1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
75 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
76 
77 #define DL_MODE_ENCRYPT			BIT(0)
78 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
79 #define DL_MODE_RESET_SEC_IV		BIT(3)
80 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
82 #define DL_MODE_NEED_RSP		BIT(31)
83 
84 #define FW_START_OVERRIDE		BIT(0)
85 #define FW_START_WORKING_PDA_CR4	BIT(2)
86 
87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
88 			 int cmd, int *wait_seq)
89 {
90 	int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
91 	struct mt7615_uni_txd *uni_txd;
92 	struct mt7615_mcu_txd *mcu_txd;
93 	u8 seq, q_idx, pkt_fmt;
94 	__le32 *txd;
95 	u32 val;
96 
97 	/* TODO: make dynamic based on msg type */
98 	dev->mt76.mcu.timeout = 20 * HZ;
99 
100 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
101 	if (!seq)
102 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
103 	if (wait_seq)
104 		*wait_seq = seq;
105 
106 	txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
107 	txd = (__le32 *)skb_push(skb, txd_len);
108 
109 	if (cmd != MCU_CMD_FW_SCATTER) {
110 		q_idx = MT_TX_MCU_PORT_RX_Q0;
111 		pkt_fmt = MT_TX_TYPE_CMD;
112 	} else {
113 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
114 		pkt_fmt = MT_TX_TYPE_FW;
115 	}
116 
117 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
118 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
119 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
120 	txd[0] = cpu_to_le32(val);
121 
122 	val = MT_TXD1_LONG_FORMAT |
123 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
124 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
125 	txd[1] = cpu_to_le32(val);
126 
127 	if (cmd & MCU_UNI_PREFIX) {
128 		uni_txd = (struct mt7615_uni_txd *)txd;
129 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
130 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
131 		uni_txd->cid = cpu_to_le16(mcu_cmd);
132 		uni_txd->s2d_index = MCU_S2D_H2N;
133 		uni_txd->pkt_type = MCU_PKT_ID;
134 		uni_txd->seq = seq;
135 
136 		return;
137 	}
138 
139 	mcu_txd = (struct mt7615_mcu_txd *)txd;
140 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
141 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
142 	mcu_txd->s2d_index = MCU_S2D_H2N;
143 	mcu_txd->pkt_type = MCU_PKT_ID;
144 	mcu_txd->seq = seq;
145 
146 	switch (cmd & ~MCU_CMD_MASK) {
147 	case MCU_FW_PREFIX:
148 		mcu_txd->set_query = MCU_Q_NA;
149 		mcu_txd->cid = mcu_cmd;
150 		break;
151 	case MCU_CE_PREFIX:
152 		if (cmd & MCU_QUERY_MASK)
153 			mcu_txd->set_query = MCU_Q_QUERY;
154 		else
155 			mcu_txd->set_query = MCU_Q_SET;
156 		mcu_txd->cid = mcu_cmd;
157 		break;
158 	default:
159 		mcu_txd->cid = MCU_CMD_EXT_CID;
160 		if (cmd & MCU_QUERY_PREFIX)
161 			mcu_txd->set_query = MCU_Q_QUERY;
162 		else
163 			mcu_txd->set_query = MCU_Q_SET;
164 		mcu_txd->ext_cid = mcu_cmd;
165 		mcu_txd->ext_cid_ack = 1;
166 		break;
167 	}
168 }
169 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
170 
171 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
172 			      struct sk_buff *skb, int seq)
173 {
174 	struct mt7615_mcu_rxd *rxd;
175 	int ret = 0;
176 
177 	if (!skb) {
178 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
179 			cmd, seq);
180 		return -ETIMEDOUT;
181 	}
182 
183 	rxd = (struct mt7615_mcu_rxd *)skb->data;
184 	if (seq != rxd->seq)
185 		return -EAGAIN;
186 
187 	switch (cmd) {
188 	case MCU_CMD_PATCH_SEM_CONTROL:
189 		skb_pull(skb, sizeof(*rxd) - 4);
190 		ret = *skb->data;
191 		break;
192 	case MCU_EXT_CMD_GET_TEMP:
193 		skb_pull(skb, sizeof(*rxd));
194 		ret = le32_to_cpu(*(__le32 *)skb->data);
195 		break;
196 	case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
197 		skb_pull(skb, sizeof(*rxd));
198 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
199 		break;
200 	case MCU_UNI_CMD_DEV_INFO_UPDATE:
201 	case MCU_UNI_CMD_BSS_INFO_UPDATE:
202 	case MCU_UNI_CMD_STA_REC_UPDATE:
203 	case MCU_UNI_CMD_HIF_CTRL:
204 	case MCU_UNI_CMD_OFFLOAD:
205 	case MCU_UNI_CMD_SUSPEND: {
206 		struct mt7615_mcu_uni_event *event;
207 
208 		skb_pull(skb, sizeof(*rxd));
209 		event = (struct mt7615_mcu_uni_event *)skb->data;
210 		ret = le32_to_cpu(event->status);
211 		break;
212 	}
213 	case MCU_CMD_REG_READ: {
214 		struct mt7615_mcu_reg_event *event;
215 
216 		skb_pull(skb, sizeof(*rxd));
217 		event = (struct mt7615_mcu_reg_event *)skb->data;
218 		ret = (int)le32_to_cpu(event->val);
219 		break;
220 	}
221 	default:
222 		break;
223 	}
224 
225 	return ret;
226 }
227 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
228 
229 static int
230 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
231 			int cmd, int *seq)
232 {
233 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
234 	enum mt76_mcuq_id qid;
235 
236 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
237 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
238 		qid = MT_MCUQ_WM;
239 	else
240 		qid = MT_MCUQ_FWDL;
241 
242 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
243 }
244 
245 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
246 {
247 	struct {
248 		__le32 wifi_stream;
249 		__le32 address;
250 		__le32 data;
251 	} req = {
252 		.wifi_stream = cpu_to_le32(wf),
253 		.address = cpu_to_le32(reg),
254 	};
255 
256 	return mt76_mcu_send_msg(&dev->mt76,
257 				 MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
258 				 &req, sizeof(req), true);
259 }
260 
261 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
262 {
263 	struct {
264 		__le32 wifi_stream;
265 		__le32 address;
266 		__le32 data;
267 	} req = {
268 		.wifi_stream = cpu_to_le32(wf),
269 		.address = cpu_to_le32(reg),
270 		.data = cpu_to_le32(val),
271 	};
272 
273 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
274 				 sizeof(req), false);
275 }
276 
277 void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
278 {
279 	if (!is_mt7622(&dev->mt76))
280 		return;
281 
282 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
283 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
284 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
285 }
286 EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
287 
288 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
289 {
290 	struct mt76_phy *mphy = &dev->mt76.phy;
291 	struct mt76_connac_pm *pm = &dev->pm;
292 	struct mt76_dev *mdev = &dev->mt76;
293 	u32 addr;
294 	int err;
295 
296 	if (is_mt7663(mdev)) {
297 		/* Clear firmware own via N9 eint */
298 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
299 		mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
300 
301 		addr = MT_CONN_HIF_ON_LPCTL;
302 	} else {
303 		addr = MT_CFG_LPCR_HOST;
304 	}
305 
306 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
307 
308 	mt7622_trigger_hif_int(dev, true);
309 
310 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
311 
312 	mt7622_trigger_hif_int(dev, false);
313 
314 	if (err) {
315 		dev_err(mdev->dev, "driver own failed\n");
316 		return -ETIMEDOUT;
317 	}
318 
319 	clear_bit(MT76_STATE_PM, &mphy->state);
320 
321 	pm->stats.last_wake_event = jiffies;
322 	pm->stats.doze_time += pm->stats.last_wake_event -
323 			       pm->stats.last_doze_event;
324 
325 	return 0;
326 }
327 
328 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
329 {
330 	struct mt76_phy *mphy = &dev->mt76.phy;
331 	struct mt76_connac_pm *pm = &dev->pm;
332 	int i, err = 0;
333 
334 	mutex_lock(&pm->mutex);
335 
336 	if (!test_bit(MT76_STATE_PM, &mphy->state))
337 		goto out;
338 
339 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
340 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
341 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
342 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
343 			break;
344 	}
345 
346 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
347 		dev_err(dev->mt76.dev, "driver own failed\n");
348 		err = -EIO;
349 		goto out;
350 	}
351 	clear_bit(MT76_STATE_PM, &mphy->state);
352 
353 	pm->stats.last_wake_event = jiffies;
354 	pm->stats.doze_time += pm->stats.last_wake_event -
355 			       pm->stats.last_doze_event;
356 out:
357 	mutex_unlock(&pm->mutex);
358 
359 	return err;
360 }
361 
362 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
363 {
364 	struct mt76_phy *mphy = &dev->mt76.phy;
365 	struct mt76_connac_pm *pm = &dev->pm;
366 	int err = 0;
367 	u32 addr;
368 
369 	mutex_lock(&pm->mutex);
370 
371 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
372 		goto out;
373 
374 	mt7622_trigger_hif_int(dev, true);
375 
376 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
377 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
378 
379 	if (is_mt7622(&dev->mt76) &&
380 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
381 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
382 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
383 		clear_bit(MT76_STATE_PM, &mphy->state);
384 		err = -EIO;
385 	}
386 
387 	mt7622_trigger_hif_int(dev, false);
388 
389 	pm->stats.last_doze_event = jiffies;
390 	pm->stats.awake_time += pm->stats.last_doze_event -
391 				pm->stats.last_wake_event;
392 out:
393 	mutex_unlock(&pm->mutex);
394 
395 	return err;
396 }
397 
398 static void
399 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
400 {
401 	if (vif->csa_active)
402 		ieee80211_csa_finish(vif);
403 }
404 
405 static void
406 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
407 {
408 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
409 	struct mt76_phy *mphy = &dev->mt76.phy;
410 	struct mt7615_mcu_csa_notify *c;
