1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
75 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
76 
77 #define DL_MODE_ENCRYPT			BIT(0)
78 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
79 #define DL_MODE_RESET_SEC_IV		BIT(3)
80 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
82 #define DL_MODE_NEED_RSP		BIT(31)
83 
84 #define FW_START_OVERRIDE		BIT(0)
85 #define FW_START_WORKING_PDA_CR4	BIT(2)
86 
87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
88 			 int cmd, int *wait_seq)
89 {
90 	int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
91 	struct mt7615_uni_txd *uni_txd;
92 	struct mt7615_mcu_txd *mcu_txd;
93 	u8 seq, q_idx, pkt_fmt;
94 	__le32 *txd;
95 	u32 val;
96 
97 	/* TODO: make dynamic based on msg type */
98 	dev->mt76.mcu.timeout = 20 * HZ;
99 
100 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
101 	if (!seq)
102 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
103 	if (wait_seq)
104 		*wait_seq = seq;
105 
106 	txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
107 	txd = (__le32 *)skb_push(skb, txd_len);
108 
109 	if (cmd != MCU_CMD_FW_SCATTER) {
110 		q_idx = MT_TX_MCU_PORT_RX_Q0;
111 		pkt_fmt = MT_TX_TYPE_CMD;
112 	} else {
113 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
114 		pkt_fmt = MT_TX_TYPE_FW;
115 	}
116 
117 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
118 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
119 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
120 	txd[0] = cpu_to_le32(val);
121 
122 	val = MT_TXD1_LONG_FORMAT |
123 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
124 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
125 	txd[1] = cpu_to_le32(val);
126 
127 	if (cmd & MCU_UNI_PREFIX) {
128 		uni_txd = (struct mt7615_uni_txd *)txd;
129 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
130 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
131 		uni_txd->cid = cpu_to_le16(mcu_cmd);
132 		uni_txd->s2d_index = MCU_S2D_H2N;
133 		uni_txd->pkt_type = MCU_PKT_ID;
134 		uni_txd->seq = seq;
135 
136 		return;
137 	}
138 
139 	mcu_txd = (struct mt7615_mcu_txd *)txd;
140 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
141 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
142 	mcu_txd->s2d_index = MCU_S2D_H2N;
143 	mcu_txd->pkt_type = MCU_PKT_ID;
144 	mcu_txd->seq = seq;
145 
146 	switch (cmd & ~MCU_CMD_MASK) {
147 	case MCU_FW_PREFIX:
148 		mcu_txd->set_query = MCU_Q_NA;
149 		mcu_txd->cid = mcu_cmd;
150 		break;
151 	case MCU_CE_PREFIX:
152 		if (cmd & MCU_QUERY_MASK)
153 			mcu_txd->set_query = MCU_Q_QUERY;
154 		else
155 			mcu_txd->set_query = MCU_Q_SET;
156 		mcu_txd->cid = mcu_cmd;
157 		break;
158 	default:
159 		mcu_txd->cid = MCU_CMD_EXT_CID;
160 		if (cmd & MCU_QUERY_PREFIX)
161 			mcu_txd->set_query = MCU_Q_QUERY;
162 		else
163 			mcu_txd->set_query = MCU_Q_SET;
164 		mcu_txd->ext_cid = mcu_cmd;
165 		mcu_txd->ext_cid_ack = 1;
166 		break;
167 	}
168 }
169 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
170 
171 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
172 			      struct sk_buff *skb, int seq)
173 {
174 	struct mt7615_mcu_rxd *rxd;
175 	int ret = 0;
176 
177 	if (!skb) {
178 		dev_err(mdev->dev, "Message %ld (seq %d) timeout\n",
179 			cmd & MCU_CMD_MASK, seq);
180 		return -ETIMEDOUT;
181 	}
182 
183 	rxd = (struct mt7615_mcu_rxd *)skb->data;
184 	if (seq != rxd->seq)
185 		return -EAGAIN;
186 
187 	switch (cmd) {
188 	case MCU_CMD_PATCH_SEM_CONTROL:
189 		skb_pull(skb, sizeof(*rxd) - 4);
190 		ret = *skb->data;
191 		break;
192 	case MCU_EXT_CMD_GET_TEMP:
193 		skb_pull(skb, sizeof(*rxd));
194 		ret = le32_to_cpu(*(__le32 *)skb->data);
195 		break;
196 	case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
197 		skb_pull(skb, sizeof(*rxd));
198 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
199 		break;
200 	case MCU_UNI_CMD_DEV_INFO_UPDATE:
201 	case MCU_UNI_CMD_BSS_INFO_UPDATE:
202 	case MCU_UNI_CMD_STA_REC_UPDATE:
203 	case MCU_UNI_CMD_HIF_CTRL:
204 	case MCU_UNI_CMD_OFFLOAD:
205 	case MCU_UNI_CMD_SUSPEND: {
206 		struct mt7615_mcu_uni_event *event;
207 
208 		skb_pull(skb, sizeof(*rxd));
209 		event = (struct mt7615_mcu_uni_event *)skb->data;
210 		ret = le32_to_cpu(event->status);
211 		break;
212 	}
213 	case MCU_CMD_REG_READ: {
214 		struct mt7615_mcu_reg_event *event;
215 
216 		skb_pull(skb, sizeof(*rxd));
217 		event = (struct mt7615_mcu_reg_event *)skb->data;
218 		ret = (int)le32_to_cpu(event->val);
219 		break;
220 	}
221 	default:
222 		break;
223 	}
224 
225 	return ret;
226 }
227 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
228 
229 static int
230 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
231 			int cmd, int *seq)
232 {
233 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
234 	enum mt76_txq_id qid;
235 
236 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
237 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
238 		qid = MT_MCUQ_WM;
239 	else
240 		qid = MT_MCUQ_FWDL;
241 
242 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
243 }
244 
245 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
246 {
247 	struct {
248 		__le32 wifi_stream;
249 		__le32 address;
250 		__le32 data;
251 	} req = {
252 		.wifi_stream = cpu_to_le32(wf),
253 		.address = cpu_to_le32(reg),
254 	};
255 
256 	return mt76_mcu_send_msg(&dev->mt76,
257 				 MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
258 				 &req, sizeof(req), true);
259 }
260 
261 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
262 {
263 	struct {
264 		__le32 wifi_stream;
265 		__le32 address;
266 		__le32 data;
267 	} req = {
268 		.wifi_stream = cpu_to_le32(wf),
269 		.address = cpu_to_le32(reg),
270 		.data = cpu_to_le32(val),
271 	};
272 
273 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
274 				 sizeof(req), false);
275 }
276 
277 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
278 {
279 	if (!is_mt7622(&dev->mt76))
280 		return;
281 
282 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
283 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
284 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
285 }
286 
287 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
288 {
289 	struct mt76_phy *mphy = &dev->mt76.phy;
290 	struct mt76_dev *mdev = &dev->mt76;
291 	u32 addr;
292 	int err;
293 
294 	addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
295 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
296 
297 	mt7622_trigger_hif_int(dev, true);
298 
299 	addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
300 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
301 
302 	mt7622_trigger_hif_int(dev, false);
303 
304 	if (err) {
305 		dev_err(mdev->dev, "driver own failed\n");
306 		return -ETIMEDOUT;
307 	}
308 
309 	clear_bit(MT76_STATE_PM, &mphy->state);
310 
311 	return 0;
312 }
313 
314 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
315 {
316 	struct mt76_phy *mphy = &dev->mt76.phy;
317 	int i;
318 
319 	if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
320 		goto out;
321 
322 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
323 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
324 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
325 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
326 			break;
327 	}
328 
329 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
330 		dev_err(dev->mt76.dev, "driver own failed\n");
331 		set_bit(MT76_STATE_PM, &mphy->state);
332 		return -EIO;
333 	}
334 
335 out:
336 	dev->pm.last_activity = jiffies;
337 
338 	return 0;
339 }
340 
341 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
342 {
343 	struct mt76_phy *mphy = &dev->mt76.phy;
344 	int err = 0;
345 	u32 addr;
346 
347 	if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
348 		return 0;
349 
350 	mt7622_trigger_hif_int(dev, true);
351 
352 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
353 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
354 
355 	if (is_mt7622(&dev->mt76) &&
356 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
357 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
358 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
359 		clear_bit(MT76_STATE_PM, &mphy->state);
360 		err = -EIO;
361 	}
362 
363 	mt7622_trigger_hif_int(dev, false);
364 
365 	return err;
366 }
367 
368 static void
369 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
370 {
371 	if (vif->csa_active)
372 		ieee80211_csa_finish(vif);
373 }
374 
375 static void
376 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
377 {
378 	struct mt76_phy *mphy = &dev->mt76.phy;
379 	struct mt7615_mcu_rdd_report *r;
380 
381 	r = (struct mt7615_mcu_rdd_report *)skb->data;
382 
383 	if (r->idx && dev->mt76.phy2)
384 		mphy = dev->mt76.phy2;
385 
386 	ieee80211_radar_detected(mphy->hw);
387 	dev->hw_pattern++;
388 }
389 
390 static void
391 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
392 {
393 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
394 	const char *data = (char *)&rxd[1];
395 	const char *type;
396 
397 	switch (rxd->s2d_index) {
398 	case 0:
399 		type = "N9";
400 		break;
401 	case 2:
402 		type = "CR4";
403 		break;
404 	default:
405 		type = "unknown";
406 		break;
407 	}
408 
409 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
410 }
411 
412 static void
413 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
416 
417 	switch (rxd->ext_eid) {
418 	case MCU_EXT_EVENT_RDD_REPORT:
419 		mt7615_mcu_rx_radar_detected(dev, skb);
420 		break;
421 	case MCU_EXT_EVENT_CSA_NOTIFY:
422 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
423 				IEEE80211_IFACE_ITER_RESUME_ALL,
424 				mt7615_mcu_csa_finish, dev);
425 		break;
426 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
427 		mt7615_mcu_rx_log_message(dev, skb);
428 		break;
429 	default:
430 		break;
431 	}
432 }
433 
434 static void
435 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
436 {
437 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
438 	struct mt7615_phy *phy;
439 	struct mt76_phy *mphy;
440 
441 	if (*seq_num & BIT(7) && dev->mt76.phy2)
442 		mphy = dev->mt76.phy2;
443 	else
444 		mphy = &dev->mt76.phy;
445 
446 	phy = (struct mt7615_phy *)mphy->priv;
447 
448 	spin_lock_bh(&dev->mt76.lock);
449 	__skb_queue_tail(&phy->scan_event_list, skb);
450 	spin_unlock_bh(&dev->mt76.lock);
451 
452 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
453 				     MT7615_HW_SCAN_TIMEOUT);
454 }
455 
456 static void
457 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
458 {
459 	struct mt7615_roc_tlv *event;
460 	struct mt7615_phy *phy;
461 	struct mt76_phy *mphy;
462 	int duration;
463 
464 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
465 	event = (struct mt7615_roc_tlv *)skb->data;
466 
467 	if (event->dbdc_band && dev->mt76.phy2)
468 		mphy = dev->mt76.phy2;
469 	else
470 		mphy = &dev->mt76.phy;
471 
472 	ieee80211_ready_on_channel(mphy->hw);
473 
474 	phy = (struct mt7615_phy *)mphy->priv;
475 	phy->roc_grant = true;
476 	wake_up(&phy->roc_wait);
477 
478 	duration = le32_to_cpu(event->max_interval);
479 	mod_timer(&phy->roc_timer,
480 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
481 }
482 
483 static void
484 mt7615_mcu_beacon_loss_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
485 {
486 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
487 	struct mt7615_beacon_loss_event *event = priv;
488 
489 	if (mvif->idx != event->bss_idx)
490 		return;
491 
492 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
493 		return;
494 
495 	ieee80211_beacon_loss(vif);
496 }
497 
498 static void
499 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
500 {
501 	struct mt7615_beacon_loss_event *event;
502 	struct mt76_phy *mphy;
503 	u8 band_idx = 0; /* DBDC support */
504 
505 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
506 	event = (struct mt7615_beacon_loss_event *)skb->data;
507 	if (band_idx && dev->mt76.phy2)
508 		mphy = dev->mt76.phy2;
509 	else
510 		mphy = &dev->mt76.phy;
511 
512 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
513 					IEEE80211_IFACE_ITER_RESUME_ALL,
514 					mt7615_mcu_beacon_loss_iter, event);
515 }
516 
517 static void
518 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
519 {
520 	struct mt7615_mcu_bss_event *event;
521 	struct mt76_phy *mphy;
522 	u8 band_idx = 0; /* DBDC support */
523 
524 	event = (struct mt7615_mcu_bss_event *)(skb->data +
525 						sizeof(struct mt7615_mcu_rxd));
526 
527 	if (band_idx && dev->mt76.phy2)
528 		mphy = dev->mt76.phy2;
529 	else
530 		mphy = &dev->mt76.phy;
531 
532 	if (event->is_absent)
533 		ieee80211_stop_queues(mphy->hw);
534 	else
535 		ieee80211_wake_queues(mphy->hw);
536 }
537 
538 static void
539 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
540 {
541 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
542 
543 	switch (rxd->eid) {
544 	case MCU_EVENT_EXT:
545 		mt7615_mcu_rx_ext_event(dev, skb);
546 		break;
547 	case MCU_EVENT_BSS_BEACON_LOSS:
548 		mt7615_mcu_beacon_loss_event(dev, skb);
549 		break;
550 	case MCU_EVENT_ROC:
551 		mt7615_mcu_roc_event(dev, skb);
552 		break;
553 	case MCU_EVENT_SCHED_SCAN_DONE:
554 	case MCU_EVENT_SCAN_DONE:
555 		mt7615_mcu_scan_event(dev, skb);
556 		return;
557 	case MCU_EVENT_BSS_ABSENCE:
558 		mt7615_mcu_bss_event(dev, skb);
559 		break;
560 	default:
561 		break;
562 	}
563 	dev_kfree_skb(skb);
564 }
565 
566 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
567 {
568 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
569 
570 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
571 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
572 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
573 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
574 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
575 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
576 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
577 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
578 	    rxd->eid == MCU_EVENT_ROC ||
579 	    !rxd->seq)
580 		mt7615_mcu_rx_unsolicited_event(dev, skb);
