drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 struct mt7615_patch_hdr {
  15         char build_date[16];
  16         char platform[4];
  17         __be32 hw_sw_ver;
  18         __be32 patch_ver;
  19         __be16 checksum;
  20 } __packed;
  21
  22 struct mt7615_fw_trailer {
  23         __le32 addr;
  24         u8 chip_id;
  25         u8 feature_set;
  26         u8 eco_code;
  27         char fw_ver[10];
  28         char build_date[15];
  29         __le32 len;
  30 } __packed;
  31
  32 #define FW_V3_COMMON_TAILER_SIZE        36
  33 #define FW_V3_REGION_TAILER_SIZE        40
  34 #define FW_START_OVERRIDE               BIT(0)
  35 #define FW_START_DLYCAL                 BIT(1)
  36 #define FW_START_WORKING_PDA_CR4        BIT(2)
  37
  38 struct mt7663_fw_trailer {
  39         u8 chip_id;
  40         u8 eco_code;
  41         u8 n_region;
  42         u8 format_ver;
  43         u8 format_flag;
  44         u8 reserv[2];
  45         char fw_ver[10];
  46         char build_date[15];
  47         __le32 crc;
  48 } __packed;
  49
  50 struct mt7663_fw_buf {
  51         __le32 crc;
  52         __le32 d_img_size;
  53         __le32 block_size;
  54         u8 rsv[4];
  55         __le32 img_dest_addr;
  56         __le32 img_size;
  57         u8 feature_set;
  58 };
  59
  60 #define MT7615_PATCH_ADDRESS            0x80000
  61 #define MT7622_PATCH_ADDRESS            0x9c000
  62 #define MT7663_PATCH_ADDRESS            0xdc000
  63
  64 #define N9_REGION_NUM                   2
  65 #define CR4_REGION_NUM                  1
  66
  67 #define IMG_CRC_LEN                     4
  68
  69 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  70 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  71
  72 #define DL_MODE_ENCRYPT                 BIT(0)
  73 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  74 #define DL_MODE_RESET_SEC_IV            BIT(3)
  75 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  76 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
  77 #define DL_MODE_NEED_RSP                BIT(31)
  78
  79 #define FW_START_OVERRIDE               BIT(0)
  80 #define FW_START_WORKING_PDA_CR4        BIT(2)
  81
  82 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
  83                          int cmd, int *wait_seq)
  84 {
  85         int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
  86         struct mt7615_uni_txd *uni_txd;
  87         struct mt7615_mcu_txd *mcu_txd;
  88         u8 seq, q_idx, pkt_fmt;
  89         __le32 *txd;
  90         u32 val;
  91
  92         seq = ++dev->mt76.mcu.msg_seq & 0xf;
  93         if (!seq)
  94                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
  95         if (wait_seq)
  96                 *wait_seq = seq;
  97
  98         txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
  99         txd = (__le32 *)skb_push(skb, txd_len);
 100
 101         if (cmd != MCU_CMD_FW_SCATTER) {
 102                 q_idx = MT_TX_MCU_PORT_RX_Q0;
 103                 pkt_fmt = MT_TX_TYPE_CMD;
 104         } else {
 105                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
 106                 pkt_fmt = MT_TX_TYPE_FW;
 107         }
 108
 109         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 110               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
 111               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
 112         txd[0] = cpu_to_le32(val);
 113
 114         val = MT_TXD1_LONG_FORMAT |
 115               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
 116               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
 117         txd[1] = cpu_to_le32(val);
 118
 119         if (cmd & MCU_UNI_PREFIX) {
 120                 uni_txd = (struct mt7615_uni_txd *)txd;
 121                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 122                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 123                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 124                 uni_txd->s2d_index = MCU_S2D_H2N;
 125                 uni_txd->pkt_type = MCU_PKT_ID;
 126                 uni_txd->seq = seq;
 127
 128                 return;
 129         }
 130
 131         mcu_txd = (struct mt7615_mcu_txd *)txd;
 132         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 133         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
 134         mcu_txd->s2d_index = MCU_S2D_H2N;
 135         mcu_txd->pkt_type = MCU_PKT_ID;
 136         mcu_txd->seq = seq;
 137
 138         switch (cmd & ~MCU_CMD_MASK) {
 139         case MCU_FW_PREFIX:
 140                 mcu_txd->set_query = MCU_Q_NA;
 141                 mcu_txd->cid = mcu_cmd;
 142                 break;
 143         case MCU_CE_PREFIX:
 144                 mcu_txd->set_query = MCU_Q_SET;
 145                 mcu_txd->cid = mcu_cmd;
 146                 break;
 147         default:
 148                 mcu_txd->cid = MCU_CMD_EXT_CID;
 149                 mcu_txd->set_query = MCU_Q_SET;
 150                 mcu_txd->ext_cid = cmd;
 151                 mcu_txd->ext_cid_ack = 1;
 152                 break;
 153         }
 154 }
 155
 156 static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
 157                                  int cmd, int *wait_seq)
 158 {
 159         enum mt76_txq_id qid;
 160
 161         mt7615_mcu_fill_msg(dev, skb, cmd, wait_seq);
 162         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 163                 qid = MT_TXQ_MCU;
 164         else
 165                 qid = MT_TXQ_FWDL;
 166
 167         return mt76_tx_queue_skb_raw(dev, qid, skb, 0);
 168 }
 169
 170 static int
 171 mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
 172                           struct sk_buff *skb, int seq)
 173 {
 174         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 175         int ret = 0;
 176
 177         if (seq != rxd->seq)
 178                 return -EAGAIN;
 179
 180         switch (cmd) {
 181         case MCU_CMD_PATCH_SEM_CONTROL:
 182                 skb_pull(skb, sizeof(*rxd) - 4);
 183                 ret = *skb->data;
 184                 break;
 185         case MCU_EXT_CMD_GET_TEMP:
 186                 skb_pull(skb, sizeof(*rxd));
 187                 ret = le32_to_cpu(*(__le32 *)skb->data);
 188                 break;
 189         default:
 190                 break;
 191         }
 192         dev_kfree_skb(skb);
 193
 194         return ret;
 195 }
 196
 197 int mt7615_mcu_wait_response(struct mt7615_dev *dev, int cmd, int seq)
 198 {
 199         unsigned long expires = jiffies + 20 * HZ;
 200         struct sk_buff *skb;
 201         int ret = 0;
 202
 203         while (true) {
 204                 skb = mt76_mcu_get_response(&dev->mt76, expires);
 205                 if (!skb) {
 206                         dev_err(dev->mt76.dev, "Message %ld (seq %d) timeout\n",
 207                                 cmd & MCU_CMD_MASK, seq);
 208                         return -ETIMEDOUT;
 209                 }
 210
 211                 ret = mt7615_mcu_parse_response(dev, cmd, skb, seq);
 212                 if (ret != -EAGAIN)
 213                         break;
 214         }
 215
 216         return ret;
 217 }
 218
 219 static int
 220 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 221                         int cmd, bool wait_resp)
 222 {
 223         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 224         int ret, seq;
 225
 226         mutex_lock(&mdev->mcu.mutex);
 227
 228         ret = __mt7615_mcu_msg_send(dev, skb, cmd, &seq);
 229         if (ret)
 230                 goto out;
 231
 232         if (wait_resp)
 233                 ret = mt7615_mcu_wait_response(dev, cmd, seq);
 234
 235 out:
 236         mutex_unlock(&mdev->mcu.mutex);
 237
 238         return ret;
 239 }
 240
 241 static int
 242 mt7615_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
 243                     int len, bool wait_resp)
 244 {
 245         struct sk_buff *skb;
 246
 247         skb = mt76_mcu_msg_alloc(mdev, data, len);
 248         if (!skb)
 249                 return -ENOMEM;
 250
 251         return __mt76_mcu_skb_send_msg(mdev, skb, cmd, wait_resp);
 252 }
 253
 254 static void
 255 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 256 {
 257         if (vif->csa_active)
 258                 ieee80211_csa_finish(vif);
 259 }
 260
 261 static void
 262 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 263 {
 264         struct mt76_phy *mphy = &dev->mt76.phy;
 265         struct mt7615_mcu_rdd_report *r;
 266
 267         r = (struct mt7615_mcu_rdd_report *)skb->data;
 268
 269         if (r->idx && dev->mt76.phy2)
 270                 mphy = dev->mt76.phy2;
 271
 272         ieee80211_radar_detected(mphy->hw);
 273         dev->hw_pattern++;
 274 }
 275
 276 static void
 277 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
 278 {
 279         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 280         const char *data = (char *)&rxd[1];
 281         const char *type;
 282
 283         switch (rxd->s2d_index) {
 284         case 0:
 285                 type = "N9";
 286                 break;
 287         case 2:
 288                 type = "CR4";
 289                 break;
 290         default:
 291                 type = "unknown";
 292                 break;
 293         }
 294
 295         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 296 }
 297
 298 static void
 299 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 300 {
 301         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 302
 303         switch (rxd->ext_eid) {
 304         case MCU_EXT_EVENT_RDD_REPORT:
 305                 mt7615_mcu_rx_radar_detected(dev, skb);
 306                 break;
 307         case MCU_EXT_EVENT_CSA_NOTIFY:
 308                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 309                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 310                                 mt7615_mcu_csa_finish, dev);
 311                 break;
 312         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 313                 mt7615_mcu_rx_log_message(dev, skb);
 314                 break;
 315         default:
 316                 break;
 317         }
 318 }
 319
 320 static void
 321 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
 322 {
 323         u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
 324         struct mt7615_phy *phy;
 325         struct mt76_phy *mphy;
 326
 327         if (*seq_num & BIT(7) && dev->mt76.phy2)
 328                 mphy = dev->mt76.phy2;
 329         else
 330                 mphy = &dev->mt76.phy;
 331
 332         phy = (struct mt7615_phy *)mphy->priv;
 333
 334         spin_lock_bh(&dev->mt76.lock);
 335         __skb_queue_tail(&phy->scan_event_list, skb);
 336         spin_unlock_bh(&dev->mt76.lock);
 337
 338         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 339                                      MT7615_HW_SCAN_TIMEOUT);
 340 }
 341
 342 static void
 343 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 344 {
 345         struct mt7615_mcu_bss_event *event;
 346         struct mt76_phy *mphy;
 347
 348         event = (struct mt7615_mcu_bss_event *)(skb->data +
 349                                                 sizeof(struct mt7615_mcu_rxd));
 350
 351         if (event->bss_idx && dev->mt76.phy2)
 352                 mphy = dev->mt76.phy2;
 353         else
 354                 mphy = &dev->mt76.phy;
 355
 356         if (event->is_absent)
 357                 ieee80211_stop_queues(mphy->hw);
 358         else
 359                 ieee80211_wake_queues(mphy->hw);
 360 }
 361
 362 static void
 363 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 364 {
 365         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 366
 367         switch (rxd->eid) {
 368         case MCU_EVENT_EXT:
 369                 mt7615_mcu_rx_ext_event(dev, skb);
 370                 break;
 371         case MCU_EVENT_SCHED_SCAN_DONE:
 372         case MCU_EVENT_SCAN_DONE:
 373                 mt7615_mcu_scan_event(dev, skb);
 374                 return;
 375         case MCU_EVENT_BSS_ABSENCE:
 376                 mt7615_mcu_bss_event(dev, skb);
 377                 break;
 378         default:
 379                 break;
 380         }
 381         dev_kfree_skb(skb);
 382 }
 383
 384 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 385 {
 386         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 387
 388         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 389             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 390             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 391             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 392             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 393             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 394             rxd->eid == MCU_EVENT_SCAN_DONE ||
 395             !rxd->seq)
 396                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 397         else
 398                 mt76_mcu_rx_event(&dev->mt76, skb);
 399 }
 400
 401 static int mt7615_mcu_init_download(struct mt7615_dev *dev, u32 addr,
 402                                     u32 len, u32 mode)
 403 {
 404         struct {
 405                 __le32 addr;
 406                 __le32 len;
 407                 __le32 mode;
 408         } req = {
 409                 .addr = cpu_to_le32(addr),
 410                 .len = cpu_to_le32(len),
 411                 .mode = cpu_to_le32(mode),
 412         };
 413
 414         return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TARGET_ADDRESS_LEN_REQ,
 415                                    &req, sizeof(req), true);
 416 }
 417
 418 static int
 419 mt7615_mcu_add_dev(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 420                    bool enable)
 421 {
 422         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 423         struct {
 424                 struct req_hdr {
 425                         u8 omac_idx;
 426                         u8 band_idx;
 427                         __le16 tlv_num;
 428                         u8 is_tlv_append;
 429                         u8 rsv[3];
 430                 } __packed hdr;
 431                 struct req_tlv {
