1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define MT_STA_BFER			BIT(0)
70 #define MT_STA_BFEE			BIT(1)
71 
72 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
73 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
74 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
75 
76 #define DL_MODE_ENCRYPT			BIT(0)
77 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
78 #define DL_MODE_RESET_SEC_IV		BIT(3)
79 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
80 #define DL_MODE_NEED_RSP		BIT(31)
81 
82 #define FW_START_OVERRIDE		BIT(0)
83 #define FW_START_WORKING_PDA_CR4	BIT(2)
84 
85 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
86 #define PATCH_SEC_TYPE_INFO		0x2
87 
88 #define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
89 #define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
90 
91 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
92 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
93 
94 static enum mt7915_cipher_type
95 mt7915_mcu_get_cipher(int cipher)
96 {
97 	switch (cipher) {
98 	case WLAN_CIPHER_SUITE_WEP40:
99 		return MT_CIPHER_WEP40;
100 	case WLAN_CIPHER_SUITE_WEP104:
101 		return MT_CIPHER_WEP104;
102 	case WLAN_CIPHER_SUITE_TKIP:
103 		return MT_CIPHER_TKIP;
104 	case WLAN_CIPHER_SUITE_AES_CMAC:
105 		return MT_CIPHER_BIP_CMAC_128;
106 	case WLAN_CIPHER_SUITE_CCMP:
107 		return MT_CIPHER_AES_CCMP;
108 	case WLAN_CIPHER_SUITE_CCMP_256:
109 		return MT_CIPHER_CCMP_256;
110 	case WLAN_CIPHER_SUITE_GCMP:
111 		return MT_CIPHER_GCMP;
112 	case WLAN_CIPHER_SUITE_GCMP_256:
113 		return MT_CIPHER_GCMP_256;
114 	case WLAN_CIPHER_SUITE_SMS4:
115 		return MT_CIPHER_WAPI;
116 	default:
117 		return MT_CIPHER_NONE;
118 	}
119 }
120 
121 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
122 {
123 	static const u8 width_to_bw[] = {
124 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
125 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
126 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
127 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
128 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
129 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
130 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
131 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
132 	};
133 
134 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
135 		return 0;
136 
137 	return width_to_bw[chandef->width];
138 }
139 
140 static const struct ieee80211_sta_he_cap *
141 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
142 {
143 	struct ieee80211_supported_band *sband;
144 	enum nl80211_band band;
145 
146 	band = phy->mt76->chandef.chan->band;
147 	sband = phy->mt76->hw->wiphy->bands[band];
148 
149 	return ieee80211_get_he_iftype_cap(sband, vif->type);
150 }
151 
152 static u8
153 mt7915_get_phy_mode(struct mt7915_dev *dev, struct ieee80211_vif *vif,
154 		    enum nl80211_band band, struct ieee80211_sta *sta)
155 {
156 	struct ieee80211_sta_ht_cap *ht_cap;
157 	struct ieee80211_sta_vht_cap *vht_cap;
158 	const struct ieee80211_sta_he_cap *he_cap;
159 	u8 mode = 0;
160 
161 	if (sta) {
162 		ht_cap = &sta->ht_cap;
163 		vht_cap = &sta->vht_cap;
164 		he_cap = &sta->he_cap;
165 	} else {
166 		struct ieee80211_supported_band *sband;
167 		struct mt7915_phy *phy;
168 		struct mt7915_vif *mvif;
169 
170 		mvif = (struct mt7915_vif *)vif->drv_priv;
171 		phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
172 		sband = phy->mt76->hw->wiphy->bands[band];
173 
174 		ht_cap = &sband->ht_cap;
175 		vht_cap = &sband->vht_cap;
176 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
177 	}
178 
179 	if (band == NL80211_BAND_2GHZ) {
180 		mode |= PHY_MODE_B | PHY_MODE_G;
181 
182 		if (ht_cap->ht_supported)
183 			mode |= PHY_MODE_GN;
184 
185 		if (he_cap->has_he)
186 			mode |= PHY_MODE_AX_24G;
187 	} else if (band == NL80211_BAND_5GHZ) {
188 		mode |= PHY_MODE_A;
189 
190 		if (ht_cap->ht_supported)
191 			mode |= PHY_MODE_AN;
192 
193 		if (vht_cap->vht_supported)
194 			mode |= PHY_MODE_AC;
195 
196 		if (he_cap->has_he)
197 			mode |= PHY_MODE_AX_5G;
198 	}
199 
200 	return mode;
201 }
202 
203 static u8
204 mt7915_mcu_get_sta_nss(u16 mcs_map)
205 {
206 	u8 nss;
207 
208 	for (nss = 8; nss > 0; nss--) {
209 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
210 
211 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
212 			break;
213 	}
214 
215 	return nss - 1;
216 }
217 
218 static int __mt7915_mcu_msg_send(struct mt7915_dev *dev, struct sk_buff *skb,
219 				 int cmd, int *wait_seq)
220 {
221 	struct mt7915_mcu_txd *mcu_txd;
222 	u8 seq, pkt_fmt, qidx;
223 	enum mt76_txq_id txq;
224 	__le32 *txd;
225 	u32 val;
226 
227 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
228 	if (!seq)
229 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
230 
231 	if (cmd == -MCU_CMD_FW_SCATTER) {
232 		txq = MT_TXQ_FWDL;
233 		goto exit;
234 	}
235 
236 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
237 
238 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state)) {
239 		txq = MT_TXQ_MCU_WA;
240 		qidx = MT_TX_MCU_PORT_RX_Q0;
241 		pkt_fmt = MT_TX_TYPE_CMD;
242 	} else {
243 		txq = MT_TXQ_MCU;
244 		qidx = MT_TX_MCU_PORT_RX_Q0;
245 		pkt_fmt = MT_TX_TYPE_CMD;
246 	}
247 
248 	txd = mcu_txd->txd;
249 
250 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
251 	      FIELD_PREP(MT_TXD0_PKT_FMT, pkt_fmt) |
252 	      FIELD_PREP(MT_TXD0_Q_IDX, qidx);
253 	txd[0] = cpu_to_le32(val);
254 
255 	val = MT_TXD1_LONG_FORMAT |
256 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
257 	txd[1] = cpu_to_le32(val);
258 
259 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
260 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, qidx));
261 	mcu_txd->pkt_type = MCU_PKT_ID;
262 	mcu_txd->seq = seq;
263 
264 	if (cmd < 0) {
265 		mcu_txd->set_query = MCU_Q_NA;
266 		mcu_txd->cid = -cmd;
267 	} else {
268 		mcu_txd->cid = MCU_CMD_EXT_CID;
269 		mcu_txd->ext_cid = cmd;
270 		mcu_txd->ext_cid_ack = 1;
271 
272 		/* do not use Q_SET for efuse */
273 		if (cmd == MCU_EXT_CMD_EFUSE_ACCESS)
274 			mcu_txd->set_query = MCU_Q_QUERY;
275 		else
276 			mcu_txd->set_query = MCU_Q_SET;
277 	}
278 
279 	mcu_txd->s2d_index = MCU_S2D_H2N;
280 	WARN_ON(cmd == MCU_EXT_CMD_EFUSE_ACCESS &&
281 		mcu_txd->set_query != MCU_Q_QUERY);
282 
283 exit:
284 	if (wait_seq)
285 		*wait_seq = seq;
286 
287 	return mt76_tx_queue_skb_raw(dev, txq, skb, 0);
288 }
289 
290 static int
291 mt7915_mcu_parse_eeprom(struct mt7915_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7915_mcu_eeprom_info *res;
294 	u8 *buf;
295 
296 	if (!skb)
297 		return -EINVAL;
298 
299 	skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
300 
301 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
302 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
303 	memcpy(buf, res->data, 16);
304 
305 	return 0;
306 }
307 
308 static int
309 mt7915_mcu_parse_response(struct mt7915_dev *dev, int cmd,
310 			  struct sk_buff *skb, int seq)
311 {
312 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
313 	int ret = 0;
314 
315 	if (seq != rxd->seq) {
316 		ret = -EAGAIN;
317 		goto out;
318 	}
319 
320 	switch (cmd) {
321 	case -MCU_CMD_PATCH_SEM_CONTROL:
322 		skb_pull(skb, sizeof(*rxd) - 4);
323 		ret = *skb->data;
324 		break;
325 	case MCU_EXT_CMD_THERMAL_CTRL:
326 		skb_pull(skb, sizeof(*rxd) + 4);
327 		ret = le32_to_cpu(*(__le32 *)skb->data);
328 		break;
329 	case MCU_EXT_CMD_EFUSE_ACCESS:
330 		ret = mt7915_mcu_parse_eeprom(dev, skb);
331 		break;
332 	default:
333 		break;
334 	}
335 out:
336 	dev_kfree_skb(skb);
337 
338 	return ret;
339 }
340 
341 static int
342 mt7915_mcu_wait_response(struct mt7915_dev *dev, int cmd, int seq)
343 {
344 	unsigned long expires = jiffies + 20 * HZ;
345 	struct sk_buff *skb;
346 	int ret = 0;
347 
348 	while (true) {
349 		skb = mt76_mcu_get_response(&dev->mt76, expires);
350 		if (!skb) {
351 			dev_err(dev->mt76.dev, "Message %d (seq %d) timeout\n",
352 				cmd, seq);
353 			return -ETIMEDOUT;
354 		}
355 
356 		ret = mt7915_mcu_parse_response(dev, cmd, skb, seq);
357 		if (ret != -EAGAIN)
358 			break;
359 	}
360 
361 	return ret;
362 }
363 
364 static int
365 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
366 			int cmd, bool wait_resp)
367 {
368 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
369 	int ret, seq;
370 
371 	mutex_lock(&mdev->mcu.mutex);
372 
373 	ret = __mt7915_mcu_msg_send(dev, skb, cmd, &seq);
374 	if (ret)
375 		goto out;
376 
377 	if (wait_resp)
378 		ret = mt7915_mcu_wait_response(dev, cmd, seq);
379 
380 out:
381 	mutex_unlock(&mdev->mcu.mutex);
382 
383 	return ret;
384 }
385 
386 static int
387 mt7915_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
388 		    int len, bool wait_resp)
389 {
390 	struct sk_buff *skb;
391 
392 	skb = mt76_mcu_msg_alloc(mdev, data, len);
393 	if (!skb)
394 		return -ENOMEM;
395 
396 	return __mt76_mcu_skb_send_msg(mdev, skb, cmd, wait_resp);
397 }
398 
399 static void
400 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
401 {
402 	if (vif->csa_active)
403 		ieee80211_csa_finish(vif);
404 }
405 
406 static void
407 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
408 {
409 	struct mt76_phy *mphy = &dev->mt76.phy;
410 	struct mt7915_mcu_rdd_report *r;
411 
412 	r = (struct mt7915_mcu_rdd_report *)skb->data;
413 
414 	if (r->idx && dev->mt76.phy2)
415 		mphy = dev->mt76.phy2;
416 
417 	ieee80211_radar_detected(mphy->hw);
418 	dev->hw_pattern++;
419 }
420 
421 static void
422 mt7915_mcu_tx_rate_cal(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
423 		       struct rate_info *rate, u16 r)
424 {
425 	struct ieee80211_supported_band *sband;
426 	u16 ru_idx = le16_to_cpu(ra->ru_idx);
427 	u16 flags = 0;
428 
429 	rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
430 	rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
431 
432 	switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
433 	case MT_PHY_TYPE_CCK:
434 	case MT_PHY_TYPE_OFDM:
435 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
436 			sband = &mphy->sband_5g.sband;
437 		else
438 			sband = &mphy->sband_2g.sband;
439 
440 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
441 		break;
442 	case MT_PHY_TYPE_HT:
443 	case MT_PHY_TYPE_HT_GF:
444 		rate->mcs += (rate->nss - 1) * 8;
445 		flags |= RATE_INFO_FLAGS_MCS;
446 
447 		if (ra->gi)
448 			flags |= RATE_INFO_FLAGS_SHORT_GI;
449 		break;
450 	case MT_PHY_TYPE_VHT:
451 		flags |= RATE_INFO_FLAGS_VHT_MCS;
452 
453 		if (ra->gi)
454 			flags |= RATE_INFO_FLAGS_SHORT_GI;
455 		break;
456 	case MT_PHY_TYPE_HE_SU:
457 	case MT_PHY_TYPE_HE_EXT_SU:
458 	case MT_PHY_TYPE_HE_TB:
459 	case MT_PHY_TYPE_HE_MU:
460 		rate->he_gi = ra->gi;
461 		rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
462 
463 		flags |= RATE_INFO_FLAGS_HE_MCS;
464 		break;
465 	default:
466 		break;
467 	}
468 	rate->flags = flags;
469 
470 	if (ru_idx) {
471 		switch (ru_idx) {
472 		case 1 ... 2:
473 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
474 			break;
475 		case 3 ... 6:
476 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
477 			break;
478 		case 7 ... 14:
479 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
480 			break;
481 		default:
482 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
483 			break;
484 		}
485 		rate->bw = RATE_INFO_BW_HE_RU;
486 	} else {
487 		u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
488 			FIELD_GET(MT_RA_RATE_BW, r);
489 
490 		switch (bw) {
491 		case IEEE80211_STA_RX_BW_160:
492 			rate->bw = RATE_INFO_BW_160;
493 			break;
494 		case IEEE80211_STA_RX_BW_80:
495 			rate->bw = RATE_INFO_BW_80;
