xref: /linux/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c (revision 06b9cce42634a50f2840777a66553b02320db5ef)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
70 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
71 
72 static u8
73 mt7915_mcu_get_sta_nss(u16 mcs_map)
74 {
75 	u8 nss;
76 
77 	for (nss = 8; nss > 0; nss--) {
78 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
79 
80 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
81 			break;
82 	}
83 
84 	return nss - 1;
85 }
86 
87 static void
88 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
89 			  u16 mcs_map)
90 {
91 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
92 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
93 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
94 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
95 
96 	for (nss = 0; nss < max_nss; nss++) {
97 		int mcs;
98 
99 		switch ((mcs_map >> (2 * nss)) & 0x3) {
100 		case IEEE80211_HE_MCS_SUPPORT_0_11:
101 			mcs = GENMASK(11, 0);
102 			break;
103 		case IEEE80211_HE_MCS_SUPPORT_0_9:
104 			mcs = GENMASK(9, 0);
105 			break;
106 		case IEEE80211_HE_MCS_SUPPORT_0_7:
107 			mcs = GENMASK(7, 0);
108 			break;
109 		default:
110 			mcs = 0;
111 		}
112 
113 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
114 
115 		switch (mcs) {
116 		case 0 ... 7:
117 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
118 			break;
119 		case 8 ... 9:
120 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
121 			break;
122 		case 10 ... 11:
123 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
124 			break;
125 		default:
126 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
127 			break;
128 		}
129 		mcs_map &= ~(0x3 << (nss * 2));
130 		mcs_map |= mcs << (nss * 2);
131 
132 		/* only support 2ss on 160MHz */
133 		if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
134 			break;
135 	}
136 
137 	*he_mcs = cpu_to_le16(mcs_map);
138 }
139 
140 static void
141 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
142 			   const u16 *mask)
143 {
144 	u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
145 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
146 	u16 mcs;
147 
148 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
149 		switch (mcs_map & 0x3) {
150 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
151 			mcs = GENMASK(9, 0);
152 			break;
153 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
154 			mcs = GENMASK(8, 0);
155 			break;
156 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
157 			mcs = GENMASK(7, 0);
158 			break;
159 		default:
160 			mcs = 0;
161 		}
162 
163 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
164 
165 		/* only support 2ss on 160MHz */
166 		if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
167 			break;
168 	}
169 }
170 
171 static void
172 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
173 			  const u8 *mask)
174 {
175 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
176 
177 	for (nss = 0; nss < max_nss; nss++)
178 		ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
179 }
180 
181 static int
182 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
183 			  struct sk_buff *skb, int seq)
184 {
185 	struct mt7915_mcu_rxd *rxd;
186 	int ret = 0;
187 
188 	if (!skb) {
189 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
190 			cmd, seq);
191 		return -ETIMEDOUT;
192 	}
193 
194 	rxd = (struct mt7915_mcu_rxd *)skb->data;
195 	if (seq != rxd->seq)
196 		return -EAGAIN;
197 
198 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
199 		skb_pull(skb, sizeof(*rxd) - 4);
200 		ret = *skb->data;
201 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
202 		skb_pull(skb, sizeof(*rxd) + 4);
203 		ret = le32_to_cpu(*(__le32 *)skb->data);
204 	} else {
205 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
206 	}
207 
208 	return ret;
209 }
210 
211 static int
212 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
213 			int cmd, int *wait_seq)
214 {
215 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
216 	struct mt7915_mcu_txd *mcu_txd;
217 	enum mt76_mcuq_id qid;
218 	__le32 *txd;
219 	u32 val;
220 	u8 seq;
221 
222 	/* TODO: make dynamic based on msg type */
223 	mdev->mcu.timeout = 20 * HZ;
224 
225 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
226 	if (!seq)
227 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
228 
229 	if (cmd == MCU_CMD(FW_SCATTER)) {
230 		qid = MT_MCUQ_FWDL;
231 		goto exit;
232 	}
233 
234 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
235 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
236 		qid = MT_MCUQ_WA;
237 	else
238 		qid = MT_MCUQ_WM;
239 
240 	txd = mcu_txd->txd;
241 
242 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
243 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
244 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
245 	txd[0] = cpu_to_le32(val);
246 
247 	val = MT_TXD1_LONG_FORMAT |
248 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
249 	txd[1] = cpu_to_le32(val);
250 
251 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
252 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
253 					       MT_TX_MCU_PORT_RX_Q0));
254 	mcu_txd->pkt_type = MCU_PKT_ID;
255 	mcu_txd->seq = seq;
256 
257 	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
258 	mcu_txd->set_query = MCU_Q_NA;
259 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
260 	if (mcu_txd->ext_cid) {
261 		mcu_txd->ext_cid_ack = 1;
262 
263 		/* do not use Q_SET for efuse */
264 		if (cmd & __MCU_CMD_FIELD_QUERY)
265 			mcu_txd->set_query = MCU_Q_QUERY;
266 		else
267 			mcu_txd->set_query = MCU_Q_SET;
268 	}
269 
270 	if (cmd & __MCU_CMD_FIELD_WA)
271 		mcu_txd->s2d_index = MCU_S2D_H2C;
272 	else
273 		mcu_txd->s2d_index = MCU_S2D_H2N;
274 
275 exit:
276 	if (wait_seq)
277 		*wait_seq = seq;
278 
279 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
280 }
281 
282 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
283 {
284 	struct {
285 		__le32 args[3];
286 	} req = {
287 		.args = {
288 			cpu_to_le32(a1),
289 			cpu_to_le32(a2),
290 			cpu_to_le32(a3),
291 		},
292 	};
293 
294 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
295 }
296 
297 static void
298 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
299 {
300 	if (vif->csa_active)
301 		ieee80211_csa_finish(vif);
302 }
303 
304 static void
305 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
306 {
307 	struct mt76_phy *mphy = &dev->mt76.phy;
308 	struct mt7915_mcu_csa_notify *c;
309 
310 	c = (struct mt7915_mcu_csa_notify *)skb->data;
311 
312 	if (c->band_idx && dev->mt76.phy2)
313 		mphy = dev->mt76.phy2;
314 
315 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
316 			IEEE80211_IFACE_ITER_RESUME_ALL,
317 			mt7915_mcu_csa_finish, mphy->hw);
318 }
319 
320 static void
321 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
322 {
323 	struct mt76_phy *mphy = &dev->mt76.phy;
324 	struct mt7915_mcu_thermal_notify *t;
325 	struct mt7915_phy *phy;
326 
327 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
328 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
329 		return;
330 
331 	if (t->ctrl.band_idx && dev->mt76.phy2)
332 		mphy = dev->mt76.phy2;
333 
334 	phy = (struct mt7915_phy *)mphy->priv;
335 	phy->throttle_state = t->ctrl.duty.duty_cycle;
336 }
337 
338 static void
339 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
340 {
341 	struct mt76_phy *mphy = &dev->mt76.phy;
342 	struct mt7915_mcu_rdd_report *r;
343 
344 	r = (struct mt7915_mcu_rdd_report *)skb->data;
345 
346 	if (r->band_idx && dev->mt76.phy2)
347 		mphy = dev->mt76.phy2;
348 
349 	if (r->band_idx == MT_RX_SEL2)
350 		cfg80211_background_radar_event(mphy->hw->wiphy,
351 						&dev->rdd2_chandef,
352 						GFP_ATOMIC);
353 	else
354 		ieee80211_radar_detected(mphy->hw);
355 	dev->hw_pattern++;
356 }
357 
358 static void
359 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
360 {
361 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
362 	const char *data = (char *)&rxd[1];
363 	const char *type;
364 	int len = skb->len - sizeof(*rxd);
365 
366 	switch (rxd->s2d_index) {
367 	case 0:
368 		if (mt7915_debugfs_rx_log(dev, data, len))
369 			return;
370 
371 		type = "WM";
372 		break;
373 	case 2:
374 		type = "WA";
375 		break;
376 	default:
377 		type = "unknown";
378 		break;
379 	}
380 
381 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
382 }
383 
384 static void
385 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
386 {
387 	if (!vif->color_change_active)
388 		return;
389 
390 	ieee80211_color_change_finish(vif);
391 }
392 
393 static void
394 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
395 {
396 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
397 
398 	switch (rxd->ext_eid) {
399 	case MCU_EXT_EVENT_THERMAL_PROTECT:
400 		mt7915_mcu_rx_thermal_notify(dev, skb);
401 		break;
402 	case MCU_EXT_EVENT_RDD_REPORT:
403 		mt7915_mcu_rx_radar_detected(dev, skb);
404 		break;
405 	case MCU_EXT_EVENT_CSA_NOTIFY:
406 		mt7915_mcu_rx_csa_notify(dev, skb);
407 		break;
408 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
409 		mt7915_mcu_rx_log_message(dev, skb);
410 		break;
411 	case MCU_EXT_EVENT_BCC_NOTIFY:
412 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
413 				IEEE80211_IFACE_ITER_RESUME_ALL,
414 				mt7915_mcu_cca_finish, dev);
415 		break;
416 	default:
417 		break;
418 	}
419 }
420 
421 static void
422 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
423 {
424 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
425 
426 	switch (rxd->eid) {
427 	case MCU_EVENT_EXT:
428 		mt7915_mcu_rx_ext_event(dev, skb);
429 		break;
430 	default:
431 		break;
432 	}
433 	dev_kfree_skb(skb);
434 }
435 
436 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
437 {
438 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
439 
440 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
441 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
442 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
443 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
444 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
445 	    !rxd->seq)
446 		mt7915_mcu_rx_unsolicited_event(dev, skb);
447 	else
448 		mt76_mcu_rx_event(&dev->mt76, skb);
449 }
450 
451 static struct tlv *
452 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
453 			     __le16 *sub_ntlv, __le16 *len)
454 {
455 	struct tlv *ptlv, tlv = {
456 		.tag = cpu_to_le16(sub_tag),
457 		.len = cpu_to_le16(sub_len),
458 	};
459 
460 	ptlv = skb_put(skb, sub_len);
461 	memcpy(ptlv, &tlv, sizeof(tlv));
462 
463 	le16_add_cpu(sub_ntlv, 1);
464 	le16_add_cpu(len, sub_len);
465 
466 	return ptlv;
467 }
468 
469 /** bss info **/
470 struct mt7915_he_obss_narrow_bw_ru_data {
471 	bool tolerated;
472 };
473 
474 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
475 						   struct cfg80211_bss *bss,
476 						   void *_data)
477 {
478 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
479 	const struct element *elem;
480 
481 	rcu_read_lock();
482 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
483 
484 	if (!elem || elem->datalen <= 10 ||
485 	    !(elem->data[10] &
486 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
487 		data->tolerated = false;
488 
489 	rcu_read_unlock();
490 }
491 
492 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
493 					      struct ieee80211_vif *vif)
494 {
495 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
496 		.tolerated = true,
497 	};
498 
499 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
500 		return false;
501 
502 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
503 			  mt7915_check_he_obss_narrow_bw_ru_iter,
504 			  &iter_data);
505 
506 	/*
507 	 * If there is at least one AP on radar channel that cannot
508 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
509 	 */
510 	return !iter_data.tolerated;
511 }
512 
513 static void
514 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
515 			struct mt7915_phy *phy)
516 {
517 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
518 	struct bss_info_rf_ch *ch;
519 	struct tlv *tlv;
520 	int freq1 = chandef->center_freq1;
521 
522 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
523 
524 	ch = (struct bss_info_rf_ch *)tlv;
525 	ch->pri_ch = chandef->chan->hw_value;
526 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
527 	ch->bw = mt76_connac_chan_bw(chandef);
528 
529 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
530 		int freq2 = chandef->center_freq2;
531 
532 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
533 	}
534 
535 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
536 		struct mt7915_dev *dev = phy->dev;
537 		struct mt76_phy *mphy = &dev->mt76.phy;
538 		bool ext_phy = phy != &dev->phy;
539 
540 		if (ext_phy && dev->mt76.phy2)
541 			mphy = dev->mt76.phy2;
542 
543 		ch->he_ru26_block =
544 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
545 		ch->he_all_disable = false;
546 	} else {
547 		ch->he_all_disable = true;
548 	}
549 }
550 
551 static void
552 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
553 		      struct mt7915_phy *phy)
554 {
555 	int max_nss = hweight8(phy->mt76->chainmask);
556 	struct bss_info_ra *ra;
557 	struct tlv *tlv;
558 
559 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
560 
561 	ra = (struct bss_info_ra *)tlv;
562 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
563 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
564 	ra->short_preamble = true;
565 	ra->tx_streams = max_nss;
566 	ra->rx_streams = max_nss;
567 	ra->algo = 4;
568 	ra->train_up_rule = 2;
569 	ra->train_up_high_thres = 110;
570 	ra->train_up_rule_rssi = -70;
571 	ra->low_traffic_thres = 2;
572 	ra->phy_cap = cpu_to_le32(0xfdf);
573 	ra->interval = cpu_to_le32(500);
574 	ra->fast_interval = cpu_to_le32(100);
575 }
576 
577 static void
578 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
579 		      struct mt7915_phy *phy)
580 {
581 #define DEFAULT_HE_PE_DURATION		4
582 #define DEFAULT_HE_DURATION_RTS_THRES	1023
583 	const struct ieee80211_sta_he_cap *cap;
584 	struct bss_info_he *he;
585 	struct tlv *tlv;
586 
587 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
588 
589 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
590 
591 	he = (struct bss_info_he *)tlv;
