mcu.c

   1// SPDX-License-Identifier: BSD-3-Clause-Clear
   2/* Copyright (C) 2019 MediaTek Inc.
   3 *
   4 * Author: Roy Luo <royluo@google.com>
   5 *         Ryder Lee <ryder.lee@mediatek.com>
   6 */
   7
   8#include <linux/firmware.h>
   9#include "mt7615.h"
  10#include "mcu.h"
  11#include "mac.h"
  12#include "eeprom.h"
  13
  14static bool prefer_offload_fw = true;
  15module_param(prefer_offload_fw, bool, 0644);
  16MODULE_PARM_DESC(prefer_offload_fw,
  17		 "Prefer client mode offload firmware (MT7663)");
  18
  19struct mt7615_patch_hdr {
  20	char build_date[16];
  21	char platform[4];
  22	__be32 hw_sw_ver;
  23	__be32 patch_ver;
  24	__be16 checksum;
  25} __packed;
  26
  27struct mt7615_fw_trailer {
  28	__le32 addr;
  29	u8 chip_id;
  30	u8 feature_set;
  31	u8 eco_code;
  32	char fw_ver[10];
  33	char build_date[15];
  34	__le32 len;
  35} __packed;
  36
  37#define FW_V3_COMMON_TAILER_SIZE	36
  38#define FW_V3_REGION_TAILER_SIZE	40
  39#define FW_START_OVERRIDE		BIT(0)
  40#define FW_START_DLYCAL                 BIT(1)
  41#define FW_START_WORKING_PDA_CR4	BIT(2)
  42
  43struct mt7663_fw_buf {
  44	__le32 crc;
  45	__le32 d_img_size;
  46	__le32 block_size;
  47	u8 rsv[4];
  48	__le32 img_dest_addr;
  49	__le32 img_size;
  50	u8 feature_set;
  51};
  52
  53#define MT7615_PATCH_ADDRESS		0x80000
  54#define MT7622_PATCH_ADDRESS		0x9c000
  55#define MT7663_PATCH_ADDRESS		0xdc000
  56
  57#define N9_REGION_NUM			2
  58#define CR4_REGION_NUM			1
  59
  60#define IMG_CRC_LEN			4
  61
  62void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
  63			 int cmd, int *wait_seq)
  64{
  65	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
  66	struct mt7615_uni_txd *uni_txd;
  67	struct mt7615_mcu_txd *mcu_txd;
  68	u8 seq, q_idx, pkt_fmt;
  69	__le32 *txd;
  70	u32 val;
  71
  72	/* TODO: make dynamic based on msg type */
  73	dev->mt76.mcu.timeout = 20 * HZ;
  74
  75	seq = ++dev->mt76.mcu.msg_seq & 0xf;
  76	if (!seq)
  77		seq = ++dev->mt76.mcu.msg_seq & 0xf;
  78	if (wait_seq)
  79		*wait_seq = seq;
  80
  81	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
  82	txd = (__le32 *)skb_push(skb, txd_len);
  83
  84	if (cmd != MCU_CMD(FW_SCATTER)) {
  85		q_idx = MT_TX_MCU_PORT_RX_Q0;
  86		pkt_fmt = MT_TX_TYPE_CMD;
  87	} else {
  88		q_idx = MT_TX_MCU_PORT_RX_FWDL;
  89		pkt_fmt = MT_TX_TYPE_FW;
  90	}
  91
  92	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
  93	      FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
  94	      FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
  95	txd[0] = cpu_to_le32(val);
  96
  97	val = MT_TXD1_LONG_FORMAT |
  98	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
  99	      FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
 100	txd[1] = cpu_to_le32(val);
 101
 102	if (cmd & __MCU_CMD_FIELD_UNI) {
 103		uni_txd = (struct mt7615_uni_txd *)txd;
 104		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 105		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 106		uni_txd->cid = cpu_to_le16(mcu_cmd);
 107		uni_txd->s2d_index = MCU_S2D_H2N;
 108		uni_txd->pkt_type = MCU_PKT_ID;
 109		uni_txd->seq = seq;
 110
 111		return;
 112	}
 113
 114	mcu_txd = (struct mt7615_mcu_txd *)txd;
 115	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 116	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
 117	mcu_txd->s2d_index = MCU_S2D_H2N;
 118	mcu_txd->pkt_type = MCU_PKT_ID;
 119	mcu_txd->seq = seq;
 120	mcu_txd->cid = mcu_cmd;
 121	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 122
 123	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
 124		if (cmd & __MCU_CMD_FIELD_QUERY)
 125			mcu_txd->set_query = MCU_Q_QUERY;
 126		else
 127			mcu_txd->set_query = MCU_Q_SET;
 128		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
 129	} else {
 130		mcu_txd->set_query = MCU_Q_NA;
 131	}
 132}
 133EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
 134
 135int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 136			      struct sk_buff *skb, int seq)
 137{
 138	struct mt7615_mcu_rxd *rxd;
 139	int ret = 0;
 140
 141	if (!skb) {
 142		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 143			cmd, seq);
 144		return -ETIMEDOUT;
 145	}
 146
 147	rxd = (struct mt7615_mcu_rxd *)skb->data;
 148	if (seq != rxd->seq)
 149		return -EAGAIN;
 150
 151	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 152		skb_pull(skb, sizeof(*rxd) - 4);
 153		ret = *skb->data;
 154	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 155		skb_pull(skb, sizeof(*rxd));
 156		ret = le32_to_cpu(*(__le32 *)skb->data);
 157	} else if (cmd == MCU_EXT_QUERY(RF_REG_ACCESS)) {
 158		skb_pull(skb, sizeof(*rxd));
 159		ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
 160	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
 161		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
 162		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
 163		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
 164		   cmd == MCU_UNI_CMD(OFFLOAD) ||
 165		   cmd == MCU_UNI_CMD(SUSPEND)) {
 166		struct mt76_connac_mcu_uni_event *event;
 167
 168		skb_pull(skb, sizeof(*rxd));
 169		event = (struct mt76_connac_mcu_uni_event *)skb->data;
 170		ret = le32_to_cpu(event->status);
 171	} else if (cmd == MCU_CE_QUERY(REG_READ)) {
 172		struct mt76_connac_mcu_reg_event *event;
 173
 174		skb_pull(skb, sizeof(*rxd));
 175		event = (struct mt76_connac_mcu_reg_event *)skb->data;
 176		ret = (int)le32_to_cpu(event->val);
 177	}
 178
 179	return ret;
 180}
 181EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
 182
 183static int
 184mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 185			int cmd, int *seq)
 186{
 187	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 188	enum mt76_mcuq_id qid;
 189
 190	mt7615_mcu_fill_msg(dev, skb, cmd, seq);
 191	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 192		qid = MT_MCUQ_WM;
 193	else
 194		qid = MT_MCUQ_FWDL;
 195
 196	return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
 197}
 198
 199u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
 200{
 201	struct {
 202		__le32 wifi_stream;
 203		__le32 address;
 204		__le32 data;
 205	} req = {
 206		.wifi_stream = cpu_to_le32(wf),
 207		.address = cpu_to_le32(reg),
 208	};
 209
 210	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
 211				 &req, sizeof(req), true);
 212}
 213
 214int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
 215{
 216	struct {
 217		__le32 wifi_stream;
 218		__le32 address;
 219		__le32 data;
 220	} req = {
 221		.wifi_stream = cpu_to_le32(wf),
 222		.address = cpu_to_le32(reg),
 223		.data = cpu_to_le32(val),
 224	};
 225
 226	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
 227				 &req, sizeof(req), false);
 228}
 229
 230void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
 231{
 232	if (!is_mt7622(&dev->mt76))
 233		return;
 234
 235	regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
 236			   MT_INFRACFG_MISC_AP2CONN_WAKE,
 237			   !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
 238}
 239EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
 240
 241static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
 242{
 243	struct mt76_phy *mphy = &dev->mt76.phy;
 244	struct mt76_connac_pm *pm = &dev->pm;
 245	struct mt76_dev *mdev = &dev->mt76;
 246	u32 addr;
 247	int err;
 248
 249	if (is_mt7663(mdev)) {
 250		/* Clear firmware own via N9 eint */
 251		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 252		mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 253
 254		addr = MT_CONN_HIF_ON_LPCTL;
 255	} else {
 256		addr = MT_CFG_LPCR_HOST;
 257	}
 258
 259	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
 260
 261	mt7622_trigger_hif_int(dev, true);
 262
 263	err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 264
 265	mt7622_trigger_hif_int(dev, false);
 266
 267	if (err) {
 268		dev_err(mdev->dev, "driver own failed\n");
 269		return -ETIMEDOUT;
 270	}
 271
 272	clear_bit(MT76_STATE_PM, &mphy->state);
 273
 274	pm->stats.last_wake_event = jiffies;
 275	pm->stats.doze_time += pm->stats.last_wake_event -
 276			       pm->stats.last_doze_event;
 277
 278	return 0;
 279}
 280
 281static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
 282{
 283	struct mt76_phy *mphy = &dev->mt76.phy;
 284	struct mt76_connac_pm *pm = &dev->pm;
 285	int i, err = 0;
 286
 287	mutex_lock(&pm->mutex);
 288
 289	if (!test_bit(MT76_STATE_PM, &mphy->state))
 290		goto out;
 291
 292	for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
 293		mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 294		if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
 295				   MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
 296			break;
 297	}
 298
 299	if (i == MT7615_DRV_OWN_RETRY_COUNT) {
 300		dev_err(dev->mt76.dev, "driver own failed\n");
 301		err = -EIO;
 302		goto out;
 303	}
 304	clear_bit(MT76_STATE_PM, &mphy->state);
 305
 306	pm->stats.last_wake_event = jiffies;
 307	pm->stats.doze_time += pm->stats.last_wake_event -
 308			       pm->stats.last_doze_event;
 309out:
 310	mutex_unlock(&pm->mutex);
