xref: /linux/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c (revision a1c3be890440a1769ed6f822376a3e3ab0d42994)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
75 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
76 
77 #define DL_MODE_ENCRYPT			BIT(0)
78 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
79 #define DL_MODE_RESET_SEC_IV		BIT(3)
80 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
82 #define DL_MODE_NEED_RSP		BIT(31)
83 
84 #define FW_START_OVERRIDE		BIT(0)
85 #define FW_START_WORKING_PDA_CR4	BIT(2)
86 
87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
88 			 int cmd, int *wait_seq)
89 {
90 	int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
91 	struct mt7615_uni_txd *uni_txd;
92 	struct mt7615_mcu_txd *mcu_txd;
93 	u8 seq, q_idx, pkt_fmt;
94 	__le32 *txd;
95 	u32 val;
96 
97 	/* TODO: make dynamic based on msg type */
98 	dev->mt76.mcu.timeout = 20 * HZ;
99 
100 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
101 	if (!seq)
102 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
103 	if (wait_seq)
104 		*wait_seq = seq;
105 
106 	txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
107 	txd = (__le32 *)skb_push(skb, txd_len);
108 
109 	if (cmd != MCU_CMD_FW_SCATTER) {
110 		q_idx = MT_TX_MCU_PORT_RX_Q0;
111 		pkt_fmt = MT_TX_TYPE_CMD;
112 	} else {
113 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
114 		pkt_fmt = MT_TX_TYPE_FW;
115 	}
116 
117 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
118 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
119 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
120 	txd[0] = cpu_to_le32(val);
121 
122 	val = MT_TXD1_LONG_FORMAT |
123 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
124 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
125 	txd[1] = cpu_to_le32(val);
126 
127 	if (cmd & MCU_UNI_PREFIX) {
128 		uni_txd = (struct mt7615_uni_txd *)txd;
129 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
130 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
131 		uni_txd->cid = cpu_to_le16(mcu_cmd);
132 		uni_txd->s2d_index = MCU_S2D_H2N;
133 		uni_txd->pkt_type = MCU_PKT_ID;
134 		uni_txd->seq = seq;
135 
136 		return;
137 	}
138 
139 	mcu_txd = (struct mt7615_mcu_txd *)txd;
140 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
141 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
142 	mcu_txd->s2d_index = MCU_S2D_H2N;
143 	mcu_txd->pkt_type = MCU_PKT_ID;
144 	mcu_txd->seq = seq;
145 
146 	switch (cmd & ~MCU_CMD_MASK) {
147 	case MCU_FW_PREFIX:
148 		mcu_txd->set_query = MCU_Q_NA;
149 		mcu_txd->cid = mcu_cmd;
150 		break;
151 	case MCU_CE_PREFIX:
152 		if (cmd & MCU_QUERY_MASK)
153 			mcu_txd->set_query = MCU_Q_QUERY;
154 		else
155 			mcu_txd->set_query = MCU_Q_SET;
156 		mcu_txd->cid = mcu_cmd;
157 		break;
158 	default:
159 		mcu_txd->cid = MCU_CMD_EXT_CID;
160 		if (cmd & MCU_QUERY_PREFIX)
161 			mcu_txd->set_query = MCU_Q_QUERY;
162 		else
163 			mcu_txd->set_query = MCU_Q_SET;
164 		mcu_txd->ext_cid = mcu_cmd;
165 		mcu_txd->ext_cid_ack = 1;
166 		break;
167 	}
168 }
169 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
170 
171 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
172 			      struct sk_buff *skb, int seq)
173 {
174 	struct mt7615_mcu_rxd *rxd;
175 	int ret = 0;
176 
177 	if (!skb) {
178 		dev_err(mdev->dev, "Message %ld (seq %d) timeout\n",
179 			cmd & MCU_CMD_MASK, seq);
180 		return -ETIMEDOUT;
181 	}
182 
183 	rxd = (struct mt7615_mcu_rxd *)skb->data;
184 	if (seq != rxd->seq)
185 		return -EAGAIN;
186 
187 	switch (cmd) {
188 	case MCU_CMD_PATCH_SEM_CONTROL:
189 		skb_pull(skb, sizeof(*rxd) - 4);
190 		ret = *skb->data;
191 		break;
192 	case MCU_EXT_CMD_GET_TEMP:
193 		skb_pull(skb, sizeof(*rxd));
194 		ret = le32_to_cpu(*(__le32 *)skb->data);
195 		break;
196 	case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
197 		skb_pull(skb, sizeof(*rxd));
198 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
199 		break;
200 	case MCU_UNI_CMD_DEV_INFO_UPDATE:
201 	case MCU_UNI_CMD_BSS_INFO_UPDATE:
202 	case MCU_UNI_CMD_STA_REC_UPDATE:
203 	case MCU_UNI_CMD_HIF_CTRL:
204 	case MCU_UNI_CMD_OFFLOAD:
205 	case MCU_UNI_CMD_SUSPEND: {
206 		struct mt7615_mcu_uni_event *event;
207 
208 		skb_pull(skb, sizeof(*rxd));
209 		event = (struct mt7615_mcu_uni_event *)skb->data;
210 		ret = le32_to_cpu(event->status);
211 		break;
212 	}
213 	case MCU_CMD_REG_READ: {
214 		struct mt7615_mcu_reg_event *event;
215 
216 		skb_pull(skb, sizeof(*rxd));
217 		event = (struct mt7615_mcu_reg_event *)skb->data;
218 		ret = (int)le32_to_cpu(event->val);
219 		break;
220 	}
221 	default:
222 		break;
223 	}
224 
225 	return ret;
226 }
227 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
228 
229 static int
230 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
231 			int cmd, int *seq)
232 {
233 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
234 	enum mt76_mcuq_id qid;
235 
236 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
237 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
238 		qid = MT_MCUQ_WM;
239 	else
240 		qid = MT_MCUQ_FWDL;
241 
242 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
243 }
244 
245 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
246 {
247 	struct {
248 		__le32 wifi_stream;
249 		__le32 address;
250 		__le32 data;
251 	} req = {
252 		.wifi_stream = cpu_to_le32(wf),
253 		.address = cpu_to_le32(reg),
254 	};
255 
256 	return mt76_mcu_send_msg(&dev->mt76,
257 				 MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
258 				 &req, sizeof(req), true);
259 }
260 
261 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
262 {
263 	struct {
264 		__le32 wifi_stream;
265 		__le32 address;
266 		__le32 data;
267 	} req = {
268 		.wifi_stream = cpu_to_le32(wf),
269 		.address = cpu_to_le32(reg),
270 		.data = cpu_to_le32(val),
271 	};
272 
273 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
274 				 sizeof(req), false);
275 }
276 
277 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
278 {
279 	if (!is_mt7622(&dev->mt76))
280 		return;
281 
282 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
283 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
284 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
285 }
286 
287 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
288 {
289 	struct mt76_phy *mphy = &dev->mt76.phy;
290 	struct mt76_dev *mdev = &dev->mt76;
291 	u32 addr;
292 	int err;
293 
294 	addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
295 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
296 
297 	mt7622_trigger_hif_int(dev, true);
298 
299 	addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
300 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
301 
302 	mt7622_trigger_hif_int(dev, false);
303 
304 	if (err) {
305 		dev_err(mdev->dev, "driver own failed\n");
306 		return -ETIMEDOUT;
307 	}
308 
309 	clear_bit(MT76_STATE_PM, &mphy->state);
310 
311 	return 0;
312 }
313 
314 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
315 {
316 	struct mt76_phy *mphy = &dev->mt76.phy;
317 	int i;
318 
319 	if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
320 		goto out;
321 
322 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
323 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
324 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
325 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
326 			break;
327 	}
328 
329 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
330 		dev_err(dev->mt76.dev, "driver own failed\n");
331 		set_bit(MT76_STATE_PM, &mphy->state);
332 		return -EIO;
333 	}
334 
335 out:
336 	dev->pm.last_activity = jiffies;
337 
338 	return 0;
339 }
340 
341 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
342 {
343 	struct mt76_phy *mphy = &dev->mt76.phy;
344 	int err = 0;
345 	u32 addr;
346 
347 	if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
348 		return 0;
349 
350 	mt7622_trigger_hif_int(dev, true);
351 
352 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
353 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
354 
355 	if (is_mt7622(&dev->mt76) &&
356 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
357 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
358 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
359 		clear_bit(MT76_STATE_PM, &mphy->state);
360 		err = -EIO;
361 	}
362 
363 	mt7622_trigger_hif_int(dev, false);
364 
365 	return err;
366 }
367 
368 static void
369 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
370 {
371 	if (vif->csa_active)
372 		ieee80211_csa_finish(vif);
373 }
374 
375 static void
376 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
377 {
378 	struct mt76_phy *mphy = &dev->mt76.phy;
379 	struct mt7615_mcu_rdd_report *r;
380 
381 	r = (struct mt7615_mcu_rdd_report *)skb->data;
382 
383 	if (r->idx && dev->mt76.phy2)
384 		mphy = dev->mt76.phy2;
385 
386 	ieee80211_radar_detected(mphy->hw);
387 	dev->hw_pattern++;
388 }
389 
390 static void
391 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
392 {
393 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
