1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
70 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
71 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
72 
73 #define DL_MODE_ENCRYPT			BIT(0)
74 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
75 #define DL_MODE_RESET_SEC_IV		BIT(3)
76 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
77 #define DL_MODE_NEED_RSP		BIT(31)
78 
79 #define FW_START_OVERRIDE		BIT(0)
80 #define FW_START_WORKING_PDA_CR4	BIT(2)
81 
82 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
83 #define PATCH_SEC_TYPE_INFO		0x2
84 
85 #define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
86 #define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
87 
88 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
89 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
90 
91 static enum mt7915_cipher_type
92 mt7915_mcu_get_cipher(int cipher)
93 {
94 	switch (cipher) {
95 	case WLAN_CIPHER_SUITE_WEP40:
96 		return MT_CIPHER_WEP40;
97 	case WLAN_CIPHER_SUITE_WEP104:
98 		return MT_CIPHER_WEP104;
99 	case WLAN_CIPHER_SUITE_TKIP:
100 		return MT_CIPHER_TKIP;
101 	case WLAN_CIPHER_SUITE_AES_CMAC:
102 		return MT_CIPHER_BIP_CMAC_128;
103 	case WLAN_CIPHER_SUITE_CCMP:
104 		return MT_CIPHER_AES_CCMP;
105 	case WLAN_CIPHER_SUITE_CCMP_256:
106 		return MT_CIPHER_CCMP_256;
107 	case WLAN_CIPHER_SUITE_GCMP:
108 		return MT_CIPHER_GCMP;
109 	case WLAN_CIPHER_SUITE_GCMP_256:
110 		return MT_CIPHER_GCMP_256;
111 	case WLAN_CIPHER_SUITE_SMS4:
112 		return MT_CIPHER_WAPI;
113 	default:
114 		return MT_CIPHER_NONE;
115 	}
116 }
117 
118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
119 {
120 	static const u8 width_to_bw[] = {
121 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
122 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
123 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
124 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
125 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
126 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
127 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
128 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
129 	};
130 
131 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
132 		return 0;
133 
134 	return width_to_bw[chandef->width];
135 }
136 
137 static const struct ieee80211_sta_he_cap *
138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
139 {
140 	struct ieee80211_supported_band *sband;
141 	enum nl80211_band band;
142 
143 	band = phy->mt76->chandef.chan->band;
144 	sband = phy->mt76->hw->wiphy->bands[band];
145 
146 	return ieee80211_get_he_iftype_cap(sband, vif->type);
147 }
148 
149 static u8
150 mt7915_get_phy_mode(struct mt7915_dev *dev, struct ieee80211_vif *vif,
151 		    enum nl80211_band band, struct ieee80211_sta *sta)
152 {
153 	struct ieee80211_sta_ht_cap *ht_cap;
154 	struct ieee80211_sta_vht_cap *vht_cap;
155 	const struct ieee80211_sta_he_cap *he_cap;
156 	u8 mode = 0;
157 
158 	if (sta) {
159 		ht_cap = &sta->ht_cap;
160 		vht_cap = &sta->vht_cap;
161 		he_cap = &sta->he_cap;
162 	} else {
163 		struct ieee80211_supported_band *sband;
164 		struct mt7915_phy *phy;
165 		struct mt7915_vif *mvif;
166 
167 		mvif = (struct mt7915_vif *)vif->drv_priv;
168 		phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
169 		sband = phy->mt76->hw->wiphy->bands[band];
170 
171 		ht_cap = &sband->ht_cap;
172 		vht_cap = &sband->vht_cap;
173 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
174 	}
175 
176 	if (band == NL80211_BAND_2GHZ) {
177 		mode |= PHY_MODE_B | PHY_MODE_G;
178 
179 		if (ht_cap->ht_supported)
180 			mode |= PHY_MODE_GN;
181 
182 		if (he_cap->has_he)
183 			mode |= PHY_MODE_AX_24G;
184 	} else if (band == NL80211_BAND_5GHZ) {
185 		mode |= PHY_MODE_A;
186 
187 		if (ht_cap->ht_supported)
188 			mode |= PHY_MODE_AN;
189 
190 		if (vht_cap->vht_supported)
191 			mode |= PHY_MODE_AC;
192 
193 		if (he_cap->has_he)
194 			mode |= PHY_MODE_AX_5G;
195 	}
196 
197 	return mode;
198 }
199 
200 static u8
201 mt7915_mcu_get_sta_nss(u16 mcs_map)
202 {
203 	u8 nss;
204 
205 	for (nss = 8; nss > 0; nss--) {
206 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
207 
208 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
209 			break;
210 	}
211 
212 	return nss - 1;
213 }
214 
215 static int
216 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
217 			  struct sk_buff *skb, int seq)
218 {
219 	struct mt7915_mcu_rxd *rxd;
220 	int ret = 0;
221 
222 	if (!skb) {
223 		dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
224 			cmd, seq);
225 		return -ETIMEDOUT;
226 	}
227 
228 	rxd = (struct mt7915_mcu_rxd *)skb->data;
229 	if (seq != rxd->seq)
230 		return -EAGAIN;
231 
232 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
233 		skb_pull(skb, sizeof(*rxd) - 4);
234 		ret = *skb->data;
235 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
236 		skb_pull(skb, sizeof(*rxd) + 4);
237 		ret = le32_to_cpu(*(__le32 *)skb->data);
238 	} else {
239 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
240 	}
241 
242 	return ret;
243 }
244 
245 static int
246 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
247 			int cmd, int *wait_seq)
248 {
249 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
250 	struct mt7915_mcu_txd *mcu_txd;
251 	enum mt76_mcuq_id qid;
252 	__le32 *txd;
253 	u32 val;
254 	u8 seq;
255 
256 	/* TODO: make dynamic based on msg type */
257 	mdev->mcu.timeout = 20 * HZ;
258 
259 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
260 	if (!seq)
261 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
262 
263 	if (cmd == MCU_CMD(FW_SCATTER)) {
264 		qid = MT_MCUQ_FWDL;
265 		goto exit;
266 	}
267 
268 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
269 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
270 		qid = MT_MCUQ_WA;
271 	else
272 		qid = MT_MCUQ_WM;
273 
274 	txd = mcu_txd->txd;
275 
276 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
277 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
278 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
279 	txd[0] = cpu_to_le32(val);
280 
281 	val = MT_TXD1_LONG_FORMAT |
282 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
283 	txd[1] = cpu_to_le32(val);
284 
285 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
286 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
287 					       MT_TX_MCU_PORT_RX_Q0));
288 	mcu_txd->pkt_type = MCU_PKT_ID;
289 	mcu_txd->seq = seq;
290 
291 	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
292 	mcu_txd->set_query = MCU_Q_NA;
293 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
294 	if (mcu_txd->ext_cid) {
295 		mcu_txd->ext_cid_ack = 1;
296 
297 		/* do not use Q_SET for efuse */
298 		if (cmd & __MCU_CMD_FIELD_QUERY)
299 			mcu_txd->set_query = MCU_Q_QUERY;
300 		else
301 			mcu_txd->set_query = MCU_Q_SET;
302 	}
303 
304 	if (cmd & __MCU_CMD_FIELD_WA)
305 		mcu_txd->s2d_index = MCU_S2D_H2C;
306 	else
307 		mcu_txd->s2d_index = MCU_S2D_H2N;
308 
309 exit:
310 	if (wait_seq)
311 		*wait_seq = seq;
312 
313 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
314 }
315 
316 static void
317 mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
318 {
319 	struct {
320 		__le32 args[3];
321 	} req = {
322 		.args = {
323 			cpu_to_le32(a1),
324 			cpu_to_le32(a2),
325 			cpu_to_le32(a3),
326 		},
327 	};
328 
329 	mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
330 }
331 
332 static void
333 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
334 {
335 	if (vif->csa_active)
336 		ieee80211_csa_finish(vif);
337 }
338 
339 static void
340 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
341 {
342 	struct mt76_phy *mphy = &dev->mt76.phy;
343 	struct mt7915_mcu_rdd_report *r;
344 
345 	r = (struct mt7915_mcu_rdd_report *)skb->data;
346 
347 	if (r->idx && dev->mt76.phy2)
348 		mphy = dev->mt76.phy2;
349 
350 	ieee80211_radar_detected(mphy->hw);
351 	dev->hw_pattern++;
352 }
353 
354 static void
355 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
356 			 struct rate_info *rate, u16 r)
357 {
358 	struct ieee80211_supported_band *sband;
359 	u16 ru_idx = le16_to_cpu(ra->ru_idx);
360 	u16 flags = 0;
361 
362 	rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
363 	rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
364 
365 	switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
366 	case MT_PHY_TYPE_CCK:
367 	case MT_PHY_TYPE_OFDM:
368 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
369 			sband = &mphy->sband_5g.sband;
370 		else
371 			sband = &mphy->sband_2g.sband;
372 
373 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
374 		break;
375 	case MT_PHY_TYPE_HT:
376 	case MT_PHY_TYPE_HT_GF:
377 		rate->mcs += (rate->nss - 1) * 8;
378 		flags |= RATE_INFO_FLAGS_MCS;
379 
380 		if (ra->gi)
381 			flags |= RATE_INFO_FLAGS_SHORT_GI;
382 		break;
383 	case MT_PHY_TYPE_VHT:
384 		flags |= RATE_INFO_FLAGS_VHT_MCS;
385 
386 		if (ra->gi)
387 			flags |= RATE_INFO_FLAGS_SHORT_GI;
388 		break;
389 	case MT_PHY_TYPE_HE_SU:
390 	case MT_PHY_TYPE_HE_EXT_SU:
391 	case MT_PHY_TYPE_HE_TB:
392 	case MT_PHY_TYPE_HE_MU:
393 		rate->he_gi = ra->gi;
394 		rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
395 
396 		flags |= RATE_INFO_FLAGS_HE_MCS;
397 		break;
398 	default:
399 		break;
400 	}
401 	rate->flags = flags;
402 
403 	if (ru_idx) {
404 		switch (ru_idx) {
405 		case 1 ... 2:
406 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
407 			break;
408 		case 3 ... 6:
409 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
410 			break;
411 		case 7 ... 14:
412 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
413 			break;
414 		default:
415 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
416 			break;
417 		}
418 		rate->bw = RATE_INFO_BW_HE_RU;
419 	} else {
420 		u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
421 			FIELD_GET(MT_RA_RATE_BW, r);
422 
423 		switch (bw) {
424 		case IEEE80211_STA_RX_BW_160:
425 			rate->bw = RATE_INFO_BW_160;
426 			break;
427 		case IEEE80211_STA_RX_BW_80:
428 			rate->bw = RATE_INFO_BW_80;
429 			break;
430 		case IEEE80211_STA_RX_BW_40:
431 			rate->bw = RATE_INFO_BW_40;
432 			break;
433 		default:
434 			rate->bw = RATE_INFO_BW_20;
435 			break;
436 		}
437 	}
438 }
439 
440 static void
441 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
442 {
443 	struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
444 	struct rate_info rate = {}, prob_rate = {};
445 	u16 probe = le16_to_cpu(ra->prob_up_rate);
446 	u16 attempts = le16_to_cpu(ra->attempts);
447 	u16 curr = le16_to_cpu(ra->curr_rate);
448 	u16 wcidx = le16_to_cpu(ra->wlan_idx);
449 	struct mt76_phy *mphy = &dev->mphy;
450 	struct mt7915_sta_stats *stats;
451 	struct mt7915_sta *msta;
452 	struct mt76_wcid *wcid;
453 
454 	if (wcidx >= MT76_N_WCIDS)
455 		return;
456 
457 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
458 	if (!wcid)
459 		return;
460 
461 	msta = container_of(wcid, struct mt7915_sta, wcid);
462 	stats = &msta->stats;
463 
464 	if (msta->wcid.ext_phy && dev->mt76.phy2)
465 		mphy = dev->mt76.phy2;
466 
467 	/* current rate */
468 	mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr);
469 	stats->tx_rate = rate;
470 
471 	/* probing rate */
472 	mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe);
473 	stats->prob_rate = prob_rate;
474 
475 	if (attempts) {
476 		u16 success = le16_to_cpu(ra->success);
477 
478 		stats->per = 1000 * (attempts - success) / attempts;
479 	}
480 }
481 
482 static void
483 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
484 {
485 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
486 	const char *data = (char *)&rxd[1];
487 	const char *type;
488 
489 	switch (rxd->s2d_index) {
490 	case 0:
491 		type = "WM";
492 		break;
493 	case 2:
494 		type = "WA";
495 		break;
496 	default:
497 		type = "unknown";
498 		break;
499 	}
500 
501 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
502 }
503 
504 static void
505 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
506 {
507 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
508 
509 	switch (rxd->ext_eid) {
510 	case MCU_EXT_EVENT_RDD_REPORT:
511 		mt7915_mcu_rx_radar_detected(dev, skb);
512 		break;
513 	case MCU_EXT_EVENT_CSA_NOTIFY:
514 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
515 				IEEE80211_IFACE_ITER_RESUME_ALL,
516 				mt7915_mcu_csa_finish, dev);
517 		break;
518 	case MCU_EXT_EVENT_RATE_REPORT:
519 		mt7915_mcu_tx_rate_report(dev, skb);
520 		break;
521 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
522 		mt7915_mcu_rx_log_message(dev, skb);
523 		break;
524 	default:
525 		break;
526 	}
527 }
528 
529 static void
530 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
531 {
532 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
533 
534 	switch (rxd->eid) {
