xref: /linux/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c (revision d30c1683aaecb93d2ab95685dc4300a33d3cea7a)
1 // SPDX-License-Identifier: BSD-3-Clause-Clear
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7981:						\
17 		_fw = MT7981_##name;				\
18 		break;						\
19 	case 0x7986:						\
20 		_fw = MT7986_##name##__VA_ARGS__;		\
21 		break;						\
22 	default:						\
23 		_fw = MT7916_##name;				\
24 		break;						\
25 	}							\
26 	_fw;							\
27 })
28 
29 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
30 					 fw_name(_dev, name) :			\
31 					 fw_name(_dev, name, _MT7975))
32 
33 #define MCU_PATCH_ADDRESS		0x200000
34 
35 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
36 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
37 
38 static bool sr_scene_detect = true;
39 module_param(sr_scene_detect, bool, 0644);
40 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
41 
42 static u8
43 mt7915_mcu_get_sta_nss(u16 mcs_map)
44 {
45 	u8 nss;
46 
47 	for (nss = 8; nss > 0; nss--) {
48 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
49 
50 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
51 			break;
52 	}
53 
54 	return nss - 1;
55 }
56 
57 static void
58 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
59 			  u16 mcs_map)
60 {
61 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
62 	struct mt7915_dev *dev = msta->vif->phy->dev;
63 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
64 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
65 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
66 
67 	for (nss = 0; nss < max_nss; nss++) {
68 		int mcs;
69 
70 		switch ((mcs_map >> (2 * nss)) & 0x3) {
71 		case IEEE80211_HE_MCS_SUPPORT_0_11:
72 			mcs = GENMASK(11, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_9:
75 			mcs = GENMASK(9, 0);
76 			break;
77 		case IEEE80211_HE_MCS_SUPPORT_0_7:
78 			mcs = GENMASK(7, 0);
79 			break;
80 		default:
81 			mcs = 0;
82 		}
83 
84 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
85 
86 		switch (mcs) {
87 		case 0 ... 7:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
89 			break;
90 		case 8 ... 9:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
92 			break;
93 		case 10 ... 11:
94 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
95 			break;
96 		default:
97 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
98 			break;
99 		}
100 		mcs_map &= ~(0x3 << (nss * 2));
101 		mcs_map |= mcs << (nss * 2);
102 
103 		/* only support 2ss on 160MHz for mt7915 */
104 		if (is_mt7915(&dev->mt76) && nss > 1 &&
105 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
106 			break;
107 	}
108 
109 	*he_mcs = cpu_to_le16(mcs_map);
110 }
111 
112 static void
113 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
114 			   const u16 *mask)
115 {
116 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
117 	struct mt7915_dev *dev = msta->vif->phy->dev;
118 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
119 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
120 	u16 mcs;
121 
122 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
123 		switch (mcs_map & 0x3) {
124 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
128 			mcs = GENMASK(8, 0);
129 			break;
130 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
131 			mcs = GENMASK(7, 0);
132 			break;
133 		default:
134 			mcs = 0;
135 		}
136 
137 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
138 
139 		/* only support 2ss on 160MHz for mt7915 */
140 		if (is_mt7915(&dev->mt76) && nss > 1 &&
141 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
142 			break;
143 	}
144 }
145 
146 static void
147 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
148 			  const u8 *mask)
149 {
150 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
151 
152 	for (nss = 0; nss < max_nss; nss++)
153 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
154 }
155 
156 static int
157 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
158 			  struct sk_buff *skb, int seq)
159 {
160 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
161 	struct mt76_connac2_mcu_rxd *rxd;
162 	int ret = 0;
163 
164 	if (!skb) {
165 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
166 			cmd, seq);
167 
168 		if (!test_and_set_bit(MT76_MCU_RESET, &dev->mphy.state)) {
169 			dev->recovery.restart = true;
170 			wake_up(&dev->mt76.mcu.wait);
171 			queue_work(dev->mt76.wq, &dev->reset_work);
172 			wake_up(&dev->reset_wait);
173 		}
174 
175 		return -ETIMEDOUT;
176 	}
177 
178 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
179 	if (seq != rxd->seq &&
180 	    !(rxd->eid == MCU_CMD_EXT_CID &&
181 	      rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
182 		return -EAGAIN;
183 
184 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
185 		skb_pull(skb, sizeof(*rxd) - 4);
186 		ret = *skb->data;
187 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
188 		skb_pull(skb, sizeof(*rxd) + 4);
189 		ret = le32_to_cpu(*(__le32 *)skb->data);
190 	} else {
191 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
192 	}
193 
194 	return ret;
195 }
196 
197 static void
198 mt7915_mcu_set_timeout(struct mt76_dev *mdev, int cmd)
199 {
200 	mdev->mcu.timeout = 5 * HZ;
201 
202 	if ((cmd & __MCU_CMD_FIELD_ID) != MCU_CMD_EXT_CID)
203 		return;
204 
205 	switch (FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd)) {
206 	case MCU_EXT_CMD_THERMAL_CTRL:
207 	case MCU_EXT_CMD_GET_MIB_INFO:
208 	case MCU_EXT_CMD_PHY_STAT_INFO:
209 	case MCU_EXT_CMD_STA_REC_UPDATE:
210 	case MCU_EXT_CMD_BSS_INFO_UPDATE:
211 		mdev->mcu.timeout = 2 * HZ;
212 		return;
213 	case MCU_EXT_CMD_EFUSE_BUFFER_MODE:
214 		mdev->mcu.timeout = 10 * HZ;
215 		return;
216 	default:
217 		break;
218 	}
219 }
220 
221 static int
222 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
223 			int cmd, int *wait_seq)
224 {
225 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
226 	enum mt76_mcuq_id qid;
227 
228 	if (cmd == MCU_CMD(FW_SCATTER))
229 		qid = MT_MCUQ_FWDL;
230 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
231 		qid = MT_MCUQ_WA;
232 	else
233 		qid = MT_MCUQ_WM;
234 
235 	mt7915_mcu_set_timeout(mdev, cmd);
236 
237 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
238 }
239 
240 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
241 {
242 	struct {
243 		__le32 args[3];
244 	} req = {
245 		.args = {
246 			cpu_to_le32(a1),
247 			cpu_to_le32(a2),
248 			cpu_to_le32(a3),
249 		},
250 	};
251 
252 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
253 }
254 
255 static void
256 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
257 {
258 	if (!vif->bss_conf.csa_active || vif->type == NL80211_IFTYPE_STATION)
259 		return;
260 
261 	ieee80211_csa_finish(vif, 0);
262 }
263 
264 static void
265 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
266 {
267 	struct mt76_phy *mphy = &dev->mt76.phy;
268 	struct mt7915_mcu_csa_notify *c;
269 
270 	c = (struct mt7915_mcu_csa_notify *)skb->data;
271 
272 	if (c->band_idx > MT_BAND1)
273 		return;
274 
275 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
276 	    dev->mt76.phys[MT_BAND1])
277 		mphy = dev->mt76.phys[MT_BAND1];
278 
279 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
280 			IEEE80211_IFACE_ITER_RESUME_ALL,
281 			mt7915_mcu_csa_finish, mphy->hw);
282 }
283 
284 static void
285 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
286 {
287 	struct mt76_phy *mphy = &dev->mt76.phy;
288 	struct mt7915_mcu_thermal_notify *t;
289 	struct mt7915_phy *phy;
290 
291 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
292 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
293 		return;
294 
295 	if (t->ctrl.band_idx > MT_BAND1)
296 		return;
297 
298 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
299 	    dev->mt76.phys[MT_BAND1])
300 		mphy = dev->mt76.phys[MT_BAND1];
301 
302 	phy = mphy->priv;
303 	phy->throttle_state = t->ctrl.duty.duty_cycle;
304 }
305 
306 static void
307 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
308 {
309 	struct mt76_phy *mphy = &dev->mt76.phy;
310 	struct mt7915_mcu_rdd_report *r;
311 	u32 sku;
312 
313 	r = (struct mt7915_mcu_rdd_report *)skb->data;
314 
315 	switch (r->rdd_idx) {
316 	case MT_RDD_IDX_BAND0:
317 		break;
318 	case MT_RDD_IDX_BAND1:
319 		sku = mt7915_check_adie(dev, true);
320 		/* the main phy is bound to band 1 for this sku */
321 		if (is_mt7986(&dev->mt76) &&
322 		    (sku == MT7975_ONE_ADIE || sku == MT7976_ONE_ADIE))
323 			break;
324 		mphy = dev->mt76.phys[MT_BAND1];
325 		break;
326 	case MT_RDD_IDX_BACKGROUND:
327 		if (!dev->rdd2_phy)
328 			return;
329 		mphy = dev->rdd2_phy->mt76;
330 		break;
331 	default:
332 		dev_err(dev->mt76.dev, "Unknown RDD idx %d\n", r->rdd_idx);
333 		return;
334 	}
335 
336 	if (!mphy)
337 		return;
338 
339 	if (r->rdd_idx == MT_RDD_IDX_BACKGROUND)
340 		cfg80211_background_radar_event(mphy->hw->wiphy,
341 						&dev->rdd2_chandef,
342 						GFP_ATOMIC);
343 	else
344 		ieee80211_radar_detected(mphy->hw, NULL);
345 	dev->hw_pattern++;
346 }
347 
348 static void
349 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
350 {
351 	struct mt76_connac2_mcu_rxd *rxd;
352 	int len = skb->len - sizeof(*rxd);
353 	const char *data, *type;
354 
355 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
356 	data = (char *)&rxd[1];
357 
358 	switch (rxd->s2d_index) {
359 	case 0:
360 		if (mt7915_debugfs_rx_log(dev, data, len))
361 			return;
362 
363 		type = "WM";
364 		break;
365 	case 2:
366 		type = "WA";
367 		break;
368 	default:
369 		type = "unknown";
370 		break;
371 	}
372 
373 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
374 }
375 
376 static void
377 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
378 {
379 	if (!vif->bss_conf.color_change_active || vif->type == NL80211_IFTYPE_STATION)
380 		return;
381 
382 	ieee80211_color_change_finish(vif, 0);
383 }
384 
385 static void
386 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
387 {
388 	struct mt76_phy *mphy = &dev->mt76.phy;
389 	struct mt7915_mcu_bcc_notify *b;
390 
391 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
392 
393 	if (b->band_idx > MT_BAND1)
394 		return;
395 
396 	if ((b->band_idx && !dev->phy.mt76->band_idx) &&
397 	    dev->mt76.phys[MT_BAND1])
398 		mphy = dev->mt76.phys[MT_BAND1];
399 
400 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
401 			IEEE80211_IFACE_ITER_RESUME_ALL,
402 			mt7915_mcu_cca_finish, mphy->hw);
403 }
404 
405 static void
406 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
407 {
408 	struct mt76_connac2_mcu_rxd *rxd;
409 
410 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
411 	switch (rxd->ext_eid) {
412 	case MCU_EXT_EVENT_THERMAL_PROTECT:
413 		mt7915_mcu_rx_thermal_notify(dev, skb);
414 		break;
415 	case MCU_EXT_EVENT_RDD_REPORT:
416 		mt7915_mcu_rx_radar_detected(dev, skb);
417 		break;
418 	case MCU_EXT_EVENT_CSA_NOTIFY:
419 		mt7915_mcu_rx_csa_notify(dev, skb);
420 		break;
421 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
422 		mt7915_mcu_rx_log_message(dev, skb);
423 		break;
424 	case MCU_EXT_EVENT_BCC_NOTIFY:
425 		mt7915_mcu_rx_bcc_notify(dev, skb);
426 		break;
427 	default:
428 		break;
429 	}
430 }
431 
432 static void
433 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
434 {
435 	struct mt76_connac2_mcu_rxd *rxd;
436 
437 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
438 	switch (rxd->eid) {
439 	case MCU_EVENT_EXT:
440 		mt7915_mcu_rx_ext_event(dev, skb);
441 		break;
442 	default:
443 		break;
444 	}
445 	dev_kfree_skb(skb);
446 }
447 
448 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
449 {
450 	struct mt76_connac2_mcu_rxd *rxd;
451 
452 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
453 	if ((rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
454 	     rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
455 	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
456 	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
457 	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
458 	     !rxd->seq) &&
459 	     !(rxd->eid == MCU_CMD_EXT_CID &&
460 	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
461 		mt7915_mcu_rx_unsolicited_event(dev, skb);
462 	else
463 		mt76_mcu_rx_event(&dev->mt76, skb);
464 }
465 
466 static struct tlv *
467 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
468 			     __le16 *sub_ntlv, __le16 *len)
469 {
470 	struct tlv *ptlv, tlv = {
471 		.tag = cpu_to_le16(sub_tag),
472 		.len = cpu_to_le16(sub_len),
473 	};
474 
475 	ptlv = skb_put_zero(skb, sub_len);
476 	memcpy(ptlv, &tlv, sizeof(tlv));
477 
478 	le16_add_cpu(sub_ntlv, 1);
479 	le16_add_cpu(len, sub_len);
480 
481 	return ptlv;
482 }
483 
484 /** bss info **/
485 struct mt7915_he_obss_narrow_bw_ru_data {
486 	bool tolerated;
487 };
488 
489 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
490 						   struct cfg80211_bss *bss,
491 						   void *_data)
492 {
493 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
494 	const struct element *elem;
495 
496 	rcu_read_lock();
497 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
498 
499 	if (!elem || elem->datalen <= 10 ||
500 	    !(elem->data[10] &
501 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
502 		data->tolerated = false;
503 
504 	rcu_read_unlock();
505 }
506 
507 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
508 					      struct ieee80211_vif *vif)
509 {
510 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
511 		.tolerated = true,
512 	};
513 
514 	if (!(vif->bss_conf.chanreq.oper.chan->flags & IEEE80211_CHAN_RADAR))
515 		return false;
516 
517 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chanreq.oper,
518 			  mt7915_check_he_obss_narrow_bw_ru_iter,
519 			  &iter_data);
520 
521 	/*
522 	 * If there is at least one AP on radar channel that cannot
523 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
524 	 */
525 	return !iter_data.tolerated;
526 }
527 
528 static void
529 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
530 			struct mt7915_phy *phy)
531 {
532 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
533 	struct bss_info_rf_ch *ch;
534 	struct tlv *tlv;
535 	int freq1 = chandef->center_freq1;
536 
537 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
538 
539 	ch = (struct bss_info_rf_ch *)tlv;
540 	ch->pri_ch = chandef->chan->hw_value;
541 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
542 	ch->bw = mt76_connac_chan_bw(chandef);
543 
544 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
545 		int freq2 = chandef->center_freq2;
546 
547 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
548 	}
549 
550 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
551 		struct mt76_phy *mphy = phy->mt76;
552 
553 		ch->he_ru26_block =
554 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
555 		ch->he_all_disable = false;
556 	} else {
557 		ch->he_all_disable = true;
558 	}
559 }
560 
561 static void
562 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
563 		      struct mt7915_phy *phy)
564 {
565 	int max_nss = hweight8(phy->mt76->antenna_mask);
566 	struct bss_info_ra *ra;
567 	struct tlv *tlv;
568 
569 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
570 
571 	ra = (struct bss_info_ra *)tlv;
572 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
573 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
574 	ra->short_preamble = true;
575 	ra->tx_streams = max_nss;
576 	ra->rx_streams = max_nss;
577 	ra->algo = 4;
578 	ra->train_up_rule = 2;
579 	ra->train_up_high_thres = 110;
580 	ra->train_up_rule_rssi = -70;
581 	ra->low_traffic_thres = 2;
582 	ra->phy_cap = cpu_to_le32(0xfdf);
583 	ra->interval = cpu_to_le32(500);
584 	ra->fast_interval = cpu_to_le32(100);
585 }
586 
587 static void
588 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
589 		      struct mt7915_phy *phy)
590 {
591 #define DEFAULT_HE_PE_DURATION		4
592 #define DEFAULT_HE_DURATION_RTS_THRES	1023
593 	const struct ieee80211_sta_he_cap *cap;
594 	struct bss_info_he *he;
595 	struct tlv *tlv;
596 
597 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
598 
599 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
600 
601 	he = (struct bss_info_he *)tlv;
602 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
603 	if (!he->he_pe_duration)
604 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
605 
606 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
607 	if (!he->he_rts_thres)
608 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
609 
610 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
611 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
612 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
613 }
614 
615 static void
616 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
617 {
618 #define TXD_CMP_MAP1		GENMASK(15, 0)
619 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
620 	struct bss_info_hw_amsdu *amsdu;
621 	struct tlv *tlv;
622 
