drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 static bool prefer_offload_fw = true;
  15 module_param(prefer_offload_fw, bool, 0644);
  16 MODULE_PARM_DESC(prefer_offload_fw,
  17                  "Prefer client mode offload firmware (MT7663)");
  18
  19 struct mt7615_patch_hdr {
  20         char build_date[16];
  21         char platform[4];
  22         __be32 hw_sw_ver;
  23         __be32 patch_ver;
  24         __be16 checksum;
  25 } __packed;
  26
  27 struct mt7615_fw_trailer {
  28         __le32 addr;
  29         u8 chip_id;
  30         u8 feature_set;
  31         u8 eco_code;
  32         char fw_ver[10];
  33         char build_date[15];
  34         __le32 len;
  35 } __packed;
  36
  37 #define FW_V3_COMMON_TAILER_SIZE        36
  38 #define FW_V3_REGION_TAILER_SIZE        40
  39 #define FW_START_OVERRIDE               BIT(0)
  40 #define FW_START_DLYCAL                 BIT(1)
  41 #define FW_START_WORKING_PDA_CR4        BIT(2)
  42
  43 struct mt7663_fw_trailer {
  44         u8 chip_id;
  45         u8 eco_code;
  46         u8 n_region;
  47         u8 format_ver;
  48         u8 format_flag;
  49         u8 reserv[2];
  50         char fw_ver[10];
  51         char build_date[15];
  52         __le32 crc;
  53 } __packed;
  54
  55 struct mt7663_fw_buf {
  56         __le32 crc;
  57         __le32 d_img_size;
  58         __le32 block_size;
  59         u8 rsv[4];
  60         __le32 img_dest_addr;
  61         __le32 img_size;
  62         u8 feature_set;
  63 };
  64
  65 #define MT7615_PATCH_ADDRESS            0x80000
  66 #define MT7622_PATCH_ADDRESS            0x9c000
  67 #define MT7663_PATCH_ADDRESS            0xdc000
  68
  69 #define N9_REGION_NUM                   2
  70 #define CR4_REGION_NUM                  1
  71
  72 #define IMG_CRC_LEN                     4
  73
  74 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  75 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  76
  77 #define DL_MODE_ENCRYPT                 BIT(0)
  78 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  79 #define DL_MODE_RESET_SEC_IV            BIT(3)
  80 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
  82 #define DL_MODE_NEED_RSP                BIT(31)
  83
  84 #define FW_START_OVERRIDE               BIT(0)
  85 #define FW_START_WORKING_PDA_CR4        BIT(2)
  86
  87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
  88                          int cmd, int *wait_seq)
  89 {
  90         int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
  91         struct mt7615_uni_txd *uni_txd;
  92         struct mt7615_mcu_txd *mcu_txd;
  93         u8 seq, q_idx, pkt_fmt;
  94         __le32 *txd;
  95         u32 val;
  96
  97         /* TODO: make dynamic based on msg type */
  98         dev->mt76.mcu.timeout = 20 * HZ;
  99
 100         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 101         if (!seq)
 102                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 103         if (wait_seq)
 104                 *wait_seq = seq;
 105
 106         txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 107         txd = (__le32 *)skb_push(skb, txd_len);
 108
 109         if (cmd != MCU_CMD(FW_SCATTER)) {
 110                 q_idx = MT_TX_MCU_PORT_RX_Q0;
 111                 pkt_fmt = MT_TX_TYPE_CMD;
 112         } else {
 113                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
 114                 pkt_fmt = MT_TX_TYPE_FW;
 115         }
 116
 117         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 118               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
 119               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
 120         txd[0] = cpu_to_le32(val);
 121
 122         val = MT_TXD1_LONG_FORMAT |
 123               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
 124               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
 125         txd[1] = cpu_to_le32(val);
 126
 127         if (cmd & __MCU_CMD_FIELD_UNI) {
 128                 uni_txd = (struct mt7615_uni_txd *)txd;
 129                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 130                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 131                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 132                 uni_txd->s2d_index = MCU_S2D_H2N;
 133                 uni_txd->pkt_type = MCU_PKT_ID;
 134                 uni_txd->seq = seq;
 135
 136                 return;
 137         }
 138
 139         mcu_txd = (struct mt7615_mcu_txd *)txd;
 140         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 141         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
 142         mcu_txd->s2d_index = MCU_S2D_H2N;
 143         mcu_txd->pkt_type = MCU_PKT_ID;
 144         mcu_txd->seq = seq;
 145         mcu_txd->cid = mcu_cmd;
 146         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 147
 148         if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
 149                 if (cmd & __MCU_CMD_FIELD_QUERY)
 150                         mcu_txd->set_query = MCU_Q_QUERY;
 151                 else
 152                         mcu_txd->set_query = MCU_Q_SET;
 153                 mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
 154         } else {
 155                 mcu_txd->set_query = MCU_Q_NA;
 156         }
 157 }
 158 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
 159
 160 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 161                               struct sk_buff *skb, int seq)
 162 {
 163         struct mt7615_mcu_rxd *rxd;
 164         int ret = 0;
 165
 166         if (!skb) {
 167                 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 168                         cmd, seq);
 169                 return -ETIMEDOUT;
 170         }
 171
 172         rxd = (struct mt7615_mcu_rxd *)skb->data;
 173         if (seq != rxd->seq)
 174                 return -EAGAIN;
 175
 176         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 177                 skb_pull(skb, sizeof(*rxd) - 4);
 178                 ret = *skb->data;
 179         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 180                 skb_pull(skb, sizeof(*rxd));
 181                 ret = le32_to_cpu(*(__le32 *)skb->data);
 182         } else if (cmd == MCU_EXT_QUERY(RF_REG_ACCESS)) {
 183                 skb_pull(skb, sizeof(*rxd));
 184                 ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
 185         } else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
 186                    cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
 187                    cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
 188                    cmd == MCU_UNI_CMD(HIF_CTRL) ||
 189                    cmd == MCU_UNI_CMD(OFFLOAD) ||
 190                    cmd == MCU_UNI_CMD(SUSPEND)) {
 191                 struct mt7615_mcu_uni_event *event;
 192
 193                 skb_pull(skb, sizeof(*rxd));
 194                 event = (struct mt7615_mcu_uni_event *)skb->data;
 195                 ret = le32_to_cpu(event->status);
 196         } else if (cmd == MCU_CE_QUERY(REG_READ)) {
 197                 struct mt7615_mcu_reg_event *event;
 198
 199                 skb_pull(skb, sizeof(*rxd));
 200                 event = (struct mt7615_mcu_reg_event *)skb->data;
 201                 ret = (int)le32_to_cpu(event->val);
 202         }
 203
 204         return ret;
 205 }
 206 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
 207
 208 static int
 209 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 210                         int cmd, int *seq)
 211 {
 212         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 213         enum mt76_mcuq_id qid;
 214
 215         mt7615_mcu_fill_msg(dev, skb, cmd, seq);
 216         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 217                 qid = MT_MCUQ_WM;
 218         else
 219                 qid = MT_MCUQ_FWDL;
 220
 221         return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
 222 }
 223
 224 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
 225 {
 226         struct {
 227                 __le32 wifi_stream;
 228                 __le32 address;
 229                 __le32 data;
 230         } req = {
 231                 .wifi_stream = cpu_to_le32(wf),
 232                 .address = cpu_to_le32(reg),
 233         };
 234
 235         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
 236                                  &req, sizeof(req), true);
 237 }
 238
 239 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
 240 {
 241         struct {
 242                 __le32 wifi_stream;
 243                 __le32 address;
 244                 __le32 data;
 245         } req = {
 246                 .wifi_stream = cpu_to_le32(wf),
 247                 .address = cpu_to_le32(reg),
 248                 .data = cpu_to_le32(val),
 249         };
 250
 251         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
 252                                  &req, sizeof(req), false);
 253 }
 254
 255 void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
 256 {
 257         if (!is_mt7622(&dev->mt76))
 258                 return;
 259
 260         regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
 261                            MT_INFRACFG_MISC_AP2CONN_WAKE,
 262                            !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
 263 }
 264 EXPORT_SYMBOL_GPL(mt7622_trigger_hif_int);
 265
 266 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
 267 {
 268         struct mt76_phy *mphy = &dev->mt76.phy;
 269         struct mt76_connac_pm *pm = &dev->pm;
 270         struct mt76_dev *mdev = &dev->mt76;
 271         u32 addr;
 272         int err;
 273
 274         if (is_mt7663(mdev)) {
 275                 /* Clear firmware own via N9 eint */
 276                 mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 277                 mt76_poll(dev, MT_CONN_ON_MISC, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 278
 279                 addr = MT_CONN_HIF_ON_LPCTL;
 280         } else {
 281                 addr = MT_CFG_LPCR_HOST;
 282         }
 283
 284         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
 285
 286         mt7622_trigger_hif_int(dev, true);
 287
 288         err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 289
 290         mt7622_trigger_hif_int(dev, false);
 291
 292         if (err) {
 293                 dev_err(mdev->dev, "driver own failed\n");
 294                 return -ETIMEDOUT;
 295         }
 296
 297         clear_bit(MT76_STATE_PM, &mphy->state);
 298
 299         pm->stats.last_wake_event = jiffies;
 300         pm->stats.doze_time += pm->stats.last_wake_event -
 301                                pm->stats.last_doze_event;
 302
 303         return 0;
 304 }
 305
 306 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
 307 {
 308         struct mt76_phy *mphy = &dev->mt76.phy;
 309         struct mt76_connac_pm *pm = &dev->pm;
 310         int i, err = 0;
 311
 312         mutex_lock(&pm->mutex);
 313
 314         if (!test_bit(MT76_STATE_PM, &mphy->state))
 315                 goto out;
 316
 317         for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
 318                 mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 319                 if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
 320                                    MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
 321                         break;
 322         }
 323
 324         if (i == MT7615_DRV_OWN_RETRY_COUNT) {
 325                 dev_err(dev->mt76.dev, "driver own failed\n");
 326                 err = -EIO;
 327                 goto out;
 328         }
 329         clear_bit(MT76_STATE_PM, &mphy->state);
 330
 331         pm->stats.last_wake_event = jiffies;
 332         pm->stats.doze_time += pm->stats.last_wake_event -
 333                                pm->stats.last_doze_event;
 334 out:
 335         mutex_unlock(&pm->mutex);
 336
 337         return err;
 338 }
 339
 340 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
 341 {
 342         struct mt76_phy *mphy = &dev->mt76.phy;
 343         struct mt76_connac_pm *pm = &dev->pm;
 344         int err = 0;
 345         u32 addr;
 346
 347         mutex_lock(&pm->mutex);
 348
 349         if (mt76_connac_skip_fw_pmctrl(mphy, pm))
 350                 goto out;
 351
 352         mt7622_trigger_hif_int(dev, true);
 353
 354         addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 355         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
 356
 357         if (is_mt7622(&dev->mt76) &&
 358             !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
 359                             MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
