xref: /linux/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c (revision 221013afb459e5deb8bd08e29b37050af5586d1c)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7981:						\
17 		_fw = MT7981_##name;				\
18 		break;						\
19 	case 0x7986:						\
20 		_fw = MT7986_##name##__VA_ARGS__;		\
21 		break;						\
22 	default:						\
23 		_fw = MT7916_##name;				\
24 		break;						\
25 	}							\
26 	_fw;							\
27 })
28 
29 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
30 					 fw_name(_dev, name) :			\
31 					 fw_name(_dev, name, _MT7975))
32 
33 #define MCU_PATCH_ADDRESS		0x200000
34 
35 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
36 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
37 
38 static bool sr_scene_detect = true;
39 module_param(sr_scene_detect, bool, 0644);
40 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
41 
42 static u8
43 mt7915_mcu_get_sta_nss(u16 mcs_map)
44 {
45 	u8 nss;
46 
47 	for (nss = 8; nss > 0; nss--) {
48 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
49 
50 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
51 			break;
52 	}
53 
54 	return nss - 1;
55 }
56 
57 static void
58 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
59 			  u16 mcs_map)
60 {
61 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
62 	struct mt7915_dev *dev = msta->vif->phy->dev;
63 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
64 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
65 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
66 
67 	for (nss = 0; nss < max_nss; nss++) {
68 		int mcs;
69 
70 		switch ((mcs_map >> (2 * nss)) & 0x3) {
71 		case IEEE80211_HE_MCS_SUPPORT_0_11:
72 			mcs = GENMASK(11, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_9:
75 			mcs = GENMASK(9, 0);
76 			break;
77 		case IEEE80211_HE_MCS_SUPPORT_0_7:
78 			mcs = GENMASK(7, 0);
79 			break;
80 		default:
81 			mcs = 0;
82 		}
83 
84 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
85 
86 		switch (mcs) {
87 		case 0 ... 7:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
89 			break;
90 		case 8 ... 9:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
92 			break;
93 		case 10 ... 11:
94 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
95 			break;
96 		default:
97 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
98 			break;
99 		}
100 		mcs_map &= ~(0x3 << (nss * 2));
101 		mcs_map |= mcs << (nss * 2);
102 
103 		/* only support 2ss on 160MHz for mt7915 */
104 		if (is_mt7915(&dev->mt76) && nss > 1 &&
105 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
106 			break;
107 	}
108 
109 	*he_mcs = cpu_to_le16(mcs_map);
110 }
111 
112 static void
113 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
114 			   const u16 *mask)
115 {
116 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
117 	struct mt7915_dev *dev = msta->vif->phy->dev;
118 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
119 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
120 	u16 mcs;
121 
122 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
123 		switch (mcs_map & 0x3) {
124 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
128 			mcs = GENMASK(8, 0);
129 			break;
130 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
131 			mcs = GENMASK(7, 0);
132 			break;
133 		default:
134 			mcs = 0;
135 		}
136 
137 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
138 
139 		/* only support 2ss on 160MHz for mt7915 */
140 		if (is_mt7915(&dev->mt76) && nss > 1 &&
141 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
142 			break;
143 	}
144 }
145 
146 static void
147 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
148 			  const u8 *mask)
149 {
150 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
151 
152 	for (nss = 0; nss < max_nss; nss++)
153 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
154 }
155 
156 static int
157 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
158 			  struct sk_buff *skb, int seq)
159 {
160 	struct mt76_connac2_mcu_rxd *rxd;
161 	int ret = 0;
162 
163 	if (!skb) {
164 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
165 			cmd, seq);
166 		return -ETIMEDOUT;
167 	}
168 
169 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
170 	if (seq != rxd->seq &&
171 	    !(rxd->eid == MCU_CMD_EXT_CID &&
172 	      rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
173 		return -EAGAIN;
174 
175 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
176 		skb_pull(skb, sizeof(*rxd) - 4);
177 		ret = *skb->data;
178 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
179 		skb_pull(skb, sizeof(*rxd) + 4);
180 		ret = le32_to_cpu(*(__le32 *)skb->data);
181 	} else {
182 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
183 	}
184 
185 	return ret;
186 }
187 
188 static int
189 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
190 			int cmd, int *wait_seq)
191 {
192 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
193 	enum mt76_mcuq_id qid;
194 	int ret;
195 
196 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
197 	if (ret)
198 		return ret;
199 
200 	if (cmd == MCU_CMD(FW_SCATTER))
201 		qid = MT_MCUQ_FWDL;
202 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
203 		qid = MT_MCUQ_WA;
204 	else
205 		qid = MT_MCUQ_WM;
206 
207 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
208 }
209 
210 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
211 {
212 	struct {
213 		__le32 args[3];
214 	} req = {
215 		.args = {
216 			cpu_to_le32(a1),
217 			cpu_to_le32(a2),
218 			cpu_to_le32(a3),
219 		},
220 	};
221 
222 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
223 }
224 
225 static void
226 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
227 {
228 	if (!vif->bss_conf.csa_active || vif->type == NL80211_IFTYPE_STATION)
229 		return;
230 
231 	ieee80211_csa_finish(vif, 0);
232 }
233 
234 static void
235 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
236 {
237 	struct mt76_phy *mphy = &dev->mt76.phy;
238 	struct mt7915_mcu_csa_notify *c;
239 
240 	c = (struct mt7915_mcu_csa_notify *)skb->data;
241 
242 	if (c->band_idx > MT_BAND1)
243 		return;
244 
245 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
246 	    dev->mt76.phys[MT_BAND1])
247 		mphy = dev->mt76.phys[MT_BAND1];
248 
249 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
250 			IEEE80211_IFACE_ITER_RESUME_ALL,
251 			mt7915_mcu_csa_finish, mphy->hw);
252 }
253 
254 static void
255 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
256 {
257 	struct mt76_phy *mphy = &dev->mt76.phy;
258 	struct mt7915_mcu_thermal_notify *t;
259 	struct mt7915_phy *phy;
260 
261 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
262 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
263 		return;
264 
265 	if (t->ctrl.band_idx > MT_BAND1)
266 		return;
267 
268 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
269 	    dev->mt76.phys[MT_BAND1])
270 		mphy = dev->mt76.phys[MT_BAND1];
271 
272 	phy = mphy->priv;
273 	phy->throttle_state = t->ctrl.duty.duty_cycle;
274 }
275 
276 static void
277 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
278 {
279 	struct mt76_phy *mphy = &dev->mt76.phy;
280 	struct mt7915_mcu_rdd_report *r;
281 
282 	r = (struct mt7915_mcu_rdd_report *)skb->data;
283 
284 	if (r->band_idx > MT_RX_SEL2)
285 		return;
286 
287 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
288 	    dev->mt76.phys[MT_BAND1])
289 		mphy = dev->mt76.phys[MT_BAND1];
290 
291 	if (r->band_idx == MT_RX_SEL2)
292 		cfg80211_background_radar_event(mphy->hw->wiphy,
293 						&dev->rdd2_chandef,
294 						GFP_ATOMIC);
295 	else
296 		ieee80211_radar_detected(mphy->hw);
297 	dev->hw_pattern++;
298 }
299 
300 static void
301 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
302 {
303 	struct mt76_connac2_mcu_rxd *rxd;
304 	int len = skb->len - sizeof(*rxd);
305 	const char *data, *type;
306 
307 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
308 	data = (char *)&rxd[1];
309 
310 	switch (rxd->s2d_index) {
311 	case 0:
312 		if (mt7915_debugfs_rx_log(dev, data, len))
313 			return;
314 
315 		type = "WM";
316 		break;
317 	case 2:
318 		type = "WA";
319 		break;
320 	default:
321 		type = "unknown";
322 		break;
323 	}
324 
325 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
326 }
327 
328 static void
329 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
330 {
331 	if (!vif->bss_conf.color_change_active || vif->type == NL80211_IFTYPE_STATION)
332 		return;
333 
334 	ieee80211_color_change_finish(vif, 0);
335 }
336 
337 static void
338 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
339 {
340 	struct mt76_phy *mphy = &dev->mt76.phy;
341 	struct mt7915_mcu_bcc_notify *b;
342 
343 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
344 
345 	if (b->band_idx > MT_BAND1)
346 		return;
347 
348 	if ((b->band_idx && !dev->phy.mt76->band_idx) &&
349 	    dev->mt76.phys[MT_BAND1])
350 		mphy = dev->mt76.phys[MT_BAND1];
351 
352 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
353 			IEEE80211_IFACE_ITER_RESUME_ALL,
354 			mt7915_mcu_cca_finish, mphy->hw);
355 }
356 
357 static void
358 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
359 {
360 	struct mt76_connac2_mcu_rxd *rxd;
361 
362 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
363 	switch (rxd->ext_eid) {
364 	case MCU_EXT_EVENT_THERMAL_PROTECT:
365 		mt7915_mcu_rx_thermal_notify(dev, skb);
366 		break;
367 	case MCU_EXT_EVENT_RDD_REPORT:
368 		mt7915_mcu_rx_radar_detected(dev, skb);
369 		break;
370 	case MCU_EXT_EVENT_CSA_NOTIFY:
371 		mt7915_mcu_rx_csa_notify(dev, skb);
372 		break;
373 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
374 		mt7915_mcu_rx_log_message(dev, skb);
375 		break;
376 	case MCU_EXT_EVENT_BCC_NOTIFY:
377 		mt7915_mcu_rx_bcc_notify(dev, skb);
378 		break;
379 	default:
380 		break;
381 	}
382 }
383 
384 static void
385 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
386 {
387 	struct mt76_connac2_mcu_rxd *rxd;
388 
389 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
390 	switch (rxd->eid) {
391 	case MCU_EVENT_EXT:
392 		mt7915_mcu_rx_ext_event(dev, skb);
393 		break;
394 	default:
395 		break;
396 	}
397 	dev_kfree_skb(skb);
398 }
399 
400 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
401 {
402 	struct mt76_connac2_mcu_rxd *rxd;
403 
404 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
405 	if ((rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
406 	     rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
407 	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
408 	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
409 	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
410 	     !rxd->seq) &&
411 	     !(rxd->eid == MCU_CMD_EXT_CID &&
412 	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
413 		mt7915_mcu_rx_unsolicited_event(dev, skb);
414 	else
415 		mt76_mcu_rx_event(&dev->mt76, skb);
416 }
417 
418 static struct tlv *
419 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
420 			     __le16 *sub_ntlv, __le16 *len)
421 {
422 	struct tlv *ptlv, tlv = {
423 		.tag = cpu_to_le16(sub_tag),
424 		.len = cpu_to_le16(sub_len),
425 	};
426 
427 	ptlv = skb_put_zero(skb, sub_len);
428 	memcpy(ptlv, &tlv, sizeof(tlv));
429 
430 	le16_add_cpu(sub_ntlv, 1);
431 	le16_add_cpu(len, sub_len);
432 
433 	return ptlv;
434 }
435 
436 /** bss info **/
437 struct mt7915_he_obss_narrow_bw_ru_data {
438 	bool tolerated;
439 };
440 
441 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
442 						   struct cfg80211_bss *bss,
443 						   void *_data)
444 {
445 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
446 	const struct element *elem;
447 
448 	rcu_read_lock();
449 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
450 
451 	if (!elem || elem->datalen <= 10 ||
452 	    !(elem->data[10] &
453 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
454 		data->tolerated = false;
455 
456 	rcu_read_unlock();
457 }
458 
459 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
460 					      struct ieee80211_vif *vif)
461 {
462 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
463 		.tolerated = true,
464 	};
465 
466 	if (!(vif->bss_conf.chanreq.oper.chan->flags & IEEE80211_CHAN_RADAR))
467 		return false;
468 
469 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chanreq.oper,
470 			  mt7915_check_he_obss_narrow_bw_ru_iter,
471 			  &iter_data);
472 
473 	/*
474 	 * If there is at least one AP on radar channel that cannot
475 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
476 	 */
477 	return !iter_data.tolerated;
478 }
479 
480 static void
481 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
482 			struct mt7915_phy *phy)
483 {
484 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
485 	struct bss_info_rf_ch *ch;
486 	struct tlv *tlv;
487 	int freq1 = chandef->center_freq1;
488 
489 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
490 
491 	ch = (struct bss_info_rf_ch *)tlv;
492 	ch->pri_ch = chandef->chan->hw_value;
493 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
494 	ch->bw = mt76_connac_chan_bw(chandef);
495 
496 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
497 		int freq2 = chandef->center_freq2;
498 
499 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
500 	}
501 
502 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
503 		struct mt76_phy *mphy = phy->mt76;
504 
505 		ch->he_ru26_block =
506 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
507 		ch->he_all_disable = false;
508 	} else {
509 		ch->he_all_disable = true;
510 	}
511 }
512 
513 static void
514 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
515 		      struct mt7915_phy *phy)
516 {
517 	int max_nss = hweight8(phy->mt76->antenna_mask);
518 	struct bss_info_ra *ra;
519 	struct tlv *tlv;
520 
521 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
522 
523 	ra = (struct bss_info_ra *)tlv;
524 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
525 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
526 	ra->short_preamble = true;
527 	ra->tx_streams = max_nss;
528 	ra->rx_streams = max_nss;
529 	ra->algo = 4;
530 	ra->train_up_rule = 2;
531 	ra->train_up_high_thres = 110;
532 	ra->train_up_rule_rssi = -70;
533 	ra->low_traffic_thres = 2;
534 	ra->phy_cap = cpu_to_le32(0xfdf);
535 	ra->interval = cpu_to_le32(500);
536 	ra->fast_interval = cpu_to_le32(100);
537 }
538 
539 static void
540 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
541 		      struct mt7915_phy *phy)
542 {
543 #define DEFAULT_HE_PE_DURATION		4
544 #define DEFAULT_HE_DURATION_RTS_THRES	1023
545 	const struct ieee80211_sta_he_cap *cap;
546 	struct bss_info_he *he;
547 	struct tlv *tlv;
548 
549 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
550 
551 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
552 
553 	he = (struct bss_info_he *)tlv;
554 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
555 	if (!he->he_pe_duration)
556 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
557 
558 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
559 	if (!he->he_rts_thres)
560 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
561 
562 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
563 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
564 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
565 }
566 
567 static void
568 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
569 {
570 #define TXD_CMP_MAP1		GENMASK(15, 0)
571 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
572 	struct bss_info_hw_amsdu *amsdu;
573 	struct tlv *tlv;
574 
575 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
576 
577 	amsdu = (struct bss_info_hw_amsdu *)tlv;
578 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
579 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
580 	amsdu->trig_thres = cpu_to_le16(2);
581 	amsdu->enable = true;
582 }
583 
584 static void
585 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
586 {
587 	struct bss_info_bmc_rate *bmc;
588 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
589 	enum nl80211_band band = chandef->chan->band;
590 	struct tlv *tlv;
591 
592 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
593 
594 	bmc = (struct bss_info_bmc_rate *)tlv;
595 	if (band == NL80211_BAND_2GHZ) {
596 		bmc->short_preamble = true;
597 	} else {
598 		bmc->bc_trans = cpu_to_le16(0x2000);
599 		bmc->mc_trans = cpu_to_le16(0x2080);
600 	}
601 }
602 
603 static int