581 	else
582 		mt76_mcu_rx_event(&dev->mt76, skb);
583 }
584 
585 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
586 				    u32 len, u32 mode)
587 {
588 	struct {
589 		__le32 addr;
590 		__le32 len;
591 		__le32 mode;
592 	} req = {
593 		.addr = cpu_to_le32(addr),
594 		.len = cpu_to_le32(len),
595 		.mode = cpu_to_le32(mode),
596 	};
597 
598 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TARGET_ADDRESS_LEN_REQ,
599 				 &req, sizeof(req), true);
600 }
601 
602 static int
603 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
604 		       bool bssid, bool enable)
605 {
606 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
607 	u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
608 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
609 	const u8 *addr = vif->addr;
610 	struct {
611 		u8 mode;
612 		u8 force_clear;
613 		u8 clear_bitmap[8];
614 		u8 entry_count;
615 		u8 write;
616 
617 		u8 index;
618 		u8 bssid;
619 		u8 addr[ETH_ALEN];
620 	} __packed req = {
621 		.mode = !!mask || enable,
622 		.entry_count = 1,
623 		.write = 1,
624 
625 		.index = idx * 2 + bssid,
626 	};
627 
628 	if (bssid)
629 		addr = vif->bss_conf.bssid;
630 
631 	if (enable)
632 		ether_addr_copy(req.addr, addr);
633 
634 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
635 				 sizeof(req), true);
636 }
637 
638 static int
639 mt7615_mcu_add_dev(struct mt7615_dev *dev, struct ieee80211_vif *vif,
640 		   bool enable)
641 {
642 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
643 	struct {
644 		struct req_hdr {
645 			u8 omac_idx;
646 			u8 band_idx;
647 			__le16 tlv_num;
648 			u8 is_tlv_append;
649 			u8 rsv[3];
650 		} __packed hdr;
651 		struct req_tlv {
652 			__le16 tag;
653 			__le16 len;
654 			u8 active;
655 			u8 band_idx;
656 			u8 omac_addr[ETH_ALEN];
657 		} __packed tlv;
658 	} data = {
659 		.hdr = {
660 			.omac_idx = mvif->omac_idx,
661 			.band_idx = mvif->band_idx,
662 			.tlv_num = cpu_to_le16(1),
663 			.is_tlv_append = 1,
664 		},
665 		.tlv = {
666 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
667 			.len = cpu_to_le16(sizeof(struct req_tlv)),
668 			.active = enable,
669 			.band_idx = mvif->band_idx,
670 		},
671 	};
672 
673 	if (mvif->omac_idx >= REPEATER_BSSID_START)
674 		return mt7615_mcu_muar_config(dev, vif, false, enable);
675 
676 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
677 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
678 				 &data, sizeof(data), true);
679 }
680 
681 static int
682 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
683 			      struct ieee80211_hw *hw,
684 			      struct ieee80211_vif *vif, bool enable)
685 {
686 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
687 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
688 	struct ieee80211_mutable_offsets offs;
689 	struct ieee80211_tx_info *info;
690 	struct req {
691 		u8 omac_idx;
692 		u8 enable;
693 		u8 wlan_idx;
694 		u8 band_idx;
695 		u8 pkt_type;
696 		u8 need_pre_tbtt_int;
697 		__le16 csa_ie_pos;
698 		__le16 pkt_len;
699 		__le16 tim_ie_pos;
700 		u8 pkt[512];
701 		u8 csa_cnt;
702 		/* bss color change */
703 		u8 bcc_cnt;
704 		__le16 bcc_ie_pos;
705 	} __packed req = {
706 		.omac_idx = mvif->omac_idx,
707 		.enable = enable,
708 		.wlan_idx = wcid->idx,
709 		.band_idx = mvif->band_idx,
710 	};
711 	struct sk_buff *skb;
712 
713 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
714 	if (!skb)
715 		return -EINVAL;
716 
717 	if (skb->len > 512 - MT_TXD_SIZE) {
718 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
719 		dev_kfree_skb(skb);
720 		return -EINVAL;
721 	}
722 
723 	if (mvif->band_idx) {
724 		info = IEEE80211_SKB_CB(skb);
725 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
726 	}
727 
728 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
729 			      0, NULL, true);
730 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
731 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
732 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
733 	if (offs.cntdwn_counter_offs[0]) {
734 		u16 csa_offs;
735 
736 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
737 		req.csa_ie_pos = cpu_to_le16(csa_offs);
738 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
739 	}
740 	dev_kfree_skb(skb);
741 
742 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
743 				 sizeof(req), true);
744 }
745 
746 static int
747 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
748 {
749 #define ENTER_PM_STATE	1
750 #define EXIT_PM_STATE	2
751 	struct {
752 		u8 pm_number;
753 		u8 pm_state;
754 		u8 bssid[ETH_ALEN];
755 		u8 dtim_period;
756 		u8 wlan_idx;
757 		__le16 bcn_interval;
758 		__le32 aid;
759 		__le32 rx_filter;
760 		u8 band_idx;
761 		u8 rsv[3];
762 		__le32 feature;
763 		u8 omac_idx;
764 		u8 wmm_idx;
765 		u8 bcn_loss_cnt;
766 		u8 bcn_sp_duration;
767 	} __packed req = {
768 		.pm_number = 5,
769 		.pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
770 		.band_idx = band,
771 	};
772 
773 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
774 				 sizeof(req), true);
775 }
776 
777 static struct sk_buff *
778 mt7615_mcu_alloc_sta_req(struct mt7615_dev *dev, struct mt7615_vif *mvif,
779 			 struct mt7615_sta *msta)
780 {
781 	struct sta_req_hdr hdr = {
782 		.bss_idx = mvif->idx,
783 		.wlan_idx = msta ? msta->wcid.idx : 0,
784 		.muar_idx = msta ? mvif->omac_idx : 0,
785 		.is_tlv_append = 1,
786 	};
787 	struct sk_buff *skb;
788 
789 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7615_STA_UPDATE_MAX_SIZE);
790 	if (!skb)
791 		return ERR_PTR(-ENOMEM);
792 
793 	skb_put_data(skb, &hdr, sizeof(hdr));
794 
795 	return skb;
796 }
797 
798 static struct wtbl_req_hdr *
799 mt7615_mcu_alloc_wtbl_req(struct mt7615_dev *dev, struct mt7615_sta *msta,
800 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
801 {
802 	struct tlv *sta_hdr = sta_wtbl;
803 	struct wtbl_req_hdr hdr = {
804 		.wlan_idx = msta->wcid.idx,
805 		.operation = cmd,
806 	};
807 	struct sk_buff *nskb = *skb;
808 
809 	if (!nskb) {
810 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
811 					  MT7615_WTBL_UPDATE_BA_SIZE);
812 		if (!nskb)
813 			return ERR_PTR(-ENOMEM);
814 
815 		*skb = nskb;
816 	}
817 
818 	if (sta_hdr)
819 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
820 
821 	return skb_put_data(nskb, &hdr, sizeof(hdr));
822 }
823 
824 static struct tlv *
825 mt7615_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
826 			  void *sta_ntlv, void *sta_wtbl)
827 {
828 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
829 	struct tlv *sta_hdr = sta_wtbl;
830 	struct tlv *ptlv, tlv = {
831 		.tag = cpu_to_le16(tag),
832 		.len = cpu_to_le16(len),
833 	};
834 	u16 ntlv;
835 
836 	ptlv = skb_put(skb, len);
837 	memcpy(ptlv, &tlv, sizeof(tlv));
838 
839 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
840 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
841 
842 	if (sta_hdr) {
843 		u16 size = le16_to_cpu(sta_hdr->len);
844 
845 		sta_hdr->len = cpu_to_le16(size + len);
846 	}
847 
848 	return ptlv;
849 }
850 
851 static struct tlv *
852 mt7615_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
853 {
854 	return mt7615_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
855 }
856 
857 static int
858 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
859 			 struct ieee80211_sta *sta, bool enable)
860 {
861 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
862 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
863 	struct bss_info_basic *bss;
864 	u8 wlan_idx = mvif->sta.wcid.idx;
865 	struct tlv *tlv;
866 
867 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
868 
869 	switch (vif->type) {
870 	case NL80211_IFTYPE_MESH_POINT:
871 	case NL80211_IFTYPE_AP:
872 		break;
873 	case NL80211_IFTYPE_STATION:
874 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
875 		if (enable && sta) {
876 			struct mt7615_sta *msta;
877 
878 			msta = (struct mt7615_sta *)sta->drv_priv;
879 			wlan_idx = msta->wcid.idx;
880 		}
881 		break;
882 	case NL80211_IFTYPE_ADHOC:
883 		type = NETWORK_IBSS;
884 		break;
885 	default:
886 		WARN_ON(1);
887 		break;
888 	}
889 
890 	bss = (struct bss_info_basic *)tlv;
891 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
892 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
893 	bss->network_type = cpu_to_le32(type);
894 	bss->dtim_period = vif->bss_conf.dtim_period;
895 	bss->bmc_tx_wlan_idx = wlan_idx;
896 	bss->wmm_idx = mvif->wmm_idx;
897 	bss->active = enable;
898 
899 	return 0;
900 }
901 
902 static void
903 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
904 {
905 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
906 	struct bss_info_omac *omac;
907 	struct tlv *tlv;
908 	u32 type = 0;
909 	u8 idx;
910 
911 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
912 
913 	switch (vif->type) {
914 	case NL80211_IFTYPE_MESH_POINT:
915 	case NL80211_IFTYPE_AP:
916 		if (vif->p2p)
917 			type = CONNECTION_P2P_GO;
918 		else
919 			type = CONNECTION_INFRA_AP;
920 		break;
921 	case NL80211_IFTYPE_STATION:
922 		if (vif->p2p)
923 			type = CONNECTION_P2P_GC;
924 		else
925 			type = CONNECTION_INFRA_STA;
926 		break;
927 	case NL80211_IFTYPE_ADHOC:
928 		type = CONNECTION_IBSS_ADHOC;
929 		break;
930 	default:
931 		WARN_ON(1);
932 		break;
933 	}
934 
935 	omac = (struct bss_info_omac *)tlv;
936 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
937 	omac->conn_type = cpu_to_le32(type);
938 	omac->omac_idx = mvif->omac_idx;
939 	omac->band_idx = mvif->band_idx;
940 	omac->hw_bss_idx = idx;
941 }
942 
943 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
944 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
945 static void
946 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
947 {
948 	struct bss_info_ext_bss *ext;
949 	int ext_bss_idx, tsf_offset;
950 	struct tlv *tlv;
951 
952 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
953 	if (ext_bss_idx < 0)
954 		return;
955 
956 	tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
957 
958 	ext = (struct bss_info_ext_bss *)tlv;
959 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
960 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
961 }
962 
963 static void
964 mt7615_mcu_sta_ba_tlv(struct sk_buff *skb,
965 		      struct ieee80211_ampdu_params *params,
966 		      bool enable, bool tx)
967 {
968 	struct sta_rec_ba *ba;
969 	struct tlv *tlv;
970 
971 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
972 
973 	ba = (struct sta_rec_ba *)tlv;
974 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
975 	ba->winsize = cpu_to_le16(params->buf_size);
976 	ba->ssn = cpu_to_le16(params->ssn);
977 	ba->ba_en = enable << params->tid;
978 	ba->amsdu = params->amsdu;
979 	ba->tid = params->tid;
980 }
981 
982 static void
983 mt7615_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
984 			 struct ieee80211_sta *sta, bool enable)
985 {
986 	struct sta_rec_basic *basic;
987 	struct tlv *tlv;
988 	int conn_type;
989 
990 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
991 
992 	basic = (struct sta_rec_basic *)tlv;
993 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
994 
995 	if (enable) {
996 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
997 		basic->conn_state = CONN_STATE_PORT_SECURE;
998 	} else {
999 		basic->conn_state = CONN_STATE_DISCONNECT;
1000 	}
1001 
1002 	if (!sta) {
1003 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1004 		eth_broadcast_addr(basic->peer_addr);
1005 		return;
1006 	}
1007 
1008 	switch (vif->type) {
1009 	case NL80211_IFTYPE_MESH_POINT:
1010 	case NL80211_IFTYPE_AP:
1011 		if (vif->p2p)
1012 			conn_type = CONNECTION_P2P_GC;
1013 		else
1014 			conn_type = CONNECTION_INFRA_STA;
1015 		basic->conn_type = cpu_to_le32(conn_type);
1016 		basic->aid = cpu_to_le16(sta->aid);
1017 		break;
1018 	case NL80211_IFTYPE_STATION:
1019 		if (vif->p2p)
1020 			conn_type = CONNECTION_P2P_GO;
1021 		else
1022 			conn_type = CONNECTION_INFRA_AP;
1023 		basic->conn_type = cpu_to_le32(conn_type);
1024 		basic->aid = cpu_to_le16(vif->bss_conf.aid);
1025 		break;
1026 	case NL80211_IFTYPE_ADHOC:
1027 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1028 		basic->aid = cpu_to_le16(sta->aid);
1029 		break;
1030 	default:
1031 		WARN_ON(1);
1032 		break;
1033 	}
1034 
1035 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1036 	basic->qos = sta->wme;
1037 }
1038 
1039 static void
1040 mt7615_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1041 {
1042 	struct tlv *tlv;
1043 
1044 	if (sta->ht_cap.ht_supported) {
1045 		struct sta_rec_ht *ht;
1046 
1047 		tlv = mt7615_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1048 		ht = (struct sta_rec_ht *)tlv;
1049 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1050 	}
1051 	if (sta->vht_cap.vht_supported) {
1052 		struct sta_rec_vht *vht;
1053 
1054 		tlv = mt7615_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1055 		vht = (struct sta_rec_vht *)tlv;
1056 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1057 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1058 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1059 	}
1060 }
1061 
1062 static void
1063 mt7615_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,
1064 		     struct ieee80211_sta *sta)
1065 {
1066 	struct sta_rec_uapsd *uapsd;
1067 	struct tlv *tlv;
1068 
1069 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1070 		return;
1071 
1072 	tlv = mt7615_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1073 	uapsd = (struct sta_rec_uapsd *)tlv;
1074 
1075 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1076 		uapsd->dac_map |= BIT(3);
1077 		uapsd->tac_map |= BIT(3);
1078 	}
1079 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1080 		uapsd->dac_map |= BIT(2);
1081 		uapsd->tac_map |= BIT(2);
1082 	}
1083 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1084 		uapsd->dac_map |= BIT(1);
1085 		uapsd->tac_map |= BIT(1);
1086 	}
1087 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1088 		uapsd->dac_map |= BIT(0);
1089 		uapsd->tac_map |= BIT(0);
1090 	}
