1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7986:						\
17 		_fw = MT7986_##name##__VA_ARGS__;		\
18 		break;						\
19 	default:						\
20 		_fw = MT7916_##name;				\
21 		break;						\
22 	}							\
23 	_fw;							\
24 })
25 
26 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
27 					 fw_name(_dev, name) :			\
28 					 fw_name(_dev, name, _MT7975))
29 
30 #define MCU_PATCH_ADDRESS		0x200000
31 
32 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
33 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
34 
35 static bool sr_scene_detect = true;
36 module_param(sr_scene_detect, bool, 0644);
37 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
38 
39 static u8
40 mt7915_mcu_get_sta_nss(u16 mcs_map)
41 {
42 	u8 nss;
43 
44 	for (nss = 8; nss > 0; nss--) {
45 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
46 
47 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
48 			break;
49 	}
50 
51 	return nss - 1;
52 }
53 
54 static void
55 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
56 			  u16 mcs_map)
57 {
58 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
59 	struct mt7915_dev *dev = msta->vif->phy->dev;
60 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
61 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
62 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
63 
64 	for (nss = 0; nss < max_nss; nss++) {
65 		int mcs;
66 
67 		switch ((mcs_map >> (2 * nss)) & 0x3) {
68 		case IEEE80211_HE_MCS_SUPPORT_0_11:
69 			mcs = GENMASK(11, 0);
70 			break;
71 		case IEEE80211_HE_MCS_SUPPORT_0_9:
72 			mcs = GENMASK(9, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_7:
75 			mcs = GENMASK(7, 0);
76 			break;
77 		default:
78 			mcs = 0;
79 		}
80 
81 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
82 
83 		switch (mcs) {
84 		case 0 ... 7:
85 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
86 			break;
87 		case 8 ... 9:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
89 			break;
90 		case 10 ... 11:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
92 			break;
93 		default:
94 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
95 			break;
96 		}
97 		mcs_map &= ~(0x3 << (nss * 2));
98 		mcs_map |= mcs << (nss * 2);
99 
100 		/* only support 2ss on 160MHz for mt7915 */
101 		if (is_mt7915(&dev->mt76) && nss > 1 &&
102 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
103 			break;
104 	}
105 
106 	*he_mcs = cpu_to_le16(mcs_map);
107 }
108 
109 static void
110 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
111 			   const u16 *mask)
112 {
113 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
114 	struct mt7915_dev *dev = msta->vif->phy->dev;
115 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
116 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
117 	u16 mcs;
118 
119 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
120 		switch (mcs_map & 0x3) {
121 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
122 			mcs = GENMASK(9, 0);
123 			break;
124 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
125 			mcs = GENMASK(8, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
128 			mcs = GENMASK(7, 0);
129 			break;
130 		default:
131 			mcs = 0;
132 		}
133 
134 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
135 
136 		/* only support 2ss on 160MHz for mt7915 */
137 		if (is_mt7915(&dev->mt76) && nss > 1 &&
138 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
139 			break;
140 	}
141 }
142 
143 static void
144 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
145 			  const u8 *mask)
146 {
147 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
148 
149 	for (nss = 0; nss < max_nss; nss++)
150 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
151 }
152 
153 static int
154 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
155 			  struct sk_buff *skb, int seq)
156 {
157 	struct mt76_connac2_mcu_rxd *rxd;
158 	int ret = 0;
159 
160 	if (!skb) {
161 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
162 			cmd, seq);
163 		return -ETIMEDOUT;
164 	}
165 
166 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
167 	if (seq != rxd->seq)
168 		return -EAGAIN;
169 
170 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
171 		skb_pull(skb, sizeof(*rxd) - 4);
172 		ret = *skb->data;
173 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
174 		skb_pull(skb, sizeof(*rxd) + 4);
175 		ret = le32_to_cpu(*(__le32 *)skb->data);
176 	} else {
177 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
178 	}
179 
180 	return ret;
181 }
182 
183 static int
184 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
185 			int cmd, int *wait_seq)
186 {
187 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
188 	enum mt76_mcuq_id qid;
189 	int ret;
190 
191 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
192 	if (ret)
193 		return ret;
194 
195 	if (cmd == MCU_CMD(FW_SCATTER))
196 		qid = MT_MCUQ_FWDL;
197 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
198 		qid = MT_MCUQ_WA;
199 	else
200 		qid = MT_MCUQ_WM;
201 
202 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
203 }
204 
205 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
206 {
207 	struct {
208 		__le32 args[3];
209 	} req = {
210 		.args = {
211 			cpu_to_le32(a1),
212 			cpu_to_le32(a2),
213 			cpu_to_le32(a3),
214 		},
215 	};
216 
217 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
218 }
219 
220 static void
221 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
222 {
223 	if (vif->bss_conf.csa_active)
224 		ieee80211_csa_finish(vif);
225 }
226 
227 static void
228 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
229 {
230 	struct mt76_phy *mphy = &dev->mt76.phy;
231 	struct mt7915_mcu_csa_notify *c;
232 
233 	c = (struct mt7915_mcu_csa_notify *)skb->data;
234 
235 	if (c->band_idx > MT_BAND1)
236 		return;
237 
238 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
239 	    dev->mt76.phys[MT_BAND1])
240 		mphy = dev->mt76.phys[MT_BAND1];
241 
242 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
243 			IEEE80211_IFACE_ITER_RESUME_ALL,
244 			mt7915_mcu_csa_finish, mphy->hw);
245 }
246 
247 static void
248 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
249 {
250 	struct mt76_phy *mphy = &dev->mt76.phy;
251 	struct mt7915_mcu_thermal_notify *t;
252 	struct mt7915_phy *phy;
253 
254 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
255 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
256 		return;
257 
258 	if (t->ctrl.band_idx > MT_BAND1)
259 		return;
260 
261 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
262 	    dev->mt76.phys[MT_BAND1])
263 		mphy = dev->mt76.phys[MT_BAND1];
264 
265 	phy = (struct mt7915_phy *)mphy->priv;
266 	phy->throttle_state = t->ctrl.duty.duty_cycle;
267 }
268 
269 static void
270 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
271 {
272 	struct mt76_phy *mphy = &dev->mt76.phy;
273 	struct mt7915_mcu_rdd_report *r;
274 
275 	r = (struct mt7915_mcu_rdd_report *)skb->data;
276 
277 	if (r->band_idx > MT_BAND1)
278 		return;
279 
280 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
281 	    dev->mt76.phys[MT_BAND1])
282 		mphy = dev->mt76.phys[MT_BAND1];
283 
284 	if (r->band_idx == MT_RX_SEL2)
285 		cfg80211_background_radar_event(mphy->hw->wiphy,
286 						&dev->rdd2_chandef,
287 						GFP_ATOMIC);
288 	else
289 		ieee80211_radar_detected(mphy->hw);
290 	dev->hw_pattern++;
291 }
292 
293 static void
294 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
295 {
296 	struct mt76_connac2_mcu_rxd *rxd;
297 	int len = skb->len - sizeof(*rxd);
298 	const char *data, *type;
299 
300 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
301 	data = (char *)&rxd[1];
302 
303 	switch (rxd->s2d_index) {
304 	case 0:
305 		if (mt7915_debugfs_rx_log(dev, data, len))
306 			return;
307 
308 		type = "WM";
309 		break;
310 	case 2:
311 		type = "WA";
312 		break;
313 	default:
314 		type = "unknown";
315 		break;
316 	}
317 
318 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
319 }
320 
321 static void
322 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
323 {
324 	if (!vif->bss_conf.color_change_active)
325 		return;
326 
327 	ieee80211_color_change_finish(vif);
328 }
329 
330 static void
331 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
332 {
333 	struct mt76_phy *mphy = &dev->mt76.phy;
334 	struct mt7915_mcu_bcc_notify *b;
335 
336 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
337 
338 	if (b->band_idx > MT_BAND1)
339 		return;
340 
341 	if ((b->band_idx && !dev->phy.mt76->band_idx) &&
342 	    dev->mt76.phys[MT_BAND1])
343 		mphy = dev->mt76.phys[MT_BAND1];
344 
345 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
346 			IEEE80211_IFACE_ITER_RESUME_ALL,
347 			mt7915_mcu_cca_finish, mphy->hw);
348 }
349 
350 static void
351 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
352 {
353 	struct mt76_connac2_mcu_rxd *rxd;
354 
355 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
356 	switch (rxd->ext_eid) {
357 	case MCU_EXT_EVENT_THERMAL_PROTECT:
358 		mt7915_mcu_rx_thermal_notify(dev, skb);
359 		break;
360 	case MCU_EXT_EVENT_RDD_REPORT:
361 		mt7915_mcu_rx_radar_detected(dev, skb);
362 		break;
363 	case MCU_EXT_EVENT_CSA_NOTIFY:
364 		mt7915_mcu_rx_csa_notify(dev, skb);
365 		break;
366 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
367 		mt7915_mcu_rx_log_message(dev, skb);
368 		break;
369 	case MCU_EXT_EVENT_BCC_NOTIFY:
370 		mt7915_mcu_rx_bcc_notify(dev, skb);
371 		break;
372 	default:
373 		break;
374 	}
375 }
376 
377 static void
378 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
379 {
380 	struct mt76_connac2_mcu_rxd *rxd;
381 
382 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
383 	switch (rxd->eid) {
384 	case MCU_EVENT_EXT:
385 		mt7915_mcu_rx_ext_event(dev, skb);
386 		break;
387 	default:
388 		break;
389 	}
390 	dev_kfree_skb(skb);
391 }
392 
393 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
394 {
395 	struct mt76_connac2_mcu_rxd *rxd;
396 
397 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
398 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
399 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
400 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
401 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
402 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
403 	    !rxd->seq)
404 		mt7915_mcu_rx_unsolicited_event(dev, skb);
405 	else
406 		mt76_mcu_rx_event(&dev->mt76, skb);
407 }
408 
409 static struct tlv *
410 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
411 			     __le16 *sub_ntlv, __le16 *len)
412 {
413 	struct tlv *ptlv, tlv = {
414 		.tag = cpu_to_le16(sub_tag),
415 		.len = cpu_to_le16(sub_len),
416 	};
417 
418 	ptlv = skb_put(skb, sub_len);
419 	memcpy(ptlv, &tlv, sizeof(tlv));
420 
421 	le16_add_cpu(sub_ntlv, 1);
422 	le16_add_cpu(len, sub_len);
423 
424 	return ptlv;
425 }
426 
427 /** bss info **/
428 struct mt7915_he_obss_narrow_bw_ru_data {
429 	bool tolerated;
430 };
431 
432 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
433 						   struct cfg80211_bss *bss,
434 						   void *_data)
435 {
436 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
437 	const struct element *elem;
438 
439 	rcu_read_lock();
440 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
441 
442 	if (!elem || elem->datalen <= 10 ||
443 	    !(elem->data[10] &
444 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
445 		data->tolerated = false;
446 
447 	rcu_read_unlock();
448 }
449 
450 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
451 					      struct ieee80211_vif *vif)
452 {
453 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
454 		.tolerated = true,
455 	};
456 
457 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
458 		return false;
459 
460 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
461 			  mt7915_check_he_obss_narrow_bw_ru_iter,
462 			  &iter_data);
463 
464 	/*
465 	 * If there is at least one AP on radar channel that cannot
466 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
467 	 */
468 	return !iter_data.tolerated;
469 }
470 
471 static void
472 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
473 			struct mt7915_phy *phy)
474 {
475 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
476 	struct bss_info_rf_ch *ch;
477 	struct tlv *tlv;
478 	int freq1 = chandef->center_freq1;
479 
480 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
481 
482 	ch = (struct bss_info_rf_ch *)tlv;
483 	ch->pri_ch = chandef->chan->hw_value;
484 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
485 	ch->bw = mt76_connac_chan_bw(chandef);
486 
487 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
488 		int freq2 = chandef->center_freq2;
489 
490 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
491 	}
492 
493 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
494 		struct mt76_phy *mphy = phy->mt76;
495 
496 		ch->he_ru26_block =
497 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
498 		ch->he_all_disable = false;
499 	} else {
500 		ch->he_all_disable = true;
501 	}
502 }
503 
504 static void
505 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
506 		      struct mt7915_phy *phy)
507 {
508 	int max_nss = hweight8(phy->mt76->antenna_mask);
509 	struct bss_info_ra *ra;
510 	struct tlv *tlv;
511 
512 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
513 
514 	ra = (struct bss_info_ra *)tlv;
515 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
516 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
517 	ra->short_preamble = true;
518 	ra->tx_streams = max_nss;
519 	ra->rx_streams = max_nss;
520 	ra->algo = 4;
521 	ra->train_up_rule = 2;
522 	ra->train_up_high_thres = 110;
523 	ra->train_up_rule_rssi = -70;
524 	ra->low_traffic_thres = 2;
525 	ra->phy_cap = cpu_to_le32(0xfdf);
526 	ra->interval = cpu_to_le32(500);
527 	ra->fast_interval = cpu_to_le32(100);
528 }
529 
530 static void
531 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
532 		      struct mt7915_phy *phy)
533 {
534 #define DEFAULT_HE_PE_DURATION		4
535 #define DEFAULT_HE_DURATION_RTS_THRES	1023
536 	const struct ieee80211_sta_he_cap *cap;
537 	struct bss_info_he *he;
538 	struct tlv *tlv;
539 
540 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
541 
542 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
543 
544 	he = (struct bss_info_he *)tlv;
545 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
546 	if (!he->he_pe_duration)
547 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
548 
549 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
