1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define MT_STA_BFER			BIT(0)
70 #define MT_STA_BFEE			BIT(1)
71 
72 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
73 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
74 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
75 
76 #define DL_MODE_ENCRYPT			BIT(0)
77 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
78 #define DL_MODE_RESET_SEC_IV		BIT(3)
79 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
80 #define DL_MODE_NEED_RSP		BIT(31)
81 
82 #define FW_START_OVERRIDE		BIT(0)
83 #define FW_START_WORKING_PDA_CR4	BIT(2)
84 
85 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
86 #define PATCH_SEC_TYPE_INFO		0x2
87 
88 #define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
89 #define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
90 
91 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
92 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
93 
94 static enum mt7915_cipher_type
95 mt7915_mcu_get_cipher(int cipher)
96 {
97 	switch (cipher) {
98 	case WLAN_CIPHER_SUITE_WEP40:
99 		return MT_CIPHER_WEP40;
100 	case WLAN_CIPHER_SUITE_WEP104:
101 		return MT_CIPHER_WEP104;
102 	case WLAN_CIPHER_SUITE_TKIP:
103 		return MT_CIPHER_TKIP;
104 	case WLAN_CIPHER_SUITE_AES_CMAC:
105 		return MT_CIPHER_BIP_CMAC_128;
106 	case WLAN_CIPHER_SUITE_CCMP:
107 		return MT_CIPHER_AES_CCMP;
108 	case WLAN_CIPHER_SUITE_CCMP_256:
109 		return MT_CIPHER_CCMP_256;
110 	case WLAN_CIPHER_SUITE_GCMP:
111 		return MT_CIPHER_GCMP;
112 	case WLAN_CIPHER_SUITE_GCMP_256:
113 		return MT_CIPHER_GCMP_256;
114 	case WLAN_CIPHER_SUITE_SMS4:
115 		return MT_CIPHER_WAPI;
116 	default:
117 		return MT_CIPHER_NONE;
118 	}
119 }
120 
121 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
122 {
123 	static const u8 width_to_bw[] = {
124 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
125 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
126 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
127 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
128 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
129 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
130 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
131 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
132 	};
133 
134 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
135 		return 0;
136 
137 	return width_to_bw[chandef->width];
138 }
139 
140 static const struct ieee80211_sta_he_cap *
141 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
142 {
143 	struct ieee80211_supported_band *sband;
144 	enum nl80211_band band;
145 
146 	band = phy->mt76->chandef.chan->band;
147 	sband = phy->mt76->hw->wiphy->bands[band];
148 
149 	return ieee80211_get_he_iftype_cap(sband, vif->type);
150 }
151 
152 static u8
153 mt7915_get_phy_mode(struct mt7915_dev *dev, struct ieee80211_vif *vif,
154 		    enum nl80211_band band, struct ieee80211_sta *sta)
155 {
156 	struct ieee80211_sta_ht_cap *ht_cap;
157 	struct ieee80211_sta_vht_cap *vht_cap;
158 	const struct ieee80211_sta_he_cap *he_cap;
159 	u8 mode = 0;
160 
161 	if (sta) {
162 		ht_cap = &sta->ht_cap;
163 		vht_cap = &sta->vht_cap;
164 		he_cap = &sta->he_cap;
165 	} else {
166 		struct ieee80211_supported_band *sband;
167 		struct mt7915_phy *phy;
168 		struct mt7915_vif *mvif;
169 
170 		mvif = (struct mt7915_vif *)vif->drv_priv;
171 		phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
172 		sband = phy->mt76->hw->wiphy->bands[band];
173 
174 		ht_cap = &sband->ht_cap;
175 		vht_cap = &sband->vht_cap;
176 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
177 	}
178 
179 	if (band == NL80211_BAND_2GHZ) {
180 		mode |= PHY_MODE_B | PHY_MODE_G;
181 
182 		if (ht_cap->ht_supported)
183 			mode |= PHY_MODE_GN;
184 
185 		if (he_cap->has_he)
186 			mode |= PHY_MODE_AX_24G;
187 	} else if (band == NL80211_BAND_5GHZ) {
188 		mode |= PHY_MODE_A;
189 
190 		if (ht_cap->ht_supported)
191 			mode |= PHY_MODE_AN;
192 
193 		if (vht_cap->vht_supported)
194 			mode |= PHY_MODE_AC;
195 
196 		if (he_cap->has_he)
197 			mode |= PHY_MODE_AX_5G;
198 	}
199 
200 	return mode;
201 }
202 
203 static u8
204 mt7915_mcu_get_sta_nss(u16 mcs_map)
205 {
206 	u8 nss;
207 
208 	for (nss = 8; nss > 0; nss--) {
209 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
210 
211 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
212 			break;
213 	}
214 
215 	return nss - 1;
216 }
217 
218 static int __mt7915_mcu_msg_send(struct mt7915_dev *dev, struct sk_buff *skb,
219 				 int cmd, int *wait_seq)
220 {
221 	struct mt7915_mcu_txd *mcu_txd;
222 	u8 seq, pkt_fmt, qidx;
223 	enum mt76_txq_id txq;
224 	__le32 *txd;
225 	u32 val;
226 
227 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
228 	if (!seq)
229 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
230 
231 	if (cmd == -MCU_CMD_FW_SCATTER) {
232 		txq = MT_TXQ_FWDL;
233 		goto exit;
234 	}
235 
236 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
237 
238 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state)) {
239 		txq = MT_TXQ_MCU_WA;
240 		qidx = MT_TX_MCU_PORT_RX_Q0;
241 		pkt_fmt = MT_TX_TYPE_CMD;
242 	} else {
243 		txq = MT_TXQ_MCU;
244 		qidx = MT_TX_MCU_PORT_RX_Q0;
245 		pkt_fmt = MT_TX_TYPE_CMD;
246 	}
247 
248 	txd = mcu_txd->txd;
249 
250 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
251 	      FIELD_PREP(MT_TXD0_PKT_FMT, pkt_fmt) |
252 	      FIELD_PREP(MT_TXD0_Q_IDX, qidx);
253 	txd[0] = cpu_to_le32(val);
254 
255 	val = MT_TXD1_LONG_FORMAT |
256 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
257 	txd[1] = cpu_to_le32(val);
258 
259 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
260 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, qidx));
261 	mcu_txd->pkt_type = MCU_PKT_ID;
262 	mcu_txd->seq = seq;
263 
264 	if (cmd < 0) {
265 		mcu_txd->set_query = MCU_Q_NA;
266 		mcu_txd->cid = -cmd;
267 	} else {
268 		mcu_txd->cid = MCU_CMD_EXT_CID;
269 		mcu_txd->ext_cid = cmd;
270 		mcu_txd->ext_cid_ack = 1;
271 
272 		/* do not use Q_SET for efuse */
273 		if (cmd == MCU_EXT_CMD_EFUSE_ACCESS)
274 			mcu_txd->set_query = MCU_Q_QUERY;
275 		else
276 			mcu_txd->set_query = MCU_Q_SET;
277 	}
278 
279 	mcu_txd->s2d_index = MCU_S2D_H2N;
280 	WARN_ON(cmd == MCU_EXT_CMD_EFUSE_ACCESS &&
281 		mcu_txd->set_query != MCU_Q_QUERY);
282 
283 exit:
284 	if (wait_seq)
285 		*wait_seq = seq;
286 
287 	return mt76_tx_queue_skb_raw(dev, txq, skb, 0);
288 }
289 
290 static int
291 mt7915_mcu_parse_eeprom(struct mt7915_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7915_mcu_eeprom_info *res;
294 	u8 *buf;
295 
296 	if (!skb)
297 		return -EINVAL;
298 
299 	skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
300 
301 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
302 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
303 	memcpy(buf, res->data, 16);
304 
305 	return 0;
306 }
307 
308 static int
309 mt7915_mcu_parse_response(struct mt7915_dev *dev, int cmd,
310 			  struct sk_buff *skb, int seq)
311 {
312 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
313 	int ret = 0;
314 
315 	if (seq != rxd->seq) {
316 		ret = -EAGAIN;
317 		goto out;
318 	}
319 
320 	switch (cmd) {
321 	case -MCU_CMD_PATCH_SEM_CONTROL:
322 		skb_pull(skb, sizeof(*rxd) - 4);
323 		ret = *skb->data;
324 		break;
325 	case MCU_EXT_CMD_THERMAL_CTRL:
326 		skb_pull(skb, sizeof(*rxd) + 4);
327 		ret = le32_to_cpu(*(__le32 *)skb->data);
328 		break;
329 	case MCU_EXT_CMD_EFUSE_ACCESS:
330 		ret = mt7915_mcu_parse_eeprom(dev, skb);
331 		break;
332 	default:
333 		break;
334 	}
335 out:
336 	dev_kfree_skb(skb);
337 
338 	return ret;
339 }
340 
341 static int
342 mt7915_mcu_wait_response(struct mt7915_dev *dev, int cmd, int seq)
343 {
344 	unsigned long expires = jiffies + 20 * HZ;
345 	struct sk_buff *skb;
346 	int ret = 0;
347 
348 	while (true) {
349 		skb = mt76_mcu_get_response(&dev->mt76, expires);
350 		if (!skb) {
351 			dev_err(dev->mt76.dev, "Message %d (seq %d) timeout\n",
352 				cmd, seq);
353 			return -ETIMEDOUT;
354 		}
355 
356 		ret = mt7915_mcu_parse_response(dev, cmd, skb, seq);
357 		if (ret != -EAGAIN)
358 			break;
359 	}
360 
361 	return ret;
362 }
363 
364 static int
365 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
366 			int cmd, bool wait_resp)
367 {
368 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
369 	int ret, seq;
370 
371 	mutex_lock(&mdev->mcu.mutex);
372 
373 	ret = __mt7915_mcu_msg_send(dev, skb, cmd, &seq);
374 	if (ret)
375 		goto out;
376 
377 	if (wait_resp)
378 		ret = mt7915_mcu_wait_response(dev, cmd, seq);
379 
380 out:
381 	mutex_unlock(&mdev->mcu.mutex);
382 
383 	return ret;
384 }
385 
386 static int
387 mt7915_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
388 		    int len, bool wait_resp)
389 {
390 	struct sk_buff *skb;
391 
392 	skb = mt76_mcu_msg_alloc(mdev, data, len);
393 	if (!skb)
394 		return -ENOMEM;
395 
396 	return __mt76_mcu_skb_send_msg(mdev, skb, cmd, wait_resp);
397 }
398 
399 static void
400 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
401 {
402 	if (vif->csa_active)
403 		ieee80211_csa_finish(vif);
404 }
405 
406 static void
407 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
408 {
409 	struct mt76_phy *mphy = &dev->mt76.phy;
410 	struct mt7915_mcu_rdd_report *r;
411 
412 	r = (struct mt7915_mcu_rdd_report *)skb->data;
413 
414 	if (r->idx && dev->mt76.phy2)
415 		mphy = dev->mt76.phy2;
416 
417 	ieee80211_radar_detected(mphy->hw);
418 	dev->hw_pattern++;
419 }
420 
421 static void
422 mt7915_mcu_tx_rate_cal(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
423 		       struct rate_info *rate, u16 r)
424 {
425 	struct ieee80211_supported_band *sband;
426 	u16 ru_idx = le16_to_cpu(ra->ru_idx);
427 	u16 flags = 0;
428 
429 	rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
430 	rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
431 
432 	switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
433 	case MT_PHY_TYPE_CCK:
434 	case MT_PHY_TYPE_OFDM:
435 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
436 			sband = &mphy->sband_5g.sband;
437 		else
438 			sband = &mphy->sband_2g.sband;
439 
440 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
441 		break;
442 	case MT_PHY_TYPE_HT:
443 	case MT_PHY_TYPE_HT_GF:
444 		rate->mcs += (rate->nss - 1) * 8;
445 		flags |= RATE_INFO_FLAGS_MCS;
446 
447 		if (ra->gi)
448 			flags |= RATE_INFO_FLAGS_SHORT_GI;
449 		break;
450 	case MT_PHY_TYPE_VHT:
451 		flags |= RATE_INFO_FLAGS_VHT_MCS;
452 
453 		if (ra->gi)
454 			flags |= RATE_INFO_FLAGS_SHORT_GI;
455 		break;
456 	case MT_PHY_TYPE_HE_SU:
457 	case MT_PHY_TYPE_HE_EXT_SU:
458 	case MT_PHY_TYPE_HE_TB:
459 	case MT_PHY_TYPE_HE_MU:
460 		rate->he_gi = ra->gi;
461 		rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
462 
463 		flags |= RATE_INFO_FLAGS_HE_MCS;
464 		break;
465 	default:
466 		break;
467 	}
468 	rate->flags = flags;
469 
470 	if (ru_idx) {
471 		switch (ru_idx) {
472 		case 1 ... 2:
473 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
474 			break;
475 		case 3 ... 6:
476 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
477 			break;
478 		case 7 ... 14:
479 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
480 			break;
481 		default:
482 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
483 			break;
484 		}
485 		rate->bw = RATE_INFO_BW_HE_RU;
486 	} else {
487 		u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
488 			FIELD_GET(MT_RA_RATE_BW, r);
489 
490 		switch (bw) {
491 		case IEEE80211_STA_RX_BW_160:
492 			rate->bw = RATE_INFO_BW_160;
493 			break;
494 		case IEEE80211_STA_RX_BW_80:
495 			rate->bw = RATE_INFO_BW_80;
496 			break;
497 		case IEEE80211_STA_RX_BW_40:
498 			rate->bw = RATE_INFO_BW_40;
499 			break;
500 		default:
501 			rate->bw = RATE_INFO_BW_20;
502 			break;
503 		}
504 	}
505 }
506 
507 static void
508 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
509 {
510 	struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