 360                 dev_err(dev->mt76.dev, "Timeout for firmware own\n");
 361                 clear_bit(MT76_STATE_PM, &mphy->state);
 362                 err = -EIO;
 363         }
 364
 365         mt7622_trigger_hif_int(dev, false);
 366
 367         pm->stats.last_doze_event = jiffies;
 368         pm->stats.awake_time += pm->stats.last_doze_event -
 369                                 pm->stats.last_wake_event;
 370 out:
 371         mutex_unlock(&pm->mutex);
 372
 373         return err;
 374 }
 375
 376 static void
 377 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 378 {
 379         if (vif->csa_active)
 380                 ieee80211_csa_finish(vif);
 381 }
 382
 383 static void
 384 mt7615_mcu_rx_csa_notify(struct mt7615_dev *dev, struct sk_buff *skb)
 385 {
 386         struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
 387         struct mt76_phy *mphy = &dev->mt76.phy;
 388         struct mt7615_mcu_csa_notify *c;
 389
 390         c = (struct mt7615_mcu_csa_notify *)skb->data;
 391
 392         if (c->omac_idx > EXT_BSSID_MAX)
 393                 return;
 394
 395         if (ext_phy && ext_phy->omac_mask & BIT_ULL(c->omac_idx))
 396                 mphy = dev->mt76.phy2;
 397
 398         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 399                         IEEE80211_IFACE_ITER_RESUME_ALL,
 400                         mt7615_mcu_csa_finish, mphy->hw);
 401 }
 402
 403 static void
 404 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 405 {
 406         struct mt76_phy *mphy = &dev->mt76.phy;
 407         struct mt7615_mcu_rdd_report *r;
 408
 409         r = (struct mt7615_mcu_rdd_report *)skb->data;
 410
 411         if (!dev->radar_pattern.n_pulses && !r->long_detected &&
 412             !r->constant_prf_detected && !r->staggered_prf_detected)
 413                 return;
 414
 415         if (r->band_idx && dev->mt76.phy2)
 416                 mphy = dev->mt76.phy2;
 417
 418         ieee80211_radar_detected(mphy->hw);
 419         dev->hw_pattern++;
 420 }
 421
 422 static void
 423 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
 424 {
 425         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 426         const char *data = (char *)&rxd[1];
 427         const char *type;
 428
 429         switch (rxd->s2d_index) {
 430         case 0:
 431                 type = "N9";
 432                 break;
 433         case 2:
 434                 type = "CR4";
 435                 break;
 436         default:
 437                 type = "unknown";
 438                 break;
 439         }
 440
 441         wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
 442                    (int)(skb->len - sizeof(*rxd)), data);
 443 }
 444
 445 static void
 446 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 447 {
 448         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 449
 450         switch (rxd->ext_eid) {
 451         case MCU_EXT_EVENT_RDD_REPORT:
 452                 mt7615_mcu_rx_radar_detected(dev, skb);
 453                 break;
 454         case MCU_EXT_EVENT_CSA_NOTIFY:
 455                 mt7615_mcu_rx_csa_notify(dev, skb);
 456                 break;
 457         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 458                 mt7615_mcu_rx_log_message(dev, skb);
 459                 break;
 460         default:
 461                 break;
 462         }
 463 }
 464
 465 static void
 466 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
 467 {
 468         u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
 469         struct mt7615_phy *phy;
 470         struct mt76_phy *mphy;
 471
 472         if (*seq_num & BIT(7) && dev->mt76.phy2)
 473                 mphy = dev->mt76.phy2;
 474         else
 475                 mphy = &dev->mt76.phy;
 476
 477         phy = (struct mt7615_phy *)mphy->priv;
 478
 479         spin_lock_bh(&dev->mt76.lock);
 480         __skb_queue_tail(&phy->scan_event_list, skb);
 481         spin_unlock_bh(&dev->mt76.lock);
 482
 483         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 484                                      MT7615_HW_SCAN_TIMEOUT);
 485 }
 486
 487 static void
 488 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
 489 {
 490         struct mt7615_roc_tlv *event;
 491         struct mt7615_phy *phy;
 492         struct mt76_phy *mphy;
 493         int duration;
 494
 495         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 496         event = (struct mt7615_roc_tlv *)skb->data;
 497
 498         if (event->dbdc_band && dev->mt76.phy2)
 499                 mphy = dev->mt76.phy2;
 500         else
 501                 mphy = &dev->mt76.phy;
 502
 503         ieee80211_ready_on_channel(mphy->hw);
 504
 505         phy = (struct mt7615_phy *)mphy->priv;
 506         phy->roc_grant = true;
 507         wake_up(&phy->roc_wait);
 508
 509         duration = le32_to_cpu(event->max_interval);
 510         mod_timer(&phy->roc_timer,
 511                   round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
 512 }
 513
 514 static void
 515 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 516 {
 517         struct mt76_connac_beacon_loss_event *event;
 518         struct mt76_phy *mphy;
 519         u8 band_idx = 0; /* DBDC support */
 520
 521         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 522         event = (struct mt76_connac_beacon_loss_event *)skb->data;
 523         if (band_idx && dev->mt76.phy2)
 524                 mphy = dev->mt76.phy2;
 525         else
 526                 mphy = &dev->mt76.phy;
 527
 528         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 529                                         IEEE80211_IFACE_ITER_RESUME_ALL,
 530                                         mt76_connac_mcu_beacon_loss_iter,
 531                                         event);
 532 }
 533
 534 static void
 535 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 536 {
 537         struct mt76_connac_mcu_bss_event *event;
 538         struct mt76_phy *mphy;
 539         u8 band_idx = 0; /* DBDC support */
 540
 541         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 542         event = (struct mt76_connac_mcu_bss_event *)skb->data;
 543
 544         if (band_idx && dev->mt76.phy2)
 545                 mphy = dev->mt76.phy2;
 546         else
 547                 mphy = &dev->mt76.phy;
 548
 549         if (event->is_absent)
 550                 ieee80211_stop_queues(mphy->hw);
 551         else
 552                 ieee80211_wake_queues(mphy->hw);
 553 }
 554
 555 static void
 556 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 557 {
 558         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 559
 560         switch (rxd->eid) {
 561         case MCU_EVENT_EXT:
 562                 mt7615_mcu_rx_ext_event(dev, skb);
 563                 break;
 564         case MCU_EVENT_BSS_BEACON_LOSS:
 565                 mt7615_mcu_beacon_loss_event(dev, skb);
 566                 break;
 567         case MCU_EVENT_ROC:
 568                 mt7615_mcu_roc_event(dev, skb);
 569                 break;
 570         case MCU_EVENT_SCHED_SCAN_DONE:
 571         case MCU_EVENT_SCAN_DONE:
 572                 mt7615_mcu_scan_event(dev, skb);
 573                 return;
 574         case MCU_EVENT_BSS_ABSENCE:
 575                 mt7615_mcu_bss_event(dev, skb);
 576                 break;
 577         case MCU_EVENT_COREDUMP:
 578                 mt76_connac_mcu_coredump_event(&dev->mt76, skb,
 579                                                &dev->coredump);
 580                 return;
 581         default:
 582                 break;
 583         }
 584         dev_kfree_skb(skb);
 585 }
 586
 587 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 588 {
 589         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 590
 591         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 592             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 593             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 594             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 595             rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 596             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 597             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 598             rxd->eid == MCU_EVENT_SCAN_DONE ||
 599             rxd->eid == MCU_EVENT_COREDUMP ||
 600             rxd->eid == MCU_EVENT_ROC ||
 601             !rxd->seq)
 602                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 603         else
 604                 mt76_mcu_rx_event(&dev->mt76, skb);
 605 }
 606
 607 static int
 608 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 609                        bool bssid, bool enable)
 610 {
 611         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 612         u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
 613         u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
 614         const u8 *addr = vif->addr;
 615         struct {
 616                 u8 mode;
 617                 u8 force_clear;
 618                 u8 clear_bitmap[8];
 619                 u8 entry_count;
 620                 u8 write;
 621
 622                 u8 index;
 623                 u8 bssid;
 624                 u8 addr[ETH_ALEN];
 625         } __packed req = {
 626                 .mode = !!mask || enable,
 627                 .entry_count = 1,
 628                 .write = 1,
 629
 630                 .index = idx * 2 + bssid,
 631         };
 632
 633         if (bssid)
 634                 addr = vif->bss_conf.bssid;
 635
 636         if (enable)
 637                 ether_addr_copy(req.addr, addr);
 638
 639         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE),
 640                                  &req, sizeof(req), true);
 641 }
 642
 643 static int
 644 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 645                    bool enable)
 646 {
 647         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 648         struct mt7615_dev *dev = phy->dev;
 649         struct {
 650                 struct req_hdr {
 651                         u8 omac_idx;
 652                         u8 band_idx;
 653                         __le16 tlv_num;
 654                         u8 is_tlv_append;
 655                         u8 rsv[3];
 656                 } __packed hdr;
 657                 struct req_tlv {
 658                         __le16 tag;
 659                         __le16 len;
 660                         u8 active;
 661                         u8 band_idx;
 662                         u8 omac_addr[ETH_ALEN];
 663                 } __packed tlv;
 664         } data = {
 665                 .hdr = {
 666                         .omac_idx = mvif->mt76.omac_idx,
 667                         .band_idx = mvif->mt76.band_idx,
 668                         .tlv_num = cpu_to_le16(1),
 669                         .is_tlv_append = 1,
 670                 },
 671                 .tlv = {
 672                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 673                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 674                         .active = enable,
 675                         .band_idx = mvif->mt76.band_idx,
 676                 },
 677         };
 678
 679         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
 680                 return mt7615_mcu_muar_config(dev, vif, false, enable);
 681
 682         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 683         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
 684                                  &data, sizeof(data), true);
 685 }
 686
 687 static int
 688 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
 689                               struct ieee80211_hw *hw,
 690                               struct ieee80211_vif *vif, bool enable)
 691 {
 692         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 693         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
 694         struct ieee80211_mutable_offsets offs;
 695         struct ieee80211_tx_info *info;
 696         struct req {
 697                 u8 omac_idx;
 698                 u8 enable;
 699                 u8 wlan_idx;
 700                 u8 band_idx;
 701                 u8 pkt_type;
 702                 u8 need_pre_tbtt_int;
 703                 __le16 csa_ie_pos;
 704                 __le16 pkt_len;
 705                 __le16 tim_ie_pos;
 706                 u8 pkt[512];
 707                 u8 csa_cnt;
 708                 /* bss color change */
 709                 u8 bcc_cnt;
 710                 __le16 bcc_ie_pos;
 711         } __packed req = {
 712                 .omac_idx = mvif->mt76.omac_idx,
 713                 .enable = enable,
 714                 .wlan_idx = wcid->idx,
 715                 .band_idx = mvif->mt76.band_idx,
 716         };
