
2166 		memset(req.txpower_sku, 0x3f, 49);
2167 	else
2168 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2169 
2170 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2171 }
2172 
2173 int mt7615_mcu_get_temperature(struct mt7615_dev *dev)
2174 {
2175 	struct {
2176 		u8 action;
2177 		u8 rsv[3];
2178 	} req = {};
2179 
2180 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL),
2181 				 &req, sizeof(req), true);
2182 }
2183 
2184 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2185 			      u32 val)
2186 {
2187 	struct {
2188 		u8 test_mode_en;
2189 		u8 param_idx;
2190 		u8 _rsv[2];
2191 
2192 		__le32 value;
2193 
2194 		u8 pad[8];
2195 	} req = {
2196 		.test_mode_en = test_mode,
2197 		.param_idx = param,
2198 		.value = cpu_to_le32(val),
2199 	};
2200 
2201 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
2202 				 &req, sizeof(req), false);
2203 }
2204 
2205 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2206 {
2207 	struct mt7615_dev *dev = phy->dev;
2208 	struct {
2209 		u8 format_id;
2210 		u8 sku_enable;
2211 		u8 band_idx;
2212 		u8 rsv;
2213 	} req = {
2214 		.format_id = 0,
2215 		.band_idx = phy != &dev->phy,
2216 		.sku_enable = enable,
2217 	};
2218 
2219 	return mt76_mcu_send_msg(&dev->mt76,
2220 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
2221 				 &req, sizeof(req), true);
2222 }
2223 
2224 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2225 {
2226 	int i;
2227 
2228 	for (i = 0; i < n_freqs; i++)
2229 		if (cur == freqs[i])
2230 			return i;
2231 
2232 	return -1;
2233 }
2234 
2235 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2236 {
2237 	static const u16 freq_list[] = {
2238 		4980, 5805, 5905, 5190,
2239 		5230, 5270, 5310, 5350,
2240 		5390, 5430, 5470, 5510,
2241 		5550, 5590, 5630, 5670,
2242 		5710, 5755, 5795, 5835,
2243 		5875, 5210, 5290, 5370,
2244 		5450, 5530, 5610, 5690,
2245 		5775, 5855
2246 	};
2247 	static const u16 freq_bw40[] = {
2248 		5190, 5230, 5270, 5310,
2249 		5350, 5390, 5430, 5470,
2250 		5510, 5550, 5590, 5630,
2251 		5670, 5710, 5755, 5795,
2252 		5835, 5875
2253 	};
2254 	int offset_2g = ARRAY_SIZE(freq_list);
2255 	int idx;
2256 
2257 	if (freq < 4000) {
2258 		if (freq < 2427)
2259 			return offset_2g;
2260 		if (freq < 2442)
2261 			return offset_2g + 1;
2262 		if (freq < 2457)
2263 			return offset_2g + 2;
2264 
2265 		return offset_2g + 3;
2266 	}
2267 
2268 	switch (bw) {
2269 	case NL80211_CHAN_WIDTH_80:
2270 	case NL80211_CHAN_WIDTH_80P80:
2271 	case NL80211_CHAN_WIDTH_160:
2272 		break;
2273 	default:
2274 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2275 					   freq + 10);
2276 		if (idx >= 0) {
2277 			freq = freq_bw40[idx];
2278 			break;
2279 		}
2280 
2281 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2282 					   freq - 10);
2283 		if (idx >= 0) {
2284 			freq = freq_bw40[idx];
2285 			break;
2286 		}
2287 		fallthrough;
2288 	case NL80211_CHAN_WIDTH_40:
2289 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2290 					   freq);
2291 		if (idx >= 0)
2292 			break;
2293 
2294 		return -1;
2295 
2296 	}
2297 
2298 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2299 }
2300 
2301 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2302 {
2303 	struct mt7615_dev *dev = phy->dev;
2304 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2305 	int freq2 = chandef->center_freq2;
2306 	int ret;
2307 	struct {
