1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7981:						\
17 		_fw = MT7981_##name;				\
18 		break;						\
19 	case 0x7986:						\
20 		_fw = MT7986_##name##__VA_ARGS__;		\
21 		break;						\
22 	default:						\
23 		_fw = MT7916_##name;				\
24 		break;						\
25 	}							\
26 	_fw;							\
27 })
28 
29 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
30 					 fw_name(_dev, name) :			\
31 					 fw_name(_dev, name, _MT7975))
32 
33 #define MCU_PATCH_ADDRESS		0x200000
34 
35 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
36 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
37 
38 static bool sr_scene_detect = true;
39 module_param(sr_scene_detect, bool, 0644);
40 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
41 
42 static u8
43 mt7915_mcu_get_sta_nss(u16 mcs_map)
44 {
45 	u8 nss;
46 
47 	for (nss = 8; nss > 0; nss--) {
48 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
49 
50 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
51 			break;
52 	}
53 
54 	return nss - 1;
55 }
56 
57 static void
58 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
59 			  u16 mcs_map)
60 {
61 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
62 	struct mt7915_dev *dev = msta->vif->phy->dev;
63 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
64 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
65 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
66 
67 	for (nss = 0; nss < max_nss; nss++) {
68 		int mcs;
69 
70 		switch ((mcs_map >> (2 * nss)) & 0x3) {
71 		case IEEE80211_HE_MCS_SUPPORT_0_11:
72 			mcs = GENMASK(11, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_9:
75 			mcs = GENMASK(9, 0);
76 			break;
77 		case IEEE80211_HE_MCS_SUPPORT_0_7:
78 			mcs = GENMASK(7, 0);
79 			break;
80 		default:
81 			mcs = 0;
82 		}
83 
84 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
85 
86 		switch (mcs) {
87 		case 0 ... 7:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
89 			break;
90 		case 8 ... 9:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
92 			break;
93 		case 10 ... 11:
94 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
95 			break;
96 		default:
97 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
98 			break;
99 		}
100 		mcs_map &= ~(0x3 << (nss * 2));
101 		mcs_map |= mcs << (nss * 2);
102 
103 		/* only support 2ss on 160MHz for mt7915 */
104 		if (is_mt7915(&dev->mt76) && nss > 1 &&
105 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
106 			break;
107 	}
108 
109 	*he_mcs = cpu_to_le16(mcs_map);
110 }
111 
112 static void
113 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
114 			   const u16 *mask)
115 {
116 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
117 	struct mt7915_dev *dev = msta->vif->phy->dev;
118 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
119 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
120 	u16 mcs;
121 
122 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
123 		switch (mcs_map & 0x3) {
124 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
128 			mcs = GENMASK(8, 0);
129 			break;
130 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
131 			mcs = GENMASK(7, 0);
132 			break;
133 		default:
134 			mcs = 0;
135 		}
136 
137 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
138 
139 		/* only support 2ss on 160MHz for mt7915 */
140 		if (is_mt7915(&dev->mt76) && nss > 1 &&
141 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
142 			break;
143 	}
144 }
145 
146 static void
147 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
148 			  const u8 *mask)
149 {
150 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
151 
152 	for (nss = 0; nss < max_nss; nss++)
153 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
154 }
155 
156 static int
157 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
158 			  struct sk_buff *skb, int seq)
159 {
160 	struct mt76_connac2_mcu_rxd *rxd;
161 	int ret = 0;
162 
163 	if (!skb) {
164 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
165 			cmd, seq);
166 		return -ETIMEDOUT;
167 	}
168 
169 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
170 	if (seq != rxd->seq &&
171 	    !(rxd->eid == MCU_CMD_EXT_CID &&
172 	      rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
173 		return -EAGAIN;
174 
175 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
176 		skb_pull(skb, sizeof(*rxd) - 4);
177 		ret = *skb->data;
178 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
179 		skb_pull(skb, sizeof(*rxd) + 4);
180 		ret = le32_to_cpu(*(__le32 *)skb->data);
181 	} else {
182 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
183 	}
184 
185 	return ret;
186 }
187 
188 static int
189 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
190 			int cmd, int *wait_seq)
191 {
192 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
193 	enum mt76_mcuq_id qid;
194 	int ret;
195 
196 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
197 	if (ret)
198 		return ret;
199 
200 	if (cmd == MCU_CMD(FW_SCATTER))
201 		qid = MT_MCUQ_FWDL;
202 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
203 		qid = MT_MCUQ_WA;
204 	else
205 		qid = MT_MCUQ_WM;
206 
207 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
208 }
209 
210 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
211 {
212 	struct {
213 		__le32 args[3];
214 	} req = {
215 		.args = {
216 			cpu_to_le32(a1),
217 			cpu_to_le32(a2),
218 			cpu_to_le32(a3),
219 		},
220 	};
221 
222 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
223 }
224 
225 static void
226 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
227 {
228 	if (vif->bss_conf.csa_active)
229 		ieee80211_csa_finish(vif);
230 }
231 
232 static void
233 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
234 {
235 	struct mt76_phy *mphy = &dev->mt76.phy;
236 	struct mt7915_mcu_csa_notify *c;
237 
238 	c = (struct mt7915_mcu_csa_notify *)skb->data;
239 
240 	if (c->band_idx > MT_BAND1)
241 		return;
242 
243 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
244 	    dev->mt76.phys[MT_BAND1])
245 		mphy = dev->mt76.phys[MT_BAND1];
246 
247 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
248 			IEEE80211_IFACE_ITER_RESUME_ALL,
249 			mt7915_mcu_csa_finish, mphy->hw);
250 }
251 
252 static void
253 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
254 {
255 	struct mt76_phy *mphy = &dev->mt76.phy;
256 	struct mt7915_mcu_thermal_notify *t;
257 	struct mt7915_phy *phy;
258 
259 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
260 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
261 		return;
262 
263 	if (t->ctrl.band_idx > MT_BAND1)
264 		return;
265 
266 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
267 	    dev->mt76.phys[MT_BAND1])
268 		mphy = dev->mt76.phys[MT_BAND1];
269 
270 	phy = (struct mt7915_phy *)mphy->priv;
271 	phy->throttle_state = t->ctrl.duty.duty_cycle;
272 }
273 
274 static void
275 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
276 {
277 	struct mt76_phy *mphy = &dev->mt76.phy;
278 	struct mt7915_mcu_rdd_report *r;
279 
280 	r = (struct mt7915_mcu_rdd_report *)skb->data;
281 
282 	if (r->band_idx > MT_RX_SEL2)
283 		return;
284 
285 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
286 	    dev->mt76.phys[MT_BAND1])
287 		mphy = dev->mt76.phys[MT_BAND1];
288 
289 	if (r->band_idx == MT_RX_SEL2)
290 		cfg80211_background_radar_event(mphy->hw->wiphy,
291 						&dev->rdd2_chandef,
292 						GFP_ATOMIC);
293 	else
294 		ieee80211_radar_detected(mphy->hw);
295 	dev->hw_pattern++;
296 }
297 
298 static void
299 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
300 {
301 	struct mt76_connac2_mcu_rxd *rxd;
302 	int len = skb->len - sizeof(*rxd);
303 	const char *data, *type;
304 
305 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
306 	data = (char *)&rxd[1];
307 
308 	switch (rxd->s2d_index) {
309 	case 0:
310 		if (mt7915_debugfs_rx_log(dev, data, len))
311 			return;
312 
313 		type = "WM";
314 		break;
315 	case 2:
316 		type = "WA";
317 		break;
318 	default:
319 		type = "unknown";
320 		break;
321 	}
322 
323 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
324 }
325 
326 static void
327 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
328 {
329 	if (!vif->bss_conf.color_change_active)
330 		return;
331 
332 	ieee80211_color_change_finish(vif);
333 }
334 
335 static void
336 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
337 {
338 	struct mt76_phy *mphy = &dev->mt76.phy;
339 	struct mt7915_mcu_bcc_notify *b;
340 
341 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
342 
343 	if (b->band_idx > MT_BAND1)
344 		return;
345 
346 	if ((b->band_idx && !dev->phy.mt76->band_idx) &&
347 	    dev->mt76.phys[MT_BAND1])
348 		mphy = dev->mt76.phys[MT_BAND1];
349 
350 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
351 			IEEE80211_IFACE_ITER_RESUME_ALL,
352 			mt7915_mcu_cca_finish, mphy->hw);
353 }
354 
355 static void
356 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
357 {
358 	struct mt76_connac2_mcu_rxd *rxd;
359 
360 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
361 	switch (rxd->ext_eid) {
362 	case MCU_EXT_EVENT_THERMAL_PROTECT:
363 		mt7915_mcu_rx_thermal_notify(dev, skb);
364 		break;
365 	case MCU_EXT_EVENT_RDD_REPORT:
366 		mt7915_mcu_rx_radar_detected(dev, skb);
367 		break;
368 	case MCU_EXT_EVENT_CSA_NOTIFY:
369 		mt7915_mcu_rx_csa_notify(dev, skb);
370 		break;
371 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
372 		mt7915_mcu_rx_log_message(dev, skb);
373 		break;
374 	case MCU_EXT_EVENT_BCC_NOTIFY:
375 		mt7915_mcu_rx_bcc_notify(dev, skb);
376 		break;
377 	default:
378 		break;
379 	}
380 }
381 
382 static void
383 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
384 {
385 	struct mt76_connac2_mcu_rxd *rxd;
386 
387 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
388 	switch (rxd->eid) {
389 	case MCU_EVENT_EXT:
390 		mt7915_mcu_rx_ext_event(dev, skb);
391 		break;
392 	default:
393 		break;
394 	}
395 	dev_kfree_skb(skb);
396 }
397 
398 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
399 {
400 	struct mt76_connac2_mcu_rxd *rxd;
401 
402 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
403 	if ((rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
404 	     rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
405 	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
406 	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
407 	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
408 	     !rxd->seq) &&
409 	     !(rxd->eid == MCU_CMD_EXT_CID &&
410 	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
411 		mt7915_mcu_rx_unsolicited_event(dev, skb);
412 	else
413 		mt76_mcu_rx_event(&dev->mt76, skb);
414 }
415 
416 static struct tlv *
417 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
418 			     __le16 *sub_ntlv, __le16 *len)
419 {
420 	struct tlv *ptlv, tlv = {
421 		.tag = cpu_to_le16(sub_tag),
422 		.len = cpu_to_le16(sub_len),
423 	};
424 
425 	ptlv = skb_put_zero(skb, sub_len);
426 	memcpy(ptlv, &tlv, sizeof(tlv));
427 
428 	le16_add_cpu(sub_ntlv, 1);
429 	le16_add_cpu(len, sub_len);
430 
431 	return ptlv;
432 }
433 
434 /** bss info **/
435 struct mt7915_he_obss_narrow_bw_ru_data {
436 	bool tolerated;
437 };
438 
439 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
440 						   struct cfg80211_bss *bss,
441 						   void *_data)
442 {
443 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
444 	const struct element *elem;
445 
446 	rcu_read_lock();
447 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
448 
449 	if (!elem || elem->datalen <= 10 ||
450 	    !(elem->data[10] &
451 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
452 		data->tolerated = false;
453 
454 	rcu_read_unlock();
455 }
456 
457 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
458 					      struct ieee80211_vif *vif)
459 {
460 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
461 		.tolerated = true,
462 	};
463 
464 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
465 		return false;
466 
467 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
468 			  mt7915_check_he_obss_narrow_bw_ru_iter,
469 			  &iter_data);
470 
471 	/*
472 	 * If there is at least one AP on radar channel that cannot
473 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
474 	 */
475 	return !iter_data.tolerated;
476 }
477 
478 static void
479 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
480 			struct mt7915_phy *phy)
481 {
482 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
483 	struct bss_info_rf_ch *ch;
484 	struct tlv *tlv;
485 	int freq1 = chandef->center_freq1;
486 
487 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
488 
489 	ch = (struct bss_info_rf_ch *)tlv;
490 	ch->pri_ch = chandef->chan->hw_value;
491 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
492 	ch->bw = mt76_connac_chan_bw(chandef);
493 
494 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
495 		int freq2 = chandef->center_freq2;
496 
497 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
498 	}
499 
500 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
501 		struct mt76_phy *mphy = phy->mt76;
502 
503 		ch->he_ru26_block =
504 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
505 		ch->he_all_disable = false;
506 	} else {
507 		ch->he_all_disable = true;
508 	}
509 }
510 
511 static void
512 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
513 		      struct mt7915_phy *phy)
514 {
515 	int max_nss = hweight8(phy->mt76->antenna_mask);
516 	struct bss_info_ra *ra;
517 	struct tlv *tlv;
518 
519 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
520 
521 	ra = (struct bss_info_ra *)tlv;
522 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
523 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
524 	ra->short_preamble = true;
525 	ra->tx_streams = max_nss;
526 	ra->rx_streams = max_nss;
527 	ra->algo = 4;
528 	ra->train_up_rule = 2;
529 	ra->train_up_high_thres = 110;
530 	ra->train_up_rule_rssi = -70;
531 	ra->low_traffic_thres = 2;
532 	ra->phy_cap = cpu_to_le32(0xfdf);
533 	ra->interval = cpu_to_le32(500);
534 	ra->fast_interval = cpu_to_le32(100);
535 }
536 
537 static void
538 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
539 		      struct mt7915_phy *phy)
540 {
541 #define DEFAULT_HE_PE_DURATION		4
542 #define DEFAULT_HE_DURATION_RTS_THRES	1023
543 	const struct ieee80211_sta_he_cap *cap;
544 	struct bss_info_he *he;
545 	struct tlv *tlv;
546 
547 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
548 
549 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
550 
551 	he = (struct bss_info_he *)tlv;
552 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
553 	if (!he->he_pe_duration)
554 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
555 
556 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
557 	if (!he->he_rts_thres)
558 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
559 
560 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
561 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
562 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
563 }
564 
565 static void
566 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
567 {
568 #define TXD_CMP_MAP1		GENMASK(15, 0)
569 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
570 	struct bss_info_hw_amsdu *amsdu;
571 	struct tlv *tlv;
572 
573 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
574 
575 	amsdu = (struct bss_info_hw_amsdu *)tlv;
576 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
577 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
578 	amsdu->trig_thres = cpu_to_le16(2);
579 	amsdu->enable = true;
580 }
581 
582 static void
583 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
584 {
585 	struct bss_info_bmc_rate *bmc;
586 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
587 	enum nl80211_band band = chandef->chan->band;
588 	struct tlv *tlv;
589 
590 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
591 
592 	bmc = (struct bss_info_bmc_rate *)tlv;
593 	if (band == NL80211_BAND_2GHZ) {
594 		bmc->short_preamble = true;
595 	} else {
596 		bmc->bc_trans = cpu_to_le16(0x2000);
597 		bmc->mc_trans = cpu_to_le16(0x2080);
598 	}
599 }
600 
601 static int
602 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
603 		       bool bssid, bool enable)
604 {
605 	struct mt7915_dev *dev = phy->dev;