 717         struct sk_buff *skb;
 718
 719         if (!enable)
 720                 goto out;
 721
 722         skb = ieee80211_beacon_get_template(hw, vif, &offs);
 723         if (!skb)
 724                 return -EINVAL;
 725
 726         if (skb->len > 512 - MT_TXD_SIZE) {
 727                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
 728                 dev_kfree_skb(skb);
 729                 return -EINVAL;
 730         }
 731
 732         if (mvif->mt76.band_idx) {
 733                 info = IEEE80211_SKB_CB(skb);
 734                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
 735         }
 736
 737         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
 738                               0, NULL, true);
 739         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
 740         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 741         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
 742         if (offs.cntdwn_counter_offs[0]) {
 743                 u16 csa_offs;
 744
 745                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
 746                 req.csa_ie_pos = cpu_to_le16(csa_offs);
 747                 req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
 748         }
 749         dev_kfree_skb(skb);
 750
 751 out:
 752         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(BCN_OFFLOAD), &req,
 753                                  sizeof(req), true);
 754 }
 755
 756 static int
 757 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
 758 {
 759 #define ENTER_PM_STATE  1
 760 #define EXIT_PM_STATE   2
 761         struct {
 762                 u8 pm_number;
 763                 u8 pm_state;
 764                 u8 bssid[ETH_ALEN];
 765                 u8 dtim_period;
 766                 u8 wlan_idx;
 767                 __le16 bcn_interval;
 768                 __le32 aid;
 769                 __le32 rx_filter;
 770                 u8 band_idx;
 771                 u8 rsv[3];
 772                 __le32 feature;
 773                 u8 omac_idx;
 774                 u8 wmm_idx;
 775                 u8 bcn_loss_cnt;
 776                 u8 bcn_sp_duration;
 777         } __packed req = {
 778                 .pm_number = 5,
 779                 .pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
 780                 .band_idx = band,
 781         };
 782
 783         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL),
 784                                  &req, sizeof(req), true);
 785 }
 786
 787 static int
 788 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 789                          struct ieee80211_sta *sta, struct mt7615_phy *phy,
 790                          bool enable)
 791 {
 792         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 793         u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
 794         struct bss_info_basic *bss;
 795         u8 wlan_idx = mvif->sta.wcid.idx;
 796         struct tlv *tlv;
 797
 798         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 799
 800         switch (vif->type) {
 801         case NL80211_IFTYPE_MESH_POINT:
 802         case NL80211_IFTYPE_AP:
 803         case NL80211_IFTYPE_MONITOR:
 804                 break;
 805         case NL80211_IFTYPE_STATION:
 806                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 807                 if (enable && sta) {
 808                         struct mt7615_sta *msta;
 809
 810                         msta = (struct mt7615_sta *)sta->drv_priv;
 811                         wlan_idx = msta->wcid.idx;
 812                 }
 813                 break;
 814         case NL80211_IFTYPE_ADHOC:
 815                 type = NETWORK_IBSS;
 816                 break;
 817         default:
 818                 WARN_ON(1);
 819                 break;
 820         }
 821
 822         bss = (struct bss_info_basic *)tlv;
 823         bss->network_type = cpu_to_le32(type);
 824         bss->bmc_wcid_lo = wlan_idx;
 825         bss->wmm_idx = mvif->mt76.wmm_idx;
 826         bss->active = enable;
 827
 828         if (vif->type != NL80211_IFTYPE_MONITOR) {
 829                 memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 830                 bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 831                 bss->dtim_period = vif->bss_conf.dtim_period;
 832         } else {
 833                 memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
 834         }
 835
 836         return 0;
 837 }
 838
 839 static void
 840 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 841 {
 842         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 843         u8 omac_idx = mvif->mt76.omac_idx;
 844         struct bss_info_omac *omac;
 845         struct tlv *tlv;
 846         u32 type = 0;
 847
 848         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 849
 850         switch (vif->type) {
 851         case NL80211_IFTYPE_MONITOR:
 852         case NL80211_IFTYPE_MESH_POINT:
 853         case NL80211_IFTYPE_AP:
 854                 if (vif->p2p)
 855                         type = CONNECTION_P2P_GO;
 856                 else
 857                         type = CONNECTION_INFRA_AP;
 858                 break;
 859         case NL80211_IFTYPE_STATION:
 860                 if (vif->p2p)
 861                         type = CONNECTION_P2P_GC;
 862                 else
 863                         type = CONNECTION_INFRA_STA;
 864                 break;
 865         case NL80211_IFTYPE_ADHOC:
 866                 type = CONNECTION_IBSS_ADHOC;
 867                 break;
 868         default:
 869                 WARN_ON(1);
 870                 break;
 871         }
 872
 873         omac = (struct bss_info_omac *)tlv;
 874         omac->conn_type = cpu_to_le32(type);
 875         omac->omac_idx = mvif->mt76.omac_idx;
 876         omac->band_idx = mvif->mt76.band_idx;
 877         omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
 878 }
 879
 880 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 881 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 882 static void
 883 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
 884 {
 885         struct bss_info_ext_bss *ext;
 886         int ext_bss_idx, tsf_offset;
 887         struct tlv *tlv;
 888
 889         ext_bss_idx = mvif->mt76.omac_idx - EXT_BSSID_START;
 890         if (ext_bss_idx < 0)
 891                 return;
 892
 893         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 894
 895         ext = (struct bss_info_ext_bss *)tlv;
 896         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 897         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 898 }
 899
 900 static int
 901 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 902                    struct ieee80211_sta *sta, bool enable)
 903 {
 904         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 905         struct mt7615_dev *dev = phy->dev;
 906         struct sk_buff *skb;
 907
 908         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
 909                 mt7615_mcu_muar_config(dev, vif, true, enable);
 910
 911         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
 912         if (IS_ERR(skb))
 913                 return PTR_ERR(skb);
 914
 915         if (enable)
 916                 mt7615_mcu_bss_omac_tlv(skb, vif);
 917
 918         mt7615_mcu_bss_basic_tlv(skb, vif, sta, phy, enable);
 919
 920         if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
 921             mvif->mt76.omac_idx < REPEATER_BSSID_START)
 922                 mt7615_mcu_bss_ext_tlv(skb, mvif);
 923
 924         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 925                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
 926 }
 927
 928 static int
 929 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
 930                       struct ieee80211_ampdu_params *params,
 931                       bool enable)
 932 {
 933         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 934         struct mt7615_vif *mvif = msta->vif;
 935         struct wtbl_req_hdr *wtbl_hdr;
 936         struct sk_buff *skb = NULL;
 937         int err;
 938
 939         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 940                                                   WTBL_SET, NULL, &skb);
 941         if (IS_ERR(wtbl_hdr))
 942                 return PTR_ERR(wtbl_hdr);
 943
 944         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
 945                                     NULL, wtbl_hdr);
 946
 947         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 948                                     MCU_EXT_CMD(WTBL_UPDATE), true);
 949         if (err < 0)
 950                 return err;
 951
 952         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 953                                             &msta->wcid);
 954         if (IS_ERR(skb))
 955                 return PTR_ERR(skb);
 956
 957         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
 958
 959         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 960                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
 961 }
 962
 963 static int
 964 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
 965                       struct ieee80211_ampdu_params *params,
 966                       bool enable)
 967 {
 968         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 969         struct mt7615_vif *mvif = msta->vif;
 970         struct wtbl_req_hdr *wtbl_hdr;
 971         struct sk_buff *skb;
 972         int err;
 973
 974         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 975                                             &msta->wcid);
 976         if (IS_ERR(skb))
 977                 return PTR_ERR(skb);
 978
 979         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
 980
 981         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 982                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
 983         if (err < 0 || !enable)
 984                 return err;
 985
 986         skb = NULL;
 987         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 988                                                   WTBL_SET, NULL, &skb);
 989         if (IS_ERR(wtbl_hdr))
 990                 return PTR_ERR(wtbl_hdr);
 991
 992         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
 993                                     NULL, wtbl_hdr);
 994
 995         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 996                                      MCU_EXT_CMD(WTBL_UPDATE), true);
 997 }
 998
 999 static int
1000 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1001                         struct ieee80211_sta *sta, bool enable)
1002 {
1003         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1004         struct sk_buff *skb, *sskb, *wskb = NULL;
1005         struct mt7615_dev *dev = phy->dev;
1006         struct wtbl_req_hdr *wtbl_hdr;
1007         struct mt7615_sta *msta;
1008         int cmd, err;
1009
1010         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1011
1012         sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1013                                              &msta->wcid);
1014         if (IS_ERR(sskb))
1015                 return PTR_ERR(sskb);
1016
1017         mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable, true);
1018         if (enable && sta)
1019                 mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
1020                                         MT76_STA_INFO_STATE_ASSOC);
1021
1022         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1023                                                   WTBL_RESET_AND_SET, NULL,
1024                                                   &wskb);
1025         if (IS_ERR(wtbl_hdr))
1026                 return PTR_ERR(wtbl_hdr);
1027
1028         if (enable) {
1029                 mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
1030                                                  NULL, wtbl_hdr);
1031                 if (sta)
1032                         mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
1033                                                     NULL, wtbl_hdr);
1034                 mt76_connac_mcu_wtbl_hdr_trans_tlv(wskb, vif, &msta->wcid,
1035                                                    NULL, wtbl_hdr);
1036         }
1037
1038         cmd = enable ? MCU_EXT_CMD(WTBL_UPDATE) : MCU_EXT_CMD(STA_REC_UPDATE);
1039         skb = enable ? wskb : sskb;
1040
1041         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1042         if (err < 0) {
1043                 skb = enable ? sskb : wskb;
1044                 dev_kfree_skb(skb);
1045
1046                 return err;
1047         }
1048
1049         cmd = enable ? MCU_EXT_CMD(STA_REC_UPDATE) : MCU_EXT_CMD(WTBL_UPDATE);
