xref: /linux/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c (revision e2c93b68cb54448c2fef24bb719a244dcef3b79e)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
70 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
71 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
72 
73 #define DL_MODE_ENCRYPT			BIT(0)
74 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
75 #define DL_MODE_RESET_SEC_IV		BIT(3)
76 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
77 #define DL_MODE_NEED_RSP		BIT(31)
78 
79 #define FW_START_OVERRIDE		BIT(0)
80 #define FW_START_WORKING_PDA_CR4	BIT(2)
81 
82 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
83 #define PATCH_SEC_TYPE_INFO		0x2
84 
85 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
86 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
87 
88 static enum mcu_cipher_type
89 mt7915_mcu_get_cipher(int cipher)
90 {
91 	switch (cipher) {
92 	case WLAN_CIPHER_SUITE_WEP40:
93 		return MCU_CIPHER_WEP40;
94 	case WLAN_CIPHER_SUITE_WEP104:
95 		return MCU_CIPHER_WEP104;
96 	case WLAN_CIPHER_SUITE_TKIP:
97 		return MCU_CIPHER_TKIP;
98 	case WLAN_CIPHER_SUITE_AES_CMAC:
99 		return MCU_CIPHER_BIP_CMAC_128;
100 	case WLAN_CIPHER_SUITE_CCMP:
101 		return MCU_CIPHER_AES_CCMP;
102 	case WLAN_CIPHER_SUITE_CCMP_256:
103 		return MCU_CIPHER_CCMP_256;
104 	case WLAN_CIPHER_SUITE_GCMP:
105 		return MCU_CIPHER_GCMP;
106 	case WLAN_CIPHER_SUITE_GCMP_256:
107 		return MCU_CIPHER_GCMP_256;
108 	case WLAN_CIPHER_SUITE_SMS4:
109 		return MCU_CIPHER_WAPI;
110 	default:
111 		return MCU_CIPHER_NONE;
112 	}
113 }
114 
115 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
116 {
117 	static const u8 width_to_bw[] = {
118 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
119 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
120 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
121 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
122 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
123 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
124 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
125 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
126 	};
127 
128 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
129 		return 0;
130 
131 	return width_to_bw[chandef->width];
132 }
133 
134 static const struct ieee80211_sta_he_cap *
135 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
136 {
137 	struct ieee80211_supported_band *sband;
138 	enum nl80211_band band;
139 
140 	band = phy->mt76->chandef.chan->band;
141 	sband = phy->mt76->hw->wiphy->bands[band];
142 
143 	return ieee80211_get_he_iftype_cap(sband, vif->type);
144 }
145 
146 static u8
147 mt7915_get_phy_mode(struct ieee80211_vif *vif, struct ieee80211_sta *sta)
148 {
149 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
150 	enum nl80211_band band = mvif->phy->mt76->chandef.chan->band;
151 	struct ieee80211_sta_ht_cap *ht_cap;
152 	struct ieee80211_sta_vht_cap *vht_cap;
153 	const struct ieee80211_sta_he_cap *he_cap;
154 	u8 mode = 0;
155 
156 	if (sta) {
157 		ht_cap = &sta->ht_cap;
158 		vht_cap = &sta->vht_cap;
159 		he_cap = &sta->he_cap;
160 	} else {
161 		struct ieee80211_supported_band *sband;
162 
163 		sband = mvif->phy->mt76->hw->wiphy->bands[band];
164 
165 		ht_cap = &sband->ht_cap;
166 		vht_cap = &sband->vht_cap;
167 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
168 	}
169 
170 	if (band == NL80211_BAND_2GHZ) {
171 		mode |= PHY_MODE_B | PHY_MODE_G;
172 
173 		if (ht_cap->ht_supported)
174 			mode |= PHY_MODE_GN;
175 
176 		if (he_cap && he_cap->has_he)
177 			mode |= PHY_MODE_AX_24G;
178 	} else if (band == NL80211_BAND_5GHZ) {
179 		mode |= PHY_MODE_A;
180 
181 		if (ht_cap->ht_supported)
182 			mode |= PHY_MODE_AN;
183 
184 		if (vht_cap->vht_supported)
185 			mode |= PHY_MODE_AC;
186 
187 		if (he_cap && he_cap->has_he)
188 			mode |= PHY_MODE_AX_5G;
189 	}
190 
191 	return mode;
192 }
193 
194 static u8
195 mt7915_mcu_get_sta_nss(u16 mcs_map)
196 {
197 	u8 nss;
198 
199 	for (nss = 8; nss > 0; nss--) {
200 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
201 
202 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
203 			break;
204 	}
205 
206 	return nss - 1;
207 }
208 
209 static void
210 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
211 			  const u16 *mask)
212 {
213 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
214 	struct cfg80211_chan_def *chandef = &msta->vif->phy->mt76->chandef;
215 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
216 	u16 mcs_map;
217 
218 	switch (chandef->width) {
219 	case NL80211_CHAN_WIDTH_80P80:
220 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80p80);
221 		break;
222 	case NL80211_CHAN_WIDTH_160:
223 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_160);
224 		break;
225 	default:
226 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80);
227 		break;
228 	}
229 
230 	for (nss = 0; nss < max_nss; nss++) {
231 		int mcs;
232 
233 		switch ((mcs_map >> (2 * nss)) & 0x3) {
234 		case IEEE80211_HE_MCS_SUPPORT_0_11:
235 			mcs = GENMASK(11, 0);
236 			break;
237 		case IEEE80211_HE_MCS_SUPPORT_0_9:
238 			mcs = GENMASK(9, 0);
239 			break;
240 		case IEEE80211_HE_MCS_SUPPORT_0_7:
241 			mcs = GENMASK(7, 0);
242 			break;
243 		default:
244 			mcs = 0;
245 		}
246 
247 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
248 
249 		switch (mcs) {
250 		case 0 ... 7:
251 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
252 			break;
253 		case 8 ... 9:
254 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
255 			break;
256 		case 10 ... 11:
257 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
258 			break;
259 		default:
260 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
261 			break;
262 		}
263 		mcs_map &= ~(0x3 << (nss * 2));
264 		mcs_map |= mcs << (nss * 2);
265 
266 		/* only support 2ss on 160MHz */
267 		if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
268 			break;
269 	}
270 
271 	*he_mcs = cpu_to_le16(mcs_map);
272 }
273 
274 static void
275 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
276 			   const u16 *mask)
277 {
278 	u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
279 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
280 	u16 mcs;
281 
282 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
283 		switch (mcs_map & 0x3) {
284 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
285 			mcs = GENMASK(9, 0);
286 			break;
287 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
288 			mcs = GENMASK(8, 0);
289 			break;
290 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
291 			mcs = GENMASK(7, 0);
292 			break;
293 		default:
294 			mcs = 0;
295 		}
296 
297 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
298 
299 		/* only support 2ss on 160MHz */
300 		if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
301 			break;
302 	}
303 }
304 
305 static void
306 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
307 			  const u8 *mask)
308 {
309 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
310 
311 	for (nss = 0; nss < max_nss; nss++)
312 		ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
313 }
314 
315 static int
316 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
317 			  struct sk_buff *skb, int seq)
318 {
319 	struct mt7915_mcu_rxd *rxd;
320 	int ret = 0;
321 
322 	if (!skb) {
323 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
324 			cmd, seq);
325 		return -ETIMEDOUT;
326 	}
327 
328 	rxd = (struct mt7915_mcu_rxd *)skb->data;
329 	if (seq != rxd->seq)
330 		return -EAGAIN;
331 
332 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
333 		skb_pull(skb, sizeof(*rxd) - 4);
334 		ret = *skb->data;
335 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
336 		skb_pull(skb, sizeof(*rxd) + 4);
337 		ret = le32_to_cpu(*(__le32 *)skb->data);
338 	} else {
339 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
340 	}
341 
342 	return ret;
343 }
344 
345 static int
346 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
347 			int cmd, int *wait_seq)
348 {
349 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
350 	struct mt7915_mcu_txd *mcu_txd;
351 	enum mt76_mcuq_id qid;
352 	__le32 *txd;
353 	u32 val;
354 	u8 seq;
355 
356 	/* TODO: make dynamic based on msg type */
357 	mdev->mcu.timeout = 20 * HZ;
358 
359 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
360 	if (!seq)
361 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
362 
363 	if (cmd == MCU_CMD(FW_SCATTER)) {
364 		qid = MT_MCUQ_FWDL;
365 		goto exit;
366 	}
367 
368 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
369 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
370 		qid = MT_MCUQ_WA;
371 	else
372 		qid = MT_MCUQ_WM;
373 
374 	txd = mcu_txd->txd;
375 
376 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
377 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
378 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
379 	txd[0] = cpu_to_le32(val);
380 
381 	val = MT_TXD1_LONG_FORMAT |
382 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
383 	txd[1] = cpu_to_le32(val);
384 
385 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
386 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
387 					       MT_TX_MCU_PORT_RX_Q0));
388 	mcu_txd->pkt_type = MCU_PKT_ID;
389 	mcu_txd->seq = seq;
390 
391 	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
392 	mcu_txd->set_query = MCU_Q_NA;
393 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
394 	if (mcu_txd->ext_cid) {
395 		mcu_txd->ext_cid_ack = 1;
396 
397 		/* do not use Q_SET for efuse */
398 		if (cmd & __MCU_CMD_FIELD_QUERY)
399 			mcu_txd->set_query = MCU_Q_QUERY;
400 		else
401 			mcu_txd->set_query = MCU_Q_SET;
402 	}
403 
404 	if (cmd & __MCU_CMD_FIELD_WA)
405 		mcu_txd->s2d_index = MCU_S2D_H2C;
406 	else
407 		mcu_txd->s2d_index = MCU_S2D_H2N;
408 
409 exit:
410 	if (wait_seq)
411 		*wait_seq = seq;
412 
413 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
414 }
415 
416 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
417 {
418 	struct {
419 		__le32 args[3];
420 	} req = {
421 		.args = {
422 			cpu_to_le32(a1),
423 			cpu_to_le32(a2),
424 			cpu_to_le32(a3),
425 		},
426 	};
427 
428 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
429 }
430 
431 static void
432 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
433 {
434 	if (vif->csa_active)
435 		ieee80211_csa_finish(vif);
436 }
437 
438 static void
439 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
440 {
441 	struct mt76_phy *mphy = &dev->mt76.phy;
442 	struct mt7915_mcu_csa_notify *c;
443 
444 	c = (struct mt7915_mcu_csa_notify *)skb->data;
445 
446 	if (c->band_idx && dev->mt76.phy2)
447 		mphy = dev->mt76.phy2;
448 
449 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
450 			IEEE80211_IFACE_ITER_RESUME_ALL,
451 			mt7915_mcu_csa_finish, mphy->hw);
452 }
453 
454 static void
455 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
456 {
457 	struct mt76_phy *mphy = &dev->mt76.phy;
458 	struct mt7915_mcu_thermal_notify *t;
459 	struct mt7915_phy *phy;
460 
461 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
462 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
463 		return;
464 
465 	if (t->ctrl.band_idx && dev->mt76.phy2)
466 		mphy = dev->mt76.phy2;
467 
468 	phy = (struct mt7915_phy *)mphy->priv;
469 	phy->throttle_state = t->ctrl.duty.duty_cycle;
470 }
471 
472 static void
473 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
474 {
475 	struct mt76_phy *mphy = &dev->mt76.phy;
476 	struct mt7915_mcu_rdd_report *r;
477 
478 	r = (struct mt7915_mcu_rdd_report *)skb->data;
479 
480 	if (r->band_idx && dev->mt76.phy2)
481 		mphy = dev->mt76.phy2;
482 
483 	ieee80211_radar_detected(mphy->hw);
484 	dev->hw_pattern++;
485 }
486 
487 static void
488 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
489 {
490 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
491 	const char *data = (char *)&rxd[1];
492 	const char *type;
493 
494 	switch (rxd->s2d_index) {
495 	case 0:
496 		type = "WM";
497 		break;
498 	case 2:
499 		type = "WA";
500 		break;
501 	default:
502 		type = "unknown";
503 		break;
504 	}
505 
506 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
507 		   (int)(skb->len - sizeof(*rxd)), data);
508 }
509 
510 static void
511 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
512 {
513 	if (!vif->color_change_active)
514 		return;
515 
516 	ieee80211_color_change_finish(vif);
517 }
518 
519 static void
520 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
521 {
522 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
523 
524 	switch (rxd->ext_eid) {
525 	case MCU_EXT_EVENT_THERMAL_PROTECT:
526 		mt7915_mcu_rx_thermal_notify(dev, skb);
527 		break;
528 	case MCU_EXT_EVENT_RDD_REPORT:
529 		mt7915_mcu_rx_radar_detected(dev, skb);
530 		break;
531 	case MCU_EXT_EVENT_CSA_NOTIFY:
532 		mt7915_mcu_rx_csa_notify(dev, skb);
533 		break;
534 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
535 		mt7915_mcu_rx_log_message(dev, skb);
536 		break;
537 	case MCU_EXT_EVENT_BCC_NOTIFY:
538 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
539 				IEEE80211_IFACE_ITER_RESUME_ALL,
540 				mt7915_mcu_cca_finish, dev);
541 		break;
542 	default:
543 		break;
544 	}
545 }
546 
547 static void
548 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
549 {
550 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
551 
552 	switch (rxd->eid) {
553 	case MCU_EVENT_EXT:
554 		mt7915_mcu_rx_ext_event(dev, skb);
555 		break;
556 	default:
557 		break;
558 	}
559 	dev_kfree_skb(skb);
560 }
561 
562 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
563 {
564 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
565 
566 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
567 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
568 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
569 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
570 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
571 	    !rxd->seq)
572 		mt7915_mcu_rx_unsolicited_event(dev, skb);
573 	else
574 		mt76_mcu_rx_event(&dev->mt76, skb);
575 }
576 
577 static struct wtbl_req_hdr *
578 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
579 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
580 {
581 	struct tlv *sta_hdr = sta_wtbl;
582 	struct wtbl_req_hdr hdr = {
583 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
584 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
585 		.operation = cmd,
586 	};
587 	struct sk_buff *nskb = *skb;
588 
589 	if (!nskb) {
590 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
591 					  MT76_CONNAC_WTBL_UPDATE_MAX_SIZE);
592 		if (!nskb)
593 			return ERR_PTR(-ENOMEM);
594 
595 		*skb = nskb;
596 	}
597 
598 	if (sta_hdr)
599 		le16_add_cpu(&sta_hdr->len, sizeof(hdr));
600 
601 	return skb_put_data(nskb, &hdr, sizeof(hdr));
602 }
603 
604 static struct tlv *
605 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
606 			  void *sta_ntlv, void *sta_wtbl)
607 {
608 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
609 	struct tlv *sta_hdr = sta_wtbl;
610 	struct tlv *ptlv, tlv = {
611 		.tag = cpu_to_le16(tag),
612 		.len = cpu_to_le16(len),
613 	};
614 	u16 ntlv;
615 
616 	ptlv = skb_put(skb, len);
617 	memcpy(ptlv, &tlv, sizeof(tlv));
618 
619 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
620 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
621 
622 	if (sta_hdr) {
623 		u16 size = le16_to_cpu(sta_hdr->len);
624 
625 		sta_hdr->len = cpu_to_le16(size + len);
626 	}
627 
628 	return ptlv;
629 }
630 
631 static struct tlv *
632 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
633 {
634 	return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
635 }
636 
637 static struct tlv *
638 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
