1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
75 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
76 
77 #define DL_MODE_ENCRYPT			BIT(0)
78 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
79 #define DL_MODE_RESET_SEC_IV		BIT(3)
80 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
82 #define DL_MODE_NEED_RSP		BIT(31)
83 
84 #define FW_START_OVERRIDE		BIT(0)
85 #define FW_START_WORKING_PDA_CR4	BIT(2)
86 
87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
88 			 int cmd, int *wait_seq)
89 {
90 	int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
91 	struct mt7615_uni_txd *uni_txd;
92 	struct mt7615_mcu_txd *mcu_txd;
93 	u8 seq, q_idx, pkt_fmt;
94 	__le32 *txd;
95 	u32 val;
96 
97 	/* TODO: make dynamic based on msg type */
98 	dev->mt76.mcu.timeout = 20 * HZ;
99 
100 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
101 	if (!seq)
102 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
103 	if (wait_seq)
104 		*wait_seq = seq;
105 
106 	txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
107 	txd = (__le32 *)skb_push(skb, txd_len);
108 
109 	if (cmd != MCU_CMD_FW_SCATTER) {
110 		q_idx = MT_TX_MCU_PORT_RX_Q0;
111 		pkt_fmt = MT_TX_TYPE_CMD;
112 	} else {
113 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
114 		pkt_fmt = MT_TX_TYPE_FW;
115 	}
116 
117 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
118 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
119 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
120 	txd[0] = cpu_to_le32(val);
121 
122 	val = MT_TXD1_LONG_FORMAT |
123 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
124 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
125 	txd[1] = cpu_to_le32(val);
126 
127 	if (cmd & MCU_UNI_PREFIX) {
128 		uni_txd = (struct mt7615_uni_txd *)txd;
129 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
130 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
131 		uni_txd->cid = cpu_to_le16(mcu_cmd);
132 		uni_txd->s2d_index = MCU_S2D_H2N;
133 		uni_txd->pkt_type = MCU_PKT_ID;
134 		uni_txd->seq = seq;
135 
136 		return;
137 	}
138 
139 	mcu_txd = (struct mt7615_mcu_txd *)txd;
140 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
141 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
142 	mcu_txd->s2d_index = MCU_S2D_H2N;
143 	mcu_txd->pkt_type = MCU_PKT_ID;
144 	mcu_txd->seq = seq;
145 
146 	switch (cmd & ~MCU_CMD_MASK) {
147 	case MCU_FW_PREFIX:
148 		mcu_txd->set_query = MCU_Q_NA;
149 		mcu_txd->cid = mcu_cmd;
150 		break;
151 	case MCU_CE_PREFIX:
152 		if (cmd & MCU_QUERY_MASK)
153 			mcu_txd->set_query = MCU_Q_QUERY;
154 		else
155 			mcu_txd->set_query = MCU_Q_SET;
156 		mcu_txd->cid = mcu_cmd;
157 		break;
158 	default:
159 		mcu_txd->cid = MCU_CMD_EXT_CID;
160 		if (cmd & MCU_QUERY_PREFIX)
161 			mcu_txd->set_query = MCU_Q_QUERY;
162 		else
163 			mcu_txd->set_query = MCU_Q_SET;
164 		mcu_txd->ext_cid = mcu_cmd;
165 		mcu_txd->ext_cid_ack = 1;
166 		break;
167 	}
168 }
169 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
170 
171 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
172 			      struct sk_buff *skb, int seq)
173 {
174 	struct mt7615_mcu_rxd *rxd;
175 	int ret = 0;
176 
177 	if (!skb) {
178 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
179 			cmd, seq);
180 		return -ETIMEDOUT;
181 	}
182 
183 	rxd = (struct mt7615_mcu_rxd *)skb->data;
184 	if (seq != rxd->seq)
185 		return -EAGAIN;
186 
187 	switch (cmd) {
188 	case MCU_CMD_PATCH_SEM_CONTROL:
189 		skb_pull(skb, sizeof(*rxd) - 4);
190 		ret = *skb->data;
191 		break;
192 	case MCU_EXT_CMD_GET_TEMP:
193 		skb_pull(skb, sizeof(*rxd));
194 		ret = le32_to_cpu(*(__le32 *)skb->data);
195 		break;
196 	case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
197 		skb_pull(skb, sizeof(*rxd));
198 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
199 		break;
200 	case MCU_UNI_CMD_DEV_INFO_UPDATE:
201 	case MCU_UNI_CMD_BSS_INFO_UPDATE:
202 	case MCU_UNI_CMD_STA_REC_UPDATE:
203 	case MCU_UNI_CMD_HIF_CTRL:
204 	case MCU_UNI_CMD_OFFLOAD:
205 	case MCU_UNI_CMD_SUSPEND: {
206 		struct mt7615_mcu_uni_event *event;
207 
208 		skb_pull(skb, sizeof(*rxd));
209 		event = (struct mt7615_mcu_uni_event *)skb->data;
210 		ret = le32_to_cpu(event->status);
211 		break;
212 	}
213 	case MCU_CMD_REG_READ: {
214 		struct mt7615_mcu_reg_event *event;
215 
216 		skb_pull(skb, sizeof(*rxd));
217 		event = (struct mt7615_mcu_reg_event *)skb->data;
218 		ret = (int)le32_to_cpu(event->val);
219 		break;
220 	}
221 	default:
222 		break;
223 	}
224 
225 	return ret;
226 }
227 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
228 
229 static int
230 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
231 			int cmd, int *seq)
232 {
233 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
234 	enum mt76_mcuq_id qid;
235 
236 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
237 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
238 		qid = MT_MCUQ_WM;
239 	else
240 		qid = MT_MCUQ_FWDL;
241 
242 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
243 }
244 
245 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
246 {
247 	struct {
248 		__le32 wifi_stream;
249 		__le32 address;
250 		__le32 data;
251 	} req = {
252 		.wifi_stream = cpu_to_le32(wf),
253 		.address = cpu_to_le32(reg),
254 	};
255 
256 	return mt76_mcu_send_msg(&dev->mt76,
257 				 MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
258 				 &req, sizeof(req), true);
259 }
260 
261 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
262 {
263 	struct {
264 		__le32 wifi_stream;
265 		__le32 address;
266 		__le32 data;
267 	} req = {
268 		.wifi_stream = cpu_to_le32(wf),
269 		.address = cpu_to_le32(reg),
270 		.data = cpu_to_le32(val),
271 	};
272 
273 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
274 				 sizeof(req), false);
275 }
276 
277 void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
278 {
279 	if (!is_mt7622(&dev->mt76))
280 		return;
281 
282 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
283 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
284 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
285 }
286 EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
287 
288 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
289 {
290 	struct mt76_phy *mphy = &dev->mt76.phy;
291 	struct mt76_connac_pm *pm = &dev->pm;
292 	struct mt76_dev *mdev = &dev->mt76;
293 	u32 addr;
294 	int err;
295 
296 	if (is_mt7663(mdev)) {
297 		/* Clear firmware own via N9 eint */
298 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
299 		mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
300 
301 		addr = MT_CONN_HIF_ON_LPCTL;
302 	} else {
303 		addr = MT_CFG_LPCR_HOST;
304 	}
305 
306 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
307 
308 	mt7622_trigger_hif_int(dev, true);
309 
310 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
311 
312 	mt7622_trigger_hif_int(dev, false);
313 
314 	if (err) {
315 		dev_err(mdev->dev, "driver own failed\n");
316 		return -ETIMEDOUT;
317 	}
318 
319 	clear_bit(MT76_STATE_PM, &mphy->state);
320 
321 	pm->stats.last_wake_event = jiffies;
322 	pm->stats.doze_time += pm->stats.last_wake_event -
323 			       pm->stats.last_doze_event;
324 
325 	return 0;
326 }
327 
328 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
329 {
330 	struct mt76_phy *mphy = &dev->mt76.phy;
331 	struct mt76_connac_pm *pm = &dev->pm;
332 	int i, err = 0;
333 
334 	mutex_lock(&pm->mutex);
335 
336 	if (!test_bit(MT76_STATE_PM, &mphy->state))
337 		goto out;
338 
339 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
340 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
341 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
342 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
343 			break;
344 	}
345 
346 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
347 		dev_err(dev->mt76.dev, "driver own failed\n");
348 		err = -EIO;
349 		goto out;
350 	}
351 	clear_bit(MT76_STATE_PM, &mphy->state);
352 
353 	pm->stats.last_wake_event = jiffies;
354 	pm->stats.doze_time += pm->stats.last_wake_event -
355 			       pm->stats.last_doze_event;
356 out:
357 	mutex_unlock(&pm->mutex);
358 
359 	return err;
360 }
361 
362 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
363 {
364 	struct mt76_phy *mphy = &dev->mt76.phy;
365 	struct mt76_connac_pm *pm = &dev->pm;
366 	int err = 0;
367 	u32 addr;
368 
369 	mutex_lock(&pm->mutex);
370 
371 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
372 		goto out;
373 
374 	mt7622_trigger_hif_int(dev, true);
375 
376 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
377 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
378 
379 	if (is_mt7622(&dev->mt76) &&
380 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
381 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
382 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
383 		clear_bit(MT76_STATE_PM, &mphy->state);
384 		err = -EIO;
385 	}
386 
387 	mt7622_trigger_hif_int(dev, false);
388 
389 	pm->stats.last_doze_event = jiffies;
390 	pm->stats.awake_time += pm->stats.last_doze_event -
391 				pm->stats.last_wake_event;
392 out:
393 	mutex_unlock(&pm->mutex);
394 
395 	return err;
396 }
397 
398 static void
399 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
400 {
401 	if (vif->csa_active)
402 		ieee80211_csa_finish(vif);
403 }
404 
405 static void
406 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
407 {
408 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
409 	struct mt76_phy *mphy = &dev->mt76.phy;
410 	struct mt7615_mcu_csa_notify *c;
411 
412 	c = (struct mt7615_mcu_csa_notify *)skb->data;
413 
414 	if (c->omac_idx > EXT_BSSID_MAX)
415 		return;
416 