 432                         __le16 tag;
 433                         __le16 len;
 434                         u8 active;
 435                         u8 band_idx;
 436                         u8 omac_addr[ETH_ALEN];
 437                 } __packed tlv;
 438         } data = {
 439                 .hdr = {
 440                         .omac_idx = mvif->omac_idx,
 441                         .band_idx = mvif->band_idx,
 442                         .tlv_num = cpu_to_le16(1),
 443                         .is_tlv_append = 1,
 444                 },
 445                 .tlv = {
 446                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 447                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 448                         .active = enable,
 449                         .band_idx = mvif->band_idx,
 450                 },
 451         };
 452
 453         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 454         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 455                                    &data, sizeof(data), true);
 456 }
 457
 458 static int
 459 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
 460                               struct ieee80211_hw *hw,
 461                               struct ieee80211_vif *vif, bool enable)
 462 {
 463         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 464         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
 465         struct ieee80211_mutable_offsets offs;
 466         struct ieee80211_tx_info *info;
 467         struct req {
 468                 u8 omac_idx;
 469                 u8 enable;
 470                 u8 wlan_idx;
 471                 u8 band_idx;
 472                 u8 pkt_type;
 473                 u8 need_pre_tbtt_int;
 474                 __le16 csa_ie_pos;
 475                 __le16 pkt_len;
 476                 __le16 tim_ie_pos;
 477                 u8 pkt[512];
 478                 u8 csa_cnt;
 479                 /* bss color change */
 480                 u8 bcc_cnt;
 481                 __le16 bcc_ie_pos;
 482         } __packed req = {
 483                 .omac_idx = mvif->omac_idx,
 484                 .enable = enable,
 485                 .wlan_idx = wcid->idx,
 486                 .band_idx = mvif->band_idx,
 487         };
 488         struct sk_buff *skb;
 489
 490         skb = ieee80211_beacon_get_template(hw, vif, &offs);
 491         if (!skb)
 492                 return -EINVAL;
 493
 494         if (skb->len > 512 - MT_TXD_SIZE) {
 495                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
 496                 dev_kfree_skb(skb);
 497                 return -EINVAL;
 498         }
 499
 500         if (mvif->band_idx) {
 501                 info = IEEE80211_SKB_CB(skb);
 502                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
 503         }
 504
 505         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
 506                               0, NULL, true);
 507         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
 508         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 509         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
 510         if (offs.csa_counter_offs[0]) {
 511                 u16 csa_offs;
 512
 513                 csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
 514                 req.csa_ie_pos = cpu_to_le16(csa_offs);
 515                 req.csa_cnt = skb->data[offs.csa_counter_offs[0]];
 516         }
 517         dev_kfree_skb(skb);
 518
 519         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD,
 520                                    &req, sizeof(req), true);
 521 }
 522
 523 static int
 524 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
 525 {
 526 #define ENTER_PM_STATE  1
 527 #define EXIT_PM_STATE   2
 528         struct {
 529                 u8 pm_number;
 530                 u8 pm_state;
 531                 u8 bssid[ETH_ALEN];
 532                 u8 dtim_period;
 533                 u8 wlan_idx;
 534                 __le16 bcn_interval;
 535                 __le32 aid;
 536                 __le32 rx_filter;
 537                 u8 band_idx;
 538                 u8 rsv[3];
 539                 __le32 feature;
 540                 u8 omac_idx;
 541                 u8 wmm_idx;
 542                 u8 bcn_loss_cnt;
 543                 u8 bcn_sp_duration;
 544         } __packed req = {
 545                 .pm_number = 5,
 546                 .pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
 547                 .band_idx = band,
 548         };
 549
 550         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
 551                                    &req, sizeof(req), true);
 552 }
 553
 554 static struct sk_buff *
 555 mt7615_mcu_alloc_sta_req(struct mt7615_dev *dev, struct mt7615_vif *mvif,
 556                          struct mt7615_sta *msta)
 557 {
 558         struct sta_req_hdr hdr = {
 559                 .bss_idx = mvif->idx,
 560                 .wlan_idx = msta ? msta->wcid.idx : 0,
 561                 .muar_idx = msta ? mvif->omac_idx : 0,
 562                 .is_tlv_append = 1,
 563         };
 564         struct sk_buff *skb;
 565
 566         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7615_STA_UPDATE_MAX_SIZE);
 567         if (!skb)
 568                 return ERR_PTR(-ENOMEM);
 569
 570         skb_put_data(skb, &hdr, sizeof(hdr));
 571
 572         return skb;
 573 }
 574
 575 static struct wtbl_req_hdr *
 576 mt7615_mcu_alloc_wtbl_req(struct mt7615_dev *dev, struct mt7615_sta *msta,
 577                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 578 {
 579         struct tlv *sta_hdr = sta_wtbl;
 580         struct wtbl_req_hdr hdr = {
 581                 .wlan_idx = msta->wcid.idx,
 582                 .operation = cmd,
 583         };
 584         struct sk_buff *nskb = *skb;
 585
 586         if (!nskb) {
 587                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 588                                           MT7615_WTBL_UPDATE_BA_SIZE);
 589                 if (!nskb)
 590                         return ERR_PTR(-ENOMEM);
 591
 592                 *skb = nskb;
 593         }
 594
 595         if (sta_hdr)
 596                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 597
 598         return skb_put_data(nskb, &hdr, sizeof(hdr));
 599 }
 600
 601 static struct tlv *
 602 mt7615_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 603                           void *sta_ntlv, void *sta_wtbl)
 604 {
 605         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 606         struct tlv *sta_hdr = sta_wtbl;
 607         struct tlv *ptlv, tlv = {
 608                 .tag = cpu_to_le16(tag),
 609                 .len = cpu_to_le16(len),
 610         };
 611         u16 ntlv;
 612
 613         ptlv = skb_put(skb, len);
 614         memcpy(ptlv, &tlv, sizeof(tlv));
 615
 616         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 617         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 618
 619         if (sta_hdr) {
 620                 u16 size = le16_to_cpu(sta_hdr->len);
 621
 622                 sta_hdr->len = cpu_to_le16(size + len);
 623         }
 624
 625         return ptlv;
 626 }
 627
 628 static struct tlv *
 629 mt7615_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 630 {
 631         return mt7615_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 632 }
 633
 634 static int
 635 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 636                          bool enable)
 637 {
 638         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 639         struct bss_info_basic *bss;
 640         u8 wlan_idx = mvif->sta.wcid.idx;
 641         u32 type = NETWORK_INFRA;
 642         struct tlv *tlv;
 643
 644         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 645
 646         switch (vif->type) {
 647         case NL80211_IFTYPE_MESH_POINT:
 648         case NL80211_IFTYPE_AP:
 649                 break;
 650         case NL80211_IFTYPE_STATION:
 651                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 652                 if (enable) {
 653                         struct ieee80211_sta *sta;
 654                         struct mt7615_sta *msta;
 655
 656                         rcu_read_lock();
 657                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 658                         if (!sta) {
 659                                 rcu_read_unlock();
 660                                 return -EINVAL;
 661                         }
 662
 663                         msta = (struct mt7615_sta *)sta->drv_priv;
 664                         wlan_idx = msta->wcid.idx;
 665                         rcu_read_unlock();
 666                 }
 667                 break;
 668         case NL80211_IFTYPE_ADHOC:
 669                 type = NETWORK_IBSS;
 670                 break;
 671         default:
 672                 WARN_ON(1);
 673                 break;
 674         }
 675
 676         bss = (struct bss_info_basic *)tlv;
 677         memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 678         bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 679         bss->network_type = cpu_to_le32(type);
 680         bss->dtim_period = vif->bss_conf.dtim_period;
 681         bss->bmc_tx_wlan_idx = wlan_idx;
 682         bss->wmm_idx = mvif->wmm_idx;
 683         bss->active = enable;
 684
 685         return 0;
 686 }
 687
 688 static void
 689 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 690 {
 691         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 692         struct bss_info_omac *omac;
 693         struct tlv *tlv;
 694         u32 type = 0;
 695         u8 idx;
 696
 697         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 698
 699         switch (vif->type) {
 700         case NL80211_IFTYPE_MESH_POINT:
 701         case NL80211_IFTYPE_AP:
 702                 type = CONNECTION_INFRA_AP;
 703                 break;
 704         case NL80211_IFTYPE_STATION:
 705                 type = CONNECTION_INFRA_STA;
 706                 break;
 707         case NL80211_IFTYPE_ADHOC:
 708                 type = CONNECTION_IBSS_ADHOC;
 709                 break;
 710         default:
 711                 WARN_ON(1);
 712                 break;
 713         }
 714
 715         omac = (struct bss_info_omac *)tlv;
 716         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 717         omac->conn_type = cpu_to_le32(type);
 718         omac->omac_idx = mvif->omac_idx;
 719         omac->band_idx = mvif->band_idx;
 720         omac->hw_bss_idx = idx;
 721 }
 722
 723 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 724 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 725 static void
 726 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
 727 {
 728         struct bss_info_ext_bss *ext;
 729         int ext_bss_idx, tsf_offset;
 730         struct tlv *tlv;
 731
 732         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 733         if (ext_bss_idx < 0)
 734                 return;
 735
 736         tlv = mt7615_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 737
 738         ext = (struct bss_info_ext_bss *)tlv;
 739         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 740         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 741 }
 742
 743 static void
 744 mt7615_mcu_sta_ba_tlv(struct sk_buff *skb,
 745                       struct ieee80211_ampdu_params *params,
 746                       bool enable, bool tx)
 747 {
 748         struct sta_rec_ba *ba;
 749         struct tlv *tlv;
 750
 751         tlv = mt7615_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
 752
 753         ba = (struct sta_rec_ba *)tlv;
 754         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
 755         ba->winsize = cpu_to_le16(params->buf_size);
 756         ba->ssn = cpu_to_le16(params->ssn);
 757         ba->ba_en = enable << params->tid;
 758         ba->amsdu = params->amsdu;
 759         ba->tid = params->tid;
 760 }
 761
 762 static void
 763 mt7615_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 764                          struct ieee80211_sta *sta, bool enable)
 765 {
 766         struct sta_rec_basic *basic;
 767         struct tlv *tlv;
 768
 769         tlv = mt7615_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
 770
 771         basic = (struct sta_rec_basic *)tlv;
 772         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
 773
 774         if (enable) {
 775                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
 776                 basic->conn_state = CONN_STATE_PORT_SECURE;
 777         } else {
 778                 basic->conn_state = CONN_STATE_DISCONNECT;
 779         }
 780
 781         if (!sta) {
 782                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
 783                 eth_broadcast_addr(basic->peer_addr);
 784                 return;
 785         }
 786
 787         switch (vif->type) {
 788         case NL80211_IFTYPE_MESH_POINT:
 789         case NL80211_IFTYPE_AP:
 790                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
 791                 break;
 792         case NL80211_IFTYPE_STATION:
 793                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
 794                 break;
 795         case NL80211_IFTYPE_ADHOC:
 796                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
 797                 break;
 798         default:
 799                 WARN_ON(1);
 800                 break;
 801         }
 802
 803         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
 804         basic->aid = cpu_to_le16(sta->aid);
 805         basic->qos = sta->wme;
 806 }
 807
 808 static void
 809 mt7615_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 810 {
 811         struct tlv *tlv;
 812
 813         if (sta->ht_cap.ht_supported) {
 814                 struct sta_rec_ht *ht;
 815
 816                 tlv = mt7615_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
 817                 ht = (struct sta_rec_ht *)tlv;
 818                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
 819         }
 820         if (sta->vht_cap.vht_supported) {
 821                 struct sta_rec_vht *vht;
 822