639 			     __le16 *sub_ntlv, __le16 *len)
640 {
641 	struct tlv *ptlv, tlv = {
642 		.tag = cpu_to_le16(sub_tag),
643 		.len = cpu_to_le16(sub_len),
644 	};
645 
646 	ptlv = skb_put(skb, sub_len);
647 	memcpy(ptlv, &tlv, sizeof(tlv));
648 
649 	le16_add_cpu(sub_ntlv, 1);
650 	le16_add_cpu(len, sub_len);
651 
652 	return ptlv;
653 }
654 
655 /** bss info **/
656 static int
657 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
658 			 struct mt7915_phy *phy, bool enable)
659 {
660 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
661 	struct bss_info_basic *bss;
662 	u16 wlan_idx = mvif->sta.wcid.idx;
663 	u32 type = NETWORK_INFRA;
664 	struct tlv *tlv;
665 
666 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
667 
668 	switch (vif->type) {
669 	case NL80211_IFTYPE_MESH_POINT:
670 	case NL80211_IFTYPE_AP:
671 	case NL80211_IFTYPE_MONITOR:
672 		break;
673 	case NL80211_IFTYPE_STATION:
674 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
675 		if (enable) {
676 			struct ieee80211_sta *sta;
677 			struct mt7915_sta *msta;
678 
679 			rcu_read_lock();
680 			sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
681 			if (!sta) {
682 				rcu_read_unlock();
683 				return -EINVAL;
684 			}
685 
686 			msta = (struct mt7915_sta *)sta->drv_priv;
687 			wlan_idx = msta->wcid.idx;
688 			rcu_read_unlock();
689 		}
690 		break;
691 	case NL80211_IFTYPE_ADHOC:
692 		type = NETWORK_IBSS;
693 		break;
694 	default:
695 		WARN_ON(1);
696 		break;
697 	}
698 
699 	bss = (struct bss_info_basic *)tlv;
700 	bss->network_type = cpu_to_le32(type);
701 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
702 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
703 	bss->wmm_idx = mvif->mt76.wmm_idx;
704 	bss->active = enable;
705 
706 	if (vif->type != NL80211_IFTYPE_MONITOR) {
707 		memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
708 		bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
709 		bss->dtim_period = vif->bss_conf.dtim_period;
710 		bss->phy_mode = mt7915_get_phy_mode(vif, NULL);
711 	} else {
712 		memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
713 	}
714 
715 	return 0;
716 }
717 
718 static void
719 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
720 {
721 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
722 	struct bss_info_omac *omac;
723 	struct tlv *tlv;
724 	u32 type = 0;
725 	u8 idx;
726 
727 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
728 
729 	switch (vif->type) {
730 	case NL80211_IFTYPE_MONITOR:
731 	case NL80211_IFTYPE_MESH_POINT:
732 	case NL80211_IFTYPE_AP:
733 		type = CONNECTION_INFRA_AP;
734 		break;
735 	case NL80211_IFTYPE_STATION:
736 		type = CONNECTION_INFRA_STA;
737 		break;
738 	case NL80211_IFTYPE_ADHOC:
739 		type = CONNECTION_IBSS_ADHOC;
740 		break;
741 	default:
742 		WARN_ON(1);
743 		break;
744 	}
745 
746 	omac = (struct bss_info_omac *)tlv;
747 	idx = mvif->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0
748 						    : mvif->mt76.omac_idx;
749 	omac->conn_type = cpu_to_le32(type);
750 	omac->omac_idx = mvif->mt76.omac_idx;
751 	omac->band_idx = mvif->mt76.band_idx;
752 	omac->hw_bss_idx = idx;
753 }
754 
755 struct mt7915_he_obss_narrow_bw_ru_data {
756 	bool tolerated;
757 };
758 
759 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
760 						   struct cfg80211_bss *bss,
761 						   void *_data)
762 {
763 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
764 	const struct element *elem;
765 
766 	rcu_read_lock();
767 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
768 
769 	if (!elem || elem->datalen <= 10 ||
770 	    !(elem->data[10] &
771 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
772 		data->tolerated = false;
773 
774 	rcu_read_unlock();
775 }
776 
777 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
778 					      struct ieee80211_vif *vif)
779 {
780 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
781 		.tolerated = true,
782 	};
783 
784 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
785 		return false;
786 
787 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
788 			  mt7915_check_he_obss_narrow_bw_ru_iter,
789 			  &iter_data);
790 
791 	/*
792 	 * If there is at least one AP on radar channel that cannot
793 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
794 	 */
795 	return !iter_data.tolerated;
796 }
797 
798 static void
799 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
800 			struct mt7915_phy *phy)
801 {
802 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
803 	struct bss_info_rf_ch *ch;
804 	struct tlv *tlv;
805 	int freq1 = chandef->center_freq1;
806 
807 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
808 
809 	ch = (struct bss_info_rf_ch *)tlv;
810 	ch->pri_ch = chandef->chan->hw_value;
811 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
812 	ch->bw = mt7915_mcu_chan_bw(chandef);
813 
814 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
815 		int freq2 = chandef->center_freq2;
816 
817 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
818 	}
819 
820 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
821 		struct mt7915_dev *dev = phy->dev;
822 		struct mt76_phy *mphy = &dev->mt76.phy;
823 		bool ext_phy = phy != &dev->phy;
824 
825 		if (ext_phy && dev->mt76.phy2)
826 			mphy = dev->mt76.phy2;
827 
828 		ch->he_ru26_block =
829 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
830 		ch->he_all_disable = false;
831 	} else {
832 		ch->he_all_disable = true;
833 	}
834 }
835 
836 static void
837 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
838 		      struct mt7915_phy *phy)
839 {
840 	int max_nss = hweight8(phy->mt76->chainmask);
841 	struct bss_info_ra *ra;
842 	struct tlv *tlv;
843 
844 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
845 
846 	ra = (struct bss_info_ra *)tlv;
847 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
848 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
849 	ra->short_preamble = true;
850 	ra->tx_streams = max_nss;
851 	ra->rx_streams = max_nss;
852 	ra->algo = 4;
853 	ra->train_up_rule = 2;
854 	ra->train_up_high_thres = 110;
855 	ra->train_up_rule_rssi = -70;
856 	ra->low_traffic_thres = 2;
857 	ra->phy_cap = cpu_to_le32(0xfdf);
858 	ra->interval = cpu_to_le32(500);
859 	ra->fast_interval = cpu_to_le32(100);
860 }
861 
862 static void
863 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
864 		      struct mt7915_phy *phy)
865 {
866 #define DEFAULT_HE_PE_DURATION		4
867 #define DEFAULT_HE_DURATION_RTS_THRES	1023
868 	const struct ieee80211_sta_he_cap *cap;
869 	struct bss_info_he *he;
870 	struct tlv *tlv;
871 
872 	cap = mt7915_get_he_phy_cap(phy, vif);
873 
874 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
875 
876 	he = (struct bss_info_he *)tlv;
877 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
878 	if (!he->he_pe_duration)
879 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
880 
881 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
882 	if (!he->he_rts_thres)
883 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
884 
885 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
886 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
887 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
888 }
889 
890 static void
891 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
892 {
893 #define TXD_CMP_MAP1		GENMASK(15, 0)
894 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
895 	struct bss_info_hw_amsdu *amsdu;
896 	struct tlv *tlv;
897 
898 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
899 
900 	amsdu = (struct bss_info_hw_amsdu *)tlv;
901 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
902 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
903 	amsdu->trig_thres = cpu_to_le16(2);
904 	amsdu->enable = true;
905 }
906 
907 static void
908 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
909 {
910 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
911 #define BCN_TX_ESTIMATE_TIME	(4096 + 20)
912 	struct bss_info_ext_bss *ext;
913 	int ext_bss_idx, tsf_offset;
914 	struct tlv *tlv;
915 
916 	ext_bss_idx = mvif->mt76.omac_idx - EXT_BSSID_START;
917 	if (ext_bss_idx < 0)
918 		return;
919 
920 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
921 
922 	ext = (struct bss_info_ext_bss *)tlv;
923 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
924 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
925 }
926 
927 static void
928 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
929 {
930 	struct bss_info_bmc_rate *bmc;
931 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
932 	enum nl80211_band band = chandef->chan->band;
933 	struct tlv *tlv;
934 
935 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
936 
937 	bmc = (struct bss_info_bmc_rate *)tlv;
938 	if (band == NL80211_BAND_2GHZ) {
939 		bmc->short_preamble = true;
940 	} else {
941 		bmc->bc_trans = cpu_to_le16(0x2000);
942 		bmc->mc_trans = cpu_to_le16(0x2080);
943 	}
944 }
945 
946 static int
947 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
948 		       bool bssid, bool enable)
949 {
950 	struct mt7915_dev *dev = phy->dev;
951 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
952 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
953 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
954 	const u8 *addr = vif->addr;
955 	struct {
956 		u8 mode;
957 		u8 force_clear;
958 		u8 clear_bitmap[8];
959 		u8 entry_count;
960 		u8 write;
961 		u8 band;
962 
963 		u8 index;
964 		u8 bssid;
965 		u8 addr[ETH_ALEN];
966 	} __packed req = {
967 		.mode = !!mask || enable,
968 		.entry_count = 1,
969 		.write = 1,
970 		.band = phy != &dev->phy,
971 		.index = idx * 2 + bssid,
972 	};
973 
974 	if (bssid)
975 		addr = vif->bss_conf.bssid;
976 
977 	if (enable)
978 		ether_addr_copy(req.addr, addr);
979 
980 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
981 				 sizeof(req), true);
982 }
983 
984 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
985 			    struct ieee80211_vif *vif, int enable)
986 {
987 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
988 	struct mt7915_dev *dev = phy->dev;
989 	struct sk_buff *skb;
990 
991 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
992 		mt7915_mcu_muar_config(phy, vif, false, enable);
993 		mt7915_mcu_muar_config(phy, vif, true, enable);
994 	}
995 
996 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
997 					      MT7915_BSS_UPDATE_MAX_SIZE);
998 	if (IS_ERR(skb))
999 		return PTR_ERR(skb);
1000 
1001 	/* bss_omac must be first */
1002 	if (enable)
1003 		mt7915_mcu_bss_omac_tlv(skb, vif);
1004 
1005 	mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1006 
1007 	if (vif->type == NL80211_IFTYPE_MONITOR)
1008 		goto out;
1009 
1010 	if (enable) {
1011 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1012 		mt7915_mcu_bss_bmc_tlv(skb, phy);
1013 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1014 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
1015 
1016 		if (vif->bss_conf.he_support)
1017 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
1018 
1019 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
1020 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
1021 			mt7915_mcu_bss_ext_tlv(skb, mvif);
1022 	}
1023 out:
1024 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1025 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1026 }
1027 
1028 /** starec & wtbl **/
1029 static int
1030 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1031 		       struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1032 {
1033 	struct mt7915_sta_key_conf *bip = &msta->bip;
1034 	struct sta_rec_sec *sec;
1035 	struct tlv *tlv;
1036 	u32 len = sizeof(*sec);
1037 
1038 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1039 
1040 	sec = (struct sta_rec_sec *)tlv;
1041 	sec->add = cmd;
1042 
1043 	if (cmd == SET_KEY) {
1044 		struct sec_key *sec_key;
1045 		u8 cipher;
1046 
1047 		cipher = mt7915_mcu_get_cipher(key->cipher);
1048 		if (cipher == MCU_CIPHER_NONE)
1049 			return -EOPNOTSUPP;
1050 
1051 		sec_key = &sec->key[0];
1052 		sec_key->cipher_len = sizeof(*sec_key);
1053 
1054 		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
1055 			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
1056 			sec_key->key_id = bip->keyidx;
1057 			sec_key->key_len = 16;
1058 			memcpy(sec_key->key, bip->key, 16);
1059 
1060 			sec_key = &sec->key[1];
1061 			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
1062 			sec_key->cipher_len = sizeof(*sec_key);
1063 			sec_key->key_len = 16;
1064 			memcpy(sec_key->key, key->key, 16);
1065 
1066 			sec->n_cipher = 2;
1067 		} else {
1068 			sec_key->cipher_id = cipher;
1069 			sec_key->key_id = key->keyidx;
1070 			sec_key->key_len = key->keylen;
1071 			memcpy(sec_key->key, key->key, key->keylen);
1072 
1073 			if (cipher == MCU_CIPHER_TKIP) {
1074 				/* Rx/Tx MIC keys are swapped */
1075 				memcpy(sec_key->key + 16, key->key + 24, 8);
1076 				memcpy(sec_key->key + 24, key->key + 16, 8);
1077 			}
1078 
1079 			/* store key_conf for BIP batch update */
1080 			if (cipher == MCU_CIPHER_AES_CCMP) {
1081 				memcpy(bip->key, key->key, key->keylen);
1082 				bip->keyidx = key->keyidx;
1083 			}
1084 
1085 			len -= sizeof(*sec_key);
1086 			sec->n_cipher = 1;
1087 		}
1088 	} else {
1089 		len -= sizeof(sec->key);
1090 		sec->n_cipher = 0;
1091 	}
1092 	sec->len = cpu_to_le16(len);
1093 
1094 	return 0;
1095 }
1096 
1097 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1098 		       struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1099 		       enum set_key_cmd cmd)
1100 {
1101 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1102 	struct sk_buff *skb;
1103 	int ret;
1104 
1105 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1106 					    &msta->wcid);
1107 	if (IS_ERR(skb))
1108 		return PTR_ERR(skb);
1109 
1110 	ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1111 	if (ret)
1112 		return ret;
1113 
1114 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1115 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1116 }
1117 
1118 static void
1119 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1120 		      struct ieee80211_ampdu_params *params,
1121 		      bool enable, bool tx)
1122 {
1123 	struct sta_rec_ba *ba;
1124 	struct tlv *tlv;
1125 
1126 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1127 
1128 	ba = (struct sta_rec_ba *)tlv;
1129 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1130 	ba->winsize = cpu_to_le16(params->buf_size);
1131 	ba->ssn = cpu_to_le16(params->ssn);
1132 	ba->ba_en = enable << params->tid;
1133 	ba->amsdu = params->amsdu;
1134 	ba->tid = params->tid;
1135 }
1136 
1137 static void
1138 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1139 		       struct ieee80211_ampdu_params *params,
1140 		       bool enable, bool tx, void *sta_wtbl,
1141 		       void *wtbl_tlv)
1142 {
1143 	struct wtbl_ba *ba;
1144 	struct tlv *tlv;
1145 
1146 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1147 					wtbl_tlv, sta_wtbl);
1148 
1149 	ba = (struct wtbl_ba *)tlv;
1150 	ba->tid = params->tid;
1151 
1152 	if (tx) {
1153 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1154 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1155 		ba->ba_en = enable;
1156 	} else {
1157 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1158 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1159 		ba->rst_ba_tid = params->tid;
1160 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1161 		ba->rst_ba_sb = 1;
1162 	}
1163 
1164 	if (enable)
1165 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1166 }
1167 
1168 static int
1169 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1170 		  struct ieee80211_ampdu_params *params,
1171 		  bool enable, bool tx)
1172 {
