xref: /linux/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c (revision 65aa371ea52a92dd10826a2ea74bd2c395ee90a8)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
70 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
71 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
72 
73 #define DL_MODE_ENCRYPT			BIT(0)
74 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
75 #define DL_MODE_RESET_SEC_IV		BIT(3)
76 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
77 #define DL_MODE_NEED_RSP		BIT(31)
78 
79 #define FW_START_OVERRIDE		BIT(0)
80 #define FW_START_WORKING_PDA_CR4	BIT(2)
81 
82 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
83 #define PATCH_SEC_TYPE_INFO		0x2
84 
85 #define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
86 #define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
87 
88 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
89 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
90 
91 static enum mcu_cipher_type
92 mt7915_mcu_get_cipher(int cipher)
93 {
94 	switch (cipher) {
95 	case WLAN_CIPHER_SUITE_WEP40:
96 		return MCU_CIPHER_WEP40;
97 	case WLAN_CIPHER_SUITE_WEP104:
98 		return MCU_CIPHER_WEP104;
99 	case WLAN_CIPHER_SUITE_TKIP:
100 		return MCU_CIPHER_TKIP;
101 	case WLAN_CIPHER_SUITE_AES_CMAC:
102 		return MCU_CIPHER_BIP_CMAC_128;
103 	case WLAN_CIPHER_SUITE_CCMP:
104 		return MCU_CIPHER_AES_CCMP;
105 	case WLAN_CIPHER_SUITE_CCMP_256:
106 		return MCU_CIPHER_CCMP_256;
107 	case WLAN_CIPHER_SUITE_GCMP:
108 		return MCU_CIPHER_GCMP;
109 	case WLAN_CIPHER_SUITE_GCMP_256:
110 		return MCU_CIPHER_GCMP_256;
111 	case WLAN_CIPHER_SUITE_SMS4:
112 		return MCU_CIPHER_WAPI;
113 	default:
114 		return MCU_CIPHER_NONE;
115 	}
116 }
117 
118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
119 {
120 	static const u8 width_to_bw[] = {
121 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
122 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
123 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
124 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
125 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
126 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
127 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
128 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
129 	};
130 
131 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
132 		return 0;
133 
134 	return width_to_bw[chandef->width];
135 }
136 
137 static const struct ieee80211_sta_he_cap *
138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
139 {
140 	struct ieee80211_supported_band *sband;
141 	enum nl80211_band band;
142 
143 	band = phy->mt76->chandef.chan->band;
144 	sband = phy->mt76->hw->wiphy->bands[band];
145 
146 	return ieee80211_get_he_iftype_cap(sband, vif->type);
147 }
148 
149 static u8
150 mt7915_get_phy_mode(struct ieee80211_vif *vif, struct ieee80211_sta *sta)
151 {
152 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
153 	enum nl80211_band band = mvif->phy->mt76->chandef.chan->band;
154 	struct ieee80211_sta_ht_cap *ht_cap;
155 	struct ieee80211_sta_vht_cap *vht_cap;
156 	const struct ieee80211_sta_he_cap *he_cap;
157 	u8 mode = 0;
158 
159 	if (sta) {
160 		ht_cap = &sta->ht_cap;
161 		vht_cap = &sta->vht_cap;
162 		he_cap = &sta->he_cap;
163 	} else {
164 		struct ieee80211_supported_band *sband;
165 
166 		sband = mvif->phy->mt76->hw->wiphy->bands[band];
167 
168 		ht_cap = &sband->ht_cap;
169 		vht_cap = &sband->vht_cap;
170 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
171 	}
172 
173 	if (band == NL80211_BAND_2GHZ) {
174 		mode |= PHY_MODE_B | PHY_MODE_G;
175 
176 		if (ht_cap->ht_supported)
177 			mode |= PHY_MODE_GN;
178 
179 		if (he_cap->has_he)
180 			mode |= PHY_MODE_AX_24G;
181 	} else if (band == NL80211_BAND_5GHZ) {
182 		mode |= PHY_MODE_A;
183 
184 		if (ht_cap->ht_supported)
185 			mode |= PHY_MODE_AN;
186 
187 		if (vht_cap->vht_supported)
188 			mode |= PHY_MODE_AC;
189 
190 		if (he_cap->has_he)
191 			mode |= PHY_MODE_AX_5G;
192 	}
193 
194 	return mode;
195 }
196 
197 static u8
198 mt7915_mcu_get_sta_nss(u16 mcs_map)
199 {
200 	u8 nss;
201 
202 	for (nss = 8; nss > 0; nss--) {
203 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
204 
205 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
206 			break;
207 	}
208 
209 	return nss - 1;
210 }
211 
212 static void
213 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
214 			  const u16 *mask)
215 {
216 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
217 	struct cfg80211_chan_def *chandef = &msta->vif->phy->mt76->chandef;
218 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
219 	u16 mcs_map;
220 
221 	switch (chandef->width) {
222 	case NL80211_CHAN_WIDTH_80P80:
223 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80p80);
224 		break;
225 	case NL80211_CHAN_WIDTH_160:
226 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_160);
227 		break;
228 	default:
229 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80);
230 		break;
231 	}
232 
233 	for (nss = 0; nss < max_nss; nss++) {
234 		int mcs;
235 
236 		switch ((mcs_map >> (2 * nss)) & 0x3) {
237 		case IEEE80211_HE_MCS_SUPPORT_0_11:
238 			mcs = GENMASK(11, 0);
239 			break;
240 		case IEEE80211_HE_MCS_SUPPORT_0_9:
241 			mcs = GENMASK(9, 0);
242 			break;
243 		case IEEE80211_HE_MCS_SUPPORT_0_7:
244 			mcs = GENMASK(7, 0);
245 			break;
246 		default:
247 			mcs = 0;
248 		}
249 
250 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
251 
252 		switch (mcs) {
253 		case 0 ... 7:
254 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
255 			break;
256 		case 8 ... 9:
257 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
258 			break;
259 		case 10 ... 11:
260 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
261 			break;
262 		default:
263 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
264 			break;
265 		}
266 		mcs_map &= ~(0x3 << (nss * 2));
267 		mcs_map |= mcs << (nss * 2);
268 
269 		/* only support 2ss on 160MHz */
270 		if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
271 			break;
272 	}
273 
274 	*he_mcs = cpu_to_le16(mcs_map);
275 }
276 
277 static void
278 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
279 			   const u16 *mask)
280 {
281 	u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
282 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
283 	u16 mcs;
284 
285 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
286 		switch (mcs_map & 0x3) {
287 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
288 			mcs = GENMASK(9, 0);
289 			break;
290 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
291 			mcs = GENMASK(8, 0);
292 			break;
293 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
294 			mcs = GENMASK(7, 0);
295 			break;
296 		default:
297 			mcs = 0;
298 		}
299 
300 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
301 
302 		/* only support 2ss on 160MHz */
303 		if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
304 			break;
305 	}
306 }
307 
308 static void
309 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
310 			  const u8 *mask)
311 {
312 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
313 
314 	for (nss = 0; nss < max_nss; nss++)
315 		ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
316 }
317 
318 static int
319 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
320 			  struct sk_buff *skb, int seq)
321 {
322 	struct mt7915_mcu_rxd *rxd;
323 	int ret = 0;
324 
325 	if (!skb) {
326 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
327 			cmd, seq);
328 		return -ETIMEDOUT;
329 	}
330 
331 	rxd = (struct mt7915_mcu_rxd *)skb->data;
332 	if (seq != rxd->seq)
333 		return -EAGAIN;
334 
335 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
336 		skb_pull(skb, sizeof(*rxd) - 4);
337 		ret = *skb->data;
338 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
339 		skb_pull(skb, sizeof(*rxd) + 4);
340 		ret = le32_to_cpu(*(__le32 *)skb->data);
341 	} else {
342 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
343 	}
344 
345 	return ret;
346 }
347 
348 static int
349 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
350 			int cmd, int *wait_seq)
351 {
352 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
353 	struct mt7915_mcu_txd *mcu_txd;
354 	enum mt76_mcuq_id qid;
355 	__le32 *txd;
356 	u32 val;
357 	u8 seq;
358 
359 	/* TODO: make dynamic based on msg type */
360 	mdev->mcu.timeout = 20 * HZ;
361 
362 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
363 	if (!seq)
364 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
365 
366 	if (cmd == MCU_CMD(FW_SCATTER)) {
367 		qid = MT_MCUQ_FWDL;
368 		goto exit;
369 	}
370 
371 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
372 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
373 		qid = MT_MCUQ_WA;
374 	else
375 		qid = MT_MCUQ_WM;
376 
377 	txd = mcu_txd->txd;
378 
379 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
380 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
381 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
382 	txd[0] = cpu_to_le32(val);
383 
384 	val = MT_TXD1_LONG_FORMAT |
385 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
386 	txd[1] = cpu_to_le32(val);
387 
388 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
389 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
390 					       MT_TX_MCU_PORT_RX_Q0));
391 	mcu_txd->pkt_type = MCU_PKT_ID;
392 	mcu_txd->seq = seq;
393 
394 	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
395 	mcu_txd->set_query = MCU_Q_NA;
396 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
397 	if (mcu_txd->ext_cid) {
398 		mcu_txd->ext_cid_ack = 1;
399 
400 		/* do not use Q_SET for efuse */
401 		if (cmd & __MCU_CMD_FIELD_QUERY)
402 			mcu_txd->set_query = MCU_Q_QUERY;
403 		else
404 			mcu_txd->set_query = MCU_Q_SET;
405 	}
406 
407 	if (cmd & __MCU_CMD_FIELD_WA)
408 		mcu_txd->s2d_index = MCU_S2D_H2C;
409 	else
410 		mcu_txd->s2d_index = MCU_S2D_H2N;
411 
412 exit:
413 	if (wait_seq)
414 		*wait_seq = seq;
415 
416 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
417 }
418 
419 static int
420 mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
421 {
422 	struct {
423 		__le32 args[3];
424 	} req = {
425 		.args = {
426 			cpu_to_le32(a1),
427 			cpu_to_le32(a2),
428 			cpu_to_le32(a3),
429 		},
430 	};
431 
432 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
433 }
434 
435 static void
436 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
437 {
438 	if (vif->csa_active)
439 		ieee80211_csa_finish(vif);
440 }
441 
442 static void
443 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
444 {
445 	struct mt76_phy *mphy = &dev->mt76.phy;
446 	struct mt7915_mcu_csa_notify *c;
447 
448 	c = (struct mt7915_mcu_csa_notify *)skb->data;
449 
450 	if (c->band_idx && dev->mt76.phy2)
451 		mphy = dev->mt76.phy2;
452 
453 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
454 			IEEE80211_IFACE_ITER_RESUME_ALL,
455 			mt7915_mcu_csa_finish, mphy->hw);
456 }
457 
458 static void
459 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
460 {
461 	struct mt76_phy *mphy = &dev->mt76.phy;
462 	struct mt7915_mcu_thermal_notify *t;
463 	struct mt7915_phy *phy;
464 
465 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
466 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
467 		return;
468 
469 	if (t->ctrl.band_idx && dev->mt76.phy2)
470 		mphy = dev->mt76.phy2;
471 
472 	phy = (struct mt7915_phy *)mphy->priv;
473 	phy->throttle_state = t->ctrl.duty.duty_cycle;
474 }
475 
476 static void
477 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
478 {
479 	struct mt76_phy *mphy = &dev->mt76.phy;
480 	struct mt7915_mcu_rdd_report *r;
481 
482 	r = (struct mt7915_mcu_rdd_report *)skb->data;
483 
484 	if (r->band_idx && dev->mt76.phy2)
485 		mphy = dev->mt76.phy2;
486 
487 	ieee80211_radar_detected(mphy->hw);
488 	dev->hw_pattern++;
489 }
490 
491 static void
492 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
493 {
494 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
495 	const char *data = (char *)&rxd[1];
496 	const char *type;
497 
498 	switch (rxd->s2d_index) {
499 	case 0:
500 		type = "WM";
501 		break;
502 	case 2:
503 		type = "WA";
504 		break;
505 	default:
506 		type = "unknown";
507 		break;
508 	}
509 
510 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
511 		   (int)(skb->len - sizeof(*rxd)), data);
512 }
513 
514 static void
515 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
516 {
517 	if (!vif->color_change_active)
518 		return;
519 
520 	ieee80211_color_change_finish(vif);
521 }
522 
523 static void
524 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
525 {
526 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
527 
528 	switch (rxd->ext_eid) {
529 	case MCU_EXT_EVENT_THERMAL_PROTECT:
530 		mt7915_mcu_rx_thermal_notify(dev, skb);
531 		break;
532 	case MCU_EXT_EVENT_RDD_REPORT:
533 		mt7915_mcu_rx_radar_detected(dev, skb);
534 		break;
535 	case MCU_EXT_EVENT_CSA_NOTIFY:
536 		mt7915_mcu_rx_csa_notify(dev, skb);
537 		break;
538 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
539 		mt7915_mcu_rx_log_message(dev, skb);
540 		break;
541 	case MCU_EXT_EVENT_BCC_NOTIFY:
542 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
543 				IEEE80211_IFACE_ITER_RESUME_ALL,
544 				mt7915_mcu_cca_finish, dev);
545 		break;
546 	default:
547 		break;
548 	}
549 }
550 
551 static void
552 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
553 {
554 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
555 
556 	switch (rxd->eid) {
557 	case MCU_EVENT_EXT:
558 		mt7915_mcu_rx_ext_event(dev, skb);
559 		break;
560 	default:
561 		break;
562 	}
563 	dev_kfree_skb(skb);
564 }
565 
566 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
567 {
568 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
569 
570 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
571 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
572 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
573 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
574 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
575 	    !rxd->seq)
576 		mt7915_mcu_rx_unsolicited_event(dev, skb);
577 	else
578 		mt76_mcu_rx_event(&dev->mt76, skb);
579 }
580 
581 static struct sk_buff *
582 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
583 			 struct mt7915_sta *msta, int len)
584 {
585 	struct sta_req_hdr hdr = {
586 		.bss_idx = mvif->idx,