496 			break;
497 		case IEEE80211_STA_RX_BW_40:
498 			rate->bw = RATE_INFO_BW_40;
499 			break;
500 		default:
501 			rate->bw = RATE_INFO_BW_20;
502 			break;
503 		}
504 	}
505 }
506 
507 static void
508 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
509 {
510 	struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
511 	struct rate_info rate = {}, prob_rate = {};
512 	u16 probe = le16_to_cpu(ra->prob_up_rate);
513 	u16 attempts = le16_to_cpu(ra->attempts);
514 	u16 curr = le16_to_cpu(ra->curr_rate);
515 	u16 wcidx = le16_to_cpu(ra->wlan_idx);
516 	struct mt76_phy *mphy = &dev->mphy;
517 	struct mt7915_sta_stats *stats;
518 	struct mt7915_sta *msta;
519 	struct mt76_wcid *wcid;
520 
521 	if (wcidx >= MT76_N_WCIDS)
522 		return;
523 
524 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
525 	msta = container_of(wcid, struct mt7915_sta, wcid);
526 	stats = &msta->stats;
527 
528 	if (msta->wcid.ext_phy && dev->mt76.phy2)
529 		mphy = dev->mt76.phy2;
530 
531 	/* current rate */
532 	mt7915_mcu_tx_rate_cal(mphy, ra, &rate, curr);
533 	stats->tx_rate = rate;
534 
535 	/* probing rate */
536 	mt7915_mcu_tx_rate_cal(mphy, ra, &prob_rate, probe);
537 	stats->prob_rate = prob_rate;
538 
539 	if (attempts) {
540 		u16 success = le16_to_cpu(ra->success);
541 
542 		stats->per = 1000 * (attempts - success) / attempts;
543 	}
544 }
545 
546 static void
547 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
548 {
549 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
550 	const char *data = (char *)&rxd[1];
551 	const char *type;
552 
553 	switch (rxd->s2d_index) {
554 	case 0:
555 		type = "WM";
556 		break;
557 	case 2:
558 		type = "WA";
559 		break;
560 	default:
561 		type = "unknown";
562 		break;
563 	}
564 
565 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
566 }
567 
568 static void
569 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
570 {
571 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
572 
573 	switch (rxd->ext_eid) {
574 	case MCU_EXT_EVENT_RDD_REPORT:
575 		mt7915_mcu_rx_radar_detected(dev, skb);
576 		break;
577 	case MCU_EXT_EVENT_CSA_NOTIFY:
578 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
579 				IEEE80211_IFACE_ITER_RESUME_ALL,
580 				mt7915_mcu_csa_finish, dev);
581 		break;
582 	case MCU_EXT_EVENT_RATE_REPORT:
583 		mt7915_mcu_tx_rate_report(dev, skb);
584 		break;
585 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
586 		mt7915_mcu_rx_log_message(dev, skb);
587 		break;
588 	default:
589 		break;
590 	}
591 }
592 
593 static void
594 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
595 {
596 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
597 
598 	switch (rxd->eid) {
599 	case MCU_EVENT_EXT:
600 		mt7915_mcu_rx_ext_event(dev, skb);
601 		break;
602 	default:
603 		break;
604 	}
605 	dev_kfree_skb(skb);
606 }
607 
608 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
609 {
610 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
611 
612 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
613 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
614 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
615 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
616 	    rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
617 	    !rxd->seq)
618 		mt7915_mcu_rx_unsolicited_event(dev, skb);
619 	else
620 		mt76_mcu_rx_event(&dev->mt76, skb);
621 }
622 
623 static struct sk_buff *
624 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
625 			 struct mt7915_sta *msta, int len)
626 {
627 	struct sta_req_hdr hdr = {
628 		.bss_idx = mvif->idx,
629 		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
630 		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
631 		.muar_idx = msta ? mvif->omac_idx : 0,
632 		.is_tlv_append = 1,
633 	};
634 	struct sk_buff *skb;
635 
636 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
637 	if (!skb)
638 		return ERR_PTR(-ENOMEM);
639 
640 	skb_put_data(skb, &hdr, sizeof(hdr));
641 
642 	return skb;
643 }
644 
645 static struct wtbl_req_hdr *
646 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
647 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
648 {
649 	struct tlv *sta_hdr = sta_wtbl;
650 	struct wtbl_req_hdr hdr = {
651 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
652 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
653 		.operation = cmd,
654 	};
655 	struct sk_buff *nskb = *skb;
656 
657 	if (!nskb) {
658 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
659 					  MT7915_WTBL_UPDATE_BA_SIZE);
660 		if (!nskb)
661 			return ERR_PTR(-ENOMEM);
662 
663 		*skb = nskb;
664 	}
665 
666 	if (sta_hdr)
667 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
668 
669 	return skb_put_data(nskb, &hdr, sizeof(hdr));
670 }
671 
672 static struct tlv *
673 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
674 			  void *sta_ntlv, void *sta_wtbl)
675 {
676 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
677 	struct tlv *sta_hdr = sta_wtbl;
678 	struct tlv *ptlv, tlv = {
679 		.tag = cpu_to_le16(tag),
680 		.len = cpu_to_le16(len),
681 	};
682 	u16 ntlv;
683 
684 	ptlv = skb_put(skb, len);
685 	memcpy(ptlv, &tlv, sizeof(tlv));
686 
687 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
688 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
689 
690 	if (sta_hdr) {
691 		u16 size = le16_to_cpu(sta_hdr->len);
692 
693 		sta_hdr->len = cpu_to_le16(size + len);
694 	}
695 
696 	return ptlv;
697 }
698 
699 static struct tlv *
700 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
701 {
702 	return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
703 }
704 
705 static struct tlv *
706 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
707 			     __le16 *sub_ntlv, __le16 *len)
708 {
709 	struct tlv *ptlv, tlv = {
710 		.tag = cpu_to_le16(sub_tag),
711 		.len = cpu_to_le16(sub_len),
712 	};
713 
714 	ptlv = skb_put(skb, sub_len);
715 	memcpy(ptlv, &tlv, sizeof(tlv));
716 
717 	*sub_ntlv = cpu_to_le16(le16_to_cpu(*sub_ntlv) + 1);
718 	*len = cpu_to_le16(le16_to_cpu(*len) + sub_len);
719 
720 	return ptlv;
721 }
722 
723 /** bss info **/
724 static int
725 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
726 			 struct mt7915_phy *phy, bool enable)
727 {
728 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
729 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
730 	enum nl80211_band band = chandef->chan->band;
731 	struct bss_info_basic *bss;
732 	u16 wlan_idx = mvif->sta.wcid.idx;
733 	u32 type = NETWORK_INFRA;
734 	struct tlv *tlv;
735 
736 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
737 
738 	switch (vif->type) {
739 	case NL80211_IFTYPE_MESH_POINT:
740 	case NL80211_IFTYPE_AP:
741 		break;
742 	case NL80211_IFTYPE_STATION:
743 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
744 		if (enable) {
745 			struct ieee80211_sta *sta;
746 			struct mt7915_sta *msta;
747 
748 			rcu_read_lock();
749 			sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
750 			if (!sta) {
751 				rcu_read_unlock();
752 				return -EINVAL;
753 			}
754 
755 			msta = (struct mt7915_sta *)sta->drv_priv;
756 			wlan_idx = msta->wcid.idx;
757 			rcu_read_unlock();
758 		}
759 		break;
760 	case NL80211_IFTYPE_ADHOC:
761 		type = NETWORK_IBSS;
762 		break;
763 	default:
764 		WARN_ON(1);
765 		break;
766 	}
767 
768 	bss = (struct bss_info_basic *)tlv;
769 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
770 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
771 	bss->network_type = cpu_to_le32(type);
772 	bss->dtim_period = vif->bss_conf.dtim_period;
773 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
774 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
775 	bss->phy_mode = mt7915_get_phy_mode(phy->dev, vif, band, NULL);
776 	bss->wmm_idx = mvif->wmm_idx;
777 	bss->active = enable;
778 
779 	return 0;
780 }
781 
782 static void
783 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
784 {
785 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
786 	struct bss_info_omac *omac;
787 	struct tlv *tlv;
788 	u32 type = 0;
789 	u8 idx;
790 
791 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
792 
793 	switch (vif->type) {
794 	case NL80211_IFTYPE_MESH_POINT:
795 	case NL80211_IFTYPE_AP:
796 		type = CONNECTION_INFRA_AP;
797 		break;
798 	case NL80211_IFTYPE_STATION:
799 		type = CONNECTION_INFRA_STA;
800 		break;
801 	case NL80211_IFTYPE_ADHOC:
802 		type = CONNECTION_IBSS_ADHOC;
803 		break;
804 	default:
805 		WARN_ON(1);
806 		break;
807 	}
808 
809 	omac = (struct bss_info_omac *)tlv;
810 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
811 	omac->conn_type = cpu_to_le32(type);
812 	omac->omac_idx = mvif->omac_idx;
813 	omac->band_idx = mvif->band_idx;
814 	omac->hw_bss_idx = idx;
815 }
816 
817 struct mt7915_he_obss_narrow_bw_ru_data {
818 	bool tolerated;
819 };
820 
821 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
822 						   struct cfg80211_bss *bss,
823 						   void *_data)
824 {
825 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
826 	const struct element *elem;
827 
828 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
829 
830 	if (!elem || elem->datalen < 10 ||
831 	    !(elem->data[10] &
832 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
833 		data->tolerated = false;
834 }
835 
836 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
837 					      struct ieee80211_vif *vif)
838 {
839 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
840 		.tolerated = true,
841 	};
842 
843 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
844 		return false;
845 
846 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
847 			  mt7915_check_he_obss_narrow_bw_ru_iter,
848 			  &iter_data);
849 
850 	/*
851 	 * If there is at least one AP on radar channel that cannot
852 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
853 	 */
854 	return !iter_data.tolerated;
855 }
856 
857 static void
858 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
859 			struct mt7915_phy *phy)
860 {
861 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
862 	struct bss_info_rf_ch *ch;
863 	struct tlv *tlv;
864 	int freq1 = chandef->center_freq1;
865 
866 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
867 
868 	ch = (struct bss_info_rf_ch *)tlv;
869 	ch->pri_ch = chandef->chan->hw_value;
870 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
871 	ch->bw = mt7915_mcu_chan_bw(chandef);
872 
873 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
874 		int freq2 = chandef->center_freq2;
875 
876 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
877 	}
878 
879 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
880 		struct mt7915_dev *dev = phy->dev;
881 		struct mt76_phy *mphy = &dev->mt76.phy;
882 		bool ext_phy = phy != &dev->phy;
883 
884 		if (ext_phy && dev->mt76.phy2)
885 			mphy = dev->mt76.phy2;
886 
887 		ch->he_ru26_block =
888 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
889 		ch->he_all_disable = false;
890 	} else {
891 		ch->he_all_disable = true;
892 	}
893 }
894 
895 static void
896 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
897 		      struct mt7915_phy *phy)
898 {
899 	struct bss_info_ra *ra;
900 	struct tlv *tlv;
901 	int max_nss = hweight8(phy->chainmask);
902 
903 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
904 
905 	ra = (struct bss_info_ra *)tlv;
906 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
907 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
908 	ra->short_preamble = true;
909 	ra->tx_streams = max_nss;
910 	ra->rx_streams = max_nss;
911 	ra->algo = 4;
912 	ra->train_up_rule = 2;
913 	ra->train_up_high_thres = 110;