592 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
593 	if (!he->he_pe_duration)
594 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
595 
596 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
597 	if (!he->he_rts_thres)
598 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
599 
600 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
601 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
602 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
603 }
604 
605 static void
606 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
607 {
608 #define TXD_CMP_MAP1		GENMASK(15, 0)
609 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
610 	struct bss_info_hw_amsdu *amsdu;
611 	struct tlv *tlv;
612 
613 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
614 
615 	amsdu = (struct bss_info_hw_amsdu *)tlv;
616 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
617 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
618 	amsdu->trig_thres = cpu_to_le16(2);
619 	amsdu->enable = true;
620 }
621 
622 static void
623 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
624 {
625 	struct bss_info_bmc_rate *bmc;
626 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
627 	enum nl80211_band band = chandef->chan->band;
628 	struct tlv *tlv;
629 
630 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
631 
632 	bmc = (struct bss_info_bmc_rate *)tlv;
633 	if (band == NL80211_BAND_2GHZ) {
634 		bmc->short_preamble = true;
635 	} else {
636 		bmc->bc_trans = cpu_to_le16(0x2000);
637 		bmc->mc_trans = cpu_to_le16(0x2080);
638 	}
639 }
640 
641 static int
642 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
643 		       bool bssid, bool enable)
644 {
645 	struct mt7915_dev *dev = phy->dev;
646 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
647 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
648 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
649 	const u8 *addr = vif->addr;
650 	struct {
651 		u8 mode;
652 		u8 force_clear;
653 		u8 clear_bitmap[8];
654 		u8 entry_count;
655 		u8 write;
656 		u8 band;
657 
658 		u8 index;
659 		u8 bssid;
660 		u8 addr[ETH_ALEN];
661 	} __packed req = {
662 		.mode = !!mask || enable,
663 		.entry_count = 1,
664 		.write = 1,
665 		.band = phy != &dev->phy,
666 		.index = idx * 2 + bssid,
667 	};
668 
669 	if (bssid)
670 		addr = vif->bss_conf.bssid;
671 
672 	if (enable)
673 		ether_addr_copy(req.addr, addr);
674 
675 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
676 				 sizeof(req), true);
677 }
678 
679 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
680 			    struct ieee80211_vif *vif, int enable)
681 {
682 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
683 	struct mt7915_dev *dev = phy->dev;
684 	struct sk_buff *skb;
685 
686 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
687 		mt7915_mcu_muar_config(phy, vif, false, enable);
688 		mt7915_mcu_muar_config(phy, vif, true, enable);
689 	}
690 
691 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
692 					      MT7915_BSS_UPDATE_MAX_SIZE);
693 	if (IS_ERR(skb))
694 		return PTR_ERR(skb);
695 
696 	/* bss_omac must be first */
697 	if (enable)
698 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
699 
700 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
701 				      mvif->sta.wcid.idx, enable);
702 
703 	if (vif->type == NL80211_IFTYPE_MONITOR)
704 		goto out;
705 
706 	if (enable) {
707 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
708 		mt7915_mcu_bss_bmc_tlv(skb, phy);
709 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
710 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
711 
712 		if (vif->bss_conf.he_support)
713 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
714 
715 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
716 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
717 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
718 	}
719 out:
720 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
721 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
722 }
723 
724 /** starec & wtbl **/
725 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
726 			 struct ieee80211_ampdu_params *params,
727 			 bool enable)
728 {
729 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
730 	struct mt7915_vif *mvif = msta->vif;
731 
732 	if (enable && !params->amsdu)
733 		msta->wcid.amsdu = false;
734 
735 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
736 				      MCU_EXT_CMD(STA_REC_UPDATE),
737 				      enable, true);
738 }
739 
740 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
741 			 struct ieee80211_ampdu_params *params,
742 			 bool enable)
743 {
744 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
745 	struct mt7915_vif *mvif = msta->vif;
746 
747 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
748 				      MCU_EXT_CMD(STA_REC_UPDATE),
749 				      enable, false);
750 }
751 
752 static void
753 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
754 		      struct ieee80211_vif *vif)
755 {
756 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
757 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
758 	struct ieee80211_he_mcs_nss_supp mcs_map;
759 	struct sta_rec_he *he;
760 	struct tlv *tlv;
761 	u32 cap = 0;
762 
763 	if (!sta->he_cap.has_he)
764 		return;
765 
766 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
767 
768 	he = (struct sta_rec_he *)tlv;
769 
770 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
771 		cap |= STA_REC_HE_CAP_HTC;
772 
773 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
774 		cap |= STA_REC_HE_CAP_BSR;
775 
776 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
777 		cap |= STA_REC_HE_CAP_OM;
778 
779 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
780 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
781 
782 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
783 		cap |= STA_REC_HE_CAP_BQR;
784 
785 	if (elem->phy_cap_info[0] &
786 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
787 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
788 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
789 
790 	if (mvif->cap.ldpc && (elem->phy_cap_info[1] &
791 			       IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
792 		cap |= STA_REC_HE_CAP_LDPC;
793 
794 	if (elem->phy_cap_info[1] &
795 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
796 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
797 
798 	if (elem->phy_cap_info[2] &
799 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
800 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
801 
802 	if (elem->phy_cap_info[2] &
803 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
804 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
805 
806 	if (elem->phy_cap_info[2] &
807 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
808 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
809 
810 	if (elem->phy_cap_info[6] &
811 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
812 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
813 
814 	if (elem->phy_cap_info[6] &
815 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
816 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
817 
818 	if (elem->phy_cap_info[7] &
819 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
820 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
821 
822 	if (elem->phy_cap_info[7] &
823 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
824 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
825 
826 	if (elem->phy_cap_info[7] &
827 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
828 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
829 
830 	if (elem->phy_cap_info[8] &
831 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
832 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
833 
834 	if (elem->phy_cap_info[8] &
835 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
836 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
837 
838 	if (elem->phy_cap_info[9] &
839 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
840 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
841 
842 	if (elem->phy_cap_info[9] &
843 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
844 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
845 
846 	he->he_cap = cpu_to_le32(cap);
847 
848 	mcs_map = sta->he_cap.he_mcs_nss_supp;
849 	switch (sta->bandwidth) {
850 	case IEEE80211_STA_RX_BW_160:
851 		if (elem->phy_cap_info[0] &
852 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
853 			mt7915_mcu_set_sta_he_mcs(sta,
854 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
855 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
856 
857 		mt7915_mcu_set_sta_he_mcs(sta,
858 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
859 					  le16_to_cpu(mcs_map.rx_mcs_160));
860 		fallthrough;
861 	default:
862 		mt7915_mcu_set_sta_he_mcs(sta,
863 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
864 					  le16_to_cpu(mcs_map.rx_mcs_80));
865 		break;
866 	}
867 
868 	he->t_frame_dur =
869 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
870 	he->max_ampdu_exp =
871 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
872 
873 	he->bw_set =
874 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
875 	he->device_class =
876 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
877 	he->punc_pream_rx =
878 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
879 
880 	he->dcm_tx_mode =
881 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
882 	he->dcm_tx_max_nss =
883 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
884 	he->dcm_rx_mode =
885 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
886 	he->dcm_rx_max_nss =
887 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
888 	he->dcm_rx_max_nss =
889 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
890 
891 	he->pkt_ext = 2;
892 }
893 
894 static void
895 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
896 			struct ieee80211_vif *vif)
897 {
898 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
899 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
900 	struct sta_rec_muru *muru;
901 	struct tlv *tlv;
902 
903 	if (vif->type != NL80211_IFTYPE_STATION &&
904 	    vif->type != NL80211_IFTYPE_AP)
905 		return;
906 
907 	if (!sta->vht_cap.vht_supported)
908 		return;
909 
910 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
911 
912 	muru = (struct sta_rec_muru *)tlv;
913 
914 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
915 			       mvif->cap.vht_mu_ebfer ||
916 			       mvif->cap.vht_mu_ebfee;
917 
918 	muru->mimo_dl.vht_mu_bfee =
919 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
920 
921 	if (!sta->he_cap.has_he)
922 		return;
923 
924 	muru->mimo_dl.partial_bw_dl_mimo =
925 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
926 
927 	muru->cfg.mimo_ul_en = true;
928 	muru->mimo_ul.full_ul_mimo =
929 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
930 	muru->mimo_ul.partial_ul_mimo =
931 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
932 
933 	muru->cfg.ofdma_dl_en = true;
934 	muru->ofdma_dl.punc_pream_rx =
935 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
936 	muru->ofdma_dl.he_20m_in_40m_2g =
937 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
938 	muru->ofdma_dl.he_20m_in_160m =
939 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
940 	muru->ofdma_dl.he_80m_in_160m =
941 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
942 
943 	muru->ofdma_ul.t_frame_dur =
944 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
945 	muru->ofdma_ul.mu_cascading =
946 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
947 	muru->ofdma_ul.uo_ra =
948 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
949 }
950 
951 static void
952 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
953 {
954 	struct sta_rec_ht *ht;
955 	struct tlv *tlv;
956 
957 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
958 
959 	ht = (struct sta_rec_ht *)tlv;
960 	ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
961 }
962 
963 static void
964 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
965 {
966 	struct sta_rec_vht *vht;
967 	struct tlv *tlv;
968 
969 	if (!sta->vht_cap.vht_supported)
970 		return;
971 
972 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
973 
974 	vht = (struct sta_rec_vht *)tlv;
975 	vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
976 	vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
977 	vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
978 }
979 
980 static void
981 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
982 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
983 {
984 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
985 	struct sta_rec_amsdu *amsdu;
986 	struct tlv *tlv;
987 
988 	if (vif->type != NL80211_IFTYPE_STATION &&
989 	    vif->type != NL80211_IFTYPE_AP)
990 		return;
991 
992 	if (!sta->max_amsdu_len)
993 	    return;
994 
995 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
996 	amsdu = (struct sta_rec_amsdu *)tlv;
997 	amsdu->max_amsdu_num = 8;
998 	amsdu->amsdu_en = true;
999 	msta->wcid.amsdu = true;
1000 
1001 	switch (sta->max_amsdu_len) {
1002 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1003 		if (!is_mt7915(&dev->mt76)) {
1004 			amsdu->max_mpdu_size =
1005 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1006 			return;
1007 		}
1008 		fallthrough;
1009 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1010 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1011 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1012 		return;
1013 	default:
1014 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1015 		return;
1016 	}
1017 }
1018 
1019 static int
1020 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1021 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1022 {
1023 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1024 	struct mt7915_sta *msta;
1025 	struct wtbl_req_hdr *wtbl_hdr;
1026 	struct mt76_wcid *wcid;
1027 	struct tlv *tlv;
1028 
1029 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1030 	wcid = sta ? &msta->wcid : NULL;
1031 
1032 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1033 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1034 						  WTBL_RESET_AND_SET, tlv,