411 
412 	c = (struct mt7615_mcu_csa_notify *)skb->data;
413 
414 	if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
415 		mphy = dev->mt76.phy2;
416 
417 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
418 			IEEE80211_IFACE_ITER_RESUME_ALL,
419 			mt7615_mcu_csa_finish, mphy->hw);
420 }
421 
422 static void
423 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
424 {
425 	struct mt76_phy *mphy = &dev->mt76.phy;
426 	struct mt7615_mcu_rdd_report *r;
427 
428 	r = (struct mt7615_mcu_rdd_report *)skb->data;
429 
430 	if (r->band_idx && dev->mt76.phy2)
431 		mphy = dev->mt76.phy2;
432 
433 	ieee80211_radar_detected(mphy->hw);
434 	dev->hw_pattern++;
435 }
436 
437 static void
438 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
439 {
440 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
441 	const char *data = (char *)&rxd[1];
442 	const char *type;
443 
444 	switch (rxd->s2d_index) {
445 	case 0:
446 		type = "N9";
447 		break;
448 	case 2:
449 		type = "CR4";
450 		break;
451 	default:
452 		type = "unknown";
453 		break;
454 	}
455 
456 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
457 		   (int)(skb->len - sizeof(*rxd)), data);
458 }
459 
460 static void
461 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
462 {
463 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
464 
465 	switch (rxd->ext_eid) {
466 	case MCU_EXT_EVENT_RDD_REPORT:
467 		mt7615_mcu_rx_radar_detected(dev, skb);
468 		break;
469 	case MCU_EXT_EVENT_CSA_NOTIFY:
470 		mt7615_mcu_rx_csa_notify(dev, skb);
471 		break;
472 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
473 		mt7615_mcu_rx_log_message(dev, skb);
474 		break;
475 	default:
476 		break;
477 	}
478 }
479 
480 static void
481 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
482 {
483 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
484 	struct mt7615_phy *phy;
485 	struct mt76_phy *mphy;
486 
487 	if (*seq_num & BIT(7) && dev->mt76.phy2)
488 		mphy = dev->mt76.phy2;
489 	else
490 		mphy = &dev->mt76.phy;
491 
492 	phy = (struct mt7615_phy *)mphy->priv;
493 
494 	spin_lock_bh(&dev->mt76.lock);
495 	__skb_queue_tail(&phy->scan_event_list, skb);
496 	spin_unlock_bh(&dev->mt76.lock);
497 
498 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
499 				     MT7615_HW_SCAN_TIMEOUT);
500 }
501 
502 static void
503 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
504 {
505 	struct mt7615_roc_tlv *event;
506 	struct mt7615_phy *phy;
507 	struct mt76_phy *mphy;
508 	int duration;
509 
510 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
511 	event = (struct mt7615_roc_tlv *)skb->data;
512 
513 	if (event->dbdc_band && dev->mt76.phy2)
514 		mphy = dev->mt76.phy2;
515 	else
516 		mphy = &dev->mt76.phy;
517 
518 	ieee80211_ready_on_channel(mphy->hw);
519 
520 	phy = (struct mt7615_phy *)mphy->priv;
521 	phy->roc_grant = true;
522 	wake_up(&phy->roc_wait);
523 
524 	duration = le32_to_cpu(event->max_interval);
525 	mod_timer(&phy->roc_timer,
526 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
527 }
528 
529 static void
530 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
531 {
532 	struct mt76_connac_beacon_loss_event *event;
533 	struct mt76_phy *mphy;
534 	u8 band_idx = 0; /* DBDC support */
535 
536 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
537 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
538 	if (band_idx && dev->mt76.phy2)
539 		mphy = dev->mt76.phy2;
540 	else
541 		mphy = &dev->mt76.phy;
542 
543 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
544 					IEEE80211_IFACE_ITER_RESUME_ALL,
545 					mt76_connac_mcu_beacon_loss_iter,
546 					event);
547 }
548 
549 static void
550 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
551 {
552 	struct mt76_connac_mcu_bss_event *event;
553 	struct mt76_phy *mphy;
554 	u8 band_idx = 0; /* DBDC support */
555 
556 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
557 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
558 
559 	if (band_idx && dev->mt76.phy2)
560 		mphy = dev->mt76.phy2;
561 	else
562 		mphy = &dev->mt76.phy;
563 
564 	if (event->is_absent)
565 		ieee80211_stop_queues(mphy->hw);
566 	else
567 		ieee80211_wake_queues(mphy->hw);
568 }
569 
570 static void
571 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
572 {
573 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
574 
575 	switch (rxd->eid) {
576 	case MCU_EVENT_EXT:
577 		mt7615_mcu_rx_ext_event(dev, skb);
578 		break;
579 	case MCU_EVENT_BSS_BEACON_LOSS:
580 		mt7615_mcu_beacon_loss_event(dev, skb);
581 		break;
582 	case MCU_EVENT_ROC:
583 		mt7615_mcu_roc_event(dev, skb);
584 		break;
585 	case MCU_EVENT_SCHED_SCAN_DONE:
586 	case MCU_EVENT_SCAN_DONE:
587 		mt7615_mcu_scan_event(dev, skb);
588 		return;
589 	case MCU_EVENT_BSS_ABSENCE:
590 		mt7615_mcu_bss_event(dev, skb);
591 		break;
592 	case MCU_EVENT_COREDUMP:
593 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
594 					       &dev->coredump);
595 		return;
596 	default:
597 		break;
598 	}
599 	dev_kfree_skb(skb);
600 }
601 
602 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
603 {
604 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
605 
606 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
607 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
608 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
609 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
610 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
611 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
612 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
613 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
614 	    rxd->eid == MCU_EVENT_COREDUMP ||
615 	    rxd->eid == MCU_EVENT_ROC ||
616 	    !rxd->seq)
617 		mt7615_mcu_rx_unsolicited_event(dev, skb);
618 	else
619 		mt76_mcu_rx_event(&dev->mt76, skb);
620 }
621 
622 static int
623 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
624 		       bool bssid, bool enable)
625 {
626 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
627 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
628 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
629 	const u8 *addr = vif->addr;
630 	struct {
631 		u8 mode;
632 		u8 force_clear;
633 		u8 clear_bitmap[8];
634 		u8 entry_count;
635 		u8 write;
636 
637 		u8 index;
638 		u8 bssid;
639 		u8 addr[ETH_ALEN];
640 	} __packed req = {
641 		.mode = !!mask || enable,
642 		.entry_count = 1,
643 		.write = 1,
644 
645 		.index = idx * 2 + bssid,
646 	};
647 
648 	if (bssid)
649 		addr = vif->bss_conf.bssid;
650 
651 	if (enable)
652 		ether_addr_copy(req.addr, addr);
653 
654 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
655 				 sizeof(req), true);
656 }
657 
658 static int
659 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
660 		   bool enable)
661 {
662 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
663 	struct mt7615_dev *dev = phy->dev;
664 	struct {
665 		struct req_hdr {
666 			u8 omac_idx;
667 			u8 band_idx;
668 			__le16 tlv_num;
669 			u8 is_tlv_append;
670 			u8 rsv[3];
671 		} __packed hdr;
672 		struct req_tlv {
673 			__le16 tag;
674 			__le16 len;
675 			u8 active;
676 			u8 band_idx;
677 			u8 omac_addr[ETH_ALEN];
678 		} __packed tlv;
679 	} data = {
680 		.hdr = {
681 			.omac_idx = mvif->mt76.omac_idx,
682 			.band_idx = mvif->mt76.band_idx,
683 			.tlv_num = cpu_to_le16(1),
684 			.is_tlv_append = 1,
685 		},
686 		.tlv = {
687 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
688 			.len = cpu_to_le16(sizeof(struct req_tlv)),
689 			.active = enable,
690 			.band_idx = mvif->mt76.band_idx,
691 		},
692 	};
693 
694 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
695 		return mt7615_mcu_muar_config(dev, vif, false, enable);
696 
697 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
698 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
699 				 &data, sizeof(data), true);
700 }
701 
702 static int
703 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
704 			      struct ieee80211_hw *hw,
705 			      struct ieee80211_vif *vif, bool enable)
706 {
707 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
708 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
709 	struct ieee80211_mutable_offsets offs;
710 	struct ieee80211_tx_info *info;
711 	struct req {
712 		u8 omac_idx;
713 		u8 enable;
714 		u8 wlan_idx;
715 		u8 band_idx;
716 		u8 pkt_type;
717 		u8 need_pre_tbtt_int;
718 		__le16 csa_ie_pos;
719 		__le16 pkt_len;
720 		__le16 tim_ie_pos;
721 		u8 pkt[512];
722 		u8 csa_cnt;
723 		/* bss color change */
724 		u8 bcc_cnt;
725 		__le16 bcc_ie_pos;
726 	} __packed req = {
727 		.omac_idx = mvif->mt76.omac_idx,
728 		.enable = enable,
729 		.wlan_idx = wcid->idx,
730 		.band_idx = mvif->mt76.band_idx,
731 	};
732 	struct sk_buff *skb;
733 
734 	if (!enable)
735 		goto out;
736 
737 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
738 	if (!skb)
739 		return -EINVAL;
740 
741 	if (skb->len > 512 - MT_TXD_SIZE) {
742 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
743 		dev_kfree_skb(skb);
744 		return -EINVAL;
745 	}
746 
747 	if (mvif->mt76.band_idx) {
748 		info = IEEE80211_SKB_CB(skb);
749 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
750 	}
751 
752 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
753 			      0, NULL, true);
754 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
755 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
756 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
757 	if (offs.cntdwn_counter_offs[0]) {
758 		u16 csa_offs;
759 