535 	case MCU_EVENT_EXT:
536 		mt7915_mcu_rx_ext_event(dev, skb);
537 		break;
538 	default:
539 		break;
540 	}
541 	dev_kfree_skb(skb);
542 }
543 
544 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
545 {
546 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
547 
548 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
549 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
550 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
551 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
552 	    rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
553 	    !rxd->seq)
554 		mt7915_mcu_rx_unsolicited_event(dev, skb);
555 	else
556 		mt76_mcu_rx_event(&dev->mt76, skb);
557 }
558 
559 static struct sk_buff *
560 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
561 			 struct mt7915_sta *msta, int len)
562 {
563 	struct sta_req_hdr hdr = {
564 		.bss_idx = mvif->idx,
565 		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
566 		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
567 		.muar_idx = msta ? mvif->omac_idx : 0,
568 		.is_tlv_append = 1,
569 	};
570 	struct sk_buff *skb;
571 
572 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
573 	if (!skb)
574 		return ERR_PTR(-ENOMEM);
575 
576 	skb_put_data(skb, &hdr, sizeof(hdr));
577 
578 	return skb;
579 }
580 
581 static struct wtbl_req_hdr *
582 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
583 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
584 {
585 	struct tlv *sta_hdr = sta_wtbl;
586 	struct wtbl_req_hdr hdr = {
587 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
588 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
589 		.operation = cmd,
590 	};
591 	struct sk_buff *nskb = *skb;
592 
593 	if (!nskb) {
594 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
595 					  MT7915_WTBL_UPDATE_BA_SIZE);
596 		if (!nskb)
597 			return ERR_PTR(-ENOMEM);
598 
599 		*skb = nskb;
600 	}
601 
602 	if (sta_hdr)
603 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
604 
605 	return skb_put_data(nskb, &hdr, sizeof(hdr));
606 }
607 
608 static struct tlv *
609 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
610 			  void *sta_ntlv, void *sta_wtbl)
611 {
612 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
613 	struct tlv *sta_hdr = sta_wtbl;
614 	struct tlv *ptlv, tlv = {
615 		.tag = cpu_to_le16(tag),
616 		.len = cpu_to_le16(len),
617 	};
618 	u16 ntlv;
619 
620 	ptlv = skb_put(skb, len);
621 	memcpy(ptlv, &tlv, sizeof(tlv));
622 
623 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
624 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
625 
626 	if (sta_hdr) {
627 		u16 size = le16_to_cpu(sta_hdr->len);
628 
629 		sta_hdr->len = cpu_to_le16(size + len);
630 	}
631 
632 	return ptlv;
633 }
634 
635 static struct tlv *
636 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
637 {
638 	return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
639 }
640 
641 static struct tlv *
642 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
643 			     __le16 *sub_ntlv, __le16 *len)
644 {
645 	struct tlv *ptlv, tlv = {
646 		.tag = cpu_to_le16(sub_tag),
647 		.len = cpu_to_le16(sub_len),
648 	};
649 
650 	ptlv = skb_put(skb, sub_len);
651 	memcpy(ptlv, &tlv, sizeof(tlv));
652 
653 	le16_add_cpu(sub_ntlv, 1);
654 	le16_add_cpu(len, sub_len);
655 
656 	return ptlv;
657 }
658 
659 /** bss info **/
660 static int
661 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
662 			 struct mt7915_phy *phy, bool enable)
663 {
664 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
665 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
666 	enum nl80211_band band = chandef->chan->band;
667 	struct bss_info_basic *bss;
668 	u16 wlan_idx = mvif->sta.wcid.idx;
669 	u32 type = NETWORK_INFRA;
670 	struct tlv *tlv;
671 
672 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
673 
674 	switch (vif->type) {
675 	case NL80211_IFTYPE_MESH_POINT:
676 	case NL80211_IFTYPE_AP:
677 	case NL80211_IFTYPE_MONITOR:
678 		break;
679 	case NL80211_IFTYPE_STATION:
680 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
681 		if (enable) {
682 			struct ieee80211_sta *sta;
683 			struct mt7915_sta *msta;
684 
685 			rcu_read_lock();
686 			sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
687 			if (!sta) {
688 				rcu_read_unlock();
689 				return -EINVAL;
690 			}
691 
692 			msta = (struct mt7915_sta *)sta->drv_priv;
693 			wlan_idx = msta->wcid.idx;
694 			rcu_read_unlock();
695 		}
696 		break;
697 	case NL80211_IFTYPE_ADHOC:
698 		type = NETWORK_IBSS;
699 		break;
700 	default:
701 		WARN_ON(1);
702 		break;
703 	}
704 
705 	bss = (struct bss_info_basic *)tlv;
706 	bss->network_type = cpu_to_le32(type);
707 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
708 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
709 	bss->wmm_idx = mvif->wmm_idx;
710 	bss->active = enable;
711 
712 	if (vif->type != NL80211_IFTYPE_MONITOR) {
713 		memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
714 		bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
715 		bss->dtim_period = vif->bss_conf.dtim_period;
716 		bss->phy_mode = mt7915_get_phy_mode(phy->dev, vif, band, NULL);
717 	} else {
718 		memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
719 	}
720 
721 	return 0;
722 }
723 
724 static void
725 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
726 {
727 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
728 	struct bss_info_omac *omac;
729 	struct tlv *tlv;
730 	u32 type = 0;
731 	u8 idx;
732 
733 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
734 
735 	switch (vif->type) {
736 	case NL80211_IFTYPE_MONITOR:
737 	case NL80211_IFTYPE_MESH_POINT:
738 	case NL80211_IFTYPE_AP:
739 		type = CONNECTION_INFRA_AP;
740 		break;
741 	case NL80211_IFTYPE_STATION:
742 		type = CONNECTION_INFRA_STA;
743 		break;
744 	case NL80211_IFTYPE_ADHOC:
745 		type = CONNECTION_IBSS_ADHOC;
746 		break;
747 	default:
748 		WARN_ON(1);
749 		break;
750 	}
751 
752 	omac = (struct bss_info_omac *)tlv;
753 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
754 	omac->conn_type = cpu_to_le32(type);
755 	omac->omac_idx = mvif->omac_idx;
756 	omac->band_idx = mvif->band_idx;
757 	omac->hw_bss_idx = idx;
758 }
759 
760 struct mt7915_he_obss_narrow_bw_ru_data {
761 	bool tolerated;
762 };
763 
764 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
765 						   struct cfg80211_bss *bss,
766 						   void *_data)
767 {
768 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
769 	const struct element *elem;
770 
771 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
772 
773 	if (!elem || elem->datalen < 10 ||
774 	    !(elem->data[10] &
775 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
776 		data->tolerated = false;
777 }
778 
779 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
780 					      struct ieee80211_vif *vif)
781 {
782 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
783 		.tolerated = true,
784 	};
785 
786 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
787 		return false;
788 
789 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
790 			  mt7915_check_he_obss_narrow_bw_ru_iter,
791 			  &iter_data);
792 
793 	/*
794 	 * If there is at least one AP on radar channel that cannot
795 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
796 	 */
797 	return !iter_data.tolerated;
798 }
799 
800 static void
801 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
802 			struct mt7915_phy *phy)
803 {
804 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
805 	struct bss_info_rf_ch *ch;
806 	struct tlv *tlv;
807 	int freq1 = chandef->center_freq1;
808 
809 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
810 
811 	ch = (struct bss_info_rf_ch *)tlv;
812 	ch->pri_ch = chandef->chan->hw_value;
813 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
814 	ch->bw = mt7915_mcu_chan_bw(chandef);
815 
816 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
817 		int freq2 = chandef->center_freq2;
818 
819 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
820 	}
821 
822 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
823 		struct mt7915_dev *dev = phy->dev;
824 		struct mt76_phy *mphy = &dev->mt76.phy;
825 		bool ext_phy = phy != &dev->phy;
826 
827 		if (ext_phy && dev->mt76.phy2)
828 			mphy = dev->mt76.phy2;
829 
830 		ch->he_ru26_block =
831 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
832 		ch->he_all_disable = false;
833 	} else {
834 		ch->he_all_disable = true;
835 	}
836 }
837 
838 static void
839 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
840 		      struct mt7915_phy *phy)
841 {
842 	int max_nss = hweight8(phy->mt76->chainmask);
843 	struct bss_info_ra *ra;
844 	struct tlv *tlv;
845 
846 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
847 
848 	ra = (struct bss_info_ra *)tlv;
849 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
850 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
851 	ra->short_preamble = true;
852 	ra->tx_streams = max_nss;
853 	ra->rx_streams = max_nss;
854 	ra->algo = 4;
855 	ra->train_up_rule = 2;
856 	ra->train_up_high_thres = 110;
857 	ra->train_up_rule_rssi = -70;
858 	ra->low_traffic_thres = 2;
859 	ra->phy_cap = cpu_to_le32(0xfdf);
860 	ra->interval = cpu_to_le32(500);
861 	ra->fast_interval = cpu_to_le32(100);
862 }
863 
864 static void
865 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
866 		      struct mt7915_phy *phy)
867 {
868 #define DEFAULT_HE_PE_DURATION		4
869 #define DEFAULT_HE_DURATION_RTS_THRES	1023
870 	const struct ieee80211_sta_he_cap *cap;
871 	struct bss_info_he *he;
872 	struct tlv *tlv;
873 
874 	cap = mt7915_get_he_phy_cap(phy, vif);
875 
876 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
877 
878 	he = (struct bss_info_he *)tlv;
879 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
880 	if (!he->he_pe_duration)
881 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
882 
883 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
884 	if (!he->he_rts_thres)
885 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
886 
887 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
888 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
889 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
890 }
891 
892 static void
893 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
894 {
895 #define TXD_CMP_MAP1		GENMASK(15, 0)
896 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
897 	struct bss_info_hw_amsdu *amsdu;
898 	struct tlv *tlv;
899 
900 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
901 
902 	amsdu = (struct bss_info_hw_amsdu *)tlv;
903 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
904 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
905 	amsdu->trig_thres = cpu_to_le16(2);
906 	amsdu->enable = true;
907 }
908 
909 static void
910 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
911 {
912 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
913 #define BCN_TX_ESTIMATE_TIME	(4096 + 20)
914 	struct bss_info_ext_bss *ext;
915 	int ext_bss_idx, tsf_offset;
916 	struct tlv *tlv;
917 
918 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
919 	if (ext_bss_idx < 0)
920 		return;
921 
922 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
923 
924 	ext = (struct bss_info_ext_bss *)tlv;
925 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
926 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
927 }
928 
929 static void
930 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
931 {
932 	struct bss_info_bmc_rate *bmc;
933 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
934 	enum nl80211_band band = chandef->chan->band;
935 	struct tlv *tlv;
936 
937 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
938 
939 	bmc = (struct bss_info_bmc_rate *)tlv;
940 	if (band == NL80211_BAND_2GHZ) {
941 		bmc->short_preamble = true;
942 	} else {
943 		bmc->bc_trans = cpu_to_le16(0x2000);
944 		bmc->mc_trans = cpu_to_le16(0x2080);
945 	}
946 }
947 
948 static int
949 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
950 		       bool bssid, bool enable)
951 {
952 	struct mt7915_dev *dev = phy->dev;
953 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
954 	u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
955 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
956 	const u8 *addr = vif->addr;
957 	struct {
958 		u8 mode;
959 		u8 force_clear;
960 		u8 clear_bitmap[8];
961 		u8 entry_count;
962 		u8 write;
963 		u8 band;
964 
965 		u8 index;
966 		u8 bssid;
967 		u8 addr[ETH_ALEN];
968 	} __packed req = {
969 		.mode = !!mask || enable,
970 		.entry_count = 1,
971 		.write = 1,
972 		.band = phy != &dev->phy,
973 		.index = idx * 2 + bssid,
974 	};
975 
976 	if (bssid)
977 		addr = vif->bss_conf.bssid;
978 
979 	if (enable)
980 		ether_addr_copy(req.addr, addr);
981 
