1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define MCU_PATCH_ADDRESS		0x200000
68 
69 #define FW_FEATURE_SET_ENCRYPT		BIT(0)
70 #define FW_FEATURE_SET_KEY_IDX		GENMASK(2, 1)
71 #define FW_FEATURE_OVERRIDE_ADDR	BIT(5)
72 
73 #define DL_MODE_ENCRYPT			BIT(0)
74 #define DL_MODE_KEY_IDX			GENMASK(2, 1)
75 #define DL_MODE_RESET_SEC_IV		BIT(3)
76 #define DL_MODE_WORKING_PDA_CR4		BIT(4)
77 #define DL_MODE_NEED_RSP		BIT(31)
78 
79 #define FW_START_OVERRIDE		BIT(0)
80 #define FW_START_WORKING_PDA_CR4	BIT(2)
81 
82 #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
83 #define PATCH_SEC_TYPE_INFO		0x2
84 
85 #define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
86 #define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
87 
88 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
89 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
90 
91 static enum mt7915_cipher_type
92 mt7915_mcu_get_cipher(int cipher)
93 {
94 	switch (cipher) {
95 	case WLAN_CIPHER_SUITE_WEP40:
96 		return MT_CIPHER_WEP40;
97 	case WLAN_CIPHER_SUITE_WEP104:
98 		return MT_CIPHER_WEP104;
99 	case WLAN_CIPHER_SUITE_TKIP:
100 		return MT_CIPHER_TKIP;
101 	case WLAN_CIPHER_SUITE_AES_CMAC:
102 		return MT_CIPHER_BIP_CMAC_128;
103 	case WLAN_CIPHER_SUITE_CCMP:
104 		return MT_CIPHER_AES_CCMP;
105 	case WLAN_CIPHER_SUITE_CCMP_256:
106 		return MT_CIPHER_CCMP_256;
107 	case WLAN_CIPHER_SUITE_GCMP:
108 		return MT_CIPHER_GCMP;
109 	case WLAN_CIPHER_SUITE_GCMP_256:
110 		return MT_CIPHER_GCMP_256;
111 	case WLAN_CIPHER_SUITE_SMS4:
112 		return MT_CIPHER_WAPI;
113 	default:
114 		return MT_CIPHER_NONE;
115 	}
116 }
117 
118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
119 {
120 	static const u8 width_to_bw[] = {
121 		[NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
122 		[NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
123 		[NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
124 		[NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
125 		[NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
126 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
127 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
128 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
129 	};
130 
131 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
132 		return 0;
133 
134 	return width_to_bw[chandef->width];
135 }
136 
137 static const struct ieee80211_sta_he_cap *
138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
139 {
140 	struct ieee80211_supported_band *sband;
141 	enum nl80211_band band;
142 
143 	band = phy->mt76->chandef.chan->band;
144 	sband = phy->mt76->hw->wiphy->bands[band];
145 
146 	return ieee80211_get_he_iftype_cap(sband, vif->type);
147 }
148 
149 static u8
150 mt7915_get_phy_mode(struct mt76_phy *mphy, struct ieee80211_vif *vif,
151 		    struct ieee80211_sta *sta)
152 {
153 	enum nl80211_band band = mphy->chandef.chan->band;
154 	struct ieee80211_sta_ht_cap *ht_cap;
155 	struct ieee80211_sta_vht_cap *vht_cap;
156 	const struct ieee80211_sta_he_cap *he_cap;
157 	u8 mode = 0;
158 
159 	if (sta) {
160 		ht_cap = &sta->ht_cap;
161 		vht_cap = &sta->vht_cap;
162 		he_cap = &sta->he_cap;
163 	} else {
164 		struct ieee80211_supported_band *sband;
165 
166 		sband = mphy->hw->wiphy->bands[band];
167 
168 		ht_cap = &sband->ht_cap;
169 		vht_cap = &sband->vht_cap;
170 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
171 	}
172 
173 	if (band == NL80211_BAND_2GHZ) {
174 		mode |= PHY_MODE_B | PHY_MODE_G;
175 
176 		if (ht_cap->ht_supported)
177 			mode |= PHY_MODE_GN;
178 
179 		if (he_cap->has_he)
180 			mode |= PHY_MODE_AX_24G;
181 	} else if (band == NL80211_BAND_5GHZ) {
182 		mode |= PHY_MODE_A;
183 
184 		if (ht_cap->ht_supported)
185 			mode |= PHY_MODE_AN;
186 
187 		if (vht_cap->vht_supported)
188 			mode |= PHY_MODE_AC;
189 
190 		if (he_cap->has_he)
191 			mode |= PHY_MODE_AX_5G;
192 	}
193 
194 	return mode;
195 }
196 
197 static u8
198 mt7915_mcu_get_sta_nss(u16 mcs_map)
199 {
200 	u8 nss;
201 
202 	for (nss = 8; nss > 0; nss--) {
203 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
204 
205 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
206 			break;
207 	}
208 
209 	return nss - 1;
210 }
211 
212 static int
213 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
214 			  struct sk_buff *skb, int seq)
215 {
216 	struct mt7915_mcu_rxd *rxd;
217 	int ret = 0;
218 
219 	if (!skb) {
220 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
221 			cmd, seq);
222 		return -ETIMEDOUT;
223 	}
224 
225 	rxd = (struct mt7915_mcu_rxd *)skb->data;
226 	if (seq != rxd->seq)
227 		return -EAGAIN;
228 
229 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
230 		skb_pull(skb, sizeof(*rxd) - 4);
231 		ret = *skb->data;
232 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
233 		skb_pull(skb, sizeof(*rxd) + 4);
234 		ret = le32_to_cpu(*(__le32 *)skb->data);
235 	} else {
236 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
237 	}
238 
239 	return ret;
240 }
241 
242 static int
243 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
244 			int cmd, int *wait_seq)
245 {
246 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
247 	struct mt7915_mcu_txd *mcu_txd;
248 	enum mt76_mcuq_id qid;
249 	__le32 *txd;
250 	u32 val;
251 	u8 seq;
252 
253 	/* TODO: make dynamic based on msg type */
254 	mdev->mcu.timeout = 20 * HZ;
255 
256 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
257 	if (!seq)
258 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
259 
260 	if (cmd == MCU_CMD(FW_SCATTER)) {
261 		qid = MT_MCUQ_FWDL;
262 		goto exit;
263 	}
264 
265 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
266 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
267 		qid = MT_MCUQ_WA;
268 	else
269 		qid = MT_MCUQ_WM;
270 
271 	txd = mcu_txd->txd;
272 
273 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
274 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
275 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
276 	txd[0] = cpu_to_le32(val);
277 
278 	val = MT_TXD1_LONG_FORMAT |
279 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
280 	txd[1] = cpu_to_le32(val);
281 
282 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
283 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
284 					       MT_TX_MCU_PORT_RX_Q0));
285 	mcu_txd->pkt_type = MCU_PKT_ID;
286 	mcu_txd->seq = seq;
287 
288 	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
289 	mcu_txd->set_query = MCU_Q_NA;
290 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
291 	if (mcu_txd->ext_cid) {
292 		mcu_txd->ext_cid_ack = 1;
293 
294 		/* do not use Q_SET for efuse */
295 		if (cmd & __MCU_CMD_FIELD_QUERY)
296 			mcu_txd->set_query = MCU_Q_QUERY;
297 		else
298 			mcu_txd->set_query = MCU_Q_SET;
299 	}
300 
301 	if (cmd & __MCU_CMD_FIELD_WA)
302 		mcu_txd->s2d_index = MCU_S2D_H2C;
303 	else
304 		mcu_txd->s2d_index = MCU_S2D_H2N;
305 
306 exit:
307 	if (wait_seq)
308 		*wait_seq = seq;
309 
310 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
311 }
312 
313 static void
314 mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
315 {
316 	struct {
317 		__le32 args[3];
318 	} req = {
319 		.args = {
320 			cpu_to_le32(a1),
321 			cpu_to_le32(a2),
322 			cpu_to_le32(a3),
323 		},
324 	};
325 
326 	mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
327 }
328 
329 static void
330 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
331 {
332 	if (vif->csa_active)
333 		ieee80211_csa_finish(vif);
334 }
335 
336 static void
337 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
338 {
339 	struct mt76_phy *mphy = &dev->mt76.phy;
340 	struct mt7915_mcu_csa_notify *c;
341 
342 	c = (struct mt7915_mcu_csa_notify *)skb->data;
343 
344 	if (c->band_idx && dev->mt76.phy2)
345 		mphy = dev->mt76.phy2;
346 
347 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
348 			IEEE80211_IFACE_ITER_RESUME_ALL,
349 			mt7915_mcu_csa_finish, mphy->hw);
350 }
351 
352 static void
353 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
354 {
355 	struct mt76_phy *mphy = &dev->mt76.phy;
356 	struct mt7915_mcu_rdd_report *r;
357 
358 	r = (struct mt7915_mcu_rdd_report *)skb->data;
359 
360 	if (r->band_idx && dev->mt76.phy2)
361 		mphy = dev->mt76.phy2;
362 
363 	ieee80211_radar_detected(mphy->hw);
364 	dev->hw_pattern++;
365 }
366 
367 static int
368 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
369 			 struct rate_info *rate, u16 r)
370 {
371 	struct ieee80211_supported_band *sband;
372 	u16 ru_idx = le16_to_cpu(ra->ru_idx);
373 	bool cck = false;
374 
375 	rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
376 	rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
377 
378 	switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
379 	case MT_PHY_TYPE_CCK:
380 		cck = true;
381 		fallthrough;
382 	case MT_PHY_TYPE_OFDM:
383 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
384 			sband = &mphy->sband_5g.sband;
385 		else
386 			sband = &mphy->sband_2g.sband;
387 
388 		rate->mcs = mt76_get_rate(mphy->dev, sband, rate->mcs, cck);
389 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
390 		break;
391 	case MT_PHY_TYPE_HT:
392 	case MT_PHY_TYPE_HT_GF:
393 		rate->mcs += (rate->nss - 1) * 8;
394 		if (rate->mcs > 31)
395 			return -EINVAL;
396 
397 		rate->flags = RATE_INFO_FLAGS_MCS;
398 		if (ra->gi)
399 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
400 		break;
401 	case MT_PHY_TYPE_VHT:
402 		if (rate->mcs > 9)
403 			return -EINVAL;
404 
405 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
406 		if (ra->gi)
407 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
408 		break;
409 	case MT_PHY_TYPE_HE_SU:
410 	case MT_PHY_TYPE_HE_EXT_SU:
411 	case MT_PHY_TYPE_HE_TB:
412 	case MT_PHY_TYPE_HE_MU:
413 		if (ra->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11)
414 			return -EINVAL;
415 
416 		rate->he_gi = ra->gi;
417 		rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
418 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
419 		break;
420 	default:
421 		return -EINVAL;
422 	}
423 
424 	if (ru_idx) {
425 		switch (ru_idx) {
426 		case 1 ... 2:
427 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
428 			break;
429 		case 3 ... 6:
430 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
431 			break;
432 		case 7 ... 14:
433 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
434 			break;
435 		default:
436 			rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
437 			break;
438 		}
439 		rate->bw = RATE_INFO_BW_HE_RU;
440 	} else {
441 		u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
442 			FIELD_GET(MT_RA_RATE_BW, r);
443 
444 		switch (bw) {
445 		case IEEE80211_STA_RX_BW_160:
446 			rate->bw = RATE_INFO_BW_160;
447 			break;
448 		case IEEE80211_STA_RX_BW_80:
449 			rate->bw = RATE_INFO_BW_80;
450 			break;
451 		case IEEE80211_STA_RX_BW_40:
452 			rate->bw = RATE_INFO_BW_40;
453 			break;
454 		default:
455 			rate->bw = RATE_INFO_BW_20;
456 			break;
457 		}
458 	}
459 
460 	return 0;
461 }
462 
463 static void
464 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
465 {
466 	struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
467 	struct rate_info rate = {}, prob_rate = {};
468 	u16 probe = le16_to_cpu(ra->prob_up_rate);
469 	u16 attempts = le16_to_cpu(ra->attempts);
470 	u16 curr = le16_to_cpu(ra->curr_rate);
471 	u16 wcidx = le16_to_cpu(ra->wlan_idx);
472 	struct mt76_phy *mphy = &dev->mphy;
473 	struct mt7915_sta_stats *stats;
474 	struct mt7915_sta *msta;
475 	struct mt76_wcid *wcid;
476 
477 	if (wcidx >= MT76_N_WCIDS)
478 		return;
479 
480 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
481 	if (!wcid)
482 		return;
483 
484 	msta = container_of(wcid, struct mt7915_sta, wcid);
485 	stats = &msta->stats;
486 
487 	if (msta->wcid.ext_phy && dev->mt76.phy2)
488 		mphy = dev->mt76.phy2;
489 
490 	/* current rate */
491 	if (!mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr))
492 		stats->tx_rate = rate;
493 
494 	/* probing rate */
495 	if (!mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe))
496 		stats->prob_rate = prob_rate;
497 
498 	if (attempts) {
499 		u16 success = le16_to_cpu(ra->success);
500 
501 		stats->per = 1000 * (attempts - success) / attempts;
502 	}
503 }
504 
505 static void
506 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
507 {
508 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
509 	const char *data = (char *)&rxd[1];
510 	const char *type;
511 
512 	switch (rxd->s2d_index) {
513 	case 0:
514 		type = "WM";
515 		break;
516 	case 2:
517 		type = "WA";
518 		break;
519 	default:
520 		type = "unknown";
521 		break;
522 	}
523 
524 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
525 		   (int)(skb->len - sizeof(*rxd)), data);
526 }
527 
528 static void
529 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
530 {
531 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
532 
533 	switch (rxd->ext_eid) {
534 	case MCU_EXT_EVENT_RDD_REPORT:
535 		mt7915_mcu_rx_radar_detected(dev, skb);
536 		break;
537 	case MCU_EXT_EVENT_CSA_NOTIFY:
538 		mt7915_mcu_rx_csa_notify(dev, skb);
539 		break;
540 	case MCU_EXT_EVENT_RATE_REPORT:
541 		mt7915_mcu_tx_rate_report(dev, skb);
542 		break;
543 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
544 		mt7915_mcu_rx_log_message(dev, skb);
545 		break;
546 	default:
547 		break;
548 	}
549 }
550 
551 static void
552 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
553 {
554 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
555 