511 	struct rate_info rate = {}, prob_rate = {};
512 	u16 probe = le16_to_cpu(ra->prob_up_rate);
513 	u16 attempts = le16_to_cpu(ra->attempts);
514 	u16 curr = le16_to_cpu(ra->curr_rate);
515 	u16 wcidx = le16_to_cpu(ra->wlan_idx);
516 	struct mt76_phy *mphy = &dev->mphy;
517 	struct mt7915_sta_stats *stats;
518 	struct mt7915_sta *msta;
519 	struct mt76_wcid *wcid;
520 
521 	if (wcidx >= MT76_N_WCIDS)
522 		return;
523 
524 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
525 	if (!wcid)
526 		return;
527 
528 	msta = container_of(wcid, struct mt7915_sta, wcid);
529 	stats = &msta->stats;
530 
531 	if (msta->wcid.ext_phy && dev->mt76.phy2)
532 		mphy = dev->mt76.phy2;
533 
534 	/* current rate */
535 	mt7915_mcu_tx_rate_cal(mphy, ra, &rate, curr);
536 	stats->tx_rate = rate;
537 
538 	/* probing rate */
539 	mt7915_mcu_tx_rate_cal(mphy, ra, &prob_rate, probe);
540 	stats->prob_rate = prob_rate;
541 
542 	if (attempts) {
543 		u16 success = le16_to_cpu(ra->success);
544 
545 		stats->per = 1000 * (attempts - success) / attempts;
546 	}
547 }
548 
549 static void
550 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
551 {
552 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
553 	const char *data = (char *)&rxd[1];
554 	const char *type;
555 
556 	switch (rxd->s2d_index) {
557 	case 0:
558 		type = "WM";
559 		break;
560 	case 2:
561 		type = "WA";
562 		break;
563 	default:
564 		type = "unknown";
565 		break;
566 	}
567 
568 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
569 }
570 
571 static void
572 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
573 {
574 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
575 
576 	switch (rxd->ext_eid) {
577 	case MCU_EXT_EVENT_RDD_REPORT:
578 		mt7915_mcu_rx_radar_detected(dev, skb);
579 		break;
580 	case MCU_EXT_EVENT_CSA_NOTIFY:
581 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
582 				IEEE80211_IFACE_ITER_RESUME_ALL,
583 				mt7915_mcu_csa_finish, dev);
584 		break;
585 	case MCU_EXT_EVENT_RATE_REPORT:
586 		mt7915_mcu_tx_rate_report(dev, skb);
587 		break;
588 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
589 		mt7915_mcu_rx_log_message(dev, skb);
590 		break;
591 	default:
592 		break;
593 	}
594 }
595 
596 static void
597 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
598 {
599 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
600 
601 	switch (rxd->eid) {
602 	case MCU_EVENT_EXT:
603 		mt7915_mcu_rx_ext_event(dev, skb);
604 		break;
605 	default:
606 		break;
607 	}
608 	dev_kfree_skb(skb);
609 }
610 
611 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
612 {
613 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
614 
615 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
616 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
617 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
618 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
619 	    rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
620 	    !rxd->seq)
621 		mt7915_mcu_rx_unsolicited_event(dev, skb);
622 	else
623 		mt76_mcu_rx_event(&dev->mt76, skb);
624 }
625 
626 static struct sk_buff *
627 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
628 			 struct mt7915_sta *msta, int len)
629 {
630 	struct sta_req_hdr hdr = {
631 		.bss_idx = mvif->idx,
632 		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
633 		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
634 		.muar_idx = msta ? mvif->omac_idx : 0,
635 		.is_tlv_append = 1,
636 	};
637 	struct sk_buff *skb;
638 
639 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
640 	if (!skb)
641 		return ERR_PTR(-ENOMEM);
642 
643 	skb_put_data(skb, &hdr, sizeof(hdr));
644 
645 	return skb;
646 }
647 
648 static struct wtbl_req_hdr *
649 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
650 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
651 {
652 	struct tlv *sta_hdr = sta_wtbl;
653 	struct wtbl_req_hdr hdr = {
654 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
655 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
656 		.operation = cmd,
657 	};
658 	struct sk_buff *nskb = *skb;
659 
660 	if (!nskb) {
661 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
662 					  MT7915_WTBL_UPDATE_BA_SIZE);
663 		if (!nskb)
664 			return ERR_PTR(-ENOMEM);
665 
666 		*skb = nskb;
667 	}
668 
669 	if (sta_hdr)
670 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
671 
672 	return skb_put_data(nskb, &hdr, sizeof(hdr));
673 }
674 
675 static struct tlv *
676 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
677 			  void *sta_ntlv, void *sta_wtbl)
678 {
679 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
680 	struct tlv *sta_hdr = sta_wtbl;
681 	struct tlv *ptlv, tlv = {
682 		.tag = cpu_to_le16(tag),
683 		.len = cpu_to_le16(len),
684 	};
685 	u16 ntlv;
686 
687 	ptlv = skb_put(skb, len);
688 	memcpy(ptlv, &tlv, sizeof(tlv));
689 
690 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
691 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
692 
693 	if (sta_hdr) {
694 		u16 size = le16_to_cpu(sta_hdr->len);
695 
696 		sta_hdr->len = cpu_to_le16(size + len);
697 	}
698 
699 	return ptlv;
700 }
701 
702 static struct tlv *
703 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
704 {
705 	return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
706 }
707 
708 static struct tlv *
709 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
710 			     __le16 *sub_ntlv, __le16 *len)
711 {
712 	struct tlv *ptlv, tlv = {
713 		.tag = cpu_to_le16(sub_tag),
714 		.len = cpu_to_le16(sub_len),
715 	};
716 
717 	ptlv = skb_put(skb, sub_len);
718 	memcpy(ptlv, &tlv, sizeof(tlv));
719 
720 	le16_add_cpu(sub_ntlv, 1);
721 	le16_add_cpu(len, sub_len);
722 
723 	return ptlv;
724 }
725 
726 /** bss info **/
727 static int
728 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
729 			 struct mt7915_phy *phy, bool enable)
730 {
731 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
732 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
733 	enum nl80211_band band = chandef->chan->band;
734 	struct bss_info_basic *bss;
735 	u16 wlan_idx = mvif->sta.wcid.idx;
736 	u32 type = NETWORK_INFRA;
737 	struct tlv *tlv;
738 
739 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
740 
741 	switch (vif->type) {
742 	case NL80211_IFTYPE_MESH_POINT:
743 	case NL80211_IFTYPE_AP:
744 		break;
745 	case NL80211_IFTYPE_STATION:
746 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
747 		if (enable) {
748 			struct ieee80211_sta *sta;
749 			struct mt7915_sta *msta;
750 
751 			rcu_read_lock();
752 			sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
753 			if (!sta) {
754 				rcu_read_unlock();
755 				return -EINVAL;
756 			}
757 
758 			msta = (struct mt7915_sta *)sta->drv_priv;
759 			wlan_idx = msta->wcid.idx;
760 			rcu_read_unlock();
761 		}
762 		break;
763 	case NL80211_IFTYPE_ADHOC:
764 		type = NETWORK_IBSS;
765 		break;
766 	default:
767 		WARN_ON(1);
768 		break;
769 	}
770 
771 	bss = (struct bss_info_basic *)tlv;
772 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
773 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
774 	bss->network_type = cpu_to_le32(type);
775 	bss->dtim_period = vif->bss_conf.dtim_period;
776 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
777 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
778 	bss->phy_mode = mt7915_get_phy_mode(phy->dev, vif, band, NULL);
779 	bss->wmm_idx = mvif->wmm_idx;
780 	bss->active = enable;
781 
782 	return 0;
783 }
784 
785 static void
786 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
787 {
788 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
789 	struct bss_info_omac *omac;
790 	struct tlv *tlv;
791 	u32 type = 0;
792 	u8 idx;
793 
794 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
795 
796 	switch (vif->type) {
797 	case NL80211_IFTYPE_MESH_POINT:
798 	case NL80211_IFTYPE_AP:
799 		type = CONNECTION_INFRA_AP;
800 		break;
801 	case NL80211_IFTYPE_STATION:
802 		type = CONNECTION_INFRA_STA;
803 		break;
804 	case NL80211_IFTYPE_ADHOC:
805 		type = CONNECTION_IBSS_ADHOC;
806 		break;
807 	default:
808 		WARN_ON(1);
809 		break;
810 	}
811 
812 	omac = (struct bss_info_omac *)tlv;
813 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
814 	omac->conn_type = cpu_to_le32(type);
815 	omac->omac_idx = mvif->omac_idx;
816 	omac->band_idx = mvif->band_idx;
817 	omac->hw_bss_idx = idx;
818 }
819 
820 struct mt7915_he_obss_narrow_bw_ru_data {
821 	bool tolerated;
822 };
823 
824 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
825 						   struct cfg80211_bss *bss,
826 						   void *_data)
827 {
828 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
829 	const struct element *elem;
830 
831 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
832 
833 	if (!elem || elem->datalen < 10 ||
834 	    !(elem->data[10] &
835 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
836 		data->tolerated = false;
837 }
838 
839 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
840 					      struct ieee80211_vif *vif)
841 {
842 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
843 		.tolerated = true,
844 	};
845 
846 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
847 		return false;
848 
849 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
850 			  mt7915_check_he_obss_narrow_bw_ru_iter,
851 			  &iter_data);
852 
853 	/*
854 	 * If there is at least one AP on radar channel that cannot
855 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
856 	 */
857 	return !iter_data.tolerated;
858 }
859 
860 static void
861 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
862 			struct mt7915_phy *phy)
863 {
864 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
865 	struct bss_info_rf_ch *ch;
866 	struct tlv *tlv;
867 	int freq1 = chandef->center_freq1;
868 
869 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
870 
871 	ch = (struct bss_info_rf_ch *)tlv;
872 	ch->pri_ch = chandef->chan->hw_value;
873 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
874 	ch->bw = mt7915_mcu_chan_bw(chandef);
875 
876 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
877 		int freq2 = chandef->center_freq2;
878 
879 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
880 	}
881 
882 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
883 		struct mt7915_dev *dev = phy->dev;
884 		struct mt76_phy *mphy = &dev->mt76.phy;
885 		bool ext_phy = phy != &dev->phy;
886 
887 		if (ext_phy && dev->mt76.phy2)
888 			mphy = dev->mt76.phy2;
889 
890 		ch->he_ru26_block =
891 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
892 		ch->he_all_disable = false;
893 	} else {
894 		ch->he_all_disable = true;
895 	}
896 }
897 
898 static void
899 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
900 		      struct mt7915_phy *phy)
901 {
902 	struct bss_info_ra *ra;
903 	struct tlv *tlv;
904 	int max_nss = hweight8(phy->chainmask);
905 
906 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
907 
908 	ra = (struct bss_info_ra *)tlv;
909 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
910 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
911 	ra->short_preamble = true;
912 	ra->tx_streams = max_nss;
913 	ra->rx_streams = max_nss;
914 	ra->algo = 4;
915 	ra->train_up_rule = 2;
916 	ra->train_up_high_thres = 110;
917 	ra->train_up_rule_rssi = -70;
918 	ra->low_traffic_thres = 2;
919 	ra->phy_cap = cpu_to_le32(0xfdf);
920 	ra->interval = cpu_to_le32(500);
921 	ra->fast_interval = cpu_to_le32(100);
922 }
923 
924 static void
925 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
926 		      struct mt7915_phy *phy)
927 {
928 #define DEFAULT_HE_PE_DURATION		4
929 #define DEFAULT_HE_DURATION_RTS_THRES	1023
930 	const struct ieee80211_sta_he_cap *cap;
931 	struct bss_info_he *he;
932 	struct tlv *tlv;
933 
934 	cap = mt7915_get_he_phy_cap(phy, vif);
935 
936 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
937 
938 	he = (struct bss_info_he *)tlv;
939 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