1173 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1174 	struct mt7915_vif *mvif = msta->vif;
1175 	struct wtbl_req_hdr *wtbl_hdr;
1176 	struct tlv *sta_wtbl;
1177 	struct sk_buff *skb;
1178 	int ret;
1179 
1180 	if (enable && tx && !params->amsdu)
1181 		msta->wcid.amsdu = false;
1182 
1183 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1184 					    &msta->wcid);
1185 	if (IS_ERR(skb))
1186 		return PTR_ERR(skb);
1187 
1188 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1189 
1190 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1191 					     &skb);
1192 	if (IS_ERR(wtbl_hdr))
1193 		return PTR_ERR(wtbl_hdr);
1194 
1195 	mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1196 
1197 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1198 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1199 	if (ret)
1200 		return ret;
1201 
1202 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1203 					    &msta->wcid);
1204 	if (IS_ERR(skb))
1205 		return PTR_ERR(skb);
1206 
1207 	mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1208 
1209 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1210 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1211 }
1212 
1213 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1214 			 struct ieee80211_ampdu_params *params,
1215 			 bool enable)
1216 {
1217 	return mt7915_mcu_sta_ba(dev, params, enable, true);
1218 }
1219 
1220 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1221 			 struct ieee80211_ampdu_params *params,
1222 			 bool enable)
1223 {
1224 	return mt7915_mcu_sta_ba(dev, params, enable, false);
1225 }
1226 
1227 static void
1228 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1229 			    struct ieee80211_sta *sta, void *sta_wtbl,
1230 			    void *wtbl_tlv)
1231 {
1232 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1233 	struct wtbl_generic *generic;
1234 	struct wtbl_rx *rx;
1235 	struct tlv *tlv;
1236 
1237 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1238 					wtbl_tlv, sta_wtbl);
1239 
1240 	generic = (struct wtbl_generic *)tlv;
1241 
1242 	if (sta) {
1243 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1244 		generic->partial_aid = cpu_to_le16(sta->aid);
1245 		generic->muar_idx = mvif->mt76.omac_idx;
1246 		generic->qos = sta->wme;
1247 	} else {
1248 		/* use BSSID in station mode */
1249 		if (vif->type == NL80211_IFTYPE_STATION)
1250 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
1251 			       ETH_ALEN);
1252 		else
1253 			eth_broadcast_addr(generic->peer_addr);
1254 
1255 		generic->muar_idx = 0xe;
1256 	}
1257 
1258 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1259 					wtbl_tlv, sta_wtbl);
1260 
1261 	rx = (struct wtbl_rx *)tlv;
1262 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1263 	rx->rca2 = 1;
1264 	rx->rv = 1;
1265 }
1266 
1267 static void
1268 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1269 			 struct ieee80211_sta *sta, bool enable)
1270 {
1271 #define EXTRA_INFO_VER          BIT(0)
1272 #define EXTRA_INFO_NEW          BIT(1)
1273 	struct sta_rec_basic *basic;
1274 	struct tlv *tlv;
1275 
1276 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1277 
1278 	basic = (struct sta_rec_basic *)tlv;
1279 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1280 
1281 	if (enable) {
1282 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1283 		basic->conn_state = CONN_STATE_PORT_SECURE;
1284 	} else {
1285 		basic->conn_state = CONN_STATE_DISCONNECT;
1286 	}
1287 
1288 	if (!sta) {
1289 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1290 		eth_broadcast_addr(basic->peer_addr);
1291 		return;
1292 	}
1293 
1294 	switch (vif->type) {
1295 	case NL80211_IFTYPE_MESH_POINT:
1296 	case NL80211_IFTYPE_AP:
1297 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1298 		break;
1299 	case NL80211_IFTYPE_STATION:
1300 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1301 		break;
1302 	case NL80211_IFTYPE_ADHOC:
1303 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1304 		break;
1305 	default:
1306 		WARN_ON(1);
1307 		break;
1308 	}
1309 
1310 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1311 	basic->aid = cpu_to_le16(sta->aid);
1312 	basic->qos = sta->wme;
1313 }
1314 
1315 static void
1316 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1317 		      struct ieee80211_vif *vif)
1318 {
1319 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1320 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1321 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
1322 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
1323 	const u16 *mcs_mask = msta->vif->bitrate_mask.control[band].he_mcs;
1324 	struct sta_rec_he *he;
1325 	struct tlv *tlv;
1326 	u32 cap = 0;
1327 
1328 	if (!sta->he_cap.has_he)
1329 		return;
1330 
1331 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1332 
1333 	he = (struct sta_rec_he *)tlv;
1334 
1335 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1336 		cap |= STA_REC_HE_CAP_HTC;
1337 
1338 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1339 		cap |= STA_REC_HE_CAP_BSR;
1340 
1341 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1342 		cap |= STA_REC_HE_CAP_OM;
1343 
1344 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
1345 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1346 
1347 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1348 		cap |= STA_REC_HE_CAP_BQR;
1349 
1350 	if (elem->phy_cap_info[0] &
1351 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1352 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1353 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1354 
1355 	if (mvif->cap.ldpc && (elem->phy_cap_info[1] &
1356 			       IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
1357 		cap |= STA_REC_HE_CAP_LDPC;
1358 
1359 	if (elem->phy_cap_info[1] &
1360 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1361 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1362 
1363 	if (elem->phy_cap_info[2] &
1364 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1365 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1366 
1367 	if (elem->phy_cap_info[2] &
1368 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1369 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1370 
1371 	if (elem->phy_cap_info[2] &
1372 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1373 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1374 
1375 	if (elem->phy_cap_info[6] &
1376 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
1377 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1378 
1379 	if (elem->phy_cap_info[6] &
1380 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1381 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1382 
1383 	if (elem->phy_cap_info[7] &
1384 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1385 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1386 
1387 	if (elem->phy_cap_info[7] &
1388 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1389 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1390 
1391 	if (elem->phy_cap_info[7] &
1392 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1393 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1394 
1395 	if (elem->phy_cap_info[8] &
1396 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1397 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1398 
1399 	if (elem->phy_cap_info[8] &
1400 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1401 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1402 
1403 	if (elem->phy_cap_info[9] &
1404 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1405 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1406 
1407 	if (elem->phy_cap_info[9] &
1408 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1409 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1410 
1411 	he->he_cap = cpu_to_le32(cap);
1412 
1413 	switch (sta->bandwidth) {
1414 	case IEEE80211_STA_RX_BW_160:
1415 		if (elem->phy_cap_info[0] &
1416 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1417 			mt7915_mcu_set_sta_he_mcs(sta,
1418 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
1419 						  mcs_mask);
1420 
1421 		mt7915_mcu_set_sta_he_mcs(sta,
1422 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
1423 					  mcs_mask);
1424 		fallthrough;
1425 	default:
1426 		mt7915_mcu_set_sta_he_mcs(sta,
1427 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
1428 					  mcs_mask);
1429 		break;
1430 	}
1431 
1432 	he->t_frame_dur =
1433 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1434 	he->max_ampdu_exp =
1435 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1436 
1437 	he->bw_set =
1438 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1439 	he->device_class =
1440 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1441 	he->punc_pream_rx =
1442 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1443 
1444 	he->dcm_tx_mode =
1445 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1446 	he->dcm_tx_max_nss =
1447 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1448 	he->dcm_rx_mode =
1449 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1450 	he->dcm_rx_max_nss =
1451 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1452 	he->dcm_rx_max_nss =
1453 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1454 
1455 	he->pkt_ext = 2;
1456 }
1457 
1458 static void
1459 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1460 		     struct ieee80211_vif *vif)
1461 {
1462 	struct sta_rec_uapsd *uapsd;
1463 	struct tlv *tlv;
1464 
1465 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1466 		return;
1467 
1468 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1469 	uapsd = (struct sta_rec_uapsd *)tlv;
1470 
1471 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1472 		uapsd->dac_map |= BIT(3);
1473 		uapsd->tac_map |= BIT(3);
1474 	}
1475 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1476 		uapsd->dac_map |= BIT(2);
1477 		uapsd->tac_map |= BIT(2);
1478 	}
1479 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1480 		uapsd->dac_map |= BIT(1);
1481 		uapsd->tac_map |= BIT(1);
1482 	}
1483 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1484 		uapsd->dac_map |= BIT(0);
1485 		uapsd->tac_map |= BIT(0);
1486 	}
1487 	uapsd->max_sp = sta->max_sp;
1488 }
1489 
1490 static void
1491 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1492 			struct ieee80211_vif *vif)
1493 {
1494 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1495 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
1496 	struct sta_rec_muru *muru;
1497 	struct tlv *tlv;
1498 
1499 	if (vif->type != NL80211_IFTYPE_STATION &&
1500 	    vif->type != NL80211_IFTYPE_AP)
1501 		return;
1502 
1503 	if (!sta->vht_cap.vht_supported)
1504 		return;
1505 
1506 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1507 
1508 	muru = (struct sta_rec_muru *)tlv;
1509 
1510 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
1511 			       mvif->cap.vht_mu_ebfer ||
1512 			       mvif->cap.vht_mu_ebfee;
1513 
1514 	muru->mimo_dl.vht_mu_bfee =
1515 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1516 
1517 	if (!sta->he_cap.has_he)
1518 		return;
1519 
1520 	muru->mimo_dl.partial_bw_dl_mimo =
1521 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1522 
1523 	muru->cfg.mimo_ul_en = true;
1524 	muru->mimo_ul.full_ul_mimo =
1525 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1526 	muru->mimo_ul.partial_ul_mimo =
1527 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1528 
1529 	muru->cfg.ofdma_dl_en = true;
1530 	muru->ofdma_dl.punc_pream_rx =
1531 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1532 	muru->ofdma_dl.he_20m_in_40m_2g =
1533 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1534 	muru->ofdma_dl.he_20m_in_160m =
1535 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1536 	muru->ofdma_dl.he_80m_in_160m =
1537 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1538 
1539 	muru->ofdma_ul.t_frame_dur =
1540 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1541 	muru->ofdma_ul.mu_cascading =
1542 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1543 	muru->ofdma_ul.uo_ra =
1544 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1545 }
1546 
1547 static void
1548 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1549 {
1550 	struct sta_rec_ht *ht;
1551 	struct tlv *tlv;
1552 
1553 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1554 
1555 	ht = (struct sta_rec_ht *)tlv;
1556 	ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1557 }
1558 
1559 static void
1560 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1561 {
1562 	struct sta_rec_vht *vht;
1563 	struct tlv *tlv;
1564 
1565 	if (!sta->vht_cap.vht_supported)
1566 		return;
1567 
1568 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1569 
1570 	vht = (struct sta_rec_vht *)tlv;
1571 	vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1572 	vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1573 	vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1574 }
1575 
1576 static void
1577 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1578 			 struct ieee80211_sta *sta)
1579 {
1580 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1581 	struct sta_rec_amsdu *amsdu;
1582 	struct tlv *tlv;
1583 
1584 	if (vif->type != NL80211_IFTYPE_STATION &&
1585 	    vif->type != NL80211_IFTYPE_AP)
1586 		return;
1587 
1588 	if (!sta->max_amsdu_len)
1589 	    return;
1590 
1591 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1592 	amsdu = (struct sta_rec_amsdu *)tlv;
1593 	amsdu->max_amsdu_num = 8;
1594 	amsdu->amsdu_en = true;
1595 	amsdu->max_mpdu_size = sta->max_amsdu_len >=
1596 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
1597 	msta->wcid.amsdu = true;
1598 }
1599 
1600 static void
1601 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1602 			 void *sta_wtbl, void *wtbl_tlv)
1603 {
1604 	struct wtbl_smps *smps;
1605 	struct tlv *tlv;
1606 
1607 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1608 					wtbl_tlv, sta_wtbl);
1609 	smps = (struct wtbl_smps *)tlv;
1610 	smps->smps = (sta->smps_mode == IEEE80211_SMPS_DYNAMIC);
1611 }
1612 
1613 static void
1614 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1615 		       struct ieee80211_sta *sta, void *sta_wtbl,
1616 		       void *wtbl_tlv)
1617 {
1618 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1619 	struct wtbl_ht *ht = NULL;
1620 	struct tlv *tlv;
1621 
1622 	/* wtbl ht */
1623 	if (sta->ht_cap.ht_supported) {
1624 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1625 						wtbl_tlv, sta_wtbl);
1626 		ht = (struct wtbl_ht *)tlv;
1627 		ht->ldpc = mvif->cap.ldpc &&
1628 			   (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1629 		ht->af = sta->ht_cap.ampdu_factor;
1630 		ht->mm = sta->ht_cap.ampdu_density;
1631 		ht->ht = true;
1632 	}
1633 
1634 	/* wtbl vht */
1635 	if (sta->vht_cap.vht_supported) {
1636 		struct wtbl_vht *vht;
1637 		u8 af;
1638 
1639 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1640 						wtbl_tlv, sta_wtbl);
1641 		vht = (struct wtbl_vht *)tlv;
1642 		vht->ldpc = mvif->cap.ldpc &&
1643 			    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1644 		vht->vht = true;
1645 
1646 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1647 			       sta->vht_cap.cap);
1648 		if (ht)
1649 			ht->af = max_t(u8, ht->af, af);
1650 	}
1651 
1652 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1653 }
1654 
1655 static void
1656 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1657 			      struct ieee80211_sta *sta,
1658 			      void *sta_wtbl, void *wtbl_tlv)
1659 {
1660 	struct mt7915_sta *msta;
1661 	struct wtbl_hdr_trans *htr = NULL;
1662 	struct tlv *tlv;
1663 
1664 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1665 					wtbl_tlv, sta_wtbl);
1666 	htr = (struct wtbl_hdr_trans *)tlv;