760 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
761 		req.csa_ie_pos = cpu_to_le16(csa_offs);
762 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
763 	}
764 	dev_kfree_skb(skb);
765 
766 out:
767 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
768 				 sizeof(req), true);
769 }
770 
771 static int
772 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
773 {
774 #define ENTER_PM_STATE	1
775 #define EXIT_PM_STATE	2
776 	struct {
777 		u8 pm_number;
778 		u8 pm_state;
779 		u8 bssid[ETH_ALEN];
780 		u8 dtim_period;
781 		u8 wlan_idx;
782 		__le16 bcn_interval;
783 		__le32 aid;
784 		__le32 rx_filter;
785 		u8 band_idx;
786 		u8 rsv[3];
787 		__le32 feature;
788 		u8 omac_idx;
789 		u8 wmm_idx;
790 		u8 bcn_loss_cnt;
791 		u8 bcn_sp_duration;
792 	} __packed req = {
793 		.pm_number = 5,
794 		.pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
795 		.band_idx = band,
796 	};
797 
798 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
799 				 sizeof(req), true);
800 }
801 
802 static int
803 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
804 			 struct ieee80211_sta *sta, bool enable)
805 {
806 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
807 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
808 	struct bss_info_basic *bss;
809 	u8 wlan_idx = mvif->sta.wcid.idx;
810 	struct tlv *tlv;
811 
812 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
813 
814 	switch (vif->type) {
815 	case NL80211_IFTYPE_MESH_POINT:
816 	case NL80211_IFTYPE_AP:
817 		break;
818 	case NL80211_IFTYPE_STATION:
819 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
820 		if (enable && sta) {
821 			struct mt7615_sta *msta;
822 
823 			msta = (struct mt7615_sta *)sta->drv_priv;
824 			wlan_idx = msta->wcid.idx;
825 		}
826 		break;
827 	case NL80211_IFTYPE_ADHOC:
828 		type = NETWORK_IBSS;
829 		break;
830 	default:
831 		WARN_ON(1);
832 		break;
833 	}
834 
835 	bss = (struct bss_info_basic *)tlv;
836 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
837 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
838 	bss->network_type = cpu_to_le32(type);
839 	bss->dtim_period = vif->bss_conf.dtim_period;
840 	bss->bmc_tx_wlan_idx = wlan_idx;
841 	bss->wmm_idx = mvif->mt76.wmm_idx;
842 	bss->active = enable;
843 
844 	return 0;
845 }
846 
847 static void
848 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
849 {
850 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
851 	u8 omac_idx = mvif->mt76.omac_idx;
852 	struct bss_info_omac *omac;
853 	struct tlv *tlv;
854 	u32 type = 0;
855 
856 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
857 
858 	switch (vif->type) {
859 	case NL80211_IFTYPE_MESH_POINT:
860 	case NL80211_IFTYPE_AP:
861 		if (vif->p2p)
862 			type = CONNECTION_P2P_GO;
863 		else
864 			type = CONNECTION_INFRA_AP;
865 		break;
866 	case NL80211_IFTYPE_STATION:
867 		if (vif->p2p)
868 			type = CONNECTION_P2P_GC;
869 		else
870 			type = CONNECTION_INFRA_STA;
871 		break;
872 	case NL80211_IFTYPE_ADHOC:
873 		type = CONNECTION_IBSS_ADHOC;
874 		break;
875 	default:
876 		WARN_ON(1);
877 		break;
878 	}
879 
880 	omac = (struct bss_info_omac *)tlv;
881 	omac->conn_type = cpu_to_le32(type);
882 	omac->omac_idx = mvif->mt76.omac_idx;
883 	omac->band_idx = mvif->mt76.band_idx;
884 	omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
885 }
886 
887 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
888 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
889 static void
890 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
891 {
892 	struct bss_info_ext_bss *ext;
893 	int ext_bss_idx, tsf_offset;
894 	struct tlv *tlv;
895 
896 	ext_bss_idx = mvif->mt76.omac_idx - EXT_BSSID_START;
897 	if (ext_bss_idx < 0)
898 		return;
899 
900 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
901 
902 	ext = (struct bss_info_ext_bss *)tlv;
903 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
904 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
905 }
906 
907 static int
908 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
909 		   struct ieee80211_sta *sta, bool enable)
910 {
911 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
912 	struct mt7615_dev *dev = phy->dev;
913 	struct sk_buff *skb;
914 
915 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
916 		mt7615_mcu_muar_config(dev, vif, true, enable);
917 
918 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
919 	if (IS_ERR(skb))
920 		return PTR_ERR(skb);
921 
922 	if (enable)
923 		mt7615_mcu_bss_omac_tlv(skb, vif);
924 
925 	mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
926 
927 	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
928 	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
929 		mt7615_mcu_bss_ext_tlv(skb, mvif);
930 
931 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
932 				     MCU_EXT_CMD_BSS_INFO_UPDATE, true);
933 }
934 
935 static int
936 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
937 		      struct ieee80211_ampdu_params *params,
938 		      bool enable)
939 {
940 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
941 	struct mt7615_vif *mvif = msta->vif;
942 	struct wtbl_req_hdr *wtbl_hdr;
943 	struct sk_buff *skb = NULL;
944 	int err;
945 
946 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
947 						  WTBL_SET, NULL, &skb);
948 	if (IS_ERR(wtbl_hdr))
949 		return PTR_ERR(wtbl_hdr);
950 
951 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
952 				    NULL, wtbl_hdr);
953 
954 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
955 				    true);
956 	if (err < 0)
957 		return err;
958 
959 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
960 					    &msta->wcid);
961 	if (IS_ERR(skb))
962 		return PTR_ERR(skb);
963 
964 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
965 
966 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
967 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
968 }
969 
970 static int
971 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
972 		      struct ieee80211_ampdu_params *params,
973 		      bool enable)
974 {
975 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
976 	struct mt7615_vif *mvif = msta->vif;
977 	struct wtbl_req_hdr *wtbl_hdr;
978 	struct sk_buff *skb;
979 	int err;
980 
981 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
982 					    &msta->wcid);
983 	if (IS_ERR(skb))
984 		return PTR_ERR(skb);
985 
986 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
987 
988 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
989 				    MCU_EXT_CMD_STA_REC_UPDATE, true);
990 	if (err < 0 || !enable)
991 		return err;
992 
993 	skb = NULL;
994 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
995 						  WTBL_SET, NULL, &skb);
996 	if (IS_ERR(wtbl_hdr))
997 		return PTR_ERR(wtbl_hdr);
998 
999 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1000 				    NULL, wtbl_hdr);
1001 
1002 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1003 				     true);
1004 }
1005 
1006 static int
1007 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1008 			struct ieee80211_sta *sta, bool enable)
1009 {
1010 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1011 	struct sk_buff *skb, *sskb, *wskb = NULL;
1012 	struct mt7615_dev *dev = phy->dev;
1013 	struct wtbl_req_hdr *wtbl_hdr;
1014 	struct mt7615_sta *msta;
1015 	int cmd, err;
1016 
1017 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1018 
1019 	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1020 					     &msta->wcid);
1021 	if (IS_ERR(sskb))
1022 		return PTR_ERR(sskb);
1023 
1024 	mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1025 	if (enable && sta)
1026 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0);
1027 
1028 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1029 						  WTBL_RESET_AND_SET, NULL,
1030 						  &wskb);
1031 	if (IS_ERR(wtbl_hdr))
1032 		return PTR_ERR(wtbl_hdr);
1033 
1034 	if (enable) {
1035 		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
1036 						 NULL, wtbl_hdr);
1037 		if (sta)
1038 			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
1039 						    NULL, wtbl_hdr);
1040 		mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, &msta->wcid, NULL,
1041 						   wtbl_hdr);
1042 	}
1043 
1044 	cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1045 	skb = enable ? wskb : sskb;
1046 
1047 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1048 	if (err < 0) {
1049 		skb = enable ? sskb : wskb;
1050 		dev_kfree_skb(skb);
1051 
1052 		return err;
1053 	}
1054 
1055 	cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1056 	skb = enable ? sskb : wskb;
1057 
1058 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1059 }
1060 
1061 static const struct mt7615_mcu_ops wtbl_update_ops = {
1062 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1063 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1064 	.add_dev_info = mt7615_mcu_add_dev,
1065 	.add_bss_info = mt7615_mcu_add_bss,
1066 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1067 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1068 	.sta_add = mt7615_mcu_wtbl_sta_add,
1069 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1070 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1071 };
1072 
1073 static int
1074 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1075 		  struct ieee80211_ampdu_params *params,
1076 		  bool enable, bool tx)
1077 {
1078 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1079 	struct mt7615_vif *mvif = msta->vif;
1080 	struct wtbl_req_hdr *wtbl_hdr;
1081 	struct tlv *sta_wtbl;