606 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
607 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
608 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
609 	const u8 *addr = vif->addr;
610 	struct {
611 		u8 mode;
612 		u8 force_clear;
613 		u8 clear_bitmap[8];
614 		u8 entry_count;
615 		u8 write;
616 		u8 band;
617 
618 		u8 index;
619 		u8 bssid;
620 		u8 addr[ETH_ALEN];
621 	} __packed req = {
622 		.mode = !!mask || enable,
623 		.entry_count = 1,
624 		.write = 1,
625 		.band = phy->mt76->band_idx,
626 		.index = idx * 2 + bssid,
627 	};
628 
629 	if (bssid)
630 		addr = vif->bss_conf.bssid;
631 
632 	if (enable)
633 		ether_addr_copy(req.addr, addr);
634 
635 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
636 				 sizeof(req), true);
637 }
638 
639 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
640 			    struct ieee80211_vif *vif, int enable)
641 {
642 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
643 	struct mt7915_dev *dev = phy->dev;
644 	struct sk_buff *skb;
645 
646 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
647 		mt7915_mcu_muar_config(phy, vif, false, enable);
648 		mt7915_mcu_muar_config(phy, vif, true, enable);
649 	}
650 
651 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
652 					      MT7915_BSS_UPDATE_MAX_SIZE);
653 	if (IS_ERR(skb))
654 		return PTR_ERR(skb);
655 
656 	/* bss_omac must be first */
657 	if (enable)
658 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
659 
660 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
661 				      mvif->sta.wcid.idx, enable);
662 
663 	if (vif->type == NL80211_IFTYPE_MONITOR)
664 		goto out;
665 
666 	if (enable) {
667 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
668 		mt7915_mcu_bss_bmc_tlv(skb, phy);
669 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
670 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
671 
672 		if (vif->bss_conf.he_support)
673 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
674 
675 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
676 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
677 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
678 	}
679 out:
680 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
681 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
682 }
683 
684 /** starec & wtbl **/
685 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
686 			 struct ieee80211_ampdu_params *params,
687 			 bool enable)
688 {
689 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
690 	struct mt7915_vif *mvif = msta->vif;
691 	int ret;
692 
693 	mt76_worker_disable(&dev->mt76.tx_worker);
694 	if (enable && !params->amsdu)
695 		msta->wcid.amsdu = false;
696 	ret = mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
697 				     MCU_EXT_CMD(STA_REC_UPDATE),
698 				     enable, true);
699 	mt76_worker_enable(&dev->mt76.tx_worker);
700 
701 	return ret;
702 }
703 
704 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
705 			 struct ieee80211_ampdu_params *params,
706 			 bool enable)
707 {
708 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
709 	struct mt7915_vif *mvif = msta->vif;
710 
711 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
712 				      MCU_EXT_CMD(STA_REC_UPDATE),
713 				      enable, false);
714 }
715 
716 static void
717 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
718 		      struct ieee80211_vif *vif)
719 {
720 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
721 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
722 	struct ieee80211_he_mcs_nss_supp mcs_map;
723 	struct sta_rec_he *he;
724 	struct tlv *tlv;
725 	u32 cap = 0;
726 
727 	if (!sta->deflink.he_cap.has_he)
728 		return;
729 
730 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
731 
732 	he = (struct sta_rec_he *)tlv;
733 
734 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
735 		cap |= STA_REC_HE_CAP_HTC;
736 
737 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
738 		cap |= STA_REC_HE_CAP_BSR;
739 
740 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
741 		cap |= STA_REC_HE_CAP_OM;
742 
743 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
744 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
745 
746 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
747 		cap |= STA_REC_HE_CAP_BQR;
748 
749 	if (elem->phy_cap_info[0] &
750 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
751 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
752 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
753 
754 	if (mvif->cap.he_ldpc &&
755 	    (elem->phy_cap_info[1] &
756 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
757 		cap |= STA_REC_HE_CAP_LDPC;
758 
759 	if (elem->phy_cap_info[1] &
760 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
761 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
762 
763 	if (elem->phy_cap_info[2] &
764 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
765 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
766 
767 	if (elem->phy_cap_info[2] &
768 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
769 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
770 
771 	if (elem->phy_cap_info[2] &
772 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
773 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
774 
775 	if (elem->phy_cap_info[6] &
776 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
777 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
778 
779 	if (elem->phy_cap_info[6] &
780 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
781 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
782 
783 	if (elem->phy_cap_info[7] &
784 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
785 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
786 
787 	if (elem->phy_cap_info[7] &
788 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
789 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
790 
791 	if (elem->phy_cap_info[7] &
792 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
793 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
794 
795 	if (elem->phy_cap_info[8] &
796 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
797 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
798 
799 	if (elem->phy_cap_info[8] &
800 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
801 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
802 
803 	if (elem->phy_cap_info[9] &
804 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
805 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
806 
807 	if (elem->phy_cap_info[9] &
808 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
809 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
810 
811 	he->he_cap = cpu_to_le32(cap);
812 
813 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
814 	switch (sta->deflink.bandwidth) {
815 	case IEEE80211_STA_RX_BW_160:
816 		if (elem->phy_cap_info[0] &
817 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
818 			mt7915_mcu_set_sta_he_mcs(sta,
819 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
820 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
821 
822 		mt7915_mcu_set_sta_he_mcs(sta,
823 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
824 					  le16_to_cpu(mcs_map.rx_mcs_160));
825 		fallthrough;
826 	default:
827 		mt7915_mcu_set_sta_he_mcs(sta,
828 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
829 					  le16_to_cpu(mcs_map.rx_mcs_80));
830 		break;
831 	}
832 
833 	he->t_frame_dur =
834 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
835 	he->max_ampdu_exp =
836 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
837 
838 	he->bw_set =
839 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
840 	he->device_class =
841 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
842 	he->punc_pream_rx =
843 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
844 
845 	he->dcm_tx_mode =
846 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
847 	he->dcm_tx_max_nss =
848 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
849 	he->dcm_rx_mode =
850 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
851 	he->dcm_rx_max_nss =
852 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
853 	he->dcm_rx_max_nss =
854 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
855 
856 	he->pkt_ext = 2;
857 }
858 
859 static void
860 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
861 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
862 {
863 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
864 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
865 	struct sta_rec_muru *muru;
866 	struct tlv *tlv;
867 
868 	if (vif->type != NL80211_IFTYPE_STATION &&
869 	    vif->type != NL80211_IFTYPE_AP)
870 		return;
871 
872 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
873 
874 	muru = (struct sta_rec_muru *)tlv;
875 
876 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
877 			       mvif->cap.vht_mu_ebfer ||
878 			       mvif->cap.vht_mu_ebfee;
879 	if (!is_mt7915(&dev->mt76))
880 		muru->cfg.mimo_ul_en = true;
881 	muru->cfg.ofdma_dl_en = true;
882 
883 	if (sta->deflink.vht_cap.vht_supported)
884 		muru->mimo_dl.vht_mu_bfee =
885 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
886 
887 	if (!sta->deflink.he_cap.has_he)
888 		return;
889 
890 	muru->mimo_dl.partial_bw_dl_mimo =
891 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
892 
893 	muru->mimo_ul.full_ul_mimo =
894 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
895 	muru->mimo_ul.partial_ul_mimo =
896 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
897 
898 	muru->ofdma_dl.punc_pream_rx =
899 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
900 	muru->ofdma_dl.he_20m_in_40m_2g =
901 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
902 	muru->ofdma_dl.he_20m_in_160m =
903 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
904 	muru->ofdma_dl.he_80m_in_160m =
905 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
906 
907 	muru->ofdma_ul.t_frame_dur =
908 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
909 	muru->ofdma_ul.mu_cascading =
910 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
911 	muru->ofdma_ul.uo_ra =
912 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
913 }
914 
915 static void
916 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
917 {
918 	struct sta_rec_ht *ht;
919 	struct tlv *tlv;
920 
921 	if (!sta->deflink.ht_cap.ht_supported)
922 		return;
923 
924 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
925 
926 	ht = (struct sta_rec_ht *)tlv;
927 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
928 }
929 
930 static void
931 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
932 {
933 	struct sta_rec_vht *vht;
934 	struct tlv *tlv;
935 
936 	if (!sta->deflink.vht_cap.vht_supported)
937 		return;
938 
939 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
940 
941 	vht = (struct sta_rec_vht *)tlv;
942 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
943 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
944 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
945 }
946 
947 static void
948 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
949 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
950 {
951 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
952 	struct sta_rec_amsdu *amsdu;
953 	struct tlv *tlv;
954 
955 	if (vif->type != NL80211_IFTYPE_STATION &&
956 	    vif->type != NL80211_IFTYPE_AP)
957 		return;
958 
959 	if (!sta->deflink.agg.max_amsdu_len)
960 	    return;
961 
962 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
963 	amsdu = (struct sta_rec_amsdu *)tlv;
964 	amsdu->max_amsdu_num = 8;
965 	amsdu->amsdu_en = true;
966 	msta->wcid.amsdu = true;
967 
968 	switch (sta->deflink.agg.max_amsdu_len) {
969 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
970 		if (!is_mt7915(&dev->mt76)) {
971 			amsdu->max_mpdu_size =
972 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
973 			return;
974 		}
975 		fallthrough;
976 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
977 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
978 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
979 		return;
980 	default:
981 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
982 		return;
983 	}
984 }
985 
986 static int
987 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
988 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
989 {
990 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
991 	struct mt7915_sta *msta;
992 	struct wtbl_req_hdr *wtbl_hdr;
993 	struct mt76_wcid *wcid;
994 	struct tlv *tlv;
995 
996 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
997 	wcid = sta ? &msta->wcid : NULL;
998 
999 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1000 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1001 						  WTBL_RESET_AND_SET, tlv,
1002 						  &skb);
1003 	if (IS_ERR(wtbl_hdr))
1004 		return PTR_ERR(wtbl_hdr);
1005 
1006 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1007 					 wtbl_hdr);
1008 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1009 	if (sta)
1010 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1011 					    wtbl_hdr, mvif->cap.ht_ldpc,
1012 					    mvif->cap.vht_ldpc);
1013 
1014 	return 0;
1015 }
1016 
1017 static inline bool
1018 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1019 			struct ieee80211_sta *sta, bool bfee)
1020 {
1021 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1022 	int sts = hweight16(phy->mt76->chainmask);
1023 
1024 	if (vif->type != NL80211_IFTYPE_STATION &&
1025 	    vif->type != NL80211_IFTYPE_AP)
1026 		return false;
1027 
1028 	if (!bfee && sts < 2)
1029 		return false;
1030 
1031 	if (sta->deflink.he_cap.has_he) {
1032 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1033 
1034 		if (bfee)
1035 			return mvif->cap.he_su_ebfee &&
1036 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1037 		else
1038 			return mvif->cap.he_su_ebfer &&
1039 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1040 	}
1041 
1042 	if (sta->deflink.vht_cap.vht_supported) {
1043 		u32 cap = sta->deflink.vht_cap.cap;
1044 
1045 		if (bfee)
1046 			return mvif->cap.vht_su_ebfee &&
1047 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1048 		else
1049 			return mvif->cap.vht_su_ebfer &&
1050 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1051 	}
1052 
1053 	return false;
1054 }
1055 
1056 static void
1057 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1058 {
1059 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1060 	bf->ndp_rate = 0;				/* mcs0 */
1061 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1062 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1063 }
1064 
1065 static void
1066 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1067 		       struct sta_rec_bf *bf)
1068 {
1069 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1070 	u8 n = 0;
1071 
1072 	bf->tx_mode = MT_PHY_TYPE_HT;
1073 
1074 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1075 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1076 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1077 			      mcs->tx_params);
1078 	else if (mcs->rx_mask[3])
1079 		n = 3;
1080 	else if (mcs->rx_mask[2])
1081 		n = 2;
1082 	else if (mcs->rx_mask[1])
1083 		n = 1;
1084 
1085 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1086 	bf->ncol = min_t(u8, bf->nrow, n);
1087 	bf->ibf_ncol = n;
1088 }
1089 
1090 static void
1091 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1092 			struct sta_rec_bf *bf, bool explicit)
1093 {
1094 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1095 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1096 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1097 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1098 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1099 
1100 	bf->tx_mode = MT_PHY_TYPE_VHT;
1101 
1102 	if (explicit) {
1103 		u8 sts, snd_dim;
1104 
1105 		mt7915_mcu_sta_sounding_rate(bf);
1106 
1107 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1108 				pc->cap);
1109 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1110 				    vc->cap);
1111 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1112 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1113 		bf->ibf_ncol = bf->ncol;
1114 
1115 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1116 			bf->nrow = 1;