394 	const char *data = (char *)&rxd[1];
395 	const char *type;
396 
397 	switch (rxd->s2d_index) {
398 	case 0:
399 		type = "N9";
400 		break;
401 	case 2:
402 		type = "CR4";
403 		break;
404 	default:
405 		type = "unknown";
406 		break;
407 	}
408 
409 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
410 }
411 
412 static void
413 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
416 
417 	switch (rxd->ext_eid) {
418 	case MCU_EXT_EVENT_RDD_REPORT:
419 		mt7615_mcu_rx_radar_detected(dev, skb);
420 		break;
421 	case MCU_EXT_EVENT_CSA_NOTIFY:
422 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
423 				IEEE80211_IFACE_ITER_RESUME_ALL,
424 				mt7615_mcu_csa_finish, dev);
425 		break;
426 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
427 		mt7615_mcu_rx_log_message(dev, skb);
428 		break;
429 	default:
430 		break;
431 	}
432 }
433 
434 static void
435 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
436 {
437 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
438 	struct mt7615_phy *phy;
439 	struct mt76_phy *mphy;
440 
441 	if (*seq_num & BIT(7) && dev->mt76.phy2)
442 		mphy = dev->mt76.phy2;
443 	else
444 		mphy = &dev->mt76.phy;
445 
446 	phy = (struct mt7615_phy *)mphy->priv;
447 
448 	spin_lock_bh(&dev->mt76.lock);
449 	__skb_queue_tail(&phy->scan_event_list, skb);
450 	spin_unlock_bh(&dev->mt76.lock);
451 
452 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
453 				     MT7615_HW_SCAN_TIMEOUT);
454 }
455 
456 static void
457 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
458 {
459 	struct mt7615_roc_tlv *event;
460 	struct mt7615_phy *phy;
461 	struct mt76_phy *mphy;
462 	int duration;
463 
464 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
465 	event = (struct mt7615_roc_tlv *)skb->data;
466 
467 	if (event->dbdc_band && dev->mt76.phy2)
468 		mphy = dev->mt76.phy2;
469 	else
470 		mphy = &dev->mt76.phy;
471 
472 	ieee80211_ready_on_channel(mphy->hw);
473 
474 	phy = (struct mt7615_phy *)mphy->priv;
475 	phy->roc_grant = true;
476 	wake_up(&phy->roc_wait);
477 
478 	duration = le32_to_cpu(event->max_interval);
479 	mod_timer(&phy->roc_timer,
480 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
481 }
482 
483 static void
484 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
485 {
486 	struct mt76_connac_beacon_loss_event *event;
487 	struct mt76_phy *mphy;
488 	u8 band_idx = 0; /* DBDC support */
489 
490 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
491 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
492 	if (band_idx && dev->mt76.phy2)
493 		mphy = dev->mt76.phy2;
494 	else
495 		mphy = &dev->mt76.phy;
496 
497 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
498 					IEEE80211_IFACE_ITER_RESUME_ALL,
499 					mt76_connac_mcu_beacon_loss_iter,
500 					event);
501 }
502 
503 static void
504 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
505 {
506 	struct mt76_connac_mcu_bss_event *event;
507 	struct mt76_phy *mphy;
508 	u8 band_idx = 0; /* DBDC support */
509 
510 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
511 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
512 
513 	if (band_idx && dev->mt76.phy2)
514 		mphy = dev->mt76.phy2;
515 	else
516 		mphy = &dev->mt76.phy;
517 
518 	if (event->is_absent)
519 		ieee80211_stop_queues(mphy->hw);
520 	else
521 		ieee80211_wake_queues(mphy->hw);
522 }
523 
524 static void
525 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
526 {
527 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
528 
529 	switch (rxd->eid) {
530 	case MCU_EVENT_EXT:
531 		mt7615_mcu_rx_ext_event(dev, skb);
532 		break;
533 	case MCU_EVENT_BSS_BEACON_LOSS:
534 		mt7615_mcu_beacon_loss_event(dev, skb);
535 		break;
536 	case MCU_EVENT_ROC:
537 		mt7615_mcu_roc_event(dev, skb);
538 		break;
539 	case MCU_EVENT_SCHED_SCAN_DONE:
540 	case MCU_EVENT_SCAN_DONE:
541 		mt7615_mcu_scan_event(dev, skb);
542 		return;
543 	case MCU_EVENT_BSS_ABSENCE:
544 		mt7615_mcu_bss_event(dev, skb);
545 		break;
546 	case MCU_EVENT_COREDUMP:
547 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
548 					       &dev->coredump);
549 		return;
550 	default:
551 		break;
552 	}
553 	dev_kfree_skb(skb);
554 }
555 
556 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
557 {
558 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
559 
560 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
561 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
562 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
563 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
564 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
565 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
566 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
567 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
568 	    rxd->eid == MCU_EVENT_COREDUMP ||
569 	    rxd->eid == MCU_EVENT_ROC ||
570 	    !rxd->seq)
571 		mt7615_mcu_rx_unsolicited_event(dev, skb);
572 	else
573 		mt76_mcu_rx_event(&dev->mt76, skb);
574 }
575 
576 static int
577 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
578 		       bool bssid, bool enable)
579 {
580 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
581 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
582 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
583 	const u8 *addr = vif->addr;
584 	struct {
585 		u8 mode;
586 		u8 force_clear;
587 		u8 clear_bitmap[8];
588 		u8 entry_count;
589 		u8 write;
590 
591 		u8 index;
592 		u8 bssid;
593 		u8 addr[ETH_ALEN];
594 	} __packed req = {
595 		.mode = !!mask || enable,
596 		.entry_count = 1,
597 		.write = 1,
598 
599 		.index = idx * 2 + bssid,
600 	};
601 
602 	if (bssid)
603 		addr = vif->bss_conf.bssid;
604 
605 	if (enable)
606 		ether_addr_copy(req.addr, addr);
607 
608 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
609 				 sizeof(req), true);
610 }
611 
612 static int
613 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
614 		   bool enable)
615 {
616 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
617 	struct mt7615_dev *dev = phy->dev;
618 	struct {
619 		struct req_hdr {
620 			u8 omac_idx;
621 			u8 band_idx;
622 			__le16 tlv_num;
623 			u8 is_tlv_append;
624 			u8 rsv[3];
625 		} __packed hdr;
626 		struct req_tlv {
627 			__le16 tag;
628 			__le16 len;
629 			u8 active;
630 			u8 band_idx;
631 			u8 omac_addr[ETH_ALEN];
632 		} __packed tlv;
633 	} data = {
634 		.hdr = {
635 			.omac_idx = mvif->mt76.omac_idx,
636 			.band_idx = mvif->mt76.band_idx,
637 			.tlv_num = cpu_to_le16(1),
638 			.is_tlv_append = 1,
639 		},
640 		.tlv = {
641 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
642 			.len = cpu_to_le16(sizeof(struct req_tlv)),
643 			.active = enable,
644 			.band_idx = mvif->mt76.band_idx,
645 		},
646 	};
647 
648 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
649 		return mt7615_mcu_muar_config(dev, vif, false, enable);
650 
651 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
652 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
653 				 &data, sizeof(data), true);
654 }
655 
656 static int
657 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
658 			      struct ieee80211_hw *hw,
659 			      struct ieee80211_vif *vif, bool enable)
660 {
661 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
662 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
663 	struct ieee80211_mutable_offsets offs;
664 	struct ieee80211_tx_info *info;
665 	struct req {
666 		u8 omac_idx;
667 		u8 enable;
668 		u8 wlan_idx;
669 		u8 band_idx;
670 		u8 pkt_type;
671 		u8 need_pre_tbtt_int;
672 		__le16 csa_ie_pos;
673 		__le16 pkt_len;
674 		__le16 tim_ie_pos;
675 		u8 pkt[512];
676 		u8 csa_cnt;
677 		/* bss color change */
678 		u8 bcc_cnt;
679 		__le16 bcc_ie_pos;
680 	} __packed req = {
681 		.omac_idx = mvif->mt76.omac_idx,
682 		.enable = enable,
683 		.wlan_idx = wcid->idx,
684 		.band_idx = mvif->mt76.band_idx,
685 	};
686 	struct sk_buff *skb;
687 
688 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
689 	if (!skb)
690 		return -EINVAL;
691 
692 	if (skb->len > 512 - MT_TXD_SIZE) {
693 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
694 		dev_kfree_skb(skb);
695 		return -EINVAL;
696 	}
697 
698 	if (mvif->mt76.band_idx) {
699 		info = IEEE80211_SKB_CB(skb);
700 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
701 	}
702 
703 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
704 			      0, NULL, true);
705 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
706 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
707 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
708 	if (offs.cntdwn_counter_offs[0]) {
709 		u16 csa_offs;
710 
711 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
712 		req.csa_ie_pos = cpu_to_le16(csa_offs);
713 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
714 	}
715 	dev_kfree_skb(skb);
716 
717 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
718 				 sizeof(req), true);
719 }
720 
721 static int
722 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
723 {
724 #define ENTER_PM_STATE	1
