xref: /linux/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c (revision d30c1683aaecb93d2ab95685dc4300a33d3cea7a)
1 // SPDX-License-Identifier: BSD-3-Clause-Clear
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_buf {
44 	__le32 crc;
45 	__le32 d_img_size;
46 	__le32 block_size;
47 	u8 rsv[4];
48 	__le32 img_dest_addr;
49 	__le32 img_size;
50 	u8 feature_set;
51 };
52 
53 #define MT7615_PATCH_ADDRESS		0x80000
54 #define MT7622_PATCH_ADDRESS		0x9c000
55 #define MT7663_PATCH_ADDRESS		0xdc000
56 
57 #define N9_REGION_NUM			2
58 #define CR4_REGION_NUM			1
59 
60 #define IMG_CRC_LEN			4
61 
62 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
63 			 int cmd, int *wait_seq)
64 {
65 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
66 	struct mt7615_uni_txd *uni_txd;
67 	struct mt7615_mcu_txd *mcu_txd;
68 	u8 seq, q_idx, pkt_fmt;
69 	__le32 *txd;
70 	u32 val;
71 
72 	/* TODO: make dynamic based on msg type */
73 	dev->mt76.mcu.timeout = 20 * HZ;
74 
75 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
76 	if (!seq)
77 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
78 	if (wait_seq)
79 		*wait_seq = seq;
80 
81 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
82 	txd = (__le32 *)skb_push(skb, txd_len);
83 
84 	if (cmd != MCU_CMD(FW_SCATTER)) {
85 		q_idx = MT_TX_MCU_PORT_RX_Q0;
86 		pkt_fmt = MT_TX_TYPE_CMD;
87 	} else {
88 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
89 		pkt_fmt = MT_TX_TYPE_FW;
90 	}
91 
92 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
93 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
94 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
95 	txd[0] = cpu_to_le32(val);
96 
97 	val = MT_TXD1_LONG_FORMAT |
98 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
99 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
100 	txd[1] = cpu_to_le32(val);
101 
102 	if (cmd & __MCU_CMD_FIELD_UNI) {
103 		uni_txd = (struct mt7615_uni_txd *)txd;
104 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
105 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
106 		uni_txd->cid = cpu_to_le16(mcu_cmd);
107 		uni_txd->s2d_index = MCU_S2D_H2N;
108 		uni_txd->pkt_type = MCU_PKT_ID;
109 		uni_txd->seq = seq;
110 
111 		return;
112 	}
113 
114 	mcu_txd = (struct mt7615_mcu_txd *)txd;
115 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
116 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
117 	mcu_txd->s2d_index = MCU_S2D_H2N;
118 	mcu_txd->pkt_type = MCU_PKT_ID;
119 	mcu_txd->seq = seq;
120 	mcu_txd->cid = mcu_cmd;
121 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
122 
123 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
124 		if (cmd & __MCU_CMD_FIELD_QUERY)
125 			mcu_txd->set_query = MCU_Q_QUERY;
126 		else
127 			mcu_txd->set_query = MCU_Q_SET;
128 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
129 	} else {
130 		mcu_txd->set_query = MCU_Q_NA;
131 	}
132 }
133 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
134 
135 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
136 			      struct sk_buff *skb, int seq)
137 {
138 	struct mt7615_mcu_rxd *rxd;
139 	int ret = 0;
140 
141 	if (!skb) {
142 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
143 			cmd, seq);
144 		return -ETIMEDOUT;
145 	}
146 
147 	rxd = (struct mt7615_mcu_rxd *)skb->data;
148 	if (seq != rxd->seq)
149 		return -EAGAIN;
150 
151 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
152 		skb_pull(skb, sizeof(*rxd) - 4);
153 		ret = *skb->data;
154 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
155 		skb_pull(skb, sizeof(*rxd));
156 		ret = le32_to_cpu(*(__le32 *)skb->data);
157 	} else if (cmd == MCU_EXT_QUERY(RF_REG_ACCESS)) {
158 		skb_pull(skb, sizeof(*rxd));
159 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
160 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
161 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
162 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
163 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
164 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
165 		   cmd == MCU_UNI_CMD(SUSPEND)) {
166 		struct mt76_connac_mcu_uni_event *event;
167 
168 		skb_pull(skb, sizeof(*rxd));
169 		event = (struct mt76_connac_mcu_uni_event *)skb->data;
170 		ret = le32_to_cpu(event->status);
171 	} else if (cmd == MCU_CE_QUERY(REG_READ)) {
172 		struct mt76_connac_mcu_reg_event *event;
173 
174 		skb_pull(skb, sizeof(*rxd));
175 		event = (struct mt76_connac_mcu_reg_event *)skb->data;
176 		ret = (int)le32_to_cpu(event->val);
177 	}
178 
179 	return ret;
180 }
181 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
182 
183 static int
184 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
185 			int cmd, int *seq)
186 {
187 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
188 	enum mt76_mcuq_id qid;
189 
190 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
191 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
192 		qid = MT_MCUQ_WM;
193 	else
194 		qid = MT_MCUQ_FWDL;
195 
196 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
197 }
198 
199 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
200 {
201 	struct {
202 		__le32 wifi_stream;
203 		__le32 address;
204 		__le32 data;
205 	} req = {
206 		.wifi_stream = cpu_to_le32(wf),
207 		.address = cpu_to_le32(reg),
208 	};
209 
210 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
211 				 &req, sizeof(req), true);
212 }
213 
214 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
215 {
216 	struct {
217 		__le32 wifi_stream;
218 		__le32 address;
219 		__le32 data;
220 	} req = {
221 		.wifi_stream = cpu_to_le32(wf),
222 		.address = cpu_to_le32(reg),
223 		.data = cpu_to_le32(val),
224 	};
225 
226 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
227 				 &req, sizeof(req), false);
228 }
229 
230 void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
231 {
232 	if (!is_mt7622(&dev->mt76))
233 		return;
234 
235 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
236 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
237 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
238 }
239 EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
240 
241 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
242 {
243 	struct mt76_phy *mphy = &dev->mt76.phy;
244 	struct mt76_connac_pm *pm = &dev->pm;
245 	struct mt76_dev *mdev = &dev->mt76;
246 	u32 addr;
247 	int err;
248 
249 	if (is_mt7663(mdev)) {
250 		/* Clear firmware own via N9 eint */
251 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
252 		mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
253 
254 		addr = MT_CONN_HIF_ON_LPCTL;
255 	} else {
256 		addr = MT_CFG_LPCR_HOST;
257 	}
258 
259 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
260 
261 	mt7622_trigger_hif_int(dev, true);
262 
263 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
264 
265 	mt7622_trigger_hif_int(dev, false);
266 
267 	if (err) {
268 		dev_err(mdev->dev, "driver own failed\n");
269 		return -ETIMEDOUT;
270 	}
271 
272 	clear_bit(MT76_STATE_PM, &mphy->state);
273 
274 	pm->stats.last_wake_event = jiffies;
275 	pm->stats.doze_time += pm->stats.last_wake_event -
276 			       pm->stats.last_doze_event;
277 
278 	return 0;
279 }
280 
281 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
282 {
283 	struct mt76_phy *mphy = &dev->mt76.phy;
284 	struct mt76_connac_pm *pm = &dev->pm;
285 	int i, err = 0;
286 
287 	mutex_lock(&pm->mutex);
288 
289 	if (!test_bit(MT76_STATE_PM, &mphy->state))
290 		goto out;
291 
292 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
293 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
294 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
295 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
296 			break;
297 	}
298 
299 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
300 		dev_err(dev->mt76.dev, "driver own failed\n");
301 		err = -EIO;
302 		goto out;
303 	}
304 	clear_bit(MT76_STATE_PM, &mphy->state);
305 
306 	pm->stats.last_wake_event = jiffies;
307 	pm->stats.doze_time += pm->stats.last_wake_event -
308 			       pm->stats.last_doze_event;
309 out:
310 	mutex_unlock(&pm->mutex);
311 
312 	return err;
313 }
314 
315 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
316 {
317 	struct mt76_phy *mphy = &dev->mt76.phy;
318 	struct mt76_connac_pm *pm = &dev->pm;
319 	int err = 0;
320 	u32 addr;
321 
322 	mutex_lock(&pm->mutex);
323 
324 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
325 		goto out;
326 
327 	mt7622_trigger_hif_int(dev, true);
328 
329 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
330 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
331 
332 	if (is_mt7622(&dev->mt76) &&
333 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
334 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
335 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
336 		clear_bit(MT76_STATE_PM, &mphy->state);
337 		err = -EIO;
338 	}
339 
340 	mt7622_trigger_hif_int(dev, false);
341 	if (!err) {
342 		pm->stats.last_doze_event = jiffies;
343 		pm->stats.awake_time += pm->stats.last_doze_event -
344 					pm->stats.last_wake_event;
