xref: /linux/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c (revision bfb921b2a9d5d1123d1d10b196a39db629ddef87)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7981:						\
17 		_fw = MT7981_##name;				\
18 		break;						\
19 	case 0x7986:						\
20 		_fw = MT7986_##name##__VA_ARGS__;		\
21 		break;						\
22 	default:						\
23 		_fw = MT7916_##name;				\
24 		break;						\
25 	}							\
26 	_fw;							\
27 })
28 
29 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
30 					 fw_name(_dev, name) :			\
31 					 fw_name(_dev, name, _MT7975))
32 
33 #define MCU_PATCH_ADDRESS		0x200000
34 
35 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
36 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
37 
38 static bool sr_scene_detect = true;
39 module_param(sr_scene_detect, bool, 0644);
40 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
41 
42 static u8
43 mt7915_mcu_get_sta_nss(u16 mcs_map)
44 {
45 	u8 nss;
46 
47 	for (nss = 8; nss > 0; nss--) {
48 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
49 
50 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
51 			break;
52 	}
53 
54 	return nss - 1;
55 }
56 
57 static void
58 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
59 			  u16 mcs_map)
60 {
61 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
62 	struct mt7915_dev *dev = msta->vif->phy->dev;
63 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
64 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
65 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
66 
67 	for (nss = 0; nss < max_nss; nss++) {
68 		int mcs;
69 
70 		switch ((mcs_map >> (2 * nss)) & 0x3) {
71 		case IEEE80211_HE_MCS_SUPPORT_0_11:
72 			mcs = GENMASK(11, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_9:
75 			mcs = GENMASK(9, 0);
76 			break;
77 		case IEEE80211_HE_MCS_SUPPORT_0_7:
78 			mcs = GENMASK(7, 0);
79 			break;
80 		default:
81 			mcs = 0;
82 		}
83 
84 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
85 
86 		switch (mcs) {
87 		case 0 ... 7:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
89 			break;
90 		case 8 ... 9:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
92 			break;
93 		case 10 ... 11:
94 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
95 			break;
96 		default:
97 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
98 			break;
99 		}
100 		mcs_map &= ~(0x3 << (nss * 2));
101 		mcs_map |= mcs << (nss * 2);
102 
103 		/* only support 2ss on 160MHz for mt7915 */
104 		if (is_mt7915(&dev->mt76) && nss > 1 &&
105 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
106 			break;
107 	}
108 
109 	*he_mcs = cpu_to_le16(mcs_map);
110 }
111 
112 static void
113 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
114 			   const u16 *mask)
115 {
116 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
117 	struct mt7915_dev *dev = msta->vif->phy->dev;
118 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
119 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
120 	u16 mcs;
121 
122 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
123 		switch (mcs_map & 0x3) {
124 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
128 			mcs = GENMASK(8, 0);
129 			break;
130 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
131 			mcs = GENMASK(7, 0);
132 			break;
133 		default:
134 			mcs = 0;
135 		}
136 
137 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
138 
139 		/* only support 2ss on 160MHz for mt7915 */
140 		if (is_mt7915(&dev->mt76) && nss > 1 &&
141 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
142 			break;
143 	}
144 }
145 
146 static void
147 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
148 			  const u8 *mask)
149 {
150 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
151 
152 	for (nss = 0; nss < max_nss; nss++)
153 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
154 }
155 
156 static int
157 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
158 			  struct sk_buff *skb, int seq)
159 {
160 	struct mt76_connac2_mcu_rxd *rxd;
161 	int ret = 0;
162 
163 	if (!skb) {
164 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
165 			cmd, seq);
166 		return -ETIMEDOUT;
167 	}
168 
169 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
170 	if (seq != rxd->seq &&
171 	    !(rxd->eid == MCU_CMD_EXT_CID &&
172 	      rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
173 		return -EAGAIN;
174 
175 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
176 		skb_pull(skb, sizeof(*rxd) - 4);
177 		ret = *skb->data;
178 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
179 		skb_pull(skb, sizeof(*rxd) + 4);
180 		ret = le32_to_cpu(*(__le32 *)skb->data);
181 	} else {
182 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
183 	}
184 
185 	return ret;
186 }
187 
188 static int
189 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
190 			int cmd, int *wait_seq)
191 {
192 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
193 	enum mt76_mcuq_id qid;
194 	int ret;
195 
196 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
197 	if (ret)
198 		return ret;
199 
200 	if (cmd == MCU_CMD(FW_SCATTER))
201 		qid = MT_MCUQ_FWDL;
202 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
203 		qid = MT_MCUQ_WA;
204 	else
205 		qid = MT_MCUQ_WM;
206 
207 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
208 }
209 
210 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
211 {
212 	struct {
213 		__le32 args[3];
214 	} req = {
215 		.args = {
216 			cpu_to_le32(a1),
217 			cpu_to_le32(a2),
218 			cpu_to_le32(a3),
219 		},
220 	};
221 
222 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
223 }
224 
225 static void
226 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
227 {
228 	if (!vif->bss_conf.csa_active || vif->type == NL80211_IFTYPE_STATION)
229 		return;
230 
231 	ieee80211_csa_finish(vif, 0);
232 }
233 
234 static void
235 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
236 {
237 	struct mt76_phy *mphy = &dev->mt76.phy;
238 	struct mt7915_mcu_csa_notify *c;
239 
240 	c = (struct mt7915_mcu_csa_notify *)skb->data;
241 
242 	if (c->band_idx > MT_BAND1)
243 		return;
244 
245 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
246 	    dev->mt76.phys[MT_BAND1])
247 		mphy = dev->mt76.phys[MT_BAND1];
248 
249 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
250 			IEEE80211_IFACE_ITER_RESUME_ALL,
251 			mt7915_mcu_csa_finish, mphy->hw);
252 }
253 
254 static void
255 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
256 {
257 	struct mt76_phy *mphy = &dev->mt76.phy;
258 	struct mt7915_mcu_thermal_notify *t;
259 	struct mt7915_phy *phy;
260 
261 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
262 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
263 		return;
264 
265 	if (t->ctrl.band_idx > MT_BAND1)
266 		return;
267 
268 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
269 	    dev->mt76.phys[MT_BAND1])
270 		mphy = dev->mt76.phys[MT_BAND1];
271 
272 	phy = mphy->priv;
273 	phy->throttle_state = t->ctrl.duty.duty_cycle;
274 }
275 
276 static void
277 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
278 {
279 	struct mt76_phy *mphy = &dev->mt76.phy;
280 	struct mt7915_mcu_rdd_report *r;
281 
282 	r = (struct mt7915_mcu_rdd_report *)skb->data;
283 
284 	if (r->band_idx > MT_RX_SEL2)
285 		return;
286 
287 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
288 	    dev->mt76.phys[MT_BAND1])
289 		mphy = dev->mt76.phys[MT_BAND1];
290 
291 	if (r->band_idx == MT_RX_SEL2)
292 		cfg80211_background_radar_event(mphy->hw->wiphy,
293 						&dev->rdd2_chandef,
294 						GFP_ATOMIC);
295 	else
296 		ieee80211_radar_detected(mphy->hw);
297 	dev->hw_pattern++;
298 }
299 
300 static void
301 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
302 {
303 	struct mt76_connac2_mcu_rxd *rxd;
304 	int len = skb->len - sizeof(*rxd);
305 	const char *data, *type;
306 
307 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
308 	data = (char *)&rxd[1];
309 
310 	switch (rxd->s2d_index) {
311 	case 0:
312 		if (mt7915_debugfs_rx_log(dev, data, len))
313 			return;
314 
315 		type = "WM";
316 		break;
317 	case 2:
318 		type = "WA";
319 		break;
320 	default:
321 		type = "unknown";
322 		break;
323 	}
324 
325 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
326 }
327 
328 static void
329 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
330 {
331 	if (!vif->bss_conf.color_change_active || vif->type == NL80211_IFTYPE_STATION)
332 		return;
333 
334 	ieee80211_color_change_finish(vif, 0);
335 }
336 
337 static void
338 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
339 {
340 	struct mt76_phy *mphy = &dev->mt76.phy;
341 	struct mt7915_mcu_bcc_notify *b;
342 
343 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
344 
345 	if (b->band_idx > MT_BAND1)
346 		return;
347 
348 	if ((b->band_idx && !dev->phy.mt76->band_idx) &&
349 	    dev->mt76.phys[MT_BAND1])
350 		mphy = dev->mt76.phys[MT_BAND1];
351 
352 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
353 			IEEE80211_IFACE_ITER_RESUME_ALL,
354 			mt7915_mcu_cca_finish, mphy->hw);
355 }
356 
357 static void
358 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
359 {
360 	struct mt76_connac2_mcu_rxd *rxd;
361 
362 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
363 	switch (rxd->ext_eid) {
364 	case MCU_EXT_EVENT_THERMAL_PROTECT:
365 		mt7915_mcu_rx_thermal_notify(dev, skb);
366 		break;
367 	case MCU_EXT_EVENT_RDD_REPORT:
368 		mt7915_mcu_rx_radar_detected(dev, skb);
369 		break;
370 	case MCU_EXT_EVENT_CSA_NOTIFY:
371 		mt7915_mcu_rx_csa_notify(dev, skb);
372 		break;
373 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
374 		mt7915_mcu_rx_log_message(dev, skb);
375 		break;
376 	case MCU_EXT_EVENT_BCC_NOTIFY:
377 		mt7915_mcu_rx_bcc_notify(dev, skb);
378 		break;
379 	default:
380 		break;
381 	}
382 }
383 
384 static void
385 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
386 {
387 	struct mt76_connac2_mcu_rxd *rxd;
388 
389 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
390 	switch (rxd->eid) {
391 	case MCU_EVENT_EXT:
392 		mt7915_mcu_rx_ext_event(dev, skb);
393 		break;
394 	default:
395 		break;
396 	}
397 	dev_kfree_skb(skb);
398 }
399 
400 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
401 {
402 	struct mt76_connac2_mcu_rxd *rxd;
403 
404 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
405 	if ((rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
406 	     rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
407 	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
408 	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
409 	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
410 	     !rxd->seq) &&
411 	     !(rxd->eid == MCU_CMD_EXT_CID &&
412 	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
413 		mt7915_mcu_rx_unsolicited_event(dev, skb);
414 	else
415 		mt76_mcu_rx_event(&dev->mt76, skb);
416 }
417 
418 static struct tlv *
419 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
420 			     __le16 *sub_ntlv, __le16 *len)
421 {
422 	struct tlv *ptlv, tlv = {
423 		.tag = cpu_to_le16(sub_tag),
424 		.len = cpu_to_le16(sub_len),
425 	};
426 
427 	ptlv = skb_put_zero(skb, sub_len);
428 	memcpy(ptlv, &tlv, sizeof(tlv));
429 
430 	le16_add_cpu(sub_ntlv, 1);
431 	le16_add_cpu(len, sub_len);
432 
433 	return ptlv;
434 }
435 
436 /** bss info **/
437 struct mt7915_he_obss_narrow_bw_ru_data {
438 	bool tolerated;
439 };
440 
441 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
442 						   struct cfg80211_bss *bss,
443 						   void *_data)
444 {
445 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
446 	const struct element *elem;
447 
448 	rcu_read_lock();
449 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
450 
451 	if (!elem || elem->datalen <= 10 ||
452 	    !(elem->data[10] &
453 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
454 		data->tolerated = false;
455 
456 	rcu_read_unlock();
457 }
458 
459 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
460 					      struct ieee80211_vif *vif)
461 {
462 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
463 		.tolerated = true,
464 	};
465 
466 	if (!(vif->bss_conf.chanreq.oper.chan->flags & IEEE80211_CHAN_RADAR))
467 		return false;
468 
469 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chanreq.oper,
470 			  mt7915_check_he_obss_narrow_bw_ru_iter,
471 			  &iter_data);
472 
473 	/*
474 	 * If there is at least one AP on radar channel that cannot
475 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
476 	 */
477 	return !iter_data.tolerated;
478 }
479 
480 static void
481 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
482 			struct mt7915_phy *phy)
483 {
484 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
485 	struct bss_info_rf_ch *ch;
486 	struct tlv *tlv;
487 	int freq1 = chandef->center_freq1;
488 
489 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
490 
491 	ch = (struct bss_info_rf_ch *)tlv;
492 	ch->pri_ch = chandef->chan->hw_value;
493 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
494 	ch->bw = mt76_connac_chan_bw(chandef);
495 
496 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
497 		int freq2 = chandef->center_freq2;
498 
499 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
500 	}
501 
502 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
503 		struct mt76_phy *mphy = phy->mt76;
504 
505 		ch->he_ru26_block =
506 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
507 		ch->he_all_disable = false;
508 	} else {
509 		ch->he_all_disable = true;
510 	}
511 }
512 
513 static void
514 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
515 		      struct mt7915_phy *phy)
516 {
517 	int max_nss = hweight8(phy->mt76->antenna_mask);
518 	struct bss_info_ra *ra;
519 	struct tlv *tlv;
520 
521 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
522 
523 	ra = (struct bss_info_ra *)tlv;
524 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
525 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
526 	ra->short_preamble = true;
527 	ra->tx_streams = max_nss;
528 	ra->rx_streams = max_nss;
529 	ra->algo = 4;
530 	ra->train_up_rule = 2;
531 	ra->train_up_high_thres = 110;
532 	ra->train_up_rule_rssi = -70;
533 	ra->low_traffic_thres = 2;
534 	ra->phy_cap = cpu_to_le32(0xfdf);
535 	ra->interval = cpu_to_le32(500);
536 	ra->fast_interval = cpu_to_le32(100);
537 }
538 
539 static void
540 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
541 		      struct mt7915_phy *phy)
542 {
543 #define DEFAULT_HE_PE_DURATION		4
544 #define DEFAULT_HE_DURATION_RTS_THRES	1023
545 	const struct ieee80211_sta_he_cap *cap;
546 	struct bss_info_he *he;
547 	struct tlv *tlv;
548 
549 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
550 
551 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
552 
553 	he = (struct bss_info_he *)tlv;
554 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
555 	if (!he->he_pe_duration)
556 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
557 
558 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
559 	if (!he->he_rts_thres)
560 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
561 
562 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
563 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
564 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
565 }
566 
567 static void
568 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
569 {
570 #define TXD_CMP_MAP1		GENMASK(15, 0)
571 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
572 	struct bss_info_hw_amsdu *amsdu;
573 	struct tlv *tlv;
574 
575 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
576 
577 	amsdu = (struct bss_info_hw_amsdu *)tlv;
578 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
579 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
580 	amsdu->trig_thres = cpu_to_le16(2);
581 	amsdu->enable = true;
582 }
583 
584 static void
585 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
586 {
587 	struct bss_info_bmc_rate *bmc;
588 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
589 	enum nl80211_band band = chandef->chan->band;
590 	struct tlv *tlv;
591 
592 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
593 
594 	bmc = (struct bss_info_bmc_rate *)tlv;
595 	if (band == NL80211_BAND_2GHZ) {
596 		bmc->short_preamble = true;
597 	} else {
598 		bmc->bc_trans = cpu_to_le16(0x2000);
599 		bmc->mc_trans = cpu_to_le16(0x2080);
600 	}
601 }
602 
603 static int