417 	if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
418 		mphy = dev->mt76.phy2;
419 
420 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
421 			IEEE80211_IFACE_ITER_RESUME_ALL,
422 			mt7615_mcu_csa_finish, mphy->hw);
423 }
424 
425 static void
426 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
427 {
428 	struct mt76_phy *mphy = &dev->mt76.phy;
429 	struct mt7615_mcu_rdd_report *r;
430 
431 	r = (struct mt7615_mcu_rdd_report *)skb->data;
432 
433 	if (!dev->radar_pattern.n_pulses && !r->long_detected &&
434 	    !r->constant_prf_detected && !r->staggered_prf_detected)
435 		return;
436 
437 	if (r->band_idx && dev->mt76.phy2)
438 		mphy = dev->mt76.phy2;
439 
440 	ieee80211_radar_detected(mphy->hw);
441 	dev->hw_pattern++;
442 }
443 
444 static void
445 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
446 {
447 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
448 	const char *data = (char *)&rxd[1];
449 	const char *type;
450 
451 	switch (rxd->s2d_index) {
452 	case 0:
453 		type = "N9";
454 		break;
455 	case 2:
456 		type = "CR4";
457 		break;
458 	default:
459 		type = "unknown";
460 		break;
461 	}
462 
463 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
464 		   (int)(skb->len - sizeof(*rxd)), data);
465 }
466 
467 static void
468 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
469 {
470 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
471 
472 	switch (rxd->ext_eid) {
473 	case MCU_EXT_EVENT_RDD_REPORT:
474 		mt7615_mcu_rx_radar_detected(dev, skb);
475 		break;
476 	case MCU_EXT_EVENT_CSA_NOTIFY:
477 		mt7615_mcu_rx_csa_notify(dev, skb);
478 		break;
479 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
480 		mt7615_mcu_rx_log_message(dev, skb);
481 		break;
482 	default:
483 		break;
484 	}
485 }
486 
487 static void
488 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
489 {
490 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
491 	struct mt7615_phy *phy;
492 	struct mt76_phy *mphy;
493 
494 	if (*seq_num & BIT(7) && dev->mt76.phy2)
495 		mphy = dev->mt76.phy2;
496 	else
497 		mphy = &dev->mt76.phy;
498 
499 	phy = (struct mt7615_phy *)mphy->priv;
500 
501 	spin_lock_bh(&dev->mt76.lock);
502 	__skb_queue_tail(&phy->scan_event_list, skb);
503 	spin_unlock_bh(&dev->mt76.lock);
504 
505 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
506 				     MT7615_HW_SCAN_TIMEOUT);
507 }
508 
509 static void
510 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
511 {
512 	struct mt7615_roc_tlv *event;
513 	struct mt7615_phy *phy;
514 	struct mt76_phy *mphy;
515 	int duration;
516 
517 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
518 	event = (struct mt7615_roc_tlv *)skb->data;
519 
520 	if (event->dbdc_band && dev->mt76.phy2)
521 		mphy = dev->mt76.phy2;
522 	else
523 		mphy = &dev->mt76.phy;
524 
525 	ieee80211_ready_on_channel(mphy->hw);
526 
527 	phy = (struct mt7615_phy *)mphy->priv;
528 	phy->roc_grant = true;
529 	wake_up(&phy->roc_wait);
530 
531 	duration = le32_to_cpu(event->max_interval);
532 	mod_timer(&phy->roc_timer,
533 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
534 }
535 
536 static void
537 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
538 {
539 	struct mt76_connac_beacon_loss_event *event;
540 	struct mt76_phy *mphy;
541 	u8 band_idx = 0; /* DBDC support */
542 
543 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
544 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
545 	if (band_idx && dev->mt76.phy2)
546 		mphy = dev->mt76.phy2;
547 	else
548 		mphy = &dev->mt76.phy;
549 
550 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
551 					IEEE80211_IFACE_ITER_RESUME_ALL,
552 					mt76_connac_mcu_beacon_loss_iter,
553 					event);
554 }
555 
556 static void
557 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
558 {
559 	struct mt76_connac_mcu_bss_event *event;
560 	struct mt76_phy *mphy;
561 	u8 band_idx = 0; /* DBDC support */
562 
563 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
564 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
565 
566 	if (band_idx && dev->mt76.phy2)
567 		mphy = dev->mt76.phy2;
568 	else
569 		mphy = &dev->mt76.phy;
570 
571 	if (event->is_absent)
572 		ieee80211_stop_queues(mphy->hw);
573 	else
574 		ieee80211_wake_queues(mphy->hw);
575 }
576 
577 static void
578 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
579 {
580 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
581 
582 	switch (rxd->eid) {
583 	case MCU_EVENT_EXT:
584 		mt7615_mcu_rx_ext_event(dev, skb);
585 		break;
586 	case MCU_EVENT_BSS_BEACON_LOSS:
587 		mt7615_mcu_beacon_loss_event(dev, skb);
588 		break;
589 	case MCU_EVENT_ROC:
590 		mt7615_mcu_roc_event(dev, skb);
591 		break;
592 	case MCU_EVENT_SCHED_SCAN_DONE:
593 	case MCU_EVENT_SCAN_DONE:
594 		mt7615_mcu_scan_event(dev, skb);
595 		return;
596 	case MCU_EVENT_BSS_ABSENCE:
597 		mt7615_mcu_bss_event(dev, skb);
598 		break;
599 	case MCU_EVENT_COREDUMP:
600 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
601 					       &dev->coredump);
602 		return;
603 	default:
604 		break;
605 	}
606 	dev_kfree_skb(skb);
607 }
608 
609 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
610 {
611 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
612 
613 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
614 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
615 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
616 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
617 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
618 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
619 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
620 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
621 	    rxd->eid == MCU_EVENT_COREDUMP ||
622 	    rxd->eid == MCU_EVENT_ROC ||
623 	    !rxd->seq)
624 		mt7615_mcu_rx_unsolicited_event(dev, skb);
625 	else
626 		mt76_mcu_rx_event(&dev->mt76, skb);
627 }
628 
629 static int
630 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
631 		       bool bssid, bool enable)
632 {
633 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
634 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
635 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
636 	const u8 *addr = vif->addr;
637 	struct {
638 		u8 mode;
639 		u8 force_clear;
640 		u8 clear_bitmap[8];
641 		u8 entry_count;
642 		u8 write;
643 
644 		u8 index;
645 		u8 bssid;
646 		u8 addr[ETH_ALEN];
647 	} __packed req = {
648 		.mode = !!mask || enable,
649 		.entry_count = 1,
650 		.write = 1,
651 
652 		.index = idx * 2 + bssid,
653 	};
654 
655 	if (bssid)
656 		addr = vif->bss_conf.bssid;
657 
658 	if (enable)
659 		ether_addr_copy(req.addr, addr);
660 
661 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
662 				 sizeof(req), true);
663 }
664 
665 static int
666 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
667 		   bool enable)
668 {
669 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
670 	struct mt7615_dev *dev = phy->dev;
671 	struct {
672 		struct req_hdr {
673 			u8 omac_idx;
674 			u8 band_idx;
675 			__le16 tlv_num;
676 			u8 is_tlv_append;
677 			u8 rsv[3];
678 		} __packed hdr;
679 		struct req_tlv {
680 			__le16 tag;
681 			__le16 len;
682 			u8 active;
683 			u8 band_idx;
684 			u8 omac_addr[ETH_ALEN];
685 		} __packed tlv;
686 	} data = {
687 		.hdr = {
688 			.omac_idx = mvif->mt76.omac_idx,
689 			.band_idx = mvif->mt76.band_idx,
690 			.tlv_num = cpu_to_le16(1),
691 			.is_tlv_append = 1,
692 		},
693 		.tlv = {
694 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
695 			.len = cpu_to_le16(sizeof(struct req_tlv)),
696 			.active = enable,
697 			.band_idx = mvif->mt76.band_idx,
698 		},
699 	};
700 
701 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
702 		return mt7615_mcu_muar_config(dev, vif, false, enable);
703 
704 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
705 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
706 				 &data, sizeof(data), true);
707 }
708 
709 static int
710 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
711 			      struct ieee80211_hw *hw,
712 			      struct ieee80211_vif *vif, bool enable)
713 {
714 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
715 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
716 	struct ieee80211_mutable_offsets offs;
717 	struct ieee80211_tx_info *info;
718 	struct req {
719 		u8 omac_idx;
720 		u8 enable;
721 		u8 wlan_idx;
722 		u8 band_idx;
723 		u8 pkt_type;
724 		u8 need_pre_tbtt_int;
725 		__le16 csa_ie_pos;
726 		__le16 pkt_len;
727 		__le16 tim_ie_pos;
728 		u8 pkt[512];
729 		u8 csa_cnt;
730 		/* bss color change */
731 		u8 bcc_cnt;
732 		__le16 bcc_ie_pos;
733 	} __packed req = {
734 		.omac_idx = mvif->mt76.omac_idx,
735 		.enable = enable,
736 		.wlan_idx = wcid->idx,
737 		.band_idx = mvif->mt76.band_idx,
738 	};
739 	struct sk_buff *skb;
740 
741 	if (!enable)
742 		goto out;
743 
744 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
745 	if (!skb)
746 		return -EINVAL;
747 
748 	if (skb->len > 512 - MT_TXD_SIZE) {
749 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
750 		dev_kfree_skb(skb);
751 		return -EINVAL;
752 	}
753 
754 	if (mvif->mt76.band_idx) {
755 		info = IEEE80211_SKB_CB(skb);
756 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
757 	}
758 
759 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
760 			      0, NULL, true);
761 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
762 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
763 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
764 	if (offs.cntdwn_counter_offs[0]) {
765 		u16 csa_offs;
766 
767 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
768 		req.csa_ie_pos = cpu_to_le16(csa_offs);
