drivers/net/wireless/mediatek/mt76/mt7615/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2019 MediaTek Inc.
   3  *
   4  * Author: Roy Luo <royluo@google.com>
   5  *         Ryder Lee <ryder.lee@mediatek.com>
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include "mt7615.h"
  10 #include "mcu.h"
  11 #include "mac.h"
  12 #include "eeprom.h"
  13
  14 static bool prefer_offload_fw = true;
  15 module_param(prefer_offload_fw, bool, 0644);
  16 MODULE_PARM_DESC(prefer_offload_fw,
  17                  "Prefer client mode offload firmware (MT7663)");
  18
  19 struct mt7615_patch_hdr {
  20         char build_date[16];
  21         char platform[4];
  22         __be32 hw_sw_ver;
  23         __be32 patch_ver;
  24         __be16 checksum;
  25 } __packed;
  26
  27 struct mt7615_fw_trailer {
  28         __le32 addr;
  29         u8 chip_id;
  30         u8 feature_set;
  31         u8 eco_code;
  32         char fw_ver[10];
  33         char build_date[15];
  34         __le32 len;
  35 } __packed;
  36
  37 #define FW_V3_COMMON_TAILER_SIZE        36
  38 #define FW_V3_REGION_TAILER_SIZE        40
  39 #define FW_START_OVERRIDE               BIT(0)
  40 #define FW_START_DLYCAL                 BIT(1)
  41 #define FW_START_WORKING_PDA_CR4        BIT(2)
  42
  43 struct mt7663_fw_trailer {
  44         u8 chip_id;
  45         u8 eco_code;
  46         u8 n_region;
  47         u8 format_ver;
  48         u8 format_flag;
  49         u8 reserv[2];
  50         char fw_ver[10];
  51         char build_date[15];
  52         __le32 crc;
  53 } __packed;
  54
  55 struct mt7663_fw_buf {
  56         __le32 crc;
  57         __le32 d_img_size;
  58         __le32 block_size;
  59         u8 rsv[4];
  60         __le32 img_dest_addr;
  61         __le32 img_size;
  62         u8 feature_set;
  63 };
  64
  65 #define MT7615_PATCH_ADDRESS            0x80000
  66 #define MT7622_PATCH_ADDRESS            0x9c000
  67 #define MT7663_PATCH_ADDRESS            0xdc000
  68
  69 #define N9_REGION_NUM                   2
  70 #define CR4_REGION_NUM                  1
  71
  72 #define IMG_CRC_LEN                     4
  73
  74 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  75 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  76
  77 #define DL_MODE_ENCRYPT                 BIT(0)
  78 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  79 #define DL_MODE_RESET_SEC_IV            BIT(3)
  80 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  81 #define DL_MODE_VALID_RAM_ENTRY         BIT(5)
  82 #define DL_MODE_NEED_RSP                BIT(31)
  83
  84 #define FW_START_OVERRIDE               BIT(0)
  85 #define FW_START_WORKING_PDA_CR4        BIT(2)
  86
  87 void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb,
  88                          int cmd, int *wait_seq)
  89 {
  90         int txd_len, mcu_cmd = cmd & MCU_CMD_MASK;
  91         struct mt7615_uni_txd *uni_txd;
  92         struct mt7615_mcu_txd *mcu_txd;
  93         u8 seq, q_idx, pkt_fmt;
  94         __le32 *txd;
  95         u32 val;
  96
  97         /* TODO: make dynamic based on msg type */
  98         dev->mt76.mcu.timeout = 20 * HZ;
  99
 100         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 101         if (!seq)
 102                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 103         if (wait_seq)
 104                 *wait_seq = seq;
 105
 106         txd_len = cmd & MCU_UNI_PREFIX ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 107         txd = (__le32 *)skb_push(skb, txd_len);
 108
 109         if (cmd != MCU_CMD_FW_SCATTER) {
 110                 q_idx = MT_TX_MCU_PORT_RX_Q0;
 111                 pkt_fmt = MT_TX_TYPE_CMD;
 112         } else {
 113                 q_idx = MT_TX_MCU_PORT_RX_FWDL;
 114                 pkt_fmt = MT_TX_TYPE_FW;
 115         }
 116
 117         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 118               FIELD_PREP(MT_TXD0_P_IDX, MT_TX_PORT_IDX_MCU) |
 119               FIELD_PREP(MT_TXD0_Q_IDX, q_idx);
 120         txd[0] = cpu_to_le32(val);
 121
 122         val = MT_TXD1_LONG_FORMAT |
 123               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD) |
 124               FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
 125         txd[1] = cpu_to_le32(val);
 126
 127         if (cmd & MCU_UNI_PREFIX) {
 128                 uni_txd = (struct mt7615_uni_txd *)txd;
 129                 uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 130                 uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 131                 uni_txd->cid = cpu_to_le16(mcu_cmd);
 132                 uni_txd->s2d_index = MCU_S2D_H2N;
 133                 uni_txd->pkt_type = MCU_PKT_ID;
 134                 uni_txd->seq = seq;
 135
 136                 return;
 137         }
 138
 139         mcu_txd = (struct mt7615_mcu_txd *)txd;
 140         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 141         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
 142         mcu_txd->s2d_index = MCU_S2D_H2N;
 143         mcu_txd->pkt_type = MCU_PKT_ID;
 144         mcu_txd->seq = seq;
 145
 146         switch (cmd & ~MCU_CMD_MASK) {
 147         case MCU_FW_PREFIX:
 148                 mcu_txd->set_query = MCU_Q_NA;
 149                 mcu_txd->cid = mcu_cmd;
 150                 break;
 151         case MCU_CE_PREFIX:
 152                 if (cmd & MCU_QUERY_MASK)
 153                         mcu_txd->set_query = MCU_Q_QUERY;
 154                 else
 155                         mcu_txd->set_query = MCU_Q_SET;
 156                 mcu_txd->cid = mcu_cmd;
 157                 break;
 158         default:
 159                 mcu_txd->cid = MCU_CMD_EXT_CID;
 160                 if (cmd & MCU_QUERY_PREFIX)
 161                         mcu_txd->set_query = MCU_Q_QUERY;
 162                 else
 163                         mcu_txd->set_query = MCU_Q_SET;
 164                 mcu_txd->ext_cid = mcu_cmd;
 165                 mcu_txd->ext_cid_ack = 1;
 166                 break;
 167         }
 168 }
 169 EXPORT_SYMBOL_GPL(mt7615_mcu_fill_msg);
 170
 171 int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 172                               struct sk_buff *skb, int seq)
 173 {
 174         struct mt7615_mcu_rxd *rxd;
 175         int ret = 0;
 176
 177         if (!skb) {
 178                 dev_err(mdev->dev, "Message %ld (seq %d) timeout\n",
 179                         cmd & MCU_CMD_MASK, seq);
 180                 return -ETIMEDOUT;
 181         }
 182
 183         rxd = (struct mt7615_mcu_rxd *)skb->data;
 184         if (seq != rxd->seq)
 185                 return -EAGAIN;
 186
 187         switch (cmd) {
 188         case MCU_CMD_PATCH_SEM_CONTROL:
 189                 skb_pull(skb, sizeof(*rxd) - 4);
 190                 ret = *skb->data;
 191                 break;
 192         case MCU_EXT_CMD_GET_TEMP:
 193                 skb_pull(skb, sizeof(*rxd));
 194                 ret = le32_to_cpu(*(__le32 *)skb->data);
 195                 break;
 196         case MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX:
 197                 skb_pull(skb, sizeof(*rxd));
 198                 ret = le32_to_cpu(*(__le32 *)&skb->data[8]);
 199                 break;
 200         case MCU_UNI_CMD_DEV_INFO_UPDATE:
 201         case MCU_UNI_CMD_BSS_INFO_UPDATE:
 202         case MCU_UNI_CMD_STA_REC_UPDATE:
 203         case MCU_UNI_CMD_HIF_CTRL:
 204         case MCU_UNI_CMD_OFFLOAD:
 205         case MCU_UNI_CMD_SUSPEND: {
 206                 struct mt7615_mcu_uni_event *event;
 207
 208                 skb_pull(skb, sizeof(*rxd));
 209                 event = (struct mt7615_mcu_uni_event *)skb->data;
 210                 ret = le32_to_cpu(event->status);
 211                 break;
 212         }
 213         case MCU_CMD_REG_READ: {
 214                 struct mt7615_mcu_reg_event *event;
 215
 216                 skb_pull(skb, sizeof(*rxd));
 217                 event = (struct mt7615_mcu_reg_event *)skb->data;
 218                 ret = (int)le32_to_cpu(event->val);
 219                 break;
 220         }
 221         default:
 222                 break;
 223         }
 224
 225         return ret;
 226 }
 227 EXPORT_SYMBOL_GPL(mt7615_mcu_parse_response);
 228
 229 static int
 230 mt7615_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 231                         int cmd, int *seq)
 232 {
 233         struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
 234         enum mt76_txq_id qid;
 235
 236         mt7615_mcu_fill_msg(dev, skb, cmd, seq);
 237         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 238                 qid = MT_MCUQ_WM;
 239         else
 240                 qid = MT_MCUQ_FWDL;
 241
 242         return mt76_tx_queue_skb_raw(dev, dev->mt76.q_mcu[qid], skb, 0);
 243 }
 244
 245 u32 mt7615_rf_rr(struct mt7615_dev *dev, u32 wf, u32 reg)
 246 {
 247         struct {
 248                 __le32 wifi_stream;
 249                 __le32 address;
 250                 __le32 data;
 251         } req = {
 252                 .wifi_stream = cpu_to_le32(wf),
 253                 .address = cpu_to_le32(reg),
 254         };
 255
 256         return mt76_mcu_send_msg(&dev->mt76,
 257                                  MCU_EXT_CMD_RF_REG_ACCESS | MCU_QUERY_PREFIX,
 258                                  &req, sizeof(req), true);
 259 }
 260
 261 int mt7615_rf_wr(struct mt7615_dev *dev, u32 wf, u32 reg, u32 val)
 262 {
 263         struct {
 264                 __le32 wifi_stream;
 265                 __le32 address;
 266                 __le32 data;
 267         } req = {
 268                 .wifi_stream = cpu_to_le32(wf),
 269                 .address = cpu_to_le32(reg),
 270                 .data = cpu_to_le32(val),
 271         };
 272
 273         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RF_REG_ACCESS, &req,
 274                                  sizeof(req), false);
 275 }
 276
 277 static void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en)
 278 {
 279         if (!is_mt7622(&dev->mt76))
 280                 return;
 281
 282         regmap_update_bits(dev->infracfg, MT_INFRACFG_MISC,
 283                            MT_INFRACFG_MISC_AP2CONN_WAKE,
 284                            !en * MT_INFRACFG_MISC_AP2CONN_WAKE);
 285 }
 286
 287 static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)
 288 {
 289         struct mt76_phy *mphy = &dev->mt76.phy;
 290         struct mt76_dev *mdev = &dev->mt76;
 291         u32 addr;
 292         int err;
 293
 294         addr = is_mt7663(mdev) ? MT_PCIE_DOORBELL_PUSH : MT_CFG_LPCR_HOST;
 295         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_DRV_OWN);
 296
 297         mt7622_trigger_hif_int(dev, true);
 298
 299         addr = is_mt7663(mdev) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 300         err = !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN, 0, 3000);
 301
 302         mt7622_trigger_hif_int(dev, false);
 303
 304         if (err) {
 305                 dev_err(mdev->dev, "driver own failed\n");
 306                 return -ETIMEDOUT;
 307         }
 308
 309         clear_bit(MT76_STATE_PM, &mphy->state);
 310
 311         return 0;
 312 }
 313
 314 static int mt7615_mcu_lp_drv_pmctrl(struct mt7615_dev *dev)
 315 {
 316         struct mt76_phy *mphy = &dev->mt76.phy;
 317         int i;
 318
 319         if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))
 320                 goto out;
 321
 322         for (i = 0; i < MT7615_DRV_OWN_RETRY_COUNT; i++) {
 323                 mt76_wr(dev, MT_PCIE_DOORBELL_PUSH, MT_CFG_LPCR_HOST_DRV_OWN);
 324                 if (mt76_poll_msec(dev, MT_CONN_HIF_ON_LPCTL,
 325                                    MT_CFG_LPCR_HOST_FW_OWN, 0, 50))
 326                         break;
 327         }
 328
 329         if (i == MT7615_DRV_OWN_RETRY_COUNT) {
 330                 dev_err(dev->mt76.dev, "driver own failed\n");
 331                 set_bit(MT76_STATE_PM, &mphy->state);
 332                 return -EIO;
 333         }
 334
 335 out:
 336         dev->pm.last_activity = jiffies;
 337
 338         return 0;
 339 }
 340
 341 static int mt7615_mcu_fw_pmctrl(struct mt7615_dev *dev)
 342 {
 343         struct mt76_phy *mphy = &dev->mt76.phy;
 344         int err = 0;