 823                 tlv = mt7615_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
 824                 vht = (struct sta_rec_vht *)tlv;
 825                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
 826                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
 827                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
 828         }
 829 }
 830
 831 static void
 832 mt7615_mcu_wtbl_ba_tlv(struct sk_buff *skb,
 833                        struct ieee80211_ampdu_params *params,
 834                        bool enable, bool tx, void *sta_wtbl,
 835                        void *wtbl_tlv)
 836 {
 837         struct wtbl_ba *ba;
 838         struct tlv *tlv;
 839
 840         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
 841                                         wtbl_tlv, sta_wtbl);
 842
 843         ba = (struct wtbl_ba *)tlv;
 844         ba->tid = params->tid;
 845
 846         if (tx) {
 847                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
 848                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
 849                 ba->ba_winsize = cpu_to_le16(params->buf_size);
 850                 ba->ba_en = enable;
 851         } else {
 852                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
 853                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
 854                 ba->rst_ba_tid = params->tid;
 855                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
 856                 ba->rst_ba_sb = 1;
 857         }
 858
 859         if (enable && tx) {
 860                 u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
 861                 int i;
 862
 863                 for (i = 7; i > 0; i--) {
 864                         if (params->buf_size >= ba_range[i])
 865                                 break;
 866                 }
 867                 ba->ba_winsize_idx = i;
 868         }
 869 }
 870
 871 static void
 872 mt7615_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 873                             struct ieee80211_sta *sta, void *sta_wtbl,
 874                             void *wtbl_tlv)
 875 {
 876         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 877         struct wtbl_generic *generic;
 878         struct wtbl_rx *rx;
 879         struct tlv *tlv;
 880
 881         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
 882                                         wtbl_tlv, sta_wtbl);
 883
 884         generic = (struct wtbl_generic *)tlv;
 885
 886         if (sta) {
 887                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
 888                 generic->partial_aid = cpu_to_le16(sta->aid);
 889                 generic->muar_idx = mvif->omac_idx;
 890                 generic->qos = sta->wme;
 891         } else {
 892                 eth_broadcast_addr(generic->peer_addr);
 893                 generic->muar_idx = 0xe;
 894         }
 895
 896         tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
 897                                         wtbl_tlv, sta_wtbl);
 898
 899         rx = (struct wtbl_rx *)tlv;
 900         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
 901         rx->rca2 = 1;
 902         rx->rv = 1;
 903 }
 904
 905 static void
 906 mt7615_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
 907                        void *sta_wtbl, void *wtbl_tlv)
 908 {
 909         struct tlv *tlv;
 910         u32 flags = 0;
 911
 912         if (sta->ht_cap.ht_supported) {
 913                 struct wtbl_ht *ht;
 914
 915                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
 916                                                 wtbl_tlv, sta_wtbl);
 917                 ht = (struct wtbl_ht *)tlv;
 918                 ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
 919                 ht->af = sta->ht_cap.ampdu_factor;
 920                 ht->mm = sta->ht_cap.ampdu_density;
 921                 ht->ht = 1;
 922
 923                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
 924                         flags |= MT_WTBL_W5_SHORT_GI_20;
 925                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
 926                         flags |= MT_WTBL_W5_SHORT_GI_40;
 927         }
 928
 929         if (sta->vht_cap.vht_supported) {
 930                 struct wtbl_vht *vht;
 931
 932                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
 933                                                 wtbl_tlv, sta_wtbl);
 934                 vht = (struct wtbl_vht *)tlv;
 935                 vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC,
 936                 vht->vht = 1;
 937
 938                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
 939                         flags |= MT_WTBL_W5_SHORT_GI_80;
 940                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
 941                         flags |= MT_WTBL_W5_SHORT_GI_160;
 942         }
 943
 944         /* wtbl smps */
 945         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) {
 946                 struct wtbl_smps *smps;
 947
 948                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
 949                                                 wtbl_tlv, sta_wtbl);
 950                 smps = (struct wtbl_smps *)tlv;
 951                 smps->smps = 1;
 952         }
 953
 954         if (sta->ht_cap.ht_supported) {
 955                 /* sgi */
 956                 u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
 957                           MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
 958                 struct wtbl_raw *raw;
 959
 960                 tlv = mt7615_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
 961                                                 sizeof(*raw), wtbl_tlv,
 962                                                 sta_wtbl);
 963                 raw = (struct wtbl_raw *)tlv;
 964                 raw->val = cpu_to_le32(flags);
 965                 raw->msk = cpu_to_le32(~msk);
 966                 raw->wtbl_idx = 1;
 967                 raw->dw = 5;
 968         }
 969 }
 970
 971 static int
 972 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 973                    bool enable)
 974 {
 975         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 976         struct mt7615_dev *dev = phy->dev;
 977         struct sk_buff *skb;
 978
 979         skb = mt7615_mcu_alloc_sta_req(dev, mvif, NULL);
 980         if (IS_ERR(skb))
 981                 return PTR_ERR(skb);
 982
 983         if (enable)
 984                 mt7615_mcu_bss_omac_tlv(skb, vif);
 985
 986         mt7615_mcu_bss_basic_tlv(skb, vif, enable);
 987
 988         if (enable && mvif->omac_idx > EXT_BSSID_START)
 989                 mt7615_mcu_bss_ext_tlv(skb, mvif);
 990
 991         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
 992                                        MCU_EXT_CMD_BSS_INFO_UPDATE, true);
 993 }
 994
 995 static int
 996 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
 997                       struct ieee80211_ampdu_params *params,
 998                       bool enable)
 999 {
1000         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1001         struct mt7615_vif *mvif = msta->vif;
1002         struct wtbl_req_hdr *wtbl_hdr;
1003         struct sk_buff *skb = NULL;
1004         int err;
1005
1006         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1007         if (IS_ERR(wtbl_hdr))
1008                 return PTR_ERR(wtbl_hdr);
1009
1010         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, NULL, wtbl_hdr);
1011
1012         err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1013                                       MCU_EXT_CMD_WTBL_UPDATE, true);
1014         if (err < 0)
1015                 return err;
1016
1017         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1018         if (IS_ERR(skb))
1019                 return PTR_ERR(skb);
1020
1021         mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1022
1023         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1024                                        MCU_EXT_CMD_STA_REC_UPDATE, true);
1025 }
1026
1027 static int
1028 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
1029                       struct ieee80211_ampdu_params *params,
1030                       bool enable)
1031 {
1032         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1033         struct mt7615_vif *mvif = msta->vif;
1034         struct wtbl_req_hdr *wtbl_hdr;
1035         struct sk_buff *skb;
1036         int err;
1037
1038         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1039         if (IS_ERR(skb))
1040                 return PTR_ERR(skb);
1041
1042         mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1043
1044         err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1045                                       MCU_EXT_CMD_STA_REC_UPDATE, true);
1046         if (err < 0 || !enable)
1047                 return err;
1048
1049         skb = NULL;
1050         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1051         if (IS_ERR(wtbl_hdr))
1052                 return PTR_ERR(wtbl_hdr);
1053
1054         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, NULL, wtbl_hdr);
1055
1056         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1057                                        MCU_EXT_CMD_WTBL_UPDATE, true);
1058 }
1059
1060 static int
1061 mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1062                         struct ieee80211_sta *sta, bool enable)
1063 {
1064         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1065         struct sk_buff *skb, *sskb, *wskb = NULL;
1066         struct wtbl_req_hdr *wtbl_hdr;
1067         struct mt7615_sta *msta;
1068         int cmd, err;
1069
1070         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1071
1072         sskb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1073         if (IS_ERR(sskb))
1074                 return PTR_ERR(sskb);
1075
1076         mt7615_mcu_sta_basic_tlv(sskb, vif, sta, enable);
1077         if (enable && sta)
1078                 mt7615_mcu_sta_ht_tlv(sskb, sta);
1079
1080         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1081                                              NULL, &wskb);
1082         if (IS_ERR(wtbl_hdr))
1083                 return PTR_ERR(wtbl_hdr);
1084
1085         if (enable) {
1086                 mt7615_mcu_wtbl_generic_tlv(wskb, vif, sta, NULL, wtbl_hdr);
1087                 if (sta)
1088                         mt7615_mcu_wtbl_ht_tlv(wskb, sta, NULL, wtbl_hdr);
1089         }
1090
1091         cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
1092         skb = enable ? wskb : sskb;
1093
1094         err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1095         if (err < 0)
1096                 return err;
1097
1098         cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
1099         skb = enable ? sskb : wskb;
1100
1101         return __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1102 }
1103
1104 static const struct mt7615_mcu_ops wtbl_update_ops = {
1105         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1106         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1107         .add_dev_info = mt7615_mcu_add_dev,
1108         .add_bss_info = mt7615_mcu_add_bss,
1109         .add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1110         .add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1111         .sta_add = mt7615_mcu_wtbl_sta_add,
1112 };
1113
1114 static int
1115 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1116                   struct ieee80211_ampdu_params *params,
1117                   bool enable, bool tx)
1118 {
1119         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1120         struct mt7615_vif *mvif = msta->vif;
1121         struct wtbl_req_hdr *wtbl_hdr;
1122         struct tlv *sta_wtbl;
1123         struct sk_buff *skb;
1124
1125         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1126         if (IS_ERR(skb))
1127                 return PTR_ERR(skb);
1128
1129         mt7615_mcu_sta_ba_tlv(skb, params, enable, tx);
1130
1131         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1132
1133         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1134                                              &skb);
1135         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1136
1137         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1138                                        MCU_EXT_CMD_STA_REC_UPDATE, true);
1139 }
1140
1141 static int
1142 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1143                      struct ieee80211_ampdu_params *params,
1144                      bool enable)
1145 {
1146         return mt7615_mcu_sta_ba(dev, params, enable, true);
1147 }
1148
1149 static int
1150 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1151                      struct ieee80211_ampdu_params *params,
1152                      bool enable)
1153 {
1154         return mt7615_mcu_sta_ba(dev, params, enable, false);
1155 }
1156
1157 static int
1158 mt7615_mcu_add_sta_cmd(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1159                        struct ieee80211_sta *sta, bool enable, int cmd)
1160 {
1161         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1162         struct wtbl_req_hdr *wtbl_hdr;
1163         struct mt7615_sta *msta;
1164         struct tlv *sta_wtbl;
1165         struct sk_buff *skb;
1166
1167         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
1168
1169         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1170         if (IS_ERR(skb))
1171                 return PTR_ERR(skb);
1172
1173         mt7615_mcu_sta_basic_tlv(skb, vif, sta, enable);
1174         if (enable && sta)
1175                 mt7615_mcu_sta_ht_tlv(skb, sta);
1176
1177         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1178
1179         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1180                                              sta_wtbl, &skb);
1181         if (enable) {
1182                 mt7615_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
1183                 if (sta)