1082 	struct sk_buff *skb;
1083 
1084 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1085 					    &msta->wcid);
1086 	if (IS_ERR(skb))
1087 		return PTR_ERR(skb);
1088 
1089 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1090 
1091 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1092 
1093 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1094 						  WTBL_SET, sta_wtbl, &skb);
1095 	if (IS_ERR(wtbl_hdr))
1096 		return PTR_ERR(wtbl_hdr);
1097 
1098 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
1099 				    sta_wtbl, wtbl_hdr);
1100 
1101 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1102 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1103 }
1104 
1105 static int
1106 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1107 		     struct ieee80211_ampdu_params *params,
1108 		     bool enable)
1109 {
1110 	return mt7615_mcu_sta_ba(dev, params, enable, true);
1111 }
1112 
1113 static int
1114 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1115 		     struct ieee80211_ampdu_params *params,
1116 		     bool enable)
1117 {
1118 	return mt7615_mcu_sta_ba(dev, params, enable, false);
1119 }
1120 
1121 static int
1122 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
1123 		     struct ieee80211_sta *sta, bool enable, int cmd)
1124 {
1125 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1126 	struct mt76_sta_cmd_info info = {
1127 		.sta = sta,
1128 		.vif = vif,
1129 		.enable = enable,
1130 		.cmd = cmd,
1131 	};
1132 
1133 	info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
1134 	return mt76_connac_mcu_add_sta_cmd(phy, &info);
1135 }
1136 
1137 static int
1138 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1139 		   struct ieee80211_sta *sta, bool enable)
1140 {
1141 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1142 				    MCU_EXT_CMD_STA_REC_UPDATE);
1143 }
1144 
1145 static const struct mt7615_mcu_ops sta_update_ops = {
1146 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1147 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1148 	.add_dev_info = mt7615_mcu_add_dev,
1149 	.add_bss_info = mt7615_mcu_add_bss,
1150 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1151 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1152 	.sta_add = mt7615_mcu_add_sta,
1153 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1154 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1155 };
1156 
1157 int mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1158 				    struct ieee80211_vif *vif,
1159 				    struct ieee80211_sta *sta)
1160 {
1161 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1162 	struct wtbl_req_hdr *wtbl_hdr;
1163 	struct sk_buff *skb = NULL;
1164 
1165 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1166 						  WTBL_SET, NULL, &skb);
1167 	if (IS_ERR(wtbl_hdr))
1168 		return PTR_ERR(wtbl_hdr);
1169 
1170 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, &msta->wcid, NULL, wtbl_hdr);
1171 
1172 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1173 				     true);
1174 }
1175 
1176 static int
1177 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1178 {
1179 	return 0;
1180 }
1181 
1182 static int
1183 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1184 				  struct ieee80211_hw *hw,
1185 				  struct ieee80211_vif *vif,
1186 				  bool enable)
1187 {
1188 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1189 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1190 	struct ieee80211_mutable_offsets offs;
1191 	struct {
1192 		struct req_hdr {
1193 			u8 bss_idx;
1194 			u8 pad[3];
1195 		} __packed hdr;
1196 		struct bcn_content_tlv {
1197 			__le16 tag;
1198 			__le16 len;
1199 			__le16 tim_ie_pos;
1200 			__le16 csa_ie_pos;
1201 			__le16 bcc_ie_pos;
1202 			/* 0: disable beacon offload
1203 			 * 1: enable beacon offload
1204 			 * 2: update probe respond offload
1205 			 */
1206 			u8 enable;
1207 			/* 0: legacy format (TXD + payload)
1208 			 * 1: only cap field IE
1209 			 */
1210 			u8 type;
1211 			__le16 pkt_len;
1212 			u8 pkt[512];
1213 		} __packed beacon_tlv;
1214 	} req = {
1215 		.hdr = {
1216 			.bss_idx = mvif->mt76.idx,
1217 		},
1218 		.beacon_tlv = {
1219 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1220 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1221 			.enable = enable,
1222 		},
1223 	};
1224 	struct sk_buff *skb;
1225 
1226 	if (!enable)
1227 		goto out;
1228 
1229 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1230 	if (!skb)
1231 		return -EINVAL;
1232 
1233 	if (skb->len > 512 - MT_TXD_SIZE) {
1234 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1235 		dev_kfree_skb(skb);
1236 		return -EINVAL;
1237 	}
1238 
1239 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1240 			      wcid, NULL, 0, NULL, true);
1241 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1242 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1243 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1244 
1245 	if (offs.cntdwn_counter_offs[0]) {
1246 		u16 csa_offs;
1247 
1248 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1249 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1250 	}
1251 	dev_kfree_skb(skb);
1252 
1253 out:
1254 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1255 				 &req, sizeof(req), true);
1256 }
1257 
1258 static int
1259 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1260 		       bool enable)
1261 {
1262 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1263 
1264 	return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1265 					   enable);
1266 }
1267 
1268 static int
1269 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1270 		       struct ieee80211_sta *sta, bool enable)
1271 {
1272 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1273 
1274 	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1275 					   enable);
1276 }
1277 
1278 static inline int
1279 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1280 		       struct ieee80211_sta *sta, bool enable)
1281 {
1282 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1283 				    MCU_UNI_CMD_STA_REC_UPDATE);
1284 }
1285 
1286 static int
1287 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1288 		     struct ieee80211_ampdu_params *params,
1289 		     bool enable)
1290 {
1291 	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1292 
1293 	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1294 				      enable, true);
1295 }
1296 
1297 static int
1298 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1299 		     struct ieee80211_ampdu_params *params,
1300 		     bool enable)
1301 {
1302 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1303 	struct mt7615_vif *mvif = msta->vif;
1304 	struct wtbl_req_hdr *wtbl_hdr;
1305 	struct tlv *sta_wtbl;
1306 	struct sk_buff *skb;
1307 	int err;
1308 
1309 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1310 					    &msta->wcid);
1311 	if (IS_ERR(skb))
1312 		return PTR_ERR(skb);
1313 
1314 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1315 
1316 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1317 				    MCU_UNI_CMD_STA_REC_UPDATE, true);
1318 	if (err < 0 || !enable)
1319 		return err;
1320 
1321 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1322 					    &msta->wcid);
1323 	if (IS_ERR(skb))
1324 		return PTR_ERR(skb);
1325 
1326 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1327 					   sizeof(struct tlv));
1328 
1329 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1330 						  WTBL_SET, sta_wtbl, &skb);
1331 	if (IS_ERR(wtbl_hdr))
1332 		return PTR_ERR(wtbl_hdr);
1333 
1334 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1335 				    sta_wtbl, wtbl_hdr);
1336 
1337 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1338 				     MCU_UNI_CMD_STA_REC_UPDATE, true);
1339 }
1340 
1341 static const struct mt7615_mcu_ops uni_update_ops = {
1342 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1343 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1344 	.add_dev_info = mt7615_mcu_uni_add_dev,
1345 	.add_bss_info = mt7615_mcu_uni_add_bss,
1346 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1347 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1348 	.sta_add = mt7615_mcu_uni_add_sta,
1349 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1350 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1351 };
1352 
1353 int mt7615_mcu_restart(struct mt76_dev *dev)
1354 {
1355 	return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1356 }
1357 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1358 
1359 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1360 {
1361 	const struct mt7615_patch_hdr *hdr;
1362 	const struct firmware *fw = NULL;
1363 	int len, ret, sem;
1364 
1365 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1366 	if (ret)
1367 		return ret;
1368 
1369 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1370 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1371 		ret = -EINVAL;
1372 		goto release_fw;
1373 	}
1374 
1375 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1376 	switch (sem) {
1377 	case PATCH_IS_DL:
1378 		goto release_fw;
1379 	case PATCH_NOT_DL_SEM_SUCCESS:
1380 		break;
1381 	default:
1382 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1383 		ret = -EAGAIN;
1384 		goto release_fw;
1385 	}
1386 
1387 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1388 
1389 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1390 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1391 
1392 	len = fw->size - sizeof(*hdr);
1393 
