1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define fw_name(_dev, name, ...)	({			\
68 	char *_fw;						\
69 	switch (mt76_chip(&(_dev)->mt76)) {			\
70 	case 0x7915:						\
71 		_fw = MT7915_##name;				\
72 		break;						\
73 	case 0x7986:						\
74 		_fw = MT7986_##name##__VA_ARGS__;		\
75 		break;						\
76 	default:						\
77 		_fw = MT7916_##name;				\
78 		break;						\
79 	}							\
80 	_fw;							\
81 })
82 
83 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
84 					 fw_name(_dev, name) :			\
85 					 fw_name(_dev, name, _MT7975))
86 
87 #define MCU_PATCH_ADDRESS		0x200000
88 
89 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
90 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
91 
92 static u8
93 mt7915_mcu_get_sta_nss(u16 mcs_map)
94 {
95 	u8 nss;
96 
97 	for (nss = 8; nss > 0; nss--) {
98 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
99 
100 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
101 			break;
102 	}
103 
104 	return nss - 1;
105 }
106 
107 static void
108 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
109 			  u16 mcs_map)
110 {
111 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
112 	struct mt7915_dev *dev = msta->vif->phy->dev;
113 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
114 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
115 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
116 
117 	for (nss = 0; nss < max_nss; nss++) {
118 		int mcs;
119 
120 		switch ((mcs_map >> (2 * nss)) & 0x3) {
121 		case IEEE80211_HE_MCS_SUPPORT_0_11:
122 			mcs = GENMASK(11, 0);
123 			break;
124 		case IEEE80211_HE_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_HE_MCS_SUPPORT_0_7:
128 			mcs = GENMASK(7, 0);
129 			break;
130 		default:
131 			mcs = 0;
132 		}
133 
134 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
135 
136 		switch (mcs) {
137 		case 0 ... 7:
138 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
139 			break;
140 		case 8 ... 9:
141 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
142 			break;
143 		case 10 ... 11:
144 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
145 			break;
146 		default:
147 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
148 			break;
149 		}
150 		mcs_map &= ~(0x3 << (nss * 2));
151 		mcs_map |= mcs << (nss * 2);
152 
153 		/* only support 2ss on 160MHz for mt7915 */
154 		if (is_mt7915(&dev->mt76) && nss > 1 &&
155 		    sta->bandwidth == IEEE80211_STA_RX_BW_160)
156 			break;
157 	}
158 
159 	*he_mcs = cpu_to_le16(mcs_map);
160 }
161 
162 static void
163 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
164 			   const u16 *mask)
165 {
166 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
167 	struct mt7915_dev *dev = msta->vif->phy->dev;
168 	u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
169 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
170 	u16 mcs;
171 
172 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
173 		switch (mcs_map & 0x3) {
174 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
175 			mcs = GENMASK(9, 0);
176 			break;
177 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
178 			mcs = GENMASK(8, 0);
179 			break;
180 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
181 			mcs = GENMASK(7, 0);
182 			break;
183 		default:
184 			mcs = 0;
185 		}
186 
187 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
188 
189 		/* only support 2ss on 160MHz for mt7915 */
190 		if (is_mt7915(&dev->mt76) && nss > 1 &&
191 		    sta->bandwidth == IEEE80211_STA_RX_BW_160)
192 			break;
193 	}
194 }
195 
196 static void
197 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
198 			  const u8 *mask)
199 {
200 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
201 
202 	for (nss = 0; nss < max_nss; nss++)
203 		ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
204 }
205 
206 static int
207 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
208 			  struct sk_buff *skb, int seq)
209 {
210 	struct mt7915_mcu_rxd *rxd;
211 	int ret = 0;
212 
213 	if (!skb) {
214 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
215 			cmd, seq);
216 		return -ETIMEDOUT;
217 	}
218 
219 	rxd = (struct mt7915_mcu_rxd *)skb->data;
220 	if (seq != rxd->seq)
221 		return -EAGAIN;
222 
223 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
224 		skb_pull(skb, sizeof(*rxd) - 4);
225 		ret = *skb->data;
226 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
227 		skb_pull(skb, sizeof(*rxd) + 4);
228 		ret = le32_to_cpu(*(__le32 *)skb->data);
229 	} else {
230 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
231 	}
232 
233 	return ret;
234 }
235 
236 static int
237 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
238 			int cmd, int *wait_seq)
239 {
240 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
241 	struct mt7915_mcu_txd *mcu_txd;
242 	enum mt76_mcuq_id qid;
243 	__le32 *txd;
244 	u32 val;
245 	u8 seq;
246 
247 	/* TODO: make dynamic based on msg type */
248 	mdev->mcu.timeout = 20 * HZ;
249 
250 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
251 	if (!seq)
252 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
253 
254 	if (cmd == MCU_CMD(FW_SCATTER)) {
255 		qid = MT_MCUQ_FWDL;
256 		goto exit;
257 	}
258 
259 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
260 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
261 		qid = MT_MCUQ_WA;
262 	else
263 		qid = MT_MCUQ_WM;
264 
265 	txd = mcu_txd->txd;
266 
267 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
268 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
269 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
270 	txd[0] = cpu_to_le32(val);
271 
272 	val = MT_TXD1_LONG_FORMAT |
273 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
274 	txd[1] = cpu_to_le32(val);
275 
276 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
277 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
278 					       MT_TX_MCU_PORT_RX_Q0));
279 	mcu_txd->pkt_type = MCU_PKT_ID;
280 	mcu_txd->seq = seq;
281 
282 	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
283 	mcu_txd->set_query = MCU_Q_NA;
284 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
285 	if (mcu_txd->ext_cid) {
286 		mcu_txd->ext_cid_ack = 1;
287 
288 		/* do not use Q_SET for efuse */
289 		if (cmd & __MCU_CMD_FIELD_QUERY)
290 			mcu_txd->set_query = MCU_Q_QUERY;
291 		else
292 			mcu_txd->set_query = MCU_Q_SET;
293 	}
294 
295 	if (cmd & __MCU_CMD_FIELD_WA)
296 		mcu_txd->s2d_index = MCU_S2D_H2C;
297 	else
298 		mcu_txd->s2d_index = MCU_S2D_H2N;
299 
300 exit:
301 	if (wait_seq)
302 		*wait_seq = seq;
303 
304 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
305 }
306 
307 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
308 {
309 	struct {
310 		__le32 args[3];
311 	} req = {
312 		.args = {
313 			cpu_to_le32(a1),
314 			cpu_to_le32(a2),
315 			cpu_to_le32(a3),
316 		},
317 	};
318 
319 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
320 }
321 
322 static void
323 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
324 {
325 	if (vif->csa_active)
326 		ieee80211_csa_finish(vif);
327 }
328 
329 static void
330 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
331 {
332 	struct mt76_phy *mphy = &dev->mt76.phy;
333 	struct mt7915_mcu_csa_notify *c;
334 
335 	c = (struct mt7915_mcu_csa_notify *)skb->data;
336 
337 	if ((c->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
338 		mphy = dev->mt76.phy2;
339 
340 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
341 			IEEE80211_IFACE_ITER_RESUME_ALL,
342 			mt7915_mcu_csa_finish, mphy->hw);
343 }
344 
345 static void
346 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
347 {
348 	struct mt76_phy *mphy = &dev->mt76.phy;
349 	struct mt7915_mcu_thermal_notify *t;
350 	struct mt7915_phy *phy;
351 
352 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
353 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
354 		return;
355 
356 	if ((t->ctrl.band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
357 		mphy = dev->mt76.phy2;
358 
359 	phy = (struct mt7915_phy *)mphy->priv;
360 	phy->throttle_state = t->ctrl.duty.duty_cycle;
361 }
362 
363 static void
364 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
365 {
366 	struct mt76_phy *mphy = &dev->mt76.phy;
367 	struct mt7915_mcu_rdd_report *r;
368 
369 	r = (struct mt7915_mcu_rdd_report *)skb->data;
370 
371 	if ((r->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
372 		mphy = dev->mt76.phy2;
373 
374 	if (r->band_idx == MT_RX_SEL2)
375 		cfg80211_background_radar_event(mphy->hw->wiphy,
376 						&dev->rdd2_chandef,
377 						GFP_ATOMIC);
378 	else
379 		ieee80211_radar_detected(mphy->hw);
380 	dev->hw_pattern++;
381 }
382 
383 static void
384 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
385 {
386 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
387 	const char *data = (char *)&rxd[1];
388 	const char *type;
389 	int len = skb->len - sizeof(*rxd);
390 
391 	switch (rxd->s2d_index) {
392 	case 0:
393 		if (mt7915_debugfs_rx_log(dev, data, len))
394 			return;
395 
396 		type = "WM";
397 		break;
398 	case 2:
399 		type = "WA";
400 		break;
401 	default:
402 		type = "unknown";
403 		break;
404 	}
405 
406 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
407 }
408 
409 static void
410 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
411 {
412 	if (!vif->color_change_active)
413 		return;
414 
415 	ieee80211_color_change_finish(vif);
416 }
417 
418 static void
419 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
420 {
421 	struct mt76_phy *mphy = &dev->mt76.phy;
422 	struct mt7915_mcu_bcc_notify *b;
423 
424 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
425 
426 	if ((b->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
427 		mphy = dev->mt76.phy2;
428 