604 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
605 		       bool bssid, bool enable)
606 {
607 	struct mt7915_dev *dev = phy->dev;
608 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
609 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
610 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
611 	const u8 *addr = vif->addr;
612 	struct {
613 		u8 mode;
614 		u8 force_clear;
615 		u8 clear_bitmap[8];
616 		u8 entry_count;
617 		u8 write;
618 		u8 band;
619 
620 		u8 index;
621 		u8 bssid;
622 		u8 addr[ETH_ALEN];
623 	} __packed req = {
624 		.mode = !!mask || enable,
625 		.entry_count = 1,
626 		.write = 1,
627 		.band = phy->mt76->band_idx,
628 		.index = idx * 2 + bssid,
629 	};
630 
631 	if (bssid)
632 		addr = vif->bss_conf.bssid;
633 
634 	if (enable)
635 		ether_addr_copy(req.addr, addr);
636 
637 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
638 				 sizeof(req), true);
639 }
640 
641 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
642 			    struct ieee80211_vif *vif, int enable)
643 {
644 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
645 	struct mt7915_dev *dev = phy->dev;
646 	struct sk_buff *skb;
647 
648 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
649 		mt7915_mcu_muar_config(phy, vif, false, enable);
650 		mt7915_mcu_muar_config(phy, vif, true, enable);
651 	}
652 
653 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
654 					      MT7915_BSS_UPDATE_MAX_SIZE);
655 	if (IS_ERR(skb))
656 		return PTR_ERR(skb);
657 
658 	/* bss_omac must be first */
659 	if (enable)
660 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
661 
662 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
663 				      mvif->sta.wcid.idx, enable);
664 
665 	if (vif->type == NL80211_IFTYPE_MONITOR)
666 		goto out;
667 
668 	if (enable) {
669 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
670 		mt7915_mcu_bss_bmc_tlv(skb, phy);
671 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
672 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
673 
674 		if (vif->bss_conf.he_support)
675 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
676 
677 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
678 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
679 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
680 	}
681 out:
682 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
683 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
684 }
685 
686 /** starec & wtbl **/
687 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
688 			 struct ieee80211_ampdu_params *params,
689 			 bool enable)
690 {
691 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
692 	struct mt7915_vif *mvif = msta->vif;
693 
694 	if (enable && !params->amsdu)
695 		msta->wcid.amsdu = false;
696 
697 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
698 				      MCU_EXT_CMD(STA_REC_UPDATE),
699 				      enable, true);
700 }
701 
702 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
703 			 struct ieee80211_ampdu_params *params,
704 			 bool enable)
705 {
706 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
707 	struct mt7915_vif *mvif = msta->vif;
708 
709 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
710 				      MCU_EXT_CMD(STA_REC_UPDATE),
711 				      enable, false);
712 }
713 
714 static void
715 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
716 		      struct ieee80211_vif *vif)
717 {
718 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
719 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
720 	struct ieee80211_he_mcs_nss_supp mcs_map;
721 	struct sta_rec_he *he;
722 	struct tlv *tlv;
723 	u32 cap = 0;
724 
725 	if (!sta->deflink.he_cap.has_he)
726 		return;
727 
728 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
729 
730 	he = (struct sta_rec_he *)tlv;
731 
732 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
733 		cap |= STA_REC_HE_CAP_HTC;
734 
735 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
736 		cap |= STA_REC_HE_CAP_BSR;
737 
738 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
739 		cap |= STA_REC_HE_CAP_OM;
740 
741 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
742 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
743 
744 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
745 		cap |= STA_REC_HE_CAP_BQR;
746 
747 	if (elem->phy_cap_info[0] &
748 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
749 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
750 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
751 
752 	if (mvif->cap.he_ldpc &&
753 	    (elem->phy_cap_info[1] &
754 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
755 		cap |= STA_REC_HE_CAP_LDPC;
756 
757 	if (elem->phy_cap_info[1] &
758 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
759 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
760 
761 	if (elem->phy_cap_info[2] &
762 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
763 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
764 
765 	if (elem->phy_cap_info[2] &
766 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
767 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
768 
769 	if (elem->phy_cap_info[2] &
770 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
771 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
772 
773 	if (elem->phy_cap_info[6] &
774 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
775 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
776 
777 	if (elem->phy_cap_info[6] &
778 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
779 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
780 
781 	if (elem->phy_cap_info[7] &
782 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
783 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
784 
785 	if (elem->phy_cap_info[7] &
786 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
787 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
788 
789 	if (elem->phy_cap_info[7] &
790 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
791 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
792 
793 	if (elem->phy_cap_info[8] &
794 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
795 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
796 
797 	if (elem->phy_cap_info[8] &
798 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
799 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
800 
801 	if (elem->phy_cap_info[9] &
802 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
803 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
804 
805 	if (elem->phy_cap_info[9] &
806 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
807 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
808 
809 	he->he_cap = cpu_to_le32(cap);
810 
811 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
812 	switch (sta->deflink.bandwidth) {
813 	case IEEE80211_STA_RX_BW_160:
814 		if (elem->phy_cap_info[0] &
815 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
816 			mt7915_mcu_set_sta_he_mcs(sta,
817 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
818 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
819 
820 		mt7915_mcu_set_sta_he_mcs(sta,
821 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
822 					  le16_to_cpu(mcs_map.rx_mcs_160));
823 		fallthrough;
824 	default:
825 		mt7915_mcu_set_sta_he_mcs(sta,
826 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
827 					  le16_to_cpu(mcs_map.rx_mcs_80));
828 		break;
829 	}
830 
831 	he->t_frame_dur =
832 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
833 	he->max_ampdu_exp =
834 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
835 
836 	he->bw_set =
837 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
838 	he->device_class =
839 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
840 	he->punc_pream_rx =
841 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
842 
843 	he->dcm_tx_mode =
844 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
845 	he->dcm_tx_max_nss =
846 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
847 	he->dcm_rx_mode =
848 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
849 	he->dcm_rx_max_nss =
850 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
851 	he->dcm_rx_max_nss =
852 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
853 
854 	he->pkt_ext = 2;
855 }
856 
857 static void
858 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
859 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
860 {
861 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
862 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
863 	struct sta_rec_muru *muru;
864 	struct tlv *tlv;
865 
866 	if (vif->type != NL80211_IFTYPE_STATION &&
867 	    vif->type != NL80211_IFTYPE_AP)
868 		return;
869 
870 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
871 
872 	muru = (struct sta_rec_muru *)tlv;
873 
874 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
875 			       mvif->cap.vht_mu_ebfer ||
876 			       mvif->cap.vht_mu_ebfee;
877 	if (!is_mt7915(&dev->mt76))
878 		muru->cfg.mimo_ul_en = true;
879 	muru->cfg.ofdma_dl_en = true;
880 
881 	if (sta->deflink.vht_cap.vht_supported)
882 		muru->mimo_dl.vht_mu_bfee =
883 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
884 
885 	if (!sta->deflink.he_cap.has_he)
886 		return;
887 
888 	muru->mimo_dl.partial_bw_dl_mimo =
889 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
890 
891 	muru->mimo_ul.full_ul_mimo =
892 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
893 	muru->mimo_ul.partial_ul_mimo =
894 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
895 
896 	muru->ofdma_dl.punc_pream_rx =
897 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
898 	muru->ofdma_dl.he_20m_in_40m_2g =
899 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
900 	muru->ofdma_dl.he_20m_in_160m =
901 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
902 	muru->ofdma_dl.he_80m_in_160m =
903 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
904 
905 	muru->ofdma_ul.t_frame_dur =
906 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
907 	muru->ofdma_ul.mu_cascading =
908 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
909 	muru->ofdma_ul.uo_ra =
910 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
911 	muru->ofdma_ul.rx_ctrl_frame_to_mbss =
912 		HE_MAC(CAP3_RX_CTRL_FRAME_TO_MULTIBSS, elem->mac_cap_info[3]);
913 }
914 
915 static void
916 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
917 {
918 	struct sta_rec_ht *ht;
919 	struct tlv *tlv;
920 
921 	if (!sta->deflink.ht_cap.ht_supported)
922 		return;
923 
924 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
925 
926 	ht = (struct sta_rec_ht *)tlv;
927 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
928 }
929 
930 static void
931 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
932 {
933 	struct sta_rec_vht *vht;
934 	struct tlv *tlv;
935 
936 	if (!sta->deflink.vht_cap.vht_supported)
937 		return;
938 
939 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
940 
941 	vht = (struct sta_rec_vht *)tlv;
942 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
943 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
944 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
945 }
946 
947 static void
948 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
949 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
950 {
951 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
952 	struct sta_rec_amsdu *amsdu;
953 	struct tlv *tlv;
954 
955 	if (vif->type != NL80211_IFTYPE_STATION &&
956 	    vif->type != NL80211_IFTYPE_AP)
957 		return;
958 
959 	if (!sta->deflink.agg.max_amsdu_len)
960 	    return;
961 
962 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
963 	amsdu = (struct sta_rec_amsdu *)tlv;
964 	amsdu->max_amsdu_num = 8;
965 	amsdu->amsdu_en = true;
966 	msta->wcid.amsdu = true;
967 
968 	switch (sta->deflink.agg.max_amsdu_len) {
969 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
970 		if (!is_mt7915(&dev->mt76)) {
971 			amsdu->max_mpdu_size =
972 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
973 			return;
974 		}
975 		fallthrough;
976 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
977 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
978 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
979 		return;
980 	default:
981 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
982 		return;
983 	}
984 }
985 
986 static int
987 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
988 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
989 {
990 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
991 	struct mt7915_sta *msta;
992 	struct wtbl_req_hdr *wtbl_hdr;
993 	struct mt76_wcid *wcid;
994 	struct tlv *tlv;
995 
996 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
997 	wcid = sta ? &msta->wcid : NULL;
998 
999 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1000 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1001 						  WTBL_RESET_AND_SET, tlv,
1002 						  &skb);
1003 	if (IS_ERR(wtbl_hdr))
1004 		return PTR_ERR(wtbl_hdr);
1005 
1006 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1007 					 wtbl_hdr);
1008 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1009 	if (sta)
1010 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1011 					    wtbl_hdr, mvif->cap.ht_ldpc,
1012 					    mvif->cap.vht_ldpc);
1013 
1014 	return 0;
1015 }
1016 
1017 static inline bool
1018 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1019 			struct ieee80211_sta *sta, bool bfee)
1020 {
1021 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1022 	int sts = hweight16(phy->mt76->chainmask);
1023 
1024 	if (vif->type != NL80211_IFTYPE_STATION &&
1025 	    vif->type != NL80211_IFTYPE_AP)
1026 		return false;
1027 
1028 	if (!bfee && sts < 2)
1029 		return false;
1030 
1031 	if (sta->deflink.he_cap.has_he) {
1032 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1033 
1034 		if (bfee)
1035 			return mvif->cap.he_su_ebfee &&
1036 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1037 		else
1038 			return mvif->cap.he_su_ebfer &&
1039 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1040 	}
1041 
1042 	if (sta->deflink.vht_cap.vht_supported) {
1043 		u32 cap = sta->deflink.vht_cap.cap;
1044 
1045 		if (bfee)
1046 			return mvif->cap.vht_su_ebfee &&
1047 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1048 		else
1049 			return mvif->cap.vht_su_ebfer &&
1050 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1051 	}
1052 
1053 	return false;
1054 }
1055 
1056 static void
1057 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1058 {
1059 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1060 	bf->ndp_rate = 0;				/* mcs0 */
1061 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1062 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1063 }
1064 
1065 static void
1066 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1067 		       struct sta_rec_bf *bf)
1068 {
1069 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1070 	u8 n = 0;
1071 
1072 	bf->tx_mode = MT_PHY_TYPE_HT;
1073 
1074 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1075 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1076 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1077 			      mcs->tx_params);
1078 	else if (mcs->rx_mask[3])
1079 		n = 3;
1080 	else if (mcs->rx_mask[2])
1081 		n = 2;
1082 	else if (mcs->rx_mask[1])
1083 		n = 1;
1084 
1085 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1086 	bf->ncol = min_t(u8, bf->nrow, n);
1087 	bf->ibf_ncol = n;
1088 }
1089 
1090 static void
1091 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1092 			struct sta_rec_bf *bf, bool explicit)
1093 {
1094 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1095 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1096 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1097 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1098 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1099 
1100 	bf->tx_mode = MT_PHY_TYPE_VHT;
1101 
1102 	if (explicit) {
1103 		u8 sts, snd_dim;
1104 
1105 		mt7915_mcu_sta_sounding_rate(bf);
1106 
1107 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1108 				pc->cap);
1109 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1110 				    vc->cap);
1111 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1112 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1113 		bf->ibf_ncol = bf->ncol;