 345         u32 addr;
 346
 347         if (test_and_set_bit(MT76_STATE_PM, &mphy->state))
 348                 return 0;
 349
 350         mt7622_trigger_hif_int(dev, true);
 351
 352         addr = is_mt7663(&dev->mt76) ? MT_CONN_HIF_ON_LPCTL : MT_CFG_LPCR_HOST;
 353         mt76_wr(dev, addr, MT_CFG_LPCR_HOST_FW_OWN);
 354
 355         if (is_mt7622(&dev->mt76) &&
 356             !mt76_poll_msec(dev, addr, MT_CFG_LPCR_HOST_FW_OWN,
 357                             MT_CFG_LPCR_HOST_FW_OWN, 3000)) {
 358                 dev_err(dev->mt76.dev, "Timeout for firmware own\n");
 359                 clear_bit(MT76_STATE_PM, &mphy->state);
 360                 err = -EIO;
 361         }
 362
 363         mt7622_trigger_hif_int(dev, false);
 364
 365         return err;
 366 }
 367
 368 static void
 369 mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 370 {
 371         if (vif->csa_active)
 372                 ieee80211_csa_finish(vif);
 373 }
 374
 375 static void
 376 mt7615_mcu_rx_radar_detected(struct mt7615_dev *dev, struct sk_buff *skb)
 377 {
 378         struct mt76_phy *mphy = &dev->mt76.phy;
 379         struct mt7615_mcu_rdd_report *r;
 380
 381         r = (struct mt7615_mcu_rdd_report *)skb->data;
 382
 383         if (r->idx && dev->mt76.phy2)
 384                 mphy = dev->mt76.phy2;
 385
 386         ieee80211_radar_detected(mphy->hw);
 387         dev->hw_pattern++;
 388 }
 389
 390 static void
 391 mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
 392 {
 393         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 394         const char *data = (char *)&rxd[1];
 395         const char *type;
 396
 397         switch (rxd->s2d_index) {
 398         case 0:
 399                 type = "N9";
 400                 break;
 401         case 2:
 402                 type = "CR4";
 403                 break;
 404         default:
 405                 type = "unknown";
 406                 break;
 407         }
 408
 409         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 410 }
 411
 412 static void
 413 mt7615_mcu_rx_ext_event(struct mt7615_dev *dev, struct sk_buff *skb)
 414 {
 415         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 416
 417         switch (rxd->ext_eid) {
 418         case MCU_EXT_EVENT_RDD_REPORT:
 419                 mt7615_mcu_rx_radar_detected(dev, skb);
 420                 break;
 421         case MCU_EXT_EVENT_CSA_NOTIFY:
 422                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 423                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 424                                 mt7615_mcu_csa_finish, dev);
 425                 break;
 426         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 427                 mt7615_mcu_rx_log_message(dev, skb);
 428                 break;
 429         default:
 430                 break;
 431         }
 432 }
 433
 434 static void
 435 mt7615_mcu_scan_event(struct mt7615_dev *dev, struct sk_buff *skb)
 436 {
 437         u8 *seq_num = skb->data + sizeof(struct mt7615_mcu_rxd);
 438         struct mt7615_phy *phy;
 439         struct mt76_phy *mphy;
 440
 441         if (*seq_num & BIT(7) && dev->mt76.phy2)
 442                 mphy = dev->mt76.phy2;
 443         else
 444                 mphy = &dev->mt76.phy;
 445
 446         phy = (struct mt7615_phy *)mphy->priv;
 447
 448         spin_lock_bh(&dev->mt76.lock);
 449         __skb_queue_tail(&phy->scan_event_list, skb);
 450         spin_unlock_bh(&dev->mt76.lock);
 451
 452         ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
 453                                      MT7615_HW_SCAN_TIMEOUT);
 454 }
 455
 456 static void
 457 mt7615_mcu_roc_event(struct mt7615_dev *dev, struct sk_buff *skb)
 458 {
 459         struct mt7615_roc_tlv *event;
 460         struct mt7615_phy *phy;
 461         struct mt76_phy *mphy;
 462         int duration;
 463
 464         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 465         event = (struct mt7615_roc_tlv *)skb->data;
 466
 467         if (event->dbdc_band && dev->mt76.phy2)
 468                 mphy = dev->mt76.phy2;
 469         else
 470                 mphy = &dev->mt76.phy;
 471
 472         ieee80211_ready_on_channel(mphy->hw);
 473
 474         phy = (struct mt7615_phy *)mphy->priv;
 475         phy->roc_grant = true;
 476         wake_up(&phy->roc_wait);
 477
 478         duration = le32_to_cpu(event->max_interval);
 479         mod_timer(&phy->roc_timer,
 480                   round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
 481 }
 482
 483 static void
 484 mt7615_mcu_beacon_loss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 485 {
 486         struct mt76_connac_beacon_loss_event *event;
 487         struct mt76_phy *mphy;
 488         u8 band_idx = 0; /* DBDC support */
 489
 490         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 491         event = (struct mt76_connac_beacon_loss_event *)skb->data;
 492         if (band_idx && dev->mt76.phy2)
 493                 mphy = dev->mt76.phy2;
 494         else
 495                 mphy = &dev->mt76.phy;
 496
 497         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 498                                         IEEE80211_IFACE_ITER_RESUME_ALL,
 499                                         mt76_connac_mcu_beacon_loss_iter,
 500                                         event);
 501 }
 502
 503 static void
 504 mt7615_mcu_bss_event(struct mt7615_dev *dev, struct sk_buff *skb)
 505 {
 506         struct mt76_connac_mcu_bss_event *event;
 507         struct mt76_phy *mphy;
 508         u8 band_idx = 0; /* DBDC support */
 509
 510         skb_pull(skb, sizeof(struct mt7615_mcu_rxd));
 511         event = (struct mt76_connac_mcu_bss_event *)skb->data;
 512
 513         if (band_idx && dev->mt76.phy2)
 514                 mphy = dev->mt76.phy2;
 515         else
 516                 mphy = &dev->mt76.phy;
 517
 518         if (event->is_absent)
 519                 ieee80211_stop_queues(mphy->hw);
 520         else
 521                 ieee80211_wake_queues(mphy->hw);
 522 }
 523
 524 static void
 525 mt7615_mcu_rx_unsolicited_event(struct mt7615_dev *dev, struct sk_buff *skb)
 526 {
 527         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 528
 529         switch (rxd->eid) {
 530         case MCU_EVENT_EXT:
 531                 mt7615_mcu_rx_ext_event(dev, skb);
 532                 break;
 533         case MCU_EVENT_BSS_BEACON_LOSS:
 534                 mt7615_mcu_beacon_loss_event(dev, skb);
 535                 break;
 536         case MCU_EVENT_ROC:
 537                 mt7615_mcu_roc_event(dev, skb);
 538                 break;
 539         case MCU_EVENT_SCHED_SCAN_DONE:
 540         case MCU_EVENT_SCAN_DONE:
 541                 mt7615_mcu_scan_event(dev, skb);
 542                 return;
 543         case MCU_EVENT_BSS_ABSENCE:
 544                 mt7615_mcu_bss_event(dev, skb);
 545                 break;
 546         default:
 547                 break;
 548         }
 549         dev_kfree_skb(skb);
 550 }
 551
 552 void mt7615_mcu_rx_event(struct mt7615_dev *dev, struct sk_buff *skb)
 553 {
 554         struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 555
 556         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 557             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 558             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 559             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 560             rxd->eid == MCU_EVENT_BSS_BEACON_LOSS ||
 561             rxd->eid == MCU_EVENT_SCHED_SCAN_DONE ||
 562             rxd->eid == MCU_EVENT_BSS_ABSENCE ||
 563             rxd->eid == MCU_EVENT_SCAN_DONE ||
 564             rxd->eid == MCU_EVENT_ROC ||
 565             !rxd->seq)
 566                 mt7615_mcu_rx_unsolicited_event(dev, skb);
 567         else
 568                 mt76_mcu_rx_event(&dev->mt76, skb);
 569 }
 570
 571 static int
 572 mt7615_mcu_muar_config(struct mt7615_dev *dev, struct ieee80211_vif *vif,
 573                        bool bssid, bool enable)
 574 {
 575         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 576         u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
 577         u32 mask = dev->omac_mask >> 32 & ~BIT(idx);
 578         const u8 *addr = vif->addr;
 579         struct {
 580                 u8 mode;
 581                 u8 force_clear;
 582                 u8 clear_bitmap[8];
 583                 u8 entry_count;
 584                 u8 write;
 585
 586                 u8 index;
 587                 u8 bssid;
 588                 u8 addr[ETH_ALEN];
 589         } __packed req = {
 590                 .mode = !!mask || enable,
 591                 .entry_count = 1,
 592                 .write = 1,
 593
 594                 .index = idx * 2 + bssid,
 595         };
 596
 597         if (bssid)
 598                 addr = vif->bss_conf.bssid;
 599
 600         if (enable)
 601                 ether_addr_copy(req.addr, addr);
 602
 603         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
 604                                  sizeof(req), true);
 605 }
 606
 607 static int
 608 mt7615_mcu_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 609                    bool enable)
 610 {
 611         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 612         struct mt7615_dev *dev = phy->dev;
 613         struct {
 614                 struct req_hdr {
 615                         u8 omac_idx;
 616                         u8 band_idx;
 617                         __le16 tlv_num;
 618                         u8 is_tlv_append;
 619                         u8 rsv[3];
 620                 } __packed hdr;
 621                 struct req_tlv {
 622                         __le16 tag;
 623                         __le16 len;
 624                         u8 active;
 625                         u8 band_idx;
 626                         u8 omac_addr[ETH_ALEN];
 627                 } __packed tlv;
 628         } data = {
 629                 .hdr = {
 630                         .omac_idx = mvif->mt76.omac_idx,
 631                         .band_idx = mvif->mt76.band_idx,
 632                         .tlv_num = cpu_to_le16(1),
 633                         .is_tlv_append = 1,
 634                 },
 635                 .tlv = {
 636                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
 637                         .len = cpu_to_le16(sizeof(struct req_tlv)),
 638                         .active = enable,
 639                         .band_idx = mvif->mt76.band_idx,
 640                 },
 641         };
 642
 643         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
 644                 return mt7615_mcu_muar_config(dev, vif, false, enable);
 645
 646         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
 647         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
 648                                  &data, sizeof(data), true);
 649 }
 650
 651 static int
 652 mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
 653                               struct ieee80211_hw *hw,
 654                               struct ieee80211_vif *vif, bool enable)
 655 {
 656         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 657         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
 658         struct ieee80211_mutable_offsets offs;
 659         struct ieee80211_tx_info *info;
 660         struct req {
 661                 u8 omac_idx;
 662                 u8 enable;
 663                 u8 wlan_idx;
 664                 u8 band_idx;
 665                 u8 pkt_type;
 666                 u8 need_pre_tbtt_int;
 667                 __le16 csa_ie_pos;
 668                 __le16 pkt_len;
 669                 __le16 tim_ie_pos;
 670                 u8 pkt[512];
 671                 u8 csa_cnt;
 672                 /* bss color change */
 673                 u8 bcc_cnt;
 674                 __le16 bcc_ie_pos;
 675         } __packed req = {
 676                 .omac_idx = mvif->mt76.omac_idx,
 677                 .enable = enable,
 678                 .wlan_idx = wcid->idx,
 679                 .band_idx = mvif->mt76.band_idx,
 680         };
 681         struct sk_buff *skb;
 682
 683         skb = ieee80211_beacon_get_template(hw, vif, &offs);