623 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
624 
625 	amsdu = (struct bss_info_hw_amsdu *)tlv;
626 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
627 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
628 	amsdu->trig_thres = cpu_to_le16(2);
629 	amsdu->enable = true;
630 }
631 
632 static void
633 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
634 {
635 	struct bss_info_bmc_rate *bmc;
636 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
637 	enum nl80211_band band = chandef->chan->band;
638 	struct tlv *tlv;
639 
640 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
641 
642 	bmc = (struct bss_info_bmc_rate *)tlv;
643 	if (band == NL80211_BAND_2GHZ) {
644 		bmc->short_preamble = true;
645 	} else {
646 		bmc->bc_trans = cpu_to_le16(0x2000);
647 		bmc->mc_trans = cpu_to_le16(0x2080);
648 	}
649 }
650 
651 static int
652 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
653 		       bool bssid, bool enable)
654 {
655 	struct mt7915_dev *dev = phy->dev;
656 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
657 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
658 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
659 	const u8 *addr = vif->addr;
660 	struct {
661 		u8 mode;
662 		u8 force_clear;
663 		u8 clear_bitmap[8];
664 		u8 entry_count;
665 		u8 write;
666 		u8 band;
667 
668 		u8 index;
669 		u8 bssid;
670 		u8 addr[ETH_ALEN];
671 	} __packed req = {
672 		.mode = !!mask || enable,
673 		.entry_count = 1,
674 		.write = 1,
675 		.band = phy->mt76->band_idx,
676 		.index = idx * 2 + bssid,
677 	};
678 
679 	if (bssid)
680 		addr = vif->bss_conf.bssid;
681 
682 	if (enable)
683 		ether_addr_copy(req.addr, addr);
684 
685 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
686 				 sizeof(req), true);
687 }
688 
689 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
690 			    struct ieee80211_vif *vif, int enable)
691 {
692 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
693 	struct mt7915_dev *dev = phy->dev;
694 	struct sk_buff *skb;
695 
696 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
697 		mt7915_mcu_muar_config(phy, vif, false, enable);
698 		mt7915_mcu_muar_config(phy, vif, true, enable);
699 	}
700 
701 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
702 					      MT7915_BSS_UPDATE_MAX_SIZE);
703 	if (IS_ERR(skb))
704 		return PTR_ERR(skb);
705 
706 	/* bss_omac must be first */
707 	if (enable)
708 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
709 
710 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
711 				      mvif->sta.wcid.idx, enable);
712 
713 	if (vif->type == NL80211_IFTYPE_MONITOR)
714 		goto out;
715 
716 	if (enable) {
717 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
718 		mt7915_mcu_bss_bmc_tlv(skb, phy);
719 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
720 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
721 
722 		if (vif->bss_conf.he_support)
723 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
724 
725 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
726 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
727 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
728 	}
729 out:
730 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
731 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
732 }
733 
734 /** starec & wtbl **/
735 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
736 			 struct ieee80211_ampdu_params *params,
737 			 bool enable)
738 {
739 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
740 	struct mt7915_vif *mvif = msta->vif;
741 	int ret;
742 
743 	mt76_worker_disable(&dev->mt76.tx_worker);
744 	if (enable && !params->amsdu)
745 		msta->wcid.amsdu = false;
746 	ret = mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
747 				     MCU_EXT_CMD(STA_REC_UPDATE),
748 				     enable, true);
749 	mt76_worker_enable(&dev->mt76.tx_worker);
750 
751 	return ret;
752 }
753 
754 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
755 			 struct ieee80211_ampdu_params *params,
756 			 bool enable)
757 {
758 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
759 	struct mt7915_vif *mvif = msta->vif;
760 
761 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
762 				      MCU_EXT_CMD(STA_REC_UPDATE),
763 				      enable, false);
764 }
765 
766 static void
767 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
768 		      struct ieee80211_vif *vif)
769 {
770 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
771 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
772 	struct ieee80211_he_mcs_nss_supp mcs_map;
773 	struct sta_rec_he *he;
774 	struct tlv *tlv;
775 	u32 cap = 0;
776 
777 	if (!sta->deflink.he_cap.has_he)
778 		return;
779 
780 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
781 
782 	he = (struct sta_rec_he *)tlv;
783 
784 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
785 		cap |= STA_REC_HE_CAP_HTC;
786 
787 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
788 		cap |= STA_REC_HE_CAP_BSR;
789 
790 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
791 		cap |= STA_REC_HE_CAP_OM;
792 
793 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
794 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
795 
796 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
797 		cap |= STA_REC_HE_CAP_BQR;
798 
799 	if (elem->phy_cap_info[0] &
800 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
801 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
802 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
803 
804 	if (mvif->cap.he_ldpc &&
805 	    (elem->phy_cap_info[1] &
806 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
807 		cap |= STA_REC_HE_CAP_LDPC;
808 
809 	if (elem->phy_cap_info[1] &
810 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
811 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
812 
813 	if (elem->phy_cap_info[2] &
814 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
815 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
816 
817 	if (elem->phy_cap_info[2] &
818 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
819 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
820 
821 	if (elem->phy_cap_info[2] &
822 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
823 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
824 
825 	if (elem->phy_cap_info[6] &
826 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
827 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
828 
829 	if (elem->phy_cap_info[6] &
830 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
831 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
832 
833 	if (elem->phy_cap_info[7] &
834 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
835 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
836 
837 	if (elem->phy_cap_info[7] &
838 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
839 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
840 
841 	if (elem->phy_cap_info[7] &
842 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
843 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
844 
845 	if (elem->phy_cap_info[8] &
846 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
847 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
848 
849 	if (elem->phy_cap_info[8] &
850 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
851 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
852 
853 	if (elem->phy_cap_info[9] &
854 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
855 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
856 
857 	if (elem->phy_cap_info[9] &
858 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
859 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
860 
861 	he->he_cap = cpu_to_le32(cap);
862 
863 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
864 	switch (sta->deflink.bandwidth) {
865 	case IEEE80211_STA_RX_BW_160:
866 		if (elem->phy_cap_info[0] &
867 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
868 			mt7915_mcu_set_sta_he_mcs(sta,
869 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
870 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
871 
872 		mt7915_mcu_set_sta_he_mcs(sta,
873 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
874 					  le16_to_cpu(mcs_map.rx_mcs_160));
875 		fallthrough;
876 	default:
877 		mt7915_mcu_set_sta_he_mcs(sta,
878 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
879 					  le16_to_cpu(mcs_map.rx_mcs_80));
880 		break;
881 	}
882 
883 	he->t_frame_dur =
884 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
885 	he->max_ampdu_exp =
886 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
887 
888 	he->bw_set =
889 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
890 	he->device_class =
891 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
892 	he->punc_pream_rx =
893 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
894 
895 	he->dcm_tx_mode =
896 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
897 	he->dcm_tx_max_nss =
898 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
899 	he->dcm_rx_mode =
900 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
901 	he->dcm_rx_max_nss =
902 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
903 	he->dcm_rx_max_nss =
904 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
905 
906 	he->pkt_ext = 2;
907 }
908 
909 static void
910 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
911 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
912 {
913 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
914 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
915 	struct sta_rec_muru *muru;
916 	struct tlv *tlv;
917 
918 	if (vif->type != NL80211_IFTYPE_STATION &&
919 	    vif->type != NL80211_IFTYPE_AP)
920 		return;
921 
922 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
923 
924 	muru = (struct sta_rec_muru *)tlv;
925 
926 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
927 			       mvif->cap.vht_mu_ebfer ||
928 			       mvif->cap.vht_mu_ebfee;
929 	if (!is_mt7915(&dev->mt76))
930 		muru->cfg.mimo_ul_en = true;
931 	muru->cfg.ofdma_dl_en = true;
932 
933 	if (sta->deflink.vht_cap.vht_supported)
934 		muru->mimo_dl.vht_mu_bfee =
935 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
936 
937 	if (!sta->deflink.he_cap.has_he)
938 		return;
939 
940 	muru->mimo_dl.partial_bw_dl_mimo =
941 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
942 
943 	muru->mimo_ul.full_ul_mimo =
944 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
945 	muru->mimo_ul.partial_ul_mimo =
946 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
947 
948 	muru->ofdma_dl.punc_pream_rx =
949 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
950 	muru->ofdma_dl.he_20m_in_40m_2g =
951 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
952 	muru->ofdma_dl.he_20m_in_160m =
953 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
954 	muru->ofdma_dl.he_80m_in_160m =
955 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
956 
957 	muru->ofdma_ul.t_frame_dur =
958 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
959 	muru->ofdma_ul.mu_cascading =
960 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
961 	muru->ofdma_ul.uo_ra =
962 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
963 	muru->ofdma_ul.rx_ctrl_frame_to_mbss =
964 		HE_MAC(CAP3_RX_CTRL_FRAME_TO_MULTIBSS, elem->mac_cap_info[3]);
965 }
966 
967 static void
968 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
969 {
970 	struct sta_rec_ht *ht;
971 	struct tlv *tlv;
972 
973 	if (!sta->deflink.ht_cap.ht_supported)
974 		return;
975 
976 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
977 
978 	ht = (struct sta_rec_ht *)tlv;
979 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
980 }
981 
982 static void
983 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
984 {
985 	struct sta_rec_vht *vht;
986 	struct tlv *tlv;
987 
988 	if (!sta->deflink.vht_cap.vht_supported)
989 		return;
990 
991 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
992 
993 	vht = (struct sta_rec_vht *)tlv;
994 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
995 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
996 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
997 }
998 
999 static void
1000 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1001 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1002 {
1003 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1004 	struct sta_rec_amsdu *amsdu;
1005 	struct tlv *tlv;
1006 
1007 	if (vif->type != NL80211_IFTYPE_STATION &&
1008 	    vif->type != NL80211_IFTYPE_AP)
1009 		return;
1010 
1011 	if (!sta->deflink.agg.max_amsdu_len)
1012 	    return;
1013 
1014 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1015 	amsdu = (struct sta_rec_amsdu *)tlv;
1016 	amsdu->max_amsdu_num = 8;
1017 	amsdu->amsdu_en = true;
1018 	msta->wcid.amsdu = true;
1019 
1020 	switch (sta->deflink.agg.max_amsdu_len) {
1021 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1022 		if (!is_mt7915(&dev->mt76)) {
1023 			amsdu->max_mpdu_size =
1024 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1025 			return;
1026 		}
1027 		fallthrough;
1028 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1029 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1030 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1031 		return;
1032 	default:
1033 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1034 		return;
1035 	}
1036 }
1037 
1038 static int
1039 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1040 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1041 {
1042 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1043 	struct mt7915_sta *msta;
1044 	struct wtbl_req_hdr *wtbl_hdr;
1045 	struct mt76_wcid *wcid;
1046 	struct tlv *tlv;
1047 
1048 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1049 	wcid = sta ? &msta->wcid : NULL;
1050 
1051 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1052 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1053 						  WTBL_RESET_AND_SET, tlv,
1054 						  &skb);
1055 	if (IS_ERR(wtbl_hdr))
1056 		return PTR_ERR(wtbl_hdr);
1057 
1058 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1059 					 wtbl_hdr);
1060 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1061 	if (sta)
1062 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1063 					    wtbl_hdr, mvif->cap.ht_ldpc,
1064 					    mvif->cap.vht_ldpc);
1065 
1066 	return 0;
1067 }
1068 
1069 static inline bool
1070 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1071 			struct ieee80211_sta *sta, bool bfee)
1072 {
1073 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1074 	int sts = hweight16(phy->mt76->chainmask);
1075 
1076 	if (vif->type != NL80211_IFTYPE_STATION &&
1077 	    vif->type != NL80211_IFTYPE_AP)
1078 		return false;
1079 
1080 	if (!bfee && sts < 2)
1081 		return false;
1082 
1083 	if (sta->deflink.he_cap.has_he) {
1084 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1085 
1086 		if (bfee)
1087 			return mvif->cap.he_su_ebfee &&
1088 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1089 		else
1090 			return mvif->cap.he_su_ebfer &&
1091 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1092 	}
1093 
1094 	if (sta->deflink.vht_cap.vht_supported) {
1095 		u32 cap = sta->deflink.vht_cap.cap;
1096 
1097 		if (bfee)
1098 			return mvif->cap.vht_su_ebfee &&
1099 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1100 		else
1101 			return mvif->cap.vht_su_ebfer &&
1102 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1103 	}
1104 
1105 	return false;
1106 }
1107 
1108 static void
1109 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1110 {
1111 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1112 	bf->ndp_rate = 0;				/* mcs0 */
1113 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1114 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1115 }
1116 
1117 static void
1118 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1119 		       struct sta_rec_bf *bf)
1120 {
1121 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1122 	u8 n = 0;
1123 
1124 	bf->tx_mode = MT_PHY_TYPE_HT;
1125 
1126 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1127 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1128 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1129 			      mcs->tx_params);
1130 	else if (mcs->rx_mask[3])
1131 		n = 3;
1132 	else if (mcs->rx_mask[2])
1133 		n = 2;
1134 	else if (mcs->rx_mask[1])
1135 		n = 1;
1136 
1137 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1138 	bf->ncol = min_t(u8, bf->nrow, n);
1139 	bf->ibf_ncol = n;
1140 }
1141 
1142 static void
1143 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1144 			struct sta_rec_bf *bf, bool explicit)
1145 {
1146 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1147 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1148 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1149 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1150 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1151 
