1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
75 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
76 
77 #define DL_MODE_ENCRYPT			BIT(0)
78 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
79 #define DL_MODE_RESET_SEC_IV		BIT(3)
80 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
82 #define DL_MODE_NEED_RSP		BIT(31)
83 
84 #define FW_START_OVERRIDE		BIT(0)
85 #define FW_START_WORKING_PDA_CR4	BIT(2)
86 
87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
88 			 int cmd, int *wait_seq)
89 {
90 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
91 	struct mt7615_uni_txd *uni_txd;
92 	struct mt7615_mcu_txd *mcu_txd;
93 	u8 seq, q_idx, pkt_fmt;
94 	__le32 *txd;
95 	u32 val;
96 
97 	/* TODO: make dynamic based on msg type */
98 	dev->mt76.mcu.timeout = 20 * HZ;
99 
100 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
101 	if (!seq)
102 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
103 	if (wait_seq)
104 		*wait_seq = seq;
105 
106 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
107 	txd = (__le32 *)skb_push(skb, txd_len);
108 
109 	if (cmd != MCU_CMD(FW_SCATTER)) {
110 		q_idx = MT_TX_MCU_PORT_RX_Q0;
111 		pkt_fmt = MT_TX_TYPE_CMD;
112 	} else {
113 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
114 		pkt_fmt = MT_TX_TYPE_FW;
115 	}
116 
117 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
118 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
119 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
120 	txd[0] = cpu_to_le32(val);
121 
122 	val = MT_TXD1_LONG_FORMAT |
123 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
124 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
125 	txd[1] = cpu_to_le32(val);
126 
127 	if (cmd & __MCU_CMD_FIELD_UNI) {
128 		uni_txd = (struct mt7615_uni_txd *)txd;
129 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
130 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
131 		uni_txd->cid = cpu_to_le16(mcu_cmd);
132 		uni_txd->s2d_index = MCU_S2D_H2N;
133 		uni_txd->pkt_type = MCU_PKT_ID;
134 		uni_txd->seq = seq;
135 
136 		return;
137 	}
138 
139 	mcu_txd = (struct mt7615_mcu_txd *)txd;
140 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
141 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
142 	mcu_txd->s2d_index = MCU_S2D_H2N;
143 	mcu_txd->pkt_type = MCU_PKT_ID;
144 	mcu_txd->seq = seq;
145 	mcu_txd->cid = mcu_cmd;
146 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
147 
148 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
149 		if (cmd & __MCU_CMD_FIELD_QUERY)
150 			mcu_txd->set_query = MCU_Q_QUERY;
151 		else
152 			mcu_txd->set_query = MCU_Q_SET;
153 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
154 	} else {
155 		mcu_txd->set_query = MCU_Q_NA;
156 	}
157 }
158 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
159 
160 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
161 			      struct sk_buff *skb, int seq)
162 {
163 	struct mt7615_mcu_rxd *rxd;
164 	int ret = 0;
165 
166 	if (!skb) {
167 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
168 			cmd, seq);
169 		return -ETIMEDOUT;
170 	}
171 
172 	rxd = (struct mt7615_mcu_rxd *)skb->data;
173 	if (seq != rxd->seq)
174 		return -EAGAIN;
175 
176 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
177 		skb_pull(skb, sizeof(*rxd) - 4);
178 		ret = *skb->data;
179 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
180 		skb_pull(skb, sizeof(*rxd));
181 		ret = le32_to_cpu(*(__le32 *)skb->data);
182 	} else if (cmd == MCU_EXT_QUERY(RF_REG_ACCESS)) {
183 		skb_pull(skb, sizeof(*rxd));
184 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
185 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
186 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
187 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
188 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
189 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
190 		   cmd == MCU_UNI_CMD(SUSPEND)) {
191 		struct mt7615_mcu_uni_event *event;
192 
193 		skb_pull(skb, sizeof(*rxd));
194 		event = (struct mt7615_mcu_uni_event *)skb->data;
195 		ret = le32_to_cpu(event->status);
196 	} else if (cmd == MCU_CE_QUERY(REG_READ)) {
197 		struct mt7615_mcu_reg_event *event;
198 
199 		skb_pull(skb, sizeof(*rxd));
200 		event = (struct mt7615_mcu_reg_event *)skb->data;
201 		ret = (int)le32_to_cpu(event->val);
202 	}
203 
204 	return ret;
205 }
206 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
207 
208 static int
209 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
210 			int cmd, int *seq)
211 {
212 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
213 	enum mt76_mcuq_id qid;
214 
215 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
216 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
217 		qid = MT_MCUQ_WM;
218 	else
219 		qid = MT_MCUQ_FWDL;
220 
221 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
222 }
223 
224 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
225 {
226 	struct {
227 		__le32 wifi_stream;
228 		__le32 address;
229 		__le32 data;
230 	} req = {
231 		.wifi_stream = cpu_to_le32(wf),
232 		.address = cpu_to_le32(reg),
233 	};
234 
235 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
236 				 &req, sizeof(req), true);
237 }
238 
239 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
240 {
241 	struct {
242 		__le32 wifi_stream;
243 		__le32 address;
244 		__le32 data;
245 	} req = {
246 		.wifi_stream = cpu_to_le32(wf),
247 		.address = cpu_to_le32(reg),
248 		.data = cpu_to_le32(val),
249 	};
250 
251 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
252 				 &req, sizeof(req), false);
253 }
254 
255 void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
256 {
257 	if (!is_mt7622(&dev->mt76))
258 		return;
259 
260 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
261 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
262 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
263 }
264 EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
265 
266 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
267 {
268 	struct mt76_phy *mphy = &dev->mt76.phy;
269 	struct mt76_connac_pm *pm = &dev->pm;
270 	struct mt76_dev *mdev = &dev->mt76;
271 	u32 addr;
272 	int err;
273 
274 	if (is_mt7663(mdev)) {
275 		/* Clear firmware own via N9 eint */
276 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
277 		mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
278 
279 		addr = MT_CONN_HIF_ON_LPCTL;
280 	} else {
281 		addr = MT_CFG_LPCR_HOST;
282 	}
283 
284 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
285 
286 	mt7622_trigger_hif_int(dev, true);
287 
288 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
289 
290 	mt7622_trigger_hif_int(dev, false);
291 
292 	if (err) {
293 		dev_err(mdev->dev, "driver own failed\n");
294 		return -ETIMEDOUT;
295 	}
296 
297 	clear_bit(MT76_STATE_PM, &mphy->state);
298 
299 	pm->stats.last_wake_event = jiffies;
300 	pm->stats.doze_time += pm->stats.last_wake_event -
301 			       pm->stats.last_doze_event;
302 
303 	return 0;
304 }
305 
306 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
307 {
308 	struct mt76_phy *mphy = &dev->mt76.phy;
309 	struct mt76_connac_pm *pm = &dev->pm;
310 	int i, err = 0;
311 
312 	mutex_lock(&pm->mutex);
313 
314 	if (!test_bit(MT76_STATE_PM, &mphy->state))
315 		goto out;
316 
317 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
318 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
319 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
320 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
321 			break;
322 	}
323 
324 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
325 		dev_err(dev->mt76.dev, "driver own failed\n");
326 		err = -EIO;
327 		goto out;
328 	}
329 	clear_bit(MT76_STATE_PM, &mphy->state);
330 
331 	pm->stats.last_wake_event = jiffies;
332 	pm->stats.doze_time += pm->stats.last_wake_event -
333 			       pm->stats.last_doze_event;
334 out:
335 	mutex_unlock(&pm->mutex);
336 
337 	return err;
338 }
339 
340 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
341 {
342 	struct mt76_phy *mphy = &dev->mt76.phy;
343 	struct mt76_connac_pm *pm = &dev->pm;
344 	int err = 0;
345 	u32 addr;
346 
347 	mutex_lock(&pm->mutex);
348 
349 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
350 		goto out;
351 
352 	mt7622_trigger_hif_int(dev, true);
353 
354 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
355 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
356 
357 	if (is_mt7622(&dev->mt76) &&
358 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
359 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
360 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
361 		clear_bit(MT76_STATE_PM, &mphy->state);
362 		err = -EIO;
363 	}
364 
365 	mt7622_trigger_hif_int(dev, false);
366 
367 	pm->stats.last_doze_event = jiffies;
368 	pm->stats.awake_time += pm->stats.last_doze_event -
369 				pm->stats.last_wake_event;
370 out:
371 	mutex_unlock(&pm->mutex);
372 
373 	return err;
374 }
375 
376 static void
377 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
378 {
379 	if (vif->csa_active)
380 		ieee80211_csa_finish(vif);
381 }
382 
383 static void
384 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
385 {
386 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
387 	struct mt76_phy *mphy = &dev->mt76.phy;
388 	struct mt7615_mcu_csa_notify *c;
389 
390 	c = (struct mt7615_mcu_csa_notify *)skb->data;
391 
392 	if (c->omac_idx > EXT_BSSID_MAX)
393 		return;
394 
395 	if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
396 		mphy = dev->mt76.phy2;
397 
398 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