 684         if (!skb)
 685                 return -EINVAL;
 686
 687         if (skb->len > 512 - MT_TXD_SIZE) {
 688                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
 689                 dev_kfree_skb(skb);
 690                 return -EINVAL;
 691         }
 692
 693         if (mvif->mt76.band_idx) {
 694                 info = IEEE80211_SKB_CB(skb);
 695                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
 696         }
 697
 698         mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL,
 699                               0, NULL, true);
 700         memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len);
 701         req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 702         req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
 703         if (offs.cntdwn_counter_offs[0]) {
 704                 u16 csa_offs;
 705
 706                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
 707                 req.csa_ie_pos = cpu_to_le16(csa_offs);
 708                 req.csa_cnt = skb->data[offs.cntdwn_counter_offs[0]];
 709         }
 710         dev_kfree_skb(skb);
 711
 712         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_BCN_OFFLOAD, &req,
 713                                  sizeof(req), true);
 714 }
 715
 716 static int
 717 mt7615_mcu_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
 718 {
 719 #define ENTER_PM_STATE  1
 720 #define EXIT_PM_STATE   2
 721         struct {
 722                 u8 pm_number;
 723                 u8 pm_state;
 724                 u8 bssid[ETH_ALEN];
 725                 u8 dtim_period;
 726                 u8 wlan_idx;
 727                 __le16 bcn_interval;
 728                 __le32 aid;
 729                 __le32 rx_filter;
 730                 u8 band_idx;
 731                 u8 rsv[3];
 732                 __le32 feature;
 733                 u8 omac_idx;
 734                 u8 wmm_idx;
 735                 u8 bcn_loss_cnt;
 736                 u8 bcn_sp_duration;
 737         } __packed req = {
 738                 .pm_number = 5,
 739                 .pm_state = state ? ENTER_PM_STATE : EXIT_PM_STATE,
 740                 .band_idx = band,
 741         };
 742
 743         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
 744                                  sizeof(req), true);
 745 }
 746
 747 static int
 748 mt7615_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 749                          struct ieee80211_sta *sta, bool enable)
 750 {
 751         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 752         u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
 753         struct bss_info_basic *bss;
 754         u8 wlan_idx = mvif->sta.wcid.idx;
 755         struct tlv *tlv;
 756
 757         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 758
 759         switch (vif->type) {
 760         case NL80211_IFTYPE_MESH_POINT:
 761         case NL80211_IFTYPE_AP:
 762                 break;
 763         case NL80211_IFTYPE_STATION:
 764                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 765                 if (enable && sta) {
 766                         struct mt7615_sta *msta;
 767
 768                         msta = (struct mt7615_sta *)sta->drv_priv;
 769                         wlan_idx = msta->wcid.idx;
 770                 }
 771                 break;
 772         case NL80211_IFTYPE_ADHOC:
 773                 type = NETWORK_IBSS;
 774                 break;
 775         default:
 776                 WARN_ON(1);
 777                 break;
 778         }
 779
 780         bss = (struct bss_info_basic *)tlv;
 781         memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 782         bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 783         bss->network_type = cpu_to_le32(type);
 784         bss->dtim_period = vif->bss_conf.dtim_period;
 785         bss->bmc_tx_wlan_idx = wlan_idx;
 786         bss->wmm_idx = mvif->mt76.wmm_idx;
 787         bss->active = enable;
 788
 789         return 0;
 790 }
 791
 792 static void
 793 mt7615_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 794 {
 795         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 796         u8 omac_idx = mvif->mt76.omac_idx;
 797         struct bss_info_omac *omac;
 798         struct tlv *tlv;
 799         u32 type = 0;
 800
 801         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 802
 803         switch (vif->type) {
 804         case NL80211_IFTYPE_MESH_POINT:
 805         case NL80211_IFTYPE_AP:
 806                 if (vif->p2p)
 807                         type = CONNECTION_P2P_GO;
 808                 else
 809                         type = CONNECTION_INFRA_AP;
 810                 break;
 811         case NL80211_IFTYPE_STATION:
 812                 if (vif->p2p)
 813                         type = CONNECTION_P2P_GC;
 814                 else
 815                         type = CONNECTION_INFRA_STA;
 816                 break;
 817         case NL80211_IFTYPE_ADHOC:
 818                 type = CONNECTION_IBSS_ADHOC;
 819                 break;
 820         default:
 821                 WARN_ON(1);
 822                 break;
 823         }
 824
 825         omac = (struct bss_info_omac *)tlv;
 826         omac->conn_type = cpu_to_le32(type);
 827         omac->omac_idx = mvif->mt76.omac_idx;
 828         omac->band_idx = mvif->mt76.band_idx;
 829         omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
 830 }
 831
 832 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 833 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
 834 static void
 835 mt7615_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7615_vif *mvif)
 836 {
 837         struct bss_info_ext_bss *ext;
 838         int ext_bss_idx, tsf_offset;
 839         struct tlv *tlv;
 840
 841         ext_bss_idx = mvif->mt76.omac_idx - EXT_BSSID_START;
 842         if (ext_bss_idx < 0)
 843                 return;
 844
 845         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 846
 847         ext = (struct bss_info_ext_bss *)tlv;
 848         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 849         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 850 }
 851
 852 static int
 853 mt7615_mcu_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 854                    struct ieee80211_sta *sta, bool enable)
 855 {
 856         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 857         struct mt7615_dev *dev = phy->dev;
 858         struct sk_buff *skb;
 859
 860         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
 861                 mt7615_mcu_muar_config(dev, vif, true, enable);
 862
 863         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL);
 864         if (IS_ERR(skb))
 865                 return PTR_ERR(skb);
 866
 867         if (enable)
 868                 mt7615_mcu_bss_omac_tlv(skb, vif);
 869
 870         mt7615_mcu_bss_basic_tlv(skb, vif, sta, enable);
 871
 872         if (enable && mvif->mt76.omac_idx >= EXT_BSSID_START &&
 873             mvif->mt76.omac_idx < REPEATER_BSSID_START)
 874                 mt7615_mcu_bss_ext_tlv(skb, mvif);
 875
 876         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 877                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
 878 }
 879
 880 static int
 881 mt7615_mcu_wtbl_tx_ba(struct mt7615_dev *dev,
 882                       struct ieee80211_ampdu_params *params,
 883                       bool enable)
 884 {
 885         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 886         struct mt7615_vif *mvif = msta->vif;
 887         struct wtbl_req_hdr *wtbl_hdr;
 888         struct sk_buff *skb = NULL;
 889         int err;
 890
 891         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 892                                                   WTBL_SET, NULL, &skb);
 893         if (IS_ERR(wtbl_hdr))
 894                 return PTR_ERR(wtbl_hdr);
 895
 896         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, true,
 897                                     NULL, wtbl_hdr);
 898
 899         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
 900                                     true);
 901         if (err < 0)
 902                 return err;
 903
 904         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 905                                             &msta->wcid);
 906         if (IS_ERR(skb))
 907                 return PTR_ERR(skb);
 908
 909         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, true);
 910
 911         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 912                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
 913 }
 914
 915 static int
 916 mt7615_mcu_wtbl_rx_ba(struct mt7615_dev *dev,
 917                       struct ieee80211_ampdu_params *params,
 918                       bool enable)
 919 {
 920         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
 921         struct mt7615_vif *mvif = msta->vif;
 922         struct wtbl_req_hdr *wtbl_hdr;
 923         struct sk_buff *skb;
 924         int err;
 925
 926         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 927                                             &msta->wcid);
 928         if (IS_ERR(skb))
 929                 return PTR_ERR(skb);
 930
 931         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
 932
 933         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 934                                     MCU_EXT_CMD_STA_REC_UPDATE, true);
 935         if (err < 0 || !enable)
 936                 return err;
 937
 938         skb = NULL;
 939         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 940                                                   WTBL_SET, NULL, &skb);
 941         if (IS_ERR(wtbl_hdr))
 942                 return PTR_ERR(wtbl_hdr);
 943
 944         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
 945                                     NULL, wtbl_hdr);
 946
 947         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
 948                                      true);
 949 }
 950
 951 static int
 952 mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 953                         struct ieee80211_sta *sta, bool enable)
 954 {
 955         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
 956         struct sk_buff *skb, *sskb, *wskb = NULL;
 957         struct mt7615_dev *dev = phy->dev;
 958         struct wtbl_req_hdr *wtbl_hdr;
 959         struct mt7615_sta *msta;
 960         int cmd, err;
 961
 962         msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;
 963
 964         sskb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
 965                                              &msta->wcid);
 966         if (IS_ERR(sskb))
 967                 return PTR_ERR(sskb);
 968
 969         mt76_connac_mcu_sta_basic_tlv(sskb, vif, sta, enable);
 970         if (enable && sta)
 971                 mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif);
 972
 973         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
 974                                                   WTBL_RESET_AND_SET, NULL,
 975                                                   &wskb);
 976         if (IS_ERR(wtbl_hdr))
 977                 return PTR_ERR(wtbl_hdr);
 978
 979         if (enable) {
 980                 mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
 981                                                  NULL, wtbl_hdr);
 982                 if (sta)
 983                         mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, wskb, sta,
 984                                                     NULL, wtbl_hdr);
 985         }
 986
 987         cmd = enable ? MCU_EXT_CMD_WTBL_UPDATE : MCU_EXT_CMD_STA_REC_UPDATE;
 988         skb = enable ? wskb : sskb;
 989
 990         err = mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
 991         if (err < 0) {
 992                 skb = enable ? sskb : wskb;
 993                 dev_kfree_skb(skb);
 994
 995                 return err;
 996         }
 997
 998         cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
 999         skb = enable ? sskb : wskb;
1000
1001         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
1002 }
1003