769 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
770 	}
771 	dev_kfree_skb(skb);
772 
773 out:
774 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
775 				 sizeof(req), true);
776 }
777 
778 static int
779 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
780 {
781 #define ENTER_PM_STATE	1
782 #define EXIT_PM_STATE	2
783 	struct {
784 		u8 pm_number;
785 		u8 pm_state;
786 		u8 bssid[ETH_ALEN];
787 		u8 dtim_period;
788 		u8 wlan_idx;
789 		__le16 bcn_interval;
790 		__le32 aid;
791 		__le32 rx_filter;
792 		u8 band_idx;
793 		u8 rsv[3];
794 		__le32 feature;
795 		u8 omac_idx;
796 		u8 wmm_idx;
797 		u8 bcn_loss_cnt;
798 		u8 bcn_sp_duration;
799 	} __packed req = {
800 		.pm_number = 5,
801 		.pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
802 		.band_idx = band,
803 	};
804 
805 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
806 				 sizeof(req), true);
807 }
808 
809 static int
810 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
811 			 struct ieee80211_sta *sta, bool enable)
812 {
813 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
814 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
815 	struct bss_info_basic *bss;
816 	u8 wlan_idx = mvif->sta.wcid.idx;
817 	struct tlv *tlv;
818 
819 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
820 
821 	switch (vif->type) {
822 	case NL80211_IFTYPE_MESH_POINT:
823 	case NL80211_IFTYPE_AP:
824 		break;
825 	case NL80211_IFTYPE_STATION:
826 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
827 		if (enable && sta) {
828 			struct mt7615_sta *msta;
829 
830 			msta = (struct mt7615_sta *)sta->drv_priv;
831 			wlan_idx = msta->wcid.idx;
832 		}
833 		break;
834 	case NL80211_IFTYPE_ADHOC:
835 		type = NETWORK_IBSS;
836 		break;
837 	default:
838 		WARN_ON(1);
839 		break;
840 	}
841 
842 	bss = (struct bss_info_basic *)tlv;
843 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
844 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
845 	bss->network_type = cpu_to_le32(type);
846 	bss->dtim_period = vif->bss_conf.dtim_period;
847 	bss->bmc_tx_wlan_idx = wlan_idx;
848 	bss->wmm_idx = mvif->mt76.wmm_idx;
849 	bss->active = enable;
850 
851 	return 0;
852 }
853 
854 static void
855 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
856 {
857 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
858 	u8 omac_idx = mvif->mt76.omac_idx;
859 	struct bss_info_omac *omac;
860 	struct tlv *tlv;
861 	u32 type = 0;
862 
863 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
864 
865 	switch (vif->type) {
866 	case NL80211_IFTYPE_MESH_POINT:
867 	case NL80211_IFTYPE_AP:
868 		if (vif->p2p)
869 			type = CONNECTION_P2P_GO;
870 		else
871 			type = CONNECTION_INFRA_AP;
872 		break;
873 	case NL80211_IFTYPE_STATION:
874 		if (vif->p2p)
875 			type = CONNECTION_P2P_GC;
876 		else
877 			type = CONNECTION_INFRA_STA;
878 		break;
879 	case NL80211_IFTYPE_ADHOC:
880 		type = CONNECTION_IBSS_ADHOC;
881 		break;
882 	default:
883 		WARN_ON(1);
884 		break;
885 	}
886 
887 	omac = (struct bss_info_omac *)tlv;
888 	omac->conn_type = cpu_to_le32(type);
889 	omac->omac_idx = mvif->mt76.omac_idx;
890 	omac->band_idx = mvif->mt76.band_idx;
891 	omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
892 }
893 
894 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
895 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
896 static void
897 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
898 {
899 	struct bss_info_ext_bss *ext;
900 	int ext_bss_idx, tsf_offset;
901 	struct tlv *tlv;
902 
903 	ext_bss_idx = mvif->mt76.omac_idx - EXT_BSSID_START;
904 	if (ext_bss_idx < 0)
905 		return;
906 
907 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
908 
909 	ext = (struct bss_info_ext_bss *)tlv;
910 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
911 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
912 }
913 
914 static int
915 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
916 		   struct ieee80211_sta *sta, bool enable)
917 {
918 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
919 	struct mt7615_dev *dev = phy->dev;
920 	struct sk_buff *skb;
921 
922 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
923 		mt7615_mcu_muar_config(dev, vif, true, enable);
924 
925 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
926 	if (IS_ERR(skb))
927 		return PTR_ERR(skb);
928 
929 	if (enable)
930 		mt7615_mcu_bss_omac_tlv(skb, vif);
931 
932 	mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
933 
934 	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
935 	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
936 		mt7615_mcu_bss_ext_tlv(skb, mvif);
937 
938 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
939 				     MCU_EXT_CMD_BSS_INFO_UPDATE, true);
940 }
941 
942 static int
943 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
944 		      struct ieee80211_ampdu_params *params,
945 		      bool enable)
946 {
947 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
948 	struct mt7615_vif *mvif = msta->vif;
949 	struct wtbl_req_hdr *wtbl_hdr;
950 	struct sk_buff *skb = NULL;
951 	int err;
952 
953 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
954 						  WTBL_SET, NULL, &skb);
955 	if (IS_ERR(wtbl_hdr))
956 		return PTR_ERR(wtbl_hdr);
957 
958 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
959 				    NULL, wtbl_hdr);
960 
961 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
962 				    true);
963 	if (err < 0)
964 		return err;
965 
966 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
967 					    &msta->wcid);
968 	if (IS_ERR(skb))
969 		return PTR_ERR(skb);
970 
971 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
972 
973 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
974 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
975 }
976 
977 static int
978 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
979 		      struct ieee80211_ampdu_params *params,
980 		      bool enable)
981 {
982 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
983 	struct mt7615_vif *mvif = msta->vif;
984 	struct wtbl_req_hdr *wtbl_hdr;
985 	struct sk_buff *skb;
986 	int err;
987 
988 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
989 					    &msta->wcid);
990 	if (IS_ERR(skb))
991 		return PTR_ERR(skb);
992 
993 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
994 
995 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
996 				    MCU_EXT_CMD_STA_REC_UPDATE, true);
997 	if (err < 0 || !enable)
998 		return err;
999 
1000 	skb = NULL;
1001 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1002 						  WTBL_SET, NULL, &skb);
1003 	if (IS_ERR(wtbl_hdr))
1004 		return PTR_ERR(wtbl_hdr);
1005 
1006 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1007 				    NULL, wtbl_hdr);
1008 
1009 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1010 				     true);
1011 }
1012 
1013 static int
1014 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1015 			struct ieee80211_sta *sta, bool enable)
1016 {
1017 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1018 	struct sk_buff *skb, *sskb, *wskb = NULL;
1019 	struct mt7615_dev *dev = phy->dev;
1020 	struct wtbl_req_hdr *wtbl_hdr;
1021 	struct mt7615_sta *msta;
1022 	int cmd, err;
1023 
1024 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1025 
1026 	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1027 					     &msta->wcid);
1028 	if (IS_ERR(sskb))
1029 		return PTR_ERR(sskb);
1030 
1031 	mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable, true);
1032 	if (enable && sta)
1033 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
1034 					MT76_STA_INFO_STATE_ASSOC);
1035 
1036 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1037 						  WTBL_RESET_AND_SET, NULL,
1038 						  &wskb);
1039 	if (IS_ERR(wtbl_hdr))
1040 		return PTR_ERR(wtbl_hdr);
1041 
1042 	if (enable) {
1043 		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
1044 						 NULL, wtbl_hdr);
1045 		if (sta)
1046 			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
1047 						    NULL, wtbl_hdr);
1048 		mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, vif, &msta->wcid,
1049 						   NULL, wtbl_hdr);
1050 	}
1051 
1052 	cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1053 	skb = enable ? wskb : sskb;
1054 
1055 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1056 	if (err < 0) {
1057 		skb = enable ? sskb : wskb;
1058 		dev_kfree_skb(skb);
1059 
1060 		return err;
1061 	}
1062 
1063 	cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1064 	skb = enable ? sskb : wskb;
1065 
1066 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1067 }
1068 
1069 static int
1070 mt7615_mcu_wtbl_update_hdr_trans(struct mt7615_dev *dev,
1071 				 struct ieee80211_vif *vif,
1072 				 struct ieee80211_sta *sta)
1073 {
1074 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1075 	struct wtbl_req_hdr *wtbl_hdr;
1076 	struct sk_buff *skb = NULL;
1077 
1078 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1079 						  WTBL_SET, NULL, &skb);
1080 	if (IS_ERR(wtbl_hdr))
1081 		return PTR_ERR(wtbl_hdr);
1082 
1083 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, &msta->wcid, NULL,
1084 					   wtbl_hdr);
1085 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1086 				     true);
1087 }
1088 
1089 static const struct mt7615_mcu_ops wtbl_update_ops = {
1090 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1091 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1092 	.add_dev_info = mt7615_mcu_add_dev,
1093 	.add_bss_info = mt7615_mcu_add_bss,
1094 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1095 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1096 	.sta_add = mt7615_mcu_wtbl_sta_add,
