1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2019 MediaTek Inc.
3  *
4  * Author: Roy Luo <royluo@google.com>
5  *         Ryder Lee <ryder.lee@mediatek.com>
6  */
7 
8 #include <linux/firmware.h>
9 #include "mt7615.h"
10 #include "mcu.h"
11 #include "mac.h"
12 #include "eeprom.h"
13 
14 static bool prefer_offload_fw = true;
15 module_param(prefer_offload_fw, bool, 0644);
16 MODULE_PARM_DESC(prefer_offload_fw,
17 		 "Prefer client mode offload firmware (MT7663)");
18 
19 struct mt7615_patch_hdr {
20 	char build_date[16];
21 	char platform[4];
22 	__be32 hw_sw_ver;
23 	__be32 patch_ver;
24 	__be16 checksum;
25 } __packed;
26 
27 struct mt7615_fw_trailer {
28 	__le32 addr;
29 	u8 chip_id;
30 	u8 feature_set;
31 	u8 eco_code;
32 	char fw_ver[10];
33 	char build_date[15];
34 	__le32 len;
35 } __packed;
36 
37 #define FW_V3_COMMON_TAILER_SIZE	36
38 #define FW_V3_REGION_TAILER_SIZE	40
39 #define FW_START_OVERRIDE		BIT(0)
40 #define FW_START_DLYCAL                 BIT(1)
41 #define FW_START_WORKING_PDA_CR4	BIT(2)
42 
43 struct mt7663_fw_trailer {
44 	u8 chip_id;
45 	u8 eco_code;
46 	u8 n_region;
47 	u8 format_ver;
48 	u8 format_flag;
49 	u8 reserv[2];
50 	char fw_ver[10];
51 	char build_date[15];
52 	__le32 crc;
53 } __packed;
54 
55 struct mt7663_fw_buf {
56 	__le32 crc;
57 	__le32 d_img_size;
58 	__le32 block_size;
59 	u8 rsv[4];
60 	__le32 img_dest_addr;
61 	__le32 img_size;
62 	u8 feature_set;
63 };
64 
65 #define MT7615_PATCH_ADDRESS		0x80000
66 #define MT7622_PATCH_ADDRESS		0x9c000
67 #define MT7663_PATCH_ADDRESS		0xdc000
68 
69 #define N9_REGION_NUM			2
70 #define CR4_REGION_NUM			1
71 
72 #define IMG_CRC_LEN			4
73 
74 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
75 			 int cmd, int *wait_seq)
76 {
77 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
78 	struct mt7615_uni_txd *uni_txd;
79 	struct mt7615_mcu_txd *mcu_txd;
80 	u8 seq, q_idx, pkt_fmt;
81 	__le32 *txd;
82 	u32 val;
83 
84 	/* TODO: make dynamic based on msg type */
85 	dev->mt76.mcu.timeout = 20 * HZ;
86 
87 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
88 	if (!seq)
89 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
90 	if (wait_seq)
91 		*wait_seq = seq;
92 
93 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
94 	txd = (__le32 *)skb_push(skb, txd_len);
95 
96 	if (cmd != MCU_CMD(FW_SCATTER)) {
97 		q_idx = MT_TX_MCU_PORT_RX_Q0;
98 		pkt_fmt = MT_TX_TYPE_CMD;
99 	} else {
100 		q_idx = MT_TX_MCU_PORT_RX_FWDL;
101 		pkt_fmt = MT_TX_TYPE_FW;
102 	}
103 
104 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
105 	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
106 	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
107 	txd[0] = cpu_to_le32(val);
108 
109 	val = MT_TXD1_LONG_FORMAT |
110 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
111 	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
112 	txd[1] = cpu_to_le32(val);
113 
114 	if (cmd & __MCU_CMD_FIELD_UNI) {
115 		uni_txd = (struct mt7615_uni_txd *)txd;
116 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
117 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
118 		uni_txd->cid = cpu_to_le16(mcu_cmd);
119 		uni_txd->s2d_index = MCU_S2D_H2N;
120 		uni_txd->pkt_type = MCU_PKT_ID;
121 		uni_txd->seq = seq;
122 
123 		return;
124 	}
125 
126 	mcu_txd = (struct mt7615_mcu_txd *)txd;
127 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
128 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
129 	mcu_txd->s2d_index = MCU_S2D_H2N;
130 	mcu_txd->pkt_type = MCU_PKT_ID;
131 	mcu_txd->seq = seq;
132 	mcu_txd->cid = mcu_cmd;
133 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
134 
135 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
136 		if (cmd & __MCU_CMD_FIELD_QUERY)
137 			mcu_txd->set_query = MCU_Q_QUERY;
138 		else
139 			mcu_txd->set_query = MCU_Q_SET;
140 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
141 	} else {
142 		mcu_txd->set_query = MCU_Q_NA;
143 	}
144 }
145 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
146 
147 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
148 			      struct sk_buff *skb, int seq)
149 {
150 	struct mt7615_mcu_rxd *rxd;
151 	int ret = 0;
152 
153 	if (!skb) {
154 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
155 			cmd, seq);
156 		return -ETIMEDOUT;
157 	}
158 
159 	rxd = (struct mt7615_mcu_rxd *)skb->data;
160 	if (seq != rxd->seq)
161 		return -EAGAIN;
162 
163 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
164 		skb_pull(skb, sizeof(*rxd) - 4);
165 		ret = *skb->data;
166 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
167 		skb_pull(skb, sizeof(*rxd));
168 		ret = le32_to_cpu(*(__le32 *)skb->data);
169 	} else if (cmd == MCU_EXT_QUERY(RF_REG_ACCESS)) {
170 		skb_pull(skb, sizeof(*rxd));
171 		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
172 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
173 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
174 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
175 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
176 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
177 		   cmd == MCU_UNI_CMD(SUSPEND)) {
178 		struct mt7615_mcu_uni_event *event;
179 
180 		skb_pull(skb, sizeof(*rxd));
181 		event = (struct mt7615_mcu_uni_event *)skb->data;
182 		ret = le32_to_cpu(event->status);
183 	} else if (cmd == MCU_CE_QUERY(REG_READ)) {
184 		struct mt7615_mcu_reg_event *event;
185 
186 		skb_pull(skb, sizeof(*rxd));
187 		event = (struct mt7615_mcu_reg_event *)skb->data;
188 		ret = (int)le32_to_cpu(event->val);
189 	}
190 
191 	return ret;
192 }
193 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
194 
195 static int
196 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
197 			int cmd, int *seq)
198 {
199 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
200 	enum mt76_mcuq_id qid;
201 
202 	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
203 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
204 		qid = MT_MCUQ_WM;
205 	else
206 		qid = MT_MCUQ_FWDL;
207 
208 	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
209 }
210 
211 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
212 {
213 	struct {
214 		__le32 wifi_stream;
215 		__le32 address;
216 		__le32 data;
217 	} req = {
218 		.wifi_stream = cpu_to_le32(wf),
219 		.address = cpu_to_le32(reg),
220 	};
221 
222 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
223 				 &req, sizeof(req), true);
224 }
225 
226 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
227 {
228 	struct {
229 		__le32 wifi_stream;
230 		__le32 address;
231 		__le32 data;
232 	} req = {
233 		.wifi_stream = cpu_to_le32(wf),
234 		.address = cpu_to_le32(reg),
235 		.data = cpu_to_le32(val),
236 	};
237 
238 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
239 				 &req, sizeof(req), false);
240 }
241 
242 void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
243 {
244 	if (!is_mt7622(&dev->mt76))
245 		return;
246 
247 	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
248 			   MT_INFRACFG_MISC_AP2CONN_WAKE,
249 			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
250 }
251 EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
252 
253 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
254 {
255 	struct mt76_phy *mphy = &dev->mt76.phy;
256 	struct mt76_connac_pm *pm = &dev->pm;
257 	struct mt76_dev *mdev = &dev->mt76;
258 	u32 addr;
259 	int err;
260 
261 	if (is_mt7663(mdev)) {
262 		/* Clear firmware own via N9 eint */
263 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
264 		mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
265 
266 		addr = MT_CONN_HIF_ON_LPCTL;
267 	} else {
268 		addr = MT_CFG_LPCR_HOST;
269 	}
270 
271 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
272 
273 	mt7622_trigger_hif_int(dev, true);
274 
275 	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
276 
277 	mt7622_trigger_hif_int(dev, false);
278 
279 	if (err) {
280 		dev_err(mdev->dev, "driver own failed\n");
281 		return -ETIMEDOUT;
282 	}
283 
284 	clear_bit(MT76_STATE_PM, &mphy->state);
285 
286 	pm->stats.last_wake_event = jiffies;
287 	pm->stats.doze_time += pm->stats.last_wake_event -
288 			       pm->stats.last_doze_event;
289 
290 	return 0;
291 }
292 
293 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
294 {
295 	struct mt76_phy *mphy = &dev->mt76.phy;
296 	struct mt76_connac_pm *pm = &dev->pm;
297 	int i, err = 0;
298 
299 	mutex_lock(&pm->mutex);
300 
301 	if (!test_bit(MT76_STATE_PM, &mphy->state))
302 		goto out;
303 
304 	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
305 		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
306 		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
307 				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
308 			break;
309 	}
310 
311 	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
312 		dev_err(dev->mt76.dev, "driver own failed\n");
313 		err = -EIO;
314 		goto out;
315 	}
316 	clear_bit(MT76_STATE_PM, &mphy->state);
317 
318 	pm->stats.last_wake_event = jiffies;
319 	pm->stats.doze_time += pm->stats.last_wake_event -
320 			       pm->stats.last_doze_event;
321 out:
322 	mutex_unlock(&pm->mutex);
323 
324 	return err;
325 }
326 