1152 	bf->tx_mode = MT_PHY_TYPE_VHT;
1153 
1154 	if (explicit) {
1155 		u8 sts, snd_dim;
1156 
1157 		mt7915_mcu_sta_sounding_rate(bf);
1158 
1159 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1160 				pc->cap);
1161 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1162 				    vc->cap);
1163 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1164 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1165 		bf->ibf_ncol = bf->ncol;
1166 
1167 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1168 			bf->nrow = 1;
1169 	} else {
1170 		bf->nrow = tx_ant;
1171 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1172 		bf->ibf_ncol = nss_mcs;
1173 
1174 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1175 			bf->ibf_nrow = 1;
1176 	}
1177 }
1178 
1179 static void
1180 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1181 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1182 {
1183 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1184 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1185 	const struct ieee80211_sta_he_cap *vc =
1186 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1187 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1188 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1189 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1190 	u8 snd_dim, sts;
1191 
1192 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1193 
1194 	mt7915_mcu_sta_sounding_rate(bf);
1195 
1196 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1197 				pe->phy_cap_info[6]);
1198 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1199 				pe->phy_cap_info[6]);
1200 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1201 			 ve->phy_cap_info[5]);
1202 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1203 		     pe->phy_cap_info[4]);
1204 	bf->nrow = min_t(u8, snd_dim, sts);
1205 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1206 	bf->ibf_ncol = bf->ncol;
1207 
1208 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1209 		return;
1210 
1211 	/* go over for 160MHz and 80p80 */
1212 	if (pe->phy_cap_info[0] &
1213 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1214 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1215 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1216 
1217 		bf->ncol_gt_bw80 = nss_mcs;
1218 	}
1219 
1220 	if (pe->phy_cap_info[0] &
1221 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1222 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1223 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1224 
1225 		if (bf->ncol_gt_bw80)
1226 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1227 		else
1228 			bf->ncol_gt_bw80 = nss_mcs;
1229 	}
1230 
1231 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1232 			 ve->phy_cap_info[5]);
1233 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1234 		     pe->phy_cap_info[4]);
1235 
1236 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1237 }
1238 
1239 static void
1240 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1241 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1242 {
1243 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1244 	struct mt7915_phy *phy = mvif->phy;
1245 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1246 	struct sta_rec_bf *bf;
1247 	struct tlv *tlv;
1248 	static const u8 matrix[4][4] = {
1249 		{0, 0, 0, 0},
1250 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1251 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1252 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1253 	};
1254 	bool ebf;
1255 
1256 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1257 		return;
1258 
1259 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1260 	if (!ebf && !dev->ibf)
1261 		return;
1262 
1263 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1264 	bf = (struct sta_rec_bf *)tlv;
1265 
1266 	/* he: eBF only, in accordance with spec
1267 	 * vht: support eBF and iBF
1268 	 * ht: iBF only, since mac80211 lacks of eBF support
1269 	 */
1270 	if (sta->deflink.he_cap.has_he && ebf)
1271 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1272 	else if (sta->deflink.vht_cap.vht_supported)
1273 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1274 	else if (sta->deflink.ht_cap.ht_supported)
1275 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1276 	else
1277 		return;
1278 
1279 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1280 	bf->bw = sta->deflink.bandwidth;
1281 	bf->ibf_dbw = sta->deflink.bandwidth;
1282 	bf->ibf_nrow = tx_ant;
1283 
1284 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1285 		bf->ibf_timeout = 0x48;
1286 	else
1287 		bf->ibf_timeout = 0x18;
1288 
1289 	if (ebf && bf->nrow != tx_ant)
1290 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1291 	else
1292 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1293 
1294 	switch (sta->deflink.bandwidth) {
1295 	case IEEE80211_STA_RX_BW_160:
1296 	case IEEE80211_STA_RX_BW_80:
1297 		bf->mem_total = bf->mem_20m * 2;
1298 		break;
1299 	case IEEE80211_STA_RX_BW_40:
1300 		bf->mem_total = bf->mem_20m;
1301 		break;
1302 	case IEEE80211_STA_RX_BW_20:
1303 	default:
1304 		break;
1305 	}
1306 }
1307 
1308 static void
1309 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1310 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1311 {
1312 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1313 	struct mt7915_phy *phy = mvif->phy;
1314 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1315 	struct sta_rec_bfee *bfee;
1316 	struct tlv *tlv;
1317 	u8 nrow = 0;
1318 
1319 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1320 		return;
1321 
1322 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1323 		return;
1324 
1325 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1326 	bfee = (struct sta_rec_bfee *)tlv;
1327 
1328 	if (sta->deflink.he_cap.has_he) {
1329 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1330 
1331 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1332 			      pe->phy_cap_info[5]);
1333 	} else if (sta->deflink.vht_cap.vht_supported) {
1334 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1335 
1336 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1337 				 pc->cap);
1338 	}
1339 
1340 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1341 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1342 }
1343 
1344 static enum mcu_mmps_mode
1345 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1346 {
1347 	switch (smps) {
1348 	case IEEE80211_SMPS_OFF:
1349 		return MCU_MMPS_DISABLE;
1350 	case IEEE80211_SMPS_STATIC:
1351 		return MCU_MMPS_STATIC;
1352 	case IEEE80211_SMPS_DYNAMIC:
1353 		return MCU_MMPS_DYNAMIC;
1354 	default:
1355 		return MCU_MMPS_DISABLE;
1356 	}
1357 }
1358 
1359 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1360 				   struct ieee80211_vif *vif,
1361 				   struct ieee80211_sta *sta,
1362 				   void *data, u32 field)
1363 {
1364 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1365 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1366 	struct sta_phy *phy = data;
1367 	struct sta_rec_ra_fixed *ra;
1368 	struct sk_buff *skb;
1369 	struct tlv *tlv;
1370 
1371 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1372 					    &msta->wcid);
1373 	if (IS_ERR(skb))
1374 		return PTR_ERR(skb);
1375 
1376 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1377 	ra = (struct sta_rec_ra_fixed *)tlv;
1378 
1379 	switch (field) {
1380 	case RATE_PARAM_AUTO:
1381 		break;
1382 	case RATE_PARAM_FIXED:
1383 	case RATE_PARAM_FIXED_MCS:
1384 	case RATE_PARAM_FIXED_GI:
1385 	case RATE_PARAM_FIXED_HE_LTF:
1386 		if (phy)
1387 			ra->phy = *phy;
1388 		break;
1389 	case RATE_PARAM_MMPS_UPDATE:
1390 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1391 		break;
1392 	case RATE_PARAM_SPE_UPDATE:
1393 		ra->spe_idx = *(u8 *)data;
1394 		break;
1395 	default:
1396 		break;
1397 	}
1398 	ra->field = cpu_to_le32(field);
1399 
1400 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1401 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1402 }
1403 
1404 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1405 			struct ieee80211_sta *sta)
1406 {
1407 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1408 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1409 	struct wtbl_req_hdr *wtbl_hdr;
1410 	struct tlv *sta_wtbl;
1411 	struct sk_buff *skb;
1412 	int ret;
1413 
1414 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1415 					    &msta->wcid);
1416 	if (IS_ERR(skb))
1417 		return PTR_ERR(skb);
1418 
1419 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1420 					   sizeof(struct tlv));
1421 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1422 						  WTBL_SET, sta_wtbl, &skb);
1423 	if (IS_ERR(wtbl_hdr))
1424 		return PTR_ERR(wtbl_hdr);
1425 
1426 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1427 
1428 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1429 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1430 	if (ret)
1431 		return ret;
1432 
1433 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1434 					      RATE_PARAM_MMPS_UPDATE);
1435 }
1436 
1437 static int
1438 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1439 		       struct ieee80211_sta *sta)
1440 {
1441 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1442 	struct mt76_phy *mphy = mvif->phy->mt76;
1443 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1444 
1445 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1446 					      RATE_PARAM_SPE_UPDATE);
1447 }
1448 
1449 static int
1450 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1451 			       struct ieee80211_vif *vif,
1452 			       struct ieee80211_sta *sta)
1453 {
1454 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1455 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1456 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1457 	enum nl80211_band band = chandef->chan->band;
1458 	struct sta_phy phy = {};
1459 	int ret, nrates = 0;
1460 
1461 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1462 	do {									\
1463 		u8 i, gi = mask->control[band]._gi;				\
1464 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1465 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1466 			phy.sgi |= gi << (i << (_he));				\
1467 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1468 		}								\
1469 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1470 			if (!mask->control[band]._mcs[i])			\
1471 				continue;					\
1472 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1473 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1474 			if (_ht)						\
1475 				phy.mcs += 8 * i;				\
1476 		}								\
1477 	} while (0)
1478 
1479 	if (sta->deflink.he_cap.has_he) {
1480 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1481 	} else if (sta->deflink.vht_cap.vht_supported) {
1482 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1483 	} else if (sta->deflink.ht_cap.ht_supported) {
1484 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1485 	} else {
1486 		nrates = hweight32(mask->control[band].legacy);
1487 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1488 	}
1489 #undef __sta_phy_bitrate_mask_check
1490 
1491 	/* fall back to auto rate control */
1492 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1493 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1494 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1495 	    nrates != 1)
1496 		return 0;
1497 
1498 	/* fixed single rate */
1499 	if (nrates == 1) {
1500 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1501 						     RATE_PARAM_FIXED_MCS);
1502 		if (ret)
1503 			return ret;
1504 	}
1505 
1506 	/* fixed GI */
1507 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1508 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1509 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1510 		u32 addr;
1511 
1512 		/* firmware updates only TXCMD but doesn't take WTBL into
1513 		 * account, so driver should update here to reflect the
1514 		 * actual txrate hardware sends out.
1515 		 */
1516 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1517 		if (sta->deflink.he_cap.has_he)
1518 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1519 		else
1520 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1521 
1522 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1523 						     RATE_PARAM_FIXED_GI);
1524 		if (ret)
1525 			return ret;
1526 	}
1527 
1528 	/* fixed HE_LTF */
1529 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1530 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1531 						     RATE_PARAM_FIXED_HE_LTF);
1532 		if (ret)
1533 			return ret;
1534 	}
1535 
1536 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1537 }
1538 
1539 static void
1540 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1541 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1542 {
1543 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1544 	struct mt76_phy *mphy = mvif->phy->mt76;
1545 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1546 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1547 	enum nl80211_band band = chandef->chan->band;
1548 	struct sta_rec_ra *ra;
1549 	struct tlv *tlv;
1550 	u32 supp_rate = sta->deflink.supp_rates[band];
1551 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1552 
1553 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1554 	ra = (struct sta_rec_ra *)tlv;
1555 
1556 	ra->valid = true;
1557 	ra->auto_rate = true;
1558 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, &sta->deflink);
1559 	ra->channel = chandef->chan->hw_value;
1560 	ra->bw = sta->deflink.bandwidth;
1561 	ra->phy.bw = sta->deflink.bandwidth;
1562 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1563 
1564 	if (supp_rate) {
1565 		supp_rate &= mask->control[band].legacy;
1566 		ra->rate_len = hweight32(supp_rate);
1567 
1568 		if (band == NL80211_BAND_2GHZ) {
1569 			ra->supp_mode = MODE_CCK;
1570 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1571 
1572 			if (ra->rate_len > 4) {
1573 				ra->supp_mode |= MODE_OFDM;
1574 				ra->supp_ofdm_rate = supp_rate >> 4;
1575 			}
1576 		} else {
1577 			ra->supp_mode = MODE_OFDM;
1578 			ra->supp_ofdm_rate = supp_rate;
1579 		}
1580 	}
1581 
1582 	if (sta->deflink.ht_cap.ht_supported) {
1583 		ra->supp_mode |= MODE_HT;
1584 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1585 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1586 
1587 		cap |= STA_CAP_HT;
1588 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1589 			cap |= STA_CAP_SGI_20;
1590 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1591 			cap |= STA_CAP_SGI_40;
1592 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1593 			cap |= STA_CAP_TX_STBC;
1594 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1595 			cap |= STA_CAP_RX_STBC;
1596 		if (mvif->cap.ht_ldpc &&
1597 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1598 			cap |= STA_CAP_LDPC;
1599 
1600 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1601 					  mask->control[band].ht_mcs);
1602 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1603 	}
1604 
1605 	if (sta->deflink.vht_cap.vht_supported) {
1606 		u8 af;
1607 
1608 		ra->supp_mode |= MODE_VHT;
1609 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1610 			       sta->deflink.vht_cap.cap);
1611 		ra->af = max_t(u8, ra->af, af);
1612 
1613 		cap |= STA_CAP_VHT;
1614 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1615 			cap |= STA_CAP_VHT_SGI_80;
1616 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1617 			cap |= STA_CAP_VHT_SGI_160;
1618 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1619 			cap |= STA_CAP_VHT_TX_STBC;
1620 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1621 			cap |= STA_CAP_VHT_RX_STBC;
1622 		if (mvif->cap.vht_ldpc &&
1623 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1624 			cap |= STA_CAP_VHT_LDPC;
1625 
1626 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1627 					   mask->control[band].vht_mcs);
1628 	}
1629 
1630 	if (sta->deflink.he_cap.has_he) {
1631 		ra->supp_mode |= MODE_HE;
1632 		cap |= STA_CAP_HE;
1633 
1634 		if (sta->deflink.he_6ghz_capa.capa)
1635 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1636 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1637 	}
1638 
1639 	ra->sta_cap = cpu_to_le32(cap);
1640 }
1641 
1642 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1643 			     struct ieee80211_sta *sta, bool changed)
1644 {
1645 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1646 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1647 	struct sk_buff *skb;
1648 	int ret;
1649 
1650 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1651 					    &msta->wcid);
1652 	if (IS_ERR(skb))
1653 		return PTR_ERR(skb);
1654 
1655 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1656 	 * once dev->rc_work changes the settings driver should also
1657 	 * update sta_rec_he here.