345 	}
346 out:
347 	mutex_unlock(&pm->mutex);
348 
349 	return err;
350 }
351 
352 static void
353 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
354 {
355 	if (vif->bss_conf.csa_active)
356 		ieee80211_csa_finish(vif, 0);
357 }
358 
359 static void
360 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
361 {
362 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
363 	struct mt76_phy *mphy = &dev->mt76.phy;
364 	struct mt7615_mcu_csa_notify *c;
365 
366 	c = (struct mt7615_mcu_csa_notify *)skb->data;
367 
368 	if (c->omac_idx > EXT_BSSID_MAX)
369 		return;
370 
371 	if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
372 		mphy = dev->mt76.phys[MT_BAND1];
373 
374 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
375 			IEEE80211_IFACE_ITER_RESUME_ALL,
376 			mt7615_mcu_csa_finish, mphy->hw);
377 }
378 
379 static void
380 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
381 {
382 	struct mt76_phy *mphy = &dev->mt76.phy;
383 	struct mt7615_mcu_rdd_report *r;
384 
385 	r = (struct mt7615_mcu_rdd_report *)skb->data;
386 
387 	if (!dev->radar_pattern.n_pulses && !r->long_detected &&
388 	    !r->constant_prf_detected && !r->staggered_prf_detected)
389 		return;
390 
391 	if (r->band_idx && dev->mt76.phys[MT_BAND1])
392 		mphy = dev->mt76.phys[MT_BAND1];
393 
394 	if (mt76_phy_dfs_state(mphy) < MT_DFS_STATE_CAC)
395 		return;
396 
397 	ieee80211_radar_detected(mphy->hw, NULL);
398 	dev->hw_pattern++;
399 }
400 
401 static void
402 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
403 {
404 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
405 	const char *data = (char *)&rxd[1];
406 	const char *type;
407 
408 	switch (rxd->s2d_index) {
409 	case 0:
410 		type = "N9";
411 		break;
412 	case 2:
413 		type = "CR4";
414 		break;
415 	default:
416 		type = "unknown";
417 		break;
418 	}
419 
420 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
421 		   (int)(skb->len - sizeof(*rxd)), data);
422 }
423 
424 static void
425 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
426 {
427 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
428 
429 	switch (rxd->ext_eid) {
430 	case MCU_EXT_EVENT_RDD_REPORT:
431 		mt7615_mcu_rx_radar_detected(dev, skb);
432 		break;
433 	case MCU_EXT_EVENT_CSA_NOTIFY:
434 		mt7615_mcu_rx_csa_notify(dev, skb);
435 		break;
436 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
437 		mt7615_mcu_rx_log_message(dev, skb);
438 		break;
439 	default:
440 		break;
441 	}
442 }
443 
444 static void
445 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
446 {
447 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
448 	struct mt7615_phy *phy;
449 	struct mt76_phy *mphy;
450 
451 	if (*seq_num & BIT(7) && dev->mt76.phys[MT_BAND1])
452 		mphy = dev->mt76.phys[MT_BAND1];
453 	else
454 		mphy = &dev->mt76.phy;
455 
456 	phy = mphy->priv;
457 
458 	spin_lock_bh(&dev->mt76.lock);
459 	__skb_queue_tail(&phy->scan_event_list, skb);
460 	spin_unlock_bh(&dev->mt76.lock);
461 
462 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
463 				     MT7615_HW_SCAN_TIMEOUT);
464 }
465 
466 static void
467 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
468 {
469 	struct mt7615_roc_tlv *event;
470 	struct mt7615_phy *phy;
471 	struct mt76_phy *mphy;
472 	int duration;
473 
474 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
475 	event = (struct mt7615_roc_tlv *)skb->data;
476 
477 	if (event->dbdc_band && dev->mt76.phys[MT_BAND1])
478 		mphy = dev->mt76.phys[MT_BAND1];
479 	else
480 		mphy = &dev->mt76.phy;
481 
482 	ieee80211_ready_on_channel(mphy->hw);
483 
484 	phy = mphy->priv;
485 	phy->roc_grant = true;
486 	wake_up(&phy->roc_wait);
487 
488 	duration = le32_to_cpu(event->max_interval);
489 	mod_timer(&phy->roc_timer,
490 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
491 }
492 
493 static void
494 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
495 {
496 	struct mt76_connac_beacon_loss_event *event;
497 	struct mt76_phy *mphy;
498 	u8 band_idx = 0; /* DBDC support */
499 
500 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
501 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
502 	if (band_idx && dev->mt76.phys[MT_BAND1])
503 		mphy = dev->mt76.phys[MT_BAND1];
504 	else
505 		mphy = &dev->mt76.phy;
506 
507 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
508 					IEEE80211_IFACE_ITER_RESUME_ALL,
509 					mt76_connac_mcu_beacon_loss_iter,
510 					event);
511 }
512 
513 static void
514 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
515 {
516 	struct mt76_connac_mcu_bss_event *event;
517 	struct mt76_phy *mphy;
518 	u8 band_idx = 0; /* DBDC support */
519 
520 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
521 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
522 
523 	if (band_idx && dev->mt76.phys[MT_BAND1])
524 		mphy = dev->mt76.phys[MT_BAND1];
525 	else
526 		mphy = &dev->mt76.phy;
527 
528 	if (event->is_absent)
529 		ieee80211_stop_queues(mphy->hw);
530 	else
531 		ieee80211_wake_queues(mphy->hw);
532 }
533 
534 static void
535 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
536 {
537 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
538 
539 	switch (rxd->eid) {
540 	case MCU_EVENT_EXT:
541 		mt7615_mcu_rx_ext_event(dev, skb);
542 		break;
543 	case MCU_EVENT_BSS_BEACON_LOSS:
544 		mt7615_mcu_beacon_loss_event(dev, skb);
545 		break;
546 	case MCU_EVENT_ROC:
547 		mt7615_mcu_roc_event(dev, skb);
548 		break;
549 	case MCU_EVENT_SCHED_SCAN_DONE:
550 	case MCU_EVENT_SCAN_DONE:
551 		mt7615_mcu_scan_event(dev, skb);
552 		return;
553 	case MCU_EVENT_BSS_ABSENCE:
554 		mt7615_mcu_bss_event(dev, skb);
555 		break;
556 	case MCU_EVENT_COREDUMP:
557 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
558 					       &dev->coredump);
559 		return;
560 	default:
561 		break;
562 	}
563 	dev_kfree_skb(skb);
564 }
565 
566 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
567 {
568 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
569 
570 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
571 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
572 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
573 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
574 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
575 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
576 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
577 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
578 	    rxd->eid == MCU_EVENT_COREDUMP ||
579 	    rxd->eid == MCU_EVENT_ROC ||
580 	    !rxd->seq)
581 		mt7615_mcu_rx_unsolicited_event(dev, skb);
582 	else
583 		mt76_mcu_rx_event(&dev->mt76, skb);
584 }
585 
586 static int
587 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
588 		       bool bssid, bool enable)
589 {
590 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
591 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
592 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
593 	const u8 *addr = vif->addr;
594 	struct {
595 		u8 mode;
596 		u8 force_clear;
597 		u8 clear_bitmap[8];
598 		u8 entry_count;
599 		u8 write;
600 
601 		u8 index;
602 		u8 bssid;
603 		u8 addr[ETH_ALEN];
604 	} __packed req = {
605 		.mode = !!mask || enable,
606 		.entry_count = 1,
607 		.write = 1,
608 
609 		.index = idx * 2 + bssid,
610 	};
611 
612 	if (bssid)
613 		addr = vif->bss_conf.bssid;
614 
615 	if (enable)
616 		ether_addr_copy(req.addr, addr);
617 
618 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE),
619 				 &req, sizeof(req), true);
620 }
621 
622 static int
623 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
624 		   bool enable)
625 {
626 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
627 	struct mt7615_dev *dev = phy->dev;
628 	struct {
629 		struct req_hdr {
630 			u8 omac_idx;
631 			u8 band_idx;
632 			__le16 tlv_num;
633 			u8 is_tlv_append;
634 			u8 rsv[3];
635 		} __packed hdr;
636 		struct req_tlv {
637 			__le16 tag;
638 			__le16 len;
639 			u8 active;
640 			u8 band_idx;
641 			u8 omac_addr[ETH_ALEN];
642 		} __packed tlv;
643 	} data = {
644 		.hdr = {
645 			.omac_idx = mvif->mt76.omac_idx,
646 			.band_idx = mvif->mt76.band_idx,
647 			.tlv_num = cpu_to_le16(1),
648 			.is_tlv_append = 1,
649 		},
650 		.tlv = {
651 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
652 			.len = cpu_to_le16(sizeof(struct req_tlv)),
653 			.active = enable,
654 			.band_idx = mvif->mt76.band_idx,
655 		},
656 	};
657 
658 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
659 		return mt7615_mcu_muar_config(dev, vif, false, enable);
660 
661 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
662 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
663 				 &data, sizeof(data), true);
664 }
665 
666 static int
667 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
668 			      struct ieee80211_hw *hw,
669 			      struct ieee80211_vif *vif, bool enable)
670 {
671 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
672 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
673 	struct ieee80211_mutable_offsets offs;
674 	struct ieee80211_tx_info *info;