1667 	htr->no_rx_trans = true;
1668 	if (vif->type == NL80211_IFTYPE_STATION)
1669 		htr->to_ds = true;
1670 	else
1671 		htr->from_ds = true;
1672 
1673 	if (!sta)
1674 		return;
1675 
1676 	msta = (struct mt7915_sta *)sta->drv_priv;
1677 	htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
1678 	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1679 		htr->to_ds = true;
1680 		htr->from_ds = true;
1681 	}
1682 }
1683 
1684 static int
1685 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1686 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1687 {
1688 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1689 	struct mt7915_sta *msta;
1690 	struct wtbl_req_hdr *wtbl_hdr;
1691 	struct tlv *tlv;
1692 
1693 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1694 
1695 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1696 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1697 					     tlv, &skb);
1698 	if (IS_ERR(wtbl_hdr))
1699 		return PTR_ERR(wtbl_hdr);
1700 
1701 	mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, tlv, wtbl_hdr);
1702 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, tlv, wtbl_hdr);
1703 
1704 	if (sta)
1705 		mt7915_mcu_wtbl_ht_tlv(skb, vif, sta, tlv, wtbl_hdr);
1706 
1707 	return 0;
1708 }
1709 
1710 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1711 				    struct ieee80211_vif *vif,
1712 				    struct ieee80211_sta *sta)
1713 {
1714 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1715 	struct wtbl_req_hdr *wtbl_hdr;
1716 	struct sk_buff *skb;
1717 
1718 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
1719 				 MT76_CONNAC_WTBL_UPDATE_MAX_SIZE);
1720 	if (!skb)
1721 		return -ENOMEM;
1722 
1723 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1724 	if (IS_ERR(wtbl_hdr))
1725 		return PTR_ERR(wtbl_hdr);
1726 
1727 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1728 
1729 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1730 				     true);
1731 }
1732 
1733 static inline bool
1734 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1735 			struct ieee80211_sta *sta, bool bfee)
1736 {
1737 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1738 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1739 
1740 	if (vif->type != NL80211_IFTYPE_STATION &&
1741 	    vif->type != NL80211_IFTYPE_AP)
1742 		return false;
1743 
1744 	if (!bfee && tx_ant < 2)
1745 		return false;
1746 
1747 	if (sta->he_cap.has_he) {
1748 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1749 
1750 		if (bfee)
1751 			return mvif->cap.he_su_ebfee &&
1752 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1753 		else
1754 			return mvif->cap.he_su_ebfer &&
1755 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1756 	}
1757 
1758 	if (sta->vht_cap.vht_supported) {
1759 		u32 cap = sta->vht_cap.cap;
1760 
1761 		if (bfee)
1762 			return mvif->cap.vht_su_ebfee &&
1763 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1764 		else
1765 			return mvif->cap.vht_su_ebfer &&
1766 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1767 	}
1768 
1769 	return false;
1770 }
1771 
1772 static void
1773 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1774 {
1775 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1776 	bf->ndp_rate = 0;				/* mcs0 */
1777 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1778 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1779 }
1780 
1781 static void
1782 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1783 		       struct sta_rec_bf *bf)
1784 {
1785 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1786 	u8 n = 0;
1787 
1788 	bf->tx_mode = MT_PHY_TYPE_HT;
1789 
1790 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1791 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1792 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1793 			      mcs->tx_params);
1794 	else if (mcs->rx_mask[3])
1795 		n = 3;
1796 	else if (mcs->rx_mask[2])
1797 		n = 2;
1798 	else if (mcs->rx_mask[1])
1799 		n = 1;
1800 
1801 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1802 	bf->ncol = min_t(u8, bf->nrow, n);
1803 	bf->ibf_ncol = n;
1804 }
1805 
1806 static void
1807 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1808 			struct sta_rec_bf *bf, bool explicit)
1809 {
1810 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1811 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1812 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1813 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1814 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1815 
1816 	bf->tx_mode = MT_PHY_TYPE_VHT;
1817 
1818 	if (explicit) {
1819 		u8 sts, snd_dim;
1820 
1821 		mt7915_mcu_sta_sounding_rate(bf);
1822 
1823 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1824 				pc->cap);
1825 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1826 				    vc->cap);
1827 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1828 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1829 		bf->ibf_ncol = bf->ncol;
1830 
1831 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1832 			bf->nrow = 1;
1833 	} else {
1834 		bf->nrow = tx_ant;
1835 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1836 		bf->ibf_ncol = nss_mcs;
1837 
1838 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1839 			bf->ibf_nrow = 1;
1840 	}
1841 }
1842 
1843 static void
1844 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1845 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1846 {
1847 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1848 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1849 	const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1850 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1851 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1852 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1853 	u8 snd_dim, sts;
1854 
1855 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1856 
1857 	mt7915_mcu_sta_sounding_rate(bf);
1858 
1859 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1860 				pe->phy_cap_info[6]);
1861 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1862 				pe->phy_cap_info[6]);
1863 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1864 			 ve->phy_cap_info[5]);
1865 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1866 		     pe->phy_cap_info[4]);
1867 	bf->nrow = min_t(u8, snd_dim, sts);
1868 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1869 	bf->ibf_ncol = bf->ncol;
1870 
1871 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1872 		return;
1873 
1874 	/* go over for 160MHz and 80p80 */
1875 	if (pe->phy_cap_info[0] &
1876 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1877 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1878 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1879 
1880 		bf->ncol_bw160 = nss_mcs;
1881 	}
1882 
1883 	if (pe->phy_cap_info[0] &
1884 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1885 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1886 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1887 
1888 		if (bf->ncol_bw160)
1889 			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1890 		else
1891 			bf->ncol_bw160 = nss_mcs;
1892 	}
1893 
1894 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1895 			 ve->phy_cap_info[5]);
1896 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1897 		     pe->phy_cap_info[4]);
1898 
1899 	bf->nrow_bw160 = min_t(int, snd_dim, sts);
1900 }
1901 
1902 static void
1903 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1904 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1905 {
1906 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1907 	struct mt7915_phy *phy =
1908 		mvif->mt76.band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1909 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1910 	struct sta_rec_bf *bf;
1911 	struct tlv *tlv;
1912 	const u8 matrix[4][4] = {
1913 		{0, 0, 0, 0},
1914 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1915 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1916 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1917 	};
1918 	bool ebf;
1919 
1920 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1921 	if (!ebf && !dev->ibf)
1922 		return;
1923 
1924 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1925 	bf = (struct sta_rec_bf *)tlv;
1926 
1927 	/* he: eBF only, in accordance with spec
1928 	 * vht: support eBF and iBF
1929 	 * ht: iBF only, since mac80211 lacks of eBF support
1930 	 */
1931 	if (sta->he_cap.has_he && ebf)
1932 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1933 	else if (sta->vht_cap.vht_supported)
1934 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1935 	else if (sta->ht_cap.ht_supported)
1936 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1937 	else
1938 		return;
1939 
1940 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1941 	bf->bw = sta->bandwidth;
1942 	bf->ibf_dbw = sta->bandwidth;
1943 	bf->ibf_nrow = tx_ant;
1944 
1945 	if (!ebf && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1946 		bf->ibf_timeout = 0x48;
1947 	else
1948 		bf->ibf_timeout = 0x18;
1949 
1950 	if (ebf && bf->nrow != tx_ant)
1951 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1952 	else
1953 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1954 
1955 	switch (sta->bandwidth) {
1956 	case IEEE80211_STA_RX_BW_160:
1957 	case IEEE80211_STA_RX_BW_80:
1958 		bf->mem_total = bf->mem_20m * 2;
1959 		break;
1960 	case IEEE80211_STA_RX_BW_40:
1961 		bf->mem_total = bf->mem_20m;
1962 		break;
1963 	case IEEE80211_STA_RX_BW_20:
1964 	default:
1965 		break;
1966 	}
1967 }
1968 
1969 static void
1970 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1971 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1972 {
1973 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1974 	struct mt7915_phy *phy =
1975 		mvif->mt76.band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1976 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1977 	struct sta_rec_bfee *bfee;
1978 	struct tlv *tlv;
1979 	u8 nrow = 0;
1980 
1981 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1982 		return;
1983 
1984 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1985 	bfee = (struct sta_rec_bfee *)tlv;
1986 
1987 	if (sta->he_cap.has_he) {
1988 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1989 
1990 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1991 			      pe->phy_cap_info[5]);
1992 	} else if (sta->vht_cap.vht_supported) {
1993 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1994 
1995 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1996 				 pc->cap);
1997 	}
1998 
1999 	/* reply with identity matrix to avoid 2x2 BF negative gain */
2000 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
2001 }
2002 
2003 static enum mcu_mmps_mode
2004 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
2005 {
2006 	switch (smps) {
2007 	case IEEE80211_SMPS_OFF:
2008 		return MCU_MMPS_DISABLE;
2009 	case IEEE80211_SMPS_STATIC:
2010 		return MCU_MMPS_STATIC;
2011 	case IEEE80211_SMPS_DYNAMIC:
2012 		return MCU_MMPS_DYNAMIC;
2013 	default:
2014 		return MCU_MMPS_DISABLE;
2015 	}
2016 }
2017 
2018 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
2019 				   struct ieee80211_vif *vif,
2020 				   struct ieee80211_sta *sta,
2021 				   void *data, u32 field)
2022 {
2023 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2024 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2025 	struct sta_phy *phy = data;
2026 	struct sta_rec_ra_fixed *ra;
2027 	struct sk_buff *skb;
2028 	struct tlv *tlv;
2029 
2030 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2031 					    &msta->wcid);
2032 	if (IS_ERR(skb))
2033 		return PTR_ERR(skb);
2034 
2035 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2036 	ra = (struct sta_rec_ra_fixed *)tlv;
2037 
2038 	switch (field) {
2039 	case RATE_PARAM_AUTO:
2040 		break;
2041 	case RATE_PARAM_FIXED:
2042 	case RATE_PARAM_FIXED_MCS:
2043 	case RATE_PARAM_FIXED_GI:
2044 	case RATE_PARAM_FIXED_HE_LTF:
2045 		if (phy)
2046 			ra->phy = *phy;
2047 		break;
2048 	case RATE_PARAM_MMPS_UPDATE:
2049 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
2050 		break;
2051 	default:
2052 		break;
2053 	}
2054 	ra->field = cpu_to_le32(field);
2055 
2056 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2057 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2058 }
2059 
2060 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2061 			struct ieee80211_sta *sta)
2062 {
2063 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2064 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2065 	struct wtbl_req_hdr *wtbl_hdr;
2066 	struct tlv *sta_wtbl;
2067 	struct sk_buff *skb;
2068 	int ret;
2069 
2070 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2071 					    &msta->wcid);
2072 	if (IS_ERR(skb))
2073 		return PTR_ERR(skb);
2074 
2075 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2076 
2077 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
2078 					     &skb);
2079 	if (IS_ERR(wtbl_hdr))
2080 		return PTR_ERR(wtbl_hdr);
2081 
2082 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2083 
2084 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2085 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
2086 	if (ret)
2087 		return ret;
2088 
2089 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
2090 					      RATE_PARAM_MMPS_UPDATE);
2091 }
2092 
2093 static int
2094 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
2095 			       struct ieee80211_vif *vif,
2096 			       struct ieee80211_sta *sta)
2097 {
2098 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2099 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2100 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
2101 	enum nl80211_band band = chandef->chan->band;
2102 	struct sta_phy phy = {};
2103 	int ret, nrates = 0;
2104 
2105 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _he)				\
2106 	do {									\
2107 		u8 i, gi = mask->control[band]._gi;				\
2108 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
2109 		for (i = 0; i <= sta->bandwidth; i++) {				\
2110 			phy.sgi |= gi << (i << (_he));				\
2111 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
2112 		}								\
2113 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) 	\
2114 			nrates += hweight16(mask->control[band]._mcs[i]);  	\
2115 		phy.mcs = ffs(mask->control[band]._mcs[0]) - 1;			\
2116 	} while (0)
2117 
2118 	if (sta->he_cap.has_he) {
2119 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 1);
2120 	} else if (sta->vht_cap.vht_supported) {
2121 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0);
2122 	} else if (sta->ht_cap.ht_supported) {
2123 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 0);
2124 	} else {
2125 		nrates = hweight32(mask->control[band].legacy);
2126 		phy.mcs = ffs(mask->control[band].legacy) - 1;
2127 	}
2128 #undef __sta_phy_bitrate_mask_check
2129 
2130 	/* fall back to auto rate control */
2131 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
2132 	    mask->control[band].he_gi == GENMASK(7, 0) &&
2133 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
2134 	    nrates != 1)
2135 		return 0;
2136 
2137 	/* fixed single rate */
2138 	if (nrates == 1) {
2139 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
2140 						     RATE_PARAM_FIXED_MCS);
2141 		if (ret)
2142 			return ret;
2143 	}
2144 
2145 	/* fixed GI */
2146 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
2147 	    mask->control[band].he_gi != GENMASK(7, 0)) {
2148 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2149 		u32 addr;
2150 
2151 		/* firmware updates only TXCMD but doesn't take WTBL into
2152 		 * account, so driver should update here to reflect the
2153 		 * actual txrate hardware sends out.