1394 	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1395 					    DL_MODE_NEED_RSP);
1396 	if (ret) {
1397 		dev_err(dev->mt76.dev, "Download request failed\n");
1398 		goto out;
1399 	}
1400 
1401 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1402 				     fw->data + sizeof(*hdr), len);
1403 	if (ret) {
1404 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1405 		goto out;
1406 	}
1407 
1408 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1409 	if (ret)
1410 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1411 
1412 out:
1413 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1414 	switch (sem) {
1415 	case PATCH_REL_SEM_SUCCESS:
1416 		break;
1417 	default:
1418 		ret = -EAGAIN;
1419 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1420 		break;
1421 	}
1422 
1423 release_fw:
1424 	release_firmware(fw);
1425 
1426 	return ret;
1427 }
1428 
1429 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1430 {
1431 	u32 ret = 0;
1432 
1433 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1434 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1435 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1436 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1437 	ret |= DL_MODE_NEED_RSP;
1438 	ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1439 
1440 	return ret;
1441 }
1442 
1443 static int
1444 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1445 			     const struct mt7615_fw_trailer *hdr,
1446 			     const u8 *data, bool is_cr4)
1447 {
1448 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1449 	int err, i, offset = 0;
1450 	u32 len, addr, mode;
1451 
1452 	for (i = 0; i < n_region; i++) {
1453 		mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1454 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1455 		addr = le32_to_cpu(hdr[i].addr);
1456 
1457 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1458 						    mode);
1459 		if (err) {
1460 			dev_err(dev->mt76.dev, "Download request failed\n");
1461 			return err;
1462 		}
1463 
1464 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1465 					     data + offset, len);
1466 		if (err) {
1467 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1468 			return err;
1469 		}
1470 
1471 		offset += len;
1472 	}
1473 
1474 	return 0;
1475 }
1476 
1477 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1478 {
1479 	const struct mt7615_fw_trailer *hdr;
1480 	const struct firmware *fw;
1481 	int ret;
1482 
1483 	ret = request_firmware(&fw, name, dev->mt76.dev);
1484 	if (ret)
1485 		return ret;
1486 
1487 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1488 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1489 		ret = -EINVAL;
1490 		goto out;
1491 	}
1492 
1493 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1494 					N9_REGION_NUM * sizeof(*hdr));
1495 
1496 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1497 		 hdr->fw_ver, hdr->build_date);
1498 
1499 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1500 	if (ret)
1501 		goto out;
1502 
1503 	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1504 					     le32_to_cpu(hdr->addr),
1505 					     FW_START_OVERRIDE);
1506 	if (ret) {
1507 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1508 		goto out;
1509 	}
1510 
1511 	snprintf(dev->mt76.hw->wiphy->fw_version,
1512 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1513 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1514 
1515 	if (!is_mt7615(&dev->mt76)) {
1516 		dev->fw_ver = MT7615_FIRMWARE_V2;
1517 		dev->mcu_ops = &sta_update_ops;
1518 	} else {
1519 		dev->fw_ver = MT7615_FIRMWARE_V1;
1520 		dev->mcu_ops = &wtbl_update_ops;
1521 	}
1522 
1523 out:
1524 	release_firmware(fw);
1525 	return ret;
1526 }
1527 
1528 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1529 {
1530 	const struct mt7615_fw_trailer *hdr;
1531 	const struct firmware *fw;
1532 	int ret;
1533 
1534 	ret = request_firmware(&fw, name, dev->mt76.dev);
1535 	if (ret)
1536 		return ret;
1537 
1538 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1539 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1540 		ret = -EINVAL;
1541 		goto out;
1542 	}
1543 
1544 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1545 					CR4_REGION_NUM * sizeof(*hdr));
1546 
1547 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1548 		 hdr->fw_ver, hdr->build_date);
1549 
1550 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1551 	if (ret)
1552 		goto out;
1553 
1554 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1555 					     FW_START_WORKING_PDA_CR4);
1556 	if (ret) {
1557 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1558 		goto out;
1559 	}
1560 
1561 out:
1562 	release_firmware(fw);
1563 
1564 	return ret;
1565 }
1566 
1567 static int mt7615_load_ram(struct mt7615_dev *dev)
1568 {
1569 	int ret;
1570 
1571 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1572 	if (ret)
1573 		return ret;
1574 
1575 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1576 }
1577 
1578 static int mt7615_load_firmware(struct mt7615_dev *dev)
1579 {
1580 	int ret;
1581 	u32 val;
1582 
1583 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1584 
1585 	if (val != FW_STATE_FW_DOWNLOAD) {
1586 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1587 		return -EIO;
1588 	}
1589 
1590 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1591 	if (ret)
1592 		return ret;
1593 
1594 	ret = mt7615_load_ram(dev);
1595 	if (ret)
1596 		return ret;
1597 
1598 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1599 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1600 				       FW_STATE_CR4_RDY), 500)) {
1601 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1602 		return -EIO;
1603 	}
1604 
1605 	return 0;
1606 }
1607 
1608 static int mt7622_load_firmware(struct mt7615_dev *dev)
1609 {
1610 	int ret;
1611 	u32 val;
1612 
1613 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1614 
1615 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1616 	if (val != FW_STATE_FW_DOWNLOAD) {
1617 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1618 		return -EIO;
1619 	}
1620 
1621 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1622 	if (ret)
1623 		return ret;
1624 
1625 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1626 	if (ret)
1627 		return ret;
1628 
1629 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1630 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1631 				       FW_STATE_NORMAL_TRX), 1500)) {
1632 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1633 		return -EIO;
1634 	}
1635 
1636 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1637 
1638 	return 0;
1639 }
1640 
1641 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1642 {
1643 	struct {
1644 		u8 ctrl_val;
1645 		u8 pad[3];
1646 	} data = {
1647 		.ctrl_val = ctrl
1648 	};
1649 
1650 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
1651 				 sizeof(data), true);
1652 }
1653 
1654 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1655 {
1656 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1657 	const struct mt7663_fw_trailer *hdr;
1658 	const struct mt7663_fw_buf *buf;
1659 	const struct firmware *fw;
1660 	const u8 *base_addr;
1661 	int i, ret;
1662 
1663 	ret = request_firmware(&fw, name, dev->mt76.dev);
1664 	if (ret)
1665 		return ret;
1666 
1667 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1668 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1669 		ret = -EINVAL;
1670 		goto out;
1671 	}
1672 
1673 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
1674 						 FW_V3_COMMON_TAILER_SIZE);
1675 
1676 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1677 		 hdr->fw_ver, hdr->build_date);
1678 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1679 
1680 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1681 	for (i = 0; i < hdr->n_region; i++) {
1682 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1683 		u32 len, addr, mode;
1684 
1685 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1686 
1687 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1688 		mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
1689 		addr = le32_to_cpu(buf->img_dest_addr);
1690 		len = le32_to_cpu(buf->img_size);
1691 
1692 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1693 						    mode);
1694 		if (ret) {
1695 			dev_err(dev->mt76.dev, "Download request failed\n");
1696 			goto out;
1697 		}
1698 
1699 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1700 					     fw->data + offset, len);
1701 		if (ret) {
1702 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1703 			goto out;
1704 		}
1705 
1706 		offset += le32_to_cpu(buf->img_size);
1707 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1708 			override_addr = le32_to_cpu(buf->img_dest_addr);
1709 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1710 				 i, override_addr);
1711 		}
1712 	}
1713 
1714 	if (override_addr)
1715 		flag |= FW_START_OVERRIDE;
1716 
1717 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1718 		 override_addr, flag);
1719 
1720 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1721 	if (ret) {
1722 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1723 		goto out;
1724 	}
1725 
1726 	snprintf(dev->mt76.hw->wiphy->fw_version,
1727 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1728 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1729 
1730 out:
1731 	release_firmware(fw);
1732 
1733 	return ret;
1734 }
1735 
1736 static int
1737 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1738 {