550 	if (!he->he_rts_thres)
551 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
552 
553 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
554 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
555 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
556 }
557 
558 static void
559 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
560 {
561 #define TXD_CMP_MAP1		GENMASK(15, 0)
562 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
563 	struct bss_info_hw_amsdu *amsdu;
564 	struct tlv *tlv;
565 
566 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
567 
568 	amsdu = (struct bss_info_hw_amsdu *)tlv;
569 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
570 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
571 	amsdu->trig_thres = cpu_to_le16(2);
572 	amsdu->enable = true;
573 }
574 
575 static void
576 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
577 {
578 	struct bss_info_bmc_rate *bmc;
579 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
580 	enum nl80211_band band = chandef->chan->band;
581 	struct tlv *tlv;
582 
583 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
584 
585 	bmc = (struct bss_info_bmc_rate *)tlv;
586 	if (band == NL80211_BAND_2GHZ) {
587 		bmc->short_preamble = true;
588 	} else {
589 		bmc->bc_trans = cpu_to_le16(0x2000);
590 		bmc->mc_trans = cpu_to_le16(0x2080);
591 	}
592 }
593 
594 static int
595 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
596 		       bool bssid, bool enable)
597 {
598 	struct mt7915_dev *dev = phy->dev;
599 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
600 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
601 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
602 	const u8 *addr = vif->addr;
603 	struct {
604 		u8 mode;
605 		u8 force_clear;
606 		u8 clear_bitmap[8];
607 		u8 entry_count;
608 		u8 write;
609 		u8 band;
610 
611 		u8 index;
612 		u8 bssid;
613 		u8 addr[ETH_ALEN];
614 	} __packed req = {
615 		.mode = !!mask || enable,
616 		.entry_count = 1,
617 		.write = 1,
618 		.band = phy->mt76->band_idx,
619 		.index = idx * 2 + bssid,
620 	};
621 
622 	if (bssid)
623 		addr = vif->bss_conf.bssid;
624 
625 	if (enable)
626 		ether_addr_copy(req.addr, addr);
627 
628 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
629 				 sizeof(req), true);
630 }
631 
632 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
633 			    struct ieee80211_vif *vif, int enable)
634 {
635 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
636 	struct mt7915_dev *dev = phy->dev;
637 	struct sk_buff *skb;
638 
639 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
640 		mt7915_mcu_muar_config(phy, vif, false, enable);
641 		mt7915_mcu_muar_config(phy, vif, true, enable);
642 	}
643 
644 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
645 					      MT7915_BSS_UPDATE_MAX_SIZE);
646 	if (IS_ERR(skb))
647 		return PTR_ERR(skb);
648 
649 	/* bss_omac must be first */
650 	if (enable)
651 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
652 
653 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
654 				      mvif->sta.wcid.idx, enable);
655 
656 	if (vif->type == NL80211_IFTYPE_MONITOR)
657 		goto out;
658 
659 	if (enable) {
660 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
661 		mt7915_mcu_bss_bmc_tlv(skb, phy);
662 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
663 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
664 
665 		if (vif->bss_conf.he_support)
666 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
667 
668 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
669 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
670 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
671 	}
672 out:
673 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
674 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
675 }
676 
677 /** starec & wtbl **/
678 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
679 			 struct ieee80211_ampdu_params *params,
680 			 bool enable)
681 {
682 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
683 	struct mt7915_vif *mvif = msta->vif;
684 
685 	if (enable && !params->amsdu)
686 		msta->wcid.amsdu = false;
687 
688 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
689 				      MCU_EXT_CMD(STA_REC_UPDATE),
690 				      enable, true);
691 }
692 
693 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
694 			 struct ieee80211_ampdu_params *params,
695 			 bool enable)
696 {
697 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
698 	struct mt7915_vif *mvif = msta->vif;
699 
700 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
701 				      MCU_EXT_CMD(STA_REC_UPDATE),
702 				      enable, false);
703 }
704 
705 static void
706 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
707 		      struct ieee80211_vif *vif)
708 {
709 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
710 	struct ieee80211_he_mcs_nss_supp mcs_map;
711 	struct sta_rec_he *he;
712 	struct tlv *tlv;
713 	u32 cap = 0;
714 
715 	if (!sta->deflink.he_cap.has_he)
716 		return;
717 
718 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
719 
720 	he = (struct sta_rec_he *)tlv;
721 
722 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
723 		cap |= STA_REC_HE_CAP_HTC;
724 
725 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
726 		cap |= STA_REC_HE_CAP_BSR;
727 
728 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
729 		cap |= STA_REC_HE_CAP_OM;
730 
731 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
732 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
733 
734 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
735 		cap |= STA_REC_HE_CAP_BQR;
736 
737 	if (elem->phy_cap_info[0] &
738 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
739 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
740 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
741 
742 	if (vif->bss_conf.he_ldpc &&
743 	    (elem->phy_cap_info[1] &
744 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
745 		cap |= STA_REC_HE_CAP_LDPC;
746 
747 	if (elem->phy_cap_info[1] &
748 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
749 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
750 
751 	if (elem->phy_cap_info[2] &
752 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
753 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
754 
755 	if (elem->phy_cap_info[2] &
756 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
757 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
758 
759 	if (elem->phy_cap_info[2] &
760 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
761 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
762 
763 	if (elem->phy_cap_info[6] &
764 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
765 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
766 
767 	if (elem->phy_cap_info[6] &
768 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
769 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
770 
771 	if (elem->phy_cap_info[7] &
772 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
773 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
774 
775 	if (elem->phy_cap_info[7] &
776 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
777 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
778 
779 	if (elem->phy_cap_info[7] &
780 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
781 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
782 
783 	if (elem->phy_cap_info[8] &
784 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
785 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
786 
787 	if (elem->phy_cap_info[8] &
788 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
789 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
790 
791 	if (elem->phy_cap_info[9] &
792 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
793 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
794 
795 	if (elem->phy_cap_info[9] &
796 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
797 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
798 
799 	he->he_cap = cpu_to_le32(cap);
800 
801 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
802 	switch (sta->deflink.bandwidth) {
803 	case IEEE80211_STA_RX_BW_160:
804 		if (elem->phy_cap_info[0] &
805 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
806 			mt7915_mcu_set_sta_he_mcs(sta,
807 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
808 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
809 
810 		mt7915_mcu_set_sta_he_mcs(sta,
811 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
812 					  le16_to_cpu(mcs_map.rx_mcs_160));
813 		fallthrough;
814 	default:
815 		mt7915_mcu_set_sta_he_mcs(sta,
816 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
817 					  le16_to_cpu(mcs_map.rx_mcs_80));
818 		break;
819 	}
820 
821 	he->t_frame_dur =
822 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
823 	he->max_ampdu_exp =
824 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
825 
826 	he->bw_set =
827 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
828 	he->device_class =
829 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
830 	he->punc_pream_rx =
831 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
832 
833 	he->dcm_tx_mode =
834 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
835 	he->dcm_tx_max_nss =
836 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
837 	he->dcm_rx_mode =
838 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
839 	he->dcm_rx_max_nss =
840 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
841 	he->dcm_rx_max_nss =
842 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
843 
844 	he->pkt_ext = 2;
845 }
846 
847 static void
848 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
849 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
850 {
851 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
852 	struct sta_rec_muru *muru;
853 	struct tlv *tlv;
854 
855 	if (vif->type != NL80211_IFTYPE_STATION &&
856 	    vif->type != NL80211_IFTYPE_AP)
857 		return;
858 
859 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
860 
861 	muru = (struct sta_rec_muru *)tlv;
862 
863 	muru->cfg.mimo_dl_en = vif->bss_conf.he_mu_beamformer ||
864 			       vif->bss_conf.vht_mu_beamformer ||
865 			       vif->bss_conf.vht_mu_beamformee;
866 	if (!is_mt7915(&dev->mt76))
867 		muru->cfg.mimo_ul_en = true;
868 	muru->cfg.ofdma_dl_en = true;
869 
870 	if (sta->deflink.vht_cap.vht_supported)
871 		muru->mimo_dl.vht_mu_bfee =
872 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
873 
874 	if (!sta->deflink.he_cap.has_he)
875 		return;
876 
877 	muru->mimo_dl.partial_bw_dl_mimo =
878 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
879 
880 	muru->mimo_ul.full_ul_mimo =
881 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
882 	muru->mimo_ul.partial_ul_mimo =
883 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
884 
885 	muru->ofdma_dl.punc_pream_rx =
886 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
887 	muru->ofdma_dl.he_20m_in_40m_2g =
888 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
889 	muru->ofdma_dl.he_20m_in_160m =
890 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
891 	muru->ofdma_dl.he_80m_in_160m =
892 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
893 
894 	muru->ofdma_ul.t_frame_dur =
895 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
896 	muru->ofdma_ul.mu_cascading =
897 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
898 	muru->ofdma_ul.uo_ra =
899 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
900 }
901 
902 static void
903 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
904 {
905 	struct sta_rec_ht *ht;
906 	struct tlv *tlv;
907 
908 	if (!sta->deflink.ht_cap.ht_supported)
909 		return;
910 
911 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
912 
913 	ht = (struct sta_rec_ht *)tlv;
914 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
915 }
916 
917 static void
918 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
919 {
920 	struct sta_rec_vht *vht;
921 	struct tlv *tlv;
922 
923 	if (!sta->deflink.vht_cap.vht_supported)
924 		return;
925 
926 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
927 
928 	vht = (struct sta_rec_vht *)tlv;
929 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
930 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
931 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
932 }
933 
934 static void
935 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
936 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
937 {
938 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
939 	struct sta_rec_amsdu *amsdu;
940 	struct tlv *tlv;
941 
942 	if (vif->type != NL80211_IFTYPE_STATION &&
943 	    vif->type != NL80211_IFTYPE_AP)
944 		return;
945 
946 	if (!sta->deflink.agg.max_amsdu_len)
947 	    return;
948 
949 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
950 	amsdu = (struct sta_rec_amsdu *)tlv;
951 	amsdu->max_amsdu_num = 8;
952 	amsdu->amsdu_en = true;
953 	msta->wcid.amsdu = true;
954 
955 	switch (sta->deflink.agg.max_amsdu_len) {
956 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
957 		if (!is_mt7915(&dev->mt76)) {
958 			amsdu->max_mpdu_size =
959 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
960 			return;
961 		}
962 		fallthrough;
963 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
964 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
965 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
966 		return;
967 	default:
968 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
969 		return;
970 	}
971 }
972 
973 static int
974 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
975 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
976 {
977 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
978 	struct mt7915_sta *msta;
979 	struct wtbl_req_hdr *wtbl_hdr;
980 	struct mt76_wcid *wcid;
981 	struct tlv *tlv;
982 
983 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
984 	wcid = sta ? &msta->wcid : NULL;
985 
986 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
987 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
988 						  WTBL_RESET_AND_SET, tlv,
989 						  &skb);
990 	if (IS_ERR(wtbl_hdr))
991 		return PTR_ERR(wtbl_hdr);
992 
993 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
994 					 wtbl_hdr);
995 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
996 	if (sta)
997 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
998 					    wtbl_hdr, vif->bss_conf.ht_ldpc,
999 					    vif->bss_conf.vht_ldpc);
1000 
1001 	return 0;
1002 }
1003 
1004 static inline bool