2154 		 */
2155 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
2156 		if (sta->he_cap.has_he)
2157 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
2158 		else
2159 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
2160 
2161 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
2162 						     RATE_PARAM_FIXED_GI);
2163 		if (ret)
2164 			return ret;
2165 	}
2166 
2167 	/* fixed HE_LTF */
2168 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
2169 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
2170 						     RATE_PARAM_FIXED_HE_LTF);
2171 		if (ret)
2172 			return ret;
2173 	}
2174 
2175 	return 0;
2176 }
2177 
2178 static void
2179 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2180 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2181 {
2182 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2183 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2184 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
2185 	enum nl80211_band band = chandef->chan->band;
2186 	struct sta_rec_ra *ra;
2187 	struct tlv *tlv;
2188 	u32 supp_rate = sta->supp_rates[band];
2189 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
2190 
2191 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2192 	ra = (struct sta_rec_ra *)tlv;
2193 
2194 	ra->valid = true;
2195 	ra->auto_rate = true;
2196 	ra->phy_mode = mt7915_get_phy_mode(vif, sta);
2197 	ra->channel = chandef->chan->hw_value;
2198 	ra->bw = sta->bandwidth;
2199 	ra->phy.bw = sta->bandwidth;
2200 
2201 	if (supp_rate) {
2202 		supp_rate &= mask->control[band].legacy;
2203 		ra->rate_len = hweight32(supp_rate);
2204 
2205 		if (band == NL80211_BAND_2GHZ) {
2206 			ra->supp_mode = MODE_CCK;
2207 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2208 
2209 			if (ra->rate_len > 4) {
2210 				ra->supp_mode |= MODE_OFDM;
2211 				ra->supp_ofdm_rate = supp_rate >> 4;
2212 			}
2213 		} else {
2214 			ra->supp_mode = MODE_OFDM;
2215 			ra->supp_ofdm_rate = supp_rate;
2216 		}
2217 	}
2218 
2219 	if (sta->ht_cap.ht_supported) {
2220 		ra->supp_mode |= MODE_HT;
2221 		ra->af = sta->ht_cap.ampdu_factor;
2222 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2223 
2224 		cap |= STA_CAP_HT;
2225 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2226 			cap |= STA_CAP_SGI_20;
2227 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2228 			cap |= STA_CAP_SGI_40;
2229 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2230 			cap |= STA_CAP_TX_STBC;
2231 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2232 			cap |= STA_CAP_RX_STBC;
2233 		if (mvif->cap.ldpc &&
2234 		    (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
2235 			cap |= STA_CAP_LDPC;
2236 
2237 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
2238 					  mask->control[band].ht_mcs);
2239 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2240 	}
2241 
2242 	if (sta->vht_cap.vht_supported) {
2243 		u8 af;
2244 
2245 		ra->supp_mode |= MODE_VHT;
2246 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2247 			       sta->vht_cap.cap);
2248 		ra->af = max_t(u8, ra->af, af);
2249 
2250 		cap |= STA_CAP_VHT;
2251 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2252 			cap |= STA_CAP_VHT_SGI_80;
2253 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2254 			cap |= STA_CAP_VHT_SGI_160;
2255 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2256 			cap |= STA_CAP_VHT_TX_STBC;
2257 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2258 			cap |= STA_CAP_VHT_RX_STBC;
2259 		if (mvif->cap.ldpc &&
2260 		    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
2261 			cap |= STA_CAP_VHT_LDPC;
2262 
2263 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
2264 					   mask->control[band].vht_mcs);
2265 	}
2266 
2267 	if (sta->he_cap.has_he) {
2268 		ra->supp_mode |= MODE_HE;
2269 		cap |= STA_CAP_HE;
2270 	}
2271 
2272 	ra->sta_cap = cpu_to_le32(cap);
2273 }
2274 
2275 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2276 			     struct ieee80211_sta *sta, bool changed)
2277 {
2278 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2279 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2280 	struct sk_buff *skb;
2281 	int ret;
2282 
2283 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2284 					    &msta->wcid);
2285 	if (IS_ERR(skb))
2286 		return PTR_ERR(skb);
2287 
2288 	/* firmware rc algorithm refers to sta_rec_he for HE control.
2289 	 * once dev->rc_work changes the settings driver should also
2290 	 * update sta_rec_he here.
2291 	 */
2292 	if (sta->he_cap.has_he && changed)
2293 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
2294 
2295 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
2296 	 * i.e 0-{7,8,9} for VHT.
2297 	 */
2298 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2299 
2300 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2301 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
2302 	if (ret)
2303 		return ret;
2304 
2305 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
2306 	 * and updates as peer fixed rate parameters, which overrides
2307 	 * sta_rec_ra and firmware rate control algorithm.
2308 	 */
2309 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
2310 }
2311 
2312 static int
2313 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2314 		     struct ieee80211_sta *sta)
2315 {
2316 #define MT_STA_BSS_GROUP		1
2317 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2318 	struct mt7915_sta *msta;
2319 	struct {
2320 		__le32 action;
2321 		u8 wlan_idx_lo;
2322 		u8 status;
2323 		u8 wlan_idx_hi;
2324 		u8 rsv0[5];
2325 		__le32 val;
2326 		u8 rsv1[8];
2327 	} __packed req = {
2328 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
2329 		.val = cpu_to_le32(mvif->mt76.idx % 16),
2330 	};
2331 
2332 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2333 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
2334 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
2335 
2336 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
2337 				 sizeof(req), true);
2338 }
2339 
2340 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2341 		       struct ieee80211_sta *sta, bool enable)
2342 {
2343 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2344 	struct mt7915_sta *msta;
2345 	struct sk_buff *skb;
2346 	int ret;
2347 
2348 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2349 
2350 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2351 					    &msta->wcid);
2352 	if (IS_ERR(skb))
2353 		return PTR_ERR(skb);
2354 
2355 	/* starec basic */
2356 	mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2357 	if (!enable)
2358 		goto out;
2359 
2360 	/* tag order is in accordance with firmware dependency. */
2361 	if (sta && sta->ht_cap.ht_supported) {
2362 		/* starec bfer */
2363 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
2364 		/* starec ht */
2365 		mt7915_mcu_sta_ht_tlv(skb, sta);
2366 		/* starec vht */
2367 		mt7915_mcu_sta_vht_tlv(skb, sta);
2368 		/* starec uapsd */
2369 		mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
2370 	}
2371 
2372 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
2373 	if (ret)
2374 		return ret;
2375 
2376 	if (sta && sta->ht_cap.ht_supported) {
2377 		/* starec amsdu */
2378 		mt7915_mcu_sta_amsdu_tlv(skb, vif, sta);
2379 		/* starec he */
2380 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
2381 		/* starec muru */
2382 		mt7915_mcu_sta_muru_tlv(skb, sta, vif);
2383 		/* starec bfee */
2384 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
2385 	}
2386 
2387 	ret = mt7915_mcu_add_group(dev, vif, sta);
2388 	if (ret)
2389 		return ret;
2390 out:
2391 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2392 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2393 }
2394 
2395 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2396 			    struct ieee80211_vif *vif, bool enable)
2397 {
2398 	struct mt7915_dev *dev = phy->dev;
2399 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2400 	struct {
2401 		struct req_hdr {
2402 			u8 omac_idx;
2403 			u8 dbdc_idx;
2404 			__le16 tlv_num;
2405 			u8 is_tlv_append;
2406 			u8 rsv[3];
2407 		} __packed hdr;
2408 		struct req_tlv {
2409 			__le16 tag;
2410 			__le16 len;
2411 			u8 active;
2412 			u8 dbdc_idx;
2413 			u8 omac_addr[ETH_ALEN];
2414 		} __packed tlv;
2415 	} data = {
2416 		.hdr = {
2417 			.omac_idx = mvif->mt76.omac_idx,
2418 			.dbdc_idx = mvif->mt76.band_idx,
2419 			.tlv_num = cpu_to_le16(1),
2420 			.is_tlv_append = 1,
2421 		},
2422 		.tlv = {
2423 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2424 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2425 			.active = enable,
2426 			.dbdc_idx = mvif->mt76.band_idx,
2427 		},
2428 	};
2429 
2430 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
2431 		return mt7915_mcu_muar_config(phy, vif, false, enable);
2432 
2433 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2434 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2435 				 &data, sizeof(data), true);
2436 }
2437 
2438 static void
2439 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
2440 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
2441 			 struct ieee80211_mutable_offsets *offs)
2442 {
2443 	struct bss_info_bcn_cntdwn *info;
2444 	struct tlv *tlv;
2445 	int sub_tag;
2446 
2447 	if (!offs->cntdwn_counter_offs[0])
2448 		return;
2449 
2450 	sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
2451 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
2452 					   &bcn->sub_ntlv, &bcn->len);
2453 	info = (struct bss_info_bcn_cntdwn *)tlv;
2454 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2455 }
2456 
2457 static void
2458 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2459 		       struct sk_buff *rskb, struct sk_buff *skb,
2460 		       struct bss_info_bcn *bcn,
2461 		       struct ieee80211_mutable_offsets *offs)
2462 {
2463 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2464 	struct bss_info_bcn_cont *cont;
2465 	struct tlv *tlv;
2466 	u8 *buf;
2467 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2468 
2469 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2470 					   len, &bcn->sub_ntlv, &bcn->len);
2471 
2472 	cont = (struct bss_info_bcn_cont *)tlv;
2473 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2474 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2475 
2476 	if (offs->cntdwn_counter_offs[0]) {
2477 		u16 offset = offs->cntdwn_counter_offs[0];
2478 
2479 		if (vif->csa_active)
2480 			cont->csa_ofs = cpu_to_le16(offset - 4);
2481 		if (vif->color_change_active)
2482 			cont->bcc_ofs = cpu_to_le16(offset - 3);
2483 	}
2484 
2485 	buf = (u8 *)tlv + sizeof(*cont);
2486 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
2487 			      true);
2488 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2489 }
2490 
2491 static void
2492 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
2493 			     struct sk_buff *skb)
2494 {
2495 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2496 	struct mt7915_vif_cap *vc = &mvif->cap;
2497 	const struct ieee80211_he_cap_elem *he;
2498 	const struct ieee80211_vht_cap *vht;
2499 	const struct ieee80211_ht_cap *ht;
2500 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
2501 	const u8 *ie;
2502 	u32 len, bc;
2503 
2504 	/* Check missing configuration options to allow AP mode in mac80211
2505 	 * to remain in sync with hostapd settings, and get a subset of
2506 	 * beacon and hardware capabilities.
2507 	 */
2508 	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
2509 		return;
2510 
2511 	memset(vc, 0, sizeof(*vc));
2512 
2513 	len = skb->len - (mgmt->u.beacon.variable - skb->data);
2514 
2515 	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
2516 			      len);
2517 	if (ie && ie[1] >= sizeof(*ht)) {
2518 		ht = (void *)(ie + 2);
2519 		vc->ldpc |= !!(le16_to_cpu(ht->cap_info) &
2520 			       IEEE80211_HT_CAP_LDPC_CODING);
2521 	}
2522 
2523 	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
2524 			      len);
2525 	if (ie && ie[1] >= sizeof(*vht)) {
2526 		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
2527 
2528 		vht = (void *)(ie + 2);
2529 		bc = le32_to_cpu(vht->vht_cap_info);
2530 
2531 		vc->ldpc |= !!(bc & IEEE80211_VHT_CAP_RXLDPC);
2532 		vc->vht_su_ebfer =
2533 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
2534 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
2535 		vc->vht_su_ebfee =
2536 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
2537 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
2538 		vc->vht_mu_ebfer =
2539 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
2540 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
2541 		vc->vht_mu_ebfee =
2542 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
2543 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
2544 	}
2545 
2546 	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
2547 				  mgmt->u.beacon.variable, len);
2548 	if (ie && ie[1] >= sizeof(*he) + 1) {
2549 		const struct ieee80211_sta_he_cap *pc =
2550 			mt7915_get_he_phy_cap(phy, vif);
2551 		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
2552 
2553 		he = (void *)(ie + 3);
2554 
2555 		vc->he_su_ebfer =
2556 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
2557 			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
2558 		vc->he_su_ebfee =
2559 			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
2560 			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
2561 		vc->he_mu_ebfer =
2562 			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
2563 			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
2564 	}
2565 }
2566 
2567 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2568 			  struct ieee80211_vif *vif, int en)
2569 {
2570 #define MAX_BEACON_SIZE 512
2571 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2572 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2573 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2574 	struct ieee80211_mutable_offsets offs;
2575 	struct ieee80211_tx_info *info;
2576 	struct sk_buff *skb, *rskb;
2577 	struct tlv *tlv;
2578 	struct bss_info_bcn *bcn;
2579 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2580 
2581 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2582 					       NULL, len);
2583 	if (IS_ERR(rskb))
2584 		return PTR_ERR(rskb);
2585 
2586 	tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2587 	bcn = (struct bss_info_bcn *)tlv;
2588 	bcn->enable = en;
2589 
2590 	if (!en)
2591 		goto out;