429 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
430 			IEEE80211_IFACE_ITER_RESUME_ALL,
431 			mt7915_mcu_cca_finish, mphy->hw);
432 }
433 
434 static void
435 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
436 {
437 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
438 
439 	switch (rxd->ext_eid) {
440 	case MCU_EXT_EVENT_THERMAL_PROTECT:
441 		mt7915_mcu_rx_thermal_notify(dev, skb);
442 		break;
443 	case MCU_EXT_EVENT_RDD_REPORT:
444 		mt7915_mcu_rx_radar_detected(dev, skb);
445 		break;
446 	case MCU_EXT_EVENT_CSA_NOTIFY:
447 		mt7915_mcu_rx_csa_notify(dev, skb);
448 		break;
449 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
450 		mt7915_mcu_rx_log_message(dev, skb);
451 		break;
452 	case MCU_EXT_EVENT_BCC_NOTIFY:
453 		mt7915_mcu_rx_bcc_notify(dev, skb);
454 		break;
455 	default:
456 		break;
457 	}
458 }
459 
460 static void
461 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
462 {
463 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
464 
465 	switch (rxd->eid) {
466 	case MCU_EVENT_EXT:
467 		mt7915_mcu_rx_ext_event(dev, skb);
468 		break;
469 	default:
470 		break;
471 	}
472 	dev_kfree_skb(skb);
473 }
474 
475 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
476 {
477 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
478 
479 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
480 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
481 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
482 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
483 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
484 	    !rxd->seq)
485 		mt7915_mcu_rx_unsolicited_event(dev, skb);
486 	else
487 		mt76_mcu_rx_event(&dev->mt76, skb);
488 }
489 
490 static struct tlv *
491 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
492 			     __le16 *sub_ntlv, __le16 *len)
493 {
494 	struct tlv *ptlv, tlv = {
495 		.tag = cpu_to_le16(sub_tag),
496 		.len = cpu_to_le16(sub_len),
497 	};
498 
499 	ptlv = skb_put(skb, sub_len);
500 	memcpy(ptlv, &tlv, sizeof(tlv));
501 
502 	le16_add_cpu(sub_ntlv, 1);
503 	le16_add_cpu(len, sub_len);
504 
505 	return ptlv;
506 }
507 
508 /** bss info **/
509 struct mt7915_he_obss_narrow_bw_ru_data {
510 	bool tolerated;
511 };
512 
513 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
514 						   struct cfg80211_bss *bss,
515 						   void *_data)
516 {
517 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
518 	const struct element *elem;
519 
520 	rcu_read_lock();
521 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
522 
523 	if (!elem || elem->datalen <= 10 ||
524 	    !(elem->data[10] &
525 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
526 		data->tolerated = false;
527 
528 	rcu_read_unlock();
529 }
530 
531 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
532 					      struct ieee80211_vif *vif)
533 {
534 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
535 		.tolerated = true,
536 	};
537 
538 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
539 		return false;
540 
541 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
542 			  mt7915_check_he_obss_narrow_bw_ru_iter,
543 			  &iter_data);
544 
545 	/*
546 	 * If there is at least one AP on radar channel that cannot
547 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
548 	 */
549 	return !iter_data.tolerated;
550 }
551 
552 static void
553 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
554 			struct mt7915_phy *phy)
555 {
556 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
557 	struct bss_info_rf_ch *ch;
558 	struct tlv *tlv;
559 	int freq1 = chandef->center_freq1;
560 
561 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
562 
563 	ch = (struct bss_info_rf_ch *)tlv;
564 	ch->pri_ch = chandef->chan->hw_value;
565 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
566 	ch->bw = mt76_connac_chan_bw(chandef);
567 
568 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
569 		int freq2 = chandef->center_freq2;
570 
571 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
572 	}
573 
574 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
575 		struct mt76_phy *mphy = phy->mt76;
576 
577 		ch->he_ru26_block =
578 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
579 		ch->he_all_disable = false;
580 	} else {
581 		ch->he_all_disable = true;
582 	}
583 }
584 
585 static void
586 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
587 		      struct mt7915_phy *phy)
588 {
589 	int max_nss = hweight8(phy->mt76->chainmask);
590 	struct bss_info_ra *ra;
591 	struct tlv *tlv;
592 
593 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
594 
595 	ra = (struct bss_info_ra *)tlv;
596 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
597 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
598 	ra->short_preamble = true;
599 	ra->tx_streams = max_nss;
600 	ra->rx_streams = max_nss;
601 	ra->algo = 4;
602 	ra->train_up_rule = 2;
603 	ra->train_up_high_thres = 110;
604 	ra->train_up_rule_rssi = -70;
605 	ra->low_traffic_thres = 2;
606 	ra->phy_cap = cpu_to_le32(0xfdf);
607 	ra->interval = cpu_to_le32(500);
608 	ra->fast_interval = cpu_to_le32(100);
609 }
610 
611 static void
612 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
613 		      struct mt7915_phy *phy)
614 {
615 #define DEFAULT_HE_PE_DURATION		4
616 #define DEFAULT_HE_DURATION_RTS_THRES	1023
617 	const struct ieee80211_sta_he_cap *cap;
618 	struct bss_info_he *he;
619 	struct tlv *tlv;
620 
621 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
622 
623 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
624 
625 	he = (struct bss_info_he *)tlv;
626 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
627 	if (!he->he_pe_duration)
628 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
629 
630 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
631 	if (!he->he_rts_thres)
632 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
633 
634 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
635 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
636 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
637 }
638 
639 static void
640 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
641 {
642 #define TXD_CMP_MAP1		GENMASK(15, 0)
643 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
644 	struct bss_info_hw_amsdu *amsdu;
645 	struct tlv *tlv;
646 
647 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
648 
649 	amsdu = (struct bss_info_hw_amsdu *)tlv;
650 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
651 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
652 	amsdu->trig_thres = cpu_to_le16(2);
653 	amsdu->enable = true;
654 }
655 
656 static void
657 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
658 {
659 	struct bss_info_bmc_rate *bmc;
660 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
661 	enum nl80211_band band = chandef->chan->band;
662 	struct tlv *tlv;
663 
664 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
665 
666 	bmc = (struct bss_info_bmc_rate *)tlv;
667 	if (band == NL80211_BAND_2GHZ) {
668 		bmc->short_preamble = true;
669 	} else {
670 		bmc->bc_trans = cpu_to_le16(0x2000);
671 		bmc->mc_trans = cpu_to_le16(0x2080);
672 	}
673 }
674 
675 static int
676 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
677 		       bool bssid, bool enable)
678 {
679 	struct mt7915_dev *dev = phy->dev;
680 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
681 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
682 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
683 	const u8 *addr = vif->addr;
684 	struct {
685 		u8 mode;
686 		u8 force_clear;
687 		u8 clear_bitmap[8];
688 		u8 entry_count;
689 		u8 write;
690 		u8 band;
691 
692 		u8 index;
693 		u8 bssid;
694 		u8 addr[ETH_ALEN];
695 	} __packed req = {
696 		.mode = !!mask || enable,
697 		.entry_count = 1,
698 		.write = 1,
699 		.band = phy != &dev->phy,
700 		.index = idx * 2 + bssid,
701 	};
702 
703 	if (bssid)
704 		addr = vif->bss_conf.bssid;
705 
706 	if (enable)
707 		ether_addr_copy(req.addr, addr);
708 
709 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
710 				 sizeof(req), true);
711 }
712 
713 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
714 			    struct ieee80211_vif *vif, int enable)
715 {
716 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
717 	struct mt7915_dev *dev = phy->dev;
718 	struct sk_buff *skb;
719 
720 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
721 		mt7915_mcu_muar_config(phy, vif, false, enable);
722 		mt7915_mcu_muar_config(phy, vif, true, enable);
723 	}
724 
725 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
726 					      MT7915_BSS_UPDATE_MAX_SIZE);
727 	if (IS_ERR(skb))
728 		return PTR_ERR(skb);
729 
730 	/* bss_omac must be first */
731 	if (enable)
732 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
733 
734 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
735 				      mvif->sta.wcid.idx, enable);
736 
737 	if (vif->type == NL80211_IFTYPE_MONITOR)
738 		goto out;
739 
740 	if (enable) {
741 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
742 		mt7915_mcu_bss_bmc_tlv(skb, phy);
743 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
744 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
745 
746 		if (vif->bss_conf.he_support)
747 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
748 
749 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
750 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
751 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
752 	}
753 out:
754 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
755 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
756 }
757 
758 /** starec & wtbl **/
759 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
760 			 struct ieee80211_ampdu_params *params,