940 	if (!he->he_pe_duration)
941 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
942 
943 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
944 	if (!he->he_rts_thres)
945 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
946 
947 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
948 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
949 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
950 }
951 
952 static void
953 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
954 {
955 #define TXD_CMP_MAP1		GENMASK(15, 0)
956 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
957 	struct bss_info_hw_amsdu *amsdu;
958 	struct tlv *tlv;
959 
960 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
961 
962 	amsdu = (struct bss_info_hw_amsdu *)tlv;
963 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
964 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
965 	amsdu->trig_thres = cpu_to_le16(2);
966 	amsdu->enable = true;
967 }
968 
969 static void
970 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
971 {
972 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
973 #define BCN_TX_ESTIMATE_TIME	(4096 + 20)
974 	struct bss_info_ext_bss *ext;
975 	int ext_bss_idx, tsf_offset;
976 	struct tlv *tlv;
977 
978 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
979 	if (ext_bss_idx < 0)
980 		return;
981 
982 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
983 
984 	ext = (struct bss_info_ext_bss *)tlv;
985 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
986 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
987 }
988 
989 static void
990 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
991 {
992 	struct bss_info_bmc_rate *bmc;
993 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
994 	enum nl80211_band band = chandef->chan->band;
995 	struct tlv *tlv;
996 
997 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
998 
999 	bmc = (struct bss_info_bmc_rate *)tlv;
1000 	if (band == NL80211_BAND_2GHZ) {
1001 		bmc->short_preamble = true;
1002 	} else {
1003 		bmc->bc_trans = cpu_to_le16(0x2000);
1004 		bmc->mc_trans = cpu_to_le16(0x2080);
1005 	}
1006 }
1007 
1008 static void
1009 mt7915_mcu_bss_sync_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
1010 {
1011 	struct bss_info_sync_mode *sync;
1012 	struct tlv *tlv;
1013 
1014 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_SYNC_MODE, sizeof(*sync));
1015 
1016 	sync = (struct bss_info_sync_mode *)tlv;
1017 	sync->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
1018 	sync->dtim_period = vif->bss_conf.dtim_period;
1019 	sync->enable = true;
1020 }
1021 
1022 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1023 			    struct ieee80211_vif *vif, int enable)
1024 {
1025 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1026 	struct sk_buff *skb;
1027 
1028 	skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1029 				       MT7915_BSS_UPDATE_MAX_SIZE);
1030 	if (IS_ERR(skb))
1031 		return PTR_ERR(skb);
1032 
1033 	/* bss_omac must be first */
1034 	if (enable)
1035 		mt7915_mcu_bss_omac_tlv(skb, vif);
1036 
1037 	mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1038 
1039 	if (enable) {
1040 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1041 		mt7915_mcu_bss_bmc_tlv(skb, phy);
1042 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1043 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
1044 
1045 		if (vif->bss_conf.he_support)
1046 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
1047 
1048 		if (mvif->omac_idx > HW_BSSID_MAX)
1049 			mt7915_mcu_bss_ext_tlv(skb, mvif);
1050 		else
1051 			mt7915_mcu_bss_sync_tlv(skb, vif);
1052 	}
1053 
1054 	return __mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1055 				       MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1056 }
1057 
1058 /** starec & wtbl **/
1059 static int
1060 mt7915_mcu_sta_key_tlv(struct sk_buff *skb, struct ieee80211_key_conf *key,
1061 		       enum set_key_cmd cmd)
1062 {
1063 	struct sta_rec_sec *sec;
1064 	struct tlv *tlv;
1065 	u32 len = sizeof(*sec);
1066 
1067 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1068 
1069 	sec = (struct sta_rec_sec *)tlv;
1070 	sec->add = cmd;
1071 
1072 	if (cmd == SET_KEY) {
1073 		struct sec_key *sec_key;
1074 		u8 cipher;
1075 
1076 		cipher = mt7915_mcu_get_cipher(key->cipher);
1077 		if (cipher == MT_CIPHER_NONE)
1078 			return -EOPNOTSUPP;
1079 
1080 		sec_key = &sec->key[0];
1081 		sec_key->cipher_len = sizeof(*sec_key);
1082 		sec_key->key_id = key->keyidx;
1083 
1084 		if (cipher == MT_CIPHER_BIP_CMAC_128) {
1085 			sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1086 			sec_key->key_len = 16;
1087 			memcpy(sec_key->key, key->key, 16);
1088 
1089 			sec_key = &sec->key[1];
1090 			sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1091 			sec_key->cipher_len = sizeof(*sec_key);
1092 			sec_key->key_len = 16;
1093 			memcpy(sec_key->key, key->key + 16, 16);
1094 
1095 			sec->n_cipher = 2;
1096 		} else {
1097 			sec_key->cipher_id = cipher;
1098 			sec_key->key_len = key->keylen;
1099 			memcpy(sec_key->key, key->key, key->keylen);
1100 
1101 			if (cipher == MT_CIPHER_TKIP) {
1102 				/* Rx/Tx MIC keys are swapped */
1103 				memcpy(sec_key->key + 16, key->key + 24, 8);
1104 				memcpy(sec_key->key + 24, key->key + 16, 8);
1105 			}
1106 
1107 			len -= sizeof(*sec_key);
1108 			sec->n_cipher = 1;
1109 		}
1110 	} else {
1111 		len -= sizeof(sec->key);
1112 		sec->n_cipher = 0;
1113 	}
1114 	sec->len = cpu_to_le16(len);
1115 
1116 	return 0;
1117 }
1118 
1119 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1120 		       struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1121 		       enum set_key_cmd cmd)
1122 {
1123 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1124 	struct sk_buff *skb;
1125 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1126 	int ret;
1127 
1128 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1129 	if (IS_ERR(skb))
1130 		return PTR_ERR(skb);
1131 
1132 	ret = mt7915_mcu_sta_key_tlv(skb, key, cmd);
1133 	if (ret)
1134 		return ret;
1135 
1136 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1137 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1138 }
1139 
1140 static void
1141 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1142 		      struct ieee80211_ampdu_params *params,
1143 		      bool enable, bool tx)
1144 {
1145 	struct sta_rec_ba *ba;
1146 	struct tlv *tlv;
1147 
1148 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1149 
1150 	ba = (struct sta_rec_ba *)tlv;
1151 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
1152 	ba->winsize = cpu_to_le16(params->buf_size);
1153 	ba->ssn = cpu_to_le16(params->ssn);
1154 	ba->ba_en = enable << params->tid;
1155 	ba->amsdu = params->amsdu;
1156 	ba->tid = params->tid;
1157 }
1158 
1159 static void
1160 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1161 		       struct ieee80211_ampdu_params *params,
1162 		       bool enable, bool tx, void *sta_wtbl,
1163 		       void *wtbl_tlv)
1164 {
1165 	struct wtbl_ba *ba;
1166 	struct tlv *tlv;
1167 
1168 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1169 					wtbl_tlv, sta_wtbl);
1170 
1171 	ba = (struct wtbl_ba *)tlv;
1172 	ba->tid = params->tid;
1173 
1174 	if (tx) {
1175 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1176 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1177 		ba->ba_en = enable;
1178 	} else {
1179 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1180 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1181 		ba->rst_ba_tid = params->tid;
1182 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1183 		ba->rst_ba_sb = 1;
1184 	}
1185 
1186 	if (enable && tx)
1187 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1188 }
1189 
1190 static int
1191 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1192 		  struct ieee80211_ampdu_params *params,
1193 		  bool enable, bool tx)
1194 {
1195 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1196 	struct mt7915_vif *mvif = msta->vif;
1197 	struct wtbl_req_hdr *wtbl_hdr;
1198 	struct tlv *sta_wtbl;
1199 	struct sk_buff *skb;
1200 	int ret;
1201 
1202 	if (enable && tx && !params->amsdu)
1203 		msta->wcid.amsdu = false;
1204 
1205 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1206 				       MT7915_STA_UPDATE_MAX_SIZE);
1207 	if (IS_ERR(skb))
1208 		return PTR_ERR(skb);
1209 
1210 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1211 
1212 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1213 					     &skb);
1214 	mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1215 
1216 	ret = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1217 				      MCU_EXT_CMD_STA_REC_UPDATE, true);
1218 	if (ret)
1219 		return ret;
1220 
1221 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1222 				       MT7915_STA_UPDATE_MAX_SIZE);
1223 	if (IS_ERR(skb))
1224 		return PTR_ERR(skb);
1225 
1226 	mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1227 
1228 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1229 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1230 }
1231 
1232 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1233 			 struct ieee80211_ampdu_params *params,
1234 			 bool enable)
1235 {
1236 	return mt7915_mcu_sta_ba(dev, params, enable, true);
1237 }
1238 
1239 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1240 			 struct ieee80211_ampdu_params *params,
1241 			 bool enable)
1242 {
1243 	return mt7915_mcu_sta_ba(dev, params, enable, false);
1244 }
1245 
1246 static void
1247 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1248 			    struct ieee80211_sta *sta, void *sta_wtbl,
1249 			    void *wtbl_tlv)
1250 {
1251 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1252 	struct wtbl_generic *generic;
1253 	struct wtbl_rx *rx;
1254 	struct tlv *tlv;
1255 
1256 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1257 					wtbl_tlv, sta_wtbl);
1258 
1259 	generic = (struct wtbl_generic *)tlv;
1260 
1261 	if (sta) {
1262 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1263 		generic->partial_aid = cpu_to_le16(sta->aid);
1264 		generic->muar_idx = mvif->omac_idx;
1265 		generic->qos = sta->wme;
1266 	} else {
1267 		/* use BSSID in station mode */
1268 		if (vif->type == NL80211_IFTYPE_STATION)
1269 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
1270 			       ETH_ALEN);
1271 		else
1272 			eth_broadcast_addr(generic->peer_addr);
1273 
1274 		generic->muar_idx = 0xe;
1275 	}
1276 
1277 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1278 					wtbl_tlv, sta_wtbl);
1279 
1280 	rx = (struct wtbl_rx *)tlv;
1281 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1282 	rx->rca2 = 1;
1283 	rx->rv = 1;
1284 }
1285 
1286 static void
1287 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1288 			 struct ieee80211_sta *sta, bool enable)
1289 {
1290 #define EXTRA_INFO_VER          BIT(0)
1291 #define EXTRA_INFO_NEW          BIT(1)
1292 	struct sta_rec_basic *basic;
1293 	struct tlv *tlv;
1294 
1295 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1296 
1297 	basic = (struct sta_rec_basic *)tlv;
1298 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1299 
1300 	if (enable) {
1301 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1302 		basic->conn_state = CONN_STATE_PORT_SECURE;
1303 	} else {
1304 		basic->conn_state = CONN_STATE_DISCONNECT;
1305 	}
1306 
1307 	if (!sta) {
1308 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1309 		eth_broadcast_addr(basic->peer_addr);
1310 		return;
1311 	}
1312 
1313 	switch (vif->type) {
1314 	case NL80211_IFTYPE_MESH_POINT:
1315 	case NL80211_IFTYPE_AP:
1316 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1317 		break;
1318 	case NL80211_IFTYPE_STATION:
1319 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1320 		break;
1321 	case NL80211_IFTYPE_ADHOC:
1322 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1323 		break;
1324 	default:
1325 		WARN_ON(1);
1326 		break;
1327 	}
1328 