2308 		u8 direction;
2309 		u8 runtime_calibration;
2310 		u8 _rsv[2];
2311 
2312 		__le16 center_freq;
2313 		u8 bw;
2314 		u8 band;
2315 		u8 is_freq2;
2316 		u8 success;
2317 		u8 dbdc_en;
2318 
2319 		u8 _rsv2;
2320 
2321 		struct {
2322 			__le32 sx0_i_lna[4];
2323 			__le32 sx0_q_lna[4];
2324 
2325 			__le32 sx2_i_lna[4];
2326 			__le32 sx2_q_lna[4];
2327 		} dcoc_data[4];
2328 	} req = {
2329 		.direction = 1,
2330 
2331 		.bw = mt7615_mcu_chan_bw(chandef),
2332 		.band = chandef->center_freq1 > 4000,
2333 		.dbdc_en = !!dev->mt76.phys[MT_BAND1],
2334 	};
2335 	u16 center_freq = chandef->center_freq1;
2336 	int freq_idx;
2337 	u8 *eep = dev->mt76.eeprom.data;
2338 
2339 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2340 		return 0;
2341 
2342 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2343 		freq2 = center_freq + 40;
2344 		center_freq -= 40;
2345 	}
2346 
2347 again:
2348 	req.runtime_calibration = 1;
2349 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2350 	if (freq_idx < 0)
2351 		goto out;
2352 
2353 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2354 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2355 	       sizeof(req.dcoc_data));
2356 	req.runtime_calibration = 0;
2357 
2358 out:
2359 	req.center_freq = cpu_to_le16(center_freq);
2360 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RXDCOC_CAL), &req,
2361 				sizeof(req), true);
2362 
2363 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2364 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2365 		req.is_freq2 = true;
2366 		center_freq = freq2;
2367 		goto again;
2368 	}
2369 
2370 	return ret;
2371 }
2372 
2373 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2374 {
2375 	static const u16 freq_list[] = {
2376 		4920, 4940, 4960, 4980,
2377 		5040, 5060, 5080, 5180,
2378 		5200, 5220, 5240, 5260,
2379 		5280, 5300, 5320, 5340,
2380 		5360, 5380, 5400, 5420,
2381 		5440, 5460, 5480, 5500,
2382 		5520, 5540, 5560, 5580,
2383 		5600, 5620, 5640, 5660,
2384 		5680, 5700, 5720, 5745,
2385 		5765, 5785, 5805, 5825,
2386 		5845, 5865, 5885, 5905
2387 	};
2388 	int offset_2g = ARRAY_SIZE(freq_list);
2389 	int idx;
2390 
2391 	if (freq < 4000) {
2392 		if (freq < 2432)
2393 			return offset_2g;
2394 		if (freq < 2457)
2395 			return offset_2g + 1;
2396 
2397 		return offset_2g + 2;
2398 	}
2399 
2400 	if (bw != NL80211_CHAN_WIDTH_20) {
2401 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2402 					   freq + 10);
2403 		if (idx >= 0)
2404 			return idx;
2405 
2406 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2407 					   freq - 10);
2408 		if (idx >= 0)
2409 			return idx;
2410 	}
2411 
2412 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2413 }
2414 
2415 
2416 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2417 {
2418 	struct mt7615_dev *dev = phy->dev;
2419 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2420 	int freq2 = chandef->center_freq2;
2421 	int ret;
2422 	struct {
2423 		u8 direction;
2424 		u8 runtime_calibration;
2425 		u8 _rsv[2];
2426 
2427 		__le16 center_freq;
2428 		u8 bw;
2429 		u8 band;
2430 		u8 is_freq2;
2431 		u8 success;
2432 		u8 dbdc_en;
2433 
2434 		u8 _rsv2;
2435 
2436 		struct {
2437 			struct {
2438 				u32 dpd_g0;
2439 				u8 data[32];
2440 			} wf0, wf1;
2441 
2442 			struct {
2443 				u32 dpd_g0_prim;
2444 				u32 dpd_g0_sec;
2445 				u8 data_prim[32];
2446 				u8 data_sec[32];
