1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7986:						\
17 		_fw = MT7986_##name##__VA_ARGS__;		\
18 		break;						\
19 	default:						\
20 		_fw = MT7916_##name;				\
21 		break;						\
22 	}							\
23 	_fw;							\
24 })
25 
26 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
27 					 fw_name(_dev, name) :			\
28 					 fw_name(_dev, name, _MT7975))
29 
30 #define MCU_PATCH_ADDRESS		0x200000
31 
32 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
33 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
34 
35 static u8
36 mt7915_mcu_get_sta_nss(u16 mcs_map)
37 {
38 	u8 nss;
39 
40 	for (nss = 8; nss > 0; nss--) {
41 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
42 
43 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
44 			break;
45 	}
46 
47 	return nss - 1;
48 }
49 
50 static void
51 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
52 			  u16 mcs_map)
53 {
54 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
55 	struct mt7915_dev *dev = msta->vif->phy->dev;
56 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
57 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
58 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
59 
60 	for (nss = 0; nss < max_nss; nss++) {
61 		int mcs;
62 
63 		switch ((mcs_map >> (2 * nss)) & 0x3) {
64 		case IEEE80211_HE_MCS_SUPPORT_0_11:
65 			mcs = GENMASK(11, 0);
66 			break;
67 		case IEEE80211_HE_MCS_SUPPORT_0_9:
68 			mcs = GENMASK(9, 0);
69 			break;
70 		case IEEE80211_HE_MCS_SUPPORT_0_7:
71 			mcs = GENMASK(7, 0);
72 			break;
73 		default:
74 			mcs = 0;
75 		}
76 
77 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
78 
79 		switch (mcs) {
80 		case 0 ... 7:
81 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
82 			break;
83 		case 8 ... 9:
84 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
85 			break;
86 		case 10 ... 11:
87 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
88 			break;
89 		default:
90 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
91 			break;
92 		}
93 		mcs_map &= ~(0x3 << (nss * 2));
94 		mcs_map |= mcs << (nss * 2);
95 
96 		/* only support 2ss on 160MHz for mt7915 */
97 		if (is_mt7915(&dev->mt76) && nss > 1 &&
98 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
99 			break;
100 	}
101 
102 	*he_mcs = cpu_to_le16(mcs_map);
103 }
104 
105 static void
106 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
107 			   const u16 *mask)
108 {
109 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
110 	struct mt7915_dev *dev = msta->vif->phy->dev;
111 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
112 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
113 	u16 mcs;
114 
115 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
116 		switch (mcs_map & 0x3) {
117 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
118 			mcs = GENMASK(9, 0);
119 			break;
120 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
121 			mcs = GENMASK(8, 0);
122 			break;
123 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
124 			mcs = GENMASK(7, 0);
125 			break;
126 		default:
127 			mcs = 0;
128 		}
129 
130 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
131 
132 		/* only support 2ss on 160MHz for mt7915 */
133 		if (is_mt7915(&dev->mt76) && nss > 1 &&
134 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
135 			break;
136 	}
137 }
138 
139 static void
140 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
141 			  const u8 *mask)
142 {
143 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
144 
145 	for (nss = 0; nss < max_nss; nss++)
146 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
147 }
148 
149 static int
150 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
151 			  struct sk_buff *skb, int seq)
152 {
153 	struct mt76_connac2_mcu_rxd *rxd;
154 	int ret = 0;
155 
156 	if (!skb) {
157 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
158 			cmd, seq);
159 		return -ETIMEDOUT;
160 	}
161 
162 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
163 	if (seq != rxd->seq)
164 		return -EAGAIN;
165 
166 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
167 		skb_pull(skb, sizeof(*rxd) - 4);
168 		ret = *skb->data;
169 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
170 		skb_pull(skb, sizeof(*rxd) + 4);
171 		ret = le32_to_cpu(*(__le32 *)skb->data);
172 	} else {
173 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
174 	}
175 
176 	return ret;
177 }
178 
179 static int
180 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
181 			int cmd, int *wait_seq)
182 {
183 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
184 	enum mt76_mcuq_id qid;
185 	int ret;
186 
187 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
188 	if (ret)
189 		return ret;
190 
191 	if (cmd == MCU_CMD(FW_SCATTER))
192 		qid = MT_MCUQ_FWDL;
193 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
194 		qid = MT_MCUQ_WA;
195 	else
196 		qid = MT_MCUQ_WM;
197 
198 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
199 }
200 
201 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
202 {
203 	struct {
204 		__le32 args[3];
205 	} req = {
206 		.args = {
207 			cpu_to_le32(a1),
208 			cpu_to_le32(a2),
209 			cpu_to_le32(a3),
210 		},
211 	};
212 
213 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
214 }
215 
216 static void
217 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
218 {
219 	if (vif->bss_conf.csa_active)
220 		ieee80211_csa_finish(vif);
221 }
222 
223 static void
224 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
225 {
226 	struct mt76_phy *mphy = &dev->mt76.phy;
227 	struct mt7915_mcu_csa_notify *c;
228 
229 	c = (struct mt7915_mcu_csa_notify *)skb->data;
230 
231 	if ((c->band_idx && !dev->phy.band_idx) && dev->mt76.phys[MT_BAND1])
232 		mphy = dev->mt76.phys[MT_BAND1];
233 
234 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
235 			IEEE80211_IFACE_ITER_RESUME_ALL,
236 			mt7915_mcu_csa_finish, mphy->hw);
237 }
238 
239 static void
240 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
241 {
242 	struct mt76_phy *mphy = &dev->mt76.phy;
243 	struct mt7915_mcu_thermal_notify *t;
244 	struct mt7915_phy *phy;
245 
246 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
247 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
248 		return;
249 
250 	if ((t->ctrl.band_idx && !dev->phy.band_idx) && dev->mt76.phys[MT_BAND1])
251 		mphy = dev->mt76.phys[MT_BAND1];
252 
253 	phy = (struct mt7915_phy *)mphy->priv;
254 	phy->throttle_state = t->ctrl.duty.duty_cycle;
255 }
256 
257 static void
258 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
259 {
260 	struct mt76_phy *mphy = &dev->mt76.phy;
261 	struct mt7915_mcu_rdd_report *r;
262 
263 	r = (struct mt7915_mcu_rdd_report *)skb->data;
264 
265 	if ((r->band_idx && !dev->phy.band_idx) && dev->mt76.phys[MT_BAND1])
266 		mphy = dev->mt76.phys[MT_BAND1];
267 
268 	if (r->band_idx == MT_RX_SEL2)
269 		cfg80211_background_radar_event(mphy->hw->wiphy,
270 						&dev->rdd2_chandef,
271 						GFP_ATOMIC);
272 	else
273 		ieee80211_radar_detected(mphy->hw);
274 	dev->hw_pattern++;
275 }
276 
277 static void
278 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
279 {
280 	struct mt76_connac2_mcu_rxd *rxd;
281 	int len = skb->len - sizeof(*rxd);
282 	const char *data, *type;
283 
284 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
285 	data = (char *)&rxd[1];
286 
287 	switch (rxd->s2d_index) {
288 	case 0:
289 		if (mt7915_debugfs_rx_log(dev, data, len))
290 			return;
291 
292 		type = "WM";
293 		break;
294 	case 2:
295 		type = "WA";
296 		break;
297 	default:
298 		type = "unknown";
299 		break;
300 	}
301 
302 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
303 }
304 
305 static void
306 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
307 {
308 	if (!vif->bss_conf.color_change_active)
309 		return;
310 
311 	ieee80211_color_change_finish(vif);
312 }
313 
314 static void
315 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
316 {
317 	struct mt76_phy *mphy = &dev->mt76.phy;
318 	struct mt7915_mcu_bcc_notify *b;
319 
320 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
321 
322 	if ((b->band_idx && !dev->phy.band_idx) && dev->mt76.phys[MT_BAND1])
323 		mphy = dev->mt76.phys[MT_BAND1];
324 
325 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
326 			IEEE80211_IFACE_ITER_RESUME_ALL,
327 			mt7915_mcu_cca_finish, mphy->hw);
328 }
329 
330 static void
331 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
332 {
333 	struct mt76_connac2_mcu_rxd *rxd;
334 
335 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
336 	switch (rxd->ext_eid) {
337 	case MCU_EXT_EVENT_THERMAL_PROTECT:
338 		mt7915_mcu_rx_thermal_notify(dev, skb);
339 		break;
340 	case MCU_EXT_EVENT_RDD_REPORT:
341 		mt7915_mcu_rx_radar_detected(dev, skb);
342 		break;
343 	case MCU_EXT_EVENT_CSA_NOTIFY:
344 		mt7915_mcu_rx_csa_notify(dev, skb);
345 		break;
346 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
347 		mt7915_mcu_rx_log_message(dev, skb);
348 		break;
349 	case MCU_EXT_EVENT_BCC_NOTIFY:
350 		mt7915_mcu_rx_bcc_notify(dev, skb);
351 		break;
352 	default:
353 		break;
354 	}
355 }
356 
357 static void
358 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
359 {
360 	struct mt76_connac2_mcu_rxd *rxd;
361 
362 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
363 	switch (rxd->eid) {
364 	case MCU_EVENT_EXT:
365 		mt7915_mcu_rx_ext_event(dev, skb);
366 		break;
367 	default:
368 		break;
369 	}
370 	dev_kfree_skb(skb);
371 }
372 
373 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
374 {
375 	struct mt76_connac2_mcu_rxd *rxd;
376 
377 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
378 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
379 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
380 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
381 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
382 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
383 	    !rxd->seq)
384 		mt7915_mcu_rx_unsolicited_event(dev, skb);
385 	else
386 		mt76_mcu_rx_event(&dev->mt76, skb);
387 }
388 
389 static struct tlv *
390 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
391 			     __le16 *sub_ntlv, __le16 *len)
392 {
393 	struct tlv *ptlv, tlv = {
394 		.tag = cpu_to_le16(sub_tag),
395 		.len = cpu_to_le16(sub_len),
396 	};
397 
398 	ptlv = skb_put(skb, sub_len);
399 	memcpy(ptlv, &tlv, sizeof(tlv));
400 
401 	le16_add_cpu(sub_ntlv, 1);
402 	le16_add_cpu(len, sub_len);
403 
404 	return ptlv;
405 }
406 
407 /** bss info **/
408 struct mt7915_he_obss_narrow_bw_ru_data {
409 	bool tolerated;
410 };
411 
412 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
413 						   struct cfg80211_bss *bss,
414 						   void *_data)
415 {
416 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
417 	const struct element *elem;
418 
419 	rcu_read_lock();
420 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
421 
422 	if (!elem || elem->datalen <= 10 ||
423 	    !(elem->data[10] &
424 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
425 		data->tolerated = false;
426 
427 	rcu_read_unlock();
428 }
429 
430 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
431 					      struct ieee80211_vif *vif)
432 {
433 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
434 		.tolerated = true,
435 	};
436 
437 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
438 		return false;
439 
440 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
441 			  mt7915_check_he_obss_narrow_bw_ru_iter,
442 			  &iter_data);
443 
444 	/*
445 	 * If there is at least one AP on radar channel that cannot
446 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
447 	 */
448 	return !iter_data.tolerated;
449 }
450 
451 static void
452 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
453 			struct mt7915_phy *phy)
454 {
455 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
456 	struct bss_info_rf_ch *ch;
457 	struct tlv *tlv;
458 	int freq1 = chandef->center_freq1;
459 
460 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
461 
462 	ch = (struct bss_info_rf_ch *)tlv;
463 	ch->pri_ch = chandef->chan->hw_value;
464 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
465 	ch->bw = mt76_connac_chan_bw(chandef);
466 
467 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
468 		int freq2 = chandef->center_freq2;
469 
470 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
471 	}
472 
473 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
474 		struct mt76_phy *mphy = phy->mt76;
475 
476 		ch->he_ru26_block =
477 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
478 		ch->he_all_disable = false;
479 	} else {
480 		ch->he_all_disable = true;
481 	}
482 }
483 
484 static void
485 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
486 		      struct mt7915_phy *phy)
487 {
488 	int max_nss = hweight8(phy->mt76->chainmask);
489 	struct bss_info_ra *ra;
490 	struct tlv *tlv;
491 
492 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
493 
494 	ra = (struct bss_info_ra *)tlv;
495 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
496 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
497 	ra->short_preamble = true;
498 	ra->tx_streams = max_nss;
499 	ra->rx_streams = max_nss;
500 	ra->algo = 4;
501 	ra->train_up_rule = 2;
502 	ra->train_up_high_thres = 110;
503 	ra->train_up_rule_rssi = -70;
504 	ra->low_traffic_thres = 2;
505 	ra->phy_cap = cpu_to_le32(0xfdf);
506 	ra->interval = cpu_to_le32(500);
507 	ra->fast_interval = cpu_to_le32(100);
508 }
509 
510 static void
511 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
512 		      struct mt7915_phy *phy)
513 {
514 #define DEFAULT_HE_PE_DURATION		4
515 #define DEFAULT_HE_DURATION_RTS_THRES	1023
516 	const struct ieee80211_sta_he_cap *cap;
517 	struct bss_info_he *he;
518 	struct tlv *tlv;
519 
520 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
521 
522 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
523 
524 	he = (struct bss_info_he *)tlv;
525 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
526 	if (!he->he_pe_duration)
527 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
528 
529 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
530 	if (!he->he_rts_thres)
531 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
532 
533 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