1114 
1115 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1116 			bf->nrow = 1;
1117 	} else {
1118 		bf->nrow = tx_ant;
1119 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1120 		bf->ibf_ncol = nss_mcs;
1121 
1122 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1123 			bf->ibf_nrow = 1;
1124 	}
1125 }
1126 
1127 static void
1128 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1129 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1130 {
1131 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1132 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1133 	const struct ieee80211_sta_he_cap *vc =
1134 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1135 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1136 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1137 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1138 	u8 snd_dim, sts;
1139 
1140 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1141 
1142 	mt7915_mcu_sta_sounding_rate(bf);
1143 
1144 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1145 				pe->phy_cap_info[6]);
1146 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1147 				pe->phy_cap_info[6]);
1148 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1149 			 ve->phy_cap_info[5]);
1150 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1151 		     pe->phy_cap_info[4]);
1152 	bf->nrow = min_t(u8, snd_dim, sts);
1153 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1154 	bf->ibf_ncol = bf->ncol;
1155 
1156 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1157 		return;
1158 
1159 	/* go over for 160MHz and 80p80 */
1160 	if (pe->phy_cap_info[0] &
1161 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1162 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1163 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1164 
1165 		bf->ncol_gt_bw80 = nss_mcs;
1166 	}
1167 
1168 	if (pe->phy_cap_info[0] &
1169 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1170 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1171 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1172 
1173 		if (bf->ncol_gt_bw80)
1174 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1175 		else
1176 			bf->ncol_gt_bw80 = nss_mcs;
1177 	}
1178 
1179 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1180 			 ve->phy_cap_info[5]);
1181 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1182 		     pe->phy_cap_info[4]);
1183 
1184 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1185 }
1186 
1187 static void
1188 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1189 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1190 {
1191 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1192 	struct mt7915_phy *phy = mvif->phy;
1193 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1194 	struct sta_rec_bf *bf;
1195 	struct tlv *tlv;
1196 	static const u8 matrix[4][4] = {
1197 		{0, 0, 0, 0},
1198 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1199 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1200 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1201 	};
1202 	bool ebf;
1203 
1204 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1205 		return;
1206 
1207 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1208 	if (!ebf && !dev->ibf)
1209 		return;
1210 
1211 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1212 	bf = (struct sta_rec_bf *)tlv;
1213 
1214 	/* he: eBF only, in accordance with spec
1215 	 * vht: support eBF and iBF
1216 	 * ht: iBF only, since mac80211 lacks of eBF support
1217 	 */
1218 	if (sta->deflink.he_cap.has_he && ebf)
1219 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1220 	else if (sta->deflink.vht_cap.vht_supported)
1221 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1222 	else if (sta->deflink.ht_cap.ht_supported)
1223 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1224 	else
1225 		return;
1226 
1227 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1228 	bf->bw = sta->deflink.bandwidth;
1229 	bf->ibf_dbw = sta->deflink.bandwidth;
1230 	bf->ibf_nrow = tx_ant;
1231 
1232 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1233 		bf->ibf_timeout = 0x48;
1234 	else
1235 		bf->ibf_timeout = 0x18;
1236 
1237 	if (ebf && bf->nrow != tx_ant)
1238 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1239 	else
1240 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1241 
1242 	switch (sta->deflink.bandwidth) {
1243 	case IEEE80211_STA_RX_BW_160:
1244 	case IEEE80211_STA_RX_BW_80:
1245 		bf->mem_total = bf->mem_20m * 2;
1246 		break;
1247 	case IEEE80211_STA_RX_BW_40:
1248 		bf->mem_total = bf->mem_20m;
1249 		break;
1250 	case IEEE80211_STA_RX_BW_20:
1251 	default:
1252 		break;
1253 	}
1254 }
1255 
1256 static void
1257 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1258 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1259 {
1260 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1261 	struct mt7915_phy *phy = mvif->phy;
1262 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1263 	struct sta_rec_bfee *bfee;
1264 	struct tlv *tlv;
1265 	u8 nrow = 0;
1266 
1267 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1268 		return;
1269 
1270 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1271 		return;
1272 
1273 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1274 	bfee = (struct sta_rec_bfee *)tlv;
1275 
1276 	if (sta->deflink.he_cap.has_he) {
1277 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1278 
1279 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1280 			      pe->phy_cap_info[5]);
1281 	} else if (sta->deflink.vht_cap.vht_supported) {
1282 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1283 
1284 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1285 				 pc->cap);
1286 	}
1287 
1288 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1289 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1290 }
1291 
1292 static enum mcu_mmps_mode
1293 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1294 {
1295 	switch (smps) {
1296 	case IEEE80211_SMPS_OFF:
1297 		return MCU_MMPS_DISABLE;
1298 	case IEEE80211_SMPS_STATIC:
1299 		return MCU_MMPS_STATIC;
1300 	case IEEE80211_SMPS_DYNAMIC:
1301 		return MCU_MMPS_DYNAMIC;
1302 	default:
1303 		return MCU_MMPS_DISABLE;
1304 	}
1305 }
1306 
1307 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1308 				   struct ieee80211_vif *vif,
1309 				   struct ieee80211_sta *sta,
1310 				   void *data, u32 field)
1311 {
1312 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1313 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1314 	struct sta_phy *phy = data;
1315 	struct sta_rec_ra_fixed *ra;
1316 	struct sk_buff *skb;
1317 	struct tlv *tlv;
1318 
1319 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1320 					    &msta->wcid);
1321 	if (IS_ERR(skb))
1322 		return PTR_ERR(skb);
1323 
1324 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1325 	ra = (struct sta_rec_ra_fixed *)tlv;
1326 
1327 	switch (field) {
1328 	case RATE_PARAM_AUTO:
1329 		break;
1330 	case RATE_PARAM_FIXED:
1331 	case RATE_PARAM_FIXED_MCS:
1332 	case RATE_PARAM_FIXED_GI:
1333 	case RATE_PARAM_FIXED_HE_LTF:
1334 		if (phy)
1335 			ra->phy = *phy;
1336 		break;
1337 	case RATE_PARAM_MMPS_UPDATE:
1338 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1339 		break;
1340 	case RATE_PARAM_SPE_UPDATE:
1341 		ra->spe_idx = *(u8 *)data;
1342 		break;
1343 	default:
1344 		break;
1345 	}
1346 	ra->field = cpu_to_le32(field);
1347 
1348 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1349 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1350 }
1351 
1352 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1353 			struct ieee80211_sta *sta)
1354 {
1355 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1356 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1357 	struct wtbl_req_hdr *wtbl_hdr;
1358 	struct tlv *sta_wtbl;
1359 	struct sk_buff *skb;
1360 	int ret;
1361 
1362 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1363 					    &msta->wcid);
1364 	if (IS_ERR(skb))
1365 		return PTR_ERR(skb);
1366 
1367 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1368 					   sizeof(struct tlv));
1369 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1370 						  WTBL_SET, sta_wtbl, &skb);
1371 	if (IS_ERR(wtbl_hdr))
1372 		return PTR_ERR(wtbl_hdr);
1373 
1374 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1375 
1376 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1377 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1378 	if (ret)
1379 		return ret;
1380 
1381 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1382 					      RATE_PARAM_MMPS_UPDATE);
1383 }
1384 
1385 static int
1386 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1387 		       struct ieee80211_sta *sta)
1388 {
1389 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1390 	struct mt76_phy *mphy = mvif->phy->mt76;
1391 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1392 
1393 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1394 					      RATE_PARAM_SPE_UPDATE);
1395 }
1396 
1397 static int
1398 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1399 			       struct ieee80211_vif *vif,
1400 			       struct ieee80211_sta *sta)
1401 {
1402 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1403 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1404 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1405 	enum nl80211_band band = chandef->chan->band;
1406 	struct sta_phy phy = {};
1407 	int ret, nrates = 0;
1408 
1409 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1410 	do {									\
1411 		u8 i, gi = mask->control[band]._gi;				\
1412 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1413 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1414 			phy.sgi |= gi << (i << (_he));				\
1415 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1416 		}								\
1417 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1418 			if (!mask->control[band]._mcs[i])			\
1419 				continue;					\
1420 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1421 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1422 			if (_ht)						\
1423 				phy.mcs += 8 * i;				\
1424 		}								\
1425 	} while (0)
1426 
1427 	if (sta->deflink.he_cap.has_he) {
1428 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1429 	} else if (sta->deflink.vht_cap.vht_supported) {
1430 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1431 	} else if (sta->deflink.ht_cap.ht_supported) {
1432 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1433 	} else {
1434 		nrates = hweight32(mask->control[band].legacy);
1435 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1436 	}
1437 #undef __sta_phy_bitrate_mask_check
1438 
1439 	/* fall back to auto rate control */
1440 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1441 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1442 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1443 	    nrates != 1)
1444 		return 0;
1445 
1446 	/* fixed single rate */
1447 	if (nrates == 1) {
1448 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1449 						     RATE_PARAM_FIXED_MCS);
1450 		if (ret)
1451 			return ret;
1452 	}
1453 
1454 	/* fixed GI */
1455 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1456 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1457 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1458 		u32 addr;
1459 
1460 		/* firmware updates only TXCMD but doesn't take WTBL into
1461 		 * account, so driver should update here to reflect the
1462 		 * actual txrate hardware sends out.
1463 		 */
1464 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1465 		if (sta->deflink.he_cap.has_he)
1466 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1467 		else
1468 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1469 
1470 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1471 						     RATE_PARAM_FIXED_GI);
1472 		if (ret)
1473 			return ret;
1474 	}
1475 
1476 	/* fixed HE_LTF */
1477 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1478 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1479 						     RATE_PARAM_FIXED_HE_LTF);
1480 		if (ret)
1481 			return ret;
1482 	}
1483 
1484 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1485 }
1486 
1487 static void
1488 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1489 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1490 {
1491 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1492 	struct mt76_phy *mphy = mvif->phy->mt76;
1493 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1494 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1495 	enum nl80211_band band = chandef->chan->band;
1496 	struct sta_rec_ra *ra;
1497 	struct tlv *tlv;
1498 	u32 supp_rate = sta->deflink.supp_rates[band];
1499 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1500 
1501 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1502 	ra = (struct sta_rec_ra *)tlv;
1503 
1504 	ra->valid = true;
1505 	ra->auto_rate = true;
1506 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1507 	ra->channel = chandef->chan->hw_value;
1508 	ra->bw = sta->deflink.bandwidth;
1509 	ra->phy.bw = sta->deflink.bandwidth;
1510 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1511 
1512 	if (supp_rate) {
1513 		supp_rate &= mask->control[band].legacy;
1514 		ra->rate_len = hweight32(supp_rate);
1515 
1516 		if (band == NL80211_BAND_2GHZ) {
1517 			ra->supp_mode = MODE_CCK;
1518 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1519 
1520 			if (ra->rate_len > 4) {
1521 				ra->supp_mode |= MODE_OFDM;
1522 				ra->supp_ofdm_rate = supp_rate >> 4;
1523 			}
1524 		} else {
1525 			ra->supp_mode = MODE_OFDM;
1526 			ra->supp_ofdm_rate = supp_rate;
1527 		}
1528 	}
1529 
1530 	if (sta->deflink.ht_cap.ht_supported) {
1531 		ra->supp_mode |= MODE_HT;
1532 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1533 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1534 
1535 		cap |= STA_CAP_HT;
1536 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1537 			cap |= STA_CAP_SGI_20;
1538 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1539 			cap |= STA_CAP_SGI_40;
1540 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1541 			cap |= STA_CAP_TX_STBC;
1542 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1543 			cap |= STA_CAP_RX_STBC;
1544 		if (mvif->cap.ht_ldpc &&
1545 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1546 			cap |= STA_CAP_LDPC;
1547 
1548 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1549 					  mask->control[band].ht_mcs);
1550 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1551 	}
1552 
1553 	if (sta->deflink.vht_cap.vht_supported) {
1554 		u8 af;
1555 
1556 		ra->supp_mode |= MODE_VHT;
1557 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1558 			       sta->deflink.vht_cap.cap);
1559 		ra->af = max_t(u8, ra->af, af);
1560 
1561 		cap |= STA_CAP_VHT;
1562 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1563 			cap |= STA_CAP_VHT_SGI_80;
1564 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1565 			cap |= STA_CAP_VHT_SGI_160;
1566 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1567 			cap |= STA_CAP_VHT_TX_STBC;
1568 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1569 			cap |= STA_CAP_VHT_RX_STBC;
1570 		if (mvif->cap.vht_ldpc &&
1571 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1572 			cap |= STA_CAP_VHT_LDPC;
1573 
1574 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1575 					   mask->control[band].vht_mcs);
1576 	}
1577 
1578 	if (sta->deflink.he_cap.has_he) {
1579 		ra->supp_mode |= MODE_HE;
1580 		cap |= STA_CAP_HE;
1581 
1582 		if (sta->deflink.he_6ghz_capa.capa)
1583 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1584 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1585 	}
1586 
1587 	ra->sta_cap = cpu_to_le32(cap);
1588 }
1589 
1590 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1591 			     struct ieee80211_sta *sta, bool changed)
1592 {
1593 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1594 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1595 	struct sk_buff *skb;
1596 	int ret;
1597 
1598 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1599 					    &msta->wcid);
1600 	if (IS_ERR(skb))
1601 		return PTR_ERR(skb);
1602 
1603 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1604 	 * once dev->rc_work changes the settings driver should also
1605 	 * update sta_rec_he here.