1035 						  &skb);
1036 	if (IS_ERR(wtbl_hdr))
1037 		return PTR_ERR(wtbl_hdr);
1038 
1039 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1040 					 wtbl_hdr);
1041 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1042 	if (sta)
1043 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1044 					    wtbl_hdr, mvif->cap.ldpc);
1045 
1046 	return 0;
1047 }
1048 
1049 static inline bool
1050 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1051 			struct ieee80211_sta *sta, bool bfee)
1052 {
1053 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1054 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1055 
1056 	if (vif->type != NL80211_IFTYPE_STATION &&
1057 	    vif->type != NL80211_IFTYPE_AP)
1058 		return false;
1059 
1060 	if (!bfee && tx_ant < 2)
1061 		return false;
1062 
1063 	if (sta->he_cap.has_he) {
1064 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1065 
1066 		if (bfee)
1067 			return mvif->cap.he_su_ebfee &&
1068 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1069 		else
1070 			return mvif->cap.he_su_ebfer &&
1071 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1072 	}
1073 
1074 	if (sta->vht_cap.vht_supported) {
1075 		u32 cap = sta->vht_cap.cap;
1076 
1077 		if (bfee)
1078 			return mvif->cap.vht_su_ebfee &&
1079 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1080 		else
1081 			return mvif->cap.vht_su_ebfer &&
1082 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1083 	}
1084 
1085 	return false;
1086 }
1087 
1088 static void
1089 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1090 {
1091 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1092 	bf->ndp_rate = 0;				/* mcs0 */
1093 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1094 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1095 }
1096 
1097 static void
1098 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1099 		       struct sta_rec_bf *bf)
1100 {
1101 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1102 	u8 n = 0;
1103 
1104 	bf->tx_mode = MT_PHY_TYPE_HT;
1105 
1106 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1107 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1108 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1109 			      mcs->tx_params);
1110 	else if (mcs->rx_mask[3])
1111 		n = 3;
1112 	else if (mcs->rx_mask[2])
1113 		n = 2;
1114 	else if (mcs->rx_mask[1])
1115 		n = 1;
1116 
1117 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1118 	bf->ncol = min_t(u8, bf->nrow, n);
1119 	bf->ibf_ncol = n;
1120 }
1121 
1122 static void
1123 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1124 			struct sta_rec_bf *bf, bool explicit)
1125 {
1126 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1127 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1128 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1129 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1130 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1131 
1132 	bf->tx_mode = MT_PHY_TYPE_VHT;
1133 
1134 	if (explicit) {
1135 		u8 sts, snd_dim;
1136 
1137 		mt7915_mcu_sta_sounding_rate(bf);
1138 
1139 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1140 				pc->cap);
1141 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1142 				    vc->cap);
1143 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1144 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1145 		bf->ibf_ncol = bf->ncol;
1146 
1147 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1148 			bf->nrow = 1;
1149 	} else {
1150 		bf->nrow = tx_ant;
1151 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1152 		bf->ibf_ncol = nss_mcs;
1153 
1154 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1155 			bf->ibf_nrow = 1;
1156 	}
1157 }
1158 
1159 static void
1160 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1161 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1162 {
1163 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1164 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1165 	const struct ieee80211_sta_he_cap *vc =
1166 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1167 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1168 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1169 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1170 	u8 snd_dim, sts;
1171 
1172 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1173 
1174 	mt7915_mcu_sta_sounding_rate(bf);
1175 
1176 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1177 				pe->phy_cap_info[6]);
1178 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1179 				pe->phy_cap_info[6]);
1180 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1181 			 ve->phy_cap_info[5]);
1182 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1183 		     pe->phy_cap_info[4]);
1184 	bf->nrow = min_t(u8, snd_dim, sts);
1185 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1186 	bf->ibf_ncol = bf->ncol;
1187 
1188 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1189 		return;
1190 
1191 	/* go over for 160MHz and 80p80 */
1192 	if (pe->phy_cap_info[0] &
1193 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1194 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1195 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1196 
1197 		bf->ncol_bw160 = nss_mcs;
1198 	}
1199 
1200 	if (pe->phy_cap_info[0] &
1201 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1202 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1203 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1204 
1205 		if (bf->ncol_bw160)
1206 			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1207 		else
1208 			bf->ncol_bw160 = nss_mcs;
1209 	}
1210 
1211 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1212 			 ve->phy_cap_info[5]);
1213 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1214 		     pe->phy_cap_info[4]);
1215 
1216 	bf->nrow_bw160 = min_t(int, snd_dim, sts);
1217 }
1218 
1219 static void
1220 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1221 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1222 {
1223 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1224 	struct mt7915_phy *phy =
1225 		mvif->mt76.band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1226 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1227 	struct sta_rec_bf *bf;
1228 	struct tlv *tlv;
1229 	const u8 matrix[4][4] = {
1230 		{0, 0, 0, 0},
1231 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1232 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1233 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1234 	};
1235 	bool ebf;
1236 
1237 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1238 	if (!ebf && !dev->ibf)
1239 		return;
1240 
1241 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1242 	bf = (struct sta_rec_bf *)tlv;
1243 
1244 	/* he: eBF only, in accordance with spec
1245 	 * vht: support eBF and iBF
1246 	 * ht: iBF only, since mac80211 lacks of eBF support
1247 	 */
1248 	if (sta->he_cap.has_he && ebf)
1249 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1250 	else if (sta->vht_cap.vht_supported)
1251 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1252 	else if (sta->ht_cap.ht_supported)
1253 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1254 	else
1255 		return;
1256 
1257 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1258 	bf->bw = sta->bandwidth;
1259 	bf->ibf_dbw = sta->bandwidth;
1260 	bf->ibf_nrow = tx_ant;
1261 
1262 	if (!ebf && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1263 		bf->ibf_timeout = 0x48;
1264 	else
1265 		bf->ibf_timeout = 0x18;
1266 
1267 	if (ebf && bf->nrow != tx_ant)
1268 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1269 	else
1270 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1271 
1272 	switch (sta->bandwidth) {
1273 	case IEEE80211_STA_RX_BW_160:
1274 	case IEEE80211_STA_RX_BW_80:
1275 		bf->mem_total = bf->mem_20m * 2;
1276 		break;
1277 	case IEEE80211_STA_RX_BW_40:
1278 		bf->mem_total = bf->mem_20m;
1279 		break;
1280 	case IEEE80211_STA_RX_BW_20:
1281 	default:
1282 		break;
1283 	}
1284 }
1285 
1286 static void
1287 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1288 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1289 {
1290 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1291 	struct mt7915_phy *phy =
1292 		mvif->mt76.band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1293 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1294 	struct sta_rec_bfee *bfee;
1295 	struct tlv *tlv;
1296 	u8 nrow = 0;
1297 
1298 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1299 		return;
1300 
1301 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1302 	bfee = (struct sta_rec_bfee *)tlv;
1303 
1304 	if (sta->he_cap.has_he) {
1305 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1306 
1307 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1308 			      pe->phy_cap_info[5]);
1309 	} else if (sta->vht_cap.vht_supported) {
1310 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1311 
1312 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1313 				 pc->cap);
1314 	}
1315 
1316 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1317 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1318 }
1319 
1320 static enum mcu_mmps_mode
1321 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1322 {
1323 	switch (smps) {
1324 	case IEEE80211_SMPS_OFF:
1325 		return MCU_MMPS_DISABLE;
1326 	case IEEE80211_SMPS_STATIC:
1327 		return MCU_MMPS_STATIC;
1328 	case IEEE80211_SMPS_DYNAMIC:
1329 		return MCU_MMPS_DYNAMIC;
1330 	default:
1331 		return MCU_MMPS_DISABLE;
1332 	}
1333 }
1334 
1335 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1336 				   struct ieee80211_vif *vif,
1337 				   struct ieee80211_sta *sta,
1338 				   void *data, u32 field)
1339 {
1340 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1341 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1342 	struct sta_phy *phy = data;
1343 	struct sta_rec_ra_fixed *ra;
1344 	struct sk_buff *skb;
1345 	struct tlv *tlv;
1346 
1347 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1348 					    &msta->wcid);
1349 	if (IS_ERR(skb))
1350 		return PTR_ERR(skb);
1351 
1352 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1353 	ra = (struct sta_rec_ra_fixed *)tlv;
1354 
1355 	switch (field) {
1356 	case RATE_PARAM_AUTO:
1357 		break;
1358 	case RATE_PARAM_FIXED:
1359 	case RATE_PARAM_FIXED_MCS:
1360 	case RATE_PARAM_FIXED_GI:
1361 	case RATE_PARAM_FIXED_HE_LTF:
1362 		if (phy)
1363 			ra->phy = *phy;
1364 		break;
1365 	case RATE_PARAM_MMPS_UPDATE:
1366 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1367 		break;
1368 	default:
1369 		break;
1370 	}
1371 	ra->field = cpu_to_le32(field);
1372 
1373 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1374 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1375 }
1376 
1377 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1378 			struct ieee80211_sta *sta)
1379 {
1380 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1381 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1382 	struct wtbl_req_hdr *wtbl_hdr;
1383 	struct tlv *sta_wtbl;
1384 	struct sk_buff *skb;
1385 	int ret;
1386 
1387 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1388 					    &msta->wcid);
1389 	if (IS_ERR(skb))
1390 		return PTR_ERR(skb);
1391 
1392 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1393 					   sizeof(struct tlv));
1394 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1395 						  WTBL_SET, sta_wtbl, &skb);
1396 	if (IS_ERR(wtbl_hdr))
1397 		return PTR_ERR(wtbl_hdr);
1398 
1399 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1400 
1401 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1402 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1403 	if (ret)
1404 		return ret;
1405 
1406 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1407 					      RATE_PARAM_MMPS_UPDATE);
1408 }
1409 
1410 static int
1411 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1412 			       struct ieee80211_vif *vif,
1413 			       struct ieee80211_sta *sta)
1414 {
1415 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1416 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1417 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1418 	enum nl80211_band band = chandef->chan->band;
1419 	struct sta_phy phy = {};
1420 	int ret, nrates = 0;
1421 
1422 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _he)				\
1423 	do {									\
1424 		u8 i, gi = mask->control[band]._gi;				\
1425 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1426 		for (i = 0; i <= sta->bandwidth; i++) {				\
1427 			phy.sgi |= gi << (i << (_he));				\
1428 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1429 		}								\
1430 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1431 			if (!mask->control[band]._mcs[i])			\
1432 				continue;					\
1433 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1434 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1435 		}								\
1436 	} while (0)
1437 
1438 	if (sta->he_cap.has_he) {
1439 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 1);
1440 	} else if (sta->vht_cap.vht_supported) {
1441 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0);
1442 	} else if (sta->ht_cap.ht_supported) {
1443 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 0);
1444 	} else {
1445 		nrates = hweight32(mask->control[band].legacy);
1446 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1447 	}
1448 #undef __sta_phy_bitrate_mask_check
1449 
1450 	/* fall back to auto rate control */
1451 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1452 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1453 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1454 	    nrates != 1)
1455 		return 0;
1456 
1457 	/* fixed single rate */
1458 	if (nrates == 1) {
1459 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1460 						     RATE_PARAM_FIXED_MCS);
1461 		if (ret)
1462 			return ret;
1463 	}
1464 
1465 	/* fixed GI */
1466 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1467 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1468 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1469 		u32 addr;
1470 
1471 		/* firmware updates only TXCMD but doesn't take WTBL into
1472 		 * account, so driver should update here to reflect the
1473 		 * actual txrate hardware sends out.