1184                         mt7615_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1185         }
1186
1187         return __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1188 }
1189
1190 static int
1191 mt7615_mcu_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1192                    struct ieee80211_sta *sta, bool enable)
1193 {
1194         return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1195                                       MCU_EXT_CMD_STA_REC_UPDATE);
1196 }
1197
1198 static const struct mt7615_mcu_ops sta_update_ops = {
1199         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1200         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1201         .add_dev_info = mt7615_mcu_add_dev,
1202         .add_bss_info = mt7615_mcu_add_bss,
1203         .add_tx_ba = mt7615_mcu_sta_tx_ba,
1204         .add_rx_ba = mt7615_mcu_sta_rx_ba,
1205         .sta_add = mt7615_mcu_add_sta,
1206 };
1207
1208 static int
1209 mt7615_mcu_uni_add_dev(struct mt7615_dev *dev,
1210                        struct ieee80211_vif *vif, bool enable)
1211 {
1212         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1213         struct {
1214                 struct req_hdr {
1215                         u8 omac_idx;
1216                         u8 band_idx;
1217                         __le16 pad;
1218                 } __packed hdr;
1219                 struct req_tlv {
1220                         __le16 tag;
1221                         __le16 len;
1222                         u8 active;
1223                         u8 pad;
1224                         u8 omac_addr[ETH_ALEN];
1225                 } __packed tlv;
1226         } data = {
1227                 .hdr = {
1228                         .omac_idx = mvif->omac_idx,
1229                         .band_idx = mvif->band_idx,
1230                 },
1231                 .tlv = {
1232                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
1233                         .len = cpu_to_le16(sizeof(struct req_tlv)),
1234                         .active = enable,
1235                 },
1236         };
1237
1238         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1239
1240         return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_DEV_INFO_UPDATE,
1241                                    &data, sizeof(data), true);
1242 }
1243
1244 static int
1245 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1246 {
1247         return 0;
1248 }
1249
1250 static int
1251 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy,
1252                        struct ieee80211_vif *vif, bool enable)
1253 {
1254         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1255         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1256         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1257         struct mt7615_dev *dev = phy->dev;
1258         struct {
1259                 struct {
1260                         u8 bss_idx;
1261                         u8 pad[3];
1262                 } __packed hdr;
1263                 struct basic_tlv {
1264                         __le16 tag;
1265                         __le16 len;
1266                         u8 active;
1267                         u8 omac_idx;
1268                         u8 hw_bss_idx;
1269                         u8 band_idx;
1270                         __le32 conn_type;
1271                         u8 conn_state;
1272                         u8 wmm_idx;
1273                         u8 bssid[ETH_ALEN];
1274                         __le16 bmc_tx_wlan_idx;
1275                         __le16 bcn_interval;
1276                         u8 dtim_period;
1277                         u8 phymode; /* bit(0): A
1278                                      * bit(1): B
1279                                      * bit(2): G
1280                                      * bit(3): GN
1281                                      * bit(4): AN
1282                                      * bit(5): AC
1283                                      */
1284                         __le16 sta_idx;
1285                         u8 nonht_basic_phy;
1286                         u8 pad[3];
1287                 } __packed basic;
1288         } basic_req = {
1289                 .hdr = {
1290                         .bss_idx = mvif->idx,
1291                 },
1292                 .basic = {
1293                         .tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1294                         .len = cpu_to_le16(sizeof(struct basic_tlv)),
1295                         .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1296                         .dtim_period = vif->bss_conf.dtim_period,
1297                         .omac_idx = mvif->omac_idx,
1298                         .band_idx = mvif->band_idx,
1299                         .wmm_idx = mvif->wmm_idx,
1300                         .active = enable,
1301                         .phymode = 0x38,
1302                 },
1303         };
1304         struct {
1305                 struct {
1306                         u8 bss_idx;
1307                         u8 pad[3];
1308                 } __packed hdr;
1309                 struct rlm_tlv {
1310                         __le16 tag;
1311                         __le16 len;
1312                         u8 control_channel;
1313                         u8 center_chan;
1314                         u8 center_chan2;
1315                         u8 bw;
1316                         u8 tx_streams;
1317                         u8 rx_streams;
1318                         u8 short_st;
1319                         u8 ht_op_info;
1320                         u8 sco;
1321                         u8 pad[3];
1322                 } __packed rlm;
1323         } __packed rlm_req = {
1324                 .hdr = {
1325                         .bss_idx = mvif->idx,
1326                 },
1327                 .rlm = {
1328                         .tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1329                         .len = cpu_to_le16(sizeof(struct rlm_tlv)),
1330                         .control_channel = chandef->chan->hw_value,
1331                         .center_chan = ieee80211_frequency_to_channel(freq1),
1332                         .center_chan2 = ieee80211_frequency_to_channel(freq2),
1333                         .tx_streams = hweight8(phy->mt76->antenna_mask),
1334                         .rx_streams = phy->chainmask,
1335                         .short_st = true,
1336                 },
1337         };
1338         u8 idx, tx_wlan_idx = 0;
1339         int err;
1340
1341         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1342         basic_req.basic.hw_bss_idx = idx;
1343
1344         switch (vif->type) {
1345         case NL80211_IFTYPE_MESH_POINT:
1346         case NL80211_IFTYPE_AP:
1347                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1348                 tx_wlan_idx = mvif->sta.wcid.idx;
1349                 break;
1350         case NL80211_IFTYPE_STATION:
1351                 if (enable) {
1352                         struct ieee80211_sta *sta;
1353                         struct mt7615_sta *msta;
1354
1355                         rcu_read_lock();
1356                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
1357                         if (!sta) {
1358                                 rcu_read_unlock();
1359                                 return -EINVAL;
1360                         }
1361
1362                         msta = (struct mt7615_sta *)sta->drv_priv;
1363                         tx_wlan_idx = msta->wcid.idx;
1364                         rcu_read_unlock();
1365                 }
1366                 basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1367                 break;
1368         default:
1369                 WARN_ON(1);
1370                 break;
1371         }
1372
1373         memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1374         basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(tx_wlan_idx);
1375         basic_req.basic.sta_idx = cpu_to_le16(tx_wlan_idx);
1376         basic_req.basic.conn_state = !enable;
1377
1378         err = __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1379                                   &basic_req, sizeof(basic_req), true);
1380         if (err < 0)
1381                 return err;
1382
1383         if (!mt7615_firmware_offload(dev))
1384                 return 0;
1385
1386         switch (chandef->width) {
1387         case NL80211_CHAN_WIDTH_40:
1388                 rlm_req.rlm.bw = CMD_CBW_40MHZ;
1389                 break;
1390         case NL80211_CHAN_WIDTH_80:
1391                 rlm_req.rlm.bw = CMD_CBW_80MHZ;
1392                 break;
1393         case NL80211_CHAN_WIDTH_80P80:
1394                 rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1395                 break;
1396         case NL80211_CHAN_WIDTH_160:
1397                 rlm_req.rlm.bw = CMD_CBW_160MHZ;
1398                 break;
1399         case NL80211_CHAN_WIDTH_5:
1400                 rlm_req.rlm.bw = CMD_CBW_5MHZ;
1401                 break;
1402         case NL80211_CHAN_WIDTH_10:
1403                 rlm_req.rlm.bw = CMD_CBW_10MHZ;
1404                 break;
1405         case NL80211_CHAN_WIDTH_20_NOHT:
1406         case NL80211_CHAN_WIDTH_20:
1407         default:
1408                 rlm_req.rlm.bw = CMD_CBW_20MHZ;
1409                 break;
1410         }
1411
1412         if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1413                 rlm_req.rlm.sco = 1; /* SCA */
1414         else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1415                 rlm_req.rlm.sco = 3; /* SCB */
1416
1417         return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1418                                    &rlm_req, sizeof(rlm_req), true);
1419 }
1420
1421 static int
1422 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1423                                   struct ieee80211_hw *hw,
1424                                   struct ieee80211_vif *vif,
1425                                   bool enable)
1426 {
1427         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1428         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1429         struct ieee80211_mutable_offsets offs;
1430         struct {
1431                 struct req_hdr {
1432                         u8 bss_idx;
1433                         u8 pad[3];
1434                 } __packed hdr;
1435                 struct bcn_content_tlv {
1436                         __le16 tag;
1437                         __le16 len;
1438                         __le16 tim_ie_pos;
1439                         __le16 csa_ie_pos;
1440                         __le16 bcc_ie_pos;
1441                         /* 0: enable beacon offload
1442                          * 1: disable beacon offload
1443                          * 2: update probe respond offload
1444                          */
1445                         u8 enable;
1446                         /* 0: legacy format (TXD + payload)
1447                          * 1: only cap field IE
1448                          */
1449                         u8 type;
1450                         __le16 pkt_len;
1451                         u8 pkt[512];
1452                 } __packed beacon_tlv;
1453         } req = {
1454                 .hdr = {
1455                         .bss_idx = mvif->idx,
1456                 },
1457                 .beacon_tlv = {
1458                         .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1459                         .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1460                         .enable = enable,
1461                 },
1462         };
1463         struct sk_buff *skb;
1464
1465         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1466         if (!skb)
1467                 return -EINVAL;
1468
1469         if (skb->len > 512 - MT_TXD_SIZE) {
1470                 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1471                 dev_kfree_skb(skb);
1472                 return -EINVAL;
1473         }
1474
1475         mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1476                               wcid, NULL, 0, NULL, true);
1477         memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1478         req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1479         req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1480
1481         if (offs.csa_counter_offs[0]) {
1482                 u16 csa_offs;
1483
1484                 csa_offs = MT_TXD_SIZE + offs.csa_counter_offs[0] - 4;
1485                 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1486         }
1487         dev_kfree_skb(skb);
1488
1489         return __mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1490                                    &req, sizeof(req), true);
1491 }
1492
1493 static int
1494 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1495                      struct ieee80211_ampdu_params *params,
1496                      bool enable)
1497 {
1498         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1499         struct mt7615_vif *mvif = msta->vif;
1500         struct wtbl_req_hdr *wtbl_hdr;
1501         struct tlv *sta_wtbl;
1502         struct sk_buff *skb;
1503         int err;
1504
1505         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1506         if (IS_ERR(skb))
1507                 return PTR_ERR(skb);
1508
1509         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1510
1511         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1512                                              &skb);
1513         if (IS_ERR(wtbl_hdr))
1514                 return PTR_ERR(wtbl_hdr);
1515
1516         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, true, sta_wtbl,
1517                                wtbl_hdr);
1518
1519         err =  __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1520                                        MCU_UNI_CMD_STA_REC_UPDATE, true);
1521         if (err < 0)
1522                 return err;
1523
1524         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1525         if (IS_ERR(skb))
1526                 return PTR_ERR(skb);
1527
1528         mt7615_mcu_sta_ba_tlv(skb, params, enable, true);
1529