1739 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1740 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1741 	int ret;
1742 
1743 	if (!prefer_offload_fw) {
1744 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1745 		primary_rom = MT7663_ROM_PATCH;
1746 	}
1747 	selected_rom = primary_rom;
1748 
1749 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1750 	if (ret) {
1751 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1752 			 primary_rom, secondary_rom);
1753 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1754 					secondary_rom);
1755 		if (ret) {
1756 			dev_err(dev->mt76.dev, "failed to load %s",
1757 				secondary_rom);
1758 			return ret;
1759 		}
1760 		selected_rom = secondary_rom;
1761 	}
1762 
1763 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1764 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1765 		dev->fw_ver = MT7615_FIRMWARE_V3;
1766 		dev->mcu_ops = &uni_update_ops;
1767 	} else {
1768 		*n9_firmware = MT7663_FIRMWARE_N9;
1769 		dev->fw_ver = MT7615_FIRMWARE_V2;
1770 		dev->mcu_ops = &sta_update_ops;
1771 	}
1772 
1773 	return 0;
1774 }
1775 
1776 int __mt7663_load_firmware(struct mt7615_dev *dev)
1777 {
1778 	const char *n9_firmware;
1779 	int ret;
1780 
1781 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1782 	if (ret) {
1783 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1784 		return -EIO;
1785 	}
1786 
1787 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1788 	if (ret)
1789 		return ret;
1790 
1791 	ret = mt7663_load_n9(dev, n9_firmware);
1792 	if (ret)
1793 		return ret;
1794 
1795 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1796 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1797 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1798 				     MT7663_TOP_MISC2_FW_STATE);
1799 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1800 		return -EIO;
1801 	}
1802 
1803 #ifdef CONFIG_PM
1804 	if (mt7615_firmware_offload(dev))
1805 		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1806 #endif /* CONFIG_PM */
1807 
1808 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1809 
1810 	return 0;
1811 }
1812 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1813 
1814 static int mt7663_load_firmware(struct mt7615_dev *dev)
1815 {
1816 	int ret;
1817 
1818 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1819 
1820 	ret = __mt7663_load_firmware(dev);
1821 	if (ret)
1822 		return ret;
1823 
1824 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1825 
1826 	return 0;
1827 }
1828 
1829 int mt7615_mcu_init(struct mt7615_dev *dev)
1830 {
1831 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1832 		.headroom = sizeof(struct mt7615_mcu_txd),
1833 		.mcu_skb_send_msg = mt7615_mcu_send_message,
1834 		.mcu_parse_response = mt7615_mcu_parse_response,
1835 		.mcu_restart = mt7615_mcu_restart,
1836 	};
1837 	int ret;
1838 
1839 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
1840 
1841 	ret = mt7615_mcu_drv_pmctrl(dev);
1842 	if (ret)
1843 		return ret;
1844 
1845 	switch (mt76_chip(&dev->mt76)) {
1846 	case 0x7622:
1847 		ret = mt7622_load_firmware(dev);
1848 		break;
1849 	case 0x7663:
1850 		ret = mt7663_load_firmware(dev);
1851 		break;
1852 	default:
1853 		ret = mt7615_load_firmware(dev);
1854 		break;
1855 	}
1856 	if (ret)
1857 		return ret;
1858 
1859 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1860 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1861 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1862 	mt7615_mcu_fw_log_2_host(dev, 0);
1863 
1864 	return 0;
1865 }
1866 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1867 
1868 void mt7615_mcu_exit(struct mt7615_dev *dev)
1869 {
1870 	__mt76_mcu_restart(&dev->mt76);
1871 	mt7615_mcu_set_fw_ctrl(dev);
1872 	skb_queue_purge(&dev->mt76.mcu.res_q);
1873 }
1874 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1875 
1876 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1877 {
1878 	struct {
1879 		u8 buffer_mode;
1880 		u8 content_format;
1881 		__le16 len;
1882 	} __packed req_hdr = {
1883 		.buffer_mode = 1,
1884 	};
1885 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1886 	struct sk_buff *skb;
1887 	int eep_len, offset;
1888 
1889 	switch (mt76_chip(&dev->mt76)) {
1890 	case 0x7622:
1891 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1892 		offset = MT_EE_NIC_CONF_0;
1893 		break;
1894 	case 0x7663:
1895 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1896 		req_hdr.content_format = 1;
1897 		offset = MT_EE_CHIP_ID;
1898 		break;
1899 	default:
1900 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1901 		offset = MT_EE_NIC_CONF_0;
1902 		break;
1903 	}
1904 
1905 	req_hdr.len = cpu_to_le16(eep_len);
1906 
1907 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1908 	if (!skb)
1909 		return -ENOMEM;
1910 
1911 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1912 	skb_put_data(skb, eep + offset, eep_len);
1913 
1914 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1915 				     MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
1916 }
1917 
1918 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1919 		       const struct ieee80211_tx_queue_params *params)
1920 {
1921 #define WMM_AIFS_SET	BIT(0)
1922 #define WMM_CW_MIN_SET	BIT(1)
1923 #define WMM_CW_MAX_SET	BIT(2)
1924 #define WMM_TXOP_SET	BIT(3)
1925 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1926 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1927 	struct req_data {
1928 		u8 number;
1929 		u8 rsv[3];
1930 		u8 queue;
1931 		u8 valid;
1932 		u8 aifs;
1933 		u8 cw_min;
1934 		__le16 cw_max;
1935 		__le16 txop;
1936 	} __packed req = {
1937 		.number = 1,
1938 		.queue = queue,
1939 		.valid = WMM_PARAM_SET,
1940 		.aifs = params->aifs,
1941 		.cw_min = 5,
1942 		.cw_max = cpu_to_le16(10),
1943 		.txop = cpu_to_le16(params->txop),
1944 	};
1945 
1946 	if (params->cw_min)
1947 		req.cw_min = fls(params->cw_min);
1948 	if (params->cw_max)
1949 		req.cw_max = cpu_to_le16(fls(params->cw_max));
1950 
1951 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
1952 				 sizeof(req), true);
1953 }
1954 
1955 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1956 {
1957 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1958 	struct dbdc_entry {
1959 		u8 type;
1960 		u8 index;
1961 		u8 band;
1962 		u8 _rsv;
1963 	};
1964 	struct {
1965 		u8 enable;
1966 		u8 num;
1967 		u8 _rsv[2];
1968 		struct dbdc_entry entry[64];
1969 	} req = {
1970 		.enable = !!ext_phy,
1971 	};
1972 	int i;
1973 
1974 	if (!ext_phy)
1975 		goto out;
1976 
1977 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
1978 	do { \
1979 		req.entry[req.num].type = _type;		\
1980 		req.entry[req.num].index = _idx;		\
1981 		req.entry[req.num++].band = _band;		\
1982 	} while (0)
1983 
1984 	for (i = 0; i < 4; i++) {
1985 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1986 
1987 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1988 	}
1989 
1990 	for (i = 0; i < 14; i++) {
1991 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1992 
1993 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1994 	}
1995 
1996 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1997 
1998 	for (i = 0; i < 3; i++)
1999 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2000 
2001 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2002 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2003 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2004 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2005 
2006 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2007 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2008 
2009 out:
2010 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
2011 				 sizeof(req), true);
2012 }
2013 
2014 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2015 {
2016 	struct wtbl_req_hdr req = {
2017 		.operation = WTBL_RESET_ALL,
2018 	};
2019 
2020 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
2021 				 sizeof(req), true);
2022 }
2023 
2024 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2025 		       enum mt7615_rdd_cmd cmd, u8 index,
2026 		       u8 rx_sel, u8 val)
2027 {
2028 	struct {
2029 		u8 ctrl;
2030 		u8 rdd_idx;
2031 		u8 rdd_rx_sel;
2032 		u8 val;
2033 		u8 rsv[4];
2034 	} req = {
2035 		.ctrl = cmd,
2036 		.rdd_idx = index,
2037 		.rdd_rx_sel = rx_sel,
2038 		.val = val,
2039 	};
2040 
2041 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
2042 				 sizeof(req), true);
2043 }
2044 
2045 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2046 {
2047 	struct {
2048 		__le16 tag;
2049 		__le16 min_lpn;
2050 	} req = {
2051 		.tag = cpu_to_le16(0x1),
2052 		.min_lpn = cpu_to_le16(val),
2053 	};
2054 
2055 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2056 				 sizeof(req), true);
2057 }
2058 
2059 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2060 			    const struct mt7615_dfs_pulse *pulse)
2061 {
2062 	struct {
2063 		__le16 tag;
2064 		__le32 max_width;	/* us */
2065 		__le32 max_pwr;		/* dbm */
2066 		__le32 min_pwr;		/* dbm */
2067 		__le32 min_stgr_pri;	/* us */
2068 		__le32 max_stgr_pri;	/* us */
2069 		__le32 min_cr_pri;	/* us */
2070 		__le32 max_cr_pri;	/* us */
2071 	} req = {
2072 		.tag = cpu_to_le16(0x3),
2073 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2074 		__req_field(max_width),
2075 		__req_field(max_pwr),
2076 		__req_field(min_pwr),
2077 		__req_field(min_stgr_pri),
2078 		__req_field(max_stgr_pri),
2079 		__req_field(min_cr_pri),
2080 		__req_field(max_cr_pri),
2081 #undef  __req_field
2082 	};
2083 