534 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
535 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
536 }
537 
538 static void
539 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
540 {
541 #define TXD_CMP_MAP1		GENMASK(15, 0)
542 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
543 	struct bss_info_hw_amsdu *amsdu;
544 	struct tlv *tlv;
545 
546 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
547 
548 	amsdu = (struct bss_info_hw_amsdu *)tlv;
549 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
550 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
551 	amsdu->trig_thres = cpu_to_le16(2);
552 	amsdu->enable = true;
553 }
554 
555 static void
556 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
557 {
558 	struct bss_info_bmc_rate *bmc;
559 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
560 	enum nl80211_band band = chandef->chan->band;
561 	struct tlv *tlv;
562 
563 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
564 
565 	bmc = (struct bss_info_bmc_rate *)tlv;
566 	if (band == NL80211_BAND_2GHZ) {
567 		bmc->short_preamble = true;
568 	} else {
569 		bmc->bc_trans = cpu_to_le16(0x2000);
570 		bmc->mc_trans = cpu_to_le16(0x2080);
571 	}
572 }
573 
574 static int
575 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
576 		       bool bssid, bool enable)
577 {
578 	struct mt7915_dev *dev = phy->dev;
579 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
580 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
581 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
582 	const u8 *addr = vif->addr;
583 	struct {
584 		u8 mode;
585 		u8 force_clear;
586 		u8 clear_bitmap[8];
587 		u8 entry_count;
588 		u8 write;
589 		u8 band;
590 
591 		u8 index;
592 		u8 bssid;
593 		u8 addr[ETH_ALEN];
594 	} __packed req = {
595 		.mode = !!mask || enable,
596 		.entry_count = 1,
597 		.write = 1,
598 		.band = phy != &dev->phy,
599 		.index = idx * 2 + bssid,
600 	};
601 
602 	if (bssid)
603 		addr = vif->bss_conf.bssid;
604 
605 	if (enable)
606 		ether_addr_copy(req.addr, addr);
607 
608 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
609 				 sizeof(req), true);
610 }
611 
612 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
613 			    struct ieee80211_vif *vif, int enable)
614 {
615 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
616 	struct mt7915_dev *dev = phy->dev;
617 	struct sk_buff *skb;
618 
619 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
620 		mt7915_mcu_muar_config(phy, vif, false, enable);
621 		mt7915_mcu_muar_config(phy, vif, true, enable);
622 	}
623 
624 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
625 					      MT7915_BSS_UPDATE_MAX_SIZE);
626 	if (IS_ERR(skb))
627 		return PTR_ERR(skb);
628 
629 	/* bss_omac must be first */
630 	if (enable)
631 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
632 
633 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
634 				      mvif->sta.wcid.idx, enable);
635 
636 	if (vif->type == NL80211_IFTYPE_MONITOR)
637 		goto out;
638 
639 	if (enable) {
640 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
641 		mt7915_mcu_bss_bmc_tlv(skb, phy);
642 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
643 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
644 
645 		if (vif->bss_conf.he_support)
646 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
647 
648 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
649 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
650 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
651 	}
652 out:
653 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
654 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
655 }
656 
657 /** starec & wtbl **/
658 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
659 			 struct ieee80211_ampdu_params *params,
660 			 bool enable)
661 {
662 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
663 	struct mt7915_vif *mvif = msta->vif;
664 
665 	if (enable && !params->amsdu)
666 		msta->wcid.amsdu = false;
667 
668 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
669 				      MCU_EXT_CMD(STA_REC_UPDATE),
670 				      enable, true);
671 }
672 
673 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
674 			 struct ieee80211_ampdu_params *params,
675 			 bool enable)
676 {
677 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
678 	struct mt7915_vif *mvif = msta->vif;
679 
680 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
681 				      MCU_EXT_CMD(STA_REC_UPDATE),
682 				      enable, false);
683 }
684 
685 static void
686 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
687 		      struct ieee80211_vif *vif)
688 {
689 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
690 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
691 	struct ieee80211_he_mcs_nss_supp mcs_map;
692 	struct sta_rec_he *he;
693 	struct tlv *tlv;
694 	u32 cap = 0;
695 
696 	if (!sta->deflink.he_cap.has_he)
697 		return;
698 
699 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
700 
701 	he = (struct sta_rec_he *)tlv;
702 
703 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
704 		cap |= STA_REC_HE_CAP_HTC;
705 
706 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
707 		cap |= STA_REC_HE_CAP_BSR;
708 
709 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
710 		cap |= STA_REC_HE_CAP_OM;
711 
712 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
713 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
714 
715 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
716 		cap |= STA_REC_HE_CAP_BQR;
717 
718 	if (elem->phy_cap_info[0] &
719 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
720 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
721 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
722 
723 	if (mvif->cap.he_ldpc &&
724 	    (elem->phy_cap_info[1] &
725 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
726 		cap |= STA_REC_HE_CAP_LDPC;
727 
728 	if (elem->phy_cap_info[1] &
729 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
730 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
731 
732 	if (elem->phy_cap_info[2] &
733 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
734 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
735 
736 	if (elem->phy_cap_info[2] &
737 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
738 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
739 
740 	if (elem->phy_cap_info[2] &
741 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
742 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
743 
744 	if (elem->phy_cap_info[6] &
745 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
746 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
747 
748 	if (elem->phy_cap_info[6] &
749 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
750 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
751 
752 	if (elem->phy_cap_info[7] &
753 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
754 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
755 
756 	if (elem->phy_cap_info[7] &
757 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
758 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
759 
760 	if (elem->phy_cap_info[7] &
761 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
762 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
763 
764 	if (elem->phy_cap_info[8] &
765 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
766 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
767 
768 	if (elem->phy_cap_info[8] &
769 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
770 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
771 
772 	if (elem->phy_cap_info[9] &
773 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
774 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
775 
776 	if (elem->phy_cap_info[9] &
777 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
778 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
779 
780 	he->he_cap = cpu_to_le32(cap);
781 
782 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
783 	switch (sta->deflink.bandwidth) {
784 	case IEEE80211_STA_RX_BW_160:
785 		if (elem->phy_cap_info[0] &
786 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
787 			mt7915_mcu_set_sta_he_mcs(sta,
788 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
789 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
790 
791 		mt7915_mcu_set_sta_he_mcs(sta,
792 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
793 					  le16_to_cpu(mcs_map.rx_mcs_160));
794 		fallthrough;
795 	default:
796 		mt7915_mcu_set_sta_he_mcs(sta,
797 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
798 					  le16_to_cpu(mcs_map.rx_mcs_80));
799 		break;
800 	}
801 
802 	he->t_frame_dur =
803 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
804 	he->max_ampdu_exp =
805 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
806 
807 	he->bw_set =
808 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
809 	he->device_class =
810 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
811 	he->punc_pream_rx =
812 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
813 
814 	he->dcm_tx_mode =
815 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
816 	he->dcm_tx_max_nss =
817 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
818 	he->dcm_rx_mode =
819 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
820 	he->dcm_rx_max_nss =
821 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
822 	he->dcm_rx_max_nss =
823 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
824 
825 	he->pkt_ext = 2;
826 }
827 
828 static void
829 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
830 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
831 {
832 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
833 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
834 	struct sta_rec_muru *muru;
835 	struct tlv *tlv;
836 
837 	if (vif->type != NL80211_IFTYPE_STATION &&
838 	    vif->type != NL80211_IFTYPE_AP)
839 		return;
840 
841 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
842 
843 	muru = (struct sta_rec_muru *)tlv;
844 
845 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
846 			       mvif->cap.vht_mu_ebfer ||
847 			       mvif->cap.vht_mu_ebfee;
848 	if (!is_mt7915(&dev->mt76))
849 		muru->cfg.mimo_ul_en = true;
850 	muru->cfg.ofdma_dl_en = true;
851 
852 	if (sta->deflink.vht_cap.vht_supported)
853 		muru->mimo_dl.vht_mu_bfee =
854 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
855 
856 	if (!sta->deflink.he_cap.has_he)
857 		return;
858 
859 	muru->mimo_dl.partial_bw_dl_mimo =
860 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
861 
862 	muru->mimo_ul.full_ul_mimo =
863 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
864 	muru->mimo_ul.partial_ul_mimo =
865 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
866 
867 	muru->ofdma_dl.punc_pream_rx =
868 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
869 	muru->ofdma_dl.he_20m_in_40m_2g =
870 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
871 	muru->ofdma_dl.he_20m_in_160m =
872 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
873 	muru->ofdma_dl.he_80m_in_160m =
874 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
875 
876 	muru->ofdma_ul.t_frame_dur =
877 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
878 	muru->ofdma_ul.mu_cascading =
879 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
880 	muru->ofdma_ul.uo_ra =
881 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
882 }
883 
884 static void
885 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
886 {
887 	struct sta_rec_ht *ht;
888 	struct tlv *tlv;
889 
890 	if (!sta->deflink.ht_cap.ht_supported)
891 		return;
892 
893 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
894 
895 	ht = (struct sta_rec_ht *)tlv;
896 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
897 }
898 
899 static void
900 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
901 {
902 	struct sta_rec_vht *vht;
903 	struct tlv *tlv;
904 
905 	if (!sta->deflink.vht_cap.vht_supported)
906 		return;
907 
908 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
909 
910 	vht = (struct sta_rec_vht *)tlv;
911 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
912 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
913 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
914 }
915 
916 static void
917 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
918 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
919 {
920 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
921 	struct sta_rec_amsdu *amsdu;
922 	struct tlv *tlv;
923 
924 	if (vif->type != NL80211_IFTYPE_STATION &&
925 	    vif->type != NL80211_IFTYPE_AP)
926 		return;
927 
928 	if (!sta->deflink.agg.max_amsdu_len)
929 	    return;
930 
931 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
932 	amsdu = (struct sta_rec_amsdu *)tlv;
933 	amsdu->max_amsdu_num = 8;
934 	amsdu->amsdu_en = true;
935 	msta->wcid.amsdu = true;
936 
937 	switch (sta->deflink.agg.max_amsdu_len) {
938 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
939 		if (!is_mt7915(&dev->mt76)) {
940 			amsdu->max_mpdu_size =
941 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
942 			return;
943 		}
944 		fallthrough;
945 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
946 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
947 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
948 		return;
949 	default:
950 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
951 		return;
952 	}
953 }
954 
955 static int
956 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
957 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
958 {
959 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
960 	struct mt7915_sta *msta;
961 	struct wtbl_req_hdr *wtbl_hdr;
962 	struct mt76_wcid *wcid;
963 	struct tlv *tlv;
964 
965 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
966 	wcid = sta ? &msta->wcid : NULL;
967 
968 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
969 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
970 						  WTBL_RESET_AND_SET, tlv,
971 						  &skb);
972 	if (IS_ERR(wtbl_hdr))
973 		return PTR_ERR(wtbl_hdr);
974 
975 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
976 					 wtbl_hdr);
977 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