761 			 bool enable)
762 {
763 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
764 	struct mt7915_vif *mvif = msta->vif;
765 
766 	if (enable && !params->amsdu)
767 		msta->wcid.amsdu = false;
768 
769 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
770 				      MCU_EXT_CMD(STA_REC_UPDATE),
771 				      enable, true);
772 }
773 
774 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
775 			 struct ieee80211_ampdu_params *params,
776 			 bool enable)
777 {
778 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
779 	struct mt7915_vif *mvif = msta->vif;
780 
781 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
782 				      MCU_EXT_CMD(STA_REC_UPDATE),
783 				      enable, false);
784 }
785 
786 static void
787 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
788 		      struct ieee80211_vif *vif)
789 {
790 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
791 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
792 	struct ieee80211_he_mcs_nss_supp mcs_map;
793 	struct sta_rec_he *he;
794 	struct tlv *tlv;
795 	u32 cap = 0;
796 
797 	if (!sta->he_cap.has_he)
798 		return;
799 
800 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
801 
802 	he = (struct sta_rec_he *)tlv;
803 
804 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
805 		cap |= STA_REC_HE_CAP_HTC;
806 
807 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
808 		cap |= STA_REC_HE_CAP_BSR;
809 
810 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
811 		cap |= STA_REC_HE_CAP_OM;
812 
813 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
814 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
815 
816 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
817 		cap |= STA_REC_HE_CAP_BQR;
818 
819 	if (elem->phy_cap_info[0] &
820 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
821 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
822 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
823 
824 	if (mvif->cap.he_ldpc &&
825 	    (elem->phy_cap_info[1] &
826 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
827 		cap |= STA_REC_HE_CAP_LDPC;
828 
829 	if (elem->phy_cap_info[1] &
830 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
831 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
832 
833 	if (elem->phy_cap_info[2] &
834 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
835 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
836 
837 	if (elem->phy_cap_info[2] &
838 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
839 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
840 
841 	if (elem->phy_cap_info[2] &
842 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
843 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
844 
845 	if (elem->phy_cap_info[6] &
846 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
847 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
848 
849 	if (elem->phy_cap_info[6] &
850 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
851 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
852 
853 	if (elem->phy_cap_info[7] &
854 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
855 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
856 
857 	if (elem->phy_cap_info[7] &
858 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
859 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
860 
861 	if (elem->phy_cap_info[7] &
862 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
863 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
864 
865 	if (elem->phy_cap_info[8] &
866 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
867 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
868 
869 	if (elem->phy_cap_info[8] &
870 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
871 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
872 
873 	if (elem->phy_cap_info[9] &
874 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
875 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
876 
877 	if (elem->phy_cap_info[9] &
878 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
879 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
880 
881 	he->he_cap = cpu_to_le32(cap);
882 
883 	mcs_map = sta->he_cap.he_mcs_nss_supp;
884 	switch (sta->bandwidth) {
885 	case IEEE80211_STA_RX_BW_160:
886 		if (elem->phy_cap_info[0] &
887 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
888 			mt7915_mcu_set_sta_he_mcs(sta,
889 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
890 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
891 
892 		mt7915_mcu_set_sta_he_mcs(sta,
893 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
894 					  le16_to_cpu(mcs_map.rx_mcs_160));
895 		fallthrough;
896 	default:
897 		mt7915_mcu_set_sta_he_mcs(sta,
898 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
899 					  le16_to_cpu(mcs_map.rx_mcs_80));
900 		break;
901 	}
902 
903 	he->t_frame_dur =
904 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
905 	he->max_ampdu_exp =
906 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
907 
908 	he->bw_set =
909 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
910 	he->device_class =
911 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
912 	he->punc_pream_rx =
913 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
914 
915 	he->dcm_tx_mode =
916 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
917 	he->dcm_tx_max_nss =
918 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
919 	he->dcm_rx_mode =
920 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
921 	he->dcm_rx_max_nss =
922 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
923 	he->dcm_rx_max_nss =
924 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
925 
926 	he->pkt_ext = 2;
927 }
928 
929 static void
930 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
931 			struct ieee80211_vif *vif)
932 {
933 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
934 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
935 	struct sta_rec_muru *muru;
936 	struct tlv *tlv;
937 
938 	if (vif->type != NL80211_IFTYPE_STATION &&
939 	    vif->type != NL80211_IFTYPE_AP)
940 		return;
941 
942 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
943 
944 	muru = (struct sta_rec_muru *)tlv;
945 
946 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
947 			       mvif->cap.vht_mu_ebfer ||
948 			       mvif->cap.vht_mu_ebfee;
949 	muru->cfg.mimo_ul_en = true;
950 	muru->cfg.ofdma_dl_en = true;
951 
952 	if (sta->vht_cap.vht_supported)
953 		muru->mimo_dl.vht_mu_bfee =
954 			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
955 
956 	if (!sta->he_cap.has_he)
957 		return;
958 
959 	muru->mimo_dl.partial_bw_dl_mimo =
960 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
961 
962 	muru->mimo_ul.full_ul_mimo =
963 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
964 	muru->mimo_ul.partial_ul_mimo =
965 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
966 
967 	muru->ofdma_dl.punc_pream_rx =
968 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
969 	muru->ofdma_dl.he_20m_in_40m_2g =
970 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
971 	muru->ofdma_dl.he_20m_in_160m =
972 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
973 	muru->ofdma_dl.he_80m_in_160m =
974 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
975 
976 	muru->ofdma_ul.t_frame_dur =
977 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
978 	muru->ofdma_ul.mu_cascading =
979 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
980 	muru->ofdma_ul.uo_ra =
981 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
982 }
983 
984 static void
985 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
986 {
987 	struct sta_rec_ht *ht;
988 	struct tlv *tlv;
989 
990 	if (!sta->ht_cap.ht_supported)
991 		return;
992 
993 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
994 
995 	ht = (struct sta_rec_ht *)tlv;
996 	ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
997 }
998 
999 static void
1000 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1001 {
1002 	struct sta_rec_vht *vht;
1003 	struct tlv *tlv;
1004 
1005 	if (!sta->vht_cap.vht_supported)
1006 		return;
1007 
1008 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1009 
1010 	vht = (struct sta_rec_vht *)tlv;
1011 	vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1012 	vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1013 	vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1014 }
1015 
1016 static void
1017 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1018 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1019 {
1020 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1021 	struct sta_rec_amsdu *amsdu;
1022 	struct tlv *tlv;
1023 
1024 	if (vif->type != NL80211_IFTYPE_STATION &&
1025 	    vif->type != NL80211_IFTYPE_AP)
1026 		return;
1027 
1028 	if (!sta->max_amsdu_len)
1029 	    return;
1030 
1031 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1032 	amsdu = (struct sta_rec_amsdu *)tlv;
1033 	amsdu->max_amsdu_num = 8;
1034 	amsdu->amsdu_en = true;
1035 	msta->wcid.amsdu = true;
1036 
1037 	switch (sta->max_amsdu_len) {
1038 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1039 		if (!is_mt7915(&dev->mt76)) {
1040 			amsdu->max_mpdu_size =
1041 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1042 			return;
1043 		}
1044 		fallthrough;
1045 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1046 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1047 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1048 		return;
1049 	default:
1050 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1051 		return;
1052 	}
1053 }
1054 
1055 static int
1056 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1057 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1058 {