1050         skb = enable ? sskb : wskb;
1051
1052         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1053 }
1054
1055 static int
1056 mt7615_mcu_wtbl_update_hdr_trans(struct mt7615_dev *dev,
1057                                  struct ieee80211_vif *vif,
1058                                  struct ieee80211_sta *sta)
1059 {
1060         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1061         struct wtbl_req_hdr *wtbl_hdr;
1062         struct sk_buff *skb = NULL;
1063
1064         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1065                                                   WTBL_SET, NULL, &skb);
1066         if (IS_ERR(wtbl_hdr))
1067                 return PTR_ERR(wtbl_hdr);
1068
1069         mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, &msta->wcid, NULL,
1070                                            wtbl_hdr);
1071         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1072                                      MCU_EXT_CMD(WTBL_UPDATE), true);
1073 }
1074
1075 static const struct mt7615_mcu_ops wtbl_update_ops = {
1076         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1077         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1078         .add_dev_info = mt7615_mcu_add_dev,
1079         .add_bss_info = mt7615_mcu_add_bss,
1080         .add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1081         .add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1082         .sta_add = mt7615_mcu_wtbl_sta_add,
1083         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1084         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1085         .set_sta_decap_offload = mt7615_mcu_wtbl_update_hdr_trans,
1086 };
1087
1088 static int
1089 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1090                   struct ieee80211_ampdu_params *params,
1091                   bool enable, bool tx)
1092 {
1093         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1094         struct mt7615_vif *mvif = msta->vif;
1095         struct wtbl_req_hdr *wtbl_hdr;
1096         struct tlv *sta_wtbl;
1097         struct sk_buff *skb;
1098
1099         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1100                                             &msta->wcid);
1101         if (IS_ERR(skb))
1102                 return PTR_ERR(skb);
1103
1104         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1105
1106         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1107
1108         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1109                                                   WTBL_SET, sta_wtbl, &skb);
1110         if (IS_ERR(wtbl_hdr))
1111                 return PTR_ERR(wtbl_hdr);
1112
1113         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
1114                                     sta_wtbl, wtbl_hdr);
1115
1116         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1117                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1118 }
1119
1120 static int
1121 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1122                      struct ieee80211_ampdu_params *params,
1123                      bool enable)
1124 {
1125         return mt7615_mcu_sta_ba(dev, params, enable, true);
1126 }
1127
1128 static int
1129 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1130                      struct ieee80211_ampdu_params *params,
1131                      bool enable)
1132 {
1133         return mt7615_mcu_sta_ba(dev, params, enable, false);
1134 }
1135
1136 static int
1137 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
1138                      struct ieee80211_sta *sta, bool enable, int cmd,
1139                      bool offload_fw)
1140 {
1141         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1142         struct mt76_sta_cmd_info info = {
1143                 .sta = sta,
1144                 .vif = vif,
1145                 .offload_fw = offload_fw,
1146                 .enable = enable,
1147                 .newly = true,
1148                 .cmd = cmd,
1149         };
1150
1151         info.wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
1152         return mt76_connac_mcu_sta_cmd(phy, &info);
1153 }
1154
1155 static int
1156 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1157                    struct ieee80211_sta *sta, bool enable)
1158 {
1159         return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1160                                     MCU_EXT_CMD(STA_REC_UPDATE), false);
1161 }
1162
1163 static int
1164 mt7615_mcu_sta_update_hdr_trans(struct mt7615_dev *dev,
1165                                 struct ieee80211_vif *vif,
1166                                 struct ieee80211_sta *sta)
1167 {
1168         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1169
1170         return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1171                                                     vif, &msta->wcid,
1172                                                     MCU_EXT_CMD(STA_REC_UPDATE));
1173 }
1174
1175 static const struct mt7615_mcu_ops sta_update_ops = {
1176         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1177         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1178         .add_dev_info = mt7615_mcu_add_dev,
1179         .add_bss_info = mt7615_mcu_add_bss,
1180         .add_tx_ba = mt7615_mcu_sta_tx_ba,
1181         .add_rx_ba = mt7615_mcu_sta_rx_ba,
1182         .sta_add = mt7615_mcu_add_sta,
1183         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1184         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1185         .set_sta_decap_offload = mt7615_mcu_sta_update_hdr_trans,
1186 };
1187
1188 static int
1189 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1190 {
1191         return 0;
1192 }
1193
1194 static int
1195 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1196                                   struct ieee80211_hw *hw,
1197                                   struct ieee80211_vif *vif,
1198                                   bool enable)
1199 {
1200         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1201         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1202         struct ieee80211_mutable_offsets offs;
1203         struct {
1204                 struct req_hdr {
1205                         u8 bss_idx;
1206                         u8 pad[3];
1207                 } __packed hdr;
1208                 struct bcn_content_tlv {
1209                         __le16 tag;
1210                         __le16 len;
1211                         __le16 tim_ie_pos;
1212                         __le16 csa_ie_pos;
1213                         __le16 bcc_ie_pos;
1214                         /* 0: disable beacon offload
1215                          * 1: enable beacon offload
1216                          * 2: update probe respond offload
1217                          */
1218                         u8 enable;
1219                         /* 0: legacy format (TXD + payload)
1220                          * 1: only cap field IE
1221                          */
1222                         u8 type;
1223                         __le16 pkt_len;
1224                         u8 pkt[512];
1225                 } __packed beacon_tlv;
1226         } req = {
1227                 .hdr = {
1228                         .bss_idx = mvif->mt76.idx,
1229                 },
1230                 .beacon_tlv = {
1231                         .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1232                         .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1233                         .enable = enable,
1234                 },
1235         };
1236         struct sk_buff *skb;
1237
1238         if (!enable)
1239                 goto out;
1240
1241         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1242         if (!skb)
1243                 return -EINVAL;
1244
1245         if (skb->len > 512 - MT_TXD_SIZE) {
1246                 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1247                 dev_kfree_skb(skb);
1248                 return -EINVAL;
1249         }
1250
1251         mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1252                               wcid, NULL, 0, NULL, true);
1253         memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1254         req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1255         req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1256
1257         if (offs.cntdwn_counter_offs[0]) {
1258                 u16 csa_offs;
1259
1260                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1261                 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1262         }
1263         dev_kfree_skb(skb);
1264
1265 out:
1266         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1267                                  &req, sizeof(req), true);
1268 }
1269
1270 static int
1271 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1272                        bool enable)
1273 {
1274         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1275
1276         return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1277                                            enable);
1278 }
1279
1280 static int
1281 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1282                        struct ieee80211_sta *sta, bool enable)
1283 {
1284         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1285
1286         return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1287                                            enable);
1288 }
1289
1290 static inline int
1291 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1292                        struct ieee80211_sta *sta, bool enable)
1293 {
1294         return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1295                                     MCU_UNI_CMD(STA_REC_UPDATE), true);
1296 }
1297
1298 static int
1299 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1300                      struct ieee80211_ampdu_params *params,
1301                      bool enable)
1302 {
1303         struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1304
1305         return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1306                                       enable, true);
1307 }
1308
1309 static int
1310 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1311                      struct ieee80211_ampdu_params *params,
1312                      bool enable)
1313 {
1314         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1315         struct mt7615_vif *mvif = msta->vif;
1316         struct wtbl_req_hdr *wtbl_hdr;
1317         struct tlv *sta_wtbl;
1318         struct sk_buff *skb;
1319         int err;
1320
1321         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1322                                             &msta->wcid);
1323         if (IS_ERR(skb))
1324                 return PTR_ERR(skb);
1325
1326         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1327
1328         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1329                                     MCU_UNI_CMD(STA_REC_UPDATE), true);
1330         if (err < 0 || !enable)
1331                 return err;
1332
1333         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1334                                             &msta->wcid);
1335         if (IS_ERR(skb))
1336                 return PTR_ERR(skb);
1337
1338         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1339                                            sizeof(struct tlv));
1340
1341         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1342                                                   WTBL_SET, sta_wtbl, &skb);
1343         if (IS_ERR(wtbl_hdr))
1344                 return PTR_ERR(wtbl_hdr);
1345
1346         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1347                                     sta_wtbl, wtbl_hdr);
1348
1349         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1350                                      MCU_UNI_CMD(STA_REC_UPDATE), true);
1351 }
1352
1353 static int
1354 mt7615_mcu_sta_uni_update_hdr_trans(struct mt7615_dev *dev,
1355                                     struct ieee80211_vif *vif,
1356                                     struct ieee80211_sta *sta)
1357 {
1358         struct mt7615_sta *msta = (struct mt7615_sta *)sta->drv_priv;
1359
1360         return mt76_connac_mcu_sta_update_hdr_trans(&dev->mt76,
1361                                                     vif, &msta->wcid,
1362                                                     MCU_UNI_CMD(STA_REC_UPDATE));
1363 }
1364
1365 static const struct mt7615_mcu_ops uni_update_ops = {
1366         .add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1367         .set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1368         .add_dev_info = mt7615_mcu_uni_add_dev,
