1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define MT_STA_BFER			BIT(0)
70 #define MT_STA_BFEE			BIT(1)
71 
72 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
73 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
74 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
75 
76 #define DL_MODE_ENCRYPT			BIT(0)
77 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
78 #define DL_MODE_RESET_SEC_IV		BIT(3)
79 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
80 #define DL_MODE_NEED_RSP		BIT(31)
81 
82 #define FW_START_OVERRIDE		BIT(0)
83 #define FW_START_WORKING_PDA_CR4	BIT(2)
84 
85 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
86 #define PATCH_SEC_TYPE_INFO		0x2
87 
88 #define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
89 #define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
90 
91 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
92 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
93 
94 static enum mt7915_cipher_type
95 mt7915_mcu_get_cipher(int cipher)
96 {
97 	switch (cipher) {
98 	case WLAN_CIPHER_SUITE_WEP40:
99 		return MT_CIPHER_WEP40;
100 	case WLAN_CIPHER_SUITE_WEP104:
101 		return MT_CIPHER_WEP104;
102 	case WLAN_CIPHER_SUITE_TKIP:
103 		return MT_CIPHER_TKIP;
104 	case WLAN_CIPHER_SUITE_AES_CMAC:
105 		return MT_CIPHER_BIP_CMAC_128;
106 	case WLAN_CIPHER_SUITE_CCMP:
107 		return MT_CIPHER_AES_CCMP;
108 	case WLAN_CIPHER_SUITE_CCMP_256:
109 		return MT_CIPHER_CCMP_256;
110 	case WLAN_CIPHER_SUITE_GCMP:
111 		return MT_CIPHER_GCMP;
112 	case WLAN_CIPHER_SUITE_GCMP_256:
113 		return MT_CIPHER_GCMP_256;
114 	case WLAN_CIPHER_SUITE_SMS4:
115 		return MT_CIPHER_WAPI;
116 	default:
117 		return MT_CIPHER_NONE;
118 	}
119 }
120 
121 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
122 {
123 	static const u8 width_to_bw[] = {
124 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
125 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
126 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
127 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
128 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
129 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
130 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
131 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
132 	};
133 
134 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
135 		return 0;
136 
137 	return width_to_bw[chandef->width];
138 }
139 
140 static const struct ieee80211_sta_he_cap *
141 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
142 {
143 	struct ieee80211_supported_band *sband;
144 	enum nl80211_band band;
145 
146 	band = phy->mt76->chandef.chan->band;
147 	sband = phy->mt76->hw->wiphy->bands[band];
148 
149 	return ieee80211_get_he_iftype_cap(sband, vif->type);
150 }
151 
152 static u8
153 mt7915_get_phy_mode(struct mt7915_dev *dev, struct ieee80211_vif *vif,
154 		    enum nl80211_band band, struct ieee80211_sta *sta)
155 {
156 	struct ieee80211_sta_ht_cap *ht_cap;
157 	struct ieee80211_sta_vht_cap *vht_cap;
158 	const struct ieee80211_sta_he_cap *he_cap;
159 	u8 mode = 0;
160 
161 	if (sta) {
162 		ht_cap = &sta->ht_cap;
163 		vht_cap = &sta->vht_cap;
164 		he_cap = &sta->he_cap;
165 	} else {
166 		struct ieee80211_supported_band *sband;
167 		struct mt7915_phy *phy;
168 		struct mt7915_vif *mvif;
169 
170 		mvif = (struct mt7915_vif *)vif->drv_priv;
171 		phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
172 		sband = phy->mt76->hw->wiphy->bands[band];
173 
174 		ht_cap = &sband->ht_cap;
175 		vht_cap = &sband->vht_cap;
176 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
177 	}
178 
179 	if (band == NL80211_BAND_2GHZ) {
180 		mode |= PHY_MODE_B | PHY_MODE_G;
181 
182 		if (ht_cap->ht_supported)
183 			mode |= PHY_MODE_GN;
184 
185 		if (he_cap->has_he)
186 			mode |= PHY_MODE_AX_24G;
187 	} else if (band == NL80211_BAND_5GHZ) {
188 		mode |= PHY_MODE_A;
189 
190 		if (ht_cap->ht_supported)
191 			mode |= PHY_MODE_AN;
192 
193 		if (vht_cap->vht_supported)
194 			mode |= PHY_MODE_AC;
195 
196 		if (he_cap->has_he)
197 			mode |= PHY_MODE_AX_5G;
198 	}
199 
200 	return mode;
201 }
202 
203 static u8
204 mt7915_mcu_get_sta_nss(u16 mcs_map)
205 {
206 	u8 nss;
207 
208 	for (nss = 8; nss > 0; nss--) {
209 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
210 
211 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
212 			break;
213 	}
214 
215 	return nss - 1;
216 }
217 
218 static int
219 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
220 			  struct sk_buff *skb, int seq)
221 {
222 	struct mt7915_mcu_rxd *rxd;
223 	int ret = 0;
224 
225 	if (!skb) {
226 		dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
227 			cmd, seq);
228 		return -ETIMEDOUT;
229 	}
230 
231 	rxd = (struct mt7915_mcu_rxd *)skb->data;
232 	if (seq != rxd->seq)
233 		return -EAGAIN;
234 
235 	switch (cmd) {
236 	case -MCU_CMD_PATCH_SEM_CONTROL:
237 		skb_pull(skb, sizeof(*rxd) - 4);
238 		ret = *skb->data;
239 		break;
240 	case MCU_EXT_CMD_THERMAL_CTRL:
241 		skb_pull(skb, sizeof(*rxd) + 4);
242 		ret = le32_to_cpu(*(__le32 *)skb->data);
243 		break;
244 	default:
245 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
246 		break;
247 	}
248 
249 	return ret;
250 }
251 
252 static int
253 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
254 			int cmd, int *wait_seq)
255 {
256 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
257 	struct mt7915_mcu_txd *mcu_txd;
258 	u8 seq, pkt_fmt, qidx;
259 	enum mt76_txq_id txq;
260 	__le32 *txd;
261 	u32 val;
262 
263 	/* TODO: make dynamic based on msg type */
264 	mdev->mcu.timeout = 20 * HZ;
265 
266 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
267 	if (!seq)
268 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
269 
270 	if (cmd == -MCU_CMD_FW_SCATTER) {
271 		txq = MT_MCUQ_FWDL;
272 		goto exit;
273 	}
274 
275 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
276 
277 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state)) {
278 		txq = MT_MCUQ_WA;
279 		qidx = MT_TX_MCU_PORT_RX_Q0;
280 		pkt_fmt = MT_TX_TYPE_CMD;
281 	} else {
282 		txq = MT_MCUQ_WM;
283 		qidx = MT_TX_MCU_PORT_RX_Q0;
284 		pkt_fmt = MT_TX_TYPE_CMD;
285 	}
286 
287 	txd = mcu_txd->txd;
288 
289 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
290 	      FIELD_PREP(MT_TXD0_PKT_FMT, pkt_fmt) |
291 	      FIELD_PREP(MT_TXD0_Q_IDX, qidx);
292 	txd[0] = cpu_to_le32(val);
293 
294 	val = MT_TXD1_LONG_FORMAT |
295 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
296 	txd[1] = cpu_to_le32(val);
297 
298 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
299 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, qidx));
300 	mcu_txd->pkt_type = MCU_PKT_ID;
301 	mcu_txd->seq = seq;
302 
303 	if (cmd < 0) {
304 		mcu_txd->set_query = MCU_Q_NA;
305 		mcu_txd->cid = -cmd;
306 	} else {
307 		mcu_txd->cid = MCU_CMD_EXT_CID;
308 		mcu_txd->ext_cid = cmd;
309 		mcu_txd->ext_cid_ack = 1;
310 
311 		/* do not use Q_SET for efuse */
312 		if (cmd == MCU_EXT_CMD_EFUSE_ACCESS)
313 			mcu_txd->set_query = MCU_Q_QUERY;
314 		else
315 			mcu_txd->set_query = MCU_Q_SET;
316 	}
317 
318 	if (cmd == MCU_EXT_CMD_MWDS_SUPPORT)
319 		mcu_txd->s2d_index = MCU_S2D_H2C;
320 	else
321 		mcu_txd->s2d_index = MCU_S2D_H2N;
322 	WARN_ON(cmd == MCU_EXT_CMD_EFUSE_ACCESS &&
323 		mcu_txd->set_query != MCU_Q_QUERY);
324 
325 exit:
326 	if (wait_seq)
327 		*wait_seq = seq;
328 
329 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[txq], skb, 0);
330 }
331 
332 static void
333 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
334 {
335 	if (vif->csa_active)
336 		ieee80211_csa_finish(vif);
337 }
338 
339 static void
340 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
341 {
342 	struct mt76_phy *mphy = &dev->mt76.phy;
343 	struct mt7915_mcu_rdd_report *r;
344 
345 	r = (struct mt7915_mcu_rdd_report *)skb->data;
346 
347 	if (r->idx && dev->mt76.phy2)
348 		mphy = dev->mt76.phy2;
349 
350 	ieee80211_radar_detected(mphy->hw);
351 	dev->hw_pattern++;
352 }
353 
354 static void
355 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
356 			 struct rate_info *rate, u16 r)
357 {
358 	struct ieee80211_supported_band *sband;
359 	u16 ru_idx = le16_to_cpu(ra->ru_idx);
360 	u16 flags = 0;
361 
362 	rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
363 	rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
364 
365 	switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
366 	case MT_PHY_TYPE_CCK:
367 	case MT_PHY_TYPE_OFDM:
368 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
369 			sband = &mphy->sband_5g.sband;
370 		else
371 			sband = &mphy->sband_2g.sband;
372 
373 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
374 		break;
375 	case MT_PHY_TYPE_HT:
376 	case MT_PHY_TYPE_HT_GF:
377 		rate->mcs += (rate->nss - 1) * 8;
378 		flags |= RATE_INFO_FLAGS_MCS;
379 
380 		if (ra->gi)
381 			flags |= RATE_INFO_FLAGS_SHORT_GI;
382 		break;
383 	case MT_PHY_TYPE_VHT:
384 		flags |= RATE_INFO_FLAGS_VHT_MCS;
385 
386 		if (ra->gi)
387 			flags |= RATE_INFO_FLAGS_SHORT_GI;
388 		break;
389 	case MT_PHY_TYPE_HE_SU:
390 	case MT_PHY_TYPE_HE_EXT_SU:
391 	case MT_PHY_TYPE_HE_TB:
392 	case MT_PHY_TYPE_HE_MU:
393 		rate->he_gi = ra->gi;
394 		rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
395 
396 		flags |= RATE_INFO_FLAGS_HE_MCS;
397 		break;
398 	default:
399 		break;
400 	}
401 	rate->flags = flags;
402 
403 	if (ru_idx) {
404 		switch (ru_idx) {
405 		case 1 ... 2:
406 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
407 			break;
408 		case 3 ... 6:
409 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
410 			break;
411 		case 7 ... 14:
412 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
413 			break;
414 		default:
415 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
416 			break;
417 		}
418 		rate->bw = RATE_INFO_BW_HE_RU;
419 	} else {
420 		u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
421 			FIELD_GET(MT_RA_RATE_BW, r);
422 
423 		switch (bw) {
424 		case IEEE80211_STA_RX_BW_160:
425 			rate->bw = RATE_INFO_BW_160;
426 			break;
427 		case IEEE80211_STA_RX_BW_80:
428 			rate->bw = RATE_INFO_BW_80;
429 			break;
430 		case IEEE80211_STA_RX_BW_40:
431 			rate->bw = RATE_INFO_BW_40;
432 			break;
433 		default:
434 			rate->bw = RATE_INFO_BW_20;
435 			break;
436 		}
437 	}
438 }
439 
440 static void
441 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
442 {
443 	struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
444 	struct rate_info rate = {}, prob_rate = {};
445 	u16 probe = le16_to_cpu(ra->prob_up_rate);
446 	u16 attempts = le16_to_cpu(ra->attempts);
447 	u16 curr = le16_to_cpu(ra->curr_rate);
448 	u16 wcidx = le16_to_cpu(ra->wlan_idx);
449 	struct mt76_phy *mphy = &dev->mphy;
450 	struct mt7915_sta_stats *stats;
451 	struct mt7915_sta *msta;
452 	struct mt76_wcid *wcid;
453 
454 	if (wcidx >= MT76_N_WCIDS)
455 		return;
456 
457 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
458 	if (!wcid)
459 		return;
460 
461 	msta = container_of(wcid, struct mt7915_sta, wcid);
462 	stats = &msta->stats;
463 
464 	if (msta->wcid.ext_phy && dev->mt76.phy2)
465 		mphy = dev->mt76.phy2;
466 
467 	/* current rate */
468 	mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr);
469 	stats->tx_rate = rate;
470 
471 	/* probing rate */
472 	mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe);
473 	stats->prob_rate = prob_rate;
474 
475 	if (attempts) {
476 		u16 success = le16_to_cpu(ra->success);
477 
478 		stats->per = 1000 * (attempts - success) / attempts;
479 	}
480 }
481 
482 static void
483 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
484 {
485 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
486 	const char *data = (char *)&rxd[1];
487 	const char *type;
488 
489 	switch (rxd->s2d_index) {
490 	case 0:
491 		type = "WM";
492 		break;
493 	case 2:
494 		type = "WA";
495 		break;
496 	default:
497 		type = "unknown";
498 		break;
499 	}
500 
501 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
502 }
503 
504 static void
505 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
506 {
507 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
508 
509 	switch (rxd->ext_eid) {
510 	case MCU_EXT_EVENT_RDD_REPORT:
511 		mt7915_mcu_rx_radar_detected(dev, skb);
512 		break;
513 	case MCU_EXT_EVENT_CSA_NOTIFY:
514 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
515 				IEEE80211_IFACE_ITER_RESUME_ALL,
516 				mt7915_mcu_csa_finish, dev);
517 		break;
518 	case MCU_EXT_EVENT_RATE_REPORT:
519 		mt7915_mcu_tx_rate_report(dev, skb);
520 		break;
521 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
522 		mt7915_mcu_rx_log_message(dev, skb);
523 		break;
524 	default:
525 		break;
526 	}
527 }
528 
529 static void
530 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
531 {
532 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
533 
534 	switch (rxd->eid) {
535 	case MCU_EVENT_EXT:
536 		mt7915_mcu_rx_ext_event(dev, skb);
537 		break;
538 	default:
539 		break;
540 	}
541 	dev_kfree_skb(skb);
542 }
543 
544 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
545 {
546 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
547 
548 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
549 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
550 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
551 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
552 	    rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
553 	    !rxd->seq)
554 		mt7915_mcu_rx_unsolicited_event(dev, skb);
555 	else
556 		mt76_mcu_rx_event(&dev->mt76, skb);
557 }
558 
559 static struct sk_buff *
560 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
561 			 struct mt7915_sta *msta, int len)
562 {
563 	struct sta_req_hdr hdr = {
564 		.bss_idx = mvif->idx,
565 		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
566 		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
567 		.muar_idx = msta ? mvif->omac_idx : 0,
568 		.is_tlv_append = 1,
569 	};
570 	struct sk_buff *skb;
571 
572 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
573 	if (!skb)
574 		return ERR_PTR(-ENOMEM);
575 
576 	skb_put_data(skb, &hdr, sizeof(hdr));
577 
578 	return skb;
579 }
580 
581 static struct wtbl_req_hdr *
582 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
583 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
584 {
585 	struct tlv *sta_hdr = sta_wtbl;
586 	struct wtbl_req_hdr hdr = {
587 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
588 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
589 		.operation = cmd,
590 	};
591 	struct sk_buff *nskb = *skb;
592 
593 	if (!nskb) {
594 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
595 					  MT7915_WTBL_UPDATE_BA_SIZE);
596 		if (!nskb)
597 			return ERR_PTR(-ENOMEM);
598 
599 		*skb = nskb;
600 	}
601 
602 	if (sta_hdr)
603 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
604 
605 	return skb_put_data(nskb, &hdr, sizeof(hdr));
606 }
607 
608 static struct tlv *
609 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
610 			  void *sta_ntlv, void *sta_wtbl)
611 {
612 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
613 	struct tlv *sta_hdr = sta_wtbl;
614 	struct tlv *ptlv, tlv = {
615 		.tag = cpu_to_le16(tag),
616 		.len = cpu_to_le16(len),
617 	};
618 	u16 ntlv;
619 
620 	ptlv = skb_put(skb, len);
621 	memcpy(ptlv, &tlv, sizeof(tlv));
622 
623 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
624 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
625 
626 	if (sta_hdr) {
627 		u16 size = le16_to_cpu(sta_hdr->len);
628 
629 		sta_hdr->len = cpu_to_le16(size + len);
630 	}
631 
632 	return ptlv;
633 }
634 
635 static struct tlv *
636 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
637 {
638 	return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
639 }
640 
641 static struct tlv *
642 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
643 			     __le16 *sub_ntlv, __le16 *len)
644 {
645 	struct tlv *ptlv, tlv = {
646 		.tag = cpu_to_le16(sub_tag),
647 		.len = cpu_to_le16(sub_len),
648 	};
649 
650 	ptlv = skb_put(skb, sub_len);
651 	memcpy(ptlv, &tlv, sizeof(tlv));
652 
653 	le16_add_cpu(sub_ntlv, 1);
654 	le16_add_cpu(len, sub_len);
655 
656 	return ptlv;
657 }
658 
659 /** bss info **/
660 static int
661 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
662 			 struct mt7915_phy *phy, bool enable)
663 {
664 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
665 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
666 	enum nl80211_band band = chandef->chan->band;
667 	struct bss_info_basic *bss;
668 	u16 wlan_idx = mvif->sta.wcid.idx;
669 	u32 type = NETWORK_INFRA;
670 	struct tlv *tlv;
671 
672 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
673 
674 	switch (vif->type) {
675 	case NL80211_IFTYPE_MESH_POINT:
676 	case NL80211_IFTYPE_AP:
677 		break;
678 	case NL80211_IFTYPE_STATION:
679 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
680 		if (enable) {
681 			struct ieee80211_sta *sta;
682 			struct mt7915_sta *msta;
683 
684 			rcu_read_lock();
685 			sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
686 			if (!sta) {
687 				rcu_read_unlock();
688 				return -EINVAL;
689 			}
690 
691 			msta = (struct mt7915_sta *)sta->drv_priv;
692 			wlan_idx = msta->wcid.idx;
693 			rcu_read_unlock();
694 		}
695 		break;
696 	case NL80211_IFTYPE_ADHOC:
697 		type = NETWORK_IBSS;
698 		break;
699 	default:
700 		WARN_ON(1);
701 		break;
702 	}
703 
704 	bss = (struct bss_info_basic *)tlv;
705 	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
706 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
707 	bss->network_type = cpu_to_le32(type);
708 	bss->dtim_period = vif->bss_conf.dtim_period;
709 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
710 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
711 	bss->phy_mode = mt7915_get_phy_mode(phy->dev, vif, band, NULL);
712 	bss->wmm_idx = mvif->wmm_idx;
713 	bss->active = enable;
714 
715 	return 0;
716 }
717 
718 static void
719 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
720 {
721 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
722 	struct bss_info_omac *omac;
723 	struct tlv *tlv;
724 	u32 type = 0;
725 	u8 idx;
726 
727 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
728 
729 	switch (vif->type) {
730 	case NL80211_IFTYPE_MESH_POINT:
731 	case NL80211_IFTYPE_AP:
732 		type = CONNECTION_INFRA_AP;
733 		break;
734 	case NL80211_IFTYPE_STATION:
735 		type = CONNECTION_INFRA_STA;
736 		break;
737 	case NL80211_IFTYPE_ADHOC:
738 		type = CONNECTION_IBSS_ADHOC;
739 		break;
740 	default:
741 		WARN_ON(1);
742 		break;
743 	}
744 
745 	omac = (struct bss_info_omac *)tlv;
746 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
747 	omac->conn_type = cpu_to_le32(type);
748 	omac->omac_idx = mvif->omac_idx;
749 	omac->band_idx = mvif->band_idx;
750 	omac->hw_bss_idx = idx;
751 }
752 
753 struct mt7915_he_obss_narrow_bw_ru_data {
754 	bool tolerated;
755 };
756 
757 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
758 						   struct cfg80211_bss *bss,
759 						   void *_data)
760 {
761 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
762 	const struct element *elem;
763 
764 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
765 
766 	if (!elem || elem->datalen < 10 ||
767 	    !(elem->data[10] &
768 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
769 		data->tolerated = false;
770 }
771 
772 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
773 					      struct ieee80211_vif *vif)
774 {
775 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
776 		.tolerated = true,
777 	};
778 
779 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
780 		return false;
781 
782 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
783 			  mt7915_check_he_obss_narrow_bw_ru_iter,
784 			  &iter_data);
785 
786 	/*
787 	 * If there is at least one AP on radar channel that cannot
788 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
789 	 */
790 	return !iter_data.tolerated;
791 }
792 
793 static void
794 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
795 			struct mt7915_phy *phy)
796 {
797 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
798 	struct bss_info_rf_ch *ch;
799 	struct tlv *tlv;
800 	int freq1 = chandef->center_freq1;
801 
802 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
803 
804 	ch = (struct bss_info_rf_ch *)tlv;
805 	ch->pri_ch = chandef->chan->hw_value;
806 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
807 	ch->bw = mt7915_mcu_chan_bw(chandef);
808 
809 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
810 		int freq2 = chandef->center_freq2;
811 
812 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
813 	}
814 
815 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
816 		struct mt7915_dev *dev = phy->dev;
817 		struct mt76_phy *mphy = &dev->mt76.phy;
818 		bool ext_phy = phy != &dev->phy;
819 
820 		if (ext_phy && dev->mt76.phy2)
821 			mphy = dev->mt76.phy2;
822 
823 		ch->he_ru26_block =
824 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
825 		ch->he_all_disable = false;
826 	} else {
827 		ch->he_all_disable = true;
828 	}
829 }
830 
831 static void
832 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
833 		      struct mt7915_phy *phy)
834 {
835 	struct bss_info_ra *ra;
836 	struct tlv *tlv;
837 	int max_nss = hweight8(phy->chainmask);
838 
839 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
840 
841 	ra = (struct bss_info_ra *)tlv;
842 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
843 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
844 	ra->short_preamble = true;
845 	ra->tx_streams = max_nss;
846 	ra->rx_streams = max_nss;
847 	ra->algo = 4;
848 	ra->train_up_rule = 2;
849 	ra->train_up_high_thres = 110;
850 	ra->train_up_rule_rssi = -70;
851 	ra->low_traffic_thres = 2;
852 	ra->phy_cap = cpu_to_le32(0xfdf);
853 	ra->interval = cpu_to_le32(500);
854 	ra->fast_interval = cpu_to_le32(100);
855 }
856 
857 static void
858 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
859 		      struct mt7915_phy *phy)
860 {
861 #define DEFAULT_HE_PE_DURATION		4
862 #define DEFAULT_HE_DURATION_RTS_THRES	1023
863 	const struct ieee80211_sta_he_cap *cap;
864 	struct bss_info_he *he;
865 	struct tlv *tlv;
866 
867 	cap = mt7915_get_he_phy_cap(phy, vif);
868 
869 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
870 
871 	he = (struct bss_info_he *)tlv;
872 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
873 	if (!he->he_pe_duration)
874 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
875 
876 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
877 	if (!he->he_rts_thres)
878 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
879 
880 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
881 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
882 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
883 }
884 
885 static void
886 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
887 {
888 #define TXD_CMP_MAP1		GENMASK(15, 0)
889 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
890 	struct bss_info_hw_amsdu *amsdu;
891 	struct tlv *tlv;
892 
893 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
894 
895 	amsdu = (struct bss_info_hw_amsdu *)tlv;
896 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
897 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
898 	amsdu->trig_thres = cpu_to_le16(2);
899 	amsdu->enable = true;
900 }
901 
902 static void
903 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
904 {
905 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
906 #define BCN_TX_ESTIMATE_TIME	(4096 + 20)
907 	struct bss_info_ext_bss *ext;
908 	int ext_bss_idx, tsf_offset;
909 	struct tlv *tlv;
910 
911 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
912 	if (ext_bss_idx < 0)
913 		return;
914 
915 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
916 
917 	ext = (struct bss_info_ext_bss *)tlv;
918 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
919 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
920 }
921 
922 static void
923 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
924 {
925 	struct bss_info_bmc_rate *bmc;
926 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
927 	enum nl80211_band band = chandef->chan->band;
928 	struct tlv *tlv;
929 
930 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
931 
932 	bmc = (struct bss_info_bmc_rate *)tlv;
933 	if (band == NL80211_BAND_2GHZ) {
934 		bmc->short_preamble = true;
935 	} else {
936 		bmc->bc_trans = cpu_to_le16(0x2000);
937 		bmc->mc_trans = cpu_to_le16(0x2080);
938 	}
939 }
940 
941 static int
942 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
943 		       bool bssid, bool enable)
944 {
945 	struct mt7915_dev *dev = phy->dev;
946 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
947 	u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
948 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
949 	const u8 *addr = vif->addr;
950 	struct {
951 		u8 mode;
952 		u8 force_clear;
953 		u8 clear_bitmap[8];
954 		u8 entry_count;
955 		u8 write;
956 		u8 band;
957 
958 		u8 index;
959 		u8 bssid;
960 		u8 addr[ETH_ALEN];
961 	} __packed req = {
962 		.mode = !!mask || enable,
963 		.entry_count = 1,
964 		.write = 1,
965 		.band = phy != &dev->phy,
966 		.index = idx * 2 + bssid,