327 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
328 {
329 	struct mt76_phy *mphy = &dev->mt76.phy;
330 	struct mt76_connac_pm *pm = &dev->pm;
331 	int err = 0;
332 	u32 addr;
333 
334 	mutex_lock(&pm->mutex);
335 
336 	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
337 		goto out;
338 
339 	mt7622_trigger_hif_int(dev, true);
340 
341 	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
342 	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
343 
344 	if (is_mt7622(&dev->mt76) &&
345 	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
346 			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
347 		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
348 		clear_bit(MT76_STATE_PM, &mphy->state);
349 		err = -EIO;
350 	}
351 
352 	mt7622_trigger_hif_int(dev, false);
353 
354 	pm->stats.last_doze_event = jiffies;
355 	pm->stats.awake_time += pm->stats.last_doze_event -
356 				pm->stats.last_wake_event;
357 out:
358 	mutex_unlock(&pm->mutex);
359 
360 	return err;
361 }
362 
363 static void
364 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
365 {
366 	if (vif->csa_active)
367 		ieee80211_csa_finish(vif);
368 }
369 
370 static void
371 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
372 {
373 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
374 	struct mt76_phy *mphy = &dev->mt76.phy;
375 	struct mt7615_mcu_csa_notify *c;
376 
377 	c = (struct mt7615_mcu_csa_notify *)skb->data;
378 
379 	if (c->omac_idx > EXT_BSSID_MAX)
380 		return;
381 
382 	if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
383 		mphy = dev->mt76.phy2;
384 
385 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
386 			IEEE80211_IFACE_ITER_RESUME_ALL,
387 			mt7615_mcu_csa_finish, mphy->hw);
388 }
389 
390 static void
391 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
392 {
393 	struct mt76_phy *mphy = &dev->mt76.phy;
394 	struct mt7615_mcu_rdd_report *r;
395 
396 	r = (struct mt7615_mcu_rdd_report *)skb->data;
397 
398 	if (!dev->radar_pattern.n_pulses && !r->long_detected &&
399 	    !r->constant_prf_detected && !r->staggered_prf_detected)
400 		return;
401 
402 	if (r->band_idx && dev->mt76.phy2)
403 		mphy = dev->mt76.phy2;
404 
405 	ieee80211_radar_detected(mphy->hw);
406 	dev->hw_pattern++;
407 }
408 
409 static void
410 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
411 {
412 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
413 	const char *data = (char *)&rxd[1];
414 	const char *type;
415 
416 	switch (rxd->s2d_index) {
417 	case 0:
418 		type = "N9";
419 		break;
420 	case 2:
421 		type = "CR4";
422 		break;
423 	default:
424 		type = "unknown";
425 		break;
426 	}
427 
428 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
429 		   (int)(skb->len - sizeof(*rxd)), data);
430 }
431 
432 static void
433 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
434 {
435 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
436 
437 	switch (rxd->ext_eid) {
438 	case MCU_EXT_EVENT_RDD_REPORT:
439 		mt7615_mcu_rx_radar_detected(dev, skb);
440 		break;
441 	case MCU_EXT_EVENT_CSA_NOTIFY:
442 		mt7615_mcu_rx_csa_notify(dev, skb);
443 		break;
444 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
445 		mt7615_mcu_rx_log_message(dev, skb);
446 		break;
447 	default:
448 		break;
449 	}
450 }
451 
452 static void
453 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
454 {
455 	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
456 	struct mt7615_phy *phy;
457 	struct mt76_phy *mphy;
458 
459 	if (*seq_num & BIT(7) && dev->mt76.phy2)
460 		mphy = dev->mt76.phy2;
461 	else
462 		mphy = &dev->mt76.phy;
463 
464 	phy = (struct mt7615_phy *)mphy->priv;
465 
466 	spin_lock_bh(&dev->mt76.lock);
467 	__skb_queue_tail(&phy->scan_event_list, skb);
468 	spin_unlock_bh(&dev->mt76.lock);
469 
470 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
471 				     MT7615_HW_SCAN_TIMEOUT);
472 }
473 
474 static void
475 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
476 {
477 	struct mt7615_roc_tlv *event;
478 	struct mt7615_phy *phy;
479 	struct mt76_phy *mphy;
480 	int duration;
481 
482 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
483 	event = (struct mt7615_roc_tlv *)skb->data;
484 
485 	if (event->dbdc_band && dev->mt76.phy2)
486 		mphy = dev->mt76.phy2;
487 	else
488 		mphy = &dev->mt76.phy;
489 
490 	ieee80211_ready_on_channel(mphy->hw);
491 
492 	phy = (struct mt7615_phy *)mphy->priv;
493 	phy->roc_grant = true;
494 	wake_up(&phy->roc_wait);
495 
496 	duration = le32_to_cpu(event->max_interval);
497 	mod_timer(&phy->roc_timer,
498 		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
499 }
500 
501 static void
502 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
503 {
504 	struct mt76_connac_beacon_loss_event *event;
505 	struct mt76_phy *mphy;
506 	u8 band_idx = 0; /* DBDC support */
507 
508 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
509 	event = (struct mt76_connac_beacon_loss_event *)skb->data;
510 	if (band_idx && dev->mt76.phy2)
511 		mphy = dev->mt76.phy2;
512 	else
513 		mphy = &dev->mt76.phy;
514 
515 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
516 					IEEE80211_IFACE_ITER_RESUME_ALL,
517 					mt76_connac_mcu_beacon_loss_iter,
518 					event);
519 }
520 
521 static void
522 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
523 {
524 	struct mt76_connac_mcu_bss_event *event;
525 	struct mt76_phy *mphy;
526 	u8 band_idx = 0; /* DBDC support */
527 
528 	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
529 	event = (struct mt76_connac_mcu_bss_event *)skb->data;
530 
531 	if (band_idx && dev->mt76.phy2)
532 		mphy = dev->mt76.phy2;
533 	else
534 		mphy = &dev->mt76.phy;
535 
536 	if (event->is_absent)
537 		ieee80211_stop_queues(mphy->hw);
538 	else
539 		ieee80211_wake_queues(mphy->hw);
540 }
541 
542 static void
543 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
544 {
545 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
546 
547 	switch (rxd->eid) {
548 	case MCU_EVENT_EXT:
549 		mt7615_mcu_rx_ext_event(dev, skb);
550 		break;
551 	case MCU_EVENT_BSS_BEACON_LOSS:
552 		mt7615_mcu_beacon_loss_event(dev, skb);
553 		break;
554 	case MCU_EVENT_ROC:
555 		mt7615_mcu_roc_event(dev, skb);
556 		break;
557 	case MCU_EVENT_SCHED_SCAN_DONE:
558 	case MCU_EVENT_SCAN_DONE:
559 		mt7615_mcu_scan_event(dev, skb);
560 		return;
561 	case MCU_EVENT_BSS_ABSENCE:
562 		mt7615_mcu_bss_event(dev, skb);
563 		break;
564 	case MCU_EVENT_COREDUMP:
565 		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
566 					       &dev->coredump);
567 		return;
568 	default:
569 		break;
570 	}
571 	dev_kfree_skb(skb);
572 }
573 
574 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
575 {
576 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
577 
578 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
579 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
580 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
581 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
582 	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
583 	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
584 	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
585 	    rxd->eid == MCU_EVENT_SCAN_DONE ||
586 	    rxd->eid == MCU_EVENT_COREDUMP ||
587 	    rxd->eid == MCU_EVENT_ROC ||
588 	    !rxd->seq)
589 		mt7615_mcu_rx_unsolicited_event(dev, skb);
590 	else
591 		mt76_mcu_rx_event(&dev->mt76, skb);
592 }
593 
594 static int
595 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
596 		       bool bssid, bool enable)
597 {
598 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
599 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
600 	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
601 	const u8 *addr = vif->addr;
602 	struct {
603 		u8 mode;
604 		u8 force_clear;
605 		u8 clear_bitmap[8];
606 		u8 entry_count;
607 		u8 write;
608 
609 		u8 index;
610 		u8 bssid;
611 		u8 addr[ETH_ALEN];
612 	} __packed req = {
613 		.mode = !!mask || enable,
614 		.entry_count = 1,
615 		.write = 1,
616 
617 		.index = idx * 2 + bssid,
618 	};
619 
620 	if (bssid)
621 		addr = vif->bss_conf.bssid;
622 
623 	if (enable)
624 		ether_addr_copy(req.addr, addr);
625 
626 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE),
627 				 &req, sizeof(req), true);
628 }
629 
630 static int
631 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
632 		   bool enable)
633 {
634 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
635 	struct mt7615_dev *dev = phy->dev;
636 	struct {
637 		struct req_hdr {
638 			u8 omac_idx;
639 			u8 band_idx;
640 			__le16 tlv_num;
641 			u8 is_tlv_append;
642 			u8 rsv[3];
643 		} __packed hdr;
644 		struct req_tlv {
645 			__le16 tag;
646 			__le16 len;
647 			u8 active;
648 			u8 band_idx;
649 			u8 omac_addr[ETH_ALEN];
650 		} __packed tlv;
651 	} data = {
652 		.hdr = {
653 			.omac_idx = mvif->mt76.omac_idx,
654 			.band_idx = mvif->mt76.band_idx,
655 			.tlv_num = cpu_to_le16(1),
656 			.is_tlv_append = 1,
657 		},
658 		.tlv = {
659 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
660 			.len = cpu_to_le16(sizeof(struct req_tlv)),
661 			.active = enable,
662 			.band_idx = mvif->mt76.band_idx,
663 		},
664 	};
665 