675 	struct req {
676 		u8 omac_idx;
677 		u8 enable;
678 		u8 wlan_idx;
679 		u8 band_idx;
680 		u8 pkt_type;
681 		u8 need_pre_tbtt_int;
682 		__le16 csa_ie_pos;
683 		__le16 pkt_len;
684 		__le16 tim_ie_pos;
685 		u8 pkt[512];
686 		u8 csa_cnt;
687 		/* bss color change */
688 		u8 bcc_cnt;
689 		__le16 bcc_ie_pos;
690 	} __packed req = {
691 		.omac_idx = mvif->mt76.omac_idx,
692 		.enable = enable,
693 		.wlan_idx = wcid->idx,
694 		.band_idx = mvif->mt76.band_idx,
695 	};
696 	struct sk_buff *skb;
697 
698 	if (!enable)
699 		goto out;
700 
701 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
702 	if (!skb)
703 		return -EINVAL;
704 
705 	if (skb->len > 512 - MT_TXD_SIZE) {
706 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
707 		dev_kfree_skb(skb);
708 		return -EINVAL;
709 	}
710 
711 	info = IEEE80211_SKB_CB(skb);
712 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, mvif->mt76.band_idx);
713 
714 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
715 			      0, NULL, 0, true);
716 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
717 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
718 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
719 	if (offs.cntdwn_counter_offs[0]) {
720 		u16 csa_offs;
721 
722 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
723 		req.csa_ie_pos = cpu_to_le16(csa_offs);
724 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
725 	}
726 	dev_kfree_skb(skb);
727 
728 out:
729 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(BCN_OFFLOAD), &req,
730 				 sizeof(req), true);
731 }
732 
733 static int
734 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
735 {
736 	return mt76_connac_mcu_set_pm(&dev->mt76, band, state);
737 }
738 
739 static int
740 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
741 		   struct ieee80211_sta *sta, bool enable)
742 {
743 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
744 	struct mt7615_dev *dev = phy->dev;
745 	struct sk_buff *skb;
746 
747 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
748 		mt7615_mcu_muar_config(dev, vif, true, enable);
749 
750 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
751 	if (IS_ERR(skb))
752 		return PTR_ERR(skb);
753 
754 	if (enable)
755 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
756 
757 	mt76_connac_mcu_bss_basic_tlv(skb, vif, sta, phy->mt76,
758 				      mvif->sta.wcid.idx, enable);
759 
760 	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
761 	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
762 		mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
763 
764 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
765 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
766 }
767 
768 static int
769 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
770 		      struct ieee80211_ampdu_params *params,
771 		      bool enable)
772 {
773 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
774 	struct mt7615_vif *mvif = msta->vif;
775 	struct wtbl_req_hdr *wtbl_hdr;
776 	struct sk_buff *skb = NULL;
777 	int err;
778 
779 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
780 						  WTBL_SET, NULL, &skb);
781 	if (IS_ERR(wtbl_hdr))
782 		return PTR_ERR(wtbl_hdr);
783 
784 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
785 				    NULL, wtbl_hdr);
786 
787 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
788 				    MCU_EXT_CMD(WTBL_UPDATE), true);
789 	if (err < 0)
790 		return err;
791 
792 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
793 					    &msta->wcid);
794 	if (IS_ERR(skb))
795 		return PTR_ERR(skb);
796 
797 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
798 
799 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
800 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
801 }
802 
803 static int
804 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
805 		      struct ieee80211_ampdu_params *params,
806 		      bool enable)
807 {
808 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
809 	struct mt7615_vif *mvif = msta->vif;
810 	struct wtbl_req_hdr *wtbl_hdr;
811 	struct sk_buff *skb;
812 	int err;
813 
814 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
815 					    &msta->wcid);
816 	if (IS_ERR(skb))
817 		return PTR_ERR(skb);
818 
819 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
820 
821 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
822 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
823 	if (err < 0 || !enable)
824 		return err;
825 
826 	skb = NULL;
827 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
828 						  WTBL_SET, NULL, &skb);
829 	if (IS_ERR(wtbl_hdr))
830 		return PTR_ERR(wtbl_hdr);
831 
832 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
833 				    NULL, wtbl_hdr);
834 
835 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
836 				     MCU_EXT_CMD(WTBL_UPDATE), true);
837 }
838 
839 static int
840 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
841 			struct ieee80211_sta *sta, bool enable)
842 {
843 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
844 	struct sk_buff *skb, *sskb, *wskb = NULL;
845 	struct ieee80211_link_sta *link_sta;
846 	struct mt7615_dev *dev = phy->dev;
847 	struct wtbl_req_hdr *wtbl_hdr;
848 	struct mt7615_sta *msta;
849 	bool new_entry = true;
850 	int conn_state;
851 	int cmd, err;
852 
853 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
854 	link_sta = sta ? &sta->deflink : NULL;
855 
856 	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
857 					     &msta->wcid);
858 	if (IS_ERR(sskb))
859 		return PTR_ERR(sskb);
860 
861 	if (!sta) {
862 		if (mvif->sta_added)
863 			new_entry = false;
864 		else
865 			mvif->sta_added = true;
866 	}
867 	conn_state = enable ? CONN_STATE_PORT_SECURE : CONN_STATE_DISCONNECT;
868 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, &vif->bss_conf,
869 				      link_sta, conn_state, new_entry);
870 	if (enable && sta)
871 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
872 					MT76_STA_INFO_STATE_ASSOC);
873 
874 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
875 						  WTBL_RESET_AND_SET, NULL,
876 						  &wskb);
877 	if (IS_ERR(wtbl_hdr)) {
878 		dev_kfree_skb(sskb);
879 		return PTR_ERR(wtbl_hdr);
880 	}
881 
882 	if (enable) {
883 		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
884 						 NULL, wtbl_hdr);
885 		if (sta)
886 			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
887 						    NULL, wtbl_hdr, true, true);
888 		mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, vif, &msta->wcid,
889 						   NULL, wtbl_hdr);
890 	}
891 
892 	cmd = enable ? MCU_EXT_CMD(WTBL_UPDATE) : MCU_EXT_CMD(STA_REC_UPDATE);
893 	skb = enable ? wskb : sskb;
894 
895 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
896 	if (err < 0) {
897 		skb = enable ? sskb : wskb;
898 		dev_kfree_skb(skb);
899 
900 		return err;
901 	}
902 
903 	cmd = enable ? MCU_EXT_CMD(STA_REC_UPDATE) : MCU_EXT_CMD(WTBL_UPDATE);
904 	skb = enable ? sskb : wskb;
905 
906 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
907 }
908 
909 static int
910 mt7615_mcu_wtbl_update_hdr_trans(struct mt7615_dev *dev,
911 				 struct ieee80211_vif *vif,
912 				 struct ieee80211_sta *sta)
913 {
914 	return mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
915 }
916 
917 static const struct mt7615_mcu_ops wtbl_update_ops = {
918 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
919 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
920 	.add_dev_info = mt7615_mcu_add_dev,
921 	.add_bss_info = mt7615_mcu_add_bss,
922 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
923 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
924 	.sta_add = mt7615_mcu_wtbl_sta_add,
925 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
926 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
927 	.set_sta_decap_offload = mt7615_mcu_wtbl_update_hdr_trans,
928 };
929 
930 static int
931 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
932 		  struct ieee80211_ampdu_params *params,
933 		  bool enable, bool tx)
934 {
935 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
936 	struct mt7615_vif *mvif = msta->vif;
937 	struct wtbl_req_hdr *wtbl_hdr;
938 	struct tlv *sta_wtbl;
939 	struct sk_buff *skb;
940 
941 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
942 					    &msta->wcid);
943 	if (IS_ERR(skb))
944 		return PTR_ERR(skb);
945 
946 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
947 
948 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
949 
950 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
951 						  WTBL_SET, sta_wtbl, &skb);
952 	if (IS_ERR(wtbl_hdr))
953 		return PTR_ERR(wtbl_hdr);
954 
955 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
956 				    sta_wtbl, wtbl_hdr);
957 
958 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
959 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
960 }
961 
962 static int
963 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
964 		     struct ieee80211_ampdu_params *params,
965 		     bool enable)
966 {
967 	return mt7615_mcu_sta_ba(dev, params, enable, true);
968 }
969 