1005 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1006 			struct ieee80211_sta *sta, bool bfee)
1007 {
1008 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1009 
1010 	if (vif->type != NL80211_IFTYPE_STATION &&
1011 	    vif->type != NL80211_IFTYPE_AP)
1012 		return false;
1013 
1014 	if (!bfee && tx_ant < 2)
1015 		return false;
1016 
1017 	if (sta->deflink.he_cap.has_he) {
1018 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1019 
1020 		if (bfee)
1021 			return vif->bss_conf.he_su_beamformee &&
1022 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1023 		else
1024 			return vif->bss_conf.he_su_beamformer &&
1025 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1026 	}
1027 
1028 	if (sta->deflink.vht_cap.vht_supported) {
1029 		u32 cap = sta->deflink.vht_cap.cap;
1030 
1031 		if (bfee)
1032 			return vif->bss_conf.vht_su_beamformee &&
1033 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1034 		else
1035 			return vif->bss_conf.vht_su_beamformer &&
1036 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1037 	}
1038 
1039 	return false;
1040 }
1041 
1042 static void
1043 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1044 {
1045 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1046 	bf->ndp_rate = 0;				/* mcs0 */
1047 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1048 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1049 }
1050 
1051 static void
1052 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1053 		       struct sta_rec_bf *bf)
1054 {
1055 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1056 	u8 n = 0;
1057 
1058 	bf->tx_mode = MT_PHY_TYPE_HT;
1059 
1060 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1061 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1062 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1063 			      mcs->tx_params);
1064 	else if (mcs->rx_mask[3])
1065 		n = 3;
1066 	else if (mcs->rx_mask[2])
1067 		n = 2;
1068 	else if (mcs->rx_mask[1])
1069 		n = 1;
1070 
1071 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1072 	bf->ncol = min_t(u8, bf->nrow, n);
1073 	bf->ibf_ncol = n;
1074 }
1075 
1076 static void
1077 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1078 			struct sta_rec_bf *bf, bool explicit)
1079 {
1080 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1081 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1082 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1083 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1084 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1085 
1086 	bf->tx_mode = MT_PHY_TYPE_VHT;
1087 
1088 	if (explicit) {
1089 		u8 sts, snd_dim;
1090 
1091 		mt7915_mcu_sta_sounding_rate(bf);
1092 
1093 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1094 				pc->cap);
1095 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1096 				    vc->cap);
1097 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1098 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1099 		bf->ibf_ncol = bf->ncol;
1100 
1101 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1102 			bf->nrow = 1;
1103 	} else {
1104 		bf->nrow = tx_ant;
1105 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1106 		bf->ibf_ncol = nss_mcs;
1107 
1108 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1109 			bf->ibf_nrow = 1;
1110 	}
1111 }
1112 
1113 static void
1114 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1115 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1116 {
1117 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1118 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1119 	const struct ieee80211_sta_he_cap *vc =
1120 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1121 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1122 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1123 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1124 	u8 snd_dim, sts;
1125 
1126 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1127 
1128 	mt7915_mcu_sta_sounding_rate(bf);
1129 
1130 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1131 				pe->phy_cap_info[6]);
1132 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1133 				pe->phy_cap_info[6]);
1134 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1135 			 ve->phy_cap_info[5]);
1136 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1137 		     pe->phy_cap_info[4]);
1138 	bf->nrow = min_t(u8, snd_dim, sts);
1139 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1140 	bf->ibf_ncol = bf->ncol;
1141 
1142 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1143 		return;
1144 
1145 	/* go over for 160MHz and 80p80 */
1146 	if (pe->phy_cap_info[0] &
1147 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1148 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1149 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1150 
1151 		bf->ncol_gt_bw80 = nss_mcs;
1152 	}
1153 
1154 	if (pe->phy_cap_info[0] &
1155 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1156 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1157 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1158 
1159 		if (bf->ncol_gt_bw80)
1160 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1161 		else
1162 			bf->ncol_gt_bw80 = nss_mcs;
1163 	}
1164 
1165 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1166 			 ve->phy_cap_info[5]);
1167 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1168 		     pe->phy_cap_info[4]);
1169 
1170 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1171 }
1172 
1173 static void
1174 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1175 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1176 {
1177 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1178 	struct mt7915_phy *phy = mvif->phy;
1179 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1180 	struct sta_rec_bf *bf;
1181 	struct tlv *tlv;
1182 	const u8 matrix[4][4] = {
1183 		{0, 0, 0, 0},
1184 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1185 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1186 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1187 	};
1188 	bool ebf;
1189 
1190 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1191 		return;
1192 
1193 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1194 	if (!ebf && !dev->ibf)
1195 		return;
1196 
1197 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1198 	bf = (struct sta_rec_bf *)tlv;
1199 
1200 	/* he: eBF only, in accordance with spec
1201 	 * vht: support eBF and iBF
1202 	 * ht: iBF only, since mac80211 lacks of eBF support
1203 	 */
1204 	if (sta->deflink.he_cap.has_he && ebf)
1205 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1206 	else if (sta->deflink.vht_cap.vht_supported)
1207 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1208 	else if (sta->deflink.ht_cap.ht_supported)
1209 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1210 	else
1211 		return;
1212 
1213 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1214 	bf->bw = sta->deflink.bandwidth;
1215 	bf->ibf_dbw = sta->deflink.bandwidth;
1216 	bf->ibf_nrow = tx_ant;
1217 
1218 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1219 		bf->ibf_timeout = 0x48;
1220 	else
1221 		bf->ibf_timeout = 0x18;
1222 
1223 	if (ebf && bf->nrow != tx_ant)
1224 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1225 	else
1226 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1227 
1228 	switch (sta->deflink.bandwidth) {
1229 	case IEEE80211_STA_RX_BW_160:
1230 	case IEEE80211_STA_RX_BW_80:
1231 		bf->mem_total = bf->mem_20m * 2;
1232 		break;
1233 	case IEEE80211_STA_RX_BW_40:
1234 		bf->mem_total = bf->mem_20m;
1235 		break;
1236 	case IEEE80211_STA_RX_BW_20:
1237 	default:
1238 		break;
1239 	}
1240 }
1241 
1242 static void
1243 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1244 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1245 {
1246 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1247 	struct mt7915_phy *phy = mvif->phy;
1248 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1249 	struct sta_rec_bfee *bfee;
1250 	struct tlv *tlv;
1251 	u8 nrow = 0;
1252 
1253 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1254 		return;
1255 
1256 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1257 		return;
1258 
1259 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1260 	bfee = (struct sta_rec_bfee *)tlv;
1261 
1262 	if (sta->deflink.he_cap.has_he) {
1263 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1264 
1265 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1266 			      pe->phy_cap_info[5]);
1267 	} else if (sta->deflink.vht_cap.vht_supported) {
1268 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1269 
1270 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1271 				 pc->cap);
1272 	}
1273 
1274 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1275 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1276 }
1277 
1278 static enum mcu_mmps_mode
1279 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1280 {
1281 	switch (smps) {
1282 	case IEEE80211_SMPS_OFF:
1283 		return MCU_MMPS_DISABLE;
1284 	case IEEE80211_SMPS_STATIC:
1285 		return MCU_MMPS_STATIC;
1286 	case IEEE80211_SMPS_DYNAMIC:
1287 		return MCU_MMPS_DYNAMIC;
1288 	default:
1289 		return MCU_MMPS_DISABLE;
1290 	}
1291 }
1292 
1293 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1294 				   struct ieee80211_vif *vif,
1295 				   struct ieee80211_sta *sta,
1296 				   void *data, u32 field)
1297 {
1298 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1299 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1300 	struct sta_phy *phy = data;
1301 	struct sta_rec_ra_fixed *ra;
1302 	struct sk_buff *skb;
1303 	struct tlv *tlv;
1304 
1305 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1306 					    &msta->wcid);
1307 	if (IS_ERR(skb))
1308 		return PTR_ERR(skb);
1309 
1310 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1311 	ra = (struct sta_rec_ra_fixed *)tlv;
1312 
1313 	switch (field) {
1314 	case RATE_PARAM_AUTO:
1315 		break;
1316 	case RATE_PARAM_FIXED:
1317 	case RATE_PARAM_FIXED_MCS:
1318 	case RATE_PARAM_FIXED_GI:
1319 	case RATE_PARAM_FIXED_HE_LTF:
1320 		if (phy)
1321 			ra->phy = *phy;
1322 		break;
1323 	case RATE_PARAM_MMPS_UPDATE:
1324 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1325 		break;
1326 	case RATE_PARAM_SPE_UPDATE:
1327 		ra->spe_idx = *(u8 *)data;
1328 		break;
1329 	default:
1330 		break;
1331 	}
1332 	ra->field = cpu_to_le32(field);
1333 
1334 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1335 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1336 }
1337 
1338 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1339 			struct ieee80211_sta *sta)
1340 {
1341 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1342 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1343 	struct wtbl_req_hdr *wtbl_hdr;
1344 	struct tlv *sta_wtbl;
1345 	struct sk_buff *skb;
1346 	int ret;
1347 
1348 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1349 					    &msta->wcid);
1350 	if (IS_ERR(skb))
1351 		return PTR_ERR(skb);
1352 
1353 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1354 					   sizeof(struct tlv));
1355 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1356 						  WTBL_SET, sta_wtbl, &skb);
1357 	if (IS_ERR(wtbl_hdr))
1358 		return PTR_ERR(wtbl_hdr);
1359 
1360 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1361 
1362 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1363 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1364 	if (ret)
1365 		return ret;
1366 
1367 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1368 					      RATE_PARAM_MMPS_UPDATE);
1369 }
1370 
1371 static int
1372 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1373 		       struct ieee80211_sta *sta)
1374 {
1375 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1376 	struct mt76_phy *mphy = mvif->phy->mt76;
1377 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1378 
1379 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1380 					      RATE_PARAM_SPE_UPDATE);
1381 }
1382 
1383 static int
1384 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1385 			       struct ieee80211_vif *vif,
1386 			       struct ieee80211_sta *sta)
1387 {
1388 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1389 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1390 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1391 	enum nl80211_band band = chandef->chan->band;
1392 	struct sta_phy phy = {};
1393 	int ret, nrates = 0;
1394 
1395 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1396 	do {									\
1397 		u8 i, gi = mask->control[band]._gi;				\
1398 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1399 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1400 			phy.sgi |= gi << (i << (_he));				\
1401 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1402 		}								\
1403 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1404 			if (!mask->control[band]._mcs[i])			\
1405 				continue;					\
1406 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1407 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1408 			if (_ht)						\
1409 				phy.mcs += 8 * i;				\
1410 		}								\
1411 	} while (0)
1412 
1413 	if (sta->deflink.he_cap.has_he) {
1414 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1415 	} else if (sta->deflink.vht_cap.vht_supported) {
1416 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1417 	} else if (sta->deflink.ht_cap.ht_supported) {
1418 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1419 	} else {
1420 		nrates = hweight32(mask->control[band].legacy);
1421 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1422 	}
1423 #undef __sta_phy_bitrate_mask_check
1424 
1425 	/* fall back to auto rate control */
1426 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1427 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1428 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1429 	    nrates != 1)
1430 		return 0;
1431 
1432 	/* fixed single rate */
1433 	if (nrates == 1) {
1434 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1435 						     RATE_PARAM_FIXED_MCS);
1436 		if (ret)
1437 			return ret;
1438 	}
1439 
1440 	/* fixed GI */
1441 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1442 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1443 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1444 		u32 addr;
1445 
1446 		/* firmware updates only TXCMD but doesn't take WTBL into
1447 		 * account, so driver should update here to reflect the
1448 		 * actual txrate hardware sends out.