978 	if (sta)
979 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
980 					    wtbl_hdr, mvif->cap.ht_ldpc,
981 					    mvif->cap.vht_ldpc);
982 
983 	return 0;
984 }
985 
986 static inline bool
987 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
988 			struct ieee80211_sta *sta, bool bfee)
989 {
990 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
991 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
992 
993 	if (vif->type != NL80211_IFTYPE_STATION &&
994 	    vif->type != NL80211_IFTYPE_AP)
995 		return false;
996 
997 	if (!bfee && tx_ant < 2)
998 		return false;
999 
1000 	if (sta->deflink.he_cap.has_he) {
1001 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1002 
1003 		if (bfee)
1004 			return mvif->cap.he_su_ebfee &&
1005 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1006 		else
1007 			return mvif->cap.he_su_ebfer &&
1008 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1009 	}
1010 
1011 	if (sta->deflink.vht_cap.vht_supported) {
1012 		u32 cap = sta->deflink.vht_cap.cap;
1013 
1014 		if (bfee)
1015 			return mvif->cap.vht_su_ebfee &&
1016 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1017 		else
1018 			return mvif->cap.vht_su_ebfer &&
1019 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1020 	}
1021 
1022 	return false;
1023 }
1024 
1025 static void
1026 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1027 {
1028 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1029 	bf->ndp_rate = 0;				/* mcs0 */
1030 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1031 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1032 }
1033 
1034 static void
1035 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1036 		       struct sta_rec_bf *bf)
1037 {
1038 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1039 	u8 n = 0;
1040 
1041 	bf->tx_mode = MT_PHY_TYPE_HT;
1042 
1043 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1044 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1045 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1046 			      mcs->tx_params);
1047 	else if (mcs->rx_mask[3])
1048 		n = 3;
1049 	else if (mcs->rx_mask[2])
1050 		n = 2;
1051 	else if (mcs->rx_mask[1])
1052 		n = 1;
1053 
1054 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1055 	bf->ncol = min_t(u8, bf->nrow, n);
1056 	bf->ibf_ncol = n;
1057 }
1058 
1059 static void
1060 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1061 			struct sta_rec_bf *bf, bool explicit)
1062 {
1063 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1064 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1065 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1066 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1067 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1068 
1069 	bf->tx_mode = MT_PHY_TYPE_VHT;
1070 
1071 	if (explicit) {
1072 		u8 sts, snd_dim;
1073 
1074 		mt7915_mcu_sta_sounding_rate(bf);
1075 
1076 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1077 				pc->cap);
1078 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1079 				    vc->cap);
1080 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1081 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1082 		bf->ibf_ncol = bf->ncol;
1083 
1084 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1085 			bf->nrow = 1;
1086 	} else {
1087 		bf->nrow = tx_ant;
1088 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1089 		bf->ibf_ncol = nss_mcs;
1090 
1091 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1092 			bf->ibf_nrow = 1;
1093 	}
1094 }
1095 
1096 static void
1097 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1098 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1099 {
1100 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1101 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1102 	const struct ieee80211_sta_he_cap *vc =
1103 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1104 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1105 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1106 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1107 	u8 snd_dim, sts;
1108 
1109 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1110 
1111 	mt7915_mcu_sta_sounding_rate(bf);
1112 
1113 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1114 				pe->phy_cap_info[6]);
1115 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1116 				pe->phy_cap_info[6]);
1117 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1118 			 ve->phy_cap_info[5]);
1119 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1120 		     pe->phy_cap_info[4]);
1121 	bf->nrow = min_t(u8, snd_dim, sts);
1122 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1123 	bf->ibf_ncol = bf->ncol;
1124 
1125 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1126 		return;
1127 
1128 	/* go over for 160MHz and 80p80 */
1129 	if (pe->phy_cap_info[0] &
1130 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1131 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1132 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1133 
1134 		bf->ncol_bw160 = nss_mcs;
1135 	}
1136 
1137 	if (pe->phy_cap_info[0] &
1138 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1139 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1140 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1141 
1142 		if (bf->ncol_bw160)
1143 			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1144 		else
1145 			bf->ncol_bw160 = nss_mcs;
1146 	}
1147 
1148 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1149 			 ve->phy_cap_info[5]);
1150 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1151 		     pe->phy_cap_info[4]);
1152 
1153 	bf->nrow_bw160 = min_t(int, snd_dim, sts);
1154 }
1155 
1156 static void
1157 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1158 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1159 {
1160 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1161 	struct mt7915_phy *phy = mvif->phy;
1162 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1163 	struct sta_rec_bf *bf;
1164 	struct tlv *tlv;
1165 	const u8 matrix[4][4] = {
1166 		{0, 0, 0, 0},
1167 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1168 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1169 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1170 	};
1171 	bool ebf;
1172 
1173 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1174 		return;
1175 
1176 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1177 	if (!ebf && !dev->ibf)
1178 		return;
1179 
1180 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1181 	bf = (struct sta_rec_bf *)tlv;
1182 
1183 	/* he: eBF only, in accordance with spec
1184 	 * vht: support eBF and iBF
1185 	 * ht: iBF only, since mac80211 lacks of eBF support
1186 	 */
1187 	if (sta->deflink.he_cap.has_he && ebf)
1188 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1189 	else if (sta->deflink.vht_cap.vht_supported)
1190 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1191 	else if (sta->deflink.ht_cap.ht_supported)
1192 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1193 	else
1194 		return;
1195 
1196 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1197 	bf->bw = sta->deflink.bandwidth;
1198 	bf->ibf_dbw = sta->deflink.bandwidth;
1199 	bf->ibf_nrow = tx_ant;
1200 
1201 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1202 		bf->ibf_timeout = 0x48;
1203 	else
1204 		bf->ibf_timeout = 0x18;
1205 
1206 	if (ebf && bf->nrow != tx_ant)
1207 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1208 	else
1209 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1210 
1211 	switch (sta->deflink.bandwidth) {
1212 	case IEEE80211_STA_RX_BW_160:
1213 	case IEEE80211_STA_RX_BW_80:
1214 		bf->mem_total = bf->mem_20m * 2;
1215 		break;
1216 	case IEEE80211_STA_RX_BW_40:
1217 		bf->mem_total = bf->mem_20m;
1218 		break;
1219 	case IEEE80211_STA_RX_BW_20:
1220 	default:
1221 		break;
1222 	}
1223 }
1224 
1225 static void
1226 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1227 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1228 {
1229 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1230 	struct mt7915_phy *phy = mvif->phy;
1231 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1232 	struct sta_rec_bfee *bfee;
1233 	struct tlv *tlv;
1234 	u8 nrow = 0;
1235 
1236 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1237 		return;
1238 
1239 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1240 		return;
1241 
1242 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1243 	bfee = (struct sta_rec_bfee *)tlv;
1244 
1245 	if (sta->deflink.he_cap.has_he) {
1246 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1247 
1248 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1249 			      pe->phy_cap_info[5]);
1250 	} else if (sta->deflink.vht_cap.vht_supported) {
1251 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1252 
1253 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1254 				 pc->cap);
1255 	}
1256 
1257 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1258 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1259 }
1260 
1261 static enum mcu_mmps_mode
1262 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1263 {
1264 	switch (smps) {
1265 	case IEEE80211_SMPS_OFF:
1266 		return MCU_MMPS_DISABLE;
1267 	case IEEE80211_SMPS_STATIC:
1268 		return MCU_MMPS_STATIC;
1269 	case IEEE80211_SMPS_DYNAMIC:
1270 		return MCU_MMPS_DYNAMIC;
1271 	default:
1272 		return MCU_MMPS_DISABLE;
1273 	}
1274 }
1275 
1276 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1277 				   struct ieee80211_vif *vif,
1278 				   struct ieee80211_sta *sta,
1279 				   void *data, u32 field)
1280 {
1281 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1282 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1283 	struct sta_phy *phy = data;
1284 	struct sta_rec_ra_fixed *ra;
1285 	struct sk_buff *skb;
1286 	struct tlv *tlv;
1287 
1288 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1289 					    &msta->wcid);
1290 	if (IS_ERR(skb))
1291 		return PTR_ERR(skb);
1292 
1293 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1294 	ra = (struct sta_rec_ra_fixed *)tlv;
1295 
1296 	switch (field) {
1297 	case RATE_PARAM_AUTO:
1298 		break;
1299 	case RATE_PARAM_FIXED:
1300 	case RATE_PARAM_FIXED_MCS:
1301 	case RATE_PARAM_FIXED_GI:
1302 	case RATE_PARAM_FIXED_HE_LTF:
1303 		if (phy)
1304 			ra->phy = *phy;
1305 		break;
1306 	case RATE_PARAM_MMPS_UPDATE:
1307 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1308 		break;
1309 	default:
1310 		break;
1311 	}
1312 	ra->field = cpu_to_le32(field);
1313 
1314 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1315 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1316 }
1317 
1318 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1319 			struct ieee80211_sta *sta)
1320 {
1321 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1322 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1323 	struct wtbl_req_hdr *wtbl_hdr;
1324 	struct tlv *sta_wtbl;
1325 	struct sk_buff *skb;
1326 	int ret;
1327 
1328 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1329 					    &msta->wcid);
1330 	if (IS_ERR(skb))
1331 		return PTR_ERR(skb);
1332 
1333 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1334 					   sizeof(struct tlv));
1335 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1336 						  WTBL_SET, sta_wtbl, &skb);
1337 	if (IS_ERR(wtbl_hdr))
1338 		return PTR_ERR(wtbl_hdr);
1339 
1340 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1341 
1342 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1343 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1344 	if (ret)
1345 		return ret;
1346 
1347 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1348 					      RATE_PARAM_MMPS_UPDATE);
1349 }
1350 
1351 static int
1352 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1353 			       struct ieee80211_vif *vif,
1354 			       struct ieee80211_sta *sta)
1355 {
1356 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1357 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1358 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1359 	enum nl80211_band band = chandef->chan->band;
1360 	struct sta_phy phy = {};
1361 	int ret, nrates = 0;
1362 
1363 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1364 	do {									\
1365 		u8 i, gi = mask->control[band]._gi;				\
1366 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1367 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1368 			phy.sgi |= gi << (i << (_he));				\
1369 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1370 		}								\
1371 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1372 			if (!mask->control[band]._mcs[i])			\
1373 				continue;					\
1374 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1375 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1376 			if (_ht)						\
1377 				phy.mcs += 8 * i;				\
1378 		}								\
1379 	} while (0)
1380 
1381 	if (sta->deflink.he_cap.has_he) {
1382 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1383 	} else if (sta->deflink.vht_cap.vht_supported) {
1384 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1385 	} else if (sta->deflink.ht_cap.ht_supported) {
1386 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1387 	} else {
1388 		nrates = hweight32(mask->control[band].legacy);
1389 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1390 	}
1391 #undef __sta_phy_bitrate_mask_check
1392 
1393 	/* fall back to auto rate control */
1394 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1395 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1396 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1397 	    nrates != 1)
1398 		return 0;
1399 
1400 	/* fixed single rate */
1401 	if (nrates == 1) {
1402 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1403 						     RATE_PARAM_FIXED_MCS);
1404 		if (ret)
1405 			return ret;
1406 	}
1407 
1408 	/* fixed GI */
1409 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1410 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1411 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1412 		u32 addr;
1413 
1414 		/* firmware updates only TXCMD but doesn't take WTBL into
1415 		 * account, so driver should update here to reflect the
1416 		 * actual txrate hardware sends out.