1606 	 */
1607 	if (changed)
1608 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1609 
1610 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1611 	 * i.e 0-{7,8,9} for VHT.
1612 	 */
1613 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1614 
1615 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1616 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1617 	if (ret)
1618 		return ret;
1619 
1620 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1621 	 * and updates as peer fixed rate parameters, which overrides
1622 	 * sta_rec_ra and firmware rate control algorithm.
1623 	 */
1624 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1625 }
1626 
1627 static int
1628 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1629 		     struct ieee80211_sta *sta)
1630 {
1631 #define MT_STA_BSS_GROUP		1
1632 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1633 	struct mt7915_sta *msta;
1634 	struct {
1635 		__le32 action;
1636 		u8 wlan_idx_lo;
1637 		u8 status;
1638 		u8 wlan_idx_hi;
1639 		u8 rsv0[5];
1640 		__le32 val;
1641 		u8 rsv1[8];
1642 	} __packed req = {
1643 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1644 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1645 	};
1646 
1647 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1648 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1649 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1650 
1651 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1652 				 sizeof(req), true);
1653 }
1654 
1655 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1656 		       struct ieee80211_sta *sta, bool enable)
1657 {
1658 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1659 	struct mt7915_sta *msta;
1660 	struct sk_buff *skb;
1661 	int ret;
1662 
1663 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1664 
1665 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1666 					    &msta->wcid);
1667 	if (IS_ERR(skb))
1668 		return PTR_ERR(skb);
1669 
1670 	/* starec basic */
1671 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
1672 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1673 	if (!enable)
1674 		goto out;
1675 
1676 	/* tag order is in accordance with firmware dependency. */
1677 	if (sta) {
1678 		/* starec bfer */
1679 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1680 		/* starec ht */
1681 		mt7915_mcu_sta_ht_tlv(skb, sta);
1682 		/* starec vht */
1683 		mt7915_mcu_sta_vht_tlv(skb, sta);
1684 		/* starec uapsd */
1685 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1686 	}
1687 
1688 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1689 	if (ret) {
1690 		dev_kfree_skb(skb);
1691 		return ret;
1692 	}
1693 
1694 	if (sta) {
1695 		/* starec amsdu */
1696 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1697 		/* starec he */
1698 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1699 		/* starec muru */
1700 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1701 		/* starec bfee */
1702 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1703 	}
1704 
1705 	ret = mt7915_mcu_add_group(dev, vif, sta);
1706 	if (ret) {
1707 		dev_kfree_skb(skb);
1708 		return ret;
1709 	}
1710 out:
1711 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1712 	if (ret)
1713 		return ret;
1714 
1715 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1716 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1717 }
1718 
1719 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1720 {
1721 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1722 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1723 	struct {
1724 		__le32 args[2];
1725 	} req = {
1726 		.args[0] = cpu_to_le32(1),
1727 		.args[1] = cpu_to_le32(6),
1728 	};
1729 
1730 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1731 					 &req, sizeof(req));
1732 #else
1733 	return 0;
1734 #endif
1735 }
1736 
1737 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1738 			    struct ieee80211_vif *vif, bool enable)
1739 {
1740 	struct mt7915_dev *dev = phy->dev;
1741 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1742 	struct {
1743 		struct req_hdr {
1744 			u8 omac_idx;
1745 			u8 band_idx;
1746 			__le16 tlv_num;
1747 			u8 is_tlv_append;
1748 			u8 rsv[3];
1749 		} __packed hdr;
1750 		struct req_tlv {
1751 			__le16 tag;
1752 			__le16 len;
1753 			u8 active;
1754 			u8 band_idx;
1755 			u8 omac_addr[ETH_ALEN];
1756 		} __packed tlv;
1757 	} data = {
1758 		.hdr = {
1759 			.omac_idx = mvif->mt76.omac_idx,
1760 			.band_idx = mvif->mt76.band_idx,
1761 			.tlv_num = cpu_to_le16(1),
1762 			.is_tlv_append = 1,
1763 		},
1764 		.tlv = {
1765 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1766 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1767 			.active = enable,
1768 			.band_idx = mvif->mt76.band_idx,
1769 		},
1770 	};
1771 
1772 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1773 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1774 
1775 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1776 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1777 				 &data, sizeof(data), true);
1778 }
1779 
1780 static void
1781 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1782 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1783 			 struct ieee80211_mutable_offsets *offs)
1784 {
1785 	struct bss_info_bcn_cntdwn *info;
1786 	struct tlv *tlv;
1787 	int sub_tag;
1788 
1789 	if (!offs->cntdwn_counter_offs[0])
1790 		return;
1791 
1792 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1793 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1794 					   &bcn->sub_ntlv, &bcn->len);
1795 	info = (struct bss_info_bcn_cntdwn *)tlv;
1796 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1797 }
1798 
1799 static void
1800 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1801 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1802 		       struct ieee80211_mutable_offsets *offs)
1803 {
1804 	struct bss_info_bcn_mbss *mbss;
1805 	const struct element *elem;
1806 	struct tlv *tlv;
1807 
1808 	if (!vif->bss_conf.bssid_indicator)
1809 		return;
1810 
1811 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1812 					   sizeof(*mbss), &bcn->sub_ntlv,
1813 					   &bcn->len);
1814 
1815 	mbss = (struct bss_info_bcn_mbss *)tlv;
1816 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1817 	mbss->bitmap = cpu_to_le32(1);
1818 
1819 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1820 			    &skb->data[offs->mbssid_off],
1821 			    skb->len - offs->mbssid_off) {
1822 		const struct element *sub_elem;
1823 
1824 		if (elem->datalen < 2)
1825 			continue;
1826 
1827 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1828 			const struct ieee80211_bssid_index *idx;
1829 			const u8 *idx_ie;
1830 
1831 			if (sub_elem->id || sub_elem->datalen < 4)
1832 				continue; /* not a valid BSS profile */
1833 
1834 			/* Find WLAN_EID_MULTI_BSSID_IDX
1835 			 * in the merged nontransmitted profile
1836 			 */
1837 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1838 						  sub_elem->data,
1839 						  sub_elem->datalen);
1840 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1841 				continue;
1842 
1843 			idx = (void *)(idx_ie + 2);
1844 			if (!idx->bssid_index || idx->bssid_index > 31)
1845 				continue;
1846 
1847 			mbss->offset[idx->bssid_index] =
1848 				cpu_to_le16(idx_ie - skb->data);
1849 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1850 		}
1851 	}
1852 }
1853 
1854 static void
1855 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1856 		       struct sk_buff *rskb, struct sk_buff *skb,
1857 		       struct bss_info_bcn *bcn,
1858 		       struct ieee80211_mutable_offsets *offs)
1859 {
1860 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1861 	struct bss_info_bcn_cont *cont;
1862 	struct tlv *tlv;
1863 	u8 *buf;
1864 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1865 
1866 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1867 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1868 					   len, &bcn->sub_ntlv, &bcn->len);
1869 
1870 	cont = (struct bss_info_bcn_cont *)tlv;
1871 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1872 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1873 
1874 	if (offs->cntdwn_counter_offs[0]) {
1875 		u16 offset = offs->cntdwn_counter_offs[0];
1876 
1877 		if (vif->bss_conf.csa_active)
1878 			cont->csa_ofs = cpu_to_le16(offset - 4);
1879 		if (vif->bss_conf.color_change_active)
1880 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1881 	}
1882 
1883 	buf = (u8 *)tlv + sizeof(*cont);
1884 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1885 			      0, BSS_CHANGED_BEACON);
1886 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1887 }
1888 
1889 int
1890 mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1891 			     u32 changed)
1892 {
1893 #define OFFLOAD_TX_MODE_SU	BIT(0)
1894 #define OFFLOAD_TX_MODE_MU	BIT(1)
1895 	struct ieee80211_hw *hw = mt76_hw(dev);
1896 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1897 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1898 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1899 	enum nl80211_band band = chandef->chan->band;
1900 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1901 	struct bss_info_bcn *bcn;
1902 	struct bss_info_inband_discovery *discov;
1903 	struct ieee80211_tx_info *info;
1904 	struct sk_buff *rskb, *skb = NULL;
1905 	struct tlv *tlv, *sub_tlv;
1906 	bool ext_phy = phy != &dev->phy;
1907 	u8 *buf, interval;
1908 	int len;
1909 
1910 	if (vif->bss_conf.nontransmitted)
1911 		return 0;
1912 
1913 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
1914 					       MT7915_MAX_BSS_OFFLOAD_SIZE);
1915 	if (IS_ERR(rskb))
1916 		return PTR_ERR(rskb);
1917 
1918 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1919 	bcn = (struct bss_info_bcn *)tlv;
1920 	bcn->enable = true;
1921 
1922 	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
1923 		interval = vif->bss_conf.fils_discovery.max_interval;
1924 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1925 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1926 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1927 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1928 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1929 	}
1930 
1931 	if (!skb) {
1932 		dev_kfree_skb(rskb);
1933 		return -EINVAL;
1934 	}
1935 
1936 	info = IEEE80211_SKB_CB(skb);
1937 	info->control.vif = vif;
1938 	info->band = band;
1939 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1940 
1941 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1942 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1943 
1944 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
1945 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1946 		dev_kfree_skb(rskb);
1947 		dev_kfree_skb(skb);
1948 		return -EINVAL;
1949 	}
1950 
1951 	sub_tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1952 					       len, &bcn->sub_ntlv, &bcn->len);
1953 	discov = (struct bss_info_inband_discovery *)sub_tlv;
1954 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1955 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1956 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1957 	discov->tx_interval = interval;
1958 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1959 	discov->enable = !!interval;
1960 
1961 	buf = (u8 *)sub_tlv + sizeof(*discov);
1962 
1963 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1964 			      0, changed);
1965 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1966 
1967 	dev_kfree_skb(skb);
1968 
1969 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
1970 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1971 }
1972 
1973 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1974 			  int en, u32 changed)
1975 {
1976 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1977 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1978 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1979 	struct ieee80211_mutable_offsets offs;
1980 	struct ieee80211_tx_info *info;
1981 	struct sk_buff *skb, *rskb;
1982 	struct tlv *tlv;
1983 	struct bss_info_bcn *bcn;
1984 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
1985 	bool ext_phy = phy != &dev->phy;
1986 
1987 	if (vif->bss_conf.nontransmitted)
1988 		return 0;
1989 
1990 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1991 					       NULL, len);
1992 	if (IS_ERR(rskb))
1993 		return PTR_ERR(rskb);
1994 
1995 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1996 	bcn = (struct bss_info_bcn *)tlv;
1997 	bcn->enable = en;
1998 
1999 	if (!en)
2000 		goto out;
2001 
2002 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
2003 	if (!skb) {
2004 		dev_kfree_skb(rskb);
2005 		return -EINVAL;
2006 	}
2007 
2008 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
2009 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2010 		dev_kfree_skb(rskb);
2011 		dev_kfree_skb(skb);
2012 		return -EINVAL;
2013 	}
2014 
2015 	info = IEEE80211_SKB_CB(skb);
2016 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
2017 
2018 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2019 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2020 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2021 	dev_kfree_skb(skb);
2022 
2023 out:
2024 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2025 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2026 }