604 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
605 		       bool bssid, bool enable)
606 {
607 	struct mt7915_dev *dev = phy->dev;
608 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
609 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
610 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
611 	const u8 *addr = vif->addr;
612 	struct {
613 		u8 mode;
614 		u8 force_clear;
615 		u8 clear_bitmap[8];
616 		u8 entry_count;
617 		u8 write;
618 		u8 band;
619 
620 		u8 index;
621 		u8 bssid;
622 		u8 addr[ETH_ALEN];
623 	} __packed req = {
624 		.mode = !!mask || enable,
625 		.entry_count = 1,
626 		.write = 1,
627 		.band = phy->mt76->band_idx,
628 		.index = idx * 2 + bssid,
629 	};
630 
631 	if (bssid)
632 		addr = vif->bss_conf.bssid;
633 
634 	if (enable)
635 		ether_addr_copy(req.addr, addr);
636 
637 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
638 				 sizeof(req), true);
639 }
640 
641 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
642 			    struct ieee80211_vif *vif, int enable)
643 {
644 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
645 	struct mt7915_dev *dev = phy->dev;
646 	struct sk_buff *skb;
647 
648 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
649 		mt7915_mcu_muar_config(phy, vif, false, enable);
650 		mt7915_mcu_muar_config(phy, vif, true, enable);
651 	}
652 
653 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
654 					      MT7915_BSS_UPDATE_MAX_SIZE);
655 	if (IS_ERR(skb))
656 		return PTR_ERR(skb);
657 
658 	/* bss_omac must be first */
659 	if (enable)
660 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
661 
662 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
663 				      mvif->sta.wcid.idx, enable);
664 
665 	if (vif->type == NL80211_IFTYPE_MONITOR)
666 		goto out;
667 
668 	if (enable) {
669 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
670 		mt7915_mcu_bss_bmc_tlv(skb, phy);
671 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
672 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
673 
674 		if (vif->bss_conf.he_support)
675 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
676 
677 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
678 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
679 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
680 	}
681 out:
682 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
683 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
684 }
685 
686 /** starec & wtbl **/
687 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
688 			 struct ieee80211_ampdu_params *params,
689 			 bool enable)
690 {
691 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
692 	struct mt7915_vif *mvif = msta->vif;
693 
694 	if (enable && !params->amsdu)
695 		msta->wcid.amsdu = false;
696 
697 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
698 				      MCU_EXT_CMD(STA_REC_UPDATE),
699 				      enable, true);
700 }
701 
702 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
703 			 struct ieee80211_ampdu_params *params,
704 			 bool enable)
705 {
706 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
707 	struct mt7915_vif *mvif = msta->vif;
708 
709 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
710 				      MCU_EXT_CMD(STA_REC_UPDATE),
711 				      enable, false);
712 }
713 
714 static void
715 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
716 		      struct ieee80211_vif *vif)
717 {
718 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
719 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
720 	struct ieee80211_he_mcs_nss_supp mcs_map;
721 	struct sta_rec_he *he;
722 	struct tlv *tlv;
723 	u32 cap = 0;
724 
725 	if (!sta->deflink.he_cap.has_he)
726 		return;
727 
728 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
729 
730 	he = (struct sta_rec_he *)tlv;
731 
732 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
733 		cap |= STA_REC_HE_CAP_HTC;
734 
735 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
736 		cap |= STA_REC_HE_CAP_BSR;
737 
738 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
739 		cap |= STA_REC_HE_CAP_OM;
740 
741 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
742 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
743 
744 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
745 		cap |= STA_REC_HE_CAP_BQR;
746 
747 	if (elem->phy_cap_info[0] &
748 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
749 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
750 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
751 
752 	if (mvif->cap.he_ldpc &&
753 	    (elem->phy_cap_info[1] &
754 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
755 		cap |= STA_REC_HE_CAP_LDPC;
756 
757 	if (elem->phy_cap_info[1] &
758 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
759 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
760 
761 	if (elem->phy_cap_info[2] &
762 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
763 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
764 
765 	if (elem->phy_cap_info[2] &
766 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
767 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
768 
769 	if (elem->phy_cap_info[2] &
770 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
771 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
772 
773 	if (elem->phy_cap_info[6] &
774 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
775 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
776 
777 	if (elem->phy_cap_info[6] &
778 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
779 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
780 
781 	if (elem->phy_cap_info[7] &
782 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
783 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
784 
785 	if (elem->phy_cap_info[7] &
786 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
787 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
788 
789 	if (elem->phy_cap_info[7] &
790 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
791 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
792 
793 	if (elem->phy_cap_info[8] &
794 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
795 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
796 
797 	if (elem->phy_cap_info[8] &
798 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
799 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
800 
801 	if (elem->phy_cap_info[9] &
802 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
803 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
804 
805 	if (elem->phy_cap_info[9] &
806 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
807 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
808 
809 	he->he_cap = cpu_to_le32(cap);
810 
811 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
812 	switch (sta->deflink.bandwidth) {
813 	case IEEE80211_STA_RX_BW_160:
814 		if (elem->phy_cap_info[0] &
815 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
816 			mt7915_mcu_set_sta_he_mcs(sta,
817 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
818 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
819 
820 		mt7915_mcu_set_sta_he_mcs(sta,
821 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
822 					  le16_to_cpu(mcs_map.rx_mcs_160));
823 		fallthrough;
824 	default:
825 		mt7915_mcu_set_sta_he_mcs(sta,
826 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
827 					  le16_to_cpu(mcs_map.rx_mcs_80));
828 		break;
829 	}
830 
831 	he->t_frame_dur =
832 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
833 	he->max_ampdu_exp =
834 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
835 
836 	he->bw_set =
837 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
838 	he->device_class =
839 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
840 	he->punc_pream_rx =
841 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
842 
843 	he->dcm_tx_mode =
844 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
845 	he->dcm_tx_max_nss =
846 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
847 	he->dcm_rx_mode =
848 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
849 	he->dcm_rx_max_nss =
850 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
851 	he->dcm_rx_max_nss =
852 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
853 
854 	he->pkt_ext = 2;
855 }
856 
857 static void
858 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
859 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
860 {
861 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
862 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
863 	struct sta_rec_muru *muru;
864 	struct tlv *tlv;
865 
866 	if (vif->type != NL80211_IFTYPE_STATION &&
867 	    vif->type != NL80211_IFTYPE_AP)
868 		return;
869 
870 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
871 
872 	muru = (struct sta_rec_muru *)tlv;
873 
874 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
875 			       mvif->cap.vht_mu_ebfer ||
876 			       mvif->cap.vht_mu_ebfee;
877 	if (!is_mt7915(&dev->mt76))
878 		muru->cfg.mimo_ul_en = true;
879 	muru->cfg.ofdma_dl_en = true;
880 
881 	if (sta->deflink.vht_cap.vht_supported)
882 		muru->mimo_dl.vht_mu_bfee =
883 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
884 
885 	if (!sta->deflink.he_cap.has_he)
886 		return;
887 
888 	muru->mimo_dl.partial_bw_dl_mimo =
889 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
890 
891 	muru->mimo_ul.full_ul_mimo =
892 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
893 	muru->mimo_ul.partial_ul_mimo =
894 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
895 
896 	muru->ofdma_dl.punc_pream_rx =
897 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
898 	muru->ofdma_dl.he_20m_in_40m_2g =
899 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
900 	muru->ofdma_dl.he_20m_in_160m =
901 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
902 	muru->ofdma_dl.he_80m_in_160m =
903 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
904 
905 	muru->ofdma_ul.t_frame_dur =
906 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
907 	muru->ofdma_ul.mu_cascading =
908 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
909 	muru->ofdma_ul.uo_ra =
910 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
911 	muru->ofdma_ul.rx_ctrl_frame_to_mbss =
912 		HE_MAC(CAP3_RX_CTRL_FRAME_TO_MULTIBSS, elem->mac_cap_info[3]);
913 }
914 
915 static void
916 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
917 {
918 	struct sta_rec_ht *ht;
919 	struct tlv *tlv;
920 
921 	if (!sta->deflink.ht_cap.ht_supported)
922 		return;
923 
924 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
925 
926 	ht = (struct sta_rec_ht *)tlv;
927 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
928 }
929 
930 static void
931 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
932 {
933 	struct sta_rec_vht *vht;
934 	struct tlv *tlv;
935 
936 	if (!sta->deflink.vht_cap.vht_supported)
937 		return;
938 
939 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
940 
941 	vht = (struct sta_rec_vht *)tlv;
942 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
943 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
944 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
945 }
946 
947 static void
948 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
949 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
950 {
951 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
952 	struct sta_rec_amsdu *amsdu;
953 	struct tlv *tlv;
954 
955 	if (vif->type != NL80211_IFTYPE_STATION &&
956 	    vif->type != NL80211_IFTYPE_AP)
957 		return;
958 
959 	if (!sta->deflink.agg.max_amsdu_len)
960 	    return;
961 
962 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
963 	amsdu = (struct sta_rec_amsdu *)tlv;
964 	amsdu->max_amsdu_num = 8;
965 	amsdu->amsdu_en = true;
966 	msta->wcid.amsdu = true;
967 
968 	switch (sta->deflink.agg.max_amsdu_len) {
969 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
970 		if (!is_mt7915(&dev->mt76)) {
971 			amsdu->max_mpdu_size =
972 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
973 			return;
974 		}
975 		fallthrough;
976 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
977 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
978 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
979 		return;
980 	default:
981 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
982 		return;
983 	}
984 }
985 
986 static int
987 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
988 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
989 {
990 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
991 	struct mt7915_sta *msta;
992 	struct wtbl_req_hdr *wtbl_hdr;
993 	struct mt76_wcid *wcid;
994 	struct tlv *tlv;
995 
996 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
997 	wcid = sta ? &msta->wcid : NULL;
998 
999 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1000 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1001 						  WTBL_RESET_AND_SET, tlv,
1002 						  &skb);
1003 	if (IS_ERR(wtbl_hdr))
1004 		return PTR_ERR(wtbl_hdr);
1005 
1006 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1007 					 wtbl_hdr);
1008 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1009 	if (sta)
1010 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1011 					    wtbl_hdr, mvif->cap.ht_ldpc,
1012 					    mvif->cap.vht_ldpc);
1013 
1014 	return 0;
1015 }
1016 
1017 static inline bool
1018 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1019 			struct ieee80211_sta *sta, bool bfee)
1020 {
1021 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1022 	int sts = hweight16(phy->mt76->chainmask);
1023 
1024 	if (vif->type != NL80211_IFTYPE_STATION &&
1025 	    vif->type != NL80211_IFTYPE_AP)
1026 		return false;
1027 
1028 	if (!bfee && sts < 2)
1029 		return false;
1030 
1031 	if (sta->deflink.he_cap.has_he) {
1032 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1033 
1034 		if (bfee)
1035 			return mvif->cap.he_su_ebfee &&
1036 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1037 		else
1038 			return mvif->cap.he_su_ebfer &&
1039 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1040 	}
1041 
1042 	if (sta->deflink.vht_cap.vht_supported) {
1043 		u32 cap = sta->deflink.vht_cap.cap;
1044 
1045 		if (bfee)
1046 			return mvif->cap.vht_su_ebfee &&
1047 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1048 		else
1049 			return mvif->cap.vht_su_ebfer &&
1050 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1051 	}
1052 
1053 	return false;
1054 }
1055 
1056 static void
1057 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1058 {
1059 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1060 	bf->ndp_rate = 0;				/* mcs0 */
1061 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1062 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1063 }
1064 
1065 static void
1066 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1067 		       struct sta_rec_bf *bf)
1068 {
1069 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1070 	u8 n = 0;
1071 
1072 	bf->tx_mode = MT_PHY_TYPE_HT;
1073 
1074 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1075 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1076 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1077 			      mcs->tx_params);
1078 	else if (mcs->rx_mask[3])
1079 		n = 3;
1080 	else if (mcs->rx_mask[2])
1081 		n = 2;
1082 	else if (mcs->rx_mask[1])
1083 		n = 1;
1084 
1085 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1086 	bf->ncol = min_t(u8, bf->nrow, n);
1087 	bf->ibf_ncol = n;
1088 }
1089 
1090 static void
1091 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1092 			struct sta_rec_bf *bf, bool explicit)
1093 {
1094 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1095 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1096 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1097 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1098 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1099 
1100 	bf->tx_mode = MT_PHY_TYPE_VHT;
1101 
1102 	if (explicit) {
1103 		u8 sts, snd_dim;
1104 
1105 		mt7915_mcu_sta_sounding_rate(bf);
1106 
1107 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1108 				pc->cap);
1109 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1110 				    vc->cap);
1111 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1112 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1113 		bf->ibf_ncol = bf->ncol;
1114 