914 	ra->train_up_rule_rssi = -70;
915 	ra->low_traffic_thres = 2;
916 	ra->phy_cap = cpu_to_le32(0xfdf);
917 	ra->interval = cpu_to_le32(500);
918 	ra->fast_interval = cpu_to_le32(100);
919 }
920 
921 static void
922 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
923 		      struct mt7915_phy *phy)
924 {
925 #define DEFAULT_HE_PE_DURATION		4
926 #define DEFAULT_HE_DURATION_RTS_THRES	1023
927 	const struct ieee80211_sta_he_cap *cap;
928 	struct bss_info_he *he;
929 	struct tlv *tlv;
930 
931 	cap = mt7915_get_he_phy_cap(phy, vif);
932 
933 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
934 
935 	he = (struct bss_info_he *)tlv;
936 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext * 4;
937 	if (!he->he_pe_duration)
938 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
939 
940 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th * 32);
941 	if (!he->he_rts_thres)
942 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
943 
944 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
945 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
946 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
947 }
948 
949 static void
950 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
951 {
952 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
953 #define BCN_TX_ESTIMATE_TIME	(4096 + 20)
954 	struct bss_info_ext_bss *ext;
955 	int ext_bss_idx, tsf_offset;
956 	struct tlv *tlv;
957 
958 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
959 	if (ext_bss_idx < 0)
960 		return;
961 
962 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
963 
964 	ext = (struct bss_info_ext_bss *)tlv;
965 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
966 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
967 }
968 
969 static void
970 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
971 {
972 	struct bss_info_bmc_rate *bmc;
973 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
974 	enum nl80211_band band = chandef->chan->band;
975 	struct tlv *tlv;
976 
977 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
978 
979 	bmc = (struct bss_info_bmc_rate *)tlv;
980 	if (band == NL80211_BAND_2GHZ) {
981 		bmc->short_preamble = true;
982 	} else {
983 		bmc->bc_trans = cpu_to_le16(0x2000);
984 		bmc->mc_trans = cpu_to_le16(0x2080);
985 	}
986 }
987 
988 static void
989 mt7915_mcu_bss_sync_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
990 {
991 	struct bss_info_sync_mode *sync;
992 	struct tlv *tlv;
993 
994 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_SYNC_MODE, sizeof(*sync));
995 
996 	sync = (struct bss_info_sync_mode *)tlv;
997 	sync->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
998 	sync->dtim_period = vif->bss_conf.dtim_period;
999 	sync->enable = true;
1000 }
1001 
1002 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1003 			    struct ieee80211_vif *vif, int enable)
1004 {
1005 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1006 	struct sk_buff *skb;
1007 
1008 	skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1009 				       MT7915_BSS_UPDATE_MAX_SIZE);
1010 	if (IS_ERR(skb))
1011 		return PTR_ERR(skb);
1012 
1013 	/* bss_omac must be first */
1014 	if (enable)
1015 		mt7915_mcu_bss_omac_tlv(skb, vif);
1016 
1017 	mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1018 
1019 	if (enable) {
1020 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1021 		mt7915_mcu_bss_bmc_tlv(skb, phy);
1022 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1023 
1024 		if (vif->bss_conf.he_support)
1025 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
1026 
1027 		if (mvif->omac_idx > HW_BSSID_MAX)
1028 			mt7915_mcu_bss_ext_tlv(skb, mvif);
1029 		else
1030 			mt7915_mcu_bss_sync_tlv(skb, vif);
1031 	}
1032 
1033 	return __mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1034 				       MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1035 }
1036 
1037 /** starec & wtbl **/
1038 static int
1039 mt7915_mcu_sta_key_tlv(struct sk_buff *skb, struct ieee80211_key_conf *key,
1040 		       enum set_key_cmd cmd)
1041 {
1042 	struct sta_rec_sec *sec;
1043 	struct tlv *tlv;
1044 	u32 len = sizeof(*sec);
1045 
1046 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1047 
1048 	sec = (struct sta_rec_sec *)tlv;
1049 	sec->add = cmd;
1050 
1051 	if (cmd == SET_KEY) {
1052 		struct sec_key *sec_key;
1053 		u8 cipher;
1054 
1055 		cipher = mt7915_mcu_get_cipher(key->cipher);
1056 		if (cipher == MT_CIPHER_NONE)
1057 			return -EOPNOTSUPP;
1058 
1059 		sec_key = &sec->key[0];
1060 		sec_key->cipher_len = sizeof(*sec_key);
1061 		sec_key->key_id = key->keyidx;
1062 
1063 		if (cipher == MT_CIPHER_BIP_CMAC_128) {
1064 			sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1065 			sec_key->key_len = 16;
1066 			memcpy(sec_key->key, key->key, 16);
1067 
1068 			sec_key = &sec->key[1];
1069 			sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1070 			sec_key->cipher_len = sizeof(*sec_key);
1071 			sec_key->key_len = 16;
1072 			memcpy(sec_key->key, key->key + 16, 16);
1073 
1074 			sec->n_cipher = 2;
1075 		} else {
1076 			sec_key->cipher_id = cipher;
1077 			sec_key->key_len = key->keylen;
1078 			memcpy(sec_key->key, key->key, key->keylen);
1079 
1080 			if (cipher == MT_CIPHER_TKIP) {
1081 				/* Rx/Tx MIC keys are swapped */
1082 				memcpy(sec_key->key + 16, key->key + 24, 8);
1083 				memcpy(sec_key->key + 24, key->key + 16, 8);
1084 			}
1085 
1086 			len -= sizeof(*sec_key);
1087 			sec->n_cipher = 1;
1088 		}
1089 	} else {
1090 		len -= sizeof(sec->key);
1091 		sec->n_cipher = 0;
1092 	}
1093 	sec->len = cpu_to_le16(len);
1094 
1095 	return 0;
1096 }
1097 
1098 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1099 		       struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1100 		       enum set_key_cmd cmd)
1101 {
1102 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1103 	struct sk_buff *skb;
1104 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1105 	int ret;
1106 
1107 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1108 	if (IS_ERR(skb))
1109 		return PTR_ERR(skb);
1110 
1111 	ret = mt7915_mcu_sta_key_tlv(skb, key, cmd);
1112 	if (ret)
1113 		return ret;
1114 
1115 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1116 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1117 }
1118 
1119 static void
1120 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1121 		      struct ieee80211_ampdu_params *params,
1122 		      bool enable, bool tx)
1123 {
1124 	struct sta_rec_ba *ba;
1125 	struct tlv *tlv;
1126 
1127 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1128 
1129 	ba = (struct sta_rec_ba *)tlv;
1130 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
1131 	ba->winsize = cpu_to_le16(params->buf_size);
1132 	ba->ssn = cpu_to_le16(params->ssn);
1133 	ba->ba_en = enable << params->tid;
1134 	ba->amsdu = params->amsdu;
1135 	ba->tid = params->tid;
1136 }
1137 
1138 static void
1139 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1140 		       struct ieee80211_ampdu_params *params,
1141 		       bool enable, bool tx, void *sta_wtbl,
1142 		       void *wtbl_tlv)
1143 {
1144 	struct wtbl_ba *ba;
1145 	struct tlv *tlv;
1146 
1147 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1148 					wtbl_tlv, sta_wtbl);
1149 
1150 	ba = (struct wtbl_ba *)tlv;
1151 	ba->tid = params->tid;
1152 
1153 	if (tx) {
1154 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1155 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1156 		ba->ba_en = enable;
1157 	} else {
1158 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1159 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1160 		ba->rst_ba_tid = params->tid;
1161 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1162 		ba->rst_ba_sb = 1;
1163 	}
1164 
1165 	if (enable && tx)
1166 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1167 }
1168 
1169 static int
1170 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1171 		  struct ieee80211_ampdu_params *params,
1172 		  bool enable, bool tx)
1173 {
1174 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1175 	struct mt7915_vif *mvif = msta->vif;
1176 	struct wtbl_req_hdr *wtbl_hdr;
1177 	struct tlv *sta_wtbl;
1178 	struct sk_buff *skb;
1179 	int ret;
1180 
1181 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1182 				       MT7915_STA_UPDATE_MAX_SIZE);
1183 	if (IS_ERR(skb))
1184 		return PTR_ERR(skb);
1185 
1186 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1187 
1188 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1189 					     &skb);
1190 	mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1191 
1192 	ret = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1193 				      MCU_EXT_CMD_STA_REC_UPDATE, true);
1194 	if (ret)
1195 		return ret;
1196 
1197 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1198 				       MT7915_STA_UPDATE_MAX_SIZE);
1199 	if (IS_ERR(skb))
1200 		return PTR_ERR(skb);
1201 
1202 	mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1203 
1204 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1205 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1206 }
1207 
1208 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1209 			 struct ieee80211_ampdu_params *params,
1210 			 bool enable)
1211 {
1212 	return mt7915_mcu_sta_ba(dev, params, enable, true);
1213 }
1214 
1215 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1216 			 struct ieee80211_ampdu_params *params,
1217 			 bool enable)
1218 {
1219 	return mt7915_mcu_sta_ba(dev, params, enable, false);
1220 }
1221 
1222 static void
1223 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1224 			    struct ieee80211_sta *sta, void *sta_wtbl,
1225 			    void *wtbl_tlv)
1226 {
1227 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1228 	struct wtbl_generic *generic;
1229 	struct wtbl_rx *rx;
1230 	struct tlv *tlv;
1231 
1232 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1233 					wtbl_tlv, sta_wtbl);
1234 
1235 	generic = (struct wtbl_generic *)tlv;
1236 
1237 	if (sta) {
1238 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1239 		generic->partial_aid = cpu_to_le16(sta->aid);
1240 		generic->muar_idx = mvif->omac_idx;
1241 		generic->qos = sta->wme;
1242 	} else {
1243 		/* use BSSID in station mode */
1244 		if (vif->type == NL80211_IFTYPE_STATION)
1245 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
1246 			       ETH_ALEN);
1247 		else
1248 			eth_broadcast_addr(generic->peer_addr);
1249 
1250 		generic->muar_idx = 0xe;
1251 	}
1252 
1253 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1254 					wtbl_tlv, sta_wtbl);
1255 
1256 	rx = (struct wtbl_rx *)tlv;
1257 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1258 	rx->rca2 = 1;
1259 	rx->rv = 1;
1260 }
1261 
1262 static void
1263 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1264 			 struct ieee80211_sta *sta, bool enable)
1265 {
1266 #define EXTRA_INFO_VER          BIT(0)
1267 #define EXTRA_INFO_NEW          BIT(1)
1268 	struct sta_rec_basic *basic;
1269 	struct tlv *tlv;
1270 
1271 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1272 
1273 	basic = (struct sta_rec_basic *)tlv;
1274 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1275 
1276 	if (enable) {
1277 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1278 		basic->conn_state = CONN_STATE_PORT_SECURE;
1279 	} else {
1280 		basic->conn_state = CONN_STATE_DISCONNECT;
1281 	}
1282 
1283 	if (!sta) {
1284 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1285 		eth_broadcast_addr(basic->peer_addr);
1286 		return;
1287 	}
1288 
1289 	switch (vif->type) {
1290 	case NL80211_IFTYPE_MESH_POINT:
1291 	case NL80211_IFTYPE_AP:
1292 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1293 		break;
1294 	case NL80211_IFTYPE_STATION:
1295 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1296 		break;
1297 	case NL80211_IFTYPE_ADHOC:
1298 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1299 		break;
1300 	default:
1301 		WARN_ON(1);
1302 		break;
1303 	}
1304 
1305 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1306 	basic->aid = cpu_to_le16(sta->aid);
1307 	basic->qos = sta->wme;
1308 }
1309 
1310 static void
1311 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1312 {
1313 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1314 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1315 	struct sta_rec_he *he;
1316 	struct tlv *tlv;
1317 	u32 cap = 0;
1318 
1319 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1320 
1321 	he = (struct sta_rec_he *)tlv;
1322 
1323 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1324 		cap |= STA_REC_HE_CAP_HTC;
1325 
1326 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1327 		cap |= STA_REC_HE_CAP_BSR;
1328 
1329 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1330 		cap |= STA_REC_HE_CAP_OM;
1331 
1332 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1333 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1334 
1335 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1336 		cap |= STA_REC_HE_CAP_BQR;
1337 
1338 	if (elem->phy_cap_info[0] &
1339 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1340 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1341 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1342 
1343 	if (elem->phy_cap_info[1] &
1344 	    IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1345 		cap |= STA_REC_HE_CAP_LDPC;
1346 
1347 	if (elem->phy_cap_info[1] &
1348 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1349 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1350 
1351 	if (elem->phy_cap_info[2] &
1352 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1353 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1354 
1355 	if (elem->phy_cap_info[2] &
1356 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1357 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1358 
1359 	if (elem->phy_cap_info[2] &
1360 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1361 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1362 
1363 	if (elem->phy_cap_info[6] &
1364 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1365 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1366 
1367 	if (elem->phy_cap_info[7] &
1368 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1369 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1370 
1371 	if (elem->phy_cap_info[7] &
1372 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1373 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1374 
1375 	if (elem->phy_cap_info[7] &
1376 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1377 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1378 
1379 	if (elem->phy_cap_info[8] &
1380 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1381 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1382 
1383 	if (elem->phy_cap_info[8] &
1384 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1385 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1386 
1387 	if (elem->phy_cap_info[9] &
1388 	    IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1389 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1390 
1391 	if (elem->phy_cap_info[9] &
1392 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1393 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1394 
1395 	if (elem->phy_cap_info[9] &
1396 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1397 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1398 
1399 	he->he_cap = cpu_to_le32(cap);
1400 
1401 	switch (sta->bandwidth) {
1402 	case IEEE80211_STA_RX_BW_160:
1403 		if (elem->phy_cap_info[0] &
1404 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1405 			he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1406 				he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1407 
1408 		he->max_nss_mcs[CMD_HE_MCS_BW160] =
1409 				he_cap->he_mcs_nss_supp.rx_mcs_160;
1410 		/* fall through */
1411 	default:
1412 		he->max_nss_mcs[CMD_HE_MCS_BW80] =
1413 				he_cap->he_mcs_nss_supp.rx_mcs_80;
1414 		break;
1415 	}
1416 
1417 	he->t_frame_dur =
1418 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1419 	he->max_ampdu_exp =
1420 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1421 
1422 	he->bw_set =
1423 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1424 	he->device_class =
1425 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1426 	he->punc_pream_rx =
1427 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1428 
1429 	he->dcm_tx_mode =
1430 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1431 	he->dcm_tx_max_nss =
1432 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1433 	he->dcm_rx_mode =
1434 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1435 	he->dcm_rx_max_nss =
1436 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1437 	he->dcm_rx_max_nss =
1438 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1439 
1440 	he->pkt_ext = 2;
1441 }
1442 
1443 static void
1444 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1445 {
1446 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1447 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1448 	struct sta_rec_muru *muru;
1449 	struct tlv *tlv;
1450 
1451 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1452 
1453 	muru = (struct sta_rec_muru *)tlv;
1454 	muru->cfg.ofdma_dl_en = true;
1455 	muru->cfg.ofdma_ul_en = true;
1456 	muru->cfg.mimo_dl_en = true;
1457 	muru->cfg.mimo_ul_en = true;
1458 
1459 	muru->ofdma_dl.punc_pream_rx =
1460 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1461 	muru->ofdma_dl.he_20m_in_40m_2g =
1462 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1463 	muru->ofdma_dl.he_20m_in_160m =
1464 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1465 	muru->ofdma_dl.he_80m_in_160m =
1466 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1467 	muru->ofdma_dl.lt16_sigb = 0;
1468 	muru->ofdma_dl.rx_su_comp_sigb = 0;
1469 	muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1470 
1471 	muru->ofdma_ul.t_frame_dur =
1472 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1473 	muru->ofdma_ul.mu_cascading =
1474 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1475 	muru->ofdma_ul.uo_ra =
1476 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1477 	muru->ofdma_ul.he_2x996_tone = 0;
1478 	muru->ofdma_ul.rx_t_frame_11ac = 0;
1479 
1480 	muru->mimo_dl.vht_mu_bfee =
1481 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1482 	muru->mimo_dl.partial_bw_dl_mimo =
1483 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1484 
1485 	muru->mimo_ul.full_ul_mimo =
1486 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1487 	muru->mimo_ul.partial_ul_mimo =
1488 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1489 }
1490 
1491 static int
1492 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1493 		  struct ieee80211_sta *sta)
1494 {
1495 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1496 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1497 	struct sk_buff *skb;
1498 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1499 
1500 	if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1501 		return 0;
1502 
1503 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1504 	if (IS_ERR(skb))
1505 		return PTR_ERR(skb);
1506 
1507 	/* starec muru */
1508 	mt7915_mcu_sta_muru_tlv(skb, sta);
1509 
1510 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1511 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1512 }
1513 
1514 static void
1515 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1516 		   struct ieee80211_sta *sta)
1517 {
1518 	struct tlv *tlv;
1519 
1520 	/* starec ht */
1521 	if (sta->ht_cap.ht_supported) {
1522 		struct sta_rec_ht *ht;
1523 
1524 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1525 		ht = (struct sta_rec_ht *)tlv;
1526 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1527 	}
1528 
1529 	/* starec vht */
1530 	if (sta->vht_cap.vht_supported) {
1531 		struct sta_rec_vht *vht;
1532 
1533 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1534 		vht = (struct sta_rec_vht *)tlv;
1535 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1536 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1537 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1538 	}
1539 
1540 	/* starec he */
1541 	if (sta->he_cap.has_he)
1542 		mt7915_mcu_sta_he_tlv(skb, sta);
1543 }
1544 
1545 static void
1546 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1547 			 void *sta_wtbl, void *wtbl_tlv)
1548 {
1549 	struct wtbl_smps *smps;
1550 	struct tlv *tlv;
1551 
1552 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1553 					wtbl_tlv, sta_wtbl);
1554 	smps = (struct wtbl_smps *)tlv;
1555 
1556 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1557 		smps->smps = true;
1558 }
1559 
1560 static void
1561 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1562 		       void *sta_wtbl, void *wtbl_tlv)
1563 {
1564 	struct wtbl_ht *ht = NULL;
1565 	struct tlv *tlv;
1566 
1567 	/* wtbl ht */
1568 	if (sta->ht_cap.ht_supported) {
1569 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1570 						wtbl_tlv, sta_wtbl);
1571 		ht = (struct wtbl_ht *)tlv;
1572 		ht->ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
1573 		ht->af = sta->ht_cap.ampdu_factor;
1574 		ht->mm = sta->ht_cap.ampdu_density;
1575 		ht->ht = true;
1576 	}
1577 
1578 	/* wtbl vht */
1579 	if (sta->vht_cap.vht_supported) {
1580 		struct wtbl_vht *vht;
1581 		u8 af;
1582 
1583 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1584 						wtbl_tlv, sta_wtbl);
1585 		vht = (struct wtbl_vht *)tlv;
1586 		vht->ldpc = sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC,
1587 		vht->vht = true;
1588 
1589 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1590 			       sta->vht_cap.cap);
1591 		if (ht)
1592 			ht->af = max_t(u8, ht->af, af);
1593 	}
1594 
1595 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1596 }
1597 
1598 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1599 			struct ieee80211_sta *sta)
1600 {
1601 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1602 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1603 	struct wtbl_req_hdr *wtbl_hdr;
1604 	struct tlv *sta_wtbl;
1605 	struct sk_buff *skb;
1606 
1607 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1608 				       MT7915_STA_UPDATE_MAX_SIZE);
1609 	if (IS_ERR(skb))
1610 		return PTR_ERR(skb);
1611 
1612 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1613 
1614 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1615 					     &skb);
1616 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1617 
1618 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1619 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
1620 }
1621 
1622 static void
1623 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1624 {
1625 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1626 	bf->ndp_rate = 0;				/* mcs0 */
1627 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1628 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1629 }
1630 
1631 static void
1632 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct sta_rec_bf *bf)
1633 {
1634 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1635 	u8 n = 0;
1636 
1637 	bf->tx_mode = MT_PHY_TYPE_HT;
1638 	bf->bf_cap |= MT_IBF;
1639 