556 	switch (rxd->eid) {
557 	case MCU_EVENT_EXT:
558 		mt7915_mcu_rx_ext_event(dev, skb);
559 		break;
560 	default:
561 		break;
562 	}
563 	dev_kfree_skb(skb);
564 }
565 
566 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
567 {
568 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
569 
570 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
571 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
572 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
573 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
574 	    rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
575 	    !rxd->seq)
576 		mt7915_mcu_rx_unsolicited_event(dev, skb);
577 	else
578 		mt76_mcu_rx_event(&dev->mt76, skb);
579 }
580 
581 static struct sk_buff *
582 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
583 			 struct mt7915_sta *msta, int len)
584 {
585 	struct sta_req_hdr hdr = {
586 		.bss_idx = mvif->idx,
587 		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
588 		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
589 		.muar_idx = msta ? mvif->omac_idx : 0,
590 		.is_tlv_append = 1,
591 	};
592 	struct sk_buff *skb;
593 
594 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
595 	if (!skb)
596 		return ERR_PTR(-ENOMEM);
597 
598 	skb_put_data(skb, &hdr, sizeof(hdr));
599 
600 	return skb;
601 }
602 
603 static struct wtbl_req_hdr *
604 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
605 			  int cmd, void *sta_wtbl, struct sk_buff **skb)
606 {
607 	struct tlv *sta_hdr = sta_wtbl;
608 	struct wtbl_req_hdr hdr = {
609 		.wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
610 		.wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
611 		.operation = cmd,
612 	};
613 	struct sk_buff *nskb = *skb;
614 
615 	if (!nskb) {
616 		nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
617 					  MT7915_WTBL_UPDATE_MAX_SIZE);
618 		if (!nskb)
619 			return ERR_PTR(-ENOMEM);
620 
621 		*skb = nskb;
622 	}
623 
624 	if (sta_hdr)
625 		sta_hdr->len = cpu_to_le16(sizeof(hdr));
626 
627 	return skb_put_data(nskb, &hdr, sizeof(hdr));
628 }
629 
630 static struct tlv *
631 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
632 			  void *sta_ntlv, void *sta_wtbl)
633 {
634 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
635 	struct tlv *sta_hdr = sta_wtbl;
636 	struct tlv *ptlv, tlv = {
637 		.tag = cpu_to_le16(tag),
638 		.len = cpu_to_le16(len),
639 	};
640 	u16 ntlv;
641 
642 	ptlv = skb_put(skb, len);
643 	memcpy(ptlv, &tlv, sizeof(tlv));
644 
645 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
646 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
647 
648 	if (sta_hdr) {
649 		u16 size = le16_to_cpu(sta_hdr->len);
650 
651 		sta_hdr->len = cpu_to_le16(size + len);
652 	}
653 
654 	return ptlv;
655 }
656 
657 static struct tlv *
658 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
659 {
660 	return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
661 }
662 
663 static struct tlv *
664 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
665 			     __le16 *sub_ntlv, __le16 *len)
666 {
667 	struct tlv *ptlv, tlv = {
668 		.tag = cpu_to_le16(sub_tag),
669 		.len = cpu_to_le16(sub_len),
670 	};
671 
672 	ptlv = skb_put(skb, sub_len);
673 	memcpy(ptlv, &tlv, sizeof(tlv));
674 
675 	le16_add_cpu(sub_ntlv, 1);
676 	le16_add_cpu(len, sub_len);
677 
678 	return ptlv;
679 }
680 
681 /** bss info **/
682 static int
683 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
684 			 struct mt7915_phy *phy, bool enable)
685 {
686 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
687 	struct bss_info_basic *bss;
688 	u16 wlan_idx = mvif->sta.wcid.idx;
689 	u32 type = NETWORK_INFRA;
690 	struct tlv *tlv;
691 
692 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
693 
694 	switch (vif->type) {
695 	case NL80211_IFTYPE_MESH_POINT:
696 	case NL80211_IFTYPE_AP:
697 	case NL80211_IFTYPE_MONITOR:
698 		break;
699 	case NL80211_IFTYPE_STATION:
700 		/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
701 		if (enable) {
702 			struct ieee80211_sta *sta;
703 			struct mt7915_sta *msta;
704 
705 			rcu_read_lock();
706 			sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
707 			if (!sta) {
708 				rcu_read_unlock();
709 				return -EINVAL;
710 			}
711 
712 			msta = (struct mt7915_sta *)sta->drv_priv;
713 			wlan_idx = msta->wcid.idx;
714 			rcu_read_unlock();
715 		}
716 		break;
717 	case NL80211_IFTYPE_ADHOC:
718 		type = NETWORK_IBSS;
719 		break;
720 	default:
721 		WARN_ON(1);
722 		break;
723 	}
724 
725 	bss = (struct bss_info_basic *)tlv;
726 	bss->network_type = cpu_to_le32(type);
727 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
728 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
729 	bss->wmm_idx = mvif->wmm_idx;
730 	bss->active = enable;
731 
732 	if (vif->type != NL80211_IFTYPE_MONITOR) {
733 		memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
734 		bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
735 		bss->dtim_period = vif->bss_conf.dtim_period;
736 		bss->phy_mode = mt7915_get_phy_mode(phy->mt76, vif, NULL);
737 	} else {
738 		memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
739 	}
740 
741 	return 0;
742 }
743 
744 static void
745 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
746 {
747 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
748 	struct bss_info_omac *omac;
749 	struct tlv *tlv;
750 	u32 type = 0;
751 	u8 idx;
752 
753 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
754 
755 	switch (vif->type) {
756 	case NL80211_IFTYPE_MONITOR:
757 	case NL80211_IFTYPE_MESH_POINT:
758 	case NL80211_IFTYPE_AP:
759 		type = CONNECTION_INFRA_AP;
760 		break;
761 	case NL80211_IFTYPE_STATION:
762 		type = CONNECTION_INFRA_STA;
763 		break;
764 	case NL80211_IFTYPE_ADHOC:
765 		type = CONNECTION_IBSS_ADHOC;
766 		break;
767 	default:
768 		WARN_ON(1);
769 		break;
770 	}
771 
772 	omac = (struct bss_info_omac *)tlv;
773 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
774 	omac->conn_type = cpu_to_le32(type);
775 	omac->omac_idx = mvif->omac_idx;
776 	omac->band_idx = mvif->band_idx;
777 	omac->hw_bss_idx = idx;
778 }
779 
780 struct mt7915_he_obss_narrow_bw_ru_data {
781 	bool tolerated;
782 };
783 
784 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
785 						   struct cfg80211_bss *bss,
786 						   void *_data)
787 {
788 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
789 	const struct element *elem;
790 
791 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
792 
793 	if (!elem || elem->datalen < 10 ||
794 	    !(elem->data[10] &
795 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
796 		data->tolerated = false;
797 }
798 
799 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
800 					      struct ieee80211_vif *vif)
801 {
802 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
803 		.tolerated = true,
804 	};
805 
806 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
807 		return false;
808 
809 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
810 			  mt7915_check_he_obss_narrow_bw_ru_iter,
811 			  &iter_data);
812 
813 	/*
814 	 * If there is at least one AP on radar channel that cannot
815 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
816 	 */
817 	return !iter_data.tolerated;
818 }
819 
820 static void
821 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
822 			struct mt7915_phy *phy)
823 {
824 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
825 	struct bss_info_rf_ch *ch;
826 	struct tlv *tlv;
827 	int freq1 = chandef->center_freq1;
828 
829 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
830 
831 	ch = (struct bss_info_rf_ch *)tlv;
832 	ch->pri_ch = chandef->chan->hw_value;
833 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
834 	ch->bw = mt7915_mcu_chan_bw(chandef);
835 
836 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
837 		int freq2 = chandef->center_freq2;
838 
839 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
840 	}
841 
842 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
843 		struct mt7915_dev *dev = phy->dev;
844 		struct mt76_phy *mphy = &dev->mt76.phy;
845 		bool ext_phy = phy != &dev->phy;
846 
847 		if (ext_phy && dev->mt76.phy2)
848 			mphy = dev->mt76.phy2;
849 
850 		ch->he_ru26_block =
851 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
852 		ch->he_all_disable = false;
853 	} else {
854 		ch->he_all_disable = true;
855 	}
856 }
857 
858 static void
859 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
860 		      struct mt7915_phy *phy)
861 {
862 	int max_nss = hweight8(phy->mt76->chainmask);
863 	struct bss_info_ra *ra;
864 	struct tlv *tlv;
865 
866 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
867 
868 	ra = (struct bss_info_ra *)tlv;
869 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
870 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
871 	ra->short_preamble = true;
872 	ra->tx_streams = max_nss;
873 	ra->rx_streams = max_nss;
874 	ra->algo = 4;
875 	ra->train_up_rule = 2;
876 	ra->train_up_high_thres = 110;
877 	ra->train_up_rule_rssi = -70;
878 	ra->low_traffic_thres = 2;
879 	ra->phy_cap = cpu_to_le32(0xfdf);
880 	ra->interval = cpu_to_le32(500);
881 	ra->fast_interval = cpu_to_le32(100);
882 }
883 
884 static void
885 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
886 		      struct mt7915_phy *phy)
887 {
888 #define DEFAULT_HE_PE_DURATION		4
889 #define DEFAULT_HE_DURATION_RTS_THRES	1023
890 	const struct ieee80211_sta_he_cap *cap;
891 	struct bss_info_he *he;
892 	struct tlv *tlv;
893 
894 	cap = mt7915_get_he_phy_cap(phy, vif);
895 
896 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
897 
898 	he = (struct bss_info_he *)tlv;
899 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
900 	if (!he->he_pe_duration)
901 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
902 
903 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
904 	if (!he->he_rts_thres)
905 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
906 
907 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
908 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
909 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
910 }
911 
912 static void
913 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
914 {
915 #define TXD_CMP_MAP1		GENMASK(15, 0)
916 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
917 	struct bss_info_hw_amsdu *amsdu;
918 	struct tlv *tlv;
919 
920 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
921 
922 	amsdu = (struct bss_info_hw_amsdu *)tlv;
923 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
924 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
925 	amsdu->trig_thres = cpu_to_le16(2);
926 	amsdu->enable = true;
927 }
928 
929 static void
930 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
931 {
932 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
933 #define BCN_TX_ESTIMATE_TIME	(4096 + 20)
934 	struct bss_info_ext_bss *ext;
935 	int ext_bss_idx, tsf_offset;
936 	struct tlv *tlv;
937 
938 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
939 	if (ext_bss_idx < 0)
940 		return;
941 
942 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
943 
944 	ext = (struct bss_info_ext_bss *)tlv;
945 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
946 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
947 }
948 
949 static void
950 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
951 {
952 	struct bss_info_bmc_rate *bmc;
953 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
954 	enum nl80211_band band = chandef->chan->band;
955 	struct tlv *tlv;
956 
957 	tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
958 
959 	bmc = (struct bss_info_bmc_rate *)tlv;
960 	if (band == NL80211_BAND_2GHZ) {
961 		bmc->short_preamble = true;
962 	} else {
963 		bmc->bc_trans = cpu_to_le16(0x2000);
964 		bmc->mc_trans = cpu_to_le16(0x2080);
965 	}
966 }
967 
968 static int
969 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
970 		       bool bssid, bool enable)
971 {
972 	struct mt7915_dev *dev = phy->dev;
973 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
974 	u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
975 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
976 	const u8 *addr = vif->addr;
977 	struct {
978 		u8 mode;
979 		u8 force_clear;
980 		u8 clear_bitmap[8];
981 		u8 entry_count;
982 		u8 write;
983 		u8 band;
984 
985 		u8 index;
986 		u8 bssid;
987 		u8 addr[ETH_ALEN];
988 	} __packed req = {
989 		.mode = !!mask || enable,
990 		.entry_count = 1,
991 		.write = 1,
992 		.band = phy != &dev->phy,
993 		.index = idx * 2 + bssid,
994 	};
995 
996 	if (bssid)
997 		addr = vif->bss_conf.bssid;
998 
999 	if (enable)
1000 		ether_addr_copy(req.addr, addr);
1001 
1002 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
1003 				 sizeof(req), true);
1004 }
1005 
1006 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1007 			    struct ieee80211_vif *vif, int enable)
1008 {
1009 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1010 	struct sk_buff *skb;
1011 
1012 	if (mvif->omac_idx >= REPEATER_BSSID_START) {
1013 		mt7915_mcu_muar_config(phy, vif, false, enable);
1014 		mt7915_mcu_muar_config(phy, vif, true, enable);
1015 	}
1016 
1017 	skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1018 				       MT7915_BSS_UPDATE_MAX_SIZE);
1019 	if (IS_ERR(skb))
1020 		return PTR_ERR(skb);
1021 
1022 	/* bss_omac must be first */
1023 	if (enable)
1024 		mt7915_mcu_bss_omac_tlv(skb, vif);
1025 
1026 	mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1027 