967 	};
968 
969 	if (bssid)
970 		addr = vif->bss_conf.bssid;
971 
972 	if (enable)
973 		ether_addr_copy(req.addr, addr);
974 
975 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
976 				 sizeof(req), true);
977 }
978 
979 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
980 			    struct ieee80211_vif *vif, int enable)
981 {
982 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
983 	struct sk_buff *skb;
984 
985 	if (mvif->omac_idx >= REPEATER_BSSID_START)
986 		mt7915_mcu_muar_config(phy, vif, true, enable);
987 
988 	skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
989 				       MT7915_BSS_UPDATE_MAX_SIZE);
990 	if (IS_ERR(skb))
991 		return PTR_ERR(skb);
992 
993 	/* bss_omac must be first */
994 	if (enable)
995 		mt7915_mcu_bss_omac_tlv(skb, vif);
996 
997 	mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
998 
999 	if (enable) {
1000 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1001 		mt7915_mcu_bss_bmc_tlv(skb, phy);
1002 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1003 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
1004 
1005 		if (vif->bss_conf.he_support)
1006 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
1007 
1008 		if (mvif->omac_idx >= EXT_BSSID_START &&
1009 		    mvif->omac_idx < REPEATER_BSSID_START)
1010 			mt7915_mcu_bss_ext_tlv(skb, mvif);
1011 	}
1012 
1013 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1014 				     MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1015 }
1016 
1017 /** starec & wtbl **/
1018 static int
1019 mt7915_mcu_sta_key_tlv(struct sk_buff *skb, struct ieee80211_key_conf *key,
1020 		       enum set_key_cmd cmd)
1021 {
1022 	struct sta_rec_sec *sec;
1023 	struct tlv *tlv;
1024 	u32 len = sizeof(*sec);
1025 
1026 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1027 
1028 	sec = (struct sta_rec_sec *)tlv;
1029 	sec->add = cmd;
1030 
1031 	if (cmd == SET_KEY) {
1032 		struct sec_key *sec_key;
1033 		u8 cipher;
1034 
1035 		cipher = mt7915_mcu_get_cipher(key->cipher);
1036 		if (cipher == MT_CIPHER_NONE)
1037 			return -EOPNOTSUPP;
1038 
1039 		sec_key = &sec->key[0];
1040 		sec_key->cipher_len = sizeof(*sec_key);
1041 		sec_key->key_id = key->keyidx;
1042 
1043 		if (cipher == MT_CIPHER_BIP_CMAC_128) {
1044 			sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1045 			sec_key->key_len = 16;
1046 			memcpy(sec_key->key, key->key, 16);
1047 
1048 			sec_key = &sec->key[1];
1049 			sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1050 			sec_key->cipher_len = sizeof(*sec_key);
1051 			sec_key->key_len = 16;
1052 			memcpy(sec_key->key, key->key + 16, 16);
1053 
1054 			sec->n_cipher = 2;
1055 		} else {
1056 			sec_key->cipher_id = cipher;
1057 			sec_key->key_len = key->keylen;
1058 			memcpy(sec_key->key, key->key, key->keylen);
1059 
1060 			if (cipher == MT_CIPHER_TKIP) {
1061 				/* Rx/Tx MIC keys are swapped */
1062 				memcpy(sec_key->key + 16, key->key + 24, 8);
1063 				memcpy(sec_key->key + 24, key->key + 16, 8);
1064 			}
1065 
1066 			len -= sizeof(*sec_key);
1067 			sec->n_cipher = 1;
1068 		}
1069 	} else {
1070 		len -= sizeof(sec->key);
1071 		sec->n_cipher = 0;
1072 	}
1073 	sec->len = cpu_to_le16(len);
1074 
1075 	return 0;
1076 }
1077 
1078 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1079 		       struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1080 		       enum set_key_cmd cmd)
1081 {
1082 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1083 	struct sk_buff *skb;
1084 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1085 	int ret;
1086 
1087 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1088 	if (IS_ERR(skb))
1089 		return PTR_ERR(skb);
1090 
1091 	ret = mt7915_mcu_sta_key_tlv(skb, key, cmd);
1092 	if (ret)
1093 		return ret;
1094 
1095 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1096 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1097 }
1098 
1099 static void
1100 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1101 		      struct ieee80211_ampdu_params *params,
1102 		      bool enable, bool tx)
1103 {
1104 	struct sta_rec_ba *ba;
1105 	struct tlv *tlv;
1106 
1107 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1108 
1109 	ba = (struct sta_rec_ba *)tlv;
1110 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
1111 	ba->winsize = cpu_to_le16(params->buf_size);
1112 	ba->ssn = cpu_to_le16(params->ssn);
1113 	ba->ba_en = enable << params->tid;
1114 	ba->amsdu = params->amsdu;
1115 	ba->tid = params->tid;
1116 }
1117 
1118 static void
1119 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1120 		       struct ieee80211_ampdu_params *params,
1121 		       bool enable, bool tx, void *sta_wtbl,
1122 		       void *wtbl_tlv)
1123 {
1124 	struct wtbl_ba *ba;
1125 	struct tlv *tlv;
1126 
1127 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1128 					wtbl_tlv, sta_wtbl);
1129 
1130 	ba = (struct wtbl_ba *)tlv;
1131 	ba->tid = params->tid;
1132 
1133 	if (tx) {
1134 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1135 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1136 		ba->ba_en = enable;
1137 	} else {
1138 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1139 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1140 		ba->rst_ba_tid = params->tid;
1141 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1142 		ba->rst_ba_sb = 1;
1143 	}
1144 
1145 	if (enable && tx)
1146 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1147 }
1148 
1149 static int
1150 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1151 		  struct ieee80211_ampdu_params *params,
1152 		  bool enable, bool tx)
1153 {
1154 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1155 	struct mt7915_vif *mvif = msta->vif;
1156 	struct wtbl_req_hdr *wtbl_hdr;
1157 	struct tlv *sta_wtbl;
1158 	struct sk_buff *skb;
1159 	int ret;
1160 
1161 	if (enable && tx && !params->amsdu)
1162 		msta->wcid.amsdu = false;
1163 
1164 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1165 				       MT7915_STA_UPDATE_MAX_SIZE);
1166 	if (IS_ERR(skb))
1167 		return PTR_ERR(skb);
1168 
1169 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1170 
1171 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1172 					     &skb);
1173 	mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1174 
1175 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1176 				    MCU_EXT_CMD_STA_REC_UPDATE, true);
1177 	if (ret)
1178 		return ret;
1179 
1180 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1181 				       MT7915_STA_UPDATE_MAX_SIZE);
1182 	if (IS_ERR(skb))
1183 		return PTR_ERR(skb);
1184 
1185 	mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1186 
1187 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1188 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1189 }
1190 
1191 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1192 			 struct ieee80211_ampdu_params *params,
1193 			 bool enable)
1194 {
1195 	return mt7915_mcu_sta_ba(dev, params, enable, true);
1196 }
1197 
1198 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1199 			 struct ieee80211_ampdu_params *params,
1200 			 bool enable)
1201 {
1202 	return mt7915_mcu_sta_ba(dev, params, enable, false);
1203 }
1204 
1205 static void
1206 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1207 			    struct ieee80211_sta *sta, void *sta_wtbl,
1208 			    void *wtbl_tlv)
1209 {
1210 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1211 	struct wtbl_generic *generic;
1212 	struct wtbl_rx *rx;
1213 	struct tlv *tlv;
1214 
1215 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1216 					wtbl_tlv, sta_wtbl);
1217 
1218 	generic = (struct wtbl_generic *)tlv;
1219 
1220 	if (sta) {
1221 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1222 		generic->partial_aid = cpu_to_le16(sta->aid);
1223 		generic->muar_idx = mvif->omac_idx;
1224 		generic->qos = sta->wme;
1225 	} else {
1226 		/* use BSSID in station mode */
1227 		if (vif->type == NL80211_IFTYPE_STATION)
1228 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
1229 			       ETH_ALEN);
1230 		else
1231 			eth_broadcast_addr(generic->peer_addr);
1232 
1233 		generic->muar_idx = 0xe;
1234 	}
1235 
1236 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1237 					wtbl_tlv, sta_wtbl);
1238 
1239 	rx = (struct wtbl_rx *)tlv;
1240 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1241 	rx->rca2 = 1;
1242 	rx->rv = 1;
1243 }
1244 
1245 static void
1246 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1247 			 struct ieee80211_sta *sta, bool enable)
1248 {
1249 #define EXTRA_INFO_VER          BIT(0)
1250 #define EXTRA_INFO_NEW          BIT(1)
1251 	struct sta_rec_basic *basic;
1252 	struct tlv *tlv;
1253 
1254 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1255 
1256 	basic = (struct sta_rec_basic *)tlv;
1257 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1258 
1259 	if (enable) {
1260 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1261 		basic->conn_state = CONN_STATE_PORT_SECURE;
1262 	} else {
1263 		basic->conn_state = CONN_STATE_DISCONNECT;
1264 	}
1265 
1266 	if (!sta) {
1267 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1268 		eth_broadcast_addr(basic->peer_addr);
1269 		return;
1270 	}
1271 
1272 	switch (vif->type) {
1273 	case NL80211_IFTYPE_MESH_POINT:
1274 	case NL80211_IFTYPE_AP:
1275 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1276 		break;
1277 	case NL80211_IFTYPE_STATION:
1278 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1279 		break;
1280 	case NL80211_IFTYPE_ADHOC:
1281 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1282 		break;
1283 	default:
1284 		WARN_ON(1);
1285 		break;
1286 	}
1287 
1288 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1289 	basic->aid = cpu_to_le16(sta->aid);
1290 	basic->qos = sta->wme;
1291 }
1292 
1293 static void
1294 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1295 {
1296 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1297 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1298 	struct sta_rec_he *he;
1299 	struct tlv *tlv;
1300 	u32 cap = 0;
1301 
1302 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1303 
1304 	he = (struct sta_rec_he *)tlv;
1305 
1306 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1307 		cap |= STA_REC_HE_CAP_HTC;
1308 
1309 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1310 		cap |= STA_REC_HE_CAP_BSR;
1311 
1312 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1313 		cap |= STA_REC_HE_CAP_OM;
1314 
1315 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1316 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1317 
1318 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1319 		cap |= STA_REC_HE_CAP_BQR;
1320 
1321 	if (elem->phy_cap_info[0] &
1322 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1323 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1324 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1325 
1326 	if (elem->phy_cap_info[1] &
1327 	    IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1328 		cap |= STA_REC_HE_CAP_LDPC;
1329 
1330 	if (elem->phy_cap_info[1] &
1331 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1332 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1333 
1334 	if (elem->phy_cap_info[2] &
1335 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1336 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1337 
1338 	if (elem->phy_cap_info[2] &
1339 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1340 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1341 
1342 	if (elem->phy_cap_info[2] &
1343 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1344 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1345 
1346 	if (elem->phy_cap_info[6] &
1347 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1348 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1349 
1350 	if (elem->phy_cap_info[7] &
1351 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1352 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1353 
1354 	if (elem->phy_cap_info[7] &
1355 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1356 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1357 
1358 	if (elem->phy_cap_info[7] &
1359 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1360 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1361 
1362 	if (elem->phy_cap_info[8] &
1363 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1364 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1365 
1366 	if (elem->phy_cap_info[8] &
1367 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1368 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1369 
1370 	if (elem->phy_cap_info[9] &