666 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
667 		return mt7615_mcu_muar_config(dev, vif, false, enable);
668 
669 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
670 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
671 				 &data, sizeof(data), true);
672 }
673 
674 static int
675 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
676 			      struct ieee80211_hw *hw,
677 			      struct ieee80211_vif *vif, bool enable)
678 {
679 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
680 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
681 	struct ieee80211_mutable_offsets offs;
682 	struct ieee80211_tx_info *info;
683 	struct req {
684 		u8 omac_idx;
685 		u8 enable;
686 		u8 wlan_idx;
687 		u8 band_idx;
688 		u8 pkt_type;
689 		u8 need_pre_tbtt_int;
690 		__le16 csa_ie_pos;
691 		__le16 pkt_len;
692 		__le16 tim_ie_pos;
693 		u8 pkt[512];
694 		u8 csa_cnt;
695 		/* bss color change */
696 		u8 bcc_cnt;
697 		__le16 bcc_ie_pos;
698 	} __packed req = {
699 		.omac_idx = mvif->mt76.omac_idx,
700 		.enable = enable,
701 		.wlan_idx = wcid->idx,
702 		.band_idx = mvif->mt76.band_idx,
703 	};
704 	struct sk_buff *skb;
705 
706 	if (!enable)
707 		goto out;
708 
709 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
710 	if (!skb)
711 		return -EINVAL;
712 
713 	if (skb->len > 512 - MT_TXD_SIZE) {
714 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
715 		dev_kfree_skb(skb);
716 		return -EINVAL;
717 	}
718 
719 	if (mvif->mt76.band_idx) {
720 		info = IEEE80211_SKB_CB(skb);
721 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
722 	}
723 
724 	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
725 			      0, NULL, true);
726 	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
727 	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
728 	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
729 	if (offs.cntdwn_counter_offs[0]) {
730 		u16 csa_offs;
731 
732 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
733 		req.csa_ie_pos = cpu_to_le16(csa_offs);
734 		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
735 	}
736 	dev_kfree_skb(skb);
737 
738 out:
739 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(BCN_OFFLOAD), &req,
740 				 sizeof(req), true);
741 }
742 
743 static int
744 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
745 {
746 	return mt76_connac_mcu_set_pm(&dev->mt76, band, state);
747 }
748 
749 static int
750 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
751 		   struct ieee80211_sta *sta, bool enable)
752 {
753 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
754 	struct mt7615_dev *dev = phy->dev;
755 	struct sk_buff *skb;
756 
757 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
758 		mt7615_mcu_muar_config(dev, vif, true, enable);
759 
760 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
761 	if (IS_ERR(skb))
762 		return PTR_ERR(skb);
763 
764 	if (enable)
765 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
766 
767 	mt76_connac_mcu_bss_basic_tlv(skb, vif, sta, phy->mt76,
768 				      mvif->sta.wcid.idx, enable);
769 
770 	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
771 	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
772 		mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
773 
774 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
775 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
776 }
777 
778 static int
779 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
780 		      struct ieee80211_ampdu_params *params,
781 		      bool enable)
782 {
783 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
784 	struct mt7615_vif *mvif = msta->vif;
785 	struct wtbl_req_hdr *wtbl_hdr;
786 	struct sk_buff *skb = NULL;
787 	int err;
788 
789 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
790 						  WTBL_SET, NULL, &skb);
791 	if (IS_ERR(wtbl_hdr))
792 		return PTR_ERR(wtbl_hdr);
793 
794 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
795 				    NULL, wtbl_hdr);
796 
797 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
798 				    MCU_EXT_CMD(WTBL_UPDATE), true);
799 	if (err < 0)
800 		return err;
801 
802 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
803 					    &msta->wcid);
804 	if (IS_ERR(skb))
805 		return PTR_ERR(skb);
806 
807 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
808 
809 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
810 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
811 }
812 
813 static int
814 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
815 		      struct ieee80211_ampdu_params *params,
816 		      bool enable)
817 {
818 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
819 	struct mt7615_vif *mvif = msta->vif;
820 	struct wtbl_req_hdr *wtbl_hdr;
821 	struct sk_buff *skb;
822 	int err;
823 
824 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
825 					    &msta->wcid);
826 	if (IS_ERR(skb))
827 		return PTR_ERR(skb);
828 
829 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
830 
831 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
832 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
833 	if (err < 0 || !enable)
834 		return err;
835 
836 	skb = NULL;
837 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
838 						  WTBL_SET, NULL, &skb);
839 	if (IS_ERR(wtbl_hdr))
840 		return PTR_ERR(wtbl_hdr);
841 
842 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
843 				    NULL, wtbl_hdr);
844 
845 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
846 				     MCU_EXT_CMD(WTBL_UPDATE), true);
847 }
848 
849 static int
850 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
851 			struct ieee80211_sta *sta, bool enable)
852 {
853 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
854 	struct sk_buff *skb, *sskb, *wskb = NULL;
855 	struct mt7615_dev *dev = phy->dev;
856 	struct wtbl_req_hdr *wtbl_hdr;
857 	struct mt7615_sta *msta;
858 	int cmd, err;
859 
860 	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
861 
862 	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
863 					     &msta->wcid);
864 	if (IS_ERR(sskb))
865 		return PTR_ERR(sskb);
866 
867 	mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable, true);
868 	if (enable && sta)
869 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
870 					MT76_STA_INFO_STATE_ASSOC);
871 
872 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
873 						  WTBL_RESET_AND_SET, NULL,
874 						  &wskb);
875 	if (IS_ERR(wtbl_hdr))
876 		return PTR_ERR(wtbl_hdr);
877 
878 	if (enable) {
879 		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
880 						 NULL, wtbl_hdr);
881 		if (sta)
882 			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
883 						    NULL, wtbl_hdr, true, true);
884 		mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, vif, &msta->wcid,
885 						   NULL, wtbl_hdr);
886 	}
887 
888 	cmd = enable ? MCU_EXT_CMD(WTBL_UPDATE) : MCU_EXT_CMD(STA_REC_UPDATE);
889 	skb = enable ? wskb : sskb;
890 
891 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
892 	if (err < 0) {
893 		skb = enable ? sskb : wskb;
894 		dev_kfree_skb(skb);
895 
896 		return err;
897 	}
898 
899 	cmd = enable ? MCU_EXT_CMD(STA_REC_UPDATE) : MCU_EXT_CMD(WTBL_UPDATE);
900 	skb = enable ? sskb : wskb;
901 
902 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
903 }
904 
905 static int
906 mt7615_mcu_wtbl_update_hdr_trans(struct mt7615_dev *dev,
907 				 struct ieee80211_vif *vif,
908 				 struct ieee80211_sta *sta)
909 {
910 	return mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
911 }
912 
913 static const struct mt7615_mcu_ops wtbl_update_ops = {
914 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
915 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
916 	.add_dev_info = mt7615_mcu_add_dev,
917 	.add_bss_info = mt7615_mcu_add_bss,
918 	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
919 	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
920 	.sta_add = mt7615_mcu_wtbl_sta_add,
921 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
922 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
923 	.set_sta_decap_offload = mt7615_mcu_wtbl_update_hdr_trans,
924 };
925 
926 static int
927 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
928 		  struct ieee80211_ampdu_params *params,
929 		  bool enable, bool tx)
930 {
931 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
932 	struct mt7615_vif *mvif = msta->vif;
933 	struct wtbl_req_hdr *wtbl_hdr;
934 	struct tlv *sta_wtbl;
935 	struct sk_buff *skb;
936 
937 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
938 					    &msta->wcid);
939 	if (IS_ERR(skb))
940 		return PTR_ERR(skb);
941 
942 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
943 
944 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
945 
946 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
947 						  WTBL_SET, sta_wtbl, &skb);
948 	if (IS_ERR(wtbl_hdr))
949 		return PTR_ERR(wtbl_hdr);
950 
951 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
952 				    sta_wtbl, wtbl_hdr);
953 
954 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
955 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
956 }
957 
958 static int
959 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