2084 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2085 				 sizeof(req), true);
2086 }
2087 
2088 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2089 			    const struct mt7615_dfs_pattern *pattern)
2090 {
2091 	struct {
2092 		__le16 tag;
2093 		__le16 radar_type;
2094 		u8 enb;
2095 		u8 stgr;
2096 		u8 min_crpn;
2097 		u8 max_crpn;
2098 		u8 min_crpr;
2099 		u8 min_pw;
2100 		u8 max_pw;
2101 		__le32 min_pri;
2102 		__le32 max_pri;
2103 		u8 min_crbn;
2104 		u8 max_crbn;
2105 		u8 min_stgpn;
2106 		u8 max_stgpn;
2107 		u8 min_stgpr;
2108 	} req = {
2109 		.tag = cpu_to_le16(0x2),
2110 		.radar_type = cpu_to_le16(index),
2111 #define __req_field_u8(field) .field = pattern->field
2112 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2113 		__req_field_u8(enb),
2114 		__req_field_u8(stgr),
2115 		__req_field_u8(min_crpn),
2116 		__req_field_u8(max_crpn),
2117 		__req_field_u8(min_crpr),
2118 		__req_field_u8(min_pw),
2119 		__req_field_u8(max_pw),
2120 		__req_field_u32(min_pri),
2121 		__req_field_u32(max_pri),
2122 		__req_field_u8(min_crbn),
2123 		__req_field_u8(max_crbn),
2124 		__req_field_u8(min_stgpn),
2125 		__req_field_u8(max_stgpn),
2126 		__req_field_u8(min_stgpr),
2127 #undef __req_field_u8
2128 #undef __req_field_u32
2129 	};
2130 
2131 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2132 				 sizeof(req), true);
2133 }
2134 
2135 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2136 {
2137 	struct {
2138 		u8 pulse_num;
2139 		u8 rsv[3];
2140 		struct {
2141 			__le32 start_time;
2142 			__le16 width;
2143 			__le16 power;
2144 		} pattern[32];
2145 	} req = {
2146 		.pulse_num = dev->radar_pattern.n_pulses,
2147 	};
2148 	u32 start_time = ktime_to_ms(ktime_get_boottime());
2149 	int i;
2150 
2151 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2152 		return -EINVAL;
2153 
2154 	/* TODO: add some noise here */
2155 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2156 		u32 ts = start_time + i * dev->radar_pattern.period;
2157 
2158 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2159 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2160 		req.pattern[i].start_time = cpu_to_le32(ts);
2161 	}
2162 
2163 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2164 				 &req, sizeof(req), false);
2165 }
2166 
2167 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2168 {
2169 	struct mt76_phy *mphy = phy->mt76;
2170 	struct ieee80211_hw *hw = mphy->hw;
2171 	struct mt76_power_limits limits;
2172 	s8 *limits_array = (s8 *)&limits;
2173 	int n_chains = hweight8(mphy->antenna_mask);
2174 	int tx_power;
2175 	int i;
2176 	static const u8 sku_mapping[] = {
2177 #define SKU_FIELD(_type, _field) \
2178 		[MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2179 		SKU_FIELD(CCK_1_2, cck[0]),
2180 		SKU_FIELD(CCK_55_11, cck[2]),
2181 		SKU_FIELD(OFDM_6_9, ofdm[0]),
2182 		SKU_FIELD(OFDM_12_18, ofdm[2]),
2183 		SKU_FIELD(OFDM_24_36, ofdm[4]),
2184 		SKU_FIELD(OFDM_48, ofdm[6]),
2185 		SKU_FIELD(OFDM_54, ofdm[7]),
2186 		SKU_FIELD(HT20_0_8, mcs[0][0]),
2187 		SKU_FIELD(HT20_32, ofdm[0]),
2188 		SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2189 		SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2190 		SKU_FIELD(HT20_5_13, mcs[0][5]),
2191 		SKU_FIELD(HT20_6_14, mcs[0][6]),
2192 		SKU_FIELD(HT20_7_15, mcs[0][7]),
2193 		SKU_FIELD(HT40_0_8, mcs[1][0]),
2194 		SKU_FIELD(HT40_32, ofdm[0]),
2195 		SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2196 		SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2197 		SKU_FIELD(HT40_5_13, mcs[1][5]),
2198 		SKU_FIELD(HT40_6_14, mcs[1][6]),
2199 		SKU_FIELD(HT40_7_15, mcs[1][7]),
2200 		SKU_FIELD(VHT20_0, mcs[0][0]),
2201 		SKU_FIELD(VHT20_1_2, mcs[0][1]),
2202 		SKU_FIELD(VHT20_3_4, mcs[0][3]),
2203 		SKU_FIELD(VHT20_5_6, mcs[0][5]),
2204 		SKU_FIELD(VHT20_7, mcs[0][7]),
2205 		SKU_FIELD(VHT20_8, mcs[0][8]),
2206 		SKU_FIELD(VHT20_9, mcs[0][9]),
2207 		SKU_FIELD(VHT40_0, mcs[1][0]),
2208 		SKU_FIELD(VHT40_1_2, mcs[1][1]),
2209 		SKU_FIELD(VHT40_3_4, mcs[1][3]),
2210 		SKU_FIELD(VHT40_5_6, mcs[1][5]),
2211 		SKU_FIELD(VHT40_7, mcs[1][7]),
2212 		SKU_FIELD(VHT40_8, mcs[1][8]),
2213 		SKU_FIELD(VHT40_9, mcs[1][9]),
2214 		SKU_FIELD(VHT80_0, mcs[2][0]),
2215 		SKU_FIELD(VHT80_1_2, mcs[2][1]),
2216 		SKU_FIELD(VHT80_3_4, mcs[2][3]),
2217 		SKU_FIELD(VHT80_5_6, mcs[2][5]),
2218 		SKU_FIELD(VHT80_7, mcs[2][7]),
2219 		SKU_FIELD(VHT80_8, mcs[2][8]),
2220 		SKU_FIELD(VHT80_9, mcs[2][9]),
2221 		SKU_FIELD(VHT160_0, mcs[3][0]),
2222 		SKU_FIELD(VHT160_1_2, mcs[3][1]),
2223 		SKU_FIELD(VHT160_3_4, mcs[3][3]),
2224 		SKU_FIELD(VHT160_5_6, mcs[3][5]),
2225 		SKU_FIELD(VHT160_7, mcs[3][7]),
2226 		SKU_FIELD(VHT160_8, mcs[3][8]),
2227 		SKU_FIELD(VHT160_9, mcs[3][9]),
2228 #undef SKU_FIELD
2229 	};
2230 
2231 	tx_power = hw->conf.power_level * 2 -
2232 		   mt76_tx_power_nss_delta(n_chains);
2233 
2234 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2235 					      &limits, tx_power);
2236 	mphy->txpower_cur = tx_power;
2237 
2238 	if (is_mt7663(mphy->dev)) {
2239 		memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2240 		return;
2241 	}
2242 
2243 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2244 		sku[i] = limits_array[sku_mapping[i]];
2245 
2246 	for (i = 0; i < 4; i++) {
2247 		int delta = 0;
2248 
2249 		if (i < n_chains - 1)
2250 			delta = mt76_tx_power_nss_delta(n_chains) -
2251 				mt76_tx_power_nss_delta(i + 1);
2252 		sku[MT_SKU_1SS_DELTA + i] = delta;
2253 	}
2254 }
2255 
2256 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2257 {
2258 	static const u8 width_to_bw[] = {
2259 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2260 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2261 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2262 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2263 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2264 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2265 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2266 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2267 	};
2268 
2269 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2270 		return 0;
2271 
2272 	return width_to_bw[chandef->width];
2273 }
2274 
2275 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2276 {
2277 	struct mt7615_dev *dev = phy->dev;
2278 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2279 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2280 	struct {
2281 		u8 control_chan;
2282 		u8 center_chan;
2283 		u8 bw;
2284 		u8 tx_streams;
2285 		u8 rx_streams_mask;
2286 		u8 switch_reason;
2287 		u8 band_idx;
2288 		/* for 80+80 only */
2289 		u8 center_chan2;
2290 		__le16 cac_case;
2291 		u8 channel_band;
2292 		u8 rsv0;
2293 		__le32 outband_freq;
2294 		u8 txpower_drop;
2295 		u8 rsv1[3];
2296 		u8 txpower_sku[53];
2297 		u8 rsv2[3];
2298 	} req = {
2299 		.control_chan = chandef->chan->hw_value,
2300 		.center_chan = ieee80211_frequency_to_channel(freq1),
2301 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2302 		.rx_streams_mask = phy->mt76->chainmask,
2303 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2304 	};
2305 
2306 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2307 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2308 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2309 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2310 		req.switch_reason = CH_SWITCH_DFS;
2311 	else
2312 		req.switch_reason = CH_SWITCH_NORMAL;
2313 
2314 	req.band_idx = phy != &dev->phy;
2315 	req.bw = mt7615_mcu_chan_bw(chandef);
2316 
2317 	if (mt76_testmode_enabled(phy->mt76))
2318 		memset(req.txpower_sku, 0x3f, 49);
2319 	else
2320 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2321 
2322 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2323 }
2324 
2325 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2326 {
2327 	struct {
2328 		u8 action;
2329 		u8 rsv[3];
2330 	} req = {
2331 		.action = index,
2332 	};
2333 
2334 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2335 				 sizeof(req), true);
2336 }
2337 
2338 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2339 			      u32 val)
2340 {
2341 	struct {
2342 		u8 test_mode_en;
2343 		u8 param_idx;
2344 		u8 _rsv[2];
2345 
2346 		__le32 value;
2347 
2348 		u8 pad[8];
2349 	} req = {
2350 		.test_mode_en = test_mode,
2351 		.param_idx = param,
2352 		.value = cpu_to_le32(val),
2353 	};
2354 
2355 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2356 				 sizeof(req), false);
2357 }
2358 
2359 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2360 {
2361 	struct mt7615_dev *dev = phy->dev;
2362 	struct {
2363 		u8 format_id;
2364 		u8 sku_enable;
2365 		u8 band_idx;
2366 		u8 rsv;
2367 	} req = {
2368 		.format_id = 0,
2369 		.band_idx = phy != &dev->phy,
2370 		.sku_enable = enable,
2371 	};
2372 
2373 	return mt76_mcu_send_msg(&dev->mt76,
2374 				 MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2375 				 sizeof(req), true);
2376 }
2377 
2378 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2379 {
2380 	int i;
2381 
2382 	for (i = 0; i < n_freqs; i++)
2383 		if (cur == freqs[i])
2384 			return i;
2385 
2386 	return -1;
2387 }
2388 
2389 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2390 {
2391 	static const u16 freq_list[] = {
2392 		4980, 5805, 5905, 5190,
2393 		5230, 5270, 5310, 5350,
2394 		5390, 5430, 5470, 5510,
2395 		5550, 5590, 5630, 5670,
2396 		5710, 5755, 5795, 5835,
2397 		5875, 5210, 5290, 5370,
2398 		5450, 5530, 5610, 5690,
2399 		5775, 5855
2400 	};
2401 	static const u16 freq_bw40[] = {
2402 		5190, 5230, 5270, 5310,