982 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
983 				 sizeof(req), true);
984 }
985 
986 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
987 			    struct ieee80211_vif *vif, int enable)
988 {
989 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
990 	struct sk_buff *skb;
991 
992 	if (mvif->omac_idx >= REPEATER_BSSID_START)
993 		mt7915_mcu_muar_config(phy, vif, true, enable);
994 
995 	skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
996 				       MT7915_BSS_UPDATE_MAX_SIZE);
997 	if (IS_ERR(skb))
998 		return PTR_ERR(skb);
999 
1000 	/* bss_omac must be first */
1001 	if (enable)
1002 		mt7915_mcu_bss_omac_tlv(skb, vif);
1003 
1004 	mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1005 
1006 	if (vif->type == NL80211_IFTYPE_MONITOR)
1007 		goto out;
1008 
1009 	if (enable) {
1010 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1011 		mt7915_mcu_bss_bmc_tlv(skb, phy);
1012 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1013 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
1014 
1015 		if (vif->bss_conf.he_support)
1016 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
1017 
1018 		if (mvif->omac_idx >= EXT_BSSID_START &&
1019 		    mvif->omac_idx < REPEATER_BSSID_START)
1020 			mt7915_mcu_bss_ext_tlv(skb, mvif);
1021 	}
1022 out:
1023 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1024 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1025 }
1026 
1027 /** starec & wtbl **/
1028 static int
1029 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1030 		       struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1031 {
1032 	struct mt7915_sta_key_conf *bip = &msta->bip;
1033 	struct sta_rec_sec *sec;
1034 	struct tlv *tlv;
1035 	u32 len = sizeof(*sec);
1036 
1037 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1038 
1039 	sec = (struct sta_rec_sec *)tlv;
1040 	sec->add = cmd;
1041 
1042 	if (cmd == SET_KEY) {
1043 		struct sec_key *sec_key;
1044 		u8 cipher;
1045 
1046 		cipher = mt7915_mcu_get_cipher(key->cipher);
1047 		if (cipher == MT_CIPHER_NONE)
1048 			return -EOPNOTSUPP;
1049 
1050 		sec_key = &sec->key[0];
1051 		sec_key->cipher_len = sizeof(*sec_key);
1052 
1053 		if (cipher == MT_CIPHER_BIP_CMAC_128) {
1054 			sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1055 			sec_key->key_id = bip->keyidx;
1056 			sec_key->key_len = 16;
1057 			memcpy(sec_key->key, bip->key, 16);
1058 
1059 			sec_key = &sec->key[1];
1060 			sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1061 			sec_key->cipher_len = sizeof(*sec_key);
1062 			sec_key->key_len = 16;
1063 			memcpy(sec_key->key, key->key, 16);
1064 
1065 			sec->n_cipher = 2;
1066 		} else {
1067 			sec_key->cipher_id = cipher;
1068 			sec_key->key_id = key->keyidx;
1069 			sec_key->key_len = key->keylen;
1070 			memcpy(sec_key->key, key->key, key->keylen);
1071 
1072 			if (cipher == MT_CIPHER_TKIP) {
1073 				/* Rx/Tx MIC keys are swapped */
1074 				memcpy(sec_key->key + 16, key->key + 24, 8);
1075 				memcpy(sec_key->key + 24, key->key + 16, 8);
1076 			}
1077 
1078 			/* store key_conf for BIP batch update */
1079 			if (cipher == MT_CIPHER_AES_CCMP) {
1080 				memcpy(bip->key, key->key, key->keylen);
1081 				bip->keyidx = key->keyidx;
1082 			}
1083 
1084 			len -= sizeof(*sec_key);
1085 			sec->n_cipher = 1;
1086 		}
1087 	} else {
1088 		len -= sizeof(sec->key);
1089 		sec->n_cipher = 0;
1090 	}
1091 	sec->len = cpu_to_le16(len);
1092 
1093 	return 0;
1094 }
1095 
1096 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1097 		       struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1098 		       enum set_key_cmd cmd)
1099 {
1100 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1101 	struct sk_buff *skb;
1102 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1103 	int ret;
1104 
1105 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1106 	if (IS_ERR(skb))
1107 		return PTR_ERR(skb);
1108 
1109 	ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1110 	if (ret)
1111 		return ret;
1112 
1113 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1114 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1115 }
1116 
1117 static void
1118 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1119 		      struct ieee80211_ampdu_params *params,
1120 		      bool enable, bool tx)
1121 {
1122 	struct sta_rec_ba *ba;
1123 	struct tlv *tlv;
1124 
1125 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1126 
1127 	ba = (struct sta_rec_ba *)tlv;
1128 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1129 	ba->winsize = cpu_to_le16(params->buf_size);
1130 	ba->ssn = cpu_to_le16(params->ssn);
1131 	ba->ba_en = enable << params->tid;
1132 	ba->amsdu = params->amsdu;
1133 	ba->tid = params->tid;
1134 }
1135 
1136 static void
1137 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1138 		       struct ieee80211_ampdu_params *params,
1139 		       bool enable, bool tx, void *sta_wtbl,
1140 		       void *wtbl_tlv)
1141 {
1142 	struct wtbl_ba *ba;
1143 	struct tlv *tlv;
1144 
1145 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1146 					wtbl_tlv, sta_wtbl);
1147 
1148 	ba = (struct wtbl_ba *)tlv;
1149 	ba->tid = params->tid;
1150 
1151 	if (tx) {
1152 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1153 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1154 		ba->ba_en = enable;
1155 	} else {
1156 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1157 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1158 		ba->rst_ba_tid = params->tid;
1159 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1160 		ba->rst_ba_sb = 1;
1161 	}
1162 
1163 	if (enable && tx)
1164 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1165 }
1166 
1167 static int
1168 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1169 		  struct ieee80211_ampdu_params *params,
1170 		  bool enable, bool tx)
1171 {
1172 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1173 	struct mt7915_vif *mvif = msta->vif;
1174 	struct wtbl_req_hdr *wtbl_hdr;
1175 	struct tlv *sta_wtbl;
1176 	struct sk_buff *skb;
1177 	int ret;
1178 
1179 	if (enable && tx && !params->amsdu)
1180 		msta->wcid.amsdu = false;
1181 
1182 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1183 				       MT7915_STA_UPDATE_MAX_SIZE);
1184 	if (IS_ERR(skb))
1185 		return PTR_ERR(skb);
1186 
1187 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1188 
1189 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1190 					     &skb);
1191 	mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1192 
1193 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1194 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1195 	if (ret)
1196 		return ret;
1197 
1198 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1199 				       MT7915_STA_UPDATE_MAX_SIZE);
1200 	if (IS_ERR(skb))
1201 		return PTR_ERR(skb);
1202 
1203 	mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1204 
1205 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1206 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1207 }
1208 
1209 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1210 			 struct ieee80211_ampdu_params *params,
1211 			 bool enable)
1212 {
1213 	return mt7915_mcu_sta_ba(dev, params, enable, true);
1214 }
1215 
1216 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1217 			 struct ieee80211_ampdu_params *params,
1218 			 bool enable)
1219 {
1220 	return mt7915_mcu_sta_ba(dev, params, enable, false);
1221 }
1222 
1223 static void
1224 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1225 			    struct ieee80211_sta *sta, void *sta_wtbl,
1226 			    void *wtbl_tlv)
1227 {
1228 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1229 	struct wtbl_generic *generic;
1230 	struct wtbl_rx *rx;
1231 	struct tlv *tlv;
1232 
1233 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1234 					wtbl_tlv, sta_wtbl);
1235 
1236 	generic = (struct wtbl_generic *)tlv;
1237 
1238 	if (sta) {
1239 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1240 		generic->partial_aid = cpu_to_le16(sta->aid);
1241 		generic->muar_idx = mvif->omac_idx;
1242 		generic->qos = sta->wme;
1243 	} else {
1244 		/* use BSSID in station mode */
1245 		if (vif->type == NL80211_IFTYPE_STATION)
1246 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
1247 			       ETH_ALEN);
1248 		else
1249 			eth_broadcast_addr(generic->peer_addr);
1250 
1251 		generic->muar_idx = 0xe;
1252 	}
1253 
1254 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1255 					wtbl_tlv, sta_wtbl);
1256 
1257 	rx = (struct wtbl_rx *)tlv;
1258 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1259 	rx->rca2 = 1;
1260 	rx->rv = 1;
1261 }
1262 
1263 static void
1264 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1265 			 struct ieee80211_sta *sta, bool enable)
1266 {
1267 #define EXTRA_INFO_VER          BIT(0)
1268 #define EXTRA_INFO_NEW          BIT(1)
1269 	struct sta_rec_basic *basic;
1270 	struct tlv *tlv;
1271 
1272 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1273 
1274 	basic = (struct sta_rec_basic *)tlv;
1275 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1276 
1277 	if (enable) {
1278 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1279 		basic->conn_state = CONN_STATE_PORT_SECURE;
1280 	} else {
1281 		basic->conn_state = CONN_STATE_DISCONNECT;
1282 	}
1283 
1284 	if (!sta) {
1285 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1286 		eth_broadcast_addr(basic->peer_addr);
1287 		return;
1288 	}
1289 
1290 	switch (vif->type) {
1291 	case NL80211_IFTYPE_MESH_POINT:
1292 	case NL80211_IFTYPE_AP:
1293 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1294 		break;
1295 	case NL80211_IFTYPE_STATION:
1296 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1297 		break;
1298 	case NL80211_IFTYPE_ADHOC:
1299 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1300 		break;
1301 	default:
1302 		WARN_ON(1);
1303 		break;
1304 	}
1305 
1306 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1307 	basic->aid = cpu_to_le16(sta->aid);
1308 	basic->qos = sta->wme;
1309 }
1310 
1311 static void
1312 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1313 {
1314 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1315 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1316 	struct sta_rec_he *he;
1317 	struct tlv *tlv;
1318 	u32 cap = 0;
1319 
1320 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1321 
1322 	he = (struct sta_rec_he *)tlv;
1323 
1324 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1325 		cap |= STA_REC_HE_CAP_HTC;
1326 
1327 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1328 		cap |= STA_REC_HE_CAP_BSR;
1329 
1330 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1331 		cap |= STA_REC_HE_CAP_OM;
1332 
1333 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1334 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1335 
1336 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1337 		cap |= STA_REC_HE_CAP_BQR;
1338 
1339 	if (elem->phy_cap_info[0] &
1340 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1341 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1342 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1343 
1344 	if (elem->phy_cap_info[1] &
1345 	    IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1346 		cap |= STA_REC_HE_CAP_LDPC;
1347 
1348 	if (elem->phy_cap_info[1] &
1349 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1350 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1351 
1352 	if (elem->phy_cap_info[2] &
1353 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1354 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1355 
1356 	if (elem->phy_cap_info[2] &
1357 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1358 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1359 
1360 	if (elem->phy_cap_info[2] &
1361 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1362 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1363 
1364 	if (elem->phy_cap_info[6] &
1365 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1366 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1367 
1368 	if (elem->phy_cap_info[7] &
1369 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1370 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1371 
1372 	if (elem->phy_cap_info[7] &
1373 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1374 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1375 
1376 	if (elem->phy_cap_info[7] &
1377 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1378 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1379 
1380 	if (elem->phy_cap_info[8] &
1381 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1382 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1383 
1384 	if (elem->phy_cap_info[8] &
1385 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1386 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1387 