2592 
2593 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2594 	if (!skb)
2595 		return -EINVAL;
2596 
2597 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2598 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2599 		dev_kfree_skb(skb);
2600 		return -EINVAL;
2601 	}
2602 
2603 	if (mvif->mt76.band_idx) {
2604 		info = IEEE80211_SKB_CB(skb);
2605 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2606 	}
2607 
2608 	mt7915_mcu_beacon_check_caps(phy, vif, skb);
2609 
2610 	/* TODO: subtag - 11v MBSSID */
2611 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2612 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2613 	dev_kfree_skb(skb);
2614 
2615 out:
2616 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2617 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2618 }
2619 
2620 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2621 				     u32 option)
2622 {
2623 	struct {
2624 		__le32 option;
2625 		__le32 addr;
2626 	} req = {
2627 		.option = cpu_to_le32(option),
2628 		.addr = cpu_to_le32(addr),
2629 	};
2630 
2631 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2632 				 sizeof(req), true);
2633 }
2634 
2635 static int mt7915_mcu_restart(struct mt76_dev *dev)
2636 {
2637 	struct {
2638 		u8 power_mode;
2639 		u8 rsv[3];
2640 	} req = {
2641 		.power_mode = 1,
2642 	};
2643 
2644 	return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2645 				 sizeof(req), false);
2646 }
2647 
2648 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2649 {
2650 	struct {
2651 		__le32 op;
2652 	} req = {
2653 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2654 	};
2655 
2656 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2657 				 sizeof(req), true);
2658 }
2659 
2660 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2661 {
2662 	struct {
2663 		u8 check_crc;
2664 		u8 reserved[3];
2665 	} req = {
2666 		.check_crc = 0,
2667 	};
2668 
2669 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2670 				 sizeof(req), true);
2671 }
2672 
2673 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2674 {
2675 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2676 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2677 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2678 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2679 		return -EIO;
2680 	}
2681 
2682 	/* clear irq when the driver own success */
2683 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2684 		MT_TOP_LPCR_HOST_BAND_STAT);
2685 
2686 	return 0;
2687 }
2688 
2689 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2690 				    u32 len, u32 mode)
2691 {
2692 	struct {
2693 		__le32 addr;
2694 		__le32 len;
2695 		__le32 mode;
2696 	} req = {
2697 		.addr = cpu_to_le32(addr),
2698 		.len = cpu_to_le32(len),
2699 		.mode = cpu_to_le32(mode),
2700 	};
2701 	int attr;
2702 
2703 	if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2704 		attr = MCU_CMD(PATCH_START_REQ);
2705 	else
2706 		attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2707 
2708 	return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2709 }
2710 
2711 static int mt7915_load_patch(struct mt7915_dev *dev)
2712 {
2713 	const struct mt7915_patch_hdr *hdr;
2714 	const struct firmware *fw = NULL;
2715 	const char *patch;
2716 	int i, ret, sem;
2717 
2718 	sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2719 	switch (sem) {
2720 	case PATCH_IS_DL:
2721 		return 0;
2722 	case PATCH_NOT_DL_SEM_SUCCESS:
2723 		break;
2724 	default:
2725 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2726 		return -EAGAIN;
2727 	}
2728 
2729 	patch = is_mt7915(&dev->mt76) ? MT7915_ROM_PATCH : MT7916_ROM_PATCH;
2730 	ret = request_firmware(&fw, patch, dev->mt76.dev);
2731 	if (ret)
2732 		goto out;
2733 
2734 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2735 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2736 		ret = -EINVAL;
2737 		goto out;
2738 	}
2739 
2740 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2741 
2742 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2743 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2744 
2745 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2746 		struct mt7915_patch_sec *sec;
2747 		const u8 *dl;
2748 		u32 len, addr;
2749 
2750 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2751 						  i * sizeof(*sec));
2752 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2753 		    PATCH_SEC_TYPE_INFO) {
2754 			ret = -EINVAL;
2755 			goto out;
2756 		}
2757 
2758 		addr = be32_to_cpu(sec->info.addr);
2759 		len = be32_to_cpu(sec->info.len);
2760 		dl = fw->data + be32_to_cpu(sec->offs);
2761 
2762 		ret = mt7915_mcu_init_download(dev, addr, len,
2763 					       DL_MODE_NEED_RSP);
2764 		if (ret) {
2765 			dev_err(dev->mt76.dev, "Download request failed\n");
2766 			goto out;
2767 		}
2768 
2769 		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2770 					       dl, len, 4096);
2771 		if (ret) {
2772 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2773 			goto out;
2774 		}
2775 	}
2776 
2777 	ret = mt7915_mcu_start_patch(dev);
2778 	if (ret)
2779 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2780 
2781 out:
2782 	sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2783 	switch (sem) {
2784 	case PATCH_REL_SEM_SUCCESS:
2785 		break;
2786 	default:
2787 		ret = -EAGAIN;
2788 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2789 		break;
2790 	}
2791 	release_firmware(fw);
2792 
2793 	return ret;
2794 }
2795 
2796 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2797 {
2798 	u32 ret = 0;
2799 
2800 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2801 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2802 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2803 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2804 	ret |= DL_MODE_NEED_RSP;
2805 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2806 
2807 	return ret;
2808 }
2809 
2810 static int
2811 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2812 			     const struct mt7915_fw_trailer *hdr,
2813 			     const u8 *data, bool is_wa)
2814 {
2815 	int i, offset = 0;
2816 	u32 override = 0, option = 0;
2817 
2818 	for (i = 0; i < hdr->n_region; i++) {
2819 		const struct mt7915_fw_region *region;
2820 		int err;
2821 		u32 len, addr, mode;
2822 
2823 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2824 			 (hdr->n_region - i) * sizeof(*region));
2825 		mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2826 		len = le32_to_cpu(region->len);
2827 		addr = le32_to_cpu(region->addr);
2828 
2829 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2830 			override = addr;
2831 
2832 		err = mt7915_mcu_init_download(dev, addr, len, mode);
2833 		if (err) {
2834 			dev_err(dev->mt76.dev, "Download request failed\n");
2835 			return err;
2836 		}
2837 
2838 		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2839 					       data + offset, len, 4096);
2840 		if (err) {
2841 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2842 			return err;
2843 		}
2844 
2845 		offset += len;
2846 	}
2847 
2848 	if (override)
2849 		option |= FW_START_OVERRIDE;
2850 
2851 	if (is_wa)
2852 		option |= FW_START_WORKING_PDA_CR4;
2853 
2854 	return mt7915_mcu_start_firmware(dev, override, option);
2855 }
2856 
2857 static int mt7915_load_ram(struct mt7915_dev *dev)
2858 {
2859 	const struct mt7915_fw_trailer *hdr;
2860 	const struct firmware *fw;
2861 	const char *mcu;
2862 	int ret;
2863 
2864 	mcu = is_mt7915(&dev->mt76) ? MT7915_FIRMWARE_WM : MT7916_FIRMWARE_WM;
2865 	ret = request_firmware(&fw, mcu, dev->mt76.dev);
2866 	if (ret)
2867 		return ret;
2868 
2869 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2870 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2871 		ret = -EINVAL;
2872 		goto out;
2873 	}
2874 
2875 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2876 					sizeof(*hdr));
2877 
2878 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2879 		 hdr->fw_ver, hdr->build_date);
2880 
2881 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2882 	if (ret) {
2883 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2884 		goto out;
2885 	}
2886 
2887 	release_firmware(fw);
2888 
2889 	mcu = is_mt7915(&dev->mt76) ? MT7915_FIRMWARE_WA : MT7916_FIRMWARE_WA;
2890 	ret = request_firmware(&fw, mcu, dev->mt76.dev);
2891 	if (ret)
2892 		return ret;
2893 
2894 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2895 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2896 		ret = -EINVAL;
2897 		goto out;
2898 	}
2899 
2900 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2901 					sizeof(*hdr));
2902 
2903 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2904 		 hdr->fw_ver, hdr->build_date);
2905 
2906 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2907 	if (ret) {
2908 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2909 		goto out;
2910 	}
2911 
2912 	snprintf(dev->mt76.hw->wiphy->fw_version,
2913 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2914 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2915 
2916 out:
2917 	release_firmware(fw);
2918 
2919 	return ret;
2920 }
2921 
2922 static int
2923 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2924 {
2925 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2926 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2927 
2928 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2929 			    state, 1000)) {
2930 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2931 		return -EIO;
2932 	}
2933 	return 0;
2934 }
2935 
2936 static int mt7915_load_firmware(struct mt7915_dev *dev)
2937 {
2938 	int ret;
2939 
2940 	/* make sure fw is download state */
2941 	if (mt7915_firmware_state(dev, false)) {
2942 		/* restart firmware once */
2943 		__mt76_mcu_restart(&dev->mt76);
2944 		ret = mt7915_firmware_state(dev, false);
2945 		if (ret) {
2946 			dev_err(dev->mt76.dev,
2947 				"Firmware is not ready for download\n");
2948 			return ret;
2949 		}
2950 	}
2951 
2952 	ret = mt7915_load_patch(dev);
2953 	if (ret)
2954 		return ret;
2955 
2956 	ret = mt7915_load_ram(dev);
2957 	if (ret)
2958 		return ret;
2959 
2960 	ret = mt7915_firmware_state(dev, true);
2961 	if (ret)
2962 		return ret;
2963 
2964 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2965 
2966 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2967 
2968 	return 0;
2969 }
2970 
2971 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2972 {
2973 	struct {
2974 		u8 ctrl_val;
2975 		u8 pad[3];
2976 	} data = {
2977 		.ctrl_val = ctrl
2978 	};
2979 
2980 	if (type == MCU_FW_LOG_WA)
2981 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2982 					 &data, sizeof(data), true);
2983 
2984 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2985 				 sizeof(data), true);
2986 }
2987 
2988 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2989 {
2990 	struct {
2991 		u8 ver;
2992 		u8 pad;
2993 		__le16 len;
2994 		u8 level;
2995 		u8 rsv[3];
2996 		__le32 module_idx;
2997 	} data = {
2998 		.module_idx = cpu_to_le32(module),
2999 		.level = level,
3000 	};
3001 
3002 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
3003 				 sizeof(data), false);
3004 }
3005 
3006 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
3007 {
3008 	struct {
3009 		__le32 cmd;
3010 		u8 enable;
3011 	} data = {
3012 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
3013 		.enable = enabled,
3014 	};
3015 
3016 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
3017 				sizeof(data), false);
3018 }
3019 
3020 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
3021 {
3022 	struct mt7915_dev *dev = phy->dev;
3023 	struct sk_buff *skb;
3024 	struct mt7915_mcu_muru_stats *mu_stats =
3025 				(struct mt7915_mcu_muru_stats *)ms;
3026 	int ret;
3027 
3028 	struct {
3029 		__le32 cmd;
3030 		u8 band_idx;
3031 	} req = {
3032 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
3033 		.band_idx = phy != &dev->phy,
3034 	};
3035 
3036 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
3037 					&req, sizeof(req), true, &skb);
3038 	if (ret)
3039 		return ret;
3040 
3041 	memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
3042 	dev_kfree_skb(skb);
3043 
3044 	return 0;
3045 }
3046 
3047 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
3048 {
3049 	struct {
3050 		u8 enable;
3051 		u8 _rsv[3];
3052 	} __packed req = {
3053 		.enable = enabled
3054 	};
3055 
3056 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
3057 				 sizeof(req), false);
3058 }
3059 
3060 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
3061 {
3062 	struct {
3063 		__le32 cmd;
3064 		u8 val[4];
3065 	} __packed req = {
3066 		.cmd = cpu_to_le32(cmd),
3067 	};
3068 
3069 	put_unaligned_le32(val, req.val);
3070 
3071 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
3072 				 sizeof(req), false);
3073 }
3074 
3075 static int
3076 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
3077 {
3078 #define RX_AIRTIME_FEATURE_CTRL		1
3079 #define RX_AIRTIME_BITWISE_CTRL		2
3080 #define RX_AIRTIME_CLEAR_EN	1
3081 	struct {
3082 		__le16 field;
3083 		__le16 sub_field;
3084 		__le32 set_status;
3085 		__le32 get_status;
3086 		u8 _rsv[12];
3087 
3088 		bool airtime_en;
3089 		bool mibtime_en;
3090 		bool earlyend_en;
3091 		u8 _rsv1[9];
3092 
3093 		bool airtime_clear;
3094 		bool mibtime_clear;
3095 		u8 _rsv2[98];
3096 	} __packed req = {
3097 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
3098 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
3099 		.airtime_clear = true,
3100 	};
3101 	int ret;
3102 
3103 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
3104 				sizeof(req), true);
3105 	if (ret)
3106 		return ret;
3107 
3108 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
3109 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
3110 	req.airtime_en = true;
3111 
3112 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
3113 				 sizeof(req), true);
3114 }
3115 
3116 int mt7915_mcu_init(struct mt7915_dev *dev)
3117 {
3118 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
3119 		.headroom = sizeof(struct mt7915_mcu_txd),
3120 		.mcu_skb_send_msg = mt7915_mcu_send_message,
3121 		.mcu_parse_response = mt7915_mcu_parse_response,
3122 		.mcu_restart = mt7915_mcu_restart,
3123 	};
3124 	int ret;
3125 
3126 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
3127 
3128 	/* force firmware operation mode into normal state,
3129 	 * which should be set before firmware download stage.