1417 		 */
1418 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1419 		if (sta->deflink.he_cap.has_he)
1420 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1421 		else
1422 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1423 
1424 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1425 						     RATE_PARAM_FIXED_GI);
1426 		if (ret)
1427 			return ret;
1428 	}
1429 
1430 	/* fixed HE_LTF */
1431 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1432 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1433 						     RATE_PARAM_FIXED_HE_LTF);
1434 		if (ret)
1435 			return ret;
1436 	}
1437 
1438 	return 0;
1439 }
1440 
1441 static void
1442 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1443 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1444 {
1445 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1446 	struct mt76_phy *mphy = mvif->phy->mt76;
1447 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1448 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1449 	enum nl80211_band band = chandef->chan->band;
1450 	struct sta_rec_ra *ra;
1451 	struct tlv *tlv;
1452 	u32 supp_rate = sta->deflink.supp_rates[band];
1453 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1454 
1455 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1456 	ra = (struct sta_rec_ra *)tlv;
1457 
1458 	ra->valid = true;
1459 	ra->auto_rate = true;
1460 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1461 	ra->channel = chandef->chan->hw_value;
1462 	ra->bw = sta->deflink.bandwidth;
1463 	ra->phy.bw = sta->deflink.bandwidth;
1464 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1465 
1466 	if (supp_rate) {
1467 		supp_rate &= mask->control[band].legacy;
1468 		ra->rate_len = hweight32(supp_rate);
1469 
1470 		if (band == NL80211_BAND_2GHZ) {
1471 			ra->supp_mode = MODE_CCK;
1472 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1473 
1474 			if (ra->rate_len > 4) {
1475 				ra->supp_mode |= MODE_OFDM;
1476 				ra->supp_ofdm_rate = supp_rate >> 4;
1477 			}
1478 		} else {
1479 			ra->supp_mode = MODE_OFDM;
1480 			ra->supp_ofdm_rate = supp_rate;
1481 		}
1482 	}
1483 
1484 	if (sta->deflink.ht_cap.ht_supported) {
1485 		ra->supp_mode |= MODE_HT;
1486 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1487 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1488 
1489 		cap |= STA_CAP_HT;
1490 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1491 			cap |= STA_CAP_SGI_20;
1492 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1493 			cap |= STA_CAP_SGI_40;
1494 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1495 			cap |= STA_CAP_TX_STBC;
1496 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1497 			cap |= STA_CAP_RX_STBC;
1498 		if (mvif->cap.ht_ldpc &&
1499 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1500 			cap |= STA_CAP_LDPC;
1501 
1502 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1503 					  mask->control[band].ht_mcs);
1504 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1505 	}
1506 
1507 	if (sta->deflink.vht_cap.vht_supported) {
1508 		u8 af;
1509 
1510 		ra->supp_mode |= MODE_VHT;
1511 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1512 			       sta->deflink.vht_cap.cap);
1513 		ra->af = max_t(u8, ra->af, af);
1514 
1515 		cap |= STA_CAP_VHT;
1516 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1517 			cap |= STA_CAP_VHT_SGI_80;
1518 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1519 			cap |= STA_CAP_VHT_SGI_160;
1520 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1521 			cap |= STA_CAP_VHT_TX_STBC;
1522 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1523 			cap |= STA_CAP_VHT_RX_STBC;
1524 		if (mvif->cap.vht_ldpc &&
1525 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1526 			cap |= STA_CAP_VHT_LDPC;
1527 
1528 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1529 					   mask->control[band].vht_mcs);
1530 	}
1531 
1532 	if (sta->deflink.he_cap.has_he) {
1533 		ra->supp_mode |= MODE_HE;
1534 		cap |= STA_CAP_HE;
1535 
1536 		if (sta->deflink.he_6ghz_capa.capa)
1537 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1538 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1539 	}
1540 
1541 	ra->sta_cap = cpu_to_le32(cap);
1542 }
1543 
1544 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1545 			     struct ieee80211_sta *sta, bool changed)
1546 {
1547 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1548 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1549 	struct sk_buff *skb;
1550 	int ret;
1551 
1552 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1553 					    &msta->wcid);
1554 	if (IS_ERR(skb))
1555 		return PTR_ERR(skb);
1556 
1557 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1558 	 * once dev->rc_work changes the settings driver should also
1559 	 * update sta_rec_he here.
1560 	 */
1561 	if (changed)
1562 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1563 
1564 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1565 	 * i.e 0-{7,8,9} for VHT.
1566 	 */
1567 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1568 
1569 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1570 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1571 	if (ret)
1572 		return ret;
1573 
1574 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1575 	 * and updates as peer fixed rate parameters, which overrides
1576 	 * sta_rec_ra and firmware rate control algorithm.
1577 	 */
1578 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1579 }
1580 
1581 static int
1582 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1583 		     struct ieee80211_sta *sta)
1584 {
1585 #define MT_STA_BSS_GROUP		1
1586 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1587 	struct mt7915_sta *msta;
1588 	struct {
1589 		__le32 action;
1590 		u8 wlan_idx_lo;
1591 		u8 status;
1592 		u8 wlan_idx_hi;
1593 		u8 rsv0[5];
1594 		__le32 val;
1595 		u8 rsv1[8];
1596 	} __packed req = {
1597 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1598 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1599 	};
1600 
1601 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1602 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1603 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1604 
1605 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1606 				 sizeof(req), true);
1607 }
1608 
1609 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1610 		       struct ieee80211_sta *sta, bool enable)
1611 {
1612 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1613 	struct mt7915_sta *msta;
1614 	struct sk_buff *skb;
1615 	int ret;
1616 
1617 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1618 
1619 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1620 					    &msta->wcid);
1621 	if (IS_ERR(skb))
1622 		return PTR_ERR(skb);
1623 
1624 	/* starec basic */
1625 	mt76_connac_mcu_sta_basic_tlv(skb, vif, sta, enable,
1626 			!rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1627 	if (!enable)
1628 		goto out;
1629 
1630 	/* tag order is in accordance with firmware dependency. */
1631 	if (sta) {
1632 		/* starec bfer */
1633 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1634 		/* starec ht */
1635 		mt7915_mcu_sta_ht_tlv(skb, sta);
1636 		/* starec vht */
1637 		mt7915_mcu_sta_vht_tlv(skb, sta);
1638 		/* starec uapsd */
1639 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1640 	}
1641 
1642 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1643 	if (ret) {
1644 		dev_kfree_skb(skb);
1645 		return ret;
1646 	}
1647 
1648 	if (sta) {
1649 		/* starec amsdu */
1650 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1651 		/* starec he */
1652 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1653 		/* starec muru */
1654 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1655 		/* starec bfee */
1656 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1657 	}
1658 
1659 	ret = mt7915_mcu_add_group(dev, vif, sta);
1660 	if (ret) {
1661 		dev_kfree_skb(skb);
1662 		return ret;
1663 	}
1664 out:
1665 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1666 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1667 }
1668 
1669 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1670 			    struct ieee80211_vif *vif, bool enable)
1671 {
1672 	struct mt7915_dev *dev = phy->dev;
1673 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1674 	struct {
1675 		struct req_hdr {
1676 			u8 omac_idx;
1677 			u8 dbdc_idx;
1678 			__le16 tlv_num;
1679 			u8 is_tlv_append;
1680 			u8 rsv[3];
1681 		} __packed hdr;
1682 		struct req_tlv {
1683 			__le16 tag;
1684 			__le16 len;
1685 			u8 active;
1686 			u8 dbdc_idx;
1687 			u8 omac_addr[ETH_ALEN];
1688 		} __packed tlv;
1689 	} data = {
1690 		.hdr = {
1691 			.omac_idx = mvif->mt76.omac_idx,
1692 			.dbdc_idx = mvif->mt76.band_idx,
1693 			.tlv_num = cpu_to_le16(1),
1694 			.is_tlv_append = 1,
1695 		},
1696 		.tlv = {
1697 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1698 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1699 			.active = enable,
1700 			.dbdc_idx = mvif->mt76.band_idx,
1701 		},
1702 	};
1703 
1704 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1705 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1706 
1707 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1708 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1709 				 &data, sizeof(data), true);
1710 }
1711 
1712 static void
1713 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1714 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1715 			 struct ieee80211_mutable_offsets *offs)
1716 {
1717 	struct bss_info_bcn_cntdwn *info;
1718 	struct tlv *tlv;
1719 	int sub_tag;
1720 
1721 	if (!offs->cntdwn_counter_offs[0])
1722 		return;
1723 
1724 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1725 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1726 					   &bcn->sub_ntlv, &bcn->len);
1727 	info = (struct bss_info_bcn_cntdwn *)tlv;
1728 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1729 }
1730 
1731 static void
1732 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1733 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1734 		       struct ieee80211_mutable_offsets *offs)
1735 {
1736 	struct bss_info_bcn_mbss *mbss;
1737 	const struct element *elem;
1738 	struct tlv *tlv;
1739 
1740 	if (!vif->bss_conf.bssid_indicator)
1741 		return;
1742 
1743 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1744 					   sizeof(*mbss), &bcn->sub_ntlv,
1745 					   &bcn->len);
1746 
1747 	mbss = (struct bss_info_bcn_mbss *)tlv;
1748 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1749 	mbss->bitmap = cpu_to_le32(1);
1750 
1751 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1752 			    &skb->data[offs->mbssid_off],
1753 			    skb->len - offs->mbssid_off) {
1754 		const struct element *sub_elem;
1755 
1756 		if (elem->datalen < 2)
1757 			continue;
1758 
1759 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1760 			const struct ieee80211_bssid_index *idx;
1761 			const u8 *idx_ie;
1762 
1763 			if (sub_elem->id || sub_elem->datalen < 4)
1764 				continue; /* not a valid BSS profile */
1765 
1766 			/* Find WLAN_EID_MULTI_BSSID_IDX
1767 			 * in the merged nontransmitted profile
1768 			 */
1769 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1770 						  sub_elem->data,
1771 						  sub_elem->datalen);
1772 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1773 				continue;
1774 
1775 			idx = (void *)(idx_ie + 2);
1776 			if (!idx->bssid_index || idx->bssid_index > 31)
1777 				continue;
1778 
1779 			mbss->offset[idx->bssid_index] =
1780 				cpu_to_le16(idx_ie - skb->data);
1781 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1782 		}
1783 	}
1784 }
1785 
1786 static void
1787 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1788 		       struct sk_buff *rskb, struct sk_buff *skb,
1789 		       struct bss_info_bcn *bcn,
1790 		       struct ieee80211_mutable_offsets *offs)
1791 {
1792 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1793 	struct bss_info_bcn_cont *cont;
1794 	struct tlv *tlv;
1795 	u8 *buf;
1796 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1797 
1798 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1799 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1800 					   len, &bcn->sub_ntlv, &bcn->len);
1801 
1802 	cont = (struct bss_info_bcn_cont *)tlv;
1803 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1804 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1805 
1806 	if (offs->cntdwn_counter_offs[0]) {
1807 		u16 offset = offs->cntdwn_counter_offs[0];
1808 
1809 		if (vif->bss_conf.csa_active)
1810 			cont->csa_ofs = cpu_to_le16(offset - 4);
1811 		if (vif->bss_conf.color_change_active)
1812 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1813 	}
1814 
1815 	buf = (u8 *)tlv + sizeof(*cont);
1816 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1817 			      0, BSS_CHANGED_BEACON);
1818 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1819 }
1820 
1821 static void
1822 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1823 			     struct sk_buff *skb)
1824 {
1825 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1826 	struct mt7915_vif_cap *vc = &mvif->cap;
1827 	const struct ieee80211_he_cap_elem *he;
1828 	const struct ieee80211_vht_cap *vht;
1829 	const struct ieee80211_ht_cap *ht;
1830 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1831 	const u8 *ie;
1832 	u32 len, bc;
1833 
1834 	/* Check missing configuration options to allow AP mode in mac80211
1835 	 * to remain in sync with hostapd settings, and get a subset of
1836 	 * beacon and hardware capabilities.