1388 	if (elem->phy_cap_info[9] &
1389 	    IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1390 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1391 
1392 	if (elem->phy_cap_info[9] &
1393 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1394 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1395 
1396 	if (elem->phy_cap_info[9] &
1397 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1398 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1399 
1400 	he->he_cap = cpu_to_le32(cap);
1401 
1402 	switch (sta->bandwidth) {
1403 	case IEEE80211_STA_RX_BW_160:
1404 		if (elem->phy_cap_info[0] &
1405 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1406 			he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1407 				he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1408 
1409 		he->max_nss_mcs[CMD_HE_MCS_BW160] =
1410 				he_cap->he_mcs_nss_supp.rx_mcs_160;
1411 		fallthrough;
1412 	default:
1413 		he->max_nss_mcs[CMD_HE_MCS_BW80] =
1414 				he_cap->he_mcs_nss_supp.rx_mcs_80;
1415 		break;
1416 	}
1417 
1418 	he->t_frame_dur =
1419 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1420 	he->max_ampdu_exp =
1421 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1422 
1423 	he->bw_set =
1424 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1425 	he->device_class =
1426 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1427 	he->punc_pream_rx =
1428 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1429 
1430 	he->dcm_tx_mode =
1431 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1432 	he->dcm_tx_max_nss =
1433 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1434 	he->dcm_rx_mode =
1435 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1436 	he->dcm_rx_max_nss =
1437 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1438 	he->dcm_rx_max_nss =
1439 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1440 
1441 	he->pkt_ext = 2;
1442 }
1443 
1444 static void
1445 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1446 		     struct ieee80211_vif *vif)
1447 {
1448 	struct sta_rec_uapsd *uapsd;
1449 	struct tlv *tlv;
1450 
1451 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1452 		return;
1453 
1454 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1455 	uapsd = (struct sta_rec_uapsd *)tlv;
1456 
1457 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1458 		uapsd->dac_map |= BIT(3);
1459 		uapsd->tac_map |= BIT(3);
1460 	}
1461 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1462 		uapsd->dac_map |= BIT(2);
1463 		uapsd->tac_map |= BIT(2);
1464 	}
1465 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1466 		uapsd->dac_map |= BIT(1);
1467 		uapsd->tac_map |= BIT(1);
1468 	}
1469 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1470 		uapsd->dac_map |= BIT(0);
1471 		uapsd->tac_map |= BIT(0);
1472 	}
1473 	uapsd->max_sp = sta->max_sp;
1474 }
1475 
1476 static void
1477 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1478 {
1479 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1480 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1481 	struct sta_rec_muru *muru;
1482 	struct tlv *tlv;
1483 
1484 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1485 
1486 	muru = (struct sta_rec_muru *)tlv;
1487 	muru->cfg.ofdma_dl_en = true;
1488 	muru->cfg.mimo_dl_en = true;
1489 
1490 	muru->ofdma_dl.punc_pream_rx =
1491 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1492 	muru->ofdma_dl.he_20m_in_40m_2g =
1493 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1494 	muru->ofdma_dl.he_20m_in_160m =
1495 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1496 	muru->ofdma_dl.he_80m_in_160m =
1497 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1498 	muru->ofdma_dl.lt16_sigb = 0;
1499 	muru->ofdma_dl.rx_su_comp_sigb = 0;
1500 	muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1501 
1502 	muru->ofdma_ul.t_frame_dur =
1503 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1504 	muru->ofdma_ul.mu_cascading =
1505 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1506 	muru->ofdma_ul.uo_ra =
1507 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1508 	muru->ofdma_ul.he_2x996_tone = 0;
1509 	muru->ofdma_ul.rx_t_frame_11ac = 0;
1510 
1511 	muru->mimo_dl.vht_mu_bfee =
1512 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1513 	muru->mimo_dl.partial_bw_dl_mimo =
1514 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1515 
1516 	muru->mimo_ul.full_ul_mimo =
1517 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1518 	muru->mimo_ul.partial_ul_mimo =
1519 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1520 }
1521 
1522 static int
1523 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1524 		  struct ieee80211_sta *sta)
1525 {
1526 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1527 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1528 	struct sk_buff *skb;
1529 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1530 
1531 	if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1532 		return 0;
1533 
1534 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1535 	if (IS_ERR(skb))
1536 		return PTR_ERR(skb);
1537 
1538 	/* starec muru */
1539 	mt7915_mcu_sta_muru_tlv(skb, sta);
1540 
1541 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1542 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1543 }
1544 
1545 static void
1546 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1547 {
1548 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1549 	struct sta_rec_amsdu *amsdu;
1550 	struct tlv *tlv;
1551 
1552 	if (!sta->max_amsdu_len)
1553 	    return;
1554 
1555 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1556 	amsdu = (struct sta_rec_amsdu *)tlv;
1557 	amsdu->max_amsdu_num = 8;
1558 	amsdu->amsdu_en = true;
1559 	amsdu->max_mpdu_size = sta->max_amsdu_len >=
1560 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
1561 	msta->wcid.amsdu = true;
1562 }
1563 
1564 static bool
1565 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1566 {
1567 	switch (vif->type) {
1568 	case NL80211_IFTYPE_AP:
1569 	case NL80211_IFTYPE_STATION:
1570 		return true;
1571 	default:
1572 		return false;
1573 	}
1574 }
1575 
1576 static void
1577 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1578 		   struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1579 {
1580 	struct tlv *tlv;
1581 
1582 	/* starec ht */
1583 	if (sta->ht_cap.ht_supported) {
1584 		struct sta_rec_ht *ht;
1585 
1586 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1587 		ht = (struct sta_rec_ht *)tlv;
1588 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1589 
1590 		if (mt7915_hw_amsdu_supported(vif))
1591 			mt7915_mcu_sta_amsdu_tlv(skb, sta);
1592 	}
1593 
1594 	/* starec vht */
1595 	if (sta->vht_cap.vht_supported) {
1596 		struct sta_rec_vht *vht;
1597 
1598 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1599 		vht = (struct sta_rec_vht *)tlv;
1600 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1601 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1602 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1603 	}
1604 
1605 	/* starec he */
1606 	if (sta->he_cap.has_he)
1607 		mt7915_mcu_sta_he_tlv(skb, sta);
1608 
1609 	/* starec uapsd */
1610 	mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1611 }
1612 
1613 static void
1614 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1615 			 void *sta_wtbl, void *wtbl_tlv)
1616 {
1617 	struct wtbl_smps *smps;
1618 	struct tlv *tlv;
1619 
1620 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1621 					wtbl_tlv, sta_wtbl);
1622 	smps = (struct wtbl_smps *)tlv;
1623 
1624 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1625 		smps->smps = true;
1626 }
1627 
1628 static void
1629 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1630 		       void *sta_wtbl, void *wtbl_tlv)
1631 {
1632 	struct wtbl_ht *ht = NULL;
1633 	struct tlv *tlv;
1634 
1635 	/* wtbl ht */
1636 	if (sta->ht_cap.ht_supported) {
1637 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1638 						wtbl_tlv, sta_wtbl);
1639 		ht = (struct wtbl_ht *)tlv;
1640 		ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1641 		ht->af = sta->ht_cap.ampdu_factor;
1642 		ht->mm = sta->ht_cap.ampdu_density;
1643 		ht->ht = true;
1644 	}
1645 
1646 	/* wtbl vht */
1647 	if (sta->vht_cap.vht_supported) {
1648 		struct wtbl_vht *vht;
1649 		u8 af;
1650 
1651 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1652 						wtbl_tlv, sta_wtbl);
1653 		vht = (struct wtbl_vht *)tlv;
1654 		vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1655 		vht->vht = true;
1656 
1657 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1658 			       sta->vht_cap.cap);
1659 		if (ht)
1660 			ht->af = max_t(u8, ht->af, af);
1661 	}
1662 
1663 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1664 }
1665 
1666 static void
1667 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1668 			      struct ieee80211_sta *sta,
1669 			      void *sta_wtbl, void *wtbl_tlv)
1670 {
1671 	struct mt7915_sta *msta;
1672 	struct wtbl_hdr_trans *htr = NULL;
1673 	struct tlv *tlv;
1674 
1675 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1676 					wtbl_tlv, sta_wtbl);
1677 	htr = (struct wtbl_hdr_trans *)tlv;
1678 	htr->no_rx_trans = true;
1679 	if (vif->type == NL80211_IFTYPE_STATION)
1680 		htr->to_ds = true;
1681 	else
1682 		htr->from_ds = true;
1683 
1684 	if (!sta)
1685 		return;
1686 
1687 	msta = (struct mt7915_sta *)sta->drv_priv;
1688 	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1689 		htr->to_ds = true;
1690 		htr->from_ds = true;
1691 	}
1692 }
1693 
1694 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1695 				    struct ieee80211_vif *vif,
1696 				    struct ieee80211_sta *sta)
1697 {
1698 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1699 	struct wtbl_req_hdr *wtbl_hdr;
1700 	struct sk_buff *skb;
1701 
1702 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1703 	if (!skb)
1704 		return -ENOMEM;
1705 
1706 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1707 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1708 
1709 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1710 				     true);
1711 }
1712 
1713 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1714 			struct ieee80211_sta *sta)
1715 {
1716 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1717 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1718 	struct wtbl_req_hdr *wtbl_hdr;
1719 	struct tlv *sta_wtbl;
1720 	struct sk_buff *skb;
1721 
1722 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1723 				       MT7915_STA_UPDATE_MAX_SIZE);
1724 	if (IS_ERR(skb))
1725 		return PTR_ERR(skb);
1726 
1727 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1728 
1729 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1730 					     &skb);
1731 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1732 
1733 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1734 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1735 }
1736 
1737 static void
1738 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1739 {
1740 	bf->bf_cap = MT_EBF;
1741 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1742 	bf->ndp_rate = 0;				/* mcs0 */
1743 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1744 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1745 }
1746 
1747 static void
1748 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1749 		       struct sta_rec_bf *bf)
1750 {
1751 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1752 	u8 n = 0;
1753 
1754 	bf->tx_mode = MT_PHY_TYPE_HT;
1755 	bf->bf_cap = MT_IBF;
1756 
1757 	if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1758 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1759 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1760 			      mcs->tx_params);
1761 	else if (mcs->rx_mask[3])
1762 		n = 3;
1763 	else if (mcs->rx_mask[2])
1764 		n = 2;
1765 	else if (mcs->rx_mask[1])
1766 		n = 1;
1767 
1768 	bf->nr = hweight8(phy->mt76->chainmask) - 1;
1769 	bf->nc = min_t(u8, bf->nr, n);
1770 	bf->ibf_ncol = n;
1771 }
1772 
1773 static void
1774 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1775 			struct sta_rec_bf *bf, bool explicit)
1776 {
1777 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1778 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1779 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1780 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1781 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1782 
1783 	bf->tx_mode = MT_PHY_TYPE_VHT;
1784 
1785 	if (explicit) {
1786 		u8 bfee_nr, bfer_nr;
1787 
1788 		mt7915_mcu_sta_sounding_rate(bf);
1789 		bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1790 				    pc->cap);
1791 		bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1792 				    vc->cap);
1793 		bf->nr = min_t(u8, min_t(u8, bfer_nr, bfee_nr), tx_ant);