1004 static const struct mt7615_mcu_ops wtbl_update_ops = {
1005         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1006         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1007         .add_dev_info = mt7615_mcu_add_dev,
1008         .add_bss_info = mt7615_mcu_add_bss,
1009         .add_tx_ba = mt7615_mcu_wtbl_tx_ba,
1010         .add_rx_ba = mt7615_mcu_wtbl_rx_ba,
1011         .sta_add = mt7615_mcu_wtbl_sta_add,
1012         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1013         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1014 };
1015
1016 static int
1017 mt7615_mcu_sta_ba(struct mt7615_dev *dev,
1018                   struct ieee80211_ampdu_params *params,
1019                   bool enable, bool tx)
1020 {
1021         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1022         struct mt7615_vif *mvif = msta->vif;
1023         struct wtbl_req_hdr *wtbl_hdr;
1024         struct tlv *sta_wtbl;
1025         struct sk_buff *skb;
1026
1027         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1028                                             &msta->wcid);
1029         if (IS_ERR(skb))
1030                 return PTR_ERR(skb);
1031
1032         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1033
1034         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1035
1036         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1037                                                   WTBL_SET, sta_wtbl, &skb);
1038         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, tx,
1039                                     sta_wtbl, wtbl_hdr);
1040
1041         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1042                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1043 }
1044
1045 static int
1046 mt7615_mcu_sta_tx_ba(struct mt7615_dev *dev,
1047                      struct ieee80211_ampdu_params *params,
1048                      bool enable)
1049 {
1050         return mt7615_mcu_sta_ba(dev, params, enable, true);
1051 }
1052
1053 static int
1054 mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
1055                      struct ieee80211_ampdu_params *params,
1056                      bool enable)
1057 {
1058         return mt7615_mcu_sta_ba(dev, params, enable, false);
1059 }
1060
1061 static int
1062 __mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
1063                      struct ieee80211_sta *sta, bool enable, int cmd)
1064 {
1065         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1066         struct mt76_wcid *wcid;
1067
1068         wcid = sta ? (struct mt76_wcid *)sta->drv_priv : &mvif->sta.wcid;
1069         return mt76_connac_mcu_add_sta_cmd(phy, vif, sta, wcid, enable, cmd);
1070 }
1071
1072 static int
1073 mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1074                    struct ieee80211_sta *sta, bool enable)
1075 {
1076         return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1077                                     MCU_EXT_CMD_STA_REC_UPDATE);
1078 }
1079
1080 static const struct mt7615_mcu_ops sta_update_ops = {
1081         .add_beacon_offload = mt7615_mcu_add_beacon_offload,
1082         .set_pm_state = mt7615_mcu_ctrl_pm_state,
1083         .add_dev_info = mt7615_mcu_add_dev,
1084         .add_bss_info = mt7615_mcu_add_bss,
1085         .add_tx_ba = mt7615_mcu_sta_tx_ba,
1086         .add_rx_ba = mt7615_mcu_sta_rx_ba,
1087         .sta_add = mt7615_mcu_add_sta,
1088         .set_drv_ctrl = mt7615_mcu_drv_pmctrl,
1089         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1090 };
1091
1092 static int
1093 mt7615_mcu_uni_ctrl_pm_state(struct mt7615_dev *dev, int band, int state)
1094 {
1095         return 0;
1096 }
1097
1098 static int
1099 mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
1100                                   struct ieee80211_hw *hw,
1101                                   struct ieee80211_vif *vif,
1102                                   bool enable)
1103 {
1104         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1105         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1106         struct ieee80211_mutable_offsets offs;
1107         struct {
1108                 struct req_hdr {
1109                         u8 bss_idx;
1110                         u8 pad[3];
1111                 } __packed hdr;
1112                 struct bcn_content_tlv {
1113                         __le16 tag;
1114                         __le16 len;
1115                         __le16 tim_ie_pos;
1116                         __le16 csa_ie_pos;
1117                         __le16 bcc_ie_pos;
1118                         /* 0: enable beacon offload
1119                          * 1: disable beacon offload
1120                          * 2: update probe respond offload
1121                          */
1122                         u8 enable;
1123                         /* 0: legacy format (TXD + payload)
1124                          * 1: only cap field IE
1125                          */
1126                         u8 type;
1127                         __le16 pkt_len;
1128                         u8 pkt[512];
1129                 } __packed beacon_tlv;
1130         } req = {
1131                 .hdr = {
1132                         .bss_idx = mvif->mt76.idx,
1133                 },
1134                 .beacon_tlv = {
1135                         .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
1136                         .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
1137                         .enable = enable,
1138                 },
1139         };
1140         struct sk_buff *skb;
1141
1142         skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
1143         if (!skb)
1144                 return -EINVAL;
1145
1146         if (skb->len > 512 - MT_TXD_SIZE) {
1147                 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
1148                 dev_kfree_skb(skb);
1149                 return -EINVAL;
1150         }
1151
1152         mt7615_mac_write_txwi(dev, (__le32 *)(req.beacon_tlv.pkt), skb,
1153                               wcid, NULL, 0, NULL, true);
1154         memcpy(req.beacon_tlv.pkt + MT_TXD_SIZE, skb->data, skb->len);
1155         req.beacon_tlv.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1156         req.beacon_tlv.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + offs.tim_offset);
1157
1158         if (offs.cntdwn_counter_offs[0]) {
1159                 u16 csa_offs;
1160
1161                 csa_offs = MT_TXD_SIZE + offs.cntdwn_counter_offs[0] - 4;
1162                 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
1163         }
1164         dev_kfree_skb(skb);
1165
1166         return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD_BSS_INFO_UPDATE,
1167                                  &req, sizeof(req), true);
1168 }
1169
1170 static int
1171 mt7615_mcu_uni_add_dev(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1172                        bool enable)
1173 {
1174         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1175
1176         return mt76_connac_mcu_uni_add_dev(phy->mt76, vif, &mvif->sta.wcid,
1177                                            enable);
1178 }
1179
1180 static int
1181 mt7615_mcu_uni_add_bss(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1182                        struct ieee80211_sta *sta, bool enable)
1183 {
1184         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
1185
1186         return mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
1187                                            enable);
1188 }
1189
1190 static inline int
1191 mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
1192                        struct ieee80211_sta *sta, bool enable)
1193 {
1194         return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
1195                                     MCU_UNI_CMD_STA_REC_UPDATE);
1196 }
1197
1198 static int
1199 mt7615_mcu_uni_tx_ba(struct mt7615_dev *dev,
1200                      struct ieee80211_ampdu_params *params,
1201                      bool enable)
1202 {
1203         struct mt7615_sta *sta = (struct mt7615_sta *)params->sta->drv_priv;
1204
1205         return mt76_connac_mcu_sta_ba(&dev->mt76, &sta->vif->mt76, params,
1206                                       enable, true);
1207 }
1208
1209 static int
1210 mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,
1211                      struct ieee80211_ampdu_params *params,
1212                      bool enable)
1213 {
1214         struct mt7615_sta *msta = (struct mt7615_sta *)params->sta->drv_priv;
1215         struct mt7615_vif *mvif = msta->vif;
1216         struct wtbl_req_hdr *wtbl_hdr;
1217         struct tlv *sta_wtbl;
1218         struct sk_buff *skb;
1219         int err;
1220
1221         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1222                                             &msta->wcid);
1223         if (IS_ERR(skb))
1224                 return PTR_ERR(skb);
1225
1226         mt76_connac_mcu_sta_ba_tlv(skb, params, enable, false);
1227
1228         err = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1229                                     MCU_UNI_CMD_STA_REC_UPDATE, true);
1230         if (err < 0 || !enable)
1231                 return err;
1232
1233         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1234                                             &msta->wcid);
1235         if (IS_ERR(skb))
1236                 return PTR_ERR(skb);
1237
1238         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1239                                            sizeof(struct tlv));
1240
1241         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1242                                                   WTBL_SET, sta_wtbl, &skb);
1243         if (IS_ERR(wtbl_hdr))
1244                 return PTR_ERR(wtbl_hdr);
1245
1246         mt76_connac_mcu_wtbl_ba_tlv(&dev->mt76, skb, params, enable, false,
1247                                     sta_wtbl, wtbl_hdr);
1248
1249         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1250                                      MCU_UNI_CMD_STA_REC_UPDATE, true);
1251 }
1252
1253 static const struct mt7615_mcu_ops uni_update_ops = {
1254         .add_beacon_offload = mt7615_mcu_uni_add_beacon_offload,
1255         .set_pm_state = mt7615_mcu_uni_ctrl_pm_state,
1256         .add_dev_info = mt7615_mcu_uni_add_dev,
1257         .add_bss_info = mt7615_mcu_uni_add_bss,
1258         .add_tx_ba = mt7615_mcu_uni_tx_ba,
1259         .add_rx_ba = mt7615_mcu_uni_rx_ba,
1260         .sta_add = mt7615_mcu_uni_add_sta,
1261         .set_drv_ctrl = mt7615_mcu_lp_drv_pmctrl,
1262         .set_fw_ctrl = mt7615_mcu_fw_pmctrl,
1263 };
1264
1265 int mt7615_mcu_restart(struct mt76_dev *dev)
1266 {
1267         return mt76_mcu_send_msg(dev, MCU_CMD_RESTART_DL_REQ, NULL, 0, true);
1268 }
1269 EXPORT_SYMBOL_GPL(mt7615_mcu_restart);
1270
1271 static int mt7615_load_patch(struct mt7615_dev *dev, u32 addr, const char *name)
1272 {
1273         const struct mt7615_patch_hdr *hdr;
1274         const struct firmware *fw = NULL;
1275         int len, ret, sem;
1276
1277         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, true);
1278         switch (sem) {
1279         case PATCH_IS_DL:
1280                 return 0;
1281         case PATCH_NOT_DL_SEM_SUCCESS:
1282                 break;
1283         default:
1284                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1285                 return -EAGAIN;
1286         }
1287
1288         ret = firmware_request_nowarn(&fw, name, dev->mt76.dev);
1289         if (ret)
1290                 goto out;
1291
1292         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1293                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1294                 ret = -EINVAL;
1295                 goto out;
1296         }
1297
1298         hdr = (const struct mt7615_patch_hdr *)(fw->data);
1299
1300         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1301                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1302
1303         len = fw->size - sizeof(*hdr);
1304
1305         ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1306                                             DL_MODE_NEED_RSP);
1307         if (ret) {