1474 		 */
1475 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1476 		if (sta->he_cap.has_he)
1477 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1478 		else
1479 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1480 
1481 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1482 						     RATE_PARAM_FIXED_GI);
1483 		if (ret)
1484 			return ret;
1485 	}
1486 
1487 	/* fixed HE_LTF */
1488 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1489 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1490 						     RATE_PARAM_FIXED_HE_LTF);
1491 		if (ret)
1492 			return ret;
1493 	}
1494 
1495 	return 0;
1496 }
1497 
1498 static void
1499 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1500 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1501 {
1502 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1503 	struct mt76_phy *mphy = mvif->phy->mt76;
1504 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1505 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1506 	enum nl80211_band band = chandef->chan->band;
1507 	struct sta_rec_ra *ra;
1508 	struct tlv *tlv;
1509 	u32 supp_rate = sta->supp_rates[band];
1510 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1511 
1512 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1513 	ra = (struct sta_rec_ra *)tlv;
1514 
1515 	ra->valid = true;
1516 	ra->auto_rate = true;
1517 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1518 	ra->channel = chandef->chan->hw_value;
1519 	ra->bw = sta->bandwidth;
1520 	ra->phy.bw = sta->bandwidth;
1521 
1522 	if (supp_rate) {
1523 		supp_rate &= mask->control[band].legacy;
1524 		ra->rate_len = hweight32(supp_rate);
1525 
1526 		if (band == NL80211_BAND_2GHZ) {
1527 			ra->supp_mode = MODE_CCK;
1528 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1529 
1530 			if (ra->rate_len > 4) {
1531 				ra->supp_mode |= MODE_OFDM;
1532 				ra->supp_ofdm_rate = supp_rate >> 4;
1533 			}
1534 		} else {
1535 			ra->supp_mode = MODE_OFDM;
1536 			ra->supp_ofdm_rate = supp_rate;
1537 		}
1538 	}
1539 
1540 	if (sta->ht_cap.ht_supported) {
1541 		ra->supp_mode |= MODE_HT;
1542 		ra->af = sta->ht_cap.ampdu_factor;
1543 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1544 
1545 		cap |= STA_CAP_HT;
1546 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1547 			cap |= STA_CAP_SGI_20;
1548 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1549 			cap |= STA_CAP_SGI_40;
1550 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1551 			cap |= STA_CAP_TX_STBC;
1552 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1553 			cap |= STA_CAP_RX_STBC;
1554 		if (mvif->cap.ldpc &&
1555 		    (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1556 			cap |= STA_CAP_LDPC;
1557 
1558 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1559 					  mask->control[band].ht_mcs);
1560 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1561 	}
1562 
1563 	if (sta->vht_cap.vht_supported) {
1564 		u8 af;
1565 
1566 		ra->supp_mode |= MODE_VHT;
1567 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1568 			       sta->vht_cap.cap);
1569 		ra->af = max_t(u8, ra->af, af);
1570 
1571 		cap |= STA_CAP_VHT;
1572 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1573 			cap |= STA_CAP_VHT_SGI_80;
1574 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1575 			cap |= STA_CAP_VHT_SGI_160;
1576 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1577 			cap |= STA_CAP_VHT_TX_STBC;
1578 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1579 			cap |= STA_CAP_VHT_RX_STBC;
1580 		if (mvif->cap.ldpc &&
1581 		    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1582 			cap |= STA_CAP_VHT_LDPC;
1583 
1584 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1585 					   mask->control[band].vht_mcs);
1586 	}
1587 
1588 	if (sta->he_cap.has_he) {
1589 		ra->supp_mode |= MODE_HE;
1590 		cap |= STA_CAP_HE;
1591 	}
1592 
1593 	ra->sta_cap = cpu_to_le32(cap);
1594 }
1595 
1596 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1597 			     struct ieee80211_sta *sta, bool changed)
1598 {
1599 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1600 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1601 	struct sk_buff *skb;
1602 	int ret;
1603 
1604 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1605 					    &msta->wcid);
1606 	if (IS_ERR(skb))
1607 		return PTR_ERR(skb);
1608 
1609 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1610 	 * once dev->rc_work changes the settings driver should also
1611 	 * update sta_rec_he here.
1612 	 */
1613 	if (sta->he_cap.has_he && changed)
1614 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1615 
1616 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1617 	 * i.e 0-{7,8,9} for VHT.
1618 	 */
1619 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1620 
1621 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1622 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1623 	if (ret)
1624 		return ret;
1625 
1626 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1627 	 * and updates as peer fixed rate parameters, which overrides
1628 	 * sta_rec_ra and firmware rate control algorithm.
1629 	 */
1630 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1631 }
1632 
1633 static int
1634 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1635 		     struct ieee80211_sta *sta)
1636 {
1637 #define MT_STA_BSS_GROUP		1
1638 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1639 	struct mt7915_sta *msta;
1640 	struct {
1641 		__le32 action;
1642 		u8 wlan_idx_lo;
1643 		u8 status;
1644 		u8 wlan_idx_hi;
1645 		u8 rsv0[5];
1646 		__le32 val;
1647 		u8 rsv1[8];
1648 	} __packed req = {
1649 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1650 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1651 	};
1652 
1653 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1654 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1655 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1656 
1657 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1658 				 sizeof(req), true);
1659 }
1660 
1661 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1662 		       struct ieee80211_sta *sta, bool enable)
1663 {
1664 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1665 	struct mt7915_sta *msta;
1666 	struct sk_buff *skb;
1667 	int ret;
1668 
1669 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1670 
1671 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1672 					    &msta->wcid);
1673 	if (IS_ERR(skb))
1674 		return PTR_ERR(skb);
1675 
1676 	/* starec basic */
1677 	mt76_connac_mcu_sta_basic_tlv(skb, vif, sta, enable, true);
1678 	if (!enable)
1679 		goto out;
1680 
1681 	/* tag order is in accordance with firmware dependency. */
1682 	if (sta && sta->ht_cap.ht_supported) {
1683 		/* starec bfer */
1684 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1685 		/* starec ht */
1686 		mt7915_mcu_sta_ht_tlv(skb, sta);
1687 		/* starec vht */
1688 		mt7915_mcu_sta_vht_tlv(skb, sta);
1689 		/* starec uapsd */
1690 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1691 	}
1692 
1693 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1694 	if (ret) {
1695 		dev_kfree_skb(skb);
1696 		return ret;
1697 	}
1698 
1699 	if (sta && sta->ht_cap.ht_supported) {
1700 		/* starec amsdu */
1701 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1702 		/* starec he */
1703 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1704 		/* starec muru */
1705 		mt7915_mcu_sta_muru_tlv(skb, sta, vif);
1706 		/* starec bfee */
1707 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1708 	}
1709 
1710 	ret = mt7915_mcu_add_group(dev, vif, sta);
1711 	if (ret) {
1712 		dev_kfree_skb(skb);
1713 		return ret;
1714 	}
1715 out:
1716 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1717 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1718 }
1719 
1720 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1721 			    struct ieee80211_vif *vif, bool enable)
1722 {
1723 	struct mt7915_dev *dev = phy->dev;
1724 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1725 	struct {
1726 		struct req_hdr {
1727 			u8 omac_idx;
1728 			u8 dbdc_idx;
1729 			__le16 tlv_num;
1730 			u8 is_tlv_append;
1731 			u8 rsv[3];
1732 		} __packed hdr;
1733 		struct req_tlv {
1734 			__le16 tag;
1735 			__le16 len;
1736 			u8 active;
1737 			u8 dbdc_idx;
1738 			u8 omac_addr[ETH_ALEN];
1739 		} __packed tlv;
1740 	} data = {
1741 		.hdr = {
1742 			.omac_idx = mvif->mt76.omac_idx,
1743 			.dbdc_idx = mvif->mt76.band_idx,
1744 			.tlv_num = cpu_to_le16(1),
1745 			.is_tlv_append = 1,
1746 		},
1747 		.tlv = {
1748 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1749 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1750 			.active = enable,
1751 			.dbdc_idx = mvif->mt76.band_idx,
1752 		},
1753 	};
1754 
1755 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1756 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1757 
1758 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1759 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1760 				 &data, sizeof(data), true);
1761 }
1762 
1763 static void
1764 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1765 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1766 			 struct ieee80211_mutable_offsets *offs)
1767 {
1768 	struct bss_info_bcn_cntdwn *info;
1769 	struct tlv *tlv;
1770 	int sub_tag;
1771 
1772 	if (!offs->cntdwn_counter_offs[0])
1773 		return;
1774 
1775 	sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1776 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1777 					   &bcn->sub_ntlv, &bcn->len);
1778 	info = (struct bss_info_bcn_cntdwn *)tlv;
1779 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1780 }
1781 
1782 static void
1783 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1784 		       struct sk_buff *rskb, struct sk_buff *skb,
1785 		       struct bss_info_bcn *bcn,
1786 		       struct ieee80211_mutable_offsets *offs)
1787 {
1788 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1789 	struct bss_info_bcn_cont *cont;
1790 	struct tlv *tlv;
1791 	u8 *buf;
1792 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1793 
1794 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1795 					   len, &bcn->sub_ntlv, &bcn->len);
1796 
1797 	cont = (struct bss_info_bcn_cont *)tlv;
1798 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1799 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1800 
1801 	if (offs->cntdwn_counter_offs[0]) {
1802 		u16 offset = offs->cntdwn_counter_offs[0];
1803 
1804 		if (vif->csa_active)
1805 			cont->csa_ofs = cpu_to_le16(offset - 4);
1806 		if (vif->color_change_active)
1807 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1808 	}
1809 
1810 	buf = (u8 *)tlv + sizeof(*cont);
1811 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
1812 			      true);
1813 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1814 }
1815 
1816 static void
1817 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1818 			     struct sk_buff *skb)
1819 {
1820 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1821 	struct mt7915_vif_cap *vc = &mvif->cap;
1822 	const struct ieee80211_he_cap_elem *he;
1823 	const struct ieee80211_vht_cap *vht;
1824 	const struct ieee80211_ht_cap *ht;
1825 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1826 	const u8 *ie;
1827 	u32 len, bc;
1828 
1829 	/* Check missing configuration options to allow AP mode in mac80211
1830 	 * to remain in sync with hostapd settings, and get a subset of
1831 	 * beacon and hardware capabilities.