1794 		bf->nc = min_t(u8, nss_mcs, bf->nr);
1795 		bf->ibf_ncol = bf->nc;
1796 
1797 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1798 			bf->nr = 1;
1799 	} else {
1800 		bf->bf_cap = MT_IBF;
1801 		bf->nr = tx_ant;
1802 		bf->nc = min_t(u8, nss_mcs, bf->nr);
1803 		bf->ibf_ncol = nss_mcs;
1804 
1805 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1806 			bf->ibf_nrow = 1;
1807 	}
1808 }
1809 
1810 static void
1811 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1812 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1813 {
1814 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1815 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1816 	const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1817 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1818 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1819 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1820 	u8 bfee_nr, bfer_nr;
1821 
1822 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1823 	mt7915_mcu_sta_sounding_rate(bf);
1824 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1825 				pe->phy_cap_info[6]);
1826 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1827 				pe->phy_cap_info[6]);
1828 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1829 			 ve->phy_cap_info[5]);
1830 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1831 			 pe->phy_cap_info[4]);
1832 	bf->nr = min_t(u8, bfer_nr, bfee_nr);
1833 	bf->nc = min_t(u8, nss_mcs, bf->nr);
1834 	bf->ibf_ncol = bf->nc;
1835 
1836 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1837 		return;
1838 
1839 	/* go over for 160MHz and 80p80 */
1840 	if (pe->phy_cap_info[0] &
1841 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1842 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1843 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1844 
1845 		bf->nc_bw160 = nss_mcs;
1846 	}
1847 
1848 	if (pe->phy_cap_info[0] &
1849 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1850 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1851 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1852 
1853 		if (bf->nc_bw160)
1854 			bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1855 		else
1856 			bf->nc_bw160 = nss_mcs;
1857 	}
1858 
1859 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1860 			 ve->phy_cap_info[5]);
1861 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1862 			 pe->phy_cap_info[4]);
1863 
1864 	bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1865 }
1866 
1867 static void
1868 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1869 			struct ieee80211_vif *vif, struct mt7915_phy *phy,
1870 			bool enable, bool explicit)
1871 {
1872 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1873 	struct sta_rec_bf *bf;
1874 	struct tlv *tlv;
1875 	const u8 matrix[4][4] = {
1876 		{0, 0, 0, 0},
1877 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1878 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1879 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1880 	};
1881 
1882 #define MT_BFER_FREE		cpu_to_le16(GENMASK(15, 0))
1883 
1884 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1885 	bf = (struct sta_rec_bf *)tlv;
1886 
1887 	if (!enable) {
1888 		bf->pfmu = MT_BFER_FREE;
1889 		return;
1890 	}
1891 
1892 	/* he: eBF only, in accordance with spec
1893 	 * vht: support eBF and iBF
1894 	 * ht: iBF only, since mac80211 lacks of eBF support
1895 	 */
1896 	if (sta->he_cap.has_he && explicit)
1897 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1898 	else if (sta->vht_cap.vht_supported)
1899 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, explicit);
1900 	else if (sta->ht_cap.ht_supported)
1901 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1902 	else
1903 		return;
1904 
1905 	bf->bw = sta->bandwidth;
1906 	bf->ibf_dbw = sta->bandwidth;
1907 	bf->ibf_nrow = tx_ant;
1908 
1909 	if (!explicit && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1910 		bf->ibf_timeout = 0x48;
1911 	else
1912 		bf->ibf_timeout = 0x18;
1913 
1914 	if (explicit && bf->nr != tx_ant)
1915 		bf->mem_20m = matrix[tx_ant][bf->nc];
1916 	else
1917 		bf->mem_20m = matrix[bf->nr][bf->nc];
1918 
1919 	switch (sta->bandwidth) {
1920 	case IEEE80211_STA_RX_BW_160:
1921 	case IEEE80211_STA_RX_BW_80:
1922 		bf->mem_total = bf->mem_20m * 2;
1923 		break;
1924 	case IEEE80211_STA_RX_BW_40:
1925 		bf->mem_total = bf->mem_20m;
1926 		break;
1927 	case IEEE80211_STA_RX_BW_20:
1928 	default:
1929 		break;
1930 	}
1931 }
1932 
1933 static void
1934 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1935 			struct mt7915_phy *phy)
1936 {
1937 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1938 	struct sta_rec_bfee *bfee;
1939 	struct tlv *tlv;
1940 	u8 nr = 0;
1941 
1942 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1943 	bfee = (struct sta_rec_bfee *)tlv;
1944 
1945 	if (sta->he_cap.has_he) {
1946 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1947 
1948 		nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1949 			    pe->phy_cap_info[5]);
1950 	} else if (sta->vht_cap.vht_supported) {
1951 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1952 
1953 		nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1954 			       pc->cap);
1955 	}
1956 
1957 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1958 	bfee->fb_identity_matrix = !!(nr == 1 && tx_ant == 2);
1959 }
1960 
1961 static int
1962 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1963 		    struct ieee80211_sta *sta, bool enable)
1964 {
1965 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1966 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1967 	struct mt7915_phy *phy;
1968 	struct sk_buff *skb;
1969 	int r, len;
1970 	bool ebfee = 0, ebf = 0;
1971 
1972 	if (vif->type != NL80211_IFTYPE_STATION &&
1973 	    vif->type != NL80211_IFTYPE_AP)
1974 		return 0;
1975 
1976 	phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1977 
1978 	if (sta->he_cap.has_he) {
1979 		struct ieee80211_he_cap_elem *pe;
1980 		const struct ieee80211_he_cap_elem *ve;
1981 		const struct ieee80211_sta_he_cap *vc;
1982 
1983 		pe = &sta->he_cap.he_cap_elem;
1984 		vc = mt7915_get_he_phy_cap(phy, vif);
1985 		ve = &vc->he_cap_elem;
1986 
1987 		ebfee = !!((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
1988 			    HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
1989 			   HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]));
1990 		ebf = !!((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
1991 			  HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
1992 			 HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]));
1993 	} else if (sta->vht_cap.vht_supported) {
1994 		struct ieee80211_sta_vht_cap *pc;
1995 		struct ieee80211_sta_vht_cap *vc;
1996 		u32 cr, ce;
1997 
1998 		pc = &sta->vht_cap;
1999 		vc = &phy->mt76->sband_5g.sband.vht_cap;
2000 		cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2001 		     IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
2002 		ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2003 		     IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
2004 
2005 		ebfee = !!((pc->cap & cr) && (vc->cap & ce));
2006 		ebf = !!((vc->cap & cr) && (pc->cap & ce));
2007 	}
2008 
2009 	/* must keep each tag independent */
2010 
2011 	/* starec bf */
2012 	if (ebf || dev->ibf) {
2013 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2014 
2015 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2016 		if (IS_ERR(skb))
2017 			return PTR_ERR(skb);
2018 
2019 		mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable, ebf);
2020 
2021 		r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2022 					  MCU_EXT_CMD(STA_REC_UPDATE), true);
2023 		if (r)
2024 			return r;
2025 	}
2026 
2027 	/* starec bfee */
2028 	if (ebfee) {
2029 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2030 
2031 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2032 		if (IS_ERR(skb))
2033 			return PTR_ERR(skb);
2034 
2035 		mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2036 
2037 		r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2038 					  MCU_EXT_CMD(STA_REC_UPDATE), true);
2039 		if (r)
2040 			return r;
2041 	}
2042 
2043 	return 0;
2044 }
2045 
2046 static void
2047 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2048 			     struct ieee80211_vif *vif,
2049 			     struct ieee80211_sta *sta)
2050 {
2051 	struct cfg80211_chan_def *chandef = &dev->mphy.chandef;
2052 	struct sta_rec_ra *ra;
2053 	struct tlv *tlv;
2054 	enum nl80211_band band = chandef->chan->band;
2055 	u32 supp_rate = sta->supp_rates[band];
2056 	int n_rates = hweight32(supp_rate);
2057 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
2058 	u8 i, nss = sta->rx_nss, mcs = 0;
2059 
2060 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2061 
2062 	ra = (struct sta_rec_ra *)tlv;
2063 	ra->valid = true;
2064 	ra->auto_rate = true;
2065 	ra->phy_mode = mt7915_get_phy_mode(dev, vif, band, sta);
2066 	ra->channel = chandef->chan->hw_value;
2067 	ra->bw = sta->bandwidth;
2068 	ra->rate_len = n_rates;
2069 	ra->phy.bw = sta->bandwidth;
2070 
2071 	if (n_rates) {
2072 		if (band == NL80211_BAND_2GHZ) {
2073 			ra->supp_mode = MODE_CCK;
2074 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2075 			ra->phy.type = MT_PHY_TYPE_CCK;
2076 
2077 			if (n_rates > 4) {
2078 				ra->supp_mode |= MODE_OFDM;
2079 				ra->supp_ofdm_rate = supp_rate >> 4;
2080 				ra->phy.type = MT_PHY_TYPE_OFDM;
2081 			}
2082 		} else {
2083 			ra->supp_mode = MODE_OFDM;
2084 			ra->supp_ofdm_rate = supp_rate;
2085 			ra->phy.type = MT_PHY_TYPE_OFDM;
2086 		}
2087 	}
2088 
2089 	if (sta->ht_cap.ht_supported) {
2090 		for (i = 0; i < nss; i++)
2091 			ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2092 
2093 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2094 		ra->supp_mode |= MODE_HT;
2095 		mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2096 		ra->af = sta->ht_cap.ampdu_factor;
2097 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2098 
2099 		cap |= STA_CAP_HT;
2100 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2101 			cap |= STA_CAP_SGI_20;
2102 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2103 			cap |= STA_CAP_SGI_40;
2104 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2105 			cap |= STA_CAP_TX_STBC;
2106 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2107 			cap |= STA_CAP_RX_STBC;
2108 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2109 			cap |= STA_CAP_LDPC;
2110 	}
2111 
2112 	if (sta->vht_cap.vht_supported) {
2113 		u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2114 		u16 vht_mcs;
2115 		u8 af, mcs_prev;
2116 
2117 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2118 			       sta->vht_cap.cap);
2119 		ra->af = max_t(u8, ra->af, af);
2120 
2121 		cap |= STA_CAP_VHT;
2122 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2123 			cap |= STA_CAP_VHT_SGI_80;
2124 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2125 			cap |= STA_CAP_VHT_SGI_160;
2126 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2127 			cap |= STA_CAP_VHT_TX_STBC;
2128 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2129 			cap |= STA_CAP_VHT_RX_STBC;
2130 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2131 			cap |= STA_CAP_VHT_LDPC;
2132 
2133 		ra->supp_mode |= MODE_VHT;
2134 		for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2135 			switch (mcs_map & 0x3) {
2136 			case IEEE80211_VHT_MCS_SUPPORT_0_9:
2137 				vht_mcs = GENMASK(9, 0);
2138 				break;
2139 			case IEEE80211_VHT_MCS_SUPPORT_0_8:
2140 				vht_mcs = GENMASK(8, 0);
2141 				break;
2142 			case IEEE80211_VHT_MCS_SUPPORT_0_7:
2143 				vht_mcs = GENMASK(7, 0);
2144 				break;
2145 			default:
2146 				vht_mcs = 0;
2147 			}
2148 
2149 			ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2150 
2151 			mcs_prev = hweight16(vht_mcs) - 1;
2152 			if (mcs_prev > mcs)
2153 				mcs = mcs_prev;
2154 
2155 			/* only support 2ss on 160MHz */
2156 			if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2157 				      ra->bw == CMD_CBW_8080MHZ))
2158 				break;
2159 		}
2160 	}
2161 
2162 	if (sta->he_cap.has_he) {
2163 		ra->supp_mode |= MODE_HE;
2164 		cap |= STA_CAP_HE;
2165 	}
2166 
2167 	ra->sta_status = cpu_to_le32(cap);
2168 
2169 	switch (BIT(fls(ra->supp_mode) - 1)) {
2170 	case MODE_VHT:
2171 		ra->phy.type = MT_PHY_TYPE_VHT;
2172 		ra->phy.mcs = mcs;
2173 		ra->phy.nss = nss;
2174 		ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2175 		ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2176 		ra->phy.sgi =
2177 			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2178 		break;
2179 	case MODE_HT:
2180 		ra->phy.type = MT_PHY_TYPE_HT;
2181 		ra->phy.mcs = mcs;