1530         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1531                                        MCU_UNI_CMD_STA_REC_UPDATE, true);
1532 }
1533
1534 static int
1535 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1536                      struct ieee80211_ampdu_params *params,
1537                      bool enable)
1538 {
1539         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1540         struct mt7615_vif *mvif = msta->vif;
1541         struct wtbl_req_hdr *wtbl_hdr;
1542         struct tlv *sta_wtbl;
1543         struct sk_buff *skb;
1544         int err;
1545
1546         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1547         if (IS_ERR(skb))
1548                 return PTR_ERR(skb);
1549
1550         mt7615_mcu_sta_ba_tlv(skb, params, enable, false);
1551
1552         err = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1553                                       MCU_UNI_CMD_STA_REC_UPDATE, true);
1554         if (err < 0 || !enable)
1555                 return err;
1556
1557         skb = mt7615_mcu_alloc_sta_req(dev, mvif, msta);
1558         if (IS_ERR(skb))
1559                 return PTR_ERR(skb);
1560
1561         sta_wtbl = mt7615_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1562
1563         wtbl_hdr = mt7615_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1564                                              &skb);
1565         if (IS_ERR(wtbl_hdr))
1566                 return PTR_ERR(wtbl_hdr);
1567
1568         mt7615_mcu_wtbl_ba_tlv(skb, params, enable, false, sta_wtbl,
1569                                wtbl_hdr);
1570
1571         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1572                                        MCU_UNI_CMD_STA_REC_UPDATE, true);
1573 }
1574
1575 static int
1576 mt7615_mcu_uni_add_sta(struct mt7615_dev *dev, struct ieee80211_vif *vif,
1577                        struct ieee80211_sta *sta, bool enable)
1578 {
1579         return mt7615_mcu_add_sta_cmd(dev, vif, sta, enable,
1580                                       MCU_UNI_CMD_STA_REC_UPDATE);
1581 }
1582
1583 static const struct mt7615_mcu_ops uni_update_ops = {
1584         .add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1585         .set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1586         .add_dev_info = mt7615_mcu_uni_add_dev,
1587         .add_bss_info = mt7615_mcu_uni_add_bss,
1588         .add_tx_ba = mt7615_mcu_uni_tx_ba,
1589         .add_rx_ba = mt7615_mcu_uni_rx_ba,
1590         .sta_add = mt7615_mcu_uni_add_sta,
1591 };
1592
1593 static int mt7615_mcu_send_firmware(struct mt7615_dev *dev, const void *data,
1594                                     int len)
1595 {
1596         int ret = 0, cur_len;
1597
1598         while (len > 0) {
1599                 cur_len = min_t(int, 4096 - sizeof(struct mt7615_mcu_txd),
1600                                 len);
1601
1602                 ret = __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_SCATTER,
1603                                           data, cur_len, false);
1604                 if (ret)
1605                         break;
1606
1607                 data += cur_len;
1608                 len -= cur_len;
1609
1610                 if (mt76_is_mmio(&dev->mt76))
1611                         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
1612         }
1613
1614         return ret;
1615 }
1616
1617 static int mt7615_mcu_start_firmware(struct mt7615_dev *dev, u32 addr,
1618                                      u32 option)
1619 {
1620         struct {
1621                 __le32 option;
1622                 __le32 addr;
1623         } req = {
1624                 .option = cpu_to_le32(option),
1625                 .addr = cpu_to_le32(addr),
1626         };
1627
1628         return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FW_START_REQ,
1629                                    &req, sizeof(req), true);
1630 }
1631
1632 static int mt7615_mcu_restart(struct mt76_dev *dev)
1633 {
1634         return __mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL,
1635                                    0, true);
1636 }
1637
1638 static int mt7615_mcu_patch_sem_ctrl(struct mt7615_dev *dev, bool get)
1639 {
1640         struct {
1641                 __le32 op;
1642         } req = {
1643                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
1644         };
1645
1646         return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_SEM_CONTROL,
1647                                    &req, sizeof(req), true);
1648 }
1649
1650 static int mt7615_mcu_start_patch(struct mt7615_dev *dev)
1651 {
1652         struct {
1653                 u8 check_crc;
1654                 u8 reserved[3];
1655         } req = {
1656                 .check_crc = 0,
1657         };
1658
1659         return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_PATCH_FINISH_REQ,
1660                                    &req, sizeof(req), true);
1661 }
1662
1663 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
1664 {
1665         if (!is_mt7622(&dev->mt76))
1666                 return;
1667
1668         regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
1669                            MT_INFRACFG_MISC_AP2CONN_WAKE,
1670                            !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
1671 }
1672
1673 static int mt7615_driver_own(struct mt7615_dev *dev)
1674 {
1675         u32 addr;
1676
1677         addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
1678         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
1679
1680         mt7622_trigger_hif_int(dev, true);
1681         if (!mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000)) {
1682                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
1683                 return -EIO;
1684         }
1685         mt7622_trigger_hif_int(dev, false);
1686
1687         return 0;
1688 }
1689
1690 static int mt7615_firmware_own(struct mt7615_dev *dev)
1691 {
1692         u32 addr;
1693
1694         addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
1695         mt7622_trigger_hif_int(dev, true);
1696
1697         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
1698
1699         if (is_mt7622(&dev->mt76) &&
1700             !mt76_poll_msec(dev, MT_CFG_LPCR_HOST,
1701                             MT_CFG_LPCR_HOST_FW_OWN,
1702                             MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
1703                 dev_err(dev->mt76.dev, "Timeout for firmware own\n");
1704                 return -EIO;
1705         }
1706         mt7622_trigger_hif_int(dev, false);
1707
1708         return 0;
1709 }
1710
1711 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1712 {
1713         const struct mt7615_patch_hdr *hdr;
1714         const struct firmware *fw = NULL;
1715         int len, ret, sem;
1716
1717         sem = mt7615_mcu_patch_sem_ctrl(dev, 1);
1718         switch (sem) {
1719         case PATCH_IS_DL:
1720                 return 0;
1721         case PATCH_NOT_DL_SEM_SUCCESS:
1722                 break;
1723         default:
1724                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1725                 return -EAGAIN;
1726         }
1727
1728         ret = request_firmware(&fw, name, dev->mt76.dev);
1729         if (ret)
1730                 goto out;
1731
1732         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1733                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1734                 ret = -EINVAL;
1735                 goto out;
1736         }
1737
1738         hdr = (const struct mt7615_patch_hdr *)(fw->data);
1739
1740         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1741                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1742
1743         len = fw->size - sizeof(*hdr);
1744
1745         ret = mt7615_mcu_init_download(dev, addr, len, DL_MODE_NEED_RSP);
1746         if (ret) {
1747                 dev_err(dev->mt76.dev, "Download request failed\n");
1748                 goto out;
1749         }
1750
1751         ret = mt7615_mcu_send_firmware(dev, fw->data + sizeof(*hdr), len);
1752         if (ret) {
1753                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1754                 goto out;
1755         }
1756
1757         ret = mt7615_mcu_start_patch(dev);
1758         if (ret)
1759                 dev_err(dev->mt76.dev, "Failed to start patch\n");
1760
1761 out:
1762         release_firmware(fw);
1763
1764         sem = mt7615_mcu_patch_sem_ctrl(dev, 0);
1765         switch (sem) {
1766         case PATCH_REL_SEM_SUCCESS:
1767                 break;
1768         default:
1769                 ret = -EAGAIN;
1770                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1771                 break;
1772         }
1773
1774         return ret;
1775 }
1776
1777 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1778 {
1779         u32 ret = 0;
1780
1781         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1782                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1783         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1784                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1785         ret |= DL_MODE_NEED_RSP;
1786         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1787
1788         return ret;
1789 }
1790
1791 static int
1792 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1793                              const struct mt7615_fw_trailer *hdr,
1794                              const u8 *data, bool is_cr4)
1795 {
1796         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1797         int err, i, offset = 0;
1798         u32 len, addr, mode;
1799
1800         for (i = 0; i < n_region; i++) {
1801                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1802                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1803                 addr = le32_to_cpu(hdr[i].addr);
1804
1805                 err = mt7615_mcu_init_download(dev, addr, len, mode);
1806                 if (err) {
1807                         dev_err(dev->mt76.dev, "Download request failed\n");
1808                         return err;
1809                 }
1810
1811                 err = mt7615_mcu_send_firmware(dev, data + offset, len);
1812                 if (err) {
1813                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1814                         return err;
1815                 }
1816
1817                 offset += len;
1818         }
1819
1820         return 0;
1821 }
1822
1823 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1824 {
1825         const struct mt7615_fw_trailer *hdr;
1826         const struct firmware *fw;
1827         int ret;
1828
1829         ret = request_firmware(&fw, name, dev->mt76.dev);
1830         if (ret)
1831                 return ret;
1832
1833         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1834                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1835                 ret = -EINVAL;
1836                 goto out;
1837         }
1838
1839         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1840                                         N9_REGION_NUM * sizeof(*hdr));
1841
1842         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1843                  hdr->fw_ver, hdr->build_date);
1844
1845         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1846         if (ret)
1847                 goto out;
1848
1849         ret = mt7615_mcu_start_firmware(dev, le32_to_cpu(hdr->addr),
1850                                         FW_START_OVERRIDE);
1851         if (ret) {
1852                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1853                 goto out;
1854         }
1855
1856         snprintf(dev->mt76.hw->wiphy->fw_version,
1857                  sizeof(dev->mt76.hw->wiphy->fw_version),
1858                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1859
1860         if (!strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
1861                 dev->fw_ver = MT7615_FIRMWARE_V2;
1862                 dev->mcu_ops = &sta_update_ops;
1863         } else {
1864                 dev->fw_ver = MT7615_FIRMWARE_V1;
1865                 dev->mcu_ops = &wtbl_update_ops;
1866         }
1867
1868 out:
1869         release_firmware(fw);
1870         return ret;
1871 }
1872
1873 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1874 {
1875         const struct mt7615_fw_trailer *hdr;
1876         const struct firmware *fw;
1877         int ret;
1878
1879         ret = request_firmware(&fw, name, dev->mt76.dev);
1880         if (ret)
1881                 return ret;
1882
1883         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1884                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1885                 ret = -EINVAL;
1886                 goto out;
1887         }
1888
1889         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1890                                         CR4_REGION_NUM * sizeof(*hdr));
1891
1892         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1893                  hdr->fw_ver, hdr->build_date);
1894
1895         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1896         if (ret)
1897                 goto out;
1898
1899         ret = mt7615_mcu_start_firmware(dev, 0, FW_START_WORKING_PDA_CR4);
1900         if (ret) {
1901                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1902                 goto out;
1903         }
1904
1905 out:
1906         release_firmware(fw);
1907
1908         return ret;
1909 }
1910
1911 static int mt7615_load_ram(struct mt7615_dev *dev)
1912 {
1913         int ret;
1914
1915         ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1916         if (ret)
1917                 return ret;
1918
1919         return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1920 }
1921
1922 static int mt7615_load_firmware(struct mt7615_dev *dev)
1923 {
1924         int ret;
1925         u32 val;
1926
1927         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1928
1929         if (val != FW_STATE_FW_DOWNLOAD) {
1930                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1931                 return -EIO;
1932         }
1933
1934         ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1935         if (ret)