1329 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1330 	basic->aid = cpu_to_le16(sta->aid);
1331 	basic->qos = sta->wme;
1332 }
1333 
1334 static void
1335 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1336 {
1337 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1338 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1339 	struct sta_rec_he *he;
1340 	struct tlv *tlv;
1341 	u32 cap = 0;
1342 
1343 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1344 
1345 	he = (struct sta_rec_he *)tlv;
1346 
1347 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1348 		cap |= STA_REC_HE_CAP_HTC;
1349 
1350 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1351 		cap |= STA_REC_HE_CAP_BSR;
1352 
1353 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1354 		cap |= STA_REC_HE_CAP_OM;
1355 
1356 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1357 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1358 
1359 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1360 		cap |= STA_REC_HE_CAP_BQR;
1361 
1362 	if (elem->phy_cap_info[0] &
1363 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1364 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1365 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1366 
1367 	if (elem->phy_cap_info[1] &
1368 	    IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1369 		cap |= STA_REC_HE_CAP_LDPC;
1370 
1371 	if (elem->phy_cap_info[1] &
1372 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1373 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1374 
1375 	if (elem->phy_cap_info[2] &
1376 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1377 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1378 
1379 	if (elem->phy_cap_info[2] &
1380 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1381 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1382 
1383 	if (elem->phy_cap_info[2] &
1384 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1385 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1386 
1387 	if (elem->phy_cap_info[6] &
1388 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1389 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1390 
1391 	if (elem->phy_cap_info[7] &
1392 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1393 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1394 
1395 	if (elem->phy_cap_info[7] &
1396 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1397 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1398 
1399 	if (elem->phy_cap_info[7] &
1400 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1401 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1402 
1403 	if (elem->phy_cap_info[8] &
1404 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1405 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1406 
1407 	if (elem->phy_cap_info[8] &
1408 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1409 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1410 
1411 	if (elem->phy_cap_info[9] &
1412 	    IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1413 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1414 
1415 	if (elem->phy_cap_info[9] &
1416 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1417 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1418 
1419 	if (elem->phy_cap_info[9] &
1420 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1421 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1422 
1423 	he->he_cap = cpu_to_le32(cap);
1424 
1425 	switch (sta->bandwidth) {
1426 	case IEEE80211_STA_RX_BW_160:
1427 		if (elem->phy_cap_info[0] &
1428 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1429 			he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1430 				he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1431 
1432 		he->max_nss_mcs[CMD_HE_MCS_BW160] =
1433 				he_cap->he_mcs_nss_supp.rx_mcs_160;
1434 		fallthrough;
1435 	default:
1436 		he->max_nss_mcs[CMD_HE_MCS_BW80] =
1437 				he_cap->he_mcs_nss_supp.rx_mcs_80;
1438 		break;
1439 	}
1440 
1441 	he->t_frame_dur =
1442 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1443 	he->max_ampdu_exp =
1444 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1445 
1446 	he->bw_set =
1447 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1448 	he->device_class =
1449 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1450 	he->punc_pream_rx =
1451 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1452 
1453 	he->dcm_tx_mode =
1454 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1455 	he->dcm_tx_max_nss =
1456 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1457 	he->dcm_rx_mode =
1458 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1459 	he->dcm_rx_max_nss =
1460 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1461 	he->dcm_rx_max_nss =
1462 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1463 
1464 	he->pkt_ext = 2;
1465 }
1466 
1467 static void
1468 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1469 		     struct ieee80211_vif *vif)
1470 {
1471 	struct sta_rec_uapsd *uapsd;
1472 	struct tlv *tlv;
1473 
1474 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1475 		return;
1476 
1477 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1478 	uapsd = (struct sta_rec_uapsd *)tlv;
1479 
1480 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1481 		uapsd->dac_map |= BIT(3);
1482 		uapsd->tac_map |= BIT(3);
1483 	}
1484 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1485 		uapsd->dac_map |= BIT(2);
1486 		uapsd->tac_map |= BIT(2);
1487 	}
1488 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1489 		uapsd->dac_map |= BIT(1);
1490 		uapsd->tac_map |= BIT(1);
1491 	}
1492 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1493 		uapsd->dac_map |= BIT(0);
1494 		uapsd->tac_map |= BIT(0);
1495 	}
1496 	uapsd->max_sp = sta->max_sp;
1497 }
1498 
1499 static void
1500 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1501 {
1502 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1503 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1504 	struct sta_rec_muru *muru;
1505 	struct tlv *tlv;
1506 
1507 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1508 
1509 	muru = (struct sta_rec_muru *)tlv;
1510 	muru->cfg.ofdma_dl_en = true;
1511 	muru->cfg.ofdma_ul_en = true;
1512 	muru->cfg.mimo_dl_en = true;
1513 	muru->cfg.mimo_ul_en = true;
1514 
1515 	muru->ofdma_dl.punc_pream_rx =
1516 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1517 	muru->ofdma_dl.he_20m_in_40m_2g =
1518 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1519 	muru->ofdma_dl.he_20m_in_160m =
1520 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1521 	muru->ofdma_dl.he_80m_in_160m =
1522 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1523 	muru->ofdma_dl.lt16_sigb = 0;
1524 	muru->ofdma_dl.rx_su_comp_sigb = 0;
1525 	muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1526 
1527 	muru->ofdma_ul.t_frame_dur =
1528 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1529 	muru->ofdma_ul.mu_cascading =
1530 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1531 	muru->ofdma_ul.uo_ra =
1532 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1533 	muru->ofdma_ul.he_2x996_tone = 0;
1534 	muru->ofdma_ul.rx_t_frame_11ac = 0;
1535 
1536 	muru->mimo_dl.vht_mu_bfee =
1537 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1538 	muru->mimo_dl.partial_bw_dl_mimo =
1539 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1540 
1541 	muru->mimo_ul.full_ul_mimo =
1542 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1543 	muru->mimo_ul.partial_ul_mimo =
1544 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1545 }
1546 
1547 static int
1548 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1549 		  struct ieee80211_sta *sta)
1550 {
1551 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1552 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1553 	struct sk_buff *skb;
1554 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1555 
1556 	if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1557 		return 0;
1558 
1559 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1560 	if (IS_ERR(skb))
1561 		return PTR_ERR(skb);
1562 
1563 	/* starec muru */
1564 	mt7915_mcu_sta_muru_tlv(skb, sta);
1565 
1566 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1567 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1568 }
1569 
1570 static void
1571 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1572 {
1573 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1574 	struct sta_rec_amsdu *amsdu;
1575 	struct tlv *tlv;
1576 
1577 	if (!sta->max_amsdu_len)
1578 	    return;
1579 
1580 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1581 	amsdu = (struct sta_rec_amsdu *)tlv;
1582 	amsdu->max_amsdu_num = 8;
1583 	amsdu->amsdu_en = true;
1584 	amsdu->max_mpdu_size = sta->max_amsdu_len >=
1585 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
1586 	msta->wcid.amsdu = true;
1587 }
1588 
1589 static bool
1590 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1591 {
1592 	switch (vif->type) {
1593 	case NL80211_IFTYPE_AP:
1594 	case NL80211_IFTYPE_STATION:
1595 		return true;
1596 	default:
1597 		return false;
1598 	}
1599 }
1600 
1601 static void
1602 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1603 		   struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1604 {
1605 	struct tlv *tlv;
1606 
1607 	/* starec ht */
1608 	if (sta->ht_cap.ht_supported) {
1609 		struct sta_rec_ht *ht;
1610 
1611 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1612 		ht = (struct sta_rec_ht *)tlv;
1613 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1614 
1615 		if (mt7915_hw_amsdu_supported(vif))
1616 			mt7915_mcu_sta_amsdu_tlv(skb, sta);
1617 	}
1618 
1619 	/* starec vht */
1620 	if (sta->vht_cap.vht_supported) {
1621 		struct sta_rec_vht *vht;
1622 
1623 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1624 		vht = (struct sta_rec_vht *)tlv;
1625 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1626 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1627 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1628 	}
1629 
1630 	/* starec he */
1631 	if (sta->he_cap.has_he)
1632 		mt7915_mcu_sta_he_tlv(skb, sta);
1633 
1634 	/* starec uapsd */
1635 	mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1636 }
1637 
1638 static void
1639 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1640 			 void *sta_wtbl, void *wtbl_tlv)
1641 {
1642 	struct wtbl_smps *smps;
1643 	struct tlv *tlv;
1644 
1645 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1646 					wtbl_tlv, sta_wtbl);
1647 	smps = (struct wtbl_smps *)tlv;
1648 
1649 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1650 		smps->smps = true;
1651 }
1652 
1653 static void
1654 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1655 		       void *sta_wtbl, void *wtbl_tlv)
1656 {
1657 	struct wtbl_ht *ht = NULL;
1658 	struct tlv *tlv;
1659 
1660 	/* wtbl ht */
1661 	if (sta->ht_cap.ht_supported) {
1662 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1663 						wtbl_tlv, sta_wtbl);
1664 		ht = (struct wtbl_ht *)tlv;
1665 		ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
1666 		ht->af = sta->ht_cap.ampdu_factor;
1667 		ht->mm = sta->ht_cap.ampdu_density;
1668 		ht->ht = true;
1669 	}
1670 
1671 	/* wtbl vht */
1672 	if (sta->vht_cap.vht_supported) {
1673 		struct wtbl_vht *vht;
1674 		u8 af;
1675 
1676 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1677 						wtbl_tlv, sta_wtbl);
1678 		vht = (struct wtbl_vht *)tlv;
1679 		vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC,
1680 		vht->vht = true;
1681 
1682 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1683 			       sta->vht_cap.cap);
1684 		if (ht)
1685 			ht->af = max_t(u8, ht->af, af);
1686 	}
1687 
1688 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1689 }
1690 
1691 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1692 			struct ieee80211_sta *sta)
1693 {