399 			IEEE80211_IFACE_ITER_RESUME_ALL,
400 			mt7615_mcu_csa_finish, mphy->hw);
401 }
402 
403 static void
404 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
405 {
406 	struct mt76_phy *mphy = &dev->mt76.phy;
407 	struct mt7615_mcu_rdd_report *r;
408 
409 	r = (struct mt7615_mcu_rdd_report *)skb->data;
410 
411 	if (!dev->radar_pattern.n_pulses && !r->long_detected &&
412 	    !r->constant_prf_detected && !r->staggered_prf_detected)
413 		return;
414 
415 	if (r->band_idx && dev->mt76.phy2)
416 		mphy = dev->mt76.phy2;
417 
418 	ieee80211_radar_detected(mphy->hw);
419 	dev->hw_pattern++;
420 }
421 
422 static void
423 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
424 {
425 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
426 	const char *data = (char *)&rxd[1];
427 	const char *type;
428 
429 	switch (rxd->s2d_index) {
430 	case 0:
431 		type = "N9";
432 		break;
433 	case 2:
434 		type = "CR4";
435 		break;
436 	default:
437 		type = "unknown";
438 		break;
439 	}
440 
441 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
442 		   (int)(skb->len - sizeof(*rxd)), data);
443 }
444 
445 static void
446 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
447 {
448 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
449 
450 	switch (rxd->ext_eid) {
451 	case MCU_EXT_EVENT_RDD_REPORT:
452 		mt7615_mcu_rx_radar_detected(dev, skb);
453 		break;
454 	case MCU_EXT_EVENT_CSA_NOTIFY:
455 		mt7615_mcu_rx_csa_notify(dev, skb);
456 		break;
457 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
458 		mt7615_mcu_rx_log_message(dev, skb);
459 		break;
460 	default:
461 		break;
462 	}
463 }
464 
465 static void
466 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
467 {
468 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
469 	struct mt7615_phy *phy;
470 	struct mt76_phy *mphy;
471 
472 	if (*seq_num & BIT(7) && dev->mt76.phy2)
473 		mphy = dev->mt76.phy2;
474 	else
475 		mphy = &dev->mt76.phy;
476 
477 	phy = (struct mt7615_phy *)mphy->priv;
478 
479 	spin_lock_bh(&dev->mt76.lock);
480 	__skb_queue_tail(&phy->scan_event_list, skb);
481 	spin_unlock_bh(&dev->mt76.lock);
482 
483 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
484 				     MT7615_HW_SCAN_TIMEOUT);
485 }
486 
487 static void
488 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
489 {
490 	struct mt7615_roc_tlv *event;
491 	struct mt7615_phy *phy;
492 	struct mt76_phy *mphy;
493 	int duration;
494 
495 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
496 	event = (struct mt7615_roc_tlv *)skb->data;
497 
498 	if (event->dbdc_band && dev->mt76.phy2)
499 		mphy = dev->mt76.phy2;
500 	else
501 		mphy = &dev->mt76.phy;
502 
503 	ieee80211_ready_on_channel(mphy->hw);
504 
505 	phy = (struct mt7615_phy *)mphy->priv;
506 	phy->roc_grant = true;
507 	wake_up(&phy->roc_wait);
508 
509 	duration = le32_to_cpu(event->max_interval);
510 	mod_timer(&phy->roc_timer,
511 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
512 }
513 
514 static void
515 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
516 {
517 	struct mt76_connac_beacon_loss_event *event;
518 	struct mt76_phy *mphy;
519 	u8 band_idx = 0; /* DBDC support */
520 
521 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
522 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
523 	if (band_idx && dev->mt76.phy2)
524 		mphy = dev->mt76.phy2;
525 	else
526 		mphy = &dev->mt76.phy;
527 
528 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
529 					IEEE80211_IFACE_ITER_RESUME_ALL,
530 					mt76_connac_mcu_beacon_loss_iter,
531 					event);
532 }
533 
534 static void
535 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
536 {
537 	struct mt76_connac_mcu_bss_event *event;
538 	struct mt76_phy *mphy;
539 	u8 band_idx = 0; /* DBDC support */
540 
541 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
542 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
543 
544 	if (band_idx && dev->mt76.phy2)
545 		mphy = dev->mt76.phy2;
546 	else
547 		mphy = &dev->mt76.phy;
548 
549 	if (event->is_absent)
550 		ieee80211_stop_queues(mphy->hw);
551 	else
552 		ieee80211_wake_queues(mphy->hw);
553 }
554 
555 static void
556 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
557 {
558 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
559 
560 	switch (rxd->eid) {
561 	case MCU_EVENT_EXT:
562 		mt7615_mcu_rx_ext_event(dev, skb);
563 		break;
564 	case MCU_EVENT_BSS_BEACON_LOSS:
565 		mt7615_mcu_beacon_loss_event(dev, skb);
566 		break;
567 	case MCU_EVENT_ROC:
568 		mt7615_mcu_roc_event(dev, skb);
569 		break;
570 	case MCU_EVENT_SCHED_SCAN_DONE:
571 	case MCU_EVENT_SCAN_DONE:
572 		mt7615_mcu_scan_event(dev, skb);
573 		return;
574 	case MCU_EVENT_BSS_ABSENCE:
575 		mt7615_mcu_bss_event(dev, skb);
576 		break;
577 	case MCU_EVENT_COREDUMP:
578 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
579 					       &dev->coredump);
580 		return;
581 	default:
582 		break;
583 	}
584 	dev_kfree_skb(skb);
585 }
586 
587 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
588 {
589 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
590 
591 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
592 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
593 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
594 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
595 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
596 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
597 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
598 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
599 	    rxd->eid == MCU_EVENT_COREDUMP ||
600 	    rxd->eid == MCU_EVENT_ROC ||
601 	    !rxd->seq)
602 		mt7615_mcu_rx_unsolicited_event(dev, skb);
603 	else
604 		mt76_mcu_rx_event(&dev->mt76, skb);
605 }
606 
607 static int
608 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
609 		       bool bssid, bool enable)
610 {
611 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
612 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
613 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
614 	const u8 *addr = vif->addr;
615 	struct {
616 		u8 mode;
617 		u8 force_clear;
618 		u8 clear_bitmap[8];
619 		u8 entry_count;
620 		u8 write;
621 
622 		u8 index;
623 		u8 bssid;
624 		u8 addr[ETH_ALEN];
625 	} __packed req = {
626 		.mode = !!mask || enable,
627 		.entry_count = 1,
628 		.write = 1,
629 
630 		.index = idx * 2 + bssid,
631 	};
632 
633 	if (bssid)
634 		addr = vif->bss_conf.bssid;
635 
636 	if (enable)
637 		ether_addr_copy(req.addr, addr);
638 
639 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE),
640 				 &req, sizeof(req), true);
641 }
642 
643 static int
644 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
645 		   bool enable)
646 {
647 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
648 	struct mt7615_dev *dev = phy->dev;
649 	struct {
650 		struct req_hdr {
651 			u8 omac_idx;
652 			u8 band_idx;
653 			__le16 tlv_num;
654 			u8 is_tlv_append;
655 			u8 rsv[3];
656 		} __packed hdr;
657 		struct req_tlv {
658 			__le16 tag;
659 			__le16 len;
660 			u8 active;
661 			u8 band_idx;
662 			u8 omac_addr[ETH_ALEN];
663 		} __packed tlv;
664 	} data = {
665 		.hdr = {
666 			.omac_idx = mvif->mt76.omac_idx,
667 			.band_idx = mvif->mt76.band_idx,
668 			.tlv_num = cpu_to_le16(1),
669 			.is_tlv_append = 1,
670 		},
671 		.tlv = {
672 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
673 			.len = cpu_to_le16(sizeof(struct req_tlv)),
674 			.active = enable,
675 			.band_idx = mvif->mt76.band_idx,
676 		},
677 	};
678 
679 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
680 		return mt7615_mcu_muar_config(dev, vif, false, enable);
681 
682 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
683 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
684 				 &data, sizeof(data), true);
685 }
686 
687 static int
688 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
689 			      struct ieee80211_hw *hw,
690 			      struct ieee80211_vif *vif, bool enable)
691 {
692 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
693 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
694 	struct ieee80211_mutable_offsets offs;
695 	struct ieee80211_tx_info *info;
696 	struct req {
697 		u8 omac_idx;
698 		u8 enable;
699 		u8 wlan_idx;
700 		u8 band_idx;
701 		u8 pkt_type;
702 		u8 need_pre_tbtt_int;
703 		__le16 csa_ie_pos;
704 		__le16 pkt_len;
705 		__le16 tim_ie_pos;
706 		u8 pkt[512];
707 		u8 csa_cnt;
708 		/* bss color change */
709 		u8 bcc_cnt;
710 		__le16 bcc_ie_pos;
711 	} __packed req = {
712 		.omac_idx = mvif->mt76.omac_idx,
713 		.enable = enable,
714 		.wlan_idx = wcid->idx,
715 		.band_idx = mvif->mt76.band_idx,
716 	};
717 	struct sk_buff *skb;
718 
719 	if (!enable)
720 		goto out;
721 
722 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
723 	if (!skb)
724 		return -EINVAL;
725 
726 	if (skb->len > 512 - MT_TXD_SIZE) {
727 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
728 		dev_kfree_skb(skb);
729 		return -EINVAL;
730 	}
731 
732 	if (mvif->mt76.band_idx) {
733 		info = IEEE80211_SKB_CB(skb);
734 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
735 	}
736 
737 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
738 			      0, NULL, true);
739 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
740 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
741 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
742 	if (offs.cntdwn_counter_offs[0]) {
743 		u16 csa_offs;
744 
745 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
746 		req.csa_ie_pos = cpu_to_le16(csa_offs);
747 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
748 	}
