1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
70 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
71 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
72 
73 #define DL_MODE_ENCRYPT			BIT(0)
74 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
75 #define DL_MODE_RESET_SEC_IV		BIT(3)
76 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
77 #define DL_MODE_NEED_RSP		BIT(31)
78 
79 #define FW_START_OVERRIDE		BIT(0)
80 #define FW_START_WORKING_PDA_CR4	BIT(2)
81 
82 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
83 #define PATCH_SEC_TYPE_INFO		0x2
84 
85 #define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
86 #define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
87 
88 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
89 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
90 
91 static enum mcu_cipher_type
92 mt7915_mcu_get_cipher(int cipher)
93 {
94 	switch (cipher) {
95 	case WLAN_CIPHER_SUITE_WEP40:
96 		return MCU_CIPHER_WEP40;
97 	case WLAN_CIPHER_SUITE_WEP104:
98 		return MCU_CIPHER_WEP104;
99 	case WLAN_CIPHER_SUITE_TKIP:
100 		return MCU_CIPHER_TKIP;
101 	case WLAN_CIPHER_SUITE_AES_CMAC:
102 		return MCU_CIPHER_BIP_CMAC_128;
103 	case WLAN_CIPHER_SUITE_CCMP:
104 		return MCU_CIPHER_AES_CCMP;
105 	case WLAN_CIPHER_SUITE_CCMP_256:
106 		return MCU_CIPHER_CCMP_256;
107 	case WLAN_CIPHER_SUITE_GCMP:
108 		return MCU_CIPHER_GCMP;
109 	case WLAN_CIPHER_SUITE_GCMP_256:
110 		return MCU_CIPHER_GCMP_256;
111 	case WLAN_CIPHER_SUITE_SMS4:
112 		return MCU_CIPHER_WAPI;
113 	default:
114 		return MCU_CIPHER_NONE;
115 	}
116 }
117 
118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
119 {
120 	static const u8 width_to_bw[] = {
121 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
122 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
123 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
124 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
125 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
126 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
127 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
128 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
129 	};
130 
131 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
132 		return 0;
133 
134 	return width_to_bw[chandef->width];
135 }
136 
137 static const struct ieee80211_sta_he_cap *
138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
139 {
140 	struct ieee80211_supported_band *sband;
141 	enum nl80211_band band;
142 
143 	band = phy->mt76->chandef.chan->band;
144 	sband = phy->mt76->hw->wiphy->bands[band];
145 
146 	return ieee80211_get_he_iftype_cap(sband, vif->type);
147 }
148 
149 static u8
150 mt7915_get_phy_mode(struct ieee80211_vif *vif, struct ieee80211_sta *sta)
151 {
152 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
153 	enum nl80211_band band = mvif->phy->mt76->chandef.chan->band;
154 	struct ieee80211_sta_ht_cap *ht_cap;
155 	struct ieee80211_sta_vht_cap *vht_cap;
156 	const struct ieee80211_sta_he_cap *he_cap;
157 	u8 mode = 0;
158 
159 	if (sta) {
160 		ht_cap = &sta->ht_cap;
161 		vht_cap = &sta->vht_cap;
162 		he_cap = &sta->he_cap;
163 	} else {
164 		struct ieee80211_supported_band *sband;
165 
166 		sband = mvif->phy->mt76->hw->wiphy->bands[band];
167 
168 		ht_cap = &sband->ht_cap;
169 		vht_cap = &sband->vht_cap;
170 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
171 	}
172 
173 	if (band == NL80211_BAND_2GHZ) {
174 		mode |= PHY_MODE_B | PHY_MODE_G;
175 
176 		if (ht_cap->ht_supported)
177 			mode |= PHY_MODE_GN;
178 
179 		if (he_cap->has_he)
180 			mode |= PHY_MODE_AX_24G;
181 	} else if (band == NL80211_BAND_5GHZ) {
182 		mode |= PHY_MODE_A;
183 
184 		if (ht_cap->ht_supported)
185 			mode |= PHY_MODE_AN;
186 
187 		if (vht_cap->vht_supported)
188 			mode |= PHY_MODE_AC;
189 
190 		if (he_cap->has_he)
191 			mode |= PHY_MODE_AX_5G;
192 	}
193 
194 	return mode;
195 }
196 
197 static u8
198 mt7915_mcu_get_sta_nss(u16 mcs_map)
199 {
200 	u8 nss;
201 
202 	for (nss = 8; nss > 0; nss--) {
203 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
204 
205 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
206 			break;
207 	}
208 
209 	return nss - 1;
210 }
211 
212 static void
213 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
214 			  const u16 *mask)
215 {
216 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
217 	struct cfg80211_chan_def *chandef = &msta->vif->phy->mt76->chandef;
218 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
219 	u16 mcs_map;
220 
221 	switch (chandef->width) {
222 	case NL80211_CHAN_WIDTH_80P80:
223 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80p80);
224 		break;
225 	case NL80211_CHAN_WIDTH_160:
226 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_160);
227 		break;
228 	default:
229 		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80);
230 		break;
231 	}
232 
233 	for (nss = 0; nss < max_nss; nss++) {
234 		int mcs;
235 
236 		switch ((mcs_map >> (2 * nss)) & 0x3) {
237 		case IEEE80211_HE_MCS_SUPPORT_0_11:
238 			mcs = GENMASK(11, 0);
239 			break;
240 		case IEEE80211_HE_MCS_SUPPORT_0_9:
241 			mcs = GENMASK(9, 0);
242 			break;
243 		case IEEE80211_HE_MCS_SUPPORT_0_7:
244 			mcs = GENMASK(7, 0);
245 			break;
246 		default:
247 			mcs = 0;
248 		}
249 
250 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
251 
252 		switch (mcs) {
253 		case 0 ... 7:
254 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
255 			break;
256 		case 8 ... 9:
257 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
258 			break;
259 		case 10 ... 11:
260 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
261 			break;
262 		default:
263 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
264 			break;
265 		}
266 		mcs_map &= ~(0x3 << (nss * 2));
267 		mcs_map |= mcs << (nss * 2);
268 
269 		/* only support 2ss on 160MHz */
270 		if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
271 			break;
272 	}
273 
274 	*he_mcs = cpu_to_le16(mcs_map);
275 }
276 
277 static void
278 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
279 			   const u16 *mask)
280 {
281 	u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
282 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
283 	u16 mcs;
284 
285 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
286 		switch (mcs_map & 0x3) {
287 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
288 			mcs = GENMASK(9, 0);
289 			break;
290 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
291 			mcs = GENMASK(8, 0);
292 			break;
293 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
294 			mcs = GENMASK(7, 0);
295 			break;
296 		default:
297 			mcs = 0;
298 		}
299 
300 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
301 
302 		/* only support 2ss on 160MHz */
303 		if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
304 			break;
305 	}
306 }
307 
308 static void
309 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
310 			  const u8 *mask)
311 {
312 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
313 
314 	for (nss = 0; nss < max_nss; nss++)
315 		ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
316 }
317 
318 static int
319 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
320 			  struct sk_buff *skb, int seq)
321 {
322 	struct mt7915_mcu_rxd *rxd;
323 	int ret = 0;
324 
325 	if (!skb) {
326 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
327 			cmd, seq);
328 		return -ETIMEDOUT;
329 	}
330 
331 	rxd = (struct mt7915_mcu_rxd *)skb->data;
332 	if (seq != rxd->seq)
333 		return -EAGAIN;
334 
335 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
336 		skb_pull(skb, sizeof(*rxd) - 4);
337 		ret = *skb->data;
338 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
339 		skb_pull(skb, sizeof(*rxd) + 4);
340 		ret = le32_to_cpu(*(__le32 *)skb->data);
341 	} else {
342 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
343 	}
344 
345 	return ret;
346 }
347 
348 static int
349 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
350 			int cmd, int *wait_seq)
351 {
352 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
353 	struct mt7915_mcu_txd *mcu_txd;
354 	enum mt76_mcuq_id qid;
355 	__le32 *txd;
356 	u32 val;
357 	u8 seq;
358 
359 	/* TODO: make dynamic based on msg type */
360 	mdev->mcu.timeout = 20 * HZ;
361 
362 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
363 	if (!seq)
364 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
365 
366 	if (cmd == MCU_CMD(FW_SCATTER)) {
367 		qid = MT_MCUQ_FWDL;
368 		goto exit;
369 	}
370 
371 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
372 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
373 		qid = MT_MCUQ_WA;
374 	else
375 		qid = MT_MCUQ_WM;
376 
377 	txd = mcu_txd->txd;
378 
379 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
380 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
381 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
382 	txd[0] = cpu_to_le32(val);
383 
384 	val = MT_TXD1_LONG_FORMAT |
385 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
386 	txd[1] = cpu_to_le32(val);
387 
388 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
389 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
390 					       MT_TX_MCU_PORT_RX_Q0));
391 	mcu_txd->pkt_type = MCU_PKT_ID;
392 	mcu_txd->seq = seq;
393 
394 	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
395 	mcu_txd->set_query = MCU_Q_NA;
396 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
397 	if (mcu_txd->ext_cid) {
398 		mcu_txd->ext_cid_ack = 1;
399 
400 		/* do not use Q_SET for efuse */
401 		if (cmd & __MCU_CMD_FIELD_QUERY)
402 			mcu_txd->set_query = MCU_Q_QUERY;
403 		else
404 			mcu_txd->set_query = MCU_Q_SET;
405 	}
406 
407 	if (cmd & __MCU_CMD_FIELD_WA)
408 		mcu_txd->s2d_index = MCU_S2D_H2C;
409 	else
410 		mcu_txd->s2d_index = MCU_S2D_H2N;
411 
412 exit:
413 	if (wait_seq)
414 		*wait_seq = seq;
415 
416 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
417 }
418 
419 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
420 {
421 	struct {
422 		__le32 args[3];
423 	} req = {
424 		.args = {
425 			cpu_to_le32(a1),
426 			cpu_to_le32(a2),
427 			cpu_to_le32(a3),
428 		},
429 	};
430 
431 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
432 }
433 
434 static void
435 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
436 {
437 	if (vif->csa_active)
438 		ieee80211_csa_finish(vif);
439 }
440 
441 static void
442 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
443 {
444 	struct mt76_phy *mphy = &dev->mt76.phy;
445 	struct mt7915_mcu_csa_notify *c;
446 
447 	c = (struct mt7915_mcu_csa_notify *)skb->data;
448 
449 	if (c->band_idx && dev->mt76.phy2)
450 		mphy = dev->mt76.phy2;
451 
452 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
453 			IEEE80211_IFACE_ITER_RESUME_ALL,
454 			mt7915_mcu_csa_finish, mphy->hw);
455 }
456 
457 static void
458 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
459 {
460 	struct mt76_phy *mphy = &dev->mt76.phy;
461 	struct mt7915_mcu_thermal_notify *t;
462 	struct mt7915_phy *phy;
463 
464 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
465 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
466 		return;
467 
468 	if (t->ctrl.band_idx && dev->mt76.phy2)
469 		mphy = dev->mt76.phy2;
470 
471 	phy = (struct mt7915_phy *)mphy->priv;
472 	phy->throttle_state = t->ctrl.duty.duty_cycle;
473 }
474 
475 static void
476 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
477 {
478 	struct mt76_phy *mphy = &dev->mt76.phy;
479 	struct mt7915_mcu_rdd_report *r;
480 
481 	r = (struct mt7915_mcu_rdd_report *)skb->data;
482 
483 	if (r->band_idx && dev->mt76.phy2)
484 		mphy = dev->mt76.phy2;
485 
486 	ieee80211_radar_detected(mphy->hw);
487 	dev->hw_pattern++;
488 }
489 
490 static void
491 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
492 {
493 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
494 	const char *data = (char *)&rxd[1];
495 	const char *type;
496 
497 	switch (rxd->s2d_index) {
498 	case 0:
499 		type = "WM";
500 		break;
501 	case 2:
502 		type = "WA";
503 		break;
504 	default:
505 		type = "unknown";
506 		break;
507 	}
508 
509 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
510 		   (int)(skb->len - sizeof(*rxd)), data);
511 }
512 
513 static void
514 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
515 {
516 	if (!vif->color_change_active)
517 		return;
518 
519 	ieee80211_color_change_finish(vif);
520 }
521 
522 static void
523 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
524 {
525 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
526 
527 	switch (rxd->ext_eid) {
528 	case MCU_EXT_EVENT_THERMAL_PROTECT:
529 		mt7915_mcu_rx_thermal_notify(dev, skb);
530 		break;
531 	case MCU_EXT_EVENT_RDD_REPORT:
532 		mt7915_mcu_rx_radar_detected(dev, skb);
533 		break;
534 	case MCU_EXT_EVENT_CSA_NOTIFY:
535 		mt7915_mcu_rx_csa_notify(dev, skb);
536 		break;
537 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
538 		mt7915_mcu_rx_log_message(dev, skb);
539 		break;
540 	case MCU_EXT_EVENT_BCC_NOTIFY:
541 		ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
542 				IEEE80211_IFACE_ITER_RESUME_ALL,
543 				mt7915_mcu_cca_finish, dev);
544 		break;
545 	default:
546 		break;
547 	}
548 }
549 
550 static void
551 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
552 {
553 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
554 
555 	switch (rxd->eid) {
556 	case MCU_EVENT_EXT:
557 		mt7915_mcu_rx_ext_event(dev, skb);
558 		break;
559 	default:
560 		break;
561 	}
562 	dev_kfree_skb(skb);
563 }
564 
565 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
566 {
567 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
568 
569 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
570 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
571 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
572 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
573 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
574 	    !rxd->seq)
575 		mt7915_mcu_rx_unsolicited_event(dev, skb);
576 	else
577 		mt76_mcu_rx_event(&dev->mt76, skb);
578 }
579 
580 static struct sk_buff *
581 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
582 			 struct mt7915_sta *msta, int len)
583 {
584 	struct sta_req_hdr hdr = {
585 		.bss_idx = mvif->idx,
586 		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
587 		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
588 		.muar_idx = msta && msta->wcid.sta ? mvif->omac_idx : 0xe,
589 		.is_tlv_append = 1,
590 	};
591 	struct sk_buff *skb;
592 
593 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
594 	if (!skb)
595 		return ERR_PTR(-ENOMEM);
596 
597 	skb_put_data(skb, &hdr, sizeof(hdr));
598 
599 	return skb;
600 }
601 
602 static struct wtbl_req_hdr *
603 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
604 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
605 {
606 	struct tlv *sta_hdr = sta_wtbl;
607 	struct wtbl_req_hdr hdr = {
608 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
609 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
610 		.operation = cmd,
611 	};
612 	struct sk_buff *nskb = *skb;
613 
614 	if (!nskb) {
615 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
616 					  MT7915_WTBL_UPDATE_MAX_SIZE);
617 		if (!nskb)
618 			return ERR_PTR(-ENOMEM);
619 
620 		*skb = nskb;
621 	}
622 
623 	if (sta_hdr)
624 		le16_add_cpu(&sta_hdr->len, sizeof(hdr));
625 
626 	return skb_put_data(nskb, &hdr, sizeof(hdr));
627 }
628 
629 static struct tlv *
630 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
631 			  void *sta_ntlv, void *sta_wtbl)
632 {
633 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
634 	struct tlv *sta_hdr = sta_wtbl;
635 	struct tlv *ptlv, tlv = {