1308                 dev_err(dev->mt76.dev, "Download request failed\n");
1309                 goto out;
1310         }
1311
1312         ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1313                                      fw->data + sizeof(*hdr), len);
1314         if (ret) {
1315                 dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1316                 goto out;
1317         }
1318
1319         ret = mt76_connac_mcu_start_patch(&dev->mt76);
1320         if (ret)
1321                 dev_err(dev->mt76.dev, "Failed to start patch\n");
1322
1323 out:
1324         release_firmware(fw);
1325
1326         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
1327         switch (sem) {
1328         case PATCH_REL_SEM_SUCCESS:
1329                 break;
1330         default:
1331                 ret = -EAGAIN;
1332                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
1333                 break;
1334         }
1335
1336         return ret;
1337 }
1338
1339 static u32 mt7615_mcu_gen_dl_mode(u8 feature_set, bool is_cr4)
1340 {
1341         u32 ret = 0;
1342
1343         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
1344                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
1345         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
1346                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
1347         ret |= DL_MODE_NEED_RSP;
1348         ret |= is_cr4 ? DL_MODE_WORKING_PDA_CR4 : 0;
1349
1350         return ret;
1351 }
1352
1353 static int
1354 mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
1355                              const struct mt7615_fw_trailer *hdr,
1356                              const u8 *data, bool is_cr4)
1357 {
1358         int n_region = is_cr4 ? CR4_REGION_NUM : N9_REGION_NUM;
1359         int err, i, offset = 0;
1360         u32 len, addr, mode;
1361
1362         for (i = 0; i < n_region; i++) {
1363                 mode = mt7615_mcu_gen_dl_mode(hdr[i].feature_set, is_cr4);
1364                 len = le32_to_cpu(hdr[i].len) + IMG_CRC_LEN;
1365                 addr = le32_to_cpu(hdr[i].addr);
1366
1367                 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1368                                                     mode);
1369                 if (err) {
1370                         dev_err(dev->mt76.dev, "Download request failed\n");
1371                         return err;
1372                 }
1373
1374                 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1375                                              data + offset, len);
1376                 if (err) {
1377                         dev_err(dev->mt76.dev, "Failed to send firmware to device\n");
1378                         return err;
1379                 }
1380
1381                 offset += len;
1382         }
1383
1384         return 0;
1385 }
1386
1387 static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)
1388 {
1389         const struct mt7615_fw_trailer *hdr;
1390         const struct firmware *fw;
1391         int ret;
1392
1393         ret = request_firmware(&fw, name, dev->mt76.dev);
1394         if (ret)
1395                 return ret;
1396
1397         if (!fw || !fw->data || fw->size < N9_REGION_NUM * sizeof(*hdr)) {
1398                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1399                 ret = -EINVAL;
1400                 goto out;
1401         }
1402
1403         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1404                                         N9_REGION_NUM * sizeof(*hdr));
1405
1406         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1407                  hdr->fw_ver, hdr->build_date);
1408
1409         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, false);
1410         if (ret)
1411                 goto out;
1412
1413         ret = mt76_connac_mcu_start_firmware(&dev->mt76,
1414                                              le32_to_cpu(hdr->addr),
1415                                              FW_START_OVERRIDE);
1416         if (ret) {
1417                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1418                 goto out;
1419         }
1420
1421         snprintf(dev->mt76.hw->wiphy->fw_version,
1422                  sizeof(dev->mt76.hw->wiphy->fw_version),
1423                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1424
1425         if (!is_mt7615(&dev->mt76) &&
1426             !strncmp(hdr->fw_ver, "2.0", sizeof(hdr->fw_ver))) {
1427                 dev->fw_ver = MT7615_FIRMWARE_V2;
1428                 dev->mcu_ops = &sta_update_ops;
1429         } else {
1430                 dev->fw_ver = MT7615_FIRMWARE_V1;
1431                 dev->mcu_ops = &wtbl_update_ops;
1432         }
1433
1434 out:
1435         release_firmware(fw);
1436         return ret;
1437 }
1438
1439 static int mt7615_load_cr4(struct mt7615_dev *dev, const char *name)
1440 {
1441         const struct mt7615_fw_trailer *hdr;
1442         const struct firmware *fw;
1443         int ret;
1444
1445         ret = request_firmware(&fw, name, dev->mt76.dev);
1446         if (ret)
1447                 return ret;
1448
1449         if (!fw || !fw->data || fw->size < CR4_REGION_NUM * sizeof(*hdr)) {
1450                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1451                 ret = -EINVAL;
1452                 goto out;
1453         }
1454
1455         hdr = (const struct mt7615_fw_trailer *)(fw->data + fw->size -
1456                                         CR4_REGION_NUM * sizeof(*hdr));
1457
1458         dev_info(dev->mt76.dev, "CR4 Firmware Version: %.10s, Build Time: %.15s\n",
1459                  hdr->fw_ver, hdr->build_date);
1460
1461         ret = mt7615_mcu_send_ram_firmware(dev, hdr, fw->data, true);
1462         if (ret)
1463                 goto out;
1464
1465         ret = mt76_connac_mcu_start_firmware(&dev->mt76, 0,
1466                                              FW_START_WORKING_PDA_CR4);
1467         if (ret) {
1468                 dev_err(dev->mt76.dev, "Failed to start CR4 firmware\n");
1469                 goto out;
1470         }
1471
1472 out:
1473         release_firmware(fw);
1474
1475         return ret;
1476 }
1477
1478 static int mt7615_load_ram(struct mt7615_dev *dev)
1479 {
1480         int ret;
1481
1482         ret = mt7615_load_n9(dev, MT7615_FIRMWARE_N9);
1483         if (ret)
1484                 return ret;
1485
1486         return mt7615_load_cr4(dev, MT7615_FIRMWARE_CR4);
1487 }
1488
1489 static int mt7615_load_firmware(struct mt7615_dev *dev)
1490 {
1491         int ret;
1492         u32 val;
1493
1494         val = mt76_get_field(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE);
1495
1496         if (val != FW_STATE_FW_DOWNLOAD) {
1497                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1498                 return -EIO;
1499         }
1500
1501         ret = mt7615_load_patch(dev, MT7615_PATCH_ADDRESS, MT7615_ROM_PATCH);
1502         if (ret)
1503                 return ret;
1504
1505         ret = mt7615_load_ram(dev);
1506         if (ret)
1507                 return ret;
1508
1509         if (!mt76_poll_msec(dev, MT_TOP_MISC2, MT_TOP_MISC2_FW_STATE,
1510                             FIELD_PREP(MT_TOP_MISC2_FW_STATE,
1511                                        FW_STATE_CR4_RDY), 500)) {
1512                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1513                 return -EIO;
1514         }
1515
1516         return 0;
1517 }
1518
1519 static int mt7622_load_firmware(struct mt7615_dev *dev)
1520 {
1521         int ret;
1522         u32 val;
1523
1524         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1525
1526         val = mt76_get_field(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE);
1527         if (val != FW_STATE_FW_DOWNLOAD) {
1528                 dev_err(dev->mt76.dev, "Firmware is not ready for download\n");
1529                 return -EIO;
1530         }
1531
1532         ret = mt7615_load_patch(dev, MT7622_PATCH_ADDRESS, MT7622_ROM_PATCH);
1533         if (ret)
1534                 return ret;
1535
1536         ret = mt7615_load_n9(dev, MT7622_FIRMWARE_N9);
1537         if (ret)
1538                 return ret;
1539
1540         if (!mt76_poll_msec(dev, MT_TOP_OFF_RSV, MT_TOP_OFF_RSV_FW_STATE,
1541                             FIELD_PREP(MT_TOP_OFF_RSV_FW_STATE,
1542                                        FW_STATE_NORMAL_TRX), 1500)) {
1543                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1544                 return -EIO;
1545         }
1546
1547         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1548
1549         return 0;
1550 }
1551
1552 int mt7615_mcu_fw_log_2_host(struct mt7615_dev *dev, u8 ctrl)
1553 {
1554         struct {
1555                 u8 ctrl_val;
1556                 u8 pad[3];
1557         } data = {
1558                 .ctrl_val = ctrl
1559         };
1560
1561         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
1562                                  sizeof(data), true);
1563 }
1564
1565 static int mt7663_load_n9(struct mt7615_dev *dev, const char *name)
1566 {
1567         u32 offset = 0, override_addr = 0, flag = FW_START_DLYCAL;
1568         const struct mt7663_fw_trailer *hdr;
1569         const struct mt7663_fw_buf *buf;
1570         const struct firmware *fw;
1571         const u8 *base_addr;
1572         int i, ret;
1573
1574         ret = request_firmware(&fw, name, dev->mt76.dev);
1575         if (ret)
1576                 return ret;
1577
1578         if (!fw || !fw->data || fw->size < FW_V3_COMMON_TAILER_SIZE) {
1579                 dev_err(dev->mt76.dev, "Invalid firmware\n");
1580                 ret = -EINVAL;
1581                 goto out;
1582         }
1583
1584         hdr = (const struct mt7663_fw_trailer *)(fw->data + fw->size -
1585                                                  FW_V3_COMMON_TAILER_SIZE);
1586
1587         dev_info(dev->mt76.dev, "N9 Firmware Version: %.10s, Build Time: %.15s\n",
1588                  hdr->fw_ver, hdr->build_date);
1589         dev_info(dev->mt76.dev, "Region number: 0x%x\n", hdr->n_region);
1590
1591         base_addr = fw->data + fw->size - FW_V3_COMMON_TAILER_SIZE;
1592         for (i = 0; i < hdr->n_region; i++) {
1593                 u32 shift = (hdr->n_region - i) * FW_V3_REGION_TAILER_SIZE;
1594                 u32 len, addr, mode;
1595
1596                 dev_info(dev->mt76.dev, "Parsing tailer Region: %d\n", i);
1597
1598                 buf = (const struct mt7663_fw_buf *)(base_addr - shift);
1599                 mode = mt7615_mcu_gen_dl_mode(buf->feature_set, false);
1600                 addr = le32_to_cpu(buf->img_dest_addr);
1601                 len = le32_to_cpu(buf->img_size);
1602
1603                 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
1604                                                     mode);
1605                 if (ret) {
1606                         dev_err(dev->mt76.dev, "Download request failed\n");
1607                         goto out;
1608                 }
1609
1610                 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD_FW_SCATTER,
1611                                              fw->data + offset, len);
1612                 if (ret) {
1613                         dev_err(dev->mt76.dev, "Failed to send firmware\n");
1614                         goto out;
1615                 }
1616
1617                 offset += le32_to_cpu(buf->img_size);
1618                 if (buf->feature_set & DL_MODE_VALID_RAM_ENTRY) {
1619                         override_addr = le32_to_cpu(buf->img_dest_addr);
1620                         dev_info(dev->mt76.dev, "Region %d, override_addr = 0x%08x\n",
1621                                  i, override_addr);
1622                 }
1623         }
1624
1625         if (override_addr)
1626                 flag |= FW_START_OVERRIDE;
1627
1628         dev_info(dev->mt76.dev, "override_addr = 0x%08x, option = %d\n",
1629                  override_addr, flag);
1630
1631         ret = mt76_connac_mcu_start_firmware(&dev->mt76, override_addr, flag);
1632         if (ret) {
1633                 dev_err(dev->mt76.dev, "Failed to start N9 firmware\n");
1634                 goto out;
1635         }
1636