1369         .add_bss_info = mt7615_mcu_uni_add_bss,
1370         .add_tx_ba = mt7615_mcu_uni_tx_ba,
1371         .add_rx_ba = mt7615_mcu_uni_rx_ba,
1372         .sta_add = mt7615_mcu_uni_add_sta,
1373         .set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1374         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1375         .set_sta_decap_offload = mt7615_mcu_sta_uni_update_hdr_trans,
1376 };
1377
1378 int mt7615_mcu_restart(struct mt76_dev *dev)
1379 {
1380         return mt76_mcu_send_msg(dev, MCU_CMD(RESTART_DL_REQ), NULL, 0, true);
1381 }
1382 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1383
1384 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1385 {
1386         const struct mt7615_patch_hdr *hdr;
1387         const struct firmware *fw = NULL;
1388         int len, ret, sem;
1389
1390         ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1391         if (ret)
1392                 return ret;
1393
1394         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1395                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1396                 ret = -EINVAL;
1397                 goto release_fw;
1398         }
1399
1400         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1401         switch (sem) {
1402         case PATCH_IS_DL:
1403                 goto release_fw;
1404         case PATCH_NOT_DL_SEM_SUCCESS:
1405                 break;
1406         default:
1407                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1408                 ret = -EAGAIN;
1409                 goto release_fw;
1410         }
1411
1412         hdr = (const struct mt7615_patch_hdr *)(fw->data);
1413
1414         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1415                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1416
1417         len = fw->size - sizeof(*hdr);
1418
1419         ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1420                                             DL_MODE_NEED_RSP);
1421         if (ret) {
1422                 dev_err(dev->mt76.dev, "Download request failed\n");
1423                 goto out;
1424         }
1425
1426         ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1427                                      fw->data + sizeof(*hdr), len);
1428         if (ret) {
1429                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1430                 goto out;
1431         }
1432
1433         ret = mt76_connac_mcu_start_patch(&dev->mt76);
1434         if (ret)
1435                 dev_err(dev->mt76.dev, "Failed to start patch\n");
1436
1437 out:
1438         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1439         switch (sem) {
1440         case PATCH_REL_SEM_SUCCESS:
1441                 break;
1442         default:
1443                 ret = -EAGAIN;
1444                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1445                 break;
1446         }
1447
1448 release_fw:
1449         release_firmware(fw);
1450
1451         return ret;
1452 }
1453
1454 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1455 {
1456         u32 ret = 0;
1457
1458         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1459                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1460         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1461                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1462         ret |= DL_MODE_NEED_RSP;
1463         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1464
1465         return ret;
1466 }
1467
1468 static int
1469 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1470                              const struct mt7615_fw_trailer *hdr,
1471                              const u8 *data, bool is_cr4)
1472 {
1473         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1474         int err, i, offset = 0;
1475         u32 len, addr, mode;
1476
1477         for (i = 0; i < n_region; i++) {
1478                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1479                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1480                 addr = le32_to_cpu(hdr[i].addr);
1481
1482                 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1483                                                     mode);
1484                 if (err) {
1485                         dev_err(dev->mt76.dev, "Download request failed\n");
1486                         return err;
1487                 }
1488
1489                 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1490                                              data + offset, len);
1491                 if (err) {
1492                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1493                         return err;
1494                 }
1495
1496                 offset += len;
1497         }
1498
1499         return 0;
1500 }
1501
1502 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1503 {
1504         const struct mt7615_fw_trailer *hdr;
1505         const struct firmware *fw;
1506         int ret;
1507
1508         ret = request_firmware(&fw, name, dev->mt76.dev);
1509         if (ret)
1510                 return ret;
1511
1512         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1513                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1514                 ret = -EINVAL;
1515                 goto out;
1516         }
1517
1518         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1519                                         N9_REGION_NUM * sizeof(*hdr));
1520
1521         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1522                  hdr->fw_ver, hdr->build_date);
1523
1524         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1525         if (ret)
1526                 goto out;
1527
1528         ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1529                                              le32_to_cpu(hdr->addr),
1530                                              FW_START_OVERRIDE);
1531         if (ret) {
1532                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1533                 goto out;
1534         }
1535
1536         snprintf(dev->mt76.hw->wiphy->fw_version,
1537                  sizeof(dev->mt76.hw->wiphy->fw_version),
1538                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1539
1540         if (!is_mt7615(&dev->mt76)) {
1541                 dev->fw_ver = MT7615_FIRMWARE_V2;
1542                 dev->mcu_ops = &sta_update_ops;
1543         } else {
1544                 dev->fw_ver = MT7615_FIRMWARE_V1;
1545                 dev->mcu_ops = &wtbl_update_ops;
1546         }
1547
1548 out:
1549         release_firmware(fw);
1550         return ret;
1551 }
1552
1553 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1554 {
1555         const struct mt7615_fw_trailer *hdr;
1556         const struct firmware *fw;
1557         int ret;
1558
1559         ret = request_firmware(&fw, name, dev->mt76.dev);
1560         if (ret)
1561                 return ret;
1562
1563         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1564                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1565                 ret = -EINVAL;
1566                 goto out;
1567         }
1568
1569         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1570                                         CR4_REGION_NUM * sizeof(*hdr));
1571
1572         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1573                  hdr->fw_ver, hdr->build_date);
1574
1575         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1576         if (ret)
1577                 goto out;
1578
1579         ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1580                                              FW_START_WORKING_PDA_CR4);
1581         if (ret) {
1582                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1583                 goto out;
1584         }
1585
1586 out:
1587         release_firmware(fw);
1588
1589         return ret;
1590 }
1591
1592 static int mt7615_load_ram(struct mt7615_dev *dev)
1593 {
1594         int ret;
1595
1596         ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1597         if (ret)
1598                 return ret;
1599
1600         return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1601 }
1602
1603 static int mt7615_load_firmware(struct mt7615_dev *dev)
1604 {
1605         int ret;
1606         u32 val;
1607
1608         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1609
1610         if (val != FW_STATE_FW_DOWNLOAD) {
1611                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1612                 return -EIO;
1613         }
1614
1615         ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1616         if (ret)
1617                 return ret;
1618
1619         ret = mt7615_load_ram(dev);
1620         if (ret)
1621                 return ret;
1622
1623         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1624                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1625                                        FW_STATE_RDY), 500)) {
1626                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1627                 return -EIO;
1628         }
1629
1630         return 0;
1631 }
1632
1633 static int mt7622_load_firmware(struct mt7615_dev *dev)
1634 {
1635         int ret;
1636         u32 val;
1637
1638         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1639
1640         val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1641         if (val != FW_STATE_FW_DOWNLOAD) {
1642                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1643                 return -EIO;
1644         }
1645
1646         ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1647         if (ret)
1648                 return ret;
1649
1650         ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1651         if (ret)
1652                 return ret;
1653
1654         if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1655                             FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1656                                        FW_STATE_NORMAL_TRX), 1500)) {
1657                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1658                 return -EIO;
1659         }
1660
1661         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1662
1663         return 0;
1664 }
1665
1666 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1667 {
1668         struct {
1669                 u8 ctrl_val;
1670                 u8 pad[3];
1671         } data = {
1672                 .ctrl_val = ctrl
1673         };
1674
1675         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST),
1676                                  &data, sizeof(data), true);
1677 }
1678
1679 static int mt7615_mcu_cal_cache_apply(struct mt7615_dev *dev)
1680 {
1681         struct {
1682                 bool cache_enable;
1683                 u8 pad[3];
1684         } data = {
1685                 .cache_enable = true
1686         };
1687
1688         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CAL_CACHE), &data,
1689                                  sizeof(data), false);
1690 }
1691
1692 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1693 {
1694         u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1695         const struct mt7663_fw_trailer *hdr;
1696         const struct mt7663_fw_buf *buf;
1697         const struct firmware *fw;
1698         const u8 *base_addr;
1699         int i, ret;
1700
1701         ret = request_firmware(&fw, name, dev->mt76.dev);
1702         if (ret)
1703                 return ret;
1704
1705         if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1706                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1707                 ret = -EINVAL;
1708                 goto out;
1709         }
1710
1711         hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
1712                                                  FW_V3_COMMON_TAILER_SIZE);
1713
1714         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1715                  hdr->fw_ver, hdr->build_date);
1716         dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1717
1718         base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1719         for (i = 0; i < hdr->n_region; i++) {
1720                 u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1721                 u32 len, addr, mode;
1722
1723                 dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1724
1725                 buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1726                 mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
1727                 addr = le32_to_cpu(buf->img_dest_addr);
1728                 len = le32_to_cpu(buf->img_size);