1837 	 */
1838 	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
1839 		return;
1840 
1841 	memset(vc, 0, sizeof(*vc));
1842 
1843 	len = skb->len - (mgmt->u.beacon.variable - skb->data);
1844 
1845 	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
1846 			      len);
1847 	if (ie && ie[1] >= sizeof(*ht)) {
1848 		ht = (void *)(ie + 2);
1849 		vc->ht_ldpc = !!(le16_to_cpu(ht->cap_info) &
1850 				 IEEE80211_HT_CAP_LDPC_CODING);
1851 	}
1852 
1853 	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
1854 			      len);
1855 	if (ie && ie[1] >= sizeof(*vht)) {
1856 		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
1857 
1858 		vht = (void *)(ie + 2);
1859 		bc = le32_to_cpu(vht->vht_cap_info);
1860 
1861 		vc->vht_ldpc = !!(bc & IEEE80211_VHT_CAP_RXLDPC);
1862 		vc->vht_su_ebfer =
1863 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
1864 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1865 		vc->vht_su_ebfee =
1866 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
1867 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1868 		vc->vht_mu_ebfer =
1869 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
1870 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
1871 		vc->vht_mu_ebfee =
1872 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
1873 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1874 	}
1875 
1876 	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
1877 				  mgmt->u.beacon.variable, len);
1878 	if (ie && ie[1] >= sizeof(*he) + 1) {
1879 		const struct ieee80211_sta_he_cap *pc =
1880 			mt76_connac_get_he_phy_cap(phy->mt76, vif);
1881 		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1882 
1883 		he = (void *)(ie + 3);
1884 
1885 		vc->he_ldpc =
1886 			HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
1887 		vc->he_su_ebfer =
1888 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
1889 			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1890 		vc->he_su_ebfee =
1891 			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
1892 			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1893 		vc->he_mu_ebfer =
1894 			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
1895 			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
1896 	}
1897 }
1898 
1899 static void
1900 mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1901 				struct sk_buff *rskb, struct bss_info_bcn *bcn,
1902 				u32 changed)
1903 {
1904 #define OFFLOAD_TX_MODE_SU	BIT(0)
1905 #define OFFLOAD_TX_MODE_MU	BIT(1)
1906 	struct ieee80211_hw *hw = mt76_hw(dev);
1907 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1908 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1909 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1910 	enum nl80211_band band = chandef->chan->band;
1911 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1912 	struct bss_info_inband_discovery *discov;
1913 	struct ieee80211_tx_info *info;
1914 	struct sk_buff *skb = NULL;
1915 	struct tlv *tlv;
1916 	bool ext_phy = phy != &dev->phy;
1917 	u8 *buf, interval;
1918 	int len;
1919 
1920 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
1921 	    vif->bss_conf.fils_discovery.max_interval) {
1922 		interval = vif->bss_conf.fils_discovery.max_interval;
1923 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1924 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1925 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1926 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1927 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1928 	}
1929 
1930 	if (!skb)
1931 		return;
1932 
1933 	info = IEEE80211_SKB_CB(skb);
1934 	info->control.vif = vif;
1935 	info->band = band;
1936 
1937 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1938 
1939 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1940 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1941 
1942 	if (len > (MT7915_MAX_BSS_OFFLOAD_SIZE - rskb->len)) {
1943 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1944 		dev_kfree_skb(skb);
1945 		return;
1946 	}
1947 
1948 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1949 					   len, &bcn->sub_ntlv, &bcn->len);
1950 	discov = (struct bss_info_inband_discovery *)tlv;
1951 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1952 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1953 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1954 	discov->tx_interval = interval;
1955 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1956 	discov->enable = true;
1957 
1958 	buf = (u8 *)tlv + sizeof(*discov);
1959 
1960 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1961 			      0, changed);
1962 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1963 
1964 	dev_kfree_skb(skb);
1965 }
1966 
1967 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1968 			  int en, u32 changed)
1969 {
1970 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1971 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1972 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1973 	struct ieee80211_mutable_offsets offs;
1974 	struct ieee80211_tx_info *info;
1975 	struct sk_buff *skb, *rskb;
1976 	struct tlv *tlv;
1977 	struct bss_info_bcn *bcn;
1978 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
1979 	bool ext_phy = phy != &dev->phy;
1980 
1981 	if (vif->bss_conf.nontransmitted)
1982 		return 0;
1983 
1984 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1985 					       NULL, len);
1986 	if (IS_ERR(rskb))
1987 		return PTR_ERR(rskb);
1988 
1989 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1990 	bcn = (struct bss_info_bcn *)tlv;
1991 	bcn->enable = en;
1992 
1993 	if (!en)
1994 		goto out;
1995 
1996 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
1997 	if (!skb)
1998 		return -EINVAL;
1999 
2000 	if (skb->len > MT7915_MAX_BEACON_SIZE - MT_TXD_SIZE) {
2001 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2002 		dev_kfree_skb(skb);
2003 		return -EINVAL;
2004 	}
2005 
2006 	info = IEEE80211_SKB_CB(skb);
2007 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
2008 
2009 	mt7915_mcu_beacon_check_caps(phy, vif, skb);
2010 
2011 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2012 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2013 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2014 	dev_kfree_skb(skb);
2015 
2016 	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
2017 	    changed & BSS_CHANGED_FILS_DISCOVERY)
2018 		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
2019 						bcn, changed);
2020 
2021 out:
2022 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2023 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2024 }
2025 
2026 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2027 {
2028 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2029 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2030 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2031 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2032 		return -EIO;
2033 	}
2034 
2035 	/* clear irq when the driver own success */
2036 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2037 		MT_TOP_LPCR_HOST_BAND_STAT);
2038 
2039 	return 0;
2040 }
2041 
2042 static int
2043 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2044 {
2045 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2046 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2047 
2048 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2049 			    state, 1000)) {
2050 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2051 		return -EIO;
2052 	}
2053 	return 0;
2054 }
2055 
2056 static int mt7915_load_firmware(struct mt7915_dev *dev)
2057 {
2058 	int ret;
2059 
2060 	/* make sure fw is download state */
2061 	if (mt7915_firmware_state(dev, false)) {
2062 		/* restart firmware once */
2063 		__mt76_mcu_restart(&dev->mt76);
2064 		ret = mt7915_firmware_state(dev, false);
2065 		if (ret) {
2066 			dev_err(dev->mt76.dev,
2067 				"Firmware is not ready for download\n");
2068 			return ret;
2069 		}
2070 	}
2071 
2072 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2073 	if (ret)
2074 		return ret;
2075 
2076 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2077 				    fw_name(dev, FIRMWARE_WA));
2078 	if (ret)
2079 		return ret;
2080 
2081 	ret = mt7915_firmware_state(dev, true);
2082 	if (ret)
2083 		return ret;
2084 
2085 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2086 
2087 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2088 
2089 	return 0;
2090 }
2091 
2092 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2093 {
2094 	struct {
2095 		u8 ctrl_val;
2096 		u8 pad[3];
2097 	} data = {
2098 		.ctrl_val = ctrl
2099 	};
2100 
2101 	if (type == MCU_FW_LOG_WA)
2102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2103 					 &data, sizeof(data), true);
2104 
2105 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2106 				 sizeof(data), true);
2107 }
2108 
2109 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2110 {
2111 	struct {
2112 		u8 ver;
2113 		u8 pad;
2114 		__le16 len;
2115 		u8 level;
2116 		u8 rsv[3];
2117 		__le32 module_idx;
2118 	} data = {
2119 		.module_idx = cpu_to_le32(module),
2120 		.level = level,
2121 	};
2122 
2123 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2124 				 sizeof(data), false);
2125 }
2126 
2127 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2128 {
2129 	struct {
2130 		__le32 cmd;
2131 		u8 enable;
2132 	} data = {
2133 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2134 		.enable = enabled,
2135 	};
2136 
2137 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2138 				sizeof(data), false);
2139 }
2140 
2141 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2142 {
2143 	struct mt7915_dev *dev = phy->dev;
2144 	struct sk_buff *skb;
2145 	struct mt7915_mcu_muru_stats *mu_stats =
2146 				(struct mt7915_mcu_muru_stats *)ms;
2147 	int ret;
2148 
2149 	struct {
2150 		__le32 cmd;
2151 		u8 band_idx;
2152 	} req = {
2153 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2154 		.band_idx = phy->band_idx,
2155 	};
2156 
2157 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2158 					&req, sizeof(req), true, &skb);
2159 	if (ret)
2160 		return ret;
2161 
2162 	memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2163 	dev_kfree_skb(skb);
2164 
2165 	return 0;
2166 }
2167 
2168 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2169 {
2170 	struct {
2171 		u8 enable;
2172 		u8 _rsv[3];
2173 	} __packed req = {
2174 		.enable = enabled
2175 	};
2176 
2177 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2178 				 sizeof(req), false);
2179 }
2180 
2181 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2182 {
2183 	struct {
2184 		__le32 cmd;
2185 		u8 val[4];
2186 	} __packed req = {
2187 		.cmd = cpu_to_le32(cmd),
2188 	};
2189 
2190 	put_unaligned_le32(val, req.val);
2191 
2192 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2193 				 sizeof(req), false);
2194 }
2195 
2196 static int
2197 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2198 {
2199 #define RX_AIRTIME_FEATURE_CTRL		1
2200 #define RX_AIRTIME_BITWISE_CTRL		2
2201 #define RX_AIRTIME_CLEAR_EN	1
2202 	struct {
2203 		__le16 field;
2204 		__le16 sub_field;
2205 		__le32 set_status;
2206 		__le32 get_status;
2207 		u8 _rsv[12];
2208 
2209 		bool airtime_en;
2210 		bool mibtime_en;
2211 		bool earlyend_en;
2212 		u8 _rsv1[9];
2213 
2214 		bool airtime_clear;
2215 		bool mibtime_clear;
2216 		u8 _rsv2[98];
2217 	} __packed req = {
2218 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2219 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2220 		.airtime_clear = true,
2221 	};
2222 	int ret;
2223 
2224 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2225 				sizeof(req), true);
2226 	if (ret)
2227 		return ret;
2228 
2229 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2230 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2231 	req.airtime_en = true;
2232 
2233 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2234 				 sizeof(req), true);
2235 }
2236 
2237 int mt7915_mcu_init(struct mt7915_dev *dev)
2238 {
2239 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2240 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2241 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2242 		.mcu_parse_response = mt7915_mcu_parse_response,
2243 		.mcu_restart = mt76_connac_mcu_restart,
2244 	};
2245 	int ret;
2246 
2247 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2248 
2249 	/* force firmware operation mode into normal state,
2250 	 * which should be set before firmware download stage.