 311
 312	return err;
 313}
 314
 315static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
 316{
 317	struct mt76_phy *mphy = &dev->mt76.phy;
 318	struct mt76_connac_pm *pm = &dev->pm;
 319	int err = 0;
 320	u32 addr;
 321
 322	mutex_lock(&pm->mutex);
 323
 324	if (mt76_connac_skip_fw_pmctrl(mphy, pm))
 325		goto out;
 326
 327	mt7622_trigger_hif_int(dev, true);
 328
 329	addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 330	mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
 331
 332	if (is_mt7622(&dev->mt76) &&
 333	    !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
 334			    MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
 335		dev_err(dev->mt76.dev, "Timeout for firmware own\n");
 336		clear_bit(MT76_STATE_PM, &mphy->state);
 337		err = -EIO;
 338	}
 339
 340	mt7622_trigger_hif_int(dev, false);
 341	if (!err) {
 342		pm->stats.last_doze_event = jiffies;
 343		pm->stats.awake_time += pm->stats.last_doze_event -
 344					pm->stats.last_wake_event;
 345	}
 346out:
 347	mutex_unlock(&pm->mutex);
 348
 349	return err;
 350}
 351
 352static void
 353mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 354{
 355	if (vif->bss_conf.csa_active)
 356		ieee80211_csa_finish(vif, 0);
 357}
 358
 359static void
 360mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
 361{
 362	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
 363	struct mt76_phy *mphy = &dev->mt76.phy;
 364	struct mt7615_mcu_csa_notify *c;
 365
 366	c = (struct mt7615_mcu_csa_notify *)skb->data;
 367
 368	if (c->omac_idx > EXT_BSSID_MAX)
 369		return;
 370
 371	if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
 372		mphy = dev->mt76.phys[MT_BAND1];
 373
 374	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 375			IEEE80211_IFACE_ITER_RESUME_ALL,
 376			mt7615_mcu_csa_finish, mphy->hw);
 377}
 378
 379static void
 380mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 381{
 382	struct mt76_phy *mphy = &dev->mt76.phy;
 383	struct mt7615_mcu_rdd_report *r;
 384
 385	r = (struct mt7615_mcu_rdd_report *)skb->data;
 386
 387	if (!dev->radar_pattern.n_pulses && !r->long_detected &&
 388	    !r->constant_prf_detected && !r->staggered_prf_detected)
 389		return;
 390
 391	if (r->band_idx && dev->mt76.phys[MT_BAND1])
 392		mphy = dev->mt76.phys[MT_BAND1];
 393
 394	if (mt76_phy_dfs_state(mphy) < MT_DFS_STATE_CAC)
 395		return;
 396
 397	ieee80211_radar_detected(mphy->hw, NULL);
 398	dev->hw_pattern++;
 399}
 400
 401static void
 402mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
 403{
 404	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 405	const char *data = (char *)&rxd[1];
 406	const char *type;
 407
 408	switch (rxd->s2d_index) {
 409	case 0:
 410		type = "N9";
 411		break;
 412	case 2:
 413		type = "CR4";
 414		break;
 415	default:
 416		type = "unknown";
 417		break;
 418	}
 419
 420	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
 421		   (int)(skb->len - sizeof(*rxd)), data);
 422}
 423
 424static void
 425mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 426{
 427	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 428
 429	switch (rxd->ext_eid) {
 430	case MCU_EXT_EVENT_RDD_REPORT:
 431		mt7615_mcu_rx_radar_detected(dev, skb);
 432		break;
 433	case MCU_EXT_EVENT_CSA_NOTIFY:
 434		mt7615_mcu_rx_csa_notify(dev, skb);
 435		break;
 436	case MCU_EXT_EVENT_FW_LOG_2_HOST:
 437		mt7615_mcu_rx_log_message(dev, skb);
 438		break;
 439	default:
 440		break;
 441	}
 442}
 443
 444static void
 445mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
 446{
 447	u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
 448	struct mt7615_phy *phy;
 449	struct mt76_phy *mphy;
 450
 451	if (*seq_num & BIT(7) && dev->mt76.phys[MT_BAND1])
 452		mphy = dev->mt76.phys[MT_BAND1];
 453	else
 454		mphy = &dev->mt76.phy;
 455
 456	phy = mphy->priv;
 457
 458	spin_lock_bh(&dev->mt76.lock);
 459	__skb_queue_tail(&phy->scan_event_list, skb);
 460	spin_unlock_bh(&dev->mt76.lock);
 461
 462	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 463				     MT7615_HW_SCAN_TIMEOUT);
 464}
 465
 466static void
 467mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
 468{
 469	struct mt7615_roc_tlv *event;
 470	struct mt7615_phy *phy;
 471	struct mt76_phy *mphy;
 472	int duration;
 473
 474	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 475	event = (struct mt7615_roc_tlv *)skb->data;
 476
 477	if (event->dbdc_band && dev->mt76.phys[MT_BAND1])
 478		mphy = dev->mt76.phys[MT_BAND1];
 479	else
 480		mphy = &dev->mt76.phy;
 481
 482	ieee80211_ready_on_channel(mphy->hw);
 483
 484	phy = mphy->priv;
 485	phy->roc_grant = true;
 486	wake_up(&phy->roc_wait);
 487
 488	duration = le32_to_cpu(event->max_interval);
 489	mod_timer(&phy->roc_timer,
 490		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
 491}
 492
 493static void
 494mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 495{
 496	struct mt76_connac_beacon_loss_event *event;
 497	struct mt76_phy *mphy;
 498	u8 band_idx = 0; /* DBDC support */
 499
 500	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 501	event = (struct mt76_connac_beacon_loss_event *)skb->data;
 502	if (band_idx && dev->mt76.phys[MT_BAND1])
 503		mphy = dev->mt76.phys[MT_BAND1];
 504	else
 505		mphy = &dev->mt76.phy;
 506
 507	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 508					IEEE80211_IFACE_ITER_RESUME_ALL,
 509					mt76_connac_mcu_beacon_loss_iter,
 510					event);
 511}
 512
 513static void
 514mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 515{
 516	struct mt76_connac_mcu_bss_event *event;
 517	struct mt76_phy *mphy;
 518	u8 band_idx = 0; /* DBDC support */
 519
 520	skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 521	event = (struct mt76_connac_mcu_bss_event *)skb->data;
 522
 523	if (band_idx && dev->mt76.phys[MT_BAND1])
 524		mphy = dev->mt76.phys[MT_BAND1];
 525	else
 526		mphy = &dev->mt76.phy;
 527
 528	if (event->is_absent)
 529		ieee80211_stop_queues(mphy->hw);
 530	else
 531		ieee80211_wake_queues(mphy->hw);
 532}
 533
 534static void
 535mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 536{
 537	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 538
 539	switch (rxd->eid) {
 540	case MCU_EVENT_EXT:
 541		mt7615_mcu_rx_ext_event(dev, skb);
 542		break;
 543	case MCU_EVENT_BSS_BEACON_LOSS:
 544		mt7615_mcu_beacon_loss_event(dev, skb);
 545		break;
 546	case MCU_EVENT_ROC:
 547		mt7615_mcu_roc_event(dev, skb);
 548		break;
 549	case MCU_EVENT_SCHED_SCAN_DONE:
 550	case MCU_EVENT_SCAN_DONE:
 551		mt7615_mcu_scan_event(dev, skb);
 552		return;
 553	case MCU_EVENT_BSS_ABSENCE:
 554		mt7615_mcu_bss_event(dev, skb);
 555		break;
 556	case MCU_EVENT_COREDUMP:
 557		mt76_connac_mcu_coredump_event(&dev->mt76, skb,
 558					       &dev->coredump);
 559		return;
 560	default:
 561		break;
 562	}
 563	dev_kfree_skb(skb);
 564}
 565
 566void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 567{
 568	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 569
 570	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 571	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 572	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 573	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 574	    rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 575	    rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 576	    rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 577	    rxd->eid == MCU_EVENT_SCAN_DONE ||
 578	    rxd->eid == MCU_EVENT_COREDUMP ||
 579	    rxd->eid == MCU_EVENT_ROC ||
 580	    !rxd->seq)
 581		mt7615_mcu_rx_unsolicited_event(dev, skb);
 582	else
 583		mt76_mcu_rx_event(&dev->mt76, skb);
 584}
 585
 586static int
 587mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 588		       bool bssid, bool enable)
 589{
 590	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 591	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
 592	u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
 593	const u8 *addr = vif->addr;
 594	struct {
 595		u8 mode;
 596		u8 force_clear;
 597		u8 clear_bitmap[8];
 598		u8 entry_count;
 599		u8 write;
 600
 601		u8 index;
 602		u8 bssid;
 603		u8 addr[ETH_ALEN];
 604	} __packed req = {
 605		.mode = !!mask || enable,
 606		.entry_count = 1,
 607		.write = 1,
 608
 609		.index = idx * 2 + bssid,
 610	};
 611
 612	if (bssid)
 613		addr = vif->bss_conf.bssid;
 614
 615	if (enable)
 616		ether_addr_copy(req.addr, addr);
 617
 618	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE),
 619				 &req, sizeof(req), true);
 620}
 621
 622static int
 623mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 624		   bool enable)
 625{
 626	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 627	struct mt7615_dev *dev = phy->dev;
 628	struct {
 629		struct req_hdr {
 630			u8 omac_idx;
 631			u8 band_idx;
 632			__le16 tlv_num;
 633			u8 is_tlv_append;
 634			u8 rsv[3];
 635		} __packed hdr;
 636		struct req_tlv {
 637			__le16 tag;
 638			__le16 len;
 639			u8 active;
 640			u8 band_idx;
 641			u8 omac_addr[ETH_ALEN];
 642		} __packed tlv;
 643	} data = {
 644		.hdr = {