1658 	 */
1659 	if (changed)
1660 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1661 
1662 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1663 	 * i.e 0-{7,8,9} for VHT.
1664 	 */
1665 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1666 
1667 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1668 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1669 	if (ret)
1670 		return ret;
1671 
1672 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1673 	 * and updates as peer fixed rate parameters, which overrides
1674 	 * sta_rec_ra and firmware rate control algorithm.
1675 	 */
1676 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1677 }
1678 
1679 static int
1680 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1681 		     struct ieee80211_sta *sta)
1682 {
1683 #define MT_STA_BSS_GROUP		1
1684 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1685 	struct mt7915_sta *msta;
1686 	struct {
1687 		__le32 action;
1688 		u8 wlan_idx_lo;
1689 		u8 status;
1690 		u8 wlan_idx_hi;
1691 		u8 rsv0[5];
1692 		__le32 val;
1693 		u8 rsv1[8];
1694 	} __packed req = {
1695 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1696 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1697 	};
1698 
1699 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1700 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1701 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1702 
1703 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1704 				 sizeof(req), true);
1705 }
1706 
1707 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1708 		       struct ieee80211_sta *sta, int conn_state, bool newly)
1709 {
1710 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1711 	struct ieee80211_link_sta *link_sta;
1712 	struct mt7915_sta *msta;
1713 	struct sk_buff *skb;
1714 	int ret;
1715 
1716 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1717 	link_sta = sta ? &sta->deflink : NULL;
1718 
1719 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1720 					    &msta->wcid);
1721 	if (IS_ERR(skb))
1722 		return PTR_ERR(skb);
1723 
1724 	/* starec basic */
1725 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, &vif->bss_conf, link_sta,
1726 				      conn_state, newly);
1727 	/* tag order is in accordance with firmware dependency. */
1728 	if (sta && conn_state != CONN_STATE_DISCONNECT) {
1729 		/* starec bfer */
1730 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1731 		/* starec ht */
1732 		mt7915_mcu_sta_ht_tlv(skb, sta);
1733 		/* starec vht */
1734 		mt7915_mcu_sta_vht_tlv(skb, sta);
1735 		/* starec uapsd */
1736 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1737 	}
1738 
1739 	if (newly || conn_state != CONN_STATE_DISCONNECT) {
1740 		ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1741 		if (ret) {
1742 			dev_kfree_skb(skb);
1743 			return ret;
1744 		}
1745 	}
1746 
1747 	if (conn_state == CONN_STATE_DISCONNECT)
1748 		goto out;
1749 
1750 	if (sta) {
1751 		/* starec amsdu */
1752 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1753 		/* starec he */
1754 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1755 		/* starec muru */
1756 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1757 		/* starec bfee */
1758 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1759 	}
1760 
1761 	ret = mt7915_mcu_add_group(dev, vif, sta);
1762 	if (ret) {
1763 		dev_kfree_skb(skb);
1764 		return ret;
1765 	}
1766 out:
1767 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1768 	if (ret)
1769 		return ret;
1770 
1771 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1772 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1773 }
1774 
1775 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1776 {
1777 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1778 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1779 	struct {
1780 		__le32 args[2];
1781 	} req = {
1782 		.args[0] = cpu_to_le32(1),
1783 		.args[1] = cpu_to_le32(6),
1784 	};
1785 
1786 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1787 					 &req, sizeof(req));
1788 #else
1789 	return 0;
1790 #endif
1791 }
1792 
1793 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1794 			    struct ieee80211_vif *vif, bool enable)
1795 {
1796 	struct mt7915_dev *dev = phy->dev;
1797 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1798 	struct {
1799 		struct req_hdr {
1800 			u8 omac_idx;
1801 			u8 band_idx;
1802 			__le16 tlv_num;
1803 			u8 is_tlv_append;
1804 			u8 rsv[3];
1805 		} __packed hdr;
1806 		struct req_tlv {
1807 			__le16 tag;
1808 			__le16 len;
1809 			u8 active;
1810 			u8 band_idx;
1811 			u8 omac_addr[ETH_ALEN];
1812 		} __packed tlv;
1813 	} data = {
1814 		.hdr = {
1815 			.omac_idx = mvif->mt76.omac_idx,
1816 			.band_idx = mvif->mt76.band_idx,
1817 			.tlv_num = cpu_to_le16(1),
1818 			.is_tlv_append = 1,
1819 		},
1820 		.tlv = {
1821 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1822 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1823 			.active = enable,
1824 			.band_idx = mvif->mt76.band_idx,
1825 		},
1826 	};
1827 
1828 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1829 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1830 
1831 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1832 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1833 				 &data, sizeof(data), true);
1834 }
1835 
1836 static void
1837 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1838 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1839 			 struct ieee80211_mutable_offsets *offs)
1840 {
1841 	struct bss_info_bcn_cntdwn *info;
1842 	struct tlv *tlv;
1843 	int sub_tag;
1844 
1845 	if (!offs->cntdwn_counter_offs[0])
1846 		return;
1847 
1848 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1849 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1850 					   &bcn->sub_ntlv, &bcn->len);
1851 	info = (struct bss_info_bcn_cntdwn *)tlv;
1852 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1853 }
1854 
1855 static void
1856 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1857 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1858 		       struct ieee80211_mutable_offsets *offs)
1859 {
1860 	struct bss_info_bcn_mbss *mbss;
1861 	const struct element *elem;
1862 	struct tlv *tlv;
1863 
1864 	if (!vif->bss_conf.bssid_indicator)
1865 		return;
1866 
1867 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1868 					   sizeof(*mbss), &bcn->sub_ntlv,
1869 					   &bcn->len);
1870 
1871 	mbss = (struct bss_info_bcn_mbss *)tlv;
1872 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1873 	mbss->bitmap = cpu_to_le32(1);
1874 
1875 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1876 			    &skb->data[offs->mbssid_off],
1877 			    skb->len - offs->mbssid_off) {
1878 		const struct element *sub_elem;
1879 
1880 		if (elem->datalen < 2)
1881 			continue;
1882 
1883 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1884 			const struct ieee80211_bssid_index *idx;
1885 			const u8 *idx_ie;
1886 
1887 			if (sub_elem->id || sub_elem->datalen < 4)
1888 				continue; /* not a valid BSS profile */
1889 
1890 			/* Find WLAN_EID_MULTI_BSSID_IDX
1891 			 * in the merged nontransmitted profile
1892 			 */
1893 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1894 						  sub_elem->data,
1895 						  sub_elem->datalen);
1896 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1897 				continue;
1898 
1899 			idx = (void *)(idx_ie + 2);
1900 			if (!idx->bssid_index || idx->bssid_index > 31)
1901 				continue;
1902 
1903 			mbss->offset[idx->bssid_index] =
1904 				cpu_to_le16(idx_ie - skb->data);
1905 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1906 		}
1907 	}
1908 }
1909 
1910 static void
1911 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1912 		       struct sk_buff *rskb, struct sk_buff *skb,
1913 		       struct bss_info_bcn *bcn,
1914 		       struct ieee80211_mutable_offsets *offs)
1915 {
1916 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1917 	struct bss_info_bcn_cont *cont;
1918 	struct tlv *tlv;
1919 	u8 *buf;
1920 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1921 
1922 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1923 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1924 					   len, &bcn->sub_ntlv, &bcn->len);
1925 
1926 	cont = (struct bss_info_bcn_cont *)tlv;
1927 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1928 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1929 
1930 	if (offs->cntdwn_counter_offs[0]) {
1931 		u16 offset = offs->cntdwn_counter_offs[0];
1932 
1933 		if (vif->bss_conf.csa_active)
1934 			cont->csa_ofs = cpu_to_le16(offset - 4);
1935 		if (vif->bss_conf.color_change_active)
1936 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1937 	}
1938 
1939 	buf = (u8 *)tlv + sizeof(*cont);
1940 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1941 			      0, BSS_CHANGED_BEACON);
1942 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1943 }
1944 
1945 int
1946 mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1947 			     u32 changed)
1948 {
1949 #define OFFLOAD_TX_MODE_SU	BIT(0)
1950 #define OFFLOAD_TX_MODE_MU	BIT(1)
1951 	struct ieee80211_hw *hw = mt76_hw(dev);
1952 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1953 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1954 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1955 	enum nl80211_band band = chandef->chan->band;
1956 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1957 	struct bss_info_bcn *bcn;
1958 	struct bss_info_inband_discovery *discov;
1959 	struct ieee80211_tx_info *info;
1960 	struct sk_buff *rskb, *skb = NULL;
1961 	struct tlv *tlv, *sub_tlv;
1962 	bool ext_phy = phy != &dev->phy;
1963 	u8 *buf, interval;
1964 	int len;
1965 
1966 	if (vif->bss_conf.nontransmitted)
1967 		return 0;
1968 
1969 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
1970 					       MT7915_MAX_BSS_OFFLOAD_SIZE);
1971 	if (IS_ERR(rskb))
1972 		return PTR_ERR(rskb);
1973 
1974 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1975 	bcn = (struct bss_info_bcn *)tlv;
1976 	bcn->enable = true;
1977 
1978 	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
1979 		interval = vif->bss_conf.fils_discovery.max_interval;
1980 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1981 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1982 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1983 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1984 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1985 	}
1986 
1987 	if (!skb) {
1988 		dev_kfree_skb(rskb);
1989 		return -EINVAL;
1990 	}
1991 
1992 	info = IEEE80211_SKB_CB(skb);
1993 	info->control.vif = vif;
1994 	info->band = band;
1995 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1996 
1997 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1998 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1999 
2000 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
2001 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
2002 		dev_kfree_skb(rskb);
2003 		dev_kfree_skb(skb);
2004 		return -EINVAL;
2005 	}
2006 
2007 	sub_tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
2008 					       len, &bcn->sub_ntlv, &bcn->len);
2009 	discov = (struct bss_info_inband_discovery *)sub_tlv;
2010 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
2011 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
2012 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
2013 	discov->tx_interval = interval;
2014 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2015 	discov->enable = !!interval;
2016 
2017 	buf = (u8 *)sub_tlv + sizeof(*discov);
2018 
2019 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
2020 			      0, changed);
2021 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2022 
2023 	dev_kfree_skb(skb);
2024 
2025 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2026 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2027 }
2028 
2029 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2030 			  int en, u32 changed)
2031 {
2032 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2033 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2034 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2035 	struct ieee80211_mutable_offsets offs;
2036 	struct ieee80211_tx_info *info;
2037 	struct sk_buff *skb, *rskb;
2038 	struct tlv *tlv;
2039 	struct bss_info_bcn *bcn;
2040 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
2041 	bool ext_phy = phy != &dev->phy;
2042 
2043 	if (vif->bss_conf.nontransmitted)
2044 		return 0;
2045 
2046 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2047 					       NULL, len);
2048 	if (IS_ERR(rskb))
2049 		return PTR_ERR(rskb);
2050 
2051 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2052 	bcn = (struct bss_info_bcn *)tlv;
2053 	bcn->enable = en;
2054 
2055 	if (!en)
2056 		goto out;
2057 
2058 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
2059 	if (!skb) {
2060 		dev_kfree_skb(rskb);
2061 		return -EINVAL;
2062 	}
2063 
2064 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
2065 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2066 		dev_kfree_skb(rskb);
2067 		dev_kfree_skb(skb);
2068 		return -EINVAL;
2069 	}
2070 
2071 	info = IEEE80211_SKB_CB(skb);
2072 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
2073 
2074 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2075 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2076 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2077 	dev_kfree_skb(skb);
2078 
2079 out:
2080 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2081 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2082 }
2083 
2084 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2085 {
2086 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2087 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2088 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2089 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2090 		return -EIO;
2091 	}
2092 
2093 	/* clear irq when the driver own success */
2094 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2095 		MT_TOP_LPCR_HOST_BAND_STAT);