2182 		ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2183 		ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2184 		ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2185 		break;
2186 	default:
2187 		break;
2188 	}
2189 }
2190 
2191 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2192 			     struct ieee80211_sta *sta)
2193 {
2194 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2195 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2196 	struct sk_buff *skb;
2197 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2198 
2199 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2200 	if (IS_ERR(skb))
2201 		return PTR_ERR(skb);
2202 
2203 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2204 
2205 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2206 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2207 }
2208 
2209 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2210 			   struct ieee80211_sta *sta, bool enable)
2211 {
2212 	int ret;
2213 
2214 	if (!sta)
2215 		return 0;
2216 
2217 	/* must keep the order */
2218 	ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2219 	if (ret)
2220 		return ret;
2221 
2222 	ret = mt7915_mcu_add_mu(dev, vif, sta);
2223 	if (ret)
2224 		return ret;
2225 
2226 	if (enable)
2227 		return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2228 
2229 	return 0;
2230 }
2231 
2232 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2233 		       struct ieee80211_sta *sta, bool enable)
2234 {
2235 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2236 	struct wtbl_req_hdr *wtbl_hdr;
2237 	struct mt7915_sta *msta;
2238 	struct tlv *sta_wtbl;
2239 	struct sk_buff *skb;
2240 
2241 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2242 
2243 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2244 				       MT7915_STA_UPDATE_MAX_SIZE);
2245 	if (IS_ERR(skb))
2246 		return PTR_ERR(skb);
2247 
2248 	mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2249 	if (enable && sta)
2250 		mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2251 
2252 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2253 
2254 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2255 					     sta_wtbl, &skb);
2256 	if (enable) {
2257 		mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2258 		mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2259 		if (sta)
2260 			mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2261 	}
2262 
2263 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2264 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2265 }
2266 
2267 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2268 			      struct ieee80211_sta *sta, u32 rate)
2269 {
2270 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2271 	struct mt7915_vif *mvif = msta->vif;
2272 	struct sta_rec_ra_fixed *ra;
2273 	struct sk_buff *skb;
2274 	struct tlv *tlv;
2275 	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2276 
2277 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2278 	if (IS_ERR(skb))
2279 		return PTR_ERR(skb);
2280 
2281 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2282 	ra = (struct sta_rec_ra_fixed *)tlv;
2283 
2284 	if (!rate) {
2285 		ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2286 		goto out;
2287 	} else {
2288 		ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2289 	}
2290 
2291 	ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2292 	ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2293 	ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2294 	ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2295 	ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2296 
2297 	if (ra->phy.bw)
2298 		ra->phy.ldpc = 7;
2299 	else
2300 		ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2301 
2302 	/* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2303 	if (ra->phy.type > MT_PHY_TYPE_VHT)
2304 		ra->phy.sgi = ra->phy.mcs * 85;
2305 	else
2306 		ra->phy.sgi = ra->phy.mcs * 15;
2307 
2308 out:
2309 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2310 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2311 }
2312 
2313 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2314 			    struct ieee80211_vif *vif, bool enable)
2315 {
2316 	struct mt7915_dev *dev = phy->dev;
2317 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2318 	struct {
2319 		struct req_hdr {
2320 			u8 omac_idx;
2321 			u8 dbdc_idx;
2322 			__le16 tlv_num;
2323 			u8 is_tlv_append;
2324 			u8 rsv[3];
2325 		} __packed hdr;
2326 		struct req_tlv {
2327 			__le16 tag;
2328 			__le16 len;
2329 			u8 active;
2330 			u8 dbdc_idx;
2331 			u8 omac_addr[ETH_ALEN];
2332 		} __packed tlv;
2333 	} data = {
2334 		.hdr = {
2335 			.omac_idx = mvif->omac_idx,
2336 			.dbdc_idx = mvif->band_idx,
2337 			.tlv_num = cpu_to_le16(1),
2338 			.is_tlv_append = 1,
2339 		},
2340 		.tlv = {
2341 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2342 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2343 			.active = enable,
2344 			.dbdc_idx = mvif->band_idx,
2345 		},
2346 	};
2347 
2348 	if (mvif->omac_idx >= REPEATER_BSSID_START)
2349 		return mt7915_mcu_muar_config(phy, vif, false, enable);
2350 
2351 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2352 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2353 				 &data, sizeof(data), true);
2354 }
2355 
2356 static void
2357 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2358 		      struct bss_info_bcn *bcn,
2359 		      struct ieee80211_mutable_offsets *offs)
2360 {
2361 	if (offs->cntdwn_counter_offs[0]) {
2362 		struct tlv *tlv;
2363 		struct bss_info_bcn_csa *csa;
2364 
2365 		tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2366 						   sizeof(*csa), &bcn->sub_ntlv,
2367 						   &bcn->len);
2368 		csa = (struct bss_info_bcn_csa *)tlv;
2369 		csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2370 	}
2371 }
2372 
2373 static void
2374 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2375 		       struct sk_buff *skb, struct bss_info_bcn *bcn,
2376 		       struct ieee80211_mutable_offsets *offs)
2377 {
2378 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2379 	struct bss_info_bcn_cont *cont;
2380 	struct tlv *tlv;
2381 	u8 *buf;
2382 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2383 
2384 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2385 					   len, &bcn->sub_ntlv, &bcn->len);
2386 
2387 	cont = (struct bss_info_bcn_cont *)tlv;
2388 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2389 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2390 
2391 	if (offs->cntdwn_counter_offs[0])
2392 		cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2393 
2394 	buf = (u8 *)tlv + sizeof(*cont);
2395 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2396 			      true);
2397 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2398 }
2399 
2400 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2401 			  struct ieee80211_vif *vif, int en)
2402 {
2403 #define MAX_BEACON_SIZE 512
2404 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2405 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2406 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2407 	struct ieee80211_mutable_offsets offs;
2408 	struct ieee80211_tx_info *info;
2409 	struct sk_buff *skb, *rskb;
2410 	struct tlv *tlv;
2411 	struct bss_info_bcn *bcn;
2412 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2413 
2414 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2415 	if (!skb)
2416 		return -EINVAL;
2417 
2418 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2419 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2420 		dev_kfree_skb(skb);
2421 		return -EINVAL;
2422 	}
2423 
2424 	rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2425 	if (IS_ERR(rskb)) {
2426 		dev_kfree_skb(skb);
2427 		return PTR_ERR(rskb);
2428 	}
2429 
2430 	tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2431 	bcn = (struct bss_info_bcn *)tlv;
2432 	bcn->enable = en;
2433 
2434 	if (mvif->band_idx) {
2435 		info = IEEE80211_SKB_CB(skb);
2436 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2437 	}
2438 
2439 	/* TODO: subtag - bss color count & 11v MBSSID */
2440 	mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2441 	mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2442 	dev_kfree_skb(skb);
2443 
2444 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2445 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2446 }
2447 
2448 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2449 				     u32 option)
2450 {
2451 	struct {
2452 		__le32 option;
2453 		__le32 addr;
2454 	} req = {
2455 		.option = cpu_to_le32(option),
2456 		.addr = cpu_to_le32(addr),
2457 	};
2458 
2459 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2460 				 sizeof(req), true);
2461 }
2462 
2463 static int mt7915_mcu_restart(struct mt76_dev *dev)
2464 {
2465 	struct {
2466 		u8 power_mode;
2467 		u8 rsv[3];
2468 	} req = {
2469 		.power_mode = 1,
2470 	};
2471 
2472 	return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2473 				 sizeof(req), false);
2474 }
2475 
2476 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2477 {
2478 	struct {
2479 		__le32 op;
2480 	} req = {
2481 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2482 	};
2483 
2484 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2485 				 sizeof(req), true);
2486 }
2487 
2488 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2489 {
2490 	struct {
2491 		u8 check_crc;
2492 		u8 reserved[3];
2493 	} req = {
2494 		.check_crc = 0,
2495 	};
2496 
2497 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2498 				 sizeof(req), true);
2499 }
2500 
2501 static int mt7915_driver_own(struct mt7915_dev *dev)
2502 {
2503 	u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2504 
2505 	mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2506 	if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2507 			    0, 500)) {
2508 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2509 		return -EIO;
2510 	}
2511 
2512 	return 0;
2513 }
2514 
2515 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2516 				    u32 len, u32 mode)
2517 {
2518 	struct {
2519 		__le32 addr;
2520 		__le32 len;
2521 		__le32 mode;
2522 	} req = {
2523 		.addr = cpu_to_le32(addr),
2524 		.len = cpu_to_le32(len),
2525 		.mode = cpu_to_le32(mode),
2526 	};
2527 	int attr;
2528 
2529 	if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2530 		attr = MCU_CMD(PATCH_START_REQ);
2531 	else
2532 		attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2533 
2534 	return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2535 }
2536 
2537 static int mt7915_load_patch(struct mt7915_dev *dev)
2538 {
2539 	const struct mt7915_patch_hdr *hdr;
2540 	const struct firmware *fw = NULL;
2541 	int i, ret, sem;
2542 
2543 	sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2544 	switch (sem) {
2545 	case PATCH_IS_DL:
2546 		return 0;
2547 	case PATCH_NOT_DL_SEM_SUCCESS:
2548 		break;
2549 	default:
2550 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2551 		return -EAGAIN;
2552 	}
2553 
2554 	ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2555 	if (ret)
2556 		goto out;
2557 
2558 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2559 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2560 		ret = -EINVAL;
2561 		goto out;
2562 	}
2563 
2564 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2565 
2566 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2567 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2568 
2569 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2570 		struct mt7915_patch_sec *sec;
2571 		const u8 *dl;
2572 		u32 len, addr;
2573 
2574 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2575 						  i * sizeof(*sec));
2576 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2577 		    PATCH_SEC_TYPE_INFO) {
2578 			ret = -EINVAL;
2579 			goto out;
2580 		}
2581 
2582 		addr = be32_to_cpu(sec->info.addr);
2583 		len = be32_to_cpu(sec->info.len);
2584 		dl = fw->data + be32_to_cpu(sec->offs);
2585 
2586 		ret = mt7915_mcu_init_download(dev, addr, len,
2587 					       DL_MODE_NEED_RSP);
2588 		if (ret) {
2589 			dev_err(dev->mt76.dev, "Download request failed\n");
2590 			goto out;
2591 		}
2592 
2593 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2594 					     dl, len);
2595 		if (ret) {
2596 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2597 			goto out;
2598 		}
2599 	}
2600 
2601 	ret = mt7915_mcu_start_patch(dev);
2602 	if (ret)
2603 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2604 
2605 out:
2606 	sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2607 	switch (sem) {
2608 	case PATCH_REL_SEM_SUCCESS:
2609 		break;
2610 	default:
2611 		ret = -EAGAIN;
2612 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2613 		goto out;
2614 	}
2615 	release_firmware(fw);
2616 
2617 	return ret;
2618 }