1729
1730                 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1731                                                     mode);
1732                 if (ret) {
1733                         dev_err(dev->mt76.dev, "Download request failed\n");
1734                         goto out;
1735                 }
1736
1737                 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
1738                                              fw->data + offset, len);
1739                 if (ret) {
1740                         dev_err(dev->mt76.dev, "Failed to send firmware\n");
1741                         goto out;
1742                 }
1743
1744                 offset += le32_to_cpu(buf->img_size);
1745                 if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1746                         override_addr = le32_to_cpu(buf->img_dest_addr);
1747                         dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1748                                  i, override_addr);
1749                 }
1750         }
1751
1752         if (override_addr)
1753                 flag |= FW_START_OVERRIDE;
1754
1755         dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1756                  override_addr, flag);
1757
1758         ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1759         if (ret) {
1760                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1761                 goto out;
1762         }
1763
1764         snprintf(dev->mt76.hw->wiphy->fw_version,
1765                  sizeof(dev->mt76.hw->wiphy->fw_version),
1766                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1767
1768 out:
1769         release_firmware(fw);
1770
1771         return ret;
1772 }
1773
1774 static int
1775 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1776 {
1777         const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1778         const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1779         int ret;
1780
1781         if (!prefer_offload_fw) {
1782                 secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1783                 primary_rom = MT7663_ROM_PATCH;
1784         }
1785         selected_rom = primary_rom;
1786
1787         ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1788         if (ret) {
1789                 dev_info(dev->mt76.dev, "%s not found, switching to %s",
1790                          primary_rom, secondary_rom);
1791                 ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1792                                         secondary_rom);
1793                 if (ret) {
1794                         dev_err(dev->mt76.dev, "failed to load %s",
1795                                 secondary_rom);
1796                         return ret;
1797                 }
1798                 selected_rom = secondary_rom;
1799         }
1800
1801         if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1802                 *n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1803                 dev->fw_ver = MT7615_FIRMWARE_V3;
1804                 dev->mcu_ops = &uni_update_ops;
1805         } else {
1806                 *n9_firmware = MT7663_FIRMWARE_N9;
1807                 dev->fw_ver = MT7615_FIRMWARE_V2;
1808                 dev->mcu_ops = &sta_update_ops;
1809         }
1810
1811         return 0;
1812 }
1813
1814 int __mt7663_load_firmware(struct mt7615_dev *dev)
1815 {
1816         const char *n9_firmware;
1817         int ret;
1818
1819         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1820         if (ret) {
1821                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1822                 return -EIO;
1823         }
1824
1825         ret = mt7663_load_rom_patch(dev, &n9_firmware);
1826         if (ret)
1827                 return ret;
1828
1829         ret = mt7663_load_n9(dev, n9_firmware);
1830         if (ret)
1831                 return ret;
1832
1833         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1834                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1835                 ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1836                                      MT7663_TOP_MISC2_FW_STATE);
1837                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1838                 return -EIO;
1839         }
1840
1841 #ifdef CONFIG_PM
1842         if (mt7615_firmware_offload(dev))
1843                 dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1844 #endif /* CONFIG_PM */
1845
1846         dev_dbg(dev->mt76.dev, "Firmware init done\n");
1847
1848         return 0;
1849 }
1850 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1851
1852 static int mt7663_load_firmware(struct mt7615_dev *dev)
1853 {
1854         int ret;
1855
1856         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1857
1858         ret = __mt7663_load_firmware(dev);
1859         if (ret)
1860                 return ret;
1861
1862         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1863
1864         return 0;
1865 }
1866
1867 int mt7615_mcu_init(struct mt7615_dev *dev)
1868 {
1869         static const struct mt76_mcu_ops mt7615_mcu_ops = {
1870                 .headroom = sizeof(struct mt7615_mcu_txd),
1871                 .mcu_skb_send_msg = mt7615_mcu_send_message,
1872                 .mcu_parse_response = mt7615_mcu_parse_response,
1873                 .mcu_restart = mt7615_mcu_restart,
1874         };
1875         int ret;
1876
1877         dev->mt76.mcu_ops = &mt7615_mcu_ops,
1878
1879         ret = mt7615_mcu_drv_pmctrl(dev);
1880         if (ret)
1881                 return ret;
1882
1883         switch (mt76_chip(&dev->mt76)) {
1884         case 0x7622:
1885                 ret = mt7622_load_firmware(dev);
1886                 break;
1887         case 0x7663:
1888                 ret = mt7663_load_firmware(dev);
1889                 break;
1890         default:
1891                 ret = mt7615_load_firmware(dev);
1892                 break;
1893         }
1894         if (ret)
1895                 return ret;
1896
1897         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1898         dev_dbg(dev->mt76.dev, "Firmware init done\n");
1899         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1900
1901         if (dev->dbdc_support) {
1902                 ret = mt7615_mcu_cal_cache_apply(dev);
1903                 if (ret)
1904                         return ret;
1905         }
1906
1907         return mt7615_mcu_fw_log_2_host(dev, 0);
1908 }
1909 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1910
1911 void mt7615_mcu_exit(struct mt7615_dev *dev)
1912 {
1913         __mt76_mcu_restart(&dev->mt76);
1914         mt7615_mcu_set_fw_ctrl(dev);
1915         skb_queue_purge(&dev->mt76.mcu.res_q);
1916 }
1917 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1918
1919 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1920 {
1921         struct {
1922                 u8 buffer_mode;
1923                 u8 content_format;
1924                 __le16 len;
1925         } __packed req_hdr = {
1926                 .buffer_mode = 1,
1927         };
1928         u8 *eep = (u8 *)dev->mt76.eeprom.data;
1929         struct sk_buff *skb;
1930         int eep_len, offset;
1931
1932         switch (mt76_chip(&dev->mt76)) {
1933         case 0x7622:
1934                 eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1935                 offset = MT_EE_NIC_CONF_0;
1936                 break;
1937         case 0x7663:
1938                 eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1939                 req_hdr.content_format = 1;
1940                 offset = MT_EE_CHIP_ID;
1941                 break;
1942         default:
1943                 eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1944                 offset = MT_EE_NIC_CONF_0;
1945                 break;
1946         }
1947
1948         req_hdr.len = cpu_to_le16(eep_len);
1949
1950         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1951         if (!skb)
1952                 return -ENOMEM;
1953
1954         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1955         skb_put_data(skb, eep + offset, eep_len);
1956
1957         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1958                                      MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
1959 }
1960
1961 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1962                        const struct ieee80211_tx_queue_params *params)
1963 {
1964 #define WMM_AIFS_SET    BIT(0)
1965 #define WMM_CW_MIN_SET  BIT(1)
1966 #define WMM_CW_MAX_SET  BIT(2)
1967 #define WMM_TXOP_SET    BIT(3)
1968 #define WMM_PARAM_SET   (WMM_AIFS_SET | WMM_CW_MIN_SET | \
1969                          WMM_CW_MAX_SET | WMM_TXOP_SET)
1970         struct req_data {
1971                 u8 number;
1972                 u8 rsv[3];
1973                 u8 queue;
1974                 u8 valid;
1975                 u8 aifs;
1976                 u8 cw_min;
1977                 __le16 cw_max;
1978                 __le16 txop;
1979         } __packed req = {
1980                 .number = 1,
1981                 .queue = queue,
1982                 .valid = WMM_PARAM_SET,
1983                 .aifs = params->aifs,
1984                 .cw_min = 5,
1985                 .cw_max = cpu_to_le16(10),
1986                 .txop = cpu_to_le16(params->txop),
1987         };
1988
1989         if (params->cw_min)
1990                 req.cw_min = fls(params->cw_min);
1991         if (params->cw_max)
1992                 req.cw_max = cpu_to_le16(fls(params->cw_max));
1993
1994         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
1995                                  &req, sizeof(req), true);
1996 }
1997
1998 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1999 {
2000         struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2001         struct dbdc_entry {
2002                 u8 type;
2003                 u8 index;
2004                 u8 band;
2005                 u8 _rsv;
2006         };
2007         struct {
2008                 u8 enable;
2009                 u8 num;
2010                 u8 _rsv[2];
2011                 struct dbdc_entry entry[64];
2012         } req = {
2013                 .enable = !!ext_phy,
2014         };
2015         int i;
2016
2017         if (!ext_phy)
2018                 goto out;
2019
2020 #define ADD_DBDC_ENTRY(_type, _idx, _band)              \
2021         do { \
2022                 req.entry[req.num].type = _type;                \
2023                 req.entry[req.num].index = _idx;                \
2024                 req.entry[req.num++].band = _band;              \
2025         } while (0)
2026
2027         for (i = 0; i < 4; i++) {
2028                 bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
2029
2030                 ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2031         }
2032
2033         for (i = 0; i < 14; i++) {
2034                 bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
2035
2036                 ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2037         }
2038
2039         ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2040
2041         for (i = 0; i < 3; i++)
2042                 ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2043
2044         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2045         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2046         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2047         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2048
2049         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2050         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2051
2052 out:
2053         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DBDC_CTRL), &req,
2054                                  sizeof(req), true);
2055 }
2056
2057 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2058 {
2059         struct wtbl_req_hdr req = {
2060                 .operation = WTBL_RESET_ALL,
2061         };
2062
2063         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(WTBL_UPDATE),
2064                                  &req, sizeof(req), true);
2065 }
2066
2067 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2068                        enum mt7615_rdd_cmd cmd, u8 index,
2069                        u8 rx_sel, u8 val)
2070 {
2071         struct {
2072                 u8 ctrl;
2073                 u8 rdd_idx;
2074                 u8 rdd_rx_sel;
2075                 u8 val;
2076                 u8 rsv[4];
2077         } req = {
2078                 .ctrl = cmd,
2079                 .rdd_idx = index,
2080                 .rdd_rx_sel = rx_sel,
2081                 .val = val,
2082         };
2083
2084         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL),