636 		.tag = cpu_to_le16(tag),
637 		.len = cpu_to_le16(len),
638 	};
639 	u16 ntlv;
640 
641 	ptlv = skb_put(skb, len);
642 	memcpy(ptlv, &tlv, sizeof(tlv));
643 
644 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
645 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
646 
647 	if (sta_hdr) {
648 		u16 size = le16_to_cpu(sta_hdr->len);
649 
650 		sta_hdr->len = cpu_to_le16(size + len);
651 	}
652 
653 	return ptlv;
654 }
655 
656 static struct tlv *
657 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
658 {
659 	return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
660 }
661 
662 static struct tlv *
663 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
664 			     __le16 *sub_ntlv, __le16 *len)
665 {
666 	struct tlv *ptlv, tlv = {
667 		.tag = cpu_to_le16(sub_tag),
668 		.len = cpu_to_le16(sub_len),
669 	};
670 
671 	ptlv = skb_put(skb, sub_len);
672 	memcpy(ptlv, &tlv, sizeof(tlv));
673 
674 	le16_add_cpu(sub_ntlv, 1);
675 	le16_add_cpu(len, sub_len);
676 
677 	return ptlv;
678 }
679 
680 /** bss info **/
681 static int
682 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
683 			 struct mt7915_phy *phy, bool enable)
684 {
685 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
686 	struct bss_info_basic *bss;
687 	u16 wlan_idx = mvif->sta.wcid.idx;
688 	u32 type = NETWORK_INFRA;
689 	struct tlv *tlv;
690 
691 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
692 
693 	switch (vif->type) {
694 	case NL80211_IFTYPE_MESH_POINT:
695 	case NL80211_IFTYPE_AP:
696 	case NL80211_IFTYPE_MONITOR:
697 		break;
698 	case NL80211_IFTYPE_STATION:
699 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
700 		if (enable) {
701 			struct ieee80211_sta *sta;
702 			struct mt7915_sta *msta;
703 
704 			rcu_read_lock();
705 			sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
706 			if (!sta) {
707 				rcu_read_unlock();
708 				return -EINVAL;
709 			}
710 
711 			msta = (struct mt7915_sta *)sta->drv_priv;
712 			wlan_idx = msta->wcid.idx;
713 			rcu_read_unlock();
714 		}
715 		break;
716 	case NL80211_IFTYPE_ADHOC:
717 		type = NETWORK_IBSS;
718 		break;
719 	default:
720 		WARN_ON(1);
721 		break;
722 	}
723 
724 	bss = (struct bss_info_basic *)tlv;
725 	bss->network_type = cpu_to_le32(type);
726 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
727 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
728 	bss->wmm_idx = mvif->wmm_idx;
729 	bss->active = enable;
730 
731 	if (vif->type != NL80211_IFTYPE_MONITOR) {
732 		memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
733 		bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
734 		bss->dtim_period = vif->bss_conf.dtim_period;
735 		bss->phy_mode = mt7915_get_phy_mode(vif, NULL);
736 	} else {
737 		memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
738 	}
739 
740 	return 0;
741 }
742 
743 static void
744 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
745 {
746 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
747 	struct bss_info_omac *omac;
748 	struct tlv *tlv;
749 	u32 type = 0;
750 	u8 idx;
751 
752 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
753 
754 	switch (vif->type) {
755 	case NL80211_IFTYPE_MONITOR:
756 	case NL80211_IFTYPE_MESH_POINT:
757 	case NL80211_IFTYPE_AP:
758 		type = CONNECTION_INFRA_AP;
759 		break;
760 	case NL80211_IFTYPE_STATION:
761 		type = CONNECTION_INFRA_STA;
762 		break;
763 	case NL80211_IFTYPE_ADHOC:
764 		type = CONNECTION_IBSS_ADHOC;
765 		break;
766 	default:
767 		WARN_ON(1);
768 		break;
769 	}
770 
771 	omac = (struct bss_info_omac *)tlv;
772 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
773 	omac->conn_type = cpu_to_le32(type);
774 	omac->omac_idx = mvif->omac_idx;
775 	omac->band_idx = mvif->band_idx;
776 	omac->hw_bss_idx = idx;
777 }
778 
779 struct mt7915_he_obss_narrow_bw_ru_data {
780 	bool tolerated;
781 };
782 
783 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
784 						   struct cfg80211_bss *bss,
785 						   void *_data)
786 {
787 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
788 	const struct element *elem;
789 
790 	rcu_read_lock();
791 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
792 
793 	if (!elem || elem->datalen <= 10 ||
794 	    !(elem->data[10] &
795 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
796 		data->tolerated = false;
797 
798 	rcu_read_unlock();
799 }
800 
801 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
802 					      struct ieee80211_vif *vif)
803 {
804 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
805 		.tolerated = true,
806 	};
807 
808 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
809 		return false;
810 
811 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
812 			  mt7915_check_he_obss_narrow_bw_ru_iter,
813 			  &iter_data);
814 
815 	/*
816 	 * If there is at least one AP on radar channel that cannot
817 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
818 	 */
819 	return !iter_data.tolerated;
820 }
821 
822 static void
823 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
824 			struct mt7915_phy *phy)
825 {
826 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
827 	struct bss_info_rf_ch *ch;
828 	struct tlv *tlv;
829 	int freq1 = chandef->center_freq1;
830 
831 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
832 
833 	ch = (struct bss_info_rf_ch *)tlv;
834 	ch->pri_ch = chandef->chan->hw_value;
835 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
836 	ch->bw = mt7915_mcu_chan_bw(chandef);
837 
838 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
839 		int freq2 = chandef->center_freq2;
840 
841 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
842 	}
843 
844 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
845 		struct mt7915_dev *dev = phy->dev;
846 		struct mt76_phy *mphy = &dev->mt76.phy;
847 		bool ext_phy = phy != &dev->phy;
848 
849 		if (ext_phy && dev->mt76.phy2)
850 			mphy = dev->mt76.phy2;
851 
852 		ch->he_ru26_block =
853 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
854 		ch->he_all_disable = false;
855 	} else {
856 		ch->he_all_disable = true;
857 	}
858 }
859 
860 static void
861 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
862 		      struct mt7915_phy *phy)
863 {
864 	int max_nss = hweight8(phy->mt76->chainmask);
865 	struct bss_info_ra *ra;
866 	struct tlv *tlv;
867 
868 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
869 
870 	ra = (struct bss_info_ra *)tlv;
871 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
872 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
873 	ra->short_preamble = true;
874 	ra->tx_streams = max_nss;
875 	ra->rx_streams = max_nss;
876 	ra->algo = 4;
877 	ra->train_up_rule = 2;
878 	ra->train_up_high_thres = 110;
879 	ra->train_up_rule_rssi = -70;
880 	ra->low_traffic_thres = 2;
881 	ra->phy_cap = cpu_to_le32(0xfdf);
882 	ra->interval = cpu_to_le32(500);
883 	ra->fast_interval = cpu_to_le32(100);
884 }
885 
886 static void
887 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
888 		      struct mt7915_phy *phy)
889 {
890 #define DEFAULT_HE_PE_DURATION		4
891 #define DEFAULT_HE_DURATION_RTS_THRES	1023
892 	const struct ieee80211_sta_he_cap *cap;
893 	struct bss_info_he *he;
894 	struct tlv *tlv;
895 
896 	cap = mt7915_get_he_phy_cap(phy, vif);
897 
898 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
899 
900 	he = (struct bss_info_he *)tlv;
901 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
902 	if (!he->he_pe_duration)
903 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
904 
905 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
906 	if (!he->he_rts_thres)
907 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
908 
909 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
910 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
911 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
912 }
913 
914 static void
915 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
916 {
917 #define TXD_CMP_MAP1		GENMASK(15, 0)
918 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
919 	struct bss_info_hw_amsdu *amsdu;
920 	struct tlv *tlv;
921 
922 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
923 
924 	amsdu = (struct bss_info_hw_amsdu *)tlv;
925 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
926 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
927 	amsdu->trig_thres = cpu_to_le16(2);
928 	amsdu->enable = true;
929 }
930 
931 static void
932 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
933 {
934 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
935 #define BCN_TX_ESTIMATE_TIME	(4096 + 20)
936 	struct bss_info_ext_bss *ext;
937 	int ext_bss_idx, tsf_offset;
938 	struct tlv *tlv;
939 
940 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
941 	if (ext_bss_idx < 0)
942 		return;
943 
944 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
945 
946 	ext = (struct bss_info_ext_bss *)tlv;
947 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
948 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
949 }
950 
951 static void
952 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
953 {
954 	struct bss_info_bmc_rate *bmc;
955 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
956 	enum nl80211_band band = chandef->chan->band;
957 	struct tlv *tlv;
958 
959 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
960 
961 	bmc = (struct bss_info_bmc_rate *)tlv;
962 	if (band == NL80211_BAND_2GHZ) {
963 		bmc->short_preamble = true;
964 	} else {
965 		bmc->bc_trans = cpu_to_le16(0x2000);
966 		bmc->mc_trans = cpu_to_le16(0x2080);
967 	}
968 }
969 
970 static int
971 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
972 		       bool bssid, bool enable)
973 {
974 	struct mt7915_dev *dev = phy->dev;
975 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
976 	u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
977 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
978 	const u8 *addr = vif->addr;
979 	struct {
980 		u8 mode;
981 		u8 force_clear;
982 		u8 clear_bitmap[8];
983 		u8 entry_count;
984 		u8 write;
985 		u8 band;
986 
987 		u8 index;
988 		u8 bssid;
989 		u8 addr[ETH_ALEN];
990 	} __packed req = {
991 		.mode = !!mask || enable,
992 		.entry_count = 1,
993 		.write = 1,
994 		.band = phy != &dev->phy,
995 		.index = idx * 2 + bssid,
996 	};
997 
998 	if (bssid)
999 		addr = vif->bss_conf.bssid;
1000 
1001 	if (enable)
1002 		ether_addr_copy(req.addr, addr);
1003 
1004 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
1005 				 sizeof(req), true);
1006 }
1007 
1008 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1009 			    struct ieee80211_vif *vif, int enable)
1010 {
1011 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1012 	struct sk_buff *skb;
1013 
1014 	if (mvif->omac_idx >= REPEATER_BSSID_START) {
1015 		mt7915_mcu_muar_config(phy, vif, false, enable);
1016 		mt7915_mcu_muar_config(phy, vif, true, enable);
1017 	}
1018 
1019 	skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1020 				       MT7915_BSS_UPDATE_MAX_SIZE);
1021 	if (IS_ERR(skb))
1022 		return PTR_ERR(skb);
1023 
1024 	/* bss_omac must be first */
1025 	if (enable)
1026 		mt7915_mcu_bss_omac_tlv(skb, vif);
1027 
1028 	mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1029 
1030 	if (vif->type == NL80211_IFTYPE_MONITOR)
1031 		goto out;
1032 
1033 	if (enable) {
1034 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1035 		mt7915_mcu_bss_bmc_tlv(skb, phy);
1036 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1037 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
1038 
1039 		if (vif->bss_conf.he_support)
1040 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
1041 
1042 		if (mvif->omac_idx >= EXT_BSSID_START &&
1043 		    mvif->omac_idx < REPEATER_BSSID_START)
1044 			mt7915_mcu_bss_ext_tlv(skb, mvif);
1045 	}
1046 out:
1047 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1048 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1049 }
1050 
1051 /** starec & wtbl **/
1052 static int
1053 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1054 		       struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1055 {
1056 	struct mt7915_sta_key_conf *bip = &msta->bip;
1057 	struct sta_rec_sec *sec;
1058 	struct tlv *tlv;
1059 	u32 len = sizeof(*sec);
1060 
1061 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1062 
1063 	sec = (struct sta_rec_sec *)tlv;
1064 	sec->add = cmd;
1065 
1066 	if (cmd == SET_KEY) {
1067 		struct sec_key *sec_key;
1068 		u8 cipher;
1069 
1070 		cipher = mt7915_mcu_get_cipher(key->cipher);
1071 		if (cipher == MCU_CIPHER_NONE)
1072 			return -EOPNOTSUPP;
1073 
1074 		sec_key = &sec->key[0];
1075 		sec_key->cipher_len = sizeof(*sec_key);
1076 
1077 		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
1078 			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
1079 			sec_key->key_id = bip->keyidx;
1080 			sec_key->key_len = 16;
1081 			memcpy(sec_key->key, bip->key, 16);
1082 
1083 			sec_key = &sec->key[1];
1084 			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
1085 			sec_key->cipher_len = sizeof(*sec_key);
1086 			sec_key->key_len = 16;
1087 			memcpy(sec_key->key, key->key, 16);
1088 
1089 			sec->n_cipher = 2;
1090 		} else {
1091 			sec_key->cipher_id = cipher;
1092 			sec_key->key_id = key->keyidx;
1093 			sec_key->key_len = key->keylen;
1094 			memcpy(sec_key->key, key->key, key->keylen);
1095 
1096 			if (cipher == MCU_CIPHER_TKIP) {
1097 				/* Rx/Tx MIC keys are swapped */
1098 				memcpy(sec_key->key + 16, key->key + 24, 8);
1099 				memcpy(sec_key->key + 24, key->key + 16, 8);
1100 			}
1101 
1102 			/* store key_conf for BIP batch update */
1103 			if (cipher == MCU_CIPHER_AES_CCMP) {
1104 				memcpy(bip->key, key->key, key->keylen);
1105 				bip->keyidx = key->keyidx;
1106 			}
1107 
1108 			len -= sizeof(*sec_key);
1109 			sec->n_cipher = 1;
1110 		}
1111 	} else {
1112 		len -= sizeof(sec->key);
1113 		sec->n_cipher = 0;
1114 	}
1115 	sec->len = cpu_to_le16(len);
1116 
1117 	return 0;
1118 }
1119 
1120 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1121 		       struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1122 		       enum set_key_cmd cmd)
1123 {
1124 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1125 	struct sk_buff *skb;
1126 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1127 	int ret;
1128 
1129 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1130 	if (IS_ERR(skb))
1131 		return PTR_ERR(skb);
1132 
1133 	ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1134 	if (ret)
1135 		return ret;
1136 
1137 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1138 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1139 }
1140 
1141 static void
1142 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1143 		      struct ieee80211_ampdu_params *params,
1144 		      bool enable, bool tx)
1145 {
1146 	struct sta_rec_ba *ba;
1147 	struct tlv *tlv;
1148 
1149 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1150 
1151 	ba = (struct sta_rec_ba *)tlv;
1152 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1153 	ba->winsize = cpu_to_le16(params->buf_size);
1154 	ba->ssn = cpu_to_le16(params->ssn);
1155 	ba->ba_en = enable << params->tid;
1156 	ba->amsdu = params->amsdu;
1157 	ba->tid = params->tid;
1158 }
1159 
1160 static void
1161 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1162 		       struct ieee80211_ampdu_params *params,
1163 		       bool enable, bool tx, void *sta_wtbl,
1164 		       void *wtbl_tlv)
1165 {
1166 	struct wtbl_ba *ba;
1167 	struct tlv *tlv;
1168 
1169 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1170 					wtbl_tlv, sta_wtbl);
1171 
1172 	ba = (struct wtbl_ba *)tlv;
1173 	ba->tid = params->tid;
1174 
1175 	if (tx) {