587 		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
588 		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
589 		.muar_idx = msta && msta->wcid.sta ? mvif->omac_idx : 0xe,
590 		.is_tlv_append = 1,
591 	};
592 	struct sk_buff *skb;
593 
594 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
595 	if (!skb)
596 		return ERR_PTR(-ENOMEM);
597 
598 	skb_put_data(skb, &hdr, sizeof(hdr));
599 
600 	return skb;
601 }
602 
603 static struct wtbl_req_hdr *
604 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
605 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
606 {
607 	struct tlv *sta_hdr = sta_wtbl;
608 	struct wtbl_req_hdr hdr = {
609 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
610 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
611 		.operation = cmd,
612 	};
613 	struct sk_buff *nskb = *skb;
614 
615 	if (!nskb) {
616 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
617 					  MT7915_WTBL_UPDATE_MAX_SIZE);
618 		if (!nskb)
619 			return ERR_PTR(-ENOMEM);
620 
621 		*skb = nskb;
622 	}
623 
624 	if (sta_hdr)
625 		le16_add_cpu(&sta_hdr->len, sizeof(hdr));
626 
627 	return skb_put_data(nskb, &hdr, sizeof(hdr));
628 }
629 
630 static struct tlv *
631 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
632 			  void *sta_ntlv, void *sta_wtbl)
633 {
634 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
635 	struct tlv *sta_hdr = sta_wtbl;
636 	struct tlv *ptlv, tlv = {
637 		.tag = cpu_to_le16(tag),
638 		.len = cpu_to_le16(len),
639 	};
640 	u16 ntlv;
641 
642 	ptlv = skb_put(skb, len);
643 	memcpy(ptlv, &tlv, sizeof(tlv));
644 
645 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
646 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
647 
648 	if (sta_hdr) {
649 		u16 size = le16_to_cpu(sta_hdr->len);
650 
651 		sta_hdr->len = cpu_to_le16(size + len);
652 	}
653 
654 	return ptlv;
655 }
656 
657 static struct tlv *
658 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
659 {
660 	return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
661 }
662 
663 static struct tlv *
664 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
665 			     __le16 *sub_ntlv, __le16 *len)
666 {
667 	struct tlv *ptlv, tlv = {
668 		.tag = cpu_to_le16(sub_tag),
669 		.len = cpu_to_le16(sub_len),
670 	};
671 
672 	ptlv = skb_put(skb, sub_len);
673 	memcpy(ptlv, &tlv, sizeof(tlv));
674 
675 	le16_add_cpu(sub_ntlv, 1);
676 	le16_add_cpu(len, sub_len);
677 
678 	return ptlv;
679 }
680 
681 /** bss info **/
682 static int
683 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
684 			 struct mt7915_phy *phy, bool enable)
685 {
686 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
687 	struct bss_info_basic *bss;
688 	u16 wlan_idx = mvif->sta.wcid.idx;
689 	u32 type = NETWORK_INFRA;
690 	struct tlv *tlv;
691 
692 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
693 
694 	switch (vif->type) {
695 	case NL80211_IFTYPE_MESH_POINT:
696 	case NL80211_IFTYPE_AP:
697 	case NL80211_IFTYPE_MONITOR:
698 		break;
699 	case NL80211_IFTYPE_STATION:
700 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
701 		if (enable) {
702 			struct ieee80211_sta *sta;
703 			struct mt7915_sta *msta;
704 
705 			rcu_read_lock();
706 			sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
707 			if (!sta) {
708 				rcu_read_unlock();
709 				return -EINVAL;
710 			}
711 
712 			msta = (struct mt7915_sta *)sta->drv_priv;
713 			wlan_idx = msta->wcid.idx;
714 			rcu_read_unlock();
715 		}
716 		break;
717 	case NL80211_IFTYPE_ADHOC:
718 		type = NETWORK_IBSS;
719 		break;
720 	default:
721 		WARN_ON(1);
722 		break;
723 	}
724 
725 	bss = (struct bss_info_basic *)tlv;
726 	bss->network_type = cpu_to_le32(type);
727 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
728 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
729 	bss->wmm_idx = mvif->wmm_idx;
730 	bss->active = enable;
731 
732 	if (vif->type != NL80211_IFTYPE_MONITOR) {
733 		memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
734 		bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
735 		bss->dtim_period = vif->bss_conf.dtim_period;
736 		bss->phy_mode = mt7915_get_phy_mode(vif, NULL);
737 	} else {
738 		memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
739 	}
740 
741 	return 0;
742 }
743 
744 static void
745 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
746 {
747 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
748 	struct bss_info_omac *omac;
749 	struct tlv *tlv;
750 	u32 type = 0;
751 	u8 idx;
752 
753 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
754 
755 	switch (vif->type) {
756 	case NL80211_IFTYPE_MONITOR:
757 	case NL80211_IFTYPE_MESH_POINT:
758 	case NL80211_IFTYPE_AP:
759 		type = CONNECTION_INFRA_AP;
760 		break;
761 	case NL80211_IFTYPE_STATION:
762 		type = CONNECTION_INFRA_STA;
763 		break;
764 	case NL80211_IFTYPE_ADHOC:
765 		type = CONNECTION_IBSS_ADHOC;
766 		break;
767 	default:
768 		WARN_ON(1);
769 		break;
770 	}
771 
772 	omac = (struct bss_info_omac *)tlv;
773 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
774 	omac->conn_type = cpu_to_le32(type);
775 	omac->omac_idx = mvif->omac_idx;
776 	omac->band_idx = mvif->band_idx;
777 	omac->hw_bss_idx = idx;
778 }
779 
780 struct mt7915_he_obss_narrow_bw_ru_data {
781 	bool tolerated;
782 };
783 
784 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
785 						   struct cfg80211_bss *bss,
786 						   void *_data)
787 {
788 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
789 	const struct element *elem;
790 
791 	rcu_read_lock();
792 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
793 
794 	if (!elem || elem->datalen <= 10 ||
795 	    !(elem->data[10] &
796 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
797 		data->tolerated = false;
798 
799 	rcu_read_unlock();
800 }
801 
802 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
803 					      struct ieee80211_vif *vif)
804 {
805 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
806 		.tolerated = true,
807 	};
808 
809 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
810 		return false;
811 
812 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
813 			  mt7915_check_he_obss_narrow_bw_ru_iter,
814 			  &iter_data);
815 
816 	/*
817 	 * If there is at least one AP on radar channel that cannot
818 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
819 	 */
820 	return !iter_data.tolerated;
821 }
822 
823 static void
824 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
825 			struct mt7915_phy *phy)
826 {
827 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
828 	struct bss_info_rf_ch *ch;
829 	struct tlv *tlv;
830 	int freq1 = chandef->center_freq1;
831 
832 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
833 
834 	ch = (struct bss_info_rf_ch *)tlv;
835 	ch->pri_ch = chandef->chan->hw_value;
836 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
837 	ch->bw = mt7915_mcu_chan_bw(chandef);
838 
839 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
840 		int freq2 = chandef->center_freq2;
841 
842 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
843 	}
844 
845 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
846 		struct mt7915_dev *dev = phy->dev;
847 		struct mt76_phy *mphy = &dev->mt76.phy;
848 		bool ext_phy = phy != &dev->phy;
849 
850 		if (ext_phy && dev->mt76.phy2)
851 			mphy = dev->mt76.phy2;
852 
853 		ch->he_ru26_block =
854 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
855 		ch->he_all_disable = false;
856 	} else {
857 		ch->he_all_disable = true;
858 	}
859 }
860 
861 static void
862 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
863 		      struct mt7915_phy *phy)
864 {
865 	int max_nss = hweight8(phy->mt76->chainmask);
866 	struct bss_info_ra *ra;
867 	struct tlv *tlv;
868 
869 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
870 
871 	ra = (struct bss_info_ra *)tlv;
872 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
873 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
874 	ra->short_preamble = true;
875 	ra->tx_streams = max_nss;
876 	ra->rx_streams = max_nss;
877 	ra->algo = 4;
878 	ra->train_up_rule = 2;
879 	ra->train_up_high_thres = 110;
880 	ra->train_up_rule_rssi = -70;
881 	ra->low_traffic_thres = 2;
882 	ra->phy_cap = cpu_to_le32(0xfdf);
883 	ra->interval = cpu_to_le32(500);
884 	ra->fast_interval = cpu_to_le32(100);
885 }
886 
887 static void
888 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
889 		      struct mt7915_phy *phy)
890 {
891 #define DEFAULT_HE_PE_DURATION		4
892 #define DEFAULT_HE_DURATION_RTS_THRES	1023
893 	const struct ieee80211_sta_he_cap *cap;
894 	struct bss_info_he *he;
895 	struct tlv *tlv;
896 
897 	cap = mt7915_get_he_phy_cap(phy, vif);
898 
899 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
900 
901 	he = (struct bss_info_he *)tlv;
902 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
903 	if (!he->he_pe_duration)
904 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
905 
906 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
907 	if (!he->he_rts_thres)
908 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
909 
910 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
911 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
912 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
913 }
914 
915 static void
916 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
917 {
918 #define TXD_CMP_MAP1		GENMASK(15, 0)
919 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
920 	struct bss_info_hw_amsdu *amsdu;
921 	struct tlv *tlv;
922 
923 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
924 
925 	amsdu = (struct bss_info_hw_amsdu *)tlv;
926 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
927 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
928 	amsdu->trig_thres = cpu_to_le16(2);
929 	amsdu->enable = true;
930 }
931 
932 static void
933 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
934 {
935 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
936 #define BCN_TX_ESTIMATE_TIME	(4096 + 20)
937 	struct bss_info_ext_bss *ext;
938 	int ext_bss_idx, tsf_offset;
939 	struct tlv *tlv;
940 
941 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
942 	if (ext_bss_idx < 0)
943 		return;
944 
945 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
946 
947 	ext = (struct bss_info_ext_bss *)tlv;
948 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
949 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
950 }
951 
952 static void
953 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
954 {
955 	struct bss_info_bmc_rate *bmc;
956 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
957 	enum nl80211_band band = chandef->chan->band;
958 	struct tlv *tlv;
959 
960 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
961 
962 	bmc = (struct bss_info_bmc_rate *)tlv;
963 	if (band == NL80211_BAND_2GHZ) {
964 		bmc->short_preamble = true;
965 	} else {
966 		bmc->bc_trans = cpu_to_le16(0x2000);
967 		bmc->mc_trans = cpu_to_le16(0x2080);
968 	}
969 }
970 
971 static int
972 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
973 		       bool bssid, bool enable)
974 {
975 	struct mt7915_dev *dev = phy->dev;
976 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
977 	u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
978 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
979 	const u8 *addr = vif->addr;
980 	struct {
981 		u8 mode;
982 		u8 force_clear;
983 		u8 clear_bitmap[8];
984 		u8 entry_count;
985 		u8 write;
986 		u8 band;
987 
988 		u8 index;
989 		u8 bssid;
990 		u8 addr[ETH_ALEN];
991 	} __packed req = {
992 		.mode = !!mask || enable,
993 		.entry_count = 1,
994 		.write = 1,
995 		.band = phy != &dev->phy,
996 		.index = idx * 2 + bssid,
997 	};
998 
999 	if (bssid)
1000 		addr = vif->bss_conf.bssid;
1001 
1002 	if (enable)
1003 		ether_addr_copy(req.addr, addr);
1004 
1005 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
1006 				 sizeof(req), true);
1007 }
1008 
1009 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1010 			    struct ieee80211_vif *vif, int enable)
1011 {
1012 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1013 	struct sk_buff *skb;
1014 
1015 	if (mvif->omac_idx >= REPEATER_BSSID_START) {
1016 		mt7915_mcu_muar_config(phy, vif, false, enable);
1017 		mt7915_mcu_muar_config(phy, vif, true, enable);
1018 	}
1019 
1020 	skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1021 				       MT7915_BSS_UPDATE_MAX_SIZE);
1022 	if (IS_ERR(skb))
1023 		return PTR_ERR(skb);
1024 
1025 	/* bss_omac must be first */
1026 	if (enable)
1027 		mt7915_mcu_bss_omac_tlv(skb, vif);
1028 
1029 	mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1030 
1031 	if (vif->type == NL80211_IFTYPE_MONITOR)
1032 		goto out;
1033 
1034 	if (enable) {
1035 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1036 		mt7915_mcu_bss_bmc_tlv(skb, phy);
1037 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1038 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
1039 
1040 		if (vif->bss_conf.he_support)
1041 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
1042 
1043 		if (mvif->omac_idx >= EXT_BSSID_START &&
1044 		    mvif->omac_idx < REPEATER_BSSID_START)
1045 			mt7915_mcu_bss_ext_tlv(skb, mvif);
1046 	}
1047 out:
1048 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1049 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1050 }
1051 
1052 /** starec & wtbl **/
1053 static int
1054 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1055 		       struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1056 {
1057 	struct mt7915_sta_key_conf *bip = &msta->bip;
1058 	struct sta_rec_sec *sec;
1059 	struct tlv *tlv;
1060 	u32 len = sizeof(*sec);
1061 
1062 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1063 
1064 	sec = (struct sta_rec_sec *)tlv;
1065 	sec->add = cmd;
1066 
1067 	if (cmd == SET_KEY) {
1068 		struct sec_key *sec_key;
1069 		u8 cipher;
1070 
1071 		cipher = mt7915_mcu_get_cipher(key->cipher);
1072 		if (cipher == MCU_CIPHER_NONE)
1073 			return -EOPNOTSUPP;
1074 
1075 		sec_key = &sec->key[0];
1076 		sec_key->cipher_len = sizeof(*sec_key);
1077 
1078 		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
1079 			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
1080 			sec_key->key_id = bip->keyidx;
1081 			sec_key->key_len = 16;
1082 			memcpy(sec_key->key, bip->key, 16);
1083 
1084 			sec_key = &sec->key[1];