 645			.omac_idx = mvif->mt76.omac_idx,
 646			.band_idx = mvif->mt76.band_idx,
 647			.tlv_num = cpu_to_le16(1),
 648			.is_tlv_append = 1,
 649		},
 650		.tlv = {
 651			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
 652			.len = cpu_to_le16(sizeof(struct req_tlv)),
 653			.active = enable,
 654			.band_idx = mvif->mt76.band_idx,
 655		},
 656	};
 657
 658	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
 659		return mt7615_mcu_muar_config(dev, vif, false, enable);
 660
 661	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 662	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
 663				 &data, sizeof(data), true);
 664}
 665
 666static int
 667mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
 668			      struct ieee80211_hw *hw,
 669			      struct ieee80211_vif *vif, bool enable)
 670{
 671	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 672	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
 673	struct ieee80211_mutable_offsets offs;
 674	struct ieee80211_tx_info *info;
 675	struct req {
 676		u8 omac_idx;
 677		u8 enable;
 678		u8 wlan_idx;
 679		u8 band_idx;
 680		u8 pkt_type;
 681		u8 need_pre_tbtt_int;
 682		__le16 csa_ie_pos;
 683		__le16 pkt_len;
 684		__le16 tim_ie_pos;
 685		u8 pkt[512];
 686		u8 csa_cnt;
 687		/* bss color change */
 688		u8 bcc_cnt;
 689		__le16 bcc_ie_pos;
 690	} __packed req = {
 691		.omac_idx = mvif->mt76.omac_idx,
 692		.enable = enable,
 693		.wlan_idx = wcid->idx,
 694		.band_idx = mvif->mt76.band_idx,
 695	};
 696	struct sk_buff *skb;
 697
 698	if (!enable)
 699		goto out;
 700
 701	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
 702	if (!skb)
 703		return -EINVAL;
 704
 705	if (skb->len > 512 - MT_TXD_SIZE) {
 706		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
 707		dev_kfree_skb(skb);
 708		return -EINVAL;
 709	}
 710
 711	info = IEEE80211_SKB_CB(skb);
 712	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, mvif->mt76.band_idx);
 713
 714	mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
 715			      0, NULL, 0, true);
 716	memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
 717	req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 718	req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
 719	if (offs.cntdwn_counter_offs[0]) {
 720		u16 csa_offs;
 721
 722		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
 723		req.csa_ie_pos = cpu_to_le16(csa_offs);
 724		req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
 725	}
 726	dev_kfree_skb(skb);
 727
 728out:
 729	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(BCN_OFFLOAD), &req,
 730				 sizeof(req), true);
 731}
 732
 733static int
 734mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
 735{
 736	return mt76_connac_mcu_set_pm(&dev->mt76, band, state);
 737}
 738
 739static int
 740mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 741		   struct ieee80211_sta *sta, bool enable)
 742{
 743	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 744	struct mt7615_dev *dev = phy->dev;
 745	struct sk_buff *skb;
 746
 747	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
 748		mt7615_mcu_muar_config(dev, vif, true, enable);
 749
 750	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
 751	if (IS_ERR(skb))
 752		return PTR_ERR(skb);
 753
 754	if (enable)
 755		mt76_connac_mcu_bss_omac_tlv(skb, vif);
 756
 757	mt76_connac_mcu_bss_basic_tlv(skb, vif, sta, phy->mt76,
 758				      mvif->sta.wcid.idx, enable);
 759
 760	if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
 761	    mvif->mt76.omac_idx < REPEATER_BSSID_START)
 762		mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
 763
 764	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 765				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
 766}
 767
 768static int
 769mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
 770		      struct ieee80211_ampdu_params *params,
 771		      bool enable)
 772{
 773	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 774	struct mt7615_vif *mvif = msta->vif;
 775	struct wtbl_req_hdr *wtbl_hdr;
 776	struct sk_buff *skb = NULL;
 777	int err;
 778
 779	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 780						  WTBL_SET, NULL, &skb);
 781	if (IS_ERR(wtbl_hdr))
 782		return PTR_ERR(wtbl_hdr);
 783
 784	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
 785				    NULL, wtbl_hdr);
 786
 787	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 788				    MCU_EXT_CMD(WTBL_UPDATE), true);
 789	if (err < 0)
 790		return err;
 791
 792	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 793					    &msta->wcid);
 794	if (IS_ERR(skb))
 795		return PTR_ERR(skb);
 796
 797	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
 798
 799	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 800				     MCU_EXT_CMD(STA_REC_UPDATE), true);
 801}
 802
 803static int
 804mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
 805		      struct ieee80211_ampdu_params *params,
 806		      bool enable)
 807{
 808	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 809	struct mt7615_vif *mvif = msta->vif;
 810	struct wtbl_req_hdr *wtbl_hdr;
 811	struct sk_buff *skb;
 812	int err;
 813
 814	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 815					    &msta->wcid);
 816	if (IS_ERR(skb))
 817		return PTR_ERR(skb);
 818
 819	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
 820
 821	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 822				    MCU_EXT_CMD(STA_REC_UPDATE), true);
 823	if (err < 0 || !enable)
 824		return err;
 825
 826	skb = NULL;
 827	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 828						  WTBL_SET, NULL, &skb);
 829	if (IS_ERR(wtbl_hdr))
 830		return PTR_ERR(wtbl_hdr);
 831
 832	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
 833				    NULL, wtbl_hdr);
 834
 835	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 836				     MCU_EXT_CMD(WTBL_UPDATE), true);
 837}
 838
 839static int
 840mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 841			struct ieee80211_sta *sta, bool enable)
 842{
 843	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 844	struct sk_buff *skb, *sskb, *wskb = NULL;
 845	struct ieee80211_link_sta *link_sta;
 846	struct mt7615_dev *dev = phy->dev;
 847	struct wtbl_req_hdr *wtbl_hdr;
 848	struct mt7615_sta *msta;
 849	bool new_entry = true;
 850	int conn_state;
 851	int cmd, err;
 852
 853	msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
 854	link_sta = sta ? &sta->deflink : NULL;
 855
 856	sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 857					     &msta->wcid);
 858	if (IS_ERR(sskb))
 859		return PTR_ERR(sskb);
 860
 861	if (!sta) {
 862		if (mvif->sta_added)
 863			new_entry = false;
 864		else
 865			mvif->sta_added = true;
 866	}
 867	conn_state = enable ? CONN_STATE_PORT_SECURE : CONN_STATE_DISCONNECT;
 868	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, &vif->bss_conf,
 869				      link_sta, conn_state, new_entry);
 870	if (enable && sta)
 871		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
 872					MT76_STA_INFO_STATE_ASSOC);
 873
 874	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 875						  WTBL_RESET_AND_SET, NULL,
 876						  &wskb);
 877	if (IS_ERR(wtbl_hdr)) {
 878		dev_kfree_skb(sskb);
 879		return PTR_ERR(wtbl_hdr);
 880	}
 881
 882	if (enable) {
 883		mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
 884						 NULL, wtbl_hdr);
 885		if (sta)
 886			mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
 887						    NULL, wtbl_hdr, true, true);
 888		mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, vif, &msta->wcid,
 889						   NULL, wtbl_hdr);
 890	}
 891
 892	cmd = enable ? MCU_EXT_CMD(WTBL_UPDATE) : MCU_EXT_CMD(STA_REC_UPDATE);
 893	skb = enable ? wskb : sskb;
 894
 895	err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
 896	if (err < 0) {
 897		skb = enable ? sskb : wskb;
 898		dev_kfree_skb(skb);
 899
 900		return err;
 901	}
 902
 903	cmd = enable ? MCU_EXT_CMD(STA_REC_UPDATE) : MCU_EXT_CMD(WTBL_UPDATE);
 904	skb = enable ? sskb : wskb;
 905
 906	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
 907}
 908
 909static int
 910mt7615_mcu_wtbl_update_hdr_trans(struct mt7615_dev *dev,
 911				 struct ieee80211_vif *vif,
 912				 struct ieee80211_sta *sta)
 913{
 914	return mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
 915}
 916
 917static const struct mt7615_mcu_ops wtbl_update_ops = {
 918	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
 919	.set_pm_state = mt7615_mcu_ctrl_pm_state,
 920	.add_dev_info = mt7615_mcu_add_dev,
 921	.add_bss_info = mt7615_mcu_add_bss,
 922	.add_tx_ba = mt7615_mcu_wtbl_tx_ba,
 923	.add_rx_ba = mt7615_mcu_wtbl_rx_ba,
 924	.sta_add = mt7615_mcu_wtbl_sta_add,
 925	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
 926	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
 927	.set_sta_decap_offload = mt7615_mcu_wtbl_update_hdr_trans,
 928};
 929
 930static int
 931mt7615_mcu_sta_ba(struct mt7615_dev *dev,
 932		  struct ieee80211_ampdu_params *params,
 933		  bool enable, bool tx)
 934{
 935	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 936	struct mt7615_vif *mvif = msta->vif;