725 #define EXIT_PM_STATE	2
726 	struct {
727 		u8 pm_number;
728 		u8 pm_state;
729 		u8 bssid[ETH_ALEN];
730 		u8 dtim_period;
731 		u8 wlan_idx;
732 		__le16 bcn_interval;
733 		__le32 aid;
734 		__le32 rx_filter;
735 		u8 band_idx;
736 		u8 rsv[3];
737 		__le32 feature;
738 		u8 omac_idx;
739 		u8 wmm_idx;
740 		u8 bcn_loss_cnt;
741 		u8 bcn_sp_duration;
742 	} __packed req = {
743 		.pm_number = 5,
744 		.pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
745 		.band_idx = band,
746 	};
747 
748 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
749 				 sizeof(req), true);
750 }
751 
752 static int
753 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
754 			 struct ieee80211_sta *sta, bool enable)
755 {
756 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
757 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
758 	struct bss_info_basic *bss;
759 	u8 wlan_idx = mvif->sta.wcid.idx;
760 	struct tlv *tlv;
761 
762 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
763 
764 	switch (vif->type) {
765 	case NL80211_IFTYPE_MESH_POINT:
766 	case NL80211_IFTYPE_AP:
767 		break;
768 	case NL80211_IFTYPE_STATION:
769 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
770 		if (enable && sta) {
771 			struct mt7615_sta *msta;
772 
773 			msta = (struct mt7615_sta *)sta->drv_priv;
774 			wlan_idx = msta->wcid.idx;
775 		}
776 		break;
777 	case NL80211_IFTYPE_ADHOC:
778 		type = NETWORK_IBSS;
779 		break;
780 	default:
781 		WARN_ON(1);
782 		break;
783 	}
784 
785 	bss = (struct bss_info_basic *)tlv;
786 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
787 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
788 	bss->network_type = cpu_to_le32(type);
789 	bss->dtim_period = vif->bss_conf.dtim_period;
790 	bss->bmc_tx_wlan_idx = wlan_idx;
791 	bss->wmm_idx = mvif->mt76.wmm_idx;
792 	bss->active = enable;
793 
794 	return 0;
795 }
796 
797 static void
798 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
799 {
800 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
801 	u8 omac_idx = mvif->mt76.omac_idx;
802 	struct bss_info_omac *omac;
803 	struct tlv *tlv;
804 	u32 type = 0;
805 
806 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
807 
808 	switch (vif->type) {
809 	case NL80211_IFTYPE_MESH_POINT:
810 	case NL80211_IFTYPE_AP:
811 		if (vif->p2p)
812 			type = CONNECTION_P2P_GO;
813 		else
814 			type = CONNECTION_INFRA_AP;
815 		break;
816 	case NL80211_IFTYPE_STATION:
817 		if (vif->p2p)
818 			type = CONNECTION_P2P_GC;
819 		else
820 			type = CONNECTION_INFRA_STA;
821 		break;
822 	case NL80211_IFTYPE_ADHOC:
823 		type = CONNECTION_IBSS_ADHOC;
824 		break;
825 	default:
826 		WARN_ON(1);
827 		break;
828 	}
829 
830 	omac = (struct bss_info_omac *)tlv;
831 	omac->conn_type = cpu_to_le32(type);
832 	omac->omac_idx = mvif->mt76.omac_idx;
833 	omac->band_idx = mvif->mt76.band_idx;
834 	omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
835 }
836 
837 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
838 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
839 static void
840 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
841 {
842 	struct bss_info_ext_bss *ext;
843 	int ext_bss_idx, tsf_offset;
844 	struct tlv *tlv;
845 
846 	ext_bss_idx = mvif->mt76.omac_idx - EXT_BSSID_START;
847 	if (ext_bss_idx < 0)
848 		return;
849 
850 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
851 
852 	ext = (struct bss_info_ext_bss *)tlv;
853 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
854 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
855 }
856 
857 static int
858 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
859 		   struct ieee80211_sta *sta, bool enable)
860 {
861 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
862 	struct mt7615_dev *dev = phy->dev;
863 	struct sk_buff *skb;
864 
865 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
866 		mt7615_mcu_muar_config(dev, vif, true, enable);
867 
868 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
869 	if (IS_ERR(skb))
870 		return PTR_ERR(skb);
871 
872 	if (enable)
873 		mt7615_mcu_bss_omac_tlv(skb, vif);
874 
875 	mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
876 
877 	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
878 	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
879 		mt7615_mcu_bss_ext_tlv(skb, mvif);
880 
881 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
882 				     MCU_EXT_CMD_BSS_INFO_UPDATE, true);
883 }
884 
885 static int
886 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
887 		      struct ieee80211_ampdu_params *params,
888 		      bool enable)
889 {
890 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
891 	struct mt7615_vif *mvif = msta->vif;
892 	struct wtbl_req_hdr *wtbl_hdr;
893 	struct sk_buff *skb = NULL;
894 	int err;
895 
896 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
897 						  WTBL_SET, NULL, &skb);
898 	if (IS_ERR(wtbl_hdr))
899 		return PTR_ERR(wtbl_hdr);
900 
901 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
902 				    NULL, wtbl_hdr);
903 
904 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
905 				    true);
906 	if (err < 0)
907 		return err;
908 
909 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
910 					    &msta->wcid);
911 	if (IS_ERR(skb))
912 		return PTR_ERR(skb);
913 
914 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
915 
916 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
917 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
918 }
919 
920 static int
921 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
922 		      struct ieee80211_ampdu_params *params,
923 		      bool enable)
924 {
925 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
926 	struct mt7615_vif *mvif = msta->vif;
927 	struct wtbl_req_hdr *wtbl_hdr;
928 	struct sk_buff *skb;
929 	int err;
930 
931 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
932 					    &msta->wcid);
933 	if (IS_ERR(skb))
934 		return PTR_ERR(skb);
935 
936 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
937 
938 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
939 				    MCU_EXT_CMD_STA_REC_UPDATE, true);
940 	if (err < 0 || !enable)
941 		return err;
942 
943 	skb = NULL;
944 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
945 						  WTBL_SET, NULL, &skb);
946 	if (IS_ERR(wtbl_hdr))
947 		return PTR_ERR(wtbl_hdr);
948 
949 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
950 				    NULL, wtbl_hdr);
951 
952 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
953 				     true);
954 }
955 
956 static int
957 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
958 			struct ieee80211_sta *sta, bool enable)
959 {
960 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
961 	struct sk_buff *skb, *sskb, *wskb = NULL;
962 	struct mt7615_dev *dev = phy->dev;
963 	struct wtbl_req_hdr *wtbl_hdr;
964 	struct mt7615_sta *msta;
965 	int cmd, err;
966 
967 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
968 
969 	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
970 					     &msta->wcid);
971 	if (IS_ERR(sskb))
972 		return PTR_ERR(sskb);
973 
974 	mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable);
975 	if (enable && sta)
976 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif);
977 
978 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
979 						  WTBL_RESET_AND_SET, NULL,
980 						  &wskb);
981 	if (IS_ERR(wtbl_hdr))
982 		return PTR_ERR(wtbl_hdr);
983 
984 	if (enable) {
985 		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
986 						 NULL, wtbl_hdr);
987 		if (sta)
988 			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
989 						    NULL, wtbl_hdr);
990 	}
991 
992 	cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
993 	skb = enable ? wskb : sskb;
994 
995 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
996 	if (err < 0) {
997 		skb = enable ? sskb : wskb;
998 		dev_kfree_skb(skb);
999 
1000 		return err;
1001 	}
1002 
1003 	cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1004 	skb = enable ? sskb : wskb;
1005 
1006 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1007 }
1008 
1009 static const struct mt7615_mcu_ops wtbl_update_ops = {
1010 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1011 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1012 	.add_dev_info = mt7615_mcu_add_dev,
1013 	.add_bss_info = mt7615_mcu_add_bss,
1014 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1015 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1016 	.sta_add = mt7615_mcu_wtbl_sta_add,
1017 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1018 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1019 };
1020 
1021 static int
1022 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1023 		  struct ieee80211_ampdu_params *params,
1024 		  bool enable, bool tx)
1025 {
1026 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1027 	struct mt7615_vif *mvif = msta->vif;
1028 	struct wtbl_req_hdr *wtbl_hdr;
1029 	struct tlv *sta_wtbl;
1030 	struct sk_buff *skb;
1031 