1371 	    IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1372 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1373 
1374 	if (elem->phy_cap_info[9] &
1375 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1376 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1377 
1378 	if (elem->phy_cap_info[9] &
1379 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1380 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1381 
1382 	he->he_cap = cpu_to_le32(cap);
1383 
1384 	switch (sta->bandwidth) {
1385 	case IEEE80211_STA_RX_BW_160:
1386 		if (elem->phy_cap_info[0] &
1387 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1388 			he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1389 				he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1390 
1391 		he->max_nss_mcs[CMD_HE_MCS_BW160] =
1392 				he_cap->he_mcs_nss_supp.rx_mcs_160;
1393 		fallthrough;
1394 	default:
1395 		he->max_nss_mcs[CMD_HE_MCS_BW80] =
1396 				he_cap->he_mcs_nss_supp.rx_mcs_80;
1397 		break;
1398 	}
1399 
1400 	he->t_frame_dur =
1401 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1402 	he->max_ampdu_exp =
1403 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1404 
1405 	he->bw_set =
1406 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1407 	he->device_class =
1408 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1409 	he->punc_pream_rx =
1410 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1411 
1412 	he->dcm_tx_mode =
1413 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1414 	he->dcm_tx_max_nss =
1415 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1416 	he->dcm_rx_mode =
1417 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1418 	he->dcm_rx_max_nss =
1419 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1420 	he->dcm_rx_max_nss =
1421 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1422 
1423 	he->pkt_ext = 2;
1424 }
1425 
1426 static void
1427 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1428 		     struct ieee80211_vif *vif)
1429 {
1430 	struct sta_rec_uapsd *uapsd;
1431 	struct tlv *tlv;
1432 
1433 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1434 		return;
1435 
1436 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1437 	uapsd = (struct sta_rec_uapsd *)tlv;
1438 
1439 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1440 		uapsd->dac_map |= BIT(3);
1441 		uapsd->tac_map |= BIT(3);
1442 	}
1443 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1444 		uapsd->dac_map |= BIT(2);
1445 		uapsd->tac_map |= BIT(2);
1446 	}
1447 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1448 		uapsd->dac_map |= BIT(1);
1449 		uapsd->tac_map |= BIT(1);
1450 	}
1451 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1452 		uapsd->dac_map |= BIT(0);
1453 		uapsd->tac_map |= BIT(0);
1454 	}
1455 	uapsd->max_sp = sta->max_sp;
1456 }
1457 
1458 static void
1459 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1460 {
1461 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1462 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1463 	struct sta_rec_muru *muru;
1464 	struct tlv *tlv;
1465 
1466 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1467 
1468 	muru = (struct sta_rec_muru *)tlv;
1469 	muru->cfg.ofdma_dl_en = true;
1470 	muru->cfg.mimo_dl_en = true;
1471 
1472 	muru->ofdma_dl.punc_pream_rx =
1473 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1474 	muru->ofdma_dl.he_20m_in_40m_2g =
1475 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1476 	muru->ofdma_dl.he_20m_in_160m =
1477 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1478 	muru->ofdma_dl.he_80m_in_160m =
1479 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1480 	muru->ofdma_dl.lt16_sigb = 0;
1481 	muru->ofdma_dl.rx_su_comp_sigb = 0;
1482 	muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1483 
1484 	muru->ofdma_ul.t_frame_dur =
1485 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1486 	muru->ofdma_ul.mu_cascading =
1487 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1488 	muru->ofdma_ul.uo_ra =
1489 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1490 	muru->ofdma_ul.he_2x996_tone = 0;
1491 	muru->ofdma_ul.rx_t_frame_11ac = 0;
1492 
1493 	muru->mimo_dl.vht_mu_bfee =
1494 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1495 	muru->mimo_dl.partial_bw_dl_mimo =
1496 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1497 
1498 	muru->mimo_ul.full_ul_mimo =
1499 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1500 	muru->mimo_ul.partial_ul_mimo =
1501 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1502 }
1503 
1504 static int
1505 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1506 		  struct ieee80211_sta *sta)
1507 {
1508 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1509 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1510 	struct sk_buff *skb;
1511 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1512 
1513 	if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1514 		return 0;
1515 
1516 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1517 	if (IS_ERR(skb))
1518 		return PTR_ERR(skb);
1519 
1520 	/* starec muru */
1521 	mt7915_mcu_sta_muru_tlv(skb, sta);
1522 
1523 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1524 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1525 }
1526 
1527 static void
1528 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1529 {
1530 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1531 	struct sta_rec_amsdu *amsdu;
1532 	struct tlv *tlv;
1533 
1534 	if (!sta->max_amsdu_len)
1535 	    return;
1536 
1537 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1538 	amsdu = (struct sta_rec_amsdu *)tlv;
1539 	amsdu->max_amsdu_num = 8;
1540 	amsdu->amsdu_en = true;
1541 	amsdu->max_mpdu_size = sta->max_amsdu_len >=
1542 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
1543 	msta->wcid.amsdu = true;
1544 }
1545 
1546 static bool
1547 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1548 {
1549 	switch (vif->type) {
1550 	case NL80211_IFTYPE_AP:
1551 	case NL80211_IFTYPE_STATION:
1552 		return true;
1553 	default:
1554 		return false;
1555 	}
1556 }
1557 
1558 static void
1559 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1560 		   struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1561 {
1562 	struct tlv *tlv;
1563 
1564 	/* starec ht */
1565 	if (sta->ht_cap.ht_supported) {
1566 		struct sta_rec_ht *ht;
1567 
1568 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1569 		ht = (struct sta_rec_ht *)tlv;
1570 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1571 
1572 		if (mt7915_hw_amsdu_supported(vif))
1573 			mt7915_mcu_sta_amsdu_tlv(skb, sta);
1574 	}
1575 
1576 	/* starec vht */
1577 	if (sta->vht_cap.vht_supported) {
1578 		struct sta_rec_vht *vht;
1579 
1580 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1581 		vht = (struct sta_rec_vht *)tlv;
1582 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1583 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1584 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1585 	}
1586 
1587 	/* starec he */
1588 	if (sta->he_cap.has_he)
1589 		mt7915_mcu_sta_he_tlv(skb, sta);
1590 
1591 	/* starec uapsd */
1592 	mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1593 }
1594 
1595 static void
1596 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1597 			 void *sta_wtbl, void *wtbl_tlv)
1598 {
1599 	struct wtbl_smps *smps;
1600 	struct tlv *tlv;
1601 
1602 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1603 					wtbl_tlv, sta_wtbl);
1604 	smps = (struct wtbl_smps *)tlv;
1605 
1606 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1607 		smps->smps = true;
1608 }
1609 
1610 static void
1611 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1612 		       void *sta_wtbl, void *wtbl_tlv)
1613 {
1614 	struct wtbl_ht *ht = NULL;
1615 	struct tlv *tlv;
1616 
1617 	/* wtbl ht */
1618 	if (sta->ht_cap.ht_supported) {
1619 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1620 						wtbl_tlv, sta_wtbl);
1621 		ht = (struct wtbl_ht *)tlv;
1622 		ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1623 		ht->af = sta->ht_cap.ampdu_factor;
1624 		ht->mm = sta->ht_cap.ampdu_density;
1625 		ht->ht = true;
1626 	}
1627 
1628 	/* wtbl vht */
1629 	if (sta->vht_cap.vht_supported) {
1630 		struct wtbl_vht *vht;
1631 		u8 af;
1632 
1633 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1634 						wtbl_tlv, sta_wtbl);
1635 		vht = (struct wtbl_vht *)tlv;
1636 		vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1637 		vht->vht = true;
1638 
1639 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1640 			       sta->vht_cap.cap);
1641 		if (ht)
1642 			ht->af = max_t(u8, ht->af, af);
1643 	}
1644 
1645 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1646 }
1647 
1648 static void
1649 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1650 			      struct ieee80211_sta *sta,
1651 			      void *sta_wtbl, void *wtbl_tlv)
1652 {
1653 	struct mt7915_sta *msta;
1654 	struct wtbl_hdr_trans *htr = NULL;
1655 	struct tlv *tlv;
1656 
1657 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1658 					wtbl_tlv, sta_wtbl);
1659 	htr = (struct wtbl_hdr_trans *)tlv;
1660 	htr->no_rx_trans = true;
1661 	if (vif->type == NL80211_IFTYPE_STATION)
1662 		htr->to_ds = true;
1663 	else
1664 		htr->from_ds = true;
1665 
1666 	if (!sta)
1667 		return;
1668 
1669 	msta = (struct mt7915_sta *)sta->drv_priv;
1670 	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1671 		htr->to_ds = true;
1672 		htr->from_ds = true;
1673 	}
1674 }
1675 
1676 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1677 				    struct ieee80211_vif *vif,
1678 				    struct ieee80211_sta *sta)
1679 {
1680 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1681 	struct wtbl_req_hdr *wtbl_hdr;
1682 	struct sk_buff *skb;
1683 
1684 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1685 	if (!skb)
1686 		return -ENOMEM;
1687 
1688 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1689 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1690 
1691 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1692 				     true);
1693 }
1694 
1695 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1696 			struct ieee80211_sta *sta)
1697 {
1698 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1699 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1700 	struct wtbl_req_hdr *wtbl_hdr;
1701 	struct tlv *sta_wtbl;
1702 	struct sk_buff *skb;
1703 
1704 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1705 				       MT7915_STA_UPDATE_MAX_SIZE);
1706 	if (IS_ERR(skb))
1707 		return PTR_ERR(skb);
1708 
1709 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1710 
1711 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1712 					     &skb);
1713 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1714 
1715 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1716 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
1717 }
1718 
1719 static void
1720 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1721 {
1722 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1723 	bf->ndp_rate = 0;				/* mcs0 */
1724 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1725 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1726 }
1727 
1728 static void
1729 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct sta_rec_bf *bf)
1730 {
1731 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1732 	u8 n = 0;
1733 
1734 	bf->tx_mode = MT_PHY_TYPE_HT;
1735 	bf->bf_cap |= MT_IBF;
1736 
1737 	if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1738 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1739 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1740 			      mcs->tx_params);
1741 	else if (mcs->rx_mask[3])
1742 		n = 3;
1743 	else if (mcs->rx_mask[2])
1744 		n = 2;
1745 	else if (mcs->rx_mask[1])
1746 		n = 1;
1747 
1748 	bf->nc = min_t(u8, bf->nr, n);
1749 	bf->ibf_ncol = bf->nc;
1750 
1751 	if (sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1752 		bf->ibf_timeout = 0x48;
1753 }
1754 
1755 static void
1756 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1757 			struct sta_rec_bf *bf)
1758 {
1759 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1760 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1761 	u8 bfee_nr, bfer_nr, n, tx_ant = hweight8(phy->chainmask) - 1;
1762 	u16 mcs_map;
1763 
1764 	bf->tx_mode = MT_PHY_TYPE_VHT;
1765 	bf->bf_cap |= MT_EBF;
1766 
1767 	mt7915_mcu_sta_sounding_rate(bf);
1768 
1769 	bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1770 			    pc->cap);
1771 	bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1772 			    vc->cap);
1773 	mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1774 