1091 	uapsd->max_sp = sta->max_sp;
1092 }
1093 
1094 static void
1095 mt7615_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1096 		       struct ieee80211_ampdu_params *params,
1097 		       bool enable, bool tx, void *sta_wtbl,
1098 		       void *wtbl_tlv)
1099 {
1100 	struct wtbl_ba *ba;
1101 	struct tlv *tlv;
1102 
1103 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1104 					wtbl_tlv, sta_wtbl);
1105 
1106 	ba = (struct wtbl_ba *)tlv;
1107 	ba->tid = params->tid;
1108 
1109 	if (tx) {
1110 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1111 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1112 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1113 		ba->ba_en = enable;
1114 	} else {
1115 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1116 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1117 		ba->rst_ba_tid = params->tid;
1118 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1119 		ba->rst_ba_sb = 1;
1120 	}
1121 
1122 	if (enable && tx) {
1123 		u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1124 		int i;
1125 
1126 		for (i = 7; i > 0; i--) {
1127 			if (params->buf_size >= ba_range[i])
1128 				break;
1129 		}
1130 		ba->ba_winsize_idx = i;
1131 	}
1132 }
1133 
1134 static void
1135 mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1136 			    struct ieee80211_sta *sta, void *sta_wtbl,
1137 			    void *wtbl_tlv)
1138 {
1139 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1140 	struct wtbl_generic *generic;
1141 	struct wtbl_rx *rx;
1142 	struct wtbl_spe *spe;
1143 	struct tlv *tlv;
1144 
1145 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1146 					wtbl_tlv, sta_wtbl);
1147 
1148 	generic = (struct wtbl_generic *)tlv;
1149 
1150 	if (sta) {
1151 		if (vif->type == NL80211_IFTYPE_STATION)
1152 			generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
1153 		else
1154 			generic->partial_aid = cpu_to_le16(sta->aid);
1155 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1156 		generic->muar_idx = mvif->omac_idx;
1157 		generic->qos = sta->wme;
1158 	} else {
1159 		eth_broadcast_addr(generic->peer_addr);
1160 		generic->muar_idx = 0xe;
1161 	}
1162 
1163 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1164 					wtbl_tlv, sta_wtbl);
1165 
1166 	rx = (struct wtbl_rx *)tlv;
1167 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1168 	rx->rca2 = 1;
1169 	rx->rv = 1;
1170 
1171 	tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
1172 					wtbl_tlv, sta_wtbl);
1173 	spe = (struct wtbl_spe *)tlv;
1174 	spe->spe_idx = 24;
1175 }
1176 
1177 static void
1178 mt7615_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1179 		       void *sta_wtbl, void *wtbl_tlv)
1180 {
1181 	struct tlv *tlv;
1182 	struct wtbl_ht *ht = NULL;
1183 	u32 flags = 0;
1184 
1185 	if (sta->ht_cap.ht_supported) {
1186 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1187 						wtbl_tlv, sta_wtbl);
1188 		ht = (struct wtbl_ht *)tlv;
1189 		ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1190 		ht->af = sta->ht_cap.ampdu_factor;
1191 		ht->mm = sta->ht_cap.ampdu_density;
1192 		ht->ht = 1;
1193 
1194 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1195 			flags |= MT_WTBL_W5_SHORT_GI_20;
1196 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1197 			flags |= MT_WTBL_W5_SHORT_GI_40;
1198 	}
1199 
1200 	if (sta->vht_cap.vht_supported) {
1201 		struct wtbl_vht *vht;
1202 		u8 af;
1203 
1204 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1205 						wtbl_tlv, sta_wtbl);
1206 		vht = (struct wtbl_vht *)tlv;
1207 		vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1208 		vht->vht = 1;
1209 
1210 		af = (sta->vht_cap.cap &
1211 		      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
1212 		      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
1213 
1214 		if (ht)
1215 		    ht->af = max(ht->af, af);
1216 
1217 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1218 			flags |= MT_WTBL_W5_SHORT_GI_80;
1219 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1220 			flags |= MT_WTBL_W5_SHORT_GI_160;
1221 	}
1222 
1223 	/* wtbl smps */
1224 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
1225 		struct wtbl_smps *smps;
1226 
1227 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1228 						wtbl_tlv, sta_wtbl);
1229 		smps = (struct wtbl_smps *)tlv;
1230 		smps->smps = 1;
1231 	}
1232 
1233 	if (sta->ht_cap.ht_supported) {
1234 		/* sgi */
1235 		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
1236 			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
1237 		struct wtbl_raw *raw;
1238 
1239 		tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
1240 						sizeof(*raw), wtbl_tlv,
1241 						sta_wtbl);
1242 		raw = (struct wtbl_raw *)tlv;
1243 		raw->val = cpu_to_le32(flags);
1244 		raw->msk = cpu_to_le32(~msk);
1245 		raw->wtbl_idx = 1;
1246 		raw->dw = 5;
1247 	}
1248 }
1249 
1250 static int
1251 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1252 		   struct ieee80211_sta *sta, bool enable)
1253 {
1254 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1255 	struct mt7615_dev *dev = phy->dev;
1256 	struct sk_buff *skb;
1257 
1258 	if (mvif->omac_idx >= REPEATER_BSSID_START)
1259 		mt7615_mcu_muar_config(dev, vif, true, enable);
1260 
1261 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, NULL);
1262 	if (IS_ERR(skb))
1263 		return PTR_ERR(skb);
1264 
1265 	if (enable)
1266 		mt7615_mcu_bss_omac_tlv(skb, vif);
1267 
1268 	mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
1269 
1270 	if (enable && mvif->omac_idx >= EXT_BSSID_START &&
1271 	    mvif->omac_idx < REPEATER_BSSID_START)
1272 		mt7615_mcu_bss_ext_tlv(skb, mvif);
1273 
1274 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1275 				     MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1276 }
1277 
1278 static int
1279 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
1280 		      struct ieee80211_ampdu_params *params,
1281 		      bool enable)
1282 {
1283 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1284 	struct mt7615_vif *mvif = msta->vif;
1285 	struct wtbl_req_hdr *wtbl_hdr;
1286 	struct sk_buff *skb = NULL;
1287 	int err;
1288 
1289 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1290 	if (IS_ERR(wtbl_hdr))
1291 		return PTR_ERR(wtbl_hdr);
1292 
1293 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, NULL, wtbl_hdr);
1294 
1295 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1296 				    true);
1297 	if (err < 0)
1298 		return err;
1299 
1300 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1301 	if (IS_ERR(skb))
1302 		return PTR_ERR(skb);
1303 
1304 	mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1305 
1306 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1307 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1308 }
1309 
1310 static int
1311 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
1312 		      struct ieee80211_ampdu_params *params,
1313 		      bool enable)
1314 {
1315 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1316 	struct mt7615_vif *mvif = msta->vif;
1317 	struct wtbl_req_hdr *wtbl_hdr;
1318 	struct sk_buff *skb;
1319 	int err;
1320 
1321 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1322 	if (IS_ERR(skb))
1323 		return PTR_ERR(skb);
1324 
1325 	mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1326 
1327 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1328 				    MCU_EXT_CMD_STA_REC_UPDATE, true);
1329 	if (err < 0 || !enable)
1330 		return err;
1331 
1332 	skb = NULL;
1333 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1334 	if (IS_ERR(wtbl_hdr))
1335 		return PTR_ERR(wtbl_hdr);
1336 
1337 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, NULL, wtbl_hdr);
1338 
1339 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1340 				     true);
1341 }
1342 
1343 static int
1344 mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1345 			struct ieee80211_sta *sta, bool enable)
1346 {
1347 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1348 	struct sk_buff *skb, *sskb, *wskb = NULL;
1349 	struct wtbl_req_hdr *wtbl_hdr;
1350 	struct mt7615_sta *msta;
1351 	int cmd, err;
1352 
1353 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1354 
1355 	sskb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1356 	if (IS_ERR(sskb))
1357 		return PTR_ERR(sskb);
1358 
1359 	mt7615_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1360 	if (enable && sta) {
1361 		mt7615_mcu_sta_ht_tlv(sskb, sta);
1362 		mt7615_mcu_sta_uapsd(sskb, vif, sta);
1363 	}
1364 
1365 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1366 					     NULL, &wskb);
1367 	if (IS_ERR(wtbl_hdr))
1368 		return PTR_ERR(wtbl_hdr);
1369 
1370 	if (enable) {
1371 		mt7615_mcu_wtbl_generic_tlv(wskb, vif, sta, NULL, wtbl_hdr);
1372 		if (sta)
1373 			mt7615_mcu_wtbl_ht_tlv(wskb, sta, NULL, wtbl_hdr);
1374 	}
1375 
1376 	cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1377 	skb = enable ? wskb : sskb;
1378 
1379 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1380 	if (err < 0) {
1381 		skb = enable ? sskb : wskb;
1382 		dev_kfree_skb(skb);
1383 
1384 		return err;
1385 	}
1386 
1387 	cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1388 	skb = enable ? sskb : wskb;
1389 
1390 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1391 }
1392 
1393 static const struct mt7615_mcu_ops wtbl_update_ops = {
1394 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1395 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1396 	.add_dev_info = mt7615_mcu_add_dev,
1397 	.add_bss_info = mt7615_mcu_add_bss,
1398 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1399 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1400 	.sta_add = mt7615_mcu_wtbl_sta_add,
1401 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1402 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1403 };
1404 
1405 static int
1406 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1407 		  struct ieee80211_ampdu_params *params,
1408 		  bool enable, bool tx)
1409 {
1410 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1411 	struct mt7615_vif *mvif = msta->vif;
1412 	struct wtbl_req_hdr *wtbl_hdr;
1413 	struct tlv *sta_wtbl;
1414 	struct sk_buff *skb;
1415 
1416 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1417 	if (IS_ERR(skb))
1418 		return PTR_ERR(skb);
1419 
1420 	mt7615_mcu_sta_ba_tlv(skb, params, enable, tx);
1421 
1422 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1423 
1424 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1425 					     &skb);
1426 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1427 
1428 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1429 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1430 }
1431 
1432 static int
1433 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1434 		     struct ieee80211_ampdu_params *params,
1435 		     bool enable)
1436 {
1437 	return mt7615_mcu_sta_ba(dev, params, enable, true);
1438 }
1439 
1440 static int
1441 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1442 		     struct ieee80211_ampdu_params *params,
1443 		     bool enable)
1444 {
1445 	return mt7615_mcu_sta_ba(dev, params, enable, false);
1446 }
1447 
1448 static int
1449 mt7615_mcu_add_sta_cmd(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1450 		       struct ieee80211_sta *sta, bool enable, int cmd)
1451 {
1452 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1453 	struct wtbl_req_hdr *wtbl_hdr;
1454 	struct mt7615_sta *msta;
1455 	struct tlv *sta_wtbl;
1456 	struct sk_buff *skb;
1457 
1458 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1459 
1460 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1461 	if (IS_ERR(skb))
1462 		return PTR_ERR(skb);
1463 
1464 	mt7615_mcu_sta_basic_tlv(skb, vif, sta, enable);
1465 	if (enable && sta) {
1466 		mt7615_mcu_sta_ht_tlv(skb, sta);
1467 		mt7615_mcu_sta_uapsd(skb, vif, sta);
1468 	}
1469 
1470 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1471 
1472 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1473 					     sta_wtbl, &skb);
1474 	if (enable) {
1475 		mt7615_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
1476 		if (sta)
1477 			mt7615_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1478 	}
1479 
1480 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1481 }
1482 
1483 static int
1484 mt7615_mcu_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1485 		   struct ieee80211_sta *sta, bool enable)
1486 {
1487 	return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1488 				      MCU_EXT_CMD_STA_REC_UPDATE);
1489 }
1490 
1491 static const struct mt7615_mcu_ops sta_update_ops = {
1492 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1493 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1494 	.add_dev_info = mt7615_mcu_add_dev,
1495 	.add_bss_info = mt7615_mcu_add_bss,
1496 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1497 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1498 	.sta_add = mt7615_mcu_add_sta,
1499 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1500 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1501 };
1502 
1503 static int
1504 mt7615_mcu_uni_add_dev(struct mt7615_dev *dev,
1505 		       struct ieee80211_vif *vif, bool enable)
1506 {
1507 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1508 	struct {
1509 		struct {
1510 			u8 omac_idx;
1511 			u8 band_idx;
1512 			__le16 pad;
1513 		} __packed hdr;
1514 		struct req_tlv {
1515 			__le16 tag;
1516 			__le16 len;
1517 			u8 active;
1518 			u8 pad;
1519 			u8 omac_addr[ETH_ALEN];
1520 		} __packed tlv;
1521 	} dev_req = {
1522 		.hdr = {
1523 			.omac_idx = mvif->omac_idx,
1524 			.band_idx = mvif->band_idx,
1525 		},
1526 		.tlv = {
1527 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1528 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1529 			.active = enable,
1530 		},
1531 	};
1532 	struct {
1533 		struct {
1534 			u8 bss_idx;
1535 			u8 pad[3];
1536 		} __packed hdr;
1537 		struct mt7615_bss_basic_tlv basic;
1538 	} basic_req = {
1539 		.hdr = {
1540 			.bss_idx = mvif->idx,
1541 		},
1542 		.basic = {