2027 
2028 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2029 {
2030 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2031 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2032 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2033 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2034 		return -EIO;
2035 	}
2036 
2037 	/* clear irq when the driver own success */
2038 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2039 		MT_TOP_LPCR_HOST_BAND_STAT);
2040 
2041 	return 0;
2042 }
2043 
2044 static int
2045 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2046 {
2047 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2048 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2049 
2050 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2051 			    state, 1000)) {
2052 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2053 		return -EIO;
2054 	}
2055 	return 0;
2056 }
2057 
2058 static int mt7915_load_firmware(struct mt7915_dev *dev)
2059 {
2060 	int ret;
2061 
2062 	/* make sure fw is download state */
2063 	if (mt7915_firmware_state(dev, false)) {
2064 		/* restart firmware once */
2065 		mt76_connac_mcu_restart(&dev->mt76);
2066 		ret = mt7915_firmware_state(dev, false);
2067 		if (ret) {
2068 			dev_err(dev->mt76.dev,
2069 				"Firmware is not ready for download\n");
2070 			return ret;
2071 		}
2072 	}
2073 
2074 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2075 	if (ret)
2076 		return ret;
2077 
2078 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2079 				    fw_name(dev, FIRMWARE_WA));
2080 	if (ret)
2081 		return ret;
2082 
2083 	ret = mt7915_firmware_state(dev, true);
2084 	if (ret)
2085 		return ret;
2086 
2087 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2088 
2089 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2090 
2091 	return 0;
2092 }
2093 
2094 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2095 {
2096 	struct {
2097 		u8 ctrl_val;
2098 		u8 pad[3];
2099 	} data = {
2100 		.ctrl_val = ctrl
2101 	};
2102 
2103 	if (type == MCU_FW_LOG_WA)
2104 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2105 					 &data, sizeof(data), true);
2106 
2107 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2108 				 sizeof(data), true);
2109 }
2110 
2111 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2112 {
2113 	struct {
2114 		u8 ver;
2115 		u8 pad;
2116 		__le16 len;
2117 		u8 level;
2118 		u8 rsv[3];
2119 		__le32 module_idx;
2120 	} data = {
2121 		.module_idx = cpu_to_le32(module),
2122 		.level = level,
2123 	};
2124 
2125 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2126 				 sizeof(data), false);
2127 }
2128 
2129 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2130 {
2131 	struct {
2132 		__le32 cmd;
2133 		u8 enable;
2134 	} data = {
2135 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2136 		.enable = enabled,
2137 	};
2138 
2139 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2140 				sizeof(data), false);
2141 }
2142 
2143 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy)
2144 {
2145 	struct mt7915_dev *dev = phy->dev;
2146 	struct sk_buff *skb;
2147 	struct mt7915_mcu_muru_stats *mu_stats;
2148 	int ret;
2149 
2150 	struct {
2151 		__le32 cmd;
2152 		u8 band_idx;
2153 	} req = {
2154 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2155 		.band_idx = phy->mt76->band_idx,
2156 	};
2157 
2158 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2159 					&req, sizeof(req), true, &skb);
2160 	if (ret)
2161 		return ret;
2162 
2163 	mu_stats = (struct mt7915_mcu_muru_stats *)(skb->data);
2164 
2165 	/* accumulate stats, these are clear-on-read */
2166 #define __dl_u32(s)	 phy->mib.dl_##s += le32_to_cpu(mu_stats->dl.s)
2167 #define __ul_u32(s)	 phy->mib.ul_##s += le32_to_cpu(mu_stats->ul.s)
2168 	__dl_u32(cck_cnt);
2169 	__dl_u32(ofdm_cnt);
2170 	__dl_u32(htmix_cnt);
2171 	__dl_u32(htgf_cnt);
2172 	__dl_u32(vht_su_cnt);
2173 	__dl_u32(vht_2mu_cnt);
2174 	__dl_u32(vht_3mu_cnt);
2175 	__dl_u32(vht_4mu_cnt);
2176 	__dl_u32(he_su_cnt);
2177 	__dl_u32(he_2ru_cnt);
2178 	__dl_u32(he_2mu_cnt);
2179 	__dl_u32(he_3ru_cnt);
2180 	__dl_u32(he_3mu_cnt);
2181 	__dl_u32(he_4ru_cnt);
2182 	__dl_u32(he_4mu_cnt);
2183 	__dl_u32(he_5to8ru_cnt);
2184 	__dl_u32(he_9to16ru_cnt);
2185 	__dl_u32(he_gtr16ru_cnt);
2186 
2187 	__ul_u32(hetrig_su_cnt);
2188 	__ul_u32(hetrig_2ru_cnt);
2189 	__ul_u32(hetrig_3ru_cnt);
2190 	__ul_u32(hetrig_4ru_cnt);
2191 	__ul_u32(hetrig_5to8ru_cnt);
2192 	__ul_u32(hetrig_9to16ru_cnt);
2193 	__ul_u32(hetrig_gtr16ru_cnt);
2194 	__ul_u32(hetrig_2mu_cnt);
2195 	__ul_u32(hetrig_3mu_cnt);
2196 	__ul_u32(hetrig_4mu_cnt);
2197 #undef __dl_u32
2198 #undef __ul_u32
2199 
2200 	dev_kfree_skb(skb);
2201 
2202 	return 0;
2203 }
2204 
2205 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2206 {
2207 	struct {
2208 		u8 enable;
2209 		u8 _rsv[3];
2210 	} __packed req = {
2211 		.enable = enabled
2212 	};
2213 
2214 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2215 				 sizeof(req), false);
2216 }
2217 
2218 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2219 {
2220 	struct {
2221 		__le32 cmd;
2222 		u8 val[4];
2223 	} __packed req = {
2224 		.cmd = cpu_to_le32(cmd),
2225 	};
2226 
2227 	put_unaligned_le32(val, req.val);
2228 
2229 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2230 				 sizeof(req), false);
2231 }
2232 
2233 static int
2234 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2235 {
2236 #define RX_AIRTIME_FEATURE_CTRL		1
2237 #define RX_AIRTIME_BITWISE_CTRL		2
2238 #define RX_AIRTIME_CLEAR_EN	1
2239 	struct {
2240 		__le16 field;
2241 		__le16 sub_field;
2242 		__le32 set_status;
2243 		__le32 get_status;
2244 		u8 _rsv[12];
2245 
2246 		bool airtime_en;
2247 		bool mibtime_en;
2248 		bool earlyend_en;
2249 		u8 _rsv1[9];
2250 
2251 		bool airtime_clear;
2252 		bool mibtime_clear;
2253 		u8 _rsv2[98];
2254 	} __packed req = {
2255 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2256 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2257 		.airtime_clear = true,
2258 	};
2259 	int ret;
2260 
2261 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2262 				sizeof(req), true);
2263 	if (ret)
2264 		return ret;
2265 
2266 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2267 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2268 	req.airtime_en = true;
2269 
2270 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2271 				 sizeof(req), true);
2272 }
2273 
2274 static int mt7915_red_set_watermark(struct mt7915_dev *dev)
2275 {
2276 #define RED_GLOBAL_TOKEN_WATERMARK 2
2277 	struct {
2278 		__le32 args[3];
2279 		u8 cmd;
2280 		u8 version;
2281 		u8 __rsv1[4];
2282 		__le16 len;
2283 		__le16 high_mark;
2284 		__le16 low_mark;
2285 		u8 __rsv2[12];
2286 	} __packed req = {
2287 		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
2288 		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
2289 		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
2290 		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
2291 		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
2292 	};
2293 
2294 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
2295 				 sizeof(req), false);
2296 }
2297 
2298 static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
2299 {
2300 #define RED_DISABLE		0
2301 #define RED_BY_WA_ENABLE	2
2302 	int ret;
2303 	u32 red_type = enabled ? RED_BY_WA_ENABLE : RED_DISABLE;
2304 	__le32 req = cpu_to_le32(red_type);
2305 
2306 	if (enabled) {
2307 		ret = mt7915_red_set_watermark(dev);
2308 		if (ret < 0)
2309 			return ret;
2310 	}
2311 
2312 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
2313 				sizeof(req), false);
2314 	if (ret < 0)
2315 		return ret;
2316 
2317 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2318 				 MCU_WA_PARAM_RED, enabled, 0);
2319 }
2320 
2321 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2322 {
2323 	int ret;
2324 
2325 	/* force firmware operation mode into normal state,
2326 	 * which should be set before firmware download stage.
2327 	 */
2328 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2329 
2330 	ret = mt7915_driver_own(dev, 0);
2331 	if (ret)
2332 		return ret;
2333 	/* set driver own for band1 when two hif exist */
2334 	if (dev->hif2) {
2335 		ret = mt7915_driver_own(dev, 1);
2336 		if (ret)
2337 			return ret;
2338 	}
2339 
2340 	ret = mt7915_load_firmware(dev);
2341 	if (ret)
2342 		return ret;
2343 
2344 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2345 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2346 	if (ret)
2347 		return ret;
2348 
2349 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2350 	if (ret)
2351 		return ret;
2352 
2353 	if ((mtk_wed_device_active(&dev->mt76.mmio.wed) &&
2354 	     is_mt7915(&dev->mt76)) ||
2355 	    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
2356 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2357 
2358 	ret = mt7915_mcu_set_mwds(dev, 1);
2359 	if (ret)
2360 		return ret;
2361 
2362 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2363 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2364 	if (ret)
2365 		return ret;
2366 
2367 	ret = mt7915_mcu_init_rx_airtime(dev);
2368 	if (ret)
2369 		return ret;
2370 
2371 	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
2372 }
2373 
2374 int mt7915_mcu_init(struct mt7915_dev *dev)
2375 {
2376 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2377 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2378 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2379 		.mcu_parse_response = mt7915_mcu_parse_response,
2380 	};
2381 
2382 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2383 
2384 	return mt7915_mcu_init_firmware(dev);
2385 }
2386 
2387 void mt7915_mcu_exit(struct mt7915_dev *dev)
2388 {
2389 	mt76_connac_mcu_restart(&dev->mt76);
2390 	if (mt7915_firmware_state(dev, false)) {
2391 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2392 		goto out;
2393 	}
2394 
2395 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2396 	if (dev->hif2)
2397 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2398 			MT_TOP_LPCR_HOST_FW_OWN);
2399 out:
2400 	skb_queue_purge(&dev->mt76.mcu.res_q);
2401 }
2402 
2403 static int
2404 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2405 {
2406 	struct {
2407 		u8 operation;
2408 		u8 count;
2409 		u8 _rsv[2];
2410 		u8 index;
2411 		u8 enable;
2412 		__le16 etype;
2413 	} req = {
2414 		.operation = 1,
2415 		.count = 1,
2416 		.enable = 1,
2417 		.etype = cpu_to_le16(ETH_P_PAE),
2418 	};
2419 
2420 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2421 				 &req, sizeof(req), false);
2422 }
2423 
2424 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2425 		       bool enable, bool hdr_trans)
2426 {
2427 	struct {
2428 		u8 operation;
2429 		u8 enable;
2430 		u8 check_bssid;
2431 		u8 insert_vlan;
2432 		u8 remove_vlan;
2433 		u8 tid;
2434 		u8 mode;
2435 		u8 rsv;
2436 	} __packed req_trans = {
2437 		.enable = hdr_trans,
2438 	};
2439 	struct {
2440 		u8 enable;
2441 		u8 band;
2442 		u8 rsv[2];
2443 	} __packed req_mac = {
2444 		.enable = enable,
2445 		.band = band,
2446 	};
2447 	int ret;
2448 
2449 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2450 				&req_trans, sizeof(req_trans), false);
2451 	if (ret)
2452 		return ret;
2453 
2454 	if (hdr_trans)
2455 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2456 
2457 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2458 				 &req_mac, sizeof(req_mac), true);
2459 }
2460 
2461 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2462 {
2463 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2464 	u8 num = req->total;
2465 	size_t len = sizeof(*req) -
2466 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2467 
2468 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2469 				 len, true);
2470 }
2471 
2472 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2473 {
2474 #define TX_CMD_MODE		1
2475 	struct mt7915_mcu_tx req = {
2476 		.valid = true,
2477 		.mode = TX_CMD_MODE,
2478 		.total = IEEE80211_NUM_ACS,
2479 	};
2480 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2481 	int ac;
2482 
2483 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2484 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2485 		struct edca *e = &req.edca[ac];
2486 
2487 		e->set = WMM_PARAM_SET;
2488 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2489 		e->aifs = q->aifs;
2490 		e->txop = cpu_to_le16(q->txop);
2491 
2492 		if (q->cw_min)
2493 			e->cw_min = fls(q->cw_min);
2494 		else
2495 			e->cw_min = 5;
2496 
2497 		if (q->cw_max)
2498 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2499 		else
2500 			e->cw_max = cpu_to_le16(10);
2501 	}
2502 
2503 	return mt7915_mcu_update_edca(dev, &req);
2504 }
2505 
2506 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2507 {
2508 	struct {
2509 		__le32 tag;
2510 		__le16 min_lpn;
2511 		u8 rsv[2];
2512 	} __packed req = {
2513 		.tag = cpu_to_le32(0x1),
2514 		.min_lpn = cpu_to_le16(val),
2515 	};
2516 
2517 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2518 				 sizeof(req), true);
2519 }
2520 
2521 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2522 			    const struct mt7915_dfs_pulse *pulse)
2523 {
2524 	struct {
2525 		__le32 tag;
2526 
2527 		__le32 max_width;		/* us */
2528 		__le32 max_pwr;			/* dbm */