1032 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1033 					    &msta->wcid);
1034 	if (IS_ERR(skb))
1035 		return PTR_ERR(skb);
1036 
1037 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1038 
1039 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1040 
1041 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1042 						  WTBL_SET, sta_wtbl, &skb);
1043 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
1044 				    sta_wtbl, wtbl_hdr);
1045 
1046 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1047 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1048 }
1049 
1050 static int
1051 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1052 		     struct ieee80211_ampdu_params *params,
1053 		     bool enable)
1054 {
1055 	return mt7615_mcu_sta_ba(dev, params, enable, true);
1056 }
1057 
1058 static int
1059 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1060 		     struct ieee80211_ampdu_params *params,
1061 		     bool enable)
1062 {
1063 	return mt7615_mcu_sta_ba(dev, params, enable, false);
1064 }
1065 
1066 static int
1067 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
1068 		     struct ieee80211_sta *sta, bool enable, int cmd)
1069 {
1070 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1071 	struct mt76_wcid *wcid;
1072 
1073 	wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
1074 	return mt76_connac_mcu_add_sta_cmd(phy, vif, sta, wcid, enable, cmd);
1075 }
1076 
1077 static int
1078 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1079 		   struct ieee80211_sta *sta, bool enable)
1080 {
1081 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1082 				    MCU_EXT_CMD_STA_REC_UPDATE);
1083 }
1084 
1085 static const struct mt7615_mcu_ops sta_update_ops = {
1086 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1087 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1088 	.add_dev_info = mt7615_mcu_add_dev,
1089 	.add_bss_info = mt7615_mcu_add_bss,
1090 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1091 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1092 	.sta_add = mt7615_mcu_add_sta,
1093 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1094 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1095 };
1096 
1097 static int
1098 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1099 {
1100 	return 0;
1101 }
1102 
1103 static int
1104 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1105 				  struct ieee80211_hw *hw,
1106 				  struct ieee80211_vif *vif,
1107 				  bool enable)
1108 {
1109 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1110 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1111 	struct ieee80211_mutable_offsets offs;
1112 	struct {
1113 		struct req_hdr {
1114 			u8 bss_idx;
1115 			u8 pad[3];
1116 		} __packed hdr;
1117 		struct bcn_content_tlv {
1118 			__le16 tag;
1119 			__le16 len;
1120 			__le16 tim_ie_pos;
1121 			__le16 csa_ie_pos;
1122 			__le16 bcc_ie_pos;
1123 			/* 0: enable beacon offload
1124 			 * 1: disable beacon offload
1125 			 * 2: update probe respond offload
1126 			 */
1127 			u8 enable;
1128 			/* 0: legacy format (TXD + payload)
1129 			 * 1: only cap field IE
1130 			 */
1131 			u8 type;
1132 			__le16 pkt_len;
1133 			u8 pkt[512];
1134 		} __packed beacon_tlv;
1135 	} req = {
1136 		.hdr = {
1137 			.bss_idx = mvif->mt76.idx,
1138 		},
1139 		.beacon_tlv = {
1140 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1141 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1142 			.enable = enable,
1143 		},
1144 	};
1145 	struct sk_buff *skb;
1146 
1147 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1148 	if (!skb)
1149 		return -EINVAL;
1150 
1151 	if (skb->len > 512 - MT_TXD_SIZE) {
1152 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1153 		dev_kfree_skb(skb);
1154 		return -EINVAL;
1155 	}
1156 
1157 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1158 			      wcid, NULL, 0, NULL, true);
1159 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1160 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1161 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1162 
1163 	if (offs.cntdwn_counter_offs[0]) {
1164 		u16 csa_offs;
1165 
1166 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1167 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1168 	}
1169 	dev_kfree_skb(skb);
1170 
1171 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1172 				 &req, sizeof(req), true);
1173 }
1174 
1175 static int
1176 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1177 		       bool enable)
1178 {
1179 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1180 
1181 	return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1182 					   enable);
1183 }
1184 
1185 static int
1186 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1187 		       struct ieee80211_sta *sta, bool enable)
1188 {
1189 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1190 
1191 	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1192 					   enable);
1193 }
1194 
1195 static inline int
1196 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1197 		       struct ieee80211_sta *sta, bool enable)
1198 {
1199 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1200 				    MCU_UNI_CMD_STA_REC_UPDATE);
1201 }
1202 
1203 static int
1204 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1205 		     struct ieee80211_ampdu_params *params,
1206 		     bool enable)
1207 {
1208 	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1209 
1210 	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1211 				      enable, true);
1212 }
1213 
1214 static int
1215 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1216 		     struct ieee80211_ampdu_params *params,
1217 		     bool enable)
1218 {
1219 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1220 	struct mt7615_vif *mvif = msta->vif;
1221 	struct wtbl_req_hdr *wtbl_hdr;
1222 	struct tlv *sta_wtbl;
1223 	struct sk_buff *skb;
1224 	int err;
1225 
1226 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1227 					    &msta->wcid);
1228 	if (IS_ERR(skb))
1229 		return PTR_ERR(skb);
1230 
1231 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1232 
1233 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1234 				    MCU_UNI_CMD_STA_REC_UPDATE, true);
1235 	if (err < 0 || !enable)
1236 		return err;
1237 
1238 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1239 					    &msta->wcid);
1240 	if (IS_ERR(skb))
1241 		return PTR_ERR(skb);
1242 
1243 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1244 					   sizeof(struct tlv));
1245 
1246 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1247 						  WTBL_SET, sta_wtbl, &skb);
1248 	if (IS_ERR(wtbl_hdr))
1249 		return PTR_ERR(wtbl_hdr);
1250 
1251 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1252 				    sta_wtbl, wtbl_hdr);
1253 
1254 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1255 				     MCU_UNI_CMD_STA_REC_UPDATE, true);
1256 }
1257 
1258 static const struct mt7615_mcu_ops uni_update_ops = {
1259 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1260 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1261 	.add_dev_info = mt7615_mcu_uni_add_dev,
1262 	.add_bss_info = mt7615_mcu_uni_add_bss,
1263 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1264 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1265 	.sta_add = mt7615_mcu_uni_add_sta,
1266 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1267 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1268 };
1269 
1270 int mt7615_mcu_restart(struct mt76_dev *dev)
1271 {
1272 	return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1273 }
1274 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1275 
1276 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1277 {
1278 	const struct mt7615_patch_hdr *hdr;
1279 	const struct firmware *fw = NULL;
1280 	int len, ret, sem;
1281 
1282 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1283 	switch (sem) {
1284 	case PATCH_IS_DL:
1285 		return 0;
1286 	case PATCH_NOT_DL_SEM_SUCCESS:
1287 		break;
1288 	default:
1289 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1290 		return -EAGAIN;
1291 	}
1292 
1293 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1294 	if (ret)
1295 		goto out;
1296 
1297 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1298 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1299 		ret = -EINVAL;
1300 		goto out;
1301 	}
1302 
1303 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1304 
1305 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1306 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1307 
1308 	len = fw->size - sizeof(*hdr);
1309 
1310 	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1311 					    DL_MODE_NEED_RSP);
1312 	if (ret) {
1313 		dev_err(dev->mt76.dev, "Download request failed\n");
1314 		goto out;
1315 	}
1316 
1317 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1318 				     fw->data + sizeof(*hdr), len);
1319 	if (ret) {
1320 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1321 		goto out;
1322 	}
1323 
1324 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1325 	if (ret)