1059 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1060 	struct mt7915_sta *msta;
1061 	struct wtbl_req_hdr *wtbl_hdr;
1062 	struct mt76_wcid *wcid;
1063 	struct tlv *tlv;
1064 
1065 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1066 	wcid = sta ? &msta->wcid : NULL;
1067 
1068 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1069 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1070 						  WTBL_RESET_AND_SET, tlv,
1071 						  &skb);
1072 	if (IS_ERR(wtbl_hdr))
1073 		return PTR_ERR(wtbl_hdr);
1074 
1075 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1076 					 wtbl_hdr);
1077 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1078 	if (sta)
1079 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1080 					    wtbl_hdr, mvif->cap.ht_ldpc,
1081 					    mvif->cap.vht_ldpc);
1082 
1083 	return 0;
1084 }
1085 
1086 static inline bool
1087 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1088 			struct ieee80211_sta *sta, bool bfee)
1089 {
1090 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1091 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1092 
1093 	if (vif->type != NL80211_IFTYPE_STATION &&
1094 	    vif->type != NL80211_IFTYPE_AP)
1095 		return false;
1096 
1097 	if (!bfee && tx_ant < 2)
1098 		return false;
1099 
1100 	if (sta->he_cap.has_he) {
1101 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1102 
1103 		if (bfee)
1104 			return mvif->cap.he_su_ebfee &&
1105 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1106 		else
1107 			return mvif->cap.he_su_ebfer &&
1108 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1109 	}
1110 
1111 	if (sta->vht_cap.vht_supported) {
1112 		u32 cap = sta->vht_cap.cap;
1113 
1114 		if (bfee)
1115 			return mvif->cap.vht_su_ebfee &&
1116 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1117 		else
1118 			return mvif->cap.vht_su_ebfer &&
1119 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1120 	}
1121 
1122 	return false;
1123 }
1124 
1125 static void
1126 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1127 {
1128 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1129 	bf->ndp_rate = 0;				/* mcs0 */
1130 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1131 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1132 }
1133 
1134 static void
1135 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1136 		       struct sta_rec_bf *bf)
1137 {
1138 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1139 	u8 n = 0;
1140 
1141 	bf->tx_mode = MT_PHY_TYPE_HT;
1142 
1143 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1144 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1145 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1146 			      mcs->tx_params);
1147 	else if (mcs->rx_mask[3])
1148 		n = 3;
1149 	else if (mcs->rx_mask[2])
1150 		n = 2;
1151 	else if (mcs->rx_mask[1])
1152 		n = 1;
1153 
1154 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1155 	bf->ncol = min_t(u8, bf->nrow, n);
1156 	bf->ibf_ncol = n;
1157 }
1158 
1159 static void
1160 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1161 			struct sta_rec_bf *bf, bool explicit)
1162 {
1163 	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1164 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1165 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1166 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1167 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1168 
1169 	bf->tx_mode = MT_PHY_TYPE_VHT;
1170 
1171 	if (explicit) {
1172 		u8 sts, snd_dim;
1173 
1174 		mt7915_mcu_sta_sounding_rate(bf);
1175 
1176 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1177 				pc->cap);
1178 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1179 				    vc->cap);
1180 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1181 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1182 		bf->ibf_ncol = bf->ncol;
1183 
1184 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1185 			bf->nrow = 1;
1186 	} else {
1187 		bf->nrow = tx_ant;
1188 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1189 		bf->ibf_ncol = nss_mcs;
1190 
1191 		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1192 			bf->ibf_nrow = 1;
1193 	}
1194 }
1195 
1196 static void
1197 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1198 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1199 {
1200 	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1201 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1202 	const struct ieee80211_sta_he_cap *vc =
1203 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1204 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1205 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1206 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1207 	u8 snd_dim, sts;
1208 
1209 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1210 
1211 	mt7915_mcu_sta_sounding_rate(bf);
1212 
1213 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1214 				pe->phy_cap_info[6]);
1215 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1216 				pe->phy_cap_info[6]);
1217 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1218 			 ve->phy_cap_info[5]);
1219 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1220 		     pe->phy_cap_info[4]);
1221 	bf->nrow = min_t(u8, snd_dim, sts);
1222 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1223 	bf->ibf_ncol = bf->ncol;
1224 
1225 	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1226 		return;
1227 
1228 	/* go over for 160MHz and 80p80 */
1229 	if (pe->phy_cap_info[0] &
1230 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1231 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1232 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1233 
1234 		bf->ncol_bw160 = nss_mcs;
1235 	}
1236 
1237 	if (pe->phy_cap_info[0] &
1238 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1239 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1240 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1241 
1242 		if (bf->ncol_bw160)
1243 			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1244 		else
1245 			bf->ncol_bw160 = nss_mcs;
1246 	}
1247 
1248 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1249 			 ve->phy_cap_info[5]);
1250 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1251 		     pe->phy_cap_info[4]);
1252 
1253 	bf->nrow_bw160 = min_t(int, snd_dim, sts);
1254 }
1255 
1256 static void
1257 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1258 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1259 {
1260 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1261 	struct mt7915_phy *phy = mvif->phy;
1262 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1263 	struct sta_rec_bf *bf;
1264 	struct tlv *tlv;
1265 	const u8 matrix[4][4] = {
1266 		{0, 0, 0, 0},
1267 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1268 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1269 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1270 	};
1271 	bool ebf;
1272 
1273 	if (!(sta->ht_cap.ht_supported || sta->he_cap.has_he))
1274 		return;
1275 
1276 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1277 	if (!ebf && !dev->ibf)
1278 		return;
1279 
1280 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1281 	bf = (struct sta_rec_bf *)tlv;
1282 
1283 	/* he: eBF only, in accordance with spec
1284 	 * vht: support eBF and iBF
1285 	 * ht: iBF only, since mac80211 lacks of eBF support
1286 	 */
1287 	if (sta->he_cap.has_he && ebf)
1288 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1289 	else if (sta->vht_cap.vht_supported)
1290 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1291 	else if (sta->ht_cap.ht_supported)
1292 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1293 	else
1294 		return;
1295 
1296 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1297 	bf->bw = sta->bandwidth;
1298 	bf->ibf_dbw = sta->bandwidth;
1299 	bf->ibf_nrow = tx_ant;
1300 
1301 	if (!ebf && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1302 		bf->ibf_timeout = 0x48;
1303 	else
1304 		bf->ibf_timeout = 0x18;
1305 
1306 	if (ebf && bf->nrow != tx_ant)
1307 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1308 	else
1309 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1310 
1311 	switch (sta->bandwidth) {
1312 	case IEEE80211_STA_RX_BW_160:
1313 	case IEEE80211_STA_RX_BW_80:
1314 		bf->mem_total = bf->mem_20m * 2;
1315 		break;
1316 	case IEEE80211_STA_RX_BW_40:
1317 		bf->mem_total = bf->mem_20m;
1318 		break;
1319 	case IEEE80211_STA_RX_BW_20:
1320 	default:
1321 		break;
1322 	}
1323 }
1324 
1325 static void
1326 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1327 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1328 {
1329 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1330 	struct mt7915_phy *phy = mvif->phy;
1331 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1332 	struct sta_rec_bfee *bfee;
1333 	struct tlv *tlv;
1334 	u8 nrow = 0;
1335 
1336 	if (!(sta->vht_cap.vht_supported || sta->he_cap.has_he))
1337 		return;
1338 
1339 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1340 		return;
1341 
1342 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1343 	bfee = (struct sta_rec_bfee *)tlv;
1344 
1345 	if (sta->he_cap.has_he) {
1346 		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1347 
1348 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1349 			      pe->phy_cap_info[5]);
1350 	} else if (sta->vht_cap.vht_supported) {
1351 		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1352 
1353 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1354 				 pc->cap);
1355 	}
1356 
1357 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1358 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1359 }
1360 
1361 static enum mcu_mmps_mode
1362 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1363 {