749 	dev_kfree_skb(skb);
750 
751 out:
752 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(BCN_OFFLOAD), &req,
753 				 sizeof(req), true);
754 }
755 
756 static int
757 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
758 {
759 #define ENTER_PM_STATE	1
760 #define EXIT_PM_STATE	2
761 	struct {
762 		u8 pm_number;
763 		u8 pm_state;
764 		u8 bssid[ETH_ALEN];
765 		u8 dtim_period;
766 		u8 wlan_idx;
767 		__le16 bcn_interval;
768 		__le32 aid;
769 		__le32 rx_filter;
770 		u8 band_idx;
771 		u8 rsv[3];
772 		__le32 feature;
773 		u8 omac_idx;
774 		u8 wmm_idx;
775 		u8 bcn_loss_cnt;
776 		u8 bcn_sp_duration;
777 	} __packed req = {
778 		.pm_number = 5,
779 		.pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
780 		.band_idx = band,
781 	};
782 
783 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL),
784 				 &req, sizeof(req), true);
785 }
786 
787 static int
788 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
789 			 struct ieee80211_sta *sta, struct mt7615_phy *phy,
790 			 bool enable)
791 {
792 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
793 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
794 	struct bss_info_basic *bss;
795 	u8 wlan_idx = mvif->sta.wcid.idx;
796 	struct tlv *tlv;
797 
798 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
799 
800 	switch (vif->type) {
801 	case NL80211_IFTYPE_MESH_POINT:
802 	case NL80211_IFTYPE_AP:
803 	case NL80211_IFTYPE_MONITOR:
804 		break;
805 	case NL80211_IFTYPE_STATION:
806 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
807 		if (enable && sta) {
808 			struct mt7615_sta *msta;
809 
810 			msta = (struct mt7615_sta *)sta->drv_priv;
811 			wlan_idx = msta->wcid.idx;
812 		}
813 		break;
814 	case NL80211_IFTYPE_ADHOC:
815 		type = NETWORK_IBSS;
816 		break;
817 	default:
818 		WARN_ON(1);
819 		break;
820 	}
821 
822 	bss = (struct bss_info_basic *)tlv;
823 	bss->network_type = cpu_to_le32(type);
824 	bss->bmc_wcid_lo = wlan_idx;
825 	bss->wmm_idx = mvif->mt76.wmm_idx;
826 	bss->active = enable;
827 
828 	if (vif->type != NL80211_IFTYPE_MONITOR) {
829 		memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
830 		bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
831 		bss->dtim_period = vif->bss_conf.dtim_period;
832 	} else {
833 		memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
834 	}
835 
836 	return 0;
837 }
838 
839 static void
840 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
841 {
842 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
843 	u8 omac_idx = mvif->mt76.omac_idx;
844 	struct bss_info_omac *omac;
845 	struct tlv *tlv;
846 	u32 type = 0;
847 
848 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
849 
850 	switch (vif->type) {
851 	case NL80211_IFTYPE_MONITOR:
852 	case NL80211_IFTYPE_MESH_POINT:
853 	case NL80211_IFTYPE_AP:
854 		if (vif->p2p)
855 			type = CONNECTION_P2P_GO;
856 		else
857 			type = CONNECTION_INFRA_AP;
858 		break;
859 	case NL80211_IFTYPE_STATION:
860 		if (vif->p2p)
861 			type = CONNECTION_P2P_GC;
862 		else
863 			type = CONNECTION_INFRA_STA;
864 		break;
865 	case NL80211_IFTYPE_ADHOC:
866 		type = CONNECTION_IBSS_ADHOC;
867 		break;
868 	default:
869 		WARN_ON(1);
870 		break;
871 	}
872 
873 	omac = (struct bss_info_omac *)tlv;
874 	omac->conn_type = cpu_to_le32(type);
875 	omac->omac_idx = mvif->mt76.omac_idx;
876 	omac->band_idx = mvif->mt76.band_idx;
877 	omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
878 }
879 
880 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
881 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
882 static void
883 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
884 {
885 	struct bss_info_ext_bss *ext;
886 	int ext_bss_idx, tsf_offset;
887 	struct tlv *tlv;
888 
889 	ext_bss_idx = mvif->mt76.omac_idx - EXT_BSSID_START;
890 	if (ext_bss_idx < 0)
891 		return;
892 
893 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
894 
895 	ext = (struct bss_info_ext_bss *)tlv;
896 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
897 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
898 }
899 
900 static int
901 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
902 		   struct ieee80211_sta *sta, bool enable)
903 {
904 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
905 	struct mt7615_dev *dev = phy->dev;
906 	struct sk_buff *skb;
907 
908 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
909 		mt7615_mcu_muar_config(dev, vif, true, enable);
910 
911 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
912 	if (IS_ERR(skb))
913 		return PTR_ERR(skb);
914 
915 	if (enable)
916 		mt7615_mcu_bss_omac_tlv(skb, vif);
917 
918 	mt7615_mcu_bss_basic_tlv(skb, vif, sta, phy, enable);
919 
920 	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
921 	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
922 		mt7615_mcu_bss_ext_tlv(skb, mvif);
923 
924 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
925 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
926 }
927 
928 static int
929 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
930 		      struct ieee80211_ampdu_params *params,
931 		      bool enable)
932 {
933 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
934 	struct mt7615_vif *mvif = msta->vif;
935 	struct wtbl_req_hdr *wtbl_hdr;
936 	struct sk_buff *skb = NULL;
937 	int err;
938 
939 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
940 						  WTBL_SET, NULL, &skb);
941 	if (IS_ERR(wtbl_hdr))
942 		return PTR_ERR(wtbl_hdr);
943 
944 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
945 				    NULL, wtbl_hdr);
946 
947 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
948 				    MCU_EXT_CMD(WTBL_UPDATE), true);
949 	if (err < 0)
950 		return err;
951 
952 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
953 					    &msta->wcid);
954 	if (IS_ERR(skb))
955 		return PTR_ERR(skb);
956 
957 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
958 
959 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
960 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
961 }
962 
963 static int
964 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
965 		      struct ieee80211_ampdu_params *params,
966 		      bool enable)
967 {
968 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
969 	struct mt7615_vif *mvif = msta->vif;
970 	struct wtbl_req_hdr *wtbl_hdr;
971 	struct sk_buff *skb;
972 	int err;
973 
974 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
975 					    &msta->wcid);
976 	if (IS_ERR(skb))
977 		return PTR_ERR(skb);
978 
979 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
980 
981 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
982 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
983 	if (err < 0 || !enable)
984 		return err;
985 
986 	skb = NULL;
987 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
988 						  WTBL_SET, NULL, &skb);
989 	if (IS_ERR(wtbl_hdr))
990 		return PTR_ERR(wtbl_hdr);
991 
992 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
993 				    NULL, wtbl_hdr);
994 
995 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
996 				     MCU_EXT_CMD(WTBL_UPDATE), true);
997 }
998 
999 static int
1000 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1001 			struct ieee80211_sta *sta, bool enable)
1002 {
1003 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1004 	struct sk_buff *skb, *sskb, *wskb = NULL;
1005 	struct mt7615_dev *dev = phy->dev;
1006 	struct wtbl_req_hdr *wtbl_hdr;
1007 	struct mt7615_sta *msta;
1008 	int cmd, err;
1009 
1010 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1011 
1012 	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1013 					     &msta->wcid);
1014 	if (IS_ERR(sskb))
1015 		return PTR_ERR(sskb);
1016 
1017 	mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable, true);
1018 	if (enable && sta)
1019 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
1020 					MT76_STA_INFO_STATE_ASSOC);
1021 
1022 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1023 						  WTBL_RESET_AND_SET, NULL,
1024 						  &wskb);
1025 	if (IS_ERR(wtbl_hdr))
1026 		return PTR_ERR(wtbl_hdr);
1027 
1028 	if (enable) {
1029 		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
1030 						 NULL, wtbl_hdr);
1031 		if (sta)
1032 			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
1033 						    NULL, wtbl_hdr);
1034 		mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, vif, &msta->wcid,
1035 						   NULL, wtbl_hdr);
1036 	}
1037 
1038 	cmd = enable ? MCU_EXT_CMD(WTBL_UPDATE) : MCU_EXT_CMD(STA_REC_UPDATE);
1039 	skb = enable ? wskb : sskb;
1040 
1041 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1042 	if (err < 0) {
1043 		skb = enable ? sskb : wskb;
1044 		dev_kfree_skb(skb);
1045 
1046 		return err;
1047 	}
1048 
1049 	cmd = enable ? MCU_EXT_CMD(STA_REC_UPDATE) : MCU_EXT_CMD(WTBL_UPDATE);
1050 	skb = enable ? sskb : wskb;
1051 
1052 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1053 }
1054 
1055 static int
1056 mt7615_mcu_wtbl_update_hdr_trans(struct mt7615_dev *dev,
1057 				 struct ieee80211_vif *vif,
1058 				 struct ieee80211_sta *sta)
1059 {
1060 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1061 	struct wtbl_req_hdr *wtbl_hdr;
1062 	struct sk_buff *skb = NULL;
1063 
1064 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1065 						  WTBL_SET, NULL, &skb);
1066 	if (IS_ERR(wtbl_hdr))
1067 		return PTR_ERR(wtbl_hdr);
1068 
1069 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, &msta->wcid, NULL,
1070 					   wtbl_hdr);
1071 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1072 				     MCU_EXT_CMD(WTBL_UPDATE), true);
1073 }
1074 
1075 static const struct mt7615_mcu_ops wtbl_update_ops = {