1117 	} else {
1118 		bf->nrow = tx_ant;
1119 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1120 		bf->ibf_ncol = nss_mcs;
1121 
1122 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1123 			bf->ibf_nrow = 1;
1124 	}
1125 }
1126 
1127 static void
1128 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1129 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1130 {
1131 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1132 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1133 	const struct ieee80211_sta_he_cap *vc =
1134 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1135 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1136 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1137 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1138 	u8 snd_dim, sts;
1139 
1140 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1141 
1142 	mt7915_mcu_sta_sounding_rate(bf);
1143 
1144 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1145 				pe->phy_cap_info[6]);
1146 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1147 				pe->phy_cap_info[6]);
1148 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1149 			 ve->phy_cap_info[5]);
1150 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1151 		     pe->phy_cap_info[4]);
1152 	bf->nrow = min_t(u8, snd_dim, sts);
1153 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1154 	bf->ibf_ncol = bf->ncol;
1155 
1156 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1157 		return;
1158 
1159 	/* go over for 160MHz and 80p80 */
1160 	if (pe->phy_cap_info[0] &
1161 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1162 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1163 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1164 
1165 		bf->ncol_gt_bw80 = nss_mcs;
1166 	}
1167 
1168 	if (pe->phy_cap_info[0] &
1169 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1170 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1171 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1172 
1173 		if (bf->ncol_gt_bw80)
1174 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1175 		else
1176 			bf->ncol_gt_bw80 = nss_mcs;
1177 	}
1178 
1179 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1180 			 ve->phy_cap_info[5]);
1181 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1182 		     pe->phy_cap_info[4]);
1183 
1184 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1185 }
1186 
1187 static void
1188 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1189 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1190 {
1191 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1192 	struct mt7915_phy *phy = mvif->phy;
1193 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1194 	struct sta_rec_bf *bf;
1195 	struct tlv *tlv;
1196 	const u8 matrix[4][4] = {
1197 		{0, 0, 0, 0},
1198 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1199 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1200 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1201 	};
1202 	bool ebf;
1203 
1204 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1205 		return;
1206 
1207 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1208 	if (!ebf && !dev->ibf)
1209 		return;
1210 
1211 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1212 	bf = (struct sta_rec_bf *)tlv;
1213 
1214 	/* he: eBF only, in accordance with spec
1215 	 * vht: support eBF and iBF
1216 	 * ht: iBF only, since mac80211 lacks of eBF support
1217 	 */
1218 	if (sta->deflink.he_cap.has_he && ebf)
1219 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1220 	else if (sta->deflink.vht_cap.vht_supported)
1221 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1222 	else if (sta->deflink.ht_cap.ht_supported)
1223 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1224 	else
1225 		return;
1226 
1227 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1228 	bf->bw = sta->deflink.bandwidth;
1229 	bf->ibf_dbw = sta->deflink.bandwidth;
1230 	bf->ibf_nrow = tx_ant;
1231 
1232 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1233 		bf->ibf_timeout = 0x48;
1234 	else
1235 		bf->ibf_timeout = 0x18;
1236 
1237 	if (ebf && bf->nrow != tx_ant)
1238 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1239 	else
1240 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1241 
1242 	switch (sta->deflink.bandwidth) {
1243 	case IEEE80211_STA_RX_BW_160:
1244 	case IEEE80211_STA_RX_BW_80:
1245 		bf->mem_total = bf->mem_20m * 2;
1246 		break;
1247 	case IEEE80211_STA_RX_BW_40:
1248 		bf->mem_total = bf->mem_20m;
1249 		break;
1250 	case IEEE80211_STA_RX_BW_20:
1251 	default:
1252 		break;
1253 	}
1254 }
1255 
1256 static void
1257 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1258 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1259 {
1260 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1261 	struct mt7915_phy *phy = mvif->phy;
1262 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1263 	struct sta_rec_bfee *bfee;
1264 	struct tlv *tlv;
1265 	u8 nrow = 0;
1266 
1267 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1268 		return;
1269 
1270 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1271 		return;
1272 
1273 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1274 	bfee = (struct sta_rec_bfee *)tlv;
1275 
1276 	if (sta->deflink.he_cap.has_he) {
1277 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1278 
1279 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1280 			      pe->phy_cap_info[5]);
1281 	} else if (sta->deflink.vht_cap.vht_supported) {
1282 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1283 
1284 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1285 				 pc->cap);
1286 	}
1287 
1288 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1289 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1290 }
1291 
1292 static enum mcu_mmps_mode
1293 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1294 {
1295 	switch (smps) {
1296 	case IEEE80211_SMPS_OFF:
1297 		return MCU_MMPS_DISABLE;
1298 	case IEEE80211_SMPS_STATIC:
1299 		return MCU_MMPS_STATIC;
1300 	case IEEE80211_SMPS_DYNAMIC:
1301 		return MCU_MMPS_DYNAMIC;
1302 	default:
1303 		return MCU_MMPS_DISABLE;
1304 	}
1305 }
1306 
1307 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1308 				   struct ieee80211_vif *vif,
1309 				   struct ieee80211_sta *sta,
1310 				   void *data, u32 field)
1311 {
1312 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1313 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1314 	struct sta_phy *phy = data;
1315 	struct sta_rec_ra_fixed *ra;
1316 	struct sk_buff *skb;
1317 	struct tlv *tlv;
1318 
1319 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1320 					    &msta->wcid);
1321 	if (IS_ERR(skb))
1322 		return PTR_ERR(skb);
1323 
1324 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1325 	ra = (struct sta_rec_ra_fixed *)tlv;
1326 
1327 	switch (field) {
1328 	case RATE_PARAM_AUTO:
1329 		break;
1330 	case RATE_PARAM_FIXED:
1331 	case RATE_PARAM_FIXED_MCS:
1332 	case RATE_PARAM_FIXED_GI:
1333 	case RATE_PARAM_FIXED_HE_LTF:
1334 		if (phy)
1335 			ra->phy = *phy;
1336 		break;
1337 	case RATE_PARAM_MMPS_UPDATE:
1338 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1339 		break;
1340 	case RATE_PARAM_SPE_UPDATE:
1341 		ra->spe_idx = *(u8 *)data;
1342 		break;
1343 	default:
1344 		break;
1345 	}
1346 	ra->field = cpu_to_le32(field);
1347 
1348 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1349 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1350 }
1351 
1352 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1353 			struct ieee80211_sta *sta)
1354 {
1355 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1356 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1357 	struct wtbl_req_hdr *wtbl_hdr;
1358 	struct tlv *sta_wtbl;
1359 	struct sk_buff *skb;
1360 	int ret;
1361 
1362 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1363 					    &msta->wcid);
1364 	if (IS_ERR(skb))
1365 		return PTR_ERR(skb);
1366 
1367 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1368 					   sizeof(struct tlv));
1369 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1370 						  WTBL_SET, sta_wtbl, &skb);
1371 	if (IS_ERR(wtbl_hdr))
1372 		return PTR_ERR(wtbl_hdr);
1373 
1374 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1375 
1376 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1377 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1378 	if (ret)
1379 		return ret;
1380 
1381 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1382 					      RATE_PARAM_MMPS_UPDATE);
1383 }
1384 
1385 static int
1386 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1387 		       struct ieee80211_sta *sta)
1388 {
1389 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1390 	struct mt76_phy *mphy = mvif->phy->mt76;
1391 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1392 
1393 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1394 					      RATE_PARAM_SPE_UPDATE);
1395 }
1396 
1397 static int
1398 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1399 			       struct ieee80211_vif *vif,
1400 			       struct ieee80211_sta *sta)
1401 {
1402 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1403 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1404 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1405 	enum nl80211_band band = chandef->chan->band;
1406 	struct sta_phy phy = {};
1407 	int ret, nrates = 0;
1408 
1409 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1410 	do {									\
1411 		u8 i, gi = mask->control[band]._gi;				\
1412 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1413 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1414 			phy.sgi |= gi << (i << (_he));				\
1415 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1416 		}								\
1417 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1418 			if (!mask->control[band]._mcs[i])			\
1419 				continue;					\
1420 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1421 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1422 			if (_ht)						\
1423 				phy.mcs += 8 * i;				\
1424 		}								\
1425 	} while (0)
1426 
1427 	if (sta->deflink.he_cap.has_he) {
1428 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1429 	} else if (sta->deflink.vht_cap.vht_supported) {
1430 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1431 	} else if (sta->deflink.ht_cap.ht_supported) {
1432 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1433 	} else {
1434 		nrates = hweight32(mask->control[band].legacy);
1435 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1436 	}
1437 #undef __sta_phy_bitrate_mask_check
1438 
1439 	/* fall back to auto rate control */
1440 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1441 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1442 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1443 	    nrates != 1)
1444 		return 0;
1445 
1446 	/* fixed single rate */
1447 	if (nrates == 1) {
1448 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1449 						     RATE_PARAM_FIXED_MCS);
1450 		if (ret)
1451 			return ret;
1452 	}
1453 
1454 	/* fixed GI */
1455 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1456 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1457 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1458 		u32 addr;
1459 
1460 		/* firmware updates only TXCMD but doesn't take WTBL into
1461 		 * account, so driver should update here to reflect the
1462 		 * actual txrate hardware sends out.
1463 		 */
1464 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1465 		if (sta->deflink.he_cap.has_he)
1466 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1467 		else
1468 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1469 
1470 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1471 						     RATE_PARAM_FIXED_GI);
1472 		if (ret)
1473 			return ret;
1474 	}
1475 
1476 	/* fixed HE_LTF */
1477 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1478 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1479 						     RATE_PARAM_FIXED_HE_LTF);
1480 		if (ret)
1481 			return ret;
1482 	}
1483 
1484 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1485 }
1486 
1487 static void
1488 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1489 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1490 {
1491 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1492 	struct mt76_phy *mphy = mvif->phy->mt76;
1493 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1494 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1495 	enum nl80211_band band = chandef->chan->band;
1496 	struct sta_rec_ra *ra;
1497 	struct tlv *tlv;
1498 	u32 supp_rate = sta->deflink.supp_rates[band];
1499 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1500 
1501 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1502 	ra = (struct sta_rec_ra *)tlv;
1503 
1504 	ra->valid = true;
1505 	ra->auto_rate = true;
1506 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1507 	ra->channel = chandef->chan->hw_value;
1508 	ra->bw = sta->deflink.bandwidth;
1509 	ra->phy.bw = sta->deflink.bandwidth;
1510 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1511 
1512 	if (supp_rate) {
1513 		supp_rate &= mask->control[band].legacy;
1514 		ra->rate_len = hweight32(supp_rate);
1515 
1516 		if (band == NL80211_BAND_2GHZ) {
1517 			ra->supp_mode = MODE_CCK;
1518 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1519 
1520 			if (ra->rate_len > 4) {
1521 				ra->supp_mode |= MODE_OFDM;
1522 				ra->supp_ofdm_rate = supp_rate >> 4;
1523 			}
1524 		} else {
1525 			ra->supp_mode = MODE_OFDM;
1526 			ra->supp_ofdm_rate = supp_rate;
1527 		}
1528 	}
1529 
1530 	if (sta->deflink.ht_cap.ht_supported) {
1531 		ra->supp_mode |= MODE_HT;
1532 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1533 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1534 
1535 		cap |= STA_CAP_HT;
1536 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1537 			cap |= STA_CAP_SGI_20;
1538 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1539 			cap |= STA_CAP_SGI_40;
1540 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1541 			cap |= STA_CAP_TX_STBC;
1542 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1543 			cap |= STA_CAP_RX_STBC;
1544 		if (mvif->cap.ht_ldpc &&
1545 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1546 			cap |= STA_CAP_LDPC;
1547 
1548 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1549 					  mask->control[band].ht_mcs);
1550 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1551 	}
1552 
1553 	if (sta->deflink.vht_cap.vht_supported) {
1554 		u8 af;
1555 
1556 		ra->supp_mode |= MODE_VHT;
1557 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1558 			       sta->deflink.vht_cap.cap);
1559 		ra->af = max_t(u8, ra->af, af);
1560 
1561 		cap |= STA_CAP_VHT;
1562 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1563 			cap |= STA_CAP_VHT_SGI_80;
1564 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1565 			cap |= STA_CAP_VHT_SGI_160;
1566 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1567 			cap |= STA_CAP_VHT_TX_STBC;
1568 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1569 			cap |= STA_CAP_VHT_RX_STBC;
1570 		if (mvif->cap.vht_ldpc &&
1571 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1572 			cap |= STA_CAP_VHT_LDPC;
1573 
1574 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1575 					   mask->control[band].vht_mcs);
1576 	}
1577 
1578 	if (sta->deflink.he_cap.has_he) {
1579 		ra->supp_mode |= MODE_HE;
1580 		cap |= STA_CAP_HE;
1581 
1582 		if (sta->deflink.he_6ghz_capa.capa)
1583 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1584 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1585 	}
1586 
1587 	ra->sta_cap = cpu_to_le32(cap);
1588 }
1589 
1590 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1591 			     struct ieee80211_sta *sta, bool changed)
1592 {
1593 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1594 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1595 	struct sk_buff *skb;
1596 	int ret;
1597 
1598 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1599 					    &msta->wcid);
1600 	if (IS_ERR(skb))
1601 		return PTR_ERR(skb);
1602 
1603 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1604 	 * once dev->rc_work changes the settings driver should also
1605 	 * update sta_rec_he here.