1364 	switch (smps) {
1365 	case IEEE80211_SMPS_OFF:
1366 		return MCU_MMPS_DISABLE;
1367 	case IEEE80211_SMPS_STATIC:
1368 		return MCU_MMPS_STATIC;
1369 	case IEEE80211_SMPS_DYNAMIC:
1370 		return MCU_MMPS_DYNAMIC;
1371 	default:
1372 		return MCU_MMPS_DISABLE;
1373 	}
1374 }
1375 
1376 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1377 				   struct ieee80211_vif *vif,
1378 				   struct ieee80211_sta *sta,
1379 				   void *data, u32 field)
1380 {
1381 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1382 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1383 	struct sta_phy *phy = data;
1384 	struct sta_rec_ra_fixed *ra;
1385 	struct sk_buff *skb;
1386 	struct tlv *tlv;
1387 
1388 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1389 					    &msta->wcid);
1390 	if (IS_ERR(skb))
1391 		return PTR_ERR(skb);
1392 
1393 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1394 	ra = (struct sta_rec_ra_fixed *)tlv;
1395 
1396 	switch (field) {
1397 	case RATE_PARAM_AUTO:
1398 		break;
1399 	case RATE_PARAM_FIXED:
1400 	case RATE_PARAM_FIXED_MCS:
1401 	case RATE_PARAM_FIXED_GI:
1402 	case RATE_PARAM_FIXED_HE_LTF:
1403 		if (phy)
1404 			ra->phy = *phy;
1405 		break;
1406 	case RATE_PARAM_MMPS_UPDATE:
1407 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1408 		break;
1409 	default:
1410 		break;
1411 	}
1412 	ra->field = cpu_to_le32(field);
1413 
1414 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1415 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1416 }
1417 
1418 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1419 			struct ieee80211_sta *sta)
1420 {
1421 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1422 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1423 	struct wtbl_req_hdr *wtbl_hdr;
1424 	struct tlv *sta_wtbl;
1425 	struct sk_buff *skb;
1426 	int ret;
1427 
1428 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1429 					    &msta->wcid);
1430 	if (IS_ERR(skb))
1431 		return PTR_ERR(skb);
1432 
1433 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1434 					   sizeof(struct tlv));
1435 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1436 						  WTBL_SET, sta_wtbl, &skb);
1437 	if (IS_ERR(wtbl_hdr))
1438 		return PTR_ERR(wtbl_hdr);
1439 
1440 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1441 
1442 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1443 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1444 	if (ret)
1445 		return ret;
1446 
1447 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1448 					      RATE_PARAM_MMPS_UPDATE);
1449 }
1450 
1451 static int
1452 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1453 			       struct ieee80211_vif *vif,
1454 			       struct ieee80211_sta *sta)
1455 {
1456 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1457 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1458 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1459 	enum nl80211_band band = chandef->chan->band;
1460 	struct sta_phy phy = {};
1461 	int ret, nrates = 0;
1462 
1463 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _he)				\
1464 	do {									\
1465 		u8 i, gi = mask->control[band]._gi;				\
1466 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1467 		for (i = 0; i <= sta->bandwidth; i++) {				\
1468 			phy.sgi |= gi << (i << (_he));				\
1469 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1470 		}								\
1471 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1472 			if (!mask->control[band]._mcs[i])			\
1473 				continue;					\
1474 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1475 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1476 		}								\
1477 	} while (0)
1478 
1479 	if (sta->he_cap.has_he) {
1480 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 1);
1481 	} else if (sta->vht_cap.vht_supported) {
1482 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0);
1483 	} else if (sta->ht_cap.ht_supported) {
1484 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 0);
1485 	} else {
1486 		nrates = hweight32(mask->control[band].legacy);
1487 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1488 	}
1489 #undef __sta_phy_bitrate_mask_check
1490 
1491 	/* fall back to auto rate control */
1492 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1493 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1494 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1495 	    nrates != 1)
1496 		return 0;
1497 
1498 	/* fixed single rate */
1499 	if (nrates == 1) {
1500 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1501 						     RATE_PARAM_FIXED_MCS);
1502 		if (ret)
1503 			return ret;
1504 	}
1505 
1506 	/* fixed GI */
1507 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1508 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1509 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1510 		u32 addr;
1511 
1512 		/* firmware updates only TXCMD but doesn't take WTBL into
1513 		 * account, so driver should update here to reflect the
1514 		 * actual txrate hardware sends out.
1515 		 */
1516 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1517 		if (sta->he_cap.has_he)
1518 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1519 		else
1520 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1521 
1522 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1523 						     RATE_PARAM_FIXED_GI);
1524 		if (ret)
1525 			return ret;
1526 	}
1527 
1528 	/* fixed HE_LTF */
1529 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1530 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1531 						     RATE_PARAM_FIXED_HE_LTF);
1532 		if (ret)
1533 			return ret;
1534 	}
1535 
1536 	return 0;
1537 }
1538 
1539 static void
1540 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1541 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1542 {
1543 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1544 	struct mt76_phy *mphy = mvif->phy->mt76;
1545 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1546 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1547 	enum nl80211_band band = chandef->chan->band;
1548 	struct sta_rec_ra *ra;
1549 	struct tlv *tlv;
1550 	u32 supp_rate = sta->supp_rates[band];
1551 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1552 
1553 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1554 	ra = (struct sta_rec_ra *)tlv;
1555 
1556 	ra->valid = true;
1557 	ra->auto_rate = true;
1558 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1559 	ra->channel = chandef->chan->hw_value;
1560 	ra->bw = sta->bandwidth;
1561 	ra->phy.bw = sta->bandwidth;
1562 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1563 
1564 	if (supp_rate) {
1565 		supp_rate &= mask->control[band].legacy;
1566 		ra->rate_len = hweight32(supp_rate);
1567 
1568 		if (band == NL80211_BAND_2GHZ) {
1569 			ra->supp_mode = MODE_CCK;
1570 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1571 
1572 			if (ra->rate_len > 4) {
1573 				ra->supp_mode |= MODE_OFDM;
1574 				ra->supp_ofdm_rate = supp_rate >> 4;
1575 			}
1576 		} else {
1577 			ra->supp_mode = MODE_OFDM;
1578 			ra->supp_ofdm_rate = supp_rate;
1579 		}
1580 	}
1581 
1582 	if (sta->ht_cap.ht_supported) {
1583 		ra->supp_mode |= MODE_HT;
1584 		ra->af = sta->ht_cap.ampdu_factor;
1585 		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1586 
1587 		cap |= STA_CAP_HT;
1588 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1589 			cap |= STA_CAP_SGI_20;
1590 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1591 			cap |= STA_CAP_SGI_40;
1592 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1593 			cap |= STA_CAP_TX_STBC;
1594 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1595 			cap |= STA_CAP_RX_STBC;
1596 		if (mvif->cap.ht_ldpc &&
1597 		    (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1598 			cap |= STA_CAP_LDPC;
1599 
1600 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1601 					  mask->control[band].ht_mcs);
1602 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1603 	}
1604 
1605 	if (sta->vht_cap.vht_supported) {
1606 		u8 af;
1607 
1608 		ra->supp_mode |= MODE_VHT;
1609 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1610 			       sta->vht_cap.cap);
1611 		ra->af = max_t(u8, ra->af, af);
1612 
1613 		cap |= STA_CAP_VHT;
1614 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1615 			cap |= STA_CAP_VHT_SGI_80;
1616 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1617 			cap |= STA_CAP_VHT_SGI_160;
1618 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1619 			cap |= STA_CAP_VHT_TX_STBC;
1620 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1621 			cap |= STA_CAP_VHT_RX_STBC;
1622 		if (mvif->cap.vht_ldpc &&
1623 		    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1624 			cap |= STA_CAP_VHT_LDPC;
1625 
1626 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1627 					   mask->control[band].vht_mcs);
1628 	}
1629 
1630 	if (sta->he_cap.has_he) {
1631 		ra->supp_mode |= MODE_HE;
1632 		cap |= STA_CAP_HE;
1633 
1634 		if (sta->he_6ghz_capa.capa)
1635 			ra->af = le16_get_bits(sta->he_6ghz_capa.capa,
1636 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1637 	}
1638 
1639 	ra->sta_cap = cpu_to_le32(cap);
1640 }
1641 
1642 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1643 			     struct ieee80211_sta *sta, bool changed)
1644 {
1645 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1646 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1647 	struct sk_buff *skb;
1648 	int ret;
1649 
1650 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1651 					    &msta->wcid);
1652 	if (IS_ERR(skb))
1653 		return PTR_ERR(skb);
1654 
1655 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1656 	 * once dev->rc_work changes the settings driver should also
1657 	 * update sta_rec_he here.