2096 
2097 	return 0;
2098 }
2099 
2100 static int
2101 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2102 {
2103 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2104 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2105 
2106 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2107 			    state, 1000)) {
2108 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2109 		return -EIO;
2110 	}
2111 	return 0;
2112 }
2113 
2114 static int mt7915_load_firmware(struct mt7915_dev *dev)
2115 {
2116 	int ret;
2117 
2118 	/* Release Semaphore if taken by previous failed attempt */
2119 	ret = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
2120 	if (ret != PATCH_REL_SEM_SUCCESS) {
2121 		dev_err(dev->mt76.dev, "Could not release semaphore\n");
2122 		/* Continue anyways */
2123 	}
2124 
2125 	/* Always restart MCU firmware */
2126 	mt76_connac_mcu_restart(&dev->mt76);
2127 
2128 	/* Check if MCU is ready */
2129 	ret = mt7915_firmware_state(dev, false);
2130 	if (ret) {
2131 		dev_err(dev->mt76.dev, "Firmware did not enter download state\n");
2132 		return ret;
2133 	}
2134 
2135 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2136 	if (ret)
2137 		return ret;
2138 
2139 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2140 				    fw_name(dev, FIRMWARE_WA));
2141 	if (ret)
2142 		return ret;
2143 
2144 	ret = mt7915_firmware_state(dev, true);
2145 	if (ret)
2146 		return ret;
2147 
2148 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2149 
2150 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2151 
2152 	return 0;
2153 }
2154 
2155 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2156 {
2157 	struct {
2158 		u8 ctrl_val;
2159 		u8 pad[3];
2160 	} data = {
2161 		.ctrl_val = ctrl
2162 	};
2163 
2164 	if (type == MCU_FW_LOG_WA)
2165 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2166 					 &data, sizeof(data), true);
2167 
2168 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2169 				 sizeof(data), true);
2170 }
2171 
2172 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2173 {
2174 	struct {
2175 		u8 ver;
2176 		u8 pad;
2177 		__le16 len;
2178 		u8 level;
2179 		u8 rsv[3];
2180 		__le32 module_idx;
2181 	} data = {
2182 		.module_idx = cpu_to_le32(module),
2183 		.level = level,
2184 	};
2185 
2186 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2187 				 sizeof(data), false);
2188 }
2189 
2190 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2191 {
2192 	struct {
2193 		__le32 cmd;
2194 		u8 enable;
2195 	} data = {
2196 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2197 		.enable = enabled,
2198 	};
2199 
2200 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2201 				sizeof(data), false);
2202 }
2203 
2204 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy)
2205 {
2206 	struct mt7915_dev *dev = phy->dev;
2207 	struct sk_buff *skb;
2208 	struct mt7915_mcu_muru_stats *mu_stats;
2209 	int ret;
2210 
2211 	struct {
2212 		__le32 cmd;
2213 		u8 band_idx;
2214 	} req = {
2215 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2216 		.band_idx = phy->mt76->band_idx,
2217 	};
2218 
2219 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2220 					&req, sizeof(req), true, &skb);
2221 	if (ret)
2222 		return ret;
2223 
2224 	mu_stats = (struct mt7915_mcu_muru_stats *)(skb->data);
2225 
2226 	/* accumulate stats, these are clear-on-read */
2227 #define __dl_u32(s)	 phy->mib.dl_##s += le32_to_cpu(mu_stats->dl.s)
2228 #define __ul_u32(s)	 phy->mib.ul_##s += le32_to_cpu(mu_stats->ul.s)
2229 	__dl_u32(cck_cnt);
2230 	__dl_u32(ofdm_cnt);
2231 	__dl_u32(htmix_cnt);
2232 	__dl_u32(htgf_cnt);
2233 	__dl_u32(vht_su_cnt);
2234 	__dl_u32(vht_2mu_cnt);
2235 	__dl_u32(vht_3mu_cnt);
2236 	__dl_u32(vht_4mu_cnt);
2237 	__dl_u32(he_su_cnt);
2238 	__dl_u32(he_2ru_cnt);
2239 	__dl_u32(he_2mu_cnt);
2240 	__dl_u32(he_3ru_cnt);
2241 	__dl_u32(he_3mu_cnt);
2242 	__dl_u32(he_4ru_cnt);
2243 	__dl_u32(he_4mu_cnt);
2244 	__dl_u32(he_5to8ru_cnt);
2245 	__dl_u32(he_9to16ru_cnt);
2246 	__dl_u32(he_gtr16ru_cnt);
2247 
2248 	__ul_u32(hetrig_su_cnt);
2249 	__ul_u32(hetrig_2ru_cnt);
2250 	__ul_u32(hetrig_3ru_cnt);
2251 	__ul_u32(hetrig_4ru_cnt);
2252 	__ul_u32(hetrig_5to8ru_cnt);
2253 	__ul_u32(hetrig_9to16ru_cnt);
2254 	__ul_u32(hetrig_gtr16ru_cnt);
2255 	__ul_u32(hetrig_2mu_cnt);
2256 	__ul_u32(hetrig_3mu_cnt);
2257 	__ul_u32(hetrig_4mu_cnt);
2258 #undef __dl_u32
2259 #undef __ul_u32
2260 
2261 	dev_kfree_skb(skb);
2262 
2263 	return 0;
2264 }
2265 
2266 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2267 {
2268 	struct {
2269 		u8 enable;
2270 		u8 _rsv[3];
2271 	} __packed req = {
2272 		.enable = enabled
2273 	};
2274 
2275 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2276 				 sizeof(req), false);
2277 }
2278 
2279 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2280 {
2281 	struct {
2282 		__le32 cmd;
2283 		u8 val[4];
2284 	} __packed req = {
2285 		.cmd = cpu_to_le32(cmd),
2286 	};
2287 
2288 	put_unaligned_le32(val, req.val);
2289 
2290 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2291 				 sizeof(req), false);
2292 }
2293 
2294 static int
2295 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2296 {
2297 #define RX_AIRTIME_FEATURE_CTRL		1
2298 #define RX_AIRTIME_BITWISE_CTRL		2
2299 #define RX_AIRTIME_CLEAR_EN	1
2300 	struct {
2301 		__le16 field;
2302 		__le16 sub_field;
2303 		__le32 set_status;
2304 		__le32 get_status;
2305 		u8 _rsv[12];
2306 
2307 		bool airtime_en;
2308 		bool mibtime_en;
2309 		bool earlyend_en;
2310 		u8 _rsv1[9];
2311 
2312 		bool airtime_clear;
2313 		bool mibtime_clear;
2314 		u8 _rsv2[98];
2315 	} __packed req = {
2316 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2317 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2318 		.airtime_clear = true,
2319 	};
2320 	int ret;
2321 
2322 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2323 				sizeof(req), true);
2324 	if (ret)
2325 		return ret;
2326 
2327 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2328 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2329 	req.airtime_en = true;
2330 
2331 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2332 				 sizeof(req), true);
2333 }
2334 
2335 static int mt7915_red_set_watermark(struct mt7915_dev *dev)
2336 {
2337 #define RED_GLOBAL_TOKEN_WATERMARK 2
2338 	struct {
2339 		__le32 args[3];
2340 		u8 cmd;
2341 		u8 version;
2342 		u8 __rsv1[4];
2343 		__le16 len;
2344 		__le16 high_mark;
2345 		__le16 low_mark;
2346 		u8 __rsv2[12];
2347 	} __packed req = {
2348 		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
2349 		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
2350 		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
2351 		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
2352 		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
2353 	};
2354 
2355 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
2356 				 sizeof(req), false);
2357 }
2358 
2359 static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
2360 {
2361 #define RED_DISABLE		0
2362 #define RED_BY_WA_ENABLE	2
2363 	int ret;
2364 	u32 red_type = enabled ? RED_BY_WA_ENABLE : RED_DISABLE;
2365 	__le32 req = cpu_to_le32(red_type);
2366 
2367 	if (enabled) {
2368 		ret = mt7915_red_set_watermark(dev);
2369 		if (ret < 0)
2370 			return ret;
2371 	}
2372 
2373 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
2374 				sizeof(req), false);
2375 	if (ret < 0)
2376 		return ret;
2377 
2378 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2379 				 MCU_WA_PARAM_RED, enabled, 0);
2380 }
2381 
2382 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2383 {
2384 	int ret;
2385 
2386 	/* force firmware operation mode into normal state,
2387 	 * which should be set before firmware download stage.
2388 	 */
2389 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2390 
2391 	ret = mt7915_driver_own(dev, 0);
2392 	if (ret)
2393 		return ret;
2394 	/* set driver own for band1 when two hif exist */
2395 	if (dev->hif2) {
2396 		ret = mt7915_driver_own(dev, 1);
2397 		if (ret)
2398 			return ret;
2399 	}
2400 
2401 	ret = mt7915_load_firmware(dev);
2402 	if (ret)
2403 		return ret;
2404 
2405 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2406 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2407 	if (ret)
2408 		return ret;
2409 
2410 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2411 	if (ret)
2412 		return ret;
2413 
2414 	mt76_connac_mcu_del_wtbl_all(&dev->mt76);
2415 
2416 	if ((mtk_wed_device_active(&dev->mt76.mmio.wed) &&
2417 	     is_mt7915(&dev->mt76)) ||
2418 	    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
2419 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2420 
2421 	ret = mt7915_mcu_set_mwds(dev, 1);
2422 	if (ret)
2423 		return ret;
2424 
2425 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2426 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2427 	if (ret)
2428 		return ret;
2429 
2430 	ret = mt7915_mcu_init_rx_airtime(dev);
2431 	if (ret)
2432 		return ret;
2433 
2434 	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
2435 }
2436 
2437 int mt7915_mcu_init(struct mt7915_dev *dev)
2438 {
2439 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2440 		.max_retry = 1,
2441 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2442 		.mcu_skb_prepare_msg = mt76_connac2_mcu_fill_message,
2443 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2444 		.mcu_parse_response = mt7915_mcu_parse_response,
2445 	};
2446 
2447 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2448 
2449 	return mt7915_mcu_init_firmware(dev);
2450 }
2451 
2452 void mt7915_mcu_exit(struct mt7915_dev *dev)
2453 {
2454 	mt76_connac_mcu_restart(&dev->mt76);
2455 	if (mt7915_firmware_state(dev, false)) {
2456 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2457 		goto out;
2458 	}
2459 
2460 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2461 	if (dev->hif2)
2462 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2463 			MT_TOP_LPCR_HOST_FW_OWN);
2464 out:
2465 	skb_queue_purge(&dev->mt76.mcu.res_q);
2466 }
2467 
2468 static int
2469 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2470 {
2471 	struct {
2472 		u8 operation;
2473 		u8 count;
2474 		u8 _rsv[2];
2475 		u8 index;
2476 		u8 enable;
2477 		__le16 etype;
2478 	} req = {
2479 		.operation = 1,
2480 		.count = 1,
2481 		.enable = 1,
2482 		.etype = cpu_to_le16(ETH_P_PAE),
2483 	};
2484 
2485 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2486 				 &req, sizeof(req), false);
2487 }
2488 
2489 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2490 		       bool enable, bool hdr_trans)
2491 {
2492 	struct {
2493 		u8 operation;
2494 		u8 enable;
2495 		u8 check_bssid;
2496 		u8 insert_vlan;
2497 		u8 remove_vlan;
2498 		u8 tid;
2499 		u8 mode;
2500 		u8 rsv;
2501 	} __packed req_trans = {
2502 		.enable = hdr_trans,
2503 	};
2504 	struct {
2505 		u8 enable;
2506 		u8 band;
2507 		u8 rsv[2];
2508 	} __packed req_mac = {
2509 		.enable = enable,
2510 		.band = band,
2511 	};
2512 	int ret;
2513 
2514 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2515 				&req_trans, sizeof(req_trans), false);
2516 	if (ret)
2517 		return ret;
2518 
2519 	if (hdr_trans)
2520 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2521 
2522 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2523 				 &req_mac, sizeof(req_mac), true);
2524 }
2525 
2526 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2527 {
2528 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2529 	u8 num = req->total;
2530 	size_t len = sizeof(*req) -
2531 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2532 
2533 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2534 				 len, true);
2535 }
2536 
2537 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2538 {
2539 #define TX_CMD_MODE		1
2540 	struct mt7915_mcu_tx req = {
2541 		.valid = true,
2542 		.mode = TX_CMD_MODE,
2543 		.total = IEEE80211_NUM_ACS,
2544 	};
2545 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2546 	int ac;
2547 
2548 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2549 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2550 		struct edca *e = &req.edca[ac];
2551 
2552 		e->set = WMM_PARAM_SET;
2553 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2554 		e->aifs = q->aifs;
2555 		e->txop = cpu_to_le16(q->txop);
2556 
2557 		if (q->cw_min)
2558 			e->cw_min = fls(q->cw_min);
2559 		else
2560 			e->cw_min = 5;
2561 
2562 		if (q->cw_max)
2563 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2564 		else
2565 			e->cw_max = cpu_to_le16(10);
2566 	}
2567 
2568 	return mt7915_mcu_update_edca(dev, &req);
2569 }
2570 
2571 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2572 {
2573 	struct {
2574 		__le32 tag;
2575 		__le16 min_lpn;
2576 		u8 rsv[2];
2577 	} __packed req = {
2578 		.tag = cpu_to_le32(0x1),
2579 		.min_lpn = cpu_to_le16(val),
2580 	};
2581 
2582 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2583 				 sizeof(req), true);
2584 }
2585 
2586 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2587 			    const struct mt7915_dfs_pulse *pulse)
2588 {
2589 	struct {
2590 		__le32 tag;
2591 
2592 		__le32 max_width;		/* us */
2593 		__le32 max_pwr;			/* dbm */
2594 		__le32 min_pwr;			/* dbm */
2595 		__le32 min_stgr_pri;		/* us */
2596 		__le32 max_stgr_pri;		/* us */
2597 		__le32 min_cr_pri;		/* us */
2598 		__le32 max_cr_pri;		/* us */
2599 	} __packed req = {
2600 		.tag = cpu_to_le32(0x3),
2601 
2602 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2603 		__req_field(max_width),
2604 		__req_field(max_pwr),
2605 		__req_field(min_pwr),
2606 		__req_field(min_stgr_pri),
2607 		__req_field(max_stgr_pri),
2608 		__req_field(min_cr_pri),
2609 		__req_field(max_cr_pri),
2610 #undef __req_field
2611 	};
2612 
2613 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2614 				 sizeof(req), true);
2615 }
2616 
2617 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2618 			    const struct mt7915_dfs_pattern *pattern)
2619 {
2620 	struct {
2621 		__le32 tag;
2622 		__le16 radar_type;
2623 
2624 		u8 enb;
2625 		u8 stgr;
2626 		u8 min_crpn;
2627 		u8 max_crpn;
2628 		u8 min_crpr;