1176 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1177 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1178 		ba->ba_en = enable;
1179 	} else {
1180 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1181 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1182 		ba->rst_ba_tid = params->tid;
1183 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1184 		ba->rst_ba_sb = 1;
1185 	}
1186 
1187 	if (enable)
1188 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1189 }
1190 
1191 static int
1192 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1193 		  struct ieee80211_ampdu_params *params,
1194 		  bool enable, bool tx)
1195 {
1196 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1197 	struct mt7915_vif *mvif = msta->vif;
1198 	struct wtbl_req_hdr *wtbl_hdr;
1199 	struct tlv *sta_wtbl;
1200 	struct sk_buff *skb;
1201 	int ret;
1202 
1203 	if (enable && tx && !params->amsdu)
1204 		msta->wcid.amsdu = false;
1205 
1206 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1207 				       MT7915_STA_UPDATE_MAX_SIZE);
1208 	if (IS_ERR(skb))
1209 		return PTR_ERR(skb);
1210 
1211 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1212 
1213 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1214 					     &skb);
1215 	if (IS_ERR(wtbl_hdr))
1216 		return PTR_ERR(wtbl_hdr);
1217 
1218 	mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1219 
1220 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1221 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1222 	if (ret)
1223 		return ret;
1224 
1225 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1226 				       MT7915_STA_UPDATE_MAX_SIZE);
1227 	if (IS_ERR(skb))
1228 		return PTR_ERR(skb);
1229 
1230 	mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1231 
1232 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1233 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1234 }
1235 
1236 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1237 			 struct ieee80211_ampdu_params *params,
1238 			 bool enable)
1239 {
1240 	return mt7915_mcu_sta_ba(dev, params, enable, true);
1241 }
1242 
1243 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1244 			 struct ieee80211_ampdu_params *params,
1245 			 bool enable)
1246 {
1247 	return mt7915_mcu_sta_ba(dev, params, enable, false);
1248 }
1249 
1250 static void
1251 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1252 			    struct ieee80211_sta *sta, void *sta_wtbl,
1253 			    void *wtbl_tlv)
1254 {
1255 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1256 	struct wtbl_generic *generic;
1257 	struct wtbl_rx *rx;
1258 	struct tlv *tlv;
1259 
1260 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1261 					wtbl_tlv, sta_wtbl);
1262 
1263 	generic = (struct wtbl_generic *)tlv;
1264 
1265 	if (sta) {
1266 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1267 		generic->partial_aid = cpu_to_le16(sta->aid);
1268 		generic->muar_idx = mvif->omac_idx;
1269 		generic->qos = sta->wme;
1270 	} else {
1271 		/* use BSSID in station mode */
1272 		if (vif->type == NL80211_IFTYPE_STATION)
1273 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
1274 			       ETH_ALEN);
1275 		else
1276 			eth_broadcast_addr(generic->peer_addr);
1277 
1278 		generic->muar_idx = 0xe;
1279 	}
1280 
1281 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1282 					wtbl_tlv, sta_wtbl);
1283 
1284 	rx = (struct wtbl_rx *)tlv;
1285 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1286 	rx->rca2 = 1;
1287 	rx->rv = 1;
1288 }
1289 
1290 static void
1291 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1292 			 struct ieee80211_sta *sta, bool enable)
1293 {
1294 #define EXTRA_INFO_VER          BIT(0)
1295 #define EXTRA_INFO_NEW          BIT(1)
1296 	struct sta_rec_basic *basic;
1297 	struct tlv *tlv;
1298 
1299 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1300 
1301 	basic = (struct sta_rec_basic *)tlv;
1302 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1303 
1304 	if (enable) {
1305 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1306 		basic->conn_state = CONN_STATE_PORT_SECURE;
1307 	} else {
1308 		basic->conn_state = CONN_STATE_DISCONNECT;
1309 	}
1310 
1311 	if (!sta) {
1312 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1313 		eth_broadcast_addr(basic->peer_addr);
1314 		return;
1315 	}
1316 
1317 	switch (vif->type) {
1318 	case NL80211_IFTYPE_MESH_POINT:
1319 	case NL80211_IFTYPE_AP:
1320 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1321 		break;
1322 	case NL80211_IFTYPE_STATION:
1323 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1324 		break;
1325 	case NL80211_IFTYPE_ADHOC:
1326 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1327 		break;
1328 	default:
1329 		WARN_ON(1);
1330 		break;
1331 	}
1332 
1333 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1334 	basic->aid = cpu_to_le16(sta->aid);
1335 	basic->qos = sta->wme;
1336 }
1337 
1338 static void
1339 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1340 		      struct ieee80211_vif *vif)
1341 {
1342 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1343 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1344 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
1345 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
1346 	const u16 *mcs_mask = msta->vif->bitrate_mask.control[band].he_mcs;
1347 	struct sta_rec_he *he;
1348 	struct tlv *tlv;
1349 	u32 cap = 0;
1350 
1351 	if (!sta->he_cap.has_he)
1352 		return;
1353 
1354 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1355 
1356 	he = (struct sta_rec_he *)tlv;
1357 
1358 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1359 		cap |= STA_REC_HE_CAP_HTC;
1360 
1361 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1362 		cap |= STA_REC_HE_CAP_BSR;
1363 
1364 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1365 		cap |= STA_REC_HE_CAP_OM;
1366 
1367 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
1368 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1369 
1370 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1371 		cap |= STA_REC_HE_CAP_BQR;
1372 
1373 	if (elem->phy_cap_info[0] &
1374 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1375 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1376 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1377 
1378 	if (mvif->cap.ldpc && (elem->phy_cap_info[1] &
1379 			       IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
1380 		cap |= STA_REC_HE_CAP_LDPC;
1381 
1382 	if (elem->phy_cap_info[1] &
1383 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1384 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1385 
1386 	if (elem->phy_cap_info[2] &
1387 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1388 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1389 
1390 	if (elem->phy_cap_info[2] &
1391 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1392 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1393 
1394 	if (elem->phy_cap_info[2] &
1395 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1396 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1397 
1398 	if (elem->phy_cap_info[6] &
1399 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
1400 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1401 
1402 	if (elem->phy_cap_info[6] &
1403 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1404 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1405 
1406 	if (elem->phy_cap_info[7] &
1407 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1408 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1409 
1410 	if (elem->phy_cap_info[7] &
1411 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1412 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1413 
1414 	if (elem->phy_cap_info[7] &
1415 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1416 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1417 
1418 	if (elem->phy_cap_info[8] &
1419 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1420 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1421 
1422 	if (elem->phy_cap_info[8] &
1423 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1424 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1425 
1426 	if (elem->phy_cap_info[9] &
1427 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1428 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1429 
1430 	if (elem->phy_cap_info[9] &
1431 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1432 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1433 
1434 	he->he_cap = cpu_to_le32(cap);
1435 
1436 	switch (sta->bandwidth) {
1437 	case IEEE80211_STA_RX_BW_160:
1438 		if (elem->phy_cap_info[0] &
1439 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1440 			mt7915_mcu_set_sta_he_mcs(sta,
1441 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
1442 						  mcs_mask);
1443 
1444 		mt7915_mcu_set_sta_he_mcs(sta,
1445 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
1446 					  mcs_mask);
1447 		fallthrough;
1448 	default:
1449 		mt7915_mcu_set_sta_he_mcs(sta,
1450 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
1451 					  mcs_mask);
1452 		break;
1453 	}
1454 
1455 	he->t_frame_dur =
1456 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1457 	he->max_ampdu_exp =
1458 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1459 
1460 	he->bw_set =
1461 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1462 	he->device_class =
1463 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1464 	he->punc_pream_rx =
1465 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1466 
1467 	he->dcm_tx_mode =
1468 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1469 	he->dcm_tx_max_nss =
1470 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1471 	he->dcm_rx_mode =
1472 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1473 	he->dcm_rx_max_nss =
1474 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1475 	he->dcm_rx_max_nss =
1476 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1477 
1478 	he->pkt_ext = 2;
1479 }
1480 
1481 static void
1482 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1483 		     struct ieee80211_vif *vif)
1484 {
1485 	struct sta_rec_uapsd *uapsd;
1486 	struct tlv *tlv;
1487 
1488 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1489 		return;
1490 
1491 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1492 	uapsd = (struct sta_rec_uapsd *)tlv;
1493 
1494 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1495 		uapsd->dac_map |= BIT(3);
1496 		uapsd->tac_map |= BIT(3);
1497 	}
1498 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1499 		uapsd->dac_map |= BIT(2);
1500 		uapsd->tac_map |= BIT(2);
1501 	}
1502 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1503 		uapsd->dac_map |= BIT(1);
1504 		uapsd->tac_map |= BIT(1);
1505 	}
1506 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1507 		uapsd->dac_map |= BIT(0);
1508 		uapsd->tac_map |= BIT(0);
1509 	}
1510 	uapsd->max_sp = sta->max_sp;
1511 }
1512 
1513 static void
1514 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1515 			struct ieee80211_vif *vif)
1516 {
1517 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1518 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
1519 	struct sta_rec_muru *muru;
1520 	struct tlv *tlv;
1521 
1522 	if (vif->type != NL80211_IFTYPE_STATION &&
1523 	    vif->type != NL80211_IFTYPE_AP)
1524 		return;
1525 
1526 	if (!sta->vht_cap.vht_supported)
1527 		return;
1528 
1529 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1530 
1531 	muru = (struct sta_rec_muru *)tlv;
1532 
1533 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
1534 			       mvif->cap.vht_mu_ebfer ||
1535 			       mvif->cap.vht_mu_ebfee;
1536 
1537 	muru->mimo_dl.vht_mu_bfee =
1538 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1539 
1540 	if (!sta->he_cap.has_he)
1541 		return;
1542 
1543 	muru->mimo_dl.partial_bw_dl_mimo =
1544 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1545 
1546 	muru->cfg.mimo_ul_en = true;
1547 	muru->mimo_ul.full_ul_mimo =
1548 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1549 	muru->mimo_ul.partial_ul_mimo =
1550 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1551 
1552 	muru->cfg.ofdma_dl_en = true;
1553 	muru->ofdma_dl.punc_pream_rx =
1554 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1555 	muru->ofdma_dl.he_20m_in_40m_2g =
1556 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1557 	muru->ofdma_dl.he_20m_in_160m =
1558 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1559 	muru->ofdma_dl.he_80m_in_160m =
1560 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1561 
1562 	muru->ofdma_ul.t_frame_dur =
1563 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1564 	muru->ofdma_ul.mu_cascading =
1565 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1566 	muru->ofdma_ul.uo_ra =
1567 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1568 }
1569 
1570 static void
1571 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1572 {
1573 	struct sta_rec_ht *ht;
1574 	struct tlv *tlv;
1575 
1576 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1577 
1578 	ht = (struct sta_rec_ht *)tlv;
1579 	ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1580 }
1581 
1582 static void
1583 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1584 {
1585 	struct sta_rec_vht *vht;
1586 	struct tlv *tlv;
1587 
1588 	if (!sta->vht_cap.vht_supported)
1589 		return;
1590 
1591 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1592 
1593 	vht = (struct sta_rec_vht *)tlv;
1594 	vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1595 	vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1596 	vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1597 }
1598 
1599 static void
1600 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1601 			 struct ieee80211_sta *sta)
1602 {
1603 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1604 	struct sta_rec_amsdu *amsdu;
1605 	struct tlv *tlv;
1606 
1607 	if (vif->type != NL80211_IFTYPE_STATION &&
1608 	    vif->type != NL80211_IFTYPE_AP)
1609 		return;
1610 
1611 	if (!sta->max_amsdu_len)
1612 	    return;
1613 
1614 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1615 	amsdu = (struct sta_rec_amsdu *)tlv;
1616 	amsdu->max_amsdu_num = 8;
1617 	amsdu->amsdu_en = true;
1618 	amsdu->max_mpdu_size = sta->max_amsdu_len >=
1619 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
1620 	msta->wcid.amsdu = true;
1621 }
1622 
1623 static void
1624 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1625 			 void *sta_wtbl, void *wtbl_tlv)
1626 {
1627 	struct wtbl_smps *smps;
1628 	struct tlv *tlv;
1629 
1630 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1631 					wtbl_tlv, sta_wtbl);
1632 	smps = (struct wtbl_smps *)tlv;
1633 	smps->smps = (sta->smps_mode == IEEE80211_SMPS_DYNAMIC);
1634 }
1635 
1636 static void
1637 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1638 		       struct ieee80211_sta *sta, void *sta_wtbl,
1639 		       void *wtbl_tlv)
1640 {
1641 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1642 	struct wtbl_ht *ht = NULL;
1643 	struct tlv *tlv;
1644 
1645 	/* wtbl ht */
1646 	if (sta->ht_cap.ht_supported) {
1647 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1648 						wtbl_tlv, sta_wtbl);
1649 		ht = (struct wtbl_ht *)tlv;
1650 		ht->ldpc = mvif->cap.ldpc &&
1651 			   (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1652 		ht->af = sta->ht_cap.ampdu_factor;
1653 		ht->mm = sta->ht_cap.ampdu_density;
1654 		ht->ht = true;
1655 	}
1656 
1657 	/* wtbl vht */
1658 	if (sta->vht_cap.vht_supported) {
1659 		struct wtbl_vht *vht;
1660 		u8 af;
1661 
1662 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1663 						wtbl_tlv, sta_wtbl);
1664 		vht = (struct wtbl_vht *)tlv;
1665 		vht->ldpc = mvif->cap.ldpc &&
1666 			    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1667 		vht->vht = true;