2447 			} wf2, wf3;
2448 		} dpd_data;
2449 	} req = {
2450 		.direction = 1,
2451 
2452 		.bw = mt7615_mcu_chan_bw(chandef),
2453 		.band = chandef->center_freq1 > 4000,
2454 		.dbdc_en = !!dev->mt76.phys[MT_BAND1],
2455 	};
2456 	u16 center_freq = chandef->center_freq1;
2457 	int freq_idx;
2458 	u8 *eep = dev->mt76.eeprom.data;
2459 
2460 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2461 		return 0;
2462 
2463 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2464 		freq2 = center_freq + 40;
2465 		center_freq -= 40;
2466 	}
2467 
2468 again:
2469 	req.runtime_calibration = 1;
2470 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2471 	if (freq_idx < 0)
2472 		goto out;
2473 
2474 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2475 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2476 	       sizeof(req.dpd_data));
2477 	req.runtime_calibration = 0;
2478 
2479 out:
2480 	req.center_freq = cpu_to_le16(center_freq);
2481 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXDPD_CAL),
2482 				&req, sizeof(req), true);
2483 
2484 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2485 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2486 		req.is_freq2 = true;
2487 		center_freq = freq2;
2488 		goto again;
2489 	}
2490 
2491 	return ret;
2492 }
2493 
2494 int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2495 {
2496 	struct {
2497 		u8 operation;
2498 		u8 count;
2499 		u8 _rsv[2];
2500 		u8 index;
2501 		u8 enable;
2502 		__le16 etype;
2503 	} req = {
2504 		.operation = 1,
2505 		.count = 1,
2506 		.enable = 1,
2507 		.etype = cpu_to_le16(ETH_P_PAE),
2508 	};
2509 
2510 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2511 				 &req, sizeof(req), false);
2512 }
2513 
2514 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2515 			  bool enable)
2516 {
2517 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2518 	struct {
2519 		u8 bss_idx;
2520 		u8 dtim_period;
2521 		__le16 aid;
2522 		__le16 bcn_interval;
2523 		__le16 atim_window;
2524 		u8 uapsd;
2525 		u8 bmc_delivered_ac;
2526 		u8 bmc_triggered_ac;
2527 		u8 pad;
2528 	} req = {
2529 		.bss_idx = mvif->mt76.idx,
2530 		.aid = cpu_to_le16(vif->cfg.aid),
2531 		.dtim_period = vif->bss_conf.dtim_period,
2532 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2533 	};
2534 	struct {
2535 		u8 bss_idx;
2536 		u8 pad[3];
2537 	} req_hdr = {
2538 		.bss_idx = mvif->mt76.idx,
2539 	};
2540 	int err;
2541 
2542 	if (vif->type != NL80211_IFTYPE_STATION)
2543 		return 0;
2544 
2545 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
2546 				&req_hdr, sizeof(req_hdr), false);
2547 	if (err < 0 || !enable)
2548 		return err;
2549 
2550 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
2551 				 &req, sizeof(req), false);
2552 }
2553 
2554 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2555 		       struct ieee80211_channel *chan, int duration)
2556 {
2557 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2558 	struct mt7615_dev *dev = phy->dev;
2559 	struct mt7615_roc_tlv req = {
2560 		.bss_idx = mvif->mt76.idx,
2561 		.active = !chan,
2562 		.max_interval = cpu_to_le32(duration),
2563 		.primary_chan = chan ? chan->hw_value : 0,
2564 		.band = chan ? chan->band : 0,
2565 		.req_type = 2,
2566 	};
2567 
2568 	phy->roc_grant = false;
2569 
2570 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC),
2571 				 &req, sizeof(req), false);
2572 }
2573