 937	struct wtbl_req_hdr *wtbl_hdr;
 938	struct tlv *sta_wtbl;
 939	struct sk_buff *skb;
 940
 941	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 942					    &msta->wcid);
 943	if (IS_ERR(skb))
 944		return PTR_ERR(skb);
 945
 946	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
 947
 948	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
 949
 950	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 951						  WTBL_SET, sta_wtbl, &skb);
 952	if (IS_ERR(wtbl_hdr))
 953		return PTR_ERR(wtbl_hdr);
 954
 955	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
 956				    sta_wtbl, wtbl_hdr);
 957
 958	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 959				     MCU_EXT_CMD(STA_REC_UPDATE), true);
 960}
 961
 962static int
 963mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
 964		     struct ieee80211_ampdu_params *params,
 965		     bool enable)
 966{
 967	return mt7615_mcu_sta_ba(dev, params, enable, true);
 968}
 969
 970static int
 971mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
 972		     struct ieee80211_ampdu_params *params,
 973		     bool enable)
 974{
 975	return mt7615_mcu_sta_ba(dev, params, enable, false);
 976}
 977
 978static int
 979__mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
 980		     struct ieee80211_sta *sta, bool enable, int cmd,
 981		     bool offload_fw)
 982{
 983	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 984	struct mt76_sta_cmd_info info = {
 985		.sta = sta,
 986		.vif = vif,
 987		.offload_fw = offload_fw,
 988		.enable = enable,
 989		.newly = true,
 990		.cmd = cmd,
 991	};
 992
 993	info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
 994	return mt76_connac_mcu_sta_cmd(phy, &info);
 995}
 996
 997static int
 998mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 999		   struct ieee80211_sta *sta, bool enable)
1000{
1001	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1002				    MCU_EXT_CMD(STA_REC_UPDATE), false);
1003}
1004
1005static int
1006mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1007				struct ieee80211_vif *vif,
1008				struct ieee80211_sta *sta)
1009{
1010	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1011
1012	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1013						    vif, &msta->wcid,
1014						    MCU_EXT_CMD(STA_REC_UPDATE));
1015}
1016
1017static const struct mt7615_mcu_ops sta_update_ops = {
1018	.add_beacon_offload = mt7615_mcu_add_beacon_offload,
1019	.set_pm_state = mt7615_mcu_ctrl_pm_state,
1020	.add_dev_info = mt7615_mcu_add_dev,
1021	.add_bss_info = mt7615_mcu_add_bss,
1022	.add_tx_ba = mt7615_mcu_sta_tx_ba,
1023	.add_rx_ba = mt7615_mcu_sta_rx_ba,
1024	.sta_add = mt7615_mcu_add_sta,
1025	.set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1026	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1027	.set_sta_decap_offload = mt7615_mcu_sta_update_hdr_trans,
1028};
1029
1030static int
1031mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1032{
1033	return 0;
1034}
1035
1036static int
1037mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1038				  struct ieee80211_hw *hw,
1039				  struct ieee80211_vif *vif,
1040				  bool enable)
1041{
1042	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1043	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1044	struct ieee80211_mutable_offsets offs;
1045	struct {
1046		struct req_hdr {
1047			u8 bss_idx;
1048			u8 pad[3];
1049		} __packed hdr;
1050		struct bcn_content_tlv {
1051			__le16 tag;
1052			__le16 len;
1053			__le16 tim_ie_pos;
1054			__le16 csa_ie_pos;
1055			__le16 bcc_ie_pos;
1056			/* 0: disable beacon offload
1057			 * 1: enable beacon offload
1058			 * 2: update probe respond offload
1059			 */
1060			u8 enable;
1061			/* 0: legacy format (TXD + payload)
1062			 * 1: only cap field IE
1063			 */
1064			u8 type;
1065			__le16 pkt_len;
1066			u8 pkt[512];
1067		} __packed beacon_tlv;
1068	} req = {
1069		.hdr = {
1070			.bss_idx = mvif->mt76.idx,
1071		},
1072		.beacon_tlv = {
1073			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1074			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1075			.enable = enable,
1076		},
1077	};
1078	struct sk_buff *skb;
1079
1080	if (!enable)
1081		goto out;
1082
1083	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
1084	if (!skb)
1085		return -EINVAL;
1086
1087	if (skb->len > 512 - MT_TXD_SIZE) {
1088		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1089		dev_kfree_skb(skb);
1090		return -EINVAL;
1091	}
1092
1093	mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1094			      wcid, NULL, 0, NULL, 0, true);
1095	memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1096	req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1097	req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1098
1099	if (offs.cntdwn_counter_offs[0]) {
1100		u16 csa_offs;
1101
1102		csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1103		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1104	}
1105	dev_kfree_skb(skb);
1106
1107out:
1108	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1109				 &req, sizeof(req), true);
1110}
1111
1112static int
1113mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1114		       bool enable)
1115{
1116	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1117
1118	return mt76_connac_mcu_uni_add_dev(phy->mt76, &vif->bss_conf, &mvif->mt76,
1119					   &mvif->sta.wcid, enable);
1120}
1121
1122static int
1123mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1124		       struct ieee80211_sta *sta, bool enable)
1125{
1126	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1127
1128	return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1129					   enable, NULL);
1130}
1131
1132static inline int
1133mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1134		       struct ieee80211_sta *sta, bool enable)
1135{
1136	return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1137				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1138}
1139
1140static int
1141mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1142		     struct ieee80211_ampdu_params *params,
1143		     bool enable)
1144{
1145	struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1146
1147	return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1148				      MCU_UNI_CMD(STA_REC_UPDATE), enable,
1149				      true);
1150}
1151
1152static int
1153mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1154		     struct ieee80211_ampdu_params *params,
1155		     bool enable)
1156{
1157	struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1158	struct mt7615_vif *mvif = msta->vif;
1159	struct wtbl_req_hdr *wtbl_hdr;
1160	struct tlv *sta_wtbl;
1161	struct sk_buff *skb;
1162	int err;
1163
1164	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1165					    &msta->wcid);
1166	if (IS_ERR(skb))
1167		return PTR_ERR(skb);
1168
1169	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1170
1171	err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1172				    MCU_UNI_CMD(STA_REC_UPDATE), true);
1173	if (err < 0 || !enable)
1174		return err;
1175
1176	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1177					    &msta->wcid);
1178	if (IS_ERR(skb))
1179		return PTR_ERR(skb);
1180
1181	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1182					   sizeof(struct tlv));
1183
1184	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1185						  WTBL_SET, sta_wtbl, &skb);
1186	if (IS_ERR(wtbl_hdr))
1187		return PTR_ERR(wtbl_hdr);
1188
1189	mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1190				    sta_wtbl, wtbl_hdr);
1191
1192	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1193				     MCU_UNI_CMD(STA_REC_UPDATE), true);
1194}
1195
1196static int
1197mt7615_mcu_sta_uni_update_hdr_trans(struct mt7615_dev *dev,
1198				    struct ieee80211_vif *vif,
1199				    struct ieee80211_sta *sta)
1200{
1201	struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1202
1203	return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1204						    vif, &msta->wcid,
1205						    MCU_UNI_CMD(STA_REC_UPDATE));
1206}
1207
1208static const struct mt7615_mcu_ops uni_update_ops = {
1209	.add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1210	.set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1211	.add_dev_info = mt7615_mcu_uni_add_dev,
1212	.add_bss_info = mt7615_mcu_uni_add_bss,
1213	.add_tx_ba = mt7615_mcu_uni_tx_ba,
1214	.add_rx_ba = mt7615_mcu_uni_rx_ba,
1215	.sta_add = mt7615_mcu_uni_add_sta,
1216	.set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1217	.set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1218	.set_sta_decap_offload = mt7615_mcu_sta_uni_update_hdr_trans,
1219};
1220
1221int mt7615_mcu_restart(struct mt76_dev *dev)
1222{
1223	return mt76_mcu_send_msg(dev, MCU_CMD(RESTART_DL_REQ), NULL, 0, true);
1224}
1225EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1226
1227static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1228{
1229	const struct mt7615_patch_hdr *hdr;
1230	const struct firmware *fw = NULL;
1231	int len, ret, sem;
1232