1606 	 */
1607 	if (changed)
1608 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1609 
1610 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1611 	 * i.e 0-{7,8,9} for VHT.
1612 	 */
1613 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1614 
1615 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1616 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1617 	if (ret)
1618 		return ret;
1619 
1620 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1621 	 * and updates as peer fixed rate parameters, which overrides
1622 	 * sta_rec_ra and firmware rate control algorithm.
1623 	 */
1624 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1625 }
1626 
1627 static int
1628 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1629 		     struct ieee80211_sta *sta)
1630 {
1631 #define MT_STA_BSS_GROUP		1
1632 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1633 	struct mt7915_sta *msta;
1634 	struct {
1635 		__le32 action;
1636 		u8 wlan_idx_lo;
1637 		u8 status;
1638 		u8 wlan_idx_hi;
1639 		u8 rsv0[5];
1640 		__le32 val;
1641 		u8 rsv1[8];
1642 	} __packed req = {
1643 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1644 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1645 	};
1646 
1647 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1648 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1649 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1650 
1651 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1652 				 sizeof(req), true);
1653 }
1654 
1655 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1656 		       struct ieee80211_sta *sta, bool enable)
1657 {
1658 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1659 	struct mt7915_sta *msta;
1660 	struct sk_buff *skb;
1661 	int ret;
1662 
1663 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1664 
1665 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1666 					    &msta->wcid);
1667 	if (IS_ERR(skb))
1668 		return PTR_ERR(skb);
1669 
1670 	/* starec basic */
1671 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
1672 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1673 	if (!enable)
1674 		goto out;
1675 
1676 	/* tag order is in accordance with firmware dependency. */
1677 	if (sta) {
1678 		/* starec bfer */
1679 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1680 		/* starec ht */
1681 		mt7915_mcu_sta_ht_tlv(skb, sta);
1682 		/* starec vht */
1683 		mt7915_mcu_sta_vht_tlv(skb, sta);
1684 		/* starec uapsd */
1685 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1686 	}
1687 
1688 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1689 	if (ret) {
1690 		dev_kfree_skb(skb);
1691 		return ret;
1692 	}
1693 
1694 	if (sta) {
1695 		/* starec amsdu */
1696 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1697 		/* starec he */
1698 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1699 		/* starec muru */
1700 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1701 		/* starec bfee */
1702 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1703 	}
1704 
1705 	ret = mt7915_mcu_add_group(dev, vif, sta);
1706 	if (ret) {
1707 		dev_kfree_skb(skb);
1708 		return ret;
1709 	}
1710 out:
1711 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1712 	if (ret)
1713 		return ret;
1714 
1715 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1716 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1717 }
1718 
1719 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1720 {
1721 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1722 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1723 	struct {
1724 		__le32 args[2];
1725 	} req = {
1726 		.args[0] = cpu_to_le32(1),
1727 		.args[1] = cpu_to_le32(6),
1728 	};
1729 
1730 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1731 					 &req, sizeof(req));
1732 #else
1733 	return 0;
1734 #endif
1735 }
1736 
1737 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1738 			    struct ieee80211_vif *vif, bool enable)
1739 {
1740 	struct mt7915_dev *dev = phy->dev;
1741 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1742 	struct {
1743 		struct req_hdr {
1744 			u8 omac_idx;
1745 			u8 band_idx;
1746 			__le16 tlv_num;
1747 			u8 is_tlv_append;
1748 			u8 rsv[3];
1749 		} __packed hdr;
1750 		struct req_tlv {
1751 			__le16 tag;
1752 			__le16 len;
1753 			u8 active;
1754 			u8 band_idx;
1755 			u8 omac_addr[ETH_ALEN];
1756 		} __packed tlv;
1757 	} data = {
1758 		.hdr = {
1759 			.omac_idx = mvif->mt76.omac_idx,
1760 			.band_idx = mvif->mt76.band_idx,
1761 			.tlv_num = cpu_to_le16(1),
1762 			.is_tlv_append = 1,
1763 		},
1764 		.tlv = {
1765 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1766 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1767 			.active = enable,
1768 			.band_idx = mvif->mt76.band_idx,
1769 		},
1770 	};
1771 
1772 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1773 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1774 
1775 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1776 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1777 				 &data, sizeof(data), true);
1778 }
1779 
1780 static void
1781 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1782 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1783 			 struct ieee80211_mutable_offsets *offs)
1784 {
1785 	struct bss_info_bcn_cntdwn *info;
1786 	struct tlv *tlv;
1787 	int sub_tag;
1788 
1789 	if (!offs->cntdwn_counter_offs[0])
1790 		return;
1791 
1792 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1793 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1794 					   &bcn->sub_ntlv, &bcn->len);
1795 	info = (struct bss_info_bcn_cntdwn *)tlv;
1796 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1797 }
1798 
1799 static void
1800 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1801 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1802 		       struct ieee80211_mutable_offsets *offs)
1803 {
1804 	struct bss_info_bcn_mbss *mbss;
1805 	const struct element *elem;
1806 	struct tlv *tlv;
1807 
1808 	if (!vif->bss_conf.bssid_indicator)
1809 		return;
1810 
1811 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1812 					   sizeof(*mbss), &bcn->sub_ntlv,
1813 					   &bcn->len);
1814 
1815 	mbss = (struct bss_info_bcn_mbss *)tlv;
1816 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1817 	mbss->bitmap = cpu_to_le32(1);
1818 
1819 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1820 			    &skb->data[offs->mbssid_off],
1821 			    skb->len - offs->mbssid_off) {
1822 		const struct element *sub_elem;
1823 
1824 		if (elem->datalen < 2)
1825 			continue;
1826 
1827 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1828 			const struct ieee80211_bssid_index *idx;
1829 			const u8 *idx_ie;
1830 
1831 			if (sub_elem->id || sub_elem->datalen < 4)
1832 				continue; /* not a valid BSS profile */
1833 
1834 			/* Find WLAN_EID_MULTI_BSSID_IDX
1835 			 * in the merged nontransmitted profile
1836 			 */
1837 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1838 						  sub_elem->data,
1839 						  sub_elem->datalen);
1840 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1841 				continue;
1842 
1843 			idx = (void *)(idx_ie + 2);
1844 			if (!idx->bssid_index || idx->bssid_index > 31)
1845 				continue;
1846 
1847 			mbss->offset[idx->bssid_index] =
1848 				cpu_to_le16(idx_ie - skb->data);
1849 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1850 		}
1851 	}
1852 }
1853 
1854 static void
1855 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1856 		       struct sk_buff *rskb, struct sk_buff *skb,
1857 		       struct bss_info_bcn *bcn,
1858 		       struct ieee80211_mutable_offsets *offs)
1859 {
1860 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1861 	struct bss_info_bcn_cont *cont;
1862 	struct tlv *tlv;
1863 	u8 *buf;
1864 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1865 
1866 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1867 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1868 					   len, &bcn->sub_ntlv, &bcn->len);
1869 
1870 	cont = (struct bss_info_bcn_cont *)tlv;
1871 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1872 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1873 
1874 	if (offs->cntdwn_counter_offs[0]) {
1875 		u16 offset = offs->cntdwn_counter_offs[0];
1876 
1877 		if (vif->bss_conf.csa_active)
1878 			cont->csa_ofs = cpu_to_le16(offset - 4);
1879 		if (vif->bss_conf.color_change_active)
1880 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1881 	}
1882 
1883 	buf = (u8 *)tlv + sizeof(*cont);
1884 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1885 			      0, BSS_CHANGED_BEACON);
1886 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1887 }
1888 
1889 int
1890 mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1891 			     u32 changed)
1892 {
1893 #define OFFLOAD_TX_MODE_SU	BIT(0)
1894 #define OFFLOAD_TX_MODE_MU	BIT(1)
1895 	struct ieee80211_hw *hw = mt76_hw(dev);
1896 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1897 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1898 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1899 	enum nl80211_band band = chandef->chan->band;
1900 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1901 	struct bss_info_bcn *bcn;
1902 	struct bss_info_inband_discovery *discov;
1903 	struct ieee80211_tx_info *info;
1904 	struct sk_buff *rskb, *skb = NULL;
1905 	struct tlv *tlv, *sub_tlv;
1906 	bool ext_phy = phy != &dev->phy;
1907 	u8 *buf, interval;
1908 	int len;
1909 
1910 	if (vif->bss_conf.nontransmitted)
1911 		return 0;
1912 
1913 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
1914 					       MT7915_MAX_BSS_OFFLOAD_SIZE);
1915 	if (IS_ERR(rskb))
1916 		return PTR_ERR(rskb);
1917 
1918 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1919 	bcn = (struct bss_info_bcn *)tlv;
1920 	bcn->enable = true;
1921 
1922 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
1923 	    vif->bss_conf.fils_discovery.max_interval) {
1924 		interval = vif->bss_conf.fils_discovery.max_interval;
1925 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1926 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1927 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1928 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1929 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1930 	}
1931 
1932 	if (!skb) {
1933 		dev_kfree_skb(rskb);
1934 		return -EINVAL;
1935 	}
1936 
1937 	info = IEEE80211_SKB_CB(skb);
1938 	info->control.vif = vif;
1939 	info->band = band;
1940 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1941 
1942 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1943 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1944 
1945 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
1946 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1947 		dev_kfree_skb(rskb);
1948 		dev_kfree_skb(skb);
1949 		return -EINVAL;
1950 	}
1951 
1952 	sub_tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1953 					       len, &bcn->sub_ntlv, &bcn->len);
1954 	discov = (struct bss_info_inband_discovery *)sub_tlv;
1955 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1956 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1957 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1958 	discov->tx_interval = interval;
1959 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1960 	discov->enable = true;
1961 
1962 	buf = (u8 *)sub_tlv + sizeof(*discov);
1963 
1964 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1965 			      0, changed);
1966 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1967 
1968 	dev_kfree_skb(skb);
1969 
1970 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
1971 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1972 }
1973 
1974 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1975 			  int en, u32 changed)
1976 {
1977 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1978 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1979 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1980 	struct ieee80211_mutable_offsets offs;
1981 	struct ieee80211_tx_info *info;
1982 	struct sk_buff *skb, *rskb;
1983 	struct tlv *tlv;
1984 	struct bss_info_bcn *bcn;
1985 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
1986 	bool ext_phy = phy != &dev->phy;
1987 
1988 	if (vif->bss_conf.nontransmitted)
1989 		return 0;
1990 
1991 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1992 					       NULL, len);
1993 	if (IS_ERR(rskb))
1994 		return PTR_ERR(rskb);
1995 
1996 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1997 	bcn = (struct bss_info_bcn *)tlv;
1998 	bcn->enable = en;
1999 
2000 	if (!en)
2001 		goto out;
2002 
2003 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
2004 	if (!skb) {
2005 		dev_kfree_skb(rskb);
2006 		return -EINVAL;
2007 	}
2008 
2009 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