2529 		__le32 min_pwr;			/* dbm */
2530 		__le32 min_stgr_pri;		/* us */
2531 		__le32 max_stgr_pri;		/* us */
2532 		__le32 min_cr_pri;		/* us */
2533 		__le32 max_cr_pri;		/* us */
2534 	} __packed req = {
2535 		.tag = cpu_to_le32(0x3),
2536 
2537 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2538 		__req_field(max_width),
2539 		__req_field(max_pwr),
2540 		__req_field(min_pwr),
2541 		__req_field(min_stgr_pri),
2542 		__req_field(max_stgr_pri),
2543 		__req_field(min_cr_pri),
2544 		__req_field(max_cr_pri),
2545 #undef __req_field
2546 	};
2547 
2548 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2549 				 sizeof(req), true);
2550 }
2551 
2552 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2553 			    const struct mt7915_dfs_pattern *pattern)
2554 {
2555 	struct {
2556 		__le32 tag;
2557 		__le16 radar_type;
2558 
2559 		u8 enb;
2560 		u8 stgr;
2561 		u8 min_crpn;
2562 		u8 max_crpn;
2563 		u8 min_crpr;
2564 		u8 min_pw;
2565 		__le32 min_pri;
2566 		__le32 max_pri;
2567 		u8 max_pw;
2568 		u8 min_crbn;
2569 		u8 max_crbn;
2570 		u8 min_stgpn;
2571 		u8 max_stgpn;
2572 		u8 min_stgpr;
2573 		u8 rsv[2];
2574 		__le32 min_stgpr_diff;
2575 	} __packed req = {
2576 		.tag = cpu_to_le32(0x2),
2577 		.radar_type = cpu_to_le16(index),
2578 
2579 #define __req_field_u8(field) .field = pattern->field
2580 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2581 		__req_field_u8(enb),
2582 		__req_field_u8(stgr),
2583 		__req_field_u8(min_crpn),
2584 		__req_field_u8(max_crpn),
2585 		__req_field_u8(min_crpr),
2586 		__req_field_u8(min_pw),
2587 		__req_field_u32(min_pri),
2588 		__req_field_u32(max_pri),
2589 		__req_field_u8(max_pw),
2590 		__req_field_u8(min_crbn),
2591 		__req_field_u8(max_crbn),
2592 		__req_field_u8(min_stgpn),
2593 		__req_field_u8(max_stgpn),
2594 		__req_field_u8(min_stgpr),
2595 		__req_field_u32(min_stgpr_diff),
2596 #undef __req_field_u8
2597 #undef __req_field_u32
2598 	};
2599 
2600 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2601 				 sizeof(req), true);
2602 }
2603 
2604 static int
2605 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2606 				 struct cfg80211_chan_def *chandef,
2607 				 int cmd)
2608 {
2609 	struct mt7915_dev *dev = phy->dev;
2610 	struct mt76_phy *mphy = phy->mt76;
2611 	struct ieee80211_channel *chan = mphy->chandef.chan;
2612 	int freq = mphy->chandef.center_freq1;
2613 	struct mt7915_mcu_background_chain_ctrl req = {
2614 		.monitor_scan_type = 2, /* simple rx */
2615 	};
2616 
2617 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2618 		return -EINVAL;
2619 
2620 	if (!cfg80211_chandef_valid(&mphy->chandef))
2621 		return -EINVAL;
2622 
2623 	switch (cmd) {
2624 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2625 		req.chan = chan->hw_value;
2626 		req.central_chan = ieee80211_frequency_to_channel(freq);
2627 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2628 		req.monitor_chan = chandef->chan->hw_value;
2629 		req.monitor_central_chan =
2630 			ieee80211_frequency_to_channel(chandef->center_freq1);
2631 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2632 		req.band_idx = phy->mt76->band_idx;
2633 		req.scan_mode = 1;
2634 		break;
2635 	}
2636 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2637 		req.monitor_chan = chandef->chan->hw_value;
2638 		req.monitor_central_chan =
2639 			ieee80211_frequency_to_channel(chandef->center_freq1);
2640 		req.band_idx = phy->mt76->band_idx;
2641 		req.scan_mode = 2;
2642 		break;
2643 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2644 		req.chan = chan->hw_value;
2645 		req.central_chan = ieee80211_frequency_to_channel(freq);
2646 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2647 		req.tx_stream = hweight8(mphy->antenna_mask);
2648 		req.rx_stream = mphy->antenna_mask;
2649 		break;
2650 	default:
2651 		return -EINVAL;
2652 	}
2653 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2654 
2655 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2656 				 &req, sizeof(req), false);
2657 }
2658 
2659 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2660 				     struct cfg80211_chan_def *chandef)
2661 {
2662 	struct mt7915_dev *dev = phy->dev;
2663 	int err, region;
2664 
2665 	if (!chandef) { /* disable offchain */
2666 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2667 					      0, 0);
2668 		if (err)
2669 			return err;
2670 
2671 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2672 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2673 	}
2674 
2675 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2676 					       CH_SWITCH_BACKGROUND_SCAN_START);
2677 	if (err)
2678 		return err;
2679 
2680 	switch (dev->mt76.region) {
2681 	case NL80211_DFS_ETSI:
2682 		region = 0;
2683 		break;
2684 	case NL80211_DFS_JP:
2685 		region = 2;
2686 		break;
2687 	case NL80211_DFS_FCC:
2688 	default:
2689 		region = 1;
2690 		break;
2691 	}
2692 
2693 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2694 				       0, region);
2695 }
2696 
2697 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2698 {
2699 	static const u8 ch_band[] = {
2700 		[NL80211_BAND_2GHZ] = 0,
2701 		[NL80211_BAND_5GHZ] = 1,
2702 		[NL80211_BAND_6GHZ] = 2,
2703 	};
2704 	struct mt7915_dev *dev = phy->dev;
2705 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2706 	int freq1 = chandef->center_freq1;
2707 	u8 band = phy->mt76->band_idx;
2708 	struct {
2709 		u8 control_ch;
2710 		u8 center_ch;
2711 		u8 bw;
2712 		u8 tx_path_num;
2713 		u8 rx_path;	/* mask or num */
2714 		u8 switch_reason;
2715 		u8 band_idx;
2716 		u8 center_ch2;	/* for 80+80 only */
2717 		__le16 cac_case;
2718 		u8 channel_band;
2719 		u8 rsv0;
2720 		__le32 outband_freq;
2721 		u8 txpower_drop;
2722 		u8 ap_bw;
2723 		u8 ap_center_ch;
2724 		u8 rsv1[57];
2725 	} __packed req = {
2726 		.control_ch = chandef->chan->hw_value,
2727 		.center_ch = ieee80211_frequency_to_channel(freq1),
2728 		.bw = mt76_connac_chan_bw(chandef),
2729 		.tx_path_num = hweight16(phy->mt76->chainmask),
2730 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2731 		.band_idx = band,
2732 		.channel_band = ch_band[chandef->chan->band],
2733 	};
2734 
2735 #ifdef CONFIG_NL80211_TESTMODE
2736 	if (phy->mt76->test.tx_antenna_mask &&
2737 	    mt76_testmode_enabled(phy->mt76)) {
2738 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2739 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2740 	}
2741 #endif
2742 
2743 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2744 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2745 
2746 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
2747 		req.switch_reason = CH_SWITCH_NORMAL;
2748 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL ||
2749 		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
2750 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2751 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2752 					  NL80211_IFTYPE_AP))
2753 		req.switch_reason = CH_SWITCH_DFS;
2754 	else
2755 		req.switch_reason = CH_SWITCH_NORMAL;
2756 
2757 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2758 		req.rx_path = hweight8(req.rx_path);
2759 
2760 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2761 		int freq2 = chandef->center_freq2;
2762 
2763 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2764 	}
2765 
2766 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2767 }
2768 
2769 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2770 {
2771 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2772 #define PAGE_IDX_MASK		GENMASK(4, 2)
2773 #define PER_PAGE_SIZE		0x400
2774 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2775 	u16 eeprom_size = mt7915_eeprom_size(dev);
2776 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2777 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2778 	int eep_len;
2779 	int i;
2780 
2781 	for (i = 0; i < total; i++, eep += eep_len) {
2782 		struct sk_buff *skb;
2783 		int ret;
2784 
2785 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2786 			eep_len = eeprom_size % PER_PAGE_SIZE;
2787 		else
2788 			eep_len = PER_PAGE_SIZE;
2789 
2790 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2791 					 sizeof(req) + eep_len);
2792 		if (!skb)
2793 			return -ENOMEM;
2794 
2795 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2796 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2797 		req.len = cpu_to_le16(eep_len);
2798 
2799 		skb_put_data(skb, &req, sizeof(req));
2800 		skb_put_data(skb, eep, eep_len);
2801 
2802 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2803 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2804 		if (ret)
2805 			return ret;
2806 	}
2807 
2808 	return 0;
2809 }
2810 
2811 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2812 {
2813 	struct mt7915_mcu_eeprom req = {
2814 		.buffer_mode = EE_MODE_EFUSE,
2815 		.format = EE_FORMAT_WHOLE,
2816 	};
2817 
2818 	if (dev->flash_mode)
2819 		return mt7915_mcu_set_eeprom_flash(dev);
2820 
2821 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2822 				 &req, sizeof(req), true);
2823 }
2824 
2825 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2826 {
2827 	struct mt7915_mcu_eeprom_info req = {
2828 		.addr = cpu_to_le32(round_down(offset,
2829 				    MT7915_EEPROM_BLOCK_SIZE)),
2830 	};
2831 	struct mt7915_mcu_eeprom_info *res;
2832 	struct sk_buff *skb;
2833 	int ret;
2834 	u8 *buf;
2835 
2836 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2837 					MCU_EXT_QUERY(EFUSE_ACCESS),
2838 					&req, sizeof(req), true, &skb);
2839 	if (ret)
2840 		return ret;
2841 
2842 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2843 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2844 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2845 	dev_kfree_skb(skb);
2846 
2847 	return 0;
2848 }
2849 
2850 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2851 {
2852 	struct {
2853 		u8 _rsv;
2854 		u8 version;
2855 		u8 die_idx;
2856 		u8 _rsv2;
2857 	} __packed req = {
2858 		.version = 1,
2859 	};
2860 	struct sk_buff *skb;
2861 	int ret;
2862 
2863 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2864 					MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
2865 					&req, sizeof(req), true, &skb);
2866 	if (ret)
2867 		return ret;
2868 
2869 	*block_num = *(u8 *)skb->data;
2870 	dev_kfree_skb(skb);
2871 
2872 	return 0;
2873 }
2874 
2875 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2876 				  u8 *data, u32 len, int cmd)
2877 {
2878 	struct {
2879 		u8 dir;
2880 		u8 valid;
2881 		__le16 bitmap;
2882 		s8 precal;
2883 		u8 action;
2884 		u8 band;
2885 		u8 idx;
2886 		u8 rsv[4];
2887 		__le32 len;
2888 	} req = {};
2889 	struct sk_buff *skb;
2890 
2891 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2892 	if (!skb)
2893 		return -ENOMEM;
2894 
2895 	req.idx = idx;
2896 	req.len = cpu_to_le32(len);
2897 	skb_put_data(skb, &req, sizeof(req));
2898 	skb_put_data(skb, data, len);
2899 
2900 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2901 }
2902 
2903 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2904 {
2905 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2906 	u32 total = mt7915_get_cal_group_size(dev);
2907 	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
2908 
2909 	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
2910 		return 0;
2911 
2912 	/*
2913 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2914 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2915 	 */
2916 	while (total > 0) {
2917 		int ret, len;
2918 
2919 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2920 
2921 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2922 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2923 		if (ret)
2924 			return ret;
2925 
2926 		total -= len;
2927 		cal += len;
2928 		idx++;
2929 	}
2930 
2931 	return 0;
2932 }
2933 
2934 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2935 {
2936 	int i;
2937 
2938 	for (i = 0; i < n_freqs; i++)
2939 		if (cur == freqs[i])
2940 			return i;
2941 
2942 	return -1;
2943 }
2944 
2945 static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
2946 {
2947 	static const u16 freq_list_v1[] = {
2948 		5180, 5200, 5220, 5240,
2949 		5260, 5280, 5300, 5320,
2950 		5500, 5520, 5540, 5560,
2951 		5580, 5600, 5620, 5640,
2952 		5660, 5680, 5700, 5745,
2953 		5765, 5785, 5805, 5825
2954 	};
2955 	static const u16 freq_list_v2[] = {
2956 		/* 6G BW20*/
2957 		5955, 5975, 5995, 6015,
2958 		6035, 6055, 6075, 6095,
2959 		6115, 6135, 6155, 6175,
2960 		6195, 6215, 6235, 6255,
2961 		6275, 6295, 6315, 6335,
2962 		6355, 6375, 6395, 6415,
2963 		6435, 6455, 6475, 6495,
2964 		6515, 6535, 6555, 6575,
2965 		6595, 6615, 6635, 6655,
2966 		6675, 6695, 6715, 6735,
2967 		6755, 6775, 6795, 6815,
2968 		6835, 6855, 6875, 6895,
2969 		6915, 6935, 6955, 6975,
2970 		6995, 7015, 7035, 7055,
2971 		7075, 7095, 7115,
2972 		/* 6G BW160 */
2973 		6025, 6185, 6345, 6505,
2974 		6665, 6825, 6985,
2975 		/* 5G BW20 */
2976 		5180, 5200, 5220, 5240,
2977 		5260, 5280, 5300, 5320,
2978 		5500, 5520, 5540, 5560,
2979 		5580, 5600, 5620, 5640,
2980 		5660, 5680, 5700, 5720,
2981 		5745, 5765, 5785, 5805,
2982 		5825, 5845, 5865, 5885,
2983 		/* 5G BW160 */
2984 		5250, 5570, 5815
2985 	};
2986 	static const u16 freq_list_v2_7981[] = {
2987 		/* 5G BW20 */
2988 		5180, 5200, 5220, 5240,
2989 		5260, 5280, 5300, 5320,
2990 		5500, 5520, 5540, 5560,