1076 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1077 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1078 	.add_dev_info = mt7615_mcu_add_dev,
1079 	.add_bss_info = mt7615_mcu_add_bss,
1080 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1081 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1082 	.sta_add = mt7615_mcu_wtbl_sta_add,
1083 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1084 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1085 	.set_sta_decap_offload = mt7615_mcu_wtbl_update_hdr_trans,
1086 };
1087 
1088 static int
1089 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1090 		  struct ieee80211_ampdu_params *params,
1091 		  bool enable, bool tx)
1092 {
1093 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1094 	struct mt7615_vif *mvif = msta->vif;
1095 	struct wtbl_req_hdr *wtbl_hdr;
1096 	struct tlv *sta_wtbl;
1097 	struct sk_buff *skb;
1098 
1099 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1100 					    &msta->wcid);
1101 	if (IS_ERR(skb))
1102 		return PTR_ERR(skb);
1103 
1104 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1105 
1106 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1107 
1108 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1109 						  WTBL_SET, sta_wtbl, &skb);
1110 	if (IS_ERR(wtbl_hdr))
1111 		return PTR_ERR(wtbl_hdr);
1112 
1113 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
1114 				    sta_wtbl, wtbl_hdr);
1115 
1116 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1117 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1118 }
1119 
1120 static int
1121 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1122 		     struct ieee80211_ampdu_params *params,
1123 		     bool enable)
1124 {
1125 	return mt7615_mcu_sta_ba(dev, params, enable, true);
1126 }
1127 
1128 static int
1129 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1130 		     struct ieee80211_ampdu_params *params,
1131 		     bool enable)
1132 {
1133 	return mt7615_mcu_sta_ba(dev, params, enable, false);
1134 }
1135 
1136 static int
1137 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
1138 		     struct ieee80211_sta *sta, bool enable, int cmd,
1139 		     bool offload_fw)
1140 {
1141 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1142 	struct mt76_sta_cmd_info info = {
1143 		.sta = sta,
1144 		.vif = vif,
1145 		.offload_fw = offload_fw,
1146 		.enable = enable,
1147 		.newly = true,
1148 		.cmd = cmd,
1149 	};
1150 
1151 	info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
1152 	return mt76_connac_mcu_sta_cmd(phy, &info);
1153 }
1154 
1155 static int
1156 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1157 		   struct ieee80211_sta *sta, bool enable)
1158 {
1159 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1160 				    MCU_EXT_CMD(STA_REC_UPDATE), false);
1161 }
1162 
1163 static int
1164 mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1165 				struct ieee80211_vif *vif,
1166 				struct ieee80211_sta *sta)
1167 {
1168 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1169 
1170 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1171 						    vif, &msta->wcid,
1172 						    MCU_EXT_CMD(STA_REC_UPDATE));
1173 }
1174 
1175 static const struct mt7615_mcu_ops sta_update_ops = {
1176 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1177 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1178 	.add_dev_info = mt7615_mcu_add_dev,
1179 	.add_bss_info = mt7615_mcu_add_bss,
1180 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1181 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1182 	.sta_add = mt7615_mcu_add_sta,
1183 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1184 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1185 	.set_sta_decap_offload = mt7615_mcu_sta_update_hdr_trans,
1186 };
1187 
1188 static int
1189 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1190 {
1191 	return 0;
1192 }
1193 
1194 static int
1195 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1196 				  struct ieee80211_hw *hw,
1197 				  struct ieee80211_vif *vif,
1198 				  bool enable)
1199 {
1200 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1201 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1202 	struct ieee80211_mutable_offsets offs;
1203 	struct {
1204 		struct req_hdr {
1205 			u8 bss_idx;
1206 			u8 pad[3];
1207 		} __packed hdr;
1208 		struct bcn_content_tlv {
1209 			__le16 tag;
1210 			__le16 len;
1211 			__le16 tim_ie_pos;
1212 			__le16 csa_ie_pos;
1213 			__le16 bcc_ie_pos;
1214 			/* 0: disable beacon offload
1215 			 * 1: enable beacon offload
1216 			 * 2: update probe respond offload
1217 			 */
1218 			u8 enable;
1219 			/* 0: legacy format (TXD + payload)
1220 			 * 1: only cap field IE
1221 			 */
1222 			u8 type;
1223 			__le16 pkt_len;
1224 			u8 pkt[512];
1225 		} __packed beacon_tlv;
1226 	} req = {
1227 		.hdr = {
1228 			.bss_idx = mvif->mt76.idx,
1229 		},
1230 		.beacon_tlv = {
1231 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1232 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1233 			.enable = enable,
1234 		},
1235 	};
1236 	struct sk_buff *skb;
1237 
1238 	if (!enable)
1239 		goto out;
1240 
1241 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1242 	if (!skb)
1243 		return -EINVAL;
1244 
1245 	if (skb->len > 512 - MT_TXD_SIZE) {
1246 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1247 		dev_kfree_skb(skb);
1248 		return -EINVAL;
1249 	}
1250 
1251 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1252 			      wcid, NULL, 0, NULL, true);
1253 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1254 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1255 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1256 
1257 	if (offs.cntdwn_counter_offs[0]) {
1258 		u16 csa_offs;
1259 
1260 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1261 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1262 	}
1263 	dev_kfree_skb(skb);
1264 
1265 out:
1266 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1267 				 &req, sizeof(req), true);
1268 }
1269 
1270 static int
1271 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1272 		       bool enable)
1273 {
1274 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1275 
1276 	return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1277 					   enable);
1278 }
1279 
1280 static int
1281 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1282 		       struct ieee80211_sta *sta, bool enable)
1283 {
1284 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1285 
1286 	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1287 					   enable);
1288 }
1289 
1290 static inline int
1291 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1292 		       struct ieee80211_sta *sta, bool enable)
1293 {
1294 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1295 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1296 }
1297 
1298 static int
1299 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1300 		     struct ieee80211_ampdu_params *params,
1301 		     bool enable)
1302 {
1303 	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1304 
1305 	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1306 				      enable, true);
1307 }
1308 
1309 static int
1310 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1311 		     struct ieee80211_ampdu_params *params,
1312 		     bool enable)
1313 {
1314 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1315 	struct mt7615_vif *mvif = msta->vif;
1316 	struct wtbl_req_hdr *wtbl_hdr;
1317 	struct tlv *sta_wtbl;
1318 	struct sk_buff *skb;
1319 	int err;
1320 
1321 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1322 					    &msta->wcid);
1323 	if (IS_ERR(skb))
1324 		return PTR_ERR(skb);
1325 
1326 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1327 
1328 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1329 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1330 	if (err < 0 || !enable)
1331 		return err;
1332 
1333 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1334 					    &msta->wcid);
1335 	if (IS_ERR(skb))
1336 		return PTR_ERR(skb);
1337 
1338 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1339 					   sizeof(struct tlv));
1340 
1341 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1342 						  WTBL_SET, sta_wtbl, &skb);
1343 	if (IS_ERR(wtbl_hdr))
1344 		return PTR_ERR(wtbl_hdr);
1345 
1346 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1347 				    sta_wtbl, wtbl_hdr);
1348 
1349 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1350 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
1351 }
1352 
1353 static int
1354 mt7615_mcu_sta_uni_update_hdr_trans(struct mt7615_dev *dev,
1355 				    struct ieee80211_vif *vif,
1356 				    struct ieee80211_sta *sta)
1357 {
1358 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1359 
1360 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1361 						    vif, &msta->wcid,
1362 						    MCU_UNI_CMD(STA_REC_UPDATE));
1363 }
1364 
1365 static const struct mt7615_mcu_ops uni_update_ops = {
1366 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1367 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1368 	.add_dev_info = mt7615_mcu_uni_add_dev,
1369 	.add_bss_info = mt7615_mcu_uni_add_bss,
1370 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1371 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1372 	.sta_add = mt7615_mcu_uni_add_sta,
1373 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1374 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1375 	.set_sta_decap_offload = mt7615_mcu_sta_uni_update_hdr_trans,
1376 };
1377 
1378 int mt7615_mcu_restart(struct mt76_dev *dev)