1326 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1327 
1328 out:
1329 	release_firmware(fw);
1330 
1331 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1332 	switch (sem) {
1333 	case PATCH_REL_SEM_SUCCESS:
1334 		break;
1335 	default:
1336 		ret = -EAGAIN;
1337 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1338 		break;
1339 	}
1340 
1341 	return ret;
1342 }
1343 
1344 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1345 {
1346 	u32 ret = 0;
1347 
1348 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1349 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1350 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1351 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1352 	ret |= DL_MODE_NEED_RSP;
1353 	ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1354 
1355 	return ret;
1356 }
1357 
1358 static int
1359 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1360 			     const struct mt7615_fw_trailer *hdr,
1361 			     const u8 *data, bool is_cr4)
1362 {
1363 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1364 	int err, i, offset = 0;
1365 	u32 len, addr, mode;
1366 
1367 	for (i = 0; i < n_region; i++) {
1368 		mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1369 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1370 		addr = le32_to_cpu(hdr[i].addr);
1371 
1372 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1373 						    mode);
1374 		if (err) {
1375 			dev_err(dev->mt76.dev, "Download request failed\n");
1376 			return err;
1377 		}
1378 
1379 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1380 					     data + offset, len);
1381 		if (err) {
1382 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1383 			return err;
1384 		}
1385 
1386 		offset += len;
1387 	}
1388 
1389 	return 0;
1390 }
1391 
1392 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1393 {
1394 	const struct mt7615_fw_trailer *hdr;
1395 	const struct firmware *fw;
1396 	int ret;
1397 
1398 	ret = request_firmware(&fw, name, dev->mt76.dev);
1399 	if (ret)
1400 		return ret;
1401 
1402 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1403 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1404 		ret = -EINVAL;
1405 		goto out;
1406 	}
1407 
1408 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1409 					N9_REGION_NUM * sizeof(*hdr));
1410 
1411 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1412 		 hdr->fw_ver, hdr->build_date);
1413 
1414 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1415 	if (ret)
1416 		goto out;
1417 
1418 	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1419 					     le32_to_cpu(hdr->addr),
1420 					     FW_START_OVERRIDE);
1421 	if (ret) {
1422 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1423 		goto out;
1424 	}
1425 
1426 	snprintf(dev->mt76.hw->wiphy->fw_version,
1427 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1428 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1429 
1430 	if (!is_mt7615(&dev->mt76) &&
1431 	    !strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
1432 		dev->fw_ver = MT7615_FIRMWARE_V2;
1433 		dev->mcu_ops = &sta_update_ops;
1434 	} else {
1435 		dev->fw_ver = MT7615_FIRMWARE_V1;
1436 		dev->mcu_ops = &wtbl_update_ops;
1437 	}
1438 
1439 out:
1440 	release_firmware(fw);
1441 	return ret;
1442 }
1443 
1444 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1445 {
1446 	const struct mt7615_fw_trailer *hdr;
1447 	const struct firmware *fw;
1448 	int ret;
1449 
1450 	ret = request_firmware(&fw, name, dev->mt76.dev);
1451 	if (ret)
1452 		return ret;
1453 
1454 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1455 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1456 		ret = -EINVAL;
1457 		goto out;
1458 	}
1459 
1460 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1461 					CR4_REGION_NUM * sizeof(*hdr));
1462 
1463 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1464 		 hdr->fw_ver, hdr->build_date);
1465 
1466 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1467 	if (ret)
1468 		goto out;
1469 
1470 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1471 					     FW_START_WORKING_PDA_CR4);
1472 	if (ret) {
1473 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1474 		goto out;
1475 	}
1476 
1477 out:
1478 	release_firmware(fw);
1479 
1480 	return ret;
1481 }
1482 
1483 static int mt7615_load_ram(struct mt7615_dev *dev)
1484 {
1485 	int ret;
1486 
1487 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1488 	if (ret)
1489 		return ret;
1490 
1491 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1492 }
1493 
1494 static int mt7615_load_firmware(struct mt7615_dev *dev)
1495 {
1496 	int ret;
1497 	u32 val;
1498 
1499 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1500 
1501 	if (val != FW_STATE_FW_DOWNLOAD) {
1502 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1503 		return -EIO;
1504 	}
1505 
1506 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1507 	if (ret)
1508 		return ret;
1509 
1510 	ret = mt7615_load_ram(dev);
1511 	if (ret)
1512 		return ret;
1513 
1514 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1515 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1516 				       FW_STATE_CR4_RDY), 500)) {
1517 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1518 		return -EIO;
1519 	}
1520 
1521 	return 0;
1522 }
1523 
1524 static int mt7622_load_firmware(struct mt7615_dev *dev)
1525 {
1526 	int ret;
1527 	u32 val;
1528 
1529 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1530 
1531 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1532 	if (val != FW_STATE_FW_DOWNLOAD) {
1533 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1534 		return -EIO;
1535 	}
1536 
1537 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1538 	if (ret)
1539 		return ret;
1540 
1541 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1542 	if (ret)
1543 		return ret;
1544 
1545 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1546 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1547 				       FW_STATE_NORMAL_TRX), 1500)) {
1548 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1549 		return -EIO;
1550 	}
1551 
1552 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1553 
1554 	return 0;
1555 }
1556 
1557 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1558 {
1559 	struct {
1560 		u8 ctrl_val;
1561 		u8 pad[3];
1562 	} data = {
1563 		.ctrl_val = ctrl
1564 	};
1565 
1566 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
1567 				 sizeof(data), true);
1568 }
1569 
1570 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1571 {
1572 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1573 	const struct mt7663_fw_trailer *hdr;
1574 	const struct mt7663_fw_buf *buf;
1575 	const struct firmware *fw;
1576 	const u8 *base_addr;
1577 	int i, ret;
1578 
1579 	ret = request_firmware(&fw, name, dev->mt76.dev);
1580 	if (ret)
1581 		return ret;
1582 
1583 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1584 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1585 		ret = -EINVAL;
1586 		goto out;
1587 	}
1588 
1589 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
1590 						 FW_V3_COMMON_TAILER_SIZE);
1591 
1592 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1593 		 hdr->fw_ver, hdr->build_date);
1594 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1595 
1596 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1597 	for (i = 0; i < hdr->n_region; i++) {
1598 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1599 		u32 len, addr, mode;
1600 
1601 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1602 
1603 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1604 		mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
1605 		addr = le32_to_cpu(buf->img_dest_addr);
1606 		len = le32_to_cpu(buf->img_size);
1607 
1608 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1609 						    mode);
1610 		if (ret) {
1611 			dev_err(dev->mt76.dev, "Download request failed\n");
1612 			goto out;
1613 		}
1614 
1615 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1616 					     fw->data + offset, len);
1617 		if (ret) {
1618 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1619 			goto out;
1620 		}
1621 
1622 		offset += le32_to_cpu(buf->img_size);
1623 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1624 			override_addr = le32_to_cpu(buf->img_dest_addr);
1625 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1626 				 i, override_addr);
1627 		}
1628 	}
1629 
1630 	if (override_addr)
1631 		flag |= FW_START_OVERRIDE;
1632 
1633 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1634 		 override_addr, flag);
1635 
1636 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1637 	if (ret) {
1638 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1639 		goto out;
1640 	}
1641 
1642 	snprintf(dev->mt76.hw->wiphy->fw_version,
1643 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1644 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1645 
1646 out:
1647 	release_firmware(fw);
1648 
1649 	return ret;
1650 }
1651 
1652 static int