1115 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1116 			bf->nrow = 1;
1117 	} else {
1118 		bf->nrow = tx_ant;
1119 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1120 		bf->ibf_ncol = nss_mcs;
1121 
1122 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1123 			bf->ibf_nrow = 1;
1124 	}
1125 }
1126 
1127 static void
1128 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1129 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1130 {
1131 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1132 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1133 	const struct ieee80211_sta_he_cap *vc =
1134 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1135 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1136 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1137 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1138 	u8 snd_dim, sts;
1139 
1140 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1141 
1142 	mt7915_mcu_sta_sounding_rate(bf);
1143 
1144 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1145 				pe->phy_cap_info[6]);
1146 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1147 				pe->phy_cap_info[6]);
1148 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1149 			 ve->phy_cap_info[5]);
1150 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1151 		     pe->phy_cap_info[4]);
1152 	bf->nrow = min_t(u8, snd_dim, sts);
1153 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1154 	bf->ibf_ncol = bf->ncol;
1155 
1156 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1157 		return;
1158 
1159 	/* go over for 160MHz and 80p80 */
1160 	if (pe->phy_cap_info[0] &
1161 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1162 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1163 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1164 
1165 		bf->ncol_gt_bw80 = nss_mcs;
1166 	}
1167 
1168 	if (pe->phy_cap_info[0] &
1169 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1170 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1171 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1172 
1173 		if (bf->ncol_gt_bw80)
1174 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1175 		else
1176 			bf->ncol_gt_bw80 = nss_mcs;
1177 	}
1178 
1179 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1180 			 ve->phy_cap_info[5]);
1181 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1182 		     pe->phy_cap_info[4]);
1183 
1184 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1185 }
1186 
1187 static void
1188 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1189 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1190 {
1191 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1192 	struct mt7915_phy *phy = mvif->phy;
1193 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1194 	struct sta_rec_bf *bf;
1195 	struct tlv *tlv;
1196 	static const u8 matrix[4][4] = {
1197 		{0, 0, 0, 0},
1198 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1199 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1200 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1201 	};
1202 	bool ebf;
1203 
1204 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1205 		return;
1206 
1207 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1208 	if (!ebf && !dev->ibf)
1209 		return;
1210 
1211 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1212 	bf = (struct sta_rec_bf *)tlv;
1213 
1214 	/* he: eBF only, in accordance with spec
1215 	 * vht: support eBF and iBF
1216 	 * ht: iBF only, since mac80211 lacks of eBF support
1217 	 */
1218 	if (sta->deflink.he_cap.has_he && ebf)
1219 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1220 	else if (sta->deflink.vht_cap.vht_supported)
1221 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1222 	else if (sta->deflink.ht_cap.ht_supported)
1223 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1224 	else
1225 		return;
1226 
1227 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1228 	bf->bw = sta->deflink.bandwidth;
1229 	bf->ibf_dbw = sta->deflink.bandwidth;
1230 	bf->ibf_nrow = tx_ant;
1231 
1232 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1233 		bf->ibf_timeout = 0x48;
1234 	else
1235 		bf->ibf_timeout = 0x18;
1236 
1237 	if (ebf && bf->nrow != tx_ant)
1238 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1239 	else
1240 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1241 
1242 	switch (sta->deflink.bandwidth) {
1243 	case IEEE80211_STA_RX_BW_160:
1244 	case IEEE80211_STA_RX_BW_80:
1245 		bf->mem_total = bf->mem_20m * 2;
1246 		break;
1247 	case IEEE80211_STA_RX_BW_40:
1248 		bf->mem_total = bf->mem_20m;
1249 		break;
1250 	case IEEE80211_STA_RX_BW_20:
1251 	default:
1252 		break;
1253 	}
1254 }
1255 
1256 static void
1257 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1258 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1259 {
1260 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1261 	struct mt7915_phy *phy = mvif->phy;
1262 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1263 	struct sta_rec_bfee *bfee;
1264 	struct tlv *tlv;
1265 	u8 nrow = 0;
1266 
1267 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1268 		return;
1269 
1270 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1271 		return;
1272 
1273 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1274 	bfee = (struct sta_rec_bfee *)tlv;
1275 
1276 	if (sta->deflink.he_cap.has_he) {
1277 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1278 
1279 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1280 			      pe->phy_cap_info[5]);
1281 	} else if (sta->deflink.vht_cap.vht_supported) {
1282 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1283 
1284 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1285 				 pc->cap);
1286 	}
1287 
1288 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1289 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1290 }
1291 
1292 static enum mcu_mmps_mode
1293 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1294 {
1295 	switch (smps) {
1296 	case IEEE80211_SMPS_OFF:
1297 		return MCU_MMPS_DISABLE;
1298 	case IEEE80211_SMPS_STATIC:
1299 		return MCU_MMPS_STATIC;
1300 	case IEEE80211_SMPS_DYNAMIC:
1301 		return MCU_MMPS_DYNAMIC;
1302 	default:
1303 		return MCU_MMPS_DISABLE;
1304 	}
1305 }
1306 
1307 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1308 				   struct ieee80211_vif *vif,
1309 				   struct ieee80211_sta *sta,
1310 				   void *data, u32 field)
1311 {
1312 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1313 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1314 	struct sta_phy *phy = data;
1315 	struct sta_rec_ra_fixed *ra;
1316 	struct sk_buff *skb;
1317 	struct tlv *tlv;
1318 
1319 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1320 					    &msta->wcid);
1321 	if (IS_ERR(skb))
1322 		return PTR_ERR(skb);
1323 
1324 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1325 	ra = (struct sta_rec_ra_fixed *)tlv;
1326 
1327 	switch (field) {
1328 	case RATE_PARAM_AUTO:
1329 		break;
1330 	case RATE_PARAM_FIXED:
1331 	case RATE_PARAM_FIXED_MCS:
1332 	case RATE_PARAM_FIXED_GI:
1333 	case RATE_PARAM_FIXED_HE_LTF:
1334 		if (phy)
1335 			ra->phy = *phy;
1336 		break;
1337 	case RATE_PARAM_MMPS_UPDATE:
1338 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1339 		break;
1340 	case RATE_PARAM_SPE_UPDATE:
1341 		ra->spe_idx = *(u8 *)data;
1342 		break;
1343 	default:
1344 		break;
1345 	}
1346 	ra->field = cpu_to_le32(field);
1347 
1348 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1349 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1350 }
1351 
1352 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1353 			struct ieee80211_sta *sta)
1354 {
1355 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1356 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1357 	struct wtbl_req_hdr *wtbl_hdr;
1358 	struct tlv *sta_wtbl;
1359 	struct sk_buff *skb;
1360 	int ret;
1361 
1362 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1363 					    &msta->wcid);
1364 	if (IS_ERR(skb))
1365 		return PTR_ERR(skb);
1366 
1367 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1368 					   sizeof(struct tlv));
1369 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1370 						  WTBL_SET, sta_wtbl, &skb);
1371 	if (IS_ERR(wtbl_hdr))
1372 		return PTR_ERR(wtbl_hdr);
1373 
1374 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1375 
1376 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1377 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1378 	if (ret)
1379 		return ret;
1380 
1381 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1382 					      RATE_PARAM_MMPS_UPDATE);
1383 }
1384 
1385 static int
1386 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1387 		       struct ieee80211_sta *sta)
1388 {
1389 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1390 	struct mt76_phy *mphy = mvif->phy->mt76;
1391 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1392 
1393 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1394 					      RATE_PARAM_SPE_UPDATE);
1395 }
1396 
1397 static int
1398 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1399 			       struct ieee80211_vif *vif,
1400 			       struct ieee80211_sta *sta)
1401 {
1402 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1403 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1404 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1405 	enum nl80211_band band = chandef->chan->band;
1406 	struct sta_phy phy = {};
1407 	int ret, nrates = 0;
1408 
1409 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1410 	do {									\
1411 		u8 i, gi = mask->control[band]._gi;				\
1412 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1413 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1414 			phy.sgi |= gi << (i << (_he));				\
1415 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1416 		}								\
1417 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1418 			if (!mask->control[band]._mcs[i])			\
1419 				continue;					\
1420 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1421 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1422 			if (_ht)						\
1423 				phy.mcs += 8 * i;				\
1424 		}								\
1425 	} while (0)
1426 
1427 	if (sta->deflink.he_cap.has_he) {
1428 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1429 	} else if (sta->deflink.vht_cap.vht_supported) {
1430 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1431 	} else if (sta->deflink.ht_cap.ht_supported) {
1432 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1433 	} else {
1434 		nrates = hweight32(mask->control[band].legacy);
1435 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1436 	}
1437 #undef __sta_phy_bitrate_mask_check
1438 
1439 	/* fall back to auto rate control */
1440 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1441 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1442 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1443 	    nrates != 1)
1444 		return 0;
1445 
1446 	/* fixed single rate */
1447 	if (nrates == 1) {
1448 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1449 						     RATE_PARAM_FIXED_MCS);
1450 		if (ret)
1451 			return ret;
1452 	}
1453 
1454 	/* fixed GI */
1455 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1456 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1457 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1458 		u32 addr;
1459 
1460 		/* firmware updates only TXCMD but doesn't take WTBL into
1461 		 * account, so driver should update here to reflect the
1462 		 * actual txrate hardware sends out.
1463 		 */
1464 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1465 		if (sta->deflink.he_cap.has_he)
1466 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1467 		else
1468 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1469 
1470 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1471 						     RATE_PARAM_FIXED_GI);
1472 		if (ret)
1473 			return ret;
1474 	}
1475 
1476 	/* fixed HE_LTF */
1477 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1478 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1479 						     RATE_PARAM_FIXED_HE_LTF);
1480 		if (ret)
1481 			return ret;
1482 	}
1483 
1484 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1485 }
1486 
1487 static void
1488 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1489 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1490 {
1491 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1492 	struct mt76_phy *mphy = mvif->phy->mt76;
1493 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1494 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1495 	enum nl80211_band band = chandef->chan->band;
1496 	struct sta_rec_ra *ra;
1497 	struct tlv *tlv;
1498 	u32 supp_rate = sta->deflink.supp_rates[band];
1499 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1500 
1501 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1502 	ra = (struct sta_rec_ra *)tlv;
1503 
1504 	ra->valid = true;
1505 	ra->auto_rate = true;
1506 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, &sta->deflink);
1507 	ra->channel = chandef->chan->hw_value;
1508 	ra->bw = sta->deflink.bandwidth;
1509 	ra->phy.bw = sta->deflink.bandwidth;
1510 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1511 
1512 	if (supp_rate) {
1513 		supp_rate &= mask->control[band].legacy;
1514 		ra->rate_len = hweight32(supp_rate);
1515 
1516 		if (band == NL80211_BAND_2GHZ) {
1517 			ra->supp_mode = MODE_CCK;
1518 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1519 
1520 			if (ra->rate_len > 4) {
1521 				ra->supp_mode |= MODE_OFDM;
1522 				ra->supp_ofdm_rate = supp_rate >> 4;
1523 			}
1524 		} else {
1525 			ra->supp_mode = MODE_OFDM;
1526 			ra->supp_ofdm_rate = supp_rate;
1527 		}
1528 	}
1529 
1530 	if (sta->deflink.ht_cap.ht_supported) {
1531 		ra->supp_mode |= MODE_HT;
1532 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1533 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1534 
1535 		cap |= STA_CAP_HT;
1536 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1537 			cap |= STA_CAP_SGI_20;
1538 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1539 			cap |= STA_CAP_SGI_40;
1540 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1541 			cap |= STA_CAP_TX_STBC;
1542 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1543 			cap |= STA_CAP_RX_STBC;
1544 		if (mvif->cap.ht_ldpc &&
1545 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1546 			cap |= STA_CAP_LDPC;
1547 
1548 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1549 					  mask->control[band].ht_mcs);
1550 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1551 	}
1552 
1553 	if (sta->deflink.vht_cap.vht_supported) {
1554 		u8 af;
1555 
1556 		ra->supp_mode |= MODE_VHT;
1557 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1558 			       sta->deflink.vht_cap.cap);
1559 		ra->af = max_t(u8, ra->af, af);
1560 
1561 		cap |= STA_CAP_VHT;
1562 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1563 			cap |= STA_CAP_VHT_SGI_80;
1564 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1565 			cap |= STA_CAP_VHT_SGI_160;
1566 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1567 			cap |= STA_CAP_VHT_TX_STBC;
1568 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1569 			cap |= STA_CAP_VHT_RX_STBC;
1570 		if (mvif->cap.vht_ldpc &&
1571 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1572 			cap |= STA_CAP_VHT_LDPC;
1573 
1574 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1575 					   mask->control[band].vht_mcs);
1576 	}
1577 
1578 	if (sta->deflink.he_cap.has_he) {
1579 		ra->supp_mode |= MODE_HE;
1580 		cap |= STA_CAP_HE;
1581 
1582 		if (sta->deflink.he_6ghz_capa.capa)
1583 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1584 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1585 	}
1586 
1587 	ra->sta_cap = cpu_to_le32(cap);
1588 }
1589 
1590 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1591 			     struct ieee80211_sta *sta, bool changed)
1592 {
1593 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1594 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1595 	struct sk_buff *skb;
1596 	int ret;
1597 
1598 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1599 					    &msta->wcid);
1600 	if (IS_ERR(skb))
1601 		return PTR_ERR(skb);
1602 
1603 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1604 	 * once dev->rc_work changes the settings driver should also
1605 	 * update sta_rec_he here.