2251 	 */
2252 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2253 
2254 	ret = mt7915_driver_own(dev, 0);
2255 	if (ret)
2256 		return ret;
2257 	/* set driver own for band1 when two hif exist */
2258 	if (dev->hif2) {
2259 		ret = mt7915_driver_own(dev, 1);
2260 		if (ret)
2261 			return ret;
2262 	}
2263 
2264 	ret = mt7915_load_firmware(dev);
2265 	if (ret)
2266 		return ret;
2267 
2268 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2269 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2270 	if (ret)
2271 		return ret;
2272 
2273 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2274 	if (ret)
2275 		return ret;
2276 
2277 	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
2278 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2279 
2280 	ret = mt7915_mcu_set_mwds(dev, 1);
2281 	if (ret)
2282 		return ret;
2283 
2284 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2285 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2286 	if (ret)
2287 		return ret;
2288 
2289 	ret = mt7915_mcu_init_rx_airtime(dev);
2290 	if (ret)
2291 		return ret;
2292 
2293 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2294 				 MCU_WA_PARAM_RED, 0, 0);
2295 }
2296 
2297 void mt7915_mcu_exit(struct mt7915_dev *dev)
2298 {
2299 	__mt76_mcu_restart(&dev->mt76);
2300 	if (mt7915_firmware_state(dev, false)) {
2301 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2302 		return;
2303 	}
2304 
2305 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2306 	if (dev->hif2)
2307 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2308 			MT_TOP_LPCR_HOST_FW_OWN);
2309 	skb_queue_purge(&dev->mt76.mcu.res_q);
2310 }
2311 
2312 static int
2313 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2314 {
2315 	struct {
2316 		u8 operation;
2317 		u8 count;
2318 		u8 _rsv[2];
2319 		u8 index;
2320 		u8 enable;
2321 		__le16 etype;
2322 	} req = {
2323 		.operation = 1,
2324 		.count = 1,
2325 		.enable = 1,
2326 		.etype = cpu_to_le16(ETH_P_PAE),
2327 	};
2328 
2329 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2330 				 &req, sizeof(req), false);
2331 }
2332 
2333 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2334 		       bool enable, bool hdr_trans)
2335 {
2336 	struct {
2337 		u8 operation;
2338 		u8 enable;
2339 		u8 check_bssid;
2340 		u8 insert_vlan;
2341 		u8 remove_vlan;
2342 		u8 tid;
2343 		u8 mode;
2344 		u8 rsv;
2345 	} __packed req_trans = {
2346 		.enable = hdr_trans,
2347 	};
2348 	struct {
2349 		u8 enable;
2350 		u8 band;
2351 		u8 rsv[2];
2352 	} __packed req_mac = {
2353 		.enable = enable,
2354 		.band = band,
2355 	};
2356 	int ret;
2357 
2358 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2359 				&req_trans, sizeof(req_trans), false);
2360 	if (ret)
2361 		return ret;
2362 
2363 	if (hdr_trans)
2364 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2365 
2366 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2367 				 &req_mac, sizeof(req_mac), true);
2368 }
2369 
2370 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2371 {
2372 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2373 	u8 num = req->total;
2374 	size_t len = sizeof(*req) -
2375 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2376 
2377 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2378 				 len, true);
2379 }
2380 
2381 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2382 {
2383 #define TX_CMD_MODE		1
2384 	struct mt7915_mcu_tx req = {
2385 		.valid = true,
2386 		.mode = TX_CMD_MODE,
2387 		.total = IEEE80211_NUM_ACS,
2388 	};
2389 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2390 	int ac;
2391 
2392 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2393 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2394 		struct edca *e = &req.edca[ac];
2395 
2396 		e->set = WMM_PARAM_SET;
2397 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2398 		e->aifs = q->aifs;
2399 		e->txop = cpu_to_le16(q->txop);
2400 
2401 		if (q->cw_min)
2402 			e->cw_min = fls(q->cw_min);
2403 		else
2404 			e->cw_min = 5;
2405 
2406 		if (q->cw_max)
2407 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2408 		else
2409 			e->cw_max = cpu_to_le16(10);
2410 	}
2411 
2412 	return mt7915_mcu_update_edca(dev, &req);
2413 }
2414 
2415 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2416 {
2417 	struct {
2418 		__le32 tag;
2419 		__le16 min_lpn;
2420 		u8 rsv[2];
2421 	} __packed req = {
2422 		.tag = cpu_to_le32(0x1),
2423 		.min_lpn = cpu_to_le16(val),
2424 	};
2425 
2426 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2427 				 sizeof(req), true);
2428 }
2429 
2430 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2431 			    const struct mt7915_dfs_pulse *pulse)
2432 {
2433 	struct {
2434 		__le32 tag;
2435 
2436 		__le32 max_width;		/* us */
2437 		__le32 max_pwr;			/* dbm */
2438 		__le32 min_pwr;			/* dbm */
2439 		__le32 min_stgr_pri;		/* us */
2440 		__le32 max_stgr_pri;		/* us */
2441 		__le32 min_cr_pri;		/* us */
2442 		__le32 max_cr_pri;		/* us */
2443 	} __packed req = {
2444 		.tag = cpu_to_le32(0x3),
2445 
2446 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2447 		__req_field(max_width),
2448 		__req_field(max_pwr),
2449 		__req_field(min_pwr),
2450 		__req_field(min_stgr_pri),
2451 		__req_field(max_stgr_pri),
2452 		__req_field(min_cr_pri),
2453 		__req_field(max_cr_pri),
2454 #undef __req_field
2455 	};
2456 
2457 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2458 				 sizeof(req), true);
2459 }
2460 
2461 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2462 			    const struct mt7915_dfs_pattern *pattern)
2463 {
2464 	struct {
2465 		__le32 tag;
2466 		__le16 radar_type;
2467 
2468 		u8 enb;
2469 		u8 stgr;
2470 		u8 min_crpn;
2471 		u8 max_crpn;
2472 		u8 min_crpr;
2473 		u8 min_pw;
2474 		__le32 min_pri;
2475 		__le32 max_pri;
2476 		u8 max_pw;
2477 		u8 min_crbn;
2478 		u8 max_crbn;
2479 		u8 min_stgpn;
2480 		u8 max_stgpn;
2481 		u8 min_stgpr;
2482 		u8 rsv[2];
2483 		__le32 min_stgpr_diff;
2484 	} __packed req = {
2485 		.tag = cpu_to_le32(0x2),
2486 		.radar_type = cpu_to_le16(index),
2487 
2488 #define __req_field_u8(field) .field = pattern->field
2489 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2490 		__req_field_u8(enb),
2491 		__req_field_u8(stgr),
2492 		__req_field_u8(min_crpn),
2493 		__req_field_u8(max_crpn),
2494 		__req_field_u8(min_crpr),
2495 		__req_field_u8(min_pw),
2496 		__req_field_u32(min_pri),
2497 		__req_field_u32(max_pri),
2498 		__req_field_u8(max_pw),
2499 		__req_field_u8(min_crbn),
2500 		__req_field_u8(max_crbn),
2501 		__req_field_u8(min_stgpn),
2502 		__req_field_u8(max_stgpn),
2503 		__req_field_u8(min_stgpr),
2504 		__req_field_u32(min_stgpr_diff),
2505 #undef __req_field_u8
2506 #undef __req_field_u32
2507 	};
2508 
2509 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2510 				 sizeof(req), true);
2511 }
2512 
2513 static int
2514 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2515 				 struct cfg80211_chan_def *chandef,
2516 				 int cmd)
2517 {
2518 	struct mt7915_dev *dev = phy->dev;
2519 	struct mt76_phy *mphy = phy->mt76;
2520 	struct ieee80211_channel *chan = mphy->chandef.chan;
2521 	int freq = mphy->chandef.center_freq1;
2522 	struct mt7915_mcu_background_chain_ctrl req = {
2523 		.monitor_scan_type = 2, /* simple rx */
2524 	};
2525 
2526 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2527 		return -EINVAL;
2528 
2529 	if (!cfg80211_chandef_valid(&mphy->chandef))
2530 		return -EINVAL;
2531 
2532 	switch (cmd) {
2533 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2534 		req.chan = chan->hw_value;
2535 		req.central_chan = ieee80211_frequency_to_channel(freq);
2536 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2537 		req.monitor_chan = chandef->chan->hw_value;
2538 		req.monitor_central_chan =
2539 			ieee80211_frequency_to_channel(chandef->center_freq1);
2540 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2541 		req.band_idx = phy != &dev->phy;
2542 		req.scan_mode = 1;
2543 		break;
2544 	}
2545 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2546 		req.monitor_chan = chandef->chan->hw_value;
2547 		req.monitor_central_chan =
2548 			ieee80211_frequency_to_channel(chandef->center_freq1);
2549 		req.band_idx = phy != &dev->phy;
2550 		req.scan_mode = 2;
2551 		break;
2552 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2553 		req.chan = chan->hw_value;
2554 		req.central_chan = ieee80211_frequency_to_channel(freq);
2555 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2556 		req.tx_stream = hweight8(mphy->antenna_mask);
2557 		req.rx_stream = mphy->antenna_mask;
2558 		break;
2559 	default:
2560 		return -EINVAL;
2561 	}
2562 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2563 
2564 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2565 				 &req, sizeof(req), false);
2566 }
2567 
2568 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2569 				     struct cfg80211_chan_def *chandef)
2570 {
2571 	struct mt7915_dev *dev = phy->dev;
2572 	int err, region;
2573 
2574 	if (!chandef) { /* disable offchain */
2575 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2576 					      0, 0);
2577 		if (err)
2578 			return err;
2579 
2580 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2581 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2582 	}
2583 
2584 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2585 					       CH_SWITCH_BACKGROUND_SCAN_START);
2586 	if (err)
2587 		return err;
2588 
2589 	switch (dev->mt76.region) {
2590 	case NL80211_DFS_ETSI:
2591 		region = 0;
2592 		break;
2593 	case NL80211_DFS_JP:
2594 		region = 2;
2595 		break;
2596 	case NL80211_DFS_FCC:
2597 	default:
2598 		region = 1;
2599 		break;
2600 	}
2601 
2602 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2603 				       0, region);
2604 }
2605 
2606 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2607 {
2608 	static const u8 ch_band[] = {
2609 		[NL80211_BAND_2GHZ] = 0,
2610 		[NL80211_BAND_5GHZ] = 1,
2611 		[NL80211_BAND_6GHZ] = 2,
2612 	};
2613 	struct mt7915_dev *dev = phy->dev;
2614 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2615 	int freq1 = chandef->center_freq1;
2616 	struct {
2617 		u8 control_ch;
2618 		u8 center_ch;
2619 		u8 bw;
2620 		u8 tx_streams_num;
2621 		u8 rx_streams;	/* mask or num */
2622 		u8 switch_reason;
2623 		u8 band_idx;
2624 		u8 center_ch2;	/* for 80+80 only */
2625 		__le16 cac_case;
2626 		u8 channel_band;
2627 		u8 rsv0;
2628 		__le32 outband_freq;
2629 		u8 txpower_drop;
2630 		u8 ap_bw;
2631 		u8 ap_center_ch;
2632 		u8 rsv1[57];
2633 	} __packed req = {
2634 		.control_ch = chandef->chan->hw_value,
2635 		.center_ch = ieee80211_frequency_to_channel(freq1),
2636 		.bw = mt76_connac_chan_bw(chandef),
2637 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
2638 		.rx_streams = phy->mt76->antenna_mask,
2639 		.band_idx = phy->band_idx,
2640 		.channel_band = ch_band[chandef->chan->band],
2641 	};
2642 
2643 #ifdef CONFIG_NL80211_TESTMODE
2644 	if (phy->mt76->test.tx_antenna_mask &&
2645 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
2646 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