2629 		u8 min_pw;
2630 		__le32 min_pri;
2631 		__le32 max_pri;
2632 		u8 max_pw;
2633 		u8 min_crbn;
2634 		u8 max_crbn;
2635 		u8 min_stgpn;
2636 		u8 max_stgpn;
2637 		u8 min_stgpr;
2638 		u8 rsv[2];
2639 		__le32 min_stgpr_diff;
2640 	} __packed req = {
2641 		.tag = cpu_to_le32(0x2),
2642 		.radar_type = cpu_to_le16(index),
2643 
2644 #define __req_field_u8(field) .field = pattern->field
2645 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2646 		__req_field_u8(enb),
2647 		__req_field_u8(stgr),
2648 		__req_field_u8(min_crpn),
2649 		__req_field_u8(max_crpn),
2650 		__req_field_u8(min_crpr),
2651 		__req_field_u8(min_pw),
2652 		__req_field_u32(min_pri),
2653 		__req_field_u32(max_pri),
2654 		__req_field_u8(max_pw),
2655 		__req_field_u8(min_crbn),
2656 		__req_field_u8(max_crbn),
2657 		__req_field_u8(min_stgpn),
2658 		__req_field_u8(max_stgpn),
2659 		__req_field_u8(min_stgpr),
2660 		__req_field_u32(min_stgpr_diff),
2661 #undef __req_field_u8
2662 #undef __req_field_u32
2663 	};
2664 
2665 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2666 				 sizeof(req), true);
2667 }
2668 
2669 static int
2670 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2671 				 struct cfg80211_chan_def *chandef,
2672 				 int cmd)
2673 {
2674 	struct mt7915_dev *dev = phy->dev;
2675 	struct mt76_phy *mphy = phy->mt76;
2676 	struct ieee80211_channel *chan = mphy->chandef.chan;
2677 	int freq = mphy->chandef.center_freq1;
2678 	struct mt7915_mcu_background_chain_ctrl req = {
2679 		.monitor_scan_type = 2, /* simple rx */
2680 	};
2681 
2682 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2683 		return -EINVAL;
2684 
2685 	if (!cfg80211_chandef_valid(&mphy->chandef))
2686 		return -EINVAL;
2687 
2688 	switch (cmd) {
2689 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2690 		req.chan = chan->hw_value;
2691 		req.central_chan = ieee80211_frequency_to_channel(freq);
2692 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2693 		req.monitor_chan = chandef->chan->hw_value;
2694 		req.monitor_central_chan =
2695 			ieee80211_frequency_to_channel(chandef->center_freq1);
2696 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2697 		req.band_idx = phy->mt76->band_idx;
2698 		req.scan_mode = 1;
2699 		break;
2700 	}
2701 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2702 		req.monitor_chan = chandef->chan->hw_value;
2703 		req.monitor_central_chan =
2704 			ieee80211_frequency_to_channel(chandef->center_freq1);
2705 		req.band_idx = phy->mt76->band_idx;
2706 		req.scan_mode = 2;
2707 		break;
2708 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2709 		req.chan = chan->hw_value;
2710 		req.central_chan = ieee80211_frequency_to_channel(freq);
2711 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2712 		req.tx_stream = hweight8(mphy->antenna_mask);
2713 		req.rx_stream = mphy->antenna_mask;
2714 		break;
2715 	default:
2716 		return -EINVAL;
2717 	}
2718 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2719 
2720 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2721 				 &req, sizeof(req), false);
2722 }
2723 
2724 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2725 				     struct cfg80211_chan_def *chandef)
2726 {
2727 	struct mt7915_dev *dev = phy->dev;
2728 	int err, region, rdd_idx;
2729 
2730 	rdd_idx = mt7915_get_rdd_idx(phy, true);
2731 	if (rdd_idx < 0)
2732 		return -EINVAL;
2733 
2734 	if (!chandef) { /* disable offchain */
2735 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, rdd_idx, 0, 0);
2736 		if (err)
2737 			return err;
2738 
2739 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2740 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2741 	}
2742 
2743 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2744 					       CH_SWITCH_BACKGROUND_SCAN_START);
2745 	if (err)
2746 		return err;
2747 
2748 	switch (dev->mt76.region) {
2749 	case NL80211_DFS_ETSI:
2750 		region = 0;
2751 		break;
2752 	case NL80211_DFS_JP:
2753 		region = 2;
2754 		break;
2755 	case NL80211_DFS_FCC:
2756 	default:
2757 		region = 1;
2758 		break;
2759 	}
2760 
2761 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, rdd_idx, 0, region);
2762 }
2763 
2764 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2765 {
2766 	static const u8 ch_band[] = {
2767 		[NL80211_BAND_2GHZ] = 0,
2768 		[NL80211_BAND_5GHZ] = 1,
2769 		[NL80211_BAND_6GHZ] = 2,
2770 	};
2771 	struct mt7915_dev *dev = phy->dev;
2772 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2773 	int freq1 = chandef->center_freq1;
2774 	u8 band = phy->mt76->band_idx;
2775 	struct {
2776 		u8 control_ch;
2777 		u8 center_ch;
2778 		u8 bw;
2779 		u8 tx_path_num;
2780 		u8 rx_path;	/* mask or num */
2781 		u8 switch_reason;
2782 		u8 band_idx;
2783 		u8 center_ch2;	/* for 80+80 only */
2784 		__le16 cac_case;
2785 		u8 channel_band;
2786 		u8 rsv0;
2787 		__le32 outband_freq;
2788 		u8 txpower_drop;
2789 		u8 ap_bw;
2790 		u8 ap_center_ch;
2791 		u8 rsv1[57];
2792 	} __packed req = {
2793 		.control_ch = chandef->chan->hw_value,
2794 		.center_ch = ieee80211_frequency_to_channel(freq1),
2795 		.bw = mt76_connac_chan_bw(chandef),
2796 		.tx_path_num = hweight16(phy->mt76->chainmask),
2797 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2798 		.band_idx = band,
2799 		.channel_band = ch_band[chandef->chan->band],
2800 	};
2801 
2802 #ifdef CONFIG_NL80211_TESTMODE
2803 	if (phy->mt76->test.tx_antenna_mask &&
2804 	    mt76_testmode_enabled(phy->mt76)) {
2805 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2806 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2807 	}
2808 #endif
2809 
2810 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2811 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2812 
2813 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
2814 		req.switch_reason = CH_SWITCH_NORMAL;
2815 	else if (phy->mt76->offchannel ||
2816 		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
2817 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2818 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2819 					  NL80211_IFTYPE_AP))
2820 		req.switch_reason = CH_SWITCH_DFS;
2821 	else
2822 		req.switch_reason = CH_SWITCH_NORMAL;
2823 
2824 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2825 		req.rx_path = hweight8(req.rx_path);
2826 
2827 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2828 		int freq2 = chandef->center_freq2;
2829 
2830 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2831 	}
2832 
2833 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2834 }
2835 
2836 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2837 {
2838 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2839 #define PAGE_IDX_MASK		GENMASK(4, 2)
2840 #define PER_PAGE_SIZE		0x400
2841 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2842 	u16 eeprom_size = mt7915_eeprom_size(dev);
2843 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2844 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2845 	int eep_len;
2846 	int i;
2847 
2848 	for (i = 0; i < total; i++, eep += eep_len) {
2849 		struct sk_buff *skb;
2850 		int ret;
2851 
2852 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2853 			eep_len = eeprom_size % PER_PAGE_SIZE;
2854 		else
2855 			eep_len = PER_PAGE_SIZE;
2856 
2857 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2858 					 sizeof(req) + eep_len);
2859 		if (!skb)
2860 			return -ENOMEM;
2861 
2862 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2863 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2864 		req.len = cpu_to_le16(eep_len);
2865 
2866 		skb_put_data(skb, &req, sizeof(req));
2867 		skb_put_data(skb, eep, eep_len);
2868 
2869 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2870 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2871 		if (ret)
2872 			return ret;
2873 	}
2874 
2875 	return 0;
2876 }
2877 
2878 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2879 {
2880 	struct mt7915_mcu_eeprom req = {
2881 		.buffer_mode = EE_MODE_EFUSE,
2882 		.format = EE_FORMAT_WHOLE,
2883 	};
2884 
2885 	if (dev->flash_mode)
2886 		return mt7915_mcu_set_eeprom_flash(dev);
2887 
2888 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2889 				 &req, sizeof(req), true);
2890 }
2891 
2892 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
2893 {
2894 	struct mt7915_mcu_eeprom_info req = {
2895 		.addr = cpu_to_le32(round_down(offset,
2896 				    MT7915_EEPROM_BLOCK_SIZE)),
2897 	};
2898 	struct mt7915_mcu_eeprom_info *res;
2899 	struct sk_buff *skb;
2900 	u8 *buf = read_buf;
2901 	int ret;
2902 
2903 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2904 					MCU_EXT_QUERY(EFUSE_ACCESS),
2905 					&req, sizeof(req), true, &skb);
2906 	if (ret)
2907 		return ret;
2908 
2909 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2910 	if (!buf)
2911 		buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2912 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2913 
2914 	dev_kfree_skb(skb);
2915 
2916 	return 0;
2917 }
2918 
2919 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2920 {
2921 	struct {
2922 		u8 _rsv;
2923 		u8 version;
2924 		u8 die_idx;
2925 		u8 _rsv2;
2926 	} __packed req = {
2927 		.version = 1,
2928 	};
2929 	struct sk_buff *skb;
2930 	int ret;
2931 
2932 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2933 					MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
2934 					&req, sizeof(req), true, &skb);
2935 	if (ret)
2936 		return ret;
2937 
2938 	*block_num = *(u8 *)skb->data;
2939 	dev_kfree_skb(skb);
2940 
2941 	return 0;
2942 }
2943 
2944 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2945 				  u8 *data, u32 len, int cmd)
2946 {
2947 	struct {
2948 		u8 dir;
2949 		u8 valid;
2950 		__le16 bitmap;
2951 		s8 precal;
2952 		u8 action;
2953 		u8 band;
2954 		u8 idx;
2955 		u8 rsv[4];
2956 		__le32 len;
2957 	} req = {};
2958 	struct sk_buff *skb;
2959 
2960 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2961 	if (!skb)
2962 		return -ENOMEM;
2963 
2964 	req.idx = idx;
2965 	req.len = cpu_to_le32(len);
2966 	skb_put_data(skb, &req, sizeof(req));
2967 	skb_put_data(skb, data, len);
2968 
2969 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2970 }
2971 
2972 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2973 {
2974 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2975 	u32 total = mt7915_get_cal_group_size(dev);
2976 	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
2977 
2978 	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
2979 		return 0;
2980 
2981 	/*
2982 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2983 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2984 	 */
2985 	while (total > 0) {
2986 		int ret, len;
2987 
2988 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2989 
2990 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2991 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2992 		if (ret)
2993 			return ret;
2994 
2995 		total -= len;
2996 		cal += len;
2997 		idx++;
2998 	}
2999 
3000 	return 0;
3001 }
3002 
3003 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3004 {
3005 	int i;
3006 
3007 	for (i = 0; i < n_freqs; i++)
3008 		if (cur == freqs[i])
3009 			return i;
3010 
3011 	return -1;
3012 }
3013 
3014 static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
3015 {
3016 	static const u16 freq_list_v1[] = {
3017 		5180, 5200, 5220, 5240,
3018 		5260, 5280, 5300, 5320,
3019 		5500, 5520, 5540, 5560,
3020 		5580, 5600, 5620, 5640,
3021 		5660, 5680, 5700, 5745,
3022 		5765, 5785, 5805, 5825
3023 	};
3024 	static const u16 freq_list_v2[] = {
3025 		/* 6G BW20*/
3026 		5955, 5975, 5995, 6015,
3027 		6035, 6055, 6075, 6095,
3028 		6115, 6135, 6155, 6175,
3029 		6195, 6215, 6235, 6255,
3030 		6275, 6295, 6315, 6335,
3031 		6355, 6375, 6395, 6415,
3032 		6435, 6455, 6475, 6495,
3033 		6515, 6535, 6555, 6575,
3034 		6595, 6615, 6635, 6655,
3035 		6675, 6695, 6715, 6735,
3036 		6755, 6775, 6795, 6815,
3037 		6835, 6855, 6875, 6895,
3038 		6915, 6935, 6955, 6975,
3039 		6995, 7015, 7035, 7055,
3040 		7075, 7095, 7115,
3041 		/* 6G BW160 */
3042 		6025, 6185, 6345, 6505,
3043 		6665, 6825, 6985,
3044 		/* 5G BW20 */
3045 		5180, 5200, 5220, 5240,
3046 		5260, 5280, 5300, 5320,
3047 		5500, 5520, 5540, 5560,
3048 		5580, 5600, 5620, 5640,
3049 		5660, 5680, 5700, 5720,
3050 		5745, 5765, 5785, 5805,
3051 		5825, 5845, 5865, 5885,
3052 		/* 5G BW160 */
3053 		5250, 5570, 5815
3054 	};
3055 	const u16 *freq_list;
3056 	int idx, n_freqs;
3057 
3058 	if (!is_mt7915(&dev->mt76)) {
3059 		freq_list = freq_list_v2;
3060 		n_freqs = ARRAY_SIZE(freq_list_v2);
3061 	} else {
3062 		freq_list = freq_list_v1;
3063 		n_freqs = ARRAY_SIZE(freq_list_v1);
3064 	}
3065 
3066 	if (freq < 4000) {
3067 		if (freq < 2432)
3068 			return n_freqs;
3069 		if (freq < 2457)
3070 			return n_freqs + 1;
3071 
3072 		return n_freqs + 2;
3073 	}
3074 
3075 	if (bw == NL80211_CHAN_WIDTH_80P80)
3076 		return -1;
3077 
3078 	if (bw != NL80211_CHAN_WIDTH_20) {
3079 		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq + 10);
3080 		if (idx >= 0)
3081 			return idx;
3082 
3083 		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq - 10);
3084 		if (idx >= 0)
3085 			return idx;
3086 	}
3087 
3088 	return mt7915_find_freq_idx(freq_list, n_freqs, freq);
3089 }
3090 
3091 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3092 {
3093 	struct mt7915_dev *dev = phy->dev;
3094 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3095 	enum nl80211_band band = chandef->chan->band;
3096 	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
3097 	u16 center_freq = chandef->center_freq1;
3098 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3099 	u8 dpd_mask, cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
3100 	int idx;
3101 
3102 	switch (band) {
3103 	case NL80211_BAND_2GHZ:
3104 		dpd_mask = MT_EE_WIFI_CAL_DPD_2G;
3105 		break;
3106 	case NL80211_BAND_5GHZ:
3107 		dpd_mask = MT_EE_WIFI_CAL_DPD_5G;
3108 		break;
3109 	case NL80211_BAND_6GHZ:
3110 		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
3111 		break;
3112 	default:
3113 		dpd_mask = 0;
3114 		break;
3115 	}
3116 
3117 	if (!(eep[offs] & dpd_mask))