1640 	if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1641 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1642 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1643 			      mcs->tx_params);
1644 	else if (mcs->rx_mask[3])
1645 		n = 3;
1646 	else if (mcs->rx_mask[2])
1647 		n = 2;
1648 	else if (mcs->rx_mask[1])
1649 		n = 1;
1650 
1651 	bf->nc = min_t(u8, bf->nr, n);
1652 	bf->ibf_ncol = bf->nc;
1653 
1654 	if (sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1655 		bf->ibf_timeout = 0x48;
1656 }
1657 
1658 static void
1659 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1660 			struct sta_rec_bf *bf)
1661 {
1662 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1663 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1664 	u8 bfee_nr, bfer_nr, n, tx_ant = hweight8(phy->chainmask) - 1;
1665 	u16 mcs_map;
1666 
1667 	bf->tx_mode = MT_PHY_TYPE_VHT;
1668 	bf->bf_cap |= MT_EBF;
1669 
1670 	mt7915_mcu_sta_sounding_rate(bf);
1671 
1672 	bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1673 			    pc->cap);
1674 	bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1675 			    vc->cap);
1676 	mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1677 
1678 	n = min_t(u8, bfer_nr, bfee_nr);
1679 	bf->nr = min_t(u8, n, tx_ant);
1680 	n = mt7915_mcu_get_sta_nss(mcs_map);
1681 
1682 	bf->nc = min_t(u8, n, bf->nr);
1683 	bf->ibf_ncol = bf->nc;
1684 
1685 	/* force nr from 4 to 2 */
1686 	if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1687 		bf->nr = 1;
1688 }
1689 
1690 static void
1691 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1692 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1693 {
1694 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1695 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1696 	const struct ieee80211_he_cap_elem *ve;
1697 	const struct ieee80211_sta_he_cap *vc;
1698 	u8 bfee_nr, bfer_nr, nss_mcs;
1699 	u16 mcs_map;
1700 
1701 	vc = mt7915_get_he_phy_cap(phy, vif);
1702 	ve = &vc->he_cap_elem;
1703 
1704 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1705 	bf->bf_cap |= MT_EBF;
1706 
1707 	mt7915_mcu_sta_sounding_rate(bf);
1708 
1709 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1710 				pe->phy_cap_info[6]);
1711 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1712 				pe->phy_cap_info[6]);
1713 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1714 			 ve->phy_cap_info[5]);
1715 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1716 			 pe->phy_cap_info[4]);
1717 
1718 	mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.tx_mcs_80);
1719 	nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1720 
1721 	bf->nr = min_t(u8, bfer_nr, bfee_nr);
1722 	bf->nc = min_t(u8, nss_mcs, bf->nr);
1723 	bf->ibf_ncol = bf->nc;
1724 
1725 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1726 		return;
1727 
1728 	/* go over for 160MHz and 80p80 */
1729 	if (pe->phy_cap_info[0] &
1730 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1731 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1732 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1733 
1734 		bf->nc_bw160 = nss_mcs;
1735 	}
1736 
1737 	if (pe->phy_cap_info[0] &
1738 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1739 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1740 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1741 
1742 		if (bf->nc_bw160)
1743 			bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1744 		else
1745 			bf->nc_bw160 = nss_mcs;
1746 	}
1747 
1748 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1749 			 ve->phy_cap_info[5]);
1750 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1751 			 pe->phy_cap_info[4]);
1752 
1753 	bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1754 }
1755 
1756 static void
1757 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1758 			struct ieee80211_vif *vif, struct mt7915_phy *phy,
1759 			bool enable)
1760 {
1761 	struct sta_rec_bf *bf;
1762 	struct tlv *tlv;
1763 	int tx_ant = hweight8(phy->chainmask) - 1;
1764 	const u8 matrix[4][4] = {
1765 		{0, 0, 0, 0},
1766 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1767 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1768 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1769 	};
1770 
1771 #define MT_BFER_FREE		cpu_to_le16(GENMASK(15, 0))
1772 
1773 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1774 	bf = (struct sta_rec_bf *)tlv;
1775 
1776 	if (!enable) {
1777 		bf->pfmu = MT_BFER_FREE;
1778 		return;
1779 	}
1780 
1781 	bf->bw = sta->bandwidth;
1782 	bf->ibf_dbw = sta->bandwidth;
1783 	bf->ibf_nrow = tx_ant;
1784 	bf->ibf_timeout = 0x18;
1785 
1786 	if (sta->he_cap.has_he)
1787 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1788 	else if (sta->vht_cap.vht_supported)
1789 		mt7915_mcu_sta_bfer_vht(sta, phy, bf);
1790 	else if (sta->ht_cap.ht_supported)
1791 		mt7915_mcu_sta_bfer_ht(sta, bf);
1792 
1793 	if (bf->bf_cap & MT_EBF && bf->nr != tx_ant)
1794 		bf->mem_20m = matrix[tx_ant][bf->nc];
1795 	else
1796 		bf->mem_20m = matrix[bf->nr][bf->nc];
1797 
1798 	switch (sta->bandwidth) {
1799 	case IEEE80211_STA_RX_BW_160:
1800 	case IEEE80211_STA_RX_BW_80:
1801 		bf->mem_total = bf->mem_20m * 2;
1802 		break;
1803 	case IEEE80211_STA_RX_BW_40:
1804 		bf->mem_total = bf->mem_20m;
1805 		break;
1806 	case IEEE80211_STA_RX_BW_20:
1807 	default:
1808 		break;
1809 	}
1810 }
1811 
1812 static void
1813 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1814 			struct mt7915_phy *phy)
1815 {
1816 	struct sta_rec_bfee *bfee;
1817 	struct tlv *tlv;
1818 	int tx_ant = hweight8(phy->chainmask) - 1;
1819 	u8 nr = 0;
1820 
1821 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1822 	bfee = (struct sta_rec_bfee *)tlv;
1823 
1824 	if (sta->he_cap.has_he) {
1825 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1826 
1827 		nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1828 			    pe->phy_cap_info[5]);
1829 	} else if (sta->vht_cap.vht_supported) {
1830 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1831 
1832 		nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1833 			       pc->cap);
1834 	}
1835 
1836 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1837 	if (nr == 1 && tx_ant == 2)
1838 		bfee->fb_identity_matrix = true;
1839 }
1840 
1841 static u8
1842 mt7915_mcu_sta_txbf_type(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1843 			 struct ieee80211_sta *sta)
1844 {
1845 	u8 type = 0;
1846 
1847 	if (vif->type != NL80211_IFTYPE_STATION &&
1848 	    vif->type != NL80211_IFTYPE_AP)
1849 		return 0;
1850 
1851 	if (sta->he_cap.has_he) {
1852 		struct ieee80211_he_cap_elem *pe;
1853 		const struct ieee80211_he_cap_elem *ve;
1854 		const struct ieee80211_sta_he_cap *vc;
1855 
1856 		pe = &sta->he_cap.he_cap_elem;
1857 		vc = mt7915_get_he_phy_cap(phy, vif);
1858 		ve = &vc->he_cap_elem;
1859 
1860 		if ((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
1861 		     HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
1862 		    HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]))
1863 			type |= MT_STA_BFEE;
1864 
1865 		if ((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
1866 		     HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
1867 		    HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]))
1868 			type |= MT_STA_BFER;
1869 	} else if (sta->vht_cap.vht_supported) {
1870 		struct ieee80211_sta_vht_cap *pc;
1871 		struct ieee80211_sta_vht_cap *vc;
1872 		u32 cr, ce;
1873 
1874 		pc = &sta->vht_cap;
1875 		vc = &phy->mt76->sband_5g.sband.vht_cap;
1876 		cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
1877 		     IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
1878 		ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
1879 		     IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1880 
1881 		if ((pc->cap & cr) && (vc->cap & ce))
1882 			type |= MT_STA_BFEE;
1883 
1884 		if ((vc->cap & cr) && (pc->cap & ce))
1885 			type |= MT_STA_BFER;
1886 	} else if (sta->ht_cap.ht_supported) {
1887 		/* TODO: iBF */
1888 	}
1889 
1890 	return type;
1891 }
1892 
1893 static int
1894 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1895 		    struct ieee80211_sta *sta, bool enable)
1896 {
1897 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1898 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1899 	struct mt7915_phy *phy;
1900 	struct sk_buff *skb;
1901 	int r, len;
1902 	u8 type;
1903 
1904 	phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1905 
1906 	type = mt7915_mcu_sta_txbf_type(phy, vif, sta);
1907 
1908 	/* must keep each tag independent */
1909 
1910 	/* starec bf */
1911 	if (type & MT_STA_BFER) {
1912 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
1913 
1914 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1915 		if (IS_ERR(skb))
1916 			return PTR_ERR(skb);
1917 
1918 		mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable);
1919 
1920 		r = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1921 					    MCU_EXT_CMD_STA_REC_UPDATE, true);
1922 		if (r)
1923 			return r;
1924 	}
1925 
1926 	/* starec bfee */
1927 	if (type & MT_STA_BFEE) {
1928 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
1929 
1930 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1931 		if (IS_ERR(skb))
1932 			return PTR_ERR(skb);
1933 
1934 		mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
1935 
1936 		r = __mt76_mcu_skb_send_msg(&dev->mt76, skb,
1937 					    MCU_EXT_CMD_STA_REC_UPDATE, true);
1938 		if (r)
1939 			return r;
1940 	}
1941 
1942 	return 0;
1943 }
1944 
1945 static void
1946 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1947 			     struct ieee80211_vif *vif,
1948 			     struct ieee80211_sta *sta)
1949 {
1950 	struct cfg80211_chan_def *chandef = &dev->mphy.chandef;
1951 	struct sta_rec_ra *ra;
1952 	struct tlv *tlv;
1953 	enum nl80211_band band = chandef->chan->band;
1954 	u32 supp_rate = sta->supp_rates[band];
1955 	int n_rates = hweight32(supp_rate);
1956 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1957 	u8 i, nss = sta->rx_nss, mcs = 0;
1958 
1959 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1960 
1961 	ra = (struct sta_rec_ra *)tlv;
1962 	ra->valid = true;
1963 	ra->auto_rate = true;
1964 	ra->phy_mode = mt7915_get_phy_mode(dev, vif, band, sta);
1965 	ra->channel = chandef->chan->hw_value;
1966 	ra->bw = sta->bandwidth;
1967 	ra->rate_len = n_rates;
1968 	ra->phy.bw = sta->bandwidth;
1969 
1970 	if (n_rates) {
1971 		if (band == NL80211_BAND_2GHZ) {
1972 			ra->supp_mode = MODE_CCK;
1973 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1974 			ra->phy.type = MT_PHY_TYPE_CCK;
1975 
1976 			if (n_rates > 4) {
1977 				ra->supp_mode |= MODE_OFDM;
1978 				ra->supp_ofdm_rate = supp_rate >> 4;
1979 				ra->phy.type = MT_PHY_TYPE_OFDM;
1980 			}
1981 		} else {
1982 			ra->supp_mode = MODE_OFDM;
1983 			ra->supp_ofdm_rate = supp_rate;
1984 			ra->phy.type = MT_PHY_TYPE_OFDM;
1985 		}
1986 	}
1987 
1988 	if (sta->ht_cap.ht_supported) {
1989 		for (i = 0; i < nss; i++)
1990 			ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
1991 
1992 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1993 		ra->supp_mode |= MODE_HT;
1994 		mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
1995 		ra->af = sta->ht_cap.ampdu_factor;
1996 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1997 
1998 		cap |= STA_CAP_HT;
1999 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2000 			cap |= STA_CAP_SGI_20;
2001 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2002 			cap |= STA_CAP_SGI_40;
2003 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2004 			cap |= STA_CAP_TX_STBC;