1668 
1669 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1670 			       sta->vht_cap.cap);
1671 		if (ht)
1672 			ht->af = max_t(u8, ht->af, af);
1673 	}
1674 
1675 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1676 }
1677 
1678 static void
1679 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1680 			      struct ieee80211_sta *sta,
1681 			      void *sta_wtbl, void *wtbl_tlv)
1682 {
1683 	struct mt7915_sta *msta;
1684 	struct wtbl_hdr_trans *htr = NULL;
1685 	struct tlv *tlv;
1686 
1687 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1688 					wtbl_tlv, sta_wtbl);
1689 	htr = (struct wtbl_hdr_trans *)tlv;
1690 	htr->no_rx_trans = true;
1691 	if (vif->type == NL80211_IFTYPE_STATION)
1692 		htr->to_ds = true;
1693 	else
1694 		htr->from_ds = true;
1695 
1696 	if (!sta)
1697 		return;
1698 
1699 	msta = (struct mt7915_sta *)sta->drv_priv;
1700 	htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
1701 	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1702 		htr->to_ds = true;
1703 		htr->from_ds = true;
1704 	}
1705 }
1706 
1707 static int
1708 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1709 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1710 {
1711 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1712 	struct mt7915_sta *msta;
1713 	struct wtbl_req_hdr *wtbl_hdr;
1714 	struct tlv *tlv;
1715 
1716 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1717 
1718 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1719 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
1720 					     tlv, &skb);
1721 	if (IS_ERR(wtbl_hdr))
1722 		return PTR_ERR(wtbl_hdr);
1723 
1724 	mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, tlv, wtbl_hdr);
1725 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, tlv, wtbl_hdr);
1726 
1727 	if (sta)
1728 		mt7915_mcu_wtbl_ht_tlv(skb, vif, sta, tlv, wtbl_hdr);
1729 
1730 	return 0;
1731 }
1732 
1733 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1734 				    struct ieee80211_vif *vif,
1735 				    struct ieee80211_sta *sta)
1736 {
1737 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1738 	struct wtbl_req_hdr *wtbl_hdr;
1739 	struct sk_buff *skb;
1740 
1741 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1742 	if (!skb)
1743 		return -ENOMEM;
1744 
1745 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1746 	if (IS_ERR(wtbl_hdr))
1747 		return PTR_ERR(wtbl_hdr);
1748 
1749 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1750 
1751 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1752 				     true);
1753 }
1754 
1755 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1756 			struct ieee80211_sta *sta)
1757 {
1758 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1759 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1760 	struct wtbl_req_hdr *wtbl_hdr;
1761 	struct tlv *sta_wtbl;
1762 	struct sk_buff *skb;
1763 
1764 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1765 				       MT7915_STA_UPDATE_MAX_SIZE);
1766 	if (IS_ERR(skb))
1767 		return PTR_ERR(skb);
1768 
1769 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1770 
1771 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1772 					     &skb);
1773 	if (IS_ERR(wtbl_hdr))
1774 		return PTR_ERR(wtbl_hdr);
1775 
1776 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1777 
1778 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1779 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1780 }
1781 
1782 static inline bool
1783 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1784 			struct ieee80211_sta *sta, bool bfee)
1785 {
1786 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1787 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1788 
1789 	if (vif->type != NL80211_IFTYPE_STATION &&
1790 	    vif->type != NL80211_IFTYPE_AP)
1791 		return false;
1792 
1793 	if (!bfee && tx_ant < 2)
1794 		return false;
1795 
1796 	if (sta->he_cap.has_he) {
1797 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1798 
1799 		if (bfee)
1800 			return mvif->cap.he_su_ebfee &&
1801 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1802 		else
1803 			return mvif->cap.he_su_ebfer &&
1804 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1805 	}
1806 
1807 	if (sta->vht_cap.vht_supported) {
1808 		u32 cap = sta->vht_cap.cap;
1809 
1810 		if (bfee)
1811 			return mvif->cap.vht_su_ebfee &&
1812 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1813 		else
1814 			return mvif->cap.vht_su_ebfer &&
1815 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1816 	}
1817 
1818 	return false;
1819 }
1820 
1821 static void
1822 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1823 {
1824 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1825 	bf->ndp_rate = 0;				/* mcs0 */
1826 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1827 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1828 }
1829 
1830 static void
1831 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1832 		       struct sta_rec_bf *bf)
1833 {
1834 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1835 	u8 n = 0;
1836 
1837 	bf->tx_mode = MT_PHY_TYPE_HT;
1838 
1839 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1840 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1841 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1842 			      mcs->tx_params);
1843 	else if (mcs->rx_mask[3])
1844 		n = 3;
1845 	else if (mcs->rx_mask[2])
1846 		n = 2;
1847 	else if (mcs->rx_mask[1])
1848 		n = 1;
1849 
1850 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1851 	bf->ncol = min_t(u8, bf->nrow, n);
1852 	bf->ibf_ncol = n;
1853 }
1854 
1855 static void
1856 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1857 			struct sta_rec_bf *bf, bool explicit)
1858 {
1859 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1860 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1861 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1862 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1863 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1864 
1865 	bf->tx_mode = MT_PHY_TYPE_VHT;
1866 
1867 	if (explicit) {
1868 		u8 sts, snd_dim;
1869 
1870 		mt7915_mcu_sta_sounding_rate(bf);
1871 
1872 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1873 				pc->cap);
1874 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1875 				    vc->cap);
1876 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1877 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1878 		bf->ibf_ncol = bf->ncol;
1879 
1880 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1881 			bf->nrow = 1;
1882 	} else {
1883 		bf->nrow = tx_ant;
1884 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1885 		bf->ibf_ncol = nss_mcs;
1886 
1887 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1888 			bf->ibf_nrow = 1;
1889 	}
1890 }
1891 
1892 static void
1893 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1894 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1895 {
1896 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1897 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1898 	const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1899 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1900 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1901 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1902 	u8 snd_dim, sts;
1903 
1904 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1905 
1906 	mt7915_mcu_sta_sounding_rate(bf);
1907 
1908 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1909 				pe->phy_cap_info[6]);
1910 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1911 				pe->phy_cap_info[6]);
1912 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1913 			 ve->phy_cap_info[5]);
1914 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1915 		     pe->phy_cap_info[4]);
1916 	bf->nrow = min_t(u8, snd_dim, sts);
1917 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1918 	bf->ibf_ncol = bf->ncol;
1919 
1920 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1921 		return;
1922 
1923 	/* go over for 160MHz and 80p80 */
1924 	if (pe->phy_cap_info[0] &
1925 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1926 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1927 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1928 
1929 		bf->ncol_bw160 = nss_mcs;
1930 	}
1931 
1932 	if (pe->phy_cap_info[0] &
1933 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1934 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1935 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1936 
1937 		if (bf->ncol_bw160)
1938 			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1939 		else
1940 			bf->ncol_bw160 = nss_mcs;
1941 	}
1942 
1943 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1944 			 ve->phy_cap_info[5]);
1945 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1946 		     pe->phy_cap_info[4]);
1947 
1948 	bf->nrow_bw160 = min_t(int, snd_dim, sts);
1949 }
1950 
1951 static void
1952 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1953 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1954 {
1955 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1956 	struct mt7915_phy *phy =
1957 		mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1958 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1959 	struct sta_rec_bf *bf;
1960 	struct tlv *tlv;
1961 	const u8 matrix[4][4] = {
1962 		{0, 0, 0, 0},
1963 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1964 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1965 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1966 	};
1967 	bool ebf;
1968 
1969 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1970 	if (!ebf && !dev->ibf)
1971 		return;
1972 
1973 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1974 	bf = (struct sta_rec_bf *)tlv;
1975 
1976 	/* he: eBF only, in accordance with spec
1977 	 * vht: support eBF and iBF
1978 	 * ht: iBF only, since mac80211 lacks of eBF support
1979 	 */
1980 	if (sta->he_cap.has_he && ebf)
1981 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1982 	else if (sta->vht_cap.vht_supported)
1983 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1984 	else if (sta->ht_cap.ht_supported)
1985 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1986 	else
1987 		return;
1988 
1989 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1990 	bf->bw = sta->bandwidth;
1991 	bf->ibf_dbw = sta->bandwidth;
1992 	bf->ibf_nrow = tx_ant;
1993 
1994 	if (!ebf && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1995 		bf->ibf_timeout = 0x48;
1996 	else
1997 		bf->ibf_timeout = 0x18;
1998 
1999 	if (ebf && bf->nrow != tx_ant)
2000 		bf->mem_20m = matrix[tx_ant][bf->ncol];
2001 	else
2002 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
2003 
2004 	switch (sta->bandwidth) {
2005 	case IEEE80211_STA_RX_BW_160:
2006 	case IEEE80211_STA_RX_BW_80:
2007 		bf->mem_total = bf->mem_20m * 2;
2008 		break;
2009 	case IEEE80211_STA_RX_BW_40:
2010 		bf->mem_total = bf->mem_20m;
2011 		break;
2012 	case IEEE80211_STA_RX_BW_20:
2013 	default:
2014 		break;
2015 	}
2016 }
2017 
2018 static void
2019 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
2020 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2021 {
2022 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2023 	struct mt7915_phy *phy =
2024 		mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2025 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
2026 	struct sta_rec_bfee *bfee;
2027 	struct tlv *tlv;
2028 	u8 nrow = 0;
2029 
2030 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
2031 		return;
2032 
2033 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
2034 	bfee = (struct sta_rec_bfee *)tlv;
2035 
2036 	if (sta->he_cap.has_he) {
2037 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
2038 
2039 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
2040 			      pe->phy_cap_info[5]);
2041 	} else if (sta->vht_cap.vht_supported) {
2042 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
2043 
2044 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
2045 				 pc->cap);
2046 	}
2047 
2048 	/* reply with identity matrix to avoid 2x2 BF negative gain */
2049 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
2050 }
2051 
2052 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
2053 				   struct ieee80211_vif *vif,
2054 				   struct ieee80211_sta *sta,
2055 				   void *data, u32 field)
2056 {
2057 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2058 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2059 	struct sta_phy *phy = data;
2060 	struct sta_rec_ra_fixed *ra;
2061 	struct sk_buff *skb;
2062 	struct tlv *tlv;
2063 	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2064 
2065 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2066 	if (IS_ERR(skb))
2067 		return PTR_ERR(skb);
2068 
2069 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2070 	ra = (struct sta_rec_ra_fixed *)tlv;
2071 
2072 	switch (field) {
2073 	case RATE_PARAM_AUTO:
2074 		break;
2075 	case RATE_PARAM_FIXED:
2076 	case RATE_PARAM_FIXED_MCS:
2077 	case RATE_PARAM_FIXED_GI:
2078 	case RATE_PARAM_FIXED_HE_LTF:
2079 		ra->phy = *phy;
2080 		break;
2081 	default:
2082 		break;
2083 	}
2084 	ra->field = cpu_to_le32(field);
2085 
2086 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2087 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2088 }
2089 
2090 static int
2091 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
2092 			       struct ieee80211_vif *vif,
2093 			       struct ieee80211_sta *sta)
2094 {
2095 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2096 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2097 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
2098 	enum nl80211_band band = chandef->chan->band;
2099 	struct sta_phy phy = {};
2100 	int ret, nrates = 0;
2101 
2102 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _he)				\
2103 	do {									\
2104 		u8 i, gi = mask->control[band]._gi;				\
2105 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
2106 		for (i = 0; i <= sta->bandwidth; i++) {				\
2107 			phy.sgi |= gi << (i << (_he));				\
2108 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
2109 		}								\
2110 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) 	\
2111 			nrates += hweight16(mask->control[band]._mcs[i]);  	\
2112 		phy.mcs = ffs(mask->control[band]._mcs[0]) - 1;			\
2113 	} while (0)
2114 
2115 	if (sta->he_cap.has_he) {
2116 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 1);
2117 	} else if (sta->vht_cap.vht_supported) {
2118 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0);
2119 	} else if (sta->ht_cap.ht_supported) {
2120 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 0);
2121 	} else {
2122 		nrates = hweight32(mask->control[band].legacy);
2123 		phy.mcs = ffs(mask->control[band].legacy) - 1;
2124 	}
2125 #undef __sta_phy_bitrate_mask_check
2126 
2127 	/* fall back to auto rate control */
2128 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
2129 	    mask->control[band].he_gi == GENMASK(7, 0) &&
2130 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
2131 	    nrates != 1)
2132 		return 0;
2133 
2134 	/* fixed single rate */
2135 	if (nrates == 1) {
2136 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
2137 						     RATE_PARAM_FIXED_MCS);
2138 		if (ret)
2139 			return ret;
2140 	}
2141 
2142 	/* fixed GI */
2143 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
2144 	    mask->control[band].he_gi != GENMASK(7, 0)) {
2145 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2146 		u32 addr;
2147 
2148 		/* firmware updates only TXCMD but doesn't take WTBL into
2149 		 * account, so driver should update here to reflect the
2150 		 * actual txrate hardware sends out.