1449 		 */
1450 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1451 		if (sta->deflink.he_cap.has_he)
1452 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1453 		else
1454 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1455 
1456 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1457 						     RATE_PARAM_FIXED_GI);
1458 		if (ret)
1459 			return ret;
1460 	}
1461 
1462 	/* fixed HE_LTF */
1463 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1464 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1465 						     RATE_PARAM_FIXED_HE_LTF);
1466 		if (ret)
1467 			return ret;
1468 	}
1469 
1470 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1471 }
1472 
1473 static void
1474 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1475 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1476 {
1477 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1478 	struct mt76_phy *mphy = mvif->phy->mt76;
1479 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1480 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1481 	enum nl80211_band band = chandef->chan->band;
1482 	struct sta_rec_ra *ra;
1483 	struct tlv *tlv;
1484 	u32 supp_rate = sta->deflink.supp_rates[band];
1485 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1486 
1487 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1488 	ra = (struct sta_rec_ra *)tlv;
1489 
1490 	ra->valid = true;
1491 	ra->auto_rate = true;
1492 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1493 	ra->channel = chandef->chan->hw_value;
1494 	ra->bw = sta->deflink.bandwidth;
1495 	ra->phy.bw = sta->deflink.bandwidth;
1496 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1497 
1498 	if (supp_rate) {
1499 		supp_rate &= mask->control[band].legacy;
1500 		ra->rate_len = hweight32(supp_rate);
1501 
1502 		if (band == NL80211_BAND_2GHZ) {
1503 			ra->supp_mode = MODE_CCK;
1504 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1505 
1506 			if (ra->rate_len > 4) {
1507 				ra->supp_mode |= MODE_OFDM;
1508 				ra->supp_ofdm_rate = supp_rate >> 4;
1509 			}
1510 		} else {
1511 			ra->supp_mode = MODE_OFDM;
1512 			ra->supp_ofdm_rate = supp_rate;
1513 		}
1514 	}
1515 
1516 	if (sta->deflink.ht_cap.ht_supported) {
1517 		ra->supp_mode |= MODE_HT;
1518 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1519 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1520 
1521 		cap |= STA_CAP_HT;
1522 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1523 			cap |= STA_CAP_SGI_20;
1524 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1525 			cap |= STA_CAP_SGI_40;
1526 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1527 			cap |= STA_CAP_TX_STBC;
1528 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1529 			cap |= STA_CAP_RX_STBC;
1530 		if (vif->bss_conf.ht_ldpc &&
1531 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1532 			cap |= STA_CAP_LDPC;
1533 
1534 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1535 					  mask->control[band].ht_mcs);
1536 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1537 	}
1538 
1539 	if (sta->deflink.vht_cap.vht_supported) {
1540 		u8 af;
1541 
1542 		ra->supp_mode |= MODE_VHT;
1543 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1544 			       sta->deflink.vht_cap.cap);
1545 		ra->af = max_t(u8, ra->af, af);
1546 
1547 		cap |= STA_CAP_VHT;
1548 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1549 			cap |= STA_CAP_VHT_SGI_80;
1550 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1551 			cap |= STA_CAP_VHT_SGI_160;
1552 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1553 			cap |= STA_CAP_VHT_TX_STBC;
1554 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1555 			cap |= STA_CAP_VHT_RX_STBC;
1556 		if (vif->bss_conf.vht_ldpc &&
1557 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1558 			cap |= STA_CAP_VHT_LDPC;
1559 
1560 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1561 					   mask->control[band].vht_mcs);
1562 	}
1563 
1564 	if (sta->deflink.he_cap.has_he) {
1565 		ra->supp_mode |= MODE_HE;
1566 		cap |= STA_CAP_HE;
1567 
1568 		if (sta->deflink.he_6ghz_capa.capa)
1569 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1570 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1571 	}
1572 
1573 	ra->sta_cap = cpu_to_le32(cap);
1574 }
1575 
1576 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1577 			     struct ieee80211_sta *sta, bool changed)
1578 {
1579 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1580 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1581 	struct sk_buff *skb;
1582 	int ret;
1583 
1584 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1585 					    &msta->wcid);
1586 	if (IS_ERR(skb))
1587 		return PTR_ERR(skb);
1588 
1589 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1590 	 * once dev->rc_work changes the settings driver should also
1591 	 * update sta_rec_he here.
1592 	 */
1593 	if (changed)
1594 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1595 
1596 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1597 	 * i.e 0-{7,8,9} for VHT.
1598 	 */
1599 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1600 
1601 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1602 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1603 	if (ret)
1604 		return ret;
1605 
1606 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1607 	 * and updates as peer fixed rate parameters, which overrides
1608 	 * sta_rec_ra and firmware rate control algorithm.
1609 	 */
1610 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1611 }
1612 
1613 static int
1614 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1615 		     struct ieee80211_sta *sta)
1616 {
1617 #define MT_STA_BSS_GROUP		1
1618 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1619 	struct mt7915_sta *msta;
1620 	struct {
1621 		__le32 action;
1622 		u8 wlan_idx_lo;
1623 		u8 status;
1624 		u8 wlan_idx_hi;
1625 		u8 rsv0[5];
1626 		__le32 val;
1627 		u8 rsv1[8];
1628 	} __packed req = {
1629 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1630 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1631 	};
1632 
1633 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1634 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1635 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1636 
1637 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1638 				 sizeof(req), true);
1639 }
1640 
1641 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1642 		       struct ieee80211_sta *sta, bool enable)
1643 {
1644 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1645 	struct mt7915_sta *msta;
1646 	struct sk_buff *skb;
1647 	int ret;
1648 
1649 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1650 
1651 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1652 					    &msta->wcid);
1653 	if (IS_ERR(skb))
1654 		return PTR_ERR(skb);
1655 
1656 	/* starec basic */
1657 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
1658 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1659 	if (!enable)
1660 		goto out;
1661 
1662 	/* tag order is in accordance with firmware dependency. */
1663 	if (sta) {
1664 		/* starec bfer */
1665 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1666 		/* starec ht */
1667 		mt7915_mcu_sta_ht_tlv(skb, sta);
1668 		/* starec vht */
1669 		mt7915_mcu_sta_vht_tlv(skb, sta);
1670 		/* starec uapsd */
1671 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1672 	}
1673 
1674 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1675 	if (ret) {
1676 		dev_kfree_skb(skb);
1677 		return ret;
1678 	}
1679 
1680 	if (sta) {
1681 		/* starec amsdu */
1682 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1683 		/* starec he */
1684 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1685 		/* starec muru */
1686 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1687 		/* starec bfee */
1688 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1689 	}
1690 
1691 	ret = mt7915_mcu_add_group(dev, vif, sta);
1692 	if (ret) {
1693 		dev_kfree_skb(skb);
1694 		return ret;
1695 	}
1696 out:
1697 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1698 	if (ret)
1699 		return ret;
1700 
1701 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1702 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1703 }
1704 
1705 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1706 {
1707 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1708 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1709 	struct {
1710 		__le32 args[2];
1711 	} req = {
1712 		.args[0] = cpu_to_le32(1),
1713 		.args[1] = cpu_to_le32(6),
1714 	};
1715 
1716 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1717 					 &req, sizeof(req));
1718 #else
1719 	return 0;
1720 #endif
1721 }
1722 
1723 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1724 			    struct ieee80211_vif *vif, bool enable)
1725 {
1726 	struct mt7915_dev *dev = phy->dev;
1727 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1728 	struct {
1729 		struct req_hdr {
1730 			u8 omac_idx;
1731 			u8 band_idx;
1732 			__le16 tlv_num;
1733 			u8 is_tlv_append;
1734 			u8 rsv[3];
1735 		} __packed hdr;
1736 		struct req_tlv {
1737 			__le16 tag;
1738 			__le16 len;
1739 			u8 active;
1740 			u8 band_idx;
1741 			u8 omac_addr[ETH_ALEN];
1742 		} __packed tlv;
1743 	} data = {
1744 		.hdr = {
1745 			.omac_idx = mvif->mt76.omac_idx,
1746 			.band_idx = mvif->mt76.band_idx,
1747 			.tlv_num = cpu_to_le16(1),
1748 			.is_tlv_append = 1,
1749 		},
1750 		.tlv = {
1751 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1752 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1753 			.active = enable,
1754 			.band_idx = mvif->mt76.band_idx,
1755 		},
1756 	};
1757 
1758 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1759 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1760 
1761 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1762 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1763 				 &data, sizeof(data), true);
1764 }
1765 
1766 static void
1767 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1768 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1769 			 struct ieee80211_mutable_offsets *offs)
1770 {
1771 	struct bss_info_bcn_cntdwn *info;
1772 	struct tlv *tlv;
1773 	int sub_tag;
1774 
1775 	if (!offs->cntdwn_counter_offs[0])
1776 		return;
1777 
1778 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1779 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1780 					   &bcn->sub_ntlv, &bcn->len);
1781 	info = (struct bss_info_bcn_cntdwn *)tlv;
1782 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1783 }
1784 
1785 static void
1786 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1787 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1788 		       struct ieee80211_mutable_offsets *offs)
1789 {
1790 	struct bss_info_bcn_mbss *mbss;
1791 	const struct element *elem;
1792 	struct tlv *tlv;
1793 
1794 	if (!vif->bss_conf.bssid_indicator)
1795 		return;
1796 
1797 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1798 					   sizeof(*mbss), &bcn->sub_ntlv,
1799 					   &bcn->len);
1800 
1801 	mbss = (struct bss_info_bcn_mbss *)tlv;
1802 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1803 	mbss->bitmap = cpu_to_le32(1);
1804 
1805 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1806 			    &skb->data[offs->mbssid_off],
1807 			    skb->len - offs->mbssid_off) {
1808 		const struct element *sub_elem;
1809 
1810 		if (elem->datalen < 2)
1811 			continue;
1812 
1813 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1814 			const struct ieee80211_bssid_index *idx;
1815 			const u8 *idx_ie;
1816 
1817 			if (sub_elem->id || sub_elem->datalen < 4)
1818 				continue; /* not a valid BSS profile */
1819 
1820 			/* Find WLAN_EID_MULTI_BSSID_IDX
1821 			 * in the merged nontransmitted profile
1822 			 */
1823 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1824 						  sub_elem->data,
1825 						  sub_elem->datalen);
1826 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1827 				continue;
1828 
1829 			idx = (void *)(idx_ie + 2);
1830 			if (!idx->bssid_index || idx->bssid_index > 31)
1831 				continue;
1832 
1833 			mbss->offset[idx->bssid_index] =
1834 				cpu_to_le16(idx_ie - skb->data);
1835 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1836 		}
1837 	}
1838 }
1839 
1840 static void
1841 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1842 		       struct sk_buff *rskb, struct sk_buff *skb,
1843 		       struct bss_info_bcn *bcn,
1844 		       struct ieee80211_mutable_offsets *offs)
1845 {
1846 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1847 	struct bss_info_bcn_cont *cont;
1848 	struct tlv *tlv;
1849 	u8 *buf;
1850 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1851 
1852 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1853 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1854 					   len, &bcn->sub_ntlv, &bcn->len);
1855 
1856 	cont = (struct bss_info_bcn_cont *)tlv;
1857 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1858 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1859 
1860 	if (offs->cntdwn_counter_offs[0]) {
1861 		u16 offset = offs->cntdwn_counter_offs[0];
1862 
1863 		if (vif->bss_conf.csa_active)
1864 			cont->csa_ofs = cpu_to_le16(offset - 4);
1865 		if (vif->bss_conf.color_change_active)