2647 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
2648 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
2649 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
2650 
2651 		if (phy != &dev->phy)
2652 			req.rx_streams >>= dev->chainshift;
2653 	}
2654 #endif
2655 
2656 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2657 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2658 		req.switch_reason = CH_SWITCH_NORMAL;
2659 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2660 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2661 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2662 					  NL80211_IFTYPE_AP))
2663 		req.switch_reason = CH_SWITCH_DFS;
2664 	else
2665 		req.switch_reason = CH_SWITCH_NORMAL;
2666 
2667 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2668 		req.rx_streams = hweight8(req.rx_streams);
2669 
2670 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2671 		int freq2 = chandef->center_freq2;
2672 
2673 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2674 	}
2675 
2676 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2677 }
2678 
2679 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2680 {
2681 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2682 #define PAGE_IDX_MASK		GENMASK(4, 2)
2683 #define PER_PAGE_SIZE		0x400
2684 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2685 	u16 eeprom_size = mt7915_eeprom_size(dev);
2686 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2687 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2688 	int eep_len;
2689 	int i;
2690 
2691 	for (i = 0; i < total; i++, eep += eep_len) {
2692 		struct sk_buff *skb;
2693 		int ret;
2694 
2695 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2696 			eep_len = eeprom_size % PER_PAGE_SIZE;
2697 		else
2698 			eep_len = PER_PAGE_SIZE;
2699 
2700 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2701 					 sizeof(req) + eep_len);
2702 		if (!skb)
2703 			return -ENOMEM;
2704 
2705 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2706 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2707 		req.len = cpu_to_le16(eep_len);
2708 
2709 		skb_put_data(skb, &req, sizeof(req));
2710 		skb_put_data(skb, eep, eep_len);
2711 
2712 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2713 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2714 		if (ret)
2715 			return ret;
2716 	}
2717 
2718 	return 0;
2719 }
2720 
2721 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2722 {
2723 	struct mt7915_mcu_eeprom req = {
2724 		.buffer_mode = EE_MODE_EFUSE,
2725 		.format = EE_FORMAT_WHOLE,
2726 	};
2727 
2728 	if (dev->flash_mode)
2729 		return mt7915_mcu_set_eeprom_flash(dev);
2730 
2731 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2732 				 &req, sizeof(req), true);
2733 }
2734 
2735 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2736 {
2737 	struct mt7915_mcu_eeprom_info req = {
2738 		.addr = cpu_to_le32(round_down(offset,
2739 				    MT7915_EEPROM_BLOCK_SIZE)),
2740 	};
2741 	struct mt7915_mcu_eeprom_info *res;
2742 	struct sk_buff *skb;
2743 	int ret;
2744 	u8 *buf;
2745 
2746 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
2747 				sizeof(req), true, &skb);
2748 	if (ret)
2749 		return ret;
2750 
2751 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2752 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2753 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2754 	dev_kfree_skb(skb);
2755 
2756 	return 0;
2757 }
2758 
2759 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2760 {
2761 	struct {
2762 		u8 _rsv;
2763 		u8 version;
2764 		u8 die_idx;
2765 		u8 _rsv2;
2766 	} __packed req = {
2767 		.version = 1,
2768 	};
2769 	struct sk_buff *skb;
2770 	int ret;
2771 
2772 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
2773 					sizeof(req), true, &skb);
2774 	if (ret)
2775 		return ret;
2776 
2777 	*block_num = *(u8 *)skb->data;
2778 	dev_kfree_skb(skb);
2779 
2780 	return 0;
2781 }
2782 
2783 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2784 				  u8 *data, u32 len, int cmd)
2785 {
2786 	struct {
2787 		u8 dir;
2788 		u8 valid;
2789 		__le16 bitmap;
2790 		s8 precal;
2791 		u8 action;
2792 		u8 band;
2793 		u8 idx;
2794 		u8 rsv[4];
2795 		__le32 len;
2796 	} req = {};
2797 	struct sk_buff *skb;
2798 
2799 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2800 	if (!skb)
2801 		return -ENOMEM;
2802 
2803 	req.idx = idx;
2804 	req.len = cpu_to_le32(len);
2805 	skb_put_data(skb, &req, sizeof(req));
2806 	skb_put_data(skb, data, len);
2807 
2808 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2809 }
2810 
2811 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2812 {
2813 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2814 	u32 total = MT_EE_CAL_GROUP_SIZE;
2815 
2816 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
2817 		return 0;
2818 
2819 	/*
2820 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2821 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2822 	 */
2823 	while (total > 0) {
2824 		int ret, len;
2825 
2826 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2827 
2828 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2829 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2830 		if (ret)
2831 			return ret;
2832 
2833 		total -= len;
2834 		cal += len;
2835 		idx++;
2836 	}
2837 
2838 	return 0;
2839 }
2840 
2841 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2842 {
2843 	int i;
2844 
2845 	for (i = 0; i < n_freqs; i++)
2846 		if (cur == freqs[i])
2847 			return i;
2848 
2849 	return -1;
2850 }
2851 
2852 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
2853 {
2854 	static const u16 freq_list[] = {
2855 		5180, 5200, 5220, 5240,
2856 		5260, 5280, 5300, 5320,
2857 		5500, 5520, 5540, 5560,
2858 		5580, 5600, 5620, 5640,
2859 		5660, 5680, 5700, 5745,
2860 		5765, 5785, 5805, 5825
2861 	};
2862 	int offset_2g = ARRAY_SIZE(freq_list);
2863 	int idx;
2864 
2865 	if (freq < 4000) {
2866 		if (freq < 2432)
2867 			return offset_2g;
2868 		if (freq < 2457)
2869 			return offset_2g + 1;
2870 
2871 		return offset_2g + 2;
2872 	}
2873 
2874 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
2875 		return -1;
2876 
2877 	if (bw != NL80211_CHAN_WIDTH_20) {
2878 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2879 					   freq + 10);
2880 		if (idx >= 0)
2881 			return idx;
2882 
2883 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2884 					   freq - 10);
2885 		if (idx >= 0)
2886 			return idx;
2887 	}
2888 
2889 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2890 }
2891 
2892 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
2893 {
2894 	struct mt7915_dev *dev = phy->dev;
2895 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2896 	u16 total = 2, center_freq = chandef->center_freq1;
2897 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2898 	int idx;
2899 
2900 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
2901 		return 0;
2902 
2903 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
2904 	if (idx < 0)
2905 		return -EINVAL;
2906 
2907 	/* Items: Tx DPD, Tx Flatness */
2908 	idx = idx * 2;
2909 	cal += MT_EE_CAL_GROUP_SIZE;
2910 
2911 	while (total--) {
2912 		int ret;
2913 
2914 		cal += (idx * MT_EE_CAL_UNIT);
2915 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
2916 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
2917 		if (ret)
2918 			return ret;
2919 
2920 		idx++;
2921 	}
2922 
2923 	return 0;
2924 }
2925 
2926 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
2927 {
2928 	/* strict order */
2929 	static const u32 offs[] = {
2930 		MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME,
2931 		MIB_BUSY_TIME_V2, MIB_TX_TIME_V2, MIB_RX_TIME_V2,
2932 		MIB_OBSS_AIRTIME_V2
2933 	};
2934 	struct mt76_channel_state *state = phy->mt76->chan_state;
2935 	struct mt76_channel_state *state_ts = &phy->state_ts;
2936 	struct mt7915_dev *dev = phy->dev;
2937 	struct mt7915_mcu_mib *res, req[4];
2938 	struct sk_buff *skb;
2939 	int i, ret, start = 0, ofs = 20;
2940 
2941 	if (!is_mt7915(&dev->mt76)) {
2942 		start = 4;
2943 		ofs = 0;
2944 	}
2945 
2946 	for (i = 0; i < 4; i++) {
2947 		req[i].band = cpu_to_le32(phy != &dev->phy);
2948 		req[i].offs = cpu_to_le32(offs[i + start]);
2949 	}
2950 
2951 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
2952 					req, sizeof(req), true, &skb);
2953 	if (ret)
2954 		return ret;
2955 
2956 	res = (struct mt7915_mcu_mib *)(skb->data + ofs);
2957 
2958 	if (chan_switch)
2959 		goto out;
2960 
2961 #define __res_u64(s) le64_to_cpu(res[s].data)
2962 	state->cc_busy += __res_u64(0) - state_ts->cc_busy;
2963 	state->cc_tx += __res_u64(1) - state_ts->cc_tx;
2964 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
2965 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
2966 
2967 out:
2968 	state_ts->cc_busy = __res_u64(0);
2969 	state_ts->cc_tx = __res_u64(1);
2970 	state_ts->cc_bss_rx = __res_u64(2);
2971 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
2972 #undef __res_u64
2973 
2974 	dev_kfree_skb(skb);
2975 
2976 	return 0;
2977 }
2978 
2979 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
2980 {
2981 	struct mt7915_dev *dev = phy->dev;
2982 	struct {
2983 		u8 ctrl_id;
2984 		u8 action;
2985 		u8 dbdc_idx;
2986 		u8 rsv[5];
2987 	} req = {
2988 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
2989 		.dbdc_idx = phy != &dev->phy,
2990 	};
2991 
2992 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
2993 				 sizeof(req), true);
2994 }
2995 
2996 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
2997 {
2998 	struct mt7915_dev *dev = phy->dev;
2999 	struct {
3000 		struct mt7915_mcu_thermal_ctrl ctrl;
3001 
3002 		__le32 trigger_temp;
3003 		__le32 restore_temp;
3004 		__le16 sustain_time;
3005 		u8 rsv[2];
3006 	} __packed req = {
3007 		.ctrl = {
3008 			.band_idx = phy->band_idx,
3009 		},
3010 	};
3011 	int level;
3012 
3013 	if (!state) {
3014 		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3015 		goto out;
3016 	}
3017 
3018 	/* set duty cycle and level */
3019 	for (level = 0; level < 4; level++) {
3020 		int ret;
3021 
3022 		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3023 		req.ctrl.duty.duty_level = level;
3024 		req.ctrl.duty.duty_cycle = state;
3025 		state /= 2;
3026 
3027 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3028 					&req, sizeof(req.ctrl), false);
3029 		if (ret)
3030 			return ret;
3031 	}
3032 
3033 	/* set high-temperature trigger threshold */
3034 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3035 	/* add a safety margin ~10 */
3036 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3037 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3038 	req.sustain_time = cpu_to_le16(10);
3039 
3040 out:
3041 	req.ctrl.type.protect_type = 1;
3042 	req.ctrl.type.trigger_type = 1;
3043 
3044 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3045 				 &req, sizeof(req), false);
3046 }
3047 
3048 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3049 {
3050 	struct mt7915_dev *dev = phy->dev;
3051 	struct mt76_phy *mphy = phy->mt76;
3052 	struct ieee80211_hw *hw = mphy->hw;