1097 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1098 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1099 	.set_sta_decap_offload = mt7615_mcu_wtbl_update_hdr_trans,
1100 };
1101 
1102 static int
1103 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1104 		  struct ieee80211_ampdu_params *params,
1105 		  bool enable, bool tx)
1106 {
1107 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1108 	struct mt7615_vif *mvif = msta->vif;
1109 	struct wtbl_req_hdr *wtbl_hdr;
1110 	struct tlv *sta_wtbl;
1111 	struct sk_buff *skb;
1112 
1113 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1114 					    &msta->wcid);
1115 	if (IS_ERR(skb))
1116 		return PTR_ERR(skb);
1117 
1118 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1119 
1120 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1121 
1122 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1123 						  WTBL_SET, sta_wtbl, &skb);
1124 	if (IS_ERR(wtbl_hdr))
1125 		return PTR_ERR(wtbl_hdr);
1126 
1127 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
1128 				    sta_wtbl, wtbl_hdr);
1129 
1130 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1131 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1132 }
1133 
1134 static int
1135 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1136 		     struct ieee80211_ampdu_params *params,
1137 		     bool enable)
1138 {
1139 	return mt7615_mcu_sta_ba(dev, params, enable, true);
1140 }
1141 
1142 static int
1143 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1144 		     struct ieee80211_ampdu_params *params,
1145 		     bool enable)
1146 {
1147 	return mt7615_mcu_sta_ba(dev, params, enable, false);
1148 }
1149 
1150 static int
1151 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
1152 		     struct ieee80211_sta *sta, bool enable, int cmd,
1153 		     bool offload_fw)
1154 {
1155 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1156 	struct mt76_sta_cmd_info info = {
1157 		.sta = sta,
1158 		.vif = vif,
1159 		.offload_fw = offload_fw,
1160 		.enable = enable,
1161 		.newly = true,
1162 		.cmd = cmd,
1163 	};
1164 
1165 	info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
1166 	return mt76_connac_mcu_sta_cmd(phy, &info);
1167 }
1168 
1169 static int
1170 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1171 		   struct ieee80211_sta *sta, bool enable)
1172 {
1173 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1174 				    MCU_EXT_CMD_STA_REC_UPDATE, false);
1175 }
1176 
1177 static int
1178 mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1179 				struct ieee80211_vif *vif,
1180 				struct ieee80211_sta *sta)
1181 {
1182 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1183 
1184 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1185 						    vif, &msta->wcid,
1186 						    MCU_EXT_CMD_STA_REC_UPDATE);
1187 }
1188 
1189 static const struct mt7615_mcu_ops sta_update_ops = {
1190 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1191 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1192 	.add_dev_info = mt7615_mcu_add_dev,
1193 	.add_bss_info = mt7615_mcu_add_bss,
1194 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1195 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1196 	.sta_add = mt7615_mcu_add_sta,
1197 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1198 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1199 	.set_sta_decap_offload = mt7615_mcu_sta_update_hdr_trans,
1200 };
1201 
1202 static int
1203 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1204 {
1205 	return 0;
1206 }
1207 
1208 static int
1209 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1210 				  struct ieee80211_hw *hw,
1211 				  struct ieee80211_vif *vif,
1212 				  bool enable)
1213 {
1214 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1215 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1216 	struct ieee80211_mutable_offsets offs;
1217 	struct {
1218 		struct req_hdr {
1219 			u8 bss_idx;
1220 			u8 pad[3];
1221 		} __packed hdr;
1222 		struct bcn_content_tlv {
1223 			__le16 tag;
1224 			__le16 len;
1225 			__le16 tim_ie_pos;
1226 			__le16 csa_ie_pos;
1227 			__le16 bcc_ie_pos;
1228 			/* 0: disable beacon offload
1229 			 * 1: enable beacon offload
1230 			 * 2: update probe respond offload
1231 			 */
1232 			u8 enable;
1233 			/* 0: legacy format (TXD + payload)
1234 			 * 1: only cap field IE
1235 			 */
1236 			u8 type;
1237 			__le16 pkt_len;
1238 			u8 pkt[512];
1239 		} __packed beacon_tlv;
1240 	} req = {
1241 		.hdr = {
1242 			.bss_idx = mvif->mt76.idx,
1243 		},
1244 		.beacon_tlv = {
1245 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1246 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1247 			.enable = enable,
1248 		},
1249 	};
1250 	struct sk_buff *skb;
1251 
1252 	if (!enable)
1253 		goto out;
1254 
1255 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1256 	if (!skb)
1257 		return -EINVAL;
1258 
1259 	if (skb->len > 512 - MT_TXD_SIZE) {
1260 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1261 		dev_kfree_skb(skb);
1262 		return -EINVAL;
1263 	}
1264 
1265 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1266 			      wcid, NULL, 0, NULL, true);
1267 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1268 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1269 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1270 
1271 	if (offs.cntdwn_counter_offs[0]) {
1272 		u16 csa_offs;
1273 
1274 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1275 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1276 	}
1277 	dev_kfree_skb(skb);
1278 
1279 out:
1280 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1281 				 &req, sizeof(req), true);
1282 }
1283 
1284 static int
1285 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1286 		       bool enable)
1287 {
1288 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1289 
1290 	return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1291 					   enable);
1292 }
1293 
1294 static int
1295 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1296 		       struct ieee80211_sta *sta, bool enable)
1297 {
1298 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1299 
1300 	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1301 					   enable);
1302 }
1303 
1304 static inline int
1305 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1306 		       struct ieee80211_sta *sta, bool enable)
1307 {
1308 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1309 				    MCU_UNI_CMD_STA_REC_UPDATE, true);
1310 }
1311 
1312 static int
1313 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1314 		     struct ieee80211_ampdu_params *params,
1315 		     bool enable)
1316 {
1317 	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1318 
1319 	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1320 				      enable, true);
1321 }
1322 
1323 static int
1324 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1325 		     struct ieee80211_ampdu_params *params,
1326 		     bool enable)
1327 {
1328 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1329 	struct mt7615_vif *mvif = msta->vif;
1330 	struct wtbl_req_hdr *wtbl_hdr;
1331 	struct tlv *sta_wtbl;
1332 	struct sk_buff *skb;
1333 	int err;
1334 
1335 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1336 					    &msta->wcid);
1337 	if (IS_ERR(skb))
1338 		return PTR_ERR(skb);
1339 
1340 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1341 
1342 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1343 				    MCU_UNI_CMD_STA_REC_UPDATE, true);
1344 	if (err < 0 || !enable)
1345 		return err;
1346 
1347 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1348 					    &msta->wcid);
1349 	if (IS_ERR(skb))
1350 		return PTR_ERR(skb);
1351 
1352 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1353 					   sizeof(struct tlv));
1354 
1355 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1356 						  WTBL_SET, sta_wtbl, &skb);
1357 	if (IS_ERR(wtbl_hdr))
1358 		return PTR_ERR(wtbl_hdr);
1359 
1360 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1361 				    sta_wtbl, wtbl_hdr);
1362 
1363 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1364 				     MCU_UNI_CMD_STA_REC_UPDATE, true);
1365 }
1366 
1367 static int
1368 mt7615_mcu_sta_uni_update_hdr_trans(struct mt7615_dev *dev,
1369 				    struct ieee80211_vif *vif,
1370 				    struct ieee80211_sta *sta)
1371 {
1372 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1373 
1374 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1375 						    vif, &msta->wcid,
1376 						    MCU_UNI_CMD_STA_REC_UPDATE);
1377 }
1378 
1379 static const struct mt7615_mcu_ops uni_update_ops = {
1380 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1381 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1382 	.add_dev_info = mt7615_mcu_uni_add_dev,
1383 	.add_bss_info = mt7615_mcu_uni_add_bss,
1384 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1385 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1386 	.sta_add = mt7615_mcu_uni_add_sta,
1387 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1388 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1389 	.set_sta_decap_offload = mt7615_mcu_sta_uni_update_hdr_trans,
1390 };
1391 
1392 int mt7615_mcu_restart(struct mt76_dev *dev)
1393 {
1394 	return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1395 }
1396 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1397 
1398 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1399 {
1400 	const struct mt7615_patch_hdr *hdr;
1401 	const struct firmware *fw = NULL;
1402 	int len, ret, sem;
1403 
1404 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1405 	if (ret)
1406 		return ret;
1407 