1653 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1654 {
1655 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1656 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1657 	int ret;
1658 
1659 	if (!prefer_offload_fw) {
1660 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1661 		primary_rom = MT7663_ROM_PATCH;
1662 	}
1663 	selected_rom = primary_rom;
1664 
1665 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1666 	if (ret) {
1667 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1668 			 primary_rom, secondary_rom);
1669 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1670 					secondary_rom);
1671 		if (ret) {
1672 			dev_err(dev->mt76.dev, "failed to load %s",
1673 				secondary_rom);
1674 			return ret;
1675 		}
1676 		selected_rom = secondary_rom;
1677 	}
1678 
1679 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1680 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1681 		dev->fw_ver = MT7615_FIRMWARE_V3;
1682 		dev->mcu_ops = &uni_update_ops;
1683 	} else {
1684 		*n9_firmware = MT7663_FIRMWARE_N9;
1685 		dev->fw_ver = MT7615_FIRMWARE_V2;
1686 		dev->mcu_ops = &sta_update_ops;
1687 	}
1688 
1689 	return 0;
1690 }
1691 
1692 int __mt7663_load_firmware(struct mt7615_dev *dev)
1693 {
1694 	const char *n9_firmware;
1695 	int ret;
1696 
1697 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1698 	if (ret) {
1699 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1700 		return -EIO;
1701 	}
1702 
1703 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1704 	if (ret)
1705 		return ret;
1706 
1707 	ret = mt7663_load_n9(dev, n9_firmware);
1708 	if (ret)
1709 		return ret;
1710 
1711 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1712 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1713 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1714 				     MT7663_TOP_MISC2_FW_STATE);
1715 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1716 		return -EIO;
1717 	}
1718 
1719 #ifdef CONFIG_PM
1720 	if (mt7615_firmware_offload(dev))
1721 		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1722 #endif /* CONFIG_PM */
1723 
1724 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1725 
1726 	return 0;
1727 }
1728 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1729 
1730 static int mt7663_load_firmware(struct mt7615_dev *dev)
1731 {
1732 	int ret;
1733 
1734 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1735 
1736 	ret = __mt7663_load_firmware(dev);
1737 	if (ret)
1738 		return ret;
1739 
1740 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1741 
1742 	return 0;
1743 }
1744 
1745 int mt7615_mcu_init(struct mt7615_dev *dev)
1746 {
1747 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1748 		.headroom = sizeof(struct mt7615_mcu_txd),
1749 		.mcu_skb_send_msg = mt7615_mcu_send_message,
1750 		.mcu_parse_response = mt7615_mcu_parse_response,
1751 		.mcu_restart = mt7615_mcu_restart,
1752 	};
1753 	int ret;
1754 
1755 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
1756 
1757 	ret = mt7615_mcu_drv_pmctrl(dev);
1758 	if (ret)
1759 		return ret;
1760 
1761 	switch (mt76_chip(&dev->mt76)) {
1762 	case 0x7622:
1763 		ret = mt7622_load_firmware(dev);
1764 		break;
1765 	case 0x7663:
1766 		ret = mt7663_load_firmware(dev);
1767 		break;
1768 	default:
1769 		ret = mt7615_load_firmware(dev);
1770 		break;
1771 	}
1772 	if (ret)
1773 		return ret;
1774 
1775 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1776 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1777 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1778 	mt7615_mcu_fw_log_2_host(dev, 0);
1779 
1780 	return 0;
1781 }
1782 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1783 
1784 void mt7615_mcu_exit(struct mt7615_dev *dev)
1785 {
1786 	__mt76_mcu_restart(&dev->mt76);
1787 	mt7615_mcu_set_fw_ctrl(dev);
1788 	skb_queue_purge(&dev->mt76.mcu.res_q);
1789 }
1790 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1791 
1792 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1793 {
1794 	struct {
1795 		u8 buffer_mode;
1796 		u8 content_format;
1797 		__le16 len;
1798 	} __packed req_hdr = {
1799 		.buffer_mode = 1,
1800 	};
1801 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1802 	struct sk_buff *skb;
1803 	int eep_len, offset;
1804 
1805 	switch (mt76_chip(&dev->mt76)) {
1806 	case 0x7622:
1807 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1808 		offset = MT_EE_NIC_CONF_0;
1809 		break;
1810 	case 0x7663:
1811 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1812 		req_hdr.content_format = 1;
1813 		offset = MT_EE_CHIP_ID;
1814 		break;
1815 	default:
1816 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1817 		offset = MT_EE_NIC_CONF_0;
1818 		break;
1819 	}
1820 
1821 	req_hdr.len = cpu_to_le16(eep_len);
1822 
1823 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1824 	if (!skb)
1825 		return -ENOMEM;
1826 
1827 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1828 	skb_put_data(skb, eep + offset, eep_len);
1829 
1830 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1831 				     MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
1832 }
1833 
1834 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1835 		       const struct ieee80211_tx_queue_params *params)
1836 {
1837 #define WMM_AIFS_SET	BIT(0)
1838 #define WMM_CW_MIN_SET	BIT(1)
1839 #define WMM_CW_MAX_SET	BIT(2)
1840 #define WMM_TXOP_SET	BIT(3)
1841 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1842 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1843 	struct req_data {
1844 		u8 number;
1845 		u8 rsv[3];
1846 		u8 queue;
1847 		u8 valid;
1848 		u8 aifs;
1849 		u8 cw_min;
1850 		__le16 cw_max;
1851 		__le16 txop;
1852 	} __packed req = {
1853 		.number = 1,
1854 		.queue = queue,
1855 		.valid = WMM_PARAM_SET,
1856 		.aifs = params->aifs,
1857 		.cw_min = 5,
1858 		.cw_max = cpu_to_le16(10),
1859 		.txop = cpu_to_le16(params->txop),
1860 	};
1861 
1862 	if (params->cw_min)
1863 		req.cw_min = fls(params->cw_min);
1864 	if (params->cw_max)
1865 		req.cw_max = cpu_to_le16(fls(params->cw_max));
1866 
1867 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
1868 				 sizeof(req), true);
1869 }
1870 
1871 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1872 {
1873 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1874 	struct dbdc_entry {
1875 		u8 type;
1876 		u8 index;
1877 		u8 band;
1878 		u8 _rsv;
1879 	};
1880 	struct {
1881 		u8 enable;
1882 		u8 num;
1883 		u8 _rsv[2];
1884 		struct dbdc_entry entry[64];
1885 	} req = {
1886 		.enable = !!ext_phy,
1887 	};
1888 	int i;
1889 
1890 	if (!ext_phy)
1891 		goto out;
1892 
1893 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
1894 	do { \
1895 		req.entry[req.num].type = _type;		\
1896 		req.entry[req.num].index = _idx;		\
1897 		req.entry[req.num++].band = _band;		\
1898 	} while (0)
1899 
1900 	for (i = 0; i < 4; i++) {
1901 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1902 
1903 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1904 	}
1905 
1906 	for (i = 0; i < 14; i++) {
1907 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1908 
1909 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1910 	}
1911 
1912 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1913 
1914 	for (i = 0; i < 3; i++)
1915 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
1916 
1917 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
1918 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
1919 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
1920 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
1921 
1922 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
1923 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
1924 
1925 out:
1926 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
1927 				 sizeof(req), true);
1928 }
1929 
1930 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1931 {
1932 	struct wtbl_req_hdr req = {
1933 		.operation = WTBL_RESET_ALL,
1934 	};
1935 
1936 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
1937 				 sizeof(req), true);
1938 }
1939 
1940 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
1941 		       enum mt7615_rdd_cmd cmd, u8 index,
1942 		       u8 rx_sel, u8 val)
1943 {
1944 	struct {
1945 		u8 ctrl;
1946 		u8 rdd_idx;
1947 		u8 rdd_rx_sel;
1948 		u8 val;
1949 		u8 rsv[4];
1950 	} req = {
1951 		.ctrl = cmd,
1952 		.rdd_idx = index,
1953 		.rdd_rx_sel = rx_sel,
1954 		.val = val,
1955 	};
1956 
1957 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
1958 				 sizeof(req), true);
1959 }
1960 
1961 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
1962 {
1963 	struct {
1964 		__le16 tag;
1965 		__le16 min_lpn;
1966 	} req = {
1967 		.tag = cpu_to_le16(0x1),
1968 		.min_lpn = cpu_to_le16(val),
1969 	};
1970 
1971 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
1972 				 sizeof(req), true);
1973 }
1974 
1975 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
1976 			    const struct mt7615_dfs_pulse *pulse)
1977 {
1978 	struct {
1979 		__le16 tag;
1980 		__le32 max_width;	/* us */
1981 		__le32 max_pwr;		/* dbm */
1982 		__le32 min_pwr;		/* dbm */