2151 		 */
2152 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
2153 		if (sta->he_cap.has_he)
2154 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
2155 		else
2156 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
2157 
2158 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
2159 						     RATE_PARAM_FIXED_GI);
2160 		if (ret)
2161 			return ret;
2162 	}
2163 
2164 	/* fixed HE_LTF */
2165 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
2166 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
2167 						     RATE_PARAM_FIXED_HE_LTF);
2168 		if (ret)
2169 			return ret;
2170 	}
2171 
2172 	return 0;
2173 }
2174 
2175 static void
2176 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2177 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2178 {
2179 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2180 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2181 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
2182 	enum nl80211_band band = chandef->chan->band;
2183 	struct sta_rec_ra *ra;
2184 	struct tlv *tlv;
2185 	u32 supp_rate = sta->supp_rates[band];
2186 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
2187 
2188 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2189 	ra = (struct sta_rec_ra *)tlv;
2190 
2191 	ra->valid = true;
2192 	ra->auto_rate = true;
2193 	ra->phy_mode = mt7915_get_phy_mode(vif, sta);
2194 	ra->channel = chandef->chan->hw_value;
2195 	ra->bw = sta->bandwidth;
2196 	ra->phy.bw = sta->bandwidth;
2197 
2198 	if (supp_rate) {
2199 		supp_rate &= mask->control[band].legacy;
2200 		ra->rate_len = hweight32(supp_rate);
2201 
2202 		if (band == NL80211_BAND_2GHZ) {
2203 			ra->supp_mode = MODE_CCK;
2204 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2205 
2206 			if (ra->rate_len > 4) {
2207 				ra->supp_mode |= MODE_OFDM;
2208 				ra->supp_ofdm_rate = supp_rate >> 4;
2209 			}
2210 		} else {
2211 			ra->supp_mode = MODE_OFDM;
2212 			ra->supp_ofdm_rate = supp_rate;
2213 		}
2214 	}
2215 
2216 	if (sta->ht_cap.ht_supported) {
2217 		ra->supp_mode |= MODE_HT;
2218 		ra->af = sta->ht_cap.ampdu_factor;
2219 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2220 
2221 		cap |= STA_CAP_HT;
2222 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2223 			cap |= STA_CAP_SGI_20;
2224 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2225 			cap |= STA_CAP_SGI_40;
2226 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2227 			cap |= STA_CAP_TX_STBC;
2228 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2229 			cap |= STA_CAP_RX_STBC;
2230 		if (mvif->cap.ldpc &&
2231 		    (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
2232 			cap |= STA_CAP_LDPC;
2233 
2234 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
2235 					  mask->control[band].ht_mcs);
2236 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2237 	}
2238 
2239 	if (sta->vht_cap.vht_supported) {
2240 		u8 af;
2241 
2242 		ra->supp_mode |= MODE_VHT;
2243 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2244 			       sta->vht_cap.cap);
2245 		ra->af = max_t(u8, ra->af, af);
2246 
2247 		cap |= STA_CAP_VHT;
2248 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2249 			cap |= STA_CAP_VHT_SGI_80;
2250 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2251 			cap |= STA_CAP_VHT_SGI_160;
2252 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2253 			cap |= STA_CAP_VHT_TX_STBC;
2254 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2255 			cap |= STA_CAP_VHT_RX_STBC;
2256 		if (mvif->cap.ldpc &&
2257 		    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
2258 			cap |= STA_CAP_VHT_LDPC;
2259 
2260 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
2261 					   mask->control[band].vht_mcs);
2262 	}
2263 
2264 	if (sta->he_cap.has_he) {
2265 		ra->supp_mode |= MODE_HE;
2266 		cap |= STA_CAP_HE;
2267 	}
2268 
2269 	ra->sta_cap = cpu_to_le32(cap);
2270 }
2271 
2272 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2273 			     struct ieee80211_sta *sta, bool changed)
2274 {
2275 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2276 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2277 	struct sk_buff *skb;
2278 	int ret;
2279 
2280 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2281 				       MT7915_STA_UPDATE_MAX_SIZE);
2282 	if (IS_ERR(skb))
2283 		return PTR_ERR(skb);
2284 
2285 	/* firmware rc algorithm refers to sta_rec_he for HE control.
2286 	 * once dev->rc_work changes the settings driver should also
2287 	 * update sta_rec_he here.
2288 	 */
2289 	if (sta->he_cap.has_he && changed)
2290 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
2291 
2292 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
2293 	 * i.e 0-{7,8,9} for VHT.
2294 	 */
2295 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2296 
2297 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2298 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
2299 	if (ret)
2300 		return ret;
2301 
2302 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
2303 	 * and updates as peer fixed rate parameters, which overrides
2304 	 * sta_rec_ra and firmware rate control algorithm.
2305 	 */
2306 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
2307 }
2308 
2309 static int
2310 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2311 		     struct ieee80211_sta *sta)
2312 {
2313 #define MT_STA_BSS_GROUP		1
2314 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2315 	struct mt7915_sta *msta;
2316 	struct {
2317 		__le32 action;
2318 		u8 wlan_idx_lo;
2319 		u8 status;
2320 		u8 wlan_idx_hi;
2321 		u8 rsv0[5];
2322 		__le32 val;
2323 		u8 rsv1[8];
2324 	} __packed req = {
2325 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
2326 		.val = cpu_to_le32(mvif->idx % 16),
2327 	};
2328 
2329 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2330 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
2331 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
2332 
2333 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
2334 				 sizeof(req), true);
2335 }
2336 
2337 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2338 		       struct ieee80211_sta *sta, bool enable)
2339 {
2340 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2341 	struct mt7915_sta *msta;
2342 	struct sk_buff *skb;
2343 	int ret;
2344 
2345 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2346 
2347 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2348 				       MT7915_STA_UPDATE_MAX_SIZE);
2349 	if (IS_ERR(skb))
2350 		return PTR_ERR(skb);
2351 
2352 	/* starec basic */
2353 	mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2354 	if (!enable)
2355 		goto out;
2356 
2357 	/* tag order is in accordance with firmware dependency. */
2358 	if (sta && sta->ht_cap.ht_supported) {
2359 		/* starec bfer */
2360 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
2361 		/* starec ht */
2362 		mt7915_mcu_sta_ht_tlv(skb, sta);
2363 		/* starec vht */
2364 		mt7915_mcu_sta_vht_tlv(skb, sta);
2365 		/* starec uapsd */
2366 		mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
2367 	}
2368 
2369 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
2370 	if (ret)
2371 		return ret;
2372 
2373 	if (sta && sta->ht_cap.ht_supported) {
2374 		/* starec amsdu */
2375 		mt7915_mcu_sta_amsdu_tlv(skb, vif, sta);
2376 		/* starec he */
2377 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
2378 		/* starec muru */
2379 		mt7915_mcu_sta_muru_tlv(skb, sta, vif);
2380 		/* starec bfee */
2381 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
2382 	}
2383 
2384 	ret = mt7915_mcu_add_group(dev, vif, sta);
2385 	if (ret)
2386 		return ret;
2387 out:
2388 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2389 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2390 }
2391 
2392 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2393 			      struct ieee80211_sta *sta, u32 rate)
2394 {
2395 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2396 	struct mt7915_vif *mvif = msta->vif;
2397 	struct sta_rec_ra_fixed *ra;
2398 	struct sk_buff *skb;
2399 	struct tlv *tlv;
2400 	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2401 
2402 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2403 	if (IS_ERR(skb))
2404 		return PTR_ERR(skb);
2405 
2406 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2407 	ra = (struct sta_rec_ra_fixed *)tlv;
2408 
2409 	if (!rate) {
2410 		ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2411 		goto out;
2412 	}
2413 
2414 	ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2415 	ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2416 	ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2417 	ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2418 	ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2419 	ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2420 
2421 	if (ra->phy.bw)
2422 		ra->phy.ldpc = 7;
2423 	else
2424 		ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2425 
2426 	/* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2427 	if (ra->phy.type > MT_PHY_TYPE_VHT) {
2428 		ra->phy.he_ltf = FIELD_GET(RATE_CFG_HE_LTF, rate) * 85;
2429 		ra->phy.sgi = FIELD_GET(RATE_CFG_GI, rate) * 85;
2430 	} else {
2431 		ra->phy.sgi = FIELD_GET(RATE_CFG_GI, rate) * 15;
2432 	}
2433 
2434 out:
2435 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2436 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2437 }
2438 
2439 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2440 			    struct ieee80211_vif *vif, bool enable)
2441 {
2442 	struct mt7915_dev *dev = phy->dev;
2443 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2444 	struct {
2445 		struct req_hdr {
2446 			u8 omac_idx;
2447 			u8 dbdc_idx;
2448 			__le16 tlv_num;
2449 			u8 is_tlv_append;
2450 			u8 rsv[3];
2451 		} __packed hdr;
2452 		struct req_tlv {
2453 			__le16 tag;
2454 			__le16 len;
2455 			u8 active;
2456 			u8 dbdc_idx;
2457 			u8 omac_addr[ETH_ALEN];
2458 		} __packed tlv;
2459 	} data = {
2460 		.hdr = {
2461 			.omac_idx = mvif->omac_idx,
2462 			.dbdc_idx = mvif->band_idx,
2463 			.tlv_num = cpu_to_le16(1),
2464 			.is_tlv_append = 1,
2465 		},
2466 		.tlv = {
2467 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2468 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2469 			.active = enable,
2470 			.dbdc_idx = mvif->band_idx,
2471 		},
2472 	};
2473 
2474 	if (mvif->omac_idx >= REPEATER_BSSID_START)
2475 		return mt7915_mcu_muar_config(phy, vif, false, enable);
2476 
2477 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2478 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2479 				 &data, sizeof(data), true);
2480 }
2481 
2482 static void
2483 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
2484 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
2485 			 struct ieee80211_mutable_offsets *offs)
2486 {
2487 	struct bss_info_bcn_cntdwn *info;
2488 	struct tlv *tlv;
2489 	int sub_tag;
2490 
2491 	if (!offs->cntdwn_counter_offs[0])
2492 		return;
2493 
2494 	sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
2495 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
2496 					   &bcn->sub_ntlv, &bcn->len);
2497 	info = (struct bss_info_bcn_cntdwn *)tlv;
2498 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2499 }
2500 
2501 static void
2502 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2503 		       struct sk_buff *rskb, struct sk_buff *skb,
2504 		       struct bss_info_bcn *bcn,
2505 		       struct ieee80211_mutable_offsets *offs)
2506 {
2507 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2508 	struct bss_info_bcn_cont *cont;
2509 	struct tlv *tlv;
2510 	u8 *buf;
2511 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2512 
2513 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2514 					   len, &bcn->sub_ntlv, &bcn->len);
2515 
2516 	cont = (struct bss_info_bcn_cont *)tlv;
2517 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2518 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2519 
2520 	if (offs->cntdwn_counter_offs[0]) {
2521 		u16 offset = offs->cntdwn_counter_offs[0];
2522 
2523 		if (vif->csa_active)
2524 			cont->csa_ofs = cpu_to_le16(offset - 4);
2525 		if (vif->color_change_active)
2526 			cont->bcc_ofs = cpu_to_le16(offset - 3);
2527 	}
2528 
2529 	buf = (u8 *)tlv + sizeof(*cont);
2530 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
2531 			      true);
2532 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2533 }
2534 
2535 static void
2536 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
2537 			     struct sk_buff *skb)
2538 {
2539 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2540 	struct mt7915_vif_cap *vc = &mvif->cap;
2541 	const struct ieee80211_he_cap_elem *he;
2542 	const struct ieee80211_vht_cap *vht;
2543 	const struct ieee80211_ht_cap *ht;
2544 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
2545 	const u8 *ie;
2546 	u32 len, bc;
2547 
2548 	/* Check missing configuration options to allow AP mode in mac80211
2549 	 * to remain in sync with hostapd settings, and get a subset of
2550 	 * beacon and hardware capabilities.