1379 {
1380 	return mt76_mcu_send_msg(dev, MCU_CMD(RESTART_DL_REQ), NULL, 0, true);
1381 }
1382 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1383 
1384 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1385 {
1386 	const struct mt7615_patch_hdr *hdr;
1387 	const struct firmware *fw = NULL;
1388 	int len, ret, sem;
1389 
1390 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1391 	if (ret)
1392 		return ret;
1393 
1394 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1395 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1396 		ret = -EINVAL;
1397 		goto release_fw;
1398 	}
1399 
1400 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1401 	switch (sem) {
1402 	case PATCH_IS_DL:
1403 		goto release_fw;
1404 	case PATCH_NOT_DL_SEM_SUCCESS:
1405 		break;
1406 	default:
1407 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1408 		ret = -EAGAIN;
1409 		goto release_fw;
1410 	}
1411 
1412 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1413 
1414 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1415 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1416 
1417 	len = fw->size - sizeof(*hdr);
1418 
1419 	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1420 					    DL_MODE_NEED_RSP);
1421 	if (ret) {
1422 		dev_err(dev->mt76.dev, "Download request failed\n");
1423 		goto out;
1424 	}
1425 
1426 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1427 				     fw->data + sizeof(*hdr), len);
1428 	if (ret) {
1429 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1430 		goto out;
1431 	}
1432 
1433 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1434 	if (ret)
1435 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1436 
1437 out:
1438 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1439 	switch (sem) {
1440 	case PATCH_REL_SEM_SUCCESS:
1441 		break;
1442 	default:
1443 		ret = -EAGAIN;
1444 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1445 		break;
1446 	}
1447 
1448 release_fw:
1449 	release_firmware(fw);
1450 
1451 	return ret;
1452 }
1453 
1454 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1455 {
1456 	u32 ret = 0;
1457 
1458 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1459 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1460 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1461 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1462 	ret |= DL_MODE_NEED_RSP;
1463 	ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1464 
1465 	return ret;
1466 }
1467 
1468 static int
1469 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1470 			     const struct mt7615_fw_trailer *hdr,
1471 			     const u8 *data, bool is_cr4)
1472 {
1473 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1474 	int err, i, offset = 0;
1475 	u32 len, addr, mode;
1476 
1477 	for (i = 0; i < n_region; i++) {
1478 		mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1479 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1480 		addr = le32_to_cpu(hdr[i].addr);
1481 
1482 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1483 						    mode);
1484 		if (err) {
1485 			dev_err(dev->mt76.dev, "Download request failed\n");
1486 			return err;
1487 		}
1488 
1489 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1490 					     data + offset, len);
1491 		if (err) {
1492 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1493 			return err;
1494 		}
1495 
1496 		offset += len;
1497 	}
1498 
1499 	return 0;
1500 }
1501 
1502 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1503 {
1504 	const struct mt7615_fw_trailer *hdr;
1505 	const struct firmware *fw;
1506 	int ret;
1507 
1508 	ret = request_firmware(&fw, name, dev->mt76.dev);
1509 	if (ret)
1510 		return ret;
1511 
1512 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1513 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1514 		ret = -EINVAL;
1515 		goto out;
1516 	}
1517 
1518 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1519 					N9_REGION_NUM * sizeof(*hdr));
1520 
1521 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1522 		 hdr->fw_ver, hdr->build_date);
1523 
1524 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1525 	if (ret)
1526 		goto out;
1527 
1528 	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1529 					     le32_to_cpu(hdr->addr),
1530 					     FW_START_OVERRIDE);
1531 	if (ret) {
1532 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1533 		goto out;
1534 	}
1535 
1536 	snprintf(dev->mt76.hw->wiphy->fw_version,
1537 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1538 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1539 
1540 	if (!is_mt7615(&dev->mt76)) {
1541 		dev->fw_ver = MT7615_FIRMWARE_V2;
1542 		dev->mcu_ops = &sta_update_ops;
1543 	} else {
1544 		dev->fw_ver = MT7615_FIRMWARE_V1;
1545 		dev->mcu_ops = &wtbl_update_ops;
1546 	}
1547 
1548 out:
1549 	release_firmware(fw);
1550 	return ret;
1551 }
1552 
1553 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1554 {
1555 	const struct mt7615_fw_trailer *hdr;
1556 	const struct firmware *fw;
1557 	int ret;
1558 
1559 	ret = request_firmware(&fw, name, dev->mt76.dev);
1560 	if (ret)
1561 		return ret;
1562 
1563 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1564 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1565 		ret = -EINVAL;
1566 		goto out;
1567 	}
1568 
1569 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1570 					CR4_REGION_NUM * sizeof(*hdr));
1571 
1572 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1573 		 hdr->fw_ver, hdr->build_date);
1574 
1575 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1576 	if (ret)
1577 		goto out;
1578 
1579 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1580 					     FW_START_WORKING_PDA_CR4);
1581 	if (ret) {
1582 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1583 		goto out;
1584 	}
1585 
1586 out:
1587 	release_firmware(fw);
1588 
1589 	return ret;
1590 }
1591 
1592 static int mt7615_load_ram(struct mt7615_dev *dev)
1593 {
1594 	int ret;
1595 
1596 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1597 	if (ret)
1598 		return ret;
1599 
1600 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1601 }
1602 
1603 static int mt7615_load_firmware(struct mt7615_dev *dev)
1604 {
1605 	int ret;
1606 	u32 val;
1607 
1608 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1609 
1610 	if (val != FW_STATE_FW_DOWNLOAD) {
1611 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1612 		return -EIO;
1613 	}
1614 
1615 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1616 	if (ret)
1617 		return ret;
1618 
1619 	ret = mt7615_load_ram(dev);
1620 	if (ret)
1621 		return ret;
1622 
1623 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1624 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1625 				       FW_STATE_RDY), 500)) {
1626 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1627 		return -EIO;
1628 	}
1629 
1630 	return 0;
1631 }
1632 
1633 static int mt7622_load_firmware(struct mt7615_dev *dev)
1634 {
1635 	int ret;
1636 	u32 val;
1637 
1638 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1639 
1640 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1641 	if (val != FW_STATE_FW_DOWNLOAD) {
1642 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1643 		return -EIO;
1644 	}
1645 
1646 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1647 	if (ret)
1648 		return ret;
1649 
1650 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1651 	if (ret)
1652 		return ret;
1653 
1654 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1655 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1656 				       FW_STATE_NORMAL_TRX), 1500)) {
1657 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1658 		return -EIO;
1659 	}
1660 
1661 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1662 
1663 	return 0;
1664 }
1665 
1666 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1667 {
1668 	struct {
1669 		u8 ctrl_val;
1670 		u8 pad[3];
1671 	} data = {
1672 		.ctrl_val = ctrl
1673 	};
1674 
1675 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST),
1676 				 &data, sizeof(data), true);
1677 }
1678 
1679 static int mt7615_mcu_cal_cache_apply(struct mt7615_dev *dev)
1680 {
1681 	struct {
1682 		bool cache_enable;
1683 		u8 pad[3];
1684 	} data = {
1685 		.cache_enable = true
1686 	};
1687 
1688 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CAL_CACHE), &data,
1689 				 sizeof(data), false);
1690 }
1691 
1692 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1693 {
1694 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1695 	const struct mt7663_fw_trailer *hdr;
1696 	const struct mt7663_fw_buf *buf;
1697 	const struct firmware *fw;
1698 	const u8 *base_addr;
1699 	int i, ret;
1700 
1701 	ret = request_firmware(&fw, name, dev->mt76.dev);
1702 	if (ret)
1703 		return ret;
1704 
1705 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1706 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1707 		ret = -EINVAL;
1708 		goto out;
1709 	}
1710 
1711 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
1712 						 FW_V3_COMMON_TAILER_SIZE);
1713 
1714 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1715 		 hdr->fw_ver, hdr->build_date);
1716 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1717 
1718 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1719 	for (i = 0; i < hdr->n_region; i++) {
1720 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1721 		u32 len, addr, mode;
1722 
1723 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1724 
1725 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1726 		mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
1727 		addr = le32_to_cpu(buf->img_dest_addr);