1983 		__le32 min_stgr_pri;	/* us */
1984 		__le32 max_stgr_pri;	/* us */
1985 		__le32 min_cr_pri;	/* us */
1986 		__le32 max_cr_pri;	/* us */
1987 	} req = {
1988 		.tag = cpu_to_le16(0x3),
1989 #define __req_field(field) .field = cpu_to_le32(pulse->field)
1990 		__req_field(max_width),
1991 		__req_field(max_pwr),
1992 		__req_field(min_pwr),
1993 		__req_field(min_stgr_pri),
1994 		__req_field(max_stgr_pri),
1995 		__req_field(min_cr_pri),
1996 		__req_field(max_cr_pri),
1997 #undef  __req_field
1998 	};
1999 
2000 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2001 				 sizeof(req), true);
2002 }
2003 
2004 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2005 			    const struct mt7615_dfs_pattern *pattern)
2006 {
2007 	struct {
2008 		__le16 tag;
2009 		__le16 radar_type;
2010 		u8 enb;
2011 		u8 stgr;
2012 		u8 min_crpn;
2013 		u8 max_crpn;
2014 		u8 min_crpr;
2015 		u8 min_pw;
2016 		u8 max_pw;
2017 		__le32 min_pri;
2018 		__le32 max_pri;
2019 		u8 min_crbn;
2020 		u8 max_crbn;
2021 		u8 min_stgpn;
2022 		u8 max_stgpn;
2023 		u8 min_stgpr;
2024 	} req = {
2025 		.tag = cpu_to_le16(0x2),
2026 		.radar_type = cpu_to_le16(index),
2027 #define __req_field_u8(field) .field = pattern->field
2028 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2029 		__req_field_u8(enb),
2030 		__req_field_u8(stgr),
2031 		__req_field_u8(min_crpn),
2032 		__req_field_u8(max_crpn),
2033 		__req_field_u8(min_crpr),
2034 		__req_field_u8(min_pw),
2035 		__req_field_u8(max_pw),
2036 		__req_field_u32(min_pri),
2037 		__req_field_u32(max_pri),
2038 		__req_field_u8(min_crbn),
2039 		__req_field_u8(max_crbn),
2040 		__req_field_u8(min_stgpn),
2041 		__req_field_u8(max_stgpn),
2042 		__req_field_u8(min_stgpr),
2043 #undef __req_field_u8
2044 #undef __req_field_u32
2045 	};
2046 
2047 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2048 				 sizeof(req), true);
2049 }
2050 
2051 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2052 {
2053 	struct {
2054 		u8 pulse_num;
2055 		u8 rsv[3];
2056 		struct {
2057 			__le32 start_time;
2058 			__le16 width;
2059 			__le16 power;
2060 		} pattern[32];
2061 	} req = {
2062 		.pulse_num = dev->radar_pattern.n_pulses,
2063 	};
2064 	u32 start_time = ktime_to_ms(ktime_get_boottime());
2065 	int i;
2066 
2067 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2068 		return -EINVAL;
2069 
2070 	/* TODO: add some noise here */
2071 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2072 		u32 ts = start_time + i * dev->radar_pattern.period;
2073 
2074 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2075 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2076 		req.pattern[i].start_time = cpu_to_le32(ts);
2077 	}
2078 
2079 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2080 				 &req, sizeof(req), false);
2081 }
2082 
2083 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2084 {
2085 	struct mt76_phy *mphy = phy->mt76;
2086 	struct ieee80211_hw *hw = mphy->hw;
2087 	int n_chains = hweight8(mphy->antenna_mask);
2088 	int tx_power;
2089 	int i;
2090 
2091 	tx_power = hw->conf.power_level * 2 -
2092 		   mt76_tx_power_nss_delta(n_chains);
2093 	mphy->txpower_cur = tx_power;
2094 
2095 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2096 		sku[i] = tx_power;
2097 
2098 	for (i = 0; i < 4; i++) {
2099 		int delta = 0;
2100 
2101 		if (i < n_chains - 1)
2102 			delta = mt76_tx_power_nss_delta(n_chains) -
2103 				mt76_tx_power_nss_delta(i + 1);
2104 		sku[MT_SKU_1SS_DELTA + i] = delta;
2105 	}
2106 }
2107 
2108 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2109 {
2110 	static const u8 width_to_bw[] = {
2111 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2112 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2113 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2114 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2115 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2116 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2117 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2118 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2119 	};
2120 
2121 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2122 		return 0;
2123 
2124 	return width_to_bw[chandef->width];
2125 }
2126 
2127 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2128 {
2129 	struct mt7615_dev *dev = phy->dev;
2130 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2131 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2132 	struct {
2133 		u8 control_chan;
2134 		u8 center_chan;
2135 		u8 bw;
2136 		u8 tx_streams;
2137 		u8 rx_streams_mask;
2138 		u8 switch_reason;
2139 		u8 band_idx;
2140 		/* for 80+80 only */
2141 		u8 center_chan2;
2142 		__le16 cac_case;
2143 		u8 channel_band;
2144 		u8 rsv0;
2145 		__le32 outband_freq;
2146 		u8 txpower_drop;
2147 		u8 rsv1[3];
2148 		u8 txpower_sku[53];
2149 		u8 rsv2[3];
2150 	} req = {
2151 		.control_chan = chandef->chan->hw_value,
2152 		.center_chan = ieee80211_frequency_to_channel(freq1),
2153 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2154 		.rx_streams_mask = phy->mt76->chainmask,
2155 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2156 	};
2157 
2158 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2159 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2160 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2161 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2162 		req.switch_reason = CH_SWITCH_DFS;
2163 	else
2164 		req.switch_reason = CH_SWITCH_NORMAL;
2165 
2166 	req.band_idx = phy != &dev->phy;
2167 	req.bw = mt7615_mcu_chan_bw(chandef);
2168 
2169 	if (mt76_testmode_enabled(phy->mt76))
2170 		memset(req.txpower_sku, 0x3f, 49);
2171 	else
2172 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2173 
2174 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2175 }
2176 
2177 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2178 {
2179 	struct {
2180 		u8 action;
2181 		u8 rsv[3];
2182 	} req = {
2183 		.action = index,
2184 	};
2185 
2186 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2187 				 sizeof(req), true);
2188 }
2189 
2190 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2191 			      u32 val)
2192 {
2193 	struct {
2194 		u8 test_mode_en;
2195 		u8 param_idx;
2196 		u8 _rsv[2];
2197 
2198 		__le32 value;
2199 
2200 		u8 pad[8];
2201 	} req = {
2202 		.test_mode_en = test_mode,
2203 		.param_idx = param,
2204 		.value = cpu_to_le32(val),
2205 	};
2206 
2207 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2208 				 sizeof(req), false);
2209 }
2210 
2211 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2212 {
2213 	struct mt7615_dev *dev = phy->dev;
2214 	struct {
2215 		u8 format_id;
2216 		u8 sku_enable;
2217 		u8 band_idx;
2218 		u8 rsv;
2219 	} req = {
2220 		.format_id = 0,
2221 		.band_idx = phy != &dev->phy,
2222 		.sku_enable = enable,
2223 	};
2224 
2225 	return mt76_mcu_send_msg(&dev->mt76,
2226 				 MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2227 				 sizeof(req), true);
2228 }
2229 
2230 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2231 {
2232 	int i;
2233 
2234 	for (i = 0; i < n_freqs; i++)
2235 		if (cur == freqs[i])
2236 			return i;
2237 
2238 	return -1;
2239 }
2240 
2241 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2242 {
2243 	static const u16 freq_list[] = {
2244 		4980, 5805, 5905, 5190,
2245 		5230, 5270, 5310, 5350,
2246 		5390, 5430, 5470, 5510,
2247 		5550, 5590, 5630, 5670,
2248 		5710, 5755, 5795, 5835,
2249 		5875, 5210, 5290, 5370,
2250 		5450, 5530, 5610, 5690,
2251 		5775, 5855
2252 	};
2253 	static const u16 freq_bw40[] = {
2254 		5190, 5230, 5270, 5310,
2255 		5350, 5390, 5430, 5470,
2256 		5510, 5550, 5590, 5630,
2257 		5670, 5710, 5755, 5795,
2258 		5835, 5875
2259 	};
2260 	int offset_2g = ARRAY_SIZE(freq_list);
2261 	int idx;
2262 
2263 	if (freq < 4000) {
2264 		if (freq < 2427)
2265 			return offset_2g;
2266 		if (freq < 2442)
2267 			return offset_2g + 1;
2268 		if (freq < 2457)
2269 			return offset_2g + 2;
2270 
2271 		return offset_2g + 3;
2272 	}
2273 
2274 	switch (bw) {
2275 	case NL80211_CHAN_WIDTH_80:
2276 	case NL80211_CHAN_WIDTH_80P80:
2277 	case NL80211_CHAN_WIDTH_160:
2278 		break;
2279 	default:
2280 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2281 					   freq + 10);
2282 		if (idx >= 0) {
2283 			freq = freq_bw40[idx];
2284 			break;
2285 		}
2286 
2287 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2288 					   freq - 10);
2289 		if (idx >= 0) {
2290 			freq = freq_bw40[idx];
2291 			break;
2292 		}
2293 		fallthrough;
2294 	case NL80211_CHAN_WIDTH_40:
2295 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2296 					   freq);
2297 		if (idx >= 0)
2298 			break;
2299 
2300 		return -1;
2301 
2302 	}
2303 
2304 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2305 }
2306 
2307 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2308 {
2309 	struct mt7615_dev *dev = phy->dev;
2310 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2311 	int freq2 = chandef->center_freq2;
2312 	int ret;
2313 	struct {