960 		     struct ieee80211_ampdu_params *params,
961 		     bool enable)
962 {
963 	return mt7615_mcu_sta_ba(dev, params, enable, true);
964 }
965 
966 static int
967 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
968 		     struct ieee80211_ampdu_params *params,
969 		     bool enable)
970 {
971 	return mt7615_mcu_sta_ba(dev, params, enable, false);
972 }
973 
974 static int
975 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
976 		     struct ieee80211_sta *sta, bool enable, int cmd,
977 		     bool offload_fw)
978 {
979 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
980 	struct mt76_sta_cmd_info info = {
981 		.sta = sta,
982 		.vif = vif,
983 		.offload_fw = offload_fw,
984 		.enable = enable,
985 		.newly = true,
986 		.cmd = cmd,
987 	};
988 
989 	info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
990 	return mt76_connac_mcu_sta_cmd(phy, &info);
991 }
992 
993 static int
994 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
995 		   struct ieee80211_sta *sta, bool enable)
996 {
997 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
998 				    MCU_EXT_CMD(STA_REC_UPDATE), false);
999 }
1000 
1001 static int
1002 mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1003 				struct ieee80211_vif *vif,
1004 				struct ieee80211_sta *sta)
1005 {
1006 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1007 
1008 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1009 						    vif, &msta->wcid,
1010 						    MCU_EXT_CMD(STA_REC_UPDATE));
1011 }
1012 
1013 static const struct mt7615_mcu_ops sta_update_ops = {
1014 	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1015 	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1016 	.add_dev_info = mt7615_mcu_add_dev,
1017 	.add_bss_info = mt7615_mcu_add_bss,
1018 	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1019 	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1020 	.sta_add = mt7615_mcu_add_sta,
1021 	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1022 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1023 	.set_sta_decap_offload = mt7615_mcu_sta_update_hdr_trans,
1024 };
1025 
1026 static int
1027 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1028 {
1029 	return 0;
1030 }
1031 
1032 static int
1033 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1034 				  struct ieee80211_hw *hw,
1035 				  struct ieee80211_vif *vif,
1036 				  bool enable)
1037 {
1038 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1039 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1040 	struct ieee80211_mutable_offsets offs;
1041 	struct {
1042 		struct req_hdr {
1043 			u8 bss_idx;
1044 			u8 pad[3];
1045 		} __packed hdr;
1046 		struct bcn_content_tlv {
1047 			__le16 tag;
1048 			__le16 len;
1049 			__le16 tim_ie_pos;
1050 			__le16 csa_ie_pos;
1051 			__le16 bcc_ie_pos;
1052 			/* 0: disable beacon offload
1053 			 * 1: enable beacon offload
1054 			 * 2: update probe respond offload
1055 			 */
1056 			u8 enable;
1057 			/* 0: legacy format (TXD + payload)
1058 			 * 1: only cap field IE
1059 			 */
1060 			u8 type;
1061 			__le16 pkt_len;
1062 			u8 pkt[512];
1063 		} __packed beacon_tlv;
1064 	} req = {
1065 		.hdr = {
1066 			.bss_idx = mvif->mt76.idx,
1067 		},
1068 		.beacon_tlv = {
1069 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1070 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1071 			.enable = enable,
1072 		},
1073 	};
1074 	struct sk_buff *skb;
1075 
1076 	if (!enable)
1077 		goto out;
1078 
1079 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1080 	if (!skb)
1081 		return -EINVAL;
1082 
1083 	if (skb->len > 512 - MT_TXD_SIZE) {
1084 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1085 		dev_kfree_skb(skb);
1086 		return -EINVAL;
1087 	}
1088 
1089 	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1090 			      wcid, NULL, 0, NULL, true);
1091 	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1092 	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1093 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1094 
1095 	if (offs.cntdwn_counter_offs[0]) {
1096 		u16 csa_offs;
1097 
1098 		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1099 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1100 	}
1101 	dev_kfree_skb(skb);
1102 
1103 out:
1104 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1105 				 &req, sizeof(req), true);
1106 }
1107 
1108 static int
1109 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1110 		       bool enable)
1111 {
1112 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1113 
1114 	return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1115 					   enable);
1116 }
1117 
1118 static int
1119 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1120 		       struct ieee80211_sta *sta, bool enable)
1121 {
1122 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1123 
1124 	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1125 					   enable);
1126 }
1127 
1128 static inline int
1129 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1130 		       struct ieee80211_sta *sta, bool enable)
1131 {
1132 	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1133 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1134 }
1135 
1136 static int
1137 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1138 		     struct ieee80211_ampdu_params *params,
1139 		     bool enable)
1140 {
1141 	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1142 
1143 	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1144 				      MCU_UNI_CMD(STA_REC_UPDATE), enable,
1145 				      true);
1146 }
1147 
1148 static int
1149 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1150 		     struct ieee80211_ampdu_params *params,
1151 		     bool enable)
1152 {
1153 	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1154 	struct mt7615_vif *mvif = msta->vif;
1155 	struct wtbl_req_hdr *wtbl_hdr;
1156 	struct tlv *sta_wtbl;
1157 	struct sk_buff *skb;
1158 	int err;
1159 
1160 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1161 					    &msta->wcid);
1162 	if (IS_ERR(skb))
1163 		return PTR_ERR(skb);
1164 
1165 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1166 
1167 	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1168 				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1169 	if (err < 0 || !enable)
1170 		return err;
1171 
1172 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1173 					    &msta->wcid);
1174 	if (IS_ERR(skb))
1175 		return PTR_ERR(skb);
1176 
1177 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1178 					   sizeof(struct tlv));
1179 
1180 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1181 						  WTBL_SET, sta_wtbl, &skb);
1182 	if (IS_ERR(wtbl_hdr))
1183 		return PTR_ERR(wtbl_hdr);
1184 
1185 	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1186 				    sta_wtbl, wtbl_hdr);
1187 
1188 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1189 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
1190 }
1191 
1192 static int
1193 mt7615_mcu_sta_uni_update_hdr_trans(struct mt7615_dev *dev,
1194 				    struct ieee80211_vif *vif,
1195 				    struct ieee80211_sta *sta)
1196 {
1197 	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1198 
1199 	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1200 						    vif, &msta->wcid,
1201 						    MCU_UNI_CMD(STA_REC_UPDATE));
1202 }
1203 
1204 static const struct mt7615_mcu_ops uni_update_ops = {
1205 	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1206 	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1207 	.add_dev_info = mt7615_mcu_uni_add_dev,
1208 	.add_bss_info = mt7615_mcu_uni_add_bss,
1209 	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1210 	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1211 	.sta_add = mt7615_mcu_uni_add_sta,
1212 	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1213 	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1214 	.set_sta_decap_offload = mt7615_mcu_sta_uni_update_hdr_trans,
1215 };
1216 
1217 int mt7615_mcu_restart(struct mt76_dev *dev)
1218 {
1219 	return mt76_mcu_send_msg(dev, MCU_CMD(RESTART_DL_REQ), NULL, 0, true);
1220 }
1221 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1222 
1223 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1224 {
1225 	const struct mt7615_patch_hdr *hdr;
1226 	const struct firmware *fw = NULL;
1227 	int len, ret, sem;
1228 
1229 	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1230 	if (ret)
1231 		return ret;
1232 
1233 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1234 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1235 		ret = -EINVAL;
1236 		goto release_fw;
1237 	}
1238 
1239 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1240 	switch (sem) {
1241 	case PATCH_IS_DL:
1242 		goto release_fw;
1243 	case PATCH_NOT_DL_SEM_SUCCESS:
1244 		break;
1245 	default:
1246 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1247 		ret = -EAGAIN;
1248 		goto release_fw;
1249 	}
1250 
1251 	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1252 
1253 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1254 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1255 
1256 	len = fw->size - sizeof(*hdr);
1257 