1728 		len = le32_to_cpu(buf->img_size);
1729 
1730 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1731 						    mode);
1732 		if (ret) {
1733 			dev_err(dev->mt76.dev, "Download request failed\n");
1734 			goto out;
1735 		}
1736 
1737 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1738 					     fw->data + offset, len);
1739 		if (ret) {
1740 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1741 			goto out;
1742 		}
1743 
1744 		offset += le32_to_cpu(buf->img_size);
1745 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1746 			override_addr = le32_to_cpu(buf->img_dest_addr);
1747 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1748 				 i, override_addr);
1749 		}
1750 	}
1751 
1752 	if (override_addr)
1753 		flag |= FW_START_OVERRIDE;
1754 
1755 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1756 		 override_addr, flag);
1757 
1758 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1759 	if (ret) {
1760 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1761 		goto out;
1762 	}
1763 
1764 	snprintf(dev->mt76.hw->wiphy->fw_version,
1765 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1766 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1767 
1768 out:
1769 	release_firmware(fw);
1770 
1771 	return ret;
1772 }
1773 
1774 static int
1775 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1776 {
1777 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1778 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1779 	int ret;
1780 
1781 	if (!prefer_offload_fw) {
1782 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1783 		primary_rom = MT7663_ROM_PATCH;
1784 	}
1785 	selected_rom = primary_rom;
1786 
1787 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1788 	if (ret) {
1789 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1790 			 primary_rom, secondary_rom);
1791 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1792 					secondary_rom);
1793 		if (ret) {
1794 			dev_err(dev->mt76.dev, "failed to load %s",
1795 				secondary_rom);
1796 			return ret;
1797 		}
1798 		selected_rom = secondary_rom;
1799 	}
1800 
1801 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1802 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1803 		dev->fw_ver = MT7615_FIRMWARE_V3;
1804 		dev->mcu_ops = &uni_update_ops;
1805 	} else {
1806 		*n9_firmware = MT7663_FIRMWARE_N9;
1807 		dev->fw_ver = MT7615_FIRMWARE_V2;
1808 		dev->mcu_ops = &sta_update_ops;
1809 	}
1810 
1811 	return 0;
1812 }
1813 
1814 int __mt7663_load_firmware(struct mt7615_dev *dev)
1815 {
1816 	const char *n9_firmware;
1817 	int ret;
1818 
1819 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1820 	if (ret) {
1821 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1822 		return -EIO;
1823 	}
1824 
1825 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1826 	if (ret)
1827 		return ret;
1828 
1829 	ret = mt7663_load_n9(dev, n9_firmware);
1830 	if (ret)
1831 		return ret;
1832 
1833 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1834 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1835 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1836 				     MT7663_TOP_MISC2_FW_STATE);
1837 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1838 		return -EIO;
1839 	}
1840 
1841 #ifdef CONFIG_PM
1842 	if (mt7615_firmware_offload(dev))
1843 		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1844 #endif /* CONFIG_PM */
1845 
1846 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1847 
1848 	return 0;
1849 }
1850 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1851 
1852 static int mt7663_load_firmware(struct mt7615_dev *dev)
1853 {
1854 	int ret;
1855 
1856 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1857 
1858 	ret = __mt7663_load_firmware(dev);
1859 	if (ret)
1860 		return ret;
1861 
1862 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1863 
1864 	return 0;
1865 }
1866 
1867 int mt7615_mcu_init(struct mt7615_dev *dev)
1868 {
1869 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1870 		.headroom = sizeof(struct mt7615_mcu_txd),
1871 		.mcu_skb_send_msg = mt7615_mcu_send_message,
1872 		.mcu_parse_response = mt7615_mcu_parse_response,
1873 		.mcu_restart = mt7615_mcu_restart,
1874 	};
1875 	int ret;
1876 
1877 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
1878 
1879 	ret = mt7615_mcu_drv_pmctrl(dev);
1880 	if (ret)
1881 		return ret;
1882 
1883 	switch (mt76_chip(&dev->mt76)) {
1884 	case 0x7622:
1885 		ret = mt7622_load_firmware(dev);
1886 		break;
1887 	case 0x7663:
1888 		ret = mt7663_load_firmware(dev);
1889 		break;
1890 	default:
1891 		ret = mt7615_load_firmware(dev);
1892 		break;
1893 	}
1894 	if (ret)
1895 		return ret;
1896 
1897 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1898 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1899 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1900 
1901 	if (dev->dbdc_support) {
1902 		ret = mt7615_mcu_cal_cache_apply(dev);
1903 		if (ret)
1904 			return ret;
1905 	}
1906 
1907 	return mt7615_mcu_fw_log_2_host(dev, 0);
1908 }
1909 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1910 
1911 void mt7615_mcu_exit(struct mt7615_dev *dev)
1912 {
1913 	__mt76_mcu_restart(&dev->mt76);
1914 	mt7615_mcu_set_fw_ctrl(dev);
1915 	skb_queue_purge(&dev->mt76.mcu.res_q);
1916 }
1917 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1918 
1919 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1920 {
1921 	struct {
1922 		u8 buffer_mode;
1923 		u8 content_format;
1924 		__le16 len;
1925 	} __packed req_hdr = {
1926 		.buffer_mode = 1,
1927 	};
1928 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1929 	struct sk_buff *skb;
1930 	int eep_len, offset;
1931 
1932 	switch (mt76_chip(&dev->mt76)) {
1933 	case 0x7622:
1934 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1935 		offset = MT_EE_NIC_CONF_0;
1936 		break;
1937 	case 0x7663:
1938 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1939 		req_hdr.content_format = 1;
1940 		offset = MT_EE_CHIP_ID;
1941 		break;
1942 	default:
1943 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1944 		offset = MT_EE_NIC_CONF_0;
1945 		break;
1946 	}
1947 
1948 	req_hdr.len = cpu_to_le16(eep_len);
1949 
1950 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1951 	if (!skb)
1952 		return -ENOMEM;
1953 
1954 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1955 	skb_put_data(skb, eep + offset, eep_len);
1956 
1957 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1958 				     MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
1959 }
1960 
1961 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1962 		       const struct ieee80211_tx_queue_params *params)
1963 {
1964 #define WMM_AIFS_SET	BIT(0)
1965 #define WMM_CW_MIN_SET	BIT(1)
1966 #define WMM_CW_MAX_SET	BIT(2)
1967 #define WMM_TXOP_SET	BIT(3)
1968 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1969 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1970 	struct req_data {
1971 		u8 number;
1972 		u8 rsv[3];
1973 		u8 queue;
1974 		u8 valid;
1975 		u8 aifs;
1976 		u8 cw_min;
1977 		__le16 cw_max;
1978 		__le16 txop;
1979 	} __packed req = {
1980 		.number = 1,
1981 		.queue = queue,
1982 		.valid = WMM_PARAM_SET,
1983 		.aifs = params->aifs,
1984 		.cw_min = 5,
1985 		.cw_max = cpu_to_le16(10),
1986 		.txop = cpu_to_le16(params->txop),
1987 	};
1988 
1989 	if (params->cw_min)
1990 		req.cw_min = fls(params->cw_min);
1991 	if (params->cw_max)
1992 		req.cw_max = cpu_to_le16(fls(params->cw_max));
1993 
1994 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
1995 				 &req, sizeof(req), true);
1996 }
1997 
1998 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1999 {
2000 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2001 	struct dbdc_entry {
2002 		u8 type;
2003 		u8 index;
2004 		u8 band;
2005 		u8 _rsv;
2006 	};
2007 	struct {
2008 		u8 enable;
2009 		u8 num;
2010 		u8 _rsv[2];
2011 		struct dbdc_entry entry[64];
2012 	} req = {
2013 		.enable = !!ext_phy,
2014 	};
2015 	int i;
2016 
2017 	if (!ext_phy)
2018 		goto out;
2019 
2020 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
2021 	do { \
2022 		req.entry[req.num].type = _type;		\
2023 		req.entry[req.num].index = _idx;		\
2024 		req.entry[req.num++].band = _band;		\
2025 	} while (0)
2026 
2027 	for (i = 0; i < 4; i++) {
2028 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
2029 
2030 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2031 	}
2032 
2033 	for (i = 0; i < 14; i++) {
2034 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
2035 
2036 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2037 	}
2038 
2039 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2040 
2041 	for (i = 0; i < 3; i++)
2042 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2043 
2044 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2045 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2046 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2047 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2048 
2049 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2050 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2051 
2052 out:
2053 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DBDC_CTRL), &req,
2054 				 sizeof(req), true);
2055 }
2056 
2057 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2058 {
2059 	struct wtbl_req_hdr req = {
2060 		.operation = WTBL_RESET_ALL,
2061 	};
2062 
2063 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(WTBL_UPDATE),
2064 				 &req, sizeof(req), true);
2065 }
2066 
2067 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2068 		       enum mt7615_rdd_cmd cmd, u8 index,