2991 		5580, 5600, 5620, 5640,
2992 		5660, 5680, 5700, 5720,
2993 		5745, 5765, 5785, 5805,
2994 		5825, 5845, 5865, 5885,
2995 		/* 5G BW160 */
2996 		5250, 5570, 5815
2997 	};
2998 	const u16 *freq_list = freq_list_v1;
2999 	int n_freqs = ARRAY_SIZE(freq_list_v1);
3000 	int idx;
3001 
3002 	if (!is_mt7915(&dev->mt76)) {
3003 		if (is_mt7981(&dev->mt76)) {
3004 			freq_list = freq_list_v2_7981;
3005 			n_freqs = ARRAY_SIZE(freq_list_v2_7981);
3006 		} else {
3007 			freq_list = freq_list_v2;
3008 			n_freqs = ARRAY_SIZE(freq_list_v2);
3009 		}
3010 	}
3011 
3012 	if (freq < 4000) {
3013 		if (freq < 2432)
3014 			return n_freqs;
3015 		if (freq < 2457)
3016 			return n_freqs + 1;
3017 
3018 		return n_freqs + 2;
3019 	}
3020 
3021 	if (bw == NL80211_CHAN_WIDTH_80P80)
3022 		return -1;
3023 
3024 	if (bw != NL80211_CHAN_WIDTH_20) {
3025 		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq + 10);
3026 		if (idx >= 0)
3027 			return idx;
3028 
3029 		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq - 10);
3030 		if (idx >= 0)
3031 			return idx;
3032 	}
3033 
3034 	return mt7915_find_freq_idx(freq_list, n_freqs, freq);
3035 }
3036 
3037 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3038 {
3039 	struct mt7915_dev *dev = phy->dev;
3040 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3041 	enum nl80211_band band = chandef->chan->band;
3042 	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
3043 	u16 center_freq = chandef->center_freq1;
3044 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3045 	u8 dpd_mask, cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
3046 	int idx;
3047 
3048 	switch (band) {
3049 	case NL80211_BAND_2GHZ:
3050 		dpd_mask = MT_EE_WIFI_CAL_DPD_2G;
3051 		break;
3052 	case NL80211_BAND_5GHZ:
3053 		dpd_mask = MT_EE_WIFI_CAL_DPD_5G;
3054 		break;
3055 	case NL80211_BAND_6GHZ:
3056 		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
3057 		break;
3058 	default:
3059 		dpd_mask = 0;
3060 		break;
3061 	}
3062 
3063 	if (!(eep[offs] & dpd_mask))
3064 		return 0;
3065 
3066 	idx = mt7915_dpd_freq_idx(dev, center_freq, chandef->width);
3067 	if (idx < 0)
3068 		return -EINVAL;
3069 
3070 	/* Items: Tx DPD, Tx Flatness */
3071 	idx = idx * cal_num;
3072 	cal += mt7915_get_cal_group_size(dev) + (idx * MT_EE_CAL_UNIT);
3073 
3074 	while (cal_num--) {
3075 		int ret;
3076 
3077 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3078 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3079 		if (ret)
3080 			return ret;
3081 
3082 		idx++;
3083 		cal += MT_EE_CAL_UNIT;
3084 	}
3085 
3086 	return 0;
3087 }
3088 
3089 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3090 {
3091 	struct mt76_channel_state *state = phy->mt76->chan_state;
3092 	struct mt76_channel_state *state_ts = &phy->state_ts;
3093 	struct mt7915_dev *dev = phy->dev;
3094 	struct mt7915_mcu_mib *res, req[5];
3095 	struct sk_buff *skb;
3096 	static const u32 *offs;
3097 	int i, ret, len, offs_cc;
3098 	u64 cc_tx;
3099 
3100 	/* strict order */
3101 	if (is_mt7915(&dev->mt76)) {
3102 		static const u32 chip_offs[] = {
3103 			MIB_NON_WIFI_TIME,
3104 			MIB_TX_TIME,
3105 			MIB_RX_TIME,
3106 			MIB_OBSS_AIRTIME,
3107 			MIB_TXOP_INIT_COUNT,
3108 		};
3109 		len = ARRAY_SIZE(chip_offs);
3110 		offs = chip_offs;
3111 		offs_cc = 20;
3112 	} else {
3113 		static const u32 chip_offs[] = {
3114 			MIB_NON_WIFI_TIME_V2,
3115 			MIB_TX_TIME_V2,
3116 			MIB_RX_TIME_V2,
3117 			MIB_OBSS_AIRTIME_V2
3118 		};
3119 		len = ARRAY_SIZE(chip_offs);
3120 		offs = chip_offs;
3121 		offs_cc = 0;
3122 	}
3123 
3124 	for (i = 0; i < len; i++) {
3125 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
3126 		req[i].offs = cpu_to_le32(offs[i]);
3127 	}
3128 
3129 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3130 					req, len * sizeof(req[0]), true, &skb);
3131 	if (ret)
3132 		return ret;
3133 
3134 	res = (struct mt7915_mcu_mib *)(skb->data + offs_cc);
3135 
3136 #define __res_u64(s) le64_to_cpu(res[s].data)
3137 	/* subtract Tx backoff time from Tx duration */
3138 	cc_tx = is_mt7915(&dev->mt76) ? __res_u64(1) - __res_u64(4) : __res_u64(1);
3139 
3140 	if (chan_switch)
3141 		goto out;
3142 
3143 	state->cc_tx += cc_tx - state_ts->cc_tx;
3144 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3145 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3146 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3147 			  state_ts->cc_busy;
3148 
3149 out:
3150 	state_ts->cc_tx = cc_tx;
3151 	state_ts->cc_bss_rx = __res_u64(2);
3152 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3153 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3154 #undef __res_u64
3155 
3156 	dev_kfree_skb(skb);
3157 
3158 	return 0;
3159 }
3160 
3161 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3162 {
3163 	struct mt7915_dev *dev = phy->dev;
3164 	struct {
3165 		u8 ctrl_id;
3166 		u8 action;
3167 		u8 band_idx;
3168 		u8 rsv[5];
3169 	} req = {
3170 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3171 		.band_idx = phy->mt76->band_idx,
3172 	};
3173 
3174 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3175 				 sizeof(req), true);
3176 }
3177 
3178 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3179 {
3180 	struct mt7915_dev *dev = phy->dev;
3181 	struct mt7915_mcu_thermal_ctrl req = {
3182 		.band_idx = phy->mt76->band_idx,
3183 		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
3184 	};
3185 	int level, ret;
3186 
3187 	/* set duty cycle and level */
3188 	for (level = 0; level < 4; level++) {
3189 		req.duty.duty_level = level;
3190 		req.duty.duty_cycle = state;
3191 		state /= 2;
3192 
3193 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3194 					&req, sizeof(req), false);
3195 		if (ret)
3196 			return ret;
3197 	}
3198 	return 0;
3199 }
3200 
3201 int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
3202 {
3203 	struct mt7915_dev *dev = phy->dev;
3204 	struct {
3205 		struct mt7915_mcu_thermal_ctrl ctrl;
3206 
3207 		__le32 trigger_temp;
3208 		__le32 restore_temp;
3209 		__le16 sustain_time;
3210 		u8 rsv[2];
3211 	} __packed req = {
3212 		.ctrl = {
3213 			.band_idx = phy->mt76->band_idx,
3214 			.type.protect_type = 1,
3215 			.type.trigger_type = 1,
3216 		},
3217 	};
3218 	int ret;
3219 
3220 	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3221 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3222 				&req, sizeof(req.ctrl), false);
3223 
3224 	if (ret)
3225 		return ret;
3226 
3227 	/* set high-temperature trigger threshold */
3228 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3229 	/* add a safety margin ~10 */
3230 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3231 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3232 	req.sustain_time = cpu_to_le16(10);
3233 
3234 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3235 				 &req, sizeof(req), false);
3236 }
3237 
3238 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3239 {
3240 	struct mt7915_dev *dev = phy->dev;
3241 	struct {
3242 		u8 format_id;
3243 		u8 rsv;
3244 		u8 band_idx;
3245 		s8 txpower_min;
3246 	} __packed req = {
3247 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3248 		.band_idx = phy->mt76->band_idx,
3249 		.txpower_min = txpower * 2, /* 0.5db */
3250 	};
3251 
3252 	return mt76_mcu_send_msg(&dev->mt76,
3253 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3254 				 sizeof(req), true);
3255 }
3256 
3257 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3258 				 struct ieee80211_vif *vif,
3259 				 struct ieee80211_sta *sta, s8 txpower)
3260 {
3261 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3262 	struct mt7915_dev *dev = phy->dev;
3263 	struct mt76_phy *mphy = phy->mt76;
3264 	struct {
3265 		u8 format_id;
3266 		u8 rsv[3];
3267 		u8 band_idx;
3268 		s8 txpower_max;
3269 		__le16 wcid;
3270 		s8 txpower_offs[48];
3271 	} __packed req = {
3272 		.format_id = TX_POWER_LIMIT_FRAME,
3273 		.band_idx = phy->mt76->band_idx,
3274 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3275 		.wcid = cpu_to_le16(msta->wcid.idx),
3276 	};
3277 	int ret;
3278 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3279 
3280 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
3281 	if (ret)
3282 		return ret;
3283 
3284 	txpower = mt7915_get_power_bound(phy, txpower);
3285 	if (txpower > mphy->txpower_cur || txpower < 0)
3286 		return -EINVAL;
3287 
3288 	if (txpower) {
3289 		u32 offs, len, i;
3290 
3291 		if (sta->deflink.ht_cap.ht_supported) {
3292 			const u8 *sku_len = mt7915_sku_group_len;
3293 
3294 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3295 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3296 
3297 			if (sta->deflink.vht_cap.vht_supported) {
3298 				offs += len;
3299 				len = sku_len[SKU_VHT_BW20] * 4;
3300 
3301 				if (sta->deflink.he_cap.has_he) {
3302 					offs += len + sku_len[SKU_HE_RU26] * 3;
3303 					len = sku_len[SKU_HE_RU242] * 4;
3304 				}
3305 			}
3306 		} else {
3307 			return -EINVAL;
3308 		}
3309 
3310 		for (i = 0; i < len; i++, offs++)
3311 			req.txpower_offs[i] =
3312 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3313 	}
3314 
3315 	return mt76_mcu_send_msg(&dev->mt76,
3316 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3317 				 sizeof(req), true);
3318 }
3319 
3320 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3321 {
3322 	struct mt7915_dev *dev = phy->dev;
3323 	struct mt76_phy *mphy = phy->mt76;
3324 	struct ieee80211_hw *hw = mphy->hw;
3325 	struct mt7915_mcu_txpower_sku req = {
3326 		.format_id = TX_POWER_LIMIT_TABLE,
3327 		.band_idx = phy->mt76->band_idx,
3328 	};
3329 	struct mt76_power_limits limits_array;
3330 	s8 *la = (s8 *)&limits_array;
3331 	int i, idx;
3332 	int tx_power;
3333 
3334 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
3335 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3336 					      &limits_array, tx_power);
3337 	mphy->txpower_cur = tx_power;
3338 
3339 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3340 		u8 mcs_num, len = mt7915_sku_group_len[i];
3341 		int j;
3342 
3343 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3344 			mcs_num = 10;
3345 
3346 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3347 				la = (s8 *)&limits_array + 12;
3348 		} else {
3349 			mcs_num = len;
3350 		}
3351 
3352 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3353 			req.txpower_sku[idx + j] = la[j];
3354 
3355 		la += mcs_num;
3356 		idx += len;
3357 	}
3358 
3359 	return mt76_mcu_send_msg(&dev->mt76,
3360 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3361 				 sizeof(req), true);
3362 }
3363 
3364 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3365 {
3366 #define RATE_POWER_INFO	2
3367 	struct mt7915_dev *dev = phy->dev;
3368 	struct {
3369 		u8 format_id;
3370 		u8 category;
3371 		u8 band_idx;
3372 		u8 _rsv;
3373 	} __packed req = {
3374 		.format_id = TX_POWER_LIMIT_INFO,
3375 		.category = RATE_POWER_INFO,
3376 		.band_idx = phy->mt76->band_idx,
3377 	};
3378 	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
3379 	struct sk_buff *skb;
3380 	int ret, i;
3381 
3382 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3383 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3384 					&req, sizeof(req), true, &skb);
3385 	if (ret)
3386 		return ret;
3387 
3388 	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
3389 	for (i = 0; i < len; i++)
3390 		txpower[i] = txpower_sku[i][req.band_idx];
3391 
3392 	dev_kfree_skb(skb);
3393 
3394 	return 0;
3395 }
3396 
3397 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3398 			      u8 en)
3399 {
3400 	struct {
3401 		u8 test_mode_en;
3402 		u8 param_idx;
3403 		u8 _rsv[2];
3404 
3405 		u8 enable;
3406 		u8 _rsv2[3];
3407 
3408 		u8 pad[8];
3409 	} __packed req = {
3410 		.test_mode_en = test_mode,
3411 		.param_idx = param,
3412 		.enable = en,
3413 	};
3414 
3415 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3416 				 sizeof(req), false);
3417 }
3418 
3419 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3420 {
3421 	struct mt7915_dev *dev = phy->dev;
3422 	struct mt7915_sku {
3423 		u8 format_id;
3424 		u8 sku_enable;
3425 		u8 band_idx;
3426 		u8 rsv;
3427 	} __packed req = {
3428 		.format_id = TX_POWER_LIMIT_ENABLE,
3429 		.band_idx = phy->mt76->band_idx,
3430 		.sku_enable = enable,
3431 	};
3432 
3433 	return mt76_mcu_send_msg(&dev->mt76,
3434 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3435 				 sizeof(req), true);
3436 }
3437 
3438 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3439 {
3440 	struct {
3441 		u8 action;
3442 		u8 set;
3443 		u8 band;
3444 		u8 rsv;
3445 	} req = {
3446 		.action = action,
3447 		.set = set,
3448 		.band = band,
3449 	};
3450 
3451 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3452 				 &req, sizeof(req), false);
3453 }
3454 
3455 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3456 {
3457 	struct {
3458 		u8 action;
3459 		union {
3460 			struct {
3461 				u8 snd_mode;
3462 				u8 sta_num;
3463 				u8 rsv;
3464 				u8 wlan_idx[4];
3465 				__le32 snd_period;	/* ms */
3466 			} __packed snd;
3467 			struct {
3468 				bool ebf;
3469 				bool ibf;
3470 				u8 rsv;
3471 			} __packed type;
3472 			struct {
3473 				u8 bf_num;
3474 				u8 bf_bitmap;
3475 				u8 bf_sel[8];
3476 				u8 rsv[5];
3477 			} __packed mod;
3478 		};
3479 	} __packed req = {
3480 		.action = action,
3481 	};
3482 