1028 	if (vif->type == NL80211_IFTYPE_MONITOR)
1029 		goto out;
1030 
1031 	if (enable) {
1032 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1033 		mt7915_mcu_bss_bmc_tlv(skb, phy);
1034 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1035 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
1036 
1037 		if (vif->bss_conf.he_support)
1038 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
1039 
1040 		if (mvif->omac_idx >= EXT_BSSID_START &&
1041 		    mvif->omac_idx < REPEATER_BSSID_START)
1042 			mt7915_mcu_bss_ext_tlv(skb, mvif);
1043 	}
1044 out:
1045 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1046 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1047 }
1048 
1049 /** starec & wtbl **/
1050 static int
1051 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1052 		       struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1053 {
1054 	struct mt7915_sta_key_conf *bip = &msta->bip;
1055 	struct sta_rec_sec *sec;
1056 	struct tlv *tlv;
1057 	u32 len = sizeof(*sec);
1058 
1059 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1060 
1061 	sec = (struct sta_rec_sec *)tlv;
1062 	sec->add = cmd;
1063 
1064 	if (cmd == SET_KEY) {
1065 		struct sec_key *sec_key;
1066 		u8 cipher;
1067 
1068 		cipher = mt7915_mcu_get_cipher(key->cipher);
1069 		if (cipher == MT_CIPHER_NONE)
1070 			return -EOPNOTSUPP;
1071 
1072 		sec_key = &sec->key[0];
1073 		sec_key->cipher_len = sizeof(*sec_key);
1074 
1075 		if (cipher == MT_CIPHER_BIP_CMAC_128) {
1076 			sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1077 			sec_key->key_id = bip->keyidx;
1078 			sec_key->key_len = 16;
1079 			memcpy(sec_key->key, bip->key, 16);
1080 
1081 			sec_key = &sec->key[1];
1082 			sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1083 			sec_key->cipher_len = sizeof(*sec_key);
1084 			sec_key->key_len = 16;
1085 			memcpy(sec_key->key, key->key, 16);
1086 
1087 			sec->n_cipher = 2;
1088 		} else {
1089 			sec_key->cipher_id = cipher;
1090 			sec_key->key_id = key->keyidx;
1091 			sec_key->key_len = key->keylen;
1092 			memcpy(sec_key->key, key->key, key->keylen);
1093 
1094 			if (cipher == MT_CIPHER_TKIP) {
1095 				/* Rx/Tx MIC keys are swapped */
1096 				memcpy(sec_key->key + 16, key->key + 24, 8);
1097 				memcpy(sec_key->key + 24, key->key + 16, 8);
1098 			}
1099 
1100 			/* store key_conf for BIP batch update */
1101 			if (cipher == MT_CIPHER_AES_CCMP) {
1102 				memcpy(bip->key, key->key, key->keylen);
1103 				bip->keyidx = key->keyidx;
1104 			}
1105 
1106 			len -= sizeof(*sec_key);
1107 			sec->n_cipher = 1;
1108 		}
1109 	} else {
1110 		len -= sizeof(sec->key);
1111 		sec->n_cipher = 0;
1112 	}
1113 	sec->len = cpu_to_le16(len);
1114 
1115 	return 0;
1116 }
1117 
1118 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1119 		       struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1120 		       enum set_key_cmd cmd)
1121 {
1122 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1123 	struct sk_buff *skb;
1124 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1125 	int ret;
1126 
1127 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1128 	if (IS_ERR(skb))
1129 		return PTR_ERR(skb);
1130 
1131 	ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1132 	if (ret)
1133 		return ret;
1134 
1135 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1136 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1137 }
1138 
1139 static void
1140 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1141 		      struct ieee80211_ampdu_params *params,
1142 		      bool enable, bool tx)
1143 {
1144 	struct sta_rec_ba *ba;
1145 	struct tlv *tlv;
1146 
1147 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1148 
1149 	ba = (struct sta_rec_ba *)tlv;
1150 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1151 	ba->winsize = cpu_to_le16(params->buf_size);
1152 	ba->ssn = cpu_to_le16(params->ssn);
1153 	ba->ba_en = enable << params->tid;
1154 	ba->amsdu = params->amsdu;
1155 	ba->tid = params->tid;
1156 }
1157 
1158 static void
1159 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1160 		       struct ieee80211_ampdu_params *params,
1161 		       bool enable, bool tx, void *sta_wtbl,
1162 		       void *wtbl_tlv)
1163 {
1164 	struct wtbl_ba *ba;
1165 	struct tlv *tlv;
1166 
1167 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1168 					wtbl_tlv, sta_wtbl);
1169 
1170 	ba = (struct wtbl_ba *)tlv;
1171 	ba->tid = params->tid;
1172 
1173 	if (tx) {
1174 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1175 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1176 		ba->ba_en = enable;
1177 	} else {
1178 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1179 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1180 		ba->rst_ba_tid = params->tid;
1181 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1182 		ba->rst_ba_sb = 1;
1183 	}
1184 
1185 	if (enable && tx)
1186 		ba->ba_winsize = cpu_to_le16(params->buf_size);
1187 }
1188 
1189 static int
1190 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1191 		  struct ieee80211_ampdu_params *params,
1192 		  bool enable, bool tx)
1193 {
1194 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1195 	struct mt7915_vif *mvif = msta->vif;
1196 	struct wtbl_req_hdr *wtbl_hdr;
1197 	struct tlv *sta_wtbl;
1198 	struct sk_buff *skb;
1199 	int ret;
1200 
1201 	if (enable && tx && !params->amsdu)
1202 		msta->wcid.amsdu = false;
1203 
1204 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1205 				       MT7915_STA_UPDATE_MAX_SIZE);
1206 	if (IS_ERR(skb))
1207 		return PTR_ERR(skb);
1208 
1209 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1210 
1211 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1212 					     &skb);
1213 	if (IS_ERR(wtbl_hdr))
1214 		return PTR_ERR(wtbl_hdr);
1215 
1216 	mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1217 
1218 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1219 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1220 	if (ret)
1221 		return ret;
1222 
1223 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1224 				       MT7915_STA_UPDATE_MAX_SIZE);
1225 	if (IS_ERR(skb))
1226 		return PTR_ERR(skb);
1227 
1228 	mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1229 
1230 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1231 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1232 }
1233 
1234 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1235 			 struct ieee80211_ampdu_params *params,
1236 			 bool enable)
1237 {
1238 	return mt7915_mcu_sta_ba(dev, params, enable, true);
1239 }
1240 
1241 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1242 			 struct ieee80211_ampdu_params *params,
1243 			 bool enable)
1244 {
1245 	return mt7915_mcu_sta_ba(dev, params, enable, false);
1246 }
1247 
1248 static void
1249 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1250 			    struct ieee80211_sta *sta, void *sta_wtbl,
1251 			    void *wtbl_tlv)
1252 {
1253 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1254 	struct wtbl_generic *generic;
1255 	struct wtbl_rx *rx;
1256 	struct tlv *tlv;
1257 
1258 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1259 					wtbl_tlv, sta_wtbl);
1260 
1261 	generic = (struct wtbl_generic *)tlv;
1262 
1263 	if (sta) {
1264 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1265 		generic->partial_aid = cpu_to_le16(sta->aid);
1266 		generic->muar_idx = mvif->omac_idx;
1267 		generic->qos = sta->wme;
1268 	} else {
1269 		/* use BSSID in station mode */
1270 		if (vif->type == NL80211_IFTYPE_STATION)
1271 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
1272 			       ETH_ALEN);
1273 		else
1274 			eth_broadcast_addr(generic->peer_addr);
1275 
1276 		generic->muar_idx = 0xe;
1277 	}
1278 
1279 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1280 					wtbl_tlv, sta_wtbl);
1281 
1282 	rx = (struct wtbl_rx *)tlv;
1283 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1284 	rx->rca2 = 1;
1285 	rx->rv = 1;
1286 }
1287 
1288 static void
1289 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1290 			 struct ieee80211_sta *sta, bool enable)
1291 {
1292 #define EXTRA_INFO_VER          BIT(0)
1293 #define EXTRA_INFO_NEW          BIT(1)
1294 	struct sta_rec_basic *basic;
1295 	struct tlv *tlv;
1296 
1297 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1298 
1299 	basic = (struct sta_rec_basic *)tlv;
1300 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1301 
1302 	if (enable) {
1303 		basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1304 		basic->conn_state = CONN_STATE_PORT_SECURE;
1305 	} else {
1306 		basic->conn_state = CONN_STATE_DISCONNECT;
1307 	}
1308 
1309 	if (!sta) {
1310 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1311 		eth_broadcast_addr(basic->peer_addr);
1312 		return;
1313 	}
1314 
1315 	switch (vif->type) {
1316 	case NL80211_IFTYPE_MESH_POINT:
1317 	case NL80211_IFTYPE_AP:
1318 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1319 		break;
1320 	case NL80211_IFTYPE_STATION:
1321 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1322 		break;
1323 	case NL80211_IFTYPE_ADHOC:
1324 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1325 		break;
1326 	default:
1327 		WARN_ON(1);
1328 		break;
1329 	}
1330 
1331 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1332 	basic->aid = cpu_to_le16(sta->aid);
1333 	basic->qos = sta->wme;
1334 }
1335 
1336 static void
1337 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1338 {
1339 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1340 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1341 	struct sta_rec_he *he;
1342 	struct tlv *tlv;
1343 	u32 cap = 0;
1344 
1345 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1346 
1347 	he = (struct sta_rec_he *)tlv;
1348 
1349 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1350 		cap |= STA_REC_HE_CAP_HTC;
1351 
1352 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1353 		cap |= STA_REC_HE_CAP_BSR;
1354 
1355 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1356 		cap |= STA_REC_HE_CAP_OM;
1357 
1358 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
1359 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1360 
1361 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1362 		cap |= STA_REC_HE_CAP_BQR;
1363 
1364 	if (elem->phy_cap_info[0] &
1365 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1366 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1367 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1368 
1369 	if (elem->phy_cap_info[1] &
1370 	    IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1371 		cap |= STA_REC_HE_CAP_LDPC;
1372 
1373 	if (elem->phy_cap_info[1] &
1374 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1375 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1376 
1377 	if (elem->phy_cap_info[2] &
1378 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1379 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1380 
1381 	if (elem->phy_cap_info[2] &
1382 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1383 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1384 
1385 	if (elem->phy_cap_info[2] &
1386 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1387 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1388 
1389 	if (elem->phy_cap_info[6] &
1390 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1391 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1392 
1393 	if (elem->phy_cap_info[7] &
1394 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1395 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1396 
1397 	if (elem->phy_cap_info[7] &
1398 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1399 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1400 
1401 	if (elem->phy_cap_info[7] &
1402 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1403 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1404 
1405 	if (elem->phy_cap_info[8] &
1406 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1407 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1408 
1409 	if (elem->phy_cap_info[8] &
1410 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1411 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1412 
1413 	if (elem->phy_cap_info[9] &
1414 	    IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1415 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1416 
1417 	if (elem->phy_cap_info[9] &
1418 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1419 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1420 
1421 	if (elem->phy_cap_info[9] &
1422 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1423 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1424 
1425 	he->he_cap = cpu_to_le32(cap);
1426 
1427 	switch (sta->bandwidth) {
1428 	case IEEE80211_STA_RX_BW_160:
1429 		if (elem->phy_cap_info[0] &
1430 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1431 			he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1432 				he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1433 
1434 		he->max_nss_mcs[CMD_HE_MCS_BW160] =
1435 				he_cap->he_mcs_nss_supp.rx_mcs_160;
1436 		fallthrough;
1437 	default:
1438 		he->max_nss_mcs[CMD_HE_MCS_BW80] =
1439 				he_cap->he_mcs_nss_supp.rx_mcs_80;
1440 		break;
1441 	}
1442 
1443 	he->t_frame_dur =
1444 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1445 	he->max_ampdu_exp =
1446 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1447 
1448 	he->bw_set =
1449 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1450 	he->device_class =