1832 	 */
1833 	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
1834 		return;
1835 
1836 	memset(vc, 0, sizeof(*vc));
1837 
1838 	len = skb->len - (mgmt->u.beacon.variable - skb->data);
1839 
1840 	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
1841 			      len);
1842 	if (ie && ie[1] >= sizeof(*ht)) {
1843 		ht = (void *)(ie + 2);
1844 		vc->ldpc |= !!(le16_to_cpu(ht->cap_info) &
1845 			       IEEE80211_HT_CAP_LDPC_CODING);
1846 	}
1847 
1848 	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
1849 			      len);
1850 	if (ie && ie[1] >= sizeof(*vht)) {
1851 		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
1852 
1853 		vht = (void *)(ie + 2);
1854 		bc = le32_to_cpu(vht->vht_cap_info);
1855 
1856 		vc->ldpc |= !!(bc & IEEE80211_VHT_CAP_RXLDPC);
1857 		vc->vht_su_ebfer =
1858 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
1859 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1860 		vc->vht_su_ebfee =
1861 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
1862 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1863 		vc->vht_mu_ebfer =
1864 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
1865 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
1866 		vc->vht_mu_ebfee =
1867 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
1868 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1869 	}
1870 
1871 	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
1872 				  mgmt->u.beacon.variable, len);
1873 	if (ie && ie[1] >= sizeof(*he) + 1) {
1874 		const struct ieee80211_sta_he_cap *pc =
1875 			mt76_connac_get_he_phy_cap(phy->mt76, vif);
1876 		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1877 
1878 		he = (void *)(ie + 3);
1879 
1880 		vc->he_su_ebfer =
1881 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
1882 			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1883 		vc->he_su_ebfee =
1884 			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
1885 			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1886 		vc->he_mu_ebfer =
1887 			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
1888 			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
1889 	}
1890 }
1891 
1892 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
1893 			  struct ieee80211_vif *vif, int en)
1894 {
1895 #define MAX_BEACON_SIZE 512
1896 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1897 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1898 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1899 	struct ieee80211_mutable_offsets offs;
1900 	struct ieee80211_tx_info *info;
1901 	struct sk_buff *skb, *rskb;
1902 	struct tlv *tlv;
1903 	struct bss_info_bcn *bcn;
1904 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
1905 
1906 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1907 					       NULL, len);
1908 	if (IS_ERR(rskb))
1909 		return PTR_ERR(rskb);
1910 
1911 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1912 	bcn = (struct bss_info_bcn *)tlv;
1913 	bcn->enable = en;
1914 
1915 	if (!en)
1916 		goto out;
1917 
1918 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
1919 	if (!skb)
1920 		return -EINVAL;
1921 
1922 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
1923 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
1924 		dev_kfree_skb(skb);
1925 		return -EINVAL;
1926 	}
1927 
1928 	if (mvif->mt76.band_idx) {
1929 		info = IEEE80211_SKB_CB(skb);
1930 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
1931 	}
1932 
1933 	mt7915_mcu_beacon_check_caps(phy, vif, skb);
1934 
1935 	/* TODO: subtag - 11v MBSSID */
1936 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
1937 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
1938 	dev_kfree_skb(skb);
1939 
1940 out:
1941 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
1942 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1943 }
1944 
1945 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
1946 {
1947 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
1948 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
1949 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
1950 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
1951 		return -EIO;
1952 	}
1953 
1954 	/* clear irq when the driver own success */
1955 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
1956 		MT_TOP_LPCR_HOST_BAND_STAT);
1957 
1958 	return 0;
1959 }
1960 
1961 static int mt7915_load_patch(struct mt7915_dev *dev)
1962 {
1963 	const struct mt7915_patch_hdr *hdr;
1964 	const struct firmware *fw = NULL;
1965 	const char *patch;
1966 	int i, ret, sem;
1967 
1968 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 1);
1969 	switch (sem) {
1970 	case PATCH_IS_DL:
1971 		return 0;
1972 	case PATCH_NOT_DL_SEM_SUCCESS:
1973 		break;
1974 	default:
1975 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
1976 		return -EAGAIN;
1977 	}
1978 
1979 	patch = is_mt7915(&dev->mt76) ? MT7915_ROM_PATCH : MT7916_ROM_PATCH;
1980 	ret = request_firmware(&fw, patch, dev->mt76.dev);
1981 	if (ret)
1982 		goto out;
1983 
1984 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
1985 		dev_err(dev->mt76.dev, "Invalid firmware\n");
1986 		ret = -EINVAL;
1987 		goto out;
1988 	}
1989 
1990 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
1991 
1992 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
1993 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
1994 
1995 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
1996 		struct mt7915_patch_sec *sec;
1997 		const u8 *dl;
1998 		u32 len, addr;
1999 
2000 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2001 						  i * sizeof(*sec));
2002 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2003 		    PATCH_SEC_TYPE_INFO) {
2004 			ret = -EINVAL;
2005 			goto out;
2006 		}
2007 
2008 		addr = be32_to_cpu(sec->info.addr);
2009 		len = be32_to_cpu(sec->info.len);
2010 		dl = fw->data + be32_to_cpu(sec->offs);
2011 
2012 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2013 						    DL_MODE_NEED_RSP);
2014 		if (ret) {
2015 			dev_err(dev->mt76.dev, "Download request failed\n");
2016 			goto out;
2017 		}
2018 
2019 		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2020 					       dl, len, 4096);
2021 		if (ret) {
2022 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2023 			goto out;
2024 		}
2025 	}
2026 
2027 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
2028 	if (ret)
2029 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2030 
2031 out:
2032 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 0);
2033 	switch (sem) {
2034 	case PATCH_REL_SEM_SUCCESS:
2035 		break;
2036 	default:
2037 		ret = -EAGAIN;
2038 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2039 		break;
2040 	}
2041 	release_firmware(fw);
2042 
2043 	return ret;
2044 }
2045 
2046 static int
2047 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2048 			     const struct mt7915_fw_trailer *hdr,
2049 			     const u8 *data, bool is_wa)
2050 {
2051 	int i, offset = 0;
2052 	u32 override = 0, option = 0;
2053 
2054 	for (i = 0; i < hdr->n_region; i++) {
2055 		const struct mt7915_fw_region *region;
2056 		int err;
2057 		u32 len, addr, mode;
2058 
2059 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2060 			 (hdr->n_region - i) * sizeof(*region));
2061 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
2062 						   region->feature_set, is_wa);
2063 		len = le32_to_cpu(region->len);
2064 		addr = le32_to_cpu(region->addr);
2065 
2066 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2067 			override = addr;
2068 
2069 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2070 						    mode);
2071 		if (err) {
2072 			dev_err(dev->mt76.dev, "Download request failed\n");
2073 			return err;
2074 		}
2075 
2076 		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2077 					       data + offset, len, 4096);
2078 		if (err) {
2079 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2080 			return err;
2081 		}
2082 
2083 		offset += len;
2084 	}
2085 
2086 	if (override)
2087 		option |= FW_START_OVERRIDE;
2088 
2089 	if (is_wa)
2090 		option |= FW_START_WORKING_PDA_CR4;
2091 
2092 	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
2093 }
2094 
2095 static int mt7915_load_ram(struct mt7915_dev *dev)
2096 {
2097 	const struct mt7915_fw_trailer *hdr;
2098 	const struct firmware *fw;
2099 	const char *mcu;
2100 	int ret;
2101 
2102 	mcu = is_mt7915(&dev->mt76) ? MT7915_FIRMWARE_WM : MT7916_FIRMWARE_WM;
2103 	ret = request_firmware(&fw, mcu, dev->mt76.dev);
2104 	if (ret)
2105 		return ret;
2106 
2107 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2108 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2109 		ret = -EINVAL;
2110 		goto out;
2111 	}
2112 
2113 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2114 					sizeof(*hdr));
2115 
2116 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2117 		 hdr->fw_ver, hdr->build_date);
2118 
2119 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2120 	if (ret) {
2121 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2122 		goto out;
2123 	}
2124 
2125 	release_firmware(fw);
2126 
2127 	mcu = is_mt7915(&dev->mt76) ? MT7915_FIRMWARE_WA : MT7916_FIRMWARE_WA;
2128 	ret = request_firmware(&fw, mcu, dev->mt76.dev);
2129 	if (ret)
2130 		return ret;
2131 
2132 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2133 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2134 		ret = -EINVAL;
2135 		goto out;
2136 	}
2137 
2138 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2139 					sizeof(*hdr));
2140 
2141 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2142 		 hdr->fw_ver, hdr->build_date);
2143 
2144 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2145 	if (ret) {
2146 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2147 		goto out;
2148 	}
2149 
2150 	snprintf(dev->mt76.hw->wiphy->fw_version,
2151 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2152 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2153 
2154 out:
2155 	release_firmware(fw);
2156 
2157 	return ret;
2158 }
2159 
2160 static int
2161 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2162 {
2163 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2164 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2165 
2166 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2167 			    state, 1000)) {
2168 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2169 		return -EIO;
2170 	}
2171 	return 0;
2172 }
2173 
2174 static int mt7915_load_firmware(struct mt7915_dev *dev)
2175 {
2176 	int ret;
2177 
2178 	/* make sure fw is download state */
2179 	if (mt7915_firmware_state(dev, false)) {
2180 		/* restart firmware once */
2181 		__mt76_mcu_restart(&dev->mt76);
2182 		ret = mt7915_firmware_state(dev, false);
2183 		if (ret) {
2184 			dev_err(dev->mt76.dev,
2185 				"Firmware is not ready for download\n");
2186 			return ret;
2187 		}
2188 	}
2189 
2190 	ret = mt7915_load_patch(dev);
2191 	if (ret)
2192 		return ret;
2193 
2194 	ret = mt7915_load_ram(dev);
2195 	if (ret)
2196 		return ret;
2197 
2198 	ret = mt7915_firmware_state(dev, true);
2199 	if (ret)
2200 		return ret;
2201 
2202 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2203 
2204 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2205 
2206 	return 0;
2207 }
2208 
2209 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2210 {
2211 	struct {
2212 		u8 ctrl_val;
2213 		u8 pad[3];
2214 	} data = {
2215 		.ctrl_val = ctrl
2216 	};
2217 
2218 	if (type == MCU_FW_LOG_WA)
2219 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2220 					 &data, sizeof(data), true);
2221 
2222 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2223 				 sizeof(data), true);
2224 }
2225 
2226 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2227 {
2228 	struct {
2229 		u8 ver;
2230 		u8 pad;
2231 		__le16 len;
2232 		u8 level;
2233 		u8 rsv[3];
2234 		__le32 module_idx;
2235 	} data = {
2236 		.module_idx = cpu_to_le32(module),
2237 		.level = level,
2238 	};
2239 
2240 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2241 				 sizeof(data), false);
2242 }
2243 
2244 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2245 {
2246 	struct {
2247 		__le32 cmd;
2248 		u8 enable;
2249 	} data = {
2250 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2251 		.enable = enabled,
2252 	};
2253 
2254 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2255 				sizeof(data), false);
2256 }
2257 
2258 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2259 {
2260 	struct mt7915_dev *dev = phy->dev;
2261 	struct sk_buff *skb;
2262 	struct mt7915_mcu_muru_stats *mu_stats =
2263 				(struct mt7915_mcu_muru_stats *)ms;
2264 	int ret;
2265 
2266 	struct {
2267 		__le32 cmd;
2268 		u8 band_idx;
2269 	} req = {
2270 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2271 		.band_idx = phy != &dev->phy,
2272 	};
2273 
2274 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2275 					&req, sizeof(req), true, &skb);
2276 	if (ret)
2277 		return ret;
2278 
2279 	memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2280 	dev_kfree_skb(skb);
2281 
2282 	return 0;
2283 }
2284 
2285 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2286 {
2287 	struct {
2288 		u8 enable;
2289 		u8 _rsv[3];
2290 	} __packed req = {
2291 		.enable = enabled
2292 	};
2293 
2294 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2295 				 sizeof(req), false);
2296 }
2297 
2298 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2299 {
2300 	struct {
2301 		__le32 cmd;
2302 		u8 val[4];
2303 	} __packed req = {
2304 		.cmd = cpu_to_le32(cmd),
2305 	};
2306 
2307 	put_unaligned_le32(val, req.val);
2308 
2309 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2310 				 sizeof(req), false);
2311 }
2312 
2313 static int
2314 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2315 {
2316 #define RX_AIRTIME_FEATURE_CTRL		1
2317 #define RX_AIRTIME_BITWISE_CTRL		2
2318 #define RX_AIRTIME_CLEAR_EN	1
2319 	struct {
2320 		__le16 field;
2321 		__le16 sub_field;
2322 		__le32 set_status;
2323 		__le32 get_status;
2324 		u8 _rsv[12];
2325 
2326 		bool airtime_en;
2327 		bool mibtime_en;
2328 		bool earlyend_en;
2329 		u8 _rsv1[9];
2330 
2331 		bool airtime_clear;
2332 		bool mibtime_clear;
2333 		u8 _rsv2[98];
2334 	} __packed req = {
2335 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2336 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2337 		.airtime_clear = true,
2338 	};
2339 	int ret;
2340 
2341 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2342 				sizeof(req), true);
2343 	if (ret)
2344 		return ret;
2345 
2346 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2347 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2348 	req.airtime_en = true;
2349 
2350 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2351 				 sizeof(req), true);
2352 }
2353 
2354 int mt7915_mcu_init(struct mt7915_dev *dev)
2355 {
2356 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2357 		.headroom = sizeof(struct mt7915_mcu_txd),
2358 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2359 		.mcu_parse_response = mt7915_mcu_parse_response,
2360 		.mcu_restart = mt76_connac_mcu_restart,
2361 	};
2362 	int ret;
2363 
2364 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2365 
2366 	/* force firmware operation mode into normal state,
2367 	 * which should be set before firmware download stage.