3130 	 */
3131 	if (is_mt7915(&dev->mt76))
3132 		mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
3133 	else
3134 		mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
3135 
3136 	ret = mt7915_driver_own(dev, 0);
3137 	if (ret)
3138 		return ret;
3139 	/* set driver own for band1 when two hif exist */
3140 	if (dev->hif2) {
3141 		ret = mt7915_driver_own(dev, 1);
3142 		if (ret)
3143 			return ret;
3144 	}
3145 
3146 	ret = mt7915_load_firmware(dev);
3147 	if (ret)
3148 		return ret;
3149 
3150 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
3151 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
3152 	if (ret)
3153 		return ret;
3154 
3155 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
3156 	if (ret)
3157 		return ret;
3158 
3159 	ret = mt7915_mcu_set_mwds(dev, 1);
3160 	if (ret)
3161 		return ret;
3162 
3163 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
3164 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
3165 	if (ret)
3166 		return ret;
3167 
3168 	ret = mt7915_mcu_init_rx_airtime(dev);
3169 	if (ret)
3170 		return ret;
3171 
3172 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
3173 				 MCU_WA_PARAM_RED, 0, 0);
3174 }
3175 
3176 void mt7915_mcu_exit(struct mt7915_dev *dev)
3177 {
3178 	__mt76_mcu_restart(&dev->mt76);
3179 	if (mt7915_firmware_state(dev, false)) {
3180 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
3181 		return;
3182 	}
3183 
3184 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
3185 	if (dev->hif2)
3186 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
3187 			MT_TOP_LPCR_HOST_FW_OWN);
3188 	skb_queue_purge(&dev->mt76.mcu.res_q);
3189 }
3190 
3191 static int
3192 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
3193 {
3194 	struct {
3195 		u8 operation;
3196 		u8 count;
3197 		u8 _rsv[2];
3198 		u8 index;
3199 		u8 enable;
3200 		__le16 etype;
3201 	} req = {
3202 		.operation = 1,
3203 		.count = 1,
3204 		.enable = 1,
3205 		.etype = cpu_to_le16(ETH_P_PAE),
3206 	};
3207 
3208 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3209 				 &req, sizeof(req), false);
3210 }
3211 
3212 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
3213 		       bool enable, bool hdr_trans)
3214 {
3215 	struct {
3216 		u8 operation;
3217 		u8 enable;
3218 		u8 check_bssid;
3219 		u8 insert_vlan;
3220 		u8 remove_vlan;
3221 		u8 tid;
3222 		u8 mode;
3223 		u8 rsv;
3224 	} __packed req_trans = {
3225 		.enable = hdr_trans,
3226 	};
3227 	struct {
3228 		u8 enable;
3229 		u8 band;
3230 		u8 rsv[2];
3231 	} __packed req_mac = {
3232 		.enable = enable,
3233 		.band = band,
3234 	};
3235 	int ret;
3236 
3237 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3238 				&req_trans, sizeof(req_trans), false);
3239 	if (ret)
3240 		return ret;
3241 
3242 	if (hdr_trans)
3243 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
3244 
3245 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
3246 				 &req_mac, sizeof(req_mac), true);
3247 }
3248 
3249 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
3250 {
3251 	struct {
3252 		__le32 cmd;
3253 		u8 band;
3254 		u8 enable;
3255 	} __packed req = {
3256 		.cmd = cpu_to_le32(SCS_ENABLE),
3257 		.band = band,
3258 		.enable = enable + 1,
3259 	};
3260 
3261 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
3262 				 sizeof(req), false);
3263 }
3264 
3265 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
3266 {
3267 	struct mt7915_dev *dev = phy->dev;
3268 	struct {
3269 		u8 prot_idx;
3270 		u8 band;
3271 		u8 rsv[2];
3272 		__le32 len_thresh;
3273 		__le32 pkt_thresh;
3274 	} __packed req = {
3275 		.prot_idx = 1,
3276 		.band = phy != &dev->phy,
3277 		.len_thresh = cpu_to_le32(val),
3278 		.pkt_thresh = cpu_to_le32(0x2),
3279 	};
3280 
3281 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
3282 				 sizeof(req), true);
3283 }
3284 
3285 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
3286 {
3287 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
3288 	u8 num = req->total;
3289 	size_t len = sizeof(*req) -
3290 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
3291 
3292 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
3293 				 len, true);
3294 }
3295 
3296 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
3297 {
3298 #define TX_CMD_MODE		1
3299 	struct mt7915_mcu_tx req = {
3300 		.valid = true,
3301 		.mode = TX_CMD_MODE,
3302 		.total = IEEE80211_NUM_ACS,
3303 	};
3304 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3305 	int ac;
3306 
3307 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3308 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3309 		struct edca *e = &req.edca[ac];
3310 
3311 		e->set = WMM_PARAM_SET;
3312 		e->queue = ac + mvif->mt76.wmm_idx * MT7915_MAX_WMM_SETS;
3313 		e->aifs = q->aifs;
3314 		e->txop = cpu_to_le16(q->txop);
3315 
3316 		if (q->cw_min)
3317 			e->cw_min = fls(q->cw_min);
3318 		else
3319 			e->cw_min = 5;
3320 
3321 		if (q->cw_max)
3322 			e->cw_max = cpu_to_le16(fls(q->cw_max));
3323 		else
3324 			e->cw_max = cpu_to_le16(10);
3325 	}
3326 
3327 	return mt7915_mcu_update_edca(dev, &req);
3328 }
3329 
3330 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3331 {
3332 #define ENTER_PM_STATE		1
3333 #define EXIT_PM_STATE		2
3334 	struct {
3335 		u8 pm_number;
3336 		u8 pm_state;
3337 		u8 bssid[ETH_ALEN];
3338 		u8 dtim_period;
3339 		u8 wlan_idx_lo;
3340 		__le16 bcn_interval;
3341 		__le32 aid;
3342 		__le32 rx_filter;
3343 		u8 band_idx;
3344 		u8 wlan_idx_hi;
3345 		u8 rsv[2];
3346 		__le32 feature;
3347 		u8 omac_idx;
3348 		u8 wmm_idx;
3349 		u8 bcn_loss_cnt;
3350 		u8 bcn_sp_duration;
3351 	} __packed req = {
3352 		.pm_number = 5,
3353 		.pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3354 		.band_idx = band,
3355 	};
3356 
3357 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3358 				 sizeof(req), true);
3359 }
3360 
3361 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3362 		       enum mt7915_rdd_cmd cmd, u8 index,
3363 		       u8 rx_sel, u8 val)
3364 {
3365 	struct {
3366 		u8 ctrl;
3367 		u8 rdd_idx;
3368 		u8 rdd_rx_sel;
3369 		u8 val;
3370 		u8 rsv[4];
3371 	} __packed req = {
3372 		.ctrl = cmd,
3373 		.rdd_idx = index,
3374 		.rdd_rx_sel = rx_sel,
3375 		.val = val,
3376 	};
3377 
3378 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3379 				 sizeof(req), true);
3380 }
3381 
3382 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3383 {
3384 	struct {
3385 		__le32 tag;
3386 		__le16 min_lpn;
3387 		u8 rsv[2];
3388 	} __packed req = {
3389 		.tag = cpu_to_le32(0x1),
3390 		.min_lpn = cpu_to_le16(val),
3391 	};
3392 
3393 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3394 				 sizeof(req), true);
3395 }
3396 
3397 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3398 			    const struct mt7915_dfs_pulse *pulse)
3399 {
3400 	struct {
3401 		__le32 tag;
3402 
3403 		__le32 max_width;		/* us */
3404 		__le32 max_pwr;			/* dbm */
3405 		__le32 min_pwr;			/* dbm */
3406 		__le32 min_stgr_pri;		/* us */
3407 		__le32 max_stgr_pri;		/* us */
3408 		__le32 min_cr_pri;		/* us */
3409 		__le32 max_cr_pri;		/* us */
3410 	} __packed req = {
3411 		.tag = cpu_to_le32(0x3),
3412 
3413 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3414 		__req_field(max_width),
3415 		__req_field(max_pwr),
3416 		__req_field(min_pwr),
3417 		__req_field(min_stgr_pri),
3418 		__req_field(max_stgr_pri),
3419 		__req_field(min_cr_pri),
3420 		__req_field(max_cr_pri),
3421 #undef __req_field
3422 	};
3423 
3424 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3425 				 sizeof(req), true);
3426 }
3427 
3428 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3429 			    const struct mt7915_dfs_pattern *pattern)
3430 {
3431 	struct {
3432 		__le32 tag;
3433 		__le16 radar_type;
3434 
3435 		u8 enb;
3436 		u8 stgr;
3437 		u8 min_crpn;
3438 		u8 max_crpn;
3439 		u8 min_crpr;
3440 		u8 min_pw;
3441 		__le32 min_pri;
3442 		__le32 max_pri;
3443 		u8 max_pw;
3444 		u8 min_crbn;
3445 		u8 max_crbn;
3446 		u8 min_stgpn;
3447 		u8 max_stgpn;
3448 		u8 min_stgpr;
3449 		u8 rsv[2];
3450 		__le32 min_stgpr_diff;
3451 	} __packed req = {
3452 		.tag = cpu_to_le32(0x2),
3453 		.radar_type = cpu_to_le16(index),
3454 
3455 #define __req_field_u8(field) .field = pattern->field
3456 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3457 		__req_field_u8(enb),
3458 		__req_field_u8(stgr),
3459 		__req_field_u8(min_crpn),
3460 		__req_field_u8(max_crpn),
3461 		__req_field_u8(min_crpr),
3462 		__req_field_u8(min_pw),
3463 		__req_field_u32(min_pri),
3464 		__req_field_u32(max_pri),
3465 		__req_field_u8(max_pw),
3466 		__req_field_u8(min_crbn),
3467 		__req_field_u8(max_crbn),
3468 		__req_field_u8(min_stgpn),
3469 		__req_field_u8(max_stgpn),
3470 		__req_field_u8(min_stgpr),
3471 		__req_field_u32(min_stgpr_diff),
3472 #undef __req_field_u8
3473 #undef __req_field_u32
3474 	};
3475 
3476 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3477 				 sizeof(req), true);
3478 }
3479 
3480 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3481 {
3482 	struct mt7915_dev *dev = phy->dev;
3483 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3484 	int freq1 = chandef->center_freq1;
3485 	bool ext_phy = phy != &dev->phy;
3486 	struct {
3487 		u8 control_ch;
3488 		u8 center_ch;
3489 		u8 bw;
3490 		u8 tx_streams_num;
3491 		u8 rx_streams;	/* mask or num */
3492 		u8 switch_reason;
3493 		u8 band_idx;
3494 		u8 center_ch2;	/* for 80+80 only */
3495 		__le16 cac_case;
3496 		u8 channel_band;
3497 		u8 rsv0;
3498 		__le32 outband_freq;
3499 		u8 txpower_drop;
3500 		u8 ap_bw;
3501 		u8 ap_center_ch;
3502 		u8 rsv1[57];
3503 	} __packed req = {
3504 		.control_ch = chandef->chan->hw_value,
3505 		.center_ch = ieee80211_frequency_to_channel(freq1),
3506 		.bw = mt7915_mcu_chan_bw(chandef),
3507 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
3508 		.rx_streams = phy->mt76->antenna_mask,
3509 		.band_idx = ext_phy,
3510 		.channel_band = chandef->chan->band,
3511 	};
3512 
3513 #ifdef CONFIG_NL80211_TESTMODE
3514 	if (phy->mt76->test.tx_antenna_mask &&
3515 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3516 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3517 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3518 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3519 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
3520 
3521 		if (ext_phy) {
3522 			req.tx_streams_num = 2;
3523 			req.rx_streams >>= 2;
3524 		}
3525 	}
3526 #endif
3527 
3528 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3529 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3530 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3531 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3532 		req.switch_reason = CH_SWITCH_DFS;
3533 	else
3534 		req.switch_reason = CH_SWITCH_NORMAL;
3535 
3536 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3537 		req.rx_streams = hweight8(req.rx_streams);
3538 
3539 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3540 		int freq2 = chandef->center_freq2;
3541 
3542 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3543 	}
3544 
3545 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3546 }
3547 
3548 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3549 {
3550 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
3551 #define PAGE_IDX_MASK		GENMASK(4, 2)
3552 #define PER_PAGE_SIZE		0x400
3553 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3554 	u16 eeprom_size = mt7915_eeprom_size(dev);
3555 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
3556 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
3557 	int eep_len;
3558 	int i;
3559 
3560 	for (i = 0; i < total; i++, eep += eep_len) {
3561 		struct sk_buff *skb;
3562 		int ret;
3563 
3564 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
3565 			eep_len = eeprom_size % PER_PAGE_SIZE;
3566 		else
3567 			eep_len = PER_PAGE_SIZE;
3568 
3569 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3570 					 sizeof(req) + eep_len);
3571 		if (!skb)
3572 			return -ENOMEM;
3573 
3574 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
3575 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3576 		req.len = cpu_to_le16(eep_len);
3577 
3578 		skb_put_data(skb, &req, sizeof(req));
3579 		skb_put_data(skb, eep, eep_len);
3580 
3581 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3582 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3583 		if (ret)
3584 			return ret;
3585 	}
3586 
3587 	return 0;
3588 }
3589 
3590 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3591 {
3592 	struct mt7915_mcu_eeprom req = {
3593 		.buffer_mode = EE_MODE_EFUSE,
3594 		.format = EE_FORMAT_WHOLE,
3595 	};
3596 
3597 	if (dev->flash_mode)
3598 		return mt7915_mcu_set_eeprom_flash(dev);
3599 
3600 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3601 				 &req, sizeof(req), true);
3602 }
3603 
3604 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3605 {
3606 	struct mt7915_mcu_eeprom_info req = {
3607 		.addr = cpu_to_le32(round_down(offset,
3608 				    MT7915_EEPROM_BLOCK_SIZE)),
3609 	};
3610 	struct mt7915_mcu_eeprom_info *res;
3611 	struct sk_buff *skb;
3612 	int ret;
3613 	u8 *buf;
3614 
3615 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3616 				sizeof(req), true, &skb);
3617 	if (ret)
3618 		return ret;
3619 
3620 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
3621 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3622 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
3623 	dev_kfree_skb(skb);
3624 
3625 	return 0;
3626 }
3627 
3628 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
3629 {
3630 	struct {
3631 		u8 _rsv;
3632 		u8 version;
3633 		u8 die_idx;
3634 		u8 _rsv2;
3635 	} __packed req = {
3636 		.version = 1,
3637 	};
3638 	struct sk_buff *skb;
3639 	int ret;
3640 
3641 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
3642 					sizeof(req), true, &skb);
3643 	if (ret)
3644 		return ret;
3645 
3646 	*block_num = *(u8 *)skb->data;
3647 	dev_kfree_skb(skb);
3648 
3649 	return 0;
3650 }
3651 
3652 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3653 				  u8 *data, u32 len, int cmd)
3654 {
3655 	struct {
3656 		u8 dir;
3657 		u8 valid;
3658 		__le16 bitmap;
3659 		s8 precal;
3660 		u8 action;
3661 		u8 band;
3662 		u8 idx;
3663 		u8 rsv[4];
3664 		__le32 len;
3665 	} req = {};
3666 	struct sk_buff *skb;
3667 
3668 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3669 	if (!skb)
3670 		return -ENOMEM;
3671 
3672 	req.idx = idx;
3673 	req.len = cpu_to_le32(len);
3674 	skb_put_data(skb, &req, sizeof(req));
3675 	skb_put_data(skb, data, len);
3676 
3677 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3678 }
3679 
3680 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3681 {
3682 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3683 	u32 total = MT_EE_CAL_GROUP_SIZE;
3684 
3685 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3686 		return 0;
3687 
3688 	/*
3689 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3690 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3691 	 */
3692 	while (total > 0) {
3693 		int ret, len;
3694 
3695 		len = min_t(u32, total, MT_EE_CAL_UNIT);
3696 
3697 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3698 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3699 		if (ret)
3700 			return ret;
3701 
3702 		total -= len;
3703 		cal += len;
3704 		idx++;
3705 	}
3706 
3707 	return 0;
3708 }
3709 
3710 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3711 {
3712 	int i;
3713 
3714 	for (i = 0; i < n_freqs; i++)
3715 		if (cur == freqs[i])
3716 			return i;
3717 
3718 	return -1;
3719 }
3720 
3721 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3722 {