1408 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1409 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1410 		ret = -EINVAL;
1411 		goto release_fw;
1412 	}
1413 
1414 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1415 	switch (sem) {
1416 	case PATCH_IS_DL:
1417 		goto release_fw;
1418 	case PATCH_NOT_DL_SEM_SUCCESS:
1419 		break;
1420 	default:
1421 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1422 		ret = -EAGAIN;
1423 		goto release_fw;
1424 	}
1425 
1426 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1427 
1428 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1429 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1430 
1431 	len = fw->size - sizeof(*hdr);
1432 
1433 	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1434 					    DL_MODE_NEED_RSP);
1435 	if (ret) {
1436 		dev_err(dev->mt76.dev, "Download request failed\n");
1437 		goto out;
1438 	}
1439 
1440 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1441 				     fw->data + sizeof(*hdr), len);
1442 	if (ret) {
1443 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1444 		goto out;
1445 	}
1446 
1447 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1448 	if (ret)
1449 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1450 
1451 out:
1452 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1453 	switch (sem) {
1454 	case PATCH_REL_SEM_SUCCESS:
1455 		break;
1456 	default:
1457 		ret = -EAGAIN;
1458 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1459 		break;
1460 	}
1461 
1462 release_fw:
1463 	release_firmware(fw);
1464 
1465 	return ret;
1466 }
1467 
1468 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1469 {
1470 	u32 ret = 0;
1471 
1472 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1473 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1474 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1475 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1476 	ret |= DL_MODE_NEED_RSP;
1477 	ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1478 
1479 	return ret;
1480 }
1481 
1482 static int
1483 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1484 			     const struct mt7615_fw_trailer *hdr,
1485 			     const u8 *data, bool is_cr4)
1486 {
1487 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1488 	int err, i, offset = 0;
1489 	u32 len, addr, mode;
1490 
1491 	for (i = 0; i < n_region; i++) {
1492 		mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1493 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1494 		addr = le32_to_cpu(hdr[i].addr);
1495 
1496 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1497 						    mode);
1498 		if (err) {
1499 			dev_err(dev->mt76.dev, "Download request failed\n");
1500 			return err;
1501 		}
1502 
1503 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1504 					     data + offset, len);
1505 		if (err) {
1506 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1507 			return err;
1508 		}
1509 
1510 		offset += len;
1511 	}
1512 
1513 	return 0;
1514 }
1515 
1516 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1517 {
1518 	const struct mt7615_fw_trailer *hdr;
1519 	const struct firmware *fw;
1520 	int ret;
1521 
1522 	ret = request_firmware(&fw, name, dev->mt76.dev);
1523 	if (ret)
1524 		return ret;
1525 
1526 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1527 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1528 		ret = -EINVAL;
1529 		goto out;
1530 	}
1531 
1532 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1533 					N9_REGION_NUM * sizeof(*hdr));
1534 
1535 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1536 		 hdr->fw_ver, hdr->build_date);
1537 
1538 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1539 	if (ret)
1540 		goto out;
1541 
1542 	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1543 					     le32_to_cpu(hdr->addr),
1544 					     FW_START_OVERRIDE);
1545 	if (ret) {
1546 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1547 		goto out;
1548 	}
1549 
1550 	snprintf(dev->mt76.hw->wiphy->fw_version,
1551 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1552 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1553 
1554 	if (!is_mt7615(&dev->mt76)) {
1555 		dev->fw_ver = MT7615_FIRMWARE_V2;
1556 		dev->mcu_ops = &sta_update_ops;
1557 	} else {
1558 		dev->fw_ver = MT7615_FIRMWARE_V1;
1559 		dev->mcu_ops = &wtbl_update_ops;
1560 	}
1561 
1562 out:
1563 	release_firmware(fw);
1564 	return ret;
1565 }
1566 
1567 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1568 {
1569 	const struct mt7615_fw_trailer *hdr;
1570 	const struct firmware *fw;
1571 	int ret;
1572 
1573 	ret = request_firmware(&fw, name, dev->mt76.dev);
1574 	if (ret)
1575 		return ret;
1576 
1577 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1578 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1579 		ret = -EINVAL;
1580 		goto out;
1581 	}
1582 
1583 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1584 					CR4_REGION_NUM * sizeof(*hdr));
1585 
1586 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1587 		 hdr->fw_ver, hdr->build_date);
1588 
1589 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1590 	if (ret)
1591 		goto out;
1592 
1593 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1594 					     FW_START_WORKING_PDA_CR4);
1595 	if (ret) {
1596 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1597 		goto out;
1598 	}
1599 
1600 out:
1601 	release_firmware(fw);
1602 
1603 	return ret;
1604 }
1605 
1606 static int mt7615_load_ram(struct mt7615_dev *dev)
1607 {
1608 	int ret;
1609 
1610 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1611 	if (ret)
1612 		return ret;
1613 
1614 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1615 }
1616 
1617 static int mt7615_load_firmware(struct mt7615_dev *dev)
1618 {
1619 	int ret;
1620 	u32 val;
1621 
1622 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1623 
1624 	if (val != FW_STATE_FW_DOWNLOAD) {
1625 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1626 		return -EIO;
1627 	}
1628 
1629 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1630 	if (ret)
1631 		return ret;
1632 
1633 	ret = mt7615_load_ram(dev);
1634 	if (ret)
1635 		return ret;
1636 
1637 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1638 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1639 				       FW_STATE_CR4_RDY), 500)) {
1640 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1641 		return -EIO;
1642 	}
1643 
1644 	return 0;
1645 }
1646 
1647 static int mt7622_load_firmware(struct mt7615_dev *dev)
1648 {
1649 	int ret;
1650 	u32 val;
1651 
1652 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1653 
1654 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1655 	if (val != FW_STATE_FW_DOWNLOAD) {
1656 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1657 		return -EIO;
1658 	}
1659 
1660 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1661 	if (ret)
1662 		return ret;
1663 
1664 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1665 	if (ret)
1666 		return ret;
1667 
1668 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1669 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1670 				       FW_STATE_NORMAL_TRX), 1500)) {
1671 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1672 		return -EIO;
1673 	}
1674 
1675 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1676 
1677 	return 0;
1678 }
1679 
1680 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1681 {
1682 	struct {
1683 		u8 ctrl_val;
1684 		u8 pad[3];
1685 	} data = {
1686 		.ctrl_val = ctrl
1687 	};
1688 
1689 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
1690 				 sizeof(data), true);
1691 }
1692 
1693 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1694 {
1695 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1696 	const struct mt7663_fw_trailer *hdr;
1697 	const struct mt7663_fw_buf *buf;
1698 	const struct firmware *fw;
1699 	const u8 *base_addr;
1700 	int i, ret;
1701 
1702 	ret = request_firmware(&fw, name, dev->mt76.dev);
1703 	if (ret)
1704 		return ret;
1705 
1706 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1707 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1708 		ret = -EINVAL;
1709 		goto out;
1710 	}
1711 
1712 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
1713 						 FW_V3_COMMON_TAILER_SIZE);
1714 
1715 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1716 		 hdr->fw_ver, hdr->build_date);
1717 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1718 
1719 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1720 	for (i = 0; i < hdr->n_region; i++) {
1721 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1722 		u32 len, addr, mode;
1723 
1724 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1725 
1726 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1727 		mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
1728 		addr = le32_to_cpu(buf->img_dest_addr);
1729 		len = le32_to_cpu(buf->img_size);
1730 
1731 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1732 						    mode);
1733 		if (ret) {
1734 			dev_err(dev->mt76.dev, "Download request failed\n");
1735 			goto out;
1736 		}
1737 
1738 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1739 					     fw->data + offset, len);
1740 		if (ret) {
1741 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1742 			goto out;
1743 		}
1744 
1745 		offset += le32_to_cpu(buf->img_size);
1746 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1747 			override_addr = le32_to_cpu(buf->img_dest_addr);
1748 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1749 				 i, override_addr);
1750 		}
1751 	}
1752 
1753 	if (override_addr)
1754 		flag |= FW_START_OVERRIDE;
1755 
1756 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1757 		 override_addr, flag);
1758 