1694 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1695 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1696 	struct wtbl_req_hdr *wtbl_hdr;
1697 	struct tlv *sta_wtbl;
1698 	struct sk_buff *skb;
1699 
1700 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1701 				       MT7915_STA_UPDATE_MAX_SIZE);
1702 	if (IS_ERR(skb))
1703 		return PTR_ERR(skb);
1704 
1705 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1706 
1707 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1708 					     &skb);
1709 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1710 
1711 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1712 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1713 }
1714 
1715 static void
1716 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1717 {
1718 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1719 	bf->ndp_rate = 0;				/* mcs0 */
1720 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1721 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1722 }
1723 
1724 static void
1725 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct sta_rec_bf *bf)
1726 {
1727 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1728 	u8 n = 0;
1729 
1730 	bf->tx_mode = MT_PHY_TYPE_HT;
1731 	bf->bf_cap |= MT_IBF;
1732 
1733 	if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1734 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1735 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1736 			      mcs->tx_params);
1737 	else if (mcs->rx_mask[3])
1738 		n = 3;
1739 	else if (mcs->rx_mask[2])
1740 		n = 2;
1741 	else if (mcs->rx_mask[1])
1742 		n = 1;
1743 
1744 	bf->nc = min_t(u8, bf->nr, n);
1745 	bf->ibf_ncol = bf->nc;
1746 
1747 	if (sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1748 		bf->ibf_timeout = 0x48;
1749 }
1750 
1751 static void
1752 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1753 			struct sta_rec_bf *bf)
1754 {
1755 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1756 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1757 	u8 bfee_nr, bfer_nr, n, tx_ant = hweight8(phy->chainmask) - 1;
1758 	u16 mcs_map;
1759 
1760 	bf->tx_mode = MT_PHY_TYPE_VHT;
1761 	bf->bf_cap |= MT_EBF;
1762 
1763 	mt7915_mcu_sta_sounding_rate(bf);
1764 
1765 	bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1766 			    pc->cap);
1767 	bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1768 			    vc->cap);
1769 	mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1770 
1771 	n = min_t(u8, bfer_nr, bfee_nr);
1772 	bf->nr = min_t(u8, n, tx_ant);
1773 	n = mt7915_mcu_get_sta_nss(mcs_map);
1774 
1775 	bf->nc = min_t(u8, n, bf->nr);
1776 	bf->ibf_ncol = bf->nc;
1777 
1778 	/* force nr from 4 to 2 */
1779 	if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1780 		bf->nr = 1;
1781 }
1782 
1783 static void
1784 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1785 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1786 {
1787 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1788 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1789 	const struct ieee80211_he_cap_elem *ve;
1790 	const struct ieee80211_sta_he_cap *vc;
1791 	u8 bfee_nr, bfer_nr, nss_mcs;
1792 	u16 mcs_map;
1793 
1794 	vc = mt7915_get_he_phy_cap(phy, vif);
1795 	ve = &vc->he_cap_elem;
1796 
1797 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1798 	bf->bf_cap |= MT_EBF;
1799 
1800 	mt7915_mcu_sta_sounding_rate(bf);
1801 
1802 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1803 				pe->phy_cap_info[6]);
1804 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1805 				pe->phy_cap_info[6]);
1806 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1807 			 ve->phy_cap_info[5]);
1808 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1809 			 pe->phy_cap_info[4]);
1810 
1811 	mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.tx_mcs_80);
1812 	nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1813 
1814 	bf->nr = min_t(u8, bfer_nr, bfee_nr);
1815 	bf->nc = min_t(u8, nss_mcs, bf->nr);
1816 	bf->ibf_ncol = bf->nc;
1817 
1818 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1819 		return;
1820 
1821 	/* go over for 160MHz and 80p80 */
1822 	if (pe->phy_cap_info[0] &
1823 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1824 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1825 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1826 
1827 		bf->nc_bw160 = nss_mcs;
1828 	}
1829 
1830 	if (pe->phy_cap_info[0] &
1831 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1832 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1833 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1834 
1835 		if (bf->nc_bw160)
1836 			bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1837 		else
1838 			bf->nc_bw160 = nss_mcs;
1839 	}
1840 
1841 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1842 			 ve->phy_cap_info[5]);
1843 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1844 			 pe->phy_cap_info[4]);
1845 
1846 	bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1847 }
1848 
1849 static void
1850 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1851 			struct ieee80211_vif *vif, struct mt7915_phy *phy,
1852 			bool enable)
1853 {
1854 	struct sta_rec_bf *bf;
1855 	struct tlv *tlv;
1856 	int tx_ant = hweight8(phy->chainmask) - 1;
1857 	const u8 matrix[4][4] = {
1858 		{0, 0, 0, 0},
1859 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1860 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1861 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1862 	};
1863 
1864 #define MT_BFER_FREE		cpu_to_le16(GENMASK(15, 0))
1865 
1866 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1867 	bf = (struct sta_rec_bf *)tlv;
1868 
1869 	if (!enable) {
1870 		bf->pfmu = MT_BFER_FREE;
1871 		return;
1872 	}
1873 
1874 	bf->bw = sta->bandwidth;
1875 	bf->ibf_dbw = sta->bandwidth;
1876 	bf->ibf_nrow = tx_ant;
1877 	bf->ibf_timeout = 0x18;
1878 
1879 	if (sta->he_cap.has_he)
1880 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1881 	else if (sta->vht_cap.vht_supported)
1882 		mt7915_mcu_sta_bfer_vht(sta, phy, bf);
1883 	else if (sta->ht_cap.ht_supported)
1884 		mt7915_mcu_sta_bfer_ht(sta, bf);
1885 
1886 	if (bf->bf_cap & MT_EBF && bf->nr != tx_ant)
1887 		bf->mem_20m = matrix[tx_ant][bf->nc];
1888 	else
1889 		bf->mem_20m = matrix[bf->nr][bf->nc];
1890 
1891 	switch (sta->bandwidth) {
1892 	case IEEE80211_STA_RX_BW_160:
1893 	case IEEE80211_STA_RX_BW_80:
1894 		bf->mem_total = bf->mem_20m * 2;
1895 		break;
1896 	case IEEE80211_STA_RX_BW_40:
1897 		bf->mem_total = bf->mem_20m;
1898 		break;
1899 	case IEEE80211_STA_RX_BW_20:
1900 	default:
1901 		break;
1902 	}
1903 }
1904 
1905 static void
1906 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1907 			struct mt7915_phy *phy)
1908 {
1909 	struct sta_rec_bfee *bfee;
1910 	struct tlv *tlv;
1911 	int tx_ant = hweight8(phy->chainmask) - 1;
1912 	u8 nr = 0;
1913 
1914 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1915 	bfee = (struct sta_rec_bfee *)tlv;
1916 
1917 	if (sta->he_cap.has_he) {
1918 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1919 
1920 		nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1921 			    pe->phy_cap_info[5]);
1922 	} else if (sta->vht_cap.vht_supported) {
1923 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1924 
1925 		nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1926 			       pc->cap);
1927 	}
1928 
1929 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1930 	if (nr == 1 && tx_ant == 2)
1931 		bfee->fb_identity_matrix = true;
1932 }
1933 
1934 static u8
1935 mt7915_mcu_sta_txbf_type(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1936 			 struct ieee80211_sta *sta)
1937 {
1938 	u8 type = 0;
1939 
1940 	if (vif->type != NL80211_IFTYPE_STATION &&
1941 	    vif->type != NL80211_IFTYPE_AP)
1942 		return 0;
1943 
1944 	if (sta->he_cap.has_he) {
1945 		struct ieee80211_he_cap_elem *pe;
1946 		const struct ieee80211_he_cap_elem *ve;
1947 		const struct ieee80211_sta_he_cap *vc;
1948 
1949 		pe = &sta->he_cap.he_cap_elem;
1950 		vc = mt7915_get_he_phy_cap(phy, vif);
1951 		ve = &vc->he_cap_elem;
1952 
1953 		if ((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
1954 		     HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
1955 		    HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]))
1956 			type |= MT_STA_BFEE;
1957 
1958 		if ((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
1959 		     HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
1960 		    HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]))
1961 			type |= MT_STA_BFER;
1962 	} else if (sta->vht_cap.vht_supported) {
1963 		struct ieee80211_sta_vht_cap *pc;
1964 		struct ieee80211_sta_vht_cap *vc;
1965 		u32 cr, ce;
1966 
1967 		pc = &sta->vht_cap;
1968 		vc = &phy->mt76->sband_5g.sband.vht_cap;
1969 		cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
1970 		     IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
1971 		ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
1972 		     IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1973 
1974 		if ((pc->cap & cr) && (vc->cap & ce))
1975 			type |= MT_STA_BFEE;
1976 
1977 		if ((vc->cap & cr) && (pc->cap & ce))
1978 			type |= MT_STA_BFER;
1979 	} else if (sta->ht_cap.ht_supported) {
1980 		/* TODO: iBF */
1981 	}
1982 
1983 	return type;
1984 }
1985 
1986 static int
1987 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1988 		    struct ieee80211_sta *sta, bool enable)
1989 {
1990 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1991 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1992 	struct mt7915_phy *phy;
1993 	struct sk_buff *skb;
1994 	int r, len;
1995 	u8 type;
1996 
1997 	phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1998 
1999 	type = mt7915_mcu_sta_txbf_type(phy, vif, sta);
2000 
2001 	/* must keep each tag independent */
2002 
2003 	/* starec bf */
2004 	if (type & MT_STA_BFER) {
2005 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2006 
2007 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2008 		if (IS_ERR(skb))
2009 			return PTR_ERR(skb);
2010 
2011 		mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable);
2012 
2013 		r = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2014 					    MCU_EXT_CMD_STA_REC_UPDATE, true);
2015 		if (r)
2016 			return r;
2017 	}
2018 
2019 	/* starec bfee */
2020 	if (type & MT_STA_BFEE) {
2021 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2022 
2023 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2024 		if (IS_ERR(skb))
2025 			return PTR_ERR(skb);
2026 
2027 		mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2028 
2029 		r = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2030 					    MCU_EXT_CMD_STA_REC_UPDATE, true);
2031 		if (r)
2032 			return r;
2033 	}
2034 
2035 	return 0;
2036 }
2037 
2038 static void
2039 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2040 			     struct ieee80211_vif *vif,
2041 			     struct ieee80211_sta *sta)
2042 {
2043 	struct cfg80211_chan_def *chandef = &dev->mphy.chandef;
2044 	struct sta_rec_ra *ra;
2045 	struct tlv *tlv;
2046 	enum nl80211_band band = chandef->chan->band;
2047 	u32 supp_rate = sta->supp_rates[band];
2048 	int n_rates = hweight32(supp_rate);
2049 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
2050 	u8 i, nss = sta->rx_nss, mcs = 0;
2051 
2052 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2053 
2054 	ra = (struct sta_rec_ra *)tlv;
2055 	ra->valid = true;
2056 	ra->auto_rate = true;
2057 	ra->phy_mode = mt7915_get_phy_mode(dev, vif, band, sta);
2058 	ra->channel = chandef->chan->hw_value;
2059 	ra->bw = sta->bandwidth;
2060 	ra->rate_len = n_rates;
2061 	ra->phy.bw = sta->bandwidth;
2062 
2063 	if (n_rates) {
2064 		if (band == NL80211_BAND_2GHZ) {
2065 			ra->supp_mode = MODE_CCK;
2066 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2067 			ra->phy.type = MT_PHY_TYPE_CCK;
2068 
2069 			if (n_rates > 4) {
2070 				ra->supp_mode |= MODE_OFDM;
2071 				ra->supp_ofdm_rate = supp_rate >> 4;
2072 				ra->phy.type = MT_PHY_TYPE_OFDM;