1258 	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1259 					    DL_MODE_NEED_RSP);
1260 	if (ret) {
1261 		dev_err(dev->mt76.dev, "Download request failed\n");
1262 		goto out;
1263 	}
1264 
1265 	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1266 				     fw->data + sizeof(*hdr), len);
1267 	if (ret) {
1268 		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1269 		goto out;
1270 	}
1271 
1272 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1273 	if (ret)
1274 		dev_err(dev->mt76.dev, "Failed to start patch\n");
1275 
1276 out:
1277 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1278 	switch (sem) {
1279 	case PATCH_REL_SEM_SUCCESS:
1280 		break;
1281 	default:
1282 		ret = -EAGAIN;
1283 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1284 		break;
1285 	}
1286 
1287 release_fw:
1288 	release_firmware(fw);
1289 
1290 	return ret;
1291 }
1292 
1293 static int
1294 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1295 			     const struct mt7615_fw_trailer *hdr,
1296 			     const u8 *data, bool is_cr4)
1297 {
1298 	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1299 	int err, i, offset = 0;
1300 	u32 len, addr, mode;
1301 
1302 	for (i = 0; i < n_region; i++) {
1303 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1304 						   hdr[i].feature_set, is_cr4);
1305 		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1306 		addr = le32_to_cpu(hdr[i].addr);
1307 
1308 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1309 						    mode);
1310 		if (err) {
1311 			dev_err(dev->mt76.dev, "Download request failed\n");
1312 			return err;
1313 		}
1314 
1315 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1316 					     data + offset, len);
1317 		if (err) {
1318 			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1319 			return err;
1320 		}
1321 
1322 		offset += len;
1323 	}
1324 
1325 	return 0;
1326 }
1327 
1328 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1329 {
1330 	const struct mt7615_fw_trailer *hdr;
1331 	const struct firmware *fw;
1332 	int ret;
1333 
1334 	ret = request_firmware(&fw, name, dev->mt76.dev);
1335 	if (ret)
1336 		return ret;
1337 
1338 	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1339 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1340 		ret = -EINVAL;
1341 		goto out;
1342 	}
1343 
1344 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1345 					N9_REGION_NUM * sizeof(*hdr));
1346 
1347 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1348 		 hdr->fw_ver, hdr->build_date);
1349 
1350 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1351 	if (ret)
1352 		goto out;
1353 
1354 	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1355 					     le32_to_cpu(hdr->addr),
1356 					     FW_START_OVERRIDE);
1357 	if (ret) {
1358 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1359 		goto out;
1360 	}
1361 
1362 	snprintf(dev->mt76.hw->wiphy->fw_version,
1363 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1364 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1365 
1366 	if (!is_mt7615(&dev->mt76)) {
1367 		dev->fw_ver = MT7615_FIRMWARE_V2;
1368 		dev->mcu_ops = &sta_update_ops;
1369 	} else {
1370 		dev->fw_ver = MT7615_FIRMWARE_V1;
1371 		dev->mcu_ops = &wtbl_update_ops;
1372 	}
1373 
1374 out:
1375 	release_firmware(fw);
1376 	return ret;
1377 }
1378 
1379 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1380 {
1381 	const struct mt7615_fw_trailer *hdr;
1382 	const struct firmware *fw;
1383 	int ret;
1384 
1385 	ret = request_firmware(&fw, name, dev->mt76.dev);
1386 	if (ret)
1387 		return ret;
1388 
1389 	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1390 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1391 		ret = -EINVAL;
1392 		goto out;
1393 	}
1394 
1395 	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1396 					CR4_REGION_NUM * sizeof(*hdr));
1397 
1398 	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1399 		 hdr->fw_ver, hdr->build_date);
1400 
1401 	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1402 	if (ret)
1403 		goto out;
1404 
1405 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1406 					     FW_START_WORKING_PDA_CR4);
1407 	if (ret) {
1408 		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1409 		goto out;
1410 	}
1411 
1412 out:
1413 	release_firmware(fw);
1414 
1415 	return ret;
1416 }
1417 
1418 static int mt7615_load_ram(struct mt7615_dev *dev)
1419 {
1420 	int ret;
1421 
1422 	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1423 	if (ret)
1424 		return ret;
1425 
1426 	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1427 }
1428 
1429 static int mt7615_load_firmware(struct mt7615_dev *dev)
1430 {
1431 	int ret;
1432 	u32 val;
1433 
1434 	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1435 
1436 	if (val != FW_STATE_FW_DOWNLOAD) {
1437 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1438 		return -EIO;
1439 	}
1440 
1441 	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1442 	if (ret)
1443 		return ret;
1444 
1445 	ret = mt7615_load_ram(dev);
1446 	if (ret)
1447 		return ret;
1448 
1449 	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1450 			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1451 				       FW_STATE_RDY), 500)) {
1452 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1453 		return -EIO;
1454 	}
1455 
1456 	return 0;
1457 }
1458 
1459 static int mt7622_load_firmware(struct mt7615_dev *dev)
1460 {
1461 	int ret;
1462 	u32 val;
1463 
1464 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1465 
1466 	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1467 	if (val != FW_STATE_FW_DOWNLOAD) {
1468 		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1469 		return -EIO;
1470 	}
1471 
1472 	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1473 	if (ret)
1474 		return ret;
1475 
1476 	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1477 	if (ret)
1478 		return ret;
1479 
1480 	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1481 			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1482 				       FW_STATE_NORMAL_TRX), 1500)) {
1483 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1484 		return -EIO;
1485 	}
1486 
1487 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1488 
1489 	return 0;
1490 }
1491 
1492 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1493 {
1494 	struct {
1495 		u8 ctrl_val;
1496 		u8 pad[3];
1497 	} data = {
1498 		.ctrl_val = ctrl
1499 	};
1500 
1501 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST),
1502 				 &data, sizeof(data), true);
1503 }
1504 
1505 static int mt7615_mcu_cal_cache_apply(struct mt7615_dev *dev)
1506 {
1507 	struct {
1508 		bool cache_enable;
1509 		u8 pad[3];
1510 	} data = {
1511 		.cache_enable = true
1512 	};
1513 
1514 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CAL_CACHE), &data,
1515 				 sizeof(data), false);
1516 }
1517 
1518 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1519 {
1520 	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1521 	const struct mt7663_fw_trailer *hdr;
1522 	const struct mt7663_fw_buf *buf;
1523 	const struct firmware *fw;
1524 	const u8 *base_addr;
1525 	int i, ret;
1526 
1527 	ret = request_firmware(&fw, name, dev->mt76.dev);
1528 	if (ret)
1529 		return ret;
1530 
1531 	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1532 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1533 		ret = -EINVAL;
1534 		goto out;
1535 	}
1536 
1537 	hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
1538 						 FW_V3_COMMON_TAILER_SIZE);
1539 
1540 	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1541 		 hdr->fw_ver, hdr->build_date);
1542 	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1543 
1544 	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1545 	for (i = 0; i < hdr->n_region; i++) {
1546 		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1547 		u32 len, addr, mode;
1548 
1549 		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1550 
1551 		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1552 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1553 						   buf->feature_set, false);
1554 		addr = le32_to_cpu(buf->img_dest_addr);
1555 		len = le32_to_cpu(buf->img_size);
1556 
1557 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1558 						    mode);
1559 		if (ret) {
1560 			dev_err(dev->mt76.dev, "Download request failed\n");
1561 			goto out;
1562 		}
1563 
1564 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1565 					     fw->data + offset, len);
1566 		if (ret) {
1567 			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1568 			goto out;
1569 		}
1570 
1571 		offset += le32_to_cpu(buf->img_size);
1572 		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1573 			override_addr = le32_to_cpu(buf->img_dest_addr);
1574 			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1575 				 i, override_addr);
1576 		}
1577 	}
1578 
1579 	if (override_addr)
1580 		flag |= FW_START_OVERRIDE;
1581 
1582 	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1583 		 override_addr, flag);
1584 
1585 	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1586 	if (ret) {
1587 		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1588 		goto out;
1589 	}
1590 
1591 	snprintf(dev->mt76.hw->wiphy->fw_version,