1775 	n = min_t(u8, bfer_nr, bfee_nr);
1776 	bf->nr = min_t(u8, n, tx_ant);
1777 	n = mt7915_mcu_get_sta_nss(mcs_map);
1778 
1779 	bf->nc = min_t(u8, n, bf->nr);
1780 	bf->ibf_ncol = bf->nc;
1781 
1782 	/* force nr from 4 to 2 */
1783 	if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1784 		bf->nr = 1;
1785 }
1786 
1787 static void
1788 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1789 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1790 {
1791 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1792 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1793 	const struct ieee80211_he_cap_elem *ve;
1794 	const struct ieee80211_sta_he_cap *vc;
1795 	u8 bfee_nr, bfer_nr, nss_mcs;
1796 	u16 mcs_map;
1797 
1798 	vc = mt7915_get_he_phy_cap(phy, vif);
1799 	ve = &vc->he_cap_elem;
1800 
1801 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1802 	bf->bf_cap |= MT_EBF;
1803 
1804 	mt7915_mcu_sta_sounding_rate(bf);
1805 
1806 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1807 				pe->phy_cap_info[6]);
1808 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1809 				pe->phy_cap_info[6]);
1810 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1811 			 ve->phy_cap_info[5]);
1812 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1813 			 pe->phy_cap_info[4]);
1814 
1815 	mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.tx_mcs_80);
1816 	nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1817 
1818 	bf->nr = min_t(u8, bfer_nr, bfee_nr);
1819 	bf->nc = min_t(u8, nss_mcs, bf->nr);
1820 	bf->ibf_ncol = bf->nc;
1821 
1822 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1823 		return;
1824 
1825 	/* go over for 160MHz and 80p80 */
1826 	if (pe->phy_cap_info[0] &
1827 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1828 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1829 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1830 
1831 		bf->nc_bw160 = nss_mcs;
1832 	}
1833 
1834 	if (pe->phy_cap_info[0] &
1835 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1836 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1837 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1838 
1839 		if (bf->nc_bw160)
1840 			bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1841 		else
1842 			bf->nc_bw160 = nss_mcs;
1843 	}
1844 
1845 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1846 			 ve->phy_cap_info[5]);
1847 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1848 			 pe->phy_cap_info[4]);
1849 
1850 	bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1851 }
1852 
1853 static void
1854 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1855 			struct ieee80211_vif *vif, struct mt7915_phy *phy,
1856 			bool enable)
1857 {
1858 	struct sta_rec_bf *bf;
1859 	struct tlv *tlv;
1860 	int tx_ant = hweight8(phy->chainmask) - 1;
1861 	const u8 matrix[4][4] = {
1862 		{0, 0, 0, 0},
1863 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1864 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1865 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1866 	};
1867 
1868 #define MT_BFER_FREE		cpu_to_le16(GENMASK(15, 0))
1869 
1870 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1871 	bf = (struct sta_rec_bf *)tlv;
1872 
1873 	if (!enable) {
1874 		bf->pfmu = MT_BFER_FREE;
1875 		return;
1876 	}
1877 
1878 	bf->bw = sta->bandwidth;
1879 	bf->ibf_dbw = sta->bandwidth;
1880 	bf->ibf_nrow = tx_ant;
1881 	bf->ibf_timeout = 0x18;
1882 
1883 	if (sta->he_cap.has_he)
1884 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1885 	else if (sta->vht_cap.vht_supported)
1886 		mt7915_mcu_sta_bfer_vht(sta, phy, bf);
1887 	else if (sta->ht_cap.ht_supported)
1888 		mt7915_mcu_sta_bfer_ht(sta, bf);
1889 
1890 	if (bf->bf_cap & MT_EBF && bf->nr != tx_ant)
1891 		bf->mem_20m = matrix[tx_ant][bf->nc];
1892 	else
1893 		bf->mem_20m = matrix[bf->nr][bf->nc];
1894 
1895 	switch (sta->bandwidth) {
1896 	case IEEE80211_STA_RX_BW_160:
1897 	case IEEE80211_STA_RX_BW_80:
1898 		bf->mem_total = bf->mem_20m * 2;
1899 		break;
1900 	case IEEE80211_STA_RX_BW_40:
1901 		bf->mem_total = bf->mem_20m;
1902 		break;
1903 	case IEEE80211_STA_RX_BW_20:
1904 	default:
1905 		break;
1906 	}
1907 }
1908 
1909 static void
1910 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1911 			struct mt7915_phy *phy)
1912 {
1913 	struct sta_rec_bfee *bfee;
1914 	struct tlv *tlv;
1915 	int tx_ant = hweight8(phy->chainmask) - 1;
1916 	u8 nr = 0;
1917 
1918 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1919 	bfee = (struct sta_rec_bfee *)tlv;
1920 
1921 	if (sta->he_cap.has_he) {
1922 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1923 
1924 		nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1925 			    pe->phy_cap_info[5]);
1926 	} else if (sta->vht_cap.vht_supported) {
1927 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1928 
1929 		nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1930 			       pc->cap);
1931 	}
1932 
1933 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1934 	if (nr == 1 && tx_ant == 2)
1935 		bfee->fb_identity_matrix = true;
1936 }
1937 
1938 static u8
1939 mt7915_mcu_sta_txbf_type(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1940 			 struct ieee80211_sta *sta)
1941 {
1942 	u8 type = 0;
1943 
1944 	if (vif->type != NL80211_IFTYPE_STATION &&
1945 	    vif->type != NL80211_IFTYPE_AP)
1946 		return 0;
1947 
1948 	if (sta->he_cap.has_he) {
1949 		struct ieee80211_he_cap_elem *pe;
1950 		const struct ieee80211_he_cap_elem *ve;
1951 		const struct ieee80211_sta_he_cap *vc;
1952 
1953 		pe = &sta->he_cap.he_cap_elem;
1954 		vc = mt7915_get_he_phy_cap(phy, vif);
1955 		ve = &vc->he_cap_elem;
1956 
1957 		if ((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
1958 		     HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
1959 		    HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]))
1960 			type |= MT_STA_BFEE;
1961 
1962 		if ((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
1963 		     HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
1964 		    HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]))
1965 			type |= MT_STA_BFER;
1966 	} else if (sta->vht_cap.vht_supported) {
1967 		struct ieee80211_sta_vht_cap *pc;
1968 		struct ieee80211_sta_vht_cap *vc;
1969 		u32 cr, ce;
1970 
1971 		pc = &sta->vht_cap;
1972 		vc = &phy->mt76->sband_5g.sband.vht_cap;
1973 		cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
1974 		     IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
1975 		ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
1976 		     IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1977 
1978 		if ((pc->cap & cr) && (vc->cap & ce))
1979 			type |= MT_STA_BFEE;
1980 
1981 		if ((vc->cap & cr) && (pc->cap & ce))
1982 			type |= MT_STA_BFER;
1983 	} else if (sta->ht_cap.ht_supported) {
1984 		/* TODO: iBF */
1985 	}
1986 
1987 	return type;
1988 }
1989 
1990 static int
1991 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1992 		    struct ieee80211_sta *sta, bool enable)
1993 {
1994 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1995 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1996 	struct mt7915_phy *phy;
1997 	struct sk_buff *skb;
1998 	int r, len;
1999 	u8 type;
2000 
2001 	phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2002 
2003 	type = mt7915_mcu_sta_txbf_type(phy, vif, sta);
2004 
2005 	/* must keep each tag independent */
2006 
2007 	/* starec bf */
2008 	if (type & MT_STA_BFER) {
2009 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2010 
2011 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2012 		if (IS_ERR(skb))
2013 			return PTR_ERR(skb);
2014 
2015 		mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable);
2016 
2017 		r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2018 					  MCU_EXT_CMD_STA_REC_UPDATE, true);
2019 		if (r)
2020 			return r;
2021 	}
2022 
2023 	/* starec bfee */
2024 	if (type & MT_STA_BFEE) {
2025 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2026 
2027 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2028 		if (IS_ERR(skb))
2029 			return PTR_ERR(skb);
2030 
2031 		mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2032 
2033 		r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2034 					  MCU_EXT_CMD_STA_REC_UPDATE, true);
2035 		if (r)
2036 			return r;
2037 	}
2038 
2039 	return 0;
2040 }
2041 
2042 static void
2043 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2044 			     struct ieee80211_vif *vif,
2045 			     struct ieee80211_sta *sta)
2046 {
2047 	struct cfg80211_chan_def *chandef = &dev->mphy.chandef;
2048 	struct sta_rec_ra *ra;
2049 	struct tlv *tlv;
2050 	enum nl80211_band band = chandef->chan->band;
2051 	u32 supp_rate = sta->supp_rates[band];
2052 	int n_rates = hweight32(supp_rate);
2053 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
2054 	u8 i, nss = sta->rx_nss, mcs = 0;
2055 
2056 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2057 
2058 	ra = (struct sta_rec_ra *)tlv;
2059 	ra->valid = true;
2060 	ra->auto_rate = true;
2061 	ra->phy_mode = mt7915_get_phy_mode(dev, vif, band, sta);
2062 	ra->channel = chandef->chan->hw_value;
2063 	ra->bw = sta->bandwidth;
2064 	ra->rate_len = n_rates;
2065 	ra->phy.bw = sta->bandwidth;
2066 
2067 	if (n_rates) {
2068 		if (band == NL80211_BAND_2GHZ) {
2069 			ra->supp_mode = MODE_CCK;
2070 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2071 			ra->phy.type = MT_PHY_TYPE_CCK;
2072 
2073 			if (n_rates > 4) {
2074 				ra->supp_mode |= MODE_OFDM;
2075 				ra->supp_ofdm_rate = supp_rate >> 4;
2076 				ra->phy.type = MT_PHY_TYPE_OFDM;
2077 			}
2078 		} else {
2079 			ra->supp_mode = MODE_OFDM;
2080 			ra->supp_ofdm_rate = supp_rate;
2081 			ra->phy.type = MT_PHY_TYPE_OFDM;
2082 		}
2083 	}
2084 
2085 	if (sta->ht_cap.ht_supported) {
2086 		for (i = 0; i < nss; i++)
2087 			ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2088 
2089 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2090 		ra->supp_mode |= MODE_HT;
2091 		mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2092 		ra->af = sta->ht_cap.ampdu_factor;
2093 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2094 
2095 		cap |= STA_CAP_HT;
2096 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2097 			cap |= STA_CAP_SGI_20;
2098 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2099 			cap |= STA_CAP_SGI_40;
2100 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2101 			cap |= STA_CAP_TX_STBC;
2102 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2103 			cap |= STA_CAP_RX_STBC;
2104 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2105 			cap |= STA_CAP_LDPC;
2106 	}
2107 
2108 	if (sta->vht_cap.vht_supported) {
2109 		u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2110 		u16 vht_mcs;
2111 		u8 af, mcs_prev;
2112 
2113 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2114 			       sta->vht_cap.cap);
2115 		ra->af = max_t(u8, ra->af, af);
2116 
2117 		cap |= STA_CAP_VHT;
2118 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2119 			cap |= STA_CAP_VHT_SGI_80;
2120 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2121 			cap |= STA_CAP_VHT_SGI_160;
2122 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2123 			cap |= STA_CAP_VHT_TX_STBC;
2124 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2125 			cap |= STA_CAP_VHT_RX_STBC;
2126 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2127 			cap |= STA_CAP_VHT_LDPC;
2128 
2129 		ra->supp_mode |= MODE_VHT;
2130 		for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2131 			switch (mcs_map & 0x3) {
2132 			case IEEE80211_VHT_MCS_SUPPORT_0_9:
2133 				vht_mcs = GENMASK(9, 0);
2134 				break;
2135 			case IEEE80211_VHT_MCS_SUPPORT_0_8:
2136 				vht_mcs = GENMASK(8, 0);
2137 				break;
2138 			case IEEE80211_VHT_MCS_SUPPORT_0_7:
2139 				vht_mcs = GENMASK(7, 0);
2140 				break;
2141 			default:
2142 				vht_mcs = 0;
2143 			}
2144 
2145 			ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2146 
2147 			mcs_prev = hweight16(vht_mcs) - 1;
2148 			if (mcs_prev > mcs)
2149 				mcs = mcs_prev;
2150 
2151 			/* only support 2ss on 160MHz */
2152 			if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2153 				      ra->bw == CMD_CBW_8080MHZ))
2154 				break;
2155 		}
2156 	}
2157 
2158 	if (sta->he_cap.has_he) {
2159 		ra->supp_mode |= MODE_HE;
2160 		cap |= STA_CAP_HE;
2161 	}
2162 
2163 	ra->sta_status = cpu_to_le32(cap);
2164 
2165 	switch (BIT(fls(ra->supp_mode) - 1)) {
2166 	case MODE_VHT:
2167 		ra->phy.type = MT_PHY_TYPE_VHT;
2168 		ra->phy.mcs = mcs;
2169 		ra->phy.nss = nss;
2170 		ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2171 		ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2172 		ra->phy.sgi =