1543 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1544 			.len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1545 			.omac_idx = mvif->omac_idx,
1546 			.band_idx = mvif->band_idx,
1547 			.wmm_idx = mvif->wmm_idx,
1548 			.active = enable,
1549 			.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx),
1550 			.sta_idx = cpu_to_le16(mvif->sta.wcid.idx),
1551 			.conn_state = 1,
1552 		},
1553 	};
1554 	int err, idx, cmd, len;
1555 	void *data;
1556 
1557 	switch (vif->type) {
1558 	case NL80211_IFTYPE_MESH_POINT:
1559 	case NL80211_IFTYPE_AP:
1560 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1561 		break;
1562 	case NL80211_IFTYPE_STATION:
1563 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1564 		break;
1565 	case NL80211_IFTYPE_ADHOC:
1566 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1567 		break;
1568 	default:
1569 		WARN_ON(1);
1570 		break;
1571 	}
1572 
1573 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1574 	basic_req.basic.hw_bss_idx = idx;
1575 
1576 	memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1577 
1578 	cmd = enable ? MCU_UNI_CMD_DEV_INFO_UPDATE : MCU_UNI_CMD_BSS_INFO_UPDATE;
1579 	data = enable ? (void *)&dev_req : (void *)&basic_req;
1580 	len = enable ? sizeof(dev_req) : sizeof(basic_req);
1581 
1582 	err = mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1583 	if (err < 0)
1584 		return err;
1585 
1586 	cmd = enable ? MCU_UNI_CMD_BSS_INFO_UPDATE : MCU_UNI_CMD_DEV_INFO_UPDATE;
1587 	data = enable ? (void *)&basic_req : (void *)&dev_req;
1588 	len = enable ? sizeof(basic_req) : sizeof(dev_req);
1589 
1590 	return mt76_mcu_send_msg(&dev->mt76, cmd, data, len, true);
1591 }
1592 
1593 static int
1594 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1595 {
1596 	return 0;
1597 }
1598 
1599 static int
1600 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1601 		       struct ieee80211_sta *sta, bool enable)
1602 {
1603 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1604 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1605 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1606 	struct mt7615_dev *dev = phy->dev;
1607 	struct {
1608 		struct {
1609 			u8 bss_idx;
1610 			u8 pad[3];
1611 		} __packed hdr;
1612 		struct mt7615_bss_basic_tlv basic;
1613 		struct mt7615_bss_qos_tlv qos;
1614 	} basic_req = {
1615 		.hdr = {
1616 			.bss_idx = mvif->idx,
1617 		},
1618 		.basic = {
1619 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1620 			.len = cpu_to_le16(sizeof(struct mt7615_bss_basic_tlv)),
1621 			.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1622 			.dtim_period = vif->bss_conf.dtim_period,
1623 			.omac_idx = mvif->omac_idx,
1624 			.band_idx = mvif->band_idx,
1625 			.wmm_idx = mvif->wmm_idx,
1626 			.active = true, /* keep bss deactivated */
1627 			.phymode = 0x38,
1628 		},
1629 		.qos = {
1630 			.tag = cpu_to_le16(UNI_BSS_INFO_QBSS),
1631 			.len = cpu_to_le16(sizeof(struct mt7615_bss_qos_tlv)),
1632 			.qos = vif->bss_conf.qos,
1633 		},
1634 	};
1635 	struct {
1636 		struct {
1637 			u8 bss_idx;
1638 			u8 pad[3];
1639 		} __packed hdr;
1640 		struct rlm_tlv {
1641 			__le16 tag;
1642 			__le16 len;
1643 			u8 control_channel;
1644 			u8 center_chan;
1645 			u8 center_chan2;
1646 			u8 bw;
1647 			u8 tx_streams;
1648 			u8 rx_streams;
1649 			u8 short_st;
1650 			u8 ht_op_info;
1651 			u8 sco;
1652 			u8 pad[3];
1653 		} __packed rlm;
1654 	} __packed rlm_req = {
1655 		.hdr = {
1656 			.bss_idx = mvif->idx,
1657 		},
1658 		.rlm = {
1659 			.tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1660 			.len = cpu_to_le16(sizeof(struct rlm_tlv)),
1661 			.control_channel = chandef->chan->hw_value,
1662 			.center_chan = ieee80211_frequency_to_channel(freq1),
1663 			.center_chan2 = ieee80211_frequency_to_channel(freq2),
1664 			.tx_streams = hweight8(phy->mt76->antenna_mask),
1665 			.rx_streams = phy->chainmask,
1666 			.short_st = true,
1667 		},
1668 	};
1669 	int err, conn_type;
1670 	u8 idx;
1671 
1672 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1673 	basic_req.basic.hw_bss_idx = idx;
1674 
1675 	switch (vif->type) {
1676 	case NL80211_IFTYPE_MESH_POINT:
1677 	case NL80211_IFTYPE_AP:
1678 		if (vif->p2p)
1679 			conn_type = CONNECTION_P2P_GO;
1680 		else
1681 			conn_type = CONNECTION_INFRA_AP;
1682 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1683 		break;
1684 	case NL80211_IFTYPE_STATION:
1685 		if (vif->p2p)
1686 			conn_type = CONNECTION_P2P_GC;
1687 		else
1688 			conn_type = CONNECTION_INFRA_STA;
1689 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1690 		break;
1691 	case NL80211_IFTYPE_ADHOC:
1692 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1693 		break;
1694 	default:
1695 		WARN_ON(1);
1696 		break;
1697 	}
1698 
1699 	memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1700 	basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(mvif->sta.wcid.idx);
1701 	basic_req.basic.sta_idx = cpu_to_le16(mvif->sta.wcid.idx);
1702 	basic_req.basic.conn_state = !enable;
1703 
1704 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1705 				&basic_req, sizeof(basic_req), true);
1706 	if (err < 0)
1707 		return err;
1708 
1709 	switch (chandef->width) {
1710 	case NL80211_CHAN_WIDTH_40:
1711 		rlm_req.rlm.bw = CMD_CBW_40MHZ;
1712 		break;
1713 	case NL80211_CHAN_WIDTH_80:
1714 		rlm_req.rlm.bw = CMD_CBW_80MHZ;
1715 		break;
1716 	case NL80211_CHAN_WIDTH_80P80:
1717 		rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1718 		break;
1719 	case NL80211_CHAN_WIDTH_160:
1720 		rlm_req.rlm.bw = CMD_CBW_160MHZ;
1721 		break;
1722 	case NL80211_CHAN_WIDTH_5:
1723 		rlm_req.rlm.bw = CMD_CBW_5MHZ;
1724 		break;
1725 	case NL80211_CHAN_WIDTH_10:
1726 		rlm_req.rlm.bw = CMD_CBW_10MHZ;
1727 		break;
1728 	case NL80211_CHAN_WIDTH_20_NOHT:
1729 	case NL80211_CHAN_WIDTH_20:
1730 	default:
1731 		rlm_req.rlm.bw = CMD_CBW_20MHZ;
1732 		break;
1733 	}
1734 
1735 	if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1736 		rlm_req.rlm.sco = 1; /* SCA */
1737 	else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1738 		rlm_req.rlm.sco = 3; /* SCB */
1739 
1740 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1741 				 &rlm_req, sizeof(rlm_req), true);
1742 }
1743 
1744 static int
1745 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1746 				  struct ieee80211_hw *hw,
1747 				  struct ieee80211_vif *vif,
1748 				  bool enable)
1749 {
1750 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1751 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1752 	struct ieee80211_mutable_offsets offs;
1753 	struct {
1754 		struct req_hdr {
1755 			u8 bss_idx;
1756 			u8 pad[3];
1757 		} __packed hdr;
1758 		struct bcn_content_tlv {
1759 			__le16 tag;
1760 			__le16 len;
1761 			__le16 tim_ie_pos;
1762 			__le16 csa_ie_pos;
1763 			__le16 bcc_ie_pos;
1764 			/* 0: enable beacon offload
1765 			 * 1: disable beacon offload
1766 			 * 2: update probe respond offload
1767 			 */
1768 			u8 enable;
1769 			/* 0: legacy format (TXD + payload)
1770 			 * 1: only cap field IE
1771 			 */
1772 			u8 type;
1773 			__le16 pkt_len;
1774 			u8 pkt[512];
1775 		} __packed beacon_tlv;
1776 	} req = {
1777 		.hdr = {
1778 			.bss_idx = mvif->idx,
1779 		},
1780 		.beacon_tlv = {
1781 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1782 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1783 			.enable = enable,
1784 		},
1785 	};
1786 	struct sk_buff *skb;
1787 
1788 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1789 	if (!skb)
1790 		return -EINVAL;
1791 
1792 	if (skb->len > 512 - MT_TXD_SIZE) {
1793 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1794 		dev_kfree_skb(skb);
1795 		return -EINVAL;
1796 	}
1797 
1798 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1799 			      wcid, NULL, 0, NULL, true);
1800 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1801 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1802 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1803 
1804 	if (offs.cntdwn_counter_offs[0]) {
1805 		u16 csa_offs;
1806 
1807 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1808 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1809 	}
1810 	dev_kfree_skb(skb);
1811 
1812 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1813 				 &req, sizeof(req), true);
1814 }
1815 
1816 static int
1817 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1818 		     struct ieee80211_ampdu_params *params,
1819 		     bool enable)
1820 {
1821 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1822 	struct mt7615_vif *mvif = msta->vif;
1823 	struct wtbl_req_hdr *wtbl_hdr;
1824 	struct tlv *sta_wtbl;
1825 	struct sk_buff *skb;
1826 	int err;
1827 
1828 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1829 	if (IS_ERR(skb))
1830 		return PTR_ERR(skb);
1831 
1832 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1833 
1834 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1835 					     &skb);
1836 	if (IS_ERR(wtbl_hdr))
1837 		return PTR_ERR(wtbl_hdr);
1838 
1839 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, sta_wtbl,
1840 			       wtbl_hdr);
1841 
1842 	err =  mt76_mcu_skb_send_msg(&dev->mt76, skb,
1843 				     MCU_UNI_CMD_STA_REC_UPDATE, true);
1844 	if (err < 0)
1845 		return err;
1846 
1847 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1848 	if (IS_ERR(skb))
1849 		return PTR_ERR(skb);
1850 
1851 	mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1852 
1853 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1854 				     MCU_UNI_CMD_STA_REC_UPDATE, true);
1855 }
1856 
1857 static int
1858 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1859 		     struct ieee80211_ampdu_params *params,
1860 		     bool enable)
1861 {
1862 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1863 	struct mt7615_vif *mvif = msta->vif;
1864 	struct wtbl_req_hdr *wtbl_hdr;
1865 	struct tlv *sta_wtbl;
1866 	struct sk_buff *skb;
1867 	int err;
1868 
1869 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1870 	if (IS_ERR(skb))
1871 		return PTR_ERR(skb);
1872 
1873 	mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1874 
1875 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1876 				    MCU_UNI_CMD_STA_REC_UPDATE, true);
1877 	if (err < 0 || !enable)
1878 		return err;
1879 
1880 	skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1881 	if (IS_ERR(skb))
1882 		return PTR_ERR(skb);
1883 
1884 	sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1885 
1886 	wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1887 					     &skb);
1888 	if (IS_ERR(wtbl_hdr))
1889 		return PTR_ERR(wtbl_hdr);
1890 
1891 	mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, sta_wtbl,
1892 			       wtbl_hdr);
1893 
1894 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1895 				     MCU_UNI_CMD_STA_REC_UPDATE, true);
1896 }
1897 
1898 static int
1899 mt7615_mcu_uni_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1900 		       struct ieee80211_sta *sta, bool enable)
1901 {
1902 	return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1903 				      MCU_UNI_CMD_STA_REC_UPDATE);
1904 }
1905 
1906 static const struct mt7615_mcu_ops uni_update_ops = {
1907 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1908 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1909 	.add_dev_info = mt7615_mcu_uni_add_dev,
1910 	.add_bss_info = mt7615_mcu_uni_add_bss,
1911 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1912 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1913 	.sta_add = mt7615_mcu_uni_add_sta,
1914 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1915 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1916 };
1917 
1918 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
1919 				     u32 option)
1920 {
1921 	struct {
1922 		__le32 option;
1923 		__le32 addr;
1924 	} req = {
1925 		.option = cpu_to_le32(option),
1926 		.addr = cpu_to_le32(addr),
1927 	};
1928 
1929 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_START_REQ, &req,
1930 				 sizeof(req), true);
1931 }
1932 
1933 int mt7615_mcu_restart(struct mt76_dev *dev)
1934 {
1935 	return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1936 }
1937 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1938 
1939 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
1940 {
1941 	struct {
1942 		__le32 op;
1943 	} req = {
1944 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
1945 	};
1946 
1947 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_SEM_CONTROL, &req,
1948 				 sizeof(req), true);
1949 }
1950 
1951 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
1952 {
1953 	struct {
1954 		u8 check_crc;
1955 		u8 reserved[3];
1956 	} req = {
1957 		.check_crc = 0,
1958 	};
1959 
1960 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_FINISH_REQ, &req,
1961 				 sizeof(req), true);
1962 }
1963 
1964 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1965 {
1966 	const struct mt7615_patch_hdr *hdr;
1967 	const struct firmware *fw = NULL;
1968 	int len, ret, sem;
1969 
1970 	sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
1971 	switch (sem) {
1972 	case PATCH_IS_DL:
1973 		return 0;
1974 	case PATCH_NOT_DL_SEM_SUCCESS:
1975 		break;
1976 	default:
1977 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1978 		return -EAGAIN;
1979 	}
1980 
1981 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1982 	if (ret)
1983 		goto out;
1984 
1985 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1986 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1987 		ret = -EINVAL;
1988 		goto out;
1989 	}
1990 
1991 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1992 
1993 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1994 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1995 
1996 	len = fw->size - sizeof(*hdr);
1997 
1998 	ret = mt7615_mcu_init_download(dev, addr, len, DL_MODE_NEED_RSP);
1999 	if (ret) {
2000 		dev_err(dev->mt76.dev, "Download request failed\n");
2001 		goto out;
2002 	}
2003 
2004 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
2005 				     fw->data + sizeof(*hdr), len);
2006 	if (ret) {