1637         snprintf(dev->mt76.hw->wiphy->fw_version,
1638                  sizeof(dev->mt76.hw->wiphy->fw_version),
1639                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
1640
1641 out:
1642         release_firmware(fw);
1643
1644         return ret;
1645 }
1646
1647 static int
1648 mt7663_load_rom_patch(struct mt7615_dev *dev, const char **n9_firmware)
1649 {
1650         const char *selected_rom, *secondary_rom = MT7663_ROM_PATCH;
1651         const char *primary_rom = MT7663_OFFLOAD_ROM_PATCH;
1652         int ret;
1653
1654         if (!prefer_offload_fw) {
1655                 secondary_rom = MT7663_OFFLOAD_ROM_PATCH;
1656                 primary_rom = MT7663_ROM_PATCH;
1657         }
1658         selected_rom = primary_rom;
1659
1660         ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS, primary_rom);
1661         if (ret) {
1662                 dev_info(dev->mt76.dev, "%s not found, switching to %s",
1663                          primary_rom, secondary_rom);
1664                 ret = mt7615_load_patch(dev, MT7663_PATCH_ADDRESS,
1665                                         secondary_rom);
1666                 if (ret) {
1667                         dev_err(dev->mt76.dev, "failed to load %s",
1668                                 secondary_rom);
1669                         return ret;
1670                 }
1671                 selected_rom = secondary_rom;
1672         }
1673
1674         if (!strcmp(selected_rom, MT7663_OFFLOAD_ROM_PATCH)) {
1675                 *n9_firmware = MT7663_OFFLOAD_FIRMWARE_N9;
1676                 dev->fw_ver = MT7615_FIRMWARE_V3;
1677                 dev->mcu_ops = &uni_update_ops;
1678         } else {
1679                 *n9_firmware = MT7663_FIRMWARE_N9;
1680                 dev->fw_ver = MT7615_FIRMWARE_V2;
1681                 dev->mcu_ops = &sta_update_ops;
1682         }
1683
1684         return 0;
1685 }
1686
1687 int __mt7663_load_firmware(struct mt7615_dev *dev)
1688 {
1689         const char *n9_firmware;
1690         int ret;
1691
1692         ret = mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY);
1693         if (ret) {
1694                 dev_dbg(dev->mt76.dev, "Firmware is already download\n");
1695                 return -EIO;
1696         }
1697
1698         ret = mt7663_load_rom_patch(dev, &n9_firmware);
1699         if (ret)
1700                 return ret;
1701
1702         ret = mt7663_load_n9(dev, n9_firmware);
1703         if (ret)
1704                 return ret;
1705
1706         if (!mt76_poll_msec(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY,
1707                             MT_TOP_MISC2_FW_N9_RDY, 1500)) {
1708                 ret = mt76_get_field(dev, MT_CONN_ON_MISC,
1709                                      MT7663_TOP_MISC2_FW_STATE);
1710                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
1711                 return -EIO;
1712         }
1713
1714 #ifdef CONFIG_PM
1715         if (mt7615_firmware_offload(dev))
1716                 dev->mt76.hw->wiphy->wowlan = &mt76_connac_wowlan_support;
1717 #endif /* CONFIG_PM */
1718
1719         dev_dbg(dev->mt76.dev, "Firmware init done\n");
1720
1721         return 0;
1722 }
1723 EXPORT_SYMBOL_GPL(__mt7663_load_firmware);
1724
1725 static int mt7663_load_firmware(struct mt7615_dev *dev)
1726 {
1727         int ret;
1728
1729         mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1730
1731         ret = __mt7663_load_firmware(dev);
1732         if (ret)
1733                 return ret;
1734
1735         mt76_clear(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_BYPASS_TX_SCH);
1736
1737         return 0;
1738 }
1739
1740 int mt7615_mcu_init(struct mt7615_dev *dev)
1741 {
1742         static const struct mt76_mcu_ops mt7615_mcu_ops = {
1743                 .headroom = sizeof(struct mt7615_mcu_txd),
1744                 .mcu_skb_send_msg = mt7615_mcu_send_message,
1745                 .mcu_parse_response = mt7615_mcu_parse_response,
1746                 .mcu_restart = mt7615_mcu_restart,
1747         };
1748         int ret;
1749
1750         dev->mt76.mcu_ops = &mt7615_mcu_ops,
1751
1752         ret = mt7615_mcu_drv_pmctrl(dev);
1753         if (ret)
1754                 return ret;
1755
1756         switch (mt76_chip(&dev->mt76)) {
1757         case 0x7622:
1758                 ret = mt7622_load_firmware(dev);
1759                 break;
1760         case 0x7663:
1761                 ret = mt7663_load_firmware(dev);
1762                 break;
1763         default:
1764                 ret = mt7615_load_firmware(dev);
1765                 break;
1766         }
1767         if (ret)
1768                 return ret;
1769
1770         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
1771         dev_dbg(dev->mt76.dev, "Firmware init done\n");
1772         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1773         mt7615_mcu_fw_log_2_host(dev, 0);
1774
1775         return 0;
1776 }
1777 EXPORT_SYMBOL_GPL(mt7615_mcu_init);
1778
1779 void mt7615_mcu_exit(struct mt7615_dev *dev)
1780 {
1781         __mt76_mcu_restart(&dev->mt76);
1782         mt7615_mcu_set_fw_ctrl(dev);
1783         skb_queue_purge(&dev->mt76.mcu.res_q);
1784 }
1785 EXPORT_SYMBOL_GPL(mt7615_mcu_exit);
1786
1787 int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)
1788 {
1789         struct {
1790                 u8 buffer_mode;
1791                 u8 content_format;
1792                 __le16 len;
1793         } __packed req_hdr = {
1794                 .buffer_mode = 1,
1795         };
1796         u8 *eep = (u8 *)dev->mt76.eeprom.data;
1797         struct sk_buff *skb;
1798         int eep_len, offset;
1799
1800         switch (mt76_chip(&dev->mt76)) {
1801         case 0x7622:
1802                 eep_len = MT7622_EE_MAX - MT_EE_NIC_CONF_0;
1803                 offset = MT_EE_NIC_CONF_0;
1804                 break;
1805         case 0x7663:
1806                 eep_len = MT7663_EE_MAX - MT_EE_CHIP_ID;
1807                 req_hdr.content_format = 1;
1808                 offset = MT_EE_CHIP_ID;
1809                 break;
1810         default:
1811                 eep_len = MT7615_EE_MAX - MT_EE_NIC_CONF_0;
1812                 offset = MT_EE_NIC_CONF_0;
1813                 break;
1814         }
1815
1816         req_hdr.len = cpu_to_le16(eep_len);
1817
1818         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req_hdr) + eep_len);
1819         if (!skb)
1820                 return -ENOMEM;
1821
1822         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
1823         skb_put_data(skb, eep + offset, eep_len);
1824
1825         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1826                                      MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
1827 }
1828
1829 int mt7615_mcu_set_wmm(struct mt7615_dev *dev, u8 queue,
1830                        const struct ieee80211_tx_queue_params *params)
1831 {
1832 #define WMM_AIFS_SET    BIT(0)
1833 #define WMM_CW_MIN_SET  BIT(1)
1834 #define WMM_CW_MAX_SET  BIT(2)
1835 #define WMM_TXOP_SET    BIT(3)
1836 #define WMM_PARAM_SET   (WMM_AIFS_SET | WMM_CW_MIN_SET | \
1837                          WMM_CW_MAX_SET | WMM_TXOP_SET)
1838         struct req_data {
1839                 u8 number;
1840                 u8 rsv[3];
1841                 u8 queue;
1842                 u8 valid;
1843                 u8 aifs;
1844                 u8 cw_min;
1845                 __le16 cw_max;
1846                 __le16 txop;
1847         } __packed req = {
1848                 .number = 1,
1849                 .queue = queue,
1850                 .valid = WMM_PARAM_SET,
1851                 .aifs = params->aifs,
1852                 .cw_min = 5,
1853                 .cw_max = cpu_to_le16(10),
1854                 .txop = cpu_to_le16(params->txop),
1855         };
1856
1857         if (params->cw_min)
1858                 req.cw_min = fls(params->cw_min);
1859         if (params->cw_max)
1860                 req.cw_max = cpu_to_le16(fls(params->cw_max));
1861
1862         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
1863                                  sizeof(req), true);
1864 }
1865
1866 int mt7615_mcu_set_dbdc(struct mt7615_dev *dev)
1867 {
1868         struct mt7615_phy *ext_phy = mt7615_ext_phy(dev);
1869         struct dbdc_entry {
1870                 u8 type;
1871                 u8 index;
1872                 u8 band;
1873                 u8 _rsv;
1874         };
1875         struct {
1876                 u8 enable;
1877                 u8 num;
1878                 u8 _rsv[2];
1879                 struct dbdc_entry entry[64];
1880         } req = {
1881                 .enable = !!ext_phy,
1882         };
1883         int i;
1884
1885         if (!ext_phy)
1886                 goto out;
1887
1888 #define ADD_DBDC_ENTRY(_type, _idx, _band)              \
1889         do { \
1890                 req.entry[req.num].type = _type;                \
1891                 req.entry[req.num].index = _idx;                \
1892                 req.entry[req.num++].band = _band;              \
1893         } while (0)
1894
1895         for (i = 0; i < 4; i++) {
1896                 bool band = !!(ext_phy->omac_mask & BIT_ULL(i));
1897
1898                 ADD_DBDC_ENTRY(DBDC_TYPE_BSS, i, band);
1899         }
1900
1901         for (i = 0; i < 14; i++) {
1902                 bool band = !!(ext_phy->omac_mask & BIT_ULL(0x11 + i));
1903
1904                 ADD_DBDC_ENTRY(DBDC_TYPE_MBSS, i, band);
1905         }
1906
1907         ADD_DBDC_ENTRY(DBDC_TYPE_MU, 0, 1);
1908
1909         for (i = 0; i < 3; i++)
1910                 ADD_DBDC_ENTRY(DBDC_TYPE_BF, i, 1);
1911
1912         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 0, 0);
1913         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 1, 0);
1914         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 2, 1);
1915         ADD_DBDC_ENTRY(DBDC_TYPE_WMM, 3, 1);
1916
1917         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 0, 0);
1918         ADD_DBDC_ENTRY(DBDC_TYPE_MGMT, 1, 1);
1919
1920 out:
1921         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DBDC_CTRL, &req,
1922                                  sizeof(req), true);
1923 }
1924
1925 int mt7615_mcu_del_wtbl_all(struct mt7615_dev *dev)
1926 {
1927         struct wtbl_req_hdr req = {
1928                 .operation = WTBL_RESET_ALL,
1929         };
1930
1931         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_WTBL_UPDATE, &req,
1932                                  sizeof(req), true);
1933 }
1934
1935 int mt7615_mcu_rdd_cmd(struct mt7615_dev *dev,
1936                        enum mt7615_rdd_cmd cmd, u8 index,
1937                        u8 rx_sel, u8 val)
1938 {
1939         struct {
1940                 u8 ctrl;
1941                 u8 rdd_idx;
1942                 u8 rdd_rx_sel;
1943                 u8 val;
1944                 u8 rsv[4];
1945         } req = {
1946                 .ctrl = cmd,
1947                 .rdd_idx = index,
1948                 .rdd_rx_sel = rx_sel,
1949                 .val = val,
1950         };
1951
1952         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
1953                                  sizeof(req), true);
1954 }
1955
1956 int mt7615_mcu_set_fcc5_lpn(struct mt7615_dev *dev, int val)
1957 {
1958         struct {
1959                 __le16 tag;
1960                 __le16 min_lpn;
1961         } req = {
1962                 .tag = cpu_to_le16(0x1),
1963                 .min_lpn = cpu_to_le16(val),
1964         };
1965
1966         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
1967                                  sizeof(req), true);
1968 }
1969
1970 int mt7615_mcu_set_pulse_th(struct mt7615_dev *dev,
1971                             const struct mt7615_dfs_pulse *pulse)
1972 {
1973         struct {
1974                 __le16 tag;
1975                 __le32 max_width;       /* us */
1976                 __le32 max_pwr;         /* dbm */
1977                 __le32 min_pwr;         /* dbm */
1978                 __le32 min_stgr_pri;    /* us */
1979                 __le32 max_stgr_pri;    /* us */
1980                 __le32 min_cr_pri;      /* us */
1981                 __le32 max_cr_pri;      /* us */
1982         } req = {
1983                 .tag = cpu_to_le16(0x3),