3118 		return 0;
3119 
3120 	idx = mt7915_dpd_freq_idx(dev, center_freq, chandef->width);
3121 	if (idx < 0)
3122 		return -EINVAL;
3123 
3124 	/* Items: Tx DPD, Tx Flatness */
3125 	idx = idx * cal_num;
3126 	cal += mt7915_get_cal_group_size(dev) + (idx * MT_EE_CAL_UNIT);
3127 
3128 	while (cal_num--) {
3129 		int ret;
3130 
3131 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3132 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3133 		if (ret)
3134 			return ret;
3135 
3136 		idx++;
3137 		cal += MT_EE_CAL_UNIT;
3138 	}
3139 
3140 	return 0;
3141 }
3142 
3143 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3144 {
3145 	struct mt76_channel_state *state = phy->mt76->chan_state;
3146 	struct mt76_channel_state *state_ts = &phy->state_ts;
3147 	struct mt7915_dev *dev = phy->dev;
3148 	struct mt7915_mcu_mib *res, req[5];
3149 	struct sk_buff *skb;
3150 	static const u32 *offs;
3151 	int i, ret, len, offs_cc;
3152 	u64 cc_tx;
3153 
3154 	/* strict order */
3155 	if (is_mt7915(&dev->mt76)) {
3156 		static const u32 chip_offs[] = {
3157 			MIB_NON_WIFI_TIME,
3158 			MIB_TX_TIME,
3159 			MIB_RX_TIME,
3160 			MIB_OBSS_AIRTIME,
3161 			MIB_TXOP_INIT_COUNT,
3162 		};
3163 		len = ARRAY_SIZE(chip_offs);
3164 		offs = chip_offs;
3165 		offs_cc = 20;
3166 	} else {
3167 		static const u32 chip_offs[] = {
3168 			MIB_NON_WIFI_TIME_V2,
3169 			MIB_TX_TIME_V2,
3170 			MIB_RX_TIME_V2,
3171 			MIB_OBSS_AIRTIME_V2
3172 		};
3173 		len = ARRAY_SIZE(chip_offs);
3174 		offs = chip_offs;
3175 		offs_cc = 0;
3176 	}
3177 
3178 	for (i = 0; i < len; i++) {
3179 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
3180 		req[i].offs = cpu_to_le32(offs[i]);
3181 	}
3182 
3183 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3184 					req, len * sizeof(req[0]), true, &skb);
3185 	if (ret)
3186 		return ret;
3187 
3188 	res = (struct mt7915_mcu_mib *)(skb->data + offs_cc);
3189 
3190 #define __res_u64(s) le64_to_cpu(res[s].data)
3191 	/* subtract Tx backoff time from Tx duration for MT7915 */
3192 	if (is_mt7915(&dev->mt76)) {
3193 		u64 backoff = (__res_u64(4) & 0xffff) * 79;  /* 16us + 9us * 7 */
3194 		cc_tx = __res_u64(1) - backoff;
3195 	} else {
3196 		cc_tx = __res_u64(1);
3197 	}
3198 
3199 	if (chan_switch)
3200 		goto out;
3201 
3202 	state->cc_tx += cc_tx - state_ts->cc_tx;
3203 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3204 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3205 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3206 			  state_ts->cc_busy;
3207 
3208 out:
3209 	state_ts->cc_tx = cc_tx;
3210 	state_ts->cc_bss_rx = __res_u64(2);
3211 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3212 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3213 #undef __res_u64
3214 
3215 	dev_kfree_skb(skb);
3216 
3217 	return 0;
3218 }
3219 
3220 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3221 {
3222 	struct mt7915_dev *dev = phy->dev;
3223 	struct {
3224 		u8 ctrl_id;
3225 		u8 action;
3226 		u8 band_idx;
3227 		u8 rsv[5];
3228 	} req = {
3229 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3230 		.band_idx = phy->mt76->band_idx,
3231 	};
3232 
3233 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3234 				 sizeof(req), true);
3235 }
3236 
3237 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3238 {
3239 	struct mt7915_dev *dev = phy->dev;
3240 	struct mt7915_mcu_thermal_ctrl req = {
3241 		.band_idx = phy->mt76->band_idx,
3242 		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
3243 	};
3244 	int level, ret;
3245 
3246 	/* set duty cycle and level */
3247 	for (level = 0; level < 4; level++) {
3248 		req.duty.duty_level = level;
3249 		req.duty.duty_cycle = state;
3250 		state /= 2;
3251 
3252 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3253 					&req, sizeof(req), false);
3254 		if (ret)
3255 			return ret;
3256 	}
3257 	return 0;
3258 }
3259 
3260 int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
3261 {
3262 	struct mt7915_dev *dev = phy->dev;
3263 	struct {
3264 		struct mt7915_mcu_thermal_ctrl ctrl;
3265 
3266 		__le32 trigger_temp;
3267 		__le32 restore_temp;
3268 		__le16 sustain_time;
3269 		u8 rsv[2];
3270 	} __packed req = {
3271 		.ctrl = {
3272 			.band_idx = phy->mt76->band_idx,
3273 			.type.protect_type = 1,
3274 			.type.trigger_type = 1,
3275 		},
3276 	};
3277 	int ret;
3278 
3279 	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3280 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3281 				&req, sizeof(req.ctrl), false);
3282 
3283 	if (ret)
3284 		return ret;
3285 
3286 	/* set high-temperature trigger threshold */
3287 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3288 	/* add a safety margin ~10 */
3289 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3290 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3291 	req.sustain_time = cpu_to_le16(10);
3292 
3293 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3294 				 &req, sizeof(req), false);
3295 }
3296 
3297 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3298 {
3299 	struct mt7915_dev *dev = phy->dev;
3300 	struct {
3301 		u8 format_id;
3302 		u8 rsv;
3303 		u8 band_idx;
3304 		s8 txpower_min;
3305 	} __packed req = {
3306 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3307 		.band_idx = phy->mt76->band_idx,
3308 		.txpower_min = txpower * 2, /* 0.5db */
3309 	};
3310 
3311 	return mt76_mcu_send_msg(&dev->mt76,
3312 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3313 				 sizeof(req), true);
3314 }
3315 
3316 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3317 				 struct ieee80211_vif *vif,
3318 				 struct ieee80211_sta *sta, s8 txpower)
3319 {
3320 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3321 	struct mt7915_dev *dev = phy->dev;
3322 	struct mt76_phy *mphy = phy->mt76;
3323 	struct {
3324 		u8 format_id;
3325 		u8 rsv[3];
3326 		u8 band_idx;
3327 		s8 txpower_max;
3328 		__le16 wcid;
3329 		s8 txpower_offs[48];
3330 	} __packed req = {
3331 		.format_id = TX_POWER_LIMIT_FRAME,
3332 		.band_idx = phy->mt76->band_idx,
3333 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3334 		.wcid = cpu_to_le16(msta->wcid.idx),
3335 	};
3336 	int ret;
3337 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3338 
3339 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku),
3340 					 TX_POWER_INFO_RATE);
3341 	if (ret)
3342 		return ret;
3343 
3344 	txpower = mt76_get_power_bound(mphy, txpower);
3345 	if (txpower > mphy->txpower_cur || txpower < 0)
3346 		return -EINVAL;
3347 
3348 	if (txpower) {
3349 		u32 offs, len, i;
3350 
3351 		if (sta->deflink.ht_cap.ht_supported) {
3352 			const u8 *sku_len = mt7915_sku_group_len;
3353 
3354 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3355 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3356 
3357 			if (sta->deflink.vht_cap.vht_supported) {
3358 				offs += len;
3359 				len = sku_len[SKU_VHT_BW20] * 4;
3360 
3361 				if (sta->deflink.he_cap.has_he) {
3362 					offs += len + sku_len[SKU_HE_RU26] * 3;
3363 					len = sku_len[SKU_HE_RU242] * 4;
3364 				}
3365 			}
3366 		} else {
3367 			return -EINVAL;
3368 		}
3369 
3370 		for (i = 0; i < len; i++, offs++)
3371 			req.txpower_offs[i] =
3372 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3373 	}
3374 
3375 	return mt76_mcu_send_msg(&dev->mt76,
3376 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3377 				 sizeof(req), true);
3378 }
3379 
3380 static void
3381 mt7915_update_txpower(struct mt7915_phy *phy, int tx_power)
3382 {
3383 	struct mt76_phy *mphy = phy->mt76;
3384 	struct ieee80211_channel *chan = mphy->main_chandef.chan;
3385 	int chain_idx, val, e2p_power_limit = 0;
3386 
3387 	if (!chan) {
3388 		mphy->txpower_cur = tx_power;
3389 		return;
3390 	}
3391 
3392 	for (chain_idx = 0; chain_idx < hweight16(mphy->chainmask); chain_idx++) {
3393 		val = mt7915_eeprom_get_target_power(phy->dev, chan, chain_idx);
3394 		val += mt7915_eeprom_get_power_delta(phy->dev, chan->band);
3395 
3396 		e2p_power_limit = max_t(int, e2p_power_limit, val);
3397 	}
3398 
3399 	if (phy->sku_limit_en)
3400 		mphy->txpower_cur = min_t(int, e2p_power_limit, tx_power);
3401 	else
3402 		mphy->txpower_cur = e2p_power_limit;
3403 }
3404 
3405 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3406 {
3407 #define TX_POWER_LIMIT_TABLE_RATE	0
3408 #define TX_POWER_LIMIT_TABLE_PATH	1
3409 	struct mt7915_dev *dev = phy->dev;
3410 	struct mt76_phy *mphy = phy->mt76;
3411 	struct ieee80211_hw *hw = mphy->hw;
3412 	struct mt7915_sku_val {
3413 		u8 format_id;
3414 		u8 limit_type;
3415 		u8 band_idx;
3416 	} __packed hdr = {
3417 		.format_id = TX_POWER_LIMIT_TABLE,
3418 		.limit_type = TX_POWER_LIMIT_TABLE_RATE,
3419 		.band_idx = phy->mt76->band_idx,
3420 	};
3421 	int i, ret, tx_power;
3422 	const u8 *len = mt7915_sku_group_len;
3423 	struct mt76_power_limits la = {};
3424 	struct sk_buff *skb;
3425 
3426 	tx_power = mt76_get_power_bound(mphy, hw->conf.power_level);
3427 	if (phy->sku_limit_en) {
3428 		tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3429 						      &la, tx_power);
3430 		mt7915_update_txpower(phy, tx_power);
3431 	} else {
3432 		mt7915_update_txpower(phy, tx_power);
3433 		return 0;
3434 	}
3435 
3436 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3437 				 sizeof(hdr) + MT7915_SKU_RATE_NUM);
3438 	if (!skb)
3439 		return -ENOMEM;
3440 
3441 	skb_put_data(skb, &hdr, sizeof(hdr));
3442 	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
3443 	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
3444 	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
3445 
3446 	/* vht */
3447 	for (i = 0; i < 4; i++) {
3448 		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
3449 		skb_put_zero(skb, 2);  /* padding */
3450 	}
3451 
3452 	/* he */
3453 	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
3454 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3455 				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
3456 	if (ret)
3457 		return ret;
3458 
3459 	/* only set per-path power table when it's configured */
3460 	if (!phy->sku_path_en)
3461 		return 0;
3462 
3463 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3464 				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
3465 	if (!skb)
3466 		return -ENOMEM;
3467 
3468 	hdr.limit_type = TX_POWER_LIMIT_TABLE_PATH;
3469 	skb_put_data(skb, &hdr, sizeof(hdr));
3470 	skb_put_data(skb, &la.path.cck, sizeof(la.path.cck));
3471 	skb_put_data(skb, &la.path.ofdm, sizeof(la.path.ofdm));
3472 	skb_put_data(skb, &la.path.ofdm_bf[1], sizeof(la.path.ofdm_bf) - 1);
3473 
3474 	/* HT20 and HT40 */
3475 	skb_put_data(skb, &la.path.ru[3], sizeof(la.path.ru[3]));
3476 	skb_put_data(skb, &la.path.ru_bf[3][1], sizeof(la.path.ru_bf[3]) - 1);
3477 	skb_put_data(skb, &la.path.ru[4], sizeof(la.path.ru[4]));
3478 	skb_put_data(skb, &la.path.ru_bf[4][1], sizeof(la.path.ru_bf[4]) - 1);
3479 
3480 	/* start from non-bf and bf fields of
3481 	 * BW20/RU242, BW40/RU484, BW80/RU996, BW160/RU2x996,
3482 	 * RU26, RU52, and RU106
3483 	 */
3484 
3485 	for (i = 0; i < 8; i++) {
3486 		bool bf = i % 2;
3487 		u8 idx = (i + 6) / 2;
3488 		s8 *buf = bf ? la.path.ru_bf[idx] : la.path.ru[idx];
3489 		/* The non-bf fields of RU26 to RU106 are special cases */
3490 		if (bf)
3491 			skb_put_data(skb, buf + 1, 9);
3492 		else
3493 			skb_put_data(skb, buf, 10);
3494 	}
3495 
3496 	for (i = 0; i < 6; i++) {
3497 		bool bf = i % 2;
3498 		u8 idx = i / 2;
3499 		s8 *buf = bf ? la.path.ru_bf[idx] : la.path.ru[idx];
3500 
3501 		skb_put_data(skb, buf, 10);
3502 	}
3503 
3504 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3505 				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
3506 }
3507 
3508 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
3509 			       u8 category)
3510 {
3511 #define RATE_POWER_INFO	2
3512 	struct mt7915_dev *dev = phy->dev;
3513 	struct {
3514 		u8 format_id;
3515 		u8 category;
3516 		u8 band_idx;
3517 		u8 _rsv;
3518 	} __packed req = {
3519 		.format_id = TX_POWER_LIMIT_INFO,
3520 		.category = category,
3521 		.band_idx = phy->mt76->band_idx,
3522 	};
3523 	struct sk_buff *skb;
3524 	int ret, i;
3525 
3526 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3527 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3528 					&req, sizeof(req), true, &skb);
3529 	if (ret)
3530 		return ret;
3531 
3532 	if (category == TX_POWER_INFO_RATE) {
3533 		s8 res[MT7915_SKU_RATE_NUM][2];
3534 
3535 		memcpy(res, skb->data + 4, sizeof(res));
3536 		for (i = 0; i < len; i++)
3537 			txpower[i] = res[i][req.band_idx];
3538 	} else if (category == TX_POWER_INFO_PATH) {
3539 		memcpy(txpower, skb->data + 4, len);
3540 	}
3541 
3542 	dev_kfree_skb(skb);
3543 
3544 	return 0;
3545 }
3546 
3547 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3548 			      u8 en)
3549 {
3550 	struct {
3551 		u8 test_mode_en;
3552 		u8 param_idx;
3553 		u8 _rsv[2];
3554 
3555 		u8 enable;
3556 		u8 _rsv2[3];
3557 
3558 		u8 pad[8];
3559 	} __packed req = {
3560 		.test_mode_en = test_mode,
3561 		.param_idx = param,
3562 		.enable = en,
3563 	};
3564 
3565 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3566 				 sizeof(req), false);
3567 }
3568 
3569 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy)
3570 {
3571 	struct mt7915_dev *dev = phy->dev;
3572 	struct mt7915_sku {
3573 		u8 format_id;
3574 		u8 sku_enable;
3575 		u8 band_idx;
3576 		u8 rsv;
3577 	} __packed req = {
3578 		.band_idx = phy->mt76->band_idx,
3579 	};
3580 	int ret;
3581 
3582 	req.sku_enable = phy->sku_limit_en;
3583 	req.format_id = TX_POWER_LIMIT_ENABLE;
3584 
3585 	ret = mt76_mcu_send_msg(&dev->mt76,
3586 				MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3587 				sizeof(req), true);
3588 	if (ret)
3589 		return ret;
3590 
3591 	req.sku_enable = phy->sku_path_en;
3592 	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
3593 
3594 	return mt76_mcu_send_msg(&dev->mt76,
3595 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3596 				 sizeof(req), true);
3597 }
3598 
3599 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3600 {
3601 	struct {
3602 		u8 action;
3603 		u8 set;
3604 		u8 band;
3605 		u8 rsv;
3606 	} req = {