3483 #define MT_BF_PROCESSING	4
3484 	switch (action) {
3485 	case MT_BF_SOUNDING_ON:
3486 		req.snd.snd_mode = MT_BF_PROCESSING;
3487 		break;
3488 	case MT_BF_TYPE_UPDATE:
3489 		req.type.ebf = true;
3490 		req.type.ibf = dev->ibf;
3491 		break;
3492 	case MT_BF_MODULE_UPDATE:
3493 		req.mod.bf_num = 2;
3494 		req.mod.bf_bitmap = GENMASK(1, 0);
3495 		break;
3496 	default:
3497 		return -EINVAL;
3498 	}
3499 
3500 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3501 				 sizeof(req), true);
3502 }
3503 
3504 static int
3505 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3506 {
3507 	struct mt7915_dev *dev = phy->dev;
3508 	struct mt7915_mcu_sr_ctrl req = {
3509 		.action = action,
3510 		.argnum = 1,
3511 		.band_idx = phy->mt76->band_idx,
3512 		.val = cpu_to_le32(val),
3513 	};
3514 
3515 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3516 				 sizeof(req), true);
3517 }
3518 
3519 static int
3520 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3521 			   struct ieee80211_he_obss_pd *he_obss_pd)
3522 {
3523 	struct mt7915_dev *dev = phy->dev;
3524 	struct {
3525 		struct mt7915_mcu_sr_ctrl ctrl;
3526 		struct {
3527 			u8 pd_th_non_srg;
3528 			u8 pd_th_srg;
3529 			u8 period_offs;
3530 			u8 rcpi_src;
3531 			__le16 obss_pd_min;
3532 			__le16 obss_pd_min_srg;
3533 			u8 resp_txpwr_mode;
3534 			u8 txpwr_restrict_mode;
3535 			u8 txpwr_ref;
3536 			u8 rsv[3];
3537 		} __packed param;
3538 	} __packed req = {
3539 		.ctrl = {
3540 			.action = SPR_SET_PARAM,
3541 			.argnum = 9,
3542 			.band_idx = phy->mt76->band_idx,
3543 		},
3544 	};
3545 	int ret;
3546 	u8 max_th = 82, non_srg_max_th = 62;
3547 
3548 	/* disable firmware dynamical PD asjustment */
3549 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3550 	if (ret)
3551 		return ret;
3552 
3553 	if (he_obss_pd->sr_ctrl &
3554 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3555 		req.param.pd_th_non_srg = max_th;
3556 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3557 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3558 	else
3559 		req.param.pd_th_non_srg  = non_srg_max_th;
3560 
3561 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3562 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3563 
3564 	req.param.obss_pd_min = cpu_to_le16(82);
3565 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3566 	req.param.txpwr_restrict_mode = 2;
3567 	req.param.txpwr_ref = 21;
3568 
3569 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3570 				 sizeof(req), true);
3571 }
3572 
3573 static int
3574 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3575 			     struct ieee80211_he_obss_pd *he_obss_pd)
3576 {
3577 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3578 	struct mt7915_dev *dev = phy->dev;
3579 	u8 omac = mvif->mt76.omac_idx;
3580 	struct {
3581 		struct mt7915_mcu_sr_ctrl ctrl;
3582 		struct {
3583 			u8 omac;
3584 			u8 rsv[3];
3585 			u8 flag[20];
3586 		} __packed siga;
3587 	} __packed req = {
3588 		.ctrl = {
3589 			.action = SPR_SET_SIGA,
3590 			.argnum = 1,
3591 			.band_idx = phy->mt76->band_idx,
3592 		},
3593 		.siga = {
3594 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3595 		},
3596 	};
3597 	int ret;
3598 
3599 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3600 		req.siga.flag[req.siga.omac] = 0xf;
3601 	else
3602 		return 0;
3603 
3604 	/* switch to normal AP mode */
3605 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3606 	if (ret)
3607 		return ret;
3608 
3609 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3610 				 sizeof(req), true);
3611 }
3612 
3613 static int
3614 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3615 			       struct ieee80211_he_obss_pd *he_obss_pd)
3616 {
3617 	struct mt7915_dev *dev = phy->dev;
3618 	struct {
3619 		struct mt7915_mcu_sr_ctrl ctrl;
3620 		struct {
3621 			__le32 color_l[2];
3622 			__le32 color_h[2];
3623 			__le32 bssid_l[2];
3624 			__le32 bssid_h[2];
3625 		} __packed bitmap;
3626 	} __packed req = {
3627 		.ctrl = {
3628 			.action = SPR_SET_SRG_BITMAP,
3629 			.argnum = 4,
3630 			.band_idx = phy->mt76->band_idx,
3631 		},
3632 	};
3633 	u32 bitmap;
3634 
3635 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3636 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3637 
3638 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3639 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3640 
3641 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3642 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3643 
3644 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3645 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3646 
3647 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3648 				 sizeof(req), true);
3649 }
3650 
3651 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3652 			    struct ieee80211_he_obss_pd *he_obss_pd)
3653 {
3654 	int ret;
3655 
3656 	/* enable firmware scene detection algorithms */
3657 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3658 	if (ret)
3659 		return ret;
3660 
3661 	/* firmware dynamically adjusts PD threshold so skip manual control */
3662 	if (sr_scene_detect && !he_obss_pd->enable)
3663 		return 0;
3664 
3665 	/* enable spatial reuse */
3666 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3667 	if (ret)
3668 		return ret;
3669 
3670 	if (sr_scene_detect || !he_obss_pd->enable)
3671 		return 0;
3672 
3673 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3674 	if (ret)
3675 		return ret;
3676 
3677 	/* set SRG/non-SRG OBSS PD threshold */
3678 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3679 	if (ret)
3680 		return ret;
3681 
3682 	/* Set SR prohibit */
3683 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3684 	if (ret)
3685 		return ret;
3686 
3687 	/* set SRG BSS color/BSSID bitmap */
3688 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3689 }
3690 
3691 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3692 			   struct ieee80211_sta *sta, struct rate_info *rate)
3693 {
3694 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3695 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3696 	struct mt7915_dev *dev = phy->dev;
3697 	struct mt76_phy *mphy = phy->mt76;
3698 	struct {
3699 		u8 category;
3700 		u8 band;
3701 		__le16 wcid;
3702 	} __packed req = {
3703 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3704 		.band = mvif->mt76.band_idx,
3705 		.wcid = cpu_to_le16(msta->wcid.idx),
3706 	};
3707 	struct ieee80211_supported_band *sband;
3708 	struct mt7915_mcu_phy_rx_info *res;
3709 	struct sk_buff *skb;
3710 	int ret;
3711 	bool cck = false;
3712 
3713 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3714 					&req, sizeof(req), true, &skb);
3715 	if (ret)
3716 		return ret;
3717 
3718 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3719 
3720 	rate->mcs = res->rate;
3721 	rate->nss = res->nsts + 1;
3722 
3723 	switch (res->mode) {
3724 	case MT_PHY_TYPE_CCK:
3725 		cck = true;
3726 		fallthrough;
3727 	case MT_PHY_TYPE_OFDM:
3728 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3729 			sband = &mphy->sband_5g.sband;
3730 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3731 			sband = &mphy->sband_6g.sband;
3732 		else
3733 			sband = &mphy->sband_2g.sband;
3734 
3735 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3736 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3737 		break;
3738 	case MT_PHY_TYPE_HT:
3739 	case MT_PHY_TYPE_HT_GF:
3740 		if (rate->mcs > 31) {
3741 			ret = -EINVAL;
3742 			goto out;
3743 		}
3744 
3745 		rate->flags = RATE_INFO_FLAGS_MCS;
3746 		if (res->gi)
3747 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3748 		break;
3749 	case MT_PHY_TYPE_VHT:
3750 		if (rate->mcs > 9) {
3751 			ret = -EINVAL;
3752 			goto out;
3753 		}
3754 
3755 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3756 		if (res->gi)
3757 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3758 		break;
3759 	case MT_PHY_TYPE_HE_SU:
3760 	case MT_PHY_TYPE_HE_EXT_SU:
3761 	case MT_PHY_TYPE_HE_TB:
3762 	case MT_PHY_TYPE_HE_MU:
3763 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3764 			ret = -EINVAL;
3765 			goto out;
3766 		}
3767 		rate->he_gi = res->gi;
3768 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3769 		break;
3770 	default:
3771 		ret = -EINVAL;
3772 		goto out;
3773 	}
3774 
3775 	switch (res->bw) {
3776 	case IEEE80211_STA_RX_BW_160:
3777 		rate->bw = RATE_INFO_BW_160;
3778 		break;
3779 	case IEEE80211_STA_RX_BW_80:
3780 		rate->bw = RATE_INFO_BW_80;
3781 		break;
3782 	case IEEE80211_STA_RX_BW_40:
3783 		rate->bw = RATE_INFO_BW_40;
3784 		break;
3785 	default:
3786 		rate->bw = RATE_INFO_BW_20;
3787 		break;
3788 	}
3789 
3790 out:
3791 	dev_kfree_skb(skb);
3792 
3793 	return ret;
3794 }
3795 
3796 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3797 				struct cfg80211_he_bss_color *he_bss_color)
3798 {
3799 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3800 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3801 	struct bss_info_color *bss_color;
3802 	struct sk_buff *skb;
3803 	struct tlv *tlv;
3804 
3805 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3806 					      NULL, len);
3807 	if (IS_ERR(skb))
3808 		return PTR_ERR(skb);
3809 
3810 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3811 				      sizeof(*bss_color));
3812 	bss_color = (struct bss_info_color *)tlv;
3813 	bss_color->disable = !he_bss_color->enabled;
3814 	bss_color->color = he_bss_color->color;
3815 
3816 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3817 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3818 }
3819 
3820 #define TWT_AGRT_TRIGGER	BIT(0)
3821 #define TWT_AGRT_ANNOUNCE	BIT(1)
3822 #define TWT_AGRT_PROTECT	BIT(2)
3823 
3824 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3825 			       struct mt7915_vif *mvif,
3826 			       struct mt7915_twt_flow *flow,
3827 			       int cmd)
3828 {
3829 	struct {
3830 		u8 tbl_idx;
3831 		u8 cmd;
3832 		u8 own_mac_idx;
3833 		u8 flowid; /* 0xff for group id */
3834 		__le16 peer_id; /* specify the peer_id (msb=0)
3835 				 * or group_id (msb=1)
3836 				 */
3837 		u8 duration; /* 256 us */
3838 		u8 bss_idx;
3839 		__le64 start_tsf;
3840 		__le16 mantissa;
3841 		u8 exponent;
3842 		u8 is_ap;
3843 		u8 agrt_params;
3844 		u8 rsv[23];
3845 	} __packed req = {
3846 		.tbl_idx = flow->table_id,
3847 		.cmd = cmd,
3848 		.own_mac_idx = mvif->mt76.omac_idx,
3849 		.flowid = flow->id,
3850 		.peer_id = cpu_to_le16(flow->wcid),
3851 		.duration = flow->duration,
3852 		.bss_idx = mvif->mt76.idx,
3853 		.start_tsf = cpu_to_le64(flow->tsf),
3854 		.mantissa = flow->mantissa,
3855 		.exponent = flow->exp,
3856 		.is_ap = true,
3857 	};
3858 
3859 	if (flow->protection)
3860 		req.agrt_params |= TWT_AGRT_PROTECT;
3861 	if (!flow->flowtype)
3862 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3863 	if (flow->trigger)
3864 		req.agrt_params |= TWT_AGRT_TRIGGER;
3865 
3866 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3867 				 &req, sizeof(req), true);
3868 }
3869 
3870 int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
3871 {
3872 	struct {
3873 		__le32 cmd;
3874 		__le32 arg0;
3875 		__le32 arg1;
3876 		__le16 arg2;
3877 	} __packed req = {
3878 		.cmd = cpu_to_le32(0x15),
3879 	};
3880 	struct mt7915_mcu_wa_tx_stat {
3881 		__le16 wcid;
3882 		u8 __rsv2[2];
3883 
3884 		/* tx_bytes is deprecated since WA byte counter uses u32,
3885 		 * which easily leads to overflow.
3886 		 */
3887 		__le32 tx_bytes;
3888 		__le32 tx_packets;
3889 	} __packed *res;
3890 	struct mt76_wcid *wcid;
3891 	struct sk_buff *skb;
3892 	int ret, len;
3893 	u16 ret_wcid;
3894 
3895 	if (is_mt7915(&dev->mt76)) {
3896 		req.arg0 = cpu_to_le32(wlan_idx);
3897 		len = sizeof(req) - sizeof(req.arg2);
3898 	} else {
3899 		req.arg0 = cpu_to_le32(1);
3900 		req.arg2 = cpu_to_le16(wlan_idx);
3901 		len = sizeof(req);
3902 	}
3903 
3904 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
3905 					&req, len, true, &skb);
3906 	if (ret)
3907 		return ret;
3908 
3909 	if (!is_mt7915(&dev->mt76))
3910 		skb_pull(skb, 4);
3911 
3912 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
3913 
3914 	ret_wcid = le16_to_cpu(res->wcid);
3915 	if (is_mt7915(&dev->mt76))
3916 		ret_wcid &= 0xff;
3917 
3918 	if (ret_wcid != wlan_idx) {
3919 		ret = -EINVAL;
3920 		goto out;
3921 	}
3922 
3923 	rcu_read_lock();
3924 
3925 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
3926 	if (wcid)
3927 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
3928 	else
3929 		ret = -EINVAL;
3930 
3931 	rcu_read_unlock();
3932 out:
3933 	dev_kfree_skb(skb);
3934 
3935 	return ret;
3936 }
3937 
3938 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3939 {
3940 	struct {
3941 		__le32 idx;
3942 		__le32 ofs;
3943 		__le32 data;
3944 	} __packed req = {
3945 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
3946 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
3947 		.data = set ? cpu_to_le32(*val) : 0,
3948 	};
3949 	struct sk_buff *skb;
3950 	int ret;
3951 
3952 	if (set)
3953 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3954 					 &req, sizeof(req), false);
3955 
3956 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3957 					&req, sizeof(req), true, &skb);
3958 	if (ret)
3959 		return ret;
3960 
3961 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3962 	dev_kfree_skb(skb);
3963 
3964 	return 0;
3965 }
3966