2007 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2008 		goto out;
2009 	}
2010 
2011 	ret = mt7615_mcu_start_patch(dev);
2012 	if (ret)
2013 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2014 
2015 out:
2016 	release_firmware(fw);
2017 
2018 	sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
2019 	switch (sem) {
2020 	case PATCH_REL_SEM_SUCCESS:
2021 		break;
2022 	default:
2023 		ret = -EAGAIN;
2024 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2025 		break;
2026 	}
2027 
2028 	return ret;
2029 }
2030 
2031 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
2032 {
2033 	u32 ret = 0;
2034 
2035 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2036 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2037 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2038 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2039 	ret |= DL_MODE_NEED_RSP;
2040 	ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
2041 
2042 	return ret;
2043 }
2044 
2045 static int
2046 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
2047 			     const struct mt7615_fw_trailer *hdr,
2048 			     const u8 *data, bool is_cr4)
2049 {
2050 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
2051 	int err, i, offset = 0;
2052 	u32 len, addr, mode;
2053 
2054 	for (i = 0; i < n_region; i++) {
2055 		mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
2056 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
2057 		addr = le32_to_cpu(hdr[i].addr);
2058 
2059 		err = mt7615_mcu_init_download(dev, addr, len, mode);
2060 		if (err) {
2061 			dev_err(dev->mt76.dev, "Download request failed\n");
2062 			return err;
2063 		}
2064 
2065 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
2066 					     data + offset, len);
2067 		if (err) {
2068 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
2069 			return err;
2070 		}
2071 
2072 		offset += len;
2073 	}
2074 
2075 	return 0;
2076 }
2077 
2078 static const struct wiphy_wowlan_support mt7615_wowlan_support = {
2079 	.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
2080 		 WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
2081 	.n_patterns = 1,
2082 	.pattern_min_len = 1,
2083 	.pattern_max_len = MT7615_WOW_PATTEN_MAX_LEN,
2084 	.max_nd_match_sets = 10,
2085 };
2086 
2087 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
2088 {
2089 	const struct mt7615_fw_trailer *hdr;
2090 	const struct firmware *fw;
2091 	int ret;
2092 
2093 	ret = request_firmware(&fw, name, dev->mt76.dev);
2094 	if (ret)
2095 		return ret;
2096 
2097 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
2098 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2099 		ret = -EINVAL;
2100 		goto out;
2101 	}
2102 
2103 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2104 					N9_REGION_NUM * sizeof(*hdr));
2105 
2106 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2107 		 hdr->fw_ver, hdr->build_date);
2108 
2109 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2110 	if (ret)
2111 		goto out;
2112 
2113 	ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
2114 					FW_START_OVERRIDE);
2115 	if (ret) {
2116 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2117 		goto out;
2118 	}
2119 
2120 	snprintf(dev->mt76.hw->wiphy->fw_version,
2121 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2122 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2123 
2124 	if (!is_mt7615(&dev->mt76) &&
2125 	    !strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
2126 		dev->fw_ver = MT7615_FIRMWARE_V2;
2127 		dev->mcu_ops = &sta_update_ops;
2128 	} else {
2129 		dev->fw_ver = MT7615_FIRMWARE_V1;
2130 		dev->mcu_ops = &wtbl_update_ops;
2131 	}
2132 
2133 out:
2134 	release_firmware(fw);
2135 	return ret;
2136 }
2137 
2138 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
2139 {
2140 	const struct mt7615_fw_trailer *hdr;
2141 	const struct firmware *fw;
2142 	int ret;
2143 
2144 	ret = request_firmware(&fw, name, dev->mt76.dev);
2145 	if (ret)
2146 		return ret;
2147 
2148 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
2149 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2150 		ret = -EINVAL;
2151 		goto out;
2152 	}
2153 
2154 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
2155 					CR4_REGION_NUM * sizeof(*hdr));
2156 
2157 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
2158 		 hdr->fw_ver, hdr->build_date);
2159 
2160 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2161 	if (ret)
2162 		goto out;
2163 
2164 	ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
2165 	if (ret) {
2166 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
2167 		goto out;
2168 	}
2169 
2170 out:
2171 	release_firmware(fw);
2172 
2173 	return ret;
2174 }
2175 
2176 static int mt7615_load_ram(struct mt7615_dev *dev)
2177 {
2178 	int ret;
2179 
2180 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
2181 	if (ret)
2182 		return ret;
2183 
2184 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
2185 }
2186 
2187 static int mt7615_load_firmware(struct mt7615_dev *dev)
2188 {
2189 	int ret;
2190 	u32 val;
2191 
2192 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
2193 
2194 	if (val != FW_STATE_FW_DOWNLOAD) {
2195 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2196 		return -EIO;
2197 	}
2198 
2199 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
2200 	if (ret)
2201 		return ret;
2202 
2203 	ret = mt7615_load_ram(dev);
2204 	if (ret)
2205 		return ret;
2206 
2207 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
2208 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
2209 				       FW_STATE_CR4_RDY), 500)) {
2210 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2211 		return -EIO;
2212 	}
2213 
2214 	return 0;
2215 }
2216 
2217 static int mt7622_load_firmware(struct mt7615_dev *dev)
2218 {
2219 	int ret;
2220 	u32 val;
2221 
2222 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2223 
2224 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
2225 	if (val != FW_STATE_FW_DOWNLOAD) {
2226 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
2227 		return -EIO;
2228 	}
2229 
2230 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
2231 	if (ret)
2232 		return ret;
2233 
2234 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
2235 	if (ret)
2236 		return ret;
2237 
2238 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
2239 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
2240 				       FW_STATE_NORMAL_TRX), 1500)) {
2241 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2242 		return -EIO;
2243 	}
2244 
2245 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2246 
2247 	return 0;
2248 }
2249 
2250 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
2251 {
2252 	struct {
2253 		u8 ctrl_val;
2254 		u8 pad[3];
2255 	} data = {
2256 		.ctrl_val = ctrl
2257 	};
2258 
2259 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
2260 				 sizeof(data), true);
2261 }
2262 
2263 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
2264 {
2265 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
2266 	const struct mt7663_fw_trailer *hdr;
2267 	const struct mt7663_fw_buf *buf;
2268 	const struct firmware *fw;
2269 	const u8 *base_addr;
2270 	int i, ret;
2271 
2272 	ret = request_firmware(&fw, name, dev->mt76.dev);
2273 	if (ret)
2274 		return ret;
2275 
2276 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
2277 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2278 		ret = -EINVAL;
2279 		goto out;
2280 	}
2281 
2282 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
2283 						 FW_V3_COMMON_TAILER_SIZE);
2284 
2285 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2286 		 hdr->fw_ver, hdr->build_date);
2287 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
2288 
2289 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
2290 	for (i = 0; i < hdr->n_region; i++) {
2291 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
2292 		u32 len, addr, mode;
2293 
2294 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
2295 
2296 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
2297 		mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
2298 		addr = le32_to_cpu(buf->img_dest_addr);
2299 		len = le32_to_cpu(buf->img_size);
2300 
2301 		ret = mt7615_mcu_init_download(dev, addr, len, mode);
2302 		if (ret) {
2303 			dev_err(dev->mt76.dev, "Download request failed\n");
2304 			goto out;
2305 		}
2306 
2307 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
2308 					     fw->data + offset, len);
2309 		if (ret) {
2310 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
2311 			goto out;
2312 		}
2313 
2314 		offset += le32_to_cpu(buf->img_size);
2315 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
2316 			override_addr = le32_to_cpu(buf->img_dest_addr);
2317 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
2318 				 i, override_addr);
2319 		}
2320 	}
2321 
2322 	if (override_addr)
2323 		flag |= FW_START_OVERRIDE;
2324 
2325 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
2326 		 override_addr, flag);
2327 
2328 	ret = mt7615_mcu_start_firmware(dev, override_addr, flag);
2329 	if (ret) {
2330 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2331 		goto out;
2332 	}
2333 
2334 	snprintf(dev->mt76.hw->wiphy->fw_version,
2335 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2336 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2337 
2338 out:
2339 	release_firmware(fw);
2340 
2341 	return ret;
2342 }
2343 
2344 static int
2345 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
2346 {
2347 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
2348 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
2349 	int ret;
2350 
2351 	if (!prefer_offload_fw) {
2352 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
2353 		primary_rom = MT7663_ROM_PATCH;
2354 	}
2355 	selected_rom = primary_rom;
2356 
2357 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
2358 	if (ret) {
2359 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
2360 			 primary_rom, secondary_rom);
2361 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
2362 					secondary_rom);
2363 		if (ret) {
2364 			dev_err(dev->mt76.dev, "failed to load %s",
2365 				secondary_rom);
2366 			return ret;
2367 		}
2368 		selected_rom = secondary_rom;
2369 	}
2370 
2371 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
2372 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
2373 		dev->fw_ver = MT7615_FIRMWARE_V3;
2374 		dev->mcu_ops = &uni_update_ops;
2375 	} else {
2376 		*n9_firmware = MT7663_FIRMWARE_N9;
2377 		dev->fw_ver = MT7615_FIRMWARE_V2;
2378 		dev->mcu_ops = &sta_update_ops;
2379 	}
2380 
2381 	return 0;
2382 }
2383 
2384 int __mt7663_load_firmware(struct mt7615_dev *dev)
2385 {
2386 	const char *n9_firmware;
2387 	int ret;
2388 
2389 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
2390 	if (ret) {
2391 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
2392 		return -EIO;
2393 	}
2394 
2395 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
2396 	if (ret)
2397 		return ret;
2398 
2399 	ret = mt7663_load_n9(dev, n9_firmware);
2400 	if (ret)
2401 		return ret;
2402 
2403 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
2404 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
2405 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
2406 				     MT7663_TOP_MISC2_FW_STATE);
2407 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2408 		return -EIO;
2409 	}
2410 
2411 #ifdef CONFIG_PM
2412 	if (mt7615_firmware_offload(dev))
2413 		dev->mt76.hw->wiphy->wowlan = &mt7615_wowlan_support;
2414 #endif /* CONFIG_PM */
2415 
2416 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2417 
2418 	return 0;
2419 }
2420 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
2421 
2422 static int mt7663_load_firmware(struct mt7615_dev *dev)
2423 {
2424 	int ret;
2425 
2426 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2427 
2428 	ret = __mt7663_load_firmware(dev);
2429 	if (ret)
2430 		return ret;
2431 
2432 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2433 
2434 	return 0;
2435 }
2436 
2437 int mt7615_mcu_init(struct mt7615_dev *dev)
2438 {
2439 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
2440 		.headroom = sizeof(struct mt7615_mcu_txd),
2441 		.mcu_skb_send_msg = mt7615_mcu_send_message,
2442 		.mcu_parse_response = mt7615_mcu_parse_response,
2443 		.mcu_restart = mt7615_mcu_restart,
2444 	};
2445 	int ret;
2446 
2447 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
2448 
2449 	ret = mt7615_mcu_drv_pmctrl(dev);
2450 	if (ret)
2451 		return ret;
2452 
2453 	switch (mt76_chip(&dev->mt76)) {
2454 	case 0x7622:
2455 		ret = mt7622_load_firmware(dev);
2456 		break;
2457 	case 0x7663:
2458 		ret = mt7663_load_firmware(dev);
2459 		break;
2460 	default:
2461 		ret = mt7615_load_firmware(dev);
2462 		break;
2463 	}
2464 	if (ret)
2465 		return ret;
2466 
2467 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2468 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2469 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2470 	mt7615_mcu_fw_log_2_host(dev, 0);
2471 
2472 	return 0;
2473 }
2474 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
2475 
2476 void mt7615_mcu_exit(struct mt7615_dev *dev)
2477 {
2478 	__mt76_mcu_restart(&dev->mt76);
2479 	mt7615_mcu_set_fw_ctrl(dev);
2480 	skb_queue_purge(&dev->mt76.mcu.res_q);
2481 }
2482 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
2483 
2484 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
2485 {
2486 	struct {
2487 		u8 buffer_mode;
2488 		u8 content_format;
2489 		__le16 len;
2490 	} __packed req_hdr = {
2491 		.buffer_mode = 1,
2492 	};
2493 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2494 	struct sk_buff *skb;
2495 	int eep_len, offset;
2496 
2497 	switch (mt76_chip(&dev->mt76)) {
2498 	case 0x7622:
2499 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
2500 		offset = MT_EE_NIC_CONF_0;
2501 		break;
2502 	case 0x7663:
2503 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
2504 		req_hdr.content_format = 1;
2505 		offset = MT_EE_CHIP_ID;
2506 		break;
2507 	default:
2508 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
2509 		offset = MT_EE_NIC_CONF_0;
2510 		break;
2511 	}
2512 
2513 	req_hdr.len = cpu_to_le16(eep_len);
2514 
2515 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
2516 	if (!skb)
2517 		return -ENOMEM;
2518 
2519 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2520 	skb_put_data(skb, eep + offset, eep_len);
2521 
2522 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2523 				     MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
2524 }
2525 EXPORT_SYMBOL_GPL(mt7615_mcu_set_eeprom);
2526 
2527 int mt7615_mcu_set_mac_enable(struct mt7615_dev *dev, int band, bool enable)
2528 {
2529 	struct {
2530 		u8 enable;
2531 		u8 band;
2532 		u8 rsv[2];
2533 	} __packed req = {
2534 		.enable = enable,
2535 		.band = band,
2536 	};
2537 
2538 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL, &req,
2539 				 sizeof(req), true);
2540 }
2541 
2542 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
2543 {
2544 	struct mt7615_dev *dev = phy->dev;
2545 	struct {
2546 		u8 prot_idx;
2547 		u8 band;
2548 		u8 rsv[2];
2549 		__le32 len_thresh;
2550 		__le32 pkt_thresh;
2551 	} __packed req = {
2552 		.prot_idx = 1,
2553 		.band = phy != &dev->phy,
2554 		.len_thresh = cpu_to_le32(val),
2555 		.pkt_thresh = cpu_to_le32(0x2),
2556 	};
2557 
2558 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL, &req,
2559 				 sizeof(req), true);
2560 }
2561 
2562 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
2563 		       const struct ieee80211_tx_queue_params *params)
2564 {
2565 #define WMM_AIFS_SET	BIT(0)
2566 #define WMM_CW_MIN_SET	BIT(1)
2567 #define WMM_CW_MAX_SET	BIT(2)
2568 #define WMM_TXOP_SET	BIT(3)
2569 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
2570 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
2571 	struct req_data {
2572 		u8 number;
2573 		u8 rsv[3];
2574 		u8 queue;
2575 		u8 valid;
2576 		u8 aifs;
2577 		u8 cw_min;
2578 		__le16 cw_max;
2579 		__le16 txop;
2580 	} __packed req = {
2581 		.number = 1,
2582 		.queue = queue,
2583 		.valid = WMM_PARAM_SET,
2584 		.aifs = params->aifs,
2585 		.cw_min = 5,
2586 		.cw_max = cpu_to_le16(10),
2587 		.txop = cpu_to_le16(params->txop),
2588 	};
2589 
2590 	if (params->cw_min)
2591 		req.cw_min = fls(params->cw_min);
2592 	if (params->cw_max)
2593 		req.cw_max = cpu_to_le16(fls(params->cw_max));
2594 
2595 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
2596 				 sizeof(req), true);
2597 }
2598 
2599 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
2600 {
2601 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2602 	struct dbdc_entry {
2603 		u8 type;
2604 		u8 index;
2605 		u8 band;
2606 		u8 _rsv;
2607 	};
2608 	struct {
2609 		u8 enable;
2610 		u8 num;
2611 		u8 _rsv[2];
2612 		struct dbdc_entry entry[64];
2613 	} req = {
2614 		.enable = !!ext_phy,
2615 	};
2616 	int i;
2617 
2618 	if (!ext_phy)
2619 		goto out;
2620 
2621 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
2622 	do { \
2623 		req.entry[req.num].type = _type;		\
2624 		req.entry[req.num].index = _idx;		\
2625 		req.entry[req.num++].band = _band;		\
2626 	} while (0)
2627 
2628 	for (i = 0; i < 4; i++) {
2629 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
2630 
2631 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2632 	}
2633 
2634 	for (i = 0; i < 14; i++) {
2635 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
2636 
2637 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2638 	}
2639 
2640 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2641 
2642 	for (i = 0; i < 3; i++)
2643 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2644 
2645 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2646 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2647 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2648 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2649 
2650 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2651 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2652 
2653 out:
2654 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
2655 				 sizeof(req), true);
2656 }
2657 
2658 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2659 {
2660 	struct wtbl_req_hdr req = {
2661 		.operation = WTBL_RESET_ALL,
2662 	};
2663 
2664 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
2665 				 sizeof(req), true);
2666 }
2667 EXPORT_SYMBOL_GPL(mt7615_mcu_del_wtbl_all);
2668 
2669 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2670 		       enum mt7615_rdd_cmd cmd, u8 index,
2671 		       u8 rx_sel, u8 val)
2672 {
2673 	struct {
2674 		u8 ctrl;
2675 		u8 rdd_idx;
2676 		u8 rdd_rx_sel;
2677 		u8 val;
2678 		u8 rsv[4];
2679 	} req = {
2680 		.ctrl = cmd,
2681 		.rdd_idx = index,
2682 		.rdd_rx_sel = rx_sel,
2683 		.val = val,
2684 	};
2685 
2686 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
2687 				 sizeof(req), true);
2688 }
2689 
2690 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2691 {
2692 	struct {
2693 		__le16 tag;
2694 		__le16 min_lpn;
2695 	} req = {
2696 		.tag = cpu_to_le16(0x1),
2697 		.min_lpn = cpu_to_le16(val),
2698 	};
2699 
2700 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2701 				 sizeof(req), true);
2702 }
2703 
2704 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2705 			    const struct mt7615_dfs_pulse *pulse)
2706 {
2707 	struct {
2708 		__le16 tag;
2709 		__le32 max_width;	/* us */
2710 		__le32 max_pwr;		/* dbm */
2711 		__le32 min_pwr;		/* dbm */
2712 		__le32 min_stgr_pri;	/* us */
2713 		__le32 max_stgr_pri;	/* us */
2714 		__le32 min_cr_pri;	/* us */
2715 		__le32 max_cr_pri;	/* us */
2716 	} req = {
2717 		.tag = cpu_to_le16(0x3),
2718 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2719 		__req_field(max_width),
2720 		__req_field(max_pwr),
2721 		__req_field(min_pwr),
2722 		__req_field(min_stgr_pri),
2723 		__req_field(max_stgr_pri),
2724 		__req_field(min_cr_pri),
2725 		__req_field(max_cr_pri),
2726 #undef  __req_field
2727 	};
2728 
2729 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2730 				 sizeof(req), true);
2731 }
2732 
2733 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2734 			    const struct mt7615_dfs_pattern *pattern)
2735 {
2736 	struct {
2737 		__le16 tag;
2738 		__le16 radar_type;
2739 		u8 enb;
2740 		u8 stgr;
2741 		u8 min_crpn;
2742 		u8 max_crpn;
2743 		u8 min_crpr;
2744 		u8 min_pw;
2745 		u8 max_pw;
2746 		__le32 min_pri;
2747 		__le32 max_pri;
2748 		u8 min_crbn;
2749 		u8 max_crbn;
2750 		u8 min_stgpn;
2751 		u8 max_stgpn;
2752 		u8 min_stgpr;
2753 	} req = {
2754 		.tag = cpu_to_le16(0x2),
2755 		.radar_type = cpu_to_le16(index),
2756 #define __req_field_u8(field) .field = pattern->field
2757 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2758 		__req_field_u8(enb),
2759 		__req_field_u8(stgr),
2760 		__req_field_u8(min_crpn),
2761 		__req_field_u8(max_crpn),
2762 		__req_field_u8(min_crpr),
2763 		__req_field_u8(min_pw),
2764 		__req_field_u8(max_pw),
2765 		__req_field_u32(min_pri),
2766 		__req_field_u32(max_pri),
2767 		__req_field_u8(min_crbn),
2768 		__req_field_u8(max_crbn),
2769 		__req_field_u8(min_stgpn),
2770 		__req_field_u8(max_stgpn),
2771 		__req_field_u8(min_stgpr),
2772 #undef __req_field_u8
2773 #undef __req_field_u32
2774 	};
2775 
2776 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2777 				 sizeof(req), true);
2778 }
2779 
2780 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2781 {
2782 	struct {
2783 		u8 pulse_num;
2784 		u8 rsv[3];
2785 		struct {
2786 			__le32 start_time;
2787 			__le16 width;
2788 			__le16 power;
2789 		} pattern[32];
2790 	} req = {
2791 		.pulse_num = dev->radar_pattern.n_pulses,
2792 	};
2793 	u32 start_time = ktime_to_ms(ktime_get_boottime());
2794 	int i;
2795 
2796 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2797 		return -EINVAL;
2798 
2799 	/* TODO: add some noise here */
2800 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2801 		u32 ts = start_time + i * dev->radar_pattern.period;
2802 
2803 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2804 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2805 		req.pattern[i].start_time = cpu_to_le32(ts);
2806 	}
2807 
2808 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2809 				 &req, sizeof(req), false);
2810 }
2811 
2812 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2813 {
2814 	struct mt76_phy *mphy = phy->mt76;
2815 	struct ieee80211_hw *hw = mphy->hw;
2816 	int n_chains = hweight8(mphy->antenna_mask);
2817 	int tx_power;
2818 	int i;
2819 
2820 	tx_power = hw->conf.power_level * 2 -
2821 		   mt76_tx_power_nss_delta(n_chains);
2822 	mphy->txpower_cur = tx_power;
2823 
2824 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2825 		sku[i] = tx_power;
2826 
2827 	for (i = 0; i < 4; i++) {
2828 		int delta = 0;
2829 
2830 		if (i < n_chains - 1)
2831 			delta = mt76_tx_power_nss_delta(n_chains) -
2832 				mt76_tx_power_nss_delta(i + 1);
2833 		sku[MT_SKU_1SS_DELTA + i] = delta;
2834 	}
2835 }
2836 
2837 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2838 {
2839 	static const u8 width_to_bw[] = {
2840 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2841 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2842 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2843 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2844 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2845 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2846 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2847 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2848 	};
2849 
2850 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2851 		return 0;
2852 
2853 	return width_to_bw[chandef->width];
2854 }
2855 
2856 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2857 {
2858 	struct mt7615_dev *dev = phy->dev;
2859 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2860 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2861 	struct {
2862 		u8 control_chan;
2863 		u8 center_chan;
2864 		u8 bw;
2865 		u8 tx_streams;
2866 		u8 rx_streams_mask;
2867 		u8 switch_reason;
2868 		u8 band_idx;
2869 		/* for 80+80 only */
2870 		u8 center_chan2;
2871 		__le16 cac_case;
2872 		u8 channel_band;
2873 		u8 rsv0;
2874 		__le32 outband_freq;
2875 		u8 txpower_drop;
2876 		u8 rsv1[3];
2877 		u8 txpower_sku[53];
2878 		u8 rsv2[3];
2879 	} req = {
2880 		.control_chan = chandef->chan->hw_value,
2881 		.center_chan = ieee80211_frequency_to_channel(freq1),
2882 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2883 		.rx_streams_mask = phy->chainmask,
2884 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2885 	};
2886 
2887 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2888 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2889 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2890 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2891 		req.switch_reason = CH_SWITCH_DFS;
2892 	else
2893 		req.switch_reason = CH_SWITCH_NORMAL;
2894 
2895 	req.band_idx = phy != &dev->phy;
2896 	req.bw = mt7615_mcu_chan_bw(chandef);
2897 
2898 	if (mt76_testmode_enabled(&dev->mt76))
2899 		memset(req.txpower_sku, 0x3f, 49);
2900 	else
2901 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2902 
2903 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2904 }
2905 
2906 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2907 {
2908 	struct {
2909 		u8 action;
2910 		u8 rsv[3];
2911 	} req = {
2912 		.action = index,
2913 	};
2914 
2915 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2916 				 sizeof(req), true);
2917 }
2918 
2919 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2920 			      u32 val)
2921 {
2922 	struct {
2923 		u8 test_mode_en;
2924 		u8 param_idx;
2925 		u8 _rsv[2];
2926 
2927 		__le32 value;
2928 
2929 		u8 pad[8];
2930 	} req = {
2931 		.test_mode_en = test_mode,
2932 		.param_idx = param,
2933 		.value = cpu_to_le32(val),
2934 	};
2935 
2936 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2937 				 sizeof(req), false);
2938 }
2939 
2940 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2941 {
2942 	struct mt7615_dev *dev = phy->dev;
2943 	struct {
2944 		u8 format_id;
2945 		u8 sku_enable;
2946 		u8 band_idx;
2947 		u8 rsv;
2948 	} req = {
2949 		.format_id = 0,
2950 		.band_idx = phy != &dev->phy,
2951 		.sku_enable = enable,
2952 	};
2953 
2954 	return mt76_mcu_send_msg(&dev->mt76,
2955 				 MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2956 				 sizeof(req), true);
2957 }
2958 
2959 int mt7615_mcu_set_vif_ps(struct mt7615_dev *dev, struct ieee80211_vif *vif)
2960 {
2961 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2962 	struct {
2963 		u8 bss_idx;
2964 		u8 ps_state; /* 0: device awake
2965 			      * 1: static power save
2966 			      * 2: dynamic power saving
2967 			      */
2968 	} req = {
2969 		.bss_idx = mvif->idx,
2970 		.ps_state = vif->bss_conf.ps ? 2 : 0,
2971 	};
2972 
2973 	if (vif->type != NL80211_IFTYPE_STATION)
2974 		return -ENOTSUPP;
2975 
2976 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_PS_PROFILE, &req,
2977 				 sizeof(req), false);
2978 }
2979 
2980 int mt7615_mcu_set_channel_domain(struct mt7615_phy *phy)
2981 {
2982 	struct mt76_phy *mphy = phy->mt76;
2983 	struct mt7615_dev *dev = phy->dev;
2984 	struct mt7615_mcu_channel_domain {
2985 		__le32 country_code; /* regulatory_request.alpha2 */
2986 		u8 bw_2g; /* BW_20_40M		0
2987 			   * BW_20M		1
2988 			   * BW_20_40_80M	2
2989 			   * BW_20_40_80_160M	3
2990 			   * BW_20_40_80_8080M	4
2991 			   */
2992 		u8 bw_5g;
2993 		__le16 pad;
2994 		u8 n_2ch;
2995 		u8 n_5ch;
2996 		__le16 pad2;
2997 	} __packed hdr = {
2998 		.bw_2g = 0,
2999 		.bw_5g = 3,
3000 		.n_2ch = mphy->sband_2g.sband.n_channels,
3001 		.n_5ch = mphy->sband_5g.sband.n_channels,
3002 	};
3003 	struct mt7615_mcu_chan {
3004 		__le16 hw_value;
3005 		__le16 pad;
3006 		__le32 flags;
3007 	} __packed;
3008 	int i, n_channels = hdr.n_2ch + hdr.n_5ch;
3009 	int len = sizeof(hdr) + n_channels * sizeof(struct mt7615_mcu_chan);
3010 	struct sk_buff *skb;
3011 
3012 	if (!mt7615_firmware_offload(dev))