3607 		.action = action,
3608 		.set = set,
3609 		.band = band,
3610 	};
3611 
3612 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3613 				 &req, sizeof(req), false);
3614 }
3615 
3616 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3617 {
3618 	struct {
3619 		u8 action;
3620 		union {
3621 			struct {
3622 				u8 snd_mode;
3623 				u8 sta_num;
3624 				u8 rsv;
3625 				u8 wlan_idx[4];
3626 				__le32 snd_period;	/* ms */
3627 			} __packed snd;
3628 			struct {
3629 				bool ebf;
3630 				bool ibf;
3631 				u8 rsv;
3632 			} __packed type;
3633 			struct {
3634 				u8 bf_num;
3635 				u8 bf_bitmap;
3636 				u8 bf_sel[8];
3637 				u8 rsv[5];
3638 			} __packed mod;
3639 		};
3640 	} __packed req = {
3641 		.action = action,
3642 	};
3643 
3644 #define MT_BF_PROCESSING	4
3645 	switch (action) {
3646 	case MT_BF_SOUNDING_ON:
3647 		req.snd.snd_mode = MT_BF_PROCESSING;
3648 		break;
3649 	case MT_BF_TYPE_UPDATE:
3650 		req.type.ebf = true;
3651 		req.type.ibf = dev->ibf;
3652 		break;
3653 	case MT_BF_MODULE_UPDATE:
3654 		req.mod.bf_num = 2;
3655 		req.mod.bf_bitmap = GENMASK(1, 0);
3656 		break;
3657 	default:
3658 		return -EINVAL;
3659 	}
3660 
3661 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3662 				 sizeof(req), true);
3663 }
3664 
3665 static int
3666 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3667 {
3668 	struct mt7915_dev *dev = phy->dev;
3669 	struct mt7915_mcu_sr_ctrl req = {
3670 		.action = action,
3671 		.argnum = 1,
3672 		.band_idx = phy->mt76->band_idx,
3673 		.val = cpu_to_le32(val),
3674 	};
3675 
3676 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3677 				 sizeof(req), true);
3678 }
3679 
3680 static int
3681 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3682 			   struct ieee80211_he_obss_pd *he_obss_pd)
3683 {
3684 	struct mt7915_dev *dev = phy->dev;
3685 	struct {
3686 		struct mt7915_mcu_sr_ctrl ctrl;
3687 		struct {
3688 			u8 pd_th_non_srg;
3689 			u8 pd_th_srg;
3690 			u8 period_offs;
3691 			u8 rcpi_src;
3692 			__le16 obss_pd_min;
3693 			__le16 obss_pd_min_srg;
3694 			u8 resp_txpwr_mode;
3695 			u8 txpwr_restrict_mode;
3696 			u8 txpwr_ref;
3697 			u8 rsv[3];
3698 		} __packed param;
3699 	} __packed req = {
3700 		.ctrl = {
3701 			.action = SPR_SET_PARAM,
3702 			.argnum = 9,
3703 			.band_idx = phy->mt76->band_idx,
3704 		},
3705 	};
3706 	int ret;
3707 	u8 max_th = 82, non_srg_max_th = 62;
3708 
3709 	/* disable firmware dynamical PD asjustment */
3710 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3711 	if (ret)
3712 		return ret;
3713 
3714 	if (he_obss_pd->sr_ctrl &
3715 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3716 		req.param.pd_th_non_srg = max_th;
3717 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3718 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3719 	else
3720 		req.param.pd_th_non_srg  = non_srg_max_th;
3721 
3722 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3723 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3724 
3725 	req.param.obss_pd_min = cpu_to_le16(82);
3726 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3727 	req.param.txpwr_restrict_mode = 2;
3728 	req.param.txpwr_ref = 21;
3729 
3730 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3731 				 sizeof(req), true);
3732 }
3733 
3734 static int
3735 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3736 			     struct ieee80211_he_obss_pd *he_obss_pd)
3737 {
3738 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3739 	struct mt7915_dev *dev = phy->dev;
3740 	u8 omac = mvif->mt76.omac_idx;
3741 	struct {
3742 		struct mt7915_mcu_sr_ctrl ctrl;
3743 		struct {
3744 			u8 omac;
3745 			u8 rsv[3];
3746 			u8 flag[20];
3747 		} __packed siga;
3748 	} __packed req = {
3749 		.ctrl = {
3750 			.action = SPR_SET_SIGA,
3751 			.argnum = 1,
3752 			.band_idx = phy->mt76->band_idx,
3753 		},
3754 		.siga = {
3755 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3756 		},
3757 	};
3758 	int ret;
3759 
3760 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3761 		req.siga.flag[req.siga.omac] = 0xf;
3762 	else
3763 		return 0;
3764 
3765 	/* switch to normal AP mode */
3766 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3767 	if (ret)
3768 		return ret;
3769 
3770 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3771 				 sizeof(req), true);
3772 }
3773 
3774 static int
3775 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3776 			       struct ieee80211_he_obss_pd *he_obss_pd)
3777 {
3778 	struct mt7915_dev *dev = phy->dev;
3779 	struct {
3780 		struct mt7915_mcu_sr_ctrl ctrl;
3781 		struct {
3782 			__le32 color_l[2];
3783 			__le32 color_h[2];
3784 			__le32 bssid_l[2];
3785 			__le32 bssid_h[2];
3786 		} __packed bitmap;
3787 	} __packed req = {
3788 		.ctrl = {
3789 			.action = SPR_SET_SRG_BITMAP,
3790 			.argnum = 4,
3791 			.band_idx = phy->mt76->band_idx,
3792 		},
3793 	};
3794 	u32 bitmap;
3795 
3796 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3797 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3798 
3799 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3800 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3801 
3802 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3803 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3804 
3805 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3806 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3807 
3808 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3809 				 sizeof(req), true);
3810 }
3811 
3812 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3813 			    struct ieee80211_he_obss_pd *he_obss_pd)
3814 {
3815 	int ret;
3816 
3817 	/* enable firmware scene detection algorithms */
3818 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3819 	if (ret)
3820 		return ret;
3821 
3822 	/* firmware dynamically adjusts PD threshold so skip manual control */
3823 	if (sr_scene_detect && !he_obss_pd->enable)
3824 		return 0;
3825 
3826 	/* enable spatial reuse */
3827 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3828 	if (ret)
3829 		return ret;
3830 
3831 	if (sr_scene_detect || !he_obss_pd->enable)
3832 		return 0;
3833 
3834 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3835 	if (ret)
3836 		return ret;
3837 
3838 	/* set SRG/non-SRG OBSS PD threshold */
3839 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3840 	if (ret)
3841 		return ret;
3842 
3843 	/* Set SR prohibit */
3844 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3845 	if (ret)
3846 		return ret;
3847 
3848 	/* set SRG BSS color/BSSID bitmap */
3849 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3850 }
3851 
3852 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3853 			   struct ieee80211_sta *sta, struct rate_info *rate)
3854 {
3855 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3856 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3857 	struct mt7915_dev *dev = phy->dev;
3858 	struct mt76_phy *mphy = phy->mt76;
3859 	struct {
3860 		u8 category;
3861 		u8 band;
3862 		__le16 wcid;
3863 	} __packed req = {
3864 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3865 		.band = mvif->mt76.band_idx,
3866 		.wcid = cpu_to_le16(msta->wcid.idx),
3867 	};
3868 	struct ieee80211_supported_band *sband;
3869 	struct mt7915_mcu_phy_rx_info *res;
3870 	struct sk_buff *skb;
3871 	int ret;
3872 	bool cck = false;
3873 
3874 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3875 					&req, sizeof(req), true, &skb);
3876 	if (ret)
3877 		return ret;
3878 
3879 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3880 
3881 	rate->mcs = res->rate;
3882 	rate->nss = res->nsts + 1;
3883 
3884 	switch (res->mode) {
3885 	case MT_PHY_TYPE_CCK:
3886 		cck = true;
3887 		fallthrough;
3888 	case MT_PHY_TYPE_OFDM:
3889 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3890 			sband = &mphy->sband_5g.sband;
3891 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3892 			sband = &mphy->sband_6g.sband;
3893 		else
3894 			sband = &mphy->sband_2g.sband;
3895 
3896 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3897 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3898 		break;
3899 	case MT_PHY_TYPE_HT:
3900 	case MT_PHY_TYPE_HT_GF:
3901 		if (rate->mcs > 31) {
3902 			ret = -EINVAL;
3903 			goto out;
3904 		}
3905 
3906 		rate->flags = RATE_INFO_FLAGS_MCS;
3907 		if (res->gi)
3908 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3909 		break;
3910 	case MT_PHY_TYPE_VHT:
3911 		if (rate->mcs > 9) {
3912 			ret = -EINVAL;
3913 			goto out;
3914 		}
3915 
3916 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3917 		if (res->gi)
3918 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3919 		break;
3920 	case MT_PHY_TYPE_HE_SU:
3921 	case MT_PHY_TYPE_HE_EXT_SU:
3922 	case MT_PHY_TYPE_HE_TB:
3923 	case MT_PHY_TYPE_HE_MU:
3924 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3925 			ret = -EINVAL;
3926 			goto out;
3927 		}
3928 		rate->he_gi = res->gi;
3929 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3930 		break;
3931 	default:
3932 		ret = -EINVAL;
3933 		goto out;
3934 	}
3935 
3936 	switch (res->bw) {
3937 	case IEEE80211_STA_RX_BW_160:
3938 		rate->bw = RATE_INFO_BW_160;
3939 		break;
3940 	case IEEE80211_STA_RX_BW_80:
3941 		rate->bw = RATE_INFO_BW_80;
3942 		break;
3943 	case IEEE80211_STA_RX_BW_40:
3944 		rate->bw = RATE_INFO_BW_40;
3945 		break;
3946 	default:
3947 		rate->bw = RATE_INFO_BW_20;
3948 		break;
3949 	}
3950 
3951 out:
3952 	dev_kfree_skb(skb);
3953 
3954 	return ret;
3955 }
3956 
3957 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3958 				struct cfg80211_he_bss_color *he_bss_color)
3959 {
3960 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3961 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3962 	struct bss_info_color *bss_color;
3963 	struct sk_buff *skb;
3964 	struct tlv *tlv;
3965 
3966 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3967 					      NULL, len);
3968 	if (IS_ERR(skb))
3969 		return PTR_ERR(skb);
3970 
3971 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3972 				      sizeof(*bss_color));
3973 	bss_color = (struct bss_info_color *)tlv;
3974 	bss_color->disable = !he_bss_color->enabled;
3975 	bss_color->color = he_bss_color->color;
3976 
3977 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3978 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3979 }
3980 
3981 #define TWT_AGRT_TRIGGER	BIT(0)
3982 #define TWT_AGRT_ANNOUNCE	BIT(1)
3983 #define TWT_AGRT_PROTECT	BIT(2)
3984 
3985 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3986 			       struct mt7915_vif *mvif,
3987 			       struct mt7915_twt_flow *flow,
3988 			       int cmd)
3989 {
3990 	struct {
3991 		u8 tbl_idx;
3992 		u8 cmd;
3993 		u8 own_mac_idx;
3994 		u8 flowid; /* 0xff for group id */
3995 		__le16 peer_id; /* specify the peer_id (msb=0)
3996 				 * or group_id (msb=1)
3997 				 */
3998 		u8 duration; /* 256 us */
3999 		u8 bss_idx;
4000 		__le64 start_tsf;
4001 		__le16 mantissa;
4002 		u8 exponent;
4003 		u8 is_ap;
4004 		u8 agrt_params;
4005 		u8 rsv[23];
4006 	} __packed req = {
4007 		.tbl_idx = flow->table_id,
4008 		.cmd = cmd,
4009 		.own_mac_idx = mvif->mt76.omac_idx,
4010 		.flowid = flow->id,
4011 		.peer_id = cpu_to_le16(flow->wcid),
4012 		.duration = flow->duration,
4013 		.bss_idx = mvif->mt76.idx,
4014 		.start_tsf = cpu_to_le64(flow->tsf),
4015 		.mantissa = flow->mantissa,
4016 		.exponent = flow->exp,
4017 		.is_ap = true,
4018 	};
4019 
4020 	if (flow->protection)
4021 		req.agrt_params |= TWT_AGRT_PROTECT;
4022 	if (!flow->flowtype)
4023 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
4024 	if (flow->trigger)
4025 		req.agrt_params |= TWT_AGRT_TRIGGER;
4026 
4027 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
4028 				 &req, sizeof(req), true);
4029 }
4030 
4031 int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
4032 {
4033 	struct {
4034 		__le32 cmd;
4035 		__le32 arg0;
4036 		__le32 arg1;
4037 		__le16 arg2;
4038 	} __packed req = {
4039 		.cmd = cpu_to_le32(0x15),
4040 	};
4041 	struct mt7915_mcu_wa_tx_stat {
4042 		__le16 wcid;
4043 		u8 __rsv2[2];
4044 
4045 		/* tx_bytes is deprecated since WA byte counter uses u32,
4046 		 * which easily leads to overflow.
4047 		 */
4048 		__le32 tx_bytes;
4049 		__le32 tx_packets;
4050 	} __packed *res;
4051 	struct mt76_wcid *wcid;
4052 	struct sk_buff *skb;
4053 	int ret, len;
4054 	u16 ret_wcid;
4055 
4056 	if (is_mt7915(&dev->mt76)) {
4057 		req.arg0 = cpu_to_le32(wlan_idx);
4058 		len = sizeof(req) - sizeof(req.arg2);
4059 	} else {
4060 		req.arg0 = cpu_to_le32(1);
4061 		req.arg2 = cpu_to_le16(wlan_idx);
4062 		len = sizeof(req);
4063 	}
4064 
4065 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
4066 					&req, len, true, &skb);
4067 	if (ret)
4068 		return ret;
4069 
4070 	if (!is_mt7915(&dev->mt76))
4071 		skb_pull(skb, 4);
4072 
4073 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
4074 
4075 	ret_wcid = le16_to_cpu(res->wcid);
4076 	if (is_mt7915(&dev->mt76))
4077 		ret_wcid &= 0xff;
4078 
4079 	if (ret_wcid != wlan_idx) {
4080 		ret = -EINVAL;
4081 		goto out;
4082 	}
4083 
4084 	rcu_read_lock();
4085 
4086 	wcid = mt76_wcid_ptr(dev, wlan_idx);
4087 	if (wcid)
4088 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
4089 	else
4090 		ret = -EINVAL;
4091 
4092 	rcu_read_unlock();
4093 out:
4094 	dev_kfree_skb(skb);
4095 
4096 	return ret;
4097 }
4098 
4099 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
4100 {
4101 	struct {
4102 		__le32 idx;
4103 		__le32 ofs;
4104 		__le32 data;
4105 	} __packed req = {
4106 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
4107 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
4108 		.data = set ? cpu_to_le32(*val) : 0,
4109 	};
4110 	struct sk_buff *skb;
4111 	int ret;
4112 
4113 	if (set)
4114 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
4115 					 &req, sizeof(req), false);
4116 
4117 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
4118 					&req, sizeof(req), true, &skb);
4119 	if (ret)
4120 		return ret;
4121 
4122 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
4123 	dev_kfree_skb(skb);
4124 
4125 	return 0;
4126 }
4127