1984 #define __req_field(field) .field = cpu_to_le32(pulse->field)
1985                 __req_field(max_width),
1986                 __req_field(max_pwr),
1987                 __req_field(min_pwr),
1988                 __req_field(min_stgr_pri),
1989                 __req_field(max_stgr_pri),
1990                 __req_field(min_cr_pri),
1991                 __req_field(max_cr_pri),
1992 #undef  __req_field
1993         };
1994
1995         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
1996                                  sizeof(req), true);
1997 }
1998
1999 int mt7615_mcu_set_radar_th(struct mt7615_dev *dev, int index,
2000                             const struct mt7615_dfs_pattern *pattern)
2001 {
2002         struct {
2003                 __le16 tag;
2004                 __le16 radar_type;
2005                 u8 enb;
2006                 u8 stgr;
2007                 u8 min_crpn;
2008                 u8 max_crpn;
2009                 u8 min_crpr;
2010                 u8 min_pw;
2011                 u8 max_pw;
2012                 __le32 min_pri;
2013                 __le32 max_pri;
2014                 u8 min_crbn;
2015                 u8 max_crbn;
2016                 u8 min_stgpn;
2017                 u8 max_stgpn;
2018                 u8 min_stgpr;
2019         } req = {
2020                 .tag = cpu_to_le16(0x2),
2021                 .radar_type = cpu_to_le16(index),
2022 #define __req_field_u8(field) .field = pattern->field
2023 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2024                 __req_field_u8(enb),
2025                 __req_field_u8(stgr),
2026                 __req_field_u8(min_crpn),
2027                 __req_field_u8(max_crpn),
2028                 __req_field_u8(min_crpr),
2029                 __req_field_u8(min_pw),
2030                 __req_field_u8(max_pw),
2031                 __req_field_u32(min_pri),
2032                 __req_field_u32(max_pri),
2033                 __req_field_u8(min_crbn),
2034                 __req_field_u8(max_crbn),
2035                 __req_field_u8(min_stgpn),
2036                 __req_field_u8(max_stgpn),
2037                 __req_field_u8(min_stgpr),
2038 #undef __req_field_u8
2039 #undef __req_field_u32
2040         };
2041
2042         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
2043                                  sizeof(req), true);
2044 }
2045
2046 int mt7615_mcu_rdd_send_pattern(struct mt7615_dev *dev)
2047 {
2048         struct {
2049                 u8 pulse_num;
2050                 u8 rsv[3];
2051                 struct {
2052                         __le32 start_time;
2053                         __le16 width;
2054                         __le16 power;
2055                 } pattern[32];
2056         } req = {
2057                 .pulse_num = dev->radar_pattern.n_pulses,
2058         };
2059         u32 start_time = ktime_to_ms(ktime_get_boottime());
2060         int i;
2061
2062         if (dev->radar_pattern.n_pulses > ARRAY_SIZE(req.pattern))
2063                 return -EINVAL;
2064
2065         /* TODO: add some noise here */
2066         for (i = 0; i < dev->radar_pattern.n_pulses; i++) {
2067                 u32 ts = start_time + i * dev->radar_pattern.period;
2068
2069                 req.pattern[i].width = cpu_to_le16(dev->radar_pattern.width);
2070                 req.pattern[i].power = cpu_to_le16(dev->radar_pattern.power);
2071                 req.pattern[i].start_time = cpu_to_le32(ts);
2072         }
2073
2074         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_PATTERN,
2075                                  &req, sizeof(req), false);
2076 }
2077
2078 static void mt7615_mcu_set_txpower_sku(struct mt7615_phy *phy, u8 *sku)
2079 {
2080         struct mt76_phy *mphy = phy->mt76;
2081         struct ieee80211_hw *hw = mphy->hw;
2082         int n_chains = hweight8(mphy->antenna_mask);
2083         int tx_power;
2084         int i;
2085
2086         tx_power = hw->conf.power_level * 2 -
2087                    mt76_tx_power_nss_delta(n_chains);
2088         mphy->txpower_cur = tx_power;
2089
2090         for (i = 0; i < MT_SKU_1SS_DELTA; i++)
2091                 sku[i] = tx_power;
2092
2093         for (i = 0; i < 4; i++) {
2094                 int delta = 0;
2095
2096                 if (i < n_chains - 1)
2097                         delta = mt76_tx_power_nss_delta(n_chains) -
2098                                 mt76_tx_power_nss_delta(i + 1);
2099                 sku[MT_SKU_1SS_DELTA + i] = delta;
2100         }
2101 }
2102
2103 static u8 mt7615_mcu_chan_bw(struct cfg80211_chan_def *chandef)
2104 {
2105         static const u8 width_to_bw[] = {
2106                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
2107                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
2108                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
2109                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
2110                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
2111                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
2112                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
2113                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
2114         };
2115
2116         if (chandef->width >= ARRAY_SIZE(width_to_bw))
2117                 return 0;
2118
2119         return width_to_bw[chandef->width];
2120 }
2121
2122 int mt7615_mcu_set_chan_info(struct mt7615_phy *phy, int cmd)
2123 {
2124         struct mt7615_dev *dev = phy->dev;
2125         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2126         int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2127         struct {
2128                 u8 control_chan;
2129                 u8 center_chan;
2130                 u8 bw;
2131                 u8 tx_streams;
2132                 u8 rx_streams_mask;
2133                 u8 switch_reason;
2134                 u8 band_idx;
2135                 /* for 80+80 only */
2136                 u8 center_chan2;
2137                 __le16 cac_case;
2138                 u8 channel_band;
2139                 u8 rsv0;
2140                 __le32 outband_freq;
2141                 u8 txpower_drop;
2142                 u8 rsv1[3];
2143                 u8 txpower_sku[53];
2144                 u8 rsv2[3];
2145         } req = {
2146                 .control_chan = chandef->chan->hw_value,
2147                 .center_chan = ieee80211_frequency_to_channel(freq1),
2148                 .tx_streams = hweight8(phy->mt76->antenna_mask),
2149                 .rx_streams_mask = phy->mt76->chainmask,
2150                 .center_chan2 = ieee80211_frequency_to_channel(freq2),
2151         };
2152
2153         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2154                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2155         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
2156                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2157                 req.switch_reason = CH_SWITCH_DFS;
2158         else
2159                 req.switch_reason = CH_SWITCH_NORMAL;
2160
2161         req.band_idx = phy != &dev->phy;
2162         req.bw = mt7615_mcu_chan_bw(chandef);
2163
2164         if (mt76_testmode_enabled(phy->mt76))
2165                 memset(req.txpower_sku, 0x3f, 49);
2166         else
2167                 mt7615_mcu_set_txpower_sku(phy, req.txpower_sku);
2168
2169         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2170 }
2171
2172 int mt7615_mcu_get_temperature(struct mt7615_dev *dev, int index)
2173 {
2174         struct {
2175                 u8 action;
2176                 u8 rsv[3];
2177         } req = {
2178                 .action = index,
2179         };
2180
2181         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_GET_TEMP, &req,
2182                                  sizeof(req), true);
2183 }
2184
2185 int mt7615_mcu_set_test_param(struct mt7615_dev *dev, u8 param, bool test_mode,
2186                               u32 val)
2187 {
2188         struct {
2189                 u8 test_mode_en;
2190                 u8 param_idx;
2191                 u8 _rsv[2];
2192
2193                 __le32 value;
2194
2195                 u8 pad[8];
2196         } req = {
2197                 .test_mode_en = test_mode,
2198                 .param_idx = param,
2199                 .value = cpu_to_le32(val),
2200         };
2201
2202         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
2203                                  sizeof(req), false);
2204 }
2205
2206 int mt7615_mcu_set_sku_en(struct mt7615_phy *phy, bool enable)
2207 {
2208         struct mt7615_dev *dev = phy->dev;
2209         struct {
2210                 u8 format_id;
2211                 u8 sku_enable;
2212                 u8 band_idx;
2213                 u8 rsv;
2214         } req = {
2215                 .format_id = 0,
2216                 .band_idx = phy != &dev->phy,
2217                 .sku_enable = enable,
2218         };
2219
2220         return mt76_mcu_send_msg(&dev->mt76,
2221                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
2222                                  sizeof(req), true);
2223 }
2224
2225 static int mt7615_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2226 {
2227         int i;
2228
2229         for (i = 0; i < n_freqs; i++)
2230                 if (cur == freqs[i])
2231                         return i;
2232
2233         return -1;
2234 }
2235
2236 static int mt7615_dcoc_freq_idx(u16 freq, u8 bw)
2237 {
2238         static const u16 freq_list[] = {
2239                 4980, 5805, 5905, 5190,
2240                 5230, 5270, 5310, 5350,
2241                 5390, 5430, 5470, 5510,
2242                 5550, 5590, 5630, 5670,
2243                 5710, 5755, 5795, 5835,
2244                 5875, 5210, 5290, 5370,
2245                 5450, 5530, 5610, 5690,
2246                 5775, 5855
2247         };
2248         static const u16 freq_bw40[] = {
2249                 5190, 5230, 5270, 5310,
2250                 5350, 5390, 5430, 5470,
2251                 5510, 5550, 5590, 5630,
2252                 5670, 5710, 5755, 5795,
2253                 5835, 5875
2254         };
2255         int offset_2g = ARRAY_SIZE(freq_list);
2256         int idx;
2257
2258         if (freq < 4000) {
2259                 if (freq < 2427)
2260                         return offset_2g;
2261                 if (freq < 2442)
2262                         return offset_2g + 1;
2263                 if (freq < 2457)
2264                         return offset_2g + 2;
2265
2266                 return offset_2g + 3;
2267         }
2268
2269         switch (bw) {
2270         case NL80211_CHAN_WIDTH_80:
2271         case NL80211_CHAN_WIDTH_80P80:
2272         case NL80211_CHAN_WIDTH_160:
2273                 break;
2274         default:
2275                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2276                                            freq + 10);
2277                 if (idx >= 0) {
2278                         freq = freq_bw40[idx];
2279                         break;
2280                 }
2281
2282                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2283                                            freq - 10);
2284                 if (idx >= 0) {
2285                         freq = freq_bw40[idx];
2286                         break;
2287                 }
2288                 fallthrough;
2289         case NL80211_CHAN_WIDTH_40:
2290                 idx = mt7615_find_freq_idx(freq_bw40, ARRAY_SIZE(freq_bw40),
2291                                            freq);
2292                 if (idx >= 0)
2293                         break;
2294
2295                 return -1;
2296
2297         }
2298
2299         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2300 }
2301
2302 int mt7615_mcu_apply_rx_dcoc(struct mt7615_phy *phy)
2303 {
2304         struct mt7615_dev *dev = phy->dev;
2305         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2306         int freq2 = chandef->center_freq2;
2307         int ret;
2308         struct {
2309                 u8 direction;
2310                 u8 runtime_calibration;
2311                 u8 _rsv[2];
2312
2313                 __le16 center_freq;
2314                 u8 bw;
2315                 u8 band;