2173 			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2174 		break;
2175 	case MODE_HT:
2176 		ra->phy.type = MT_PHY_TYPE_HT;
2177 		ra->phy.mcs = mcs;
2178 		ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2179 		ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2180 		ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2181 		break;
2182 	default:
2183 		break;
2184 	}
2185 }
2186 
2187 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2188 			     struct ieee80211_sta *sta)
2189 {
2190 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2191 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2192 	struct sk_buff *skb;
2193 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2194 
2195 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2196 	if (IS_ERR(skb))
2197 		return PTR_ERR(skb);
2198 
2199 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2200 
2201 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2202 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
2203 }
2204 
2205 static int
2206 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2207 		     struct ieee80211_sta *sta)
2208 {
2209 #define MT_STA_BSS_GROUP		1
2210 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2211 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2212 	struct {
2213 		__le32 action;
2214 		u8 wlan_idx_lo;
2215 		u8 status;
2216 		u8 wlan_idx_hi;
2217 		u8 rsv0[5];
2218 		__le32 val;
2219 		u8 rsv1[8];
2220 	} __packed req = {
2221 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
2222 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
2223 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
2224 		.val = cpu_to_le32(mvif->idx % 16),
2225 	};
2226 
2227 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_DRR_CTRL, &req,
2228 				 sizeof(req), true);
2229 }
2230 
2231 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2232 			   struct ieee80211_sta *sta, bool enable)
2233 {
2234 	int ret;
2235 
2236 	if (!sta)
2237 		return 0;
2238 
2239 	/* must keep the order */
2240 	ret = mt7915_mcu_add_group(dev, vif, sta);
2241 	if (ret)
2242 		return ret;
2243 
2244 	ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2245 	if (ret)
2246 		return ret;
2247 
2248 	ret = mt7915_mcu_add_mu(dev, vif, sta);
2249 	if (ret)
2250 		return ret;
2251 
2252 	if (enable)
2253 		return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2254 
2255 	return 0;
2256 }
2257 
2258 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2259 		       struct ieee80211_sta *sta, bool enable)
2260 {
2261 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2262 	struct wtbl_req_hdr *wtbl_hdr;
2263 	struct mt7915_sta *msta;
2264 	struct tlv *sta_wtbl;
2265 	struct sk_buff *skb;
2266 
2267 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2268 
2269 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2270 				       MT7915_STA_UPDATE_MAX_SIZE);
2271 	if (IS_ERR(skb))
2272 		return PTR_ERR(skb);
2273 
2274 	mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2275 	if (enable && sta)
2276 		mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2277 
2278 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2279 
2280 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2281 					     sta_wtbl, &skb);
2282 	if (enable) {
2283 		mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2284 		mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2285 		if (sta)
2286 			mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2287 	}
2288 
2289 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2290 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
2291 }
2292 
2293 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2294 			      struct ieee80211_sta *sta, u32 rate)
2295 {
2296 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2297 	struct mt7915_vif *mvif = msta->vif;
2298 	struct sta_rec_ra_fixed *ra;
2299 	struct sk_buff *skb;
2300 	struct tlv *tlv;
2301 	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2302 
2303 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2304 	if (IS_ERR(skb))
2305 		return PTR_ERR(skb);
2306 
2307 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2308 	ra = (struct sta_rec_ra_fixed *)tlv;
2309 
2310 	if (!rate) {
2311 		ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2312 		goto out;
2313 	} else {
2314 		ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2315 	}
2316 
2317 	ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2318 	ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2319 	ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2320 	ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2321 	ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2322 
2323 	if (ra->phy.bw)
2324 		ra->phy.ldpc = 7;
2325 	else
2326 		ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2327 
2328 	/* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2329 	if (ra->phy.type > MT_PHY_TYPE_VHT)
2330 		ra->phy.sgi = ra->phy.mcs * 85;
2331 	else
2332 		ra->phy.sgi = ra->phy.mcs * 15;
2333 
2334 out:
2335 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2336 				     MCU_EXT_CMD_STA_REC_UPDATE, true);
2337 }
2338 
2339 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2340 			    struct ieee80211_vif *vif, bool enable)
2341 {
2342 	struct mt7915_dev *dev = phy->dev;
2343 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2344 	struct {
2345 		struct req_hdr {
2346 			u8 omac_idx;
2347 			u8 dbdc_idx;
2348 			__le16 tlv_num;
2349 			u8 is_tlv_append;
2350 			u8 rsv[3];
2351 		} __packed hdr;
2352 		struct req_tlv {
2353 			__le16 tag;
2354 			__le16 len;
2355 			u8 active;
2356 			u8 dbdc_idx;
2357 			u8 omac_addr[ETH_ALEN];
2358 		} __packed tlv;
2359 	} data = {
2360 		.hdr = {
2361 			.omac_idx = mvif->omac_idx,
2362 			.dbdc_idx = mvif->band_idx,
2363 			.tlv_num = cpu_to_le16(1),
2364 			.is_tlv_append = 1,
2365 		},
2366 		.tlv = {
2367 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2368 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2369 			.active = enable,
2370 			.dbdc_idx = mvif->band_idx,
2371 		},
2372 	};
2373 
2374 	if (mvif->omac_idx >= REPEATER_BSSID_START)
2375 		return mt7915_mcu_muar_config(phy, vif, false, enable);
2376 
2377 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2378 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
2379 				 &data, sizeof(data), true);
2380 }
2381 
2382 static void
2383 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2384 		      struct bss_info_bcn *bcn,
2385 		      struct ieee80211_mutable_offsets *offs)
2386 {
2387 	if (offs->cntdwn_counter_offs[0]) {
2388 		struct tlv *tlv;
2389 		struct bss_info_bcn_csa *csa;
2390 
2391 		tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2392 						   sizeof(*csa), &bcn->sub_ntlv,
2393 						   &bcn->len);
2394 		csa = (struct bss_info_bcn_csa *)tlv;
2395 		csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2396 	}
2397 }
2398 
2399 static void
2400 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2401 		       struct sk_buff *skb, struct bss_info_bcn *bcn,
2402 		       struct ieee80211_mutable_offsets *offs)
2403 {
2404 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2405 	struct bss_info_bcn_cont *cont;
2406 	struct tlv *tlv;
2407 	u8 *buf;
2408 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2409 
2410 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2411 					   len, &bcn->sub_ntlv, &bcn->len);
2412 
2413 	cont = (struct bss_info_bcn_cont *)tlv;
2414 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2415 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2416 
2417 	if (offs->cntdwn_counter_offs[0])
2418 		cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2419 
2420 	buf = (u8 *)tlv + sizeof(*cont);
2421 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2422 			      true);
2423 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2424 }
2425 
2426 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2427 			  struct ieee80211_vif *vif, int en)
2428 {
2429 #define MAX_BEACON_SIZE 512
2430 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2431 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2432 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2433 	struct ieee80211_mutable_offsets offs;
2434 	struct ieee80211_tx_info *info;
2435 	struct sk_buff *skb, *rskb;
2436 	struct tlv *tlv;
2437 	struct bss_info_bcn *bcn;
2438 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2439 
2440 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2441 	if (!skb)
2442 		return -EINVAL;
2443 
2444 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2445 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2446 		dev_kfree_skb(skb);
2447 		return -EINVAL;
2448 	}
2449 
2450 	rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2451 	if (IS_ERR(rskb)) {
2452 		dev_kfree_skb(skb);
2453 		return PTR_ERR(rskb);
2454 	}
2455 
2456 	tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2457 	bcn = (struct bss_info_bcn *)tlv;
2458 	bcn->enable = en;
2459 
2460 	if (mvif->band_idx) {
2461 		info = IEEE80211_SKB_CB(skb);
2462 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2463 	}
2464 
2465 	/* TODO: subtag - bss color count & 11v MBSSID */
2466 	mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2467 	mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2468 	dev_kfree_skb(skb);
2469 
2470 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2471 				     MCU_EXT_CMD_BSS_INFO_UPDATE, true);
2472 }
2473 
2474 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2475 				     u32 option)
2476 {
2477 	struct {
2478 		__le32 option;
2479 		__le32 addr;
2480 	} req = {
2481 		.option = cpu_to_le32(option),
2482 		.addr = cpu_to_le32(addr),
2483 	};
2484 
2485 	return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ, &req,
2486 				 sizeof(req), true);
2487 }
2488 
2489 static int mt7915_mcu_restart(struct mt76_dev *dev)
2490 {
2491 	struct {
2492 		u8 power_mode;
2493 		u8 rsv[3];
2494 	} req = {
2495 		.power_mode = 1,
2496 	};
2497 
2498 	return mt76_mcu_send_msg(dev, -MCU_CMD_NIC_POWER_CTRL, &req,
2499 				 sizeof(req), false);
2500 }
2501 
2502 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2503 {
2504 	struct {
2505 		__le32 op;
2506 	} req = {
2507 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2508 	};
2509 
2510 	return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL, &req,
2511 				 sizeof(req), true);
2512 }
2513 
2514 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2515 {
2516 	struct {
2517 		u8 check_crc;
2518 		u8 reserved[3];
2519 	} req = {
2520 		.check_crc = 0,
2521 	};
2522 
2523 	return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ, &req,
2524 				 sizeof(req), true);
2525 }
2526 
2527 static int mt7915_driver_own(struct mt7915_dev *dev)
2528 {
2529 	u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2530 
2531 	mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2532 	if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2533 			    0, 500)) {
2534 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2535 		return -EIO;
2536 	}
2537 
2538 	return 0;
2539 }
2540 
2541 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2542 				    u32 len, u32 mode)
2543 {
2544 	struct {
2545 		__le32 addr;
2546 		__le32 len;
2547 		__le32 mode;
2548 	} req = {
2549 		.addr = cpu_to_le32(addr),
2550 		.len = cpu_to_le32(len),
2551 		.mode = cpu_to_le32(mode),
2552 	};
2553 	int attr;
2554 
2555 	if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2556 		attr = -MCU_CMD_PATCH_START_REQ;
2557 	else
2558 		attr = -MCU_CMD_TARGET_ADDRESS_LEN_REQ;
2559 
2560 	return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2561 }
2562 
2563 static int mt7915_load_patch(struct mt7915_dev *dev)
2564 {
2565 	const struct mt7915_patch_hdr *hdr;
2566 	const struct firmware *fw = NULL;
2567 	int i, ret, sem;
2568 
2569 	sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2570 	switch (sem) {
2571 	case PATCH_IS_DL:
2572 		return 0;
2573 	case PATCH_NOT_DL_SEM_SUCCESS:
2574 		break;
2575 	default:
2576 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2577 		return -EAGAIN;
2578 	}
2579 
2580 	ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2581 	if (ret)
2582 		goto out;
2583 
2584 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2585 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2586 		ret = -EINVAL;
2587 		goto out;
2588 	}
2589 
2590 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2591 
2592 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2593 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2594 
2595 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2596 		struct mt7915_patch_sec *sec;