2403 		5350, 5390, 5430, 5470,
2404 		5510, 5550, 5590, 5630,
2405 		5670, 5710, 5755, 5795,
2406 		5835, 5875
2407 	};
2408 	int offset_2g = ARRAY_SIZE(freq_list);
2409 	int idx;
2410 
2411 	if (freq < 4000) {
2412 		if (freq < 2427)
2413 			return offset_2g;
2414 		if (freq < 2442)
2415 			return offset_2g + 1;
2416 		if (freq < 2457)
2417 			return offset_2g + 2;
2418 
2419 		return offset_2g + 3;
2420 	}
2421 
2422 	switch (bw) {
2423 	case NL80211_CHAN_WIDTH_80:
2424 	case NL80211_CHAN_WIDTH_80P80:
2425 	case NL80211_CHAN_WIDTH_160:
2426 		break;
2427 	default:
2428 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2429 					   freq + 10);
2430 		if (idx >= 0) {
2431 			freq = freq_bw40[idx];
2432 			break;
2433 		}
2434 
2435 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2436 					   freq - 10);
2437 		if (idx >= 0) {
2438 			freq = freq_bw40[idx];
2439 			break;
2440 		}
2441 		fallthrough;
2442 	case NL80211_CHAN_WIDTH_40:
2443 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2444 					   freq);
2445 		if (idx >= 0)
2446 			break;
2447 
2448 		return -1;
2449 
2450 	}
2451 
2452 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2453 }
2454 
2455 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2456 {
2457 	struct mt7615_dev *dev = phy->dev;
2458 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2459 	int freq2 = chandef->center_freq2;
2460 	int ret;
2461 	struct {
2462 		u8 direction;
2463 		u8 runtime_calibration;
2464 		u8 _rsv[2];
2465 
2466 		__le16 center_freq;
2467 		u8 bw;
2468 		u8 band;
2469 		u8 is_freq2;
2470 		u8 success;
2471 		u8 dbdc_en;
2472 
2473 		u8 _rsv2;
2474 
2475 		struct {
2476 			__le32 sx0_i_lna[4];
2477 			__le32 sx0_q_lna[4];
2478 
2479 			__le32 sx2_i_lna[4];
2480 			__le32 sx2_q_lna[4];
2481 		} dcoc_data[4];
2482 	} req = {
2483 		.direction = 1,
2484 
2485 		.bw = mt7615_mcu_chan_bw(chandef),
2486 		.band = chandef->center_freq1 > 4000,
2487 		.dbdc_en = !!dev->mt76.phy2,
2488 	};
2489 	u16 center_freq = chandef->center_freq1;
2490 	int freq_idx;
2491 	u8 *eep = dev->mt76.eeprom.data;
2492 
2493 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2494 		return 0;
2495 
2496 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2497 		freq2 = center_freq + 40;
2498 		center_freq -= 40;
2499 	}
2500 
2501 again:
2502 	req.runtime_calibration = 1;
2503 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2504 	if (freq_idx < 0)
2505 		goto out;
2506 
2507 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2508 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2509 	       sizeof(req.dcoc_data));
2510 	req.runtime_calibration = 0;
2511 
2512 out:
2513 	req.center_freq = cpu_to_le16(center_freq);
2514 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
2515 				sizeof(req), true);
2516 
2517 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2518 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2519 		req.is_freq2 = true;
2520 		center_freq = freq2;
2521 		goto again;
2522 	}
2523 
2524 	return ret;
2525 }
2526 
2527 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2528 {
2529 	static const u16 freq_list[] = {
2530 		4920, 4940, 4960, 4980,
2531 		5040, 5060, 5080, 5180,
2532 		5200, 5220, 5240, 5260,
2533 		5280, 5300, 5320, 5340,
2534 		5360, 5380, 5400, 5420,
2535 		5440, 5460, 5480, 5500,
2536 		5520, 5540, 5560, 5580,
2537 		5600, 5620, 5640, 5660,
2538 		5680, 5700, 5720, 5745,
2539 		5765, 5785, 5805, 5825,
2540 		5845, 5865, 5885, 5905
2541 	};
2542 	int offset_2g = ARRAY_SIZE(freq_list);
2543 	int idx;
2544 
2545 	if (freq < 4000) {
2546 		if (freq < 2432)
2547 			return offset_2g;
2548 		if (freq < 2457)
2549 			return offset_2g + 1;
2550 
2551 		return offset_2g + 2;
2552 	}
2553 
2554 	if (bw != NL80211_CHAN_WIDTH_20) {
2555 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2556 					   freq + 10);
2557 		if (idx >= 0)
2558 			return idx;
2559 
2560 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2561 					   freq - 10);
2562 		if (idx >= 0)
2563 			return idx;
2564 	}
2565 
2566 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2567 }
2568 
2569 
2570 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2571 {
2572 	struct mt7615_dev *dev = phy->dev;
2573 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2574 	int freq2 = chandef->center_freq2;
2575 	int ret;
2576 	struct {
2577 		u8 direction;
2578 		u8 runtime_calibration;
2579 		u8 _rsv[2];
2580 
2581 		__le16 center_freq;
2582 		u8 bw;
2583 		u8 band;
2584 		u8 is_freq2;
2585 		u8 success;
2586 		u8 dbdc_en;
2587 
2588 		u8 _rsv2;
2589 
2590 		struct {
2591 			struct {
2592 				u32 dpd_g0;
2593 				u8 data[32];
2594 			} wf0, wf1;
2595 
2596 			struct {
2597 				u32 dpd_g0_prim;
2598 				u32 dpd_g0_sec;
2599 				u8 data_prim[32];
2600 				u8 data_sec[32];
2601 			} wf2, wf3;
2602 		} dpd_data;
2603 	} req = {
2604 		.direction = 1,
2605 
2606 		.bw = mt7615_mcu_chan_bw(chandef),
2607 		.band = chandef->center_freq1 > 4000,
2608 		.dbdc_en = !!dev->mt76.phy2,
2609 	};
2610 	u16 center_freq = chandef->center_freq1;
2611 	int freq_idx;
2612 	u8 *eep = dev->mt76.eeprom.data;
2613 
2614 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2615 		return 0;
2616 
2617 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2618 		freq2 = center_freq + 40;
2619 		center_freq -= 40;
2620 	}
2621 
2622 again:
2623 	req.runtime_calibration = 1;
2624 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2625 	if (freq_idx < 0)
2626 		goto out;
2627 
2628 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2629 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2630 	       sizeof(req.dpd_data));
2631 	req.runtime_calibration = 0;
2632 
2633 out:
2634 	req.center_freq = cpu_to_le16(center_freq);
2635 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
2636 				sizeof(req), true);
2637 
2638 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2639 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2640 		req.is_freq2 = true;
2641 		center_freq = freq2;
2642 		goto again;
2643 	}
2644 
2645 	return ret;
2646 }
2647 
2648 int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2649 {
2650 	struct {
2651 		u8 operation;
2652 		u8 count;
2653 		u8 _rsv[2];
2654 		u8 index;
2655 		u8 enable;
2656 		__le16 etype;
2657 	} req = {
2658 		.operation = 1,
2659 		.count = 1,
2660 		.enable = 1,
2661 		.etype = cpu_to_le16(ETH_P_PAE),
2662 	};
2663 
2664 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RX_HDR_TRANS,
2665 				 &req, sizeof(req), false);
2666 }
2667 
2668 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2669 			  bool enable)
2670 {
2671 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2672 	struct {
2673 		u8 bss_idx;
2674 		u8 dtim_period;
2675 		__le16 aid;
2676 		__le16 bcn_interval;
2677 		__le16 atim_window;
2678 		u8 uapsd;
2679 		u8 bmc_delivered_ac;
2680 		u8 bmc_triggered_ac;
2681 		u8 pad;
2682 	} req = {
2683 		.bss_idx = mvif->mt76.idx,
2684 		.aid = cpu_to_le16(vif->bss_conf.aid),
2685 		.dtim_period = vif->bss_conf.dtim_period,
2686 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2687 	};
2688 	struct {
2689 		u8 bss_idx;
2690 		u8 pad[3];
2691 	} req_hdr = {
2692 		.bss_idx = mvif->mt76.idx,
2693 	};
2694 	int err;
2695 
2696 	if (vif->type != NL80211_IFTYPE_STATION)
2697 		return 0;
2698 
2699 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
2700 				sizeof(req_hdr), false);
2701 	if (err < 0 || !enable)
2702 		return err;
2703 
2704 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
2705 				 sizeof(req), false);
2706 }
2707 
2708 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2709 		       struct ieee80211_channel *chan, int duration)
2710 {
2711 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2712 	struct mt7615_dev *dev = phy->dev;
2713 	struct mt7615_roc_tlv req = {
2714 		.bss_idx = mvif->mt76.idx,
2715 		.active = !chan,
2716 		.max_interval = cpu_to_le32(duration),
2717 		.primary_chan = chan ? chan->hw_value : 0,
2718 		.band = chan ? chan->band : 0,
2719 		.req_type = 2,
2720 	};
2721 
2722 	phy->roc_grant = false;
2723 
2724 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
2725 				 sizeof(req), false);
2726 }
2727 
2728 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
2729 			     struct ieee80211_vif *vif)
2730 {
2731 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2732 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
2733 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
2734 	struct {
2735 		__le32 ct_win;
2736 		u8 bss_idx;
2737 		u8 rsv[3];
2738 	} __packed req = {
2739 		.ct_win = cpu_to_le32(ct_window),
2740 		.bss_idx = mvif->mt76.idx,
2741 	};
2742 
2743 	if (!mt7615_firmware_offload(dev))
2744 		return -ENOTSUPP;
2745 
2746 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
2747 				 sizeof(req), false);
2748 }
2749 
2750 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
2751 {
2752 	struct {
2753 		__le32 addr;
2754 		__le32 val;
2755 	} __packed req = {
2756 		.addr = cpu_to_le32(offset),
2757 	};
2758 
2759 	return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
2760 				 true);
2761 }
2762 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
2763 
2764 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
2765 {
2766 	struct {
2767 		__le32 addr;
2768 		__le32 val;
2769 	} __packed req = {
2770 		.addr = cpu_to_le32(offset),
2771 		.val = cpu_to_le32(val),
2772 	};
2773 
2774 	mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
2775 }
2776 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);
2777