2073 			}
2074 		} else {
2075 			ra->supp_mode = MODE_OFDM;
2076 			ra->supp_ofdm_rate = supp_rate;
2077 			ra->phy.type = MT_PHY_TYPE_OFDM;
2078 		}
2079 	}
2080 
2081 	if (sta->ht_cap.ht_supported) {
2082 		for (i = 0; i < nss; i++)
2083 			ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2084 
2085 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2086 		ra->supp_mode |= MODE_HT;
2087 		mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2088 		ra->af = sta->ht_cap.ampdu_factor;
2089 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2090 
2091 		cap |= STA_CAP_HT;
2092 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2093 			cap |= STA_CAP_SGI_20;
2094 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2095 			cap |= STA_CAP_SGI_40;
2096 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2097 			cap |= STA_CAP_TX_STBC;
2098 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2099 			cap |= STA_CAP_RX_STBC;
2100 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2101 			cap |= STA_CAP_LDPC;
2102 	}
2103 
2104 	if (sta->vht_cap.vht_supported) {
2105 		u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2106 		u16 vht_mcs;
2107 		u8 af, mcs_prev;
2108 
2109 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2110 			       sta->vht_cap.cap);
2111 		ra->af = max_t(u8, ra->af, af);
2112 
2113 		cap |= STA_CAP_VHT;
2114 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2115 			cap |= STA_CAP_VHT_SGI_80;
2116 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2117 			cap |= STA_CAP_VHT_SGI_160;
2118 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2119 			cap |= STA_CAP_VHT_TX_STBC;
2120 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2121 			cap |= STA_CAP_VHT_RX_STBC;
2122 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2123 			cap |= STA_CAP_VHT_LDPC;
2124 
2125 		ra->supp_mode |= MODE_VHT;
2126 		for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2127 			switch (mcs_map & 0x3) {
2128 			case IEEE80211_VHT_MCS_SUPPORT_0_9:
2129 				vht_mcs = GENMASK(9, 0);
2130 				break;
2131 			case IEEE80211_VHT_MCS_SUPPORT_0_8:
2132 				vht_mcs = GENMASK(8, 0);
2133 				break;
2134 			case IEEE80211_VHT_MCS_SUPPORT_0_7:
2135 				vht_mcs = GENMASK(7, 0);
2136 				break;
2137 			default:
2138 				vht_mcs = 0;
2139 			}
2140 
2141 			ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2142 
2143 			mcs_prev = hweight16(vht_mcs) - 1;
2144 			if (mcs_prev > mcs)
2145 				mcs = mcs_prev;
2146 
2147 			/* only support 2ss on 160MHz */
2148 			if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2149 				      ra->bw == CMD_CBW_8080MHZ))
2150 				break;
2151 		}
2152 	}
2153 
2154 	if (sta->he_cap.has_he) {
2155 		ra->supp_mode |= MODE_HE;
2156 		cap |= STA_CAP_HE;
2157 	}
2158 
2159 	ra->sta_status = cpu_to_le32(cap);
2160 
2161 	switch (BIT(fls(ra->supp_mode) - 1)) {
2162 	case MODE_VHT:
2163 		ra->phy.type = MT_PHY_TYPE_VHT;
2164 		ra->phy.mcs = mcs;
2165 		ra->phy.nss = nss;
2166 		ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2167 		ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2168 		ra->phy.sgi =
2169 			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2170 		break;
2171 	case MODE_HT:
2172 		ra->phy.type = MT_PHY_TYPE_HT;
2173 		ra->phy.mcs = mcs;
2174 		ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2175 		ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2176 		ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2177 		break;
2178 	default:
2179 		break;
2180 	}
2181 }
2182 
2183 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2184 			     struct ieee80211_sta *sta)
2185 {
2186 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2187 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2188 	struct sk_buff *skb;
2189 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2190 
2191 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2192 	if (IS_ERR(skb))
2193 		return PTR_ERR(skb);
2194 
2195 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2196 
2197 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2198 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
2199 }
2200 
2201 static int
2202 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2203 		     struct ieee80211_sta *sta)
2204 {
2205 #define MT_STA_BSS_GROUP		1
2206 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2207 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2208 	struct {
2209 		__le32 action;
2210 		u8 wlan_idx_lo;
2211 		u8 status;
2212 		u8 wlan_idx_hi;
2213 		u8 rsv0[5];
2214 		__le32 val;
2215 		u8 rsv1[8];
2216 	} __packed req = {
2217 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
2218 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
2219 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
2220 		.val = cpu_to_le32(mvif->idx),
2221 	};
2222 
2223 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_DRR_CTRL,
2224 				   &req, sizeof(req), true);
2225 }
2226 
2227 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2228 			   struct ieee80211_sta *sta, bool enable)
2229 {
2230 	int ret;
2231 
2232 	if (!sta)
2233 		return 0;
2234 
2235 	/* must keep the order */
2236 	ret = mt7915_mcu_add_group(dev, vif, sta);
2237 	if (ret)
2238 		return ret;
2239 
2240 	ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2241 	if (ret)
2242 		return ret;
2243 
2244 	ret = mt7915_mcu_add_mu(dev, vif, sta);
2245 	if (ret)
2246 		return ret;
2247 
2248 	if (enable)
2249 		return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2250 
2251 	return 0;
2252 }
2253 
2254 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2255 		       struct ieee80211_sta *sta, bool enable)
2256 {
2257 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2258 	struct wtbl_req_hdr *wtbl_hdr;
2259 	struct mt7915_sta *msta;
2260 	struct tlv *sta_wtbl;
2261 	struct sk_buff *skb;
2262 
2263 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2264 
2265 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2266 				       MT7915_STA_UPDATE_MAX_SIZE);
2267 	if (IS_ERR(skb))
2268 		return PTR_ERR(skb);
2269 
2270 	mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2271 	if (enable && sta)
2272 		mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2273 
2274 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2275 
2276 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2277 					     sta_wtbl, &skb);
2278 	if (enable) {
2279 		mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2280 		if (sta)
2281 			mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2282 	}
2283 
2284 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2285 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
2286 }
2287 
2288 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2289 			      struct ieee80211_sta *sta, u32 rate)
2290 {
2291 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2292 	struct mt7915_vif *mvif = msta->vif;
2293 	struct sta_rec_ra_fixed *ra;
2294 	struct sk_buff *skb;
2295 	struct tlv *tlv;
2296 	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2297 
2298 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2299 	if (IS_ERR(skb))
2300 		return PTR_ERR(skb);
2301 
2302 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2303 	ra = (struct sta_rec_ra_fixed *)tlv;
2304 
2305 	if (!rate) {
2306 		ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2307 		goto out;
2308 	} else {
2309 		ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2310 	}
2311 
2312 	ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2313 	ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2314 	ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2315 	ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2316 	ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2317 
2318 	if (ra->phy.bw)
2319 		ra->phy.ldpc = 7;
2320 	else
2321 		ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2322 
2323 	/* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2324 	if (ra->phy.type > MT_PHY_TYPE_VHT)
2325 		ra->phy.sgi = ra->phy.mcs * 85;
2326 	else
2327 		ra->phy.sgi = ra->phy.mcs * 15;
2328 
2329 out:
2330 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2331 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
2332 }
2333 
2334 int mt7915_mcu_add_dev_info(struct mt7915_dev *dev,
2335 			    struct ieee80211_vif *vif, bool enable)
2336 {
2337 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2338 	struct {
2339 		struct req_hdr {
2340 			u8 omac_idx;
2341 			u8 dbdc_idx;
2342 			__le16 tlv_num;
2343 			u8 is_tlv_append;
2344 			u8 rsv[3];
2345 		} __packed hdr;
2346 		struct req_tlv {
2347 			__le16 tag;
2348 			__le16 len;
2349 			u8 active;
2350 			u8 dbdc_idx;
2351 			u8 omac_addr[ETH_ALEN];
2352 		} __packed tlv;
2353 	} data = {
2354 		.hdr = {
2355 			.omac_idx = mvif->omac_idx,
2356 			.dbdc_idx = mvif->band_idx,
2357 			.tlv_num = cpu_to_le16(1),
2358 			.is_tlv_append = 1,
2359 		},
2360 		.tlv = {
2361 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2362 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2363 			.active = enable,
2364 			.dbdc_idx = mvif->band_idx,
2365 		},
2366 	};
2367 
2368 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2369 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
2370 				   &data, sizeof(data), true);
2371 }
2372 
2373 static void
2374 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2375 		      struct bss_info_bcn *bcn,
2376 		      struct ieee80211_mutable_offsets *offs)
2377 {
2378 	if (offs->cntdwn_counter_offs[0]) {
2379 		struct tlv *tlv;
2380 		struct bss_info_bcn_csa *csa;
2381 
2382 		tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2383 						   sizeof(*csa), &bcn->sub_ntlv,
2384 						   &bcn->len);
2385 		csa = (struct bss_info_bcn_csa *)tlv;
2386 		csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2387 	}
2388 }
2389 
2390 static void
2391 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2392 		       struct sk_buff *skb, struct bss_info_bcn *bcn,
2393 		       struct ieee80211_mutable_offsets *offs)
2394 {
2395 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2396 	struct bss_info_bcn_cont *cont;
2397 	struct tlv *tlv;
2398 	u8 *buf;
2399 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2400 
2401 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2402 					   len, &bcn->sub_ntlv, &bcn->len);
2403 
2404 	cont = (struct bss_info_bcn_cont *)tlv;
2405 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2406 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2407 
2408 	if (offs->cntdwn_counter_offs[0])
2409 		cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2410 
2411 	buf = (u8 *)tlv + sizeof(*cont);
2412 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2413 			      true);
2414 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2415 }
2416 
2417 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2418 			  struct ieee80211_vif *vif, int en)
2419 {
2420 #define MAX_BEACON_SIZE 512
2421 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2422 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2423 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2424 	struct ieee80211_mutable_offsets offs;
2425 	struct ieee80211_tx_info *info;
2426 	struct sk_buff *skb, *rskb;
2427 	struct tlv *tlv;
2428 	struct bss_info_bcn *bcn;
2429 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2430 
2431 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2432 	if (!skb)
2433 		return -EINVAL;
2434 
2435 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2436 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2437 		dev_kfree_skb(skb);
2438 		return -EINVAL;
2439 	}
2440 
2441 	rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2442 	if (IS_ERR(rskb)) {
2443 		dev_kfree_skb(skb);
2444 		return PTR_ERR(rskb);
2445 	}
2446 
2447 	tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2448 	bcn = (struct bss_info_bcn *)tlv;
2449 	bcn->enable = en;
2450 
2451 	if (mvif->band_idx) {
2452 		info = IEEE80211_SKB_CB(skb);