1866 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1867 	}
1868 
1869 	buf = (u8 *)tlv + sizeof(*cont);
1870 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1871 			      0, BSS_CHANGED_BEACON);
1872 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1873 }
1874 
1875 static void
1876 mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1877 				struct sk_buff *rskb, struct bss_info_bcn *bcn,
1878 				u32 changed)
1879 {
1880 #define OFFLOAD_TX_MODE_SU	BIT(0)
1881 #define OFFLOAD_TX_MODE_MU	BIT(1)
1882 	struct ieee80211_hw *hw = mt76_hw(dev);
1883 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1884 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1885 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1886 	enum nl80211_band band = chandef->chan->band;
1887 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1888 	struct bss_info_inband_discovery *discov;
1889 	struct ieee80211_tx_info *info;
1890 	struct sk_buff *skb = NULL;
1891 	struct tlv *tlv;
1892 	bool ext_phy = phy != &dev->phy;
1893 	u8 *buf, interval;
1894 	int len;
1895 
1896 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
1897 	    vif->bss_conf.fils_discovery.max_interval) {
1898 		interval = vif->bss_conf.fils_discovery.max_interval;
1899 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1900 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1901 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1902 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1903 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1904 	}
1905 
1906 	if (!skb)
1907 		return;
1908 
1909 	info = IEEE80211_SKB_CB(skb);
1910 	info->control.vif = vif;
1911 	info->band = band;
1912 
1913 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1914 
1915 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1916 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1917 
1918 	if (len > (MT7915_MAX_BSS_OFFLOAD_SIZE - rskb->len)) {
1919 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1920 		dev_kfree_skb(skb);
1921 		return;
1922 	}
1923 
1924 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1925 					   len, &bcn->sub_ntlv, &bcn->len);
1926 	discov = (struct bss_info_inband_discovery *)tlv;
1927 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1928 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1929 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1930 	discov->tx_interval = interval;
1931 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1932 	discov->enable = true;
1933 
1934 	buf = (u8 *)tlv + sizeof(*discov);
1935 
1936 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1937 			      0, changed);
1938 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1939 
1940 	dev_kfree_skb(skb);
1941 }
1942 
1943 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1944 			  int en, u32 changed)
1945 {
1946 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1947 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1948 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1949 	struct ieee80211_mutable_offsets offs;
1950 	struct ieee80211_tx_info *info;
1951 	struct sk_buff *skb, *rskb;
1952 	struct tlv *tlv;
1953 	struct bss_info_bcn *bcn;
1954 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
1955 	bool ext_phy = phy != &dev->phy;
1956 
1957 	if (vif->bss_conf.nontransmitted)
1958 		return 0;
1959 
1960 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1961 					       NULL, len);
1962 	if (IS_ERR(rskb))
1963 		return PTR_ERR(rskb);
1964 
1965 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1966 	bcn = (struct bss_info_bcn *)tlv;
1967 	bcn->enable = en;
1968 
1969 	if (!en)
1970 		goto out;
1971 
1972 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
1973 	if (!skb)
1974 		return -EINVAL;
1975 
1976 	if (skb->len > MT7915_MAX_BEACON_SIZE - MT_TXD_SIZE) {
1977 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
1978 		dev_kfree_skb(skb);
1979 		return -EINVAL;
1980 	}
1981 
1982 	info = IEEE80211_SKB_CB(skb);
1983 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1984 
1985 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
1986 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
1987 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
1988 	dev_kfree_skb(skb);
1989 
1990 	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
1991 	    changed & BSS_CHANGED_FILS_DISCOVERY)
1992 		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
1993 						bcn, changed);
1994 
1995 out:
1996 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
1997 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1998 }
1999 
2000 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2001 {
2002 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2003 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2004 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2005 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2006 		return -EIO;
2007 	}
2008 
2009 	/* clear irq when the driver own success */
2010 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2011 		MT_TOP_LPCR_HOST_BAND_STAT);
2012 
2013 	return 0;
2014 }
2015 
2016 static int
2017 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2018 {
2019 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2020 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2021 
2022 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2023 			    state, 1000)) {
2024 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2025 		return -EIO;
2026 	}
2027 	return 0;
2028 }
2029 
2030 static int mt7915_load_firmware(struct mt7915_dev *dev)
2031 {
2032 	int ret;
2033 
2034 	/* make sure fw is download state */
2035 	if (mt7915_firmware_state(dev, false)) {
2036 		/* restart firmware once */
2037 		mt76_connac_mcu_restart(&dev->mt76);
2038 		ret = mt7915_firmware_state(dev, false);
2039 		if (ret) {
2040 			dev_err(dev->mt76.dev,
2041 				"Firmware is not ready for download\n");
2042 			return ret;
2043 		}
2044 	}
2045 
2046 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2047 	if (ret)
2048 		return ret;
2049 
2050 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2051 				    fw_name(dev, FIRMWARE_WA));
2052 	if (ret)
2053 		return ret;
2054 
2055 	ret = mt7915_firmware_state(dev, true);
2056 	if (ret)
2057 		return ret;
2058 
2059 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2060 
2061 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2062 
2063 	return 0;
2064 }
2065 
2066 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2067 {
2068 	struct {
2069 		u8 ctrl_val;
2070 		u8 pad[3];
2071 	} data = {
2072 		.ctrl_val = ctrl
2073 	};
2074 
2075 	if (type == MCU_FW_LOG_WA)
2076 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2077 					 &data, sizeof(data), true);
2078 
2079 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2080 				 sizeof(data), true);
2081 }
2082 
2083 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2084 {
2085 	struct {
2086 		u8 ver;
2087 		u8 pad;
2088 		__le16 len;
2089 		u8 level;
2090 		u8 rsv[3];
2091 		__le32 module_idx;
2092 	} data = {
2093 		.module_idx = cpu_to_le32(module),
2094 		.level = level,
2095 	};
2096 
2097 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2098 				 sizeof(data), false);
2099 }
2100 
2101 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2102 {
2103 	struct {
2104 		__le32 cmd;
2105 		u8 enable;
2106 	} data = {
2107 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2108 		.enable = enabled,
2109 	};
2110 
2111 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2112 				sizeof(data), false);
2113 }
2114 
2115 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2116 {
2117 	struct mt7915_dev *dev = phy->dev;
2118 	struct sk_buff *skb;
2119 	struct mt7915_mcu_muru_stats *mu_stats =
2120 				(struct mt7915_mcu_muru_stats *)ms;
2121 	int ret;
2122 
2123 	struct {
2124 		__le32 cmd;
2125 		u8 band_idx;
2126 	} req = {
2127 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2128 		.band_idx = phy->mt76->band_idx,
2129 	};
2130 
2131 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2132 					&req, sizeof(req), true, &skb);
2133 	if (ret)
2134 		return ret;
2135 
2136 	memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2137 	dev_kfree_skb(skb);
2138 
2139 	return 0;
2140 }
2141 
2142 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2143 {
2144 	struct {
2145 		u8 enable;
2146 		u8 _rsv[3];
2147 	} __packed req = {
2148 		.enable = enabled
2149 	};
2150 
2151 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2152 				 sizeof(req), false);
2153 }
2154 
2155 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2156 {
2157 	struct {
2158 		__le32 cmd;
2159 		u8 val[4];
2160 	} __packed req = {
2161 		.cmd = cpu_to_le32(cmd),
2162 	};
2163 
2164 	put_unaligned_le32(val, req.val);
2165 
2166 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2167 				 sizeof(req), false);
2168 }
2169 
2170 static int
2171 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2172 {
2173 #define RX_AIRTIME_FEATURE_CTRL		1
2174 #define RX_AIRTIME_BITWISE_CTRL		2
2175 #define RX_AIRTIME_CLEAR_EN	1
2176 	struct {
2177 		__le16 field;
2178 		__le16 sub_field;
2179 		__le32 set_status;
2180 		__le32 get_status;
2181 		u8 _rsv[12];
2182 
2183 		bool airtime_en;
2184 		bool mibtime_en;
2185 		bool earlyend_en;
2186 		u8 _rsv1[9];
2187 
2188 		bool airtime_clear;
2189 		bool mibtime_clear;
2190 		u8 _rsv2[98];
2191 	} __packed req = {
2192 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2193 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2194 		.airtime_clear = true,
2195 	};
2196 	int ret;
2197 
2198 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2199 				sizeof(req), true);
2200 	if (ret)
2201 		return ret;
2202 
2203 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2204 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2205 	req.airtime_en = true;
2206 
2207 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2208 				 sizeof(req), true);
2209 }
2210 
2211 static int mt7915_red_set_watermark(struct mt7915_dev *dev)
2212 {
2213 #define RED_GLOBAL_TOKEN_WATERMARK 2
2214 	struct {
2215 		__le32 args[3];
2216 		u8 cmd;
2217 		u8 version;
2218 		u8 __rsv1[4];
2219 		__le16 len;
2220 		__le16 high_mark;
2221 		__le16 low_mark;
2222 		u8 __rsv2[12];
2223 	} __packed req = {
2224 		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
2225 		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
2226 		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
2227 		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
2228 		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
2229 	};
2230 
2231 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
2232 				 sizeof(req), false);
2233 }
2234 
2235 static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
2236 {
2237 #define RED_DISABLE		0
2238 #define RED_BY_WA_ENABLE	2
2239 	int ret;
2240 	u32 red_type = enabled ? RED_BY_WA_ENABLE : RED_DISABLE;
2241 	__le32 req = cpu_to_le32(red_type);
2242 
2243 	if (enabled) {
2244 		ret = mt7915_red_set_watermark(dev);
2245 		if (ret < 0)
2246 			return ret;
2247 	}
2248 
2249 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
2250 				sizeof(req), false);
2251 	if (ret < 0)
2252 		return ret;
2253 
2254 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2255 				 MCU_WA_PARAM_RED, enabled, 0);
2256 }
2257 
2258 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2259 {
2260 	int ret;
2261 
2262 	/* force firmware operation mode into normal state,
2263 	 * which should be set before firmware download stage.
2264 	 */
2265 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2266 
2267 	ret = mt7915_driver_own(dev, 0);
2268 	if (ret)
2269 		return ret;
2270 	/* set driver own for band1 when two hif exist */
2271 	if (dev->hif2) {
2272 		ret = mt7915_driver_own(dev, 1);
2273 		if (ret)
2274 			return ret;
2275 	}
2276 
2277 	ret = mt7915_load_firmware(dev);
2278 	if (ret)
2279 		return ret;
2280 
2281 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2282 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2283 	if (ret)
2284 		return ret;
2285 
2286 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2287 	if (ret)
2288 		return ret;
2289 
2290 	if ((mtk_wed_device_active(&dev->mt76.mmio.wed) &&
2291 	     is_mt7915(&dev->mt76)) ||
2292 	    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
2293 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2294 
2295 	ret = mt7915_mcu_set_mwds(dev, 1);
2296 	if (ret)
2297 		return ret;
2298 
2299 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2300 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2301 	if (ret)
2302 		return ret;
2303 
2304 	ret = mt7915_mcu_init_rx_airtime(dev);
2305 	if (ret)
2306 		return ret;
2307 
2308 	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
2309 }
2310 
2311 int mt7915_mcu_init(struct mt7915_dev *dev)
2312 {
2313 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2314 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2315 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2316 		.mcu_parse_response = mt7915_mcu_parse_response,
2317 	};
2318 
2319 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2320 
2321 	return mt7915_mcu_init_firmware(dev);
2322 }
2323 
2324 void mt7915_mcu_exit(struct mt7915_dev *dev)
2325 {