2010 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2011 		dev_kfree_skb(rskb);
2012 		dev_kfree_skb(skb);
2013 		return -EINVAL;
2014 	}
2015 
2016 	info = IEEE80211_SKB_CB(skb);
2017 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
2018 
2019 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2020 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2021 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2022 	dev_kfree_skb(skb);
2023 
2024 out:
2025 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2026 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2027 }
2028 
2029 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2030 {
2031 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2032 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2033 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2034 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2035 		return -EIO;
2036 	}
2037 
2038 	/* clear irq when the driver own success */
2039 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2040 		MT_TOP_LPCR_HOST_BAND_STAT);
2041 
2042 	return 0;
2043 }
2044 
2045 static int
2046 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2047 {
2048 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2049 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2050 
2051 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2052 			    state, 1000)) {
2053 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2054 		return -EIO;
2055 	}
2056 	return 0;
2057 }
2058 
2059 static int mt7915_load_firmware(struct mt7915_dev *dev)
2060 {
2061 	int ret;
2062 
2063 	/* make sure fw is download state */
2064 	if (mt7915_firmware_state(dev, false)) {
2065 		/* restart firmware once */
2066 		mt76_connac_mcu_restart(&dev->mt76);
2067 		ret = mt7915_firmware_state(dev, false);
2068 		if (ret) {
2069 			dev_err(dev->mt76.dev,
2070 				"Firmware is not ready for download\n");
2071 			return ret;
2072 		}
2073 	}
2074 
2075 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2076 	if (ret)
2077 		return ret;
2078 
2079 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2080 				    fw_name(dev, FIRMWARE_WA));
2081 	if (ret)
2082 		return ret;
2083 
2084 	ret = mt7915_firmware_state(dev, true);
2085 	if (ret)
2086 		return ret;
2087 
2088 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2089 
2090 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2091 
2092 	return 0;
2093 }
2094 
2095 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2096 {
2097 	struct {
2098 		u8 ctrl_val;
2099 		u8 pad[3];
2100 	} data = {
2101 		.ctrl_val = ctrl
2102 	};
2103 
2104 	if (type == MCU_FW_LOG_WA)
2105 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2106 					 &data, sizeof(data), true);
2107 
2108 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2109 				 sizeof(data), true);
2110 }
2111 
2112 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2113 {
2114 	struct {
2115 		u8 ver;
2116 		u8 pad;
2117 		__le16 len;
2118 		u8 level;
2119 		u8 rsv[3];
2120 		__le32 module_idx;
2121 	} data = {
2122 		.module_idx = cpu_to_le32(module),
2123 		.level = level,
2124 	};
2125 
2126 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2127 				 sizeof(data), false);
2128 }
2129 
2130 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2131 {
2132 	struct {
2133 		__le32 cmd;
2134 		u8 enable;
2135 	} data = {
2136 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2137 		.enable = enabled,
2138 	};
2139 
2140 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2141 				sizeof(data), false);
2142 }
2143 
2144 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy)
2145 {
2146 	struct mt7915_dev *dev = phy->dev;
2147 	struct sk_buff *skb;
2148 	struct mt7915_mcu_muru_stats *mu_stats;
2149 	int ret;
2150 
2151 	struct {
2152 		__le32 cmd;
2153 		u8 band_idx;
2154 	} req = {
2155 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2156 		.band_idx = phy->mt76->band_idx,
2157 	};
2158 
2159 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2160 					&req, sizeof(req), true, &skb);
2161 	if (ret)
2162 		return ret;
2163 
2164 	mu_stats = (struct mt7915_mcu_muru_stats *)(skb->data);
2165 
2166 	/* accumulate stats, these are clear-on-read */
2167 #define __dl_u32(s)	 phy->mib.dl_##s += le32_to_cpu(mu_stats->dl.s)
2168 #define __ul_u32(s)	 phy->mib.ul_##s += le32_to_cpu(mu_stats->ul.s)
2169 	__dl_u32(cck_cnt);
2170 	__dl_u32(ofdm_cnt);
2171 	__dl_u32(htmix_cnt);
2172 	__dl_u32(htgf_cnt);
2173 	__dl_u32(vht_su_cnt);
2174 	__dl_u32(vht_2mu_cnt);
2175 	__dl_u32(vht_3mu_cnt);
2176 	__dl_u32(vht_4mu_cnt);
2177 	__dl_u32(he_su_cnt);
2178 	__dl_u32(he_2ru_cnt);
2179 	__dl_u32(he_2mu_cnt);
2180 	__dl_u32(he_3ru_cnt);
2181 	__dl_u32(he_3mu_cnt);
2182 	__dl_u32(he_4ru_cnt);
2183 	__dl_u32(he_4mu_cnt);
2184 	__dl_u32(he_5to8ru_cnt);
2185 	__dl_u32(he_9to16ru_cnt);
2186 	__dl_u32(he_gtr16ru_cnt);
2187 
2188 	__ul_u32(hetrig_su_cnt);
2189 	__ul_u32(hetrig_2ru_cnt);
2190 	__ul_u32(hetrig_3ru_cnt);
2191 	__ul_u32(hetrig_4ru_cnt);
2192 	__ul_u32(hetrig_5to8ru_cnt);
2193 	__ul_u32(hetrig_9to16ru_cnt);
2194 	__ul_u32(hetrig_gtr16ru_cnt);
2195 	__ul_u32(hetrig_2mu_cnt);
2196 	__ul_u32(hetrig_3mu_cnt);
2197 	__ul_u32(hetrig_4mu_cnt);
2198 #undef __dl_u32
2199 #undef __ul_u32
2200 
2201 	dev_kfree_skb(skb);
2202 
2203 	return 0;
2204 }
2205 
2206 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2207 {
2208 	struct {
2209 		u8 enable;
2210 		u8 _rsv[3];
2211 	} __packed req = {
2212 		.enable = enabled
2213 	};
2214 
2215 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2216 				 sizeof(req), false);
2217 }
2218 
2219 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2220 {
2221 	struct {
2222 		__le32 cmd;
2223 		u8 val[4];
2224 	} __packed req = {
2225 		.cmd = cpu_to_le32(cmd),
2226 	};
2227 
2228 	put_unaligned_le32(val, req.val);
2229 
2230 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2231 				 sizeof(req), false);
2232 }
2233 
2234 static int
2235 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2236 {
2237 #define RX_AIRTIME_FEATURE_CTRL		1
2238 #define RX_AIRTIME_BITWISE_CTRL		2
2239 #define RX_AIRTIME_CLEAR_EN	1
2240 	struct {
2241 		__le16 field;
2242 		__le16 sub_field;
2243 		__le32 set_status;
2244 		__le32 get_status;
2245 		u8 _rsv[12];
2246 
2247 		bool airtime_en;
2248 		bool mibtime_en;
2249 		bool earlyend_en;
2250 		u8 _rsv1[9];
2251 
2252 		bool airtime_clear;
2253 		bool mibtime_clear;
2254 		u8 _rsv2[98];
2255 	} __packed req = {
2256 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2257 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2258 		.airtime_clear = true,
2259 	};
2260 	int ret;
2261 
2262 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2263 				sizeof(req), true);
2264 	if (ret)
2265 		return ret;
2266 
2267 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2268 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2269 	req.airtime_en = true;
2270 
2271 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2272 				 sizeof(req), true);
2273 }
2274 
2275 static int mt7915_red_set_watermark(struct mt7915_dev *dev)
2276 {
2277 #define RED_GLOBAL_TOKEN_WATERMARK 2
2278 	struct {
2279 		__le32 args[3];
2280 		u8 cmd;
2281 		u8 version;
2282 		u8 __rsv1[4];
2283 		__le16 len;
2284 		__le16 high_mark;
2285 		__le16 low_mark;
2286 		u8 __rsv2[12];
2287 	} __packed req = {
2288 		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
2289 		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
2290 		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
2291 		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
2292 		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
2293 	};
2294 
2295 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
2296 				 sizeof(req), false);
2297 }
2298 
2299 static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
2300 {
2301 #define RED_DISABLE		0
2302 #define RED_BY_WA_ENABLE	2
2303 	int ret;
2304 	u32 red_type = enabled ? RED_BY_WA_ENABLE : RED_DISABLE;
2305 	__le32 req = cpu_to_le32(red_type);
2306 
2307 	if (enabled) {
2308 		ret = mt7915_red_set_watermark(dev);
2309 		if (ret < 0)
2310 			return ret;
2311 	}
2312 
2313 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
2314 				sizeof(req), false);
2315 	if (ret < 0)
2316 		return ret;
2317 
2318 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2319 				 MCU_WA_PARAM_RED, enabled, 0);
2320 }
2321 
2322 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2323 {
2324 	int ret;
2325 
2326 	/* force firmware operation mode into normal state,
2327 	 * which should be set before firmware download stage.
2328 	 */
2329 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2330 
2331 	ret = mt7915_driver_own(dev, 0);
2332 	if (ret)
2333 		return ret;
2334 	/* set driver own for band1 when two hif exist */
2335 	if (dev->hif2) {
2336 		ret = mt7915_driver_own(dev, 1);
2337 		if (ret)
2338 			return ret;
2339 	}
2340 
2341 	ret = mt7915_load_firmware(dev);
2342 	if (ret)
2343 		return ret;
2344 
2345 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2346 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2347 	if (ret)
2348 		return ret;
2349 
2350 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2351 	if (ret)
2352 		return ret;
2353 
2354 	if ((mtk_wed_device_active(&dev->mt76.mmio.wed) &&
2355 	     is_mt7915(&dev->mt76)) ||
2356 	    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
2357 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2358 
2359 	ret = mt7915_mcu_set_mwds(dev, 1);
2360 	if (ret)
2361 		return ret;
2362 
2363 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2364 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2365 	if (ret)
2366 		return ret;
2367 
2368 	ret = mt7915_mcu_init_rx_airtime(dev);
2369 	if (ret)
2370 		return ret;
2371 
2372 	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
2373 }
2374 
2375 int mt7915_mcu_init(struct mt7915_dev *dev)
2376 {
2377 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2378 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2379 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2380 		.mcu_parse_response = mt7915_mcu_parse_response,
2381 	};
2382 
2383 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2384 
2385 	return mt7915_mcu_init_firmware(dev);
2386 }
2387 
2388 void mt7915_mcu_exit(struct mt7915_dev *dev)
2389 {
2390 	mt76_connac_mcu_restart(&dev->mt76);
2391 	if (mt7915_firmware_state(dev, false)) {
2392 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2393 		goto out;
2394 	}
2395 
2396 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2397 	if (dev->hif2)
2398 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2399 			MT_TOP_LPCR_HOST_FW_OWN);
2400 out:
2401 	skb_queue_purge(&dev->mt76.mcu.res_q);
2402 }
2403 
2404 static int
2405 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2406 {
2407 	struct {
2408 		u8 operation;
2409 		u8 count;
2410 		u8 _rsv[2];
2411 		u8 index;
2412 		u8 enable;
2413 		__le16 etype;
2414 	} req = {
2415 		.operation = 1,
2416 		.count = 1,
2417 		.enable = 1,
2418 		.etype = cpu_to_le16(ETH_P_PAE),
2419 	};
2420 
2421 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2422 				 &req, sizeof(req), false);
2423 }
2424 
2425 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2426 		       bool enable, bool hdr_trans)
2427 {
2428 	struct {
2429 		u8 operation;
2430 		u8 enable;
2431 		u8 check_bssid;
2432 		u8 insert_vlan;
2433 		u8 remove_vlan;
2434 		u8 tid;
2435 		u8 mode;
2436 		u8 rsv;
2437 	} __packed req_trans = {
2438 		.enable = hdr_trans,
2439 	};
2440 	struct {
2441 		u8 enable;
2442 		u8 band;
2443 		u8 rsv[2];
2444 	} __packed req_mac = {
2445 		.enable = enable,
2446 		.band = band,
2447 	};
2448 	int ret;
2449 
2450 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2451 				&req_trans, sizeof(req_trans), false);
2452 	if (ret)
2453 		return ret;
2454 
2455 	if (hdr_trans)
2456 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2457 
2458 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2459 				 &req_mac, sizeof(req_mac), true);
2460 }
2461 
2462 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2463 {
2464 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2465 	u8 num = req->total;
2466 	size_t len = sizeof(*req) -
2467 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2468 
2469 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2470 				 len, true);
2471 }
2472 
2473 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2474 {
2475 #define TX_CMD_MODE		1
2476 	struct mt7915_mcu_tx req = {
2477 		.valid = true,
2478 		.mode = TX_CMD_MODE,
2479 		.total = IEEE80211_NUM_ACS,
2480 	};
2481 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2482 	int ac;
2483 
2484 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2485 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2486 		struct edca *e = &req.edca[ac];
2487 
2488 		e->set = WMM_PARAM_SET;