2453 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2454 	}
2455 
2456 	/* TODO: subtag - bss color count & 11v MBSSID */
2457 	mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2458 	mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2459 	dev_kfree_skb(skb);
2460 
2461 	return __mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2462 				       MCU_EXT_CMD_BSS_INFO_UPDATE, true);
2463 }
2464 
2465 static int mt7915_mcu_send_firmware(struct mt7915_dev *dev, const void *data,
2466 				    int len)
2467 {
2468 	int ret = 0, cur_len;
2469 
2470 	while (len > 0) {
2471 		cur_len = min_t(int, 4096 - sizeof(struct mt7915_mcu_txd),
2472 				len);
2473 
2474 		ret = __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_SCATTER,
2475 					  data, cur_len, false);
2476 		if (ret)
2477 			break;
2478 
2479 		data += cur_len;
2480 		len -= cur_len;
2481 		mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2482 	}
2483 
2484 	return ret;
2485 }
2486 
2487 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2488 				     u32 option)
2489 {
2490 	struct {
2491 		__le32 option;
2492 		__le32 addr;
2493 	} req = {
2494 		.option = cpu_to_le32(option),
2495 		.addr = cpu_to_le32(addr),
2496 	};
2497 
2498 	return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ,
2499 				   &req, sizeof(req), true);
2500 }
2501 
2502 static int mt7915_mcu_restart(struct mt76_dev *dev)
2503 {
2504 	struct {
2505 		u8 power_mode;
2506 		u8 rsv[3];
2507 	} req = {
2508 		.power_mode = 1,
2509 	};
2510 
2511 	return __mt76_mcu_send_msg(dev, -MCU_CMD_NIC_POWER_CTRL, &req,
2512 				   sizeof(req), false);
2513 }
2514 
2515 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2516 {
2517 	struct {
2518 		__le32 op;
2519 	} req = {
2520 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2521 	};
2522 
2523 	return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL,
2524 				   &req, sizeof(req), true);
2525 }
2526 
2527 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2528 {
2529 	struct {
2530 		u8 check_crc;
2531 		u8 reserved[3];
2532 	} req = {
2533 		.check_crc = 0,
2534 	};
2535 
2536 	return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ,
2537 				   &req, sizeof(req), true);
2538 }
2539 
2540 static int mt7915_driver_own(struct mt7915_dev *dev)
2541 {
2542 	u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2543 
2544 	mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2545 	if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2546 			    0, 500)) {
2547 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2548 		return -EIO;
2549 	}
2550 
2551 	return 0;
2552 }
2553 
2554 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2555 				    u32 len, u32 mode)
2556 {
2557 	struct {
2558 		__le32 addr;
2559 		__le32 len;
2560 		__le32 mode;
2561 	} req = {
2562 		.addr = cpu_to_le32(addr),
2563 		.len = cpu_to_le32(len),
2564 		.mode = cpu_to_le32(mode),
2565 	};
2566 	int attr;
2567 
2568 	if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2569 		attr = -MCU_CMD_PATCH_START_REQ;
2570 	else
2571 		attr = -MCU_CMD_TARGET_ADDRESS_LEN_REQ;
2572 
2573 	return __mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2574 }
2575 
2576 static int mt7915_load_patch(struct mt7915_dev *dev)
2577 {
2578 	const struct mt7915_patch_hdr *hdr;
2579 	const struct firmware *fw = NULL;
2580 	int i, ret, sem;
2581 
2582 	sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2583 	switch (sem) {
2584 	case PATCH_IS_DL:
2585 		return 0;
2586 	case PATCH_NOT_DL_SEM_SUCCESS:
2587 		break;
2588 	default:
2589 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2590 		return -EAGAIN;
2591 	}
2592 
2593 	ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2594 	if (ret)
2595 		goto out;
2596 
2597 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2598 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2599 		ret = -EINVAL;
2600 		goto out;
2601 	}
2602 
2603 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2604 
2605 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2606 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2607 
2608 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2609 		struct mt7915_patch_sec *sec;
2610 		const u8 *dl;
2611 		u32 len, addr;
2612 
2613 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2614 						  i * sizeof(*sec));
2615 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2616 		    PATCH_SEC_TYPE_INFO) {
2617 			ret = -EINVAL;
2618 			goto out;
2619 		}
2620 
2621 		addr = be32_to_cpu(sec->info.addr);
2622 		len = be32_to_cpu(sec->info.len);
2623 		dl = fw->data + be32_to_cpu(sec->offs);
2624 
2625 		ret = mt7915_mcu_init_download(dev, addr, len,
2626 					       DL_MODE_NEED_RSP);
2627 		if (ret) {
2628 			dev_err(dev->mt76.dev, "Download request failed\n");
2629 			goto out;
2630 		}
2631 
2632 		ret = mt7915_mcu_send_firmware(dev, dl, len);
2633 		if (ret) {
2634 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2635 			goto out;
2636 		}
2637 	}
2638 
2639 	ret = mt7915_mcu_start_patch(dev);
2640 	if (ret)
2641 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2642 
2643 out:
2644 	sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2645 	switch (sem) {
2646 	case PATCH_REL_SEM_SUCCESS:
2647 		break;
2648 	default:
2649 		ret = -EAGAIN;
2650 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2651 		goto out;
2652 	}
2653 	release_firmware(fw);
2654 
2655 	return ret;
2656 }
2657 
2658 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2659 {
2660 	u32 ret = 0;
2661 
2662 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2663 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2664 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2665 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2666 	ret |= DL_MODE_NEED_RSP;
2667 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2668 
2669 	return ret;
2670 }
2671 
2672 static int
2673 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2674 			     const struct mt7915_fw_trailer *hdr,
2675 			     const u8 *data, bool is_wa)
2676 {
2677 	int i, offset = 0;
2678 	u32 override = 0, option = 0;
2679 
2680 	for (i = 0; i < hdr->n_region; i++) {
2681 		const struct mt7915_fw_region *region;
2682 		int err;
2683 		u32 len, addr, mode;
2684 
2685 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2686 			 (hdr->n_region - i) * sizeof(*region));
2687 		mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2688 		len = le32_to_cpu(region->len);
2689 		addr = le32_to_cpu(region->addr);
2690 
2691 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2692 			override = addr;
2693 
2694 		err = mt7915_mcu_init_download(dev, addr, len, mode);
2695 		if (err) {
2696 			dev_err(dev->mt76.dev, "Download request failed\n");
2697 			return err;
2698 		}
2699 
2700 		err = mt7915_mcu_send_firmware(dev, data + offset, len);
2701 		if (err) {
2702 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2703 			return err;
2704 		}
2705 
2706 		offset += len;
2707 	}
2708 
2709 	if (override)
2710 		option |= FW_START_OVERRIDE;
2711 
2712 	if (is_wa)
2713 		option |= FW_START_WORKING_PDA_CR4;
2714 
2715 	return mt7915_mcu_start_firmware(dev, override, option);
2716 }
2717 
2718 static int mt7915_load_ram(struct mt7915_dev *dev)
2719 {
2720 	const struct mt7915_fw_trailer *hdr;
2721 	const struct firmware *fw;
2722 	int ret;
2723 
2724 	ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2725 	if (ret)
2726 		return ret;
2727 
2728 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2729 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2730 		ret = -EINVAL;
2731 		goto out;
2732 	}
2733 
2734 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2735 					sizeof(*hdr));
2736 
2737 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2738 		 hdr->fw_ver, hdr->build_date);
2739 
2740 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2741 	if (ret) {
2742 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2743 		goto out;
2744 	}
2745 
2746 	release_firmware(fw);
2747 
2748 	ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2749 	if (ret)
2750 		return ret;
2751 
2752 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2753 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2754 		ret = -EINVAL;
2755 		goto out;
2756 	}
2757 
2758 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2759 					sizeof(*hdr));
2760 
2761 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2762 		 hdr->fw_ver, hdr->build_date);
2763 
2764 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2765 	if (ret) {
2766 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2767 		goto out;
2768 	}
2769 
2770 	snprintf(dev->mt76.hw->wiphy->fw_version,
2771 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2772 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2773 
2774 out:
2775 	release_firmware(fw);
2776 
2777 	return ret;
2778 }
2779 
2780 static int mt7915_load_firmware(struct mt7915_dev *dev)
2781 {
2782 	int ret;
2783 	u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2784 
2785 	val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2786 
2787 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2788 		/* restart firmware once */
2789 		__mt76_mcu_restart(&dev->mt76);
2790 		if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2791 				    val, 1000)) {
2792 			dev_err(dev->mt76.dev,
2793 				"Firmware is not ready for download\n");
2794 			return -EIO;
2795 		}
2796 	}
2797 
2798 	ret = mt7915_load_patch(dev);
2799 	if (ret)
2800 		return ret;
2801 
2802 	ret = mt7915_load_ram(dev);
2803 	if (ret)
2804 		return ret;
2805 
2806 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2807 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2808 				       FW_STATE_WACPU_RDY), 1000)) {
2809 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2810 		return -EIO;
2811 	}
2812 
2813 	mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2814 
2815 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2816 
2817 	return 0;
2818 }
2819 
2820 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2821 {
2822 	struct {
2823 		u8 ctrl_val;
2824 		u8 pad[3];
2825 	} data = {
2826 		.ctrl_val = ctrl
2827 	};
2828 
2829 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST,
2830 				   &data, sizeof(data), true);
2831 }
2832 
2833 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2834 {
2835 	struct {
2836 		u8 ver;
2837 		u8 pad;
2838 		u16 len;
2839 		u8 level;
2840 		u8 rsv[3];
2841 		__le32 module_idx;
2842 	} data = {
2843 		.module_idx = cpu_to_le32(module),
2844 		.level = level,
2845 	};
2846 
2847 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_DBG_CTRL,
2848 				   &data, sizeof(data), false);
2849 }
2850 
2851 int mt7915_mcu_init(struct mt7915_dev *dev)
2852 {
2853 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2854 		.headroom = sizeof(struct mt7915_mcu_txd),
2855 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2856 		.mcu_send_msg = mt7915_mcu_msg_send,
2857 		.mcu_restart = mt7915_mcu_restart,
2858 	};
2859 	int ret;
2860 
2861 	dev->mt76.mcu_ops = &mt7915_mcu_ops,
2862 
2863 	ret = mt7915_driver_own(dev);
2864 	if (ret)
2865 		return ret;
2866 
2867 	ret = mt7915_load_firmware(dev);
2868 	if (ret)
2869 		return ret;
2870 
2871 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2872 	mt7915_mcu_fw_log_2_host(dev, 0);
2873 
2874 	return 0;
2875 }
2876 
2877 void mt7915_mcu_exit(struct mt7915_dev *dev)
2878 {
2879 	u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2880 
2881 	__mt76_mcu_restart(&dev->mt76);
2882 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2883 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2884 				       FW_STATE_FW_DOWNLOAD), 1000)) {
2885 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2886 		return;
2887 	}
2888 
2889 	reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2890 	mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2891 	skb_queue_purge(&dev->mt76.mcu.res_q);
2892 }
2893 