2326 	mt76_connac_mcu_restart(&dev->mt76);
2327 	if (mt7915_firmware_state(dev, false)) {
2328 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2329 		goto out;
2330 	}
2331 
2332 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2333 	if (dev->hif2)
2334 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2335 			MT_TOP_LPCR_HOST_FW_OWN);
2336 out:
2337 	skb_queue_purge(&dev->mt76.mcu.res_q);
2338 }
2339 
2340 static int
2341 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2342 {
2343 	struct {
2344 		u8 operation;
2345 		u8 count;
2346 		u8 _rsv[2];
2347 		u8 index;
2348 		u8 enable;
2349 		__le16 etype;
2350 	} req = {
2351 		.operation = 1,
2352 		.count = 1,
2353 		.enable = 1,
2354 		.etype = cpu_to_le16(ETH_P_PAE),
2355 	};
2356 
2357 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2358 				 &req, sizeof(req), false);
2359 }
2360 
2361 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2362 		       bool enable, bool hdr_trans)
2363 {
2364 	struct {
2365 		u8 operation;
2366 		u8 enable;
2367 		u8 check_bssid;
2368 		u8 insert_vlan;
2369 		u8 remove_vlan;
2370 		u8 tid;
2371 		u8 mode;
2372 		u8 rsv;
2373 	} __packed req_trans = {
2374 		.enable = hdr_trans,
2375 	};
2376 	struct {
2377 		u8 enable;
2378 		u8 band;
2379 		u8 rsv[2];
2380 	} __packed req_mac = {
2381 		.enable = enable,
2382 		.band = band,
2383 	};
2384 	int ret;
2385 
2386 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2387 				&req_trans, sizeof(req_trans), false);
2388 	if (ret)
2389 		return ret;
2390 
2391 	if (hdr_trans)
2392 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2393 
2394 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2395 				 &req_mac, sizeof(req_mac), true);
2396 }
2397 
2398 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2399 {
2400 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2401 	u8 num = req->total;
2402 	size_t len = sizeof(*req) -
2403 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2404 
2405 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2406 				 len, true);
2407 }
2408 
2409 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2410 {
2411 #define TX_CMD_MODE		1
2412 	struct mt7915_mcu_tx req = {
2413 		.valid = true,
2414 		.mode = TX_CMD_MODE,
2415 		.total = IEEE80211_NUM_ACS,
2416 	};
2417 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2418 	int ac;
2419 
2420 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2421 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2422 		struct edca *e = &req.edca[ac];
2423 
2424 		e->set = WMM_PARAM_SET;
2425 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2426 		e->aifs = q->aifs;
2427 		e->txop = cpu_to_le16(q->txop);
2428 
2429 		if (q->cw_min)
2430 			e->cw_min = fls(q->cw_min);
2431 		else
2432 			e->cw_min = 5;
2433 
2434 		if (q->cw_max)
2435 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2436 		else
2437 			e->cw_max = cpu_to_le16(10);
2438 	}
2439 
2440 	return mt7915_mcu_update_edca(dev, &req);
2441 }
2442 
2443 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2444 {
2445 	struct {
2446 		__le32 tag;
2447 		__le16 min_lpn;
2448 		u8 rsv[2];
2449 	} __packed req = {
2450 		.tag = cpu_to_le32(0x1),
2451 		.min_lpn = cpu_to_le16(val),
2452 	};
2453 
2454 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2455 				 sizeof(req), true);
2456 }
2457 
2458 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2459 			    const struct mt7915_dfs_pulse *pulse)
2460 {
2461 	struct {
2462 		__le32 tag;
2463 
2464 		__le32 max_width;		/* us */
2465 		__le32 max_pwr;			/* dbm */
2466 		__le32 min_pwr;			/* dbm */
2467 		__le32 min_stgr_pri;		/* us */
2468 		__le32 max_stgr_pri;		/* us */
2469 		__le32 min_cr_pri;		/* us */
2470 		__le32 max_cr_pri;		/* us */
2471 	} __packed req = {
2472 		.tag = cpu_to_le32(0x3),
2473 
2474 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2475 		__req_field(max_width),
2476 		__req_field(max_pwr),
2477 		__req_field(min_pwr),
2478 		__req_field(min_stgr_pri),
2479 		__req_field(max_stgr_pri),
2480 		__req_field(min_cr_pri),
2481 		__req_field(max_cr_pri),
2482 #undef __req_field
2483 	};
2484 
2485 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2486 				 sizeof(req), true);
2487 }
2488 
2489 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2490 			    const struct mt7915_dfs_pattern *pattern)
2491 {
2492 	struct {
2493 		__le32 tag;
2494 		__le16 radar_type;
2495 
2496 		u8 enb;
2497 		u8 stgr;
2498 		u8 min_crpn;
2499 		u8 max_crpn;
2500 		u8 min_crpr;
2501 		u8 min_pw;
2502 		__le32 min_pri;
2503 		__le32 max_pri;
2504 		u8 max_pw;
2505 		u8 min_crbn;
2506 		u8 max_crbn;
2507 		u8 min_stgpn;
2508 		u8 max_stgpn;
2509 		u8 min_stgpr;
2510 		u8 rsv[2];
2511 		__le32 min_stgpr_diff;
2512 	} __packed req = {
2513 		.tag = cpu_to_le32(0x2),
2514 		.radar_type = cpu_to_le16(index),
2515 
2516 #define __req_field_u8(field) .field = pattern->field
2517 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2518 		__req_field_u8(enb),
2519 		__req_field_u8(stgr),
2520 		__req_field_u8(min_crpn),
2521 		__req_field_u8(max_crpn),
2522 		__req_field_u8(min_crpr),
2523 		__req_field_u8(min_pw),
2524 		__req_field_u32(min_pri),
2525 		__req_field_u32(max_pri),
2526 		__req_field_u8(max_pw),
2527 		__req_field_u8(min_crbn),
2528 		__req_field_u8(max_crbn),
2529 		__req_field_u8(min_stgpn),
2530 		__req_field_u8(max_stgpn),
2531 		__req_field_u8(min_stgpr),
2532 		__req_field_u32(min_stgpr_diff),
2533 #undef __req_field_u8
2534 #undef __req_field_u32
2535 	};
2536 
2537 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2538 				 sizeof(req), true);
2539 }
2540 
2541 static int
2542 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2543 				 struct cfg80211_chan_def *chandef,
2544 				 int cmd)
2545 {
2546 	struct mt7915_dev *dev = phy->dev;
2547 	struct mt76_phy *mphy = phy->mt76;
2548 	struct ieee80211_channel *chan = mphy->chandef.chan;
2549 	int freq = mphy->chandef.center_freq1;
2550 	struct mt7915_mcu_background_chain_ctrl req = {
2551 		.monitor_scan_type = 2, /* simple rx */
2552 	};
2553 
2554 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2555 		return -EINVAL;
2556 
2557 	if (!cfg80211_chandef_valid(&mphy->chandef))
2558 		return -EINVAL;
2559 
2560 	switch (cmd) {
2561 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2562 		req.chan = chan->hw_value;
2563 		req.central_chan = ieee80211_frequency_to_channel(freq);
2564 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2565 		req.monitor_chan = chandef->chan->hw_value;
2566 		req.monitor_central_chan =
2567 			ieee80211_frequency_to_channel(chandef->center_freq1);
2568 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2569 		req.band_idx = phy->mt76->band_idx;
2570 		req.scan_mode = 1;
2571 		break;
2572 	}
2573 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2574 		req.monitor_chan = chandef->chan->hw_value;
2575 		req.monitor_central_chan =
2576 			ieee80211_frequency_to_channel(chandef->center_freq1);
2577 		req.band_idx = phy->mt76->band_idx;
2578 		req.scan_mode = 2;
2579 		break;
2580 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2581 		req.chan = chan->hw_value;
2582 		req.central_chan = ieee80211_frequency_to_channel(freq);
2583 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2584 		req.tx_stream = hweight8(mphy->antenna_mask);
2585 		req.rx_stream = mphy->antenna_mask;
2586 		break;
2587 	default:
2588 		return -EINVAL;
2589 	}
2590 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2591 
2592 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2593 				 &req, sizeof(req), false);
2594 }
2595 
2596 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2597 				     struct cfg80211_chan_def *chandef)
2598 {
2599 	struct mt7915_dev *dev = phy->dev;
2600 	int err, region;
2601 
2602 	if (!chandef) { /* disable offchain */
2603 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2604 					      0, 0);
2605 		if (err)
2606 			return err;
2607 
2608 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2609 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2610 	}
2611 
2612 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2613 					       CH_SWITCH_BACKGROUND_SCAN_START);
2614 	if (err)
2615 		return err;
2616 
2617 	switch (dev->mt76.region) {
2618 	case NL80211_DFS_ETSI:
2619 		region = 0;
2620 		break;
2621 	case NL80211_DFS_JP:
2622 		region = 2;
2623 		break;
2624 	case NL80211_DFS_FCC:
2625 	default:
2626 		region = 1;
2627 		break;
2628 	}
2629 
2630 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2631 				       0, region);
2632 }
2633 
2634 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2635 {
2636 	static const u8 ch_band[] = {
2637 		[NL80211_BAND_2GHZ] = 0,
2638 		[NL80211_BAND_5GHZ] = 1,
2639 		[NL80211_BAND_6GHZ] = 2,
2640 	};
2641 	struct mt7915_dev *dev = phy->dev;
2642 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2643 	int freq1 = chandef->center_freq1;
2644 	u8 band = phy->mt76->band_idx;
2645 	struct {
2646 		u8 control_ch;
2647 		u8 center_ch;
2648 		u8 bw;
2649 		u8 tx_path_num;
2650 		u8 rx_path;	/* mask or num */
2651 		u8 switch_reason;
2652 		u8 band_idx;
2653 		u8 center_ch2;	/* for 80+80 only */
2654 		__le16 cac_case;
2655 		u8 channel_band;
2656 		u8 rsv0;
2657 		__le32 outband_freq;
2658 		u8 txpower_drop;
2659 		u8 ap_bw;
2660 		u8 ap_center_ch;
2661 		u8 rsv1[57];
2662 	} __packed req = {
2663 		.control_ch = chandef->chan->hw_value,
2664 		.center_ch = ieee80211_frequency_to_channel(freq1),
2665 		.bw = mt76_connac_chan_bw(chandef),
2666 		.tx_path_num = hweight16(phy->mt76->chainmask),
2667 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2668 		.band_idx = band,
2669 		.channel_band = ch_band[chandef->chan->band],
2670 	};
2671 
2672 #ifdef CONFIG_NL80211_TESTMODE
2673 	if (phy->mt76->test.tx_antenna_mask &&
2674 	    mt76_testmode_enabled(phy->mt76)) {
2675 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2676 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2677 	}
2678 #endif
2679 
2680 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2681 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2682 
2683 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2684 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2685 		req.switch_reason = CH_SWITCH_NORMAL;
2686 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2687 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2688 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2689 					  NL80211_IFTYPE_AP))
2690 		req.switch_reason = CH_SWITCH_DFS;
2691 	else
2692 		req.switch_reason = CH_SWITCH_NORMAL;
2693 
2694 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2695 		req.rx_path = hweight8(req.rx_path);
2696 
2697 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2698 		int freq2 = chandef->center_freq2;
2699 
2700 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2701 	}
2702 
2703 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2704 }
2705 
2706 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2707 {
2708 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2709 #define PAGE_IDX_MASK		GENMASK(4, 2)
2710 #define PER_PAGE_SIZE		0x400
2711 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2712 	u16 eeprom_size = mt7915_eeprom_size(dev);
2713 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2714 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2715 	int eep_len;
2716 	int i;
2717 
2718 	for (i = 0; i < total; i++, eep += eep_len) {
2719 		struct sk_buff *skb;
2720 		int ret;
2721 
2722 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2723 			eep_len = eeprom_size % PER_PAGE_SIZE;
2724 		else
2725 			eep_len = PER_PAGE_SIZE;
2726 
2727 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2728 					 sizeof(req) + eep_len);
2729 		if (!skb)
2730 			return -ENOMEM;
2731 
2732 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2733 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2734 		req.len = cpu_to_le16(eep_len);
2735 
2736 		skb_put_data(skb, &req, sizeof(req));
2737 		skb_put_data(skb, eep, eep_len);
2738 
2739 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2740 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2741 		if (ret)
2742 			return ret;
2743 	}
2744 
2745 	return 0;
2746 }
2747 
2748 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2749 {
2750 	struct mt7915_mcu_eeprom req = {
2751 		.buffer_mode = EE_MODE_EFUSE,
2752 		.format = EE_FORMAT_WHOLE,
2753 	};
2754 
2755 	if (dev->flash_mode)
2756 		return mt7915_mcu_set_eeprom_flash(dev);
2757 
2758 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2759 				 &req, sizeof(req), true);
2760 }
2761 
2762 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2763 {
2764 	struct mt7915_mcu_eeprom_info req = {
2765 		.addr = cpu_to_le32(round_down(offset,
2766 				    MT7915_EEPROM_BLOCK_SIZE)),
2767 	};
2768 	struct mt7915_mcu_eeprom_info *res;
2769 	struct sk_buff *skb;
2770 	int ret;
2771 	u8 *buf;
2772 
2773 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2774 					MCU_EXT_QUERY(EFUSE_ACCESS),
2775 					&req, sizeof(req), true, &skb);
2776 	if (ret)
2777 		return ret;
2778 
2779 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2780 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2781 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2782 	dev_kfree_skb(skb);