2489 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2490 		e->aifs = q->aifs;
2491 		e->txop = cpu_to_le16(q->txop);
2492 
2493 		if (q->cw_min)
2494 			e->cw_min = fls(q->cw_min);
2495 		else
2496 			e->cw_min = 5;
2497 
2498 		if (q->cw_max)
2499 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2500 		else
2501 			e->cw_max = cpu_to_le16(10);
2502 	}
2503 
2504 	return mt7915_mcu_update_edca(dev, &req);
2505 }
2506 
2507 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2508 {
2509 	struct {
2510 		__le32 tag;
2511 		__le16 min_lpn;
2512 		u8 rsv[2];
2513 	} __packed req = {
2514 		.tag = cpu_to_le32(0x1),
2515 		.min_lpn = cpu_to_le16(val),
2516 	};
2517 
2518 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2519 				 sizeof(req), true);
2520 }
2521 
2522 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2523 			    const struct mt7915_dfs_pulse *pulse)
2524 {
2525 	struct {
2526 		__le32 tag;
2527 
2528 		__le32 max_width;		/* us */
2529 		__le32 max_pwr;			/* dbm */
2530 		__le32 min_pwr;			/* dbm */
2531 		__le32 min_stgr_pri;		/* us */
2532 		__le32 max_stgr_pri;		/* us */
2533 		__le32 min_cr_pri;		/* us */
2534 		__le32 max_cr_pri;		/* us */
2535 	} __packed req = {
2536 		.tag = cpu_to_le32(0x3),
2537 
2538 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2539 		__req_field(max_width),
2540 		__req_field(max_pwr),
2541 		__req_field(min_pwr),
2542 		__req_field(min_stgr_pri),
2543 		__req_field(max_stgr_pri),
2544 		__req_field(min_cr_pri),
2545 		__req_field(max_cr_pri),
2546 #undef __req_field
2547 	};
2548 
2549 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2550 				 sizeof(req), true);
2551 }
2552 
2553 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2554 			    const struct mt7915_dfs_pattern *pattern)
2555 {
2556 	struct {
2557 		__le32 tag;
2558 		__le16 radar_type;
2559 
2560 		u8 enb;
2561 		u8 stgr;
2562 		u8 min_crpn;
2563 		u8 max_crpn;
2564 		u8 min_crpr;
2565 		u8 min_pw;
2566 		__le32 min_pri;
2567 		__le32 max_pri;
2568 		u8 max_pw;
2569 		u8 min_crbn;
2570 		u8 max_crbn;
2571 		u8 min_stgpn;
2572 		u8 max_stgpn;
2573 		u8 min_stgpr;
2574 		u8 rsv[2];
2575 		__le32 min_stgpr_diff;
2576 	} __packed req = {
2577 		.tag = cpu_to_le32(0x2),
2578 		.radar_type = cpu_to_le16(index),
2579 
2580 #define __req_field_u8(field) .field = pattern->field
2581 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2582 		__req_field_u8(enb),
2583 		__req_field_u8(stgr),
2584 		__req_field_u8(min_crpn),
2585 		__req_field_u8(max_crpn),
2586 		__req_field_u8(min_crpr),
2587 		__req_field_u8(min_pw),
2588 		__req_field_u32(min_pri),
2589 		__req_field_u32(max_pri),
2590 		__req_field_u8(max_pw),
2591 		__req_field_u8(min_crbn),
2592 		__req_field_u8(max_crbn),
2593 		__req_field_u8(min_stgpn),
2594 		__req_field_u8(max_stgpn),
2595 		__req_field_u8(min_stgpr),
2596 		__req_field_u32(min_stgpr_diff),
2597 #undef __req_field_u8
2598 #undef __req_field_u32
2599 	};
2600 
2601 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2602 				 sizeof(req), true);
2603 }
2604 
2605 static int
2606 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2607 				 struct cfg80211_chan_def *chandef,
2608 				 int cmd)
2609 {
2610 	struct mt7915_dev *dev = phy->dev;
2611 	struct mt76_phy *mphy = phy->mt76;
2612 	struct ieee80211_channel *chan = mphy->chandef.chan;
2613 	int freq = mphy->chandef.center_freq1;
2614 	struct mt7915_mcu_background_chain_ctrl req = {
2615 		.monitor_scan_type = 2, /* simple rx */
2616 	};
2617 
2618 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2619 		return -EINVAL;
2620 
2621 	if (!cfg80211_chandef_valid(&mphy->chandef))
2622 		return -EINVAL;
2623 
2624 	switch (cmd) {
2625 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2626 		req.chan = chan->hw_value;
2627 		req.central_chan = ieee80211_frequency_to_channel(freq);
2628 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2629 		req.monitor_chan = chandef->chan->hw_value;
2630 		req.monitor_central_chan =
2631 			ieee80211_frequency_to_channel(chandef->center_freq1);
2632 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2633 		req.band_idx = phy->mt76->band_idx;
2634 		req.scan_mode = 1;
2635 		break;
2636 	}
2637 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2638 		req.monitor_chan = chandef->chan->hw_value;
2639 		req.monitor_central_chan =
2640 			ieee80211_frequency_to_channel(chandef->center_freq1);
2641 		req.band_idx = phy->mt76->band_idx;
2642 		req.scan_mode = 2;
2643 		break;
2644 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2645 		req.chan = chan->hw_value;
2646 		req.central_chan = ieee80211_frequency_to_channel(freq);
2647 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2648 		req.tx_stream = hweight8(mphy->antenna_mask);
2649 		req.rx_stream = mphy->antenna_mask;
2650 		break;
2651 	default:
2652 		return -EINVAL;
2653 	}
2654 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2655 
2656 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2657 				 &req, sizeof(req), false);
2658 }
2659 
2660 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2661 				     struct cfg80211_chan_def *chandef)
2662 {
2663 	struct mt7915_dev *dev = phy->dev;
2664 	int err, region;
2665 
2666 	if (!chandef) { /* disable offchain */
2667 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2668 					      0, 0);
2669 		if (err)
2670 			return err;
2671 
2672 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2673 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2674 	}
2675 
2676 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2677 					       CH_SWITCH_BACKGROUND_SCAN_START);
2678 	if (err)
2679 		return err;
2680 
2681 	switch (dev->mt76.region) {
2682 	case NL80211_DFS_ETSI:
2683 		region = 0;
2684 		break;
2685 	case NL80211_DFS_JP:
2686 		region = 2;
2687 		break;
2688 	case NL80211_DFS_FCC:
2689 	default:
2690 		region = 1;
2691 		break;
2692 	}
2693 
2694 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2695 				       0, region);
2696 }
2697 
2698 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2699 {
2700 	static const u8 ch_band[] = {
2701 		[NL80211_BAND_2GHZ] = 0,
2702 		[NL80211_BAND_5GHZ] = 1,
2703 		[NL80211_BAND_6GHZ] = 2,
2704 	};
2705 	struct mt7915_dev *dev = phy->dev;
2706 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2707 	int freq1 = chandef->center_freq1;
2708 	u8 band = phy->mt76->band_idx;
2709 	struct {
2710 		u8 control_ch;
2711 		u8 center_ch;
2712 		u8 bw;
2713 		u8 tx_path_num;
2714 		u8 rx_path;	/* mask or num */
2715 		u8 switch_reason;
2716 		u8 band_idx;
2717 		u8 center_ch2;	/* for 80+80 only */
2718 		__le16 cac_case;
2719 		u8 channel_band;
2720 		u8 rsv0;
2721 		__le32 outband_freq;
2722 		u8 txpower_drop;
2723 		u8 ap_bw;
2724 		u8 ap_center_ch;
2725 		u8 rsv1[57];
2726 	} __packed req = {
2727 		.control_ch = chandef->chan->hw_value,
2728 		.center_ch = ieee80211_frequency_to_channel(freq1),
2729 		.bw = mt76_connac_chan_bw(chandef),
2730 		.tx_path_num = hweight16(phy->mt76->chainmask),
2731 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2732 		.band_idx = band,
2733 		.channel_band = ch_band[chandef->chan->band],
2734 	};
2735 
2736 #ifdef CONFIG_NL80211_TESTMODE
2737 	if (phy->mt76->test.tx_antenna_mask &&
2738 	    mt76_testmode_enabled(phy->mt76)) {
2739 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2740 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2741 	}
2742 #endif
2743 
2744 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2745 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2746 
2747 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
2748 		req.switch_reason = CH_SWITCH_NORMAL;
2749 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL ||
2750 		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
2751 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2752 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2753 					  NL80211_IFTYPE_AP))
2754 		req.switch_reason = CH_SWITCH_DFS;
2755 	else
2756 		req.switch_reason = CH_SWITCH_NORMAL;
2757 
2758 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2759 		req.rx_path = hweight8(req.rx_path);
2760 
2761 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2762 		int freq2 = chandef->center_freq2;
2763 
2764 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2765 	}
2766 
2767 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2768 }
2769 
2770 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2771 {
2772 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2773 #define PAGE_IDX_MASK		GENMASK(4, 2)
2774 #define PER_PAGE_SIZE		0x400
2775 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2776 	u16 eeprom_size = mt7915_eeprom_size(dev);
2777 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2778 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2779 	int eep_len;
2780 	int i;
2781 
2782 	for (i = 0; i < total; i++, eep += eep_len) {
2783 		struct sk_buff *skb;
2784 		int ret;
2785 
2786 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2787 			eep_len = eeprom_size % PER_PAGE_SIZE;
2788 		else
2789 			eep_len = PER_PAGE_SIZE;
2790 
2791 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2792 					 sizeof(req) + eep_len);
2793 		if (!skb)
2794 			return -ENOMEM;
2795 
2796 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2797 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2798 		req.len = cpu_to_le16(eep_len);
2799 
2800 		skb_put_data(skb, &req, sizeof(req));
2801 		skb_put_data(skb, eep, eep_len);
2802 
2803 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2804 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2805 		if (ret)
2806 			return ret;
2807 	}
2808 
2809 	return 0;
2810 }
2811 
2812 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2813 {
2814 	struct mt7915_mcu_eeprom req = {
2815 		.buffer_mode = EE_MODE_EFUSE,
2816 		.format = EE_FORMAT_WHOLE,
2817 	};
2818 
2819 	if (dev->flash_mode)
2820 		return mt7915_mcu_set_eeprom_flash(dev);
2821 
2822 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2823 				 &req, sizeof(req), true);
2824 }
2825 
2826 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2827 {
2828 	struct mt7915_mcu_eeprom_info req = {
2829 		.addr = cpu_to_le32(round_down(offset,
2830 				    MT7915_EEPROM_BLOCK_SIZE)),
2831 	};
2832 	struct mt7915_mcu_eeprom_info *res;
2833 	struct sk_buff *skb;
2834 	int ret;
2835 	u8 *buf;
2836 
2837 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2838 					MCU_EXT_QUERY(EFUSE_ACCESS),
2839 					&req, sizeof(req), true, &skb);
2840 	if (ret)
2841 		return ret;
2842 
2843 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2844 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2845 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2846 	dev_kfree_skb(skb);
2847 
2848 	return 0;
2849 }
2850 
2851 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2852 {
2853 	struct {
2854 		u8 _rsv;
2855 		u8 version;
2856 		u8 die_idx;
2857 		u8 _rsv2;
2858 	} __packed req = {
2859 		.version = 1,
2860 	};
2861 	struct sk_buff *skb;
2862 	int ret;
2863 
2864 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2865 					MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
2866 					&req, sizeof(req), true, &skb);
2867 	if (ret)
2868 		return ret;
2869 
2870 	*block_num = *(u8 *)skb->data;
2871 	dev_kfree_skb(skb);
2872 
2873 	return 0;
2874 }
2875 
2876 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2877 				  u8 *data, u32 len, int cmd)
2878 {
2879 	struct {
2880 		u8 dir;
2881 		u8 valid;
2882 		__le16 bitmap;
2883 		s8 precal;
2884 		u8 action;
2885 		u8 band;
2886 		u8 idx;
2887 		u8 rsv[4];
2888 		__le32 len;
2889 	} req = {};
2890 	struct sk_buff *skb;
2891 
2892 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2893 	if (!skb)
2894 		return -ENOMEM;
2895 
2896 	req.idx = idx;
2897 	req.len = cpu_to_le32(len);
2898 	skb_put_data(skb, &req, sizeof(req));
2899 	skb_put_data(skb, data, len);
2900 
2901 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2902 }
2903 
2904 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2905 {
2906 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2907 	u32 total = MT_EE_CAL_GROUP_SIZE;
2908 
2909 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
2910 		return 0;
2911 
2912 	/*
2913 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2914 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2915 	 */
2916 	while (total > 0) {
2917 		int ret, len;
2918 
2919 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2920 
2921 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2922 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2923 		if (ret)
2924 			return ret;
2925 
2926 		total -= len;
2927 		cal += len;
2928 		idx++;
2929 	}
2930 
2931 	return 0;
2932 }
2933 
2934 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2935 {
2936 	int i;
2937 
2938 	for (i = 0; i < n_freqs; i++)
2939 		if (cur == freqs[i])