2894 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2895 		       bool enable, bool hdr_trans)
2896 {
2897 	struct {
2898 		u8 operation;
2899 		u8 enable;
2900 		u8 check_bssid;
2901 		u8 insert_vlan;
2902 		u8 remove_vlan;
2903 		u8 tid;
2904 		u8 mode;
2905 		u8 rsv;
2906 	} __packed req_trans = {
2907 		.enable = hdr_trans,
2908 	};
2909 	struct {
2910 		u8 enable;
2911 		u8 band;
2912 		u8 rsv[2];
2913 	} __packed req_mac = {
2914 		.enable = enable,
2915 		.band = band,
2916 	};
2917 	int ret;
2918 
2919 	ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RX_HDR_TRANS,
2920 				  &req_trans, sizeof(req_trans), false);
2921 	if (ret)
2922 		return ret;
2923 
2924 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2925 				   &req_mac, sizeof(req_mac), true);
2926 }
2927 
2928 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2929 {
2930 	struct {
2931 		__le32 cmd;
2932 		u8 band;
2933 		u8 enable;
2934 	} __packed req = {
2935 		.cmd = cpu_to_le32(SCS_ENABLE),
2936 		.band = band,
2937 		.enable = enable + 1,
2938 	};
2939 
2940 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SCS_CTRL, &req,
2941 				   sizeof(req), false);
2942 }
2943 
2944 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2945 {
2946 	struct mt7915_dev *dev = phy->dev;
2947 	struct {
2948 		u8 prot_idx;
2949 		u8 band;
2950 		u8 rsv[2];
2951 		__le32 len_thresh;
2952 		__le32 pkt_thresh;
2953 	} __packed req = {
2954 		.prot_idx = 1,
2955 		.band = phy != &dev->phy,
2956 		.len_thresh = cpu_to_le32(val),
2957 		.pkt_thresh = cpu_to_le32(0x2),
2958 	};
2959 
2960 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
2961 				   &req, sizeof(req), true);
2962 }
2963 
2964 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2965 {
2966 #define WMM_AIFS_SET		BIT(0)
2967 #define WMM_CW_MIN_SET		BIT(1)
2968 #define WMM_CW_MAX_SET		BIT(2)
2969 #define WMM_TXOP_SET		BIT(3)
2970 #define WMM_PARAM_SET		GENMASK(3, 0)
2971 #define TX_CMD_MODE		1
2972 	struct edca {
2973 		u8 queue;
2974 		u8 set;
2975 		u8 aifs;
2976 		u8 cw_min;
2977 		__le16 cw_max;
2978 		__le16 txop;
2979 	};
2980 	struct mt7915_mcu_tx {
2981 		u8 total;
2982 		u8 action;
2983 		u8 valid;
2984 		u8 mode;
2985 
2986 		struct edca edca[IEEE80211_NUM_ACS];
2987 	} __packed req = {
2988 		.valid = true,
2989 		.mode = TX_CMD_MODE,
2990 		.total = IEEE80211_NUM_ACS,
2991 	};
2992 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2993 	int ac;
2994 
2995 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2996 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2997 		struct edca *e = &req.edca[ac];
2998 
2999 		e->set = WMM_PARAM_SET;
3000 		e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3001 		e->aifs = q->aifs;
3002 		e->txop = cpu_to_le16(q->txop);
3003 
3004 		if (q->cw_min)
3005 			e->cw_min = fls(q->cw_min);
3006 		else
3007 			e->cw_min = 5;
3008 
3009 		if (q->cw_max)
3010 			e->cw_max = cpu_to_le16(fls(q->cw_max));
3011 		else
3012 			e->cw_max = cpu_to_le16(10);
3013 	}
3014 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
3015 				  &req, sizeof(req), true);
3016 }
3017 
3018 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3019 {
3020 #define ENTER_PM_STATE		1
3021 #define EXIT_PM_STATE		2
3022 	struct {
3023 		u8 pm_number;
3024 		u8 pm_state;
3025 		u8 bssid[ETH_ALEN];
3026 		u8 dtim_period;
3027 		u8 wlan_idx_lo;
3028 		__le16 bcn_interval;
3029 		__le32 aid;
3030 		__le32 rx_filter;
3031 		u8 band_idx;
3032 		u8 wlan_idx_hi;
3033 		u8 rsv[2];
3034 		__le32 feature;
3035 		u8 omac_idx;
3036 		u8 wmm_idx;
3037 		u8 bcn_loss_cnt;
3038 		u8 bcn_sp_duration;
3039 	} __packed req = {
3040 		.pm_number = 5,
3041 		.pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3042 		.band_idx = band,
3043 	};
3044 
3045 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
3046 				   &req, sizeof(req), true);
3047 }
3048 
3049 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3050 		       enum mt7915_rdd_cmd cmd, u8 index,
3051 		       u8 rx_sel, u8 val)
3052 {
3053 	struct {
3054 		u8 ctrl;
3055 		u8 rdd_idx;
3056 		u8 rdd_rx_sel;
3057 		u8 val;
3058 		u8 rsv[4];
3059 	} __packed req = {
3060 		.ctrl = cmd,
3061 		.rdd_idx = index,
3062 		.rdd_rx_sel = rx_sel,
3063 		.val = val,
3064 	};
3065 
3066 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL,
3067 				   &req, sizeof(req), true);
3068 }
3069 
3070 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3071 {
3072 	struct {
3073 		u32 tag;
3074 		u16 min_lpn;
3075 		u8 rsv[2];
3076 	} __packed req = {
3077 		.tag = 0x1,
3078 		.min_lpn = val,
3079 	};
3080 
3081 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
3082 				   &req, sizeof(req), true);
3083 }
3084 
3085 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3086 			    const struct mt7915_dfs_pulse *pulse)
3087 {
3088 	struct {
3089 		u32 tag;
3090 		struct mt7915_dfs_pulse pulse;
3091 	} __packed req = {
3092 		.tag = 0x3,
3093 	};
3094 
3095 	memcpy(&req.pulse, pulse, sizeof(*pulse));
3096 
3097 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
3098 				   &req, sizeof(req), true);
3099 }
3100 
3101 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3102 			    const struct mt7915_dfs_pattern *pattern)
3103 {
3104 	struct {
3105 		u32 tag;
3106 		u16 radar_type;
3107 		struct mt7915_dfs_pattern pattern;
3108 	} __packed req = {
3109 		.tag = 0x2,
3110 		.radar_type = index,
3111 	};
3112 
3113 	memcpy(&req.pattern, pattern, sizeof(*pattern));
3114 
3115 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
3116 				   &req, sizeof(req), true);
3117 }
3118 
3119 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3120 {
3121 	struct mt7915_dev *dev = phy->dev;
3122 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3123 	int freq1 = chandef->center_freq1;
3124 	struct {
3125 		u8 control_ch;
3126 		u8 center_ch;
3127 		u8 bw;
3128 		u8 tx_streams_num;
3129 		u8 rx_streams;	/* mask or num */
3130 		u8 switch_reason;
3131 		u8 band_idx;
3132 		u8 center_ch2;	/* for 80+80 only */
3133 		__le16 cac_case;
3134 		u8 channel_band;
3135 		u8 rsv0;
3136 		__le32 outband_freq;
3137 		u8 txpower_drop;
3138 		u8 ap_bw;
3139 		u8 ap_center_ch;
3140 		u8 rsv1[57];
3141 	} __packed req = {
3142 		.control_ch = chandef->chan->hw_value,
3143 		.center_ch = ieee80211_frequency_to_channel(freq1),
3144 		.bw = mt7915_mcu_chan_bw(chandef),
3145 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
3146 		.rx_streams = phy->chainmask,
3147 		.band_idx = phy != &dev->phy,
3148 		.channel_band = chandef->chan->band,
3149 	};
3150 
3151 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3152 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3153 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3154 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3155 		req.switch_reason = CH_SWITCH_DFS;
3156 	else
3157 		req.switch_reason = CH_SWITCH_NORMAL;
3158 
3159 	if (cmd == MCU_EXT_CMD_CHANNEL_SWITCH)
3160 		req.rx_streams = hweight8(req.rx_streams);
3161 
3162 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3163 		int freq2 = chandef->center_freq2;
3164 
3165 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3166 	}
3167 
3168 	return __mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3169 }
3170 
3171 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3172 {
3173 	struct req_hdr {
3174 		u8 buffer_mode;
3175 		u8 format;
3176 		__le16 len;
3177 	} __packed req = {
3178 		.buffer_mode = EE_MODE_EFUSE,
3179 		.format = EE_FORMAT_WHOLE,
3180 	};
3181 
3182 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
3183 				   &req, sizeof(req), true);
3184 }
3185 
3186 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3187 {
3188 	struct mt7915_mcu_eeprom_info req = {
3189 		.addr = cpu_to_le32(round_down(offset, 16)),
3190 	};
3191 
3192 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_ACCESS, &req,
3193 				   sizeof(req), true);
3194 }
3195 
3196 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3197 {
3198 	struct {
3199 		u8 ctrl_id;
3200 		u8 action;
3201 		u8 band;
3202 		u8 rsv[5];
3203 	} req = {
3204 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3205 		.action = index,
3206 	};
3207 
3208 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_THERMAL_CTRL, &req,
3209 				   sizeof(req), true);
3210 }
3211 
3212 int mt7915_mcu_get_rate_info(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3213 {
3214 	struct {
3215 		__le32 cmd;
3216 		__le16 wlan_idx;
3217 		__le16 ru_idx;
3218 		__le16 direction;
3219 		__le16 dump_group;
3220 	} req = {
3221 		.cmd = cpu_to_le32(cmd),
3222 		.wlan_idx = cpu_to_le16(wlan_idx),
3223 		.dump_group = cpu_to_le16(1),
3224 	};
3225 
3226 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RATE_CTRL, &req,
3227 				   sizeof(req), false);
3228 }
3229 
3230 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3231 {
3232 	struct mt7915_dev *dev = phy->dev;
3233 	struct mt76_phy *mphy = phy->mt76;
3234 	struct ieee80211_hw *hw = mphy->hw;
3235 	struct mt7915_sku_val {
3236 		u8 format_id;
3237 		u8 limit_type;
3238 		u8 dbdc_idx;
3239 		s8 val[MT7915_SKU_RATE_NUM];
3240 	} __packed req = {
3241 		.format_id = 4,
3242 		.dbdc_idx = phy != &dev->phy,
3243 	};
3244 	int i;
3245 	s8 *delta;
3246 
3247 	delta = dev->rate_power[mphy->chandef.chan->band];
3248 	mphy->txpower_cur = hw->conf.power_level * 2 +
3249 			    delta[MT7915_SKU_MAX_DELTA_IDX];
3250 
3251 	for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3252 		req.val[i] = hw->conf.power_level * 2 + delta[i];
3253 
3254 	return __mt76_mcu_send_msg(&dev->mt76,
3255 				   MCU_EXT_CMD_TX_POWER_FEATURE_CTRL,
3256 				   &req, sizeof(req), true);
3257 }
3258 
3259 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3260 {
3261 	struct mt7915_dev *dev = phy->dev;
3262 	struct mt7915_sku {
3263 		u8 format_id;
3264 		u8 sku_enable;
3265 		u8 dbdc_idx;
3266 		u8 rsv;
3267 	} __packed req = {
3268 		.format_id = 0,
3269 		.dbdc_idx = phy != &dev->phy,
3270 		.sku_enable = enable,
3271 	};
3272 
3273 	return __mt76_mcu_send_msg(&dev->mt76,
3274 				   MCU_EXT_CMD_TX_POWER_FEATURE_CTRL,
3275 				   &req, sizeof(req), true);
3276 }
3277 
3278 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3279 {
3280 	struct {
3281 		u8 action;
3282 		u8 set;
3283 		u8 band;
3284 		u8 rsv;
3285 	} req = {
3286 		.action = action,
3287 		.set = set,
3288 		.band = band,
3289 	};
3290 
3291 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SER_TRIGGER,
3292 				   &req, sizeof(req), false);
3293 }
3294 
3295 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3296 {
3297 #define MT_BF_TYPE_UPDATE		20
3298 	struct {
3299 		u8 action;
3300 		bool ebf;
3301 		bool ibf;
3302 		u8 rsv;
3303 	} __packed req = {
3304 		.action = MT_BF_TYPE_UPDATE,
3305 		.ebf = true,
3306 		.ibf = false,
3307 	};
3308 
3309 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION,
3310 				   &req, sizeof(req), true);
3311 }
3312 
3313 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3314 {
3315 #define MT_BF_PROCESSING		4
3316 	struct {
3317 		u8 action;
3318 		u8 snd_mode;
3319 		u8 sta_num;
3320 		u8 rsv;
3321 		u8 wlan_idx[4];
3322 		__le32 snd_period;	/* ms */
3323 	} __packed req = {
3324 		.action = true,
3325 		.snd_mode = MT_BF_PROCESSING,
3326 	};
3327 
3328 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION,
3329 				   &req, sizeof(req), true);
3330 }
3331 
3332 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3333 			    bool enable)
3334 {
3335 #define MT_SPR_ENABLE		1
3336 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3337 	struct {
3338 		u8 action;
3339 		u8 arg_num;
3340 		u8 band_idx;
3341 		u8 status;
3342 		u8 drop_tx_idx;
3343 		u8 sta_idx;	/* 256 sta */
3344 		u8 rsv[2];
3345 		u32 val;
3346 	} __packed req = {
3347 		.action = MT_SPR_ENABLE,
3348 		.arg_num = 1,
3349 		.band_idx = mvif->band_idx,
3350 		.val = enable,
3351 	};
3352 
3353 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SPR,
3354 				   &req, sizeof(req), true);
3355 }
3356