2368 	 */
2369 	if (is_mt7915(&dev->mt76))
2370 		mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2371 	else
2372 		mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
2373 
2374 	ret = mt7915_driver_own(dev, 0);
2375 	if (ret)
2376 		return ret;
2377 	/* set driver own for band1 when two hif exist */
2378 	if (dev->hif2) {
2379 		ret = mt7915_driver_own(dev, 1);
2380 		if (ret)
2381 			return ret;
2382 	}
2383 
2384 	ret = mt7915_load_firmware(dev);
2385 	if (ret)
2386 		return ret;
2387 
2388 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2389 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2390 	if (ret)
2391 		return ret;
2392 
2393 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2394 	if (ret)
2395 		return ret;
2396 
2397 	ret = mt7915_mcu_set_mwds(dev, 1);
2398 	if (ret)
2399 		return ret;
2400 
2401 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2402 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2403 	if (ret)
2404 		return ret;
2405 
2406 	ret = mt7915_mcu_init_rx_airtime(dev);
2407 	if (ret)
2408 		return ret;
2409 
2410 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2411 				 MCU_WA_PARAM_RED, 0, 0);
2412 }
2413 
2414 void mt7915_mcu_exit(struct mt7915_dev *dev)
2415 {
2416 	__mt76_mcu_restart(&dev->mt76);
2417 	if (mt7915_firmware_state(dev, false)) {
2418 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2419 		return;
2420 	}
2421 
2422 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2423 	if (dev->hif2)
2424 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2425 			MT_TOP_LPCR_HOST_FW_OWN);
2426 	skb_queue_purge(&dev->mt76.mcu.res_q);
2427 }
2428 
2429 static int
2430 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2431 {
2432 	struct {
2433 		u8 operation;
2434 		u8 count;
2435 		u8 _rsv[2];
2436 		u8 index;
2437 		u8 enable;
2438 		__le16 etype;
2439 	} req = {
2440 		.operation = 1,
2441 		.count = 1,
2442 		.enable = 1,
2443 		.etype = cpu_to_le16(ETH_P_PAE),
2444 	};
2445 
2446 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2447 				 &req, sizeof(req), false);
2448 }
2449 
2450 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2451 		       bool enable, bool hdr_trans)
2452 {
2453 	struct {
2454 		u8 operation;
2455 		u8 enable;
2456 		u8 check_bssid;
2457 		u8 insert_vlan;
2458 		u8 remove_vlan;
2459 		u8 tid;
2460 		u8 mode;
2461 		u8 rsv;
2462 	} __packed req_trans = {
2463 		.enable = hdr_trans,
2464 	};
2465 	struct {
2466 		u8 enable;
2467 		u8 band;
2468 		u8 rsv[2];
2469 	} __packed req_mac = {
2470 		.enable = enable,
2471 		.band = band,
2472 	};
2473 	int ret;
2474 
2475 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2476 				&req_trans, sizeof(req_trans), false);
2477 	if (ret)
2478 		return ret;
2479 
2480 	if (hdr_trans)
2481 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2482 
2483 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2484 				 &req_mac, sizeof(req_mac), true);
2485 }
2486 
2487 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2488 {
2489 	struct {
2490 		__le32 cmd;
2491 		u8 band;
2492 		u8 enable;
2493 	} __packed req = {
2494 		.cmd = cpu_to_le32(SCS_ENABLE),
2495 		.band = band,
2496 		.enable = enable + 1,
2497 	};
2498 
2499 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
2500 				 sizeof(req), false);
2501 }
2502 
2503 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2504 {
2505 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2506 	u8 num = req->total;
2507 	size_t len = sizeof(*req) -
2508 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2509 
2510 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2511 				 len, true);
2512 }
2513 
2514 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2515 {
2516 #define TX_CMD_MODE		1
2517 	struct mt7915_mcu_tx req = {
2518 		.valid = true,
2519 		.mode = TX_CMD_MODE,
2520 		.total = IEEE80211_NUM_ACS,
2521 	};
2522 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2523 	int ac;
2524 
2525 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2526 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2527 		struct edca *e = &req.edca[ac];
2528 
2529 		e->set = WMM_PARAM_SET;
2530 		e->queue = ac + mvif->mt76.wmm_idx * MT7915_MAX_WMM_SETS;
2531 		e->aifs = q->aifs;
2532 		e->txop = cpu_to_le16(q->txop);
2533 
2534 		if (q->cw_min)
2535 			e->cw_min = fls(q->cw_min);
2536 		else
2537 			e->cw_min = 5;
2538 
2539 		if (q->cw_max)
2540 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2541 		else
2542 			e->cw_max = cpu_to_le16(10);
2543 	}
2544 
2545 	return mt7915_mcu_update_edca(dev, &req);
2546 }
2547 
2548 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2549 {
2550 	struct {
2551 		__le32 tag;
2552 		__le16 min_lpn;
2553 		u8 rsv[2];
2554 	} __packed req = {
2555 		.tag = cpu_to_le32(0x1),
2556 		.min_lpn = cpu_to_le16(val),
2557 	};
2558 
2559 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2560 				 sizeof(req), true);
2561 }
2562 
2563 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2564 			    const struct mt7915_dfs_pulse *pulse)
2565 {
2566 	struct {
2567 		__le32 tag;
2568 
2569 		__le32 max_width;		/* us */
2570 		__le32 max_pwr;			/* dbm */
2571 		__le32 min_pwr;			/* dbm */
2572 		__le32 min_stgr_pri;		/* us */
2573 		__le32 max_stgr_pri;		/* us */
2574 		__le32 min_cr_pri;		/* us */
2575 		__le32 max_cr_pri;		/* us */
2576 	} __packed req = {
2577 		.tag = cpu_to_le32(0x3),
2578 
2579 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2580 		__req_field(max_width),
2581 		__req_field(max_pwr),
2582 		__req_field(min_pwr),
2583 		__req_field(min_stgr_pri),
2584 		__req_field(max_stgr_pri),
2585 		__req_field(min_cr_pri),
2586 		__req_field(max_cr_pri),
2587 #undef __req_field
2588 	};
2589 
2590 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2591 				 sizeof(req), true);
2592 }
2593 
2594 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2595 			    const struct mt7915_dfs_pattern *pattern)
2596 {
2597 	struct {
2598 		__le32 tag;
2599 		__le16 radar_type;
2600 
2601 		u8 enb;
2602 		u8 stgr;
2603 		u8 min_crpn;
2604 		u8 max_crpn;
2605 		u8 min_crpr;
2606 		u8 min_pw;
2607 		__le32 min_pri;
2608 		__le32 max_pri;
2609 		u8 max_pw;
2610 		u8 min_crbn;
2611 		u8 max_crbn;
2612 		u8 min_stgpn;
2613 		u8 max_stgpn;
2614 		u8 min_stgpr;
2615 		u8 rsv[2];
2616 		__le32 min_stgpr_diff;
2617 	} __packed req = {
2618 		.tag = cpu_to_le32(0x2),
2619 		.radar_type = cpu_to_le16(index),
2620 
2621 #define __req_field_u8(field) .field = pattern->field
2622 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2623 		__req_field_u8(enb),
2624 		__req_field_u8(stgr),
2625 		__req_field_u8(min_crpn),
2626 		__req_field_u8(max_crpn),
2627 		__req_field_u8(min_crpr),
2628 		__req_field_u8(min_pw),
2629 		__req_field_u32(min_pri),
2630 		__req_field_u32(max_pri),
2631 		__req_field_u8(max_pw),
2632 		__req_field_u8(min_crbn),
2633 		__req_field_u8(max_crbn),
2634 		__req_field_u8(min_stgpn),
2635 		__req_field_u8(max_stgpn),
2636 		__req_field_u8(min_stgpr),
2637 		__req_field_u32(min_stgpr_diff),
2638 #undef __req_field_u8
2639 #undef __req_field_u32
2640 	};
2641 
2642 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2643 				 sizeof(req), true);
2644 }
2645 
2646 static int
2647 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2648 				 struct cfg80211_chan_def *chandef,
2649 				 int cmd)
2650 {
2651 	struct mt7915_dev *dev = phy->dev;
2652 	struct mt76_phy *mphy = phy->mt76;
2653 	struct ieee80211_channel *chan = mphy->chandef.chan;
2654 	int freq = mphy->chandef.center_freq1;
2655 	struct mt7915_mcu_background_chain_ctrl req = {
2656 		.monitor_scan_type = 2, /* simple rx */
2657 	};
2658 
2659 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2660 		return -EINVAL;
2661 
2662 	if (!cfg80211_chandef_valid(&mphy->chandef))
2663 		return -EINVAL;
2664 
2665 	switch (cmd) {
2666 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2667 		req.chan = chan->hw_value;
2668 		req.central_chan = ieee80211_frequency_to_channel(freq);
2669 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2670 		req.monitor_chan = chandef->chan->hw_value;
2671 		req.monitor_central_chan =
2672 			ieee80211_frequency_to_channel(chandef->center_freq1);
2673 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2674 		req.band_idx = phy != &dev->phy;
2675 		req.scan_mode = 1;
2676 		break;
2677 	}
2678 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2679 		req.monitor_chan = chandef->chan->hw_value;
2680 		req.monitor_central_chan =
2681 			ieee80211_frequency_to_channel(chandef->center_freq1);
2682 		req.band_idx = phy != &dev->phy;
2683 		req.scan_mode = 2;
2684 		break;
2685 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2686 		req.chan = chan->hw_value;
2687 		req.central_chan = ieee80211_frequency_to_channel(freq);
2688 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2689 		req.tx_stream = hweight8(mphy->antenna_mask);
2690 		req.rx_stream = mphy->antenna_mask;
2691 		break;
2692 	default:
2693 		return -EINVAL;
2694 	}
2695 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2696 
2697 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2698 				 &req, sizeof(req), false);
2699 }
2700 
2701 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2702 				     struct cfg80211_chan_def *chandef)
2703 {
2704 	struct mt7915_dev *dev = phy->dev;
2705 	int err, region;
2706 
2707 	if (!chandef) { /* disable offchain */
2708 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2709 					      0, 0);
2710 		if (err)
2711 			return err;
2712 
2713 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2714 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2715 	}
2716 
2717 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2718 					       CH_SWITCH_BACKGROUND_SCAN_START);
2719 	if (err)
2720 		return err;
2721 
2722 	switch (dev->mt76.region) {
2723 	case NL80211_DFS_ETSI:
2724 		region = 0;
2725 		break;
2726 	case NL80211_DFS_JP:
2727 		region = 2;
2728 		break;
2729 	case NL80211_DFS_FCC:
2730 	default:
2731 		region = 1;
2732 		break;
2733 	}
2734 
2735 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2736 				       0, region);
2737 }
2738 
2739 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2740 {
2741 	struct mt7915_dev *dev = phy->dev;
2742 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2743 	int freq1 = chandef->center_freq1;
2744 	bool ext_phy = phy != &dev->phy;
2745 	struct {
2746 		u8 control_ch;
2747 		u8 center_ch;
2748 		u8 bw;
2749 		u8 tx_streams_num;
2750 		u8 rx_streams;	/* mask or num */
2751 		u8 switch_reason;
2752 		u8 band_idx;
2753 		u8 center_ch2;	/* for 80+80 only */
2754 		__le16 cac_case;
2755 		u8 channel_band;
2756 		u8 rsv0;
2757 		__le32 outband_freq;
2758 		u8 txpower_drop;
2759 		u8 ap_bw;
2760 		u8 ap_center_ch;
2761 		u8 rsv1[57];
2762 	} __packed req = {