1658 	 */
1659 	if (changed)
1660 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1661 
1662 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1663 	 * i.e 0-{7,8,9} for VHT.
1664 	 */
1665 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1666 
1667 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1668 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1669 	if (ret)
1670 		return ret;
1671 
1672 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1673 	 * and updates as peer fixed rate parameters, which overrides
1674 	 * sta_rec_ra and firmware rate control algorithm.
1675 	 */
1676 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1677 }
1678 
1679 static int
1680 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1681 		     struct ieee80211_sta *sta)
1682 {
1683 #define MT_STA_BSS_GROUP		1
1684 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1685 	struct mt7915_sta *msta;
1686 	struct {
1687 		__le32 action;
1688 		u8 wlan_idx_lo;
1689 		u8 status;
1690 		u8 wlan_idx_hi;
1691 		u8 rsv0[5];
1692 		__le32 val;
1693 		u8 rsv1[8];
1694 	} __packed req = {
1695 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1696 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1697 	};
1698 
1699 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1700 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1701 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1702 
1703 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1704 				 sizeof(req), true);
1705 }
1706 
1707 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1708 		       struct ieee80211_sta *sta, bool enable)
1709 {
1710 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1711 	struct mt7915_sta *msta;
1712 	struct sk_buff *skb;
1713 	int ret;
1714 
1715 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1716 
1717 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1718 					    &msta->wcid);
1719 	if (IS_ERR(skb))
1720 		return PTR_ERR(skb);
1721 
1722 	/* starec basic */
1723 	mt76_connac_mcu_sta_basic_tlv(skb, vif, sta, enable, true);
1724 	if (!enable)
1725 		goto out;
1726 
1727 	/* tag order is in accordance with firmware dependency. */
1728 	if (sta) {
1729 		/* starec bfer */
1730 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1731 		/* starec ht */
1732 		mt7915_mcu_sta_ht_tlv(skb, sta);
1733 		/* starec vht */
1734 		mt7915_mcu_sta_vht_tlv(skb, sta);
1735 		/* starec uapsd */
1736 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1737 	}
1738 
1739 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1740 	if (ret) {
1741 		dev_kfree_skb(skb);
1742 		return ret;
1743 	}
1744 
1745 	if (sta) {
1746 		/* starec amsdu */
1747 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1748 		/* starec he */
1749 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1750 		/* starec muru */
1751 		mt7915_mcu_sta_muru_tlv(skb, sta, vif);
1752 		/* starec bfee */
1753 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1754 	}
1755 
1756 	ret = mt7915_mcu_add_group(dev, vif, sta);
1757 	if (ret) {
1758 		dev_kfree_skb(skb);
1759 		return ret;
1760 	}
1761 out:
1762 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1763 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1764 }
1765 
1766 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1767 			    struct ieee80211_vif *vif, bool enable)
1768 {
1769 	struct mt7915_dev *dev = phy->dev;
1770 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1771 	struct {
1772 		struct req_hdr {
1773 			u8 omac_idx;
1774 			u8 dbdc_idx;
1775 			__le16 tlv_num;
1776 			u8 is_tlv_append;
1777 			u8 rsv[3];
1778 		} __packed hdr;
1779 		struct req_tlv {
1780 			__le16 tag;
1781 			__le16 len;
1782 			u8 active;
1783 			u8 dbdc_idx;
1784 			u8 omac_addr[ETH_ALEN];
1785 		} __packed tlv;
1786 	} data = {
1787 		.hdr = {
1788 			.omac_idx = mvif->mt76.omac_idx,
1789 			.dbdc_idx = mvif->mt76.band_idx,
1790 			.tlv_num = cpu_to_le16(1),
1791 			.is_tlv_append = 1,
1792 		},
1793 		.tlv = {
1794 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1795 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1796 			.active = enable,
1797 			.dbdc_idx = mvif->mt76.band_idx,
1798 		},
1799 	};
1800 
1801 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1802 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1803 
1804 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1805 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1806 				 &data, sizeof(data), true);
1807 }
1808 
1809 static void
1810 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1811 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1812 			 struct ieee80211_mutable_offsets *offs)
1813 {
1814 	struct bss_info_bcn_cntdwn *info;
1815 	struct tlv *tlv;
1816 	int sub_tag;
1817 
1818 	if (!offs->cntdwn_counter_offs[0])
1819 		return;
1820 
1821 	sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1822 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1823 					   &bcn->sub_ntlv, &bcn->len);
1824 	info = (struct bss_info_bcn_cntdwn *)tlv;
1825 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1826 }
1827 
1828 static void
1829 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1830 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1831 		       struct ieee80211_mutable_offsets *offs)
1832 {
1833 	struct bss_info_bcn_mbss *mbss;
1834 	const struct element *elem;
1835 	struct tlv *tlv;
1836 
1837 	if (!vif->bss_conf.bssid_indicator)
1838 		return;
1839 
1840 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1841 					   sizeof(*mbss), &bcn->sub_ntlv,
1842 					   &bcn->len);
1843 
1844 	mbss = (struct bss_info_bcn_mbss *)tlv;
1845 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1846 	mbss->bitmap = cpu_to_le32(1);
1847 
1848 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1849 			    &skb->data[offs->mbssid_off],
1850 			    skb->len - offs->mbssid_off) {
1851 		const struct element *sub_elem;
1852 
1853 		if (elem->datalen < 2)
1854 			continue;
1855 
1856 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1857 			const u8 *data;
1858 
1859 			if (sub_elem->id || sub_elem->datalen < 4)
1860 				continue; /* not a valid BSS profile */
1861 
1862 			/* Find WLAN_EID_MULTI_BSSID_IDX
1863 			 * in the merged nontransmitted profile
1864 			 */
1865 			data = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1866 						sub_elem->data,
1867 						sub_elem->datalen);
1868 			if (!data || data[1] < 1 || !data[2])
1869 				continue;
1870 
1871 			mbss->offset[data[2]] = cpu_to_le16(data - skb->data);
1872 			mbss->bitmap |= cpu_to_le32(BIT(data[2]));
1873 		}
1874 	}
1875 }
1876 
1877 static void
1878 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1879 		       struct sk_buff *rskb, struct sk_buff *skb,
1880 		       struct bss_info_bcn *bcn,
1881 		       struct ieee80211_mutable_offsets *offs)
1882 {
1883 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1884 	struct bss_info_bcn_cont *cont;
1885 	struct tlv *tlv;
1886 	u8 *buf;
1887 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1888 
1889 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1890 					   len, &bcn->sub_ntlv, &bcn->len);
1891 
1892 	cont = (struct bss_info_bcn_cont *)tlv;
1893 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1894 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1895 
1896 	if (offs->cntdwn_counter_offs[0]) {
1897 		u16 offset = offs->cntdwn_counter_offs[0];
1898 
1899 		if (vif->csa_active)
1900 			cont->csa_ofs = cpu_to_le16(offset - 4);
1901 		if (vif->color_change_active)
1902 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1903 	}
1904 
1905 	buf = (u8 *)tlv + sizeof(*cont);
1906 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
1907 			      true);
1908 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1909 }
1910 
1911 static void
1912 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1913 			     struct sk_buff *skb)
1914 {
1915 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1916 	struct mt7915_vif_cap *vc = &mvif->cap;
1917 	const struct ieee80211_he_cap_elem *he;
1918 	const struct ieee80211_vht_cap *vht;
1919 	const struct ieee80211_ht_cap *ht;
1920 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1921 	const u8 *ie;
1922 	u32 len, bc;
1923 
1924 	/* Check missing configuration options to allow AP mode in mac80211
1925 	 * to remain in sync with hostapd settings, and get a subset of
1926 	 * beacon and hardware capabilities.