1592 		 sizeof(dev->mt76.hw->wiphy->fw_version),
1593 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1594 
1595 out:
1596 	release_firmware(fw);
1597 
1598 	return ret;
1599 }
1600 
1601 static int
1602 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1603 {
1604 	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1605 	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1606 	int ret;
1607 
1608 	if (!prefer_offload_fw) {
1609 		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1610 		primary_rom = MT7663_ROM_PATCH;
1611 	}
1612 	selected_rom = primary_rom;
1613 
1614 	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1615 	if (ret) {
1616 		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1617 			 primary_rom, secondary_rom);
1618 		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1619 					secondary_rom);
1620 		if (ret) {
1621 			dev_err(dev->mt76.dev, "failed to load %s",
1622 				secondary_rom);
1623 			return ret;
1624 		}
1625 		selected_rom = secondary_rom;
1626 	}
1627 
1628 	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1629 		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1630 		dev->fw_ver = MT7615_FIRMWARE_V3;
1631 		dev->mcu_ops = &uni_update_ops;
1632 	} else {
1633 		*n9_firmware = MT7663_FIRMWARE_N9;
1634 		dev->fw_ver = MT7615_FIRMWARE_V2;
1635 		dev->mcu_ops = &sta_update_ops;
1636 	}
1637 
1638 	return 0;
1639 }
1640 
1641 int __mt7663_load_firmware(struct mt7615_dev *dev)
1642 {
1643 	const char *n9_firmware;
1644 	int ret;
1645 
1646 	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1647 	if (ret) {
1648 		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1649 		return -EIO;
1650 	}
1651 
1652 	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1653 	if (ret)
1654 		return ret;
1655 
1656 	ret = mt7663_load_n9(dev, n9_firmware);
1657 	if (ret)
1658 		return ret;
1659 
1660 	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1661 			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1662 		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1663 				     MT7663_TOP_MISC2_FW_STATE);
1664 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1665 		return -EIO;
1666 	}
1667 
1668 #ifdef CONFIG_PM
1669 	if (mt7615_firmware_offload(dev))
1670 		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1671 #endif /* CONFIG_PM */
1672 
1673 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1674 
1675 	return 0;
1676 }
1677 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1678 
1679 static int mt7663_load_firmware(struct mt7615_dev *dev)
1680 {
1681 	int ret;
1682 
1683 	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1684 
1685 	ret = __mt7663_load_firmware(dev);
1686 	if (ret)
1687 		return ret;
1688 
1689 	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1690 
1691 	return 0;
1692 }
1693 
1694 int mt7615_mcu_init(struct mt7615_dev *dev)
1695 {
1696 	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1697 		.headroom = sizeof(struct mt7615_mcu_txd),
1698 		.mcu_skb_send_msg = mt7615_mcu_send_message,
1699 		.mcu_parse_response = mt7615_mcu_parse_response,
1700 		.mcu_restart = mt7615_mcu_restart,
1701 	};
1702 	int ret;
1703 
1704 	dev->mt76.mcu_ops = &mt7615_mcu_ops,
1705 
1706 	ret = mt7615_mcu_drv_pmctrl(dev);
1707 	if (ret)
1708 		return ret;
1709 
1710 	switch (mt76_chip(&dev->mt76)) {
1711 	case 0x7622:
1712 		ret = mt7622_load_firmware(dev);
1713 		break;
1714 	case 0x7663:
1715 		ret = mt7663_load_firmware(dev);
1716 		break;
1717 	default:
1718 		ret = mt7615_load_firmware(dev);
1719 		break;
1720 	}
1721 	if (ret)
1722 		return ret;
1723 
1724 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1725 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1726 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1727 
1728 	if (dev->dbdc_support) {
1729 		ret = mt7615_mcu_cal_cache_apply(dev);
1730 		if (ret)
1731 			return ret;
1732 	}
1733 
1734 	return mt7615_mcu_fw_log_2_host(dev, 0);
1735 }
1736 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1737 
1738 void mt7615_mcu_exit(struct mt7615_dev *dev)
1739 {
1740 	__mt76_mcu_restart(&dev->mt76);
1741 	mt7615_mcu_set_fw_ctrl(dev);
1742 	skb_queue_purge(&dev->mt76.mcu.res_q);
1743 }
1744 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1745 
1746 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1747 {
1748 	struct {
1749 		u8 buffer_mode;
1750 		u8 content_format;
1751 		__le16 len;
1752 	} __packed req_hdr = {
1753 		.buffer_mode = 1,
1754 	};
1755 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1756 	struct sk_buff *skb;
1757 	int eep_len, offset;
1758 
1759 	switch (mt76_chip(&dev->mt76)) {
1760 	case 0x7622:
1761 		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1762 		offset = MT_EE_NIC_CONF_0;
1763 		break;
1764 	case 0x7663:
1765 		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1766 		req_hdr.content_format = 1;
1767 		offset = MT_EE_CHIP_ID;
1768 		break;
1769 	default:
1770 		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1771 		offset = MT_EE_NIC_CONF_0;
1772 		break;
1773 	}
1774 
1775 	req_hdr.len = cpu_to_le16(eep_len);
1776 
1777 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1778 	if (!skb)
1779 		return -ENOMEM;
1780 
1781 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1782 	skb_put_data(skb, eep + offset, eep_len);
1783 
1784 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1785 				     MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
1786 }
1787 
1788 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1789 		       const struct ieee80211_tx_queue_params *params)
1790 {
1791 #define WMM_AIFS_SET	BIT(0)
1792 #define WMM_CW_MIN_SET	BIT(1)
1793 #define WMM_CW_MAX_SET	BIT(2)
1794 #define WMM_TXOP_SET	BIT(3)
1795 #define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1796 			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1797 	struct req_data {
1798 		u8 number;
1799 		u8 rsv[3];
1800 		u8 queue;
1801 		u8 valid;
1802 		u8 aifs;
1803 		u8 cw_min;
1804 		__le16 cw_max;
1805 		__le16 txop;
1806 	} __packed req = {
1807 		.number = 1,
1808 		.queue = queue,
1809 		.valid = WMM_PARAM_SET,
1810 		.aifs = params->aifs,
1811 		.cw_min = 5,
1812 		.cw_max = cpu_to_le16(10),
1813 		.txop = cpu_to_le16(params->txop),
1814 	};
1815 
1816 	if (params->cw_min)
1817 		req.cw_min = fls(params->cw_min);
1818 	if (params->cw_max)
1819 		req.cw_max = cpu_to_le16(fls(params->cw_max));
1820 
1821 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
1822 				 &req, sizeof(req), true);
1823 }
1824 
1825 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1826 {
1827 	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1828 	struct dbdc_entry {
1829 		u8 type;
1830 		u8 index;
1831 		u8 band;
1832 		u8 _rsv;
1833 	};
1834 	struct {
1835 		u8 enable;
1836 		u8 num;
1837 		u8 _rsv[2];
1838 		struct dbdc_entry entry[64];
1839 	} req = {
1840 		.enable = !!ext_phy,
1841 	};
1842 	int i;
1843 
1844 	if (!ext_phy)
1845 		goto out;
1846 
1847 #define ADD_DBDC_ENTRY(_type, _idx, _band)		\
1848 	do { \
1849 		req.entry[req.num].type = _type;		\
1850 		req.entry[req.num].index = _idx;		\
1851 		req.entry[req.num++].band = _band;		\
1852 	} while (0)
1853 
1854 	for (i = 0; i < 4; i++) {
1855 		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1856 
1857 		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1858 	}
1859 
1860 	for (i = 0; i < 14; i++) {
1861 		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1862 
1863 		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1864 	}
1865 
1866 	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1867 
1868 	for (i = 0; i < 3; i++)
1869 		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
1870 
1871 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
1872 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
1873 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
1874 	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
1875 
1876 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
1877 	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
1878 
1879 out:
1880 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DBDC_CTRL), &req,
1881 				 sizeof(req), true);
1882 }
1883 
1884 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1885 {
1886 	struct wtbl_req_hdr req = {
1887 		.operation = WTBL_RESET_ALL,
1888 	};
1889 
1890 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(WTBL_UPDATE),
1891 				 &req, sizeof(req), true);
1892 }
1893 
1894 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
1895 {
1896 	struct {
1897 		__le16 tag;
1898 		__le16 min_lpn;
1899 	} req = {
1900 		.tag = cpu_to_le16(0x1),
1901 		.min_lpn = cpu_to_le16(val),
1902 	};
1903 
1904 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1905 				 &req, sizeof(req), true);
1906 }
1907 
1908 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
1909 			    const struct mt7615_dfs_pulse *pulse)
1910 {
1911 	struct {
1912 		__le16 tag;
1913 		__le32 max_width;	/* us */
1914 		__le32 max_pwr;		/* dbm */
1915 		__le32 min_pwr;		/* dbm */
1916 		__le32 min_stgr_pri;	/* us */
1917 		__le32 max_stgr_pri;	/* us */
1918 		__le32 min_cr_pri;	/* us */
1919 		__le32 max_cr_pri;	/* us */
1920 	} req = {