2005 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2006 			cap |= STA_CAP_RX_STBC;
2007 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2008 			cap |= STA_CAP_LDPC;
2009 	}
2010 
2011 	if (sta->vht_cap.vht_supported) {
2012 		u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2013 		u16 vht_mcs;
2014 		u8 af, mcs_prev;
2015 
2016 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2017 			       sta->vht_cap.cap);
2018 		ra->af = max_t(u8, ra->af, af);
2019 
2020 		cap |= STA_CAP_VHT;
2021 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2022 			cap |= STA_CAP_VHT_SGI_80;
2023 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2024 			cap |= STA_CAP_VHT_SGI_160;
2025 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2026 			cap |= STA_CAP_VHT_TX_STBC;
2027 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2028 			cap |= STA_CAP_VHT_RX_STBC;
2029 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2030 			cap |= STA_CAP_VHT_LDPC;
2031 
2032 		ra->supp_mode |= MODE_VHT;
2033 		for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2034 			switch (mcs_map & 0x3) {
2035 			case IEEE80211_VHT_MCS_SUPPORT_0_9:
2036 				vht_mcs = GENMASK(9, 0);
2037 				break;
2038 			case IEEE80211_VHT_MCS_SUPPORT_0_8:
2039 				vht_mcs = GENMASK(8, 0);
2040 				break;
2041 			case IEEE80211_VHT_MCS_SUPPORT_0_7:
2042 				vht_mcs = GENMASK(7, 0);
2043 				break;
2044 			default:
2045 				vht_mcs = 0;
2046 			}
2047 
2048 			ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2049 
2050 			mcs_prev = hweight16(vht_mcs) - 1;
2051 			if (mcs_prev > mcs)
2052 				mcs = mcs_prev;
2053 
2054 			/* only support 2ss on 160MHz */
2055 			if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2056 				      ra->bw == CMD_CBW_8080MHZ))
2057 				break;
2058 		}
2059 	}
2060 
2061 	if (sta->he_cap.has_he) {
2062 		ra->supp_mode |= MODE_HE;
2063 		cap |= STA_CAP_HE;
2064 	}
2065 
2066 	ra->sta_status = cpu_to_le32(cap);
2067 
2068 	switch (BIT(fls(ra->supp_mode) - 1)) {
2069 	case MODE_VHT:
2070 		ra->phy.type = MT_PHY_TYPE_VHT;
2071 		ra->phy.mcs = mcs;
2072 		ra->phy.nss = nss;
2073 		ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2074 		ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2075 		ra->phy.sgi =
2076 			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2077 		break;
2078 	case MODE_HT:
2079 		ra->phy.type = MT_PHY_TYPE_HT;
2080 		ra->phy.mcs = mcs;
2081 		ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2082 		ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2083 		ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2084 		break;
2085 	default:
2086 		break;
2087 	}
2088 }
2089 
2090 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2091 			     struct ieee80211_sta *sta)
2092 {
2093 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2094 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2095 	struct sk_buff *skb;
2096 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2097 
2098 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2099 	if (IS_ERR(skb))
2100 		return PTR_ERR(skb);
2101 
2102 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2103 
2104 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2105 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
2106 }
2107 
2108 static int
2109 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2110 		     struct ieee80211_sta *sta)
2111 {
2112 #define MT_STA_BSS_GROUP		1
2113 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2114 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2115 	struct {
2116 		__le32 action;
2117 		u8 wlan_idx_lo;
2118 		u8 status;
2119 		u8 wlan_idx_hi;
2120 		u8 rsv0[5];
2121 		__le32 val;
2122 		u8 rsv1[8];
2123 	} __packed req = {
2124 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
2125 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
2126 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
2127 		.val = cpu_to_le32(mvif->idx),
2128 	};
2129 
2130 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_DRR_CTRL,
2131 				   &req, sizeof(req), true);
2132 }
2133 
2134 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2135 			   struct ieee80211_sta *sta, bool enable)
2136 {
2137 	int ret;
2138 
2139 	if (!sta)
2140 		return 0;
2141 
2142 	/* must keep the order */
2143 	ret = mt7915_mcu_add_group(dev, vif, sta);
2144 	if (ret)
2145 		return ret;
2146 
2147 	ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2148 	if (ret)
2149 		return ret;
2150 
2151 	ret = mt7915_mcu_add_mu(dev, vif, sta);
2152 	if (ret)
2153 		return ret;
2154 
2155 	if (enable)
2156 		return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2157 
2158 	return 0;
2159 }
2160 
2161 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2162 		       struct ieee80211_sta *sta, bool enable)
2163 {
2164 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2165 	struct wtbl_req_hdr *wtbl_hdr;
2166 	struct mt7915_sta *msta;
2167 	struct tlv *sta_wtbl;
2168 	struct sk_buff *skb;
2169 
2170 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2171 
2172 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2173 				       MT7915_STA_UPDATE_MAX_SIZE);
2174 	if (IS_ERR(skb))
2175 		return PTR_ERR(skb);
2176 
2177 	mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2178 	if (enable && sta)
2179 		mt7915_mcu_sta_tlv(dev, skb, sta);
2180 
2181 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2182 
2183 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2184 					     sta_wtbl, &skb);
2185 	if (enable) {
2186 		mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2187 		if (sta)
2188 			mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2189 	}
2190 
2191 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2192 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
2193 }
2194 
2195 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2196 			      struct ieee80211_sta *sta, u32 rate)
2197 {
2198 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2199 	struct mt7915_vif *mvif = msta->vif;
2200 	struct sta_rec_ra_fixed *ra;
2201 	struct sk_buff *skb;
2202 	struct tlv *tlv;
2203 	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2204 
2205 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2206 	if (IS_ERR(skb))
2207 		return PTR_ERR(skb);
2208 
2209 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2210 	ra = (struct sta_rec_ra_fixed *)tlv;
2211 
2212 	if (!rate) {
2213 		ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2214 		goto out;
2215 	} else {
2216 		ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2217 	}
2218 
2219 	ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2220 	ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2221 	ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2222 	ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2223 	ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2224 
2225 	if (ra->phy.bw)
2226 		ra->phy.ldpc = 7;
2227 	else
2228 		ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2229 
2230 	/* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2231 	if (ra->phy.type > MT_PHY_TYPE_VHT)
2232 		ra->phy.sgi = ra->phy.mcs * 85;
2233 	else
2234 		ra->phy.sgi = ra->phy.mcs * 15;
2235 
2236 out:
2237 	return __mt76_mcu_skb_send_msg(&dev->mt76, skb,
2238 				       MCU_EXT_CMD_STA_REC_UPDATE, true);
2239 }
2240 
2241 int mt7915_mcu_add_dev_info(struct mt7915_dev *dev,
2242 			    struct ieee80211_vif *vif, bool enable)
2243 {
2244 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2245 	struct {
2246 		struct req_hdr {
2247 			u8 omac_idx;
2248 			u8 dbdc_idx;
2249 			__le16 tlv_num;
2250 			u8 is_tlv_append;
2251 			u8 rsv[3];
2252 		} __packed hdr;
2253 		struct req_tlv {
2254 			__le16 tag;
2255 			__le16 len;
2256 			u8 active;
2257 			u8 dbdc_idx;
2258 			u8 omac_addr[ETH_ALEN];
2259 		} __packed tlv;
2260 	} data = {
2261 		.hdr = {
2262 			.omac_idx = mvif->omac_idx,
2263 			.dbdc_idx = mvif->band_idx,
2264 			.tlv_num = cpu_to_le16(1),
2265 			.is_tlv_append = 1,
2266 		},
2267 		.tlv = {
2268 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2269 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2270 			.active = enable,
2271 			.dbdc_idx = mvif->band_idx,
2272 		},
2273 	};
2274 
2275 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2276 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
2277 				   &data, sizeof(data), true);
2278 }
2279 
2280 static void
2281 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2282 		      struct bss_info_bcn *bcn,
2283 		      struct ieee80211_mutable_offsets *offs)
2284 {
2285 	if (offs->csa_counter_offs[0]) {
2286 		struct tlv *tlv;
2287 		struct bss_info_bcn_csa *csa;
2288 
2289 		tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2290 						   sizeof(*csa), &bcn->sub_ntlv,
2291 						   &bcn->len);
2292 		csa = (struct bss_info_bcn_csa *)tlv;
2293 		csa->cnt = skb->data[offs->csa_counter_offs[0]];
2294 	}
2295 }
2296 
2297 static void
2298 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2299 		       struct sk_buff *skb, struct bss_info_bcn *bcn,
2300 		       struct ieee80211_mutable_offsets *offs)
2301 {
2302 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2303 	struct bss_info_bcn_cont *cont;
2304 	struct tlv *tlv;
2305 	u8 *buf;
2306 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2307 
2308 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2309 					   len, &bcn->sub_ntlv, &bcn->len);
2310 
2311 	cont = (struct bss_info_bcn_cont *)tlv;
2312 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2313 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2314 
2315 	if (offs->csa_counter_offs[0])
2316 		cont->csa_ofs = cpu_to_le16(offs->csa_counter_offs[0] - 4);
2317 
2318 	buf = (u8 *)tlv + sizeof(*cont);
2319 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2320 			      true);
2321 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2322 }
2323 
2324 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2325 			  struct ieee80211_vif *vif, int en)
2326 {
2327 #define MAX_BEACON_SIZE 512
2328 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2329 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2330 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2331 	struct ieee80211_mutable_offsets offs;
2332 	struct ieee80211_tx_info *info;
2333 	struct sk_buff *skb, *rskb;
2334 	struct tlv *tlv;
2335 	struct bss_info_bcn *bcn;
2336 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2337 
2338 	rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2339 	if (IS_ERR(rskb))
2340 		return PTR_ERR(rskb);
2341 
2342 	tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2343 	bcn = (struct bss_info_bcn *)tlv;
2344 	bcn->enable = en;
2345 
2346 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2347 	if (!skb)
2348 		return -EINVAL;
2349 
2350 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2351 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2352 		dev_kfree_skb(skb);
2353 		return -EINVAL;
2354 	}
2355 
2356 	if (mvif->band_idx) {
2357 		info = IEEE80211_SKB_CB(skb);
2358 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2359 	}
2360 
2361 	/* TODO: subtag - bss color count & 11v MBSSID */
2362 	mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2363 	mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2364 	dev_kfree_skb(skb);
2365 
2366 	return __mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2367 				       MCU_EXT_CMD_BSS_INFO_UPDATE, true);
2368 }
2369 
2370 static int mt7915_mcu_send_firmware(struct mt7915_dev *dev, const void *data,
2371 				    int len)
2372 {
2373 	int ret = 0, cur_len;
2374 
2375 	while (len > 0) {