3013 		return 0;
3014 
3015 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
3016 	if (!skb)
3017 		return -ENOMEM;
3018 
3019 	skb_put_data(skb, &hdr, sizeof(hdr));
3020 
3021 	for (i = 0; i < n_channels; i++) {
3022 		struct ieee80211_channel *chan;
3023 		struct mt7615_mcu_chan channel;
3024 
3025 		if (i < hdr.n_2ch)
3026 			chan = &mphy->sband_2g.sband.channels[i];
3027 		else
3028 			chan = &mphy->sband_5g.sband.channels[i - hdr.n_2ch];
3029 
3030 		channel.hw_value = cpu_to_le16(chan->hw_value);
3031 		channel.flags = cpu_to_le32(chan->flags);
3032 		channel.pad = 0;
3033 
3034 		skb_put_data(skb, &channel, sizeof(channel));
3035 	}
3036 
3037 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_SET_CHAN_DOMAIN,
3038 				     false);
3039 }
3040 
3041 #define MT7615_SCAN_CHANNEL_TIME	60
3042 int mt7615_mcu_hw_scan(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3043 		       struct ieee80211_scan_request *scan_req)
3044 {
3045 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3046 	struct cfg80211_scan_request *sreq = &scan_req->req;
3047 	int n_ssids = 0, err, i, duration = MT7615_SCAN_CHANNEL_TIME;
3048 	int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
3049 	struct ieee80211_channel **scan_list = sreq->channels;
3050 	struct mt7615_dev *dev = phy->dev;
3051 	bool ext_phy = phy != &dev->phy;
3052 	struct mt7615_mcu_scan_channel *chan;
3053 	struct mt7615_hw_scan_req *req;
3054 	struct sk_buff *skb;
3055 
3056 	/* fall-back to sw-scan */
3057 	if (!mt7615_firmware_offload(dev))
3058 		return 1;
3059 
3060 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(*req));
3061 	if (!skb)
3062 		return -ENOMEM;
3063 
3064 	set_bit(MT76_HW_SCANNING, &phy->mt76->state);
3065 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3066 
3067 	req = (struct mt7615_hw_scan_req *)skb_put(skb, sizeof(*req));
3068 
3069 	req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3070 	req->bss_idx = mvif->idx;
3071 	req->scan_type = sreq->n_ssids ? 1 : 0;
3072 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
3073 	req->version = 1;
3074 
3075 	for (i = 0; i < sreq->n_ssids; i++) {
3076 		if (!sreq->ssids[i].ssid_len)
3077 			continue;
3078 
3079 		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
3080 		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
3081 		       sreq->ssids[i].ssid_len);
3082 		n_ssids++;
3083 	}
3084 	req->ssid_type = n_ssids ? BIT(2) : BIT(0);
3085 	req->ssid_type_ext = n_ssids ? BIT(0) : 0;
3086 	req->ssids_num = n_ssids;
3087 
3088 	/* increase channel time for passive scan */
3089 	if (!sreq->n_ssids)
3090 		duration *= 2;
3091 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
3092 	req->channel_min_dwell_time = cpu_to_le16(duration);
3093 	req->channel_dwell_time = cpu_to_le16(duration);
3094 
3095 	req->channels_num = min_t(u8, sreq->n_channels, 32);
3096 	req->ext_channels_num = min_t(u8, ext_channels_num, 32);
3097 	for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
3098 		if (i >= 32)
3099 			chan = &req->ext_channels[i - 32];
3100 		else
3101 			chan = &req->channels[i];
3102 
3103 		chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3104 		chan->channel_num = scan_list[i]->hw_value;
3105 	}
3106 	req->channel_type = sreq->n_channels ? 4 : 0;
3107 
3108 	if (sreq->ie_len > 0) {
3109 		memcpy(req->ies, sreq->ie, sreq->ie_len);
3110 		req->ies_len = cpu_to_le16(sreq->ie_len);
3111 	}
3112 
3113 	memcpy(req->bssid, sreq->bssid, ETH_ALEN);
3114 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3115 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
3116 				     sreq->mac_addr_mask);
3117 		req->scan_func = 1;
3118 	}
3119 
3120 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_START_HW_SCAN,
3121 				    false);
3122 	if (err < 0)
3123 		clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
3124 
3125 	return err;
3126 }
3127 
3128 int mt7615_mcu_cancel_hw_scan(struct mt7615_phy *phy,
3129 			      struct ieee80211_vif *vif)
3130 {
3131 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3132 	struct mt7615_dev *dev = phy->dev;
3133 	struct {
3134 		u8 seq_num;
3135 		u8 is_ext_channel;
3136 		u8 rsv[2];
3137 	} __packed req = {
3138 		.seq_num = mvif->scan_seq_num,
3139 	};
3140 
3141 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->mt76->state)) {
3142 		struct cfg80211_scan_info info = {
3143 			.aborted = true,
3144 		};
3145 
3146 		ieee80211_scan_completed(phy->mt76->hw, &info);
3147 	}
3148 
3149 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_CANCEL_HW_SCAN, &req,
3150 				 sizeof(req), false);
3151 }
3152 
3153 int mt7615_mcu_sched_scan_req(struct mt7615_phy *phy,
3154 			      struct ieee80211_vif *vif,
3155 			      struct cfg80211_sched_scan_request *sreq)
3156 {
3157 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3158 	struct ieee80211_channel **scan_list = sreq->channels;
3159 	struct mt7615_dev *dev = phy->dev;
3160 	bool ext_phy = phy != &dev->phy;
3161 	struct mt7615_mcu_scan_channel *chan;
3162 	struct mt7615_sched_scan_req *req;
3163 	struct cfg80211_match_set *match;
3164 	struct cfg80211_ssid *ssid;
3165 	struct sk_buff *skb;
3166 	int i;
3167 
3168 	if (!mt7615_firmware_offload(dev))
3169 		return -ENOTSUPP;
3170 
3171 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3172 				 sizeof(*req) + sreq->ie_len);
3173 	if (!skb)
3174 		return -ENOMEM;
3175 
3176 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3177 
3178 	req = (struct mt7615_sched_scan_req *)skb_put(skb, sizeof(*req));
3179 	req->version = 1;
3180 	req->seq_num = mvif->scan_seq_num | ext_phy << 7;
3181 
3182 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3183 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
3184 				     sreq->mac_addr_mask);
3185 		req->scan_func = 1;
3186 	}
3187 
3188 	req->ssids_num = sreq->n_ssids;
3189 	for (i = 0; i < req->ssids_num; i++) {
3190 		ssid = &sreq->ssids[i];
3191 		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
3192 		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
3193 	}
3194 
3195 	req->match_num = sreq->n_match_sets;
3196 	for (i = 0; i < req->match_num; i++) {
3197 		match = &sreq->match_sets[i];
3198 		memcpy(req->match[i].ssid, match->ssid.ssid,
3199 		       match->ssid.ssid_len);
3200 		req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
3201 		req->match[i].ssid_len = match->ssid.ssid_len;
3202 	}
3203 
3204 	req->channel_type = sreq->n_channels ? 4 : 0;
3205 	req->channels_num = min_t(u8, sreq->n_channels, 64);
3206 	for (i = 0; i < req->channels_num; i++) {
3207 		chan = &req->channels[i];
3208 		chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
3209 		chan->channel_num = scan_list[i]->hw_value;
3210 	}
3211 
3212 	req->intervals_num = sreq->n_scan_plans;
3213 	for (i = 0; i < req->intervals_num; i++)
3214 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3215 
3216 	if (sreq->ie_len > 0) {
3217 		req->ie_len = cpu_to_le16(sreq->ie_len);
3218 		memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
3219 	}
3220 
3221 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_SCHED_SCAN_REQ,
3222 				     false);
3223 }
3224 
3225 int mt7615_mcu_sched_scan_enable(struct mt7615_phy *phy,
3226 				 struct ieee80211_vif *vif,
3227 				 bool enable)
3228 {
3229 	struct mt7615_dev *dev = phy->dev;
3230 	struct {
3231 		u8 active; /* 0: enabled 1: disabled */
3232 		u8 rsv[3];
3233 	} __packed req = {
3234 		.active = !enable,
3235 	};
3236 
3237 	if (!mt7615_firmware_offload(dev))
3238 		return -ENOTSUPP;
3239 
3240 	if (enable)
3241 		set_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3242 	else
3243 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
3244 
3245 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SCHED_SCAN_ENABLE, &req,
3246 				 sizeof(req), false);
3247 }
3248 
3249 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3250 {
3251 	int i;
3252 
3253 	for (i = 0; i < n_freqs; i++)
3254 		if (cur == freqs[i])
3255 			return i;
3256 
3257 	return -1;
3258 }
3259 
3260 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
3261 {
3262 	static const u16 freq_list[] = {
3263 		4980, 5805, 5905, 5190,
3264 		5230, 5270, 5310, 5350,
3265 		5390, 5430, 5470, 5510,
3266 		5550, 5590, 5630, 5670,
3267 		5710, 5755, 5795, 5835,
3268 		5875, 5210, 5290, 5370,
3269 		5450, 5530, 5610, 5690,
3270 		5775, 5855
3271 	};
3272 	static const u16 freq_bw40[] = {
3273 		5190, 5230, 5270, 5310,
3274 		5350, 5390, 5430, 5470,
3275 		5510, 5550, 5590, 5630,
3276 		5670, 5710, 5755, 5795,
3277 		5835, 5875
3278 	};
3279 	int offset_2g = ARRAY_SIZE(freq_list);
3280 	int idx;
3281 
3282 	if (freq < 4000) {
3283 		if (freq < 2427)
3284 			return offset_2g;
3285 		if (freq < 2442)
3286 			return offset_2g + 1;
3287 		if (freq < 2457)
3288 			return offset_2g + 2;
3289 
3290 		return offset_2g + 3;
3291 	}
3292 
3293 	switch (bw) {
3294 	case NL80211_CHAN_WIDTH_80:
3295 	case NL80211_CHAN_WIDTH_80P80:
3296 	case NL80211_CHAN_WIDTH_160:
3297 		break;
3298 	default:
3299 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3300 					   freq + 10);
3301 		if (idx >= 0) {
3302 			freq = freq_bw40[idx];
3303 			break;
3304 		}
3305 
3306 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3307 					   freq - 10);
3308 		if (idx >= 0) {
3309 			freq = freq_bw40[idx];
3310 			break;
3311 		}
3312 		fallthrough;
3313 	case NL80211_CHAN_WIDTH_40:
3314 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
3315 					   freq);
3316 		if (idx >= 0)
3317 			break;
3318 
3319 		return -1;
3320 
3321 	}
3322 
3323 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3324 }
3325 
3326 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
3327 {
3328 	struct mt7615_dev *dev = phy->dev;
3329 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3330 	int freq2 = chandef->center_freq2;
3331 	int ret;
3332 	struct {
3333 		u8 direction;
3334 		u8 runtime_calibration;
3335 		u8 _rsv[2];
3336 
3337 		__le16 center_freq;
3338 		u8 bw;
3339 		u8 band;
3340 		u8 is_freq2;
3341 		u8 success;
3342 		u8 dbdc_en;
3343 
3344 		u8 _rsv2;
3345 
3346 		struct {
3347 			__le32 sx0_i_lna[4];
3348 			__le32 sx0_q_lna[4];
3349 
3350 			__le32 sx2_i_lna[4];
3351 			__le32 sx2_q_lna[4];
3352 		} dcoc_data[4];
3353 	} req = {
3354 		.direction = 1,
3355 
3356 		.bw = mt7615_mcu_chan_bw(chandef),
3357 		.band = chandef->center_freq1 > 4000,
3358 		.dbdc_en = !!dev->mt76.phy2,
3359 	};
3360 	u16 center_freq = chandef->center_freq1;
3361 	int freq_idx;
3362 	u8 *eep = dev->mt76.eeprom.data;
3363 
3364 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
3365 		return 0;
3366 
3367 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
3368 		freq2 = center_freq + 40;
3369 		center_freq -= 40;
3370 	}
3371 
3372 again:
3373 	req.runtime_calibration = 1;
3374 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
3375 	if (freq_idx < 0)
3376 		goto out;
3377 
3378 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
3379 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
3380 	       sizeof(req.dcoc_data));
3381 	req.runtime_calibration = 0;
3382 
3383 out:
3384 	req.center_freq = cpu_to_le16(center_freq);
3385 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
3386 				sizeof(req), true);
3387 
3388 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3389 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3390 		req.is_freq2 = true;
3391 		center_freq = freq2;
3392 		goto again;
3393 	}
3394 
3395 	return ret;
3396 }
3397 
3398 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
3399 {
3400 	static const u16 freq_list[] = {
3401 		4920, 4940, 4960, 4980,
3402 		5040, 5060, 5080, 5180,
3403 		5200, 5220, 5240, 5260,
3404 		5280, 5300, 5320, 5340,
3405 		5360, 5380, 5400, 5420,
3406 		5440, 5460, 5480, 5500,
3407 		5520, 5540, 5560, 5580,
3408 		5600, 5620, 5640, 5660,
3409 		5680, 5700, 5720, 5745,
3410 		5765, 5785, 5805, 5825,
3411 		5845, 5865, 5885, 5905
3412 	};
3413 	int offset_2g = ARRAY_SIZE(freq_list);
3414 	int idx;
3415 
3416 	if (freq < 4000) {
3417 		if (freq < 2432)
3418 			return offset_2g;
3419 		if (freq < 2457)
3420 			return offset_2g + 1;
3421 
3422 		return offset_2g + 2;
3423 	}
3424 
3425 	if (bw != NL80211_CHAN_WIDTH_20) {
3426 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3427 					   freq + 10);
3428 		if (idx >= 0)
3429 			return idx;
3430 
3431 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3432 					   freq - 10);
3433 		if (idx >= 0)
3434 			return idx;
3435 	}
3436 
3437 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3438 }
3439 
3440 
3441 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
3442 {
3443 	struct mt7615_dev *dev = phy->dev;
3444 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3445 	int freq2 = chandef->center_freq2;
3446 	int ret;
3447 	struct {
3448 		u8 direction;
3449 		u8 runtime_calibration;
3450 		u8 _rsv[2];
3451 
3452 		__le16 center_freq;
3453 		u8 bw;
3454 		u8 band;
3455 		u8 is_freq2;
3456 		u8 success;
3457 		u8 dbdc_en;
3458 
3459 		u8 _rsv2;
3460 
3461 		struct {
3462 			struct {
3463 				u32 dpd_g0;
3464 				u8 data[32];
3465 			} wf0, wf1;
3466 
3467 			struct {
3468 				u32 dpd_g0_prim;
3469 				u32 dpd_g0_sec;
3470 				u8 data_prim[32];
3471 				u8 data_sec[32];
3472 			} wf2, wf3;
3473 		} dpd_data;
3474 	} req = {
3475 		.direction = 1,
3476 
3477 		.bw = mt7615_mcu_chan_bw(chandef),
3478 		.band = chandef->center_freq1 > 4000,
3479 		.dbdc_en = !!dev->mt76.phy2,
3480 	};
3481 	u16 center_freq = chandef->center_freq1;
3482 	int freq_idx;
3483 	u8 *eep = dev->mt76.eeprom.data;
3484 
3485 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
3486 		return 0;
3487 
3488 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
3489 		freq2 = center_freq + 40;
3490 		center_freq -= 40;
3491 	}
3492 
3493 again:
3494 	req.runtime_calibration = 1;
3495 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
3496 	if (freq_idx < 0)
3497 		goto out;
3498 
3499 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
3500 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
3501 	       sizeof(req.dpd_data));