2069 		       u8 rx_sel, u8 val)
2070 {
2071 	struct {
2072 		u8 ctrl;
2073 		u8 rdd_idx;
2074 		u8 rdd_rx_sel;
2075 		u8 val;
2076 		u8 rsv[4];
2077 	} req = {
2078 		.ctrl = cmd,
2079 		.rdd_idx = index,
2080 		.rdd_rx_sel = rx_sel,
2081 		.val = val,
2082 	};
2083 
2084 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL),
2085 				 &req, sizeof(req), true);
2086 }
2087 
2088 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2089 {
2090 	struct {
2091 		__le16 tag;
2092 		__le16 min_lpn;
2093 	} req = {
2094 		.tag = cpu_to_le16(0x1),
2095 		.min_lpn = cpu_to_le16(val),
2096 	};
2097 
2098 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
2099 				 &req, sizeof(req), true);
2100 }
2101 
2102 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2103 			    const struct mt7615_dfs_pulse *pulse)
2104 {
2105 	struct {
2106 		__le16 tag;
2107 		__le32 max_width;	/* us */
2108 		__le32 max_pwr;		/* dbm */
2109 		__le32 min_pwr;		/* dbm */
2110 		__le32 min_stgr_pri;	/* us */
2111 		__le32 max_stgr_pri;	/* us */
2112 		__le32 min_cr_pri;	/* us */
2113 		__le32 max_cr_pri;	/* us */
2114 	} req = {
2115 		.tag = cpu_to_le16(0x3),
2116 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2117 		__req_field(max_width),
2118 		__req_field(max_pwr),
2119 		__req_field(min_pwr),
2120 		__req_field(min_stgr_pri),
2121 		__req_field(max_stgr_pri),
2122 		__req_field(min_cr_pri),
2123 		__req_field(max_cr_pri),
2124 #undef  __req_field
2125 	};
2126 
2127 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
2128 				 &req, sizeof(req), true);
2129 }
2130 
2131 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2132 			    const struct mt7615_dfs_pattern *pattern)
2133 {
2134 	struct {
2135 		__le16 tag;
2136 		__le16 radar_type;
2137 		u8 enb;
2138 		u8 stgr;
2139 		u8 min_crpn;
2140 		u8 max_crpn;
2141 		u8 min_crpr;
2142 		u8 min_pw;
2143 		u8 max_pw;
2144 		__le32 min_pri;
2145 		__le32 max_pri;
2146 		u8 min_crbn;
2147 		u8 max_crbn;
2148 		u8 min_stgpn;
2149 		u8 max_stgpn;
2150 		u8 min_stgpr;
2151 	} req = {
2152 		.tag = cpu_to_le16(0x2),
2153 		.radar_type = cpu_to_le16(index),
2154 #define __req_field_u8(field) .field = pattern->field
2155 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2156 		__req_field_u8(enb),
2157 		__req_field_u8(stgr),
2158 		__req_field_u8(min_crpn),
2159 		__req_field_u8(max_crpn),
2160 		__req_field_u8(min_crpr),
2161 		__req_field_u8(min_pw),
2162 		__req_field_u8(max_pw),
2163 		__req_field_u32(min_pri),
2164 		__req_field_u32(max_pri),
2165 		__req_field_u8(min_crbn),
2166 		__req_field_u8(max_crbn),
2167 		__req_field_u8(min_stgpn),
2168 		__req_field_u8(max_stgpn),
2169 		__req_field_u8(min_stgpr),
2170 #undef __req_field_u8
2171 #undef __req_field_u32
2172 	};
2173 
2174 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
2175 				 &req, sizeof(req), true);
2176 }
2177 
2178 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2179 {
2180 	struct {
2181 		u8 pulse_num;
2182 		u8 rsv[3];
2183 		struct {
2184 			__le32 start_time;
2185 			__le16 width;
2186 			__le16 power;
2187 		} pattern[32];
2188 	} req = {
2189 		.pulse_num = dev->radar_pattern.n_pulses,
2190 	};
2191 	u32 start_time = ktime_to_ms(ktime_get_boottime());
2192 	int i;
2193 
2194 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2195 		return -EINVAL;
2196 
2197 	/* TODO: add some noise here */
2198 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2199 		u32 ts = start_time + i * dev->radar_pattern.period;
2200 
2201 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2202 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2203 		req.pattern[i].start_time = cpu_to_le32(ts);
2204 	}
2205 
2206 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_PATTERN),
2207 				 &req, sizeof(req), false);
2208 }
2209 
2210 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2211 {
2212 	struct mt76_phy *mphy = phy->mt76;
2213 	struct ieee80211_hw *hw = mphy->hw;
2214 	struct mt76_power_limits limits;
2215 	s8 *limits_array = (s8 *)&limits;
2216 	int n_chains = hweight8(mphy->antenna_mask);
2217 	int tx_power;
2218 	int i;
2219 	static const u8 sku_mapping[] = {
2220 #define SKU_FIELD(_type, _field) \
2221 		[MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2222 		SKU_FIELD(CCK_1_2, cck[0]),
2223 		SKU_FIELD(CCK_55_11, cck[2]),
2224 		SKU_FIELD(OFDM_6_9, ofdm[0]),
2225 		SKU_FIELD(OFDM_12_18, ofdm[2]),
2226 		SKU_FIELD(OFDM_24_36, ofdm[4]),
2227 		SKU_FIELD(OFDM_48, ofdm[6]),
2228 		SKU_FIELD(OFDM_54, ofdm[7]),
2229 		SKU_FIELD(HT20_0_8, mcs[0][0]),
2230 		SKU_FIELD(HT20_32, ofdm[0]),
2231 		SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2232 		SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2233 		SKU_FIELD(HT20_5_13, mcs[0][5]),
2234 		SKU_FIELD(HT20_6_14, mcs[0][6]),
2235 		SKU_FIELD(HT20_7_15, mcs[0][7]),
2236 		SKU_FIELD(HT40_0_8, mcs[1][0]),
2237 		SKU_FIELD(HT40_32, ofdm[0]),
2238 		SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2239 		SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2240 		SKU_FIELD(HT40_5_13, mcs[1][5]),
2241 		SKU_FIELD(HT40_6_14, mcs[1][6]),
2242 		SKU_FIELD(HT40_7_15, mcs[1][7]),
2243 		SKU_FIELD(VHT20_0, mcs[0][0]),
2244 		SKU_FIELD(VHT20_1_2, mcs[0][1]),
2245 		SKU_FIELD(VHT20_3_4, mcs[0][3]),
2246 		SKU_FIELD(VHT20_5_6, mcs[0][5]),
2247 		SKU_FIELD(VHT20_7, mcs[0][7]),
2248 		SKU_FIELD(VHT20_8, mcs[0][8]),
2249 		SKU_FIELD(VHT20_9, mcs[0][9]),
2250 		SKU_FIELD(VHT40_0, mcs[1][0]),
2251 		SKU_FIELD(VHT40_1_2, mcs[1][1]),
2252 		SKU_FIELD(VHT40_3_4, mcs[1][3]),
2253 		SKU_FIELD(VHT40_5_6, mcs[1][5]),
2254 		SKU_FIELD(VHT40_7, mcs[1][7]),
2255 		SKU_FIELD(VHT40_8, mcs[1][8]),
2256 		SKU_FIELD(VHT40_9, mcs[1][9]),
2257 		SKU_FIELD(VHT80_0, mcs[2][0]),
2258 		SKU_FIELD(VHT80_1_2, mcs[2][1]),
2259 		SKU_FIELD(VHT80_3_4, mcs[2][3]),
2260 		SKU_FIELD(VHT80_5_6, mcs[2][5]),
2261 		SKU_FIELD(VHT80_7, mcs[2][7]),
2262 		SKU_FIELD(VHT80_8, mcs[2][8]),
2263 		SKU_FIELD(VHT80_9, mcs[2][9]),
2264 		SKU_FIELD(VHT160_0, mcs[3][0]),
2265 		SKU_FIELD(VHT160_1_2, mcs[3][1]),
2266 		SKU_FIELD(VHT160_3_4, mcs[3][3]),
2267 		SKU_FIELD(VHT160_5_6, mcs[3][5]),
2268 		SKU_FIELD(VHT160_7, mcs[3][7]),
2269 		SKU_FIELD(VHT160_8, mcs[3][8]),
2270 		SKU_FIELD(VHT160_9, mcs[3][9]),
2271 #undef SKU_FIELD
2272 	};
2273 
2274 	tx_power = hw->conf.power_level * 2 -
2275 		   mt76_tx_power_nss_delta(n_chains);
2276 
2277 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2278 					      &limits, tx_power);
2279 	mphy->txpower_cur = tx_power;
2280 
2281 	if (is_mt7663(mphy->dev)) {
2282 		memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2283 		return;
2284 	}
2285 
2286 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2287 		sku[i] = limits_array[sku_mapping[i]];
2288 
2289 	for (i = 0; i < 4; i++) {
2290 		int delta = 0;
2291 
2292 		if (i < n_chains - 1)
2293 			delta = mt76_tx_power_nss_delta(n_chains) -
2294 				mt76_tx_power_nss_delta(i + 1);
2295 		sku[MT_SKU_1SS_DELTA + i] = delta;
2296 	}
2297 }
2298 
2299 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2300 {
2301 	static const u8 width_to_bw[] = {
2302 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2303 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2304 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2305 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2306 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2307 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2308 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2309 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2310 	};
2311 
2312 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2313 		return 0;
2314 
2315 	return width_to_bw[chandef->width];
2316 }
2317 
2318 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2319 {
2320 	struct mt7615_dev *dev = phy->dev;
2321 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2322 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2323 	struct {
2324 		u8 control_chan;
2325 		u8 center_chan;
2326 		u8 bw;
2327 		u8 tx_streams;
2328 		u8 rx_streams_mask;
2329 		u8 switch_reason;
2330 		u8 band_idx;
2331 		/* for 80+80 only */
2332 		u8 center_chan2;
2333 		__le16 cac_case;
2334 		u8 channel_band;
2335 		u8 rsv0;
2336 		__le32 outband_freq;
2337 		u8 txpower_drop;
2338 		u8 rsv1[3];
2339 		u8 txpower_sku[53];
2340 		u8 rsv2[3];
2341 	} req = {
2342 		.control_chan = chandef->chan->hw_value,
2343 		.center_chan = ieee80211_frequency_to_channel(freq1),
2344 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2345 		.rx_streams_mask = phy->mt76->chainmask,
2346 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2347 	};
2348 
2349 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2350 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2351 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2352 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2353 		req.switch_reason = CH_SWITCH_DFS;
2354 	else
2355 		req.switch_reason = CH_SWITCH_NORMAL;
2356 
2357 	req.band_idx = phy != &dev->phy;
2358 	req.bw = mt7615_mcu_chan_bw(chandef);
2359 
2360 	if (mt76_testmode_enabled(phy->mt76))
2361 		memset(req.txpower_sku, 0x3f, 49);
2362 	else
2363 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2364 
2365 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2366 }
2367 
2368 int mt7615_mcu_get_temperature(struct mt7615_dev *dev)
2369 {
2370 	struct {
2371 		u8 action;
2372 		u8 rsv[3];
2373 	} req = {};
2374 
2375 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL),
2376 				 &req, sizeof(req), true);
2377 }
2378 
2379 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2380 			      u32 val)
2381 {
2382 	struct {
2383 		u8 test_mode_en;