1606 	 */
1607 	if (changed)
1608 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1609 
1610 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1611 	 * i.e 0-{7,8,9} for VHT.
1612 	 */
1613 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1614 
1615 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1616 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1617 	if (ret)
1618 		return ret;
1619 
1620 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1621 	 * and updates as peer fixed rate parameters, which overrides
1622 	 * sta_rec_ra and firmware rate control algorithm.
1623 	 */
1624 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1625 }
1626 
1627 static int
1628 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1629 		     struct ieee80211_sta *sta)
1630 {
1631 #define MT_STA_BSS_GROUP		1
1632 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1633 	struct mt7915_sta *msta;
1634 	struct {
1635 		__le32 action;
1636 		u8 wlan_idx_lo;
1637 		u8 status;
1638 		u8 wlan_idx_hi;
1639 		u8 rsv0[5];
1640 		__le32 val;
1641 		u8 rsv1[8];
1642 	} __packed req = {
1643 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1644 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1645 	};
1646 
1647 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1648 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1649 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1650 
1651 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1652 				 sizeof(req), true);
1653 }
1654 
1655 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1656 		       struct ieee80211_sta *sta, bool enable)
1657 {
1658 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1659 	struct ieee80211_link_sta *link_sta;
1660 	struct mt7915_sta *msta;
1661 	struct sk_buff *skb;
1662 	int ret;
1663 
1664 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1665 	link_sta = sta ? &sta->deflink : NULL;
1666 
1667 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1668 					    &msta->wcid);
1669 	if (IS_ERR(skb))
1670 		return PTR_ERR(skb);
1671 
1672 	/* starec basic */
1673 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, link_sta, enable,
1674 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1675 	if (!enable)
1676 		goto out;
1677 
1678 	/* tag order is in accordance with firmware dependency. */
1679 	if (sta) {
1680 		/* starec bfer */
1681 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1682 		/* starec ht */
1683 		mt7915_mcu_sta_ht_tlv(skb, sta);
1684 		/* starec vht */
1685 		mt7915_mcu_sta_vht_tlv(skb, sta);
1686 		/* starec uapsd */
1687 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1688 	}
1689 
1690 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1691 	if (ret) {
1692 		dev_kfree_skb(skb);
1693 		return ret;
1694 	}
1695 
1696 	if (sta) {
1697 		/* starec amsdu */
1698 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1699 		/* starec he */
1700 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1701 		/* starec muru */
1702 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1703 		/* starec bfee */
1704 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1705 	}
1706 
1707 	ret = mt7915_mcu_add_group(dev, vif, sta);
1708 	if (ret) {
1709 		dev_kfree_skb(skb);
1710 		return ret;
1711 	}
1712 out:
1713 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1714 	if (ret)
1715 		return ret;
1716 
1717 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1718 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1719 }
1720 
1721 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1722 {
1723 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1724 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1725 	struct {
1726 		__le32 args[2];
1727 	} req = {
1728 		.args[0] = cpu_to_le32(1),
1729 		.args[1] = cpu_to_le32(6),
1730 	};
1731 
1732 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1733 					 &req, sizeof(req));
1734 #else
1735 	return 0;
1736 #endif
1737 }
1738 
1739 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1740 			    struct ieee80211_vif *vif, bool enable)
1741 {
1742 	struct mt7915_dev *dev = phy->dev;
1743 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1744 	struct {
1745 		struct req_hdr {
1746 			u8 omac_idx;
1747 			u8 band_idx;
1748 			__le16 tlv_num;
1749 			u8 is_tlv_append;
1750 			u8 rsv[3];
1751 		} __packed hdr;
1752 		struct req_tlv {
1753 			__le16 tag;
1754 			__le16 len;
1755 			u8 active;
1756 			u8 band_idx;
1757 			u8 omac_addr[ETH_ALEN];
1758 		} __packed tlv;
1759 	} data = {
1760 		.hdr = {
1761 			.omac_idx = mvif->mt76.omac_idx,
1762 			.band_idx = mvif->mt76.band_idx,
1763 			.tlv_num = cpu_to_le16(1),
1764 			.is_tlv_append = 1,
1765 		},
1766 		.tlv = {
1767 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1768 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1769 			.active = enable,
1770 			.band_idx = mvif->mt76.band_idx,
1771 		},
1772 	};
1773 
1774 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1775 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1776 
1777 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1778 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1779 				 &data, sizeof(data), true);
1780 }
1781 
1782 static void
1783 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1784 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1785 			 struct ieee80211_mutable_offsets *offs)
1786 {
1787 	struct bss_info_bcn_cntdwn *info;
1788 	struct tlv *tlv;
1789 	int sub_tag;
1790 
1791 	if (!offs->cntdwn_counter_offs[0])
1792 		return;
1793 
1794 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1795 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1796 					   &bcn->sub_ntlv, &bcn->len);
1797 	info = (struct bss_info_bcn_cntdwn *)tlv;
1798 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1799 }
1800 
1801 static void
1802 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1803 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1804 		       struct ieee80211_mutable_offsets *offs)
1805 {
1806 	struct bss_info_bcn_mbss *mbss;
1807 	const struct element *elem;
1808 	struct tlv *tlv;
1809 
1810 	if (!vif->bss_conf.bssid_indicator)
1811 		return;
1812 
1813 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1814 					   sizeof(*mbss), &bcn->sub_ntlv,
1815 					   &bcn->len);
1816 
1817 	mbss = (struct bss_info_bcn_mbss *)tlv;
1818 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1819 	mbss->bitmap = cpu_to_le32(1);
1820 
1821 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1822 			    &skb->data[offs->mbssid_off],
1823 			    skb->len - offs->mbssid_off) {
1824 		const struct element *sub_elem;
1825 
1826 		if (elem->datalen < 2)
1827 			continue;
1828 
1829 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1830 			const struct ieee80211_bssid_index *idx;
1831 			const u8 *idx_ie;
1832 
1833 			if (sub_elem->id || sub_elem->datalen < 4)
1834 				continue; /* not a valid BSS profile */
1835 
1836 			/* Find WLAN_EID_MULTI_BSSID_IDX
1837 			 * in the merged nontransmitted profile
1838 			 */
1839 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1840 						  sub_elem->data,
1841 						  sub_elem->datalen);
1842 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1843 				continue;
1844 
1845 			idx = (void *)(idx_ie + 2);
1846 			if (!idx->bssid_index || idx->bssid_index > 31)
1847 				continue;
1848 
1849 			mbss->offset[idx->bssid_index] =
1850 				cpu_to_le16(idx_ie - skb->data);
1851 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1852 		}
1853 	}
1854 }
1855 
1856 static void
1857 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1858 		       struct sk_buff *rskb, struct sk_buff *skb,
1859 		       struct bss_info_bcn *bcn,
1860 		       struct ieee80211_mutable_offsets *offs)
1861 {
1862 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1863 	struct bss_info_bcn_cont *cont;
1864 	struct tlv *tlv;
1865 	u8 *buf;
1866 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1867 
1868 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1869 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1870 					   len, &bcn->sub_ntlv, &bcn->len);
1871 
1872 	cont = (struct bss_info_bcn_cont *)tlv;
1873 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1874 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1875 
1876 	if (offs->cntdwn_counter_offs[0]) {
1877 		u16 offset = offs->cntdwn_counter_offs[0];
1878 
1879 		if (vif->bss_conf.csa_active)
1880 			cont->csa_ofs = cpu_to_le16(offset - 4);
1881 		if (vif->bss_conf.color_change_active)
1882 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1883 	}
1884 
1885 	buf = (u8 *)tlv + sizeof(*cont);
1886 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1887 			      0, BSS_CHANGED_BEACON);
1888 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1889 }
1890 
1891 int
1892 mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1893 			     u32 changed)
1894 {
1895 #define OFFLOAD_TX_MODE_SU	BIT(0)
1896 #define OFFLOAD_TX_MODE_MU	BIT(1)
1897 	struct ieee80211_hw *hw = mt76_hw(dev);
1898 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1899 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1900 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1901 	enum nl80211_band band = chandef->chan->band;
1902 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1903 	struct bss_info_bcn *bcn;
1904 	struct bss_info_inband_discovery *discov;
1905 	struct ieee80211_tx_info *info;
1906 	struct sk_buff *rskb, *skb = NULL;
1907 	struct tlv *tlv, *sub_tlv;
1908 	bool ext_phy = phy != &dev->phy;
1909 	u8 *buf, interval;
1910 	int len;
1911 
1912 	if (vif->bss_conf.nontransmitted)
1913 		return 0;
1914 
1915 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
1916 					       MT7915_MAX_BSS_OFFLOAD_SIZE);
1917 	if (IS_ERR(rskb))
1918 		return PTR_ERR(rskb);
1919 
1920 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1921 	bcn = (struct bss_info_bcn *)tlv;
1922 	bcn->enable = true;
1923 
1924 	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
1925 		interval = vif->bss_conf.fils_discovery.max_interval;
1926 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1927 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1928 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1929 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1930 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1931 	}
1932 
1933 	if (!skb) {
1934 		dev_kfree_skb(rskb);
1935 		return -EINVAL;
1936 	}
1937 
1938 	info = IEEE80211_SKB_CB(skb);
1939 	info->control.vif = vif;
1940 	info->band = band;
1941 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1942 
1943 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1944 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1945 
1946 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
1947 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1948 		dev_kfree_skb(rskb);
1949 		dev_kfree_skb(skb);
1950 		return -EINVAL;
1951 	}
1952 
1953 	sub_tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1954 					       len, &bcn->sub_ntlv, &bcn->len);
1955 	discov = (struct bss_info_inband_discovery *)sub_tlv;
1956 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1957 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1958 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1959 	discov->tx_interval = interval;
1960 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1961 	discov->enable = !!interval;
1962 
1963 	buf = (u8 *)sub_tlv + sizeof(*discov);
1964 
1965 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1966 			      0, changed);
1967 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1968 
1969 	dev_kfree_skb(skb);
1970 
1971 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
1972 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1973 }
1974 
1975 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1976 			  int en, u32 changed)
1977 {
1978 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1979 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1980 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1981 	struct ieee80211_mutable_offsets offs;
1982 	struct ieee80211_tx_info *info;
1983 	struct sk_buff *skb, *rskb;
1984 	struct tlv *tlv;
1985 	struct bss_info_bcn *bcn;
1986 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
1987 	bool ext_phy = phy != &dev->phy;
1988 
1989 	if (vif->bss_conf.nontransmitted)
1990 		return 0;
1991 
1992 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1993 					       NULL, len);
1994 	if (IS_ERR(rskb))
1995 		return PTR_ERR(rskb);
1996 
1997 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1998 	bcn = (struct bss_info_bcn *)tlv;
1999 	bcn->enable = en;
2000 
2001 	if (!en)
2002 		goto out;
2003 
2004 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
2005 	if (!skb) {
2006 		dev_kfree_skb(rskb);
2007 		return -EINVAL;
2008 	}
2009 
2010 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
2011 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2012 		dev_kfree_skb(rskb);
2013 		dev_kfree_skb(skb);
2014 		return -EINVAL;
2015 	}
2016 
2017 	info = IEEE80211_SKB_CB(skb);
2018 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
2019 
2020 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2021 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2022 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2023 	dev_kfree_skb(skb);
2024 
2025 out:
2026 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2027 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2028 }
2029 
2030 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2031 {
2032 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2033 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2034 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2035 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2036 		return -EIO;
2037 	}
2038 
2039 	/* clear irq when the driver own success */
2040 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2041 		MT_TOP_LPCR_HOST_BAND_STAT);
2042 
2043 	return 0;
2044 }
2045 
2046 static int
2047 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2048 {
2049 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2050 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2051 
2052 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2053 			    state, 1000)) {
2054 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2055 		return -EIO;
2056 	}
2057 	return 0;
2058 }
2059 
2060 static int mt7915_load_firmware(struct mt7915_dev *dev)
2061 {
2062 	int ret;
2063 
2064 	/* make sure fw is download state */
2065 	if (mt7915_firmware_state(dev, false)) {
2066 		/* restart firmware once */
2067 		mt76_connac_mcu_restart(&dev->mt76);
2068 		ret = mt7915_firmware_state(dev, false);
2069 		if (ret) {
2070 			dev_err(dev->mt76.dev,
2071 				"Firmware is not ready for download\n");
2072 			return ret;
2073 		}
2074 	}
2075 
2076 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2077 	if (ret)
2078 		return ret;
2079 
2080 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2081 				    fw_name(dev, FIRMWARE_WA));
2082 	if (ret)
2083 		return ret;
2084 
2085 	ret = mt7915_firmware_state(dev, true);
2086 	if (ret)
2087 		return ret;
2088 
2089 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2090 
2091 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2092 
2093 	return 0;
2094 }
2095 
2096 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2097 {
2098 	struct {
2099 		u8 ctrl_val;
2100 		u8 pad[3];
2101 	} data = {
2102 		.ctrl_val = ctrl
2103 	};
2104 
2105 	if (type == MCU_FW_LOG_WA)
2106 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2107 					 &data, sizeof(data), true);
2108 
2109 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2110 				 sizeof(data), true);
2111 }
2112 
2113 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2114 {
2115 	struct {
2116 		u8 ver;
2117 		u8 pad;
2118 		__le16 len;
2119 		u8 level;
2120 		u8 rsv[3];
2121 		__le32 module_idx;
2122 	} data = {
2123 		.module_idx = cpu_to_le32(module),
2124 		.level = level,
2125 	};
2126 
2127 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2128 				 sizeof(data), false);
2129 }
2130 
2131 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2132 {
2133 	struct {
2134 		__le32 cmd;
2135 		u8 enable;
2136 	} data = {
2137 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2138 		.enable = enabled,
2139 	};
2140 
2141 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2142 				sizeof(data), false);
2143 }
2144 
2145 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy)
2146 {
2147 	struct mt7915_dev *dev = phy->dev;
2148 	struct sk_buff *skb;
2149 	struct mt7915_mcu_muru_stats *mu_stats;
2150 	int ret;
2151 
2152 	struct {
2153 		__le32 cmd;
2154 		u8 band_idx;
2155 	} req = {
2156 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2157 		.band_idx = phy->mt76->band_idx,
2158 	};
2159 
2160 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2161 					&req, sizeof(req), true, &skb);
2162 	if (ret)
2163 		return ret;
2164 
2165 	mu_stats = (struct mt7915_mcu_muru_stats *)(skb->data);
2166 
2167 	/* accumulate stats, these are clear-on-read */
2168 #define __dl_u32(s)	 phy->mib.dl_##s += le32_to_cpu(mu_stats->dl.s)
2169 #define __ul_u32(s)	 phy->mib.ul_##s += le32_to_cpu(mu_stats->ul.s)
2170 	__dl_u32(cck_cnt);
2171 	__dl_u32(ofdm_cnt);
2172 	__dl_u32(htmix_cnt);
2173 	__dl_u32(htgf_cnt);
2174 	__dl_u32(vht_su_cnt);
2175 	__dl_u32(vht_2mu_cnt);
2176 	__dl_u32(vht_3mu_cnt);
2177 	__dl_u32(vht_4mu_cnt);
2178 	__dl_u32(he_su_cnt);
2179 	__dl_u32(he_2ru_cnt);
2180 	__dl_u32(he_2mu_cnt);
2181 	__dl_u32(he_3ru_cnt);
2182 	__dl_u32(he_3mu_cnt);
2183 	__dl_u32(he_4ru_cnt);
2184 	__dl_u32(he_4mu_cnt);
2185 	__dl_u32(he_5to8ru_cnt);
2186 	__dl_u32(he_9to16ru_cnt);
2187 	__dl_u32(he_gtr16ru_cnt);
2188 
2189 	__ul_u32(hetrig_su_cnt);
2190 	__ul_u32(hetrig_2ru_cnt);
2191 	__ul_u32(hetrig_3ru_cnt);
2192 	__ul_u32(hetrig_4ru_cnt);
2193 	__ul_u32(hetrig_5to8ru_cnt);
2194 	__ul_u32(hetrig_9to16ru_cnt);
2195 	__ul_u32(hetrig_gtr16ru_cnt);
2196 	__ul_u32(hetrig_2mu_cnt);
2197 	__ul_u32(hetrig_3mu_cnt);
2198 	__ul_u32(hetrig_4mu_cnt);
2199 #undef __dl_u32
2200 #undef __ul_u32
2201 
2202 	dev_kfree_skb(skb);
2203 
2204 	return 0;
2205 }
2206 
2207 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2208 {
2209 	struct {
2210 		u8 enable;
2211 		u8 _rsv[3];
2212 	} __packed req = {
2213 		.enable = enabled
2214 	};
2215 
2216 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2217 				 sizeof(req), false);
2218 }
2219 
2220 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2221 {
2222 	struct {
2223 		__le32 cmd;
2224 		u8 val[4];
2225 	} __packed req = {
2226 		.cmd = cpu_to_le32(cmd),
2227 	};
2228 
2229 	put_unaligned_le32(val, req.val);
2230 
2231 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2232 				 sizeof(req), false);
2233 }
2234 
2235 static int
2236 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2237 {
2238 #define RX_AIRTIME_FEATURE_CTRL		1
2239 #define RX_AIRTIME_BITWISE_CTRL		2
2240 #define RX_AIRTIME_CLEAR_EN	1
2241 	struct {
2242 		__le16 field;
2243 		__le16 sub_field;
2244 		__le32 set_status;
2245 		__le32 get_status;
2246 		u8 _rsv[12];
2247 
2248 		bool airtime_en;
2249 		bool mibtime_en;
2250 		bool earlyend_en;
2251 		u8 _rsv1[9];
2252 
2253 		bool airtime_clear;
2254 		bool mibtime_clear;
2255 		u8 _rsv2[98];
2256 	} __packed req = {
2257 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2258 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2259 		.airtime_clear = true,
2260 	};
2261 	int ret;
2262 
2263 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2264 				sizeof(req), true);
2265 	if (ret)
2266 		return ret;
2267 
2268 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2269 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2270 	req.airtime_en = true;
2271 
2272 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2273 				 sizeof(req), true);
2274 }
2275 
2276 static int mt7915_red_set_watermark(struct mt7915_dev *dev)
2277 {
2278 #define RED_GLOBAL_TOKEN_WATERMARK 2
2279 	struct {
2280 		__le32 args[3];
2281 		u8 cmd;
2282 		u8 version;
2283 		u8 __rsv1[4];
2284 		__le16 len;
2285 		__le16 high_mark;
2286 		__le16 low_mark;
2287 		u8 __rsv2[12];
2288 	} __packed req = {
2289 		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
2290 		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
2291 		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
2292 		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
2293 		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
2294 	};
2295 
2296 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
2297 				 sizeof(req), false);
2298 }
2299 
2300 static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
2301 {
2302 #define RED_DISABLE		0
2303 #define RED_BY_WA_ENABLE	2
2304 	int ret;
2305 	u32 red_type = enabled ? RED_BY_WA_ENABLE : RED_DISABLE;
2306 	__le32 req = cpu_to_le32(red_type);
2307 
2308 	if (enabled) {
2309 		ret = mt7915_red_set_watermark(dev);
2310 		if (ret < 0)
2311 			return ret;
2312 	}
2313 
2314 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
2315 				sizeof(req), false);
2316 	if (ret < 0)
2317 		return ret;
2318 
2319 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2320 				 MCU_WA_PARAM_RED, enabled, 0);
2321 }
2322 
2323 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2324 {
2325 	int ret;
2326 
2327 	/* force firmware operation mode into normal state,
2328 	 * which should be set before firmware download stage.
2329 	 */
2330 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2331 
2332 	ret = mt7915_driver_own(dev, 0);
2333 	if (ret)
2334 		return ret;
2335 	/* set driver own for band1 when two hif exist */
2336 	if (dev->hif2) {
2337 		ret = mt7915_driver_own(dev, 1);
2338 		if (ret)
2339 			return ret;
2340 	}
2341 
2342 	ret = mt7915_load_firmware(dev);
2343 	if (ret)
2344 		return ret;
2345 
2346 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2347 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2348 	if (ret)
2349 		return ret;
2350 
2351 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2352 	if (ret)
2353 		return ret;
2354 
2355 	if ((mtk_wed_device_active(&dev->mt76.mmio.wed) &&
2356 	     is_mt7915(&dev->mt76)) ||
2357 	    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
2358 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2359 
2360 	ret = mt7915_mcu_set_mwds(dev, 1);
2361 	if (ret)
2362 		return ret;
2363 
2364 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2365 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2366 	if (ret)
2367 		return ret;
2368 
2369 	ret = mt7915_mcu_init_rx_airtime(dev);
2370 	if (ret)
2371 		return ret;
2372 
2373 	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
2374 }
2375 
2376 int mt7915_mcu_init(struct mt7915_dev *dev)
2377 {
2378 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2379 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2380 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2381 		.mcu_parse_response = mt7915_mcu_parse_response,
2382 	};
2383 
2384 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2385 
2386 	return mt7915_mcu_init_firmware(dev);
2387 }
2388 
2389 void mt7915_mcu_exit(struct mt7915_dev *dev)
2390 {
2391 	mt76_connac_mcu_restart(&dev->mt76);
2392 	if (mt7915_firmware_state(dev, false)) {
2393 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2394 		goto out;
2395 	}
2396 
2397 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2398 	if (dev->hif2)
2399 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2400 			MT_TOP_LPCR_HOST_FW_OWN);
2401 out:
2402 	skb_queue_purge(&dev->mt76.mcu.res_q);
2403 }
2404 
2405 static int
2406 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2407 {
2408 	struct {
2409 		u8 operation;
2410 		u8 count;
2411 		u8 _rsv[2];
2412 		u8 index;
2413 		u8 enable;
2414 		__le16 etype;
2415 	} req = {
2416 		.operation = 1,
2417 		.count = 1,
2418 		.enable = 1,
2419 		.etype = cpu_to_le16(ETH_P_PAE),
2420 	};
2421 
2422 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2423 				 &req, sizeof(req), false);
2424 }
2425 
2426 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2427 		       bool enable, bool hdr_trans)
2428 {
2429 	struct {
2430 		u8 operation;
2431 		u8 enable;
2432 		u8 check_bssid;
2433 		u8 insert_vlan;
2434 		u8 remove_vlan;
2435 		u8 tid;
2436 		u8 mode;
2437 		u8 rsv;
2438 	} __packed req_trans = {
2439 		.enable = hdr_trans,
2440 	};
2441 	struct {
2442 		u8 enable;
2443 		u8 band;
2444 		u8 rsv[2];
2445 	} __packed req_mac = {
2446 		.enable = enable,
2447 		.band = band,
2448 	};
2449 	int ret;
2450 
2451 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2452 				&req_trans, sizeof(req_trans), false);
2453 	if (ret)
2454 		return ret;
2455 
2456 	if (hdr_trans)
2457 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2458 
2459 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2460 				 &req_mac, sizeof(req_mac), true);
2461 }
2462 
2463 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2464 {
2465 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2466 	u8 num = req->total;
2467 	size_t len = sizeof(*req) -
2468 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2469 
2470 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2471 				 len, true);
2472 }
2473 
2474 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2475 {
2476 #define TX_CMD_MODE		1
2477 	struct mt7915_mcu_tx req = {
2478 		.valid = true,
2479 		.mode = TX_CMD_MODE,
2480 		.total = IEEE80211_NUM_ACS,
2481 	};
2482 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2483 	int ac;
2484 
2485 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2486 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2487 		struct edca *e = &req.edca[ac];
2488 
2489 		e->set = WMM_PARAM_SET;
2490 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2491 		e->aifs = q->aifs;
2492 		e->txop = cpu_to_le16(q->txop);
2493 
2494 		if (q->cw_min)
2495 			e->cw_min = fls(q->cw_min);
2496 		else
2497 			e->cw_min = 5;
2498 
2499 		if (q->cw_max)
2500 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2501 		else
2502 			e->cw_max = cpu_to_le16(10);
2503 	}
2504 
2505 	return mt7915_mcu_update_edca(dev, &req);
2506 }
2507 
2508 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2509 {
2510 	struct {
2511 		__le32 tag;
2512 		__le16 min_lpn;
2513 		u8 rsv[2];
2514 	} __packed req = {
2515 		.tag = cpu_to_le32(0x1),
2516 		.min_lpn = cpu_to_le16(val),
2517 	};
2518 
2519 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2520 				 sizeof(req), true);
2521 }
2522 
2523 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2524 			    const struct mt7915_dfs_pulse *pulse)
2525 {
2526 	struct {
2527 		__le32 tag;
2528 