1927 	 */
1928 	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
1929 		return;
1930 
1931 	memset(vc, 0, sizeof(*vc));
1932 
1933 	len = skb->len - (mgmt->u.beacon.variable - skb->data);
1934 
1935 	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
1936 			      len);
1937 	if (ie && ie[1] >= sizeof(*ht)) {
1938 		ht = (void *)(ie + 2);
1939 		vc->ht_ldpc = !!(le16_to_cpu(ht->cap_info) &
1940 				 IEEE80211_HT_CAP_LDPC_CODING);
1941 	}
1942 
1943 	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
1944 			      len);
1945 	if (ie && ie[1] >= sizeof(*vht)) {
1946 		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
1947 
1948 		vht = (void *)(ie + 2);
1949 		bc = le32_to_cpu(vht->vht_cap_info);
1950 
1951 		vc->vht_ldpc = !!(bc & IEEE80211_VHT_CAP_RXLDPC);
1952 		vc->vht_su_ebfer =
1953 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
1954 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1955 		vc->vht_su_ebfee =
1956 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
1957 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1958 		vc->vht_mu_ebfer =
1959 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
1960 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
1961 		vc->vht_mu_ebfee =
1962 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
1963 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1964 	}
1965 
1966 	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
1967 				  mgmt->u.beacon.variable, len);
1968 	if (ie && ie[1] >= sizeof(*he) + 1) {
1969 		const struct ieee80211_sta_he_cap *pc =
1970 			mt76_connac_get_he_phy_cap(phy->mt76, vif);
1971 		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1972 
1973 		he = (void *)(ie + 3);
1974 
1975 		vc->he_ldpc =
1976 			HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
1977 		vc->he_su_ebfer =
1978 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
1979 			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1980 		vc->he_su_ebfee =
1981 			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
1982 			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1983 		vc->he_mu_ebfer =
1984 			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
1985 			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
1986 	}
1987 }
1988 
1989 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
1990 			  struct ieee80211_vif *vif, int en)
1991 {
1992 #define MAX_BEACON_SIZE 512
1993 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1994 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1995 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1996 	struct ieee80211_mutable_offsets offs;
1997 	struct ieee80211_tx_info *info;
1998 	struct sk_buff *skb, *rskb;
1999 	struct tlv *tlv;
2000 	struct bss_info_bcn *bcn;
2001 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2002 	bool ext_phy = phy != &dev->phy;
2003 
2004 	if (vif->bss_conf.nontransmitted)
2005 		return 0;
2006 
2007 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2008 					       NULL, len);
2009 	if (IS_ERR(rskb))
2010 		return PTR_ERR(rskb);
2011 
2012 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2013 	bcn = (struct bss_info_bcn *)tlv;
2014 	bcn->enable = en;
2015 
2016 	if (!en)
2017 		goto out;
2018 
2019 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2020 	if (!skb)
2021 		return -EINVAL;
2022 
2023 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2024 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2025 		dev_kfree_skb(skb);
2026 		return -EINVAL;
2027 	}
2028 
2029 	if (ext_phy) {
2030 		info = IEEE80211_SKB_CB(skb);
2031 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2032 	}
2033 
2034 	mt7915_mcu_beacon_check_caps(phy, vif, skb);
2035 
2036 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2037 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2038 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2039 	dev_kfree_skb(skb);
2040 
2041 out:
2042 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2043 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2044 }
2045 
2046 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2047 {
2048 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2049 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2050 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2051 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2052 		return -EIO;
2053 	}
2054 
2055 	/* clear irq when the driver own success */
2056 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2057 		MT_TOP_LPCR_HOST_BAND_STAT);
2058 
2059 	return 0;
2060 }
2061 
2062 static int mt7915_load_patch(struct mt7915_dev *dev)
2063 {
2064 	const struct mt7915_patch_hdr *hdr;
2065 	const struct firmware *fw = NULL;
2066 	int i, ret, sem;
2067 
2068 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 1);
2069 	switch (sem) {
2070 	case PATCH_IS_DL:
2071 		return 0;
2072 	case PATCH_NOT_DL_SEM_SUCCESS:
2073 		break;
2074 	default:
2075 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2076 		return -EAGAIN;
2077 	}
2078 
2079 	ret = request_firmware(&fw, fw_name_var(dev, ROM_PATCH),
2080 			       dev->mt76.dev);
2081 	if (ret)
2082 		goto out;
2083 
2084 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2085 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2086 		ret = -EINVAL;
2087 		goto out;
2088 	}
2089 
2090 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2091 
2092 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2093 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2094 
2095 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2096 		struct mt7915_patch_sec *sec;
2097 		const u8 *dl;
2098 		u32 len, addr;
2099 
2100 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2101 						  i * sizeof(*sec));
2102 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2103 		    PATCH_SEC_TYPE_INFO) {
2104 			ret = -EINVAL;
2105 			goto out;
2106 		}
2107 
2108 		addr = be32_to_cpu(sec->info.addr);
2109 		len = be32_to_cpu(sec->info.len);
2110 		dl = fw->data + be32_to_cpu(sec->offs);
2111 
2112 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2113 						    DL_MODE_NEED_RSP);
2114 		if (ret) {
2115 			dev_err(dev->mt76.dev, "Download request failed\n");
2116 			goto out;
2117 		}
2118 
2119 		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2120 					       dl, len, 4096);
2121 		if (ret) {
2122 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2123 			goto out;
2124 		}
2125 	}
2126 
2127 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
2128 	if (ret)
2129 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2130 
2131 out:
2132 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 0);
2133 	switch (sem) {
2134 	case PATCH_REL_SEM_SUCCESS:
2135 		break;
2136 	default:
2137 		ret = -EAGAIN;
2138 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2139 		break;
2140 	}
2141 	release_firmware(fw);
2142 
2143 	return ret;
2144 }
2145 
2146 static int
2147 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2148 			     const struct mt7915_fw_trailer *hdr,
2149 			     const u8 *data, bool is_wa)
2150 {
2151 	int i, offset = 0;
2152 	u32 override = 0, option = 0;
2153 
2154 	for (i = 0; i < hdr->n_region; i++) {
2155 		const struct mt7915_fw_region *region;
2156 		int err;
2157 		u32 len, addr, mode;
2158 
2159 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2160 			 (hdr->n_region - i) * sizeof(*region));
2161 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
2162 						   region->feature_set, is_wa);
2163 		len = le32_to_cpu(region->len);
2164 		addr = le32_to_cpu(region->addr);
2165 
2166 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2167 			override = addr;
2168 
2169 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2170 						    mode);
2171 		if (err) {
2172 			dev_err(dev->mt76.dev, "Download request failed\n");
2173 			return err;
2174 		}
2175 
2176 		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2177 					       data + offset, len, 4096);
2178 		if (err) {
2179 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2180 			return err;
2181 		}
2182 
2183 		offset += len;
2184 	}
2185 
2186 	if (override)
2187 		option |= FW_START_OVERRIDE;
2188 
2189 	if (is_wa)
2190 		option |= FW_START_WORKING_PDA_CR4;
2191 
2192 	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
2193 }
2194 
2195 static int mt7915_load_ram(struct mt7915_dev *dev)
2196 {
2197 	const struct mt7915_fw_trailer *hdr;
2198 	const struct firmware *fw;
2199 	int ret;
2200 
2201 	ret = request_firmware(&fw, fw_name_var(dev, FIRMWARE_WM),
2202 			       dev->mt76.dev);
2203 	if (ret)
2204 		return ret;
2205 