2376 		cur_len = min_t(int, 4096 - sizeof(struct mt7915_mcu_txd),
2377 				len);
2378 
2379 		ret = __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_SCATTER,
2380 					  data, cur_len, false);
2381 		if (ret)
2382 			break;
2383 
2384 		data += cur_len;
2385 		len -= cur_len;
2386 		mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2387 	}
2388 
2389 	return ret;
2390 }
2391 
2392 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2393 				     u32 option)
2394 {
2395 	struct {
2396 		__le32 option;
2397 		__le32 addr;
2398 	} req = {
2399 		.option = cpu_to_le32(option),
2400 		.addr = cpu_to_le32(addr),
2401 	};
2402 
2403 	return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ,
2404 				   &req, sizeof(req), true);
2405 }
2406 
2407 static int mt7915_mcu_restart(struct mt76_dev *dev)
2408 {
2409 	struct {
2410 		u8 power_mode;
2411 		u8 rsv[3];
2412 	} req = {
2413 		.power_mode = 1,
2414 	};
2415 
2416 	return __mt76_mcu_send_msg(dev, -MCU_CMD_NIC_POWER_CTRL, &req,
2417 				   sizeof(req), false);
2418 }
2419 
2420 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2421 {
2422 	struct {
2423 		__le32 op;
2424 	} req = {
2425 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2426 	};
2427 
2428 	return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL,
2429 				   &req, sizeof(req), true);
2430 }
2431 
2432 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2433 {
2434 	struct {
2435 		u8 check_crc;
2436 		u8 reserved[3];
2437 	} req = {
2438 		.check_crc = 0,
2439 	};
2440 
2441 	return __mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ,
2442 				   &req, sizeof(req), true);
2443 }
2444 
2445 static int mt7915_driver_own(struct mt7915_dev *dev)
2446 {
2447 	u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2448 
2449 	mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2450 	if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2451 			    0, 500)) {
2452 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2453 		return -EIO;
2454 	}
2455 
2456 	return 0;
2457 }
2458 
2459 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2460 				    u32 len, u32 mode)
2461 {
2462 	struct {
2463 		__le32 addr;
2464 		__le32 len;
2465 		__le32 mode;
2466 	} req = {
2467 		.addr = cpu_to_le32(addr),
2468 		.len = cpu_to_le32(len),
2469 		.mode = cpu_to_le32(mode),
2470 	};
2471 	int attr;
2472 
2473 	if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2474 		attr = -MCU_CMD_PATCH_START_REQ;
2475 	else
2476 		attr = -MCU_CMD_TARGET_ADDRESS_LEN_REQ;
2477 
2478 	return __mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2479 }
2480 
2481 static int mt7915_load_patch(struct mt7915_dev *dev)
2482 {
2483 	const struct mt7915_patch_hdr *hdr;
2484 	const struct firmware *fw = NULL;
2485 	int i, ret, sem;
2486 
2487 	sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2488 	switch (sem) {
2489 	case PATCH_IS_DL:
2490 		return 0;
2491 	case PATCH_NOT_DL_SEM_SUCCESS:
2492 		break;
2493 	default:
2494 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2495 		return -EAGAIN;
2496 	}
2497 
2498 	ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2499 	if (ret)
2500 		goto out;
2501 
2502 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2503 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2504 		ret = -EINVAL;
2505 		goto out;
2506 	}
2507 
2508 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2509 
2510 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2511 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2512 
2513 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2514 		struct mt7915_patch_sec *sec;
2515 		const u8 *dl;
2516 		u32 len, addr;
2517 
2518 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2519 						  i * sizeof(*sec));
2520 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2521 		    PATCH_SEC_TYPE_INFO) {
2522 			ret = -EINVAL;
2523 			goto out;
2524 		}
2525 
2526 		addr = be32_to_cpu(sec->info.addr);
2527 		len = be32_to_cpu(sec->info.len);
2528 		dl = fw->data + be32_to_cpu(sec->offs);
2529 
2530 		ret = mt7915_mcu_init_download(dev, addr, len,
2531 					       DL_MODE_NEED_RSP);
2532 		if (ret) {
2533 			dev_err(dev->mt76.dev, "Download request failed\n");
2534 			goto out;
2535 		}
2536 
2537 		ret = mt7915_mcu_send_firmware(dev, dl, len);
2538 		if (ret) {
2539 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2540 			goto out;
2541 		}
2542 	}
2543 
2544 	ret = mt7915_mcu_start_patch(dev);
2545 	if (ret)
2546 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2547 
2548 out:
2549 	sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2550 	switch (sem) {
2551 	case PATCH_REL_SEM_SUCCESS:
2552 		break;
2553 	default:
2554 		ret = -EAGAIN;
2555 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2556 		goto out;
2557 	}
2558 	release_firmware(fw);
2559 
2560 	return ret;
2561 }
2562 
2563 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2564 {
2565 	u32 ret = 0;
2566 
2567 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2568 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2569 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2570 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2571 	ret |= DL_MODE_NEED_RSP;
2572 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2573 
2574 	return ret;
2575 }
2576 
2577 static int
2578 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2579 			     const struct mt7915_fw_trailer *hdr,
2580 			     const u8 *data, bool is_wa)
2581 {
2582 	int i, offset = 0;
2583 	u32 override = 0, option = 0;
2584 
2585 	for (i = 0; i < hdr->n_region; i++) {
2586 		const struct mt7915_fw_region *region;
2587 		int err;
2588 		u32 len, addr, mode;
2589 
2590 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2591 			 (hdr->n_region - i) * sizeof(*region));
2592 		mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2593 		len = le32_to_cpu(region->len);
2594 		addr = le32_to_cpu(region->addr);
2595 
2596 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2597 			override = addr;
2598 
2599 		err = mt7915_mcu_init_download(dev, addr, len, mode);
2600 		if (err) {
2601 			dev_err(dev->mt76.dev, "Download request failed\n");
2602 			return err;
2603 		}
2604 
2605 		err = mt7915_mcu_send_firmware(dev, data + offset, len);
2606 		if (err) {
2607 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2608 			return err;
2609 		}
2610 
2611 		offset += len;
2612 	}
2613 
2614 	if (override)
2615 		option |= FW_START_OVERRIDE;
2616 
2617 	if (is_wa)
2618 		option |= FW_START_WORKING_PDA_CR4;
2619 
2620 	return mt7915_mcu_start_firmware(dev, override, option);
2621 }
2622 
2623 static int mt7915_load_ram(struct mt7915_dev *dev)
2624 {
2625 	const struct mt7915_fw_trailer *hdr;
2626 	const struct firmware *fw;
2627 	int ret;
2628 
2629 	ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2630 	if (ret)
2631 		return ret;
2632 
2633 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2634 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2635 		ret = -EINVAL;
2636 		goto out;
2637 	}
2638 
2639 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2640 					sizeof(*hdr));
2641 
2642 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2643 		 hdr->fw_ver, hdr->build_date);
2644 
2645 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2646 	if (ret) {
2647 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2648 		goto out;
2649 	}
2650 
2651 	release_firmware(fw);
2652 
2653 	ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2654 	if (ret)
2655 		return ret;
2656 
2657 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2658 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2659 		ret = -EINVAL;
2660 		goto out;
2661 	}
2662 
2663 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2664 					sizeof(*hdr));
2665 
2666 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2667 		 hdr->fw_ver, hdr->build_date);
2668 
2669 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2670 	if (ret) {
2671 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2672 		goto out;
2673 	}
2674 
2675 	snprintf(dev->mt76.hw->wiphy->fw_version,
2676 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2677 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2678 
2679 out:
2680 	release_firmware(fw);
2681 
2682 	return ret;
2683 }
2684 
2685 static int mt7915_load_firmware(struct mt7915_dev *dev)
2686 {
2687 	int ret;
2688 	u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2689 
2690 	val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2691 
2692 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2693 		/* restart firmware once */
2694 		__mt76_mcu_restart(&dev->mt76);
2695 		if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2696 				    val, 1000)) {
2697 			dev_err(dev->mt76.dev,
2698 				"Firmware is not ready for download\n");
2699 			return -EIO;
2700 		}
2701 	}
2702 
2703 	ret = mt7915_load_patch(dev);
2704 	if (ret)
2705 		return ret;
2706 
2707 	ret = mt7915_load_ram(dev);
2708 	if (ret)
2709 		return ret;
2710 
2711 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2712 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2713 				       FW_STATE_WACPU_RDY), 1000)) {
2714 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2715 		return -EIO;
2716 	}
2717 
2718 	mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2719 
2720 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2721 
2722 	return 0;
2723 }
2724 
2725 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2726 {
2727 	struct {
2728 		u8 ctrl_val;
2729 		u8 pad[3];
2730 	} data = {
2731 		.ctrl_val = ctrl
2732 	};
2733 
2734 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST,
2735 				   &data, sizeof(data), true);
2736 }
2737 
2738 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2739 {
2740 	struct {
2741 		u8 ver;
2742 		u8 pad;
2743 		u16 len;
2744 		u8 level;
2745 		u8 rsv[3];
2746 		__le32 module_idx;
2747 	} data = {
2748 		.module_idx = cpu_to_le32(module),
2749 		.level = level,
2750 	};
2751 
2752 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_DBG_CTRL,
2753 				   &data, sizeof(data), false);
2754 }
2755 
2756 int mt7915_mcu_init(struct mt7915_dev *dev)
2757 {
2758 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2759 		.headroom = sizeof(struct mt7915_mcu_txd),
2760 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2761 		.mcu_send_msg = mt7915_mcu_msg_send,
2762 		.mcu_restart = mt7915_mcu_restart,
2763 	};
2764 	int ret;
2765 
2766 	dev->mt76.mcu_ops = &mt7915_mcu_ops,
2767 
2768 	ret = mt7915_driver_own(dev);
2769 	if (ret)
2770 		return ret;
2771 
2772 	ret = mt7915_load_firmware(dev);
2773 	if (ret)
2774 		return ret;
2775 
2776 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2777 	mt7915_mcu_fw_log_2_host(dev, 0);
2778 
2779 	return 0;
2780 }
2781 
2782 void mt7915_mcu_exit(struct mt7915_dev *dev)
2783 {
2784 	u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2785 
2786 	__mt76_mcu_restart(&dev->mt76);
2787 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2788 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2789 				       FW_STATE_FW_DOWNLOAD), 1000)) {
2790 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2791 		return;
2792 	}
2793 
2794 	reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2795 	mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2796 	skb_queue_purge(&dev->mt76.mcu.res_q);
2797 }
2798 
2799 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2800 		       bool enable, bool hdr_trans)
2801 {
2802 	struct {
2803 		u8 operation;
2804 		u8 enable;
2805 		u8 check_bssid;
2806 		u8 insert_vlan;
2807 		u8 remove_vlan;
2808 		u8 tid;
2809 		u8 mode;