2619 
2620 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2621 {
2622 	u32 ret = 0;
2623 
2624 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2625 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2626 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2627 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2628 	ret |= DL_MODE_NEED_RSP;
2629 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2630 
2631 	return ret;
2632 }
2633 
2634 static int
2635 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2636 			     const struct mt7915_fw_trailer *hdr,
2637 			     const u8 *data, bool is_wa)
2638 {
2639 	int i, offset = 0;
2640 	u32 override = 0, option = 0;
2641 
2642 	for (i = 0; i < hdr->n_region; i++) {
2643 		const struct mt7915_fw_region *region;
2644 		int err;
2645 		u32 len, addr, mode;
2646 
2647 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2648 			 (hdr->n_region - i) * sizeof(*region));
2649 		mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2650 		len = le32_to_cpu(region->len);
2651 		addr = le32_to_cpu(region->addr);
2652 
2653 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2654 			override = addr;
2655 
2656 		err = mt7915_mcu_init_download(dev, addr, len, mode);
2657 		if (err) {
2658 			dev_err(dev->mt76.dev, "Download request failed\n");
2659 			return err;
2660 		}
2661 
2662 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2663 					     data + offset, len);
2664 		if (err) {
2665 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2666 			return err;
2667 		}
2668 
2669 		offset += len;
2670 	}
2671 
2672 	if (override)
2673 		option |= FW_START_OVERRIDE;
2674 
2675 	if (is_wa)
2676 		option |= FW_START_WORKING_PDA_CR4;
2677 
2678 	return mt7915_mcu_start_firmware(dev, override, option);
2679 }
2680 
2681 static int mt7915_load_ram(struct mt7915_dev *dev)
2682 {
2683 	const struct mt7915_fw_trailer *hdr;
2684 	const struct firmware *fw;
2685 	int ret;
2686 
2687 	ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2688 	if (ret)
2689 		return ret;
2690 
2691 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2692 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2693 		ret = -EINVAL;
2694 		goto out;
2695 	}
2696 
2697 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2698 					sizeof(*hdr));
2699 
2700 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2701 		 hdr->fw_ver, hdr->build_date);
2702 
2703 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2704 	if (ret) {
2705 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2706 		goto out;
2707 	}
2708 
2709 	release_firmware(fw);
2710 
2711 	ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2712 	if (ret)
2713 		return ret;
2714 
2715 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2716 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2717 		ret = -EINVAL;
2718 		goto out;
2719 	}
2720 
2721 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2722 					sizeof(*hdr));
2723 
2724 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2725 		 hdr->fw_ver, hdr->build_date);
2726 
2727 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2728 	if (ret) {
2729 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2730 		goto out;
2731 	}
2732 
2733 	snprintf(dev->mt76.hw->wiphy->fw_version,
2734 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2735 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2736 
2737 out:
2738 	release_firmware(fw);
2739 
2740 	return ret;
2741 }
2742 
2743 static int mt7915_load_firmware(struct mt7915_dev *dev)
2744 {
2745 	int ret;
2746 	u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2747 
2748 	val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2749 
2750 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2751 		/* restart firmware once */
2752 		__mt76_mcu_restart(&dev->mt76);
2753 		if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2754 				    val, 1000)) {
2755 			dev_err(dev->mt76.dev,
2756 				"Firmware is not ready for download\n");
2757 			return -EIO;
2758 		}
2759 	}
2760 
2761 	ret = mt7915_load_patch(dev);
2762 	if (ret)
2763 		return ret;
2764 
2765 	ret = mt7915_load_ram(dev);
2766 	if (ret)
2767 		return ret;
2768 
2769 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2770 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2771 				       FW_STATE_WACPU_RDY), 1000)) {
2772 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2773 		return -EIO;
2774 	}
2775 
2776 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2777 
2778 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2779 
2780 	return 0;
2781 }
2782 
2783 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2784 {
2785 	struct {
2786 		u8 ctrl_val;
2787 		u8 pad[3];
2788 	} data = {
2789 		.ctrl_val = ctrl
2790 	};
2791 
2792 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2793 				 sizeof(data), true);
2794 }
2795 
2796 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2797 {
2798 	struct {
2799 		u8 ver;
2800 		u8 pad;
2801 		__le16 len;
2802 		u8 level;
2803 		u8 rsv[3];
2804 		__le32 module_idx;
2805 	} data = {
2806 		.module_idx = cpu_to_le32(module),
2807 		.level = level,
2808 	};
2809 
2810 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2811 				 sizeof(data), false);
2812 }
2813 
2814 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2815 {
2816 	struct {
2817 		u8 enable;
2818 		u8 _rsv[3];
2819 	} __packed req = {
2820 		.enable = enabled
2821 	};
2822 
2823 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2824 				 sizeof(req), false);
2825 }
2826 
2827 int mt7915_mcu_init(struct mt7915_dev *dev)
2828 {
2829 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2830 		.headroom = sizeof(struct mt7915_mcu_txd),
2831 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2832 		.mcu_parse_response = mt7915_mcu_parse_response,
2833 		.mcu_restart = mt7915_mcu_restart,
2834 	};
2835 	int ret;
2836 
2837 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2838 
2839 	ret = mt7915_driver_own(dev);
2840 	if (ret)
2841 		return ret;
2842 
2843 	ret = mt7915_load_firmware(dev);
2844 	if (ret)
2845 		return ret;
2846 
2847 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2848 	mt7915_mcu_fw_log_2_host(dev, 0);
2849 	mt7915_mcu_set_mwds(dev, 1);
2850 	mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_RED, 0, 0);
2851 
2852 	return 0;
2853 }
2854 
2855 void mt7915_mcu_exit(struct mt7915_dev *dev)
2856 {
2857 	u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2858 
2859 	__mt76_mcu_restart(&dev->mt76);
2860 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2861 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2862 				       FW_STATE_FW_DOWNLOAD), 1000)) {
2863 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2864 		return;
2865 	}
2866 
2867 	reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2868 	mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2869 	skb_queue_purge(&dev->mt76.mcu.res_q);
2870 }
2871 
2872 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2873 		       bool enable, bool hdr_trans)
2874 {
2875 	struct {
2876 		u8 operation;
2877 		u8 enable;
2878 		u8 check_bssid;
2879 		u8 insert_vlan;
2880 		u8 remove_vlan;
2881 		u8 tid;
2882 		u8 mode;
2883 		u8 rsv;
2884 	} __packed req_trans = {
2885 		.enable = hdr_trans,
2886 	};
2887 	struct {
2888 		u8 enable;
2889 		u8 band;
2890 		u8 rsv[2];
2891 	} __packed req_mac = {
2892 		.enable = enable,
2893 		.band = band,
2894 	};
2895 	int ret;
2896 
2897 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2898 				&req_trans, sizeof(req_trans), false);
2899 	if (ret)
2900 		return ret;
2901 
2902 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2903 				 &req_mac, sizeof(req_mac), true);
2904 }
2905 
2906 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2907 {
2908 	struct {
2909 		__le32 cmd;
2910 		u8 band;
2911 		u8 enable;
2912 	} __packed req = {
2913 		.cmd = cpu_to_le32(SCS_ENABLE),
2914 		.band = band,
2915 		.enable = enable + 1,
2916 	};
2917 
2918 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
2919 				 sizeof(req), false);
2920 }
2921 
2922 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2923 {
2924 	struct mt7915_dev *dev = phy->dev;
2925 	struct {
2926 		u8 prot_idx;
2927 		u8 band;
2928 		u8 rsv[2];
2929 		__le32 len_thresh;
2930 		__le32 pkt_thresh;
2931 	} __packed req = {
2932 		.prot_idx = 1,
2933 		.band = phy != &dev->phy,
2934 		.len_thresh = cpu_to_le32(val),
2935 		.pkt_thresh = cpu_to_le32(0x2),
2936 	};
2937 
2938 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
2939 				 sizeof(req), true);
2940 }
2941 
2942 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2943 {
2944 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2945 	u8 num = req->total;
2946 	size_t len = sizeof(*req) -
2947 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2948 
2949 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2950 				 len, true);
2951 }
2952 
2953 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2954 {
2955 #define TX_CMD_MODE		1
2956 	struct mt7915_mcu_tx req = {
2957 		.valid = true,
2958 		.mode = TX_CMD_MODE,
2959 		.total = IEEE80211_NUM_ACS,
2960 	};
2961 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2962 	int ac;
2963 
2964 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2965 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2966 		struct edca *e = &req.edca[ac];
2967 
2968 		e->set = WMM_PARAM_SET;
2969 		e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
2970 		e->aifs = q->aifs;
2971 		e->txop = cpu_to_le16(q->txop);
2972 
2973 		if (q->cw_min)
2974 			e->cw_min = fls(q->cw_min);
2975 		else
2976 			e->cw_min = 5;
2977 
2978 		if (q->cw_max)
2979 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2980 		else
2981 			e->cw_max = cpu_to_le16(10);
2982 	}
2983 
2984 	return mt7915_mcu_update_edca(dev, &req);
2985 }
2986 
2987 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
2988 {
2989 #define ENTER_PM_STATE		1
2990 #define EXIT_PM_STATE		2
2991 	struct {
2992 		u8 pm_number;
2993 		u8 pm_state;
2994 		u8 bssid[ETH_ALEN];
2995 		u8 dtim_period;
2996 		u8 wlan_idx_lo;
2997 		__le16 bcn_interval;
2998 		__le32 aid;
2999 		__le32 rx_filter;
3000 		u8 band_idx;
3001 		u8 wlan_idx_hi;
3002 		u8 rsv[2];
3003 		__le32 feature;
3004 		u8 omac_idx;
3005 		u8 wmm_idx;
3006 		u8 bcn_loss_cnt;
3007 		u8 bcn_sp_duration;
3008 	} __packed req = {
3009 		.pm_number = 5,
3010 		.pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3011 		.band_idx = band,
3012 	};
3013 
3014 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3015 				 sizeof(req), true);
3016 }
3017 
3018 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3019 		       enum mt7915_rdd_cmd cmd, u8 index,
3020 		       u8 rx_sel, u8 val)
3021 {
3022 	struct {
3023 		u8 ctrl;
3024 		u8 rdd_idx;
3025 		u8 rdd_rx_sel;
3026 		u8 val;
3027 		u8 rsv[4];
3028 	} __packed req = {
3029 		.ctrl = cmd,
3030 		.rdd_idx = index,
3031 		.rdd_rx_sel = rx_sel,
3032 		.val = val,
3033 	};
3034 
3035 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3036 				 sizeof(req), true);
3037 }
3038 
3039 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3040 {
3041 	struct {
3042 		__le32 tag;
3043 		__le16 min_lpn;
3044 		u8 rsv[2];
3045 	} __packed req = {
3046 		.tag = cpu_to_le32(0x1),
3047 		.min_lpn = cpu_to_le16(val),
3048 	};
3049 
3050 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3051 				 sizeof(req), true);
3052 }
3053 
3054 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3055 			    const struct mt7915_dfs_pulse *pulse)
3056 {
3057 	struct {
3058 		__le32 tag;
3059 
3060 		__le32 max_width;		/* us */
3061 		__le32 max_pwr;			/* dbm */
3062 		__le32 min_pwr;			/* dbm */
3063 		__le32 min_stgr_pri;		/* us */
3064 		__le32 max_stgr_pri;		/* us */
3065 		__le32 min_cr_pri;		/* us */
3066 		__le32 max_cr_pri;		/* us */
3067 	} __packed req = {
3068 		.tag = cpu_to_le32(0x3),
3069 
3070 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3071 		__req_field(max_width),
3072 		__req_field(max_pwr),
3073 		__req_field(min_pwr),
3074 		__req_field(min_stgr_pri),
3075 		__req_field(max_stgr_pri),
3076 		__req_field(min_cr_pri),
3077 		__req_field(max_cr_pri),
3078 #undef __req_field
3079 	};
3080 
3081 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3082 				 sizeof(req), true);
3083 }
3084 
3085 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3086 			    const struct mt7915_dfs_pattern *pattern)
3087 {
3088 	struct {
3089 		__le32 tag;
3090 		__le16 radar_type;
3091 
3092 		u8 enb;
3093 		u8 stgr;
3094 		u8 min_crpn;
3095 		u8 max_crpn;
3096 		u8 min_crpr;
3097 		u8 min_pw;
3098 		__le32 min_pri;
3099 		__le32 max_pri;
3100 		u8 max_pw;
3101 		u8 min_crbn;
3102 		u8 max_crbn;
3103 		u8 min_stgpn;
3104 		u8 max_stgpn;
3105 		u8 min_stgpr;
3106 		u8 rsv[2];