970 static int
971 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
972 		     struct ieee80211_ampdu_params *params,
973 		     bool enable)
974 {
975 	return mt7615_mcu_sta_ba(dev, params, enable, false);
976 }
977 
978 static int
979 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
980 		     struct ieee80211_sta *sta, bool enable, int cmd,
981 		     bool offload_fw)
982 {
983 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
984 	struct mt76_sta_cmd_info info = {
985 		.sta = sta,
986 		.vif = vif,
987 		.offload_fw = offload_fw,
988 		.enable = enable,
989 		.newly = true,
990 		.cmd = cmd,
991 	};
992 
993 	info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
994 	return mt76_connac_mcu_sta_cmd(phy, &info);
995 }
996 
997 static int
998 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
999 		   struct ieee80211_sta *sta, bool enable)
1000 {
1001 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1002 				    MCU_EXT_CMD(STA_REC_UPDATE), false);
1003 }
1004 
1005 static int
1006 mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1007 				struct ieee80211_vif *vif,
1008 				struct ieee80211_sta *sta)
1009 {
1010 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1011 
1012 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1013 						    vif, &msta->wcid,
1014 						    MCU_EXT_CMD(STA_REC_UPDATE));
1015 }
1016 
1017 static const struct mt7615_mcu_ops sta_update_ops = {
1018 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1019 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1020 	.add_dev_info = mt7615_mcu_add_dev,
1021 	.add_bss_info = mt7615_mcu_add_bss,
1022 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1023 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1024 	.sta_add = mt7615_mcu_add_sta,
1025 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1026 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1027 	.set_sta_decap_offload = mt7615_mcu_sta_update_hdr_trans,
1028 };
1029 
1030 static int
1031 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1032 {
1033 	return 0;
1034 }
1035 
1036 static int
1037 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1038 				  struct ieee80211_hw *hw,
1039 				  struct ieee80211_vif *vif,
1040 				  bool enable)
1041 {
1042 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1043 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1044 	struct ieee80211_mutable_offsets offs;
1045 	struct {
1046 		struct req_hdr {
1047 			u8 bss_idx;
1048 			u8 pad[3];
1049 		} __packed hdr;
1050 		struct bcn_content_tlv {
1051 			__le16 tag;
1052 			__le16 len;
1053 			__le16 tim_ie_pos;
1054 			__le16 csa_ie_pos;
1055 			__le16 bcc_ie_pos;
1056 			/* 0: disable beacon offload
1057 			 * 1: enable beacon offload
1058 			 * 2: update probe respond offload
1059 			 */
1060 			u8 enable;
1061 			/* 0: legacy format (TXD + payload)
1062 			 * 1: only cap field IE
1063 			 */
1064 			u8 type;
1065 			__le16 pkt_len;
1066 			u8 pkt[512];
1067 		} __packed beacon_tlv;
1068 	} req = {
1069 		.hdr = {
1070 			.bss_idx = mvif->mt76.idx,
1071 		},
1072 		.beacon_tlv = {
1073 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1074 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1075 			.enable = enable,
1076 		},
1077 	};
1078 	struct sk_buff *skb;
1079 
1080 	if (!enable)
1081 		goto out;
1082 
1083 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
1084 	if (!skb)
1085 		return -EINVAL;
1086 
1087 	if (skb->len > 512 - MT_TXD_SIZE) {
1088 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1089 		dev_kfree_skb(skb);
1090 		return -EINVAL;
1091 	}
1092 
1093 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1094 			      wcid, NULL, 0, NULL, 0, true);
1095 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1096 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1097 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1098 
1099 	if (offs.cntdwn_counter_offs[0]) {
1100 		u16 csa_offs;
1101 
1102 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1103 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1104 	}
1105 	dev_kfree_skb(skb);
1106 
1107 out:
1108 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1109 				 &req, sizeof(req), true);
1110 }
1111 
1112 static int
1113 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1114 		       bool enable)
1115 {
1116 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1117 
1118 	return mt76_connac_mcu_uni_add_dev(phy->mt76, &vif->bss_conf, &mvif->mt76,
1119 					   &mvif->sta.wcid, enable);
1120 }
1121 
1122 static int
1123 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1124 		       struct ieee80211_sta *sta, bool enable)
1125 {
1126 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1127 
1128 	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1129 					   enable, NULL);
1130 }
1131 
1132 static inline int
1133 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1134 		       struct ieee80211_sta *sta, bool enable)
1135 {
1136 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1137 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1138 }
1139 
1140 static int
1141 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1142 		     struct ieee80211_ampdu_params *params,
1143 		     bool enable)
1144 {
1145 	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1146 
1147 	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1148 				      MCU_UNI_CMD(STA_REC_UPDATE), enable,
1149 				      true);
1150 }
1151 
1152 static int
1153 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1154 		     struct ieee80211_ampdu_params *params,
1155 		     bool enable)
1156 {
1157 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1158 	struct mt7615_vif *mvif = msta->vif;
1159 	struct wtbl_req_hdr *wtbl_hdr;
1160 	struct tlv *sta_wtbl;
1161 	struct sk_buff *skb;
1162 	int err;
1163 
1164 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1165 					    &msta->wcid);
1166 	if (IS_ERR(skb))
1167 		return PTR_ERR(skb);
1168 
1169 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1170 
1171 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1172 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1173 	if (err < 0 || !enable)
1174 		return err;
1175 
1176 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1177 					    &msta->wcid);
1178 	if (IS_ERR(skb))
1179 		return PTR_ERR(skb);
1180 
1181 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1182 					   sizeof(struct tlv));
1183 
1184 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1185 						  WTBL_SET, sta_wtbl, &skb);
1186 	if (IS_ERR(wtbl_hdr))
1187 		return PTR_ERR(wtbl_hdr);
1188 
1189 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1190 				    sta_wtbl, wtbl_hdr);
1191 
1192 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1193 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
1194 }
1195 
1196 static int
1197 mt7615_mcu_sta_uni_update_hdr_trans(struct mt7615_dev *dev,
1198 				    struct ieee80211_vif *vif,
1199 				    struct ieee80211_sta *sta)
1200 {
1201 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1202 
1203 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1204 						    vif, &msta->wcid,
1205 						    MCU_UNI_CMD(STA_REC_UPDATE));
1206 }
1207 
1208 static const struct mt7615_mcu_ops uni_update_ops = {
1209 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1210 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1211 	.add_dev_info = mt7615_mcu_uni_add_dev,
1212 	.add_bss_info = mt7615_mcu_uni_add_bss,
1213 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1214 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1215 	.sta_add = mt7615_mcu_uni_add_sta,
1216 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1217 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1218 	.set_sta_decap_offload = mt7615_mcu_sta_uni_update_hdr_trans,
1219 };
1220 
1221 int mt7615_mcu_restart(struct mt76_dev *dev)
1222 {
1223 	return mt76_mcu_send_msg(dev, MCU_CMD(RESTART_DL_REQ), NULL, 0, true);
1224 }
1225 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1226 
1227 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1228 {
1229 	const struct mt7615_patch_hdr *hdr;
1230 	const struct firmware *fw = NULL;
1231 	int len, ret, sem;
1232 
1233 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1234 	if (ret)
1235 		return ret;
1236 
1237 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1238 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1239 		ret = -EINVAL;
1240 		goto release_fw;
1241 	}
1242 
1243 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1244 	switch (sem) {
1245 	case PATCH_IS_DL:
1246 		goto release_fw;
1247 	case PATCH_NOT_DL_SEM_SUCCESS:
1248 		break;
1249 	default:
1250 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1251 		ret = -EAGAIN;
1252 		goto release_fw;
1253 	}
1254 
1255 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1256 
1257 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1258 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1259 
1260 	len = fw->size - sizeof(*hdr);
1261 