2597 		const u8 *dl;
2598 		u32 len, addr;
2599 
2600 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2601 						  i * sizeof(*sec));
2602 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2603 		    PATCH_SEC_TYPE_INFO) {
2604 			ret = -EINVAL;
2605 			goto out;
2606 		}
2607 
2608 		addr = be32_to_cpu(sec->info.addr);
2609 		len = be32_to_cpu(sec->info.len);
2610 		dl = fw->data + be32_to_cpu(sec->offs);
2611 
2612 		ret = mt7915_mcu_init_download(dev, addr, len,
2613 					       DL_MODE_NEED_RSP);
2614 		if (ret) {
2615 			dev_err(dev->mt76.dev, "Download request failed\n");
2616 			goto out;
2617 		}
2618 
2619 		ret = mt76_mcu_send_firmware(&dev->mt76, -MCU_CMD_FW_SCATTER,
2620 					     dl, len);
2621 		if (ret) {
2622 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2623 			goto out;
2624 		}
2625 	}
2626 
2627 	ret = mt7915_mcu_start_patch(dev);
2628 	if (ret)
2629 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2630 
2631 out:
2632 	sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2633 	switch (sem) {
2634 	case PATCH_REL_SEM_SUCCESS:
2635 		break;
2636 	default:
2637 		ret = -EAGAIN;
2638 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2639 		goto out;
2640 	}
2641 	release_firmware(fw);
2642 
2643 	return ret;
2644 }
2645 
2646 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2647 {
2648 	u32 ret = 0;
2649 
2650 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2651 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2652 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2653 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2654 	ret |= DL_MODE_NEED_RSP;
2655 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2656 
2657 	return ret;
2658 }
2659 
2660 static int
2661 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2662 			     const struct mt7915_fw_trailer *hdr,
2663 			     const u8 *data, bool is_wa)
2664 {
2665 	int i, offset = 0;
2666 	u32 override = 0, option = 0;
2667 
2668 	for (i = 0; i < hdr->n_region; i++) {
2669 		const struct mt7915_fw_region *region;
2670 		int err;
2671 		u32 len, addr, mode;
2672 
2673 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2674 			 (hdr->n_region - i) * sizeof(*region));
2675 		mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2676 		len = le32_to_cpu(region->len);
2677 		addr = le32_to_cpu(region->addr);
2678 
2679 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2680 			override = addr;
2681 
2682 		err = mt7915_mcu_init_download(dev, addr, len, mode);
2683 		if (err) {
2684 			dev_err(dev->mt76.dev, "Download request failed\n");
2685 			return err;
2686 		}
2687 
2688 		err = mt76_mcu_send_firmware(&dev->mt76, -MCU_CMD_FW_SCATTER,
2689 					     data + offset, len);
2690 		if (err) {
2691 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2692 			return err;
2693 		}
2694 
2695 		offset += len;
2696 	}
2697 
2698 	if (override)
2699 		option |= FW_START_OVERRIDE;
2700 
2701 	if (is_wa)
2702 		option |= FW_START_WORKING_PDA_CR4;
2703 
2704 	return mt7915_mcu_start_firmware(dev, override, option);
2705 }
2706 
2707 static int mt7915_load_ram(struct mt7915_dev *dev)
2708 {
2709 	const struct mt7915_fw_trailer *hdr;
2710 	const struct firmware *fw;
2711 	int ret;
2712 
2713 	ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2714 	if (ret)
2715 		return ret;
2716 
2717 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2718 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2719 		ret = -EINVAL;
2720 		goto out;
2721 	}
2722 
2723 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2724 					sizeof(*hdr));
2725 
2726 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2727 		 hdr->fw_ver, hdr->build_date);
2728 
2729 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2730 	if (ret) {
2731 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2732 		goto out;
2733 	}
2734 
2735 	release_firmware(fw);
2736 
2737 	ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2738 	if (ret)
2739 		return ret;
2740 
2741 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2742 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2743 		ret = -EINVAL;
2744 		goto out;
2745 	}
2746 
2747 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2748 					sizeof(*hdr));
2749 
2750 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2751 		 hdr->fw_ver, hdr->build_date);
2752 
2753 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2754 	if (ret) {
2755 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2756 		goto out;
2757 	}
2758 
2759 	snprintf(dev->mt76.hw->wiphy->fw_version,
2760 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2761 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2762 
2763 out:
2764 	release_firmware(fw);
2765 
2766 	return ret;
2767 }
2768 
2769 static int mt7915_load_firmware(struct mt7915_dev *dev)
2770 {
2771 	int ret;
2772 	u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2773 
2774 	val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2775 
2776 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2777 		/* restart firmware once */
2778 		__mt76_mcu_restart(&dev->mt76);
2779 		if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2780 				    val, 1000)) {
2781 			dev_err(dev->mt76.dev,
2782 				"Firmware is not ready for download\n");
2783 			return -EIO;
2784 		}
2785 	}
2786 
2787 	ret = mt7915_load_patch(dev);
2788 	if (ret)
2789 		return ret;
2790 
2791 	ret = mt7915_load_ram(dev);
2792 	if (ret)
2793 		return ret;
2794 
2795 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2796 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2797 				       FW_STATE_WACPU_RDY), 1000)) {
2798 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2799 		return -EIO;
2800 	}
2801 
2802 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2803 
2804 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2805 
2806 	return 0;
2807 }
2808 
2809 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2810 {
2811 	struct {
2812 		u8 ctrl_val;
2813 		u8 pad[3];
2814 	} data = {
2815 		.ctrl_val = ctrl
2816 	};
2817 
2818 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
2819 				 sizeof(data), true);
2820 }
2821 
2822 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2823 {
2824 	struct {
2825 		u8 ver;
2826 		u8 pad;
2827 		__le16 len;
2828 		u8 level;
2829 		u8 rsv[3];
2830 		__le32 module_idx;
2831 	} data = {
2832 		.module_idx = cpu_to_le32(module),
2833 		.level = level,
2834 	};
2835 
2836 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_DBG_CTRL, &data,
2837 				 sizeof(data), false);
2838 }
2839 
2840 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2841 {
2842 	struct {
2843 		u8 enable;
2844 		u8 _rsv[3];
2845 	} __packed req = {
2846 		.enable = enabled
2847 	};
2848 
2849 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MWDS_SUPPORT, &req,
2850 				 sizeof(req), false);
2851 }
2852 
2853 int mt7915_mcu_init(struct mt7915_dev *dev)
2854 {
2855 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2856 		.headroom = sizeof(struct mt7915_mcu_txd),
2857 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2858 		.mcu_parse_response = mt7915_mcu_parse_response,
2859 		.mcu_restart = mt7915_mcu_restart,
2860 	};
2861 	int ret;
2862 
2863 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2864 
2865 	ret = mt7915_driver_own(dev);
2866 	if (ret)
2867 		return ret;
2868 
2869 	ret = mt7915_load_firmware(dev);
2870 	if (ret)
2871 		return ret;
2872 
2873 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2874 	mt7915_mcu_fw_log_2_host(dev, 0);
2875 	mt7915_mcu_set_mwds(dev, 1);
2876 
2877 	return 0;
2878 }
2879 
2880 void mt7915_mcu_exit(struct mt7915_dev *dev)
2881 {
2882 	u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2883 
2884 	__mt76_mcu_restart(&dev->mt76);
2885 	if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2886 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2887 				       FW_STATE_FW_DOWNLOAD), 1000)) {
2888 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2889 		return;
2890 	}
2891 
2892 	reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2893 	mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2894 	skb_queue_purge(&dev->mt76.mcu.res_q);
2895 }
2896 
2897 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2898 		       bool enable, bool hdr_trans)
2899 {
2900 	struct {
2901 		u8 operation;
2902 		u8 enable;
2903 		u8 check_bssid;
2904 		u8 insert_vlan;
2905 		u8 remove_vlan;
2906 		u8 tid;
2907 		u8 mode;
2908 		u8 rsv;
2909 	} __packed req_trans = {
2910 		.enable = hdr_trans,
2911 	};
2912 	struct {
2913 		u8 enable;
2914 		u8 band;
2915 		u8 rsv[2];
2916 	} __packed req_mac = {
2917 		.enable = enable,
2918 		.band = band,
2919 	};
2920 	int ret;
2921 
2922 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RX_HDR_TRANS,
2923 				&req_trans, sizeof(req_trans), false);
2924 	if (ret)
2925 		return ret;
2926 
2927 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2928 				 &req_mac, sizeof(req_mac), true);
2929 }
2930 
2931 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2932 {
2933 	struct {
2934 		__le32 cmd;
2935 		u8 band;
2936 		u8 enable;
2937 	} __packed req = {
2938 		.cmd = cpu_to_le32(SCS_ENABLE),
2939 		.band = band,
2940 		.enable = enable + 1,
2941 	};
2942 
2943 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SCS_CTRL, &req,
2944 				 sizeof(req), false);
2945 }
2946 
2947 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2948 {
2949 	struct mt7915_dev *dev = phy->dev;
2950 	struct {
2951 		u8 prot_idx;
2952 		u8 band;
2953 		u8 rsv[2];
2954 		__le32 len_thresh;
2955 		__le32 pkt_thresh;
2956 	} __packed req = {
2957 		.prot_idx = 1,
2958 		.band = phy != &dev->phy,
2959 		.len_thresh = cpu_to_le32(val),
2960 		.pkt_thresh = cpu_to_le32(0x2),
2961 	};
2962 
2963 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL, &req,
2964 				 sizeof(req), true);
2965 }
2966 
2967 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2968 {
2969 #define WMM_AIFS_SET		BIT(0)
2970 #define WMM_CW_MIN_SET		BIT(1)
2971 #define WMM_CW_MAX_SET		BIT(2)
2972 #define WMM_TXOP_SET		BIT(3)
2973 #define WMM_PARAM_SET		GENMASK(3, 0)
2974 #define TX_CMD_MODE		1
2975 	struct edca {
2976 		u8 queue;
2977 		u8 set;
2978 		u8 aifs;
2979 		u8 cw_min;
2980 		__le16 cw_max;
2981 		__le16 txop;
2982 	};
2983 	struct mt7915_mcu_tx {
2984 		u8 total;
2985 		u8 action;
2986 		u8 valid;
2987 		u8 mode;
2988 
2989 		struct edca edca[IEEE80211_NUM_ACS];
2990 	} __packed req = {
2991 		.valid = true,
2992 		.mode = TX_CMD_MODE,
2993 		.total = IEEE80211_NUM_ACS,
2994 	};
2995 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2996 	int ac;
2997 
2998 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2999 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3000 		struct edca *e = &req.edca[ac];
3001 
3002 		e->set = WMM_PARAM_SET;
3003 		e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3004 		e->aifs = q->aifs;
3005 		e->txop = cpu_to_le16(q->txop);
3006 
3007 		if (q->cw_min)
3008 			e->cw_min = fls(q->cw_min);
3009 		else
3010 			e->cw_min = 5;
3011 
3012 		if (q->cw_max)
3013 			e->cw_max = cpu_to_le16(fls(q->cw_max));
3014 		else
3015 			e->cw_max = cpu_to_le16(10);
3016 	}
3017 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
3018 				 sizeof(req), true);
3019 }
3020 
3021 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3022 {
3023 #define ENTER_PM_STATE		1
3024 #define EXIT_PM_STATE		2
3025 	struct {
3026 		u8 pm_number;
3027 		u8 pm_state;
3028 		u8 bssid[ETH_ALEN];
3029 		u8 dtim_period;
3030 		u8 wlan_idx_lo;
3031 		__le16 bcn_interval;
3032 		__le32 aid;
3033 		__le32 rx_filter;
3034 		u8 band_idx;
3035 		u8 wlan_idx_hi;
3036 		u8 rsv[2];
3037 		__le32 feature;
3038 		u8 omac_idx;
3039 		u8 wmm_idx;
3040 		u8 bcn_loss_cnt;
3041 		u8 bcn_sp_duration;
3042 	} __packed req = {
3043 		.pm_number = 5,
3044 		.pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3045 		.band_idx = band,
3046 	};
3047 
3048 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
3049 				 sizeof(req), true);
3050 }
3051 
3052 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3053 		       enum mt7915_rdd_cmd cmd, u8 index,
3054 		       u8 rx_sel, u8 val)
3055 {
3056 	struct {
3057 		u8 ctrl;
3058 		u8 rdd_idx;
3059 		u8 rdd_rx_sel;
3060 		u8 val;
3061 		u8 rsv[4];
3062 	} __packed req = {
3063 		.ctrl = cmd,
3064 		.rdd_idx = index,
3065 		.rdd_rx_sel = rx_sel,
3066 		.val = val,
3067 	};
3068 
3069 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
3070 				 sizeof(req), true);
3071 }
3072 
3073 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3074 {
3075 	struct {