2551 	 */
2552 	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
2553 		return;
2554 
2555 	memset(vc, 0, sizeof(*vc));
2556 
2557 	len = skb->len - (mgmt->u.beacon.variable - skb->data);
2558 
2559 	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
2560 			      len);
2561 	if (ie && ie[1] >= sizeof(*ht)) {
2562 		ht = (void *)(ie + 2);
2563 		vc->ldpc |= !!(le16_to_cpu(ht->cap_info) &
2564 			       IEEE80211_HT_CAP_LDPC_CODING);
2565 	}
2566 
2567 	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
2568 			      len);
2569 	if (ie && ie[1] >= sizeof(*vht)) {
2570 		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
2571 
2572 		vht = (void *)(ie + 2);
2573 		bc = le32_to_cpu(vht->vht_cap_info);
2574 
2575 		vc->ldpc |= !!(bc & IEEE80211_VHT_CAP_RXLDPC);
2576 		vc->vht_su_ebfer =
2577 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
2578 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
2579 		vc->vht_su_ebfee =
2580 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
2581 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
2582 		vc->vht_mu_ebfer =
2583 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
2584 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
2585 		vc->vht_mu_ebfee =
2586 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
2587 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
2588 	}
2589 
2590 	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
2591 				  mgmt->u.beacon.variable, len);
2592 	if (ie && ie[1] >= sizeof(*he) + 1) {
2593 		const struct ieee80211_sta_he_cap *pc =
2594 			mt7915_get_he_phy_cap(phy, vif);
2595 		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
2596 
2597 		he = (void *)(ie + 3);
2598 
2599 		vc->he_su_ebfer =
2600 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
2601 			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
2602 		vc->he_su_ebfee =
2603 			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
2604 			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
2605 		vc->he_mu_ebfer =
2606 			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
2607 			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
2608 	}
2609 }
2610 
2611 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2612 			  struct ieee80211_vif *vif, int en)
2613 {
2614 #define MAX_BEACON_SIZE 512
2615 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2616 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2617 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2618 	struct ieee80211_mutable_offsets offs;
2619 	struct ieee80211_tx_info *info;
2620 	struct sk_buff *skb, *rskb;
2621 	struct tlv *tlv;
2622 	struct bss_info_bcn *bcn;
2623 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2624 
2625 	rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2626 	if (IS_ERR(rskb))
2627 		return PTR_ERR(rskb);
2628 
2629 	tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2630 	bcn = (struct bss_info_bcn *)tlv;
2631 	bcn->enable = en;
2632 
2633 	if (!en)
2634 		goto out;
2635 
2636 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2637 	if (!skb)
2638 		return -EINVAL;
2639 
2640 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2641 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2642 		dev_kfree_skb(skb);
2643 		return -EINVAL;
2644 	}
2645 
2646 	if (mvif->band_idx) {
2647 		info = IEEE80211_SKB_CB(skb);
2648 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2649 	}
2650 
2651 	mt7915_mcu_beacon_check_caps(phy, vif, skb);
2652 
2653 	/* TODO: subtag - 11v MBSSID */
2654 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2655 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2656 	dev_kfree_skb(skb);
2657 
2658 out:
2659 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2660 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2661 }
2662 
2663 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2664 				     u32 option)
2665 {
2666 	struct {
2667 		__le32 option;
2668 		__le32 addr;
2669 	} req = {
2670 		.option = cpu_to_le32(option),
2671 		.addr = cpu_to_le32(addr),
2672 	};
2673 
2674 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2675 				 sizeof(req), true);
2676 }
2677 
2678 static int mt7915_mcu_restart(struct mt76_dev *dev)
2679 {
2680 	struct {
2681 		u8 power_mode;
2682 		u8 rsv[3];
2683 	} req = {
2684 		.power_mode = 1,
2685 	};
2686 
2687 	return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2688 				 sizeof(req), false);
2689 }
2690 
2691 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2692 {
2693 	struct {
2694 		__le32 op;
2695 	} req = {
2696 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2697 	};
2698 
2699 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2700 				 sizeof(req), true);
2701 }
2702 
2703 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2704 {
2705 	struct {
2706 		u8 check_crc;
2707 		u8 reserved[3];
2708 	} req = {
2709 		.check_crc = 0,
2710 	};
2711 
2712 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2713 				 sizeof(req), true);
2714 }
2715 
2716 static int mt7915_driver_own(struct mt7915_dev *dev)
2717 {
2718 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_DRV_OWN);
2719 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND0,
2720 			    MT_TOP_LPCR_HOST_FW_OWN, 0, 500)) {
2721 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2722 		return -EIO;
2723 	}
2724 
2725 	return 0;
2726 }
2727 
2728 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2729 				    u32 len, u32 mode)
2730 {
2731 	struct {
2732 		__le32 addr;
2733 		__le32 len;
2734 		__le32 mode;
2735 	} req = {
2736 		.addr = cpu_to_le32(addr),
2737 		.len = cpu_to_le32(len),
2738 		.mode = cpu_to_le32(mode),
2739 	};
2740 	int attr;
2741 
2742 	if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2743 		attr = MCU_CMD(PATCH_START_REQ);
2744 	else
2745 		attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2746 
2747 	return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2748 }
2749 
2750 static int mt7915_load_patch(struct mt7915_dev *dev)
2751 {
2752 	const struct mt7915_patch_hdr *hdr;
2753 	const struct firmware *fw = NULL;
2754 	int i, ret, sem;
2755 
2756 	sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2757 	switch (sem) {
2758 	case PATCH_IS_DL:
2759 		return 0;
2760 	case PATCH_NOT_DL_SEM_SUCCESS:
2761 		break;
2762 	default:
2763 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2764 		return -EAGAIN;
2765 	}
2766 
2767 	ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2768 	if (ret)
2769 		goto out;
2770 
2771 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2772 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2773 		ret = -EINVAL;
2774 		goto out;
2775 	}
2776 
2777 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2778 
2779 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2780 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2781 
2782 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2783 		struct mt7915_patch_sec *sec;
2784 		const u8 *dl;
2785 		u32 len, addr;
2786 
2787 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2788 						  i * sizeof(*sec));
2789 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2790 		    PATCH_SEC_TYPE_INFO) {
2791 			ret = -EINVAL;
2792 			goto out;
2793 		}
2794 
2795 		addr = be32_to_cpu(sec->info.addr);
2796 		len = be32_to_cpu(sec->info.len);
2797 		dl = fw->data + be32_to_cpu(sec->offs);
2798 
2799 		ret = mt7915_mcu_init_download(dev, addr, len,
2800 					       DL_MODE_NEED_RSP);
2801 		if (ret) {
2802 			dev_err(dev->mt76.dev, "Download request failed\n");
2803 			goto out;
2804 		}
2805 
2806 		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2807 					       dl, len, 4096);
2808 		if (ret) {
2809 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2810 			goto out;
2811 		}
2812 	}
2813 
2814 	ret = mt7915_mcu_start_patch(dev);
2815 	if (ret)
2816 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2817 
2818 out:
2819 	sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2820 	switch (sem) {
2821 	case PATCH_REL_SEM_SUCCESS:
2822 		break;
2823 	default:
2824 		ret = -EAGAIN;
2825 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2826 		break;
2827 	}
2828 	release_firmware(fw);
2829 
2830 	return ret;
2831 }
2832 
2833 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2834 {
2835 	u32 ret = 0;
2836 
2837 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2838 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2839 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2840 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2841 	ret |= DL_MODE_NEED_RSP;
2842 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2843 
2844 	return ret;
2845 }
2846 
2847 static int
2848 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2849 			     const struct mt7915_fw_trailer *hdr,
2850 			     const u8 *data, bool is_wa)
2851 {
2852 	int i, offset = 0;
2853 	u32 override = 0, option = 0;
2854 
2855 	for (i = 0; i < hdr->n_region; i++) {
2856 		const struct mt7915_fw_region *region;
2857 		int err;
2858 		u32 len, addr, mode;
2859 
2860 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2861 			 (hdr->n_region - i) * sizeof(*region));
2862 		mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2863 		len = le32_to_cpu(region->len);
2864 		addr = le32_to_cpu(region->addr);
2865 
2866 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2867 			override = addr;
2868 
2869 		err = mt7915_mcu_init_download(dev, addr, len, mode);
2870 		if (err) {
2871 			dev_err(dev->mt76.dev, "Download request failed\n");
2872 			return err;
2873 		}
2874 
2875 		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2876 					       data + offset, len, 4096);
2877 		if (err) {
2878 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2879 			return err;
2880 		}
2881 
2882 		offset += len;
2883 	}
2884 
2885 	if (override)
2886 		option |= FW_START_OVERRIDE;
2887 
2888 	if (is_wa)
2889 		option |= FW_START_WORKING_PDA_CR4;
2890 
2891 	return mt7915_mcu_start_firmware(dev, override, option);
2892 }
2893 
2894 static int mt7915_load_ram(struct mt7915_dev *dev)
2895 {
2896 	const struct mt7915_fw_trailer *hdr;
2897 	const struct firmware *fw;
2898 	int ret;
2899 
2900 	ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2901 	if (ret)
2902 		return ret;
2903 
2904 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2905 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2906 		ret = -EINVAL;
2907 		goto out;
2908 	}
2909 
2910 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2911 					sizeof(*hdr));
2912 
2913 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2914 		 hdr->fw_ver, hdr->build_date);
2915 
2916 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2917 	if (ret) {
2918 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2919 		goto out;
2920 	}
2921 
2922 	release_firmware(fw);
2923 
2924 	ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2925 	if (ret)
2926 		return ret;
2927 
2928 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2929 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2930 		ret = -EINVAL;
2931 		goto out;
2932 	}
2933 
2934 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2935 					sizeof(*hdr));
2936 
2937 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2938 		 hdr->fw_ver, hdr->build_date);
2939 
2940 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2941 	if (ret) {
2942 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2943 		goto out;
2944 	}
2945 
2946 	snprintf(dev->mt76.hw->wiphy->fw_version,
2947 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2948 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2949 
2950 out:
2951 	release_firmware(fw);
2952 
2953 	return ret;
2954 }
2955 
2956 static int mt7915_load_firmware(struct mt7915_dev *dev)
2957 {
2958 	int ret;
2959 
2960 	ret = mt7915_load_patch(dev);
2961 	if (ret)
2962 		return ret;
2963 
2964 	ret = mt7915_load_ram(dev);
2965 	if (ret)
2966 		return ret;
2967 
2968 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2969 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2970 				       FW_STATE_WACPU_RDY), 1000)) {
2971 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2972 		return -EIO;
2973 	}
2974 
2975 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2976 
2977 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2978 
2979 	return 0;
2980 }
2981 
2982 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2983 {
2984 	struct {
2985 		u8 ctrl_val;
2986 		u8 pad[3];
2987 	} data = {
2988 		.ctrl_val = ctrl
2989 	};
2990 
2991 	if (type == MCU_FW_LOG_WA)
2992 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2993 					 &data, sizeof(data), true);
2994 
2995 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2996 				 sizeof(data), true);
2997 }
2998 
2999 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
3000 {
3001 	struct {
3002 		u8 ver;
3003 		u8 pad;
3004 		__le16 len;
3005 		u8 level;
3006 		u8 rsv[3];
3007 		__le32 module_idx;
3008 	} data = {
3009 		.module_idx = cpu_to_le32(module),
3010 		.level = level,
3011 	};
3012 
3013 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
3014 				 sizeof(data), false);
3015 }
3016 
3017 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
3018 {
3019 	struct {
3020 		u8 enable;
3021 		u8 _rsv[3];
3022 	} __packed req = {
3023 		.enable = enabled
3024 	};
3025 
3026 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
3027 				 sizeof(req), false);
3028 }
3029 
3030 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
3031 {
3032 	struct {
3033 		__le32 cmd;
3034 		u8 val[4];
3035 	} __packed req = {
3036 		.cmd = cpu_to_le32(cmd),
3037 	};
3038 
3039 	put_unaligned_le32(val, req.val);
3040 
3041 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
3042 				 sizeof(req), false);
3043 }
3044 
3045 static int
3046 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
3047 {
3048 #define RX_AIRTIME_FEATURE_CTRL		1
3049 #define RX_AIRTIME_BITWISE_CTRL		2
3050 #define RX_AIRTIME_CLEAR_EN	1
3051 	struct {
3052 		__le16 field;
3053 		__le16 sub_field;
3054 		__le32 set_status;
3055 		__le32 get_status;
3056 		u8 _rsv[12];
3057 
3058 		bool airtime_en;
3059 		bool mibtime_en;
3060 		bool earlyend_en;
3061 		u8 _rsv1[9];
3062 
3063 		bool airtime_clear;
3064 		bool mibtime_clear;
3065 		u8 _rsv2[98];
3066 	} __packed req = {
3067 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
3068 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
3069 		.airtime_clear = true,
3070 	};
3071 	int ret;
3072 
3073 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
3074 				sizeof(req), true);
3075 	if (ret)
3076 		return ret;
3077 
3078 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
3079 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
3080 	req.airtime_en = true;
3081 
3082 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
3083 				 sizeof(req), true);
3084 }
3085 
3086 int mt7915_mcu_init(struct mt7915_dev *dev)
3087 {
3088 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
3089 		.headroom = sizeof(struct mt7915_mcu_txd),
3090 		.mcu_skb_send_msg = mt7915_mcu_send_message,
3091 		.mcu_parse_response = mt7915_mcu_parse_response,
3092 		.mcu_restart = mt7915_mcu_restart,