1262 	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1263 					    DL_MODE_NEED_RSP);
1264 	if (ret) {
1265 		dev_err(dev->mt76.dev, "Download request failed\n");
1266 		goto out;
1267 	}
1268 
1269 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1270 				     fw->data + sizeof(*hdr), len);
1271 	if (ret) {
1272 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1273 		goto out;
1274 	}
1275 
1276 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1277 	if (ret)
1278 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1279 
1280 out:
1281 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1282 	switch (sem) {
1283 	case PATCH_REL_SEM_SUCCESS:
1284 		break;
1285 	default:
1286 		ret = -EAGAIN;
1287 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1288 		break;
1289 	}
1290 
1291 release_fw:
1292 	release_firmware(fw);
1293 
1294 	return ret;
1295 }
1296 
1297 static int
1298 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1299 			     const struct mt7615_fw_trailer *hdr,
1300 			     const u8 *data, bool is_cr4)
1301 {
1302 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1303 	int err, i, offset = 0;
1304 	u32 len, addr, mode;
1305 
1306 	for (i = 0; i < n_region; i++) {
1307 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1308 						   hdr[i].feature_set, is_cr4);
1309 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1310 		addr = le32_to_cpu(hdr[i].addr);
1311 
1312 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1313 						    mode);
1314 		if (err) {
1315 			dev_err(dev->mt76.dev, "Download request failed\n");
1316 			return err;
1317 		}
1318 
1319 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1320 					     data + offset, len);
1321 		if (err) {
1322 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1323 			return err;
1324 		}
1325 
1326 		offset += len;
1327 	}
1328 
1329 	return 0;
1330 }
1331 
1332 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1333 {
1334 	const struct mt7615_fw_trailer *hdr;
1335 	const struct firmware *fw;
1336 	int ret;
1337 
1338 	ret = request_firmware(&fw, name, dev->mt76.dev);
1339 	if (ret)
1340 		return ret;
1341 
1342 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1343 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1344 		ret = -EINVAL;
1345 		goto out;
1346 	}
1347 
1348 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1349 					N9_REGION_NUM * sizeof(*hdr));
1350 
1351 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1352 		 hdr->fw_ver, hdr->build_date);
1353 
1354 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1355 	if (ret)
1356 		goto out;
1357 
1358 	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1359 					     le32_to_cpu(hdr->addr),
1360 					     FW_START_OVERRIDE);
1361 	if (ret) {
1362 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1363 		goto out;
1364 	}
1365 
1366 	snprintf(dev->mt76.hw->wiphy->fw_version,
1367 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1368 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1369 
1370 	if (!is_mt7615(&dev->mt76)) {
1371 		dev->fw_ver = MT7615_FIRMWARE_V2;
1372 		dev->mcu_ops = &sta_update_ops;
1373 	} else {
1374 		dev->fw_ver = MT7615_FIRMWARE_V1;
1375 		dev->mcu_ops = &wtbl_update_ops;
1376 	}
1377 
1378 out:
1379 	release_firmware(fw);
1380 	return ret;
1381 }
1382 
1383 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1384 {
1385 	const struct mt7615_fw_trailer *hdr;
1386 	const struct firmware *fw;
1387 	int ret;
1388 
1389 	ret = request_firmware(&fw, name, dev->mt76.dev);
1390 	if (ret)
1391 		return ret;
1392 
1393 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1394 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1395 		ret = -EINVAL;
1396 		goto out;
1397 	}
1398 
1399 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1400 					CR4_REGION_NUM * sizeof(*hdr));
1401 
1402 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1403 		 hdr->fw_ver, hdr->build_date);
1404 
1405 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1406 	if (ret)
1407 		goto out;
1408 
1409 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1410 					     FW_START_WORKING_PDA_CR4);
1411 	if (ret) {
1412 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1413 		goto out;
1414 	}
1415 
1416 out:
1417 	release_firmware(fw);
1418 
1419 	return ret;
1420 }
1421 
1422 static int mt7615_load_ram(struct mt7615_dev *dev)
1423 {
1424 	int ret;
1425 
1426 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1427 	if (ret)
1428 		return ret;
1429 
1430 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1431 }
1432 
1433 static int mt7615_load_firmware(struct mt7615_dev *dev)
1434 {
1435 	int ret;
1436 	u32 val;
1437 
1438 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1439 
1440 	if (val != FW_STATE_FW_DOWNLOAD) {
1441 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1442 		return -EIO;
1443 	}
1444 
1445 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1446 	if (ret)
1447 		return ret;
1448 
1449 	ret = mt7615_load_ram(dev);
1450 	if (ret)
1451 		return ret;
1452 
1453 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1454 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1455 				       FW_STATE_RDY), 500)) {
1456 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1457 		return -EIO;
1458 	}
1459 
1460 	return 0;
1461 }
1462 
1463 static int mt7622_load_firmware(struct mt7615_dev *dev)
1464 {
1465 	int ret;
1466 	u32 val;
1467 
1468 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1469 
1470 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1471 	if (val != FW_STATE_FW_DOWNLOAD) {
1472 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1473 		return -EIO;
1474 	}
1475 
1476 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1477 	if (ret)
1478 		return ret;
1479 
1480 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1481 	if (ret)
1482 		return ret;
1483 
1484 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1485 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1486 				       FW_STATE_NORMAL_TRX), 1500)) {
1487 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1488 		return -EIO;
1489 	}
1490 
1491 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1492 
1493 	return 0;
1494 }
1495 
1496 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1497 {
1498 	struct {
1499 		u8 ctrl_val;
1500 		u8 pad[3];
1501 	} data = {
1502 		.ctrl_val = ctrl
1503 	};
1504 
1505 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST),
1506 				 &data, sizeof(data), true);
1507 }
1508 
1509 static int mt7615_mcu_cal_cache_apply(struct mt7615_dev *dev)
1510 {
1511 	struct {
1512 		bool cache_enable;
1513 		u8 pad[3];
1514 	} data = {
1515 		.cache_enable = true
1516 	};
1517 
1518 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CAL_CACHE), &data,
1519 				 sizeof(data), false);
1520 }
1521 
1522 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1523 {
1524 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1525 	const struct mt76_connac2_fw_trailer *hdr;
1526 	const struct mt7663_fw_buf *buf;
1527 	const struct firmware *fw;
1528 	const u8 *base_addr;
1529 	int i, ret;
1530 
1531 	ret = request_firmware(&fw, name, dev->mt76.dev);
1532 	if (ret)
1533 		return ret;
1534 
1535 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1536 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1537 		ret = -EINVAL;
1538 		goto out;
1539 	}
1540 
1541 	hdr = (const void *)(fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE);
1542 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1543 		 hdr->fw_ver, hdr->build_date);
1544 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1545 
1546 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1547 	for (i = 0; i < hdr->n_region; i++) {
1548 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1549 		u32 len, addr, mode;
1550 
1551 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1552 
1553 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1554 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1555 						   buf->feature_set, false);
1556 		addr = le32_to_cpu(buf->img_dest_addr);
1557 		len = le32_to_cpu(buf->img_size);
1558 
1559 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1560 						    mode);
1561 		if (ret) {
1562 			dev_err(dev->mt76.dev, "Download request failed\n");
1563 			goto out;
1564 		}
1565 
1566 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1567 					     fw->data + offset, len);
1568 		if (ret) {
1569 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1570 			goto out;
1571 		}
1572 
1573 		offset += le32_to_cpu(buf->img_size);
1574 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1575 			override_addr = le32_to_cpu(buf->img_dest_addr);
1576 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1577 				 i, override_addr);
1578 		}
1579 	}
1580 
1581 	if (override_addr)
1582 		flag |= FW_START_OVERRIDE;
1583 
1584 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1585 		 override_addr, flag);
1586 
1587 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1588 	if (ret) {
1589 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1590 		goto out;
1591 	}