1085 			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
1086 			sec_key->cipher_len = sizeof(*sec_key);
1087 			sec_key->key_len = 16;
1088 			memcpy(sec_key->key, key->key, 16);
1089 
1090 			sec->n_cipher = 2;
1091 		} else {
1092 			sec_key->cipher_id = cipher;
1093 			sec_key->key_id = key->keyidx;
1094 			sec_key->key_len = key->keylen;
1095 			memcpy(sec_key->key, key->key, key->keylen);
1096 
1097 			if (cipher == MCU_CIPHER_TKIP) {
1098 				/* Rx/Tx MIC keys are swapped */
1099 				memcpy(sec_key->key + 16, key->key + 24, 8);
1100 				memcpy(sec_key->key + 24, key->key + 16, 8);
1101 			}
1102 
1103 			/* store key_conf for BIP batch update */
1104 			if (cipher == MCU_CIPHER_AES_CCMP) {
1105 				memcpy(bip->key, key->key, key->keylen);
1106 				bip->keyidx = key->keyidx;
1107 			}
1108 
1109 			len -= sizeof(*sec_key);
1110 			sec->n_cipher = 1;
1111 		}
1112 	} else {
1113 		len -= sizeof(sec->key);
1114 		sec->n_cipher = 0;
1115 	}
1116 	sec->len = cpu_to_le16(len);
1117 
1118 	return 0;
1119 }
1120 
1121 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1122 		       struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1123 		       enum set_key_cmd cmd)
1124 {
1125 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1126 	struct sk_buff *skb;
1127 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1128 	int ret;
1129 
1130 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1131 	if (IS_ERR(skb))
1132 		return PTR_ERR(skb);
1133 
1134 	ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1135 	if (ret)
1136 		return ret;
1137 
1138 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1139 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1140 }
1141 
1142 static void
1143 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1144 		      struct ieee80211_ampdu_params *params,
1145 		      bool enable, bool tx)
1146 {
1147 	struct sta_rec_ba *ba;
1148 	struct tlv *tlv;
1149 
1150 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1151 
1152 	ba = (struct sta_rec_ba *)tlv;
1153 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1154 	ba->winsize = cpu_to_le16(params->buf_size);
1155 	ba->ssn = cpu_to_le16(params->ssn);
1156 	ba->ba_en = enable << params->tid;
1157 	ba->amsdu = params->amsdu;
1158 	ba->tid = params->tid;
1159 }
1160 
1161 static void
1162 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1163 		       struct ieee80211_ampdu_params *params,
1164 		       bool enable, bool tx, void *sta_wtbl,
1165 		       void *wtbl_tlv)
1166 {
1167 	struct wtbl_ba *ba;
1168 	struct tlv *tlv;
1169 
1170 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1171 					wtbl_tlv, sta_wtbl);
1172 
1173 	ba = (struct wtbl_ba *)tlv;
1174 	ba->tid = params->tid;
1175 
1176 	if (tx) {
1177 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1178 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1179 		ba->ba_en = enable;
1180 	} else {
1181 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1182 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1183 		ba->rst_ba_tid = params->tid;
1184 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1185 		ba->rst_ba_sb = 1;
1186 	}
1187 
1188 	if (enable)
1189 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1190 }
1191 
1192 static int
1193 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1194 		  struct ieee80211_ampdu_params *params,
1195 		  bool enable, bool tx)
1196 {
1197 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1198 	struct mt7915_vif *mvif = msta->vif;
1199 	struct wtbl_req_hdr *wtbl_hdr;
1200 	struct tlv *sta_wtbl;
1201 	struct sk_buff *skb;
1202 	int ret;
1203 
1204 	if (enable && tx && !params->amsdu)
1205 		msta->wcid.amsdu = false;
1206 
1207 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1208 				       MT7915_STA_UPDATE_MAX_SIZE);
1209 	if (IS_ERR(skb))
1210 		return PTR_ERR(skb);
1211 
1212 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1213 
1214 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1215 					     &skb);
1216 	if (IS_ERR(wtbl_hdr))
1217 		return PTR_ERR(wtbl_hdr);
1218 
1219 	mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1220 
1221 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1222 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1223 	if (ret)
1224 		return ret;
1225 
1226 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1227 				       MT7915_STA_UPDATE_MAX_SIZE);
1228 	if (IS_ERR(skb))
1229 		return PTR_ERR(skb);
1230 
1231 	mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1232 
1233 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1234 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1235 }
1236 
1237 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1238 			 struct ieee80211_ampdu_params *params,
1239 			 bool enable)
1240 {
1241 	return mt7915_mcu_sta_ba(dev, params, enable, true);
1242 }
1243 
1244 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1245 			 struct ieee80211_ampdu_params *params,
1246 			 bool enable)
1247 {
1248 	return mt7915_mcu_sta_ba(dev, params, enable, false);
1249 }
1250 
1251 static void
1252 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1253 			    struct ieee80211_sta *sta, void *sta_wtbl,
1254 			    void *wtbl_tlv)
1255 {
1256 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1257 	struct wtbl_generic *generic;
1258 	struct wtbl_rx *rx;
1259 	struct tlv *tlv;
1260 
1261 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1262 					wtbl_tlv, sta_wtbl);
1263 
1264 	generic = (struct wtbl_generic *)tlv;
1265 
1266 	if (sta) {
1267 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1268 		generic->partial_aid = cpu_to_le16(sta->aid);
1269 		generic->muar_idx = mvif->omac_idx;
1270 		generic->qos = sta->wme;
1271 	} else {
1272 		/* use BSSID in station mode */
1273 		if (vif->type == NL80211_IFTYPE_STATION)
1274 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
1275 			       ETH_ALEN);
1276 		else
1277 			eth_broadcast_addr(generic->peer_addr);
1278 
1279 		generic->muar_idx = 0xe;
1280 	}
1281 
1282 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1283 					wtbl_tlv, sta_wtbl);
1284 
1285 	rx = (struct wtbl_rx *)tlv;
1286 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1287 	rx->rca2 = 1;
1288 	rx->rv = 1;
1289 }
1290 
1291 static void
1292 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1293 			 struct ieee80211_sta *sta, bool enable)
1294 {
1295 #define EXTRA_INFO_VER          BIT(0)
1296 #define EXTRA_INFO_NEW          BIT(1)
1297 	struct sta_rec_basic *basic;
1298 	struct tlv *tlv;
1299 
1300 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1301 
1302 	basic = (struct sta_rec_basic *)tlv;
1303 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1304 
1305 	if (enable) {
1306 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1307 		basic->conn_state = CONN_STATE_PORT_SECURE;
1308 	} else {
1309 		basic->conn_state = CONN_STATE_DISCONNECT;
1310 	}
1311 
1312 	if (!sta) {
1313 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1314 		eth_broadcast_addr(basic->peer_addr);
1315 		return;
1316 	}
1317 
1318 	switch (vif->type) {
1319 	case NL80211_IFTYPE_MESH_POINT:
1320 	case NL80211_IFTYPE_AP:
1321 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1322 		break;
1323 	case NL80211_IFTYPE_STATION:
1324 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1325 		break;
1326 	case NL80211_IFTYPE_ADHOC:
1327 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1328 		break;
1329 	default:
1330 		WARN_ON(1);
1331 		break;
1332 	}
1333 
1334 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1335 	basic->aid = cpu_to_le16(sta->aid);
1336 	basic->qos = sta->wme;
1337 }
1338 
1339 static void
1340 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1341 		      struct ieee80211_vif *vif)
1342 {
1343 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1344 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1345 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
1346 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
1347 	const u16 *mcs_mask = msta->vif->bitrate_mask.control[band].he_mcs;
1348 	struct sta_rec_he *he;
1349 	struct tlv *tlv;
1350 	u32 cap = 0;
1351 
1352 	if (!sta->he_cap.has_he)
1353 		return;
1354 
1355 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1356 
1357 	he = (struct sta_rec_he *)tlv;
1358 
1359 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1360 		cap |= STA_REC_HE_CAP_HTC;
1361 
1362 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1363 		cap |= STA_REC_HE_CAP_BSR;
1364 
1365 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1366 		cap |= STA_REC_HE_CAP_OM;
1367 
1368 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
1369 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1370 
1371 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1372 		cap |= STA_REC_HE_CAP_BQR;
1373 
1374 	if (elem->phy_cap_info[0] &
1375 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1376 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1377 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1378 
1379 	if (mvif->cap.ldpc && (elem->phy_cap_info[1] &
1380 			       IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
1381 		cap |= STA_REC_HE_CAP_LDPC;
1382 
1383 	if (elem->phy_cap_info[1] &
1384 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1385 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1386 
1387 	if (elem->phy_cap_info[2] &
1388 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1389 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1390 
1391 	if (elem->phy_cap_info[2] &
1392 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1393 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1394 
1395 	if (elem->phy_cap_info[2] &
1396 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1397 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1398 
1399 	if (elem->phy_cap_info[6] &
1400 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
1401 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1402 
1403 	if (elem->phy_cap_info[6] &
1404 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1405 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1406 
1407 	if (elem->phy_cap_info[7] &
1408 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1409 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1410 
1411 	if (elem->phy_cap_info[7] &
1412 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1413 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1414 
1415 	if (elem->phy_cap_info[7] &
1416 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1417 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1418 
1419 	if (elem->phy_cap_info[8] &
1420 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1421 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1422 
1423 	if (elem->phy_cap_info[8] &
1424 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1425 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1426 
1427 	if (elem->phy_cap_info[9] &
1428 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1429 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1430 
1431 	if (elem->phy_cap_info[9] &
1432 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1433 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1434 
1435 	he->he_cap = cpu_to_le32(cap);
1436 
1437 	switch (sta->bandwidth) {
1438 	case IEEE80211_STA_RX_BW_160:
1439 		if (elem->phy_cap_info[0] &
1440 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1441 			mt7915_mcu_set_sta_he_mcs(sta,
1442 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
1443 						  mcs_mask);
1444 
1445 		mt7915_mcu_set_sta_he_mcs(sta,
1446 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
1447 					  mcs_mask);
1448 		fallthrough;
1449 	default:
1450 		mt7915_mcu_set_sta_he_mcs(sta,
1451 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
1452 					  mcs_mask);
1453 		break;
1454 	}
1455 
1456 	he->t_frame_dur =
1457 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1458 	he->max_ampdu_exp =
1459 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1460 
1461 	he->bw_set =
1462 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1463 	he->device_class =
1464 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1465 	he->punc_pream_rx =
1466 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1467 
1468 	he->dcm_tx_mode =
1469 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1470 	he->dcm_tx_max_nss =
1471 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1472 	he->dcm_rx_mode =
1473 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1474 	he->dcm_rx_max_nss =
1475 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1476 	he->dcm_rx_max_nss =
1477 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1478 
1479 	he->pkt_ext = 2;
1480 }
1481 
1482 static void
1483 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1484 		     struct ieee80211_vif *vif)
1485 {
1486 	struct sta_rec_uapsd *uapsd;
1487 	struct tlv *tlv;
1488 
1489 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1490 		return;
1491 
1492 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1493 	uapsd = (struct sta_rec_uapsd *)tlv;
1494 
1495 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1496 		uapsd->dac_map |= BIT(3);
1497 		uapsd->tac_map |= BIT(3);
1498 	}
1499 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1500 		uapsd->dac_map |= BIT(2);
1501 		uapsd->tac_map |= BIT(2);
1502 	}
1503 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1504 		uapsd->dac_map |= BIT(1);
1505 		uapsd->tac_map |= BIT(1);
1506 	}
1507 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1508 		uapsd->dac_map |= BIT(0);
1509 		uapsd->tac_map |= BIT(0);
1510 	}
1511 	uapsd->max_sp = sta->max_sp;
1512 }
1513 
1514 static void
1515 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1516 			struct ieee80211_vif *vif)
1517 {
1518 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1519 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
1520 	struct sta_rec_muru *muru;
1521 	struct tlv *tlv;
1522 
1523 	if (vif->type != NL80211_IFTYPE_STATION &&
1524 	    vif->type != NL80211_IFTYPE_AP)
1525 		return;
1526 
1527 	if (!sta->vht_cap.vht_supported)
1528 		return;
1529 
1530 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1531 
1532 	muru = (struct sta_rec_muru *)tlv;
1533 
1534 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
1535 			       mvif->cap.vht_mu_ebfer ||
1536 			       mvif->cap.vht_mu_ebfee;
1537 