3093 	};
3094 	int ret;
3095 
3096 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
3097 
3098 	ret = mt7915_driver_own(dev);
3099 	if (ret)
3100 		return ret;
3101 
3102 	ret = mt7915_load_firmware(dev);
3103 	if (ret)
3104 		return ret;
3105 
3106 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
3107 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
3108 	if (ret)
3109 		return ret;
3110 
3111 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
3112 	if (ret)
3113 		return ret;
3114 
3115 	ret = mt7915_mcu_set_mwds(dev, 1);
3116 	if (ret)
3117 		return ret;
3118 
3119 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
3120 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
3121 	if (ret)
3122 		return ret;
3123 
3124 	ret = mt7915_mcu_init_rx_airtime(dev);
3125 	if (ret)
3126 		return ret;
3127 
3128 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
3129 				 MCU_WA_PARAM_RED, 0, 0);
3130 }
3131 
3132 void mt7915_mcu_exit(struct mt7915_dev *dev)
3133 {
3134 	__mt76_mcu_restart(&dev->mt76);
3135 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
3136 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
3137 				       FW_STATE_FW_DOWNLOAD), 1000)) {
3138 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
3139 		return;
3140 	}
3141 
3142 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_FW_OWN);
3143 	skb_queue_purge(&dev->mt76.mcu.res_q);
3144 }
3145 
3146 static int
3147 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
3148 {
3149 	struct {
3150 		u8 operation;
3151 		u8 count;
3152 		u8 _rsv[2];
3153 		u8 index;
3154 		u8 enable;
3155 		__le16 etype;
3156 	} req = {
3157 		.operation = 1,
3158 		.count = 1,
3159 		.enable = 1,
3160 		.etype = cpu_to_le16(ETH_P_PAE),
3161 	};
3162 
3163 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3164 				 &req, sizeof(req), false);
3165 }
3166 
3167 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
3168 		       bool enable, bool hdr_trans)
3169 {
3170 	struct {
3171 		u8 operation;
3172 		u8 enable;
3173 		u8 check_bssid;
3174 		u8 insert_vlan;
3175 		u8 remove_vlan;
3176 		u8 tid;
3177 		u8 mode;
3178 		u8 rsv;
3179 	} __packed req_trans = {
3180 		.enable = hdr_trans,
3181 	};
3182 	struct {
3183 		u8 enable;
3184 		u8 band;
3185 		u8 rsv[2];
3186 	} __packed req_mac = {
3187 		.enable = enable,
3188 		.band = band,
3189 	};
3190 	int ret;
3191 
3192 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3193 				&req_trans, sizeof(req_trans), false);
3194 	if (ret)
3195 		return ret;
3196 
3197 	if (hdr_trans)
3198 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
3199 
3200 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
3201 				 &req_mac, sizeof(req_mac), true);
3202 }
3203 
3204 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
3205 {
3206 	struct {
3207 		__le32 cmd;
3208 		u8 band;
3209 		u8 enable;
3210 	} __packed req = {
3211 		.cmd = cpu_to_le32(SCS_ENABLE),
3212 		.band = band,
3213 		.enable = enable + 1,
3214 	};
3215 
3216 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
3217 				 sizeof(req), false);
3218 }
3219 
3220 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
3221 {
3222 	struct mt7915_dev *dev = phy->dev;
3223 	struct {
3224 		u8 prot_idx;
3225 		u8 band;
3226 		u8 rsv[2];
3227 		__le32 len_thresh;
3228 		__le32 pkt_thresh;
3229 	} __packed req = {
3230 		.prot_idx = 1,
3231 		.band = phy != &dev->phy,
3232 		.len_thresh = cpu_to_le32(val),
3233 		.pkt_thresh = cpu_to_le32(0x2),
3234 	};
3235 
3236 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
3237 				 sizeof(req), true);
3238 }
3239 
3240 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
3241 {
3242 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
3243 	u8 num = req->total;
3244 	size_t len = sizeof(*req) -
3245 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
3246 
3247 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
3248 				 len, true);
3249 }
3250 
3251 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
3252 {
3253 #define TX_CMD_MODE		1
3254 	struct mt7915_mcu_tx req = {
3255 		.valid = true,
3256 		.mode = TX_CMD_MODE,
3257 		.total = IEEE80211_NUM_ACS,
3258 	};
3259 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3260 	int ac;
3261 
3262 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3263 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3264 		struct edca *e = &req.edca[ac];
3265 
3266 		e->set = WMM_PARAM_SET;
3267 		e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3268 		e->aifs = q->aifs;
3269 		e->txop = cpu_to_le16(q->txop);
3270 
3271 		if (q->cw_min)
3272 			e->cw_min = fls(q->cw_min);
3273 		else
3274 			e->cw_min = 5;
3275 
3276 		if (q->cw_max)
3277 			e->cw_max = cpu_to_le16(fls(q->cw_max));
3278 		else
3279 			e->cw_max = cpu_to_le16(10);
3280 	}
3281 
3282 	return mt7915_mcu_update_edca(dev, &req);
3283 }
3284 
3285 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3286 {
3287 #define ENTER_PM_STATE		1
3288 #define EXIT_PM_STATE		2
3289 	struct {
3290 		u8 pm_number;
3291 		u8 pm_state;
3292 		u8 bssid[ETH_ALEN];
3293 		u8 dtim_period;
3294 		u8 wlan_idx_lo;
3295 		__le16 bcn_interval;
3296 		__le32 aid;
3297 		__le32 rx_filter;
3298 		u8 band_idx;
3299 		u8 wlan_idx_hi;
3300 		u8 rsv[2];
3301 		__le32 feature;
3302 		u8 omac_idx;
3303 		u8 wmm_idx;
3304 		u8 bcn_loss_cnt;
3305 		u8 bcn_sp_duration;
3306 	} __packed req = {
3307 		.pm_number = 5,
3308 		.pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3309 		.band_idx = band,
3310 	};
3311 
3312 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3313 				 sizeof(req), true);
3314 }
3315 
3316 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3317 		       enum mt7915_rdd_cmd cmd, u8 index,
3318 		       u8 rx_sel, u8 val)
3319 {
3320 	struct {
3321 		u8 ctrl;
3322 		u8 rdd_idx;
3323 		u8 rdd_rx_sel;
3324 		u8 val;
3325 		u8 rsv[4];
3326 	} __packed req = {
3327 		.ctrl = cmd,
3328 		.rdd_idx = index,
3329 		.rdd_rx_sel = rx_sel,
3330 		.val = val,
3331 	};
3332 
3333 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3334 				 sizeof(req), true);
3335 }
3336 
3337 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3338 {
3339 	struct {
3340 		__le32 tag;
3341 		__le16 min_lpn;
3342 		u8 rsv[2];
3343 	} __packed req = {
3344 		.tag = cpu_to_le32(0x1),
3345 		.min_lpn = cpu_to_le16(val),
3346 	};
3347 
3348 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3349 				 sizeof(req), true);
3350 }
3351 
3352 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3353 			    const struct mt7915_dfs_pulse *pulse)
3354 {
3355 	struct {
3356 		__le32 tag;
3357 
3358 		__le32 max_width;		/* us */
3359 		__le32 max_pwr;			/* dbm */
3360 		__le32 min_pwr;			/* dbm */
3361 		__le32 min_stgr_pri;		/* us */
3362 		__le32 max_stgr_pri;		/* us */
3363 		__le32 min_cr_pri;		/* us */
3364 		__le32 max_cr_pri;		/* us */
3365 	} __packed req = {
3366 		.tag = cpu_to_le32(0x3),
3367 
3368 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3369 		__req_field(max_width),
3370 		__req_field(max_pwr),
3371 		__req_field(min_pwr),
3372 		__req_field(min_stgr_pri),
3373 		__req_field(max_stgr_pri),
3374 		__req_field(min_cr_pri),
3375 		__req_field(max_cr_pri),
3376 #undef __req_field
3377 	};
3378 
3379 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3380 				 sizeof(req), true);
3381 }
3382 
3383 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3384 			    const struct mt7915_dfs_pattern *pattern)
3385 {
3386 	struct {
3387 		__le32 tag;
3388 		__le16 radar_type;
3389 
3390 		u8 enb;
3391 		u8 stgr;
3392 		u8 min_crpn;
3393 		u8 max_crpn;
3394 		u8 min_crpr;
3395 		u8 min_pw;
3396 		__le32 min_pri;
3397 		__le32 max_pri;
3398 		u8 max_pw;
3399 		u8 min_crbn;
3400 		u8 max_crbn;
3401 		u8 min_stgpn;
3402 		u8 max_stgpn;
3403 		u8 min_stgpr;
3404 		u8 rsv[2];
3405 		__le32 min_stgpr_diff;
3406 	} __packed req = {
3407 		.tag = cpu_to_le32(0x2),
3408 		.radar_type = cpu_to_le16(index),
3409 
3410 #define __req_field_u8(field) .field = pattern->field
3411 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3412 		__req_field_u8(enb),
3413 		__req_field_u8(stgr),
3414 		__req_field_u8(min_crpn),
3415 		__req_field_u8(max_crpn),
3416 		__req_field_u8(min_crpr),
3417 		__req_field_u8(min_pw),
3418 		__req_field_u32(min_pri),
3419 		__req_field_u32(max_pri),
3420 		__req_field_u8(max_pw),
3421 		__req_field_u8(min_crbn),
3422 		__req_field_u8(max_crbn),
3423 		__req_field_u8(min_stgpn),
3424 		__req_field_u8(max_stgpn),
3425 		__req_field_u8(min_stgpr),
3426 		__req_field_u32(min_stgpr_diff),
3427 #undef __req_field_u8
3428 #undef __req_field_u32
3429 	};
3430 
3431 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3432 				 sizeof(req), true);
3433 }
3434 
3435 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3436 {
3437 	struct mt7915_dev *dev = phy->dev;
3438 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3439 	int freq1 = chandef->center_freq1;
3440 	bool ext_phy = phy != &dev->phy;
3441 	struct {
3442 		u8 control_ch;
3443 		u8 center_ch;
3444 		u8 bw;
3445 		u8 tx_streams_num;
3446 		u8 rx_streams;	/* mask or num */
3447 		u8 switch_reason;
3448 		u8 band_idx;
3449 		u8 center_ch2;	/* for 80+80 only */
3450 		__le16 cac_case;
3451 		u8 channel_band;
3452 		u8 rsv0;
3453 		__le32 outband_freq;
3454 		u8 txpower_drop;
3455 		u8 ap_bw;
3456 		u8 ap_center_ch;
3457 		u8 rsv1[57];
3458 	} __packed req = {
3459 		.control_ch = chandef->chan->hw_value,
3460 		.center_ch = ieee80211_frequency_to_channel(freq1),
3461 		.bw = mt7915_mcu_chan_bw(chandef),
3462 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
3463 		.rx_streams = phy->mt76->antenna_mask,
3464 		.band_idx = ext_phy,
3465 		.channel_band = chandef->chan->band,
3466 	};
3467 
3468 #ifdef CONFIG_NL80211_TESTMODE
3469 	if (phy->mt76->test.tx_antenna_mask &&
3470 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3471 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3472 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3473 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3474 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
3475 
3476 		if (ext_phy) {
3477 			req.tx_streams_num = 2;
3478 			req.rx_streams >>= 2;
3479 		}
3480 	}
3481 #endif
3482 
3483 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3484 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3485 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3486 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3487 		req.switch_reason = CH_SWITCH_DFS;
3488 	else
3489 		req.switch_reason = CH_SWITCH_NORMAL;
3490 
3491 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3492 		req.rx_streams = hweight8(req.rx_streams);
3493 
3494 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3495 		int freq2 = chandef->center_freq2;
3496 
3497 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3498 	}
3499 
3500 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3501 }
3502 
3503 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3504 {
3505 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
3506 #define PAGE_IDX_MASK		GENMASK(4, 2)
3507 #define PER_PAGE_SIZE		0x400
3508 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3509 	u8 total = DIV_ROUND_UP(MT7915_EEPROM_SIZE, PER_PAGE_SIZE);
3510 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
3511 	int eep_len;
3512 	int i;
3513 
3514 	for (i = 0; i < total; i++, eep += eep_len) {
3515 		struct sk_buff *skb;
3516 		int ret;
3517 
3518 		if (i == total - 1 && !!(MT7915_EEPROM_SIZE % PER_PAGE_SIZE))
3519 			eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3520 		else
3521 			eep_len = PER_PAGE_SIZE;
3522 
3523 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3524 					 sizeof(req) + eep_len);
3525 		if (!skb)
3526 			return -ENOMEM;
3527 
3528 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
3529 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3530 		req.len = cpu_to_le16(eep_len);
3531 
3532 		skb_put_data(skb, &req, sizeof(req));
3533 		skb_put_data(skb, eep, eep_len);
3534 
3535 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3536 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3537 		if (ret)
3538 			return ret;
3539 	}
3540 
3541 	return 0;
3542 }
3543 
3544 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3545 {
3546 	struct mt7915_mcu_eeprom req = {
3547 		.buffer_mode = EE_MODE_EFUSE,
3548 		.format = EE_FORMAT_WHOLE,
3549 	};
3550 
3551 	if (dev->flash_mode)
3552 		return mt7915_mcu_set_eeprom_flash(dev);
3553 
3554 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3555 				 &req, sizeof(req), true);
3556 }
3557 
3558 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3559 {
3560 	struct mt7915_mcu_eeprom_info req = {
3561 		.addr = cpu_to_le32(round_down(offset,
3562 				    MT7915_EEPROM_BLOCK_SIZE)),
3563 	};
3564 	struct mt7915_mcu_eeprom_info *res;
3565 	struct sk_buff *skb;
3566 	int ret;
3567 	u8 *buf;
3568 
3569 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3570 				sizeof(req), true, &skb);
3571 	if (ret)
3572 		return ret;
3573 
3574 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
3575 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3576 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
3577 	dev_kfree_skb(skb);
3578 
3579 	return 0;
3580 }
3581 
3582 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3583 				  u8 *data, u32 len, int cmd)
3584 {
3585 	struct {
3586 		u8 dir;
3587 		u8 valid;
3588 		__le16 bitmap;
3589 		s8 precal;
3590 		u8 action;
3591 		u8 band;
3592 		u8 idx;
3593 		u8 rsv[4];
3594 		__le32 len;
3595 	} req = {};
3596 	struct sk_buff *skb;
3597 
3598 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3599 	if (!skb)
3600 		return -ENOMEM;
3601 
3602 	req.idx = idx;
3603 	req.len = cpu_to_le32(len);
3604 	skb_put_data(skb, &req, sizeof(req));
3605 	skb_put_data(skb, data, len);
3606 
3607 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3608 }
3609 
3610 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3611 {
3612 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3613 	u32 total = MT_EE_CAL_GROUP_SIZE;
3614 
3615 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3616 		return 0;
3617 
3618 	/*
3619 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3620 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3621 	 */
3622 	while (total > 0) {
3623 		int ret, len;
3624 
3625 		len = min_t(u32, total, MT_EE_CAL_UNIT);
3626 
3627 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3628 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3629 		if (ret)
3630 			return ret;
3631 
3632 		total -= len;
3633 		cal += len;
3634 		idx++;
3635 	}
3636 
3637 	return 0;
3638 }
3639 
3640 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3641 {
3642 	int i;
3643 
3644 	for (i = 0; i < n_freqs; i++)
3645 		if (cur == freqs[i])
3646 			return i;
3647 
3648 	return -1;
3649 }
3650 
3651 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3652 {
3653 	static const u16 freq_list[] = {
3654 		5180, 5200, 5220, 5240,
3655 		5260, 5280, 5300, 5320,
3656 		5500, 5520, 5540, 5560,
3657 		5580, 5600, 5620, 5640,
3658 		5660, 5680, 5700, 5745,
3659 		5765, 5785, 5805, 5825
3660 	};