1592 
1593 	snprintf(dev->mt76.hw->wiphy->fw_version,
1594 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1595 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1596 
1597 out:
1598 	release_firmware(fw);
1599 
1600 	return ret;
1601 }
1602 
1603 static int
1604 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1605 {
1606 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1607 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1608 	int ret;
1609 
1610 	if (!prefer_offload_fw) {
1611 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1612 		primary_rom = MT7663_ROM_PATCH;
1613 	}
1614 	selected_rom = primary_rom;
1615 
1616 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1617 	if (ret) {
1618 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1619 			 primary_rom, secondary_rom);
1620 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1621 					secondary_rom);
1622 		if (ret) {
1623 			dev_err(dev->mt76.dev, "failed to load %s",
1624 				secondary_rom);
1625 			return ret;
1626 		}
1627 		selected_rom = secondary_rom;
1628 	}
1629 
1630 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1631 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1632 		dev->fw_ver = MT7615_FIRMWARE_V3;
1633 		dev->mcu_ops = &uni_update_ops;
1634 	} else {
1635 		*n9_firmware = MT7663_FIRMWARE_N9;
1636 		dev->fw_ver = MT7615_FIRMWARE_V2;
1637 		dev->mcu_ops = &sta_update_ops;
1638 	}
1639 
1640 	return 0;
1641 }
1642 
1643 int __mt7663_load_firmware(struct mt7615_dev *dev)
1644 {
1645 	const char *n9_firmware;
1646 	int ret;
1647 
1648 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1649 	if (ret) {
1650 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1651 		return -EIO;
1652 	}
1653 
1654 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1655 	if (ret)
1656 		return ret;
1657 
1658 	ret = mt7663_load_n9(dev, n9_firmware);
1659 	if (ret)
1660 		return ret;
1661 
1662 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1663 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1664 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1665 				     MT7663_TOP_MISC2_FW_STATE);
1666 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1667 		return -EIO;
1668 	}
1669 
1670 #ifdef CONFIG_PM
1671 	if (mt7615_firmware_offload(dev))
1672 		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1673 #endif /* CONFIG_PM */
1674 
1675 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1676 
1677 	return 0;
1678 }
1679 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1680 
1681 static int mt7663_load_firmware(struct mt7615_dev *dev)
1682 {
1683 	int ret;
1684 
1685 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1686 
1687 	ret = __mt7663_load_firmware(dev);
1688 	if (ret)
1689 		return ret;
1690 
1691 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1692 
1693 	return 0;
1694 }
1695 
1696 int mt7615_mcu_init(struct mt7615_dev *dev)
1697 {
1698 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1699 		.headroom = sizeof(struct mt7615_mcu_txd),
1700 		.mcu_skb_send_msg = mt7615_mcu_send_message,
1701 		.mcu_parse_response = mt7615_mcu_parse_response,
1702 	};
1703 	int ret;
1704 
1705 	dev->mt76.mcu_ops = &mt7615_mcu_ops;
1706 
1707 	ret = mt7615_mcu_drv_pmctrl(dev);
1708 	if (ret)
1709 		return ret;
1710 
1711 	switch (mt76_chip(&dev->mt76)) {
1712 	case 0x7622:
1713 		ret = mt7622_load_firmware(dev);
1714 		break;
1715 	case 0x7663:
1716 		ret = mt7663_load_firmware(dev);
1717 		break;
1718 	default:
1719 		ret = mt7615_load_firmware(dev);
1720 		break;
1721 	}
1722 	if (ret)
1723 		return ret;
1724 
1725 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1726 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1727 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1728 
1729 	if (dev->dbdc_support) {
1730 		ret = mt7615_mcu_cal_cache_apply(dev);
1731 		if (ret)
1732 			return ret;
1733 	}
1734 
1735 	return mt7615_mcu_fw_log_2_host(dev, 0);
1736 }
1737 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1738 
1739 void mt7615_mcu_exit(struct mt7615_dev *dev)
1740 {
1741 	mt7615_mcu_restart(&dev->mt76);
1742 	mt7615_mcu_set_fw_ctrl(dev);
1743 	skb_queue_purge(&dev->mt76.mcu.res_q);
1744 }
1745 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1746 
1747 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1748 {
1749 	struct {
1750 		u8 buffer_mode;
1751 		u8 content_format;
1752 		__le16 len;
1753 	} __packed req_hdr = {
1754 		.buffer_mode = 1,
1755 	};
1756 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1757 	struct sk_buff *skb;
1758 	int eep_len, offset;
1759 
1760 	switch (mt76_chip(&dev->mt76)) {
1761 	case 0x7622:
1762 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1763 		offset = MT_EE_NIC_CONF_0;
1764 		break;
1765 	case 0x7663:
1766 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1767 		req_hdr.content_format = 1;
1768 		offset = MT_EE_CHIP_ID;
1769 		break;
1770 	default:
1771 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1772 		offset = MT_EE_NIC_CONF_0;
1773 		break;
1774 	}
1775 
1776 	req_hdr.len = cpu_to_le16(eep_len);
1777 
1778 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1779 	if (!skb)
1780 		return -ENOMEM;
1781 
1782 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1783 	skb_put_data(skb, eep + offset, eep_len);
1784 
1785 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1786 				     MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
1787 }
1788 
1789 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1790 		       const struct ieee80211_tx_queue_params *params)
1791 {
1792 #define WMM_AIFS_SET	BIT(0)
1793 #define WMM_CW_MIN_SET	BIT(1)
1794 #define WMM_CW_MAX_SET	BIT(2)
1795 #define WMM_TXOP_SET	BIT(3)
1796 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1797 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1798 	struct req_data {
1799 		u8 number;
1800 		u8 rsv[3];
1801 		u8 queue;
1802 		u8 valid;
1803 		u8 aifs;
1804 		u8 cw_min;
1805 		__le16 cw_max;
1806 		__le16 txop;
1807 	} __packed req = {
1808 		.number = 1,
1809 		.queue = queue,
1810 		.valid = WMM_PARAM_SET,
1811 		.aifs = params->aifs,
1812 		.cw_min = 5,
1813 		.cw_max = cpu_to_le16(10),
1814 		.txop = cpu_to_le16(params->txop),
1815 	};
1816 
1817 	if (params->cw_min)
1818 		req.cw_min = fls(params->cw_min);
1819 	if (params->cw_max)
1820 		req.cw_max = cpu_to_le16(fls(params->cw_max));
1821 
1822 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
1823 				 &req, sizeof(req), true);
1824 }
1825 
1826 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1827 {
1828 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1829 	struct dbdc_entry {
1830 		u8 type;
1831 		u8 index;
1832 		u8 band;
1833 		u8 _rsv;
1834 	};
1835 	struct {
1836 		u8 enable;
1837 		u8 num;
1838 		u8 _rsv[2];
1839 		struct dbdc_entry entry[64];
1840 	} req = {
1841 		.enable = !!ext_phy,
1842 	};
1843 	int i;
1844 
1845 	if (!ext_phy)
1846 		goto out;
1847 
1848 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
1849 	do { \
1850 		req.entry[req.num].type = _type;		\
1851 		req.entry[req.num].index = _idx;		\
1852 		req.entry[req.num++].band = _band;		\
1853 	} while (0)
1854 
1855 	for (i = 0; i < 4; i++) {
1856 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1857 
1858 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1859 	}
1860 
1861 	for (i = 0; i < 14; i++) {
1862 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1863 
1864 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1865 	}
1866 
1867 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1868 
1869 	for (i = 0; i < 3; i++)
1870 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
1871 
1872 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
1873 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
1874 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
1875 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
1876 
1877 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
1878 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
1879 
1880 out:
1881 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DBDC_CTRL), &req,
1882 				 sizeof(req), true);
1883 }
1884 
1885 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
1886 {
1887 	struct {
1888 		__le16 tag;
1889 		__le16 min_lpn;
1890 	} req = {
1891 		.tag = cpu_to_le16(0x1),
1892 		.min_lpn = cpu_to_le16(val),
1893 	};
1894 
1895 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1896 				 &req, sizeof(req), true);
1897 }
1898 
1899 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
1900 			    const struct mt7615_dfs_pulse *pulse)
1901 {
1902 	struct {
1903 		__le16 tag;
1904 		__le32 max_width;	/* us */
1905 		__le32 max_pwr;		/* dbm */
1906 		__le32 min_pwr;		/* dbm */
1907 		__le32 min_stgr_pri;	/* us */
1908 		__le32 max_stgr_pri;	/* us */
1909 		__le32 min_cr_pri;	/* us */
1910 		__le32 max_cr_pri;	/* us */
1911 	} req = {
1912 		.tag = cpu_to_le16(0x3),
1913 #define __req_field(field) .field = cpu_to_le32(pulse->field)
1914 		__req_field(max_width),
1915 		__req_field(max_pwr),
1916 		__req_field(min_pwr),