1233	ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1234	if (ret)
1235		return ret;
1236
1237	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1238		dev_err(dev->mt76.dev, "Invalid firmware\n");
1239		ret = -EINVAL;
1240		goto release_fw;
1241	}
1242
1243	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1244	switch (sem) {
1245	case PATCH_IS_DL:
1246		goto release_fw;
1247	case PATCH_NOT_DL_SEM_SUCCESS:
1248		break;
1249	default:
1250		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1251		ret = -EAGAIN;
1252		goto release_fw;
1253	}
1254
1255	hdr = (const struct mt7615_patch_hdr *)(fw->data);
1256
1257	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1258		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1259
1260	len = fw->size - sizeof(*hdr);
1261
1262	ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1263					    DL_MODE_NEED_RSP);
1264	if (ret) {
1265		dev_err(dev->mt76.dev, "Download request failed\n");
1266		goto out;
1267	}
1268
1269	ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1270				     fw->data + sizeof(*hdr), len);
1271	if (ret) {
1272		dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1273		goto out;
1274	}
1275
1276	ret = mt76_connac_mcu_start_patch(&dev->mt76);
1277	if (ret)
1278		dev_err(dev->mt76.dev, "Failed to start patch\n");
1279
1280out:
1281	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1282	switch (sem) {
1283	case PATCH_REL_SEM_SUCCESS:
1284		break;
1285	default:
1286		ret = -EAGAIN;
1287		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1288		break;
1289	}
1290
1291release_fw:
1292	release_firmware(fw);
1293
1294	return ret;
1295}
1296
1297static int
1298mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1299			     const struct mt7615_fw_trailer *hdr,
1300			     const u8 *data, bool is_cr4)
1301{
1302	int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1303	int err, i, offset = 0;
1304	u32 len, addr, mode;
1305
1306	for (i = 0; i < n_region; i++) {
1307		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1308						   hdr[i].feature_set, is_cr4);
1309		len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1310		addr = le32_to_cpu(hdr[i].addr);
1311
1312		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1313						    mode);
1314		if (err) {
1315			dev_err(dev->mt76.dev, "Download request failed\n");
1316			return err;
1317		}
1318
1319		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1320					     data + offset, len);
1321		if (err) {
1322			dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1323			return err;
1324		}
1325
1326		offset += len;
1327	}
1328
1329	return 0;
1330}
1331
1332static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1333{
1334	const struct mt7615_fw_trailer *hdr;
1335	const struct firmware *fw;
1336	int ret;
1337
1338	ret = request_firmware(&fw, name, dev->mt76.dev);
1339	if (ret)
1340		return ret;
1341
1342	if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1343		dev_err(dev->mt76.dev, "Invalid firmware\n");
1344		ret = -EINVAL;
1345		goto out;
1346	}
1347
1348	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1349					N9_REGION_NUM * sizeof(*hdr));
1350
1351	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1352		 hdr->fw_ver, hdr->build_date);
1353
1354	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1355	if (ret)
1356		goto out;
1357
1358	ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1359					     le32_to_cpu(hdr->addr),
1360					     FW_START_OVERRIDE);
1361	if (ret) {
1362		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1363		goto out;
1364	}
1365
1366	snprintf(dev->mt76.hw->wiphy->fw_version,
1367		 sizeof(dev->mt76.hw->wiphy->fw_version),
1368		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1369
1370	if (!is_mt7615(&dev->mt76)) {
1371		dev->fw_ver = MT7615_FIRMWARE_V2;
1372		dev->mcu_ops = &sta_update_ops;
1373	} else {
1374		dev->fw_ver = MT7615_FIRMWARE_V1;
1375		dev->mcu_ops = &wtbl_update_ops;
1376	}
1377
1378out:
1379	release_firmware(fw);
1380	return ret;
1381}
1382
1383static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1384{
1385	const struct mt7615_fw_trailer *hdr;
1386	const struct firmware *fw;
1387	int ret;
1388
1389	ret = request_firmware(&fw, name, dev->mt76.dev);
1390	if (ret)
1391		return ret;
1392
1393	if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1394		dev_err(dev->mt76.dev, "Invalid firmware\n");
1395		ret = -EINVAL;
1396		goto out;
1397	}
1398
1399	hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1400					CR4_REGION_NUM * sizeof(*hdr));
1401
1402	dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1403		 hdr->fw_ver, hdr->build_date);
1404
1405	ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1406	if (ret)
1407		goto out;
1408
1409	ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1410					     FW_START_WORKING_PDA_CR4);
1411	if (ret) {
1412		dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1413		goto out;
1414	}
1415
1416out:
1417	release_firmware(fw);
1418
1419	return ret;
1420}
1421
1422static int mt7615_load_ram(struct mt7615_dev *dev)
1423{
1424	int ret;
1425
1426	ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1427	if (ret)
1428		return ret;
1429
1430	return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1431}
1432
1433static int mt7615_load_firmware(struct mt7615_dev *dev)
1434{
1435	int ret;
1436	u32 val;
1437
1438	val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1439
1440	if (val != FW_STATE_FW_DOWNLOAD) {
1441		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1442		return -EIO;
1443	}
1444
1445	ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1446	if (ret)
1447		return ret;
1448
1449	ret = mt7615_load_ram(dev);
1450	if (ret)
1451		return ret;
1452
1453	if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1454			    FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1455				       FW_STATE_RDY), 500)) {
1456		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1457		return -EIO;
1458	}
1459
1460	return 0;
1461}
1462
1463static int mt7622_load_firmware(struct mt7615_dev *dev)
1464{
1465	int ret;
1466	u32 val;
1467
1468	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1469
1470	val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1471	if (val != FW_STATE_FW_DOWNLOAD) {
1472		dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1473		return -EIO;
1474	}
1475
1476	ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1477	if (ret)
1478		return ret;
1479
1480	ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1481	if (ret)
1482		return ret;
1483
1484	if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1485			    FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1486				       FW_STATE_NORMAL_TRX), 1500)) {
1487		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1488		return -EIO;
1489	}
1490
1491	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1492
1493	return 0;
1494}
1495
1496int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1497{
1498	struct {
1499		u8 ctrl_val;
1500		u8 pad[3];
1501	} data = {
1502		.ctrl_val = ctrl
1503	};
1504
1505	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST),
1506				 &data, sizeof(data), true);
1507}
1508
1509static int mt7615_mcu_cal_cache_apply(struct mt7615_dev *dev)
1510{
1511	struct {
1512		bool cache_enable;
1513		u8 pad[3];
1514	} data = {
1515		.cache_enable = true
1516	};
1517
1518	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CAL_CACHE), &data,
1519				 sizeof(data), false);
1520}
1521
1522static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1523{
1524	u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1525	const struct mt76_connac2_fw_trailer *hdr;
1526	const struct mt7663_fw_buf *buf;
1527	const struct firmware *fw;
1528	const u8 *base_addr;
1529	int i, ret;
1530
1531	ret = request_firmware(&fw, name, dev->mt76.dev);
1532	if (ret)
1533		return ret;
1534
1535	if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1536		dev_err(dev->mt76.dev, "Invalid firmware\n");
1537		ret = -EINVAL;
1538		goto out;
1539	}
1540
1541	hdr = (const void *)(fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE);
1542	dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1543		 hdr->fw_ver, hdr->build_date);
1544	dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1545
1546	base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1547	for (i = 0; i < hdr->n_region; i++) {
1548		u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1549		u32 len, addr, mode;
1550
1551		dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1552
1553		buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1554		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
1555						   buf->feature_set, false);
1556		addr = le32_to_cpu(buf->img_dest_addr);
1557		len = le32_to_cpu(buf->img_size);
1558
1559		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1560						    mode);
1561		if (ret) {
1562			dev_err(dev->mt76.dev, "Download request failed\n");
1563			goto out;
1564		}
1565
1566		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1567					     fw->data + offset, len);
1568		if (ret) {
1569			dev_err(dev->mt76.dev, "Failed to send firmware\n");