1451 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1452 	he->punc_pream_rx =
1453 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1454 
1455 	he->dcm_tx_mode =
1456 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1457 	he->dcm_tx_max_nss =
1458 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1459 	he->dcm_rx_mode =
1460 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1461 	he->dcm_rx_max_nss =
1462 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1463 	he->dcm_rx_max_nss =
1464 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1465 
1466 	he->pkt_ext = 2;
1467 }
1468 
1469 static void
1470 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1471 		     struct ieee80211_vif *vif)
1472 {
1473 	struct sta_rec_uapsd *uapsd;
1474 	struct tlv *tlv;
1475 
1476 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1477 		return;
1478 
1479 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1480 	uapsd = (struct sta_rec_uapsd *)tlv;
1481 
1482 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1483 		uapsd->dac_map |= BIT(3);
1484 		uapsd->tac_map |= BIT(3);
1485 	}
1486 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1487 		uapsd->dac_map |= BIT(2);
1488 		uapsd->tac_map |= BIT(2);
1489 	}
1490 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1491 		uapsd->dac_map |= BIT(1);
1492 		uapsd->tac_map |= BIT(1);
1493 	}
1494 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1495 		uapsd->dac_map |= BIT(0);
1496 		uapsd->tac_map |= BIT(0);
1497 	}
1498 	uapsd->max_sp = sta->max_sp;
1499 }
1500 
1501 static void
1502 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1503 {
1504 	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1505 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1506 	struct sta_rec_muru *muru;
1507 	struct tlv *tlv;
1508 
1509 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1510 
1511 	muru = (struct sta_rec_muru *)tlv;
1512 	muru->cfg.ofdma_dl_en = true;
1513 	muru->cfg.mimo_dl_en = true;
1514 
1515 	muru->ofdma_dl.punc_pream_rx =
1516 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1517 	muru->ofdma_dl.he_20m_in_40m_2g =
1518 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1519 	muru->ofdma_dl.he_20m_in_160m =
1520 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1521 	muru->ofdma_dl.he_80m_in_160m =
1522 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1523 	muru->ofdma_dl.lt16_sigb = 0;
1524 	muru->ofdma_dl.rx_su_comp_sigb = 0;
1525 	muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1526 
1527 	muru->ofdma_ul.t_frame_dur =
1528 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1529 	muru->ofdma_ul.mu_cascading =
1530 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1531 	muru->ofdma_ul.uo_ra =
1532 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1533 	muru->ofdma_ul.he_2x996_tone = 0;
1534 	muru->ofdma_ul.rx_t_frame_11ac = 0;
1535 
1536 	muru->mimo_dl.vht_mu_bfee =
1537 		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1538 	muru->mimo_dl.partial_bw_dl_mimo =
1539 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1540 
1541 	muru->mimo_ul.full_ul_mimo =
1542 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1543 	muru->mimo_ul.partial_ul_mimo =
1544 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1545 }
1546 
1547 static int
1548 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1549 		  struct ieee80211_sta *sta)
1550 {
1551 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1552 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1553 	struct sk_buff *skb;
1554 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1555 
1556 	if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1557 		return 0;
1558 
1559 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1560 	if (IS_ERR(skb))
1561 		return PTR_ERR(skb);
1562 
1563 	/* starec muru */
1564 	mt7915_mcu_sta_muru_tlv(skb, sta);
1565 
1566 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1567 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1568 }
1569 
1570 static void
1571 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1572 {
1573 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1574 	struct sta_rec_amsdu *amsdu;
1575 	struct tlv *tlv;
1576 
1577 	if (!sta->max_amsdu_len)
1578 	    return;
1579 
1580 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1581 	amsdu = (struct sta_rec_amsdu *)tlv;
1582 	amsdu->max_amsdu_num = 8;
1583 	amsdu->amsdu_en = true;
1584 	amsdu->max_mpdu_size = sta->max_amsdu_len >=
1585 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
1586 	msta->wcid.amsdu = true;
1587 }
1588 
1589 static bool
1590 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1591 {
1592 	switch (vif->type) {
1593 	case NL80211_IFTYPE_AP:
1594 	case NL80211_IFTYPE_STATION:
1595 		return true;
1596 	default:
1597 		return false;
1598 	}
1599 }
1600 
1601 static void
1602 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1603 		   struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1604 {
1605 	struct tlv *tlv;
1606 
1607 	/* starec ht */
1608 	if (sta->ht_cap.ht_supported) {
1609 		struct sta_rec_ht *ht;
1610 
1611 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1612 		ht = (struct sta_rec_ht *)tlv;
1613 		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1614 
1615 		if (mt7915_hw_amsdu_supported(vif))
1616 			mt7915_mcu_sta_amsdu_tlv(skb, sta);
1617 	}
1618 
1619 	/* starec vht */
1620 	if (sta->vht_cap.vht_supported) {
1621 		struct sta_rec_vht *vht;
1622 
1623 		tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1624 		vht = (struct sta_rec_vht *)tlv;
1625 		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1626 		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1627 		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1628 	}
1629 
1630 	/* starec he */
1631 	if (sta->he_cap.has_he)
1632 		mt7915_mcu_sta_he_tlv(skb, sta);
1633 
1634 	/* starec uapsd */
1635 	mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1636 }
1637 
1638 static void
1639 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1640 			 void *sta_wtbl, void *wtbl_tlv)
1641 {
1642 	struct wtbl_smps *smps;
1643 	struct tlv *tlv;
1644 
1645 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1646 					wtbl_tlv, sta_wtbl);
1647 	smps = (struct wtbl_smps *)tlv;
1648 
1649 	if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1650 		smps->smps = true;
1651 }
1652 
1653 static void
1654 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1655 		       void *sta_wtbl, void *wtbl_tlv)
1656 {
1657 	struct wtbl_ht *ht = NULL;
1658 	struct tlv *tlv;
1659 
1660 	/* wtbl ht */
1661 	if (sta->ht_cap.ht_supported) {
1662 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1663 						wtbl_tlv, sta_wtbl);
1664 		ht = (struct wtbl_ht *)tlv;
1665 		ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1666 		ht->af = sta->ht_cap.ampdu_factor;
1667 		ht->mm = sta->ht_cap.ampdu_density;
1668 		ht->ht = true;
1669 	}
1670 
1671 	/* wtbl vht */
1672 	if (sta->vht_cap.vht_supported) {
1673 		struct wtbl_vht *vht;
1674 		u8 af;
1675 
1676 		tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1677 						wtbl_tlv, sta_wtbl);
1678 		vht = (struct wtbl_vht *)tlv;
1679 		vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1680 		vht->vht = true;
1681 
1682 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1683 			       sta->vht_cap.cap);
1684 		if (ht)
1685 			ht->af = max_t(u8, ht->af, af);
1686 	}
1687 
1688 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1689 }
1690 
1691 static void
1692 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1693 			      struct ieee80211_sta *sta,
1694 			      void *sta_wtbl, void *wtbl_tlv)
1695 {
1696 	struct mt7915_sta *msta;
1697 	struct wtbl_hdr_trans *htr = NULL;
1698 	struct tlv *tlv;
1699 
1700 	tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1701 					wtbl_tlv, sta_wtbl);
1702 	htr = (struct wtbl_hdr_trans *)tlv;
1703 	htr->no_rx_trans = true;
1704 	if (vif->type == NL80211_IFTYPE_STATION)
1705 		htr->to_ds = true;
1706 	else
1707 		htr->from_ds = true;
1708 
1709 	if (!sta)
1710 		return;
1711 
1712 	msta = (struct mt7915_sta *)sta->drv_priv;
1713 	htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
1714 	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1715 		htr->to_ds = true;
1716 		htr->from_ds = true;
1717 	}
1718 }
1719 
1720 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1721 				    struct ieee80211_vif *vif,
1722 				    struct ieee80211_sta *sta)
1723 {
1724 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1725 	struct wtbl_req_hdr *wtbl_hdr;
1726 	struct sk_buff *skb;
1727 
1728 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1729 	if (!skb)
1730 		return -ENOMEM;
1731 
1732 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1733 	if (IS_ERR(wtbl_hdr))
1734 		return PTR_ERR(wtbl_hdr);
1735 
1736 	mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1737 
1738 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1739 				     true);
1740 }
1741 
1742 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1743 			struct ieee80211_sta *sta)
1744 {
1745 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1746 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1747 	struct wtbl_req_hdr *wtbl_hdr;
1748 	struct tlv *sta_wtbl;
1749 	struct sk_buff *skb;
1750 
1751 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1752 				       MT7915_STA_UPDATE_MAX_SIZE);
1753 	if (IS_ERR(skb))
1754 		return PTR_ERR(skb);
1755 
1756 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1757 
1758 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1759 					     &skb);
1760 	if (IS_ERR(wtbl_hdr))
1761 		return PTR_ERR(wtbl_hdr);
1762 
1763 	mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1764 
1765 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1766 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1767 }
1768 
1769 static void
1770 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1771 {
1772 	bf->bf_cap = MT_EBF;
1773 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1774 	bf->ndp_rate = 0;				/* mcs0 */
1775 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1776 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1777 }
1778 
1779 static void
1780 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1781 		       struct sta_rec_bf *bf)
1782 {
1783 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1784 	u8 n = 0;
1785 
1786 	bf->tx_mode = MT_PHY_TYPE_HT;
1787 	bf->bf_cap = MT_IBF;
1788 
1789 	if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1790 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1791 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1792 			      mcs->tx_params);
1793 	else if (mcs->rx_mask[3])
1794 		n = 3;
1795 	else if (mcs->rx_mask[2])
1796 		n = 2;
1797 	else if (mcs->rx_mask[1])
1798 		n = 1;
1799 
1800 	bf->nr = hweight8(phy->mt76->chainmask) - 1;
1801 	bf->nc = min_t(u8, bf->nr, n);
1802 	bf->ibf_ncol = n;
1803 }
1804 
1805 static void
1806 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1807 			struct sta_rec_bf *bf, bool explicit)
1808 {
1809 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1810 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1811 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1812 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1813 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1814 
1815 	bf->tx_mode = MT_PHY_TYPE_VHT;
1816 
1817 	if (explicit) {
1818 		u8 bfee_nr, bfer_nr;
1819 
1820 		mt7915_mcu_sta_sounding_rate(bf);
1821 		bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1822 				    pc->cap);
1823 		bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1824 				    vc->cap);
1825 		bf->nr = min_t(u8, min_t(u8, bfer_nr, bfee_nr), tx_ant);
1826 		bf->nc = min_t(u8, nss_mcs, bf->nr);
1827 		bf->ibf_ncol = bf->nc;
1828 
1829 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1830 			bf->nr = 1;
1831 	} else {
1832 		bf->bf_cap = MT_IBF;
1833 		bf->nr = tx_ant;
1834 		bf->nc = min_t(u8, nss_mcs, bf->nr);
1835 		bf->ibf_ncol = nss_mcs;
1836 
1837 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1838 			bf->ibf_nrow = 1;
1839 	}
1840 }
1841 
1842 static void
1843 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1844 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1845 {
1846 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1847 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1848 	const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1849 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1850 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1851 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1852 	u8 bfee_nr, bfer_nr;
1853 
1854 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1855 	mt7915_mcu_sta_sounding_rate(bf);
1856 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1857 				pe->phy_cap_info[6]);
1858 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1859 				pe->phy_cap_info[6]);
1860 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1861 			 ve->phy_cap_info[5]);
1862 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1863 			 pe->phy_cap_info[4]);
1864 	bf->nr = min_t(u8, bfer_nr, bfee_nr);
1865 	bf->nc = min_t(u8, nss_mcs, bf->nr);
1866 	bf->ibf_ncol = bf->nc;
1867 
1868 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1869 		return;
1870 
1871 	/* go over for 160MHz and 80p80 */
1872 	if (pe->phy_cap_info[0] &