2783 
2784 	return 0;
2785 }
2786 
2787 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2788 {
2789 	struct {
2790 		u8 _rsv;
2791 		u8 version;
2792 		u8 die_idx;
2793 		u8 _rsv2;
2794 	} __packed req = {
2795 		.version = 1,
2796 	};
2797 	struct sk_buff *skb;
2798 	int ret;
2799 
2800 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2801 					MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
2802 					&req, sizeof(req), true, &skb);
2803 	if (ret)
2804 		return ret;
2805 
2806 	*block_num = *(u8 *)skb->data;
2807 	dev_kfree_skb(skb);
2808 
2809 	return 0;
2810 }
2811 
2812 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2813 				  u8 *data, u32 len, int cmd)
2814 {
2815 	struct {
2816 		u8 dir;
2817 		u8 valid;
2818 		__le16 bitmap;
2819 		s8 precal;
2820 		u8 action;
2821 		u8 band;
2822 		u8 idx;
2823 		u8 rsv[4];
2824 		__le32 len;
2825 	} req = {};
2826 	struct sk_buff *skb;
2827 
2828 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2829 	if (!skb)
2830 		return -ENOMEM;
2831 
2832 	req.idx = idx;
2833 	req.len = cpu_to_le32(len);
2834 	skb_put_data(skb, &req, sizeof(req));
2835 	skb_put_data(skb, data, len);
2836 
2837 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2838 }
2839 
2840 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2841 {
2842 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2843 	u32 total = MT_EE_CAL_GROUP_SIZE;
2844 
2845 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
2846 		return 0;
2847 
2848 	/*
2849 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2850 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2851 	 */
2852 	while (total > 0) {
2853 		int ret, len;
2854 
2855 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2856 
2857 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2858 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2859 		if (ret)
2860 			return ret;
2861 
2862 		total -= len;
2863 		cal += len;
2864 		idx++;
2865 	}
2866 
2867 	return 0;
2868 }
2869 
2870 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2871 {
2872 	int i;
2873 
2874 	for (i = 0; i < n_freqs; i++)
2875 		if (cur == freqs[i])
2876 			return i;
2877 
2878 	return -1;
2879 }
2880 
2881 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
2882 {
2883 	static const u16 freq_list[] = {
2884 		5180, 5200, 5220, 5240,
2885 		5260, 5280, 5300, 5320,
2886 		5500, 5520, 5540, 5560,
2887 		5580, 5600, 5620, 5640,
2888 		5660, 5680, 5700, 5745,
2889 		5765, 5785, 5805, 5825
2890 	};
2891 	int offset_2g = ARRAY_SIZE(freq_list);
2892 	int idx;
2893 
2894 	if (freq < 4000) {
2895 		if (freq < 2432)
2896 			return offset_2g;
2897 		if (freq < 2457)
2898 			return offset_2g + 1;
2899 
2900 		return offset_2g + 2;
2901 	}
2902 
2903 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
2904 		return -1;
2905 
2906 	if (bw != NL80211_CHAN_WIDTH_20) {
2907 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2908 					   freq + 10);
2909 		if (idx >= 0)
2910 			return idx;
2911 
2912 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2913 					   freq - 10);
2914 		if (idx >= 0)
2915 			return idx;
2916 	}
2917 
2918 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2919 }
2920 
2921 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
2922 {
2923 	struct mt7915_dev *dev = phy->dev;
2924 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2925 	u16 total = 2, center_freq = chandef->center_freq1;
2926 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2927 	int idx;
2928 
2929 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
2930 		return 0;
2931 
2932 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
2933 	if (idx < 0)
2934 		return -EINVAL;
2935 
2936 	/* Items: Tx DPD, Tx Flatness */
2937 	idx = idx * 2;
2938 	cal += MT_EE_CAL_GROUP_SIZE;
2939 
2940 	while (total--) {
2941 		int ret;
2942 
2943 		cal += (idx * MT_EE_CAL_UNIT);
2944 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
2945 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
2946 		if (ret)
2947 			return ret;
2948 
2949 		idx++;
2950 	}
2951 
2952 	return 0;
2953 }
2954 
2955 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
2956 {
2957 	struct mt76_channel_state *state = phy->mt76->chan_state;
2958 	struct mt76_channel_state *state_ts = &phy->state_ts;
2959 	struct mt7915_dev *dev = phy->dev;
2960 	struct mt7915_mcu_mib *res, req[5];
2961 	struct sk_buff *skb;
2962 	static const u32 *offs;
2963 	int i, ret, len, offs_cc;
2964 	u64 cc_tx;
2965 
2966 	/* strict order */
2967 	if (is_mt7915(&dev->mt76)) {
2968 		static const u32 chip_offs[] = {
2969 			MIB_NON_WIFI_TIME,
2970 			MIB_TX_TIME,
2971 			MIB_RX_TIME,
2972 			MIB_OBSS_AIRTIME,
2973 			MIB_TXOP_INIT_COUNT,
2974 		};
2975 		len = ARRAY_SIZE(chip_offs);
2976 		offs = chip_offs;
2977 		offs_cc = 20;
2978 	} else {
2979 		static const u32 chip_offs[] = {
2980 			MIB_NON_WIFI_TIME_V2,
2981 			MIB_TX_TIME_V2,
2982 			MIB_RX_TIME_V2,
2983 			MIB_OBSS_AIRTIME_V2
2984 		};
2985 		len = ARRAY_SIZE(chip_offs);
2986 		offs = chip_offs;
2987 		offs_cc = 0;
2988 	}
2989 
2990 	for (i = 0; i < len; i++) {
2991 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
2992 		req[i].offs = cpu_to_le32(offs[i]);
2993 	}
2994 
2995 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
2996 					req, sizeof(req), true, &skb);
2997 	if (ret)
2998 		return ret;
2999 
3000 	res = (struct mt7915_mcu_mib *)(skb->data + offs_cc);
3001 
3002 #define __res_u64(s) le64_to_cpu(res[s].data)
3003 	/* subtract Tx backoff time from Tx duration */
3004 	cc_tx = is_mt7915(&dev->mt76) ? __res_u64(1) - __res_u64(4) : __res_u64(1);
3005 
3006 	if (chan_switch)
3007 		goto out;
3008 
3009 	state->cc_tx += cc_tx - state_ts->cc_tx;
3010 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3011 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3012 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3013 			  state_ts->cc_busy;
3014 
3015 out:
3016 	state_ts->cc_tx = cc_tx;
3017 	state_ts->cc_bss_rx = __res_u64(2);
3018 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3019 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3020 #undef __res_u64
3021 
3022 	dev_kfree_skb(skb);
3023 
3024 	return 0;
3025 }
3026 
3027 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3028 {
3029 	struct mt7915_dev *dev = phy->dev;
3030 	struct {
3031 		u8 ctrl_id;
3032 		u8 action;
3033 		u8 band_idx;
3034 		u8 rsv[5];
3035 	} req = {
3036 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3037 		.band_idx = phy->mt76->band_idx,
3038 	};
3039 
3040 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3041 				 sizeof(req), true);
3042 }
3043 
3044 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3045 {
3046 	struct mt7915_dev *dev = phy->dev;
3047 	struct mt7915_mcu_thermal_ctrl req = {
3048 		.band_idx = phy->mt76->band_idx,
3049 		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
3050 	};
3051 	int level, ret;
3052 
3053 	/* set duty cycle and level */
3054 	for (level = 0; level < 4; level++) {
3055 		req.duty.duty_level = level;
3056 		req.duty.duty_cycle = state;
3057 		state /= 2;
3058 
3059 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3060 					&req, sizeof(req), false);
3061 		if (ret)
3062 			return ret;
3063 	}
3064 	return 0;
3065 }
3066 
3067 int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
3068 {
3069 	struct mt7915_dev *dev = phy->dev;
3070 	struct {
3071 		struct mt7915_mcu_thermal_ctrl ctrl;
3072 
3073 		__le32 trigger_temp;
3074 		__le32 restore_temp;
3075 		__le16 sustain_time;
3076 		u8 rsv[2];
3077 	} __packed req = {
3078 		.ctrl = {
3079 			.band_idx = phy->mt76->band_idx,
3080 			.type.protect_type = 1,
3081 			.type.trigger_type = 1,
3082 		},
3083 	};
3084 	int ret;
3085 
3086 	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3087 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3088 				&req, sizeof(req.ctrl), false);
3089 
3090 	if (ret)
3091 		return ret;
3092 
3093 	/* set high-temperature trigger threshold */
3094 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3095 	/* add a safety margin ~10 */
3096 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3097 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3098 	req.sustain_time = cpu_to_le16(10);
3099 
3100 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3101 				 &req, sizeof(req), false);
3102 }
3103 
3104 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3105 {
3106 	struct mt7915_dev *dev = phy->dev;
3107 	struct {
3108 		u8 format_id;
3109 		u8 rsv;
3110 		u8 band_idx;
3111 		s8 txpower_min;
3112 	} __packed req = {
3113 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3114 		.band_idx = phy->mt76->band_idx,
3115 		.txpower_min = txpower * 2, /* 0.5db */
3116 	};
3117 
3118 	return mt76_mcu_send_msg(&dev->mt76,
3119 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3120 				 sizeof(req), true);
3121 }
3122 
3123 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3124 				 struct ieee80211_vif *vif,
3125 				 struct ieee80211_sta *sta, s8 txpower)
3126 {
3127 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3128 	struct mt7915_dev *dev = phy->dev;
3129 	struct mt76_phy *mphy = phy->mt76;
3130 	struct {
3131 		u8 format_id;
3132 		u8 rsv[3];
3133 		u8 band_idx;
3134 		s8 txpower_max;
3135 		__le16 wcid;
3136 		s8 txpower_offs[48];
3137 	} __packed req = {
3138 		.format_id = TX_POWER_LIMIT_FRAME,
3139 		.band_idx = phy->mt76->band_idx,
3140 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3141 		.wcid = cpu_to_le16(msta->wcid.idx),
3142 	};
3143 	int ret;
3144 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3145 
3146 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
3147 	if (ret)
3148 		return ret;
3149 
3150 	txpower = mt7915_get_power_bound(phy, txpower);
3151 	if (txpower > mphy->txpower_cur || txpower < 0)
3152 		return -EINVAL;
3153 
3154 	if (txpower) {
3155 		u32 offs, len, i;
3156 
3157 		if (sta->deflink.ht_cap.ht_supported) {
3158 			const u8 *sku_len = mt7915_sku_group_len;
3159 
3160 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3161 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3162 
3163 			if (sta->deflink.vht_cap.vht_supported) {
3164 				offs += len;
3165 				len = sku_len[SKU_VHT_BW20] * 4;
3166 
3167 				if (sta->deflink.he_cap.has_he) {
3168 					offs += len + sku_len[SKU_HE_RU26] * 3;
3169 					len = sku_len[SKU_HE_RU242] * 4;
3170 				}
3171 			}
3172 		} else {
3173 			return -EINVAL;
3174 		}
3175 
3176 		for (i = 0; i < len; i++, offs++)
3177 			req.txpower_offs[i] =
3178 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3179 	}
3180 
3181 	return mt76_mcu_send_msg(&dev->mt76,
3182 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3183 				 sizeof(req), true);
3184 }
3185 
3186 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3187 {
3188 	struct mt7915_dev *dev = phy->dev;
3189 	struct mt76_phy *mphy = phy->mt76;
3190 	struct ieee80211_hw *hw = mphy->hw;
3191 	struct mt7915_mcu_txpower_sku req = {
3192 		.format_id = TX_POWER_LIMIT_TABLE,
3193 		.band_idx = phy->mt76->band_idx,
3194 	};
3195 	struct mt76_power_limits limits_array;
3196 	s8 *la = (s8 *)&limits_array;
3197 	int i, idx;
3198 	int tx_power;
3199 
3200 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
3201 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3202 					      &limits_array, tx_power);
3203 	mphy->txpower_cur = tx_power;
3204 
3205 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3206 		u8 mcs_num, len = mt7915_sku_group_len[i];
3207 		int j;
3208 
3209 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3210 			mcs_num = 10;
3211 
3212 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3213 				la = (s8 *)&limits_array + 12;
3214 		} else {
3215 			mcs_num = len;
3216 		}
3217 
3218 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3219 			req.txpower_sku[idx + j] = la[j];
3220 
3221 		la += mcs_num;
3222 		idx += len;
3223 	}
3224 
3225 	return mt76_mcu_send_msg(&dev->mt76,
3226 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3227 				 sizeof(req), true);
3228 }
3229 
3230 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3231 {
3232 #define RATE_POWER_INFO	2
3233 	struct mt7915_dev *dev = phy->dev;
3234 	struct {
3235 		u8 format_id;
3236 		u8 category;
3237 		u8 band_idx;
3238 		u8 _rsv;
3239 	} __packed req = {
3240 		.format_id = TX_POWER_LIMIT_INFO,
3241 		.category = RATE_POWER_INFO,
3242 		.band_idx = phy->mt76->band_idx,
3243 	};
3244 	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
3245 	struct sk_buff *skb;
3246 	int ret, i;
3247 
3248 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3249 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3250 					&req, sizeof(req), true, &skb);
3251 	if (ret)
3252 		return ret;
3253 
3254 	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
3255 	for (i = 0; i < len; i++)
3256 		txpower[i] = txpower_sku[i][req.band_idx];
3257 
3258 	dev_kfree_skb(skb);
3259 
3260 	return 0;
3261 }
3262 
3263 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3264 			      u8 en)
3265 {
3266 	struct {
3267 		u8 test_mode_en;
3268 		u8 param_idx;
3269 		u8 _rsv[2];
3270 
3271 		u8 enable;
3272 		u8 _rsv2[3];
3273 
3274 		u8 pad[8];
3275 	} __packed req = {
3276 		.test_mode_en = test_mode,
3277 		.param_idx = param,
3278 		.enable = en,