1759 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1760 	if (ret) {
1761 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1762 		goto out;
1763 	}
1764 
1765 	snprintf(dev->mt76.hw->wiphy->fw_version,
1766 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1767 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1768 
1769 out:
1770 	release_firmware(fw);
1771 
1772 	return ret;
1773 }
1774 
1775 static int
1776 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1777 {
1778 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1779 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1780 	int ret;
1781 
1782 	if (!prefer_offload_fw) {
1783 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1784 		primary_rom = MT7663_ROM_PATCH;
1785 	}
1786 	selected_rom = primary_rom;
1787 
1788 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1789 	if (ret) {
1790 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1791 			 primary_rom, secondary_rom);
1792 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1793 					secondary_rom);
1794 		if (ret) {
1795 			dev_err(dev->mt76.dev, "failed to load %s",
1796 				secondary_rom);
1797 			return ret;
1798 		}
1799 		selected_rom = secondary_rom;
1800 	}
1801 
1802 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1803 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1804 		dev->fw_ver = MT7615_FIRMWARE_V3;
1805 		dev->mcu_ops = &uni_update_ops;
1806 	} else {
1807 		*n9_firmware = MT7663_FIRMWARE_N9;
1808 		dev->fw_ver = MT7615_FIRMWARE_V2;
1809 		dev->mcu_ops = &sta_update_ops;
1810 	}
1811 
1812 	return 0;
1813 }
1814 
1815 int __mt7663_load_firmware(struct mt7615_dev *dev)
1816 {
1817 	const char *n9_firmware;
1818 	int ret;
1819 
1820 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1821 	if (ret) {
1822 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1823 		return -EIO;
1824 	}
1825 
1826 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1827 	if (ret)
1828 		return ret;
1829 
1830 	ret = mt7663_load_n9(dev, n9_firmware);
1831 	if (ret)
1832 		return ret;
1833 
1834 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1835 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1836 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1837 				     MT7663_TOP_MISC2_FW_STATE);
1838 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1839 		return -EIO;
1840 	}
1841 
1842 #ifdef CONFIG_PM
1843 	if (mt7615_firmware_offload(dev))
1844 		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1845 #endif /* CONFIG_PM */
1846 
1847 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1848 
1849 	return 0;
1850 }
1851 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1852 
1853 static int mt7663_load_firmware(struct mt7615_dev *dev)
1854 {
1855 	int ret;
1856 
1857 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1858 
1859 	ret = __mt7663_load_firmware(dev);
1860 	if (ret)
1861 		return ret;
1862 
1863 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1864 
1865 	return 0;
1866 }
1867 
1868 int mt7615_mcu_init(struct mt7615_dev *dev)
1869 {
1870 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1871 		.headroom = sizeof(struct mt7615_mcu_txd),
1872 		.mcu_skb_send_msg = mt7615_mcu_send_message,
1873 		.mcu_parse_response = mt7615_mcu_parse_response,
1874 		.mcu_restart = mt7615_mcu_restart,
1875 	};
1876 	int ret;
1877 
1878 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
1879 
1880 	ret = mt7615_mcu_drv_pmctrl(dev);
1881 	if (ret)
1882 		return ret;
1883 
1884 	switch (mt76_chip(&dev->mt76)) {
1885 	case 0x7622:
1886 		ret = mt7622_load_firmware(dev);
1887 		break;
1888 	case 0x7663:
1889 		ret = mt7663_load_firmware(dev);
1890 		break;
1891 	default:
1892 		ret = mt7615_load_firmware(dev);
1893 		break;
1894 	}
1895 	if (ret)
1896 		return ret;
1897 
1898 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1899 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1900 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1901 	mt7615_mcu_fw_log_2_host(dev, 0);
1902 
1903 	return 0;
1904 }
1905 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1906 
1907 void mt7615_mcu_exit(struct mt7615_dev *dev)
1908 {
1909 	__mt76_mcu_restart(&dev->mt76);
1910 	mt7615_mcu_set_fw_ctrl(dev);
1911 	skb_queue_purge(&dev->mt76.mcu.res_q);
1912 }
1913 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1914 
1915 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1916 {
1917 	struct {
1918 		u8 buffer_mode;
1919 		u8 content_format;
1920 		__le16 len;
1921 	} __packed req_hdr = {
1922 		.buffer_mode = 1,
1923 	};
1924 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1925 	struct sk_buff *skb;
1926 	int eep_len, offset;
1927 
1928 	switch (mt76_chip(&dev->mt76)) {
1929 	case 0x7622:
1930 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1931 		offset = MT_EE_NIC_CONF_0;
1932 		break;
1933 	case 0x7663:
1934 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1935 		req_hdr.content_format = 1;
1936 		offset = MT_EE_CHIP_ID;
1937 		break;
1938 	default:
1939 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1940 		offset = MT_EE_NIC_CONF_0;
1941 		break;
1942 	}
1943 
1944 	req_hdr.len = cpu_to_le16(eep_len);
1945 
1946 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1947 	if (!skb)
1948 		return -ENOMEM;
1949 
1950 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1951 	skb_put_data(skb, eep + offset, eep_len);
1952 
1953 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1954 				     MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
1955 }
1956 
1957 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1958 		       const struct ieee80211_tx_queue_params *params)
1959 {
1960 #define WMM_AIFS_SET	BIT(0)
1961 #define WMM_CW_MIN_SET	BIT(1)
1962 #define WMM_CW_MAX_SET	BIT(2)
1963 #define WMM_TXOP_SET	BIT(3)
1964 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1965 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1966 	struct req_data {
1967 		u8 number;
1968 		u8 rsv[3];
1969 		u8 queue;
1970 		u8 valid;
1971 		u8 aifs;
1972 		u8 cw_min;
1973 		__le16 cw_max;
1974 		__le16 txop;
1975 	} __packed req = {
1976 		.number = 1,
1977 		.queue = queue,
1978 		.valid = WMM_PARAM_SET,
1979 		.aifs = params->aifs,
1980 		.cw_min = 5,
1981 		.cw_max = cpu_to_le16(10),
1982 		.txop = cpu_to_le16(params->txop),
1983 	};
1984 
1985 	if (params->cw_min)
1986 		req.cw_min = fls(params->cw_min);
1987 	if (params->cw_max)
1988 		req.cw_max = cpu_to_le16(fls(params->cw_max));
1989 
1990 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
1991 				 sizeof(req), true);
1992 }
1993 
1994 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1995 {
1996 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1997 	struct dbdc_entry {
1998 		u8 type;
1999 		u8 index;
2000 		u8 band;
2001 		u8 _rsv;
2002 	};
2003 	struct {
2004 		u8 enable;
2005 		u8 num;
2006 		u8 _rsv[2];
2007 		struct dbdc_entry entry[64];
2008 	} req = {
2009 		.enable = !!ext_phy,
2010 	};
2011 	int i;
2012 
2013 	if (!ext_phy)
2014 		goto out;
2015 
2016 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
2017 	do { \
2018 		req.entry[req.num].type = _type;		\
2019 		req.entry[req.num].index = _idx;		\
2020 		req.entry[req.num++].band = _band;		\
2021 	} while (0)
2022 
2023 	for (i = 0; i < 4; i++) {
2024 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
2025 
2026 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2027 	}
2028 
2029 	for (i = 0; i < 14; i++) {
2030 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
2031 
2032 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2033 	}
2034 
2035 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2036 
2037 	for (i = 0; i < 3; i++)
2038 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2039 
2040 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2041 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2042 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2043 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2044 
2045 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2046 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2047 
2048 out:
2049 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
2050 				 sizeof(req), true);
2051 }
2052 
2053 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2054 {
2055 	struct wtbl_req_hdr req = {
2056 		.operation = WTBL_RESET_ALL,
2057 	};
2058 
2059 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
2060 				 sizeof(req), true);
2061 }
2062 
2063 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2064 		       enum mt7615_rdd_cmd cmd, u8 index,
2065 		       u8 rx_sel, u8 val)
2066 {
2067 	struct {
2068 		u8 ctrl;
2069 		u8 rdd_idx;
2070 		u8 rdd_rx_sel;
2071 		u8 val;
2072 		u8 rsv[4];
2073 	} req = {
2074 		.ctrl = cmd,
2075 		.rdd_idx = index,
2076 		.rdd_rx_sel = rx_sel,
2077 		.val = val,
2078 	};
2079 
2080 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
2081 				 sizeof(req), true);
2082 }
2083 
2084 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2085 {
2086 	struct {
2087 		__le16 tag;
2088 		__le16 min_lpn;
2089 	} req = {
2090 		.tag = cpu_to_le16(0x1),
2091 		.min_lpn = cpu_to_le16(val),
2092 	};
2093 
2094 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2095 				 sizeof(req), true);
2096 }
2097 
2098 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2099 			    const struct mt7615_dfs_pulse *pulse)
2100 {
2101 	struct {
2102 		__le16 tag;
2103 		__le32 max_width;	/* us */
2104 		__le32 max_pwr;		/* dbm */
2105 		__le32 min_pwr;		/* dbm */
2106 		__le32 min_stgr_pri;	/* us */
2107 		__le32 max_stgr_pri;	/* us */
2108 		__le32 min_cr_pri;	/* us */
2109 		__le32 max_cr_pri;	/* us */
2110 	} req = {
2111 		.tag = cpu_to_le16(0x3),