1917 		__req_field(min_stgr_pri),
1918 		__req_field(max_stgr_pri),
1919 		__req_field(min_cr_pri),
1920 		__req_field(max_cr_pri),
1921 #undef  __req_field
1922 	};
1923 
1924 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1925 				 &req, sizeof(req), true);
1926 }
1927 
1928 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
1929 			    const struct mt7615_dfs_pattern *pattern)
1930 {
1931 	struct {
1932 		__le16 tag;
1933 		__le16 radar_type;
1934 		u8 enb;
1935 		u8 stgr;
1936 		u8 min_crpn;
1937 		u8 max_crpn;
1938 		u8 min_crpr;
1939 		u8 min_pw;
1940 		u8 max_pw;
1941 		__le32 min_pri;
1942 		__le32 max_pri;
1943 		u8 min_crbn;
1944 		u8 max_crbn;
1945 		u8 min_stgpn;
1946 		u8 max_stgpn;
1947 		u8 min_stgpr;
1948 	} req = {
1949 		.tag = cpu_to_le16(0x2),
1950 		.radar_type = cpu_to_le16(index),
1951 #define __req_field_u8(field) .field = pattern->field
1952 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
1953 		__req_field_u8(enb),
1954 		__req_field_u8(stgr),
1955 		__req_field_u8(min_crpn),
1956 		__req_field_u8(max_crpn),
1957 		__req_field_u8(min_crpr),
1958 		__req_field_u8(min_pw),
1959 		__req_field_u8(max_pw),
1960 		__req_field_u32(min_pri),
1961 		__req_field_u32(max_pri),
1962 		__req_field_u8(min_crbn),
1963 		__req_field_u8(max_crbn),
1964 		__req_field_u8(min_stgpn),
1965 		__req_field_u8(max_stgpn),
1966 		__req_field_u8(min_stgpr),
1967 #undef __req_field_u8
1968 #undef __req_field_u32
1969 	};
1970 
1971 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1972 				 &req, sizeof(req), true);
1973 }
1974 
1975 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
1976 {
1977 	struct {
1978 		u8 pulse_num;
1979 		u8 rsv[3];
1980 		struct {
1981 			__le32 start_time;
1982 			__le16 width;
1983 			__le16 power;
1984 		} pattern[32];
1985 	} req = {
1986 		.pulse_num = dev->radar_pattern.n_pulses,
1987 	};
1988 	u32 start_time = ktime_to_ms(ktime_get_boottime());
1989 	int i;
1990 
1991 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
1992 		return -EINVAL;
1993 
1994 	/* TODO: add some noise here */
1995 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
1996 		u32 ts = start_time + i * dev->radar_pattern.period;
1997 
1998 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
1999 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2000 		req.pattern[i].start_time = cpu_to_le32(ts);
2001 	}
2002 
2003 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_PATTERN),
2004 				 &req, sizeof(req), false);
2005 }
2006 
2007 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2008 {
2009 	struct mt76_phy *mphy = phy->mt76;
2010 	struct ieee80211_hw *hw = mphy->hw;
2011 	struct mt76_power_limits limits;
2012 	s8 *limits_array = (s8 *)&limits;
2013 	int n_chains = hweight8(mphy->antenna_mask);
2014 	int tx_power = hw->conf.power_level * 2;
2015 	int i;
2016 	static const u8 sku_mapping[] = {
2017 #define SKU_FIELD(_type, _field) \
2018 		[MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2019 		SKU_FIELD(CCK_1_2, cck[0]),
2020 		SKU_FIELD(CCK_55_11, cck[2]),
2021 		SKU_FIELD(OFDM_6_9, ofdm[0]),
2022 		SKU_FIELD(OFDM_12_18, ofdm[2]),
2023 		SKU_FIELD(OFDM_24_36, ofdm[4]),
2024 		SKU_FIELD(OFDM_48, ofdm[6]),
2025 		SKU_FIELD(OFDM_54, ofdm[7]),
2026 		SKU_FIELD(HT20_0_8, mcs[0][0]),
2027 		SKU_FIELD(HT20_32, ofdm[0]),
2028 		SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2029 		SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2030 		SKU_FIELD(HT20_5_13, mcs[0][5]),
2031 		SKU_FIELD(HT20_6_14, mcs[0][6]),
2032 		SKU_FIELD(HT20_7_15, mcs[0][7]),
2033 		SKU_FIELD(HT40_0_8, mcs[1][0]),
2034 		SKU_FIELD(HT40_32, ofdm[0]),
2035 		SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2036 		SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2037 		SKU_FIELD(HT40_5_13, mcs[1][5]),
2038 		SKU_FIELD(HT40_6_14, mcs[1][6]),
2039 		SKU_FIELD(HT40_7_15, mcs[1][7]),
2040 		SKU_FIELD(VHT20_0, mcs[0][0]),
2041 		SKU_FIELD(VHT20_1_2, mcs[0][1]),
2042 		SKU_FIELD(VHT20_3_4, mcs[0][3]),
2043 		SKU_FIELD(VHT20_5_6, mcs[0][5]),
2044 		SKU_FIELD(VHT20_7, mcs[0][7]),
2045 		SKU_FIELD(VHT20_8, mcs[0][8]),
2046 		SKU_FIELD(VHT20_9, mcs[0][9]),
2047 		SKU_FIELD(VHT40_0, mcs[1][0]),
2048 		SKU_FIELD(VHT40_1_2, mcs[1][1]),
2049 		SKU_FIELD(VHT40_3_4, mcs[1][3]),
2050 		SKU_FIELD(VHT40_5_6, mcs[1][5]),
2051 		SKU_FIELD(VHT40_7, mcs[1][7]),
2052 		SKU_FIELD(VHT40_8, mcs[1][8]),
2053 		SKU_FIELD(VHT40_9, mcs[1][9]),
2054 		SKU_FIELD(VHT80_0, mcs[2][0]),
2055 		SKU_FIELD(VHT80_1_2, mcs[2][1]),
2056 		SKU_FIELD(VHT80_3_4, mcs[2][3]),
2057 		SKU_FIELD(VHT80_5_6, mcs[2][5]),
2058 		SKU_FIELD(VHT80_7, mcs[2][7]),
2059 		SKU_FIELD(VHT80_8, mcs[2][8]),
2060 		SKU_FIELD(VHT80_9, mcs[2][9]),
2061 		SKU_FIELD(VHT160_0, mcs[3][0]),
2062 		SKU_FIELD(VHT160_1_2, mcs[3][1]),
2063 		SKU_FIELD(VHT160_3_4, mcs[3][3]),
2064 		SKU_FIELD(VHT160_5_6, mcs[3][5]),
2065 		SKU_FIELD(VHT160_7, mcs[3][7]),
2066 		SKU_FIELD(VHT160_8, mcs[3][8]),
2067 		SKU_FIELD(VHT160_9, mcs[3][9]),
2068 #undef SKU_FIELD
2069 	};
2070 
2071 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan, tx_power);
2072 	tx_power -= mt76_tx_power_path_delta(n_chains);
2073 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2074 					      &limits, tx_power);
2075 	mphy->txpower_cur = tx_power;
2076 
2077 	if (is_mt7663(mphy->dev)) {
2078 		memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2079 		return;
2080 	}
2081 
2082 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2083 		sku[i] = limits_array[sku_mapping[i]];
2084 
2085 	for (i = 0; i < 4; i++) {
2086 		int delta = 0;
2087 
2088 		if (i < n_chains - 1)
2089 			delta = mt76_tx_power_path_delta(n_chains) -
2090 				mt76_tx_power_path_delta(i + 1);
2091 		sku[MT_SKU_1SS_DELTA + i] = delta;
2092 	}
2093 }
2094 
2095 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2096 {
2097 	static const u8 width_to_bw[] = {
2098 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2099 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2100 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2101 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2102 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2103 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2104 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2105 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2106 	};
2107 
2108 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2109 		return 0;
2110 
2111 	return width_to_bw[chandef->width];
2112 }
2113 
2114 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2115 {
2116 	struct mt7615_dev *dev = phy->dev;
2117 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2118 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2119 	struct {
2120 		u8 control_chan;
2121 		u8 center_chan;
2122 		u8 bw;
2123 		u8 tx_streams;
2124 		u8 rx_streams_mask;
2125 		u8 switch_reason;
2126 		u8 band_idx;
2127 		/* for 80+80 only */
2128 		u8 center_chan2;
2129 		__le16 cac_case;
2130 		u8 channel_band;
2131 		u8 rsv0;
2132 		__le32 outband_freq;
2133 		u8 txpower_drop;
2134 		u8 rsv1[3];
2135 		u8 txpower_sku[53];
2136 		u8 rsv2[3];
2137 	} req = {
2138 		.control_chan = chandef->chan->hw_value,
2139 		.center_chan = ieee80211_frequency_to_channel(freq1),
2140 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2141 		.rx_streams_mask = phy->mt76->chainmask,
2142 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2143 	};
2144 
2145 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2146 	    phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
2147 		req.switch_reason = CH_SWITCH_NORMAL;
2148 	else if (phy->mt76->offchannel)
2149 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2150 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2151 					  NL80211_IFTYPE_AP))
2152 		req.switch_reason = CH_SWITCH_DFS;
2153 	else
2154 		req.switch_reason = CH_SWITCH_NORMAL;
2155 
2156 	req.band_idx = phy != &dev->phy;
2157 	req.bw = mt7615_mcu_chan_bw(chandef);
2158 
2159 	if (mt76_testmode_enabled(phy->mt76))
2160 		memset(req.txpower_sku, 0x3f, 49);
2161 	else
2162 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2163 
2164 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2165 }
2166 
2167 int mt7615_mcu_get_temperature(struct mt7615_dev *dev)
2168 {
2169 	struct {
2170 		u8 action;
2171 		u8 rsv[3];
2172 	} req = {};
2173 
2174 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL),
2175 				 &req, sizeof(req), true);
2176 }
2177 
2178 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2179 			      u32 val)
2180 {
2181 	struct {
2182 		u8 test_mode_en;
2183 		u8 param_idx;
2184 		u8 _rsv[2];
2185 
2186 		__le32 value;
2187 
2188 		u8 pad[8];
2189 	} req = {
2190 		.test_mode_en = test_mode,
2191 		.param_idx = param,
2192 		.value = cpu_to_le32(val),
2193 	};
2194 
2195 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
2196 				 &req, sizeof(req), false);
2197 }
2198 
2199 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2200 {
2201 	struct mt7615_dev *dev = phy->dev;
2202 	struct {
2203 		u8 format_id;
2204 		u8 sku_enable;
2205 		u8 band_idx;
2206 		u8 rsv;
2207 	} req = {
2208 		.format_id = 0,