1570			goto out;
1571		}
1572
1573		offset += le32_to_cpu(buf->img_size);
1574		if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1575			override_addr = le32_to_cpu(buf->img_dest_addr);
1576			dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1577				 i, override_addr);
1578		}
1579	}
1580
1581	if (override_addr)
1582		flag |= FW_START_OVERRIDE;
1583
1584	dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1585		 override_addr, flag);
1586
1587	ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1588	if (ret) {
1589		dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1590		goto out;
1591	}
1592
1593	snprintf(dev->mt76.hw->wiphy->fw_version,
1594		 sizeof(dev->mt76.hw->wiphy->fw_version),
1595		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1596
1597out:
1598	release_firmware(fw);
1599
1600	return ret;
1601}
1602
1603static int
1604mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1605{
1606	const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1607	const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1608	int ret;
1609
1610	if (!prefer_offload_fw) {
1611		secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1612		primary_rom = MT7663_ROM_PATCH;
1613	}
1614	selected_rom = primary_rom;
1615
1616	ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1617	if (ret) {
1618		dev_info(dev->mt76.dev, "%s not found, switching to %s",
1619			 primary_rom, secondary_rom);
1620		ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1621					secondary_rom);
1622		if (ret) {
1623			dev_err(dev->mt76.dev, "failed to load %s",
1624				secondary_rom);
1625			return ret;
1626		}
1627		selected_rom = secondary_rom;
1628	}
1629
1630	if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1631		*n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1632		dev->fw_ver = MT7615_FIRMWARE_V3;
1633		dev->mcu_ops = &uni_update_ops;
1634	} else {
1635		*n9_firmware = MT7663_FIRMWARE_N9;
1636		dev->fw_ver = MT7615_FIRMWARE_V2;
1637		dev->mcu_ops = &sta_update_ops;
1638	}
1639
1640	return 0;
1641}
1642
1643int __mt7663_load_firmware(struct mt7615_dev *dev)
1644{
1645	const char *n9_firmware;
1646	int ret;
1647
1648	ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1649	if (ret) {
1650		dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1651		return -EIO;
1652	}
1653
1654	ret = mt7663_load_rom_patch(dev, &n9_firmware);
1655	if (ret)
1656		return ret;
1657
1658	ret = mt7663_load_n9(dev, n9_firmware);
1659	if (ret)
1660		return ret;
1661
1662	if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1663			    MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1664		ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1665				     MT7663_TOP_MISC2_FW_STATE);
1666		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1667		return -EIO;
1668	}
1669
1670#ifdef CONFIG_PM
1671	if (mt7615_firmware_offload(dev))
1672		dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1673#endif /* CONFIG_PM */
1674
1675	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1676
1677	return 0;
1678}
1679EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1680
1681static int mt7663_load_firmware(struct mt7615_dev *dev)
1682{
1683	int ret;
1684
1685	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1686
1687	ret = __mt7663_load_firmware(dev);
1688	if (ret)
1689		return ret;
1690
1691	mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1692
1693	return 0;
1694}
1695
1696int mt7615_mcu_init(struct mt7615_dev *dev)
1697{
1698	static const struct mt76_mcu_ops mt7615_mcu_ops = {
1699		.headroom = sizeof(struct mt7615_mcu_txd),
1700		.mcu_skb_send_msg = mt7615_mcu_send_message,
1701		.mcu_parse_response = mt7615_mcu_parse_response,
1702	};
1703	int ret;
1704
1705	dev->mt76.mcu_ops = &mt7615_mcu_ops;
1706
1707	ret = mt7615_mcu_drv_pmctrl(dev);
1708	if (ret)
1709		return ret;
1710
1711	switch (mt76_chip(&dev->mt76)) {
1712	case 0x7622:
1713		ret = mt7622_load_firmware(dev);
1714		break;
1715	case 0x7663:
1716		ret = mt7663_load_firmware(dev);
1717		break;
1718	default:
1719		ret = mt7615_load_firmware(dev);
1720		break;
1721	}
1722	if (ret)
1723		return ret;
1724
1725	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1726	dev_dbg(dev->mt76.dev, "Firmware init done\n");
1727	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1728
1729	if (dev->dbdc_support) {
1730		ret = mt7615_mcu_cal_cache_apply(dev);
1731		if (ret)
1732			return ret;
1733	}
1734
1735	return mt7615_mcu_fw_log_2_host(dev, 0);
1736}
1737EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1738
1739void mt7615_mcu_exit(struct mt7615_dev *dev)
1740{
1741	mt7615_mcu_restart(&dev->mt76);
1742	mt7615_mcu_set_fw_ctrl(dev);
1743	skb_queue_purge(&dev->mt76.mcu.res_q);
1744}
1745EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1746
1747int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1748{
1749	struct {
1750		u8 buffer_mode;
1751		u8 content_format;
1752		__le16 len;
1753	} __packed req_hdr = {
1754		.buffer_mode = 1,
1755	};
1756	u8 *eep = (u8 *)dev->mt76.eeprom.data;
1757	struct sk_buff *skb;
1758	int eep_len, offset;
1759
1760	switch (mt76_chip(&dev->mt76)) {
1761	case 0x7622:
1762		eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1763		offset = MT_EE_NIC_CONF_0;
1764		break;
1765	case 0x7663:
1766		eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1767		req_hdr.content_format = 1;
1768		offset = MT_EE_CHIP_ID;
1769		break;
1770	default:
1771		eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1772		offset = MT_EE_NIC_CONF_0;
1773		break;
1774	}
1775
1776	req_hdr.len = cpu_to_le16(eep_len);
1777
1778	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1779	if (!skb)
1780		return -ENOMEM;
1781
1782	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1783	skb_put_data(skb, eep + offset, eep_len);
1784
1785	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1786				     MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
1787}
1788
1789int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1790		       const struct ieee80211_tx_queue_params *params)
1791{
1792#define WMM_AIFS_SET	BIT(0)
1793#define WMM_CW_MIN_SET	BIT(1)
1794#define WMM_CW_MAX_SET	BIT(2)
1795#define WMM_TXOP_SET	BIT(3)
1796#define WMM_PARAM_SET	(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1797			 WMM_CW_MAX_SET | WMM_TXOP_SET)
1798	struct req_data {
1799		u8 number;
1800		u8 rsv[3];
1801		u8 queue;
1802		u8 valid;
1803		u8 aifs;
1804		u8 cw_min;
1805		__le16 cw_max;
1806		__le16 txop;
1807	} __packed req = {
1808		.number = 1,
1809		.queue = queue,
1810		.valid = WMM_PARAM_SET,
1811		.aifs = params->aifs,
1812		.cw_min = 5,
1813		.cw_max = cpu_to_le16(10),
1814		.txop = cpu_to_le16(params->txop),
1815	};
1816
1817	if (params->cw_min)
1818		req.cw_min = fls(params->cw_min);
1819	if (params->cw_max)
1820		req.cw_max = cpu_to_le16(fls(params->cw_max));
1821
1822	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
1823				 &req, sizeof(req), true);
1824}
1825
1826int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1827{
1828	struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1829	struct dbdc_entry {
1830		u8 type;
1831		u8 index;
1832		u8 band;
1833		u8 _rsv;
1834	};
1835	struct {
1836		u8 enable;
1837		u8 num;
1838		u8 _rsv[2];
1839		struct dbdc_entry entry[64];
1840	} req = {
1841		.enable = !!ext_phy,
1842	};
1843	int i;
1844
1845	if (!ext_phy)
1846		goto out;
1847
1848#define ADD_DBDC_ENTRY(_type, _idx, _band)		\
1849	do { \
1850		req.entry[req.num].type = _type;		\
1851		req.entry[req.num].index = _idx;		\
1852		req.entry[req.num++].band = _band;		\
1853	} while (0)
1854
1855	for (i = 0; i < 4; i++) {
1856		bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1857
1858		ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1859	}
1860
1861	for (i = 0; i < 14; i++) {
1862		bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1863
1864		ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1865	}
1866
1867	ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1868
1869	for (i = 0; i < 3; i++)
1870		ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
1871
1872	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
1873	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
1874	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
1875	ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
1876
1877	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
1878	ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
1879
1880out:
1881	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DBDC_CTRL), &req,
1882				 sizeof(req), true);
1883}
1884
1885int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
1886{
1887	struct {
1888		__le16 tag;
1889		__le16 min_lpn;
1890	} req = {
1891		.tag = cpu_to_le16(0x1),
1892		.min_lpn = cpu_to_le16(val),
1893	};
1894
1895	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1896				 &req, sizeof(req), true);
1897}
1898
1899int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
1900			    const struct mt7615_dfs_pulse *pulse)
1901{
1902	struct {
1903		__le16 tag;
1904		__le32 max_width;	/* us */