1538 	muru->mimo_dl.vht_mu_bfee =
1539 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1540 
1541 	if (!sta->he_cap.has_he)
1542 		return;
1543 
1544 	muru->mimo_dl.partial_bw_dl_mimo =
1545 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1546 
1547 	muru->cfg.mimo_ul_en = true;
1548 	muru->mimo_ul.full_ul_mimo =
1549 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1550 	muru->mimo_ul.partial_ul_mimo =
1551 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1552 
1553 	muru->cfg.ofdma_dl_en = true;
1554 	muru->ofdma_dl.punc_pream_rx =
1555 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1556 	muru->ofdma_dl.he_20m_in_40m_2g =
1557 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1558 	muru->ofdma_dl.he_20m_in_160m =
1559 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1560 	muru->ofdma_dl.he_80m_in_160m =
1561 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1562 
1563 	muru->ofdma_ul.t_frame_dur =
1564 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1565 	muru->ofdma_ul.mu_cascading =
1566 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1567 	muru->ofdma_ul.uo_ra =
1568 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1569 }
1570 
1571 static void
1572 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1573 {
1574 	struct sta_rec_ht *ht;
1575 	struct tlv *tlv;
1576 
1577 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1578 
1579 	ht = (struct sta_rec_ht *)tlv;
1580 	ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1581 }
1582 
1583 static void
1584 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1585 {
1586 	struct sta_rec_vht *vht;
1587 	struct tlv *tlv;
1588 
1589 	if (!sta->vht_cap.vht_supported)
1590 		return;
1591 
1592 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1593 
1594 	vht = (struct sta_rec_vht *)tlv;
1595 	vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1596 	vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1597 	vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1598 }
1599 
1600 static void
1601 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1602 			 struct ieee80211_sta *sta)
1603 {
1604 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1605 	struct sta_rec_amsdu *amsdu;
1606 	struct tlv *tlv;
1607 
1608 	if (vif->type != NL80211_IFTYPE_STATION &&
1609 	    vif->type != NL80211_IFTYPE_AP)
1610 		return;
1611 
1612 	if (!sta->max_amsdu_len)
1613 	    return;
1614 
1615 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1616 	amsdu = (struct sta_rec_amsdu *)tlv;
1617 	amsdu->max_amsdu_num = 8;
1618 	amsdu->amsdu_en = true;
1619 	amsdu->max_mpdu_size = sta->max_amsdu_len >=
1620 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
1621 	msta->wcid.amsdu = true;
1622 }
1623 
1624 static void
1625 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1626 			 void *sta_wtbl, void *wtbl_tlv)
1627 {
1628 	struct wtbl_smps *smps;
1629 	struct tlv *tlv;
1630 
1631 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1632 					wtbl_tlv, sta_wtbl);
1633 	smps = (struct wtbl_smps *)tlv;
1634 	smps->smps = (sta->smps_mode == IEEE80211_SMPS_DYNAMIC);
1635 }
1636 
1637 static void
1638 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1639 		       struct ieee80211_sta *sta, void *sta_wtbl,
1640 		       void *wtbl_tlv)
1641 {
1642 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1643 	struct wtbl_ht *ht = NULL;
1644 	struct tlv *tlv;
1645 
1646 	/* wtbl ht */
1647 	if (sta->ht_cap.ht_supported) {
1648 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1649 						wtbl_tlv, sta_wtbl);
1650 		ht = (struct wtbl_ht *)tlv;
1651 		ht->ldpc = mvif->cap.ldpc &&
1652 			   (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1653 		ht->af = sta->ht_cap.ampdu_factor;
1654 		ht->mm = sta->ht_cap.ampdu_density;
1655 		ht->ht = true;
1656 	}
1657 
1658 	/* wtbl vht */
1659 	if (sta->vht_cap.vht_supported) {
1660 		struct wtbl_vht *vht;
1661 		u8 af;
1662 
1663 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1664 						wtbl_tlv, sta_wtbl);
1665 		vht = (struct wtbl_vht *)tlv;
1666 		vht->ldpc = mvif->cap.ldpc &&
1667 			    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1668 		vht->vht = true;
1669 
1670 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1671 			       sta->vht_cap.cap);
1672 		if (ht)
1673 			ht->af = max_t(u8, ht->af, af);
1674 	}
1675 
1676 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1677 }
1678 
1679 static void
1680 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1681 			      struct ieee80211_sta *sta,
1682 			      void *sta_wtbl, void *wtbl_tlv)
1683 {
1684 	struct mt7915_sta *msta;
1685 	struct wtbl_hdr_trans *htr = NULL;
1686 	struct tlv *tlv;
1687 
1688 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1689 					wtbl_tlv, sta_wtbl);
1690 	htr = (struct wtbl_hdr_trans *)tlv;
1691 	htr->no_rx_trans = true;
1692 	if (vif->type == NL80211_IFTYPE_STATION)
1693 		htr->to_ds = true;
1694 	else
1695 		htr->from_ds = true;
1696 
1697 	if (!sta)
1698 		return;
1699 
1700 	msta = (struct mt7915_sta *)sta->drv_priv;
1701 	htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
1702 	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1703 		htr->to_ds = true;
1704 		htr->from_ds = true;
1705 	}
1706 }
1707 
1708 static int
1709 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1710 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1711 {
1712 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1713 	struct mt7915_sta *msta;
1714 	struct wtbl_req_hdr *wtbl_hdr;
1715 	struct tlv *tlv;
1716 
1717 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1718 
1719 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1720 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1721 					     tlv, &skb);
1722 	if (IS_ERR(wtbl_hdr))
1723 		return PTR_ERR(wtbl_hdr);
1724 
1725 	mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, tlv, wtbl_hdr);
1726 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, tlv, wtbl_hdr);
1727 
1728 	if (sta)
1729 		mt7915_mcu_wtbl_ht_tlv(skb, vif, sta, tlv, wtbl_hdr);
1730 
1731 	return 0;
1732 }
1733 
1734 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1735 				    struct ieee80211_vif *vif,
1736 				    struct ieee80211_sta *sta)
1737 {
1738 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1739 	struct wtbl_req_hdr *wtbl_hdr;
1740 	struct sk_buff *skb;
1741 
1742 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1743 	if (!skb)
1744 		return -ENOMEM;
1745 
1746 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1747 	if (IS_ERR(wtbl_hdr))
1748 		return PTR_ERR(wtbl_hdr);
1749 
1750 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1751 
1752 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1753 				     true);
1754 }
1755 
1756 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1757 			struct ieee80211_sta *sta)
1758 {
1759 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1760 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1761 	struct wtbl_req_hdr *wtbl_hdr;
1762 	struct tlv *sta_wtbl;
1763 	struct sk_buff *skb;
1764 
1765 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1766 				       MT7915_STA_UPDATE_MAX_SIZE);
1767 	if (IS_ERR(skb))
1768 		return PTR_ERR(skb);
1769 
1770 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1771 
1772 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1773 					     &skb);
1774 	if (IS_ERR(wtbl_hdr))
1775 		return PTR_ERR(wtbl_hdr);
1776 
1777 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1778 
1779 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1780 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1781 }
1782 
1783 static inline bool
1784 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1785 			struct ieee80211_sta *sta, bool bfee)
1786 {
1787 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1788 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1789 
1790 	if (vif->type != NL80211_IFTYPE_STATION &&
1791 	    vif->type != NL80211_IFTYPE_AP)
1792 		return false;
1793 
1794 	if (!bfee && tx_ant < 2)
1795 		return false;
1796 
1797 	if (sta->he_cap.has_he) {
1798 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1799 
1800 		if (bfee)
1801 			return mvif->cap.he_su_ebfee &&
1802 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1803 		else
1804 			return mvif->cap.he_su_ebfer &&
1805 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1806 	}
1807 
1808 	if (sta->vht_cap.vht_supported) {
1809 		u32 cap = sta->vht_cap.cap;
1810 
1811 		if (bfee)
1812 			return mvif->cap.vht_su_ebfee &&
1813 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1814 		else
1815 			return mvif->cap.vht_su_ebfer &&
1816 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1817 	}
1818 
1819 	return false;
1820 }
1821 
1822 static void
1823 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1824 {
1825 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1826 	bf->ndp_rate = 0;				/* mcs0 */
1827 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1828 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1829 }
1830 
1831 static void
1832 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1833 		       struct sta_rec_bf *bf)
1834 {
1835 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1836 	u8 n = 0;
1837 
1838 	bf->tx_mode = MT_PHY_TYPE_HT;
1839 
1840 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1841 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1842 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1843 			      mcs->tx_params);
1844 	else if (mcs->rx_mask[3])
1845 		n = 3;
1846 	else if (mcs->rx_mask[2])
1847 		n = 2;
1848 	else if (mcs->rx_mask[1])
1849 		n = 1;
1850 
1851 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1852 	bf->ncol = min_t(u8, bf->nrow, n);
1853 	bf->ibf_ncol = n;
1854 }
1855 
1856 static void
1857 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1858 			struct sta_rec_bf *bf, bool explicit)
1859 {
1860 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1861 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1862 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1863 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1864 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1865 
1866 	bf->tx_mode = MT_PHY_TYPE_VHT;
1867 
1868 	if (explicit) {
1869 		u8 sts, snd_dim;
1870 
1871 		mt7915_mcu_sta_sounding_rate(bf);
1872 
1873 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1874 				pc->cap);
1875 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1876 				    vc->cap);
1877 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1878 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1879 		bf->ibf_ncol = bf->ncol;
1880 
1881 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1882 			bf->nrow = 1;
1883 	} else {
1884 		bf->nrow = tx_ant;
1885 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1886 		bf->ibf_ncol = nss_mcs;
1887 
1888 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1889 			bf->ibf_nrow = 1;
1890 	}
1891 }
1892 
1893 static void
1894 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1895 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1896 {
1897 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1898 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1899 	const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1900 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1901 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1902 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1903 	u8 snd_dim, sts;
1904 
1905 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1906 
1907 	mt7915_mcu_sta_sounding_rate(bf);
1908 
1909 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1910 				pe->phy_cap_info[6]);
1911 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1912 				pe->phy_cap_info[6]);
1913 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1914 			 ve->phy_cap_info[5]);
1915 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1916 		     pe->phy_cap_info[4]);
1917 	bf->nrow = min_t(u8, snd_dim, sts);
1918 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1919 	bf->ibf_ncol = bf->ncol;
1920 
1921 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1922 		return;
1923 
1924 	/* go over for 160MHz and 80p80 */
1925 	if (pe->phy_cap_info[0] &
1926 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1927 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1928 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1929 
1930 		bf->ncol_bw160 = nss_mcs;
1931 	}
1932 
1933 	if (pe->phy_cap_info[0] &
1934 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1935 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1936 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1937 
1938 		if (bf->ncol_bw160)
1939 			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1940 		else
1941 			bf->ncol_bw160 = nss_mcs;
1942 	}
1943 
1944 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1945 			 ve->phy_cap_info[5]);
1946 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1947 		     pe->phy_cap_info[4]);
1948 
1949 	bf->nrow_bw160 = min_t(int, snd_dim, sts);
1950 }
1951 
1952 static void
1953 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1954 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1955 {
1956 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1957 	struct mt7915_phy *phy =
1958 		mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1959 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1960 	struct sta_rec_bf *bf;
1961 	struct tlv *tlv;
1962 	const u8 matrix[4][4] = {
1963 		{0, 0, 0, 0},
1964 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1965 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1966 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1967 	};
1968 	bool ebf;
1969 
1970 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1971 	if (!ebf && !dev->ibf)
1972 		return;
1973 
1974 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1975 	bf = (struct sta_rec_bf *)tlv;
1976 
1977 	/* he: eBF only, in accordance with spec
1978 	 * vht: support eBF and iBF
1979 	 * ht: iBF only, since mac80211 lacks of eBF support
1980 	 */
1981 	if (sta->he_cap.has_he && ebf)
1982 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1983 	else if (sta->vht_cap.vht_supported)
1984 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1985 	else if (sta->ht_cap.ht_supported)
1986 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1987 	else
1988 		return;
1989 