2085                                  &req, sizeof(req), true);
2086 }
2087
2088 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2089 {
2090         struct {
2091                 __le16 tag;
2092                 __le16 min_lpn;
2093         } req = {
2094                 .tag = cpu_to_le16(0x1),
2095                 .min_lpn = cpu_to_le16(val),
2096         };
2097
2098         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
2099                                  &req, sizeof(req), true);
2100 }
2101
2102 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2103                             const struct mt7615_dfs_pulse *pulse)
2104 {
2105         struct {
2106                 __le16 tag;
2107                 __le32 max_width;       /* us */
2108                 __le32 max_pwr;         /* dbm */
2109                 __le32 min_pwr;         /* dbm */
2110                 __le32 min_stgr_pri;    /* us */
2111                 __le32 max_stgr_pri;    /* us */
2112                 __le32 min_cr_pri;      /* us */
2113                 __le32 max_cr_pri;      /* us */
2114         } req = {
2115                 .tag = cpu_to_le16(0x3),
2116 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2117                 __req_field(max_width),
2118                 __req_field(max_pwr),
2119                 __req_field(min_pwr),
2120                 __req_field(min_stgr_pri),
2121                 __req_field(max_stgr_pri),
2122                 __req_field(min_cr_pri),
2123                 __req_field(max_cr_pri),
2124 #undef  __req_field
2125         };
2126
2127         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
2128                                  &req, sizeof(req), true);
2129 }
2130
2131 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2132                             const struct mt7615_dfs_pattern *pattern)
2133 {
2134         struct {
2135                 __le16 tag;
2136                 __le16 radar_type;
2137                 u8 enb;
2138                 u8 stgr;
2139                 u8 min_crpn;
2140                 u8 max_crpn;
2141                 u8 min_crpr;
2142                 u8 min_pw;
2143                 u8 max_pw;
2144                 __le32 min_pri;
2145                 __le32 max_pri;
2146                 u8 min_crbn;
2147                 u8 max_crbn;
2148                 u8 min_stgpn;
2149                 u8 max_stgpn;
2150                 u8 min_stgpr;
2151         } req = {
2152                 .tag = cpu_to_le16(0x2),
2153                 .radar_type = cpu_to_le16(index),
2154 #define __req_field_u8(field) .field = pattern->field
2155 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2156                 __req_field_u8(enb),
2157                 __req_field_u8(stgr),
2158                 __req_field_u8(min_crpn),
2159                 __req_field_u8(max_crpn),
2160                 __req_field_u8(min_crpr),
2161                 __req_field_u8(min_pw),
2162                 __req_field_u8(max_pw),
2163                 __req_field_u32(min_pri),
2164                 __req_field_u32(max_pri),
2165                 __req_field_u8(min_crbn),
2166                 __req_field_u8(max_crbn),
2167                 __req_field_u8(min_stgpn),
2168                 __req_field_u8(max_stgpn),
2169                 __req_field_u8(min_stgpr),
2170 #undef __req_field_u8
2171 #undef __req_field_u32
2172         };
2173
2174         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RADAR_TH),
2175                                  &req, sizeof(req), true);
2176 }
2177
2178 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2179 {
2180         struct {
2181                 u8 pulse_num;
2182                 u8 rsv[3];
2183                 struct {
2184                         __le32 start_time;
2185                         __le16 width;
2186                         __le16 power;
2187                 } pattern[32];
2188         } req = {
2189                 .pulse_num = dev->radar_pattern.n_pulses,
2190         };
2191         u32 start_time = ktime_to_ms(ktime_get_boottime());
2192         int i;
2193
2194         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2195                 return -EINVAL;
2196
2197         /* TODO: add some noise here */
2198         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2199                 u32 ts = start_time + i * dev->radar_pattern.period;
2200
2201                 req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2202                 req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2203                 req.pattern[i].start_time = cpu_to_le32(ts);
2204         }
2205
2206         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_PATTERN),
2207                                  &req, sizeof(req), false);
2208 }
2209
2210 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2211 {
2212         struct mt76_phy *mphy = phy->mt76;
2213         struct ieee80211_hw *hw = mphy->hw;
2214         struct mt76_power_limits limits;
2215         s8 *limits_array = (s8 *)&limits;
2216         int n_chains = hweight8(mphy->antenna_mask);
2217         int tx_power;
2218         int i;
2219         static const u8 sku_mapping[] = {
2220 #define SKU_FIELD(_type, _field) \
2221                 [MT_SKU_##_type] = offsetof(struct mt76_power_limits, _field)
2222                 SKU_FIELD(CCK_1_2, cck[0]),
2223                 SKU_FIELD(CCK_55_11, cck[2]),
2224                 SKU_FIELD(OFDM_6_9, ofdm[0]),
2225                 SKU_FIELD(OFDM_12_18, ofdm[2]),
2226                 SKU_FIELD(OFDM_24_36, ofdm[4]),
2227                 SKU_FIELD(OFDM_48, ofdm[6]),
2228                 SKU_FIELD(OFDM_54, ofdm[7]),
2229                 SKU_FIELD(HT20_0_8, mcs[0][0]),
2230                 SKU_FIELD(HT20_32, ofdm[0]),
2231                 SKU_FIELD(HT20_1_2_9_10, mcs[0][1]),
2232                 SKU_FIELD(HT20_3_4_11_12, mcs[0][3]),
2233                 SKU_FIELD(HT20_5_13, mcs[0][5]),
2234                 SKU_FIELD(HT20_6_14, mcs[0][6]),
2235                 SKU_FIELD(HT20_7_15, mcs[0][7]),
2236                 SKU_FIELD(HT40_0_8, mcs[1][0]),
2237                 SKU_FIELD(HT40_32, ofdm[0]),
2238                 SKU_FIELD(HT40_1_2_9_10, mcs[1][1]),
2239                 SKU_FIELD(HT40_3_4_11_12, mcs[1][3]),
2240                 SKU_FIELD(HT40_5_13, mcs[1][5]),
2241                 SKU_FIELD(HT40_6_14, mcs[1][6]),
2242                 SKU_FIELD(HT40_7_15, mcs[1][7]),
2243                 SKU_FIELD(VHT20_0, mcs[0][0]),
2244                 SKU_FIELD(VHT20_1_2, mcs[0][1]),
2245                 SKU_FIELD(VHT20_3_4, mcs[0][3]),
2246                 SKU_FIELD(VHT20_5_6, mcs[0][5]),
2247                 SKU_FIELD(VHT20_7, mcs[0][7]),
2248                 SKU_FIELD(VHT20_8, mcs[0][8]),
2249                 SKU_FIELD(VHT20_9, mcs[0][9]),
2250                 SKU_FIELD(VHT40_0, mcs[1][0]),
2251                 SKU_FIELD(VHT40_1_2, mcs[1][1]),
2252                 SKU_FIELD(VHT40_3_4, mcs[1][3]),
2253                 SKU_FIELD(VHT40_5_6, mcs[1][5]),
2254                 SKU_FIELD(VHT40_7, mcs[1][7]),
2255                 SKU_FIELD(VHT40_8, mcs[1][8]),
2256                 SKU_FIELD(VHT40_9, mcs[1][9]),
2257                 SKU_FIELD(VHT80_0, mcs[2][0]),
2258                 SKU_FIELD(VHT80_1_2, mcs[2][1]),
2259                 SKU_FIELD(VHT80_3_4, mcs[2][3]),
2260                 SKU_FIELD(VHT80_5_6, mcs[2][5]),
2261                 SKU_FIELD(VHT80_7, mcs[2][7]),
2262                 SKU_FIELD(VHT80_8, mcs[2][8]),
2263                 SKU_FIELD(VHT80_9, mcs[2][9]),
2264                 SKU_FIELD(VHT160_0, mcs[3][0]),
2265                 SKU_FIELD(VHT160_1_2, mcs[3][1]),
2266                 SKU_FIELD(VHT160_3_4, mcs[3][3]),
2267                 SKU_FIELD(VHT160_5_6, mcs[3][5]),
2268                 SKU_FIELD(VHT160_7, mcs[3][7]),
2269                 SKU_FIELD(VHT160_8, mcs[3][8]),
2270                 SKU_FIELD(VHT160_9, mcs[3][9]),
2271 #undef SKU_FIELD
2272         };
2273
2274         tx_power = hw->conf.power_level * 2 -
2275                    mt76_tx_power_nss_delta(n_chains);
2276
2277         tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
2278                                               &limits, tx_power);
2279         mphy->txpower_cur = tx_power;
2280
2281         if (is_mt7663(mphy->dev)) {
2282                 memset(sku, tx_power, MT_SKU_4SS_DELTA + 1);
2283                 return;
2284         }
2285
2286         for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2287                 sku[i] = limits_array[sku_mapping[i]];
2288
2289         for (i = 0; i < 4; i++) {
2290                 int delta = 0;
2291
2292                 if (i < n_chains - 1)
2293                         delta = mt76_tx_power_nss_delta(n_chains) -
2294                                 mt76_tx_power_nss_delta(i + 1);
2295                 sku[MT_SKU_1SS_DELTA + i] = delta;
2296         }
2297 }
2298
2299 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2300 {
2301         static const u8 width_to_bw[] = {
2302                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2303                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2304                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2305                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2306                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2307                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2308                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2309                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2310         };
2311
2312         if (chandef->width >= ARRAY_SIZE(width_to_bw))
2313                 return 0;
2314
2315         return width_to_bw[chandef->width];
2316 }
2317
2318 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2319 {
2320         struct mt7615_dev *dev = phy->dev;
2321         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2322         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2323         struct {
2324                 u8 control_chan;
2325                 u8 center_chan;
2326                 u8 bw;
2327                 u8 tx_streams;
2328                 u8 rx_streams_mask;
2329                 u8 switch_reason;
2330                 u8 band_idx;
2331                 /* for 80+80 only */
2332                 u8 center_chan2;
2333                 __le16 cac_case;
2334                 u8 channel_band;
2335                 u8 rsv0;
2336                 __le32 outband_freq;
2337                 u8 txpower_drop;
2338                 u8 rsv1[3];
2339                 u8 txpower_sku[53];
2340                 u8 rsv2[3];
2341         } req = {
2342                 .control_chan = chandef->chan->hw_value,
2343                 .center_chan = ieee80211_frequency_to_channel(freq1),
2344                 .tx_streams = hweight8(phy->mt76->antenna_mask),
2345                 .rx_streams_mask = phy->mt76->chainmask,
2346                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
2347         };
2348
2349         if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2350                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2351         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2352                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2353                 req.switch_reason = CH_SWITCH_DFS;
2354         else
2355                 req.switch_reason = CH_SWITCH_NORMAL;
2356
2357         req.band_idx = phy != &dev->phy;
2358         req.bw = mt7615_mcu_chan_bw(chandef);
2359
2360         if (mt76_testmode_enabled(phy->mt76))
2361                 memset(req.txpower_sku, 0x3f, 49);
2362         else
2363                 mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2364
2365         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2366 }
2367
2368 int mt7615_mcu_get_temperature(struct mt7615_dev *dev)
2369 {
2370         struct {
2371                 u8 action;
2372                 u8 rsv[3];
2373         } req = {};
2374
2375         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL),
2376                                  &req, sizeof(req), true);
2377 }
2378
2379 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2380                               u32 val)
2381 {
2382         struct {
2383                 u8 test_mode_en;
2384                 u8 param_idx;
2385                 u8 _rsv[2];
2386
2387                 __le32 value;
2388
2389                 u8 pad[8];
2390         } req = {
2391                 .test_mode_en = test_mode,
2392                 .param_idx = param,
2393                 .value = cpu_to_le32(val),
2394         };
2395
2396         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
2397                                  &req, sizeof(req), false);
2398 }
2399
2400 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2401 {