1873 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1874 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1875 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1876 
1877 		bf->nc_bw160 = nss_mcs;
1878 	}
1879 
1880 	if (pe->phy_cap_info[0] &
1881 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1882 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1883 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1884 
1885 		if (bf->nc_bw160)
1886 			bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1887 		else
1888 			bf->nc_bw160 = nss_mcs;
1889 	}
1890 
1891 	bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1892 			 ve->phy_cap_info[5]);
1893 	bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1894 			 pe->phy_cap_info[4]);
1895 
1896 	bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1897 }
1898 
1899 static void
1900 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1901 			struct ieee80211_vif *vif, struct mt7915_phy *phy,
1902 			bool enable, bool explicit)
1903 {
1904 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1905 	struct sta_rec_bf *bf;
1906 	struct tlv *tlv;
1907 	const u8 matrix[4][4] = {
1908 		{0, 0, 0, 0},
1909 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1910 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1911 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1912 	};
1913 
1914 #define MT_BFER_FREE		cpu_to_le16(GENMASK(15, 0))
1915 
1916 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1917 	bf = (struct sta_rec_bf *)tlv;
1918 
1919 	if (!enable) {
1920 		bf->pfmu = MT_BFER_FREE;
1921 		return;
1922 	}
1923 
1924 	/* he: eBF only, in accordance with spec
1925 	 * vht: support eBF and iBF
1926 	 * ht: iBF only, since mac80211 lacks of eBF support
1927 	 */
1928 	if (sta->he_cap.has_he && explicit)
1929 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1930 	else if (sta->vht_cap.vht_supported)
1931 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, explicit);
1932 	else if (sta->ht_cap.ht_supported)
1933 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1934 	else
1935 		return;
1936 
1937 	bf->bw = sta->bandwidth;
1938 	bf->ibf_dbw = sta->bandwidth;
1939 	bf->ibf_nrow = tx_ant;
1940 
1941 	if (!explicit && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1942 		bf->ibf_timeout = 0x48;
1943 	else
1944 		bf->ibf_timeout = 0x18;
1945 
1946 	if (explicit && bf->nr != tx_ant)
1947 		bf->mem_20m = matrix[tx_ant][bf->nc];
1948 	else
1949 		bf->mem_20m = matrix[bf->nr][bf->nc];
1950 
1951 	switch (sta->bandwidth) {
1952 	case IEEE80211_STA_RX_BW_160:
1953 	case IEEE80211_STA_RX_BW_80:
1954 		bf->mem_total = bf->mem_20m * 2;
1955 		break;
1956 	case IEEE80211_STA_RX_BW_40:
1957 		bf->mem_total = bf->mem_20m;
1958 		break;
1959 	case IEEE80211_STA_RX_BW_20:
1960 	default:
1961 		break;
1962 	}
1963 }
1964 
1965 static void
1966 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1967 			struct mt7915_phy *phy)
1968 {
1969 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1970 	struct sta_rec_bfee *bfee;
1971 	struct tlv *tlv;
1972 	u8 nr = 0;
1973 
1974 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1975 	bfee = (struct sta_rec_bfee *)tlv;
1976 
1977 	if (sta->he_cap.has_he) {
1978 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1979 
1980 		nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1981 			    pe->phy_cap_info[5]);
1982 	} else if (sta->vht_cap.vht_supported) {
1983 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1984 
1985 		nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1986 			       pc->cap);
1987 	}
1988 
1989 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1990 	bfee->fb_identity_matrix = !!(nr == 1 && tx_ant == 2);
1991 }
1992 
1993 static int
1994 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1995 		    struct ieee80211_sta *sta, bool enable)
1996 {
1997 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1998 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1999 	struct mt7915_phy *phy;
2000 	struct sk_buff *skb;
2001 	int r, len;
2002 	bool ebfee = 0, ebf = 0;
2003 
2004 	if (vif->type != NL80211_IFTYPE_STATION &&
2005 	    vif->type != NL80211_IFTYPE_AP)
2006 		return 0;
2007 
2008 	phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2009 
2010 	if (sta->he_cap.has_he) {
2011 		struct ieee80211_he_cap_elem *pe;
2012 		const struct ieee80211_he_cap_elem *ve;
2013 		const struct ieee80211_sta_he_cap *vc;
2014 
2015 		pe = &sta->he_cap.he_cap_elem;
2016 		vc = mt7915_get_he_phy_cap(phy, vif);
2017 		ve = &vc->he_cap_elem;
2018 
2019 		ebfee = !!((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
2020 			    HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
2021 			   HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]));
2022 		ebf = !!((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
2023 			  HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
2024 			 HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]));
2025 	} else if (sta->vht_cap.vht_supported) {
2026 		struct ieee80211_sta_vht_cap *pc;
2027 		struct ieee80211_sta_vht_cap *vc;
2028 		u32 cr, ce;
2029 
2030 		pc = &sta->vht_cap;
2031 		vc = &phy->mt76->sband_5g.sband.vht_cap;
2032 		cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2033 		     IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
2034 		ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2035 		     IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
2036 
2037 		ebfee = !!((pc->cap & cr) && (vc->cap & ce));
2038 		ebf = !!((vc->cap & cr) && (pc->cap & ce));
2039 	}
2040 
2041 	/* must keep each tag independent */
2042 
2043 	/* starec bf */
2044 	if (ebf || dev->ibf) {
2045 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2046 
2047 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2048 		if (IS_ERR(skb))
2049 			return PTR_ERR(skb);
2050 
2051 		mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable, ebf);
2052 
2053 		r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2054 					  MCU_EXT_CMD(STA_REC_UPDATE), true);
2055 		if (r)
2056 			return r;
2057 	}
2058 
2059 	/* starec bfee */
2060 	if (ebfee) {
2061 		len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2062 
2063 		skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2064 		if (IS_ERR(skb))
2065 			return PTR_ERR(skb);
2066 
2067 		mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2068 
2069 		r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2070 					  MCU_EXT_CMD(STA_REC_UPDATE), true);
2071 		if (r)
2072 			return r;
2073 	}
2074 
2075 	return 0;
2076 }
2077 
2078 static void
2079 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2080 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2081 {
2082 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2083 	struct mt76_phy *mphy = &dev->mphy;
2084 	enum nl80211_band band;
2085 	struct sta_rec_ra *ra;
2086 	struct tlv *tlv;
2087 	u32 supp_rate, n_rates, cap = sta->wme ? STA_CAP_WMM : 0;
2088 	u8 i, nss = sta->rx_nss, mcs = 0;
2089 
2090 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2091 	ra = (struct sta_rec_ra *)tlv;
2092 
2093 	if (msta->wcid.ext_phy && dev->mt76.phy2)
2094 		mphy = dev->mt76.phy2;
2095 
2096 	band = mphy->chandef.chan->band;
2097 	supp_rate = sta->supp_rates[band];
2098 	n_rates = hweight32(supp_rate);
2099 
2100 	ra->valid = true;
2101 	ra->auto_rate = true;
2102 	ra->phy_mode = mt7915_get_phy_mode(mphy, vif, sta);
2103 	ra->channel = mphy->chandef.chan->hw_value;
2104 	ra->bw = sta->bandwidth;
2105 	ra->rate_len = n_rates;
2106 	ra->phy.bw = sta->bandwidth;
2107 
2108 	if (n_rates) {
2109 		if (band == NL80211_BAND_2GHZ) {
2110 			ra->supp_mode = MODE_CCK;
2111 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2112 			ra->phy.type = MT_PHY_TYPE_CCK;
2113 
2114 			if (n_rates > 4) {
2115 				ra->supp_mode |= MODE_OFDM;
2116 				ra->supp_ofdm_rate = supp_rate >> 4;
2117 				ra->phy.type = MT_PHY_TYPE_OFDM;
2118 			}
2119 		} else {
2120 			ra->supp_mode = MODE_OFDM;
2121 			ra->supp_ofdm_rate = supp_rate;
2122 			ra->phy.type = MT_PHY_TYPE_OFDM;
2123 		}
2124 	}
2125 
2126 	if (sta->ht_cap.ht_supported) {
2127 		for (i = 0; i < nss; i++)
2128 			ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2129 
2130 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2131 		ra->supp_mode |= MODE_HT;
2132 		mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2133 		ra->af = sta->ht_cap.ampdu_factor;
2134 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2135 
2136 		cap |= STA_CAP_HT;
2137 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2138 			cap |= STA_CAP_SGI_20;
2139 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2140 			cap |= STA_CAP_SGI_40;
2141 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2142 			cap |= STA_CAP_TX_STBC;
2143 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2144 			cap |= STA_CAP_RX_STBC;
2145 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2146 			cap |= STA_CAP_LDPC;
2147 	}
2148 
2149 	if (sta->vht_cap.vht_supported) {
2150 		u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2151 		u16 vht_mcs;
2152 		u8 af, mcs_prev;
2153 
2154 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2155 			       sta->vht_cap.cap);
2156 		ra->af = max_t(u8, ra->af, af);
2157 
2158 		cap |= STA_CAP_VHT;
2159 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2160 			cap |= STA_CAP_VHT_SGI_80;
2161 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2162 			cap |= STA_CAP_VHT_SGI_160;
2163 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2164 			cap |= STA_CAP_VHT_TX_STBC;
2165 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2166 			cap |= STA_CAP_VHT_RX_STBC;
2167 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2168 			cap |= STA_CAP_VHT_LDPC;
2169 
2170 		ra->supp_mode |= MODE_VHT;
2171 		for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2172 			switch (mcs_map & 0x3) {
2173 			case IEEE80211_VHT_MCS_SUPPORT_0_9:
2174 				vht_mcs = GENMASK(9, 0);
2175 				break;
2176 			case IEEE80211_VHT_MCS_SUPPORT_0_8:
2177 				vht_mcs = GENMASK(8, 0);
2178 				break;
2179 			case IEEE80211_VHT_MCS_SUPPORT_0_7:
2180 				vht_mcs = GENMASK(7, 0);
2181 				break;
2182 			default:
2183 				vht_mcs = 0;
2184 			}
2185 
2186 			ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2187 
2188 			mcs_prev = hweight16(vht_mcs) - 1;
2189 			if (mcs_prev > mcs)
2190 				mcs = mcs_prev;
2191 
2192 			/* only support 2ss on 160MHz */
2193 			if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2194 				      ra->bw == CMD_CBW_8080MHZ))
2195 				break;
2196 		}
2197 	}
2198 
2199 	if (sta->he_cap.has_he) {
2200 		ra->supp_mode |= MODE_HE;
2201 		cap |= STA_CAP_HE;
2202 	}
2203 
2204 	ra->sta_status = cpu_to_le32(cap);
2205 
2206 	switch (BIT(fls(ra->supp_mode) - 1)) {
2207 	case MODE_VHT:
2208 		ra->phy.type = MT_PHY_TYPE_VHT;
2209 		ra->phy.mcs = mcs;
2210 		ra->phy.nss = nss;
2211 		ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2212 		ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2213 		ra->phy.sgi =
2214 			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2215 		break;
2216 	case MODE_HT:
2217 		ra->phy.type = MT_PHY_TYPE_HT;
2218 		ra->phy.mcs = mcs;
2219 		ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2220 		ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2221 		ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2222 		break;
2223 	default:
2224 		break;
2225 	}
2226 }
2227 
2228 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2229 			     struct ieee80211_sta *sta)
2230 {
2231 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2232 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2233 	struct sk_buff *skb;
2234 	int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2235 
2236 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2237 	if (IS_ERR(skb))
2238 		return PTR_ERR(skb);
2239 
2240 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2241 
2242 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2243 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2244 }
2245 
2246 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2247 			   struct ieee80211_sta *sta, bool enable)
2248 {
2249 	int ret;
2250 
2251 	if (!sta)
2252 		return 0;
2253 
2254 	/* must keep the order */
2255 	ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2256 	if (ret)
2257 		return ret;
2258 
2259 	ret = mt7915_mcu_add_mu(dev, vif, sta);
2260 	if (ret)
2261 		return ret;
2262 
2263 	if (enable)
2264 		return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2265 
2266 	return 0;
2267 }
2268 
2269 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2270 		       struct ieee80211_sta *sta, bool enable)
2271 {
2272 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2273 	struct wtbl_req_hdr *wtbl_hdr;
2274 	struct mt7915_sta *msta;
2275 	struct tlv *sta_wtbl;
2276 	struct sk_buff *skb;
2277 
2278 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2279 
2280 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2281 				       MT7915_STA_UPDATE_MAX_SIZE);
2282 	if (IS_ERR(skb))
2283 		return PTR_ERR(skb);
2284 
2285 	mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2286 	if (enable && sta)
2287 		mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2288 
2289 	sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2290 
2291 	wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2292 					     sta_wtbl, &skb);
2293 	if (IS_ERR(wtbl_hdr))
2294 		return PTR_ERR(wtbl_hdr);
2295 
2296 	if (enable) {