1990 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1991 	bf->bw = sta->bandwidth;
1992 	bf->ibf_dbw = sta->bandwidth;
1993 	bf->ibf_nrow = tx_ant;
1994 
1995 	if (!ebf && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1996 		bf->ibf_timeout = 0x48;
1997 	else
1998 		bf->ibf_timeout = 0x18;
1999 
2000 	if (ebf && bf->nrow != tx_ant)
2001 		bf->mem_20m = matrix[tx_ant][bf->ncol];
2002 	else
2003 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
2004 
2005 	switch (sta->bandwidth) {
2006 	case IEEE80211_STA_RX_BW_160:
2007 	case IEEE80211_STA_RX_BW_80:
2008 		bf->mem_total = bf->mem_20m * 2;
2009 		break;
2010 	case IEEE80211_STA_RX_BW_40:
2011 		bf->mem_total = bf->mem_20m;
2012 		break;
2013 	case IEEE80211_STA_RX_BW_20:
2014 	default:
2015 		break;
2016 	}
2017 }
2018 
2019 static void
2020 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
2021 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2022 {
2023 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2024 	struct mt7915_phy *phy =
2025 		mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2026 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
2027 	struct sta_rec_bfee *bfee;
2028 	struct tlv *tlv;
2029 	u8 nrow = 0;
2030 
2031 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
2032 		return;
2033 
2034 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
2035 	bfee = (struct sta_rec_bfee *)tlv;
2036 
2037 	if (sta->he_cap.has_he) {
2038 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
2039 
2040 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
2041 			      pe->phy_cap_info[5]);
2042 	} else if (sta->vht_cap.vht_supported) {
2043 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
2044 
2045 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
2046 				 pc->cap);
2047 	}
2048 
2049 	/* reply with identity matrix to avoid 2x2 BF negative gain */
2050 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
2051 }
2052 
2053 static void
2054 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2055 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2056 {
2057 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2058 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2059 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
2060 	enum nl80211_band band = chandef->chan->band;
2061 	struct sta_rec_ra *ra;
2062 	struct tlv *tlv;
2063 	u32 supp_rate = sta->supp_rates[band];
2064 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
2065 
2066 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2067 	ra = (struct sta_rec_ra *)tlv;
2068 
2069 	ra->valid = true;
2070 	ra->auto_rate = true;
2071 	ra->phy_mode = mt7915_get_phy_mode(vif, sta);
2072 	ra->channel = chandef->chan->hw_value;
2073 	ra->bw = sta->bandwidth;
2074 	ra->phy.bw = sta->bandwidth;
2075 
2076 	if (supp_rate) {
2077 		supp_rate &= mask->control[band].legacy;
2078 		ra->rate_len = hweight32(supp_rate);
2079 
2080 		if (band == NL80211_BAND_2GHZ) {
2081 			ra->supp_mode = MODE_CCK;
2082 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2083 
2084 			if (ra->rate_len > 4) {
2085 				ra->supp_mode |= MODE_OFDM;
2086 				ra->supp_ofdm_rate = supp_rate >> 4;
2087 			}
2088 		} else {
2089 			ra->supp_mode = MODE_OFDM;
2090 			ra->supp_ofdm_rate = supp_rate;
2091 		}
2092 	}
2093 
2094 	if (sta->ht_cap.ht_supported) {
2095 		const u8 *mcs_mask = mask->control[band].ht_mcs;
2096 
2097 		ra->supp_mode |= MODE_HT;
2098 		ra->af = sta->ht_cap.ampdu_factor;
2099 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2100 
2101 		cap |= STA_CAP_HT;
2102 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2103 			cap |= STA_CAP_SGI_20;
2104 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2105 			cap |= STA_CAP_SGI_40;
2106 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2107 			cap |= STA_CAP_TX_STBC;
2108 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2109 			cap |= STA_CAP_RX_STBC;
2110 		if (mvif->cap.ldpc &&
2111 		    (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
2112 			cap |= STA_CAP_LDPC;
2113 
2114 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs, mcs_mask);
2115 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2116 	}
2117 
2118 	if (sta->vht_cap.vht_supported) {
2119 		const u16 *mcs_mask = mask->control[band].vht_mcs;
2120 		u8 af;
2121 
2122 		ra->supp_mode |= MODE_VHT;
2123 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2124 			       sta->vht_cap.cap);
2125 		ra->af = max_t(u8, ra->af, af);
2126 
2127 		cap |= STA_CAP_VHT;
2128 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2129 			cap |= STA_CAP_VHT_SGI_80;
2130 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2131 			cap |= STA_CAP_VHT_SGI_160;
2132 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2133 			cap |= STA_CAP_VHT_TX_STBC;
2134 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2135 			cap |= STA_CAP_VHT_RX_STBC;
2136 		if (mvif->cap.ldpc &&
2137 		    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
2138 			cap |= STA_CAP_VHT_LDPC;
2139 
2140 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs, mcs_mask);
2141 	}
2142 
2143 	if (sta->he_cap.has_he) {
2144 		ra->supp_mode |= MODE_HE;
2145 		cap |= STA_CAP_HE;
2146 	}
2147 
2148 	ra->sta_cap = cpu_to_le32(cap);
2149 }
2150 
2151 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2152 			     struct ieee80211_sta *sta)
2153 {
2154 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2155 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2156 	struct sk_buff *skb;
2157 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2158 
2159 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2160 	if (IS_ERR(skb))
2161 		return PTR_ERR(skb);
2162 
2163 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2164 
2165 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2166 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2167 }
2168 
2169 int mt7915_mcu_add_he(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2170 		      struct ieee80211_sta *sta)
2171 {
2172 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2173 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2174 	struct sk_buff *skb;
2175 	int len;
2176 
2177 	if (!sta->he_cap.has_he)
2178 		return 0;
2179 
2180 	len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_he);
2181 
2182 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2183 	if (IS_ERR(skb))
2184 		return PTR_ERR(skb);
2185 
2186 	mt7915_mcu_sta_he_tlv(skb, sta, vif);
2187 
2188 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2189 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2190 }
2191 
2192 static int
2193 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2194 		     struct ieee80211_sta *sta)
2195 {
2196 #define MT_STA_BSS_GROUP		1
2197 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2198 	struct mt7915_sta *msta;
2199 	struct {
2200 		__le32 action;
2201 		u8 wlan_idx_lo;
2202 		u8 status;
2203 		u8 wlan_idx_hi;
2204 		u8 rsv0[5];
2205 		__le32 val;
2206 		u8 rsv1[8];
2207 	} __packed req = {
2208 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
2209 		.val = cpu_to_le32(mvif->idx % 16),
2210 	};
2211 
2212 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2213 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
2214 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
2215 
2216 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
2217 				 sizeof(req), true);
2218 }
2219 
2220 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2221 		       struct ieee80211_sta *sta, bool enable)
2222 {
2223 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2224 	struct mt7915_sta *msta;
2225 	struct sk_buff *skb;
2226 	int ret;
2227 
2228 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2229 
2230 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2231 				       MT7915_STA_UPDATE_MAX_SIZE);
2232 	if (IS_ERR(skb))
2233 		return PTR_ERR(skb);
2234 
2235 	/* starec basic */
2236 	mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2237 	if (!enable)
2238 		goto out;
2239 
2240 	/* tag order is in accordance with firmware dependency. */
2241 	if (sta && sta->ht_cap.ht_supported) {
2242 		/* starec bfer */
2243 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
2244 		/* starec ht */
2245 		mt7915_mcu_sta_ht_tlv(skb, sta);
2246 		/* starec vht */
2247 		mt7915_mcu_sta_vht_tlv(skb, sta);
2248 		/* starec uapsd */
2249 		mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
2250 	}
2251 
2252 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
2253 	if (ret)
2254 		return ret;
2255 
2256 	if (sta && sta->ht_cap.ht_supported) {
2257 		/* starec amsdu */
2258 		mt7915_mcu_sta_amsdu_tlv(skb, vif, sta);
2259 		/* starec he */
2260 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
2261 		/* starec muru */
2262 		mt7915_mcu_sta_muru_tlv(skb, sta, vif);
2263 		/* starec bfee */
2264 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
2265 	}
2266 
2267 	ret = mt7915_mcu_add_group(dev, vif, sta);
2268 	if (ret)
2269 		return ret;
2270 out:
2271 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2272 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2273 }
2274 
2275 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2276 			      struct ieee80211_sta *sta, u32 rate)
2277 {
2278 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2279 	struct mt7915_vif *mvif = msta->vif;
2280 	struct sta_rec_ra_fixed *ra;
2281 	struct sk_buff *skb;
2282 	struct tlv *tlv;
2283 	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2284 
2285 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2286 	if (IS_ERR(skb))
2287 		return PTR_ERR(skb);
2288 
2289 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2290 	ra = (struct sta_rec_ra_fixed *)tlv;
2291 
2292 	if (!rate) {
2293 		ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2294 		goto out;
2295 	}
2296 
2297 	ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2298 	ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2299 	ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2300 	ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2301 	ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2302 	ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2303 
2304 	if (ra->phy.bw)
2305 		ra->phy.ldpc = 7;
2306 	else
2307 		ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2308 
2309 	/* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2310 	if (ra->phy.type > MT_PHY_TYPE_VHT) {
2311 		ra->phy.he_ltf = FIELD_GET(RATE_CFG_HE_LTF, rate) * 85;
2312 		ra->phy.sgi = FIELD_GET(RATE_CFG_GI, rate) * 85;
2313 	} else {
2314 		ra->phy.sgi = FIELD_GET(RATE_CFG_GI, rate) * 15;
2315 	}
2316 
2317 out:
2318 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2319 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2320 }
2321 
2322 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2323 			    struct ieee80211_vif *vif, bool enable)
2324 {
2325 	struct mt7915_dev *dev = phy->dev;
2326 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2327 	struct {
2328 		struct req_hdr {
2329 			u8 omac_idx;
2330 			u8 dbdc_idx;
2331 			__le16 tlv_num;
2332 			u8 is_tlv_append;
2333 			u8 rsv[3];
2334 		} __packed hdr;
2335 		struct req_tlv {
2336 			__le16 tag;
2337 			__le16 len;
2338 			u8 active;
2339 			u8 dbdc_idx;
2340 			u8 omac_addr[ETH_ALEN];
2341 		} __packed tlv;
2342 	} data = {
2343 		.hdr = {
2344 			.omac_idx = mvif->omac_idx,
2345 			.dbdc_idx = mvif->band_idx,
2346 			.tlv_num = cpu_to_le16(1),
2347 			.is_tlv_append = 1,
2348 		},
2349 		.tlv = {
2350 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2351 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2352 			.active = enable,
2353 			.dbdc_idx = mvif->band_idx,
2354 		},
2355 	};
2356 
2357 	if (mvif->omac_idx >= REPEATER_BSSID_START)
2358 		return mt7915_mcu_muar_config(phy, vif, false, enable);
2359 
2360 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2361 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2362 				 &data, sizeof(data), true);
2363 }
2364 
2365 static void
2366 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
2367 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
2368 			 struct ieee80211_mutable_offsets *offs)
2369 {
2370 	struct bss_info_bcn_cntdwn *info;
2371 	struct tlv *tlv;
2372 	int sub_tag;
2373 
2374 	if (!offs->cntdwn_counter_offs[0])
2375 		return;
2376 
2377 	sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
2378 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
2379 					   &bcn->sub_ntlv, &bcn->len);
2380 	info = (struct bss_info_bcn_cntdwn *)tlv;
2381 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2382 }
2383 
2384 static void
2385 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2386 		       struct sk_buff *rskb, struct sk_buff *skb,
2387 		       struct bss_info_bcn *bcn,
2388 		       struct ieee80211_mutable_offsets *offs)
2389 {
2390 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2391 	struct bss_info_bcn_cont *cont;
2392 	struct tlv *tlv;
2393 	u8 *buf;
2394 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2395 
2396 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2397 					   len, &bcn->sub_ntlv, &bcn->len);
2398 
2399 	cont = (struct bss_info_bcn_cont *)tlv;
2400 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2401 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2402 
2403 	if (offs->cntdwn_counter_offs[0]) {
2404 		u16 offset = offs->cntdwn_counter_offs[0];
2405 
2406 		if (vif->csa_active)
2407 			cont->csa_ofs = cpu_to_le16(offset - 4);
2408 		if (vif->color_change_active)
2409 			cont->bcc_ofs = cpu_to_le16(offset - 3);
2410 	}
2411 
2412 	buf = (u8 *)tlv + sizeof(*cont);
2413 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
2414 			      true);
2415 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2416 }
2417 
2418 static void
2419 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
2420 			     struct sk_buff *skb)
2421 {
2422 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2423 	struct mt7915_vif_cap *vc = &mvif->cap;
2424 	const struct ieee80211_he_cap_elem *he;
2425 	const struct ieee80211_vht_cap *vht;
2426 	const struct ieee80211_ht_cap *ht;
2427 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
2428 	const u8 *ie;
2429 	u32 len, bc;
2430 
2431 	/* Check missing configuration options to allow AP mode in mac80211
2432 	 * to remain in sync with hostapd settings, and get a subset of
2433 	 * beacon and hardware capabilities.