2763 		.control_ch = chandef->chan->hw_value,
2764 		.center_ch = ieee80211_frequency_to_channel(freq1),
2765 		.bw = mt76_connac_chan_bw(chandef),
2766 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
2767 		.rx_streams = phy->mt76->antenna_mask,
2768 		.band_idx = ext_phy,
2769 		.channel_band = chandef->chan->band,
2770 	};
2771 
2772 #ifdef CONFIG_NL80211_TESTMODE
2773 	if (phy->mt76->test.tx_antenna_mask &&
2774 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
2775 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
2776 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
2777 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
2778 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
2779 
2780 		if (ext_phy) {
2781 			req.tx_streams_num = 2;
2782 			req.rx_streams >>= 2;
2783 		}
2784 	}
2785 #endif
2786 
2787 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2788 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2789 	else if (phy->mt76->hw->conf.radar_enabled &&
2790 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
2791 		req.switch_reason = CH_SWITCH_DFS;
2792 	else
2793 		req.switch_reason = CH_SWITCH_NORMAL;
2794 
2795 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2796 		req.rx_streams = hweight8(req.rx_streams);
2797 
2798 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2799 		int freq2 = chandef->center_freq2;
2800 
2801 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2802 	}
2803 
2804 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2805 }
2806 
2807 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2808 {
2809 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2810 #define PAGE_IDX_MASK		GENMASK(4, 2)
2811 #define PER_PAGE_SIZE		0x400
2812 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2813 	u16 eeprom_size = mt7915_eeprom_size(dev);
2814 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2815 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2816 	int eep_len;
2817 	int i;
2818 
2819 	for (i = 0; i < total; i++, eep += eep_len) {
2820 		struct sk_buff *skb;
2821 		int ret;
2822 
2823 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2824 			eep_len = eeprom_size % PER_PAGE_SIZE;
2825 		else
2826 			eep_len = PER_PAGE_SIZE;
2827 
2828 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2829 					 sizeof(req) + eep_len);
2830 		if (!skb)
2831 			return -ENOMEM;
2832 
2833 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2834 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2835 		req.len = cpu_to_le16(eep_len);
2836 
2837 		skb_put_data(skb, &req, sizeof(req));
2838 		skb_put_data(skb, eep, eep_len);
2839 
2840 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2841 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2842 		if (ret)
2843 			return ret;
2844 	}
2845 
2846 	return 0;
2847 }
2848 
2849 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2850 {
2851 	struct mt7915_mcu_eeprom req = {
2852 		.buffer_mode = EE_MODE_EFUSE,
2853 		.format = EE_FORMAT_WHOLE,
2854 	};
2855 
2856 	if (dev->flash_mode)
2857 		return mt7915_mcu_set_eeprom_flash(dev);
2858 
2859 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2860 				 &req, sizeof(req), true);
2861 }
2862 
2863 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2864 {
2865 	struct mt7915_mcu_eeprom_info req = {
2866 		.addr = cpu_to_le32(round_down(offset,
2867 				    MT7915_EEPROM_BLOCK_SIZE)),
2868 	};
2869 	struct mt7915_mcu_eeprom_info *res;
2870 	struct sk_buff *skb;
2871 	int ret;
2872 	u8 *buf;
2873 
2874 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
2875 				sizeof(req), true, &skb);
2876 	if (ret)
2877 		return ret;
2878 
2879 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2880 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2881 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2882 	dev_kfree_skb(skb);
2883 
2884 	return 0;
2885 }
2886 
2887 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2888 {
2889 	struct {
2890 		u8 _rsv;
2891 		u8 version;
2892 		u8 die_idx;
2893 		u8 _rsv2;
2894 	} __packed req = {
2895 		.version = 1,
2896 	};
2897 	struct sk_buff *skb;
2898 	int ret;
2899 
2900 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
2901 					sizeof(req), true, &skb);
2902 	if (ret)
2903 		return ret;
2904 
2905 	*block_num = *(u8 *)skb->data;
2906 	dev_kfree_skb(skb);
2907 
2908 	return 0;
2909 }
2910 
2911 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2912 				  u8 *data, u32 len, int cmd)
2913 {
2914 	struct {
2915 		u8 dir;
2916 		u8 valid;
2917 		__le16 bitmap;
2918 		s8 precal;
2919 		u8 action;
2920 		u8 band;
2921 		u8 idx;
2922 		u8 rsv[4];
2923 		__le32 len;
2924 	} req = {};
2925 	struct sk_buff *skb;
2926 
2927 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2928 	if (!skb)
2929 		return -ENOMEM;
2930 
2931 	req.idx = idx;
2932 	req.len = cpu_to_le32(len);
2933 	skb_put_data(skb, &req, sizeof(req));
2934 	skb_put_data(skb, data, len);
2935 
2936 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2937 }
2938 
2939 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2940 {
2941 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2942 	u32 total = MT_EE_CAL_GROUP_SIZE;
2943 
2944 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
2945 		return 0;
2946 
2947 	/*
2948 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2949 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2950 	 */
2951 	while (total > 0) {
2952 		int ret, len;
2953 
2954 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2955 
2956 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2957 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2958 		if (ret)
2959 			return ret;
2960 
2961 		total -= len;
2962 		cal += len;
2963 		idx++;
2964 	}
2965 
2966 	return 0;
2967 }
2968 
2969 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2970 {
2971 	int i;
2972 
2973 	for (i = 0; i < n_freqs; i++)
2974 		if (cur == freqs[i])
2975 			return i;
2976 
2977 	return -1;
2978 }
2979 
2980 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
2981 {
2982 	static const u16 freq_list[] = {
2983 		5180, 5200, 5220, 5240,
2984 		5260, 5280, 5300, 5320,
2985 		5500, 5520, 5540, 5560,
2986 		5580, 5600, 5620, 5640,
2987 		5660, 5680, 5700, 5745,
2988 		5765, 5785, 5805, 5825
2989 	};
2990 	int offset_2g = ARRAY_SIZE(freq_list);
2991 	int idx;
2992 
2993 	if (freq < 4000) {
2994 		if (freq < 2432)
2995 			return offset_2g;
2996 		if (freq < 2457)
2997 			return offset_2g + 1;
2998 
2999 		return offset_2g + 2;
3000 	}
3001 
3002 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3003 		return -1;
3004 
3005 	if (bw != NL80211_CHAN_WIDTH_20) {
3006 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3007 					   freq + 10);
3008 		if (idx >= 0)
3009 			return idx;
3010 
3011 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3012 					   freq - 10);
3013 		if (idx >= 0)
3014 			return idx;
3015 	}
3016 
3017 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3018 }
3019 
3020 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3021 {
3022 	struct mt7915_dev *dev = phy->dev;
3023 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3024 	u16 total = 2, center_freq = chandef->center_freq1;
3025 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3026 	int idx;
3027 
3028 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3029 		return 0;
3030 
3031 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3032 	if (idx < 0)
3033 		return -EINVAL;
3034 
3035 	/* Items: Tx DPD, Tx Flatness */
3036 	idx = idx * 2;
3037 	cal += MT_EE_CAL_GROUP_SIZE;
3038 
3039 	while (total--) {
3040 		int ret;
3041 
3042 		cal += (idx * MT_EE_CAL_UNIT);
3043 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3044 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3045 		if (ret)
3046 			return ret;
3047 
3048 		idx++;
3049 	}
3050 
3051 	return 0;
3052 }
3053 
3054 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3055 {
3056 	/* strict order */
3057 	static const u32 offs[] = {
3058 		MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME,
3059 		MIB_BUSY_TIME_V2, MIB_TX_TIME_V2, MIB_RX_TIME_V2,
3060 		MIB_OBSS_AIRTIME_V2
3061 	};
3062 	struct mt76_channel_state *state = phy->mt76->chan_state;
3063 	struct mt76_channel_state *state_ts = &phy->state_ts;
3064 	struct mt7915_dev *dev = phy->dev;
3065 	struct mt7915_mcu_mib *res, req[4];
3066 	struct sk_buff *skb;
3067 	int i, ret, start = 0;
3068 
3069 	if (!is_mt7915(&dev->mt76))
3070 		start = 4;
3071 
3072 	for (i = 0; i < 4; i++) {
3073 		req[i].band = cpu_to_le32(phy != &dev->phy);
3074 		req[i].offs = cpu_to_le32(offs[i + start]);
3075 	}
3076 
3077 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3078 					req, sizeof(req), true, &skb);
3079 	if (ret)
3080 		return ret;
3081 
3082 	res = (struct mt7915_mcu_mib *)(skb->data + 20);
3083 
3084 	if (chan_switch)
3085 		goto out;
3086 
3087 #define __res_u64(s) le64_to_cpu(res[s].data)
3088 	state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3089 	state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3090 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3091 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3092 
3093 out:
3094 	state_ts->cc_busy = __res_u64(0);
3095 	state_ts->cc_tx = __res_u64(1);
3096 	state_ts->cc_bss_rx = __res_u64(2);
3097 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3098 #undef __res_u64
3099 
3100 	dev_kfree_skb(skb);
3101 
3102 	return 0;
3103 }
3104 
3105 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3106 {
3107 	struct mt7915_dev *dev = phy->dev;
3108 	struct {
3109 		u8 ctrl_id;
3110 		u8 action;
3111 		u8 dbdc_idx;
3112 		u8 rsv[5];
3113 	} req = {
3114 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3115 		.dbdc_idx = phy != &dev->phy,
3116 	};
3117 
3118 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3119 				 sizeof(req), true);
3120 }
3121 
3122 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3123 {
3124 	struct mt7915_dev *dev = phy->dev;
3125 	struct {
3126 		struct mt7915_mcu_thermal_ctrl ctrl;
3127 
3128 		__le32 trigger_temp;
3129 		__le32 restore_temp;
3130 		__le16 sustain_time;
3131 		u8 rsv[2];
3132 	} __packed req = {
3133 		.ctrl = {
3134 			.band_idx = phy != &dev->phy,
3135 		},
3136 	};
3137 	int level;
3138 
3139 	if (!state) {
3140 		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3141 		goto out;
3142 	}
3143 
3144 	/* set duty cycle and level */
3145 	for (level = 0; level < 4; level++) {
3146 		int ret;
3147 
3148 		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3149 		req.ctrl.duty.duty_level = level;
3150 		req.ctrl.duty.duty_cycle = state;
3151 		state /= 2;
3152 
3153 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3154 					&req, sizeof(req.ctrl), false);
3155 		if (ret)
3156 			return ret;
3157 	}
3158 
3159 	/* set high-temperature trigger threshold */