3279 	};
3280 
3281 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3282 				 sizeof(req), false);
3283 }
3284 
3285 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3286 {
3287 	struct mt7915_dev *dev = phy->dev;
3288 	struct mt7915_sku {
3289 		u8 format_id;
3290 		u8 sku_enable;
3291 		u8 band_idx;
3292 		u8 rsv;
3293 	} __packed req = {
3294 		.format_id = TX_POWER_LIMIT_ENABLE,
3295 		.band_idx = phy->mt76->band_idx,
3296 		.sku_enable = enable,
3297 	};
3298 
3299 	return mt76_mcu_send_msg(&dev->mt76,
3300 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3301 				 sizeof(req), true);
3302 }
3303 
3304 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3305 {
3306 	struct {
3307 		u8 action;
3308 		u8 set;
3309 		u8 band;
3310 		u8 rsv;
3311 	} req = {
3312 		.action = action,
3313 		.set = set,
3314 		.band = band,
3315 	};
3316 
3317 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3318 				 &req, sizeof(req), false);
3319 }
3320 
3321 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3322 {
3323 	struct {
3324 		u8 action;
3325 		union {
3326 			struct {
3327 				u8 snd_mode;
3328 				u8 sta_num;
3329 				u8 rsv;
3330 				u8 wlan_idx[4];
3331 				__le32 snd_period;	/* ms */
3332 			} __packed snd;
3333 			struct {
3334 				bool ebf;
3335 				bool ibf;
3336 				u8 rsv;
3337 			} __packed type;
3338 			struct {
3339 				u8 bf_num;
3340 				u8 bf_bitmap;
3341 				u8 bf_sel[8];
3342 				u8 rsv[5];
3343 			} __packed mod;
3344 		};
3345 	} __packed req = {
3346 		.action = action,
3347 	};
3348 
3349 #define MT_BF_PROCESSING	4
3350 	switch (action) {
3351 	case MT_BF_SOUNDING_ON:
3352 		req.snd.snd_mode = MT_BF_PROCESSING;
3353 		break;
3354 	case MT_BF_TYPE_UPDATE:
3355 		req.type.ebf = true;
3356 		req.type.ibf = dev->ibf;
3357 		break;
3358 	case MT_BF_MODULE_UPDATE:
3359 		req.mod.bf_num = 2;
3360 		req.mod.bf_bitmap = GENMASK(1, 0);
3361 		break;
3362 	default:
3363 		return -EINVAL;
3364 	}
3365 
3366 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3367 				 sizeof(req), true);
3368 }
3369 
3370 static int
3371 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3372 {
3373 	struct mt7915_dev *dev = phy->dev;
3374 	struct mt7915_mcu_sr_ctrl req = {
3375 		.action = action,
3376 		.argnum = 1,
3377 		.band_idx = phy->mt76->band_idx,
3378 		.val = cpu_to_le32(val),
3379 	};
3380 
3381 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3382 				 sizeof(req), true);
3383 }
3384 
3385 static int
3386 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3387 			   struct ieee80211_he_obss_pd *he_obss_pd)
3388 {
3389 	struct mt7915_dev *dev = phy->dev;
3390 	struct {
3391 		struct mt7915_mcu_sr_ctrl ctrl;
3392 		struct {
3393 			u8 pd_th_non_srg;
3394 			u8 pd_th_srg;
3395 			u8 period_offs;
3396 			u8 rcpi_src;
3397 			__le16 obss_pd_min;
3398 			__le16 obss_pd_min_srg;
3399 			u8 resp_txpwr_mode;
3400 			u8 txpwr_restrict_mode;
3401 			u8 txpwr_ref;
3402 			u8 rsv[3];
3403 		} __packed param;
3404 	} __packed req = {
3405 		.ctrl = {
3406 			.action = SPR_SET_PARAM,
3407 			.argnum = 9,
3408 			.band_idx = phy->mt76->band_idx,
3409 		},
3410 	};
3411 	int ret;
3412 	u8 max_th = 82, non_srg_max_th = 62;
3413 
3414 	/* disable firmware dynamical PD asjustment */
3415 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3416 	if (ret)
3417 		return ret;
3418 
3419 	if (he_obss_pd->sr_ctrl &
3420 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3421 		req.param.pd_th_non_srg = max_th;
3422 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3423 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3424 	else
3425 		req.param.pd_th_non_srg  = non_srg_max_th;
3426 
3427 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3428 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3429 
3430 	req.param.obss_pd_min = cpu_to_le16(82);
3431 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3432 	req.param.txpwr_restrict_mode = 2;
3433 	req.param.txpwr_ref = 21;
3434 
3435 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3436 				 sizeof(req), true);
3437 }
3438 
3439 static int
3440 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3441 			     struct ieee80211_he_obss_pd *he_obss_pd)
3442 {
3443 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3444 	struct mt7915_dev *dev = phy->dev;
3445 	u8 omac = mvif->mt76.omac_idx;
3446 	struct {
3447 		struct mt7915_mcu_sr_ctrl ctrl;
3448 		struct {
3449 			u8 omac;
3450 			u8 rsv[3];
3451 			u8 flag[20];
3452 		} __packed siga;
3453 	} __packed req = {
3454 		.ctrl = {
3455 			.action = SPR_SET_SIGA,
3456 			.argnum = 1,
3457 			.band_idx = phy->mt76->band_idx,
3458 		},
3459 		.siga = {
3460 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3461 		},
3462 	};
3463 	int ret;
3464 
3465 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3466 		req.siga.flag[req.siga.omac] = 0xf;
3467 	else
3468 		return 0;
3469 
3470 	/* switch to normal AP mode */
3471 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3472 	if (ret)
3473 		return ret;
3474 
3475 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3476 				 sizeof(req), true);
3477 }
3478 
3479 static int
3480 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3481 			       struct ieee80211_he_obss_pd *he_obss_pd)
3482 {
3483 	struct mt7915_dev *dev = phy->dev;
3484 	struct {
3485 		struct mt7915_mcu_sr_ctrl ctrl;
3486 		struct {
3487 			__le32 color_l[2];
3488 			__le32 color_h[2];
3489 			__le32 bssid_l[2];
3490 			__le32 bssid_h[2];
3491 		} __packed bitmap;
3492 	} __packed req = {
3493 		.ctrl = {
3494 			.action = SPR_SET_SRG_BITMAP,
3495 			.argnum = 4,
3496 			.band_idx = phy->mt76->band_idx,
3497 		},
3498 	};
3499 	u32 bitmap;
3500 
3501 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3502 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3503 
3504 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3505 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3506 
3507 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3508 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3509 
3510 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3511 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3512 
3513 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3514 				 sizeof(req), true);
3515 }
3516 
3517 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3518 			    struct ieee80211_he_obss_pd *he_obss_pd)
3519 {
3520 	int ret;
3521 
3522 	/* enable firmware scene detection algorithms */
3523 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3524 	if (ret)
3525 		return ret;
3526 
3527 	/* firmware dynamically adjusts PD threshold so skip manual control */
3528 	if (sr_scene_detect && !he_obss_pd->enable)
3529 		return 0;
3530 
3531 	/* enable spatial reuse */
3532 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3533 	if (ret)
3534 		return ret;
3535 
3536 	if (sr_scene_detect || !he_obss_pd->enable)
3537 		return 0;
3538 
3539 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3540 	if (ret)
3541 		return ret;
3542 
3543 	/* set SRG/non-SRG OBSS PD threshold */
3544 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3545 	if (ret)
3546 		return ret;
3547 
3548 	/* Set SR prohibit */
3549 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3550 	if (ret)
3551 		return ret;
3552 
3553 	/* set SRG BSS color/BSSID bitmap */
3554 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3555 }
3556 
3557 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3558 			   struct ieee80211_sta *sta, struct rate_info *rate)
3559 {
3560 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3561 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3562 	struct mt7915_dev *dev = phy->dev;
3563 	struct mt76_phy *mphy = phy->mt76;
3564 	struct {
3565 		u8 category;
3566 		u8 band;
3567 		__le16 wcid;
3568 	} __packed req = {
3569 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3570 		.band = mvif->mt76.band_idx,
3571 		.wcid = cpu_to_le16(msta->wcid.idx),
3572 	};
3573 	struct ieee80211_supported_band *sband;
3574 	struct mt7915_mcu_phy_rx_info *res;
3575 	struct sk_buff *skb;
3576 	int ret;
3577 	bool cck = false;
3578 
3579 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3580 					&req, sizeof(req), true, &skb);
3581 	if (ret)
3582 		return ret;
3583 
3584 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3585 
3586 	rate->mcs = res->rate;
3587 	rate->nss = res->nsts + 1;
3588 
3589 	switch (res->mode) {
3590 	case MT_PHY_TYPE_CCK:
3591 		cck = true;
3592 		fallthrough;
3593 	case MT_PHY_TYPE_OFDM:
3594 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3595 			sband = &mphy->sband_5g.sband;
3596 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3597 			sband = &mphy->sband_6g.sband;
3598 		else
3599 			sband = &mphy->sband_2g.sband;
3600 
3601 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3602 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3603 		break;
3604 	case MT_PHY_TYPE_HT:
3605 	case MT_PHY_TYPE_HT_GF:
3606 		if (rate->mcs > 31) {
3607 			ret = -EINVAL;
3608 			goto out;
3609 		}
3610 
3611 		rate->flags = RATE_INFO_FLAGS_MCS;
3612 		if (res->gi)
3613 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3614 		break;
3615 	case MT_PHY_TYPE_VHT:
3616 		if (rate->mcs > 9) {
3617 			ret = -EINVAL;
3618 			goto out;
3619 		}
3620 
3621 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3622 		if (res->gi)
3623 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3624 		break;
3625 	case MT_PHY_TYPE_HE_SU:
3626 	case MT_PHY_TYPE_HE_EXT_SU:
3627 	case MT_PHY_TYPE_HE_TB:
3628 	case MT_PHY_TYPE_HE_MU:
3629 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3630 			ret = -EINVAL;
3631 			goto out;
3632 		}
3633 		rate->he_gi = res->gi;
3634 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3635 		break;
3636 	default:
3637 		ret = -EINVAL;
3638 		goto out;
3639 	}
3640 
3641 	switch (res->bw) {
3642 	case IEEE80211_STA_RX_BW_160:
3643 		rate->bw = RATE_INFO_BW_160;
3644 		break;
3645 	case IEEE80211_STA_RX_BW_80:
3646 		rate->bw = RATE_INFO_BW_80;
3647 		break;
3648 	case IEEE80211_STA_RX_BW_40:
3649 		rate->bw = RATE_INFO_BW_40;
3650 		break;
3651 	default:
3652 		rate->bw = RATE_INFO_BW_20;
3653 		break;
3654 	}
3655 
3656 out:
3657 	dev_kfree_skb(skb);
3658 
3659 	return ret;
3660 }
3661 
3662 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3663 				struct cfg80211_he_bss_color *he_bss_color)
3664 {
3665 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3666 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3667 	struct bss_info_color *bss_color;
3668 	struct sk_buff *skb;
3669 	struct tlv *tlv;
3670 
3671 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3672 					      NULL, len);
3673 	if (IS_ERR(skb))
3674 		return PTR_ERR(skb);
3675 
3676 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3677 				      sizeof(*bss_color));
3678 	bss_color = (struct bss_info_color *)tlv;
3679 	bss_color->disable = !he_bss_color->enabled;
3680 	bss_color->color = he_bss_color->color;
3681 
3682 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3683 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3684 }
3685 
3686 #define TWT_AGRT_TRIGGER	BIT(0)
3687 #define TWT_AGRT_ANNOUNCE	BIT(1)
3688 #define TWT_AGRT_PROTECT	BIT(2)
3689 
3690 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3691 			       struct mt7915_vif *mvif,
3692 			       struct mt7915_twt_flow *flow,
3693 			       int cmd)
3694 {
3695 	struct {
3696 		u8 tbl_idx;
3697 		u8 cmd;
3698 		u8 own_mac_idx;
3699 		u8 flowid; /* 0xff for group id */
3700 		__le16 peer_id; /* specify the peer_id (msb=0)
3701 				 * or group_id (msb=1)
3702 				 */
3703 		u8 duration; /* 256 us */
3704 		u8 bss_idx;
3705 		__le64 start_tsf;
3706 		__le16 mantissa;
3707 		u8 exponent;
3708 		u8 is_ap;
3709 		u8 agrt_params;
3710 		u8 rsv[23];
3711 	} __packed req = {
3712 		.tbl_idx = flow->table_id,
3713 		.cmd = cmd,
3714 		.own_mac_idx = mvif->mt76.omac_idx,
3715 		.flowid = flow->id,
3716 		.peer_id = cpu_to_le16(flow->wcid),
3717 		.duration = flow->duration,
3718 		.bss_idx = mvif->mt76.idx,
3719 		.start_tsf = cpu_to_le64(flow->tsf),
3720 		.mantissa = flow->mantissa,
3721 		.exponent = flow->exp,
3722 		.is_ap = true,
3723 	};
3724 
3725 	if (flow->protection)
3726 		req.agrt_params |= TWT_AGRT_PROTECT;
3727 	if (!flow->flowtype)
3728 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3729 	if (flow->trigger)
3730 		req.agrt_params |= TWT_AGRT_TRIGGER;
3731 
3732 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3733 				 &req, sizeof(req), true);
3734 }
3735 
3736 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3737 {
3738 	struct {
3739 		__le32 idx;
3740 		__le32 ofs;
3741 		__le32 data;
3742 	} __packed req = {
3743 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
3744 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
3745 		.data = set ? cpu_to_le32(*val) : 0,
3746 	};
3747 	struct sk_buff *skb;
3748 	int ret;
3749 
3750 	if (set)
3751 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3752 					 &req, sizeof(req), false);
3753 
3754 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3755 					&req, sizeof(req), true, &skb);
3756 	if (ret)
3757 		return ret;
3758 
3759 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3760 	dev_kfree_skb(skb);
3761 
3762 	return 0;
3763 }
3764