2529 		__le32 max_width;		/* us */
2530 		__le32 max_pwr;			/* dbm */
2531 		__le32 min_pwr;			/* dbm */
2532 		__le32 min_stgr_pri;		/* us */
2533 		__le32 max_stgr_pri;		/* us */
2534 		__le32 min_cr_pri;		/* us */
2535 		__le32 max_cr_pri;		/* us */
2536 	} __packed req = {
2537 		.tag = cpu_to_le32(0x3),
2538 
2539 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2540 		__req_field(max_width),
2541 		__req_field(max_pwr),
2542 		__req_field(min_pwr),
2543 		__req_field(min_stgr_pri),
2544 		__req_field(max_stgr_pri),
2545 		__req_field(min_cr_pri),
2546 		__req_field(max_cr_pri),
2547 #undef __req_field
2548 	};
2549 
2550 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2551 				 sizeof(req), true);
2552 }
2553 
2554 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2555 			    const struct mt7915_dfs_pattern *pattern)
2556 {
2557 	struct {
2558 		__le32 tag;
2559 		__le16 radar_type;
2560 
2561 		u8 enb;
2562 		u8 stgr;
2563 		u8 min_crpn;
2564 		u8 max_crpn;
2565 		u8 min_crpr;
2566 		u8 min_pw;
2567 		__le32 min_pri;
2568 		__le32 max_pri;
2569 		u8 max_pw;
2570 		u8 min_crbn;
2571 		u8 max_crbn;
2572 		u8 min_stgpn;
2573 		u8 max_stgpn;
2574 		u8 min_stgpr;
2575 		u8 rsv[2];
2576 		__le32 min_stgpr_diff;
2577 	} __packed req = {
2578 		.tag = cpu_to_le32(0x2),
2579 		.radar_type = cpu_to_le16(index),
2580 
2581 #define __req_field_u8(field) .field = pattern->field
2582 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2583 		__req_field_u8(enb),
2584 		__req_field_u8(stgr),
2585 		__req_field_u8(min_crpn),
2586 		__req_field_u8(max_crpn),
2587 		__req_field_u8(min_crpr),
2588 		__req_field_u8(min_pw),
2589 		__req_field_u32(min_pri),
2590 		__req_field_u32(max_pri),
2591 		__req_field_u8(max_pw),
2592 		__req_field_u8(min_crbn),
2593 		__req_field_u8(max_crbn),
2594 		__req_field_u8(min_stgpn),
2595 		__req_field_u8(max_stgpn),
2596 		__req_field_u8(min_stgpr),
2597 		__req_field_u32(min_stgpr_diff),
2598 #undef __req_field_u8
2599 #undef __req_field_u32
2600 	};
2601 
2602 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2603 				 sizeof(req), true);
2604 }
2605 
2606 static int
2607 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2608 				 struct cfg80211_chan_def *chandef,
2609 				 int cmd)
2610 {
2611 	struct mt7915_dev *dev = phy->dev;
2612 	struct mt76_phy *mphy = phy->mt76;
2613 	struct ieee80211_channel *chan = mphy->chandef.chan;
2614 	int freq = mphy->chandef.center_freq1;
2615 	struct mt7915_mcu_background_chain_ctrl req = {
2616 		.monitor_scan_type = 2, /* simple rx */
2617 	};
2618 
2619 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2620 		return -EINVAL;
2621 
2622 	if (!cfg80211_chandef_valid(&mphy->chandef))
2623 		return -EINVAL;
2624 
2625 	switch (cmd) {
2626 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2627 		req.chan = chan->hw_value;
2628 		req.central_chan = ieee80211_frequency_to_channel(freq);
2629 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2630 		req.monitor_chan = chandef->chan->hw_value;
2631 		req.monitor_central_chan =
2632 			ieee80211_frequency_to_channel(chandef->center_freq1);
2633 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2634 		req.band_idx = phy->mt76->band_idx;
2635 		req.scan_mode = 1;
2636 		break;
2637 	}
2638 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2639 		req.monitor_chan = chandef->chan->hw_value;
2640 		req.monitor_central_chan =
2641 			ieee80211_frequency_to_channel(chandef->center_freq1);
2642 		req.band_idx = phy->mt76->band_idx;
2643 		req.scan_mode = 2;
2644 		break;
2645 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2646 		req.chan = chan->hw_value;
2647 		req.central_chan = ieee80211_frequency_to_channel(freq);
2648 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2649 		req.tx_stream = hweight8(mphy->antenna_mask);
2650 		req.rx_stream = mphy->antenna_mask;
2651 		break;
2652 	default:
2653 		return -EINVAL;
2654 	}
2655 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2656 
2657 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2658 				 &req, sizeof(req), false);
2659 }
2660 
2661 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2662 				     struct cfg80211_chan_def *chandef)
2663 {
2664 	struct mt7915_dev *dev = phy->dev;
2665 	int err, region;
2666 
2667 	if (!chandef) { /* disable offchain */
2668 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2669 					      0, 0);
2670 		if (err)
2671 			return err;
2672 
2673 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2674 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2675 	}
2676 
2677 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2678 					       CH_SWITCH_BACKGROUND_SCAN_START);
2679 	if (err)
2680 		return err;
2681 
2682 	switch (dev->mt76.region) {
2683 	case NL80211_DFS_ETSI:
2684 		region = 0;
2685 		break;
2686 	case NL80211_DFS_JP:
2687 		region = 2;
2688 		break;
2689 	case NL80211_DFS_FCC:
2690 	default:
2691 		region = 1;
2692 		break;
2693 	}
2694 
2695 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2696 				       0, region);
2697 }
2698 
2699 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2700 {
2701 	static const u8 ch_band[] = {
2702 		[NL80211_BAND_2GHZ] = 0,
2703 		[NL80211_BAND_5GHZ] = 1,
2704 		[NL80211_BAND_6GHZ] = 2,
2705 	};
2706 	struct mt7915_dev *dev = phy->dev;
2707 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2708 	int freq1 = chandef->center_freq1;
2709 	u8 band = phy->mt76->band_idx;
2710 	struct {
2711 		u8 control_ch;
2712 		u8 center_ch;
2713 		u8 bw;
2714 		u8 tx_path_num;
2715 		u8 rx_path;	/* mask or num */
2716 		u8 switch_reason;
2717 		u8 band_idx;
2718 		u8 center_ch2;	/* for 80+80 only */
2719 		__le16 cac_case;
2720 		u8 channel_band;
2721 		u8 rsv0;
2722 		__le32 outband_freq;
2723 		u8 txpower_drop;
2724 		u8 ap_bw;
2725 		u8 ap_center_ch;
2726 		u8 rsv1[57];
2727 	} __packed req = {
2728 		.control_ch = chandef->chan->hw_value,
2729 		.center_ch = ieee80211_frequency_to_channel(freq1),
2730 		.bw = mt76_connac_chan_bw(chandef),
2731 		.tx_path_num = hweight16(phy->mt76->chainmask),
2732 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2733 		.band_idx = band,
2734 		.channel_band = ch_band[chandef->chan->band],
2735 	};
2736 
2737 #ifdef CONFIG_NL80211_TESTMODE
2738 	if (phy->mt76->test.tx_antenna_mask &&
2739 	    mt76_testmode_enabled(phy->mt76)) {
2740 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2741 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2742 	}
2743 #endif
2744 
2745 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2746 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2747 
2748 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
2749 		req.switch_reason = CH_SWITCH_NORMAL;
2750 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL ||
2751 		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
2752 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2753 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2754 					  NL80211_IFTYPE_AP))
2755 		req.switch_reason = CH_SWITCH_DFS;
2756 	else
2757 		req.switch_reason = CH_SWITCH_NORMAL;
2758 
2759 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2760 		req.rx_path = hweight8(req.rx_path);
2761 
2762 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2763 		int freq2 = chandef->center_freq2;
2764 
2765 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2766 	}
2767 
2768 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2769 }
2770 
2771 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2772 {
2773 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2774 #define PAGE_IDX_MASK		GENMASK(4, 2)
2775 #define PER_PAGE_SIZE		0x400
2776 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2777 	u16 eeprom_size = mt7915_eeprom_size(dev);
2778 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2779 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2780 	int eep_len;
2781 	int i;
2782 
2783 	for (i = 0; i < total; i++, eep += eep_len) {
2784 		struct sk_buff *skb;
2785 		int ret;
2786 
2787 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2788 			eep_len = eeprom_size % PER_PAGE_SIZE;
2789 		else
2790 			eep_len = PER_PAGE_SIZE;
2791 
2792 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2793 					 sizeof(req) + eep_len);
2794 		if (!skb)
2795 			return -ENOMEM;
2796 
2797 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2798 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2799 		req.len = cpu_to_le16(eep_len);
2800 
2801 		skb_put_data(skb, &req, sizeof(req));
2802 		skb_put_data(skb, eep, eep_len);
2803 
2804 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2805 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2806 		if (ret)
2807 			return ret;
2808 	}
2809 
2810 	return 0;
2811 }
2812 
2813 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2814 {
2815 	struct mt7915_mcu_eeprom req = {
2816 		.buffer_mode = EE_MODE_EFUSE,
2817 		.format = EE_FORMAT_WHOLE,
2818 	};
2819 
2820 	if (dev->flash_mode)
2821 		return mt7915_mcu_set_eeprom_flash(dev);
2822 
2823 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2824 				 &req, sizeof(req), true);
2825 }
2826 
2827 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2828 {
2829 	struct mt7915_mcu_eeprom_info req = {
2830 		.addr = cpu_to_le32(round_down(offset,
2831 				    MT7915_EEPROM_BLOCK_SIZE)),
2832 	};
2833 	struct mt7915_mcu_eeprom_info *res;
2834 	struct sk_buff *skb;
2835 	int ret;
2836 	u8 *buf;
2837 
2838 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2839 					MCU_EXT_QUERY(EFUSE_ACCESS),
2840 					&req, sizeof(req), true, &skb);
2841 	if (ret)
2842 		return ret;
2843 
2844 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2845 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2846 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2847 	dev_kfree_skb(skb);
2848 
2849 	return 0;
2850 }
2851 
2852 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2853 {
2854 	struct {
2855 		u8 _rsv;
2856 		u8 version;
2857 		u8 die_idx;
2858 		u8 _rsv2;
2859 	} __packed req = {
2860 		.version = 1,
2861 	};
2862 	struct sk_buff *skb;
2863 	int ret;
2864 
2865 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2866 					MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
2867 					&req, sizeof(req), true, &skb);
2868 	if (ret)
2869 		return ret;
2870 
2871 	*block_num = *(u8 *)skb->data;
2872 	dev_kfree_skb(skb);
2873 
2874 	return 0;
2875 }
2876 
2877 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2878 				  u8 *data, u32 len, int cmd)
2879 {
2880 	struct {
2881 		u8 dir;
2882 		u8 valid;
2883 		__le16 bitmap;
2884 		s8 precal;
2885 		u8 action;
2886 		u8 band;
2887 		u8 idx;
2888 		u8 rsv[4];
2889 		__le32 len;
2890 	} req = {};
2891 	struct sk_buff *skb;
2892 
2893 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2894 	if (!skb)
2895 		return -ENOMEM;
2896 
2897 	req.idx = idx;
2898 	req.len = cpu_to_le32(len);
2899 	skb_put_data(skb, &req, sizeof(req));
2900 	skb_put_data(skb, data, len);
2901 
2902 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2903 }
2904 
2905 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2906 {
2907 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2908 	u32 total = mt7915_get_cal_group_size(dev);
2909 	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
2910 
2911 	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
2912 		return 0;
2913 
2914 	/*
2915 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2916 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2917 	 */
2918 	while (total > 0) {
2919 		int ret, len;
2920 
2921 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2922 
2923 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2924 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2925 		if (ret)
2926 			return ret;
2927 
2928 		total -= len;
2929 		cal += len;
2930 		idx++;
2931 	}
2932 
2933 	return 0;
2934 }
2935 
2936 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2937 {
2938 	int i;
2939 
2940 	for (i = 0; i < n_freqs; i++)
2941 		if (cur == freqs[i])
2942 			return i;
2943 
2944 	return -1;
2945 }
2946 
2947 static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
2948 {
2949 	static const u16 freq_list_v1[] = {
2950 		5180, 5200, 5220, 5240,
2951 		5260, 5280, 5300, 5320,
2952 		5500, 5520, 5540, 5560,
2953 		5580, 5600, 5620, 5640,
2954 		5660, 5680, 5700, 5745,
2955 		5765, 5785, 5805, 5825
2956 	};
2957 	static const u16 freq_list_v2[] = {
2958 		/* 6G BW20*/
2959 		5955, 5975, 5995, 6015,
2960 		6035, 6055, 6075, 6095,
2961 		6115, 6135, 6155, 6175,
2962 		6195, 6215, 6235, 6255,
2963 		6275, 6295, 6315, 6335,
2964 		6355, 6375, 6395, 6415,
2965 		6435, 6455, 6475, 6495,
2966 		6515, 6535, 6555, 6575,
2967 		6595, 6615, 6635, 6655,
2968 		6675, 6695, 6715, 6735,
2969 		6755, 6775, 6795, 6815,
2970 		6835, 6855, 6875, 6895,
2971 		6915, 6935, 6955, 6975,
2972 		6995, 7015, 7035, 7055,
2973 		7075, 7095, 7115,
2974 		/* 6G BW160 */
2975 		6025, 6185, 6345, 6505,
2976 		6665, 6825, 6985,
2977 		/* 5G BW20 */
2978 		5180, 5200, 5220, 5240,
2979 		5260, 5280, 5300, 5320,
2980 		5500, 5520, 5540, 5560,
2981 		5580, 5600, 5620, 5640,
2982 		5660, 5680, 5700, 5720,
2983 		5745, 5765, 5785, 5805,
2984 		5825, 5845, 5865, 5885,
2985 		/* 5G BW160 */
2986 		5250, 5570, 5815
2987 	};
2988 	static const u16 freq_list_v2_7981[] = {
2989 		/* 5G BW20 */
2990 		5180, 5200, 5220, 5240,