2940 			return i;
2941 
2942 	return -1;
2943 }
2944 
2945 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
2946 {
2947 	static const u16 freq_list[] = {
2948 		5180, 5200, 5220, 5240,
2949 		5260, 5280, 5300, 5320,
2950 		5500, 5520, 5540, 5560,
2951 		5580, 5600, 5620, 5640,
2952 		5660, 5680, 5700, 5745,
2953 		5765, 5785, 5805, 5825
2954 	};
2955 	int offset_2g = ARRAY_SIZE(freq_list);
2956 	int idx;
2957 
2958 	if (freq < 4000) {
2959 		if (freq < 2432)
2960 			return offset_2g;
2961 		if (freq < 2457)
2962 			return offset_2g + 1;
2963 
2964 		return offset_2g + 2;
2965 	}
2966 
2967 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
2968 		return -1;
2969 
2970 	if (bw != NL80211_CHAN_WIDTH_20) {
2971 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2972 					   freq + 10);
2973 		if (idx >= 0)
2974 			return idx;
2975 
2976 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2977 					   freq - 10);
2978 		if (idx >= 0)
2979 			return idx;
2980 	}
2981 
2982 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2983 }
2984 
2985 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
2986 {
2987 	struct mt7915_dev *dev = phy->dev;
2988 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2989 	u16 total = 2, center_freq = chandef->center_freq1;
2990 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2991 	int idx;
2992 
2993 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
2994 		return 0;
2995 
2996 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
2997 	if (idx < 0)
2998 		return -EINVAL;
2999 
3000 	/* Items: Tx DPD, Tx Flatness */
3001 	idx = idx * 2;
3002 	cal += MT_EE_CAL_GROUP_SIZE;
3003 
3004 	while (total--) {
3005 		int ret;
3006 
3007 		cal += (idx * MT_EE_CAL_UNIT);
3008 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3009 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3010 		if (ret)
3011 			return ret;
3012 
3013 		idx++;
3014 	}
3015 
3016 	return 0;
3017 }
3018 
3019 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3020 {
3021 	struct mt76_channel_state *state = phy->mt76->chan_state;
3022 	struct mt76_channel_state *state_ts = &phy->state_ts;
3023 	struct mt7915_dev *dev = phy->dev;
3024 	struct mt7915_mcu_mib *res, req[5];
3025 	struct sk_buff *skb;
3026 	static const u32 *offs;
3027 	int i, ret, len, offs_cc;
3028 	u64 cc_tx;
3029 
3030 	/* strict order */
3031 	if (is_mt7915(&dev->mt76)) {
3032 		static const u32 chip_offs[] = {
3033 			MIB_NON_WIFI_TIME,
3034 			MIB_TX_TIME,
3035 			MIB_RX_TIME,
3036 			MIB_OBSS_AIRTIME,
3037 			MIB_TXOP_INIT_COUNT,
3038 		};
3039 		len = ARRAY_SIZE(chip_offs);
3040 		offs = chip_offs;
3041 		offs_cc = 20;
3042 	} else {
3043 		static const u32 chip_offs[] = {
3044 			MIB_NON_WIFI_TIME_V2,
3045 			MIB_TX_TIME_V2,
3046 			MIB_RX_TIME_V2,
3047 			MIB_OBSS_AIRTIME_V2
3048 		};
3049 		len = ARRAY_SIZE(chip_offs);
3050 		offs = chip_offs;
3051 		offs_cc = 0;
3052 	}
3053 
3054 	for (i = 0; i < len; i++) {
3055 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
3056 		req[i].offs = cpu_to_le32(offs[i]);
3057 	}
3058 
3059 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3060 					req, len * sizeof(req[0]), true, &skb);
3061 	if (ret)
3062 		return ret;
3063 
3064 	res = (struct mt7915_mcu_mib *)(skb->data + offs_cc);
3065 
3066 #define __res_u64(s) le64_to_cpu(res[s].data)
3067 	/* subtract Tx backoff time from Tx duration */
3068 	cc_tx = is_mt7915(&dev->mt76) ? __res_u64(1) - __res_u64(4) : __res_u64(1);
3069 
3070 	if (chan_switch)
3071 		goto out;
3072 
3073 	state->cc_tx += cc_tx - state_ts->cc_tx;
3074 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3075 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3076 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3077 			  state_ts->cc_busy;
3078 
3079 out:
3080 	state_ts->cc_tx = cc_tx;
3081 	state_ts->cc_bss_rx = __res_u64(2);
3082 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3083 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3084 #undef __res_u64
3085 
3086 	dev_kfree_skb(skb);
3087 
3088 	return 0;
3089 }
3090 
3091 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3092 {
3093 	struct mt7915_dev *dev = phy->dev;
3094 	struct {
3095 		u8 ctrl_id;
3096 		u8 action;
3097 		u8 band_idx;
3098 		u8 rsv[5];
3099 	} req = {
3100 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3101 		.band_idx = phy->mt76->band_idx,
3102 	};
3103 
3104 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3105 				 sizeof(req), true);
3106 }
3107 
3108 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3109 {
3110 	struct mt7915_dev *dev = phy->dev;
3111 	struct mt7915_mcu_thermal_ctrl req = {
3112 		.band_idx = phy->mt76->band_idx,
3113 		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
3114 	};
3115 	int level, ret;
3116 
3117 	/* set duty cycle and level */
3118 	for (level = 0; level < 4; level++) {
3119 		req.duty.duty_level = level;
3120 		req.duty.duty_cycle = state;
3121 		state /= 2;
3122 
3123 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3124 					&req, sizeof(req), false);
3125 		if (ret)
3126 			return ret;
3127 	}
3128 	return 0;
3129 }
3130 
3131 int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
3132 {
3133 	struct mt7915_dev *dev = phy->dev;
3134 	struct {
3135 		struct mt7915_mcu_thermal_ctrl ctrl;
3136 
3137 		__le32 trigger_temp;
3138 		__le32 restore_temp;
3139 		__le16 sustain_time;
3140 		u8 rsv[2];
3141 	} __packed req = {
3142 		.ctrl = {
3143 			.band_idx = phy->mt76->band_idx,
3144 			.type.protect_type = 1,
3145 			.type.trigger_type = 1,
3146 		},
3147 	};
3148 	int ret;
3149 
3150 	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3151 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3152 				&req, sizeof(req.ctrl), false);
3153 
3154 	if (ret)
3155 		return ret;
3156 
3157 	/* set high-temperature trigger threshold */
3158 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3159 	/* add a safety margin ~10 */
3160 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3161 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3162 	req.sustain_time = cpu_to_le16(10);
3163 
3164 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3165 				 &req, sizeof(req), false);
3166 }
3167 
3168 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3169 {
3170 	struct mt7915_dev *dev = phy->dev;
3171 	struct {
3172 		u8 format_id;
3173 		u8 rsv;
3174 		u8 band_idx;
3175 		s8 txpower_min;
3176 	} __packed req = {
3177 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3178 		.band_idx = phy->mt76->band_idx,
3179 		.txpower_min = txpower * 2, /* 0.5db */
3180 	};
3181 
3182 	return mt76_mcu_send_msg(&dev->mt76,
3183 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3184 				 sizeof(req), true);
3185 }
3186 
3187 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3188 				 struct ieee80211_vif *vif,
3189 				 struct ieee80211_sta *sta, s8 txpower)
3190 {
3191 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3192 	struct mt7915_dev *dev = phy->dev;
3193 	struct mt76_phy *mphy = phy->mt76;
3194 	struct {
3195 		u8 format_id;
3196 		u8 rsv[3];
3197 		u8 band_idx;
3198 		s8 txpower_max;
3199 		__le16 wcid;
3200 		s8 txpower_offs[48];
3201 	} __packed req = {
3202 		.format_id = TX_POWER_LIMIT_FRAME,
3203 		.band_idx = phy->mt76->band_idx,
3204 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3205 		.wcid = cpu_to_le16(msta->wcid.idx),
3206 	};
3207 	int ret;
3208 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3209 
3210 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
3211 	if (ret)
3212 		return ret;
3213 
3214 	txpower = mt7915_get_power_bound(phy, txpower);
3215 	if (txpower > mphy->txpower_cur || txpower < 0)
3216 		return -EINVAL;
3217 
3218 	if (txpower) {
3219 		u32 offs, len, i;
3220 
3221 		if (sta->deflink.ht_cap.ht_supported) {
3222 			const u8 *sku_len = mt7915_sku_group_len;
3223 
3224 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3225 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3226 
3227 			if (sta->deflink.vht_cap.vht_supported) {
3228 				offs += len;
3229 				len = sku_len[SKU_VHT_BW20] * 4;
3230 
3231 				if (sta->deflink.he_cap.has_he) {
3232 					offs += len + sku_len[SKU_HE_RU26] * 3;
3233 					len = sku_len[SKU_HE_RU242] * 4;
3234 				}
3235 			}
3236 		} else {
3237 			return -EINVAL;
3238 		}
3239 
3240 		for (i = 0; i < len; i++, offs++)
3241 			req.txpower_offs[i] =
3242 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3243 	}
3244 
3245 	return mt76_mcu_send_msg(&dev->mt76,
3246 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3247 				 sizeof(req), true);
3248 }
3249 
3250 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3251 {
3252 	struct mt7915_dev *dev = phy->dev;
3253 	struct mt76_phy *mphy = phy->mt76;
3254 	struct ieee80211_hw *hw = mphy->hw;
3255 	struct mt7915_mcu_txpower_sku req = {
3256 		.format_id = TX_POWER_LIMIT_TABLE,
3257 		.band_idx = phy->mt76->band_idx,
3258 	};
3259 	struct mt76_power_limits limits_array;
3260 	s8 *la = (s8 *)&limits_array;
3261 	int i, idx;
3262 	int tx_power;
3263 
3264 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
3265 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3266 					      &limits_array, tx_power);
3267 	mphy->txpower_cur = tx_power;
3268 
3269 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3270 		u8 mcs_num, len = mt7915_sku_group_len[i];
3271 		int j;
3272 
3273 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3274 			mcs_num = 10;
3275 
3276 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3277 				la = (s8 *)&limits_array + 12;
3278 		} else {
3279 			mcs_num = len;
3280 		}
3281 
3282 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3283 			req.txpower_sku[idx + j] = la[j];
3284 
3285 		la += mcs_num;
3286 		idx += len;
3287 	}
3288 
3289 	return mt76_mcu_send_msg(&dev->mt76,
3290 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3291 				 sizeof(req), true);
3292 }
3293 
3294 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3295 {
3296 #define RATE_POWER_INFO	2
3297 	struct mt7915_dev *dev = phy->dev;
3298 	struct {
3299 		u8 format_id;
3300 		u8 category;
3301 		u8 band_idx;
3302 		u8 _rsv;
3303 	} __packed req = {
3304 		.format_id = TX_POWER_LIMIT_INFO,
3305 		.category = RATE_POWER_INFO,
3306 		.band_idx = phy->mt76->band_idx,
3307 	};
3308 	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
3309 	struct sk_buff *skb;
3310 	int ret, i;
3311 
3312 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3313 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3314 					&req, sizeof(req), true, &skb);
3315 	if (ret)
3316 		return ret;
3317 
3318 	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
3319 	for (i = 0; i < len; i++)
3320 		txpower[i] = txpower_sku[i][req.band_idx];
3321 
3322 	dev_kfree_skb(skb);
3323 
3324 	return 0;
3325 }
3326 
3327 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3328 			      u8 en)
3329 {
3330 	struct {
3331 		u8 test_mode_en;
3332 		u8 param_idx;
3333 		u8 _rsv[2];
3334 
3335 		u8 enable;
3336 		u8 _rsv2[3];
3337 
3338 		u8 pad[8];
3339 	} __packed req = {
3340 		.test_mode_en = test_mode,
3341 		.param_idx = param,
3342 		.enable = en,
3343 	};
3344 
3345 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3346 				 sizeof(req), false);
3347 }
3348 
3349 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3350 {
3351 	struct mt7915_dev *dev = phy->dev;
3352 	struct mt7915_sku {
3353 		u8 format_id;
3354 		u8 sku_enable;
3355 		u8 band_idx;
3356 		u8 rsv;
3357 	} __packed req = {
3358 		.format_id = TX_POWER_LIMIT_ENABLE,
3359 		.band_idx = phy->mt76->band_idx,
3360 		.sku_enable = enable,
3361 	};
3362 
3363 	return mt76_mcu_send_msg(&dev->mt76,
3364 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3365 				 sizeof(req), true);
3366 }
3367 
3368 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3369 {
3370 	struct {
3371 		u8 action;
3372 		u8 set;
3373 		u8 band;
3374 		u8 rsv;
3375 	} req = {
3376 		.action = action,
3377 		.set = set,
3378 		.band = band,
3379 	};
3380 
3381 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3382 				 &req, sizeof(req), false);
3383 }
3384 
3385 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3386 {
3387 	struct {
3388 		u8 action;
3389 		union {
3390 			struct {
3391 				u8 snd_mode;
3392 				u8 sta_num;
3393 				u8 rsv;
3394 				u8 wlan_idx[4];
3395 				__le32 snd_period;	/* ms */
3396 			} __packed snd;
3397 			struct {
3398 				bool ebf;
3399 				bool ibf;
3400 				u8 rsv;
3401 			} __packed type;
3402 			struct {
3403 				u8 bf_num;
3404 				u8 bf_bitmap;
3405 				u8 bf_sel[8];
3406 				u8 rsv[5];
3407 			} __packed mod;
3408 		};
3409 	} __packed req = {
3410 		.action = action,
3411 	};
3412 
3413 #define MT_BF_PROCESSING	4
3414 	switch (action) {
3415 	case MT_BF_SOUNDING_ON:
3416 		req.snd.snd_mode = MT_BF_PROCESSING;
3417 		break;
3418 	case MT_BF_TYPE_UPDATE:
3419 		req.type.ebf = true;