1905		__le32 max_pwr;		/* dbm */
1906		__le32 min_pwr;		/* dbm */
1907		__le32 min_stgr_pri;	/* us */
1908		__le32 max_stgr_pri;	/* us */
1909		__le32 min_cr_pri;	/* us */
1910		__le32 max_cr_pri;	/* us */
1911	} req = {
1912		.tag = cpu_to_le16(0x3),
1913#define __req_field(field) .field = cpu_to_le32(pulse->field)
1914		__req_field(max_width),
1915		__req_field(max_pwr),
1916		__req_field(min_pwr),
1917		__req_field(min_stgr_pri),
1918		__req_field(max_stgr_pri),
1919		__req_field(min_cr_pri),
1920		__req_field(max_cr_pri),
1921#undef  __req_field
1922	};
1923
1924	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1925				 &req, sizeof(req), true);
1926}
1927
1928int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
1929			    const struct mt7615_dfs_pattern *pattern)
1930{
1931	struct {
1932		__le16 tag;
1933		__le16 radar_type;
1934		u8 enb;
1935		u8 stgr;
1936		u8 min_crpn;
1937		u8 max_crpn;
1938		u8 min_crpr;
1939		u8 min_pw;
1940		u8 max_pw;
1941		__le32 min_pri;
1942		__le32 max_pri;
1943		u8 min_crbn;
1944		u8 max_crbn;
1945		u8 min_stgpn;
1946		u8 max_stgpn;
1947		u8 min_stgpr;
1948	} req = {
1949		.tag = cpu_to_le16(0x2),
1950		.radar_type = cpu_to_le16(index),
1951#define __req_field_u8(field) .field = pattern->field
1952#define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
1953		__req_field_u8(enb),
1954		__req_field_u8(stgr),
1955		__req_field_u8(min_crpn),
1956		__req_field_u8(max_crpn),
1957		__req_field_u8(min_crpr),
1958		__req_field_u8(min_pw),
1959		__req_field_u8(max_pw),
1960		__req_field_u32(min_pri),
1961		__req_field_u32(max_pri),
1962		__req_field_u8(min_crbn),
1963		__req_field_u8(max_crbn),
1964		__req_field_u8(min_stgpn),
1965		__req_field_u8(max_stgpn),
1966		__req_field_u8(min_stgpr),
1967#undef __req_field_u8
1968#undef __req_field_u32
1969	};
1970
1971	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
1972				 &req, sizeof(req), true);
1973}
1974
1975int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
1976{
1977	struct {
1978		u8 pulse_num;
1979		u8 rsv[3];
1980		struct {
1981			__le32 start_time;
1982			__le16 width;
1983			__le16 power;
1984		} pattern[32];
1985	} req = {
1986		.pulse_num = dev->radar_pattern.n_pulses,
1987	};
1988	u32 start_time = ktime_to_ms(ktime_get_boottime());
1989	int i;
1990
1991	if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
1992		return -EINVAL;
1993
1994	/* TODO: add some noise here */
1995	for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
1996		u32 ts = start_time + i * dev->radar_pattern.period;
1997
1998		req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
1999		req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2000		req.pattern[i].start_time = cpu_to_le32(ts);
2001	}
2002
2003	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_PATTERN),
2004				 &req, sizeof(req), false);
2005}
2006
2007static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2008{
2009	struct mt76_phy *mphy = phy->mt76;
2010	struct ieee80211_hw *hw = mphy->hw;
2011	struct mt76_power_limits limits;
2012	s8 *limits_array = (s8 *)&limits;
2013	int n_chains = hweight8(mphy->antenna_mask);
2014	int tx_power = hw->conf.power_level * 2;
2015	int i;
2016	static const u8 sku_mapping[] = {
2017#define SKU_FIELD(_type, _field) \
2018		[MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2019		SKU_FIELD(CCK_1_2, cck[0]),
2020		SKU_FIELD(CCK_55_11, cck[2]),
2021		SKU_FIELD(OFDM_6_9, ofdm[0]),
2022		SKU_FIELD(OFDM_12_18, ofdm[2]),
2023		SKU_FIELD(OFDM_24_36, ofdm[4]),
2024		SKU_FIELD(OFDM_48, ofdm[6]),
2025		SKU_FIELD(OFDM_54, ofdm[7]),
2026		SKU_FIELD(HT20_0_8, mcs[0][0]),
2027		SKU_FIELD(HT20_32, ofdm[0]),
2028		SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2029		SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2030		SKU_FIELD(HT20_5_13, mcs[0][5]),
2031		SKU_FIELD(HT20_6_14, mcs[0][6]),
2032		SKU_FIELD(HT20_7_15, mcs[0][7]),
2033		SKU_FIELD(HT40_0_8, mcs[1][0]),
2034		SKU_FIELD(HT40_32, ofdm[0]),
2035		SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2036		SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2037		SKU_FIELD(HT40_5_13, mcs[1][5]),
2038		SKU_FIELD(HT40_6_14, mcs[1][6]),
2039		SKU_FIELD(HT40_7_15, mcs[1][7]),
2040		SKU_FIELD(VHT20_0, mcs[0][0]),
2041		SKU_FIELD(VHT20_1_2, mcs[0][1]),
2042		SKU_FIELD(VHT20_3_4, mcs[0][3]),
2043		SKU_FIELD(VHT20_5_6, mcs[0][5]),
2044		SKU_FIELD(VHT20_7, mcs[0][7]),
2045		SKU_FIELD(VHT20_8, mcs[0][8]),
2046		SKU_FIELD(VHT20_9, mcs[0][9]),
2047		SKU_FIELD(VHT40_0, mcs[1][0]),
2048		SKU_FIELD(VHT40_1_2, mcs[1][1]),
2049		SKU_FIELD(VHT40_3_4, mcs[1][3]),
2050		SKU_FIELD(VHT40_5_6, mcs[1][5]),
2051		SKU_FIELD(VHT40_7, mcs[1][7]),
2052		SKU_FIELD(VHT40_8, mcs[1][8]),
2053		SKU_FIELD(VHT40_9, mcs[1][9]),
2054		SKU_FIELD(VHT80_0, mcs[2][0]),
2055		SKU_FIELD(VHT80_1_2, mcs[2][1]),
2056		SKU_FIELD(VHT80_3_4, mcs[2][3]),
2057		SKU_FIELD(VHT80_5_6, mcs[2][5]),
2058		SKU_FIELD(VHT80_7, mcs[2][7]),
2059		SKU_FIELD(VHT80_8, mcs[2][8]),
2060		SKU_FIELD(VHT80_9, mcs[2][9]),
2061		SKU_FIELD(VHT160_0, mcs[3][0]),
2062		SKU_FIELD(VHT160_1_2, mcs[3][1]),
2063		SKU_FIELD(VHT160_3_4, mcs[3][3]),
2064		SKU_FIELD(VHT160_5_6, mcs[3][5]),
2065		SKU_FIELD(VHT160_7, mcs[3][7]),
2066		SKU_FIELD(VHT160_8, mcs[3][8]),
2067		SKU_FIELD(VHT160_9, mcs[3][9]),
2068#undef SKU_FIELD
2069	};
2070
2071	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan, tx_power);
2072	tx_power -= mt76_tx_power_path_delta(n_chains);
2073	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2074					      &limits, tx_power);
2075	mphy->txpower_cur = tx_power;
2076
2077	if (is_mt7663(mphy->dev)) {
2078		memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2079		return;
2080	}
2081
2082	for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2083		sku[i] = limits_array[sku_mapping[i]];
2084
2085	for (i = 0; i < 4; i++) {
2086		int delta = 0;
2087
2088		if (i < n_chains - 1)
2089			delta = mt76_tx_power_path_delta(n_chains) -
2090				mt76_tx_power_path_delta(i + 1);
2091		sku[MT_SKU_1SS_DELTA + i] = delta;
2092	}
2093}
2094
2095static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2096{
2097	static const u8 width_to_bw[] = {
2098		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2099		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2100		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2101		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2102		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2103		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2104		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2105		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2106	};
2107
2108	if (chandef->width >= ARRAY_SIZE(width_to_bw))
2109		return 0;
2110
2111	return width_to_bw[chandef->width];
2112}
2113
2114int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2115{
2116	struct mt7615_dev *dev = phy->dev;
2117	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2118	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2119	struct {
2120		u8 control_chan;
2121		u8 center_chan;
2122		u8 bw;
2123		u8 tx_streams;
2124		u8 rx_streams_mask;
2125		u8 switch_reason;
2126		u8 band_idx;
2127		/* for 80+80 only */
2128		u8 center_chan2;
2129		__le16 cac_case;
2130		u8 channel_band;
2131		u8 rsv0;
2132		__le32 outband_freq;
2133		u8 txpower_drop;
2134		u8 rsv1[3];
2135		u8 txpower_sku[53];
2136		u8 rsv2[3];
2137	} req = {
2138		.control_chan = chandef->chan->hw_value,
2139		.center_chan = ieee80211_frequency_to_channel(freq1),
2140		.tx_streams = hweight8(phy->mt76->antenna_mask),
2141		.rx_streams_mask = phy->mt76->chainmask,
2142		.center_chan2 = ieee80211_frequency_to_channel(freq2),
2143	};
2144
2145	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2146	    phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
2147		req.switch_reason = CH_SWITCH_NORMAL;
2148	else if (phy->mt76->offchannel)
2149		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2150	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2151					  NL80211_IFTYPE_AP))
2152		req.switch_reason = CH_SWITCH_DFS;
2153	else
2154		req.switch_reason = CH_SWITCH_NORMAL;
2155
2156	req.band_idx = phy != &dev->phy;
2157	req.bw = mt7615_mcu_chan_bw(chandef);
2158
2159	if (mt76_testmode_enabled(phy->mt76))
2160		memset(req.txpower_sku, 0x3f, 49);
2161	else
2162		mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2163
2164	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2165}
2166
2167int mt7615_mcu_get_temperature(struct mt7615_dev *dev)
2168{
2169	struct {
2170		u8 action;
2171		u8 rsv[3];
2172	} req = {};
2173
2174	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL),
2175				 &req, sizeof(req), true);
2176}
2177
2178int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2179			      u32 val)
2180{
2181	struct {
2182		u8 test_mode_en;
2183		u8 param_idx;
2184		u8 _rsv[2];
2185
2186		__le32 value;
2187
2188		u8 pad[8];
2189	} req = {
2190		.test_mode_en = test_mode,
2191		.param_idx = param,
2192		.value = cpu_to_le32(val),
2193	};
2194
2195	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
2196				 &req, sizeof(req), false);
2197}