2434 	 */
2435 	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
2436 		return;
2437 
2438 	memset(vc, 0, sizeof(*vc));
2439 
2440 	len = skb->len - (mgmt->u.beacon.variable - skb->data);
2441 
2442 	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
2443 			      len);
2444 	if (ie && ie[1] >= sizeof(*ht)) {
2445 		ht = (void *)(ie + 2);
2446 		bc = le32_to_cpu(ht->cap_info);
2447 
2448 		vc->ldpc |= !!(bc & IEEE80211_HT_CAP_LDPC_CODING);
2449 	}
2450 
2451 	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
2452 			      len);
2453 	if (ie && ie[1] >= sizeof(*vht)) {
2454 		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
2455 
2456 		vht = (void *)(ie + 2);
2457 		bc = le32_to_cpu(vht->vht_cap_info);
2458 
2459 		vc->ldpc |= !!(bc & IEEE80211_VHT_CAP_RXLDPC);
2460 		vc->vht_su_ebfer =
2461 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
2462 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
2463 		vc->vht_su_ebfee =
2464 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
2465 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
2466 		vc->vht_mu_ebfer =
2467 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
2468 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
2469 		vc->vht_mu_ebfee =
2470 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
2471 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
2472 	}
2473 
2474 	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
2475 				  mgmt->u.beacon.variable, len);
2476 	if (ie && ie[1] >= sizeof(*he) + 1) {
2477 		const struct ieee80211_sta_he_cap *pc =
2478 			mt7915_get_he_phy_cap(phy, vif);
2479 		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
2480 
2481 		he = (void *)(ie + 3);
2482 
2483 		vc->he_su_ebfer =
2484 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
2485 			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
2486 		vc->he_su_ebfee =
2487 			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
2488 			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
2489 		vc->he_mu_ebfer =
2490 			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
2491 			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
2492 	}
2493 }
2494 
2495 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2496 			  struct ieee80211_vif *vif, int en)
2497 {
2498 #define MAX_BEACON_SIZE 512
2499 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2500 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2501 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2502 	struct ieee80211_mutable_offsets offs;
2503 	struct ieee80211_tx_info *info;
2504 	struct sk_buff *skb, *rskb;
2505 	struct tlv *tlv;
2506 	struct bss_info_bcn *bcn;
2507 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2508 
2509 	rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2510 	if (IS_ERR(rskb))
2511 		return PTR_ERR(rskb);
2512 
2513 	tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2514 	bcn = (struct bss_info_bcn *)tlv;
2515 	bcn->enable = en;
2516 
2517 	if (!en)
2518 		goto out;
2519 
2520 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2521 	if (!skb)
2522 		return -EINVAL;
2523 
2524 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2525 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2526 		dev_kfree_skb(skb);
2527 		return -EINVAL;
2528 	}
2529 
2530 	if (mvif->band_idx) {
2531 		info = IEEE80211_SKB_CB(skb);
2532 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2533 	}
2534 
2535 	mt7915_mcu_beacon_check_caps(phy, vif, skb);
2536 
2537 	/* TODO: subtag - 11v MBSSID */
2538 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2539 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2540 	dev_kfree_skb(skb);
2541 
2542 out:
2543 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2544 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2545 }
2546 
2547 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2548 				     u32 option)
2549 {
2550 	struct {
2551 		__le32 option;
2552 		__le32 addr;
2553 	} req = {
2554 		.option = cpu_to_le32(option),
2555 		.addr = cpu_to_le32(addr),
2556 	};
2557 
2558 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2559 				 sizeof(req), true);
2560 }
2561 
2562 static int mt7915_mcu_restart(struct mt76_dev *dev)
2563 {
2564 	struct {
2565 		u8 power_mode;
2566 		u8 rsv[3];
2567 	} req = {
2568 		.power_mode = 1,
2569 	};
2570 
2571 	return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2572 				 sizeof(req), false);
2573 }
2574 
2575 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2576 {
2577 	struct {
2578 		__le32 op;
2579 	} req = {
2580 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2581 	};
2582 
2583 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2584 				 sizeof(req), true);
2585 }
2586 
2587 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2588 {
2589 	struct {
2590 		u8 check_crc;
2591 		u8 reserved[3];
2592 	} req = {
2593 		.check_crc = 0,
2594 	};
2595 
2596 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2597 				 sizeof(req), true);
2598 }
2599 
2600 static int mt7915_driver_own(struct mt7915_dev *dev)
2601 {
2602 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_DRV_OWN);
2603 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND0,
2604 			    MT_TOP_LPCR_HOST_FW_OWN, 0, 500)) {
2605 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2606 		return -EIO;
2607 	}
2608 
2609 	return 0;
2610 }
2611 
2612 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2613 				    u32 len, u32 mode)
2614 {
2615 	struct {
2616 		__le32 addr;
2617 		__le32 len;
2618 		__le32 mode;
2619 	} req = {
2620 		.addr = cpu_to_le32(addr),
2621 		.len = cpu_to_le32(len),
2622 		.mode = cpu_to_le32(mode),
2623 	};
2624 	int attr;
2625 
2626 	if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2627 		attr = MCU_CMD(PATCH_START_REQ);
2628 	else
2629 		attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2630 
2631 	return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2632 }
2633 
2634 static int mt7915_load_patch(struct mt7915_dev *dev)
2635 {
2636 	const struct mt7915_patch_hdr *hdr;
2637 	const struct firmware *fw = NULL;
2638 	int i, ret, sem;
2639 
2640 	sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2641 	switch (sem) {
2642 	case PATCH_IS_DL:
2643 		return 0;
2644 	case PATCH_NOT_DL_SEM_SUCCESS:
2645 		break;
2646 	default:
2647 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2648 		return -EAGAIN;
2649 	}
2650 
2651 	ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2652 	if (ret)
2653 		goto out;
2654 
2655 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2656 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2657 		ret = -EINVAL;
2658 		goto out;
2659 	}
2660 
2661 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2662 
2663 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2664 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2665 
2666 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2667 		struct mt7915_patch_sec *sec;
2668 		const u8 *dl;
2669 		u32 len, addr;
2670 
2671 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2672 						  i * sizeof(*sec));
2673 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2674 		    PATCH_SEC_TYPE_INFO) {
2675 			ret = -EINVAL;
2676 			goto out;
2677 		}
2678 
2679 		addr = be32_to_cpu(sec->info.addr);
2680 		len = be32_to_cpu(sec->info.len);
2681 		dl = fw->data + be32_to_cpu(sec->offs);
2682 
2683 		ret = mt7915_mcu_init_download(dev, addr, len,
2684 					       DL_MODE_NEED_RSP);
2685 		if (ret) {
2686 			dev_err(dev->mt76.dev, "Download request failed\n");
2687 			goto out;
2688 		}
2689 
2690 		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2691 					       dl, len, 4096);
2692 		if (ret) {
2693 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2694 			goto out;
2695 		}
2696 	}
2697 
2698 	ret = mt7915_mcu_start_patch(dev);
2699 	if (ret)
2700 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2701 
2702 out:
2703 	sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2704 	switch (sem) {
2705 	case PATCH_REL_SEM_SUCCESS:
2706 		break;
2707 	default:
2708 		ret = -EAGAIN;
2709 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2710 		break;
2711 	}
2712 	release_firmware(fw);
2713 
2714 	return ret;
2715 }
2716 
2717 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2718 {
2719 	u32 ret = 0;
2720 
2721 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2722 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2723 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2724 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2725 	ret |= DL_MODE_NEED_RSP;
2726 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2727 
2728 	return ret;
2729 }
2730 
2731 static int
2732 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2733 			     const struct mt7915_fw_trailer *hdr,
2734 			     const u8 *data, bool is_wa)
2735 {
2736 	int i, offset = 0;
2737 	u32 override = 0, option = 0;
2738 
2739 	for (i = 0; i < hdr->n_region; i++) {
2740 		const struct mt7915_fw_region *region;
2741 		int err;
2742 		u32 len, addr, mode;
2743 
2744 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2745 			 (hdr->n_region - i) * sizeof(*region));
2746 		mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2747 		len = le32_to_cpu(region->len);
2748 		addr = le32_to_cpu(region->addr);
2749 
2750 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2751 			override = addr;
2752 
2753 		err = mt7915_mcu_init_download(dev, addr, len, mode);
2754 		if (err) {
2755 			dev_err(dev->mt76.dev, "Download request failed\n");
2756 			return err;
2757 		}
2758 
2759 		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2760 					       data + offset, len, 4096);
2761 		if (err) {
2762 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2763 			return err;
2764 		}
2765 
2766 		offset += len;
2767 	}
2768 
2769 	if (override)
2770 		option |= FW_START_OVERRIDE;
2771 
2772 	if (is_wa)
2773 		option |= FW_START_WORKING_PDA_CR4;
2774 
2775 	return mt7915_mcu_start_firmware(dev, override, option);
2776 }
2777 
2778 static int mt7915_load_ram(struct mt7915_dev *dev)
2779 {
2780 	const struct mt7915_fw_trailer *hdr;
2781 	const struct firmware *fw;
2782 	int ret;
2783 
2784 	ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2785 	if (ret)
2786 		return ret;
2787 
2788 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2789 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2790 		ret = -EINVAL;
2791 		goto out;
2792 	}
2793 
2794 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2795 					sizeof(*hdr));
2796 
2797 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2798 		 hdr->fw_ver, hdr->build_date);
2799 
2800 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2801 	if (ret) {
2802 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2803 		goto out;
2804 	}
2805 
2806 	release_firmware(fw);
2807 
2808 	ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2809 	if (ret)
2810 		return ret;
2811 
2812 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2813 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2814 		ret = -EINVAL;
2815 		goto out;
2816 	}
2817 
2818 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2819 					sizeof(*hdr));
2820 
2821 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2822 		 hdr->fw_ver, hdr->build_date);
2823 
2824 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2825 	if (ret) {
2826 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2827 		goto out;
2828 	}
2829 
2830 	snprintf(dev->mt76.hw->wiphy->fw_version,
2831 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2832 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2833 
2834 out:
2835 	release_firmware(fw);
2836 
2837 	return ret;
2838 }
2839 
2840 static int mt7915_load_firmware(struct mt7915_dev *dev)
2841 {
2842 	int ret;
2843 
2844 	ret = mt7915_load_patch(dev);
2845 	if (ret)
2846 		return ret;
2847 
2848 	ret = mt7915_load_ram(dev);
2849 	if (ret)
2850 		return ret;
2851 
2852 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2853 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2854 				       FW_STATE_WACPU_RDY), 1000)) {
2855 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2856 		return -EIO;
2857 	}
2858 
2859 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2860 
2861 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2862 
2863 	return 0;
2864 }
2865 
2866 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2867 {
2868 	struct {
2869 		u8 ctrl_val;
2870 		u8 pad[3];
2871 	} data = {
2872 		.ctrl_val = ctrl
2873 	};
2874 
2875 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2876 				 sizeof(data), true);
2877 }
2878 
2879 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2880 {
2881 	struct {
2882 		u8 ver;
2883 		u8 pad;
2884 		__le16 len;
2885 		u8 level;
2886 		u8 rsv[3];
2887 		__le32 module_idx;
2888 	} data = {
2889 		.module_idx = cpu_to_le32(module),
2890 		.level = level,
2891 	};
2892 
2893 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2894 				 sizeof(data), false);
2895 }
2896 
2897 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2898 {
2899 	struct {
2900 		u8 enable;
2901 		u8 _rsv[3];
2902 	} __packed req = {
2903 		.enable = enabled
2904 	};
2905 
2906 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2907 				 sizeof(req), false);
2908 }
2909 
2910 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2911 {
2912 	struct {
2913 		__le32 cmd;
2914 		u8 val[4];
2915 	} __packed req = {
2916 		.cmd = cpu_to_le32(cmd),
2917 	};
2918 
2919 	put_unaligned_le32(val, req.val);
2920 
2921 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2922 				 sizeof(req), false);
2923 }
2924 
2925 static int
2926 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2927 {
2928 #define RX_AIRTIME_FEATURE_CTRL		1
2929 #define RX_AIRTIME_BITWISE_CTRL		2
2930 #define RX_AIRTIME_CLEAR_EN	1
2931 	struct {
2932 		__le16 field;
2933 		__le16 sub_field;
2934 		__le32 set_status;
2935 		__le32 get_status;
2936 		u8 _rsv[12];
2937 
2938 		bool airtime_en;
2939 		bool mibtime_en;
2940 		bool earlyend_en;
2941 		u8 _rsv1[9];
2942 
2943 		bool airtime_clear;
2944 		bool mibtime_clear;
2945 		u8 _rsv2[98];
2946 	} __packed req = {
2947 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2948 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2949 		.airtime_clear = true,
2950 	};
2951 	int ret;
2952 
2953 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2954 				sizeof(req), true);
2955 	if (ret)
2956 		return ret;
2957 
2958 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2959 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2960 	req.airtime_en = true;
2961 
2962 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2963 				 sizeof(req), true);
2964 }
2965 
2966 int mt7915_mcu_init(struct mt7915_dev *dev)
2967 {
2968 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2969 		.headroom = sizeof(struct mt7915_mcu_txd),
2970 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2971 		.mcu_parse_response = mt7915_mcu_parse_response,
2972 		.mcu_restart = mt7915_mcu_restart,
2973 	};
2974 	int ret;
2975 