3076 		__le32 tag;
3077 		__le16 min_lpn;
3078 		u8 rsv[2];
3079 	} __packed req = {
3080 		.tag = cpu_to_le32(0x1),
3081 		.min_lpn = cpu_to_le16(val),
3082 	};
3083 
3084 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3085 				 sizeof(req), true);
3086 }
3087 
3088 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3089 			    const struct mt7915_dfs_pulse *pulse)
3090 {
3091 	struct {
3092 		__le32 tag;
3093 
3094 		__le32 max_width;		/* us */
3095 		__le32 max_pwr;			/* dbm */
3096 		__le32 min_pwr;			/* dbm */
3097 		__le32 min_stgr_pri;		/* us */
3098 		__le32 max_stgr_pri;		/* us */
3099 		__le32 min_cr_pri;		/* us */
3100 		__le32 max_cr_pri;		/* us */
3101 	} __packed req = {
3102 		.tag = cpu_to_le32(0x3),
3103 
3104 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3105 		__req_field(max_width),
3106 		__req_field(max_pwr),
3107 		__req_field(min_pwr),
3108 		__req_field(min_stgr_pri),
3109 		__req_field(max_stgr_pri),
3110 		__req_field(min_cr_pri),
3111 		__req_field(max_cr_pri),
3112 #undef __req_field
3113 	};
3114 
3115 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3116 				 sizeof(req), true);
3117 }
3118 
3119 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3120 			    const struct mt7915_dfs_pattern *pattern)
3121 {
3122 	struct {
3123 		__le32 tag;
3124 		__le16 radar_type;
3125 
3126 		u8 enb;
3127 		u8 stgr;
3128 		u8 min_crpn;
3129 		u8 max_crpn;
3130 		u8 min_crpr;
3131 		u8 min_pw;
3132 		u32 min_pri;
3133 		u32 max_pri;
3134 		u8 max_pw;
3135 		u8 min_crbn;
3136 		u8 max_crbn;
3137 		u8 min_stgpn;
3138 		u8 max_stgpn;
3139 		u8 min_stgpr;
3140 		u8 rsv[2];
3141 		u32 min_stgpr_diff;
3142 	} __packed req = {
3143 		.tag = cpu_to_le32(0x2),
3144 		.radar_type = cpu_to_le16(index),
3145 
3146 #define __req_field_u8(field) .field = pattern->field
3147 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3148 		__req_field_u8(enb),
3149 		__req_field_u8(stgr),
3150 		__req_field_u8(min_crpn),
3151 		__req_field_u8(max_crpn),
3152 		__req_field_u8(min_crpr),
3153 		__req_field_u8(min_pw),
3154 		__req_field_u32(min_pri),
3155 		__req_field_u32(max_pri),
3156 		__req_field_u8(max_pw),
3157 		__req_field_u8(min_crbn),
3158 		__req_field_u8(max_crbn),
3159 		__req_field_u8(min_stgpn),
3160 		__req_field_u8(max_stgpn),
3161 		__req_field_u8(min_stgpr),
3162 		__req_field_u32(min_stgpr_diff),
3163 #undef __req_field_u8
3164 #undef __req_field_u32
3165 	};
3166 
3167 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3168 				 sizeof(req), true);
3169 }
3170 
3171 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3172 {
3173 	struct mt7915_dev *dev = phy->dev;
3174 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3175 	int freq1 = chandef->center_freq1;
3176 	struct {
3177 		u8 control_ch;
3178 		u8 center_ch;
3179 		u8 bw;
3180 		u8 tx_streams_num;
3181 		u8 rx_streams;	/* mask or num */
3182 		u8 switch_reason;
3183 		u8 band_idx;
3184 		u8 center_ch2;	/* for 80+80 only */
3185 		__le16 cac_case;
3186 		u8 channel_band;
3187 		u8 rsv0;
3188 		__le32 outband_freq;
3189 		u8 txpower_drop;
3190 		u8 ap_bw;
3191 		u8 ap_center_ch;
3192 		u8 rsv1[57];
3193 	} __packed req = {
3194 		.control_ch = chandef->chan->hw_value,
3195 		.center_ch = ieee80211_frequency_to_channel(freq1),
3196 		.bw = mt7915_mcu_chan_bw(chandef),
3197 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
3198 		.rx_streams = phy->mt76->antenna_mask,
3199 		.band_idx = phy != &dev->phy,
3200 		.channel_band = chandef->chan->band,
3201 	};
3202 
3203 #ifdef CONFIG_NL80211_TESTMODE
3204 	if (dev->mt76.test.tx_antenna_mask &&
3205 	    (dev->mt76.test.state == MT76_TM_STATE_TX_FRAMES ||
3206 	     dev->mt76.test.state == MT76_TM_STATE_RX_FRAMES)) {
3207 		req.tx_streams_num = fls(dev->mt76.test.tx_antenna_mask);
3208 		req.rx_streams = dev->mt76.test.tx_antenna_mask;
3209 	}
3210 #endif
3211 
3212 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3213 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3214 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3215 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3216 		req.switch_reason = CH_SWITCH_DFS;
3217 	else
3218 		req.switch_reason = CH_SWITCH_NORMAL;
3219 
3220 	if (cmd == MCU_EXT_CMD_CHANNEL_SWITCH)
3221 		req.rx_streams = hweight8(req.rx_streams);
3222 
3223 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3224 		int freq2 = chandef->center_freq2;
3225 
3226 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3227 	}
3228 
3229 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3230 }
3231 
3232 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3233 {
3234 	struct req_hdr {
3235 		u8 buffer_mode;
3236 		u8 format;
3237 		__le16 len;
3238 	} __packed req = {
3239 		.buffer_mode = EE_MODE_EFUSE,
3240 		.format = EE_FORMAT_WHOLE,
3241 	};
3242 
3243 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
3244 				 &req, sizeof(req), true);
3245 }
3246 
3247 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3248 {
3249 	struct mt7915_mcu_eeprom_info req = {
3250 		.addr = cpu_to_le32(round_down(offset, 16)),
3251 	};
3252 	struct mt7915_mcu_eeprom_info *res;
3253 	struct sk_buff *skb;
3254 	int ret;
3255 	u8 *buf;
3256 
3257 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_ACCESS, &req,
3258 				sizeof(req), true, &skb);
3259 	if (ret)
3260 		return ret;
3261 
3262 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
3263 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3264 	memcpy(buf, res->data, 16);
3265 	dev_kfree_skb(skb);
3266 
3267 	return 0;
3268 }
3269 
3270 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3271 {
3272 	struct {
3273 		u8 ctrl_id;
3274 		u8 action;
3275 		u8 band;
3276 		u8 rsv[5];
3277 	} req = {
3278 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3279 		.action = index,
3280 	};
3281 
3282 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_THERMAL_CTRL, &req,
3283 				 sizeof(req), true);
3284 }
3285 
3286 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3287 {
3288 	struct {
3289 		__le32 cmd;
3290 		__le16 wlan_idx;
3291 		__le16 ru_idx;
3292 		__le16 direction;
3293 		__le16 dump_group;
3294 	} req = {
3295 		.cmd = cpu_to_le32(cmd),
3296 		.wlan_idx = cpu_to_le16(wlan_idx),
3297 		.dump_group = cpu_to_le16(1),
3298 	};
3299 
3300 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RATE_CTRL, &req,
3301 				 sizeof(req), false);
3302 }
3303 
3304 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3305 {
3306 	struct mt7915_dev *dev = phy->dev;
3307 	struct mt76_phy *mphy = phy->mt76;
3308 	struct ieee80211_hw *hw = mphy->hw;
3309 	struct mt7915_sku_val {
3310 		u8 format_id;
3311 		u8 limit_type;
3312 		u8 dbdc_idx;
3313 		s8 val[MT7915_SKU_RATE_NUM];
3314 	} __packed req = {
3315 		.format_id = 4,
3316 		.dbdc_idx = phy != &dev->phy,
3317 	};
3318 	int i;
3319 	s8 *delta;
3320 
3321 	delta = dev->rate_power[mphy->chandef.chan->band];
3322 	mphy->txpower_cur = hw->conf.power_level * 2 +
3323 			    delta[MT7915_SKU_MAX_DELTA_IDX];
3324 
3325 	for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3326 		req.val[i] = hw->conf.power_level * 2 + delta[i];
3327 
3328 	return mt76_mcu_send_msg(&dev->mt76,
3329 				 MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
3330 				 sizeof(req), true);
3331 }
3332 
3333 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3334 			      u8 en)
3335 {
3336 	struct {
3337 		u8 test_mode_en;
3338 		u8 param_idx;
3339 		u8 _rsv[2];
3340 
3341 		u8 enable;
3342 		u8 _rsv2[3];
3343 
3344 		u8 pad[8];
3345 	} __packed req = {
3346 		.test_mode_en = test_mode,
3347 		.param_idx = param,
3348 		.enable = en,
3349 	};
3350 
3351 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
3352 				 sizeof(req), false);
3353 }
3354 
3355 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3356 {
3357 	struct mt7915_dev *dev = phy->dev;
3358 	struct mt7915_sku {
3359 		u8 format_id;
3360 		u8 sku_enable;
3361 		u8 dbdc_idx;
3362 		u8 rsv;
3363 	} __packed req = {
3364 		.format_id = 0,
3365 		.dbdc_idx = phy != &dev->phy,
3366 		.sku_enable = enable,
3367 	};
3368 
3369 	return mt76_mcu_send_msg(&dev->mt76,
3370 				 MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
3371 				 sizeof(req), true);
3372 }
3373 
3374 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3375 {
3376 	struct {
3377 		u8 action;
3378 		u8 set;
3379 		u8 band;
3380 		u8 rsv;
3381 	} req = {
3382 		.action = action,
3383 		.set = set,
3384 		.band = band,
3385 	};
3386 
3387 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SER_TRIGGER,
3388 				 &req, sizeof(req), false);
3389 }
3390 
3391 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3392 {
3393 #define MT_BF_TYPE_UPDATE		20
3394 	struct {
3395 		u8 action;
3396 		bool ebf;
3397 		bool ibf;
3398 		u8 rsv;
3399 	} __packed req = {
3400 		.action = MT_BF_TYPE_UPDATE,
3401 		.ebf = true,
3402 		.ibf = false,
3403 	};
3404 
3405 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION, &req,
3406 				 sizeof(req), true);
3407 }
3408 
3409 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3410 {
3411 #define MT_BF_PROCESSING		4
3412 	struct {
3413 		u8 action;
3414 		u8 snd_mode;
3415 		u8 sta_num;
3416 		u8 rsv;
3417 		u8 wlan_idx[4];
3418 		__le32 snd_period;	/* ms */
3419 	} __packed req = {
3420 		.action = true,
3421 		.snd_mode = MT_BF_PROCESSING,
3422 	};
3423 
3424 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION, &req,
3425 				 sizeof(req), true);
3426 }
3427 
3428 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3429 			    bool enable)
3430 {
3431 #define MT_SPR_ENABLE		1
3432 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3433 	struct {
3434 		u8 action;
3435 		u8 arg_num;
3436 		u8 band_idx;
3437 		u8 status;
3438 		u8 drop_tx_idx;
3439 		u8 sta_idx;	/* 256 sta */
3440 		u8 rsv[2];
3441 		__le32 val;
3442 	} __packed req = {
3443 		.action = MT_SPR_ENABLE,
3444 		.arg_num = 1,
3445 		.band_idx = mvif->band_idx,
3446 		.val = cpu_to_le32(enable),
3447 	};
3448 
3449 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SPR, &req,
3450 				 sizeof(req), true);
3451 }
3452 
3453 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3454 			   struct ieee80211_sta *sta, struct rate_info *rate)
3455 {
3456 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3457 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3458 	struct mt7915_dev *dev = phy->dev;
3459 	struct mt76_phy *mphy = phy->mt76;
3460 	struct {
3461 		u8 category;
3462 		u8 band;
3463 		__le16 wcid;
3464 	} __packed req = {
3465 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3466 		.band = mvif->band_idx,
3467 		.wcid = cpu_to_le16(msta->wcid.idx),
3468 	};
3469 	struct ieee80211_supported_band *sband;
3470 	struct mt7915_mcu_phy_rx_info *res;
3471 	struct sk_buff *skb;
3472 	u16 flags = 0;
3473 	int ret;
3474 	int i;
3475 
3476 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD_PHY_STAT_INFO,
3477 					&req, sizeof(req), true, &skb);
3478 	if (ret)
3479 		return ret;
3480 
3481 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3482 
3483 	rate->mcs = res->rate;
3484 	rate->nss = res->nsts + 1;
3485 
3486 	switch (res->mode) {
3487 	case MT_PHY_TYPE_CCK:
3488 	case MT_PHY_TYPE_OFDM:
3489 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3490 			sband = &mphy->sband_5g.sband;
3491 		else
3492 			sband = &mphy->sband_2g.sband;
3493 
3494 		for (i = 0; i < sband->n_bitrates; i++) {
3495 			if (rate->mcs != (sband->bitrates[i].hw_value & 0xf))
3496 				continue;
3497 
3498 			rate->legacy = sband->bitrates[i].bitrate;
3499 			break;
3500 		}
3501 		break;
3502 	case MT_PHY_TYPE_HT:
3503 	case MT_PHY_TYPE_HT_GF:
3504 		if (rate->mcs > 31)
3505 			return -EINVAL;
3506 
3507 		flags |= RATE_INFO_FLAGS_MCS;
3508 
3509 		if (res->gi)
3510 			flags |= RATE_INFO_FLAGS_SHORT_GI;
3511 		break;
3512 	case MT_PHY_TYPE_VHT:
3513 		flags |= RATE_INFO_FLAGS_VHT_MCS;
3514 
3515 		if (res->gi)
3516 			flags |= RATE_INFO_FLAGS_SHORT_GI;
3517 		break;
3518 	case MT_PHY_TYPE_HE_SU:
3519 	case MT_PHY_TYPE_HE_EXT_SU:
3520 	case MT_PHY_TYPE_HE_TB:
3521 	case MT_PHY_TYPE_HE_MU:
3522 		rate->he_gi = res->gi;
3523 
3524 		flags |= RATE_INFO_FLAGS_HE_MCS;
3525 		break;
3526 	default:
3527 		break;
3528 	}
3529 	rate->flags = flags;
3530 
3531 	switch (res->bw) {
3532 	case IEEE80211_STA_RX_BW_160:
3533 		rate->bw = RATE_INFO_BW_160;
3534 		break;
3535 	case IEEE80211_STA_RX_BW_80:
3536 		rate->bw = RATE_INFO_BW_80;
3537 		break;
3538 	case IEEE80211_STA_RX_BW_40:
3539 		rate->bw = RATE_INFO_BW_40;
3540 		break;
3541 	default:
3542 		rate->bw = RATE_INFO_BW_20;
3543 		break;
3544 	}
3545 
3546 	dev_kfree_skb(skb);
3547 
3548 	return 0;
3549 }
3550