3723 	static const u16 freq_list[] = {
3724 		5180, 5200, 5220, 5240,
3725 		5260, 5280, 5300, 5320,
3726 		5500, 5520, 5540, 5560,
3727 		5580, 5600, 5620, 5640,
3728 		5660, 5680, 5700, 5745,
3729 		5765, 5785, 5805, 5825
3730 	};
3731 	int offset_2g = ARRAY_SIZE(freq_list);
3732 	int idx;
3733 
3734 	if (freq < 4000) {
3735 		if (freq < 2432)
3736 			return offset_2g;
3737 		if (freq < 2457)
3738 			return offset_2g + 1;
3739 
3740 		return offset_2g + 2;
3741 	}
3742 
3743 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3744 		return -1;
3745 
3746 	if (bw != NL80211_CHAN_WIDTH_20) {
3747 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3748 					   freq + 10);
3749 		if (idx >= 0)
3750 			return idx;
3751 
3752 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3753 					   freq - 10);
3754 		if (idx >= 0)
3755 			return idx;
3756 	}
3757 
3758 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3759 }
3760 
3761 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3762 {
3763 	struct mt7915_dev *dev = phy->dev;
3764 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3765 	u16 total = 2, center_freq = chandef->center_freq1;
3766 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3767 	int idx;
3768 
3769 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3770 		return 0;
3771 
3772 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3773 	if (idx < 0)
3774 		return -EINVAL;
3775 
3776 	/* Items: Tx DPD, Tx Flatness */
3777 	idx = idx * 2;
3778 	cal += MT_EE_CAL_GROUP_SIZE;
3779 
3780 	while (total--) {
3781 		int ret;
3782 
3783 		cal += (idx * MT_EE_CAL_UNIT);
3784 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3785 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3786 		if (ret)
3787 			return ret;
3788 
3789 		idx++;
3790 	}
3791 
3792 	return 0;
3793 }
3794 
3795 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3796 {
3797 	/* strict order */
3798 	static const u32 offs[] = {
3799 		MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME,
3800 		MIB_BUSY_TIME_V2, MIB_TX_TIME_V2, MIB_RX_TIME_V2,
3801 		MIB_OBSS_AIRTIME_V2
3802 	};
3803 	struct mt76_channel_state *state = phy->mt76->chan_state;
3804 	struct mt76_channel_state *state_ts = &phy->state_ts;
3805 	struct mt7915_dev *dev = phy->dev;
3806 	struct mt7915_mcu_mib *res, req[4];
3807 	struct sk_buff *skb;
3808 	int i, ret, start = 0;
3809 
3810 	if (!is_mt7915(&dev->mt76))
3811 		start = 4;
3812 
3813 	for (i = 0; i < 4; i++) {
3814 		req[i].band = cpu_to_le32(phy != &dev->phy);
3815 		req[i].offs = cpu_to_le32(offs[i + start]);
3816 	}
3817 
3818 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3819 					req, sizeof(req), true, &skb);
3820 	if (ret)
3821 		return ret;
3822 
3823 	res = (struct mt7915_mcu_mib *)(skb->data + 20);
3824 
3825 	if (chan_switch)
3826 		goto out;
3827 
3828 #define __res_u64(s) le64_to_cpu(res[s].data)
3829 	state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3830 	state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3831 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3832 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3833 
3834 out:
3835 	state_ts->cc_busy = __res_u64(0);
3836 	state_ts->cc_tx = __res_u64(1);
3837 	state_ts->cc_bss_rx = __res_u64(2);
3838 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3839 #undef __res_u64
3840 
3841 	dev_kfree_skb(skb);
3842 
3843 	return 0;
3844 }
3845 
3846 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3847 {
3848 	struct mt7915_dev *dev = phy->dev;
3849 	struct {
3850 		u8 ctrl_id;
3851 		u8 action;
3852 		u8 dbdc_idx;
3853 		u8 rsv[5];
3854 	} req = {
3855 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3856 		.dbdc_idx = phy != &dev->phy,
3857 	};
3858 
3859 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3860 				 sizeof(req), true);
3861 }
3862 
3863 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3864 {
3865 	struct mt7915_dev *dev = phy->dev;
3866 	struct {
3867 		struct mt7915_mcu_thermal_ctrl ctrl;
3868 
3869 		__le32 trigger_temp;
3870 		__le32 restore_temp;
3871 		__le16 sustain_time;
3872 		u8 rsv[2];
3873 	} __packed req = {
3874 		.ctrl = {
3875 			.band_idx = phy != &dev->phy,
3876 		},
3877 	};
3878 	int level;
3879 
3880 	if (!state) {
3881 		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3882 		goto out;
3883 	}
3884 
3885 	/* set duty cycle and level */
3886 	for (level = 0; level < 4; level++) {
3887 		int ret;
3888 
3889 		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3890 		req.ctrl.duty.duty_level = level;
3891 		req.ctrl.duty.duty_cycle = state;
3892 		state /= 2;
3893 
3894 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3895 					&req, sizeof(req.ctrl), false);
3896 		if (ret)
3897 			return ret;
3898 	}
3899 
3900 	/* set high-temperature trigger threshold */
3901 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3902 	/* add a safety margin ~10 */
3903 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3904 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3905 	req.sustain_time = cpu_to_le16(10);
3906 
3907 out:
3908 	req.ctrl.type.protect_type = 1;
3909 	req.ctrl.type.trigger_type = 1;
3910 
3911 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3912 				 &req, sizeof(req), false);
3913 }
3914 
3915 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3916 {
3917 	struct mt7915_dev *dev = phy->dev;
3918 	struct mt76_phy *mphy = phy->mt76;
3919 	struct ieee80211_hw *hw = mphy->hw;
3920 	struct mt7915_sku_val {
3921 		u8 format_id;
3922 		u8 limit_type;
3923 		u8 dbdc_idx;
3924 		s8 val[MT7915_SKU_RATE_NUM];
3925 	} __packed req = {
3926 		.format_id = 4,
3927 		.dbdc_idx = phy != &dev->phy,
3928 	};
3929 	struct mt76_power_limits limits_array;
3930 	s8 *la = (s8 *)&limits_array;
3931 	int i, idx, n_chains = hweight8(mphy->antenna_mask);
3932 	int tx_power = hw->conf.power_level * 2;
3933 
3934 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan,
3935 				      tx_power);
3936 	tx_power -= mt76_tx_power_nss_delta(n_chains);
3937 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3938 					      &limits_array, tx_power);
3939 	mphy->txpower_cur = tx_power;
3940 
3941 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3942 		u8 mcs_num, len = mt7915_sku_group_len[i];
3943 		int j;
3944 
3945 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3946 			mcs_num = 10;
3947 
3948 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3949 				la = (s8 *)&limits_array + 12;
3950 		} else {
3951 			mcs_num = len;
3952 		}
3953 
3954 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3955 			req.val[idx + j] = la[j];
3956 
3957 		la += mcs_num;
3958 		idx += len;
3959 	}
3960 
3961 	return mt76_mcu_send_msg(&dev->mt76,
3962 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3963 				 sizeof(req), true);
3964 }
3965 
3966 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3967 {
3968 #define RATE_POWER_INFO	2
3969 	struct mt7915_dev *dev = phy->dev;
3970 	struct {
3971 		u8 format_id;
3972 		u8 category;
3973 		u8 band;
3974 		u8 _rsv;
3975 	} __packed req = {
3976 		.format_id = 7,
3977 		.category = RATE_POWER_INFO,
3978 		.band = phy != &dev->phy,
3979 	};
3980 	s8 res[MT7915_SKU_RATE_NUM][2];
3981 	struct sk_buff *skb;
3982 	int ret, i;
3983 
3984 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3985 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3986 					&req, sizeof(req), true, &skb);
3987 	if (ret)
3988 		return ret;
3989 
3990 	memcpy(res, skb->data + 4, sizeof(res));
3991 	for (i = 0; i < len; i++)
3992 		txpower[i] = res[i][req.band];
3993 
3994 	dev_kfree_skb(skb);
3995 
3996 	return 0;
3997 }
3998 
3999 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
4000 			      u8 en)
4001 {
4002 	struct {
4003 		u8 test_mode_en;
4004 		u8 param_idx;
4005 		u8 _rsv[2];
4006 
4007 		u8 enable;
4008 		u8 _rsv2[3];
4009 
4010 		u8 pad[8];
4011 	} __packed req = {
4012 		.test_mode_en = test_mode,
4013 		.param_idx = param,
4014 		.enable = en,
4015 	};
4016 
4017 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
4018 				 sizeof(req), false);
4019 }
4020 
4021 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
4022 {
4023 	struct mt7915_dev *dev = phy->dev;
4024 	struct mt7915_sku {
4025 		u8 format_id;
4026 		u8 sku_enable;
4027 		u8 dbdc_idx;
4028 		u8 rsv;
4029 	} __packed req = {
4030 		.format_id = 0,
4031 		.dbdc_idx = phy != &dev->phy,
4032 		.sku_enable = enable,
4033 	};
4034 
4035 	return mt76_mcu_send_msg(&dev->mt76,
4036 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
4037 				 sizeof(req), true);
4038 }
4039 
4040 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
4041 {
4042 	struct {
4043 		u8 action;
4044 		u8 set;
4045 		u8 band;
4046 		u8 rsv;
4047 	} req = {
4048 		.action = action,
4049 		.set = set,
4050 		.band = band,
4051 	};
4052 
4053 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
4054 				 &req, sizeof(req), false);
4055 }
4056 
4057 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
4058 {
4059 	struct {
4060 		u8 action;
4061 		union {
4062 			struct {
4063 				u8 snd_mode;
4064 				u8 sta_num;
4065 				u8 rsv;
4066 				u8 wlan_idx[4];
4067 				__le32 snd_period;	/* ms */
4068 			} __packed snd;
4069 			struct {
4070 				bool ebf;
4071 				bool ibf;
4072 				u8 rsv;
4073 			} __packed type;
4074 			struct {
4075 				u8 bf_num;
4076 				u8 bf_bitmap;
4077 				u8 bf_sel[8];
4078 				u8 rsv[5];
4079 			} __packed mod;
4080 		};
4081 	} __packed req = {
4082 		.action = action,
4083 	};
4084 
4085 #define MT_BF_PROCESSING	4
4086 	switch (action) {
4087 	case MT_BF_SOUNDING_ON:
4088 		req.snd.snd_mode = MT_BF_PROCESSING;
4089 		break;
4090 	case MT_BF_TYPE_UPDATE:
4091 		req.type.ebf = true;
4092 		req.type.ibf = dev->ibf;
4093 		break;
4094 	case MT_BF_MODULE_UPDATE:
4095 		req.mod.bf_num = 2;
4096 		req.mod.bf_bitmap = GENMASK(1, 0);
4097 		break;
4098 	default:
4099 		return -EINVAL;
4100 	}
4101 
4102 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
4103 				 sizeof(req), true);
4104 }
4105 
4106 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
4107 			    bool enable)
4108 {
4109 #define MT_SPR_ENABLE		1
4110 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
4111 	struct {
4112 		u8 action;
4113 		u8 arg_num;
4114 		u8 band_idx;
4115 		u8 status;
4116 		u8 drop_tx_idx;
4117 		u8 sta_idx;	/* 256 sta */
4118 		u8 rsv[2];
4119 		__le32 val;
4120 	} __packed req = {
4121 		.action = MT_SPR_ENABLE,
4122 		.arg_num = 1,
4123 		.band_idx = mvif->mt76.band_idx,
4124 		.val = cpu_to_le32(enable),
4125 	};
4126 
4127 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
4128 				 sizeof(req), true);
4129 }
4130 
4131 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
4132 			   struct ieee80211_sta *sta, struct rate_info *rate)
4133 {
4134 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
4135 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
4136 	struct mt7915_dev *dev = phy->dev;
4137 	struct mt76_phy *mphy = phy->mt76;
4138 	struct {
4139 		u8 category;
4140 		u8 band;
4141 		__le16 wcid;
4142 	} __packed req = {
4143 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
4144 		.band = mvif->mt76.band_idx,
4145 		.wcid = cpu_to_le16(msta->wcid.idx),
4146 	};
4147 	struct ieee80211_supported_band *sband;
4148 	struct mt7915_mcu_phy_rx_info *res;
4149 	struct sk_buff *skb;
4150 	int ret;
4151 	bool cck = false;
4152 
4153 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
4154 					&req, sizeof(req), true, &skb);
4155 	if (ret)
4156 		return ret;
4157 
4158 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
4159 
4160 	rate->mcs = res->rate;
4161 	rate->nss = res->nsts + 1;
4162 
4163 	switch (res->mode) {
4164 	case MT_PHY_TYPE_CCK:
4165 		cck = true;
4166 		fallthrough;
4167 	case MT_PHY_TYPE_OFDM:
4168 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
4169 			sband = &mphy->sband_5g.sband;
4170 		else
4171 			sband = &mphy->sband_2g.sband;
4172 
4173 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
4174 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
4175 		break;
4176 	case MT_PHY_TYPE_HT:
4177 	case MT_PHY_TYPE_HT_GF:
4178 		if (rate->mcs > 31) {
4179 			ret = -EINVAL;
4180 			goto out;
4181 		}
4182 
4183 		rate->flags = RATE_INFO_FLAGS_MCS;
4184 		if (res->gi)
4185 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
4186 		break;
4187 	case MT_PHY_TYPE_VHT:
4188 		if (rate->mcs > 9) {
4189 			ret = -EINVAL;
4190 			goto out;
4191 		}
4192 
4193 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
4194 		if (res->gi)
4195 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
4196 		break;
4197 	case MT_PHY_TYPE_HE_SU:
4198 	case MT_PHY_TYPE_HE_EXT_SU:
4199 	case MT_PHY_TYPE_HE_TB:
4200 	case MT_PHY_TYPE_HE_MU:
4201 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
4202 			ret = -EINVAL;
4203 			goto out;
4204 		}
4205 		rate->he_gi = res->gi;
4206 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
4207 		break;
4208 	default:
4209 		ret = -EINVAL;
4210 		goto out;
4211 	}
4212 
4213 	switch (res->bw) {
4214 	case IEEE80211_STA_RX_BW_160:
4215 		rate->bw = RATE_INFO_BW_160;
4216 		break;
4217 	case IEEE80211_STA_RX_BW_80:
4218 		rate->bw = RATE_INFO_BW_80;
4219 		break;
4220 	case IEEE80211_STA_RX_BW_40:
4221 		rate->bw = RATE_INFO_BW_40;
4222 		break;
4223 	default:
4224 		rate->bw = RATE_INFO_BW_20;
4225 		break;
4226 	}
4227 
4228 out:
4229 	dev_kfree_skb(skb);
4230 
4231 	return ret;
4232 }
4233 
4234 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
4235 				struct cfg80211_he_bss_color *he_bss_color)
4236 {
4237 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
4238 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
4239 	struct bss_info_color *bss_color;
4240 	struct sk_buff *skb;
4241 	struct tlv *tlv;
4242 
4243 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
4244 					      NULL, len);
4245 	if (IS_ERR(skb))
4246 		return PTR_ERR(skb);
4247 
4248 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR, sizeof(*bss_color));
4249 	bss_color = (struct bss_info_color *)tlv;
4250 	bss_color->disable = !he_bss_color->enabled;
4251 	bss_color->color = he_bss_color->color;
4252 
4253 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
4254 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
4255 }
4256 
4257 #define TWT_AGRT_TRIGGER	BIT(0)
4258 #define TWT_AGRT_ANNOUNCE	BIT(1)
4259 #define TWT_AGRT_PROTECT	BIT(2)
4260 
4261 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
4262 			       struct mt7915_vif *mvif,
4263 			       struct mt7915_twt_flow *flow,
4264 			       int cmd)
4265 {
4266 	struct {
4267 		u8 tbl_idx;
4268 		u8 cmd;
4269 		u8 own_mac_idx;
4270 		u8 flowid; /* 0xff for group id */
4271 		__le16 peer_id; /* specify the peer_id (msb=0)
4272 				 * or group_id (msb=1)
4273 				 */
4274 		u8 duration; /* 256 us */
4275 		u8 bss_idx;
4276 		__le64 start_tsf;
4277 		__le16 mantissa;
4278 		u8 exponent;
4279 		u8 is_ap;
4280 		u8 agrt_params;
4281 		u8 rsv[23];
4282 	} __packed req = {
4283 		.tbl_idx = flow->table_id,
4284 		.cmd = cmd,
4285 		.own_mac_idx = mvif->mt76.omac_idx,
4286 		.flowid = flow->id,
4287 		.peer_id = cpu_to_le16(flow->wcid),
4288 		.duration = flow->duration,
4289 		.bss_idx = mvif->mt76.idx,
4290 		.start_tsf = cpu_to_le64(flow->tsf),
4291 		.mantissa = flow->mantissa,
4292 		.exponent = flow->exp,
4293 		.is_ap = true,
4294 	};
4295 
4296 	if (flow->protection)
4297 		req.agrt_params |= TWT_AGRT_PROTECT;
4298 	if (!flow->flowtype)
4299 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
4300 	if (flow->trigger)
4301 		req.agrt_params |= TWT_AGRT_TRIGGER;
4302 
4303 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
4304 				 &req, sizeof(req), true);
4305 }
4306