2297 		mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2298 		mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2299 		if (sta)
2300 			mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2301 	}
2302 
2303 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2304 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2305 }
2306 
2307 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2308 			      struct ieee80211_sta *sta, u32 rate)
2309 {
2310 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2311 	struct mt7915_vif *mvif = msta->vif;
2312 	struct sta_rec_ra_fixed *ra;
2313 	struct sk_buff *skb;
2314 	struct tlv *tlv;
2315 	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2316 
2317 	skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2318 	if (IS_ERR(skb))
2319 		return PTR_ERR(skb);
2320 
2321 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2322 	ra = (struct sta_rec_ra_fixed *)tlv;
2323 
2324 	if (!rate) {
2325 		ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2326 		goto out;
2327 	} else {
2328 		ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2329 	}
2330 
2331 	ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2332 	ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2333 	ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2334 	ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2335 	ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2336 
2337 	if (ra->phy.bw)
2338 		ra->phy.ldpc = 7;
2339 	else
2340 		ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2341 
2342 	/* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2343 	if (ra->phy.type > MT_PHY_TYPE_VHT)
2344 		ra->phy.sgi = ra->phy.mcs * 85;
2345 	else
2346 		ra->phy.sgi = ra->phy.mcs * 15;
2347 
2348 out:
2349 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2350 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
2351 }
2352 
2353 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2354 			    struct ieee80211_vif *vif, bool enable)
2355 {
2356 	struct mt7915_dev *dev = phy->dev;
2357 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2358 	struct {
2359 		struct req_hdr {
2360 			u8 omac_idx;
2361 			u8 dbdc_idx;
2362 			__le16 tlv_num;
2363 			u8 is_tlv_append;
2364 			u8 rsv[3];
2365 		} __packed hdr;
2366 		struct req_tlv {
2367 			__le16 tag;
2368 			__le16 len;
2369 			u8 active;
2370 			u8 dbdc_idx;
2371 			u8 omac_addr[ETH_ALEN];
2372 		} __packed tlv;
2373 	} data = {
2374 		.hdr = {
2375 			.omac_idx = mvif->omac_idx,
2376 			.dbdc_idx = mvif->band_idx,
2377 			.tlv_num = cpu_to_le16(1),
2378 			.is_tlv_append = 1,
2379 		},
2380 		.tlv = {
2381 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2382 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2383 			.active = enable,
2384 			.dbdc_idx = mvif->band_idx,
2385 		},
2386 	};
2387 
2388 	if (mvif->omac_idx >= REPEATER_BSSID_START)
2389 		return mt7915_mcu_muar_config(phy, vif, false, enable);
2390 
2391 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2392 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2393 				 &data, sizeof(data), true);
2394 }
2395 
2396 static void
2397 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2398 		      struct bss_info_bcn *bcn,
2399 		      struct ieee80211_mutable_offsets *offs)
2400 {
2401 	if (offs->cntdwn_counter_offs[0]) {
2402 		struct tlv *tlv;
2403 		struct bss_info_bcn_csa *csa;
2404 
2405 		tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2406 						   sizeof(*csa), &bcn->sub_ntlv,
2407 						   &bcn->len);
2408 		csa = (struct bss_info_bcn_csa *)tlv;
2409 		csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2410 	}
2411 }
2412 
2413 static void
2414 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2415 		       struct sk_buff *skb, struct bss_info_bcn *bcn,
2416 		       struct ieee80211_mutable_offsets *offs)
2417 {
2418 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2419 	struct bss_info_bcn_cont *cont;
2420 	struct tlv *tlv;
2421 	u8 *buf;
2422 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2423 
2424 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2425 					   len, &bcn->sub_ntlv, &bcn->len);
2426 
2427 	cont = (struct bss_info_bcn_cont *)tlv;
2428 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2429 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2430 
2431 	if (offs->cntdwn_counter_offs[0])
2432 		cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2433 
2434 	buf = (u8 *)tlv + sizeof(*cont);
2435 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2436 			      true);
2437 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2438 }
2439 
2440 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2441 			  struct ieee80211_vif *vif, int en)
2442 {
2443 #define MAX_BEACON_SIZE 512
2444 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2445 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2446 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2447 	struct ieee80211_mutable_offsets offs;
2448 	struct ieee80211_tx_info *info;
2449 	struct sk_buff *skb, *rskb;
2450 	struct tlv *tlv;
2451 	struct bss_info_bcn *bcn;
2452 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2453 
2454 	rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2455 	if (IS_ERR(rskb))
2456 		return PTR_ERR(rskb);
2457 
2458 	tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2459 	bcn = (struct bss_info_bcn *)tlv;
2460 	bcn->enable = en;
2461 
2462 	if (!en)
2463 		goto out;
2464 
2465 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2466 	if (!skb)
2467 		return -EINVAL;
2468 
2469 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2470 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2471 		dev_kfree_skb(skb);
2472 		return -EINVAL;
2473 	}
2474 
2475 	if (mvif->band_idx) {
2476 		info = IEEE80211_SKB_CB(skb);
2477 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2478 	}
2479 
2480 	/* TODO: subtag - bss color count & 11v MBSSID */
2481 	mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2482 	mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2483 	dev_kfree_skb(skb);
2484 
2485 out:
2486 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2487 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2488 }
2489 
2490 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2491 				     u32 option)
2492 {
2493 	struct {
2494 		__le32 option;
2495 		__le32 addr;
2496 	} req = {
2497 		.option = cpu_to_le32(option),
2498 		.addr = cpu_to_le32(addr),
2499 	};
2500 
2501 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2502 				 sizeof(req), true);
2503 }
2504 
2505 static int mt7915_mcu_restart(struct mt76_dev *dev)
2506 {
2507 	struct {
2508 		u8 power_mode;
2509 		u8 rsv[3];
2510 	} req = {
2511 		.power_mode = 1,
2512 	};
2513 
2514 	return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2515 				 sizeof(req), false);
2516 }
2517 
2518 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2519 {
2520 	struct {
2521 		__le32 op;
2522 	} req = {
2523 		.op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2524 	};
2525 
2526 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2527 				 sizeof(req), true);
2528 }
2529 
2530 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2531 {
2532 	struct {
2533 		u8 check_crc;
2534 		u8 reserved[3];
2535 	} req = {
2536 		.check_crc = 0,
2537 	};
2538 
2539 	return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2540 				 sizeof(req), true);
2541 }
2542 
2543 static int mt7915_driver_own(struct mt7915_dev *dev)
2544 {
2545 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_DRV_OWN);
2546 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND0,
2547 			    MT_TOP_LPCR_HOST_FW_OWN, 0, 500)) {
2548 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2549 		return -EIO;
2550 	}
2551 
2552 	return 0;
2553 }
2554 
2555 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2556 				    u32 len, u32 mode)
2557 {
2558 	struct {
2559 		__le32 addr;
2560 		__le32 len;
2561 		__le32 mode;
2562 	} req = {
2563 		.addr = cpu_to_le32(addr),
2564 		.len = cpu_to_le32(len),
2565 		.mode = cpu_to_le32(mode),
2566 	};
2567 	int attr;
2568 
2569 	if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2570 		attr = MCU_CMD(PATCH_START_REQ);
2571 	else
2572 		attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2573 
2574 	return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2575 }
2576 
2577 static int mt7915_load_patch(struct mt7915_dev *dev)
2578 {
2579 	const struct mt7915_patch_hdr *hdr;
2580 	const struct firmware *fw = NULL;
2581 	int i, ret, sem;
2582 
2583 	sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2584 	switch (sem) {
2585 	case PATCH_IS_DL:
2586 		return 0;
2587 	case PATCH_NOT_DL_SEM_SUCCESS:
2588 		break;
2589 	default:
2590 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2591 		return -EAGAIN;
2592 	}
2593 
2594 	ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2595 	if (ret)
2596 		goto out;
2597 
2598 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2599 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2600 		ret = -EINVAL;
2601 		goto out;
2602 	}
2603 
2604 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2605 
2606 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2607 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2608 
2609 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2610 		struct mt7915_patch_sec *sec;
2611 		const u8 *dl;
2612 		u32 len, addr;
2613 
2614 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2615 						  i * sizeof(*sec));
2616 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2617 		    PATCH_SEC_TYPE_INFO) {
2618 			ret = -EINVAL;
2619 			goto out;
2620 		}
2621 
2622 		addr = be32_to_cpu(sec->info.addr);
2623 		len = be32_to_cpu(sec->info.len);
2624 		dl = fw->data + be32_to_cpu(sec->offs);
2625 
2626 		ret = mt7915_mcu_init_download(dev, addr, len,
2627 					       DL_MODE_NEED_RSP);
2628 		if (ret) {
2629 			dev_err(dev->mt76.dev, "Download request failed\n");
2630 			goto out;
2631 		}
2632 
2633 		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2634 					     dl, len);
2635 		if (ret) {
2636 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2637 			goto out;
2638 		}
2639 	}
2640 
2641 	ret = mt7915_mcu_start_patch(dev);
2642 	if (ret)
2643 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2644 
2645 out:
2646 	sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2647 	switch (sem) {
2648 	case PATCH_REL_SEM_SUCCESS:
2649 		break;
2650 	default:
2651 		ret = -EAGAIN;
2652 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2653 		goto out;
2654 	}
2655 	release_firmware(fw);
2656 
2657 	return ret;
2658 }
2659 
2660 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2661 {
2662 	u32 ret = 0;
2663 
2664 	ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2665 	       (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2666 	ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2667 			  FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2668 	ret |= DL_MODE_NEED_RSP;
2669 	ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2670 
2671 	return ret;
2672 }
2673 
2674 static int
2675 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2676 			     const struct mt7915_fw_trailer *hdr,
2677 			     const u8 *data, bool is_wa)
2678 {
2679 	int i, offset = 0;
2680 	u32 override = 0, option = 0;
2681 
2682 	for (i = 0; i < hdr->n_region; i++) {
2683 		const struct mt7915_fw_region *region;
2684 		int err;
2685 		u32 len, addr, mode;
2686 
2687 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2688 			 (hdr->n_region - i) * sizeof(*region));
2689 		mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2690 		len = le32_to_cpu(region->len);
2691 		addr = le32_to_cpu(region->addr);
2692 
2693 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2694 			override = addr;
2695 
2696 		err = mt7915_mcu_init_download(dev, addr, len, mode);
2697 		if (err) {
2698 			dev_err(dev->mt76.dev, "Download request failed\n");
2699 			return err;
2700 		}
2701 
2702 		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2703 					     data + offset, len);
2704 		if (err) {
2705 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2706 			return err;
2707 		}
2708 
2709 		offset += len;
2710 	}
2711 
2712 	if (override)
2713 		option |= FW_START_OVERRIDE;
2714 
2715 	if (is_wa)
2716 		option |= FW_START_WORKING_PDA_CR4;
2717 
2718 	return mt7915_mcu_start_firmware(dev, override, option);
2719 }
2720 
2721 static int mt7915_load_ram(struct mt7915_dev *dev)
2722 {
2723 	const struct mt7915_fw_trailer *hdr;
2724 	const struct firmware *fw;
2725 	int ret;
2726 
2727 	ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2728 	if (ret)
2729 		return ret;
2730 
2731 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2732 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2733 		ret = -EINVAL;
2734 		goto out;
2735 	}
2736 
2737 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2738 					sizeof(*hdr));
2739 
2740 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2741 		 hdr->fw_ver, hdr->build_date);
2742 
2743 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2744 	if (ret) {
2745 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2746 		goto out;
2747 	}
2748 
2749 	release_firmware(fw);
2750 
2751 	ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2752 	if (ret)
2753 		return ret;
2754 
2755 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2756 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2757 		ret = -EINVAL;
2758 		goto out;
2759 	}
2760 