2810 		u8 rsv;
2811 	} __packed req_trans = {
2812 		.enable = hdr_trans,
2813 	};
2814 	struct {
2815 		u8 enable;
2816 		u8 band;
2817 		u8 rsv[2];
2818 	} __packed req_mac = {
2819 		.enable = enable,
2820 		.band = band,
2821 	};
2822 	int ret;
2823 
2824 	ret = __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RX_HDR_TRANS,
2825 				  &req_trans, sizeof(req_trans), false);
2826 	if (ret)
2827 		return ret;
2828 
2829 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2830 				   &req_mac, sizeof(req_mac), true);
2831 }
2832 
2833 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2834 {
2835 	struct {
2836 		__le32 cmd;
2837 		u8 band;
2838 		u8 enable;
2839 	} __packed req = {
2840 		.cmd = cpu_to_le32(SCS_ENABLE),
2841 		.band = band,
2842 		.enable = enable + 1,
2843 	};
2844 
2845 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SCS_CTRL, &req,
2846 				   sizeof(req), false);
2847 }
2848 
2849 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2850 {
2851 	struct mt7915_dev *dev = phy->dev;
2852 	struct {
2853 		u8 prot_idx;
2854 		u8 band;
2855 		u8 rsv[2];
2856 		__le32 len_thresh;
2857 		__le32 pkt_thresh;
2858 	} __packed req = {
2859 		.prot_idx = 1,
2860 		.band = phy != &dev->phy,
2861 		.len_thresh = cpu_to_le32(val),
2862 		.pkt_thresh = cpu_to_le32(0x2),
2863 	};
2864 
2865 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL,
2866 				   &req, sizeof(req), true);
2867 }
2868 
2869 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2870 {
2871 #define WMM_AIFS_SET		BIT(0)
2872 #define WMM_CW_MIN_SET		BIT(1)
2873 #define WMM_CW_MAX_SET		BIT(2)
2874 #define WMM_TXOP_SET		BIT(3)
2875 #define WMM_PARAM_SET		GENMASK(3, 0)
2876 #define TX_CMD_MODE		1
2877 	struct edca {
2878 		u8 queue;
2879 		u8 set;
2880 		u8 aifs;
2881 		u8 cw_min;
2882 		__le16 cw_max;
2883 		__le16 txop;
2884 	};
2885 	struct mt7915_mcu_tx {
2886 		u8 total;
2887 		u8 action;
2888 		u8 valid;
2889 		u8 mode;
2890 
2891 		struct edca edca[IEEE80211_NUM_ACS];
2892 	} __packed req = {
2893 		.valid = true,
2894 		.mode = TX_CMD_MODE,
2895 		.total = IEEE80211_NUM_ACS,
2896 	};
2897 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2898 	int ac;
2899 
2900 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2901 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2902 		struct edca *e = &req.edca[ac];
2903 
2904 		e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
2905 		e->aifs = q->aifs;
2906 		e->txop = cpu_to_le16(q->txop);
2907 
2908 		if (q->cw_min)
2909 			e->cw_min = fls(q->cw_min);
2910 		else
2911 			e->cw_min = 5;
2912 
2913 		if (q->cw_max)
2914 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2915 		else
2916 			e->cw_max = cpu_to_le16(10);
2917 	}
2918 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE,
2919 				  &req, sizeof(req), true);
2920 }
2921 
2922 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
2923 {
2924 #define ENTER_PM_STATE		1
2925 #define EXIT_PM_STATE		2
2926 	struct {
2927 		u8 pm_number;
2928 		u8 pm_state;
2929 		u8 bssid[ETH_ALEN];
2930 		u8 dtim_period;
2931 		u8 wlan_idx_lo;
2932 		__le16 bcn_interval;
2933 		__le32 aid;
2934 		__le32 rx_filter;
2935 		u8 band_idx;
2936 		u8 wlan_idx_hi;
2937 		u8 rsv[2];
2938 		__le32 feature;
2939 		u8 omac_idx;
2940 		u8 wmm_idx;
2941 		u8 bcn_loss_cnt;
2942 		u8 bcn_sp_duration;
2943 	} __packed req = {
2944 		.pm_number = 5,
2945 		.pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
2946 		.band_idx = band,
2947 	};
2948 
2949 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL,
2950 				   &req, sizeof(req), true);
2951 }
2952 
2953 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
2954 		       enum mt7915_rdd_cmd cmd, u8 index,
2955 		       u8 rx_sel, u8 val)
2956 {
2957 	struct {
2958 		u8 ctrl;
2959 		u8 rdd_idx;
2960 		u8 rdd_rx_sel;
2961 		u8 val;
2962 		u8 rsv[4];
2963 	} __packed req = {
2964 		.ctrl = cmd,
2965 		.rdd_idx = index,
2966 		.rdd_rx_sel = rx_sel,
2967 		.val = val,
2968 	};
2969 
2970 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL,
2971 				   &req, sizeof(req), true);
2972 }
2973 
2974 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2975 {
2976 	struct {
2977 		u32 tag;
2978 		u16 min_lpn;
2979 		u8 rsv[2];
2980 	} __packed req = {
2981 		.tag = 0x1,
2982 		.min_lpn = val,
2983 	};
2984 
2985 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
2986 				   &req, sizeof(req), true);
2987 }
2988 
2989 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2990 			    const struct mt7915_dfs_pulse *pulse)
2991 {
2992 	struct {
2993 		u32 tag;
2994 		struct mt7915_dfs_pulse pulse;
2995 	} __packed req = {
2996 		.tag = 0x3,
2997 	};
2998 
2999 	memcpy(&req.pulse, pulse, sizeof(*pulse));
3000 
3001 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
3002 				   &req, sizeof(req), true);
3003 }
3004 
3005 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3006 			    const struct mt7915_dfs_pattern *pattern)
3007 {
3008 	struct {
3009 		u32 tag;
3010 		u16 radar_type;
3011 		struct mt7915_dfs_pattern pattern;
3012 	} __packed req = {
3013 		.tag = 0x2,
3014 		.radar_type = index,
3015 	};
3016 
3017 	memcpy(&req.pattern, pattern, sizeof(*pattern));
3018 
3019 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH,
3020 				   &req, sizeof(req), true);
3021 }
3022 
3023 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3024 {
3025 	struct mt7915_dev *dev = phy->dev;
3026 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3027 	int freq1 = chandef->center_freq1;
3028 	struct {
3029 		u8 control_ch;
3030 		u8 center_ch;
3031 		u8 bw;
3032 		u8 tx_streams_num;
3033 		u8 rx_streams;	/* mask or num */
3034 		u8 switch_reason;
3035 		u8 band_idx;
3036 		u8 center_ch2;	/* for 80+80 only */
3037 		__le16 cac_case;
3038 		u8 channel_band;
3039 		u8 rsv0;
3040 		__le32 outband_freq;
3041 		u8 txpower_drop;
3042 		u8 ap_bw;
3043 		u8 ap_center_ch;
3044 		u8 rsv1[57];
3045 	} __packed req = {
3046 		.control_ch = chandef->chan->hw_value,
3047 		.center_ch = ieee80211_frequency_to_channel(freq1),
3048 		.bw = mt7915_mcu_chan_bw(chandef),
3049 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
3050 		.rx_streams = phy->chainmask,
3051 		.band_idx = phy != &dev->phy,
3052 		.channel_band = chandef->chan->band,
3053 	};
3054 
3055 	if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3056 	    chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3057 		req.switch_reason = CH_SWITCH_DFS;
3058 	else
3059 		req.switch_reason = CH_SWITCH_NORMAL;
3060 
3061 	if (cmd == MCU_EXT_CMD_CHANNEL_SWITCH)
3062 		req.rx_streams = hweight8(req.rx_streams);
3063 
3064 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3065 		int freq2 = chandef->center_freq2;
3066 
3067 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3068 	}
3069 
3070 	return __mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3071 }
3072 
3073 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3074 {
3075 	struct req_hdr {
3076 		u8 buffer_mode;
3077 		u8 format;
3078 		__le16 len;
3079 	} __packed req = {
3080 		.buffer_mode = EE_MODE_EFUSE,
3081 		.format = EE_FORMAT_WHOLE,
3082 	};
3083 
3084 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
3085 				   &req, sizeof(req), true);
3086 }
3087 
3088 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3089 {
3090 	struct mt7915_mcu_eeprom_info req = {
3091 		.addr = cpu_to_le32(round_down(offset, 16)),
3092 	};
3093 
3094 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_ACCESS, &req,
3095 				   sizeof(req), true);
3096 }
3097 
3098 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3099 {
3100 	struct {
3101 		u8 ctrl_id;
3102 		u8 action;
3103 		u8 band;
3104 		u8 rsv[5];
3105 	} req = {
3106 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3107 		.action = index,
3108 	};
3109 
3110 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_THERMAL_CTRL, &req,
3111 				   sizeof(req), true);
3112 }
3113 
3114 int mt7915_mcu_get_rate_info(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3115 {
3116 	struct {
3117 		__le32 cmd;
3118 		__le16 wlan_idx;
3119 		__le16 ru_idx;
3120 		__le16 direction;
3121 		__le16 dump_group;
3122 	} req = {
3123 		.cmd = cpu_to_le32(cmd),
3124 		.wlan_idx = cpu_to_le16(wlan_idx),
3125 		.dump_group = cpu_to_le16(1),
3126 	};
3127 
3128 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RATE_CTRL, &req,
3129 				   sizeof(req), false);
3130 }
3131 
3132 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3133 {
3134 	struct mt7915_dev *dev = phy->dev;
3135 	struct mt76_phy *mphy = phy->mt76;
3136 	struct ieee80211_hw *hw = mphy->hw;
3137 	struct mt7915_sku_val {
3138 		u8 format_id;
3139 		u8 limit_type;
3140 		u8 dbdc_idx;
3141 		s8 val[MT7915_SKU_RATE_NUM];
3142 	} __packed req = {
3143 		.format_id = 4,
3144 		.dbdc_idx = phy != &dev->phy,
3145 	};
3146 	int i;
3147 	s8 *delta;
3148 
3149 	delta = dev->rate_power[mphy->chandef.chan->band];
3150 	mphy->txpower_cur = hw->conf.power_level * 2 +
3151 			    delta[MT7915_SKU_MAX_DELTA_IDX];
3152 
3153 	for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3154 		req.val[i] = hw->conf.power_level * 2 + delta[i];
3155 
3156 	return __mt76_mcu_send_msg(&dev->mt76,
3157 				   MCU_EXT_CMD_TX_POWER_FEATURE_CTRL,
3158 				   &req, sizeof(req), true);
3159 }
3160 
3161 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3162 {
3163 	struct mt7915_dev *dev = phy->dev;
3164 	struct mt7915_sku {
3165 		u8 format_id;
3166 		u8 sku_enable;
3167 		u8 dbdc_idx;
3168 		u8 rsv;
3169 	} __packed req = {
3170 		.format_id = 0,
3171 		.dbdc_idx = phy != &dev->phy,
3172 		.sku_enable = enable,
3173 	};
3174 
3175 	return __mt76_mcu_send_msg(&dev->mt76,
3176 				   MCU_EXT_CMD_TX_POWER_FEATURE_CTRL,
3177 				   &req, sizeof(req), true);
3178 }
3179 
3180 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3181 {
3182 	struct {
3183 		u8 action;
3184 		u8 set;
3185 		u8 band;
3186 		u8 rsv;
3187 	} req = {
3188 		.action = action,
3189 		.set = set,
3190 		.band = band,
3191 	};
3192 
3193 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SER_TRIGGER,
3194 				   &req, sizeof(req), false);
3195 }
3196 
3197 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3198 {
3199 #define MT_BF_TYPE_UPDATE		20
3200 	struct {
3201 		u8 action;
3202 		bool ebf;
3203 		bool ibf;
3204 		u8 rsv;
3205 	} __packed req = {
3206 		.action = MT_BF_TYPE_UPDATE,
3207 		.ebf = true,
3208 		.ibf = false,
3209 	};
3210 
3211 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION,
3212 				   &req, sizeof(req), true);
3213 }
3214 
3215 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3216 {
3217 #define MT_BF_PROCESSING		4
3218 	struct {
3219 		u8 action;
3220 		u8 snd_mode;
3221 		u8 sta_num;
3222 		u8 rsv;
3223 		u8 wlan_idx[4];
3224 		__le32 snd_period;	/* ms */
3225 	} __packed req = {
3226 		.action = true,
3227 		.snd_mode = MT_BF_PROCESSING,
3228 	};
3229 
3230 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION,
3231 				   &req, sizeof(req), true);
3232 }
3233 
3234 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3235 			    bool enable)
3236 {
3237 #define MT_SPR_ENABLE		1
3238 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3239 	struct {
3240 		u8 action;
3241 		u8 arg_num;
3242 		u8 band_idx;
3243 		u8 status;
3244 		u8 drop_tx_idx;
3245 		u8 sta_idx;	/* 256 sta */
3246 		u8 rsv[2];
3247 		u32 val;
3248 	} __packed req = {
3249 		.action = MT_SPR_ENABLE,
3250 		.arg_num = 1,
3251 		.band_idx = mvif->band_idx,
3252 		.val = enable,
3253 	};
3254 
3255 	return __mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SPR,
3256 				   &req, sizeof(req), true);
3257 }
3258