3420 		req.type.ibf = dev->ibf;
3421 		break;
3422 	case MT_BF_MODULE_UPDATE:
3423 		req.mod.bf_num = 2;
3424 		req.mod.bf_bitmap = GENMASK(1, 0);
3425 		break;
3426 	default:
3427 		return -EINVAL;
3428 	}
3429 
3430 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3431 				 sizeof(req), true);
3432 }
3433 
3434 static int
3435 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3436 {
3437 	struct mt7915_dev *dev = phy->dev;
3438 	struct mt7915_mcu_sr_ctrl req = {
3439 		.action = action,
3440 		.argnum = 1,
3441 		.band_idx = phy->mt76->band_idx,
3442 		.val = cpu_to_le32(val),
3443 	};
3444 
3445 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3446 				 sizeof(req), true);
3447 }
3448 
3449 static int
3450 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3451 			   struct ieee80211_he_obss_pd *he_obss_pd)
3452 {
3453 	struct mt7915_dev *dev = phy->dev;
3454 	struct {
3455 		struct mt7915_mcu_sr_ctrl ctrl;
3456 		struct {
3457 			u8 pd_th_non_srg;
3458 			u8 pd_th_srg;
3459 			u8 period_offs;
3460 			u8 rcpi_src;
3461 			__le16 obss_pd_min;
3462 			__le16 obss_pd_min_srg;
3463 			u8 resp_txpwr_mode;
3464 			u8 txpwr_restrict_mode;
3465 			u8 txpwr_ref;
3466 			u8 rsv[3];
3467 		} __packed param;
3468 	} __packed req = {
3469 		.ctrl = {
3470 			.action = SPR_SET_PARAM,
3471 			.argnum = 9,
3472 			.band_idx = phy->mt76->band_idx,
3473 		},
3474 	};
3475 	int ret;
3476 	u8 max_th = 82, non_srg_max_th = 62;
3477 
3478 	/* disable firmware dynamical PD asjustment */
3479 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3480 	if (ret)
3481 		return ret;
3482 
3483 	if (he_obss_pd->sr_ctrl &
3484 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3485 		req.param.pd_th_non_srg = max_th;
3486 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3487 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3488 	else
3489 		req.param.pd_th_non_srg  = non_srg_max_th;
3490 
3491 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3492 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3493 
3494 	req.param.obss_pd_min = cpu_to_le16(82);
3495 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3496 	req.param.txpwr_restrict_mode = 2;
3497 	req.param.txpwr_ref = 21;
3498 
3499 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3500 				 sizeof(req), true);
3501 }
3502 
3503 static int
3504 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3505 			     struct ieee80211_he_obss_pd *he_obss_pd)
3506 {
3507 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3508 	struct mt7915_dev *dev = phy->dev;
3509 	u8 omac = mvif->mt76.omac_idx;
3510 	struct {
3511 		struct mt7915_mcu_sr_ctrl ctrl;
3512 		struct {
3513 			u8 omac;
3514 			u8 rsv[3];
3515 			u8 flag[20];
3516 		} __packed siga;
3517 	} __packed req = {
3518 		.ctrl = {
3519 			.action = SPR_SET_SIGA,
3520 			.argnum = 1,
3521 			.band_idx = phy->mt76->band_idx,
3522 		},
3523 		.siga = {
3524 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3525 		},
3526 	};
3527 	int ret;
3528 
3529 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3530 		req.siga.flag[req.siga.omac] = 0xf;
3531 	else
3532 		return 0;
3533 
3534 	/* switch to normal AP mode */
3535 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3536 	if (ret)
3537 		return ret;
3538 
3539 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3540 				 sizeof(req), true);
3541 }
3542 
3543 static int
3544 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3545 			       struct ieee80211_he_obss_pd *he_obss_pd)
3546 {
3547 	struct mt7915_dev *dev = phy->dev;
3548 	struct {
3549 		struct mt7915_mcu_sr_ctrl ctrl;
3550 		struct {
3551 			__le32 color_l[2];
3552 			__le32 color_h[2];
3553 			__le32 bssid_l[2];
3554 			__le32 bssid_h[2];
3555 		} __packed bitmap;
3556 	} __packed req = {
3557 		.ctrl = {
3558 			.action = SPR_SET_SRG_BITMAP,
3559 			.argnum = 4,
3560 			.band_idx = phy->mt76->band_idx,
3561 		},
3562 	};
3563 	u32 bitmap;
3564 
3565 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3566 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3567 
3568 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3569 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3570 
3571 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3572 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3573 
3574 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3575 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3576 
3577 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3578 				 sizeof(req), true);
3579 }
3580 
3581 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3582 			    struct ieee80211_he_obss_pd *he_obss_pd)
3583 {
3584 	int ret;
3585 
3586 	/* enable firmware scene detection algorithms */
3587 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3588 	if (ret)
3589 		return ret;
3590 
3591 	/* firmware dynamically adjusts PD threshold so skip manual control */
3592 	if (sr_scene_detect && !he_obss_pd->enable)
3593 		return 0;
3594 
3595 	/* enable spatial reuse */
3596 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3597 	if (ret)
3598 		return ret;
3599 
3600 	if (sr_scene_detect || !he_obss_pd->enable)
3601 		return 0;
3602 
3603 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3604 	if (ret)
3605 		return ret;
3606 
3607 	/* set SRG/non-SRG OBSS PD threshold */
3608 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3609 	if (ret)
3610 		return ret;
3611 
3612 	/* Set SR prohibit */
3613 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3614 	if (ret)
3615 		return ret;
3616 
3617 	/* set SRG BSS color/BSSID bitmap */
3618 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3619 }
3620 
3621 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3622 			   struct ieee80211_sta *sta, struct rate_info *rate)
3623 {
3624 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3625 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3626 	struct mt7915_dev *dev = phy->dev;
3627 	struct mt76_phy *mphy = phy->mt76;
3628 	struct {
3629 		u8 category;
3630 		u8 band;
3631 		__le16 wcid;
3632 	} __packed req = {
3633 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3634 		.band = mvif->mt76.band_idx,
3635 		.wcid = cpu_to_le16(msta->wcid.idx),
3636 	};
3637 	struct ieee80211_supported_band *sband;
3638 	struct mt7915_mcu_phy_rx_info *res;
3639 	struct sk_buff *skb;
3640 	int ret;
3641 	bool cck = false;
3642 
3643 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3644 					&req, sizeof(req), true, &skb);
3645 	if (ret)
3646 		return ret;
3647 
3648 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3649 
3650 	rate->mcs = res->rate;
3651 	rate->nss = res->nsts + 1;
3652 
3653 	switch (res->mode) {
3654 	case MT_PHY_TYPE_CCK:
3655 		cck = true;
3656 		fallthrough;
3657 	case MT_PHY_TYPE_OFDM:
3658 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3659 			sband = &mphy->sband_5g.sband;
3660 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3661 			sband = &mphy->sband_6g.sband;
3662 		else
3663 			sband = &mphy->sband_2g.sband;
3664 
3665 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3666 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3667 		break;
3668 	case MT_PHY_TYPE_HT:
3669 	case MT_PHY_TYPE_HT_GF:
3670 		if (rate->mcs > 31) {
3671 			ret = -EINVAL;
3672 			goto out;
3673 		}
3674 
3675 		rate->flags = RATE_INFO_FLAGS_MCS;
3676 		if (res->gi)
3677 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3678 		break;
3679 	case MT_PHY_TYPE_VHT:
3680 		if (rate->mcs > 9) {
3681 			ret = -EINVAL;
3682 			goto out;
3683 		}
3684 
3685 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3686 		if (res->gi)
3687 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3688 		break;
3689 	case MT_PHY_TYPE_HE_SU:
3690 	case MT_PHY_TYPE_HE_EXT_SU:
3691 	case MT_PHY_TYPE_HE_TB:
3692 	case MT_PHY_TYPE_HE_MU:
3693 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3694 			ret = -EINVAL;
3695 			goto out;
3696 		}
3697 		rate->he_gi = res->gi;
3698 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3699 		break;
3700 	default:
3701 		ret = -EINVAL;
3702 		goto out;
3703 	}
3704 
3705 	switch (res->bw) {
3706 	case IEEE80211_STA_RX_BW_160:
3707 		rate->bw = RATE_INFO_BW_160;
3708 		break;
3709 	case IEEE80211_STA_RX_BW_80:
3710 		rate->bw = RATE_INFO_BW_80;
3711 		break;
3712 	case IEEE80211_STA_RX_BW_40:
3713 		rate->bw = RATE_INFO_BW_40;
3714 		break;
3715 	default:
3716 		rate->bw = RATE_INFO_BW_20;
3717 		break;
3718 	}
3719 
3720 out:
3721 	dev_kfree_skb(skb);
3722 
3723 	return ret;
3724 }
3725 
3726 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3727 				struct cfg80211_he_bss_color *he_bss_color)
3728 {
3729 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3730 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3731 	struct bss_info_color *bss_color;
3732 	struct sk_buff *skb;
3733 	struct tlv *tlv;
3734 
3735 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3736 					      NULL, len);
3737 	if (IS_ERR(skb))
3738 		return PTR_ERR(skb);
3739 
3740 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3741 				      sizeof(*bss_color));
3742 	bss_color = (struct bss_info_color *)tlv;
3743 	bss_color->disable = !he_bss_color->enabled;
3744 	bss_color->color = he_bss_color->color;
3745 
3746 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3747 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3748 }
3749 
3750 #define TWT_AGRT_TRIGGER	BIT(0)
3751 #define TWT_AGRT_ANNOUNCE	BIT(1)
3752 #define TWT_AGRT_PROTECT	BIT(2)
3753 
3754 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3755 			       struct mt7915_vif *mvif,
3756 			       struct mt7915_twt_flow *flow,
3757 			       int cmd)
3758 {
3759 	struct {
3760 		u8 tbl_idx;
3761 		u8 cmd;
3762 		u8 own_mac_idx;
3763 		u8 flowid; /* 0xff for group id */
3764 		__le16 peer_id; /* specify the peer_id (msb=0)
3765 				 * or group_id (msb=1)
3766 				 */
3767 		u8 duration; /* 256 us */
3768 		u8 bss_idx;
3769 		__le64 start_tsf;
3770 		__le16 mantissa;
3771 		u8 exponent;
3772 		u8 is_ap;
3773 		u8 agrt_params;
3774 		u8 rsv[23];
3775 	} __packed req = {
3776 		.tbl_idx = flow->table_id,
3777 		.cmd = cmd,
3778 		.own_mac_idx = mvif->mt76.omac_idx,
3779 		.flowid = flow->id,
3780 		.peer_id = cpu_to_le16(flow->wcid),
3781 		.duration = flow->duration,
3782 		.bss_idx = mvif->mt76.idx,
3783 		.start_tsf = cpu_to_le64(flow->tsf),
3784 		.mantissa = flow->mantissa,
3785 		.exponent = flow->exp,
3786 		.is_ap = true,
3787 	};
3788 
3789 	if (flow->protection)
3790 		req.agrt_params |= TWT_AGRT_PROTECT;
3791 	if (!flow->flowtype)
3792 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3793 	if (flow->trigger)
3794 		req.agrt_params |= TWT_AGRT_TRIGGER;
3795 
3796 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3797 				 &req, sizeof(req), true);
3798 }
3799 
3800 int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
3801 {
3802 	struct {
3803 		__le32 cmd;
3804 		__le32 num;
3805 		__le32 __rsv;
3806 		__le16 wlan_idx;
3807 	} req = {
3808 		.cmd = cpu_to_le32(0x15),
3809 		.num = cpu_to_le32(1),
3810 		.wlan_idx = cpu_to_le16(wlan_idx),
3811 	};
3812 	struct mt7915_mcu_wa_tx_stat {
3813 		__le16 wlan_idx;
3814 		u8 __rsv[2];
3815 
3816 		/* tx_bytes is deprecated since WA byte counter uses u32,
3817 		 * which easily leads to overflow.
3818 		 */
3819 		__le32 tx_bytes;
3820 		__le32 tx_packets;
3821 	} *res;
3822 	struct mt76_wcid *wcid;
3823 	struct sk_buff *skb;
3824 	int ret;
3825 
3826 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
3827 					&req, sizeof(req), true, &skb);
3828 	if (ret)
3829 		return ret;
3830 
3831 	if (!is_mt7915(&dev->mt76))
3832 		skb_pull(skb, 4);
3833 
3834 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
3835 
3836 	if (le16_to_cpu(res->wlan_idx) != wlan_idx) {
3837 		ret = -EINVAL;
3838 		goto out;
3839 	}
3840 
3841 	rcu_read_lock();
3842 
3843 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
3844 	if (wcid)
3845 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
3846 	else
3847 		ret = -EINVAL;
3848 
3849 	rcu_read_unlock();
3850 out:
3851 	dev_kfree_skb(skb);
3852 
3853 	return ret;
3854 }
3855 
3856 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3857 {
3858 	struct {
3859 		__le32 idx;
3860 		__le32 ofs;
3861 		__le32 data;
3862 	} __packed req = {
3863 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
3864 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
3865 		.data = set ? cpu_to_le32(*val) : 0,
3866 	};
3867 	struct sk_buff *skb;
3868 	int ret;
3869 
3870 	if (set)
3871 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3872 					 &req, sizeof(req), false);
3873 
3874 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3875 					&req, sizeof(req), true, &skb);
3876 	if (ret)
3877 		return ret;
3878 
3879 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3880 	dev_kfree_skb(skb);
3881 
3882 	return 0;
3883 }
3884