1936                 return ret;
1937
1938         ret = mt7615_load_ram(dev);
1939         if (ret)
1940                 return ret;
1941
1942         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1943                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1944                                        FW_STATE_CR4_RDY), 500)) {
1945                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1946                 return -EIO;
1947         }
1948
1949         return 0;
1950 }
1951
1952 static int mt7622_load_firmware(struct mt7615_dev *dev)
1953 {
1954         int ret;
1955         u32 val;
1956
1957         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1958
1959         val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1960         if (val != FW_STATE_FW_DOWNLOAD) {
1961                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1962                 return -EIO;
1963         }
1964
1965         ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1966         if (ret)
1967                 return ret;
1968
1969         ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1970         if (ret)
1971                 return ret;
1972
1973         if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1974                             FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1975                                        FW_STATE_NORMAL_TRX), 1500)) {
1976                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1977                 return -EIO;
1978         }
1979
1980         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1981
1982         return 0;
1983 }
1984
1985 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1986 {
1987         struct {
1988                 u8 ctrl_val;
1989                 u8 pad[3];
1990         } data = {
1991                 .ctrl_val = ctrl
1992         };
1993
1994         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST,
1995                                    &data, sizeof(data), true);
1996 }
1997
1998 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1999 {
2000         u32 offset = 0, override_addr = 0, flag = 0;
2001         const struct mt7663_fw_trailer *hdr;
2002         const struct mt7663_fw_buf *buf;
2003         const struct firmware *fw;
2004         const u8 *base_addr;
2005         int i, ret;
2006
2007         ret = request_firmware(&fw, name, dev->mt76.dev);
2008         if (ret)
2009                 return ret;
2010
2011         if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
2012                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2013                 ret = -EINVAL;
2014                 goto out;
2015         }
2016
2017         hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
2018                                                  FW_V3_COMMON_TAILER_SIZE);
2019
2020         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
2021                  hdr->fw_ver, hdr->build_date);
2022         dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
2023
2024         base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
2025         for (i = 0; i < hdr->n_region; i++) {
2026                 u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
2027                 u32 len, addr, mode;
2028
2029                 dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
2030
2031                 buf = (const struct mt7663_fw_buf *)(base_addr - shift);
2032                 mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
2033                 addr = le32_to_cpu(buf->img_dest_addr);
2034                 len = le32_to_cpu(buf->img_size);
2035
2036                 ret = mt7615_mcu_init_download(dev, addr, len, mode);
2037                 if (ret) {
2038                         dev_err(dev->mt76.dev, "Download request failed\n");
2039                         goto out;
2040                 }
2041
2042                 ret = mt7615_mcu_send_firmware(dev, fw->data + offset, len);
2043                 if (ret) {
2044                         dev_err(dev->mt76.dev, "Failed to send firmware\n");
2045                         goto out;
2046                 }
2047
2048                 offset += le32_to_cpu(buf->img_size);
2049                 if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
2050                         override_addr = le32_to_cpu(buf->img_dest_addr);
2051                         dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
2052                                  i, override_addr);
2053                 }
2054         }
2055
2056         if (is_mt7663(&dev->mt76)) {
2057                 flag |= FW_START_DLYCAL;
2058                 if (override_addr)
2059                         flag |= FW_START_OVERRIDE;
2060
2061                 dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
2062                          override_addr, flag);
2063         }
2064
2065         ret = mt7615_mcu_start_firmware(dev, override_addr, flag);
2066         if (ret) {
2067                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
2068                 goto out;
2069         }
2070
2071         snprintf(dev->mt76.hw->wiphy->fw_version,
2072                  sizeof(dev->mt76.hw->wiphy->fw_version),
2073                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2074
2075 out:
2076         release_firmware(fw);
2077
2078         return ret;
2079 }
2080
2081 int __mt7663_load_firmware(struct mt7615_dev *dev)
2082 {
2083         int ret;
2084
2085         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
2086         if (ret) {
2087                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
2088                 return -EIO;
2089         }
2090
2091         ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, MT7663_ROM_PATCH);
2092         if (ret)
2093                 return ret;
2094
2095         dev->fw_ver = MT7615_FIRMWARE_V3;
2096         dev->mcu_ops = &uni_update_ops;
2097
2098         ret = mt7663_load_n9(dev, MT7663_FIRMWARE_N9);
2099         if (ret)
2100                 return ret;
2101
2102         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
2103                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
2104                 ret = mt76_get_field(dev, MT_CONN_ON_MISC,
2105                                      MT7663_TOP_MISC2_FW_STATE);
2106                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2107                 return -EIO;
2108         }
2109
2110         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2111
2112         return 0;
2113 }
2114 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
2115
2116 static int mt7663_load_firmware(struct mt7615_dev *dev)
2117 {
2118         int ret;
2119
2120         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2121
2122         ret = __mt7663_load_firmware(dev);
2123         if (ret)
2124                 return ret;
2125
2126         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
2127
2128         return 0;
2129 }
2130
2131 int mt7615_mcu_init(struct mt7615_dev *dev)
2132 {
2133         static const struct mt76_mcu_ops mt7615_mcu_ops = {
2134                 .headroom = sizeof(struct mt7615_mcu_txd),
2135                 .mcu_skb_send_msg = mt7615_mcu_send_message,
2136                 .mcu_send_msg = mt7615_mcu_msg_send,
2137                 .mcu_restart = mt7615_mcu_restart,
2138         };
2139         int ret;
2140
2141         dev->mt76.mcu_ops = &mt7615_mcu_ops,
2142
2143         ret = mt7615_driver_own(dev);
2144         if (ret)
2145                 return ret;
2146
2147         switch (mt76_chip(&dev->mt76)) {
2148         case 0x7622:
2149                 ret = mt7622_load_firmware(dev);
2150                 break;
2151         case 0x7663:
2152                 ret = mt7663_load_firmware(dev);
2153                 break;
2154         default:
2155                 ret = mt7615_load_firmware(dev);
2156                 break;
2157         }
2158         if (ret)
2159                 return ret;
2160
2161         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2162         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2163         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2164         mt7615_mcu_fw_log_2_host(dev, 0);
2165
2166         return 0;
2167 }
2168
2169 void mt7615_mcu_exit(struct mt7615_dev *dev)
2170 {
2171         __mt76_mcu_restart(&dev->mt76);
2172         mt7615_firmware_own(dev);
2173         skb_queue_purge(&dev->mt76.mcu.res_q);
2174 }
2175
2176 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
2177 {
2178         struct {
2179                 u8 buffer_mode;
2180                 u8 content_format;
2181                 __le16 len;
2182         } __packed req_hdr = {
2183                 .buffer_mode = 1,
2184         };
2185         u8 *eep = (u8 *)dev->mt76.eeprom.data;
2186         struct sk_buff *skb;
2187         int eep_len, offset;
2188
2189         switch (mt76_chip(&dev->mt76)) {
2190         case 0x7622:
2191                 eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
2192                 offset = MT_EE_NIC_CONF_0;
2193                 break;
2194         case 0x7663:
2195                 eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
2196                 req_hdr.content_format = 1;
2197                 offset = MT_EE_CHIP_ID;
2198                 break;
2199         default:
2200                 eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
2201                 offset = MT_EE_NIC_CONF_0;
2202                 break;
2203         }
2204
2205         req_hdr.len = cpu_to_le16(eep_len);
2206
2207         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
2208         if (!skb)
2209                 return -ENOMEM;
2210
2211         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2212         skb_put_data(skb, eep + offset, eep_len);
2213
2214         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2215                                        MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
2216 }
2217
2218 int mt7615_mcu_set_mac_enable(struct mt7615_dev *dev, int band, bool enable)
2219 {
2220         struct {
2221                 u8 enable;
2222                 u8 band;
2223                 u8 rsv[2];
2224         } __packed req = {
2225                 .enable = enable,
2226                 .band = band,
2227         };
2228
2229         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2230                                    &req, sizeof(req), true);
2231 }
2232
2233 int mt7615_mcu_set_rts_thresh(struct mt7615_phy *phy, u32 val)
2234 {
2235         struct mt7615_dev *dev = phy->dev;
2236         struct {
2237                 u8 prot_idx;
2238                 u8 band;
2239                 u8 rsv[2];
2240                 __le32 len_thresh;
2241                 __le32 pkt_thresh;
2242         } __packed req = {
2243                 .prot_idx = 1,
2244                 .band = phy != &dev->phy,
2245                 .len_thresh = cpu_to_le32(val),
2246                 .pkt_thresh = cpu_to_le32(0x2),
2247         };
2248
2249         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
2250                                    &req, sizeof(req), true);
2251 }
2252
2253 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
2254                        const struct ieee80211_tx_queue_params *params)
2255 {
2256 #define WMM_AIFS_SET    BIT(0)
2257 #define WMM_CW_MIN_SET  BIT(1)
2258 #define WMM_CW_MAX_SET  BIT(2)
2259 #define WMM_TXOP_SET    BIT(3)
2260 #define WMM_PARAM_SET   (WMM_AIFS_SET | WMM_CW_MIN_SET | \
2261                          WMM_CW_MAX_SET | WMM_TXOP_SET)
2262         struct req_data {
2263                 u8 number;
2264                 u8 rsv[3];
2265                 u8 queue;
2266                 u8 valid;
2267                 u8 aifs;
2268                 u8 cw_min;
2269                 __le16 cw_max;
2270                 __le16 txop;
2271         } __packed req = {
2272                 .number = 1,
2273                 .queue = queue,
2274                 .valid = WMM_PARAM_SET,
2275                 .aifs = params->aifs,
2276                 .cw_min = 5,
2277                 .cw_max = cpu_to_le16(10),
2278                 .txop = cpu_to_le16(params->txop),
2279         };
2280
2281         if (params->cw_min)
2282                 req.cw_min = fls(params->cw_min);
2283         if (params->cw_max)
2284                 req.cw_max = cpu_to_le16(fls(params->cw_max));
2285
2286         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
2287                                    &req, sizeof(req), true);
2288 }
2289
2290 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
2291 {
2292         struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
2293         struct dbdc_entry {
2294                 u8 type;
2295                 u8 index;
2296                 u8 band;
2297                 u8 _rsv;
2298         };
2299         struct {
2300                 u8 enable;
2301                 u8 num;
2302                 u8 _rsv[2];
2303                 struct dbdc_entry entry[64];
2304         } req = {
2305                 .enable = !!ext_phy,
2306         };
2307         int i;
2308
2309         if (!ext_phy)
2310                 goto out;
2311
2312 #define ADD_DBDC_ENTRY(_type, _idx, _band)              \
2313         do { \
2314                 req.entry[req.num].type = _type;                \
2315                 req.entry[req.num].index = _idx;                \
2316                 req.entry[req.num++].band = _band;              \
2317         } while (0)
2318
2319         for (i = 0; i < 4; i++) {
2320                 bool band = !!(ext_phy->omac_mask & BIT(i));
2321
2322                 ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
2323         }
2324
2325         for (i = 0; i < 14; i++) {
2326                 bool band = !!(ext_phy->omac_mask & BIT(0x11 + i));
2327
2328                 ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
2329         }
2330
2331         ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
2332
2333         for (i = 0; i < 3; i++)
2334                 ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
2335
2336         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
2337         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