2316                 u8 is_freq2;
2317                 u8 success;
2318                 u8 dbdc_en;
2319
2320                 u8 _rsv2;
2321
2322                 struct {
2323                         __le32 sx0_i_lna[4];
2324                         __le32 sx0_q_lna[4];
2325
2326                         __le32 sx2_i_lna[4];
2327                         __le32 sx2_q_lna[4];
2328                 } dcoc_data[4];
2329         } req = {
2330                 .direction = 1,
2331
2332                 .bw = mt7615_mcu_chan_bw(chandef),
2333                 .band = chandef->center_freq1 > 4000,
2334                 .dbdc_en = !!dev->mt76.phy2,
2335         };
2336         u16 center_freq = chandef->center_freq1;
2337         int freq_idx;
2338         u8 *eep = dev->mt76.eeprom.data;
2339
2340         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_RX_CAL))
2341                 return 0;
2342
2343         if (chandef->width == NL80211_CHAN_WIDTH_160) {
2344                 freq2 = center_freq + 40;
2345                 center_freq -= 40;
2346         }
2347
2348 again:
2349         req.runtime_calibration = 1;
2350         freq_idx = mt7615_dcoc_freq_idx(center_freq, chandef->width);
2351         if (freq_idx < 0)
2352                 goto out;
2353
2354         memcpy(req.dcoc_data, eep + MT7615_EEPROM_DCOC_OFFSET +
2355                               freq_idx * MT7615_EEPROM_DCOC_SIZE,
2356                sizeof(req.dcoc_data));
2357         req.runtime_calibration = 0;
2358
2359 out:
2360         req.center_freq = cpu_to_le16(center_freq);
2361         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RXDCOC_CAL, &req,
2362                                 sizeof(req), true);
2363
2364         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2365              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2366                 req.is_freq2 = true;
2367                 center_freq = freq2;
2368                 goto again;
2369         }
2370
2371         return ret;
2372 }
2373
2374 static int mt7615_dpd_freq_idx(u16 freq, u8 bw)
2375 {
2376         static const u16 freq_list[] = {
2377                 4920, 4940, 4960, 4980,
2378                 5040, 5060, 5080, 5180,
2379                 5200, 5220, 5240, 5260,
2380                 5280, 5300, 5320, 5340,
2381                 5360, 5380, 5400, 5420,
2382                 5440, 5460, 5480, 5500,
2383                 5520, 5540, 5560, 5580,
2384                 5600, 5620, 5640, 5660,
2385                 5680, 5700, 5720, 5745,
2386                 5765, 5785, 5805, 5825,
2387                 5845, 5865, 5885, 5905
2388         };
2389         int offset_2g = ARRAY_SIZE(freq_list);
2390         int idx;
2391
2392         if (freq < 4000) {
2393                 if (freq < 2432)
2394                         return offset_2g;
2395                 if (freq < 2457)
2396                         return offset_2g + 1;
2397
2398                 return offset_2g + 2;
2399         }
2400
2401         if (bw != NL80211_CHAN_WIDTH_20) {
2402                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2403                                            freq + 10);
2404                 if (idx >= 0)
2405                         return idx;
2406
2407                 idx = mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2408                                            freq - 10);
2409                 if (idx >= 0)
2410                         return idx;
2411         }
2412
2413         return mt7615_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2414 }
2415
2416
2417 int mt7615_mcu_apply_tx_dpd(struct mt7615_phy *phy)
2418 {
2419         struct mt7615_dev *dev = phy->dev;
2420         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2421         int freq2 = chandef->center_freq2;
2422         int ret;
2423         struct {
2424                 u8 direction;
2425                 u8 runtime_calibration;
2426                 u8 _rsv[2];
2427
2428                 __le16 center_freq;
2429                 u8 bw;
2430                 u8 band;
2431                 u8 is_freq2;
2432                 u8 success;
2433                 u8 dbdc_en;
2434
2435                 u8 _rsv2;
2436
2437                 struct {
2438                         struct {
2439                                 u32 dpd_g0;
2440                                 u8 data[32];
2441                         } wf0, wf1;
2442
2443                         struct {
2444                                 u32 dpd_g0_prim;
2445                                 u32 dpd_g0_sec;
2446                                 u8 data_prim[32];
2447                                 u8 data_sec[32];
2448                         } wf2, wf3;
2449                 } dpd_data;
2450         } req = {
2451                 .direction = 1,
2452
2453                 .bw = mt7615_mcu_chan_bw(chandef),
2454                 .band = chandef->center_freq1 > 4000,
2455                 .dbdc_en = !!dev->mt76.phy2,
2456         };
2457         u16 center_freq = chandef->center_freq1;
2458         int freq_idx;
2459         u8 *eep = dev->mt76.eeprom.data;
2460
2461         if (!(eep[MT_EE_CALDATA_FLASH] & MT_EE_CALDATA_FLASH_TX_DPD))
2462                 return 0;
2463
2464         if (chandef->width == NL80211_CHAN_WIDTH_160) {
2465                 freq2 = center_freq + 40;
2466                 center_freq -= 40;
2467         }
2468
2469 again:
2470         req.runtime_calibration = 1;
2471         freq_idx = mt7615_dpd_freq_idx(center_freq, chandef->width);
2472         if (freq_idx < 0)
2473                 goto out;
2474
2475         memcpy(&req.dpd_data, eep + MT7615_EEPROM_TXDPD_OFFSET +
2476                               freq_idx * MT7615_EEPROM_TXDPD_SIZE,
2477                sizeof(req.dpd_data));
2478         req.runtime_calibration = 0;
2479
2480 out:
2481         req.center_freq = cpu_to_le16(center_freq);
2482         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXDPD_CAL, &req,
2483                                 sizeof(req), true);
2484
2485         if ((chandef->width == NL80211_CHAN_WIDTH_80P80 ||
2486              chandef->width == NL80211_CHAN_WIDTH_160) && !req.is_freq2) {
2487                 req.is_freq2 = true;
2488                 center_freq = freq2;
2489                 goto again;
2490         }
2491
2492         return ret;
2493 }
2494
2495 int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
2496                           bool enable)
2497 {
2498         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2499         struct {
2500                 u8 bss_idx;
2501                 u8 dtim_period;
2502                 __le16 aid;
2503                 __le16 bcn_interval;
2504                 __le16 atim_window;
2505                 u8 uapsd;
2506                 u8 bmc_delivered_ac;
2507                 u8 bmc_triggered_ac;
2508                 u8 pad;
2509         } req = {
2510                 .bss_idx = mvif->mt76.idx,
2511                 .aid = cpu_to_le16(vif->bss_conf.aid),
2512                 .dtim_period = vif->bss_conf.dtim_period,
2513                 .bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
2514         };
2515         struct {
2516                 u8 bss_idx;
2517                 u8 pad[3];
2518         } req_hdr = {
2519                 .bss_idx = mvif->mt76.idx,
2520         };
2521         int err;
2522
2523         if (vif->type != NL80211_IFTYPE_STATION)
2524                 return 0;
2525
2526         err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
2527                                 sizeof(req_hdr), false);
2528         if (err < 0 || !enable)
2529                 return err;
2530
2531         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
2532                                  sizeof(req), false);
2533 }
2534
2535 int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
2536                        struct ieee80211_channel *chan, int duration)
2537 {
2538         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2539         struct mt7615_dev *dev = phy->dev;
2540         struct mt7615_roc_tlv req = {
2541                 .bss_idx = mvif->mt76.idx,
2542                 .active = !chan,
2543                 .max_interval = cpu_to_le32(duration),
2544                 .primary_chan = chan ? chan->hw_value : 0,
2545                 .band = chan ? chan->band : 0,
2546                 .req_type = 2,
2547         };
2548
2549         phy->roc_grant = false;
2550
2551         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
2552                                  sizeof(req), false);
2553 }
2554
2555 int mt7615_mcu_update_arp_filter(struct ieee80211_hw *hw,
2556                                  struct ieee80211_vif *vif,
2557                                  struct ieee80211_bss_conf *info)
2558 {
2559         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2560         struct mt7615_dev *dev = mt7615_hw_dev(hw);
2561         struct sk_buff *skb;
2562         int i, len = min_t(int, info->arp_addr_cnt,
2563                            IEEE80211_BSS_ARP_ADDR_LIST_LEN);
2564         struct {
2565                 struct {
2566                         u8 bss_idx;
2567                         u8 pad[3];
2568                 } __packed hdr;
2569                 struct mt76_connac_arpns_tlv arp;
2570         } req_hdr = {
2571                 .hdr = {
2572                         .bss_idx = mvif->mt76.idx,
2573                 },
2574                 .arp = {
2575                         .tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
2576                         .len = cpu_to_le16(sizeof(struct mt76_connac_arpns_tlv)),
2577                         .ips_num = len,
2578                         .mode = 2,  /* update */
2579                         .option = 1,
2580                 },
2581         };
2582
2583         if (!mt7615_firmware_offload(dev))
2584                 return 0;
2585
2586         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2587                                  sizeof(req_hdr) + len * sizeof(__be32));
2588         if (!skb)
2589                 return -ENOMEM;
2590
2591         skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2592         for (i = 0; i < len; i++) {
2593                 u8 *addr = (u8 *)skb_put(skb, sizeof(__be32));
2594
2595                 memcpy(addr, &info->arp_addr_list[i], sizeof(__be32));
2596         }
2597
2598         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_UNI_CMD_OFFLOAD,
2599                                      true);
2600 }
2601
2602 int mt7615_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
2603                              struct ieee80211_vif *vif)
2604 {
2605         struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
2606         int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
2607         struct mt7615_dev *dev = mt7615_hw_dev(hw);
2608         struct {
2609                 __le32 ct_win;
2610                 u8 bss_idx;
2611                 u8 rsv[3];
2612         } __packed req = {
2613                 .ct_win = cpu_to_le32(ct_window),
2614                 .bss_idx = mvif->mt76.idx,
2615         };
2616
2617         if (!mt7615_firmware_offload(dev))
2618                 return -ENOTSUPP;
2619
2620         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_P2P_OPPPS, &req,
2621                                  sizeof(req), false);
2622 }
2623
2624 u32 mt7615_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
2625 {
2626         struct {
2627                 __le32 addr;
2628                 __le32 val;
2629         } __packed req = {
2630                 .addr = cpu_to_le32(offset),
2631         };
2632
2633         return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
2634                                  true);
2635 }
2636 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_rr);
2637
2638 void mt7615_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
2639 {
2640         struct {
2641                 __le32 addr;
2642                 __le32 val;
2643         } __packed req = {
2644                 .addr = cpu_to_le32(offset),
2645                 .val = cpu_to_le32(val),
2646         };
2647
2648         mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
2649 }
2650 EXPORT_SYMBOL_GPL(mt7615_mcu_reg_wr);