2976 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2977 
2978 	ret = mt7915_driver_own(dev);
2979 	if (ret)
2980 		return ret;
2981 
2982 	ret = mt7915_load_firmware(dev);
2983 	if (ret)
2984 		return ret;
2985 
2986 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2987 	ret = mt7915_mcu_fw_log_2_host(dev, 0);
2988 	if (ret)
2989 		return ret;
2990 
2991 	ret = mt7915_mcu_set_mwds(dev, 1);
2992 	if (ret)
2993 		return ret;
2994 
2995 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2996 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2997 	if (ret)
2998 		return ret;
2999 
3000 	ret = mt7915_mcu_init_rx_airtime(dev);
3001 	if (ret)
3002 		return ret;
3003 
3004 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
3005 				 MCU_WA_PARAM_RED, 0, 0);
3006 }
3007 
3008 void mt7915_mcu_exit(struct mt7915_dev *dev)
3009 {
3010 	__mt76_mcu_restart(&dev->mt76);
3011 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
3012 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
3013 				       FW_STATE_FW_DOWNLOAD), 1000)) {
3014 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
3015 		return;
3016 	}
3017 
3018 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_FW_OWN);
3019 	skb_queue_purge(&dev->mt76.mcu.res_q);
3020 }
3021 
3022 static int
3023 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
3024 {
3025 	struct {
3026 		u8 operation;
3027 		u8 count;
3028 		u8 _rsv[2];
3029 		u8 index;
3030 		u8 enable;
3031 		__le16 etype;
3032 	} req = {
3033 		.operation = 1,
3034 		.count = 1,
3035 		.enable = 1,
3036 		.etype = cpu_to_le16(ETH_P_PAE),
3037 	};
3038 
3039 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3040 				 &req, sizeof(req), false);
3041 }
3042 
3043 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
3044 		       bool enable, bool hdr_trans)
3045 {
3046 	struct {
3047 		u8 operation;
3048 		u8 enable;
3049 		u8 check_bssid;
3050 		u8 insert_vlan;
3051 		u8 remove_vlan;
3052 		u8 tid;
3053 		u8 mode;
3054 		u8 rsv;
3055 	} __packed req_trans = {
3056 		.enable = hdr_trans,
3057 	};
3058 	struct {
3059 		u8 enable;
3060 		u8 band;
3061 		u8 rsv[2];
3062 	} __packed req_mac = {
3063 		.enable = enable,
3064 		.band = band,
3065 	};
3066 	int ret;
3067 
3068 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3069 				&req_trans, sizeof(req_trans), false);
3070 	if (ret)
3071 		return ret;
3072 
3073 	if (hdr_trans)
3074 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
3075 
3076 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
3077 				 &req_mac, sizeof(req_mac), true);
3078 }
3079 
3080 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
3081 {
3082 	struct {
3083 		__le32 cmd;
3084 		u8 band;
3085 		u8 enable;
3086 	} __packed req = {
3087 		.cmd = cpu_to_le32(SCS_ENABLE),
3088 		.band = band,
3089 		.enable = enable + 1,
3090 	};
3091 
3092 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
3093 				 sizeof(req), false);
3094 }
3095 
3096 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
3097 {
3098 	struct mt7915_dev *dev = phy->dev;
3099 	struct {
3100 		u8 prot_idx;
3101 		u8 band;
3102 		u8 rsv[2];
3103 		__le32 len_thresh;
3104 		__le32 pkt_thresh;
3105 	} __packed req = {
3106 		.prot_idx = 1,
3107 		.band = phy != &dev->phy,
3108 		.len_thresh = cpu_to_le32(val),
3109 		.pkt_thresh = cpu_to_le32(0x2),
3110 	};
3111 
3112 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
3113 				 sizeof(req), true);
3114 }
3115 
3116 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
3117 {
3118 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
3119 	u8 num = req->total;
3120 	size_t len = sizeof(*req) -
3121 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
3122 
3123 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
3124 				 len, true);
3125 }
3126 
3127 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
3128 {
3129 #define TX_CMD_MODE		1
3130 	struct mt7915_mcu_tx req = {
3131 		.valid = true,
3132 		.mode = TX_CMD_MODE,
3133 		.total = IEEE80211_NUM_ACS,
3134 	};
3135 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3136 	int ac;
3137 
3138 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3139 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3140 		struct edca *e = &req.edca[ac];
3141 
3142 		e->set = WMM_PARAM_SET;
3143 		e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3144 		e->aifs = q->aifs;
3145 		e->txop = cpu_to_le16(q->txop);
3146 
3147 		if (q->cw_min)
3148 			e->cw_min = fls(q->cw_min);
3149 		else
3150 			e->cw_min = 5;
3151 
3152 		if (q->cw_max)
3153 			e->cw_max = cpu_to_le16(fls(q->cw_max));
3154 		else
3155 			e->cw_max = cpu_to_le16(10);
3156 	}
3157 
3158 	return mt7915_mcu_update_edca(dev, &req);
3159 }
3160 
3161 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3162 {
3163 #define ENTER_PM_STATE		1
3164 #define EXIT_PM_STATE		2
3165 	struct {
3166 		u8 pm_number;
3167 		u8 pm_state;
3168 		u8 bssid[ETH_ALEN];
3169 		u8 dtim_period;
3170 		u8 wlan_idx_lo;
3171 		__le16 bcn_interval;
3172 		__le32 aid;
3173 		__le32 rx_filter;
3174 		u8 band_idx;
3175 		u8 wlan_idx_hi;
3176 		u8 rsv[2];
3177 		__le32 feature;
3178 		u8 omac_idx;
3179 		u8 wmm_idx;
3180 		u8 bcn_loss_cnt;
3181 		u8 bcn_sp_duration;
3182 	} __packed req = {
3183 		.pm_number = 5,
3184 		.pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3185 		.band_idx = band,
3186 	};
3187 
3188 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3189 				 sizeof(req), true);
3190 }
3191 
3192 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3193 		       enum mt7915_rdd_cmd cmd, u8 index,
3194 		       u8 rx_sel, u8 val)
3195 {
3196 	struct {
3197 		u8 ctrl;
3198 		u8 rdd_idx;
3199 		u8 rdd_rx_sel;
3200 		u8 val;
3201 		u8 rsv[4];
3202 	} __packed req = {
3203 		.ctrl = cmd,
3204 		.rdd_idx = index,
3205 		.rdd_rx_sel = rx_sel,
3206 		.val = val,
3207 	};
3208 
3209 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3210 				 sizeof(req), true);
3211 }
3212 
3213 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3214 {
3215 	struct {
3216 		__le32 tag;
3217 		__le16 min_lpn;
3218 		u8 rsv[2];
3219 	} __packed req = {
3220 		.tag = cpu_to_le32(0x1),
3221 		.min_lpn = cpu_to_le16(val),
3222 	};
3223 
3224 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3225 				 sizeof(req), true);
3226 }
3227 
3228 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3229 			    const struct mt7915_dfs_pulse *pulse)
3230 {
3231 	struct {
3232 		__le32 tag;
3233 
3234 		__le32 max_width;		/* us */
3235 		__le32 max_pwr;			/* dbm */
3236 		__le32 min_pwr;			/* dbm */
3237 		__le32 min_stgr_pri;		/* us */
3238 		__le32 max_stgr_pri;		/* us */
3239 		__le32 min_cr_pri;		/* us */
3240 		__le32 max_cr_pri;		/* us */
3241 	} __packed req = {
3242 		.tag = cpu_to_le32(0x3),
3243 
3244 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3245 		__req_field(max_width),
3246 		__req_field(max_pwr),
3247 		__req_field(min_pwr),
3248 		__req_field(min_stgr_pri),
3249 		__req_field(max_stgr_pri),
3250 		__req_field(min_cr_pri),
3251 		__req_field(max_cr_pri),
3252 #undef __req_field
3253 	};
3254 
3255 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3256 				 sizeof(req), true);
3257 }
3258 
3259 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3260 			    const struct mt7915_dfs_pattern *pattern)
3261 {
3262 	struct {
3263 		__le32 tag;
3264 		__le16 radar_type;
3265 
3266 		u8 enb;
3267 		u8 stgr;
3268 		u8 min_crpn;
3269 		u8 max_crpn;
3270 		u8 min_crpr;
3271 		u8 min_pw;
3272 		__le32 min_pri;
3273 		__le32 max_pri;
3274 		u8 max_pw;
3275 		u8 min_crbn;
3276 		u8 max_crbn;
3277 		u8 min_stgpn;
3278 		u8 max_stgpn;
3279 		u8 min_stgpr;
3280 		u8 rsv[2];
3281 		__le32 min_stgpr_diff;
3282 	} __packed req = {
3283 		.tag = cpu_to_le32(0x2),
3284 		.radar_type = cpu_to_le16(index),
3285 
3286 #define __req_field_u8(field) .field = pattern->field
3287 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3288 		__req_field_u8(enb),
3289 		__req_field_u8(stgr),
3290 		__req_field_u8(min_crpn),
3291 		__req_field_u8(max_crpn),
3292 		__req_field_u8(min_crpr),
3293 		__req_field_u8(min_pw),
3294 		__req_field_u32(min_pri),
3295 		__req_field_u32(max_pri),
3296 		__req_field_u8(max_pw),
3297 		__req_field_u8(min_crbn),
3298 		__req_field_u8(max_crbn),
3299 		__req_field_u8(min_stgpn),
3300 		__req_field_u8(max_stgpn),
3301 		__req_field_u8(min_stgpr),
3302 		__req_field_u32(min_stgpr_diff),
3303 #undef __req_field_u8
3304 #undef __req_field_u32
3305 	};
3306 
3307 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3308 				 sizeof(req), true);
3309 }
3310 
3311 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3312 {
3313 	struct mt7915_dev *dev = phy->dev;
3314 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3315 	int freq1 = chandef->center_freq1;
3316 	bool ext_phy = phy != &dev->phy;
3317 	struct {
3318 		u8 control_ch;
3319 		u8 center_ch;
3320 		u8 bw;
3321 		u8 tx_streams_num;
3322 		u8 rx_streams;	/* mask or num */
3323 		u8 switch_reason;
3324 		u8 band_idx;
3325 		u8 center_ch2;	/* for 80+80 only */
3326 		__le16 cac_case;
3327 		u8 channel_band;
3328 		u8 rsv0;
3329 		__le32 outband_freq;
3330 		u8 txpower_drop;
3331 		u8 ap_bw;
3332 		u8 ap_center_ch;
3333 		u8 rsv1[57];
3334 	} __packed req = {
3335 		.control_ch = chandef->chan->hw_value,
3336 		.center_ch = ieee80211_frequency_to_channel(freq1),
3337 		.bw = mt7915_mcu_chan_bw(chandef),
3338 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
3339 		.rx_streams = phy->mt76->antenna_mask,
3340 		.band_idx = ext_phy,
3341 		.channel_band = chandef->chan->band,
3342 	};
3343 
3344 #ifdef CONFIG_NL80211_TESTMODE
3345 	if (phy->mt76->test.tx_antenna_mask &&
3346 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3347 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3348 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3349 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3350 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
3351 
3352 		if (ext_phy) {
3353 			req.tx_streams_num = 2;
3354 			req.rx_streams >>= 2;
3355 		}
3356 	}
3357 #endif
3358 
3359 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3360 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3361 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3362 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3363 		req.switch_reason = CH_SWITCH_DFS;
3364 	else
3365 		req.switch_reason = CH_SWITCH_NORMAL;
3366 
3367 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3368 		req.rx_streams = hweight8(req.rx_streams);
3369 
3370 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3371 		int freq2 = chandef->center_freq2;
3372 
3373 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3374 	}
3375 
3376 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3377 }
3378 
3379 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3380 {
3381 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
3382 #define PAGE_IDX_MASK		GENMASK(4, 2)
3383 #define PER_PAGE_SIZE		0x400
3384 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3385 	u8 total = DIV_ROUND_UP(MT7915_EEPROM_SIZE, PER_PAGE_SIZE);
3386 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
3387 	int eep_len;
3388 	int i;
3389 
3390 	for (i = 0; i < total; i++, eep += eep_len) {
3391 		struct sk_buff *skb;
3392 		int ret;
3393 
3394 		if (i == total - 1 && !!(MT7915_EEPROM_SIZE % PER_PAGE_SIZE))
3395 			eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3396 		else
3397 			eep_len = PER_PAGE_SIZE;
3398 
3399 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3400 					 sizeof(req) + eep_len);
3401 		if (!skb)
3402 			return -ENOMEM;
3403 
3404 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
3405 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3406 		req.len = cpu_to_le16(eep_len);
3407 
3408 		skb_put_data(skb, &req, sizeof(req));
3409 		skb_put_data(skb, eep, eep_len);
3410 
3411 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3412 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3413 		if (ret)
3414 			return ret;
3415 	}
3416 
3417 	return 0;
3418 }
3419 
3420 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3421 {
3422 	struct mt7915_mcu_eeprom req = {
3423 		.buffer_mode = EE_MODE_EFUSE,
3424 		.format = EE_FORMAT_WHOLE,
3425 	};
3426 
3427 	if (dev->flash_mode)
3428 		return mt7915_mcu_set_eeprom_flash(dev);
3429 
3430 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3431 				 &req, sizeof(req), true);
3432 }
3433 
3434 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3435 {
3436 	struct mt7915_mcu_eeprom_info req = {
3437 		.addr = cpu_to_le32(round_down(offset,
3438 				    MT7915_EEPROM_BLOCK_SIZE)),
3439 	};
3440 	struct mt7915_mcu_eeprom_info *res;
3441 	struct sk_buff *skb;
3442 	int ret;
3443 	u8 *buf;
3444 
3445 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3446 				sizeof(req), true, &skb);
3447 	if (ret)
3448 		return ret;
3449 
3450 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
3451 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3452 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
3453 	dev_kfree_skb(skb);
3454 
3455 	return 0;
3456 }
3457 
3458 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3459 				  u8 *data, u32 len, int cmd)
3460 {
3461 	struct {
3462 		u8 dir;
3463 		u8 valid;
3464 		__le16 bitmap;
3465 		s8 precal;
3466 		u8 action;
3467 		u8 band;
3468 		u8 idx;
3469 		u8 rsv[4];
3470 		__le32 len;
3471 	} req = {};
3472 	struct sk_buff *skb;
3473 
3474 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3475 	if (!skb)
3476 		return -ENOMEM;
3477 
3478 	req.idx = idx;
3479 	req.len = cpu_to_le32(len);
3480 	skb_put_data(skb, &req, sizeof(req));
3481 	skb_put_data(skb, data, len);
3482 
3483 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3484 }
3485 
3486 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3487 {
3488 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3489 	u32 total = MT_EE_CAL_GROUP_SIZE;
3490 
3491 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3492 		return 0;
3493 
3494 	/*
3495 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3496 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3497 	 */
3498 	while (total > 0) {
3499 		int ret, len;
3500 
3501 		len = min_t(u32, total, MT_EE_CAL_UNIT);
3502 
3503 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3504 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3505 		if (ret)
3506 			return ret;
3507 
3508 		total -= len;
3509 		cal += len;
3510 		idx++;
3511 	}
3512 
3513 	return 0;
3514 }
3515 
3516 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3517 {
3518 	int i;
3519 
3520 	for (i = 0; i < n_freqs; i++)
3521 		if (cur == freqs[i])
3522 			return i;
3523 
3524 	return -1;
3525 }
3526 
3527 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3528 {
3529 	static const u16 freq_list[] = {
3530 		5180, 5200, 5220, 5240,
3531 		5260, 5280, 5300, 5320,
3532 		5500, 5520, 5540, 5560,
3533 		5580, 5600, 5620, 5640,
3534 		5660, 5680, 5700, 5745,
3535 		5765, 5785, 5805, 5825
3536 	};
3537 	int offset_2g = ARRAY_SIZE(freq_list);
3538 	int idx;
3539 
3540 	if (freq < 4000) {