2198
2199int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2200{
2201	struct mt7615_dev *dev = phy->dev;
2202	struct {
2203		u8 format_id;
2204		u8 sku_enable;
2205		u8 band_idx;
2206		u8 rsv;
2207	} req = {
2208		.format_id = 0,
2209		.band_idx = phy != &dev->phy,
2210		.sku_enable = enable,
2211	};
2212
2213	return mt76_mcu_send_msg(&dev->mt76,
2214				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
2215				 &req, sizeof(req), true);
2216}
2217
2218static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2219{
2220	int i;
2221
2222	for (i = 0; i < n_freqs; i++)
2223		if (cur == freqs[i])
2224			return i;
2225
2226	return -1;
2227}
2228
2229static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2230{
2231	static const u16 freq_list[] = {
2232		4980, 5805, 5905, 5190,
2233		5230, 5270, 5310, 5350,
2234		5390, 5430, 5470, 5510,
2235		5550, 5590, 5630, 5670,
2236		5710, 5755, 5795, 5835,
2237		5875, 5210, 5290, 5370,
2238		5450, 5530, 5610, 5690,
2239		5775, 5855
2240	};
2241	static const u16 freq_bw40[] = {
2242		5190, 5230, 5270, 5310,
2243		5350, 5390, 5430, 5470,
2244		5510, 5550, 5590, 5630,
2245		5670, 5710, 5755, 5795,
2246		5835, 5875
2247	};
2248	int offset_2g = ARRAY_SIZE(freq_list);
2249	int idx;
2250
2251	if (freq < 4000) {
2252		if (freq < 2427)
2253			return offset_2g;
2254		if (freq < 2442)
2255			return offset_2g + 1;
2256		if (freq < 2457)
2257			return offset_2g + 2;
2258
2259		return offset_2g + 3;
2260	}
2261
2262	switch (bw) {
2263	case NL80211_CHAN_WIDTH_80:
2264	case NL80211_CHAN_WIDTH_80P80:
2265	case NL80211_CHAN_WIDTH_160:
2266		break;
2267	default:
2268		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2269					   freq + 10);
2270		if (idx >= 0) {
2271			freq = freq_bw40[idx];
2272			break;
2273		}
2274
2275		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2276					   freq - 10);
2277		if (idx >= 0) {
2278			freq = freq_bw40[idx];
2279			break;
2280		}
2281		fallthrough;
2282	case NL80211_CHAN_WIDTH_40:
2283		idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2284					   freq);
2285		if (idx >= 0)
2286			break;
2287
2288		return -1;
2289
2290	}
2291
2292	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2293}
2294
2295int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2296{
2297	struct mt7615_dev *dev = phy->dev;
2298	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2299	int freq2 = chandef->center_freq2;
2300	int ret;
2301	struct {
2302		u8 direction;
2303		u8 runtime_calibration;
2304		u8 _rsv[2];
2305
2306		__le16 center_freq;
2307		u8 bw;
2308		u8 band;
2309		u8 is_freq2;
2310		u8 success;
2311		u8 dbdc_en;
2312
2313		u8 _rsv2;
2314
2315		struct {
2316			__le32 sx0_i_lna[4];
2317			__le32 sx0_q_lna[4];
2318
2319			__le32 sx2_i_lna[4];
2320			__le32 sx2_q_lna[4];
2321		} dcoc_data[4];
2322	} req = {
2323		.direction = 1,
2324
2325		.bw = mt7615_mcu_chan_bw(chandef),
2326		.band = chandef->center_freq1 > 4000,
2327		.dbdc_en = !!dev->mt76.phys[MT_BAND1],
2328	};
2329	u16 center_freq = chandef->center_freq1;
2330	int freq_idx;
2331	u8 *eep = dev->mt76.eeprom.data;
2332
2333	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2334		return 0;
2335
2336	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2337		freq2 = center_freq + 40;
2338		center_freq -= 40;
2339	}
2340
2341again:
2342	req.runtime_calibration = 1;
2343	freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2344	if (freq_idx < 0)
2345		goto out;
2346
2347	memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2348			      freq_idx * MT7615_EEPROM_DCOC_SIZE,
2349	       sizeof(req.dcoc_data));
2350	req.runtime_calibration = 0;
2351
2352out:
2353	req.center_freq = cpu_to_le16(center_freq);
2354	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RXDCOC_CAL), &req,
2355				sizeof(req), true);
2356
2357	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2358	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2359		req.is_freq2 = true;
2360		center_freq = freq2;
2361		goto again;
2362	}
2363
2364	return ret;
2365}
2366
2367static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2368{
2369	static const u16 freq_list[] = {
2370		4920, 4940, 4960, 4980,
2371		5040, 5060, 5080, 5180,
2372		5200, 5220, 5240, 5260,
2373		5280, 5300, 5320, 5340,
2374		5360, 5380, 5400, 5420,
2375		5440, 5460, 5480, 5500,
2376		5520, 5540, 5560, 5580,
2377		5600, 5620, 5640, 5660,
2378		5680, 5700, 5720, 5745,
2379		5765, 5785, 5805, 5825,
2380		5845, 5865, 5885, 5905
2381	};
2382	int offset_2g = ARRAY_SIZE(freq_list);
2383	int idx;
2384
2385	if (freq < 4000) {
2386		if (freq < 2432)
2387			return offset_2g;
2388		if (freq < 2457)
2389			return offset_2g + 1;
2390
2391		return offset_2g + 2;
2392	}
2393
2394	if (bw != NL80211_CHAN_WIDTH_20) {
2395		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2396					   freq + 10);
2397		if (idx >= 0)
2398			return idx;
2399
2400		idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2401					   freq - 10);
2402		if (idx >= 0)
2403			return idx;
2404	}
2405
2406	return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2407}
2408
2409
2410int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2411{
2412	struct mt7615_dev *dev = phy->dev;
2413	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2414	int freq2 = chandef->center_freq2;
2415	int ret;
2416	struct {
2417		u8 direction;
2418		u8 runtime_calibration;
2419		u8 _rsv[2];
2420
2421		__le16 center_freq;
2422		u8 bw;
2423		u8 band;
2424		u8 is_freq2;
2425		u8 success;
2426		u8 dbdc_en;
2427
2428		u8 _rsv2;
2429
2430		struct {
2431			struct {
2432				u32 dpd_g0;
2433				u8 data[32];
2434			} wf0, wf1;
2435
2436			struct {
2437				u32 dpd_g0_prim;
2438				u32 dpd_g0_sec;
2439				u8 data_prim[32];
2440				u8 data_sec[32];
2441			} wf2, wf3;
2442		} dpd_data;
2443	} req = {
2444		.direction = 1,
2445
2446		.bw = mt7615_mcu_chan_bw(chandef),
2447		.band = chandef->center_freq1 > 4000,
2448		.dbdc_en = !!dev->mt76.phys[MT_BAND1],
2449	};
2450	u16 center_freq = chandef->center_freq1;
2451	int freq_idx;
2452	u8 *eep = dev->mt76.eeprom.data;
2453
2454	if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2455		return 0;
2456
2457	if (chandef->width == NL80211_CHAN_WIDTH_160) {
2458		freq2 = center_freq + 40;
2459		center_freq -= 40;
2460	}
2461
2462again:
2463	req.runtime_calibration = 1;
2464	freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2465	if (freq_idx < 0)
2466		goto out;
2467
2468	memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2469			      freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2470	       sizeof(req.dpd_data));
2471	req.runtime_calibration = 0;
2472
2473out:
2474	req.center_freq = cpu_to_le16(center_freq);
2475	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXDPD_CAL),
2476				&req, sizeof(req), true);
2477
2478	if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2479	     chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2480		req.is_freq2 = true;
2481		center_freq = freq2;
2482		goto again;
2483	}
2484
2485	return ret;
2486}
2487
2488int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2489{
2490	struct {
2491		u8 operation;
2492		u8 count;
2493		u8 _rsv[2];
2494		u8 index;
2495		u8 enable;
2496		__le16 etype;
2497	} req = {
2498		.operation = 1,
2499		.count = 1,
2500		.enable = 1,
2501		.etype = cpu_to_le16(ETH_P_PAE),
2502	};
2503
2504	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2505				 &req, sizeof(req), false);
2506}
2507
2508int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2509			  bool enable)
2510{
2511	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2512	struct {
2513		u8 bss_idx;
2514		u8 dtim_period;
2515		__le16 aid;
2516		__le16 bcn_interval;
2517		__le16 atim_window;
2518		u8 uapsd;
2519		u8 bmc_delivered_ac;
2520		u8 bmc_triggered_ac;
2521		u8 pad;
2522	} req = {
2523		.bss_idx = mvif->mt76.idx,
2524		.aid = cpu_to_le16(vif->cfg.aid),
2525		.dtim_period = vif->bss_conf.dtim_period,
2526		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2527	};
2528	struct {
2529		u8 bss_idx;
2530		u8 pad[3];
2531	} req_hdr = {
2532		.bss_idx = mvif->mt76.idx,
2533	};
2534	int err;
2535
2536	if (vif->type != NL80211_IFTYPE_STATION)
2537		return 0;
2538
2539	err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
2540				&req_hdr, sizeof(req_hdr), false);
2541	if (err < 0 || !enable)
2542		return err;
2543
2544	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
2545				 &req, sizeof(req), false);
2546}
2547
2548int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2549		       struct ieee80211_channel *chan, int duration)
2550{
2551	struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2552	struct mt7615_dev *dev = phy->dev;
2553	struct mt7615_roc_tlv req = {
2554		.bss_idx = mvif->mt76.idx,
2555		.active = !chan,
2556		.max_interval = cpu_to_le32(duration),
2557		.primary_chan = chan ? chan->hw_value : 0,
2558		.band = chan ? chan->band : 0,
2559		.req_type = 2,
2560	};
2561
2562	phy->roc_grant = false;
2563
2564	return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC),
2565				 &req, sizeof(req), false);
2566}