3160 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3161 	/* add a safety margin ~10 */
3162 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3163 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3164 	req.sustain_time = cpu_to_le16(10);
3165 
3166 out:
3167 	req.ctrl.type.protect_type = 1;
3168 	req.ctrl.type.trigger_type = 1;
3169 
3170 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3171 				 &req, sizeof(req), false);
3172 }
3173 
3174 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3175 {
3176 	struct mt7915_dev *dev = phy->dev;
3177 	struct mt76_phy *mphy = phy->mt76;
3178 	struct ieee80211_hw *hw = mphy->hw;
3179 	struct mt7915_sku_val {
3180 		u8 format_id;
3181 		u8 limit_type;
3182 		u8 dbdc_idx;
3183 		s8 val[MT7915_SKU_RATE_NUM];
3184 	} __packed req = {
3185 		.format_id = 4,
3186 		.dbdc_idx = phy != &dev->phy,
3187 	};
3188 	struct mt76_power_limits limits_array;
3189 	s8 *la = (s8 *)&limits_array;
3190 	int i, idx, n_chains = hweight8(mphy->antenna_mask);
3191 	int tx_power = hw->conf.power_level * 2;
3192 
3193 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan,
3194 				      tx_power);
3195 	tx_power -= mt76_tx_power_nss_delta(n_chains);
3196 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3197 					      &limits_array, tx_power);
3198 	mphy->txpower_cur = tx_power;
3199 
3200 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3201 		u8 mcs_num, len = mt7915_sku_group_len[i];
3202 		int j;
3203 
3204 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3205 			mcs_num = 10;
3206 
3207 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3208 				la = (s8 *)&limits_array + 12;
3209 		} else {
3210 			mcs_num = len;
3211 		}
3212 
3213 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3214 			req.val[idx + j] = la[j];
3215 
3216 		la += mcs_num;
3217 		idx += len;
3218 	}
3219 
3220 	return mt76_mcu_send_msg(&dev->mt76,
3221 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3222 				 sizeof(req), true);
3223 }
3224 
3225 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3226 {
3227 #define RATE_POWER_INFO	2
3228 	struct mt7915_dev *dev = phy->dev;
3229 	struct {
3230 		u8 format_id;
3231 		u8 category;
3232 		u8 band;
3233 		u8 _rsv;
3234 	} __packed req = {
3235 		.format_id = 7,
3236 		.category = RATE_POWER_INFO,
3237 		.band = phy != &dev->phy,
3238 	};
3239 	s8 res[MT7915_SKU_RATE_NUM][2];
3240 	struct sk_buff *skb;
3241 	int ret, i;
3242 
3243 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3244 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3245 					&req, sizeof(req), true, &skb);
3246 	if (ret)
3247 		return ret;
3248 
3249 	memcpy(res, skb->data + 4, sizeof(res));
3250 	for (i = 0; i < len; i++)
3251 		txpower[i] = res[i][req.band];
3252 
3253 	dev_kfree_skb(skb);
3254 
3255 	return 0;
3256 }
3257 
3258 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3259 			      u8 en)
3260 {
3261 	struct {
3262 		u8 test_mode_en;
3263 		u8 param_idx;
3264 		u8 _rsv[2];
3265 
3266 		u8 enable;
3267 		u8 _rsv2[3];
3268 
3269 		u8 pad[8];
3270 	} __packed req = {
3271 		.test_mode_en = test_mode,
3272 		.param_idx = param,
3273 		.enable = en,
3274 	};
3275 
3276 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3277 				 sizeof(req), false);
3278 }
3279 
3280 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3281 {
3282 	struct mt7915_dev *dev = phy->dev;
3283 	struct mt7915_sku {
3284 		u8 format_id;
3285 		u8 sku_enable;
3286 		u8 dbdc_idx;
3287 		u8 rsv;
3288 	} __packed req = {
3289 		.format_id = 0,
3290 		.dbdc_idx = phy != &dev->phy,
3291 		.sku_enable = enable,
3292 	};
3293 
3294 	return mt76_mcu_send_msg(&dev->mt76,
3295 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3296 				 sizeof(req), true);
3297 }
3298 
3299 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3300 {
3301 	struct {
3302 		u8 action;
3303 		u8 set;
3304 		u8 band;
3305 		u8 rsv;
3306 	} req = {
3307 		.action = action,
3308 		.set = set,
3309 		.band = band,
3310 	};
3311 
3312 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3313 				 &req, sizeof(req), false);
3314 }
3315 
3316 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3317 {
3318 	struct {
3319 		u8 action;
3320 		union {
3321 			struct {
3322 				u8 snd_mode;
3323 				u8 sta_num;
3324 				u8 rsv;
3325 				u8 wlan_idx[4];
3326 				__le32 snd_period;	/* ms */
3327 			} __packed snd;
3328 			struct {
3329 				bool ebf;
3330 				bool ibf;
3331 				u8 rsv;
3332 			} __packed type;
3333 			struct {
3334 				u8 bf_num;
3335 				u8 bf_bitmap;
3336 				u8 bf_sel[8];
3337 				u8 rsv[5];
3338 			} __packed mod;
3339 		};
3340 	} __packed req = {
3341 		.action = action,
3342 	};
3343 
3344 #define MT_BF_PROCESSING	4
3345 	switch (action) {
3346 	case MT_BF_SOUNDING_ON:
3347 		req.snd.snd_mode = MT_BF_PROCESSING;
3348 		break;
3349 	case MT_BF_TYPE_UPDATE:
3350 		req.type.ebf = true;
3351 		req.type.ibf = dev->ibf;
3352 		break;
3353 	case MT_BF_MODULE_UPDATE:
3354 		req.mod.bf_num = 2;
3355 		req.mod.bf_bitmap = GENMASK(1, 0);
3356 		break;
3357 	default:
3358 		return -EINVAL;
3359 	}
3360 
3361 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3362 				 sizeof(req), true);
3363 }
3364 
3365 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3366 			    bool enable)
3367 {
3368 #define MT_SPR_ENABLE		1
3369 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3370 	struct {
3371 		u8 action;
3372 		u8 arg_num;
3373 		u8 band_idx;
3374 		u8 status;
3375 		u8 drop_tx_idx;
3376 		u8 sta_idx;	/* 256 sta */
3377 		u8 rsv[2];
3378 		__le32 val;
3379 	} __packed req = {
3380 		.action = MT_SPR_ENABLE,
3381 		.arg_num = 1,
3382 		.band_idx = mvif->mt76.band_idx,
3383 		.val = cpu_to_le32(enable),
3384 	};
3385 
3386 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3387 				 sizeof(req), true);
3388 }
3389 
3390 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3391 			   struct ieee80211_sta *sta, struct rate_info *rate)
3392 {
3393 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3394 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3395 	struct mt7915_dev *dev = phy->dev;
3396 	struct mt76_phy *mphy = phy->mt76;
3397 	struct {
3398 		u8 category;
3399 		u8 band;
3400 		__le16 wcid;
3401 	} __packed req = {
3402 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3403 		.band = mvif->mt76.band_idx,
3404 		.wcid = cpu_to_le16(msta->wcid.idx),
3405 	};
3406 	struct ieee80211_supported_band *sband;
3407 	struct mt7915_mcu_phy_rx_info *res;
3408 	struct sk_buff *skb;
3409 	int ret;
3410 	bool cck = false;
3411 
3412 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3413 					&req, sizeof(req), true, &skb);
3414 	if (ret)
3415 		return ret;
3416 
3417 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3418 
3419 	rate->mcs = res->rate;
3420 	rate->nss = res->nsts + 1;
3421 
3422 	switch (res->mode) {
3423 	case MT_PHY_TYPE_CCK:
3424 		cck = true;
3425 		fallthrough;
3426 	case MT_PHY_TYPE_OFDM:
3427 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3428 			sband = &mphy->sband_5g.sband;
3429 		else
3430 			sband = &mphy->sband_2g.sband;
3431 
3432 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3433 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3434 		break;
3435 	case MT_PHY_TYPE_HT:
3436 	case MT_PHY_TYPE_HT_GF:
3437 		if (rate->mcs > 31) {
3438 			ret = -EINVAL;
3439 			goto out;
3440 		}
3441 
3442 		rate->flags = RATE_INFO_FLAGS_MCS;
3443 		if (res->gi)
3444 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3445 		break;
3446 	case MT_PHY_TYPE_VHT:
3447 		if (rate->mcs > 9) {
3448 			ret = -EINVAL;
3449 			goto out;
3450 		}
3451 
3452 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3453 		if (res->gi)
3454 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3455 		break;
3456 	case MT_PHY_TYPE_HE_SU:
3457 	case MT_PHY_TYPE_HE_EXT_SU:
3458 	case MT_PHY_TYPE_HE_TB:
3459 	case MT_PHY_TYPE_HE_MU:
3460 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3461 			ret = -EINVAL;
3462 			goto out;
3463 		}
3464 		rate->he_gi = res->gi;
3465 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3466 		break;
3467 	default:
3468 		ret = -EINVAL;
3469 		goto out;
3470 	}
3471 
3472 	switch (res->bw) {
3473 	case IEEE80211_STA_RX_BW_160:
3474 		rate->bw = RATE_INFO_BW_160;
3475 		break;
3476 	case IEEE80211_STA_RX_BW_80:
3477 		rate->bw = RATE_INFO_BW_80;
3478 		break;
3479 	case IEEE80211_STA_RX_BW_40:
3480 		rate->bw = RATE_INFO_BW_40;
3481 		break;
3482 	default:
3483 		rate->bw = RATE_INFO_BW_20;
3484 		break;
3485 	}
3486 
3487 out:
3488 	dev_kfree_skb(skb);
3489 
3490 	return ret;
3491 }
3492 
3493 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3494 				struct cfg80211_he_bss_color *he_bss_color)
3495 {
3496 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3497 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3498 	struct bss_info_color *bss_color;
3499 	struct sk_buff *skb;
3500 	struct tlv *tlv;
3501 
3502 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3503 					      NULL, len);
3504 	if (IS_ERR(skb))
3505 		return PTR_ERR(skb);
3506 
3507 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3508 				      sizeof(*bss_color));
3509 	bss_color = (struct bss_info_color *)tlv;
3510 	bss_color->disable = !he_bss_color->enabled;
3511 	bss_color->color = he_bss_color->color;
3512 
3513 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3514 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3515 }
3516 
3517 #define TWT_AGRT_TRIGGER	BIT(0)
3518 #define TWT_AGRT_ANNOUNCE	BIT(1)
3519 #define TWT_AGRT_PROTECT	BIT(2)
3520 
3521 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3522 			       struct mt7915_vif *mvif,
3523 			       struct mt7915_twt_flow *flow,
3524 			       int cmd)
3525 {
3526 	struct {
3527 		u8 tbl_idx;
3528 		u8 cmd;
3529 		u8 own_mac_idx;
3530 		u8 flowid; /* 0xff for group id */
3531 		__le16 peer_id; /* specify the peer_id (msb=0)
3532 				 * or group_id (msb=1)
3533 				 */
3534 		u8 duration; /* 256 us */
3535 		u8 bss_idx;
3536 		__le64 start_tsf;
3537 		__le16 mantissa;
3538 		u8 exponent;
3539 		u8 is_ap;
3540 		u8 agrt_params;
3541 		u8 rsv[23];
3542 	} __packed req = {
3543 		.tbl_idx = flow->table_id,
3544 		.cmd = cmd,
3545 		.own_mac_idx = mvif->mt76.omac_idx,
3546 		.flowid = flow->id,
3547 		.peer_id = cpu_to_le16(flow->wcid),
3548 		.duration = flow->duration,
3549 		.bss_idx = mvif->mt76.idx,
3550 		.start_tsf = cpu_to_le64(flow->tsf),
3551 		.mantissa = flow->mantissa,
3552 		.exponent = flow->exp,
3553 		.is_ap = true,
3554 	};
3555 
3556 	if (flow->protection)
3557 		req.agrt_params |= TWT_AGRT_PROTECT;
3558 	if (!flow->flowtype)
3559 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3560 	if (flow->trigger)
3561 		req.agrt_params |= TWT_AGRT_TRIGGER;
3562 
3563 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3564 				 &req, sizeof(req), true);
3565 }
3566