3541 		if (freq < 2432)
3542 			return offset_2g;
3543 		if (freq < 2457)
3544 			return offset_2g + 1;
3545 
3546 		return offset_2g + 2;
3547 	}
3548 
3549 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3550 		return -1;
3551 
3552 	if (bw != NL80211_CHAN_WIDTH_20) {
3553 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3554 					   freq + 10);
3555 		if (idx >= 0)
3556 			return idx;
3557 
3558 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3559 					   freq - 10);
3560 		if (idx >= 0)
3561 			return idx;
3562 	}
3563 
3564 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3565 }
3566 
3567 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3568 {
3569 	struct mt7915_dev *dev = phy->dev;
3570 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3571 	u16 total = 2, center_freq = chandef->center_freq1;
3572 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3573 	int idx;
3574 
3575 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3576 		return 0;
3577 
3578 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3579 	if (idx < 0)
3580 		return -EINVAL;
3581 
3582 	/* Items: Tx DPD, Tx Flatness */
3583 	idx = idx * 2;
3584 	cal += MT_EE_CAL_GROUP_SIZE;
3585 
3586 	while (total--) {
3587 		int ret;
3588 
3589 		cal += (idx * MT_EE_CAL_UNIT);
3590 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3591 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3592 		if (ret)
3593 			return ret;
3594 
3595 		idx++;
3596 	}
3597 
3598 	return 0;
3599 }
3600 
3601 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3602 {
3603 	/* strict order */
3604 	static const enum mt7915_chan_mib_offs offs[] = {
3605 		MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME
3606 	};
3607 	struct mt76_channel_state *state = phy->mt76->chan_state;
3608 	struct mt76_channel_state *state_ts = &phy->state_ts;
3609 	struct mt7915_dev *dev = phy->dev;
3610 	struct mt7915_mcu_mib *res, req[4];
3611 	struct sk_buff *skb;
3612 	int i, ret;
3613 
3614 	for (i = 0; i < 4; i++) {
3615 		req[i].band = cpu_to_le32(phy != &dev->phy);
3616 		req[i].offs = cpu_to_le32(offs[i]);
3617 	}
3618 
3619 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3620 					req, sizeof(req), true, &skb);
3621 	if (ret)
3622 		return ret;
3623 
3624 	res = (struct mt7915_mcu_mib *)(skb->data + 20);
3625 
3626 	if (chan_switch)
3627 		goto out;
3628 
3629 #define __res_u64(s) le64_to_cpu(res[s].data)
3630 	state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3631 	state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3632 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3633 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3634 
3635 out:
3636 	state_ts->cc_busy = __res_u64(0);
3637 	state_ts->cc_tx = __res_u64(1);
3638 	state_ts->cc_bss_rx = __res_u64(2);
3639 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3640 #undef __res_u64
3641 
3642 	dev_kfree_skb(skb);
3643 
3644 	return 0;
3645 }
3646 
3647 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3648 {
3649 	struct mt7915_dev *dev = phy->dev;
3650 	struct {
3651 		u8 ctrl_id;
3652 		u8 action;
3653 		u8 dbdc_idx;
3654 		u8 rsv[5];
3655 	} req = {
3656 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3657 		.dbdc_idx = phy != &dev->phy,
3658 	};
3659 
3660 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3661 				 sizeof(req), true);
3662 }
3663 
3664 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3665 {
3666 	struct mt7915_dev *dev = phy->dev;
3667 	struct {
3668 		struct mt7915_mcu_thermal_ctrl ctrl;
3669 
3670 		__le32 trigger_temp;
3671 		__le32 restore_temp;
3672 		__le16 sustain_time;
3673 		u8 rsv[2];
3674 	} __packed req = {
3675 		.ctrl = {
3676 			.band_idx = phy != &dev->phy,
3677 		},
3678 	};
3679 	int level;
3680 
3681 	if (!state) {
3682 		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3683 		goto out;
3684 	}
3685 
3686 	/* set duty cycle and level */
3687 	for (level = 0; level < 4; level++) {
3688 		int ret;
3689 
3690 		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3691 		req.ctrl.duty.duty_level = level;
3692 		req.ctrl.duty.duty_cycle = state;
3693 		state /= 2;
3694 
3695 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3696 					&req, sizeof(req.ctrl), false);
3697 		if (ret)
3698 			return ret;
3699 	}
3700 
3701 	/* set high-temperature trigger threshold */
3702 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3703 	/* add a safety margin ~10 */
3704 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3705 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3706 	req.sustain_time = cpu_to_le16(10);
3707 
3708 out:
3709 	req.ctrl.type.protect_type = 1;
3710 	req.ctrl.type.trigger_type = 1;
3711 
3712 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3713 				 &req, sizeof(req), false);
3714 }
3715 
3716 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3717 {
3718 	struct mt7915_dev *dev = phy->dev;
3719 	struct mt76_phy *mphy = phy->mt76;
3720 	struct ieee80211_hw *hw = mphy->hw;
3721 	struct mt7915_sku_val {
3722 		u8 format_id;
3723 		u8 limit_type;
3724 		u8 dbdc_idx;
3725 		s8 val[MT7915_SKU_RATE_NUM];
3726 	} __packed req = {
3727 		.format_id = 4,
3728 		.dbdc_idx = phy != &dev->phy,
3729 	};
3730 	struct mt76_power_limits limits_array;
3731 	s8 *la = (s8 *)&limits_array;
3732 	int i, idx, n_chains = hweight8(mphy->antenna_mask);
3733 	int tx_power;
3734 
3735 	tx_power = hw->conf.power_level * 2 -
3736 		   mt76_tx_power_nss_delta(n_chains);
3737 
3738 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3739 					      &limits_array, tx_power);
3740 	mphy->txpower_cur = tx_power;
3741 
3742 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3743 		u8 mcs_num, len = mt7915_sku_group_len[i];
3744 		int j;
3745 
3746 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3747 			mcs_num = 10;
3748 
3749 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3750 				la = (s8 *)&limits_array + 12;
3751 		} else {
3752 			mcs_num = len;
3753 		}
3754 
3755 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3756 			req.val[idx + j] = la[j];
3757 
3758 		la += mcs_num;
3759 		idx += len;
3760 	}
3761 
3762 	return mt76_mcu_send_msg(&dev->mt76,
3763 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3764 				 sizeof(req), true);
3765 }
3766 
3767 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3768 {
3769 #define RATE_POWER_INFO	2
3770 	struct mt7915_dev *dev = phy->dev;
3771 	struct {
3772 		u8 format_id;
3773 		u8 category;
3774 		u8 band;
3775 		u8 _rsv;
3776 	} __packed req = {
3777 		.format_id = 7,
3778 		.category = RATE_POWER_INFO,
3779 		.band = phy != &dev->phy,
3780 	};
3781 	s8 res[MT7915_SKU_RATE_NUM][2];
3782 	struct sk_buff *skb;
3783 	int ret, i;
3784 
3785 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3786 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3787 					&req, sizeof(req), true, &skb);
3788 	if (ret)
3789 		return ret;
3790 
3791 	memcpy(res, skb->data + 4, sizeof(res));
3792 	for (i = 0; i < len; i++)
3793 		txpower[i] = res[i][req.band];
3794 
3795 	dev_kfree_skb(skb);
3796 
3797 	return 0;
3798 }
3799 
3800 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3801 			      u8 en)
3802 {
3803 	struct {
3804 		u8 test_mode_en;
3805 		u8 param_idx;
3806 		u8 _rsv[2];
3807 
3808 		u8 enable;
3809 		u8 _rsv2[3];
3810 
3811 		u8 pad[8];
3812 	} __packed req = {
3813 		.test_mode_en = test_mode,
3814 		.param_idx = param,
3815 		.enable = en,
3816 	};
3817 
3818 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3819 				 sizeof(req), false);
3820 }
3821 
3822 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3823 {
3824 	struct mt7915_dev *dev = phy->dev;
3825 	struct mt7915_sku {
3826 		u8 format_id;
3827 		u8 sku_enable;
3828 		u8 dbdc_idx;
3829 		u8 rsv;
3830 	} __packed req = {
3831 		.format_id = 0,
3832 		.dbdc_idx = phy != &dev->phy,
3833 		.sku_enable = enable,
3834 	};
3835 
3836 	return mt76_mcu_send_msg(&dev->mt76,
3837 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3838 				 sizeof(req), true);
3839 }
3840 
3841 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3842 {
3843 	struct {
3844 		u8 action;
3845 		u8 set;
3846 		u8 band;
3847 		u8 rsv;
3848 	} req = {
3849 		.action = action,
3850 		.set = set,
3851 		.band = band,
3852 	};
3853 
3854 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3855 				 &req, sizeof(req), false);
3856 }
3857 
3858 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3859 {
3860 	struct {
3861 		u8 action;
3862 		union {
3863 			struct {
3864 				u8 snd_mode;
3865 				u8 sta_num;
3866 				u8 rsv;
3867 				u8 wlan_idx[4];
3868 				__le32 snd_period;	/* ms */
3869 			} __packed snd;
3870 			struct {
3871 				bool ebf;
3872 				bool ibf;
3873 				u8 rsv;
3874 			} __packed type;
3875 			struct {
3876 				u8 bf_num;
3877 				u8 bf_bitmap;
3878 				u8 bf_sel[8];
3879 				u8 rsv[5];
3880 			} __packed mod;
3881 		};
3882 	} __packed req = {
3883 		.action = action,
3884 	};
3885 
3886 #define MT_BF_PROCESSING	4
3887 	switch (action) {
3888 	case MT_BF_SOUNDING_ON:
3889 		req.snd.snd_mode = MT_BF_PROCESSING;
3890 		break;
3891 	case MT_BF_TYPE_UPDATE:
3892 		req.type.ebf = true;
3893 		req.type.ibf = dev->ibf;
3894 		break;
3895 	case MT_BF_MODULE_UPDATE:
3896 		req.mod.bf_num = 2;
3897 		req.mod.bf_bitmap = GENMASK(1, 0);
3898 		break;
3899 	default:
3900 		return -EINVAL;
3901 	}
3902 
3903 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3904 				 sizeof(req), true);
3905 }
3906 
3907 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3908 			    bool enable)
3909 {
3910 #define MT_SPR_ENABLE		1
3911 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3912 	struct {
3913 		u8 action;
3914 		u8 arg_num;
3915 		u8 band_idx;
3916 		u8 status;
3917 		u8 drop_tx_idx;
3918 		u8 sta_idx;	/* 256 sta */
3919 		u8 rsv[2];
3920 		__le32 val;
3921 	} __packed req = {
3922 		.action = MT_SPR_ENABLE,
3923 		.arg_num = 1,
3924 		.band_idx = mvif->band_idx,
3925 		.val = cpu_to_le32(enable),
3926 	};
3927 
3928 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3929 				 sizeof(req), true);
3930 }
3931 
3932 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3933 			   struct ieee80211_sta *sta, struct rate_info *rate)
3934 {
3935 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3936 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3937 	struct mt7915_dev *dev = phy->dev;
3938 	struct mt76_phy *mphy = phy->mt76;
3939 	struct {
3940 		u8 category;
3941 		u8 band;
3942 		__le16 wcid;
3943 	} __packed req = {
3944 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3945 		.band = mvif->band_idx,
3946 		.wcid = cpu_to_le16(msta->wcid.idx),
3947 	};
3948 	struct ieee80211_supported_band *sband;
3949 	struct mt7915_mcu_phy_rx_info *res;
3950 	struct sk_buff *skb;
3951 	int ret;
3952 	bool cck = false;
3953 
3954 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3955 					&req, sizeof(req), true, &skb);
3956 	if (ret)
3957 		return ret;
3958 
3959 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3960 
3961 	rate->mcs = res->rate;
3962 	rate->nss = res->nsts + 1;
3963 
3964 	switch (res->mode) {
3965 	case MT_PHY_TYPE_CCK:
3966 		cck = true;
3967 		fallthrough;
3968 	case MT_PHY_TYPE_OFDM:
3969 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3970 			sband = &mphy->sband_5g.sband;
3971 		else
3972 			sband = &mphy->sband_2g.sband;
3973 
3974 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3975 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3976 		break;
3977 	case MT_PHY_TYPE_HT:
3978 	case MT_PHY_TYPE_HT_GF:
3979 		if (rate->mcs > 31) {
3980 			ret = -EINVAL;
3981 			goto out;
3982 		}
3983 
3984 		rate->flags = RATE_INFO_FLAGS_MCS;
3985 		if (res->gi)
3986 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3987 		break;
3988 	case MT_PHY_TYPE_VHT:
3989 		if (rate->mcs > 9) {
3990 			ret = -EINVAL;
3991 			goto out;
3992 		}
3993 
3994 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3995 		if (res->gi)
3996 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3997 		break;
3998 	case MT_PHY_TYPE_HE_SU:
3999 	case MT_PHY_TYPE_HE_EXT_SU:
4000 	case MT_PHY_TYPE_HE_TB:
4001 	case MT_PHY_TYPE_HE_MU:
4002 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
4003 			ret = -EINVAL;
4004 			goto out;
4005 		}
4006 		rate->he_gi = res->gi;
4007 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
4008 		break;
4009 	default:
4010 		ret = -EINVAL;
4011 		goto out;
4012 	}
4013 
4014 	switch (res->bw) {
4015 	case IEEE80211_STA_RX_BW_160:
4016 		rate->bw = RATE_INFO_BW_160;
4017 		break;
4018 	case IEEE80211_STA_RX_BW_80:
4019 		rate->bw = RATE_INFO_BW_80;
4020 		break;
4021 	case IEEE80211_STA_RX_BW_40:
4022 		rate->bw = RATE_INFO_BW_40;
4023 		break;
4024 	default:
4025 		rate->bw = RATE_INFO_BW_20;
4026 		break;
4027 	}
4028 
4029 out:
4030 	dev_kfree_skb(skb);
4031 
4032 	return ret;
4033 }
4034 
4035 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
4036 				struct cfg80211_he_bss_color *he_bss_color)
4037 {
4038 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
4039 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
4040 	struct bss_info_color *bss_color;
4041 	struct sk_buff *skb;
4042 	struct tlv *tlv;
4043 
4044 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
4045 	if (IS_ERR(skb))
4046 		return PTR_ERR(skb);
4047 
4048 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR, sizeof(*bss_color));
4049 	bss_color = (struct bss_info_color *)tlv;
4050 	bss_color->disable = !he_bss_color->enabled;
4051 	bss_color->color = he_bss_color->color;
4052 
4053 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
4054 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
4055 }
4056 
4057 #define TWT_AGRT_TRIGGER	BIT(0)
4058 #define TWT_AGRT_ANNOUNCE	BIT(1)
4059 #define TWT_AGRT_PROTECT	BIT(2)
4060 
4061 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
4062 			       struct mt7915_vif *mvif,
4063 			       struct mt7915_twt_flow *flow,
4064 			       int cmd)
4065 {
4066 	struct {
4067 		u8 tbl_idx;
4068 		u8 cmd;
4069 		u8 own_mac_idx;
4070 		u8 flowid; /* 0xff for group id */
4071 		__le16 peer_id; /* specify the peer_id (msb=0)
4072 				 * or group_id (msb=1)
4073 				 */
4074 		u8 duration; /* 256 us */
4075 		u8 bss_idx;
4076 		__le64 start_tsf;
4077 		__le16 mantissa;
4078 		u8 exponent;
4079 		u8 is_ap;
4080 		u8 agrt_params;
4081 		u8 rsv[23];
4082 	} __packed req = {
4083 		.tbl_idx = flow->table_id,
4084 		.cmd = cmd,
4085 		.own_mac_idx = mvif->omac_idx,
4086 		.flowid = flow->id,
4087 		.peer_id = cpu_to_le16(flow->wcid),
4088 		.duration = flow->duration,
4089 		.bss_idx = mvif->idx,
4090 		.start_tsf = cpu_to_le64(flow->tsf),
4091 		.mantissa = flow->mantissa,
4092 		.exponent = flow->exp,
4093 		.is_ap = true,
4094 	};
4095 
4096 	if (flow->protection)
4097 		req.agrt_params |= TWT_AGRT_PROTECT;
4098 	if (!flow->flowtype)
4099 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
4100 	if (flow->trigger)
4101 		req.agrt_params |= TWT_AGRT_TRIGGER;
4102 
4103 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
4104 				 &req, sizeof(req), true);
4105 }
4106