3502 	req.runtime_calibration = 0;
3503 
3504 out:
3505 	req.center_freq = cpu_to_le16(center_freq);
3506 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
3507 				sizeof(req), true);
3508 
3509 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3510 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3511 		req.is_freq2 = true;
3512 		center_freq = freq2;
3513 		goto again;
3514 	}
3515 
3516 	return ret;
3517 }
3518 
3519 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3520 			  bool enable)
3521 {
3522 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3523 	struct {
3524 		u8 bss_idx;
3525 		u8 dtim_period;
3526 		__le16 aid;
3527 		__le16 bcn_interval;
3528 		__le16 atim_window;
3529 		u8 uapsd;
3530 		u8 bmc_delivered_ac;
3531 		u8 bmc_triggered_ac;
3532 		u8 pad;
3533 	} req = {
3534 		.bss_idx = mvif->idx,
3535 		.aid = cpu_to_le16(vif->bss_conf.aid),
3536 		.dtim_period = vif->bss_conf.dtim_period,
3537 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
3538 	};
3539 	struct {
3540 		u8 bss_idx;
3541 		u8 pad[3];
3542 	} req_hdr = {
3543 		.bss_idx = mvif->idx,
3544 	};
3545 	int err;
3546 
3547 	if (vif->type != NL80211_IFTYPE_STATION)
3548 		return 0;
3549 
3550 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
3551 				sizeof(req_hdr), false);
3552 	if (err < 0 || !enable)
3553 		return err;
3554 
3555 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
3556 				 sizeof(req), false);
3557 }
3558 
3559 #ifdef CONFIG_PM
3560 int mt7615_mcu_set_hif_suspend(struct mt7615_dev *dev, bool suspend)
3561 {
3562 	struct {
3563 		struct {
3564 			u8 hif_type; /* 0x0: HIF_SDIO
3565 				      * 0x1: HIF_USB
3566 				      * 0x2: HIF_PCIE
3567 				      */
3568 			u8 pad[3];
3569 		} __packed hdr;
3570 		struct hif_suspend_tlv {
3571 			__le16 tag;
3572 			__le16 len;
3573 			u8 suspend;
3574 		} __packed hif_suspend;
3575 	} req = {
3576 		.hif_suspend = {
3577 			.tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
3578 			.len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
3579 			.suspend = suspend,
3580 		},
3581 	};
3582 
3583 	if (mt76_is_mmio(&dev->mt76))
3584 		req.hdr.hif_type = 2;
3585 	else if (mt76_is_usb(&dev->mt76))
3586 		req.hdr.hif_type = 1;
3587 	else if (mt76_is_sdio(&dev->mt76))
3588 		req.hdr.hif_type = 0;
3589 
3590 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_HIF_CTRL, &req,
3591 				 sizeof(req), true);
3592 }
3593 EXPORT_SYMBOL_GPL(mt7615_mcu_set_hif_suspend);
3594 
3595 static int
3596 mt7615_mcu_set_wow_ctrl(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3597 			bool suspend, struct cfg80211_wowlan *wowlan)
3598 {
3599 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3600 	struct mt7615_dev *dev = phy->dev;
3601 	struct {
3602 		struct {
3603 			u8 bss_idx;
3604 			u8 pad[3];
3605 		} __packed hdr;
3606 		struct mt7615_wow_ctrl_tlv wow_ctrl_tlv;
3607 		struct mt7615_wow_gpio_param_tlv gpio_tlv;
3608 	} req = {
3609 		.hdr = {
3610 			.bss_idx = mvif->idx,
3611 		},
3612 		.wow_ctrl_tlv = {
3613 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
3614 			.len = cpu_to_le16(sizeof(struct mt7615_wow_ctrl_tlv)),
3615 			.cmd = suspend ? 1 : 2,
3616 		},
3617 		.gpio_tlv = {
3618 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
3619 			.len = cpu_to_le16(sizeof(struct mt7615_wow_gpio_param_tlv)),
3620 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
3621 		},
3622 	};
3623 
3624 	if (wowlan->magic_pkt)
3625 		req.wow_ctrl_tlv.trigger |= BIT(0);
3626 	if (wowlan->disconnect)
3627 		req.wow_ctrl_tlv.trigger |= BIT(2);
3628 	if (wowlan->nd_config) {
3629 		mt7615_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
3630 		req.wow_ctrl_tlv.trigger |= BIT(5);
3631 		mt7615_mcu_sched_scan_enable(phy, vif, suspend);
3632 	}
3633 
3634 	if (mt76_is_mmio(&dev->mt76))
3635 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
3636 	else if (mt76_is_usb(&dev->mt76))
3637 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
3638 	else if (mt76_is_sdio(&dev->mt76))
3639 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
3640 
3641 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
3642 				 sizeof(req), true);
3643 }
3644 
3645 static int
3646 mt7615_mcu_set_wow_pattern(struct mt7615_dev *dev,
3647 			   struct ieee80211_vif *vif,
3648 			   u8 index, bool enable,
3649 			   struct cfg80211_pkt_pattern *pattern)
3650 {
3651 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3652 	struct mt7615_wow_pattern_tlv *ptlv;
3653 	struct sk_buff *skb;
3654 	struct req_hdr {
3655 		u8 bss_idx;
3656 		u8 pad[3];
3657 	} __packed hdr = {
3658 		.bss_idx = mvif->idx,
3659 	};
3660 
3661 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3662 				 sizeof(hdr) + sizeof(*ptlv));
3663 	if (!skb)
3664 		return -ENOMEM;
3665 
3666 	skb_put_data(skb, &hdr, sizeof(hdr));
3667 	ptlv = (struct mt7615_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
3668 	ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
3669 	ptlv->len = cpu_to_le16(sizeof(*ptlv));
3670 	ptlv->data_len = pattern->pattern_len;
3671 	ptlv->enable = enable;
3672 	ptlv->index = index;
3673 
3674 	memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
3675 	memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8);
3676 
3677 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_SUSPEND,
3678 				     true);
3679 }
3680 
3681 static int
3682 mt7615_mcu_set_suspend_mode(struct mt7615_dev *dev,
3683 			    struct ieee80211_vif *vif,
3684 			    bool enable, u8 mdtim, bool wow_suspend)
3685 {
3686 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3687 	struct {
3688 		struct {
3689 			u8 bss_idx;
3690 			u8 pad[3];
3691 		} __packed hdr;
3692 		struct mt7615_suspend_tlv suspend_tlv;
3693 	} req = {
3694 		.hdr = {
3695 			.bss_idx = mvif->idx,
3696 		},
3697 		.suspend_tlv = {
3698 			.tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
3699 			.len = cpu_to_le16(sizeof(struct mt7615_suspend_tlv)),
3700 			.enable = enable,
3701 			.mdtim = mdtim,
3702 			.wow_suspend = wow_suspend,
3703 		},
3704 	};
3705 
3706 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_SUSPEND, &req,
3707 				 sizeof(req), true);
3708 }
3709 
3710 static int
3711 mt7615_mcu_set_gtk_rekey(struct mt7615_dev *dev,
3712 			 struct ieee80211_vif *vif,
3713 			 bool suspend)
3714 {
3715 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3716 	struct {
3717 		struct {
3718 			u8 bss_idx;
3719 			u8 pad[3];
3720 		} __packed hdr;
3721 		struct mt7615_gtk_rekey_tlv gtk_tlv;
3722 	} __packed req = {
3723 		.hdr = {
3724 			.bss_idx = mvif->idx,
3725 		},
3726 		.gtk_tlv = {
3727 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
3728 			.len = cpu_to_le16(sizeof(struct mt7615_gtk_rekey_tlv)),
3729 			.rekey_mode = !suspend,
3730 		},
3731 	};
3732 
3733 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
3734 				 sizeof(req), true);
3735 }
3736 
3737 static int
3738 mt7615_mcu_set_arp_filter(struct mt7615_dev *dev, struct ieee80211_vif *vif,
3739 			  bool suspend)
3740 {
3741 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3742 	struct {
3743 		struct {
3744 			u8 bss_idx;
3745 			u8 pad[3];
3746 		} __packed hdr;
3747 		struct mt7615_arpns_tlv arpns;
3748 	} req = {
3749 		.hdr = {
3750 			.bss_idx = mvif->idx,
3751 		},
3752 		.arpns = {
3753 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3754 			.len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3755 			.mode = suspend,
3756 		},
3757 	};
3758 
3759 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_OFFLOAD, &req,
3760 				 sizeof(req), true);
3761 }
3762 
3763 void mt7615_mcu_set_suspend_iter(void *priv, u8 *mac,
3764 				 struct ieee80211_vif *vif)
3765 {
3766 	struct mt7615_phy *phy = priv;
3767 	bool suspend = test_bit(MT76_STATE_SUSPEND, &phy->mt76->state);
3768 	struct ieee80211_hw *hw = phy->mt76->hw;
3769 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
3770 	int i;
3771 
3772 	mt7615_mcu_set_gtk_rekey(phy->dev, vif, suspend);
3773 	mt7615_mcu_set_arp_filter(phy->dev, vif, suspend);
3774 
3775 	mt7615_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
3776 
3777 	for (i = 0; i < wowlan->n_patterns; i++)
3778 		mt7615_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
3779 					   &wowlan->patterns[i]);
3780 	mt7615_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
3781 }
3782 
3783 static void
3784 mt7615_mcu_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3785 		    struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
3786 		    void *data)
3787 {
3788 	struct mt7615_gtk_rekey_tlv *gtk_tlv = data;
3789 	u32 cipher;
3790 
3791 	if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
3792 	    key->cipher != WLAN_CIPHER_SUITE_CCMP &&
3793 	    key->cipher != WLAN_CIPHER_SUITE_TKIP)
3794 		return;
3795 
3796 	if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
3797 		gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
3798 		cipher = BIT(3);
3799 	} else {
3800 		gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
3801 		cipher = BIT(4);
3802 	}
3803 
3804 	/* we are assuming here to have a single pairwise key */
3805 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3806 		gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
3807 		gtk_tlv->group_cipher = cpu_to_le32(cipher);
3808 		gtk_tlv->keyid = key->keyidx;
3809 	}
3810 }
3811 
3812 int mt7615_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
3813 				struct ieee80211_vif *vif,
3814 				struct cfg80211_gtk_rekey_data *key)
3815 {
3816 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3817 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3818 	struct mt7615_gtk_rekey_tlv *gtk_tlv;
3819 	struct sk_buff *skb;
3820 	struct {
3821 		u8 bss_idx;
3822 		u8 pad[3];
3823 	} __packed hdr = {
3824 		.bss_idx = mvif->idx,
3825 	};
3826 
3827 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3828 				 sizeof(hdr) + sizeof(*gtk_tlv));
3829 	if (!skb)
3830 		return -ENOMEM;
3831 
3832 	skb_put_data(skb, &hdr, sizeof(hdr));
3833 	gtk_tlv = (struct mt7615_gtk_rekey_tlv *)skb_put(skb,
3834 							 sizeof(*gtk_tlv));
3835 	gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
3836 	gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
3837 	gtk_tlv->rekey_mode = 2;
3838 	gtk_tlv->option = 1;
3839 
3840 	rcu_read_lock();
3841 	ieee80211_iter_keys_rcu(hw, vif, mt7615_mcu_key_iter, gtk_tlv);
3842 	rcu_read_unlock();
3843 
3844 	memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
3845 	memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
3846 	memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
3847 
3848 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
3849 				     true);
3850 }
3851 #endif /* CONFIG_PM */
3852 
3853 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
3854 		       struct ieee80211_channel *chan, int duration)
3855 {
3856 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3857 	struct mt7615_dev *dev = phy->dev;
3858 	struct mt7615_roc_tlv req = {
3859 		.bss_idx = mvif->idx,
3860 		.active = !chan,
3861 		.max_interval = cpu_to_le32(duration),
3862 		.primary_chan = chan ? chan->hw_value : 0,
3863 		.band = chan ? chan->band : 0,
3864 		.req_type = 2,
3865 	};
3866 
3867 	phy->roc_grant = false;
3868 
3869 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
3870 				 sizeof(req), false);
3871 }
3872 
3873 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
3874 				 struct ieee80211_vif *vif,
3875 				 struct ieee80211_bss_conf *info)
3876 {
3877 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3878 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3879 	struct sk_buff *skb;
3880 	int i, len = min_t(int, info->arp_addr_cnt,
3881 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
3882 	struct {
3883 		struct {
3884 			u8 bss_idx;
3885 			u8 pad[3];
3886 		} __packed hdr;
3887 		struct mt7615_arpns_tlv arp;
3888 	} req_hdr = {
3889 		.hdr = {
3890 			.bss_idx = mvif->idx,
3891 		},
3892 		.arp = {
3893 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
3894 			.len = cpu_to_le16(sizeof(struct mt7615_arpns_tlv)),
3895 			.ips_num = len,
3896 			.mode = 2,  /* update */
3897 			.option = 1,
3898 		},
3899 	};
3900 
3901 	if (!mt7615_firmware_offload(dev))
3902 		return 0;
3903 
3904 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3905 				 sizeof(req_hdr) + len * sizeof(__be32));
3906 	if (!skb)
3907 		return -ENOMEM;
3908 
3909 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
3910 	for (i = 0; i < len; i++) {
3911 		u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
3912 
3913 		memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
3914 	}
3915 
3916 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
3917 				     true);
3918 }
3919 
3920 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
3921 			     struct ieee80211_vif *vif)
3922 {
3923 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
3924 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
3925 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
3926 	struct {
3927 		__le32 ct_win;
3928 		u8 bss_idx;
3929 		u8 rsv[3];
3930 	} __packed req = {
3931 		.ct_win = cpu_to_le32(ct_window),
3932 		.bss_idx = mvif->idx,
3933 	};
3934 
3935 	if (!mt7615_firmware_offload(dev))
3936 		return -ENOTSUPP;
3937 
3938 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
3939 				 sizeof(req), false);
3940 }
3941 
3942 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
3943 {
3944 	struct {
3945 		__le32 addr;
3946 		__le32 val;
3947 	} __packed req = {
3948 		.addr = cpu_to_le32(offset),
3949 	};
3950 
3951 	return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
3952 				 true);
3953 }
3954 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
3955 
3956 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
3957 {
3958 	struct {
3959 		__le32 addr;
3960 		__le32 val;
3961 	} __packed req = {
3962 		.addr = cpu_to_le32(offset),
3963 		.val = cpu_to_le32(val),
3964 	};
3965 
3966 	mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
3967 }
3968 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);
3969