3107 		__le32 min_stgpr_diff;
3108 	} __packed req = {
3109 		.tag = cpu_to_le32(0x2),
3110 		.radar_type = cpu_to_le16(index),
3111 
3112 #define __req_field_u8(field) .field = pattern->field
3113 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3114 		__req_field_u8(enb),
3115 		__req_field_u8(stgr),
3116 		__req_field_u8(min_crpn),
3117 		__req_field_u8(max_crpn),
3118 		__req_field_u8(min_crpr),
3119 		__req_field_u8(min_pw),
3120 		__req_field_u32(min_pri),
3121 		__req_field_u32(max_pri),
3122 		__req_field_u8(max_pw),
3123 		__req_field_u8(min_crbn),
3124 		__req_field_u8(max_crbn),
3125 		__req_field_u8(min_stgpn),
3126 		__req_field_u8(max_stgpn),
3127 		__req_field_u8(min_stgpr),
3128 		__req_field_u32(min_stgpr_diff),
3129 #undef __req_field_u8
3130 #undef __req_field_u32
3131 	};
3132 
3133 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3134 				 sizeof(req), true);
3135 }
3136 
3137 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3138 {
3139 	struct mt7915_dev *dev = phy->dev;
3140 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3141 	int freq1 = chandef->center_freq1;
3142 	bool ext_phy = phy != &dev->phy;
3143 	struct {
3144 		u8 control_ch;
3145 		u8 center_ch;
3146 		u8 bw;
3147 		u8 tx_streams_num;
3148 		u8 rx_streams;	/* mask or num */
3149 		u8 switch_reason;
3150 		u8 band_idx;
3151 		u8 center_ch2;	/* for 80+80 only */
3152 		__le16 cac_case;
3153 		u8 channel_band;
3154 		u8 rsv0;
3155 		__le32 outband_freq;
3156 		u8 txpower_drop;
3157 		u8 ap_bw;
3158 		u8 ap_center_ch;
3159 		u8 rsv1[57];
3160 	} __packed req = {
3161 		.control_ch = chandef->chan->hw_value,
3162 		.center_ch = ieee80211_frequency_to_channel(freq1),
3163 		.bw = mt7915_mcu_chan_bw(chandef),
3164 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
3165 		.rx_streams = phy->mt76->antenna_mask,
3166 		.band_idx = ext_phy,
3167 		.channel_band = chandef->chan->band,
3168 	};
3169 
3170 #ifdef CONFIG_NL80211_TESTMODE
3171 	if (phy->mt76->test.tx_antenna_mask &&
3172 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3173 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3174 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3175 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3176 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
3177 
3178 		if (ext_phy) {
3179 			req.tx_streams_num = 2;
3180 			req.rx_streams >>= 2;
3181 		}
3182 	}
3183 #endif
3184 
3185 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3186 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3187 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3188 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3189 		req.switch_reason = CH_SWITCH_DFS;
3190 	else
3191 		req.switch_reason = CH_SWITCH_NORMAL;
3192 
3193 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3194 		req.rx_streams = hweight8(req.rx_streams);
3195 
3196 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3197 		int freq2 = chandef->center_freq2;
3198 
3199 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3200 	}
3201 
3202 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3203 }
3204 
3205 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3206 {
3207 #define TOTAL_PAGE_MASK		GENMASK(7, 5)
3208 #define PAGE_IDX_MASK		GENMASK(4, 2)
3209 #define PER_PAGE_SIZE		0x400
3210 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3211 	u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;
3212 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
3213 	int eep_len;
3214 	int i;
3215 
3216 	for (i = 0; i <= total; i++, eep += eep_len) {
3217 		struct sk_buff *skb;
3218 		int ret;
3219 
3220 		if (i == total)
3221 			eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3222 		else
3223 			eep_len = PER_PAGE_SIZE;
3224 
3225 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3226 					 sizeof(req) + eep_len);
3227 		if (!skb)
3228 			return -ENOMEM;
3229 
3230 		req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |
3231 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3232 		req.len = cpu_to_le16(eep_len);
3233 
3234 		skb_put_data(skb, &req, sizeof(req));
3235 		skb_put_data(skb, eep, eep_len);
3236 
3237 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3238 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3239 		if (ret)
3240 			return ret;
3241 	}
3242 
3243 	return 0;
3244 }
3245 
3246 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3247 {
3248 	struct mt7915_mcu_eeprom req = {
3249 		.buffer_mode = EE_MODE_EFUSE,
3250 		.format = EE_FORMAT_WHOLE,
3251 	};
3252 
3253 	if (dev->flash_mode)
3254 		return mt7915_mcu_set_eeprom_flash(dev);
3255 
3256 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3257 				 &req, sizeof(req), true);
3258 }
3259 
3260 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3261 {
3262 	struct mt7915_mcu_eeprom_info req = {
3263 		.addr = cpu_to_le32(round_down(offset, 16)),
3264 	};
3265 	struct mt7915_mcu_eeprom_info *res;
3266 	struct sk_buff *skb;
3267 	int ret;
3268 	u8 *buf;
3269 
3270 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3271 				sizeof(req), true, &skb);
3272 	if (ret)
3273 		return ret;
3274 
3275 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
3276 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3277 	memcpy(buf, res->data, 16);
3278 	dev_kfree_skb(skb);
3279 
3280 	return 0;
3281 }
3282 
3283 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3284 {
3285 	struct {
3286 		u8 ctrl_id;
3287 		u8 action;
3288 		u8 band;
3289 		u8 rsv[5];
3290 	} req = {
3291 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3292 		.action = index,
3293 	};
3294 
3295 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3296 				 sizeof(req), true);
3297 }
3298 
3299 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3300 {
3301 	struct {
3302 		__le32 cmd;
3303 		__le16 wlan_idx;
3304 		__le16 ru_idx;
3305 		__le16 direction;
3306 		__le16 dump_group;
3307 	} req = {
3308 		.cmd = cpu_to_le32(cmd),
3309 		.wlan_idx = cpu_to_le16(wlan_idx),
3310 		.dump_group = cpu_to_le16(1),
3311 	};
3312 
3313 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RATE_CTRL), &req,
3314 				 sizeof(req), false);
3315 }
3316 
3317 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3318 {
3319 	struct mt7915_dev *dev = phy->dev;
3320 	struct mt76_phy *mphy = phy->mt76;
3321 	struct ieee80211_hw *hw = mphy->hw;
3322 	struct mt7915_sku_val {
3323 		u8 format_id;
3324 		u8 limit_type;
3325 		u8 dbdc_idx;
3326 		s8 val[MT7915_SKU_RATE_NUM];
3327 	} __packed req = {
3328 		.format_id = 4,
3329 		.dbdc_idx = phy != &dev->phy,
3330 	};
3331 	int i;
3332 	s8 *delta;
3333 
3334 	delta = dev->rate_power[mphy->chandef.chan->band];
3335 	mphy->txpower_cur = hw->conf.power_level * 2 +
3336 			    delta[MT7915_SKU_MAX_DELTA_IDX];
3337 
3338 	for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3339 		req.val[i] = hw->conf.power_level * 2 + delta[i];
3340 
3341 	return mt76_mcu_send_msg(&dev->mt76,
3342 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3343 				 sizeof(req), true);
3344 }
3345 
3346 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3347 			      u8 en)
3348 {
3349 	struct {
3350 		u8 test_mode_en;
3351 		u8 param_idx;
3352 		u8 _rsv[2];
3353 
3354 		u8 enable;
3355 		u8 _rsv2[3];
3356 
3357 		u8 pad[8];
3358 	} __packed req = {
3359 		.test_mode_en = test_mode,
3360 		.param_idx = param,
3361 		.enable = en,
3362 	};
3363 
3364 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3365 				 sizeof(req), false);
3366 }
3367 
3368 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3369 {
3370 	struct mt7915_dev *dev = phy->dev;
3371 	struct mt7915_sku {
3372 		u8 format_id;
3373 		u8 sku_enable;
3374 		u8 dbdc_idx;
3375 		u8 rsv;
3376 	} __packed req = {
3377 		.format_id = 0,
3378 		.dbdc_idx = phy != &dev->phy,
3379 		.sku_enable = enable,
3380 	};
3381 
3382 	return mt76_mcu_send_msg(&dev->mt76,
3383 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3384 				 sizeof(req), true);
3385 }
3386 
3387 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3388 {
3389 	struct {
3390 		u8 action;
3391 		u8 set;
3392 		u8 band;
3393 		u8 rsv;
3394 	} req = {
3395 		.action = action,
3396 		.set = set,
3397 		.band = band,
3398 	};
3399 
3400 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3401 				 &req, sizeof(req), false);
3402 }
3403 
3404 int mt7915_mcu_set_txbf_module(struct mt7915_dev *dev)
3405 {
3406 #define MT_BF_MODULE_UPDATE               25
3407 	struct {
3408 		u8 action;
3409 		u8 bf_num;
3410 		u8 bf_bitmap;
3411 		u8 bf_sel[8];
3412 		u8 rsv[8];
3413 	} __packed req = {
3414 		.action = MT_BF_MODULE_UPDATE,
3415 		.bf_num = 2,
3416 		.bf_bitmap = GENMASK(1, 0),
3417 	};
3418 
3419 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3420 				 sizeof(req), true);
3421 }
3422 
3423 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3424 {
3425 #define MT_BF_TYPE_UPDATE		20
3426 	struct {
3427 		u8 action;
3428 		bool ebf;
3429 		bool ibf;
3430 		u8 rsv;
3431 	} __packed req = {
3432 		.action = MT_BF_TYPE_UPDATE,
3433 		.ebf = true,
3434 		.ibf = dev->ibf,
3435 	};
3436 
3437 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3438 				 sizeof(req), true);
3439 }
3440 
3441 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3442 {
3443 #define MT_BF_PROCESSING		4
3444 	struct {
3445 		u8 action;
3446 		u8 snd_mode;
3447 		u8 sta_num;
3448 		u8 rsv;
3449 		u8 wlan_idx[4];
3450 		__le32 snd_period;	/* ms */
3451 	} __packed req = {
3452 		.action = true,
3453 		.snd_mode = MT_BF_PROCESSING,
3454 	};
3455 
3456 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3457 				 sizeof(req), true);
3458 }
3459 
3460 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3461 			    bool enable)
3462 {
3463 #define MT_SPR_ENABLE		1
3464 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3465 	struct {
3466 		u8 action;
3467 		u8 arg_num;
3468 		u8 band_idx;
3469 		u8 status;
3470 		u8 drop_tx_idx;
3471 		u8 sta_idx;	/* 256 sta */
3472 		u8 rsv[2];
3473 		__le32 val;
3474 	} __packed req = {
3475 		.action = MT_SPR_ENABLE,
3476 		.arg_num = 1,
3477 		.band_idx = mvif->band_idx,
3478 		.val = cpu_to_le32(enable),
3479 	};
3480 
3481 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3482 				 sizeof(req), true);
3483 }
3484 
3485 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3486 			   struct ieee80211_sta *sta, struct rate_info *rate)
3487 {
3488 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3489 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3490 	struct mt7915_dev *dev = phy->dev;
3491 	struct mt76_phy *mphy = phy->mt76;
3492 	struct {
3493 		u8 category;
3494 		u8 band;
3495 		__le16 wcid;
3496 	} __packed req = {
3497 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3498 		.band = mvif->band_idx,
3499 		.wcid = cpu_to_le16(msta->wcid.idx),
3500 	};
3501 	struct ieee80211_supported_band *sband;
3502 	struct mt7915_mcu_phy_rx_info *res;
3503 	struct sk_buff *skb;
3504 	u16 flags = 0;
3505 	int ret;
3506 	int i;
3507 
3508 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3509 					&req, sizeof(req), true, &skb);
3510 	if (ret)
3511 		return ret;
3512 
3513 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3514 
3515 	rate->mcs = res->rate;
3516 	rate->nss = res->nsts + 1;
3517 
3518 	switch (res->mode) {
3519 	case MT_PHY_TYPE_CCK:
3520 	case MT_PHY_TYPE_OFDM:
3521 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3522 			sband = &mphy->sband_5g.sband;
3523 		else
3524 			sband = &mphy->sband_2g.sband;
3525 
3526 		for (i = 0; i < sband->n_bitrates; i++) {
3527 			if (rate->mcs != (sband->bitrates[i].hw_value & 0xf))
3528 				continue;
3529 
3530 			rate->legacy = sband->bitrates[i].bitrate;
3531 			break;
3532 		}
3533 		break;
3534 	case MT_PHY_TYPE_HT:
3535 	case MT_PHY_TYPE_HT_GF:
3536 		if (rate->mcs > 31)
3537 			return -EINVAL;
3538 
3539 		flags |= RATE_INFO_FLAGS_MCS;
3540 
3541 		if (res->gi)
3542 			flags |= RATE_INFO_FLAGS_SHORT_GI;
3543 		break;
3544 	case MT_PHY_TYPE_VHT:
3545 		flags |= RATE_INFO_FLAGS_VHT_MCS;
3546 
3547 		if (res->gi)
3548 			flags |= RATE_INFO_FLAGS_SHORT_GI;
3549 		break;
3550 	case MT_PHY_TYPE_HE_SU:
3551 	case MT_PHY_TYPE_HE_EXT_SU:
3552 	case MT_PHY_TYPE_HE_TB:
3553 	case MT_PHY_TYPE_HE_MU:
3554 		rate->he_gi = res->gi;
3555 
3556 		flags |= RATE_INFO_FLAGS_HE_MCS;
3557 		break;
3558 	default:
3559 		break;
3560 	}
3561 	rate->flags = flags;
3562 
3563 	switch (res->bw) {
3564 	case IEEE80211_STA_RX_BW_160:
3565 		rate->bw = RATE_INFO_BW_160;
3566 		break;
3567 	case IEEE80211_STA_RX_BW_80:
3568 		rate->bw = RATE_INFO_BW_80;
3569 		break;
3570 	case IEEE80211_STA_RX_BW_40:
3571 		rate->bw = RATE_INFO_BW_40;
3572 		break;
3573 	default:
3574 		rate->bw = RATE_INFO_BW_20;
3575 		break;
3576 	}
3577 
3578 	dev_kfree_skb(skb);
3579 
3580 	return 0;
3581 }
3582