2402         struct mt7615_dev *dev = phy->dev;
2403         struct {
2404                 u8 format_id;
2405                 u8 sku_enable;
2406                 u8 band_idx;
2407                 u8 rsv;
2408         } req = {
2409                 .format_id = 0,
2410                 .band_idx = phy != &dev->phy,
2411                 .sku_enable = enable,
2412         };
2413
2414         return mt76_mcu_send_msg(&dev->mt76,
2415                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
2416                                  &req, sizeof(req), true);
2417 }
2418
2419 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2420 {
2421         int i;
2422
2423         for (i = 0; i < n_freqs; i++)
2424                 if (cur == freqs[i])
2425                         return i;
2426
2427         return -1;
2428 }
2429
2430 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2431 {
2432         static const u16 freq_list[] = {
2433                 4980, 5805, 5905, 5190,
2434                 5230, 5270, 5310, 5350,
2435                 5390, 5430, 5470, 5510,
2436                 5550, 5590, 5630, 5670,
2437                 5710, 5755, 5795, 5835,
2438                 5875, 5210, 5290, 5370,
2439                 5450, 5530, 5610, 5690,
2440                 5775, 5855
2441         };
2442         static const u16 freq_bw40[] = {
2443                 5190, 5230, 5270, 5310,
2444                 5350, 5390, 5430, 5470,
2445                 5510, 5550, 5590, 5630,
2446                 5670, 5710, 5755, 5795,
2447                 5835, 5875
2448         };
2449         int offset_2g = ARRAY_SIZE(freq_list);
2450         int idx;
2451
2452         if (freq < 4000) {
2453                 if (freq < 2427)
2454                         return offset_2g;
2455                 if (freq < 2442)
2456                         return offset_2g + 1;
2457                 if (freq < 2457)
2458                         return offset_2g + 2;
2459
2460                 return offset_2g + 3;
2461         }
2462
2463         switch (bw) {
2464         case NL80211_CHAN_WIDTH_80:
2465         case NL80211_CHAN_WIDTH_80P80:
2466         case NL80211_CHAN_WIDTH_160:
2467                 break;
2468         default:
2469                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2470                                            freq + 10);
2471                 if (idx >= 0) {
2472                         freq = freq_bw40[idx];
2473                         break;
2474                 }
2475
2476                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2477                                            freq - 10);
2478                 if (idx >= 0) {
2479                         freq = freq_bw40[idx];
2480                         break;
2481                 }
2482                 fallthrough;
2483         case NL80211_CHAN_WIDTH_40:
2484                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2485                                            freq);
2486                 if (idx >= 0)
2487                         break;
2488
2489                 return -1;
2490
2491         }
2492
2493         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2494 }
2495
2496 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2497 {
2498         struct mt7615_dev *dev = phy->dev;
2499         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2500         int freq2 = chandef->center_freq2;
2501         int ret;
2502         struct {
2503                 u8 direction;
2504                 u8 runtime_calibration;
2505                 u8 _rsv[2];
2506
2507                 __le16 center_freq;
2508                 u8 bw;
2509                 u8 band;
2510                 u8 is_freq2;
2511                 u8 success;
2512                 u8 dbdc_en;
2513
2514                 u8 _rsv2;
2515
2516                 struct {
2517                         __le32 sx0_i_lna[4];
2518                         __le32 sx0_q_lna[4];
2519
2520                         __le32 sx2_i_lna[4];
2521                         __le32 sx2_q_lna[4];
2522                 } dcoc_data[4];
2523         } req = {
2524                 .direction = 1,
2525
2526                 .bw = mt7615_mcu_chan_bw(chandef),
2527                 .band = chandef->center_freq1 > 4000,
2528                 .dbdc_en = !!dev->mt76.phy2,
2529         };
2530         u16 center_freq = chandef->center_freq1;
2531         int freq_idx;
2532         u8 *eep = dev->mt76.eeprom.data;
2533
2534         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2535                 return 0;
2536
2537         if (chandef->width == NL80211_CHAN_WIDTH_160) {
2538                 freq2 = center_freq + 40;
2539                 center_freq -= 40;
2540         }
2541
2542 again:
2543         req.runtime_calibration = 1;
2544         freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2545         if (freq_idx < 0)
2546                 goto out;
2547
2548         memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2549                               freq_idx * MT7615_EEPROM_DCOC_SIZE,
2550                sizeof(req.dcoc_data));
2551         req.runtime_calibration = 0;
2552
2553 out:
2554         req.center_freq = cpu_to_le16(center_freq);
2555         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RXDCOC_CAL), &req,
2556                                 sizeof(req), true);
2557
2558         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2559              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2560                 req.is_freq2 = true;
2561                 center_freq = freq2;
2562                 goto again;
2563         }
2564
2565         return ret;
2566 }
2567
2568 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2569 {
2570         static const u16 freq_list[] = {
2571                 4920, 4940, 4960, 4980,
2572                 5040, 5060, 5080, 5180,
2573                 5200, 5220, 5240, 5260,
2574                 5280, 5300, 5320, 5340,
2575                 5360, 5380, 5400, 5420,
2576                 5440, 5460, 5480, 5500,
2577                 5520, 5540, 5560, 5580,
2578                 5600, 5620, 5640, 5660,
2579                 5680, 5700, 5720, 5745,
2580                 5765, 5785, 5805, 5825,
2581                 5845, 5865, 5885, 5905
2582         };
2583         int offset_2g = ARRAY_SIZE(freq_list);
2584         int idx;
2585
2586         if (freq < 4000) {
2587                 if (freq < 2432)
2588                         return offset_2g;
2589                 if (freq < 2457)
2590                         return offset_2g + 1;
2591
2592                 return offset_2g + 2;
2593         }
2594
2595         if (bw != NL80211_CHAN_WIDTH_20) {
2596                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2597                                            freq + 10);
2598                 if (idx >= 0)
2599                         return idx;
2600
2601                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2602                                            freq - 10);
2603                 if (idx >= 0)
2604                         return idx;
2605         }
2606
2607         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2608 }
2609
2610
2611 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2612 {
2613         struct mt7615_dev *dev = phy->dev;
2614         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2615         int freq2 = chandef->center_freq2;
2616         int ret;
2617         struct {
2618                 u8 direction;
2619                 u8 runtime_calibration;
2620                 u8 _rsv[2];
2621
2622                 __le16 center_freq;
2623                 u8 bw;
2624                 u8 band;
2625                 u8 is_freq2;
2626                 u8 success;
2627                 u8 dbdc_en;
2628
2629                 u8 _rsv2;
2630
2631                 struct {
2632                         struct {
2633                                 u32 dpd_g0;
2634                                 u8 data[32];
2635                         } wf0, wf1;
2636
2637                         struct {
2638                                 u32 dpd_g0_prim;
2639                                 u32 dpd_g0_sec;
2640                                 u8 data_prim[32];
2641                                 u8 data_sec[32];
2642                         } wf2, wf3;
2643                 } dpd_data;
2644         } req = {
2645                 .direction = 1,
2646
2647                 .bw = mt7615_mcu_chan_bw(chandef),
2648                 .band = chandef->center_freq1 > 4000,
2649                 .dbdc_en = !!dev->mt76.phy2,
2650         };
2651         u16 center_freq = chandef->center_freq1;
2652         int freq_idx;
2653         u8 *eep = dev->mt76.eeprom.data;
2654
2655         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2656                 return 0;
2657
2658         if (chandef->width == NL80211_CHAN_WIDTH_160) {
2659                 freq2 = center_freq + 40;
2660                 center_freq -= 40;
2661         }
2662
2663 again:
2664         req.runtime_calibration = 1;
2665         freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2666         if (freq_idx < 0)
2667                 goto out;
2668
2669         memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2670                               freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2671                sizeof(req.dpd_data));
2672         req.runtime_calibration = 0;
2673
2674 out:
2675         req.center_freq = cpu_to_le16(center_freq);
2676         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXDPD_CAL),
2677                                 &req, sizeof(req), true);
2678
2679         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2680              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2681                 req.is_freq2 = true;
2682                 center_freq = freq2;
2683                 goto again;
2684         }
2685
2686         return ret;
2687 }
2688
2689 int mt7615_mcu_set_rx_hdr_trans_blacklist(struct mt7615_dev *dev)
2690 {
2691         struct {
2692                 u8 operation;
2693                 u8 count;
2694                 u8 _rsv[2];
2695                 u8 index;
2696                 u8 enable;
2697                 __le16 etype;
2698         } req = {
2699                 .operation = 1,
2700                 .count = 1,
2701                 .enable = 1,
2702                 .etype = cpu_to_le16(ETH_P_PAE),
2703         };
2704
2705         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2706                                  &req, sizeof(req), false);
2707 }
2708
2709 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2710                           bool enable)
2711 {
2712         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2713         struct {
2714                 u8 bss_idx;
2715                 u8 dtim_period;
2716                 __le16 aid;
2717                 __le16 bcn_interval;
2718                 __le16 atim_window;
2719                 u8 uapsd;
2720                 u8 bmc_delivered_ac;
2721                 u8 bmc_triggered_ac;
2722                 u8 pad;
2723         } req = {
2724                 .bss_idx = mvif->mt76.idx,
2725                 .aid = cpu_to_le16(vif->bss_conf.aid),
2726                 .dtim_period = vif->bss_conf.dtim_period,
2727                 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2728         };
2729         struct {
2730                 u8 bss_idx;
2731                 u8 pad[3];
2732         } req_hdr = {
2733                 .bss_idx = mvif->mt76.idx,
2734         };
2735         int err;
2736
2737         if (vif->type != NL80211_IFTYPE_STATION)
2738                 return 0;
2739
2740         err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
2741                                 &req_hdr, sizeof(req_hdr), false);
2742         if (err < 0 || !enable)
2743                 return err;
2744
2745         return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
2746                                  &req, sizeof(req), false);
2747 }
2748
2749 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2750                        struct ieee80211_channel *chan, int duration)
2751 {
2752         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2753         struct mt7615_dev *dev = phy->dev;
2754         struct mt7615_roc_tlv req = {
2755                 .bss_idx = mvif->mt76.idx,
2756                 .active = !chan,
2757                 .max_interval = cpu_to_le32(duration),
2758                 .primary_chan = chan ? chan->hw_value : 0,
2759                 .band = chan ? chan->band : 0,
2760                 .req_type = 2,
2761         };
2762
2763         phy->roc_grant = false;
2764
2765         return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC),
2766                                  &req, sizeof(req), false);
2767 }