1921 		.tag = cpu_to_le16(0x3),
1922 #define __req_field(field) .field = cpu_to_le32(pulse->field)
1923 		__req_field(max_width),
1924 		__req_field(max_pwr),
1925 		__req_field(min_pwr),
1926 		__req_field(min_stgr_pri),
1927 		__req_field(max_stgr_pri),
1928 		__req_field(min_cr_pri),
1929 		__req_field(max_cr_pri),
1930 #undef  __req_field
1931 	};
1932 
1933 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1934 				 &req, sizeof(req), true);
1935 }
1936 
1937 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
1938 			    const struct mt7615_dfs_pattern *pattern)
1939 {
1940 	struct {
1941 		__le16 tag;
1942 		__le16 radar_type;
1943 		u8 enb;
1944 		u8 stgr;
1945 		u8 min_crpn;
1946 		u8 max_crpn;
1947 		u8 min_crpr;
1948 		u8 min_pw;
1949 		u8 max_pw;
1950 		__le32 min_pri;
1951 		__le32 max_pri;
1952 		u8 min_crbn;
1953 		u8 max_crbn;
1954 		u8 min_stgpn;
1955 		u8 max_stgpn;
1956 		u8 min_stgpr;
1957 	} req = {
1958 		.tag = cpu_to_le16(0x2),
1959 		.radar_type = cpu_to_le16(index),
1960 #define __req_field_u8(field) .field = pattern->field
1961 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
1962 		__req_field_u8(enb),
1963 		__req_field_u8(stgr),
1964 		__req_field_u8(min_crpn),
1965 		__req_field_u8(max_crpn),
1966 		__req_field_u8(min_crpr),
1967 		__req_field_u8(min_pw),
1968 		__req_field_u8(max_pw),
1969 		__req_field_u32(min_pri),
1970 		__req_field_u32(max_pri),
1971 		__req_field_u8(min_crbn),
1972 		__req_field_u8(max_crbn),
1973 		__req_field_u8(min_stgpn),
1974 		__req_field_u8(max_stgpn),
1975 		__req_field_u8(min_stgpr),
1976 #undef __req_field_u8
1977 #undef __req_field_u32
1978 	};
1979 
1980 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1981 				 &req, sizeof(req), true);
1982 }
1983 
1984 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
1985 {
1986 	struct {
1987 		u8 pulse_num;
1988 		u8 rsv[3];
1989 		struct {
1990 			__le32 start_time;
1991 			__le16 width;
1992 			__le16 power;
1993 		} pattern[32];
1994 	} req = {
1995 		.pulse_num = dev->radar_pattern.n_pulses,
1996 	};
1997 	u32 start_time = ktime_to_ms(ktime_get_boottime());
1998 	int i;
1999 
2000 	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2001 		return -EINVAL;
2002 
2003 	/* TODO: add some noise here */
2004 	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2005 		u32 ts = start_time + i * dev->radar_pattern.period;
2006 
2007 		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2008 		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2009 		req.pattern[i].start_time = cpu_to_le32(ts);
2010 	}
2011 
2012 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_PATTERN),
2013 				 &req, sizeof(req), false);
2014 }
2015 
2016 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2017 {
2018 	struct mt76_phy *mphy = phy->mt76;
2019 	struct ieee80211_hw *hw = mphy->hw;
2020 	struct mt76_power_limits limits;
2021 	s8 *limits_array = (s8 *)&limits;
2022 	int n_chains = hweight8(mphy->antenna_mask);
2023 	int tx_power = hw->conf.power_level * 2;
2024 	int i;
2025 	static const u8 sku_mapping[] = {
2026 #define SKU_FIELD(_type, _field) \
2027 		[MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2028 		SKU_FIELD(CCK_1_2, cck[0]),
2029 		SKU_FIELD(CCK_55_11, cck[2]),
2030 		SKU_FIELD(OFDM_6_9, ofdm[0]),
2031 		SKU_FIELD(OFDM_12_18, ofdm[2]),
2032 		SKU_FIELD(OFDM_24_36, ofdm[4]),
2033 		SKU_FIELD(OFDM_48, ofdm[6]),
2034 		SKU_FIELD(OFDM_54, ofdm[7]),
2035 		SKU_FIELD(HT20_0_8, mcs[0][0]),
2036 		SKU_FIELD(HT20_32, ofdm[0]),
2037 		SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2038 		SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2039 		SKU_FIELD(HT20_5_13, mcs[0][5]),
2040 		SKU_FIELD(HT20_6_14, mcs[0][6]),
2041 		SKU_FIELD(HT20_7_15, mcs[0][7]),
2042 		SKU_FIELD(HT40_0_8, mcs[1][0]),
2043 		SKU_FIELD(HT40_32, ofdm[0]),
2044 		SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2045 		SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2046 		SKU_FIELD(HT40_5_13, mcs[1][5]),
2047 		SKU_FIELD(HT40_6_14, mcs[1][6]),
2048 		SKU_FIELD(HT40_7_15, mcs[1][7]),
2049 		SKU_FIELD(VHT20_0, mcs[0][0]),
2050 		SKU_FIELD(VHT20_1_2, mcs[0][1]),
2051 		SKU_FIELD(VHT20_3_4, mcs[0][3]),
2052 		SKU_FIELD(VHT20_5_6, mcs[0][5]),
2053 		SKU_FIELD(VHT20_7, mcs[0][7]),
2054 		SKU_FIELD(VHT20_8, mcs[0][8]),
2055 		SKU_FIELD(VHT20_9, mcs[0][9]),
2056 		SKU_FIELD(VHT40_0, mcs[1][0]),
2057 		SKU_FIELD(VHT40_1_2, mcs[1][1]),
2058 		SKU_FIELD(VHT40_3_4, mcs[1][3]),
2059 		SKU_FIELD(VHT40_5_6, mcs[1][5]),
2060 		SKU_FIELD(VHT40_7, mcs[1][7]),
2061 		SKU_FIELD(VHT40_8, mcs[1][8]),
2062 		SKU_FIELD(VHT40_9, mcs[1][9]),
2063 		SKU_FIELD(VHT80_0, mcs[2][0]),
2064 		SKU_FIELD(VHT80_1_2, mcs[2][1]),
2065 		SKU_FIELD(VHT80_3_4, mcs[2][3]),
2066 		SKU_FIELD(VHT80_5_6, mcs[2][5]),
2067 		SKU_FIELD(VHT80_7, mcs[2][7]),
2068 		SKU_FIELD(VHT80_8, mcs[2][8]),
2069 		SKU_FIELD(VHT80_9, mcs[2][9]),
2070 		SKU_FIELD(VHT160_0, mcs[3][0]),
2071 		SKU_FIELD(VHT160_1_2, mcs[3][1]),
2072 		SKU_FIELD(VHT160_3_4, mcs[3][3]),
2073 		SKU_FIELD(VHT160_5_6, mcs[3][5]),
2074 		SKU_FIELD(VHT160_7, mcs[3][7]),
2075 		SKU_FIELD(VHT160_8, mcs[3][8]),
2076 		SKU_FIELD(VHT160_9, mcs[3][9]),
2077 #undef SKU_FIELD
2078 	};
2079 
2080 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan, tx_power);
2081 	tx_power -= mt76_tx_power_nss_delta(n_chains);
2082 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2083 					      &limits, tx_power);
2084 	mphy->txpower_cur = tx_power;
2085 
2086 	if (is_mt7663(mphy->dev)) {
2087 		memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2088 		return;
2089 	}
2090 
2091 	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2092 		sku[i] = limits_array[sku_mapping[i]];
2093 
2094 	for (i = 0; i < 4; i++) {
2095 		int delta = 0;
2096 
2097 		if (i < n_chains - 1)
2098 			delta = mt76_tx_power_nss_delta(n_chains) -
2099 				mt76_tx_power_nss_delta(i + 1);
2100 		sku[MT_SKU_1SS_DELTA + i] = delta;
2101 	}
2102 }
2103 
2104 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2105 {
2106 	static const u8 width_to_bw[] = {
2107 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2108 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2109 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2110 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2111 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2112 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2113 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2114 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2115 	};
2116 
2117 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2118 		return 0;
2119 
2120 	return width_to_bw[chandef->width];
2121 }
2122 
2123 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2124 {
2125 	struct mt7615_dev *dev = phy->dev;
2126 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2127 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2128 	struct {
2129 		u8 control_chan;
2130 		u8 center_chan;
2131 		u8 bw;
2132 		u8 tx_streams;
2133 		u8 rx_streams_mask;
2134 		u8 switch_reason;
2135 		u8 band_idx;
2136 		/* for 80+80 only */
2137 		u8 center_chan2;
2138 		__le16 cac_case;
2139 		u8 channel_band;
2140 		u8 rsv0;
2141 		__le32 outband_freq;
2142 		u8 txpower_drop;
2143 		u8 rsv1[3];
2144 		u8 txpower_sku[53];
2145 		u8 rsv2[3];
2146 	} req = {
2147 		.control_chan = chandef->chan->hw_value,
2148 		.center_chan = ieee80211_frequency_to_channel(freq1),
2149 		.tx_streams = hweight8(phy->mt76->antenna_mask),
2150 		.rx_streams_mask = phy->mt76->chainmask,
2151 		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2152 	};
2153 
2154 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2155 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2156 		req.switch_reason = CH_SWITCH_NORMAL;
2157 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2158 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2159 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2160 					  NL80211_IFTYPE_AP))
2161 		req.switch_reason = CH_SWITCH_DFS;
2162 	else
2163 		req.switch_reason = CH_SWITCH_NORMAL;
2164 
2165 	req.band_idx = phy != &dev->phy;
2166 	req.bw = mt7615_mcu_chan_bw(chandef);
2167 
2168 	if (mt76_testmode_enabled(phy->mt76))
2169 		memset(req.txpower_sku, 0x3f, 49);
2170 	else
2171 		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2172 
2173 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2174 }
2175 
2176 int mt7615_mcu_get_temperature(struct mt7615_dev *dev)
2177 {
2178 	struct {
2179 		u8 action;
2180 		u8 rsv[3];
2181 	} req = {};
2182 
2183 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL),
2184 				 &req, sizeof(req), true);
2185 }
2186 
2187 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2188 			      u32 val)
2189 {
2190 	struct {
2191 		u8 test_mode_en;
2192 		u8 param_idx;
2193 		u8 _rsv[2];
2194 
2195 		__le32 value;
2196 
2197 		u8 pad[8];
2198 	} req = {
2199 		.test_mode_en = test_mode,
2200 		.param_idx = param,
2201 		.value = cpu_to_le32(val),
2202 	};
2203 
2204 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
2205 				 &req, sizeof(req), false);
2206 }
2207 
2208 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2209 {
2210 	struct mt7615_dev *dev = phy->dev;
2211 	struct {