2209 		.band_idx = phy != &dev->phy,
2210 		.sku_enable = enable,
2211 	};
2212 
2213 	return mt76_mcu_send_msg(&dev->mt76,
2214 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
2215 				 &req, sizeof(req), true);
2216 }
2217 
2218 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2219 {
2220 	int i;
2221 
2222 	for (i = 0; i < n_freqs; i++)
2223 		if (cur == freqs[i])
2224 			return i;
2225 
2226 	return -1;
2227 }
2228 
2229 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2230 {
2231 	static const u16 freq_list[] = {
2232 		4980, 5805, 5905, 5190,
2233 		5230, 5270, 5310, 5350,
2234 		5390, 5430, 5470, 5510,
2235 		5550, 5590, 5630, 5670,
2236 		5710, 5755, 5795, 5835,
2237 		5875, 5210, 5290, 5370,
2238 		5450, 5530, 5610, 5690,
2239 		5775, 5855
2240 	};
2241 	static const u16 freq_bw40[] = {
2242 		5190, 5230, 5270, 5310,
2243 		5350, 5390, 5430, 5470,
2244 		5510, 5550, 5590, 5630,
2245 		5670, 5710, 5755, 5795,
2246 		5835, 5875
2247 	};
2248 	int offset_2g = ARRAY_SIZE(freq_list);
2249 	int idx;
2250 
2251 	if (freq < 4000) {
2252 		if (freq < 2427)
2253 			return offset_2g;
2254 		if (freq < 2442)
2255 			return offset_2g + 1;
2256 		if (freq < 2457)
2257 			return offset_2g + 2;
2258 
2259 		return offset_2g + 3;
2260 	}
2261 
2262 	switch (bw) {
2263 	case NL80211_CHAN_WIDTH_80:
2264 	case NL80211_CHAN_WIDTH_80P80:
2265 	case NL80211_CHAN_WIDTH_160:
2266 		break;
2267 	default:
2268 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2269 					   freq + 10);
2270 		if (idx >= 0) {
2271 			freq = freq_bw40[idx];
2272 			break;
2273 		}
2274 
2275 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2276 					   freq - 10);
2277 		if (idx >= 0) {
2278 			freq = freq_bw40[idx];
2279 			break;
2280 		}
2281 		fallthrough;
2282 	case NL80211_CHAN_WIDTH_40:
2283 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2284 					   freq);
2285 		if (idx >= 0)
2286 			break;
2287 
2288 		return -1;
2289 
2290 	}
2291 
2292 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2293 }
2294 
2295 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2296 {
2297 	struct mt7615_dev *dev = phy->dev;
2298 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2299 	int freq2 = chandef->center_freq2;
2300 	int ret;
2301 	struct {
2302 		u8 direction;
2303 		u8 runtime_calibration;
2304 		u8 _rsv[2];
2305 
2306 		__le16 center_freq;
2307 		u8 bw;
2308 		u8 band;
2309 		u8 is_freq2;
2310 		u8 success;
2311 		u8 dbdc_en;
2312 
2313 		u8 _rsv2;
2314 
2315 		struct {
2316 			__le32 sx0_i_lna[4];
2317 			__le32 sx0_q_lna[4];
2318 
2319 			__le32 sx2_i_lna[4];
2320 			__le32 sx2_q_lna[4];
2321 		} dcoc_data[4];
2322 	} req = {
2323 		.direction = 1,
2324 
2325 		.bw = mt7615_mcu_chan_bw(chandef),
2326 		.band = chandef->center_freq1 > 4000,
2327 		.dbdc_en = !!dev->mt76.phys[MT_BAND1],
2328 	};
2329 	u16 center_freq = chandef->center_freq1;
2330 	int freq_idx;
2331 	u8 *eep = dev->mt76.eeprom.data;
2332 
2333 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2334 		return 0;
2335 
2336 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2337 		freq2 = center_freq + 40;
2338 		center_freq -= 40;
2339 	}
2340 
2341 again:
2342 	req.runtime_calibration = 1;
2343 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2344 	if (freq_idx < 0)
2345 		goto out;
2346 
2347 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2348 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2349 	       sizeof(req.dcoc_data));
2350 	req.runtime_calibration = 0;
2351 
2352 out:
2353 	req.center_freq = cpu_to_le16(center_freq);
2354 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RXDCOC_CAL), &req,
2355 				sizeof(req), true);
2356 
2357 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2358 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2359 		req.is_freq2 = true;
2360 		center_freq = freq2;
2361 		goto again;
2362 	}
2363 
2364 	return ret;
2365 }
2366 
2367 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2368 {
2369 	static const u16 freq_list[] = {
2370 		4920, 4940, 4960, 4980,
2371 		5040, 5060, 5080, 5180,
2372 		5200, 5220, 5240, 5260,
2373 		5280, 5300, 5320, 5340,
2374 		5360, 5380, 5400, 5420,
2375 		5440, 5460, 5480, 5500,
2376 		5520, 5540, 5560, 5580,
2377 		5600, 5620, 5640, 5660,
2378 		5680, 5700, 5720, 5745,
2379 		5765, 5785, 5805, 5825,
2380 		5845, 5865, 5885, 5905
2381 	};
2382 	int offset_2g = ARRAY_SIZE(freq_list);
2383 	int idx;
2384 
2385 	if (freq < 4000) {
2386 		if (freq < 2432)
2387 			return offset_2g;
2388 		if (freq < 2457)
2389 			return offset_2g + 1;
2390 
2391 		return offset_2g + 2;
2392 	}
2393 
2394 	if (bw != NL80211_CHAN_WIDTH_20) {
2395 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2396 					   freq + 10);
2397 		if (idx >= 0)
2398 			return idx;
2399 
2400 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2401 					   freq - 10);
2402 		if (idx >= 0)
2403 			return idx;
2404 	}
2405 
2406 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2407 }
2408 
2409 
2410 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2411 {
2412 	struct mt7615_dev *dev = phy->dev;
2413 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2414 	int freq2 = chandef->center_freq2;
2415 	int ret;
2416 	struct {
2417 		u8 direction;
2418 		u8 runtime_calibration;
2419 		u8 _rsv[2];
2420 
2421 		__le16 center_freq;
2422 		u8 bw;
2423 		u8 band;
2424 		u8 is_freq2;
2425 		u8 success;
2426 		u8 dbdc_en;
2427 
2428 		u8 _rsv2;
2429 
2430 		struct {
2431 			struct {
2432 				u32 dpd_g0;
2433 				u8 data[32];
2434 			} wf0, wf1;
2435 
2436 			struct {
2437 				u32 dpd_g0_prim;
2438 				u32 dpd_g0_sec;
2439 				u8 data_prim[32];
2440 				u8 data_sec[32];
2441 			} wf2, wf3;
2442 		} dpd_data;
2443 	} req = {
2444 		.direction = 1,
2445 
2446 		.bw = mt7615_mcu_chan_bw(chandef),
2447 		.band = chandef->center_freq1 > 4000,
2448 		.dbdc_en = !!dev->mt76.phys[MT_BAND1],
2449 	};
2450 	u16 center_freq = chandef->center_freq1;
2451 	int freq_idx;
2452 	u8 *eep = dev->mt76.eeprom.data;
2453 
2454 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2455 		return 0;
2456 
2457 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2458 		freq2 = center_freq + 40;
2459 		center_freq -= 40;
2460 	}
2461 
2462 again:
2463 	req.runtime_calibration = 1;
2464 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2465 	if (freq_idx < 0)
2466 		goto out;
2467 
2468 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2469 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2470 	       sizeof(req.dpd_data));
2471 	req.runtime_calibration = 0;
2472 
2473 out:
2474 	req.center_freq = cpu_to_le16(center_freq);
2475 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXDPD_CAL),
2476 				&req, sizeof(req), true);
2477 
2478 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2479 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2480 		req.is_freq2 = true;
2481 		center_freq = freq2;
2482 		goto again;
2483 	}
2484 
2485 	return ret;
2486 }
2487 
2488 int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2489 {
2490 	struct {
2491 		u8 operation;
2492 		u8 count;
2493 		u8 _rsv[2];
2494 		u8 index;
2495 		u8 enable;
2496 		__le16 etype;
2497 	} req = {
2498 		.operation = 1,
2499 		.count = 1,
2500 		.enable = 1,
2501 		.etype = cpu_to_le16(ETH_P_PAE),
2502 	};
2503 
2504 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2505 				 &req, sizeof(req), false);
2506 }
2507 
2508 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2509 			  bool enable)
2510 {
2511 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2512 	struct {
2513 		u8 bss_idx;
2514 		u8 dtim_period;
2515 		__le16 aid;
2516 		__le16 bcn_interval;
2517 		__le16 atim_window;
2518 		u8 uapsd;
2519 		u8 bmc_delivered_ac;
2520 		u8 bmc_triggered_ac;
2521 		u8 pad;
2522 	} req = {
2523 		.bss_idx = mvif->mt76.idx,
2524 		.aid = cpu_to_le16(vif->cfg.aid),
2525 		.dtim_period = vif->bss_conf.dtim_period,
2526 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2527 	};
2528 	struct {
2529 		u8 bss_idx;
2530 		u8 pad[3];
2531 	} req_hdr = {
2532 		.bss_idx = mvif->mt76.idx,
2533 	};
2534 	int err;
2535 
2536 	if (vif->type != NL80211_IFTYPE_STATION)
2537 		return 0;
2538 
2539 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
2540 				&req_hdr, sizeof(req_hdr), false);
2541 	if (err < 0 || !enable)
2542 		return err;
2543 
2544 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
2545 				 &req, sizeof(req), false);
2546 }
2547 
2548 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2549 		       struct ieee80211_channel *chan, int duration)
2550 {
2551 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2552 	struct mt7615_dev *dev = phy->dev;
2553 	struct mt7615_roc_tlv req = {
2554 		.bss_idx = mvif->mt76.idx,
2555 		.active = !chan,
2556 		.max_interval = cpu_to_le32(duration),
2557 		.primary_chan = chan ? chan->hw_value : 0,
2558 		.band = chan ? chan->band : 0,
2559 		.req_type = 2,
2560 	};
2561 
2562 	phy->roc_grant = false;
2563 
2564 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC),
2565 				 &req, sizeof(req), false);
2566 }
2567