2112 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2113 		__req_field(max_width),
2114 		__req_field(max_pwr),
2115 		__req_field(min_pwr),
2116 		__req_field(min_stgr_pri),
2117 		__req_field(max_stgr_pri),
2118 		__req_field(min_cr_pri),
2119 		__req_field(max_cr_pri),
2120 #undef  __req_field
2121 	};
2122 
2123 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2124 				 sizeof(req), true);
2125 }
2126 
2127 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2128 			    const struct mt7615_dfs_pattern *pattern)
2129 {
2130 	struct {
2131 		__le16 tag;
2132 		__le16 radar_type;
2133 		u8 enb;
2134 		u8 stgr;
2135 		u8 min_crpn;
2136 		u8 max_crpn;
2137 		u8 min_crpr;
2138 		u8 min_pw;
2139 		u8 max_pw;
2140 		__le32 min_pri;
2141 		__le32 max_pri;
2142 		u8 min_crbn;
2143 		u8 max_crbn;
2144 		u8 min_stgpn;
2145 		u8 max_stgpn;
2146 		u8 min_stgpr;
2147 	} req = {
2148 		.tag = cpu_to_le16(0x2),
2149 		.radar_type = cpu_to_le16(index),
2150 #define __req_field_u8(field) .field = pattern->field
2151 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2152 		__req_field_u8(enb),
2153 		__req_field_u8(stgr),
2154 		__req_field_u8(min_crpn),
2155 		__req_field_u8(max_crpn),
2156 		__req_field_u8(min_crpr),
2157 		__req_field_u8(min_pw),
2158 		__req_field_u8(max_pw),
2159 		__req_field_u32(min_pri),
2160 		__req_field_u32(max_pri),
2161 		__req_field_u8(min_crbn),
2162 		__req_field_u8(max_crbn),
2163 		__req_field_u8(min_stgpn),
2164 		__req_field_u8(max_stgpn),
2165 		__req_field_u8(min_stgpr),
2166 #undef __req_field_u8
2167 #undef __req_field_u32
2168 	};
2169 
2170 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2171 				 sizeof(req), true);
2172 }
2173 
2174 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2175 {
2176 	struct {
2177 		u8 pulse_num;
2178 		u8 rsv[3];
2179 		struct {
2180 			__le32 start_time;
2181 			__le16 width;
2182 			__le16 power;
2183 		} pattern[32];
2184 	} req = {
2185 		.pulse_num = dev->radar_pattern.n_pulses,
2186 	};
2187 	u32 start_time = ktime_to_ms(ktime_get_boottime());
2188 	int i;
2189 
2190 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2191 		return -EINVAL;
2192 
2193 	/* TODO: add some noise here */
2194 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2195 		u32 ts = start_time + i * dev->radar_pattern.period;
2196 
2197 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2198 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2199 		req.pattern[i].start_time = cpu_to_le32(ts);
2200 	}
2201 
2202 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2203 				 &req, sizeof(req), false);
2204 }
2205 
2206 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2207 {
2208 	struct mt76_phy *mphy = phy->mt76;
2209 	struct ieee80211_hw *hw = mphy->hw;
2210 	struct mt76_power_limits limits;
2211 	s8 *limits_array = (s8 *)&limits;
2212 	int n_chains = hweight8(mphy->antenna_mask);
2213 	int tx_power;
2214 	int i;
2215 	static const u8 sku_mapping[] = {
2216 #define SKU_FIELD(_type, _field) \
2217 		[MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2218 		SKU_FIELD(CCK_1_2, cck[0]),
2219 		SKU_FIELD(CCK_55_11, cck[2]),
2220 		SKU_FIELD(OFDM_6_9, ofdm[0]),
2221 		SKU_FIELD(OFDM_12_18, ofdm[2]),
2222 		SKU_FIELD(OFDM_24_36, ofdm[4]),
2223 		SKU_FIELD(OFDM_48, ofdm[6]),
2224 		SKU_FIELD(OFDM_54, ofdm[7]),
2225 		SKU_FIELD(HT20_0_8, mcs[0][0]),
2226 		SKU_FIELD(HT20_32, ofdm[0]),
2227 		SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2228 		SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2229 		SKU_FIELD(HT20_5_13, mcs[0][5]),
2230 		SKU_FIELD(HT20_6_14, mcs[0][6]),
2231 		SKU_FIELD(HT20_7_15, mcs[0][7]),
2232 		SKU_FIELD(HT40_0_8, mcs[1][0]),
2233 		SKU_FIELD(HT40_32, ofdm[0]),
2234 		SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2235 		SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2236 		SKU_FIELD(HT40_5_13, mcs[1][5]),
2237 		SKU_FIELD(HT40_6_14, mcs[1][6]),
2238 		SKU_FIELD(HT40_7_15, mcs[1][7]),
2239 		SKU_FIELD(VHT20_0, mcs[0][0]),
2240 		SKU_FIELD(VHT20_1_2, mcs[0][1]),
2241 		SKU_FIELD(VHT20_3_4, mcs[0][3]),
2242 		SKU_FIELD(VHT20_5_6, mcs[0][5]),
2243 		SKU_FIELD(VHT20_7, mcs[0][7]),
2244 		SKU_FIELD(VHT20_8, mcs[0][8]),
2245 		SKU_FIELD(VHT20_9, mcs[0][9]),
2246 		SKU_FIELD(VHT40_0, mcs[1][0]),
2247 		SKU_FIELD(VHT40_1_2, mcs[1][1]),
2248 		SKU_FIELD(VHT40_3_4, mcs[1][3]),
2249 		SKU_FIELD(VHT40_5_6, mcs[1][5]),
2250 		SKU_FIELD(VHT40_7, mcs[1][7]),
2251 		SKU_FIELD(VHT40_8, mcs[1][8]),
2252 		SKU_FIELD(VHT40_9, mcs[1][9]),
2253 		SKU_FIELD(VHT80_0, mcs[2][0]),
2254 		SKU_FIELD(VHT80_1_2, mcs[2][1]),
2255 		SKU_FIELD(VHT80_3_4, mcs[2][3]),
2256 		SKU_FIELD(VHT80_5_6, mcs[2][5]),
2257 		SKU_FIELD(VHT80_7, mcs[2][7]),
2258 		SKU_FIELD(VHT80_8, mcs[2][8]),
2259 		SKU_FIELD(VHT80_9, mcs[2][9]),
2260 		SKU_FIELD(VHT160_0, mcs[3][0]),
2261 		SKU_FIELD(VHT160_1_2, mcs[3][1]),
2262 		SKU_FIELD(VHT160_3_4, mcs[3][3]),
2263 		SKU_FIELD(VHT160_5_6, mcs[3][5]),
2264 		SKU_FIELD(VHT160_7, mcs[3][7]),
2265 		SKU_FIELD(VHT160_8, mcs[3][8]),
2266 		SKU_FIELD(VHT160_9, mcs[3][9]),
2267 #undef SKU_FIELD
2268 	};
2269 
2270 	tx_power = hw->conf.power_level * 2 -
2271 		   mt76_tx_power_nss_delta(n_chains);
2272 
2273 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2274 					      &limits, tx_power);
2275 	mphy->txpower_cur = tx_power;
2276 
2277 	if (is_mt7663(mphy->dev)) {
2278 		memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2279 		return;
2280 	}
2281 
2282 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2283 		sku[i] = limits_array[sku_mapping[i]];
2284 
2285 	for (i = 0; i < 4; i++) {
2286 		int delta = 0;
2287 
2288 		if (i < n_chains - 1)
2289 			delta = mt76_tx_power_nss_delta(n_chains) -
2290 				mt76_tx_power_nss_delta(i + 1);
2291 		sku[MT_SKU_1SS_DELTA + i] = delta;
2292 	}
2293 }
2294 
2295 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2296 {
2297 	static const u8 width_to_bw[] = {
2298 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2299 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2300 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2301 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2302 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2303 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2304 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2305 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2306 	};
2307 
2308 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2309 		return 0;
2310 
2311 	return width_to_bw[chandef->width];
2312 }
2313 
2314 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2315 {
2316 	struct mt7615_dev *dev = phy->dev;
2317 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2318 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2319 	struct {
2320 		u8 control_chan;
2321 		u8 center_chan;
2322 		u8 bw;
2323 		u8 tx_streams;
2324 		u8 rx_streams_mask;
2325 		u8 switch_reason;
2326 		u8 band_idx;
2327 		/* for 80+80 only */
2328 		u8 center_chan2;
2329 		__le16 cac_case;
2330 		u8 channel_band;
2331 		u8 rsv0;
2332 		__le32 outband_freq;
2333 		u8 txpower_drop;
2334 		u8 rsv1[3];
2335 		u8 txpower_sku[53];
2336 		u8 rsv2[3];
2337 	} req = {
2338 		.control_chan = chandef->chan->hw_value,
2339 		.center_chan = ieee80211_frequency_to_channel(freq1),
2340 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2341 		.rx_streams_mask = phy->mt76->chainmask,
2342 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2343 	};
2344 
2345 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2346 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2347 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2348 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2349 		req.switch_reason = CH_SWITCH_DFS;
2350 	else
2351 		req.switch_reason = CH_SWITCH_NORMAL;
2352 
2353 	req.band_idx = phy != &dev->phy;
2354 	req.bw = mt7615_mcu_chan_bw(chandef);
2355 
2356 	if (mt76_testmode_enabled(phy->mt76))
2357 		memset(req.txpower_sku, 0x3f, 49);
2358 	else
2359 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2360 
2361 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2362 }
2363 
2364 int mt7615_mcu_get_temperature(struct mt7615_dev *dev)
2365 {
2366 	struct {
2367 		u8 action;
2368 		u8 rsv[3];
2369 	} req = {};
2370 
2371 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2372 				 sizeof(req), true);
2373 }
2374 
2375 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2376 			      u32 val)
2377 {
2378 	struct {
2379 		u8 test_mode_en;
2380 		u8 param_idx;
2381 		u8 _rsv[2];
2382 
2383 		__le32 value;
2384 
2385 		u8 pad[8];
2386 	} req = {
2387 		.test_mode_en = test_mode,
2388 		.param_idx = param,
2389 		.value = cpu_to_le32(val),
2390 	};
2391 
2392 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2393 				 sizeof(req), false);
2394 }
2395 
2396 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2397 {
2398 	struct mt7615_dev *dev = phy->dev;
2399 	struct {
2400 		u8 format_id;
2401 		u8 sku_enable;
2402 		u8 band_idx;
2403 		u8 rsv;
2404 	} req = {
2405 		.format_id = 0,
2406 		.band_idx = phy != &dev->phy,
2407 		.sku_enable = enable,
2408 	};
2409 
2410 	return mt76_mcu_send_msg(&dev->mt76,
2411 				 MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2412 				 sizeof(req), true);
2413 }
2414 
2415 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2416 {
2417 	int i;
2418 
2419 	for (i = 0; i < n_freqs; i++)
2420 		if (cur == freqs[i])
2421 			return i;
2422 
2423 	return -1;
2424 }
2425 
2426 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2427 {
2428 	static const u16 freq_list[] = {
2429 		4980, 5805, 5905, 5190,
2430 		5230, 5270, 5310, 5350,
2431 		5390, 5430, 5470, 5510,
2432 		5550, 5590, 5630, 5670,
2433 		5710, 5755, 5795, 5835,