2761 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2762 					sizeof(*hdr));
2763 
2764 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2765 		 hdr->fw_ver, hdr->build_date);
2766 
2767 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2768 	if (ret) {
2769 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2770 		goto out;
2771 	}
2772 
2773 	snprintf(dev->mt76.hw->wiphy->fw_version,
2774 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2775 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2776 
2777 out:
2778 	release_firmware(fw);
2779 
2780 	return ret;
2781 }
2782 
2783 static int mt7915_load_firmware(struct mt7915_dev *dev)
2784 {
2785 	int ret;
2786 
2787 	ret = mt7915_load_patch(dev);
2788 	if (ret)
2789 		return ret;
2790 
2791 	ret = mt7915_load_ram(dev);
2792 	if (ret)
2793 		return ret;
2794 
2795 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2796 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2797 				       FW_STATE_WACPU_RDY), 1000)) {
2798 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2799 		return -EIO;
2800 	}
2801 
2802 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2803 
2804 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2805 
2806 	return 0;
2807 }
2808 
2809 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2810 {
2811 	struct {
2812 		u8 ctrl_val;
2813 		u8 pad[3];
2814 	} data = {
2815 		.ctrl_val = ctrl
2816 	};
2817 
2818 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2819 				 sizeof(data), true);
2820 }
2821 
2822 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2823 {
2824 	struct {
2825 		u8 ver;
2826 		u8 pad;
2827 		__le16 len;
2828 		u8 level;
2829 		u8 rsv[3];
2830 		__le32 module_idx;
2831 	} data = {
2832 		.module_idx = cpu_to_le32(module),
2833 		.level = level,
2834 	};
2835 
2836 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2837 				 sizeof(data), false);
2838 }
2839 
2840 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2841 {
2842 	struct {
2843 		u8 enable;
2844 		u8 _rsv[3];
2845 	} __packed req = {
2846 		.enable = enabled
2847 	};
2848 
2849 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2850 				 sizeof(req), false);
2851 }
2852 
2853 int mt7915_mcu_init(struct mt7915_dev *dev)
2854 {
2855 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2856 		.headroom = sizeof(struct mt7915_mcu_txd),
2857 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2858 		.mcu_parse_response = mt7915_mcu_parse_response,
2859 		.mcu_restart = mt7915_mcu_restart,
2860 	};
2861 	int ret;
2862 
2863 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2864 
2865 	ret = mt7915_driver_own(dev);
2866 	if (ret)
2867 		return ret;
2868 
2869 	ret = mt7915_load_firmware(dev);
2870 	if (ret)
2871 		return ret;
2872 
2873 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2874 	mt7915_mcu_fw_log_2_host(dev, 0);
2875 	mt7915_mcu_set_mwds(dev, 1);
2876 	mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_RED, 0, 0);
2877 
2878 	return 0;
2879 }
2880 
2881 void mt7915_mcu_exit(struct mt7915_dev *dev)
2882 {
2883 	__mt76_mcu_restart(&dev->mt76);
2884 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2885 			    FIELD_PREP(MT_TOP_MISC_FW_STATE,
2886 				       FW_STATE_FW_DOWNLOAD), 1000)) {
2887 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2888 		return;
2889 	}
2890 
2891 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_FW_OWN);
2892 	skb_queue_purge(&dev->mt76.mcu.res_q);
2893 }
2894 
2895 static int
2896 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2897 {
2898 	struct {
2899 		u8 operation;
2900 		u8 count;
2901 		u8 _rsv[2];
2902 		u8 index;
2903 		u8 enable;
2904 		__le16 etype;
2905 	} req = {
2906 		.operation = 1,
2907 		.count = 1,
2908 		.enable = 1,
2909 		.etype = cpu_to_le16(ETH_P_PAE),
2910 	};
2911 
2912 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2913 				 &req, sizeof(req), false);
2914 }
2915 
2916 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2917 		       bool enable, bool hdr_trans)
2918 {
2919 	struct {
2920 		u8 operation;
2921 		u8 enable;
2922 		u8 check_bssid;
2923 		u8 insert_vlan;
2924 		u8 remove_vlan;
2925 		u8 tid;
2926 		u8 mode;
2927 		u8 rsv;
2928 	} __packed req_trans = {
2929 		.enable = hdr_trans,
2930 	};
2931 	struct {
2932 		u8 enable;
2933 		u8 band;
2934 		u8 rsv[2];
2935 	} __packed req_mac = {
2936 		.enable = enable,
2937 		.band = band,
2938 	};
2939 	int ret;
2940 
2941 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2942 				&req_trans, sizeof(req_trans), false);
2943 	if (ret)
2944 		return ret;
2945 
2946 	if (hdr_trans)
2947 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2948 
2949 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2950 				 &req_mac, sizeof(req_mac), true);
2951 }
2952 
2953 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2954 {
2955 	struct {
2956 		__le32 cmd;
2957 		u8 band;
2958 		u8 enable;
2959 	} __packed req = {
2960 		.cmd = cpu_to_le32(SCS_ENABLE),
2961 		.band = band,
2962 		.enable = enable + 1,
2963 	};
2964 
2965 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
2966 				 sizeof(req), false);
2967 }
2968 
2969 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2970 {
2971 	struct mt7915_dev *dev = phy->dev;
2972 	struct {
2973 		u8 prot_idx;
2974 		u8 band;
2975 		u8 rsv[2];
2976 		__le32 len_thresh;
2977 		__le32 pkt_thresh;
2978 	} __packed req = {
2979 		.prot_idx = 1,
2980 		.band = phy != &dev->phy,
2981 		.len_thresh = cpu_to_le32(val),
2982 		.pkt_thresh = cpu_to_le32(0x2),
2983 	};
2984 
2985 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
2986 				 sizeof(req), true);
2987 }
2988 
2989 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2990 {
2991 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2992 	u8 num = req->total;
2993 	size_t len = sizeof(*req) -
2994 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2995 
2996 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2997 				 len, true);
2998 }
2999 
3000 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
3001 {
3002 #define TX_CMD_MODE		1
3003 	struct mt7915_mcu_tx req = {
3004 		.valid = true,
3005 		.mode = TX_CMD_MODE,
3006 		.total = IEEE80211_NUM_ACS,
3007 	};
3008 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3009 	int ac;
3010 
3011 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3012 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3013 		struct edca *e = &req.edca[ac];
3014 
3015 		e->set = WMM_PARAM_SET;
3016 		e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3017 		e->aifs = q->aifs;
3018 		e->txop = cpu_to_le16(q->txop);
3019 
3020 		if (q->cw_min)
3021 			e->cw_min = fls(q->cw_min);
3022 		else
3023 			e->cw_min = 5;
3024 
3025 		if (q->cw_max)
3026 			e->cw_max = cpu_to_le16(fls(q->cw_max));
3027 		else
3028 			e->cw_max = cpu_to_le16(10);
3029 	}
3030 
3031 	return mt7915_mcu_update_edca(dev, &req);
3032 }
3033 
3034 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3035 {
3036 #define ENTER_PM_STATE		1
3037 #define EXIT_PM_STATE		2
3038 	struct {
3039 		u8 pm_number;
3040 		u8 pm_state;
3041 		u8 bssid[ETH_ALEN];
3042 		u8 dtim_period;
3043 		u8 wlan_idx_lo;
3044 		__le16 bcn_interval;
3045 		__le32 aid;
3046 		__le32 rx_filter;
3047 		u8 band_idx;
3048 		u8 wlan_idx_hi;
3049 		u8 rsv[2];
3050 		__le32 feature;
3051 		u8 omac_idx;
3052 		u8 wmm_idx;
3053 		u8 bcn_loss_cnt;
3054 		u8 bcn_sp_duration;
3055 	} __packed req = {
3056 		.pm_number = 5,
3057 		.pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3058 		.band_idx = band,
3059 	};
3060 
3061 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3062 				 sizeof(req), true);
3063 }
3064 
3065 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3066 		       enum mt7915_rdd_cmd cmd, u8 index,
3067 		       u8 rx_sel, u8 val)
3068 {
3069 	struct {
3070 		u8 ctrl;
3071 		u8 rdd_idx;
3072 		u8 rdd_rx_sel;
3073 		u8 val;
3074 		u8 rsv[4];
3075 	} __packed req = {
3076 		.ctrl = cmd,
3077 		.rdd_idx = index,
3078 		.rdd_rx_sel = rx_sel,
3079 		.val = val,
3080 	};
3081 
3082 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3083 				 sizeof(req), true);
3084 }
3085 
3086 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3087 {
3088 	struct {
3089 		__le32 tag;
3090 		__le16 min_lpn;
3091 		u8 rsv[2];
3092 	} __packed req = {
3093 		.tag = cpu_to_le32(0x1),
3094 		.min_lpn = cpu_to_le16(val),
3095 	};
3096 
3097 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3098 				 sizeof(req), true);
3099 }
3100 
3101 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3102 			    const struct mt7915_dfs_pulse *pulse)
3103 {
3104 	struct {
3105 		__le32 tag;
3106 
3107 		__le32 max_width;		/* us */
3108 		__le32 max_pwr;			/* dbm */
3109 		__le32 min_pwr;			/* dbm */
3110 		__le32 min_stgr_pri;		/* us */
3111 		__le32 max_stgr_pri;		/* us */
3112 		__le32 min_cr_pri;		/* us */
3113 		__le32 max_cr_pri;		/* us */
3114 	} __packed req = {
3115 		.tag = cpu_to_le32(0x3),
3116 
3117 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3118 		__req_field(max_width),
3119 		__req_field(max_pwr),
3120 		__req_field(min_pwr),
3121 		__req_field(min_stgr_pri),
3122 		__req_field(max_stgr_pri),
3123 		__req_field(min_cr_pri),
3124 		__req_field(max_cr_pri),
3125 #undef __req_field
3126 	};
3127 
3128 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3129 				 sizeof(req), true);
3130 }
3131 
3132 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3133 			    const struct mt7915_dfs_pattern *pattern)
3134 {
3135 	struct {
3136 		__le32 tag;
3137 		__le16 radar_type;
3138 
3139 		u8 enb;
3140 		u8 stgr;
3141 		u8 min_crpn;
3142 		u8 max_crpn;
3143 		u8 min_crpr;
3144 		u8 min_pw;
3145 		__le32 min_pri;
3146 		__le32 max_pri;
3147 		u8 max_pw;
3148 		u8 min_crbn;
3149 		u8 max_crbn;
3150 		u8 min_stgpn;
3151 		u8 max_stgpn;
3152 		u8 min_stgpr;
3153 		u8 rsv[2];
3154 		__le32 min_stgpr_diff;
3155 	} __packed req = {
3156 		.tag = cpu_to_le32(0x2),
3157 		.radar_type = cpu_to_le16(index),
3158 
3159 #define __req_field_u8(field) .field = pattern->field
3160 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3161 		__req_field_u8(enb),
3162 		__req_field_u8(stgr),
3163 		__req_field_u8(min_crpn),
3164 		__req_field_u8(max_crpn),
3165 		__req_field_u8(min_crpr),
3166 		__req_field_u8(min_pw),
3167 		__req_field_u32(min_pri),
3168 		__req_field_u32(max_pri),
3169 		__req_field_u8(max_pw),
3170 		__req_field_u8(min_crbn),
3171 		__req_field_u8(max_crbn),
3172 		__req_field_u8(min_stgpn),
3173 		__req_field_u8(max_stgpn),
3174 		__req_field_u8(min_stgpr),
3175 		__req_field_u32(min_stgpr_diff),
3176 #undef __req_field_u8
3177 #undef __req_field_u32
3178 	};
3179 
3180 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3181 				 sizeof(req), true);
3182 }
3183 
3184 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3185 {
3186 	struct mt7915_dev *dev = phy->dev;
3187 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3188 	int freq1 = chandef->center_freq1;
3189 	bool ext_phy = phy != &dev->phy;
3190 	struct {
3191 		u8 control_ch;
3192 		u8 center_ch;
3193 		u8 bw;
3194 		u8 tx_streams_num;
3195 		u8 rx_streams;	/* mask or num */
3196 		u8 switch_reason;
3197 		u8 band_idx;
3198 		u8 center_ch2;	/* for 80+80 only */
3199 		__le16 cac_case;
3200 		u8 channel_band;
3201 		u8 rsv0;
3202 		__le32 outband_freq;
3203 		u8 txpower_drop;
3204 		u8 ap_bw;
3205 		u8 ap_center_ch;
3206 		u8 rsv1[57];
3207 	} __packed req = {
3208 		.control_ch = chandef->chan->hw_value,
3209 		.center_ch = ieee80211_frequency_to_channel(freq1),
3210 		.bw = mt7915_mcu_chan_bw(chandef),
3211 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
3212 		.rx_streams = phy->mt76->antenna_mask,
3213 		.band_idx = ext_phy,
3214 		.channel_band = chandef->chan->band,
3215 	};
3216 
3217 #ifdef CONFIG_NL80211_TESTMODE
3218 	if (phy->mt76->test.tx_antenna_mask &&
3219 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3220 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3221 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3222 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3223 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
3224 
3225 		if (ext_phy) {
3226 			req.tx_streams_num = 2;
3227 			req.rx_streams >>= 2;
3228 		}
3229 	}
3230 #endif
3231 
3232 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3233 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3234 	else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3235 		 chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3236 		req.switch_reason = CH_SWITCH_DFS;
3237 	else
3238 		req.switch_reason = CH_SWITCH_NORMAL;
3239 
3240 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3241 		req.rx_streams = hweight8(req.rx_streams);
3242 
3243 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3244 		int freq2 = chandef->center_freq2;
3245 
3246 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3247 	}
3248 
3249 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3250 }
3251 
3252 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3253 {
3254 #define TOTAL_PAGE_MASK		GENMASK(7, 5)
3255 #define PAGE_IDX_MASK		GENMASK(4, 2)
3256 #define PER_PAGE_SIZE		0x400
3257 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3258 	u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;
3259 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
3260 	int eep_len;
3261 	int i;
3262 
3263 	for (i = 0; i <= total; i++, eep += eep_len) {
3264 		struct sk_buff *skb;
3265 		int ret;
3266 
3267 		if (i == total)