3661 	int offset_2g = ARRAY_SIZE(freq_list);
3662 	int idx;
3663 
3664 	if (freq < 4000) {
3665 		if (freq < 2432)
3666 			return offset_2g;
3667 		if (freq < 2457)
3668 			return offset_2g + 1;
3669 
3670 		return offset_2g + 2;
3671 	}
3672 
3673 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3674 		return -1;
3675 
3676 	if (bw != NL80211_CHAN_WIDTH_20) {
3677 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3678 					   freq + 10);
3679 		if (idx >= 0)
3680 			return idx;
3681 
3682 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3683 					   freq - 10);
3684 		if (idx >= 0)
3685 			return idx;
3686 	}
3687 
3688 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3689 }
3690 
3691 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3692 {
3693 	struct mt7915_dev *dev = phy->dev;
3694 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3695 	u16 total = 2, center_freq = chandef->center_freq1;
3696 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3697 	int idx;
3698 
3699 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3700 		return 0;
3701 
3702 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3703 	if (idx < 0)
3704 		return -EINVAL;
3705 
3706 	/* Items: Tx DPD, Tx Flatness */
3707 	idx = idx * 2;
3708 	cal += MT_EE_CAL_GROUP_SIZE;
3709 
3710 	while (total--) {
3711 		int ret;
3712 
3713 		cal += (idx * MT_EE_CAL_UNIT);
3714 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3715 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3716 		if (ret)
3717 			return ret;
3718 
3719 		idx++;
3720 	}
3721 
3722 	return 0;
3723 }
3724 
3725 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3726 {
3727 	/* strict order */
3728 	static const enum mt7915_chan_mib_offs offs[] = {
3729 		MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME
3730 	};
3731 	struct mt76_channel_state *state = phy->mt76->chan_state;
3732 	struct mt76_channel_state *state_ts = &phy->state_ts;
3733 	struct mt7915_dev *dev = phy->dev;
3734 	struct mt7915_mcu_mib *res, req[4];
3735 	struct sk_buff *skb;
3736 	int i, ret;
3737 
3738 	for (i = 0; i < 4; i++) {
3739 		req[i].band = cpu_to_le32(phy != &dev->phy);
3740 		req[i].offs = cpu_to_le32(offs[i]);
3741 	}
3742 
3743 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3744 					req, sizeof(req), true, &skb);
3745 	if (ret)
3746 		return ret;
3747 
3748 	res = (struct mt7915_mcu_mib *)(skb->data + 20);
3749 
3750 	if (chan_switch)
3751 		goto out;
3752 
3753 #define __res_u64(s) le64_to_cpu(res[s].data)
3754 	state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3755 	state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3756 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3757 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3758 
3759 out:
3760 	state_ts->cc_busy = __res_u64(0);
3761 	state_ts->cc_tx = __res_u64(1);
3762 	state_ts->cc_bss_rx = __res_u64(2);
3763 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3764 #undef __res_u64
3765 
3766 	dev_kfree_skb(skb);
3767 
3768 	return 0;
3769 }
3770 
3771 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3772 {
3773 	struct mt7915_dev *dev = phy->dev;
3774 	struct {
3775 		u8 ctrl_id;
3776 		u8 action;
3777 		u8 dbdc_idx;
3778 		u8 rsv[5];
3779 	} req = {
3780 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3781 		.dbdc_idx = phy != &dev->phy,
3782 	};
3783 
3784 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3785 				 sizeof(req), true);
3786 }
3787 
3788 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3789 {
3790 	struct mt7915_dev *dev = phy->dev;
3791 	struct {
3792 		struct mt7915_mcu_thermal_ctrl ctrl;
3793 
3794 		__le32 trigger_temp;
3795 		__le32 restore_temp;
3796 		__le16 sustain_time;
3797 		u8 rsv[2];
3798 	} __packed req = {
3799 		.ctrl = {
3800 			.band_idx = phy != &dev->phy,
3801 		},
3802 	};
3803 	int level;
3804 
3805 	if (!state) {
3806 		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3807 		goto out;
3808 	}
3809 
3810 	/* set duty cycle and level */
3811 	for (level = 0; level < 4; level++) {
3812 		int ret;
3813 
3814 		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3815 		req.ctrl.duty.duty_level = level;
3816 		req.ctrl.duty.duty_cycle = state;
3817 		state /= 2;
3818 
3819 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3820 					&req, sizeof(req.ctrl), false);
3821 		if (ret)
3822 			return ret;
3823 	}
3824 
3825 	/* set high-temperature trigger threshold */
3826 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3827 	/* add a safety margin ~10 */
3828 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3829 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3830 	req.sustain_time = cpu_to_le16(10);
3831 
3832 out:
3833 	req.ctrl.type.protect_type = 1;
3834 	req.ctrl.type.trigger_type = 1;
3835 
3836 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3837 				 &req, sizeof(req), false);
3838 }
3839 
3840 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3841 {
3842 	struct mt7915_dev *dev = phy->dev;
3843 	struct mt76_phy *mphy = phy->mt76;
3844 	struct ieee80211_hw *hw = mphy->hw;
3845 	struct mt7915_sku_val {
3846 		u8 format_id;
3847 		u8 limit_type;
3848 		u8 dbdc_idx;
3849 		s8 val[MT7915_SKU_RATE_NUM];
3850 	} __packed req = {
3851 		.format_id = 4,
3852 		.dbdc_idx = phy != &dev->phy,
3853 	};
3854 	struct mt76_power_limits limits_array;
3855 	s8 *la = (s8 *)&limits_array;
3856 	int i, idx, n_chains = hweight8(mphy->antenna_mask);
3857 	int tx_power;
3858 
3859 	tx_power = hw->conf.power_level * 2 -
3860 		   mt76_tx_power_nss_delta(n_chains);
3861 
3862 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3863 					      &limits_array, tx_power);
3864 	mphy->txpower_cur = tx_power;
3865 
3866 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3867 		u8 mcs_num, len = mt7915_sku_group_len[i];
3868 		int j;
3869 
3870 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3871 			mcs_num = 10;
3872 
3873 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3874 				la = (s8 *)&limits_array + 12;
3875 		} else {
3876 			mcs_num = len;
3877 		}
3878 
3879 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3880 			req.val[idx + j] = la[j];
3881 
3882 		la += mcs_num;
3883 		idx += len;
3884 	}
3885 
3886 	return mt76_mcu_send_msg(&dev->mt76,
3887 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3888 				 sizeof(req), true);
3889 }
3890 
3891 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3892 {
3893 #define RATE_POWER_INFO	2
3894 	struct mt7915_dev *dev = phy->dev;
3895 	struct {
3896 		u8 format_id;
3897 		u8 category;
3898 		u8 band;
3899 		u8 _rsv;
3900 	} __packed req = {
3901 		.format_id = 7,
3902 		.category = RATE_POWER_INFO,
3903 		.band = phy != &dev->phy,
3904 	};
3905 	s8 res[MT7915_SKU_RATE_NUM][2];
3906 	struct sk_buff *skb;
3907 	int ret, i;
3908 
3909 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3910 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3911 					&req, sizeof(req), true, &skb);
3912 	if (ret)
3913 		return ret;
3914 
3915 	memcpy(res, skb->data + 4, sizeof(res));
3916 	for (i = 0; i < len; i++)
3917 		txpower[i] = res[i][req.band];
3918 
3919 	dev_kfree_skb(skb);
3920 
3921 	return 0;
3922 }
3923 
3924 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3925 			      u8 en)
3926 {
3927 	struct {
3928 		u8 test_mode_en;
3929 		u8 param_idx;
3930 		u8 _rsv[2];
3931 
3932 		u8 enable;
3933 		u8 _rsv2[3];
3934 
3935 		u8 pad[8];
3936 	} __packed req = {
3937 		.test_mode_en = test_mode,
3938 		.param_idx = param,
3939 		.enable = en,
3940 	};
3941 
3942 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3943 				 sizeof(req), false);
3944 }
3945 
3946 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3947 {
3948 	struct mt7915_dev *dev = phy->dev;
3949 	struct mt7915_sku {
3950 		u8 format_id;
3951 		u8 sku_enable;
3952 		u8 dbdc_idx;
3953 		u8 rsv;
3954 	} __packed req = {
3955 		.format_id = 0,
3956 		.dbdc_idx = phy != &dev->phy,
3957 		.sku_enable = enable,
3958 	};
3959 
3960 	return mt76_mcu_send_msg(&dev->mt76,
3961 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3962 				 sizeof(req), true);
3963 }
3964 
3965 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3966 {
3967 	struct {
3968 		u8 action;
3969 		u8 set;
3970 		u8 band;
3971 		u8 rsv;
3972 	} req = {
3973 		.action = action,
3974 		.set = set,
3975 		.band = band,
3976 	};
3977 
3978 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3979 				 &req, sizeof(req), false);
3980 }
3981 
3982 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3983 {
3984 	struct {
3985 		u8 action;
3986 		union {
3987 			struct {
3988 				u8 snd_mode;
3989 				u8 sta_num;
3990 				u8 rsv;
3991 				u8 wlan_idx[4];
3992 				__le32 snd_period;	/* ms */
3993 			} __packed snd;
3994 			struct {
3995 				bool ebf;
3996 				bool ibf;
3997 				u8 rsv;
3998 			} __packed type;
3999 			struct {
4000 				u8 bf_num;
4001 				u8 bf_bitmap;
4002 				u8 bf_sel[8];
4003 				u8 rsv[5];
4004 			} __packed mod;
4005 		};
4006 	} __packed req = {
4007 		.action = action,
4008 	};
4009 
4010 #define MT_BF_PROCESSING	4
4011 	switch (action) {
4012 	case MT_BF_SOUNDING_ON:
4013 		req.snd.snd_mode = MT_BF_PROCESSING;
4014 		break;
4015 	case MT_BF_TYPE_UPDATE:
4016 		req.type.ebf = true;
4017 		req.type.ibf = dev->ibf;
4018 		break;
4019 	case MT_BF_MODULE_UPDATE:
4020 		req.mod.bf_num = 2;
4021 		req.mod.bf_bitmap = GENMASK(1, 0);
4022 		break;
4023 	default:
4024 		return -EINVAL;
4025 	}
4026 
4027 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
4028 				 sizeof(req), true);
4029 }
4030 
4031 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
4032 			    bool enable)
4033 {
4034 #define MT_SPR_ENABLE		1
4035 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
4036 	struct {
4037 		u8 action;
4038 		u8 arg_num;
4039 		u8 band_idx;
4040 		u8 status;
4041 		u8 drop_tx_idx;
4042 		u8 sta_idx;	/* 256 sta */
4043 		u8 rsv[2];
4044 		__le32 val;
4045 	} __packed req = {
4046 		.action = MT_SPR_ENABLE,
4047 		.arg_num = 1,
4048 		.band_idx = mvif->band_idx,
4049 		.val = cpu_to_le32(enable),
4050 	};
4051 
4052 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
4053 				 sizeof(req), true);
4054 }
4055 
4056 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
4057 			   struct ieee80211_sta *sta, struct rate_info *rate)
4058 {
4059 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
4060 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
4061 	struct mt7915_dev *dev = phy->dev;
4062 	struct mt76_phy *mphy = phy->mt76;
4063 	struct {
4064 		u8 category;
4065 		u8 band;
4066 		__le16 wcid;
4067 	} __packed req = {
4068 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
4069 		.band = mvif->band_idx,
4070 		.wcid = cpu_to_le16(msta->wcid.idx),
4071 	};
4072 	struct ieee80211_supported_band *sband;
4073 	struct mt7915_mcu_phy_rx_info *res;
4074 	struct sk_buff *skb;
4075 	int ret;
4076 	bool cck = false;
4077 
4078 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
4079 					&req, sizeof(req), true, &skb);
4080 	if (ret)
4081 		return ret;
4082 
4083 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
4084 
4085 	rate->mcs = res->rate;
4086 	rate->nss = res->nsts + 1;
4087 
4088 	switch (res->mode) {
4089 	case MT_PHY_TYPE_CCK:
4090 		cck = true;
4091 		fallthrough;
4092 	case MT_PHY_TYPE_OFDM:
4093 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
4094 			sband = &mphy->sband_5g.sband;
4095 		else
4096 			sband = &mphy->sband_2g.sband;
4097 
4098 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
4099 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
4100 		break;
4101 	case MT_PHY_TYPE_HT:
4102 	case MT_PHY_TYPE_HT_GF:
4103 		if (rate->mcs > 31) {
4104 			ret = -EINVAL;
4105 			goto out;
4106 		}
4107 
4108 		rate->flags = RATE_INFO_FLAGS_MCS;
4109 		if (res->gi)
4110 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
4111 		break;
4112 	case MT_PHY_TYPE_VHT:
4113 		if (rate->mcs > 9) {
4114 			ret = -EINVAL;
4115 			goto out;
4116 		}
4117 
4118 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
4119 		if (res->gi)
4120 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
4121 		break;
4122 	case MT_PHY_TYPE_HE_SU:
4123 	case MT_PHY_TYPE_HE_EXT_SU:
4124 	case MT_PHY_TYPE_HE_TB:
4125 	case MT_PHY_TYPE_HE_MU:
4126 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
4127 			ret = -EINVAL;
4128 			goto out;
4129 		}
4130 		rate->he_gi = res->gi;
4131 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
4132 		break;
4133 	default:
4134 		ret = -EINVAL;
4135 		goto out;
4136 	}
4137 
4138 	switch (res->bw) {
4139 	case IEEE80211_STA_RX_BW_160:
4140 		rate->bw = RATE_INFO_BW_160;
4141 		break;
4142 	case IEEE80211_STA_RX_BW_80:
4143 		rate->bw = RATE_INFO_BW_80;
4144 		break;
4145 	case IEEE80211_STA_RX_BW_40:
4146 		rate->bw = RATE_INFO_BW_40;
4147 		break;
4148 	default:
4149 		rate->bw = RATE_INFO_BW_20;
4150 		break;
4151 	}
4152 
4153 out:
4154 	dev_kfree_skb(skb);
4155 
4156 	return ret;
4157 }
4158 
4159 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
4160 				struct cfg80211_he_bss_color *he_bss_color)
4161 {
4162 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
4163 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
4164 	struct bss_info_color *bss_color;
4165 	struct sk_buff *skb;
4166 	struct tlv *tlv;
4167 
4168 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
4169 	if (IS_ERR(skb))
4170 		return PTR_ERR(skb);
4171 
4172 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR, sizeof(*bss_color));
4173 	bss_color = (struct bss_info_color *)tlv;
4174 	bss_color->disable = !he_bss_color->enabled;
4175 	bss_color->color = he_bss_color->color;
4176 
4177 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
4178 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
4179 }
4180 
4181 #define TWT_AGRT_TRIGGER	BIT(0)
4182 #define TWT_AGRT_ANNOUNCE	BIT(1)
4183 #define TWT_AGRT_PROTECT	BIT(2)
4184 
4185 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
4186 			       struct mt7915_vif *mvif,
4187 			       struct mt7915_twt_flow *flow,
4188 			       int cmd)
4189 {
4190 	struct {
4191 		u8 tbl_idx;
4192 		u8 cmd;
4193 		u8 own_mac_idx;
4194 		u8 flowid; /* 0xff for group id */
4195 		__le16 peer_id; /* specify the peer_id (msb=0)
4196 				 * or group_id (msb=1)
4197 				 */
4198 		u8 duration; /* 256 us */
4199 		u8 bss_idx;
4200 		__le64 start_tsf;
4201 		__le16 mantissa;
4202 		u8 exponent;
4203 		u8 is_ap;
4204 		u8 agrt_params;
4205 		u8 rsv[23];
4206 	} __packed req = {
4207 		.tbl_idx = flow->table_id,
4208 		.cmd = cmd,
4209 		.own_mac_idx = mvif->omac_idx,
4210 		.flowid = flow->id,
4211 		.peer_id = cpu_to_le16(flow->wcid),
4212 		.duration = flow->duration,
4213 		.bss_idx = mvif->idx,
4214 		.start_tsf = cpu_to_le64(flow->tsf),
4215 		.mantissa = flow->mantissa,
4216 		.exponent = flow->exp,
4217 		.is_ap = true,
4218 	};
4219 
4220 	if (flow->protection)
4221 		req.agrt_params |= TWT_AGRT_PROTECT;
4222 	if (!flow->flowtype)
4223 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
4224 	if (flow->trigger)
4225 		req.agrt_params |= TWT_AGRT_TRIGGER;
4226 
4227 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
4228 				 &req, sizeof(req), true);
4229 }
4230