2314 		u8 direction;
2315 		u8 runtime_calibration;
2316 		u8 _rsv[2];
2317 
2318 		__le16 center_freq;
2319 		u8 bw;
2320 		u8 band;
2321 		u8 is_freq2;
2322 		u8 success;
2323 		u8 dbdc_en;
2324 
2325 		u8 _rsv2;
2326 
2327 		struct {
2328 			__le32 sx0_i_lna[4];
2329 			__le32 sx0_q_lna[4];
2330 
2331 			__le32 sx2_i_lna[4];
2332 			__le32 sx2_q_lna[4];
2333 		} dcoc_data[4];
2334 	} req = {
2335 		.direction = 1,
2336 
2337 		.bw = mt7615_mcu_chan_bw(chandef),
2338 		.band = chandef->center_freq1 > 4000,
2339 		.dbdc_en = !!dev->mt76.phy2,
2340 	};
2341 	u16 center_freq = chandef->center_freq1;
2342 	int freq_idx;
2343 	u8 *eep = dev->mt76.eeprom.data;
2344 
2345 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2346 		return 0;
2347 
2348 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2349 		freq2 = center_freq + 40;
2350 		center_freq -= 40;
2351 	}
2352 
2353 again:
2354 	req.runtime_calibration = 1;
2355 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2356 	if (freq_idx < 0)
2357 		goto out;
2358 
2359 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2360 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2361 	       sizeof(req.dcoc_data));
2362 	req.runtime_calibration = 0;
2363 
2364 out:
2365 	req.center_freq = cpu_to_le16(center_freq);
2366 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
2367 				sizeof(req), true);
2368 
2369 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2370 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2371 		req.is_freq2 = true;
2372 		center_freq = freq2;
2373 		goto again;
2374 	}
2375 
2376 	return ret;
2377 }
2378 
2379 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2380 {
2381 	static const u16 freq_list[] = {
2382 		4920, 4940, 4960, 4980,
2383 		5040, 5060, 5080, 5180,
2384 		5200, 5220, 5240, 5260,
2385 		5280, 5300, 5320, 5340,
2386 		5360, 5380, 5400, 5420,
2387 		5440, 5460, 5480, 5500,
2388 		5520, 5540, 5560, 5580,
2389 		5600, 5620, 5640, 5660,
2390 		5680, 5700, 5720, 5745,
2391 		5765, 5785, 5805, 5825,
2392 		5845, 5865, 5885, 5905
2393 	};
2394 	int offset_2g = ARRAY_SIZE(freq_list);
2395 	int idx;
2396 
2397 	if (freq < 4000) {
2398 		if (freq < 2432)
2399 			return offset_2g;
2400 		if (freq < 2457)
2401 			return offset_2g + 1;
2402 
2403 		return offset_2g + 2;
2404 	}
2405 
2406 	if (bw != NL80211_CHAN_WIDTH_20) {
2407 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2408 					   freq + 10);
2409 		if (idx >= 0)
2410 			return idx;
2411 
2412 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2413 					   freq - 10);
2414 		if (idx >= 0)
2415 			return idx;
2416 	}
2417 
2418 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2419 }
2420 
2421 
2422 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2423 {
2424 	struct mt7615_dev *dev = phy->dev;
2425 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2426 	int freq2 = chandef->center_freq2;
2427 	int ret;
2428 	struct {
2429 		u8 direction;
2430 		u8 runtime_calibration;
2431 		u8 _rsv[2];
2432 
2433 		__le16 center_freq;
2434 		u8 bw;
2435 		u8 band;
2436 		u8 is_freq2;
2437 		u8 success;
2438 		u8 dbdc_en;
2439 
2440 		u8 _rsv2;
2441 
2442 		struct {
2443 			struct {
2444 				u32 dpd_g0;
2445 				u8 data[32];
2446 			} wf0, wf1;
2447 
2448 			struct {
2449 				u32 dpd_g0_prim;
2450 				u32 dpd_g0_sec;
2451 				u8 data_prim[32];
2452 				u8 data_sec[32];
2453 			} wf2, wf3;
2454 		} dpd_data;
2455 	} req = {
2456 		.direction = 1,
2457 
2458 		.bw = mt7615_mcu_chan_bw(chandef),
2459 		.band = chandef->center_freq1 > 4000,
2460 		.dbdc_en = !!dev->mt76.phy2,
2461 	};
2462 	u16 center_freq = chandef->center_freq1;
2463 	int freq_idx;
2464 	u8 *eep = dev->mt76.eeprom.data;
2465 
2466 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2467 		return 0;
2468 
2469 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2470 		freq2 = center_freq + 40;
2471 		center_freq -= 40;
2472 	}
2473 
2474 again:
2475 	req.runtime_calibration = 1;
2476 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2477 	if (freq_idx < 0)
2478 		goto out;
2479 
2480 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2481 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2482 	       sizeof(req.dpd_data));
2483 	req.runtime_calibration = 0;
2484 
2485 out:
2486 	req.center_freq = cpu_to_le16(center_freq);
2487 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
2488 				sizeof(req), true);
2489 
2490 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2491 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2492 		req.is_freq2 = true;
2493 		center_freq = freq2;
2494 		goto again;
2495 	}
2496 
2497 	return ret;
2498 }
2499 
2500 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2501 			  bool enable)
2502 {
2503 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2504 	struct {
2505 		u8 bss_idx;
2506 		u8 dtim_period;
2507 		__le16 aid;
2508 		__le16 bcn_interval;
2509 		__le16 atim_window;
2510 		u8 uapsd;
2511 		u8 bmc_delivered_ac;
2512 		u8 bmc_triggered_ac;
2513 		u8 pad;
2514 	} req = {
2515 		.bss_idx = mvif->mt76.idx,
2516 		.aid = cpu_to_le16(vif->bss_conf.aid),
2517 		.dtim_period = vif->bss_conf.dtim_period,
2518 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2519 	};
2520 	struct {
2521 		u8 bss_idx;
2522 		u8 pad[3];
2523 	} req_hdr = {
2524 		.bss_idx = mvif->mt76.idx,
2525 	};
2526 	int err;
2527 
2528 	if (vif->type != NL80211_IFTYPE_STATION)
2529 		return 0;
2530 
2531 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
2532 				sizeof(req_hdr), false);
2533 	if (err < 0 || !enable)
2534 		return err;
2535 
2536 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
2537 				 sizeof(req), false);
2538 }
2539 
2540 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2541 		       struct ieee80211_channel *chan, int duration)
2542 {
2543 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2544 	struct mt7615_dev *dev = phy->dev;
2545 	struct mt7615_roc_tlv req = {
2546 		.bss_idx = mvif->mt76.idx,
2547 		.active = !chan,
2548 		.max_interval = cpu_to_le32(duration),
2549 		.primary_chan = chan ? chan->hw_value : 0,
2550 		.band = chan ? chan->band : 0,
2551 		.req_type = 2,
2552 	};
2553 
2554 	phy->roc_grant = false;
2555 
2556 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
2557 				 sizeof(req), false);
2558 }
2559 
2560 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
2561 				 struct ieee80211_vif *vif,
2562 				 struct ieee80211_bss_conf *info)
2563 {
2564 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2565 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
2566 	struct sk_buff *skb;
2567 	int i, len = min_t(int, info->arp_addr_cnt,
2568 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
2569 	struct {
2570 		struct {
2571 			u8 bss_idx;
2572 			u8 pad[3];
2573 		} __packed hdr;
2574 		struct mt76_connac_arpns_tlv arp;
2575 	} req_hdr = {
2576 		.hdr = {
2577 			.bss_idx = mvif->mt76.idx,
2578 		},
2579 		.arp = {
2580 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
2581 			.len = cpu_to_le16(sizeof(struct mt76_connac_arpns_tlv)),
2582 			.ips_num = len,
2583 			.mode = 2,  /* update */
2584 			.option = 1,
2585 		},
2586 	};
2587 
2588 	if (!mt7615_firmware_offload(dev))
2589 		return 0;
2590 
2591 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2592 				 sizeof(req_hdr) + len * sizeof(__be32));
2593 	if (!skb)
2594 		return -ENOMEM;
2595 
2596 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2597 	for (i = 0; i < len; i++) {
2598 		u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
2599 
2600 		memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
2601 	}
2602 
2603 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
2604 				     true);
2605 }
2606 
2607 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
2608 			     struct ieee80211_vif *vif)
2609 {
2610 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2611 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
2612 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
2613 	struct {
2614 		__le32 ct_win;
2615 		u8 bss_idx;
2616 		u8 rsv[3];
2617 	} __packed req = {
2618 		.ct_win = cpu_to_le32(ct_window),
2619 		.bss_idx = mvif->mt76.idx,
2620 	};
2621 
2622 	if (!mt7615_firmware_offload(dev))
2623 		return -ENOTSUPP;
2624 
2625 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
2626 				 sizeof(req), false);
2627 }
2628 
2629 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
2630 {
2631 	struct {
2632 		__le32 addr;
2633 		__le32 val;
2634 	} __packed req = {
2635 		.addr = cpu_to_le32(offset),
2636 	};
2637 
2638 	return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
2639 				 true);
2640 }
2641 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
2642 
2643 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
2644 {
2645 	struct {
2646 		__le32 addr;
2647 		__le32 val;
2648 	} __packed req = {
2649 		.addr = cpu_to_le32(offset),
2650 		.val = cpu_to_le32(val),
2651 	};
2652 
2653 	mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
2654 }
2655 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);
2656