2338         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
2339         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
2340
2341         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
2342         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
2343
2344 out:
2345         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL,
2346                                    &req, sizeof(req), true);
2347 }
2348
2349 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
2350 {
2351         struct wtbl_req_hdr req = {
2352                 .operation = WTBL_RESET_ALL,
2353         };
2354
2355         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE,
2356                                    &req, sizeof(req), true);
2357 }
2358
2359 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
2360                        enum mt7615_rdd_cmd cmd, u8 index,
2361                        u8 rx_sel, u8 val)
2362 {
2363         struct {
2364                 u8 ctrl;
2365                 u8 rdd_idx;
2366                 u8 rdd_rx_sel;
2367                 u8 val;
2368                 u8 rsv[4];
2369         } req = {
2370                 .ctrl = cmd,
2371                 .rdd_idx = index,
2372                 .rdd_rx_sel = rx_sel,
2373                 .val = val,
2374         };
2375
2376         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL,
2377                                    &req, sizeof(req), true);
2378 }
2379
2380 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
2381 {
2382         struct {
2383                 u16 tag;
2384                 u16 min_lpn;
2385         } req = {
2386                 .tag = 0x1,
2387                 .min_lpn = val,
2388         };
2389
2390         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2391                                    &req, sizeof(req), true);
2392 }
2393
2394 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
2395                             const struct mt7615_dfs_pulse *pulse)
2396 {
2397         struct {
2398                 u16 tag;
2399                 struct mt7615_dfs_pulse pulse;
2400         } req = {
2401                 .tag = 0x3,
2402         };
2403
2404         memcpy(&req.pulse, pulse, sizeof(*pulse));
2405
2406         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2407                                    &req, sizeof(req), true);
2408 }
2409
2410 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2411                             const struct mt7615_dfs_pattern *pattern)
2412 {
2413         struct {
2414                 u16 tag;
2415                 u16 radar_type;
2416                 struct mt7615_dfs_pattern pattern;
2417         } req = {
2418                 .tag = 0x2,
2419                 .radar_type = index,
2420         };
2421
2422         memcpy(&req.pattern, pattern, sizeof(*pattern));
2423
2424         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2425                                    &req, sizeof(req), true);
2426 }
2427
2428 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2429 {
2430         struct {
2431                 u8 pulse_num;
2432                 u8 rsv[3];
2433                 struct {
2434                         u32 start_time;
2435                         u16 width;
2436                         s16 power;
2437                 } pattern[32];
2438         } req = {
2439                 .pulse_num = dev->radar_pattern.n_pulses,
2440         };
2441         u32 start_time = ktime_to_ms(ktime_get_boottime());
2442         int i;
2443
2444         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2445                 return -EINVAL;
2446
2447         /* TODO: add some noise here */
2448         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2449                 req.pattern[i].width = dev->radar_pattern.width;
2450                 req.pattern[i].power = dev->radar_pattern.power;
2451                 req.pattern[i].start_time = start_time +
2452                                             i * dev->radar_pattern.period;
2453         }
2454
2455         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2456                                    &req, sizeof(req), false);
2457 }
2458
2459 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2460 {
2461         struct mt76_phy *mphy = phy->mt76;
2462         struct ieee80211_hw *hw = mphy->hw;
2463         int n_chains = hweight8(mphy->antenna_mask);
2464         int tx_power;
2465         int i;
2466
2467         tx_power = hw->conf.power_level * 2 -
2468                    mt76_tx_power_nss_delta(n_chains);
2469         mphy->txpower_cur = tx_power;
2470
2471         for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2472                 sku[i] = tx_power;
2473
2474         for (i = 0; i < 4; i++) {
2475                 int delta = 0;
2476
2477                 if (i < n_chains - 1)
2478                         delta = mt76_tx_power_nss_delta(n_chains) -
2479                                 mt76_tx_power_nss_delta(i + 1);
2480                 sku[MT_SKU_1SS_DELTA + i] = delta;
2481         }
2482 }
2483
2484 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2485 {
2486         static const u8 width_to_bw[] = {
2487                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2488                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2489                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2490                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2491                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2492                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2493                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2494                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2495         };
2496
2497         if (chandef->width >= ARRAY_SIZE(width_to_bw))
2498                 return 0;
2499
2500         return width_to_bw[chandef->width];
2501 }
2502
2503 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2504 {
2505         struct mt7615_dev *dev = phy->dev;
2506         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2507         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2508         struct {
2509                 u8 control_chan;
2510                 u8 center_chan;
2511                 u8 bw;
2512                 u8 tx_streams;
2513                 u8 rx_streams_mask;
2514                 u8 switch_reason;
2515                 u8 band_idx;
2516                 /* for 80+80 only */
2517                 u8 center_chan2;
2518                 __le16 cac_case;
2519                 u8 channel_band;
2520                 u8 rsv0;
2521                 __le32 outband_freq;
2522                 u8 txpower_drop;
2523                 u8 rsv1[3];
2524                 u8 txpower_sku[53];
2525                 u8 rsv2[3];
2526         } req = {
2527                 .control_chan = chandef->chan->hw_value,
2528                 .center_chan = ieee80211_frequency_to_channel(freq1),
2529                 .tx_streams = hweight8(phy->mt76->antenna_mask),
2530                 .rx_streams_mask = phy->chainmask,
2531                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
2532         };
2533
2534         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2535                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2536         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2537                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2538                 req.switch_reason = CH_SWITCH_DFS;
2539         else
2540                 req.switch_reason = CH_SWITCH_NORMAL;
2541
2542         req.band_idx = phy != &dev->phy;
2543         req.bw = mt7615_mcu_chan_bw(chandef);
2544
2545         mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2546
2547         return __mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2548 }
2549
2550 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2551 {
2552         struct {
2553                 u8 action;
2554                 u8 rsv[3];
2555         } req = {
2556                 .action = index,
2557         };
2558
2559         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2560                                    sizeof(req), true);
2561 }
2562
2563 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2564 {
2565         struct mt7615_dev *dev = phy->dev;
2566         struct {
2567                 u8 format_id;
2568                 u8 sku_enable;
2569                 u8 band_idx;
2570                 u8 rsv;
2571         } req = {
2572                 .format_id = 0,
2573                 .band_idx = phy != &dev->phy,
2574                 .sku_enable = enable,
2575         };
2576
2577         return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2578                                    sizeof(req), true);
2579 }
2580
2581 int mt7615_mcu_set_channel_domain(struct mt7615_phy *phy)
2582 {
2583         struct mt76_phy *mphy = phy->mt76;
2584         struct mt7615_dev *dev = phy->dev;
2585         struct mt7615_mcu_channel_domain {
2586                 __le32 country_code; /* regulatory_request.alpha2 */
2587                 u8 bw_2g; /* BW_20_40M          0
2588                            * BW_20M             1
2589                            * BW_20_40_80M       2
2590                            * BW_20_40_80_160M   3
2591                            * BW_20_40_80_8080M  4
2592                            */
2593                 u8 bw_5g;
2594                 __le16 pad;
2595                 u8 n_2ch;
2596                 u8 n_5ch;
2597                 __le16 pad2;
2598         } __packed hdr = {
2599                 .bw_2g = 0,
2600                 .bw_5g = 3,
2601                 .n_2ch = mphy->sband_2g.sband.n_channels,
2602                 .n_5ch = mphy->sband_5g.sband.n_channels,
2603         };
2604         struct mt7615_mcu_chan {
2605                 __le16 hw_value;
2606                 __le16 pad;
2607                 __le32 flags;
2608         } __packed;
2609         int i, n_channels = hdr.n_2ch + hdr.n_5ch;
2610         int len = sizeof(hdr) + n_channels * sizeof(struct mt7615_mcu_chan);
2611         struct sk_buff *skb;
2612
2613         if (!mt7615_firmware_offload(dev))
2614                 return 0;
2615
2616         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
2617         if (!skb)
2618                 return -ENOMEM;
2619
2620         skb_put_data(skb, &hdr, sizeof(hdr));
2621
2622         for (i = 0; i < n_channels; i++) {
2623                 struct ieee80211_channel *chan;
2624                 struct mt7615_mcu_chan channel;
2625
2626                 if (i < hdr.n_2ch)
2627                         chan = &mphy->sband_2g.sband.channels[i];
2628                 else
2629                         chan = &mphy->sband_5g.sband.channels[i - hdr.n_2ch];
2630
2631                 channel.hw_value = cpu_to_le16(chan->hw_value);
2632                 channel.flags = cpu_to_le32(chan->flags);
2633                 channel.pad = 0;
2634
2635                 skb_put_data(skb, &channel, sizeof(channel));
2636         }
2637
2638         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2639                                        MCU_CMD_SET_CHAN_DOMAIN, false);
2640 }
2641
2642 #define MT7615_SCAN_CHANNEL_TIME        120
2643 int mt7615_mcu_hw_scan(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2644                        struct ieee80211_scan_request *scan_req)
2645 {
2646         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2647         struct cfg80211_scan_request *sreq = &scan_req->req;
2648         int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
2649         struct ieee80211_channel **scan_list = sreq->channels;
2650         int err, i, duration = MT7615_SCAN_CHANNEL_TIME;
2651         struct mt7615_dev *dev = phy->dev;
2652         bool ext_phy = phy != &dev->phy;
2653         struct mt7615_mcu_scan_channel *chan;
2654         struct mt7615_hw_scan_req *req;
2655         struct sk_buff *skb;
2656
2657         /* fall-back to sw-scan */
2658         if (!mt7615_firmware_offload(dev))
2659                 return 1;
2660
2661         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(*req));
2662         if (!skb)
2663                 return -ENOMEM;
2664
2665         set_bit(MT76_HW_SCANNING, &phy->mt76->state);
2666         mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2667
2668         req = (struct mt7615_hw_scan_req *)skb_put(skb, sizeof(*req));
2669
2670         req->seq_num = mvif->scan_seq_num | ext_phy << 7;
2671         req->bss_idx = mvif->idx;
2672         req->scan_type = 1;
2673         req->ssid_type = 1;
2674         req->probe_req_num = 2;
2675         req->version = 1;
2676         req->channel_type = 4;
2677
2678         for (i = 0; i < sreq->n_ssids; i++) {
2679                 req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2680                 memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
2681                        sreq->ssids[i].ssid_len);
2682         }
2683
2684         req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
2685         req->channel_min_dwell_time = cpu_to_le16(duration);
2686         req->channel_dwell_time = cpu_to_le16(duration);
2687
2688         req->channels_num = min_t(u8, sreq->n_channels, 32);
2689         req->ext_channels_num = min_t(u8, ext_channels_num, 32);
2690         for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
2691                 if (i >= 32)
2692                         chan = &req->ext_channels[i - 32];
2693                 else
2694                         chan = &req->channels[i];
2695
2696                 chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
2697                 chan->channel_num = scan_list[i]->hw_value;
2698         }
2699
2700         if (sreq->ie_len > 0) {
2701                 memcpy(req->ies, sreq->ie, sreq->ie_len);
2702                 req->ies_len = cpu_to_le16(sreq->ie_len);
2703         }
2704
2705         memcpy(req->bssid, sreq->bssid, ETH_ALEN);
2706         if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2707                 get_random_mask_addr(req->random_mac, sreq->mac_addr,
2708                                      sreq->mac_addr_mask);
2709                 req->scan_func = 1;
2710         }
2711
2712         err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_CMD_START_HW_SCAN,