2212 		u8 format_id;
2213 		u8 sku_enable;
2214 		u8 band_idx;
2215 		u8 rsv;
2216 	} req = {
2217 		.format_id = 0,
2218 		.band_idx = phy != &dev->phy,
2219 		.sku_enable = enable,
2220 	};
2221 
2222 	return mt76_mcu_send_msg(&dev->mt76,
2223 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
2224 				 &req, sizeof(req), true);
2225 }
2226 
2227 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2228 {
2229 	int i;
2230 
2231 	for (i = 0; i < n_freqs; i++)
2232 		if (cur == freqs[i])
2233 			return i;
2234 
2235 	return -1;
2236 }
2237 
2238 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2239 {
2240 	static const u16 freq_list[] = {
2241 		4980, 5805, 5905, 5190,
2242 		5230, 5270, 5310, 5350,
2243 		5390, 5430, 5470, 5510,
2244 		5550, 5590, 5630, 5670,
2245 		5710, 5755, 5795, 5835,
2246 		5875, 5210, 5290, 5370,
2247 		5450, 5530, 5610, 5690,
2248 		5775, 5855
2249 	};
2250 	static const u16 freq_bw40[] = {
2251 		5190, 5230, 5270, 5310,
2252 		5350, 5390, 5430, 5470,
2253 		5510, 5550, 5590, 5630,
2254 		5670, 5710, 5755, 5795,
2255 		5835, 5875
2256 	};
2257 	int offset_2g = ARRAY_SIZE(freq_list);
2258 	int idx;
2259 
2260 	if (freq < 4000) {
2261 		if (freq < 2427)
2262 			return offset_2g;
2263 		if (freq < 2442)
2264 			return offset_2g + 1;
2265 		if (freq < 2457)
2266 			return offset_2g + 2;
2267 
2268 		return offset_2g + 3;
2269 	}
2270 
2271 	switch (bw) {
2272 	case NL80211_CHAN_WIDTH_80:
2273 	case NL80211_CHAN_WIDTH_80P80:
2274 	case NL80211_CHAN_WIDTH_160:
2275 		break;
2276 	default:
2277 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2278 					   freq + 10);
2279 		if (idx >= 0) {
2280 			freq = freq_bw40[idx];
2281 			break;
2282 		}
2283 
2284 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2285 					   freq - 10);
2286 		if (idx >= 0) {
2287 			freq = freq_bw40[idx];
2288 			break;
2289 		}
2290 		fallthrough;
2291 	case NL80211_CHAN_WIDTH_40:
2292 		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2293 					   freq);
2294 		if (idx >= 0)
2295 			break;
2296 
2297 		return -1;
2298 
2299 	}
2300 
2301 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2302 }
2303 
2304 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2305 {
2306 	struct mt7615_dev *dev = phy->dev;
2307 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2308 	int freq2 = chandef->center_freq2;
2309 	int ret;
2310 	struct {
2311 		u8 direction;
2312 		u8 runtime_calibration;
2313 		u8 _rsv[2];
2314 
2315 		__le16 center_freq;
2316 		u8 bw;
2317 		u8 band;
2318 		u8 is_freq2;
2319 		u8 success;
2320 		u8 dbdc_en;
2321 
2322 		u8 _rsv2;
2323 
2324 		struct {
2325 			__le32 sx0_i_lna[4];
2326 			__le32 sx0_q_lna[4];
2327 
2328 			__le32 sx2_i_lna[4];
2329 			__le32 sx2_q_lna[4];
2330 		} dcoc_data[4];
2331 	} req = {
2332 		.direction = 1,
2333 
2334 		.bw = mt7615_mcu_chan_bw(chandef),
2335 		.band = chandef->center_freq1 > 4000,
2336 		.dbdc_en = !!dev->mt76.phy2,
2337 	};
2338 	u16 center_freq = chandef->center_freq1;
2339 	int freq_idx;
2340 	u8 *eep = dev->mt76.eeprom.data;
2341 
2342 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2343 		return 0;
2344 
2345 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2346 		freq2 = center_freq + 40;
2347 		center_freq -= 40;
2348 	}
2349 
2350 again:
2351 	req.runtime_calibration = 1;
2352 	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2353 	if (freq_idx < 0)
2354 		goto out;
2355 
2356 	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2357 			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2358 	       sizeof(req.dcoc_data));
2359 	req.runtime_calibration = 0;
2360 
2361 out:
2362 	req.center_freq = cpu_to_le16(center_freq);
2363 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RXDCOC_CAL), &req,
2364 				sizeof(req), true);
2365 
2366 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2367 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2368 		req.is_freq2 = true;
2369 		center_freq = freq2;
2370 		goto again;
2371 	}
2372 
2373 	return ret;
2374 }
2375 
2376 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2377 {
2378 	static const u16 freq_list[] = {
2379 		4920, 4940, 4960, 4980,
2380 		5040, 5060, 5080, 5180,
2381 		5200, 5220, 5240, 5260,
2382 		5280, 5300, 5320, 5340,
2383 		5360, 5380, 5400, 5420,
2384 		5440, 5460, 5480, 5500,
2385 		5520, 5540, 5560, 5580,
2386 		5600, 5620, 5640, 5660,
2387 		5680, 5700, 5720, 5745,
2388 		5765, 5785, 5805, 5825,
2389 		5845, 5865, 5885, 5905
2390 	};
2391 	int offset_2g = ARRAY_SIZE(freq_list);
2392 	int idx;
2393 
2394 	if (freq < 4000) {
2395 		if (freq < 2432)
2396 			return offset_2g;
2397 		if (freq < 2457)
2398 			return offset_2g + 1;
2399 
2400 		return offset_2g + 2;
2401 	}
2402 
2403 	if (bw != NL80211_CHAN_WIDTH_20) {
2404 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2405 					   freq + 10);
2406 		if (idx >= 0)
2407 			return idx;
2408 
2409 		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2410 					   freq - 10);
2411 		if (idx >= 0)
2412 			return idx;
2413 	}
2414 
2415 	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2416 }
2417 
2418 
2419 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2420 {
2421 	struct mt7615_dev *dev = phy->dev;
2422 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2423 	int freq2 = chandef->center_freq2;
2424 	int ret;
2425 	struct {
2426 		u8 direction;
2427 		u8 runtime_calibration;
2428 		u8 _rsv[2];
2429 
2430 		__le16 center_freq;
2431 		u8 bw;
2432 		u8 band;
2433 		u8 is_freq2;
2434 		u8 success;
2435 		u8 dbdc_en;
2436 
2437 		u8 _rsv2;
2438 
2439 		struct {
2440 			struct {
2441 				u32 dpd_g0;
2442 				u8 data[32];
2443 			} wf0, wf1;
2444 
2445 			struct {
2446 				u32 dpd_g0_prim;
2447 				u32 dpd_g0_sec;
2448 				u8 data_prim[32];
2449 				u8 data_sec[32];
2450 			} wf2, wf3;
2451 		} dpd_data;
2452 	} req = {
2453 		.direction = 1,
2454 
2455 		.bw = mt7615_mcu_chan_bw(chandef),
2456 		.band = chandef->center_freq1 > 4000,
2457 		.dbdc_en = !!dev->mt76.phy2,
2458 	};
2459 	u16 center_freq = chandef->center_freq1;
2460 	int freq_idx;
2461 	u8 *eep = dev->mt76.eeprom.data;
2462 
2463 	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2464 		return 0;
2465 
2466 	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2467 		freq2 = center_freq + 40;
2468 		center_freq -= 40;
2469 	}
2470 
2471 again:
2472 	req.runtime_calibration = 1;
2473 	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2474 	if (freq_idx < 0)
2475 		goto out;
2476 
2477 	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2478 			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2479 	       sizeof(req.dpd_data));
2480 	req.runtime_calibration = 0;
2481 
2482 out:
2483 	req.center_freq = cpu_to_le16(center_freq);
2484 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXDPD_CAL),
2485 				&req, sizeof(req), true);
2486 
2487 	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2488 	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2489 		req.is_freq2 = true;
2490 		center_freq = freq2;
2491 		goto again;
2492 	}
2493 
2494 	return ret;
2495 }
2496 
2497 int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2498 {
2499 	struct {
2500 		u8 operation;
2501 		u8 count;
2502 		u8 _rsv[2];
2503 		u8 index;
2504 		u8 enable;
2505 		__le16 etype;
2506 	} req = {
2507 		.operation = 1,
2508 		.count = 1,
2509 		.enable = 1,
2510 		.etype = cpu_to_le16(ETH_P_PAE),
2511 	};
2512 
2513 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2514 				 &req, sizeof(req), false);
2515 }
2516 
2517 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2518 			  bool enable)
2519 {
2520 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2521 	struct {
2522 		u8 bss_idx;
2523 		u8 dtim_period;
2524 		__le16 aid;
2525 		__le16 bcn_interval;
2526 		__le16 atim_window;
2527 		u8 uapsd;
2528 		u8 bmc_delivered_ac;
2529 		u8 bmc_triggered_ac;
2530 		u8 pad;
2531 	} req = {
2532 		.bss_idx = mvif->mt76.idx,
2533 		.aid = cpu_to_le16(vif->bss_conf.aid),
2534 		.dtim_period = vif->bss_conf.dtim_period,
2535 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2536 	};
2537 	struct {
2538 		u8 bss_idx;
2539 		u8 pad[3];
2540 	} req_hdr = {
2541 		.bss_idx = mvif->mt76.idx,
2542 	};
2543 	int err;
2544 
2545 	if (vif->type != NL80211_IFTYPE_STATION)
2546 		return 0;
2547 
2548 	err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
2549 				&req_hdr, sizeof(req_hdr), false);
2550 	if (err < 0 || !enable)
2551 		return err;
2552 
2553 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
2554 				 &req, sizeof(req), false);
2555 }
2556 
2557 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2558 		       struct ieee80211_channel *chan, int duration)
2559 {
2560 	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2561 	struct mt7615_dev *dev = phy->dev;
2562 	struct mt7615_roc_tlv req = {
2563 		.bss_idx = mvif->mt76.idx,
2564 		.active = !chan,
2565 		.max_interval = cpu_to_le32(duration),
2566 		.primary_chan = chan ? chan->hw_value : 0,
2567 		.band = chan ? chan->band : 0,
2568 		.req_type = 2,
2569 	};
2570 
2571 	phy->roc_grant = false;
2572 
2573 	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC),
2574 				 &req, sizeof(req), false);
2575 }
2576