2991 		5260, 5280, 5300, 5320,
2992 		5500, 5520, 5540, 5560,
2993 		5580, 5600, 5620, 5640,
2994 		5660, 5680, 5700, 5720,
2995 		5745, 5765, 5785, 5805,
2996 		5825, 5845, 5865, 5885,
2997 		/* 5G BW160 */
2998 		5250, 5570, 5815
2999 	};
3000 	const u16 *freq_list = freq_list_v1;
3001 	int n_freqs = ARRAY_SIZE(freq_list_v1);
3002 	int idx;
3003 
3004 	if (!is_mt7915(&dev->mt76)) {
3005 		if (is_mt7981(&dev->mt76)) {
3006 			freq_list = freq_list_v2_7981;
3007 			n_freqs = ARRAY_SIZE(freq_list_v2_7981);
3008 		} else {
3009 			freq_list = freq_list_v2;
3010 			n_freqs = ARRAY_SIZE(freq_list_v2);
3011 		}
3012 	}
3013 
3014 	if (freq < 4000) {
3015 		if (freq < 2432)
3016 			return n_freqs;
3017 		if (freq < 2457)
3018 			return n_freqs + 1;
3019 
3020 		return n_freqs + 2;
3021 	}
3022 
3023 	if (bw == NL80211_CHAN_WIDTH_80P80)
3024 		return -1;
3025 
3026 	if (bw != NL80211_CHAN_WIDTH_20) {
3027 		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq + 10);
3028 		if (idx >= 0)
3029 			return idx;
3030 
3031 		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq - 10);
3032 		if (idx >= 0)
3033 			return idx;
3034 	}
3035 
3036 	return mt7915_find_freq_idx(freq_list, n_freqs, freq);
3037 }
3038 
3039 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3040 {
3041 	struct mt7915_dev *dev = phy->dev;
3042 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3043 	enum nl80211_band band = chandef->chan->band;
3044 	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
3045 	u16 center_freq = chandef->center_freq1;
3046 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3047 	u8 dpd_mask, cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
3048 	int idx;
3049 
3050 	switch (band) {
3051 	case NL80211_BAND_2GHZ:
3052 		dpd_mask = MT_EE_WIFI_CAL_DPD_2G;
3053 		break;
3054 	case NL80211_BAND_5GHZ:
3055 		dpd_mask = MT_EE_WIFI_CAL_DPD_5G;
3056 		break;
3057 	case NL80211_BAND_6GHZ:
3058 		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
3059 		break;
3060 	default:
3061 		dpd_mask = 0;
3062 		break;
3063 	}
3064 
3065 	if (!(eep[offs] & dpd_mask))
3066 		return 0;
3067 
3068 	idx = mt7915_dpd_freq_idx(dev, center_freq, chandef->width);
3069 	if (idx < 0)
3070 		return -EINVAL;
3071 
3072 	/* Items: Tx DPD, Tx Flatness */
3073 	idx = idx * cal_num;
3074 	cal += mt7915_get_cal_group_size(dev) + (idx * MT_EE_CAL_UNIT);
3075 
3076 	while (cal_num--) {
3077 		int ret;
3078 
3079 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3080 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3081 		if (ret)
3082 			return ret;
3083 
3084 		idx++;
3085 		cal += MT_EE_CAL_UNIT;
3086 	}
3087 
3088 	return 0;
3089 }
3090 
3091 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3092 {
3093 	struct mt76_channel_state *state = phy->mt76->chan_state;
3094 	struct mt76_channel_state *state_ts = &phy->state_ts;
3095 	struct mt7915_dev *dev = phy->dev;
3096 	struct mt7915_mcu_mib *res, req[5];
3097 	struct sk_buff *skb;
3098 	static const u32 *offs;
3099 	int i, ret, len, offs_cc;
3100 	u64 cc_tx;
3101 
3102 	/* strict order */
3103 	if (is_mt7915(&dev->mt76)) {
3104 		static const u32 chip_offs[] = {
3105 			MIB_NON_WIFI_TIME,
3106 			MIB_TX_TIME,
3107 			MIB_RX_TIME,
3108 			MIB_OBSS_AIRTIME,
3109 			MIB_TXOP_INIT_COUNT,
3110 		};
3111 		len = ARRAY_SIZE(chip_offs);
3112 		offs = chip_offs;
3113 		offs_cc = 20;
3114 	} else {
3115 		static const u32 chip_offs[] = {
3116 			MIB_NON_WIFI_TIME_V2,
3117 			MIB_TX_TIME_V2,
3118 			MIB_RX_TIME_V2,
3119 			MIB_OBSS_AIRTIME_V2
3120 		};
3121 		len = ARRAY_SIZE(chip_offs);
3122 		offs = chip_offs;
3123 		offs_cc = 0;
3124 	}
3125 
3126 	for (i = 0; i < len; i++) {
3127 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
3128 		req[i].offs = cpu_to_le32(offs[i]);
3129 	}
3130 
3131 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3132 					req, len * sizeof(req[0]), true, &skb);
3133 	if (ret)
3134 		return ret;
3135 
3136 	res = (struct mt7915_mcu_mib *)(skb->data + offs_cc);
3137 
3138 #define __res_u64(s) le64_to_cpu(res[s].data)
3139 	/* subtract Tx backoff time from Tx duration */
3140 	cc_tx = is_mt7915(&dev->mt76) ? __res_u64(1) - __res_u64(4) : __res_u64(1);
3141 
3142 	if (chan_switch)
3143 		goto out;
3144 
3145 	state->cc_tx += cc_tx - state_ts->cc_tx;
3146 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3147 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3148 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3149 			  state_ts->cc_busy;
3150 
3151 out:
3152 	state_ts->cc_tx = cc_tx;
3153 	state_ts->cc_bss_rx = __res_u64(2);
3154 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3155 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3156 #undef __res_u64
3157 
3158 	dev_kfree_skb(skb);
3159 
3160 	return 0;
3161 }
3162 
3163 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3164 {
3165 	struct mt7915_dev *dev = phy->dev;
3166 	struct {
3167 		u8 ctrl_id;
3168 		u8 action;
3169 		u8 band_idx;
3170 		u8 rsv[5];
3171 	} req = {
3172 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3173 		.band_idx = phy->mt76->band_idx,
3174 	};
3175 
3176 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3177 				 sizeof(req), true);
3178 }
3179 
3180 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3181 {
3182 	struct mt7915_dev *dev = phy->dev;
3183 	struct mt7915_mcu_thermal_ctrl req = {
3184 		.band_idx = phy->mt76->band_idx,
3185 		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
3186 	};
3187 	int level, ret;
3188 
3189 	/* set duty cycle and level */
3190 	for (level = 0; level < 4; level++) {
3191 		req.duty.duty_level = level;
3192 		req.duty.duty_cycle = state;
3193 		state /= 2;
3194 
3195 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3196 					&req, sizeof(req), false);
3197 		if (ret)
3198 			return ret;
3199 	}
3200 	return 0;
3201 }
3202 
3203 int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
3204 {
3205 	struct mt7915_dev *dev = phy->dev;
3206 	struct {
3207 		struct mt7915_mcu_thermal_ctrl ctrl;
3208 
3209 		__le32 trigger_temp;
3210 		__le32 restore_temp;
3211 		__le16 sustain_time;
3212 		u8 rsv[2];
3213 	} __packed req = {
3214 		.ctrl = {
3215 			.band_idx = phy->mt76->band_idx,
3216 			.type.protect_type = 1,
3217 			.type.trigger_type = 1,
3218 		},
3219 	};
3220 	int ret;
3221 
3222 	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3223 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3224 				&req, sizeof(req.ctrl), false);
3225 
3226 	if (ret)
3227 		return ret;
3228 
3229 	/* set high-temperature trigger threshold */
3230 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3231 	/* add a safety margin ~10 */
3232 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3233 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3234 	req.sustain_time = cpu_to_le16(10);
3235 
3236 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3237 				 &req, sizeof(req), false);
3238 }
3239 
3240 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3241 {
3242 	struct mt7915_dev *dev = phy->dev;
3243 	struct {
3244 		u8 format_id;
3245 		u8 rsv;
3246 		u8 band_idx;
3247 		s8 txpower_min;
3248 	} __packed req = {
3249 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3250 		.band_idx = phy->mt76->band_idx,
3251 		.txpower_min = txpower * 2, /* 0.5db */
3252 	};
3253 
3254 	return mt76_mcu_send_msg(&dev->mt76,
3255 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3256 				 sizeof(req), true);
3257 }
3258 
3259 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3260 				 struct ieee80211_vif *vif,
3261 				 struct ieee80211_sta *sta, s8 txpower)
3262 {
3263 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3264 	struct mt7915_dev *dev = phy->dev;
3265 	struct mt76_phy *mphy = phy->mt76;
3266 	struct {
3267 		u8 format_id;
3268 		u8 rsv[3];
3269 		u8 band_idx;
3270 		s8 txpower_max;
3271 		__le16 wcid;
3272 		s8 txpower_offs[48];
3273 	} __packed req = {
3274 		.format_id = TX_POWER_LIMIT_FRAME,
3275 		.band_idx = phy->mt76->band_idx,
3276 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3277 		.wcid = cpu_to_le16(msta->wcid.idx),
3278 	};
3279 	int ret;
3280 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3281 
3282 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
3283 	if (ret)
3284 		return ret;
3285 
3286 	txpower = mt7915_get_power_bound(phy, txpower);
3287 	if (txpower > mphy->txpower_cur || txpower < 0)
3288 		return -EINVAL;
3289 
3290 	if (txpower) {
3291 		u32 offs, len, i;
3292 
3293 		if (sta->deflink.ht_cap.ht_supported) {
3294 			const u8 *sku_len = mt7915_sku_group_len;
3295 
3296 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3297 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3298 
3299 			if (sta->deflink.vht_cap.vht_supported) {
3300 				offs += len;
3301 				len = sku_len[SKU_VHT_BW20] * 4;
3302 
3303 				if (sta->deflink.he_cap.has_he) {
3304 					offs += len + sku_len[SKU_HE_RU26] * 3;
3305 					len = sku_len[SKU_HE_RU242] * 4;
3306 				}
3307 			}
3308 		} else {
3309 			return -EINVAL;
3310 		}
3311 
3312 		for (i = 0; i < len; i++, offs++)
3313 			req.txpower_offs[i] =
3314 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3315 	}
3316 
3317 	return mt76_mcu_send_msg(&dev->mt76,
3318 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3319 				 sizeof(req), true);
3320 }
3321 
3322 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3323 {
3324 	struct mt7915_dev *dev = phy->dev;
3325 	struct mt76_phy *mphy = phy->mt76;
3326 	struct ieee80211_hw *hw = mphy->hw;
3327 	struct mt7915_mcu_txpower_sku req = {
3328 		.format_id = TX_POWER_LIMIT_TABLE,
3329 		.band_idx = phy->mt76->band_idx,
3330 	};
3331 	struct mt76_power_limits limits_array;
3332 	s8 *la = (s8 *)&limits_array;
3333 	int i, idx;
3334 	int tx_power;
3335 
3336 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
3337 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3338 					      &limits_array, tx_power);
3339 	mphy->txpower_cur = tx_power;
3340 
3341 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3342 		u8 mcs_num, len = mt7915_sku_group_len[i];
3343 		int j;
3344 
3345 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3346 			mcs_num = 10;
3347 
3348 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3349 				la = (s8 *)&limits_array + 12;
3350 		} else {
3351 			mcs_num = len;
3352 		}
3353 
3354 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3355 			req.txpower_sku[idx + j] = la[j];
3356 
3357 		la += mcs_num;
3358 		idx += len;
3359 	}
3360 
3361 	return mt76_mcu_send_msg(&dev->mt76,
3362 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3363 				 sizeof(req), true);
3364 }
3365 
3366 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3367 {
3368 #define RATE_POWER_INFO	2
3369 	struct mt7915_dev *dev = phy->dev;
3370 	struct {
3371 		u8 format_id;
3372 		u8 category;
3373 		u8 band_idx;
3374 		u8 _rsv;
3375 	} __packed req = {
3376 		.format_id = TX_POWER_LIMIT_INFO,
3377 		.category = RATE_POWER_INFO,
3378 		.band_idx = phy->mt76->band_idx,
3379 	};
3380 	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
3381 	struct sk_buff *skb;
3382 	int ret, i;
3383 
3384 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3385 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3386 					&req, sizeof(req), true, &skb);
3387 	if (ret)
3388 		return ret;
3389 
3390 	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
3391 	for (i = 0; i < len; i++)
3392 		txpower[i] = txpower_sku[i][req.band_idx];
3393 
3394 	dev_kfree_skb(skb);
3395 
3396 	return 0;
3397 }
3398 
3399 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3400 			      u8 en)
3401 {
3402 	struct {
3403 		u8 test_mode_en;
3404 		u8 param_idx;
3405 		u8 _rsv[2];
3406 
3407 		u8 enable;
3408 		u8 _rsv2[3];
3409 
3410 		u8 pad[8];
3411 	} __packed req = {
3412 		.test_mode_en = test_mode,
3413 		.param_idx = param,
3414 		.enable = en,
3415 	};
3416 
3417 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3418 				 sizeof(req), false);
3419 }
3420 
3421 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3422 {
3423 	struct mt7915_dev *dev = phy->dev;
3424 	struct mt7915_sku {
3425 		u8 format_id;
3426 		u8 sku_enable;
3427 		u8 band_idx;
3428 		u8 rsv;
3429 	} __packed req = {
3430 		.format_id = TX_POWER_LIMIT_ENABLE,
3431 		.band_idx = phy->mt76->band_idx,
3432 		.sku_enable = enable,
3433 	};
3434 
3435 	return mt76_mcu_send_msg(&dev->mt76,
3436 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3437 				 sizeof(req), true);
3438 }
3439 
3440 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3441 {
3442 	struct {
3443 		u8 action;
3444 		u8 set;
3445 		u8 band;
3446 		u8 rsv;
3447 	} req = {
3448 		.action = action,
3449 		.set = set,
3450 		.band = band,
3451 	};
3452 
3453 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3454 				 &req, sizeof(req), false);
3455 }
3456 
3457 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3458 {
3459 	struct {
3460 		u8 action;
3461 		union {
3462 			struct {
3463 				u8 snd_mode;
3464 				u8 sta_num;
3465 				u8 rsv;
3466 				u8 wlan_idx[4];
3467 				__le32 snd_period;	/* ms */
3468 			} __packed snd;
3469 			struct {
3470 				bool ebf;
3471 				bool ibf;
3472 				u8 rsv;
3473 			} __packed type;
3474 			struct {
3475 				u8 bf_num;
3476 				u8 bf_bitmap;
3477 				u8 bf_sel[8];
3478 				u8 rsv[5];
3479 			} __packed mod;
3480 		};
3481 	} __packed req = {
3482 		.action = action,