3268 			eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3269 		else
3270 			eep_len = PER_PAGE_SIZE;
3271 
3272 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3273 					 sizeof(req) + eep_len);
3274 		if (!skb)
3275 			return -ENOMEM;
3276 
3277 		req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |
3278 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3279 		req.len = cpu_to_le16(eep_len);
3280 
3281 		skb_put_data(skb, &req, sizeof(req));
3282 		skb_put_data(skb, eep, eep_len);
3283 
3284 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3285 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3286 		if (ret)
3287 			return ret;
3288 	}
3289 
3290 	return 0;
3291 }
3292 
3293 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3294 {
3295 	struct mt7915_mcu_eeprom req = {
3296 		.buffer_mode = EE_MODE_EFUSE,
3297 		.format = EE_FORMAT_WHOLE,
3298 	};
3299 
3300 	if (dev->flash_mode)
3301 		return mt7915_mcu_set_eeprom_flash(dev);
3302 
3303 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3304 				 &req, sizeof(req), true);
3305 }
3306 
3307 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3308 {
3309 	struct mt7915_mcu_eeprom_info req = {
3310 		.addr = cpu_to_le32(round_down(offset, 16)),
3311 	};
3312 	struct mt7915_mcu_eeprom_info *res;
3313 	struct sk_buff *skb;
3314 	int ret;
3315 	u8 *buf;
3316 
3317 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3318 				sizeof(req), true, &skb);
3319 	if (ret)
3320 		return ret;
3321 
3322 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
3323 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3324 	memcpy(buf, res->data, 16);
3325 	dev_kfree_skb(skb);
3326 
3327 	return 0;
3328 }
3329 
3330 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3331 				  u8 *data, u32 len, int cmd)
3332 {
3333 	struct {
3334 		u8 dir;
3335 		u8 valid;
3336 		__le16 bitmap;
3337 		s8 precal;
3338 		u8 action;
3339 		u8 band;
3340 		u8 idx;
3341 		u8 rsv[4];
3342 		__le32 len;
3343 	} req;
3344 	struct sk_buff *skb;
3345 
3346 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3347 	if (!skb)
3348 		return -ENOMEM;
3349 
3350 	req.idx = idx;
3351 	req.len = cpu_to_le32(len);
3352 	skb_put_data(skb, &req, sizeof(req));
3353 	skb_put_data(skb, data, len);
3354 
3355 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3356 }
3357 
3358 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3359 {
3360 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3361 	u32 total = MT_EE_CAL_GROUP_SIZE;
3362 
3363 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3364 		return 0;
3365 
3366 	/*
3367 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3368 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3369 	 */
3370 	while (total > 0) {
3371 		int ret, len;
3372 
3373 		len = min_t(u32, total, MT_EE_CAL_UNIT);
3374 
3375 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3376 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3377 		if (ret)
3378 			return ret;
3379 
3380 		total -= len;
3381 		cal += len;
3382 		idx++;
3383 	}
3384 
3385 	return 0;
3386 }
3387 
3388 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3389 {
3390 	int i;
3391 
3392 	for (i = 0; i < n_freqs; i++)
3393 		if (cur == freqs[i])
3394 			return i;
3395 
3396 	return -1;
3397 }
3398 
3399 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3400 {
3401 	static const u16 freq_list[] = {
3402 		5180, 5200, 5220, 5240,
3403 		5260, 5280, 5300, 5320,
3404 		5500, 5520, 5540, 5560,
3405 		5580, 5600, 5620, 5640,
3406 		5660, 5680, 5700, 5745,
3407 		5765, 5785, 5805, 5825
3408 	};
3409 	int offset_2g = ARRAY_SIZE(freq_list);
3410 	int idx;
3411 
3412 	if (freq < 4000) {
3413 		if (freq < 2432)
3414 			return offset_2g;
3415 		if (freq < 2457)
3416 			return offset_2g + 1;
3417 
3418 		return offset_2g + 2;
3419 	}
3420 
3421 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3422 		return -1;
3423 
3424 	if (bw != NL80211_CHAN_WIDTH_20) {
3425 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3426 					   freq + 10);
3427 		if (idx >= 0)
3428 			return idx;
3429 
3430 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3431 					   freq - 10);
3432 		if (idx >= 0)
3433 			return idx;
3434 	}
3435 
3436 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3437 }
3438 
3439 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3440 {
3441 	struct mt7915_dev *dev = phy->dev;
3442 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3443 	u16 total = 2, idx, center_freq = chandef->center_freq1;
3444 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3445 
3446 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3447 		return 0;
3448 
3449 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3450 	if (idx < 0)
3451 		return -EINVAL;
3452 
3453 	/* Items: Tx DPD, Tx Flatness */
3454 	idx = idx * 2;
3455 	cal += MT_EE_CAL_GROUP_SIZE;
3456 
3457 	while (total--) {
3458 		int ret;
3459 
3460 		cal += (idx * MT_EE_CAL_UNIT);
3461 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3462 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3463 		if (ret)
3464 			return ret;
3465 
3466 		idx++;
3467 	}
3468 
3469 	return 0;
3470 }
3471 
3472 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3473 {
3474 	struct {
3475 		u8 ctrl_id;
3476 		u8 action;
3477 		u8 band;
3478 		u8 rsv[5];
3479 	} req = {
3480 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3481 		.action = index,
3482 	};
3483 
3484 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3485 				 sizeof(req), true);
3486 }
3487 
3488 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3489 {
3490 	struct {
3491 		__le32 cmd;
3492 		__le16 wlan_idx;
3493 		__le16 ru_idx;
3494 		__le16 direction;
3495 		__le16 dump_group;
3496 	} req = {
3497 		.cmd = cpu_to_le32(cmd),
3498 		.wlan_idx = cpu_to_le16(wlan_idx),
3499 		.dump_group = cpu_to_le16(1),
3500 	};
3501 
3502 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RATE_CTRL), &req,
3503 				 sizeof(req), false);
3504 }
3505 
3506 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3507 {
3508 #define MT7915_SKU_RATE_NUM		161
3509 	struct mt7915_dev *dev = phy->dev;
3510 	struct mt76_phy *mphy = phy->mt76;
3511 	struct ieee80211_hw *hw = mphy->hw;
3512 	struct mt7915_sku_val {
3513 		u8 format_id;
3514 		u8 limit_type;
3515 		u8 dbdc_idx;
3516 		s8 val[MT7915_SKU_RATE_NUM];
3517 	} __packed req = {
3518 		.format_id = 4,
3519 		.dbdc_idx = phy != &dev->phy,
3520 	};
3521 	struct mt76_power_limits limits_array;
3522 	s8 *la = (s8 *)&limits_array;
3523 	int i, idx, n_chains = hweight8(mphy->antenna_mask);
3524 	int tx_power;
3525 
3526 	tx_power = hw->conf.power_level * 2 -
3527 		   mt76_tx_power_nss_delta(n_chains);
3528 
3529 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3530 					      &limits_array, tx_power);
3531 	mphy->txpower_cur = tx_power;
3532 
3533 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3534 		u8 mcs_num, len = mt7915_sku_group_len[i];
3535 		int j;
3536 
3537 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3538 			mcs_num = 10;
3539 
3540 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3541 				la = (s8 *)&limits_array + 12;
3542 		} else {
3543 			mcs_num = len;
3544 		}
3545 
3546 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3547 			req.val[idx + j] = la[j];
3548 
3549 		la += mcs_num;
3550 		idx += len;
3551 	}
3552 
3553 	return mt76_mcu_send_msg(&dev->mt76,
3554 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3555 				 sizeof(req), true);
3556 }
3557 
3558 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3559 			      u8 en)
3560 {
3561 	struct {
3562 		u8 test_mode_en;
3563 		u8 param_idx;
3564 		u8 _rsv[2];
3565 
3566 		u8 enable;
3567 		u8 _rsv2[3];
3568 
3569 		u8 pad[8];
3570 	} __packed req = {
3571 		.test_mode_en = test_mode,
3572 		.param_idx = param,
3573 		.enable = en,
3574 	};
3575 
3576 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3577 				 sizeof(req), false);
3578 }
3579 
3580 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3581 {
3582 	struct mt7915_dev *dev = phy->dev;
3583 	struct mt7915_sku {
3584 		u8 format_id;
3585 		u8 sku_enable;
3586 		u8 dbdc_idx;
3587 		u8 rsv;
3588 	} __packed req = {
3589 		.format_id = 0,
3590 		.dbdc_idx = phy != &dev->phy,
3591 		.sku_enable = enable,
3592 	};
3593 
3594 	return mt76_mcu_send_msg(&dev->mt76,
3595 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3596 				 sizeof(req), true);
3597 }
3598 
3599 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3600 {
3601 	struct {
3602 		u8 action;
3603 		u8 set;
3604 		u8 band;
3605 		u8 rsv;
3606 	} req = {
3607 		.action = action,
3608 		.set = set,
3609 		.band = band,
3610 	};
3611 
3612 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3613 				 &req, sizeof(req), false);
3614 }
3615 
3616 int mt7915_mcu_set_txbf_module(struct mt7915_dev *dev)
3617 {
3618 #define MT_BF_MODULE_UPDATE               25
3619 	struct {
3620 		u8 action;
3621 		u8 bf_num;
3622 		u8 bf_bitmap;
3623 		u8 bf_sel[8];
3624 		u8 rsv[8];
3625 	} __packed req = {
3626 		.action = MT_BF_MODULE_UPDATE,
3627 		.bf_num = 2,
3628 		.bf_bitmap = GENMASK(1, 0),
3629 	};
3630 
3631 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3632 				 sizeof(req), true);
3633 }
3634 
3635 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3636 {
3637 #define MT_BF_TYPE_UPDATE		20
3638 	struct {
3639 		u8 action;
3640 		bool ebf;
3641 		bool ibf;
3642 		u8 rsv;
3643 	} __packed req = {
3644 		.action = MT_BF_TYPE_UPDATE,
3645 		.ebf = true,
3646 		.ibf = dev->ibf,
3647 	};
3648 
3649 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3650 				 sizeof(req), true);
3651 }
3652 
3653 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3654 {
3655 #define MT_BF_PROCESSING		4
3656 	struct {
3657 		u8 action;
3658 		u8 snd_mode;
3659 		u8 sta_num;
3660 		u8 rsv;
3661 		u8 wlan_idx[4];
3662 		__le32 snd_period;	/* ms */
3663 	} __packed req = {
3664 		.action = true,
3665 		.snd_mode = MT_BF_PROCESSING,
3666 	};
3667 
3668 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3669 				 sizeof(req), true);
3670 }
3671 
3672 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3673 			    bool enable)
3674 {
3675 #define MT_SPR_ENABLE		1
3676 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3677 	struct {
3678 		u8 action;
3679 		u8 arg_num;
3680 		u8 band_idx;
3681 		u8 status;
3682 		u8 drop_tx_idx;
3683 		u8 sta_idx;	/* 256 sta */
3684 		u8 rsv[2];
3685 		__le32 val;
3686 	} __packed req = {
3687 		.action = MT_SPR_ENABLE,
3688 		.arg_num = 1,
3689 		.band_idx = mvif->band_idx,
3690 		.val = cpu_to_le32(enable),
3691 	};
3692 
3693 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3694 				 sizeof(req), true);
3695 }
3696 
3697 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3698 			   struct ieee80211_sta *sta, struct rate_info *rate)
3699 {
3700 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3701 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3702 	struct mt7915_dev *dev = phy->dev;
3703 	struct mt76_phy *mphy = phy->mt76;
3704 	struct {
3705 		u8 category;
3706 		u8 band;
3707 		__le16 wcid;
3708 	} __packed req = {
3709 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3710 		.band = mvif->band_idx,
3711 		.wcid = cpu_to_le16(msta->wcid.idx),
3712 	};
3713 	struct ieee80211_supported_band *sband;
3714 	struct mt7915_mcu_phy_rx_info *res;
3715 	struct sk_buff *skb;
3716 	int ret;
3717 	bool cck = false;
3718 
3719 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3720 					&req, sizeof(req), true, &skb);
3721 	if (ret)
3722 		return ret;
3723 
3724 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3725 
3726 	rate->mcs = res->rate;
3727 	rate->nss = res->nsts + 1;
3728 
3729 	switch (res->mode) {
3730 	case MT_PHY_TYPE_CCK:
3731 		cck = true;
3732 		fallthrough;
3733 	case MT_PHY_TYPE_OFDM:
3734 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3735 			sband = &mphy->sband_5g.sband;
3736 		else
3737 			sband = &mphy->sband_2g.sband;
3738 
3739 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3740 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3741 		break;
3742 	case MT_PHY_TYPE_HT:
3743 	case MT_PHY_TYPE_HT_GF:
3744 		if (rate->mcs > 31) {
3745 			ret = -EINVAL;
3746 			goto out;
3747 		}
3748 
3749 		rate->flags = RATE_INFO_FLAGS_MCS;
3750 		if (res->gi)
3751 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3752 		break;
3753 	case MT_PHY_TYPE_VHT:
3754 		if (rate->mcs > 9) {
3755 			ret = -EINVAL;
3756 			goto out;
3757 		}
3758 
3759 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3760 		if (res->gi)
3761 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3762 		break;
3763 	case MT_PHY_TYPE_HE_SU:
3764 	case MT_PHY_TYPE_HE_EXT_SU:
3765 	case MT_PHY_TYPE_HE_TB:
3766 	case MT_PHY_TYPE_HE_MU:
3767 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3768 			ret = -EINVAL;
3769 			goto out;
3770 		}
3771 		rate->he_gi = res->gi;
3772 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3773 		break;
3774 	default:
3775 		ret = -EINVAL;
3776 		goto out;
3777 	}
3778 
3779 	switch (res->bw) {
3780 	case IEEE80211_STA_RX_BW_160:
3781 		rate->bw = RATE_INFO_BW_160;
3782 		break;
3783 	case IEEE80211_STA_RX_BW_80:
3784 		rate->bw = RATE_INFO_BW_80;
3785 		break;
3786 	case IEEE80211_STA_RX_BW_40:
3787 		rate->bw = RATE_INFO_BW_40;
3788 		break;
3789 	default:
3790 		rate->bw = RATE_INFO_BW_20;
3791 		break;
3792 	}
3793 
3794 out:
3795 	dev_kfree_skb(skb);
3796 
3797 	return ret;
3798 }
3799