2434 		5875, 5210, 5290, 5370,
2435 		5450, 5530, 5610, 5690,
2436 		5775, 5855
2437 	};
2438 	static const u16 freq_bw40[] = {
2439 		5190, 5230, 5270, 5310,
2440 		5350, 5390, 5430, 5470,
2441 		5510, 5550, 5590, 5630,
2442 		5670, 5710, 5755, 5795,
2443 		5835, 5875
2444 	};
2445 	int offset_2g = ARRAY_SIZE(freq_list);
2446 	int idx;
2447 
2448 	if (freq < 4000) {
2449 		if (freq < 2427)
2450 			return offset_2g;
2451 		if (freq < 2442)
2452 			return offset_2g + 1;
2453 		if (freq < 2457)
2454 			return offset_2g + 2;
2455 
2456 		return offset_2g + 3;
2457 	}
2458 
2459 	switch (bw) {
2460 	case NL80211_CHAN_WIDTH_80:
2461 	case NL80211_CHAN_WIDTH_80P80:
2462 	case NL80211_CHAN_WIDTH_160:
2463 		break;
2464 	default:
2465 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2466 					   freq + 10);
2467 		if (idx >= 0) {
2468 			freq = freq_bw40[idx];
2469 			break;
2470 		}
2471 
2472 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2473 					   freq - 10);
2474 		if (idx >= 0) {
2475 			freq = freq_bw40[idx];
2476 			break;
2477 		}
2478 		fallthrough;
2479 	case NL80211_CHAN_WIDTH_40:
2480 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2481 					   freq);
2482 		if (idx >= 0)
2483 			break;
2484 
2485 		return -1;
2486 
2487 	}
2488 
2489 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2490 }
2491 
2492 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2493 {
2494 	struct mt7615_dev *dev = phy->dev;
2495 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2496 	int freq2 = chandef->center_freq2;
2497 	int ret;
2498 	struct {
2499 		u8 direction;
2500 		u8 runtime_calibration;
2501 		u8 _rsv[2];
2502 
2503 		__le16 center_freq;
2504 		u8 bw;
2505 		u8 band;
2506 		u8 is_freq2;
2507 		u8 success;
2508 		u8 dbdc_en;
2509 
2510 		u8 _rsv2;
2511 
2512 		struct {
2513 			__le32 sx0_i_lna[4];
2514 			__le32 sx0_q_lna[4];
2515 
2516 			__le32 sx2_i_lna[4];
2517 			__le32 sx2_q_lna[4];
2518 		} dcoc_data[4];
2519 	} req = {
2520 		.direction = 1,
2521 
2522 		.bw = mt7615_mcu_chan_bw(chandef),
2523 		.band = chandef->center_freq1 > 4000,
2524 		.dbdc_en = !!dev->mt76.phy2,
2525 	};
2526 	u16 center_freq = chandef->center_freq1;
2527 	int freq_idx;
2528 	u8 *eep = dev->mt76.eeprom.data;
2529 
2530 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2531 		return 0;
2532 
2533 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2534 		freq2 = center_freq + 40;
2535 		center_freq -= 40;
2536 	}
2537 
2538 again:
2539 	req.runtime_calibration = 1;
2540 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2541 	if (freq_idx < 0)
2542 		goto out;
2543 
2544 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2545 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2546 	       sizeof(req.dcoc_data));
2547 	req.runtime_calibration = 0;
2548 
2549 out:
2550 	req.center_freq = cpu_to_le16(center_freq);
2551 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
2552 				sizeof(req), true);
2553 
2554 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2555 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2556 		req.is_freq2 = true;
2557 		center_freq = freq2;
2558 		goto again;
2559 	}
2560 
2561 	return ret;
2562 }
2563 
2564 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2565 {
2566 	static const u16 freq_list[] = {
2567 		4920, 4940, 4960, 4980,
2568 		5040, 5060, 5080, 5180,
2569 		5200, 5220, 5240, 5260,
2570 		5280, 5300, 5320, 5340,
2571 		5360, 5380, 5400, 5420,
2572 		5440, 5460, 5480, 5500,
2573 		5520, 5540, 5560, 5580,
2574 		5600, 5620, 5640, 5660,
2575 		5680, 5700, 5720, 5745,
2576 		5765, 5785, 5805, 5825,
2577 		5845, 5865, 5885, 5905
2578 	};
2579 	int offset_2g = ARRAY_SIZE(freq_list);
2580 	int idx;
2581 
2582 	if (freq < 4000) {
2583 		if (freq < 2432)
2584 			return offset_2g;
2585 		if (freq < 2457)
2586 			return offset_2g + 1;
2587 
2588 		return offset_2g + 2;
2589 	}
2590 
2591 	if (bw != NL80211_CHAN_WIDTH_20) {
2592 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2593 					   freq + 10);
2594 		if (idx >= 0)
2595 			return idx;
2596 
2597 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2598 					   freq - 10);
2599 		if (idx >= 0)
2600 			return idx;
2601 	}
2602 
2603 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2604 }
2605 
2606 
2607 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2608 {
2609 	struct mt7615_dev *dev = phy->dev;
2610 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2611 	int freq2 = chandef->center_freq2;
2612 	int ret;
2613 	struct {
2614 		u8 direction;
2615 		u8 runtime_calibration;
2616 		u8 _rsv[2];
2617 
2618 		__le16 center_freq;
2619 		u8 bw;
2620 		u8 band;
2621 		u8 is_freq2;
2622 		u8 success;
2623 		u8 dbdc_en;
2624 
2625 		u8 _rsv2;
2626 
2627 		struct {
2628 			struct {
2629 				u32 dpd_g0;
2630 				u8 data[32];
2631 			} wf0, wf1;
2632 
2633 			struct {
2634 				u32 dpd_g0_prim;
2635 				u32 dpd_g0_sec;
2636 				u8 data_prim[32];
2637 				u8 data_sec[32];
2638 			} wf2, wf3;
2639 		} dpd_data;
2640 	} req = {
2641 		.direction = 1,
2642 
2643 		.bw = mt7615_mcu_chan_bw(chandef),
2644 		.band = chandef->center_freq1 > 4000,
2645 		.dbdc_en = !!dev->mt76.phy2,
2646 	};
2647 	u16 center_freq = chandef->center_freq1;
2648 	int freq_idx;
2649 	u8 *eep = dev->mt76.eeprom.data;
2650 
2651 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2652 		return 0;
2653 
2654 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2655 		freq2 = center_freq + 40;
2656 		center_freq -= 40;
2657 	}
2658 
2659 again:
2660 	req.runtime_calibration = 1;
2661 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2662 	if (freq_idx < 0)
2663 		goto out;
2664 
2665 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2666 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2667 	       sizeof(req.dpd_data));
2668 	req.runtime_calibration = 0;
2669 
2670 out:
2671 	req.center_freq = cpu_to_le16(center_freq);
2672 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
2673 				sizeof(req), true);
2674 
2675 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2676 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2677 		req.is_freq2 = true;
2678 		center_freq = freq2;
2679 		goto again;
2680 	}
2681 
2682 	return ret;
2683 }
2684 
2685 int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2686 {
2687 	struct {
2688 		u8 operation;
2689 		u8 count;
2690 		u8 _rsv[2];
2691 		u8 index;
2692 		u8 enable;
2693 		__le16 etype;
2694 	} req = {
2695 		.operation = 1,
2696 		.count = 1,
2697 		.enable = 1,
2698 		.etype = cpu_to_le16(ETH_P_PAE),
2699 	};
2700 
2701 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RX_HDR_TRANS,
2702 				 &req, sizeof(req), false);
2703 }
2704 
2705 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2706 			  bool enable)
2707 {
2708 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2709 	struct {
2710 		u8 bss_idx;
2711 		u8 dtim_period;
2712 		__le16 aid;
2713 		__le16 bcn_interval;
2714 		__le16 atim_window;
2715 		u8 uapsd;
2716 		u8 bmc_delivered_ac;
2717 		u8 bmc_triggered_ac;
2718 		u8 pad;
2719 	} req = {
2720 		.bss_idx = mvif->mt76.idx,
2721 		.aid = cpu_to_le16(vif->bss_conf.aid),
2722 		.dtim_period = vif->bss_conf.dtim_period,
2723 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2724 	};
2725 	struct {
2726 		u8 bss_idx;
2727 		u8 pad[3];
2728 	} req_hdr = {
2729 		.bss_idx = mvif->mt76.idx,
2730 	};
2731 	int err;
2732 
2733 	if (vif->type != NL80211_IFTYPE_STATION)
2734 		return 0;
2735 
2736 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
2737 				sizeof(req_hdr), false);
2738 	if (err < 0 || !enable)
2739 		return err;
2740 
2741 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
2742 				 sizeof(req), false);
2743 }
2744 
2745 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2746 		       struct ieee80211_channel *chan, int duration)
2747 {
2748 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2749 	struct mt7615_dev *dev = phy->dev;
2750 	struct mt7615_roc_tlv req = {
2751 		.bss_idx = mvif->mt76.idx,
2752 		.active = !chan,
2753 		.max_interval = cpu_to_le32(duration),
2754 		.primary_chan = chan ? chan->hw_value : 0,
2755 		.band = chan ? chan->band : 0,
2756 		.req_type = 2,
2757 	};
2758 
2759 	phy->roc_grant = false;
2760 
2761 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
2762 				 sizeof(req), false);
2763 }
2764 
2765 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
2766 			     struct ieee80211_vif *vif)
2767 {
2768 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2769 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
2770 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
2771 	struct {
2772 		__le32 ct_win;
2773 		u8 bss_idx;
2774 		u8 rsv[3];
2775 	} __packed req = {
2776 		.ct_win = cpu_to_le32(ct_window),
2777 		.bss_idx = mvif->mt76.idx,
2778 	};
2779 
2780 	if (!mt7615_firmware_offload(dev))
2781 		return -ENOTSUPP;
2782 
2783 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
2784 				 sizeof(req), false);
2785 }
2786 
2787 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
2788 {
2789 	struct {
2790 		__le32 addr;
2791 		__le32 val;
2792 	} __packed req = {
2793 		.addr = cpu_to_le32(offset),
2794 	};
2795 
2796 	return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
2797 				 true);
2798 }
2799 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
2800 
2801 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
2802 {
2803 	struct {
2804 		__le32 addr;
2805 		__le32 val;
2806 	} __packed req = {
2807 		.addr = cpu_to_le32(offset),
2808 		.val = cpu_to_le32(val),
2809 	};
2810 
2811 	mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
2812 }
2813 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);
2814