3483 	};
3484 
3485 #define MT_BF_PROCESSING	4
3486 	switch (action) {
3487 	case MT_BF_SOUNDING_ON:
3488 		req.snd.snd_mode = MT_BF_PROCESSING;
3489 		break;
3490 	case MT_BF_TYPE_UPDATE:
3491 		req.type.ebf = true;
3492 		req.type.ibf = dev->ibf;
3493 		break;
3494 	case MT_BF_MODULE_UPDATE:
3495 		req.mod.bf_num = 2;
3496 		req.mod.bf_bitmap = GENMASK(1, 0);
3497 		break;
3498 	default:
3499 		return -EINVAL;
3500 	}
3501 
3502 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3503 				 sizeof(req), true);
3504 }
3505 
3506 static int
3507 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3508 {
3509 	struct mt7915_dev *dev = phy->dev;
3510 	struct mt7915_mcu_sr_ctrl req = {
3511 		.action = action,
3512 		.argnum = 1,
3513 		.band_idx = phy->mt76->band_idx,
3514 		.val = cpu_to_le32(val),
3515 	};
3516 
3517 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3518 				 sizeof(req), true);
3519 }
3520 
3521 static int
3522 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3523 			   struct ieee80211_he_obss_pd *he_obss_pd)
3524 {
3525 	struct mt7915_dev *dev = phy->dev;
3526 	struct {
3527 		struct mt7915_mcu_sr_ctrl ctrl;
3528 		struct {
3529 			u8 pd_th_non_srg;
3530 			u8 pd_th_srg;
3531 			u8 period_offs;
3532 			u8 rcpi_src;
3533 			__le16 obss_pd_min;
3534 			__le16 obss_pd_min_srg;
3535 			u8 resp_txpwr_mode;
3536 			u8 txpwr_restrict_mode;
3537 			u8 txpwr_ref;
3538 			u8 rsv[3];
3539 		} __packed param;
3540 	} __packed req = {
3541 		.ctrl = {
3542 			.action = SPR_SET_PARAM,
3543 			.argnum = 9,
3544 			.band_idx = phy->mt76->band_idx,
3545 		},
3546 	};
3547 	int ret;
3548 	u8 max_th = 82, non_srg_max_th = 62;
3549 
3550 	/* disable firmware dynamical PD asjustment */
3551 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3552 	if (ret)
3553 		return ret;
3554 
3555 	if (he_obss_pd->sr_ctrl &
3556 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3557 		req.param.pd_th_non_srg = max_th;
3558 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3559 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3560 	else
3561 		req.param.pd_th_non_srg  = non_srg_max_th;
3562 
3563 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3564 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3565 
3566 	req.param.obss_pd_min = cpu_to_le16(82);
3567 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3568 	req.param.txpwr_restrict_mode = 2;
3569 	req.param.txpwr_ref = 21;
3570 
3571 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3572 				 sizeof(req), true);
3573 }
3574 
3575 static int
3576 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3577 			     struct ieee80211_he_obss_pd *he_obss_pd)
3578 {
3579 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3580 	struct mt7915_dev *dev = phy->dev;
3581 	u8 omac = mvif->mt76.omac_idx;
3582 	struct {
3583 		struct mt7915_mcu_sr_ctrl ctrl;
3584 		struct {
3585 			u8 omac;
3586 			u8 rsv[3];
3587 			u8 flag[20];
3588 		} __packed siga;
3589 	} __packed req = {
3590 		.ctrl = {
3591 			.action = SPR_SET_SIGA,
3592 			.argnum = 1,
3593 			.band_idx = phy->mt76->band_idx,
3594 		},
3595 		.siga = {
3596 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3597 		},
3598 	};
3599 	int ret;
3600 
3601 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3602 		req.siga.flag[req.siga.omac] = 0xf;
3603 	else
3604 		return 0;
3605 
3606 	/* switch to normal AP mode */
3607 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3608 	if (ret)
3609 		return ret;
3610 
3611 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3612 				 sizeof(req), true);
3613 }
3614 
3615 static int
3616 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3617 			       struct ieee80211_he_obss_pd *he_obss_pd)
3618 {
3619 	struct mt7915_dev *dev = phy->dev;
3620 	struct {
3621 		struct mt7915_mcu_sr_ctrl ctrl;
3622 		struct {
3623 			__le32 color_l[2];
3624 			__le32 color_h[2];
3625 			__le32 bssid_l[2];
3626 			__le32 bssid_h[2];
3627 		} __packed bitmap;
3628 	} __packed req = {
3629 		.ctrl = {
3630 			.action = SPR_SET_SRG_BITMAP,
3631 			.argnum = 4,
3632 			.band_idx = phy->mt76->band_idx,
3633 		},
3634 	};
3635 	u32 bitmap;
3636 
3637 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3638 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3639 
3640 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3641 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3642 
3643 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3644 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3645 
3646 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3647 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3648 
3649 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3650 				 sizeof(req), true);
3651 }
3652 
3653 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3654 			    struct ieee80211_he_obss_pd *he_obss_pd)
3655 {
3656 	int ret;
3657 
3658 	/* enable firmware scene detection algorithms */
3659 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3660 	if (ret)
3661 		return ret;
3662 
3663 	/* firmware dynamically adjusts PD threshold so skip manual control */
3664 	if (sr_scene_detect && !he_obss_pd->enable)
3665 		return 0;
3666 
3667 	/* enable spatial reuse */
3668 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3669 	if (ret)
3670 		return ret;
3671 
3672 	if (sr_scene_detect || !he_obss_pd->enable)
3673 		return 0;
3674 
3675 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3676 	if (ret)
3677 		return ret;
3678 
3679 	/* set SRG/non-SRG OBSS PD threshold */
3680 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3681 	if (ret)
3682 		return ret;
3683 
3684 	/* Set SR prohibit */
3685 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3686 	if (ret)
3687 		return ret;
3688 
3689 	/* set SRG BSS color/BSSID bitmap */
3690 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3691 }
3692 
3693 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3694 			   struct ieee80211_sta *sta, struct rate_info *rate)
3695 {
3696 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3697 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3698 	struct mt7915_dev *dev = phy->dev;
3699 	struct mt76_phy *mphy = phy->mt76;
3700 	struct {
3701 		u8 category;
3702 		u8 band;
3703 		__le16 wcid;
3704 	} __packed req = {
3705 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3706 		.band = mvif->mt76.band_idx,
3707 		.wcid = cpu_to_le16(msta->wcid.idx),
3708 	};
3709 	struct ieee80211_supported_band *sband;
3710 	struct mt7915_mcu_phy_rx_info *res;
3711 	struct sk_buff *skb;
3712 	int ret;
3713 	bool cck = false;
3714 
3715 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3716 					&req, sizeof(req), true, &skb);
3717 	if (ret)
3718 		return ret;
3719 
3720 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3721 
3722 	rate->mcs = res->rate;
3723 	rate->nss = res->nsts + 1;
3724 
3725 	switch (res->mode) {
3726 	case MT_PHY_TYPE_CCK:
3727 		cck = true;
3728 		fallthrough;
3729 	case MT_PHY_TYPE_OFDM:
3730 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3731 			sband = &mphy->sband_5g.sband;
3732 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3733 			sband = &mphy->sband_6g.sband;
3734 		else
3735 			sband = &mphy->sband_2g.sband;
3736 
3737 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3738 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3739 		break;
3740 	case MT_PHY_TYPE_HT:
3741 	case MT_PHY_TYPE_HT_GF:
3742 		if (rate->mcs > 31) {
3743 			ret = -EINVAL;
3744 			goto out;
3745 		}
3746 
3747 		rate->flags = RATE_INFO_FLAGS_MCS;
3748 		if (res->gi)
3749 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3750 		break;
3751 	case MT_PHY_TYPE_VHT:
3752 		if (rate->mcs > 9) {
3753 			ret = -EINVAL;
3754 			goto out;
3755 		}
3756 
3757 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3758 		if (res->gi)
3759 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3760 		break;
3761 	case MT_PHY_TYPE_HE_SU:
3762 	case MT_PHY_TYPE_HE_EXT_SU:
3763 	case MT_PHY_TYPE_HE_TB:
3764 	case MT_PHY_TYPE_HE_MU:
3765 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3766 			ret = -EINVAL;
3767 			goto out;
3768 		}
3769 		rate->he_gi = res->gi;
3770 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3771 		break;
3772 	default:
3773 		ret = -EINVAL;
3774 		goto out;
3775 	}
3776 
3777 	switch (res->bw) {
3778 	case IEEE80211_STA_RX_BW_160:
3779 		rate->bw = RATE_INFO_BW_160;
3780 		break;
3781 	case IEEE80211_STA_RX_BW_80:
3782 		rate->bw = RATE_INFO_BW_80;
3783 		break;
3784 	case IEEE80211_STA_RX_BW_40:
3785 		rate->bw = RATE_INFO_BW_40;
3786 		break;
3787 	default:
3788 		rate->bw = RATE_INFO_BW_20;
3789 		break;
3790 	}
3791 
3792 out:
3793 	dev_kfree_skb(skb);
3794 
3795 	return ret;
3796 }
3797 
3798 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3799 				struct cfg80211_he_bss_color *he_bss_color)
3800 {
3801 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3802 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3803 	struct bss_info_color *bss_color;
3804 	struct sk_buff *skb;
3805 	struct tlv *tlv;
3806 
3807 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3808 					      NULL, len);
3809 	if (IS_ERR(skb))
3810 		return PTR_ERR(skb);
3811 
3812 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3813 				      sizeof(*bss_color));
3814 	bss_color = (struct bss_info_color *)tlv;
3815 	bss_color->disable = !he_bss_color->enabled;
3816 	bss_color->color = he_bss_color->color;
3817 
3818 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3819 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3820 }
3821 
3822 #define TWT_AGRT_TRIGGER	BIT(0)
3823 #define TWT_AGRT_ANNOUNCE	BIT(1)
3824 #define TWT_AGRT_PROTECT	BIT(2)
3825 
3826 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3827 			       struct mt7915_vif *mvif,
3828 			       struct mt7915_twt_flow *flow,
3829 			       int cmd)
3830 {
3831 	struct {
3832 		u8 tbl_idx;
3833 		u8 cmd;
3834 		u8 own_mac_idx;
3835 		u8 flowid; /* 0xff for group id */
3836 		__le16 peer_id; /* specify the peer_id (msb=0)
3837 				 * or group_id (msb=1)
3838 				 */
3839 		u8 duration; /* 256 us */
3840 		u8 bss_idx;
3841 		__le64 start_tsf;
3842 		__le16 mantissa;
3843 		u8 exponent;
3844 		u8 is_ap;
3845 		u8 agrt_params;
3846 		u8 rsv[23];
3847 	} __packed req = {
3848 		.tbl_idx = flow->table_id,
3849 		.cmd = cmd,
3850 		.own_mac_idx = mvif->mt76.omac_idx,
3851 		.flowid = flow->id,
3852 		.peer_id = cpu_to_le16(flow->wcid),
3853 		.duration = flow->duration,
3854 		.bss_idx = mvif->mt76.idx,
3855 		.start_tsf = cpu_to_le64(flow->tsf),
3856 		.mantissa = flow->mantissa,
3857 		.exponent = flow->exp,
3858 		.is_ap = true,
3859 	};
3860 
3861 	if (flow->protection)
3862 		req.agrt_params |= TWT_AGRT_PROTECT;
3863 	if (!flow->flowtype)
3864 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3865 	if (flow->trigger)
3866 		req.agrt_params |= TWT_AGRT_TRIGGER;
3867 
3868 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3869 				 &req, sizeof(req), true);
3870 }
3871 
3872 int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
3873 {
3874 	struct {
3875 		__le32 cmd;
3876 		__le32 arg0;
3877 		__le32 arg1;
3878 		__le16 arg2;
3879 	} __packed req = {
3880 		.cmd = cpu_to_le32(0x15),
3881 	};
3882 	struct mt7915_mcu_wa_tx_stat {
3883 		__le16 wcid;
3884 		u8 __rsv2[2];
3885 
3886 		/* tx_bytes is deprecated since WA byte counter uses u32,
3887 		 * which easily leads to overflow.
3888 		 */
3889 		__le32 tx_bytes;
3890 		__le32 tx_packets;
3891 	} __packed *res;
3892 	struct mt76_wcid *wcid;
3893 	struct sk_buff *skb;
3894 	int ret, len;
3895 	u16 ret_wcid;
3896 
3897 	if (is_mt7915(&dev->mt76)) {
3898 		req.arg0 = cpu_to_le32(wlan_idx);
3899 		len = sizeof(req) - sizeof(req.arg2);
3900 	} else {
3901 		req.arg0 = cpu_to_le32(1);
3902 		req.arg2 = cpu_to_le16(wlan_idx);
3903 		len = sizeof(req);
3904 	}
3905 
3906 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
3907 					&req, len, true, &skb);
3908 	if (ret)
3909 		return ret;
3910 
3911 	if (!is_mt7915(&dev->mt76))
3912 		skb_pull(skb, 4);
3913 
3914 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
3915 
3916 	ret_wcid = le16_to_cpu(res->wcid);
3917 	if (is_mt7915(&dev->mt76))
3918 		ret_wcid &= 0xff;
3919 
3920 	if (ret_wcid != wlan_idx) {
3921 		ret = -EINVAL;
3922 		goto out;
3923 	}
3924 
3925 	rcu_read_lock();
3926 
3927 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
3928 	if (wcid)
3929 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
3930 	else
3931 		ret = -EINVAL;
3932 
3933 	rcu_read_unlock();
3934 out:
3935 	dev_kfree_skb(skb);
3936 
3937 	return ret;
3938 }
3939 
3940 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3941 {
3942 	struct {
3943 		__le32 idx;
3944 		__le32 ofs;
3945 		__le32 data;
3946 	} __packed req = {
3947 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
3948 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
3949 		.data = set ? cpu_to_le32(*val) : 0,
3950 	};
3951 	struct sk_buff *skb;
3952 	int ret;
3953 
3954 	if (set)
3955 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3956 					 &req, sizeof(req), false);
3957 
3958 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3959 					&req, sizeof(req), true, &skb);
3960 	if (ret)
3961 		return ret;
3962 
3963 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3964 	dev_kfree_skb(skb);
3965 
3966 	return 0;
3967 }
3968