2713                                       false);
2714         if (err < 0)
2715                 clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
2716
2717         return err;
2718 }
2719
2720 int mt7615_mcu_cancel_hw_scan(struct mt7615_phy *phy,
2721                               struct ieee80211_vif *vif)
2722 {
2723         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2724         struct mt7615_dev *dev = phy->dev;
2725         struct cfg80211_scan_info info = {
2726                 .aborted = true,
2727         };
2728         struct {
2729                 u8 seq_num;
2730                 u8 is_ext_channel;
2731                 u8 rsv[2];
2732         } __packed req = {
2733                 .seq_num = mvif->scan_seq_num,
2734         };
2735
2736         ieee80211_scan_completed(phy->mt76->hw, &info);
2737         clear_bit(MT76_HW_SCANNING, &phy->mt76->state);
2738
2739         return __mt76_mcu_send_msg(&dev->mt76,  MCU_CMD_CANCEL_HW_SCAN, &req,
2740                                    sizeof(req), false);
2741 }
2742
2743 int mt7615_mcu_sched_scan_req(struct mt7615_phy *phy,
2744                               struct ieee80211_vif *vif,
2745                               struct cfg80211_sched_scan_request *sreq)
2746 {
2747         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2748         struct ieee80211_channel **scan_list = sreq->channels;
2749         struct mt7615_dev *dev = phy->dev;
2750         bool ext_phy = phy != &dev->phy;
2751         struct mt7615_mcu_scan_channel *chan;
2752         struct mt7615_sched_scan_req *req;
2753         struct cfg80211_match_set *match;
2754         struct cfg80211_ssid *ssid;
2755         struct sk_buff *skb;
2756         int i;
2757
2758         if (!mt7615_firmware_offload(dev))
2759                 return -ENOTSUPP;
2760
2761         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2762                                  sizeof(*req) + sreq->ie_len);
2763         if (!skb)
2764                 return -ENOMEM;
2765
2766         mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2767
2768         req = (struct mt7615_sched_scan_req *)skb_put(skb, sizeof(*req));
2769         req->version = 1;
2770         req->seq_num = mvif->scan_seq_num | ext_phy << 7;
2771         req->scan_func = !!(sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR);
2772
2773         req->ssids_num = sreq->n_ssids;
2774         for (i = 0; i < req->ssids_num; i++) {
2775                 ssid = &sreq->ssids[i];
2776                 memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
2777                 req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
2778         }
2779
2780         req->match_num = sreq->n_match_sets;
2781         for (i = 0; i < req->match_num; i++) {
2782                 match = &sreq->match_sets[i];
2783                 memcpy(req->match[i].ssid, match->ssid.ssid,
2784                        match->ssid.ssid_len);
2785                 req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
2786                 req->match[i].ssid_len = match->ssid.ssid_len;
2787         }
2788
2789         req->channel_type = 4;
2790         req->channels_num = min_t(u8, sreq->n_channels, 64);
2791         for (i = 0; i < req->channels_num; i++) {
2792                 chan = &req->channels[i];
2793                 chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2;
2794                 chan->channel_num = scan_list[i]->hw_value;
2795         }
2796
2797         req->intervals_num = sreq->n_scan_plans;
2798         for (i = 0; i < req->intervals_num; i++)
2799                 req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2800
2801         if (sreq->ie_len > 0) {
2802                 req->ie_len = cpu_to_le16(sreq->ie_len);
2803                 memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
2804         }
2805
2806         return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2807                                        MCU_CMD_SCHED_SCAN_REQ, false);
2808 }
2809
2810 int mt7615_mcu_sched_scan_enable(struct mt7615_phy *phy,
2811                                  struct ieee80211_vif *vif,
2812                                  bool enable)
2813 {
2814         struct mt7615_dev *dev = phy->dev;
2815         struct {
2816                 u8 active; /* 0: enabled 1: disabled */
2817                 u8 rsv[3];
2818         } __packed req = {
2819                 .active = !enable,
2820         };
2821
2822         if (!mt7615_firmware_offload(dev))
2823                 return -ENOTSUPP;
2824
2825         if (enable)
2826                 set_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
2827         else
2828                 clear_bit(MT76_HW_SCHED_SCANNING, &phy->mt76->state);
2829
2830         return __mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SCHED_SCAN_ENABLE,
2831                                    &req, sizeof(req), false);
2832 }
2833
2834 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2835 {
2836         int i;
2837
2838         for (i = 0; i < n_freqs; i++)
2839                 if (cur == freqs[i])
2840                         return i;
2841
2842         return -1;
2843 }
2844
2845 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2846 {
2847         static const u16 freq_list[] = {
2848                 4980, 5805, 5905, 5190,
2849                 5230, 5270, 5310, 5350,
2850                 5390, 5430, 5470, 5510,
2851                 5550, 5590, 5630, 5670,
2852                 5710, 5755, 5795, 5835,
2853                 5875, 5210, 5290, 5370,
2854                 5450, 5530, 5610, 5690,
2855                 5775, 5855
2856         };
2857         static const u16 freq_bw40[] = {
2858                 5190, 5230, 5270, 5310,
2859                 5350, 5390, 5430, 5470,
2860                 5510, 5550, 5590, 5630,
2861                 5670, 5710, 5755, 5795,
2862                 5835, 5875
2863         };
2864         int offset_2g = ARRAY_SIZE(freq_list);
2865         int idx;
2866
2867         if (freq < 4000) {
2868                 if (freq < 2427)
2869                         return offset_2g;
2870                 if (freq < 2442)
2871                         return offset_2g + 1;
2872                 if (freq < 2457)
2873                         return offset_2g + 2;
2874
2875                 return offset_2g + 3;
2876         }
2877
2878         switch (bw) {
2879         case NL80211_CHAN_WIDTH_80:
2880         case NL80211_CHAN_WIDTH_80P80:
2881         case NL80211_CHAN_WIDTH_160:
2882                 break;
2883         default:
2884                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2885                                            freq + 10);
2886                 if (idx >= 0) {
2887                         freq = freq_bw40[idx];
2888                         break;
2889                 }
2890
2891                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2892                                            freq - 10);
2893                 if (idx >= 0) {
2894                         freq = freq_bw40[idx];
2895                         break;
2896                 }
2897                 /* fall through */
2898         case NL80211_CHAN_WIDTH_40:
2899                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2900                                            freq);
2901                 if (idx >= 0)
2902                         break;
2903
2904                 return -1;
2905
2906         }
2907
2908         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2909 }
2910
2911 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2912 {
2913         struct mt7615_dev *dev = phy->dev;
2914         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2915         int freq2 = chandef->center_freq2;
2916         int ret;
2917         struct {
2918                 u8 direction;
2919                 u8 runtime_calibration;
2920                 u8 _rsv[2];
2921
2922                 __le16 center_freq;
2923                 u8 bw;
2924                 u8 band;
2925                 u8 is_freq2;
2926                 u8 success;
2927                 u8 dbdc_en;
2928
2929                 u8 _rsv2;
2930
2931                 struct {
2932                         __le32 sx0_i_lna[4];
2933                         __le32 sx0_q_lna[4];
2934
2935                         __le32 sx2_i_lna[4];
2936                         __le32 sx2_q_lna[4];
2937                 } dcoc_data[4];
2938         } req = {
2939                 .direction = 1,
2940
2941                 .bw = mt7615_mcu_chan_bw(chandef),
2942                 .band = chandef->center_freq1 > 4000,
2943                 .dbdc_en = !!dev->mt76.phy2,
2944         };
2945         u16 center_freq = chandef->center_freq1;
2946         int freq_idx;
2947         u8 *eep = dev->mt76.eeprom.data;
2948
2949         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2950                 return 0;
2951
2952         if (chandef->width == NL80211_CHAN_WIDTH_160) {
2953                 freq2 = center_freq + 40;
2954                 center_freq -= 40;
2955         }
2956
2957 again:
2958         req.runtime_calibration = 1;
2959         freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2960         if (freq_idx < 0)
2961                 goto out;
2962
2963         memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2964                               freq_idx * MT7615_EEPROM_DCOC_SIZE,
2965                sizeof(req.dcoc_data));
2966         req.runtime_calibration = 0;
2967
2968 out:
2969         req.center_freq = cpu_to_le16(center_freq);
2970         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
2971                                   sizeof(req), true);
2972
2973         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2974              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2975                 req.is_freq2 = true;
2976                 center_freq = freq2;
2977                 goto again;
2978         }
2979
2980         return ret;
2981 }
2982
2983 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2984 {
2985         static const u16 freq_list[] = {
2986                 4920, 4940, 4960, 4980,
2987                 5040, 5060, 5080, 5180,
2988                 5200, 5220, 5240, 5260,
2989                 5280, 5300, 5320, 5340,
2990                 5360, 5380, 5400, 5420,
2991                 5440, 5460, 5480, 5500,
2992                 5520, 5540, 5560, 5580,
2993                 5600, 5620, 5640, 5660,
2994                 5680, 5700, 5720, 5745,
2995                 5765, 5785, 5805, 5825,
2996                 5845, 5865, 5885, 5905
2997         };
2998         int offset_2g = ARRAY_SIZE(freq_list);
2999         int idx;
3000
3001         if (freq < 4000) {
3002                 if (freq < 2432)
3003                         return offset_2g;
3004                 if (freq < 2457)
3005                         return offset_2g + 1;
3006
3007                 return offset_2g + 2;
3008         }
3009
3010         if (bw != NL80211_CHAN_WIDTH_20) {
3011                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3012                                            freq + 10);
3013                 if (idx >= 0)
3014                         return idx;
3015
3016                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3017                                            freq - 10);
3018                 if (idx >= 0)
3019                         return idx;
3020         }
3021
3022         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3023 }
3024
3025
3026 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
3027 {
3028         struct mt7615_dev *dev = phy->dev;
3029         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3030         int freq2 = chandef->center_freq2;
3031         int ret;
3032         struct {
3033                 u8 direction;
3034                 u8 runtime_calibration;
3035                 u8 _rsv[2];
3036
3037                 __le16 center_freq;
3038                 u8 bw;
3039                 u8 band;
3040                 u8 is_freq2;
3041                 u8 success;
3042                 u8 dbdc_en;
3043
3044                 u8 _rsv2;
3045
3046                 struct {
3047                         struct {
3048                                 u32 dpd_g0;
3049                                 u8 data[32];
3050                         } wf0, wf1;
3051
3052                         struct {
3053                                 u32 dpd_g0_prim;
3054                                 u32 dpd_g0_sec;
3055                                 u8 data_prim[32];
3056                                 u8 data_sec[32];
3057                         } wf2, wf3;
3058                 } dpd_data;
3059         } req = {
3060                 .direction = 1,
3061
3062                 .bw = mt7615_mcu_chan_bw(chandef),
3063                 .band = chandef->center_freq1 > 4000,
3064                 .dbdc_en = !!dev->mt76.phy2,
3065         };
3066         u16 center_freq = chandef->center_freq1;
3067         int freq_idx;
3068         u8 *eep = dev->mt76.eeprom.data;
3069
3070         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
3071                 return 0;
3072
3073         if (chandef->width == NL80211_CHAN_WIDTH_160) {
3074                 freq2 = center_freq + 40;
3075                 center_freq -= 40;
3076         }
3077
3078 again:
3079         req.runtime_calibration = 1;
3080         freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
3081         if (freq_idx < 0)
3082                 goto out;
3083
3084         memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
3085                               freq_idx * MT7615_EEPROM_TXDPD_SIZE,
3086                sizeof(req.dpd_data));
3087         req.runtime_calibration = 0;
3088
3089 out:
3090         req.center_freq = cpu_to_le16(center_freq);
3091         ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
3092                                   sizeof(req), true);
3093
3094         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
3095              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
3096                 req.is_freq2 = true;
3097                 center_freq = freq2;
3098                 goto again;
3099         }
3100
3101         return ret;
3102 }