2384 		u8 param_idx;
2385 		u8 _rsv[2];
2386 
2387 		__le32 value;
2388 
2389 		u8 pad[8];
2390 	} req = {
2391 		.test_mode_en = test_mode,
2392 		.param_idx = param,
2393 		.value = cpu_to_le32(val),
2394 	};
2395 
2396 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
2397 				 &req, sizeof(req), false);
2398 }
2399 
2400 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2401 {
2402 	struct mt7615_dev *dev = phy->dev;
2403 	struct {
2404 		u8 format_id;
2405 		u8 sku_enable;
2406 		u8 band_idx;
2407 		u8 rsv;
2408 	} req = {
2409 		.format_id = 0,
2410 		.band_idx = phy != &dev->phy,
2411 		.sku_enable = enable,
2412 	};
2413 
2414 	return mt76_mcu_send_msg(&dev->mt76,
2415 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
2416 				 &req, sizeof(req), true);
2417 }
2418 
2419 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2420 {
2421 	int i;
2422 
2423 	for (i = 0; i < n_freqs; i++)
2424 		if (cur == freqs[i])
2425 			return i;
2426 
2427 	return -1;
2428 }
2429 
2430 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2431 {
2432 	static const u16 freq_list[] = {
2433 		4980, 5805, 5905, 5190,
2434 		5230, 5270, 5310, 5350,
2435 		5390, 5430, 5470, 5510,
2436 		5550, 5590, 5630, 5670,
2437 		5710, 5755, 5795, 5835,
2438 		5875, 5210, 5290, 5370,
2439 		5450, 5530, 5610, 5690,
2440 		5775, 5855
2441 	};
2442 	static const u16 freq_bw40[] = {
2443 		5190, 5230, 5270, 5310,
2444 		5350, 5390, 5430, 5470,
2445 		5510, 5550, 5590, 5630,
2446 		5670, 5710, 5755, 5795,
2447 		5835, 5875
2448 	};
2449 	int offset_2g = ARRAY_SIZE(freq_list);
2450 	int idx;
2451 
2452 	if (freq < 4000) {
2453 		if (freq < 2427)
2454 			return offset_2g;
2455 		if (freq < 2442)
2456 			return offset_2g + 1;
2457 		if (freq < 2457)
2458 			return offset_2g + 2;
2459 
2460 		return offset_2g + 3;
2461 	}
2462 
2463 	switch (bw) {
2464 	case NL80211_CHAN_WIDTH_80:
2465 	case NL80211_CHAN_WIDTH_80P80:
2466 	case NL80211_CHAN_WIDTH_160:
2467 		break;
2468 	default:
2469 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2470 					   freq + 10);
2471 		if (idx >= 0) {
2472 			freq = freq_bw40[idx];
2473 			break;
2474 		}
2475 
2476 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2477 					   freq - 10);
2478 		if (idx >= 0) {
2479 			freq = freq_bw40[idx];
2480 			break;
2481 		}
2482 		fallthrough;
2483 	case NL80211_CHAN_WIDTH_40:
2484 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2485 					   freq);
2486 		if (idx >= 0)
2487 			break;
2488 
2489 		return -1;
2490 
2491 	}
2492 
2493 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2494 }
2495 
2496 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2497 {
2498 	struct mt7615_dev *dev = phy->dev;
2499 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2500 	int freq2 = chandef->center_freq2;
2501 	int ret;
2502 	struct {
2503 		u8 direction;
2504 		u8 runtime_calibration;
2505 		u8 _rsv[2];
2506 
2507 		__le16 center_freq;
2508 		u8 bw;
2509 		u8 band;
2510 		u8 is_freq2;
2511 		u8 success;
2512 		u8 dbdc_en;
2513 
2514 		u8 _rsv2;
2515 
2516 		struct {
2517 			__le32 sx0_i_lna[4];
2518 			__le32 sx0_q_lna[4];
2519 
2520 			__le32 sx2_i_lna[4];
2521 			__le32 sx2_q_lna[4];
2522 		} dcoc_data[4];
2523 	} req = {
2524 		.direction = 1,
2525 
2526 		.bw = mt7615_mcu_chan_bw(chandef),
2527 		.band = chandef->center_freq1 > 4000,
2528 		.dbdc_en = !!dev->mt76.phy2,
2529 	};
2530 	u16 center_freq = chandef->center_freq1;
2531 	int freq_idx;
2532 	u8 *eep = dev->mt76.eeprom.data;
2533 
2534 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2535 		return 0;
2536 
2537 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2538 		freq2 = center_freq + 40;
2539 		center_freq -= 40;
2540 	}
2541 
2542 again:
2543 	req.runtime_calibration = 1;
2544 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2545 	if (freq_idx < 0)
2546 		goto out;
2547 
2548 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2549 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2550 	       sizeof(req.dcoc_data));
2551 	req.runtime_calibration = 0;
2552 
2553 out:
2554 	req.center_freq = cpu_to_le16(center_freq);
2555 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RXDCOC_CAL), &req,
2556 				sizeof(req), true);
2557 
2558 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2559 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2560 		req.is_freq2 = true;
2561 		center_freq = freq2;
2562 		goto again;
2563 	}
2564 
2565 	return ret;
2566 }
2567 
2568 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2569 {
2570 	static const u16 freq_list[] = {
2571 		4920, 4940, 4960, 4980,
2572 		5040, 5060, 5080, 5180,
2573 		5200, 5220, 5240, 5260,
2574 		5280, 5300, 5320, 5340,
2575 		5360, 5380, 5400, 5420,
2576 		5440, 5460, 5480, 5500,
2577 		5520, 5540, 5560, 5580,
2578 		5600, 5620, 5640, 5660,
2579 		5680, 5700, 5720, 5745,
2580 		5765, 5785, 5805, 5825,
2581 		5845, 5865, 5885, 5905
2582 	};
2583 	int offset_2g = ARRAY_SIZE(freq_list);
2584 	int idx;
2585 
2586 	if (freq < 4000) {
2587 		if (freq < 2432)
2588 			return offset_2g;
2589 		if (freq < 2457)
2590 			return offset_2g + 1;
2591 
2592 		return offset_2g + 2;
2593 	}
2594 
2595 	if (bw != NL80211_CHAN_WIDTH_20) {
2596 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2597 					   freq + 10);
2598 		if (idx >= 0)
2599 			return idx;
2600 
2601 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2602 					   freq - 10);
2603 		if (idx >= 0)
2604 			return idx;
2605 	}
2606 
2607 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2608 }
2609 
2610 
2611 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2612 {
2613 	struct mt7615_dev *dev = phy->dev;
2614 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2615 	int freq2 = chandef->center_freq2;
2616 	int ret;
2617 	struct {
2618 		u8 direction;
2619 		u8 runtime_calibration;
2620 		u8 _rsv[2];
2621 
2622 		__le16 center_freq;
2623 		u8 bw;
2624 		u8 band;
2625 		u8 is_freq2;
2626 		u8 success;
2627 		u8 dbdc_en;
2628 
2629 		u8 _rsv2;
2630 
2631 		struct {
2632 			struct {
2633 				u32 dpd_g0;
2634 				u8 data[32];
2635 			} wf0, wf1;
2636 
2637 			struct {
2638 				u32 dpd_g0_prim;
2639 				u32 dpd_g0_sec;
2640 				u8 data_prim[32];
2641 				u8 data_sec[32];
2642 			} wf2, wf3;
2643 		} dpd_data;
2644 	} req = {
2645 		.direction = 1,
2646 
2647 		.bw = mt7615_mcu_chan_bw(chandef),
2648 		.band = chandef->center_freq1 > 4000,
2649 		.dbdc_en = !!dev->mt76.phy2,
2650 	};
2651 	u16 center_freq = chandef->center_freq1;
2652 	int freq_idx;
2653 	u8 *eep = dev->mt76.eeprom.data;
2654 
2655 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2656 		return 0;
2657 
2658 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2659 		freq2 = center_freq + 40;
2660 		center_freq -= 40;
2661 	}
2662 
2663 again:
2664 	req.runtime_calibration = 1;
2665 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2666 	if (freq_idx < 0)
2667 		goto out;
2668 
2669 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2670 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2671 	       sizeof(req.dpd_data));
2672 	req.runtime_calibration = 0;
2673 
2674 out:
2675 	req.center_freq = cpu_to_le16(center_freq);
2676 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXDPD_CAL),
2677 				&req, sizeof(req), true);
2678 
2679 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2680 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2681 		req.is_freq2 = true;
2682 		center_freq = freq2;
2683 		goto again;
2684 	}
2685 
2686 	return ret;
2687 }
2688 
2689 int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2690 {
2691 	struct {
2692 		u8 operation;
2693 		u8 count;
2694 		u8 _rsv[2];
2695 		u8 index;
2696 		u8 enable;
2697 		__le16 etype;
2698 	} req = {
2699 		.operation = 1,
2700 		.count = 1,
2701 		.enable = 1,
2702 		.etype = cpu_to_le16(ETH_P_PAE),
2703 	};
2704 
2705 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2706 				 &req, sizeof(req), false);
2707 }
2708 
2709 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2710 			  bool enable)
2711 {
2712 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2713 	struct {
2714 		u8 bss_idx;
2715 		u8 dtim_period;
2716 		__le16 aid;
2717 		__le16 bcn_interval;
2718 		__le16 atim_window;
2719 		u8 uapsd;
2720 		u8 bmc_delivered_ac;
2721 		u8 bmc_triggered_ac;
2722 		u8 pad;
2723 	} req = {
2724 		.bss_idx = mvif->mt76.idx,
2725 		.aid = cpu_to_le16(vif->bss_conf.aid),
2726 		.dtim_period = vif->bss_conf.dtim_period,
2727 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2728 	};
2729 	struct {
2730 		u8 bss_idx;
2731 		u8 pad[3];
2732 	} req_hdr = {
2733 		.bss_idx = mvif->mt76.idx,
2734 	};
2735 	int err;
2736 
2737 	if (vif->type != NL80211_IFTYPE_STATION)
2738 		return 0;
2739 
2740 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
2741 				&req_hdr, sizeof(req_hdr), false);
2742 	if (err < 0 || !enable)
2743 		return err;
2744 
2745 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
2746 				 &req, sizeof(req), false);
2747 }
2748 
2749 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2750 		       struct ieee80211_channel *chan, int duration)
2751 {
2752 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2753 	struct mt7615_dev *dev = phy->dev;
2754 	struct mt7615_roc_tlv req = {
2755 		.bss_idx = mvif->mt76.idx,
2756 		.active = !chan,
2757 		.max_interval = cpu_to_le32(duration),
2758 		.primary_chan = chan ? chan->hw_value : 0,
2759 		.band = chan ? chan->band : 0,
2760 		.req_type = 2,
2761 	};
2762 
2763 	phy->roc_grant = false;
2764 
2765 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC),
2766 				 &req, sizeof(req), false);
2767 }
2768