3053 	struct mt7915_sku_val {
3054 		u8 format_id;
3055 		u8 limit_type;
3056 		u8 dbdc_idx;
3057 		s8 val[MT7915_SKU_RATE_NUM];
3058 	} __packed req = {
3059 		.format_id = 4,
3060 		.dbdc_idx = phy != &dev->phy,
3061 	};
3062 	struct mt76_power_limits limits_array;
3063 	s8 *la = (s8 *)&limits_array;
3064 	int i, idx, n_chains = hweight8(mphy->antenna_mask);
3065 	int tx_power = hw->conf.power_level * 2;
3066 
3067 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan,
3068 				      tx_power);
3069 	tx_power -= mt76_tx_power_nss_delta(n_chains);
3070 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3071 					      &limits_array, tx_power);
3072 	mphy->txpower_cur = tx_power;
3073 
3074 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3075 		u8 mcs_num, len = mt7915_sku_group_len[i];
3076 		int j;
3077 
3078 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3079 			mcs_num = 10;
3080 
3081 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3082 				la = (s8 *)&limits_array + 12;
3083 		} else {
3084 			mcs_num = len;
3085 		}
3086 
3087 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3088 			req.val[idx + j] = la[j];
3089 
3090 		la += mcs_num;
3091 		idx += len;
3092 	}
3093 
3094 	return mt76_mcu_send_msg(&dev->mt76,
3095 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3096 				 sizeof(req), true);
3097 }
3098 
3099 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3100 {
3101 #define RATE_POWER_INFO	2
3102 	struct mt7915_dev *dev = phy->dev;
3103 	struct {
3104 		u8 format_id;
3105 		u8 category;
3106 		u8 band;
3107 		u8 _rsv;
3108 	} __packed req = {
3109 		.format_id = 7,
3110 		.category = RATE_POWER_INFO,
3111 		.band = phy != &dev->phy,
3112 	};
3113 	s8 res[MT7915_SKU_RATE_NUM][2];
3114 	struct sk_buff *skb;
3115 	int ret, i;
3116 
3117 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3118 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3119 					&req, sizeof(req), true, &skb);
3120 	if (ret)
3121 		return ret;
3122 
3123 	memcpy(res, skb->data + 4, sizeof(res));
3124 	for (i = 0; i < len; i++)
3125 		txpower[i] = res[i][req.band];
3126 
3127 	dev_kfree_skb(skb);
3128 
3129 	return 0;
3130 }
3131 
3132 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3133 			      u8 en)
3134 {
3135 	struct {
3136 		u8 test_mode_en;
3137 		u8 param_idx;
3138 		u8 _rsv[2];
3139 
3140 		u8 enable;
3141 		u8 _rsv2[3];
3142 
3143 		u8 pad[8];
3144 	} __packed req = {
3145 		.test_mode_en = test_mode,
3146 		.param_idx = param,
3147 		.enable = en,
3148 	};
3149 
3150 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3151 				 sizeof(req), false);
3152 }
3153 
3154 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3155 {
3156 	struct mt7915_dev *dev = phy->dev;
3157 	struct mt7915_sku {
3158 		u8 format_id;
3159 		u8 sku_enable;
3160 		u8 dbdc_idx;
3161 		u8 rsv;
3162 	} __packed req = {
3163 		.format_id = 0,
3164 		.dbdc_idx = phy != &dev->phy,
3165 		.sku_enable = enable,
3166 	};
3167 
3168 	return mt76_mcu_send_msg(&dev->mt76,
3169 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3170 				 sizeof(req), true);
3171 }
3172 
3173 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3174 {
3175 	struct {
3176 		u8 action;
3177 		u8 set;
3178 		u8 band;
3179 		u8 rsv;
3180 	} req = {
3181 		.action = action,
3182 		.set = set,
3183 		.band = band,
3184 	};
3185 
3186 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3187 				 &req, sizeof(req), false);
3188 }
3189 
3190 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3191 {
3192 	struct {
3193 		u8 action;
3194 		union {
3195 			struct {
3196 				u8 snd_mode;
3197 				u8 sta_num;
3198 				u8 rsv;
3199 				u8 wlan_idx[4];
3200 				__le32 snd_period;	/* ms */
3201 			} __packed snd;
3202 			struct {
3203 				bool ebf;
3204 				bool ibf;
3205 				u8 rsv;
3206 			} __packed type;
3207 			struct {
3208 				u8 bf_num;
3209 				u8 bf_bitmap;
3210 				u8 bf_sel[8];
3211 				u8 rsv[5];
3212 			} __packed mod;
3213 		};
3214 	} __packed req = {
3215 		.action = action,
3216 	};
3217 
3218 #define MT_BF_PROCESSING	4
3219 	switch (action) {
3220 	case MT_BF_SOUNDING_ON:
3221 		req.snd.snd_mode = MT_BF_PROCESSING;
3222 		break;
3223 	case MT_BF_TYPE_UPDATE:
3224 		req.type.ebf = true;
3225 		req.type.ibf = dev->ibf;
3226 		break;
3227 	case MT_BF_MODULE_UPDATE:
3228 		req.mod.bf_num = 2;
3229 		req.mod.bf_bitmap = GENMASK(1, 0);
3230 		break;
3231 	default:
3232 		return -EINVAL;
3233 	}
3234 
3235 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3236 				 sizeof(req), true);
3237 }
3238 
3239 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3240 			    bool enable)
3241 {
3242 #define MT_SPR_ENABLE		1
3243 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3244 	struct {
3245 		u8 action;
3246 		u8 arg_num;
3247 		u8 band_idx;
3248 		u8 status;
3249 		u8 drop_tx_idx;
3250 		u8 sta_idx;	/* 256 sta */
3251 		u8 rsv[2];
3252 		__le32 val;
3253 	} __packed req = {
3254 		.action = MT_SPR_ENABLE,
3255 		.arg_num = 1,
3256 		.band_idx = mvif->mt76.band_idx,
3257 		.val = cpu_to_le32(enable),
3258 	};
3259 
3260 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3261 				 sizeof(req), true);
3262 }
3263 
3264 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3265 			   struct ieee80211_sta *sta, struct rate_info *rate)
3266 {
3267 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3268 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3269 	struct mt7915_dev *dev = phy->dev;
3270 	struct mt76_phy *mphy = phy->mt76;
3271 	struct {
3272 		u8 category;
3273 		u8 band;
3274 		__le16 wcid;
3275 	} __packed req = {
3276 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3277 		.band = mvif->mt76.band_idx,
3278 		.wcid = cpu_to_le16(msta->wcid.idx),
3279 	};
3280 	struct ieee80211_supported_band *sband;
3281 	struct mt7915_mcu_phy_rx_info *res;
3282 	struct sk_buff *skb;
3283 	int ret;
3284 	bool cck = false;
3285 
3286 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3287 					&req, sizeof(req), true, &skb);
3288 	if (ret)
3289 		return ret;
3290 
3291 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3292 
3293 	rate->mcs = res->rate;
3294 	rate->nss = res->nsts + 1;
3295 
3296 	switch (res->mode) {
3297 	case MT_PHY_TYPE_CCK:
3298 		cck = true;
3299 		fallthrough;
3300 	case MT_PHY_TYPE_OFDM:
3301 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3302 			sband = &mphy->sband_5g.sband;
3303 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3304 			sband = &mphy->sband_6g.sband;
3305 		else
3306 			sband = &mphy->sband_2g.sband;
3307 
3308 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3309 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3310 		break;
3311 	case MT_PHY_TYPE_HT:
3312 	case MT_PHY_TYPE_HT_GF:
3313 		if (rate->mcs > 31) {
3314 			ret = -EINVAL;
3315 			goto out;
3316 		}
3317 
3318 		rate->flags = RATE_INFO_FLAGS_MCS;
3319 		if (res->gi)
3320 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3321 		break;
3322 	case MT_PHY_TYPE_VHT:
3323 		if (rate->mcs > 9) {
3324 			ret = -EINVAL;
3325 			goto out;
3326 		}
3327 
3328 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3329 		if (res->gi)
3330 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3331 		break;
3332 	case MT_PHY_TYPE_HE_SU:
3333 	case MT_PHY_TYPE_HE_EXT_SU:
3334 	case MT_PHY_TYPE_HE_TB:
3335 	case MT_PHY_TYPE_HE_MU:
3336 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3337 			ret = -EINVAL;
3338 			goto out;
3339 		}
3340 		rate->he_gi = res->gi;
3341 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3342 		break;
3343 	default:
3344 		ret = -EINVAL;
3345 		goto out;
3346 	}
3347 
3348 	switch (res->bw) {
3349 	case IEEE80211_STA_RX_BW_160:
3350 		rate->bw = RATE_INFO_BW_160;
3351 		break;
3352 	case IEEE80211_STA_RX_BW_80:
3353 		rate->bw = RATE_INFO_BW_80;
3354 		break;
3355 	case IEEE80211_STA_RX_BW_40:
3356 		rate->bw = RATE_INFO_BW_40;
3357 		break;
3358 	default:
3359 		rate->bw = RATE_INFO_BW_20;
3360 		break;
3361 	}
3362 
3363 out:
3364 	dev_kfree_skb(skb);
3365 
3366 	return ret;
3367 }
3368 
3369 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3370 				struct cfg80211_he_bss_color *he_bss_color)
3371 {
3372 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3373 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3374 	struct bss_info_color *bss_color;
3375 	struct sk_buff *skb;
3376 	struct tlv *tlv;
3377 
3378 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3379 					      NULL, len);
3380 	if (IS_ERR(skb))
3381 		return PTR_ERR(skb);
3382 
3383 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3384 				      sizeof(*bss_color));
3385 	bss_color = (struct bss_info_color *)tlv;
3386 	bss_color->disable = !he_bss_color->enabled;
3387 	bss_color->color = he_bss_color->color;
3388 
3389 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3390 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3391 }
3392 
3393 #define TWT_AGRT_TRIGGER	BIT(0)
3394 #define TWT_AGRT_ANNOUNCE	BIT(1)
3395 #define TWT_AGRT_PROTECT	BIT(2)
3396 
3397 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3398 			       struct mt7915_vif *mvif,
3399 			       struct mt7915_twt_flow *flow,
3400 			       int cmd)
3401 {
3402 	struct {
3403 		u8 tbl_idx;
3404 		u8 cmd;
3405 		u8 own_mac_idx;
3406 		u8 flowid; /* 0xff for group id */
3407 		__le16 peer_id; /* specify the peer_id (msb=0)
3408 				 * or group_id (msb=1)
3409 				 */
3410 		u8 duration; /* 256 us */
3411 		u8 bss_idx;
3412 		__le64 start_tsf;
3413 		__le16 mantissa;
3414 		u8 exponent;
3415 		u8 is_ap;
3416 		u8 agrt_params;
3417 		u8 rsv[23];
3418 	} __packed req = {
3419 		.tbl_idx = flow->table_id,
3420 		.cmd = cmd,
3421 		.own_mac_idx = mvif->mt76.omac_idx,
3422 		.flowid = flow->id,
3423 		.peer_id = cpu_to_le16(flow->wcid),
3424 		.duration = flow->duration,
3425 		.bss_idx = mvif->mt76.idx,
3426 		.start_tsf = cpu_to_le64(flow->tsf),
3427 		.mantissa = flow->mantissa,
3428 		.exponent = flow->exp,
3429 		.is_ap = true,
3430 	};
3431 
3432 	if (flow->protection)
3433 		req.agrt_params |= TWT_AGRT_PROTECT;
3434 	if (!flow->flowtype)
3435 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3436 	if (flow->trigger)
3437 		req.agrt_params |= TWT_AGRT_TRIGGER;
3438 
3439 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3440 				 &req, sizeof(req), true);
3441 }
3442 
3443 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3444 {
3445 	struct {
3446 		__le32 idx;
3447 		__le32 ofs;
3448 		__le32 data;
3449 	} __packed req = {
3450 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 28))),
3451 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(27, 0))),
3452 		.data = set ? cpu_to_le32(*val) : 0,
3453 	};
3454 	struct sk_buff *skb;
3455 	int ret;
3456 
3457 	if (set)
3458 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3459 					 &req, sizeof(req), false);
3460 
3461 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3462 					&req, sizeof(req), true, &skb);
3463 	if (ret)
3464 		return ret;
3465 
3466 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3467 	dev_kfree_skb(skb);
3468 
3469 	return 0;
3470 }
3471