2206 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2207 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2208 		ret = -EINVAL;
2209 		goto out;
2210 	}
2211 
2212 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2213 					sizeof(*hdr));
2214 
2215 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2216 		 hdr->fw_ver, hdr->build_date);
2217 
2218 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2219 	if (ret) {
2220 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2221 		goto out;
2222 	}
2223 
2224 	release_firmware(fw);
2225 
2226 	ret = request_firmware(&fw, fw_name(dev, FIRMWARE_WA),
2227 			       dev->mt76.dev);
2228 	if (ret)
2229 		return ret;
2230 
2231 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2232 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2233 		ret = -EINVAL;
2234 		goto out;
2235 	}
2236 
2237 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2238 					sizeof(*hdr));
2239 
2240 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2241 		 hdr->fw_ver, hdr->build_date);
2242 
2243 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2244 	if (ret) {
2245 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2246 		goto out;
2247 	}
2248 
2249 	snprintf(dev->mt76.hw->wiphy->fw_version,
2250 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2251 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2252 
2253 out:
2254 	release_firmware(fw);
2255 
2256 	return ret;
2257 }
2258 
2259 static int
2260 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2261 {
2262 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2263 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2264 
2265 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2266 			    state, 1000)) {
2267 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2268 		return -EIO;
2269 	}
2270 	return 0;
2271 }
2272 
2273 static int mt7915_load_firmware(struct mt7915_dev *dev)
2274 {
2275 	int ret;
2276 
2277 	/* make sure fw is download state */
2278 	if (mt7915_firmware_state(dev, false)) {
2279 		/* restart firmware once */
2280 		__mt76_mcu_restart(&dev->mt76);
2281 		ret = mt7915_firmware_state(dev, false);
2282 		if (ret) {
2283 			dev_err(dev->mt76.dev,
2284 				"Firmware is not ready for download\n");
2285 			return ret;
2286 		}
2287 	}
2288 
2289 	ret = mt7915_load_patch(dev);
2290 	if (ret)
2291 		return ret;
2292 
2293 	ret = mt7915_load_ram(dev);
2294 	if (ret)
2295 		return ret;
2296 
2297 	ret = mt7915_firmware_state(dev, true);
2298 	if (ret)
2299 		return ret;
2300 
2301 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2302 
2303 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2304 
2305 	return 0;
2306 }
2307 
2308 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2309 {
2310 	struct {
2311 		u8 ctrl_val;
2312 		u8 pad[3];
2313 	} data = {
2314 		.ctrl_val = ctrl
2315 	};
2316 
2317 	if (type == MCU_FW_LOG_WA)
2318 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2319 					 &data, sizeof(data), true);
2320 
2321 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2322 				 sizeof(data), true);
2323 }
2324 
2325 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2326 {
2327 	struct {
2328 		u8 ver;
2329 		u8 pad;
2330 		__le16 len;
2331 		u8 level;
2332 		u8 rsv[3];
2333 		__le32 module_idx;
2334 	} data = {
2335 		.module_idx = cpu_to_le32(module),
2336 		.level = level,
2337 	};
2338 
2339 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2340 				 sizeof(data), false);
2341 }
2342 
2343 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2344 {
2345 	struct {
2346 		__le32 cmd;
2347 		u8 enable;
2348 	} data = {
2349 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2350 		.enable = enabled,
2351 	};
2352 
2353 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2354 				sizeof(data), false);
2355 }
2356 
2357 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2358 {
2359 	struct mt7915_dev *dev = phy->dev;
2360 	struct sk_buff *skb;
2361 	struct mt7915_mcu_muru_stats *mu_stats =
2362 				(struct mt7915_mcu_muru_stats *)ms;
2363 	int ret;
2364 
2365 	struct {
2366 		__le32 cmd;
2367 		u8 band_idx;
2368 	} req = {
2369 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2370 		.band_idx = phy->band_idx,
2371 	};
2372 
2373 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2374 					&req, sizeof(req), true, &skb);
2375 	if (ret)
2376 		return ret;
2377 
2378 	memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2379 	dev_kfree_skb(skb);
2380 
2381 	return 0;
2382 }
2383 
2384 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2385 {
2386 	struct {
2387 		u8 enable;
2388 		u8 _rsv[3];
2389 	} __packed req = {
2390 		.enable = enabled
2391 	};
2392 
2393 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2394 				 sizeof(req), false);
2395 }
2396 
2397 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2398 {
2399 	struct {
2400 		__le32 cmd;
2401 		u8 val[4];
2402 	} __packed req = {
2403 		.cmd = cpu_to_le32(cmd),
2404 	};
2405 
2406 	put_unaligned_le32(val, req.val);
2407 
2408 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2409 				 sizeof(req), false);
2410 }
2411 
2412 static int
2413 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2414 {
2415 #define RX_AIRTIME_FEATURE_CTRL		1
2416 #define RX_AIRTIME_BITWISE_CTRL		2
2417 #define RX_AIRTIME_CLEAR_EN	1
2418 	struct {
2419 		__le16 field;
2420 		__le16 sub_field;
2421 		__le32 set_status;
2422 		__le32 get_status;
2423 		u8 _rsv[12];
2424 
2425 		bool airtime_en;
2426 		bool mibtime_en;
2427 		bool earlyend_en;
2428 		u8 _rsv1[9];
2429 
2430 		bool airtime_clear;
2431 		bool mibtime_clear;
2432 		u8 _rsv2[98];
2433 	} __packed req = {
2434 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2435 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2436 		.airtime_clear = true,
2437 	};
2438 	int ret;
2439 
2440 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2441 				sizeof(req), true);
2442 	if (ret)
2443 		return ret;
2444 
2445 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2446 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2447 	req.airtime_en = true;
2448 
2449 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2450 				 sizeof(req), true);
2451 }
2452 
2453 int mt7915_mcu_init(struct mt7915_dev *dev)
2454 {
2455 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2456 		.headroom = sizeof(struct mt7915_mcu_txd),
2457 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2458 		.mcu_parse_response = mt7915_mcu_parse_response,
2459 		.mcu_restart = mt76_connac_mcu_restart,
2460 	};
2461 	int ret;
2462 
2463 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2464 
2465 	/* force firmware operation mode into normal state,
2466 	 * which should be set before firmware download stage.
2467 	 */
2468 	if (is_mt7915(&dev->mt76))
2469 		mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2470 	else
2471 		mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
2472 
2473 	ret = mt7915_driver_own(dev, 0);
2474 	if (ret)
2475 		return ret;
2476 	/* set driver own for band1 when two hif exist */
2477 	if (dev->hif2) {
2478 		ret = mt7915_driver_own(dev, 1);
2479 		if (ret)
2480 			return ret;
2481 	}
2482 
2483 	ret = mt7915_load_firmware(dev);
2484 	if (ret)
2485 		return ret;
2486 
2487 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2488 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2489 	if (ret)
2490 		return ret;
2491 
2492 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2493 	if (ret)
2494 		return ret;
2495 
2496 	ret = mt7915_mcu_set_mwds(dev, 1);
2497 	if (ret)
2498 		return ret;
2499 
2500 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2501 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2502 	if (ret)
2503 		return ret;
2504 
2505 	ret = mt7915_mcu_init_rx_airtime(dev);
2506 	if (ret)
2507 		return ret;
2508 
2509 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2510 				 MCU_WA_PARAM_RED, 0, 0);
2511 }
2512 
2513 void mt7915_mcu_exit(struct mt7915_dev *dev)
2514 {
2515 	__mt76_mcu_restart(&dev->mt76);
2516 	if (mt7915_firmware_state(dev, false)) {
2517 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2518 		return;
2519 	}
2520 
2521 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2522 	if (dev->hif2)
2523 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2524 			MT_TOP_LPCR_HOST_FW_OWN);
2525 	skb_queue_purge(&dev->mt76.mcu.res_q);
2526 }
2527 
2528 static int
2529 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2530 {
2531 	struct {
2532 		u8 operation;
2533 		u8 count;
2534 		u8 _rsv[2];
2535 		u8 index;
2536 		u8 enable;
2537 		__le16 etype;
2538 	} req = {
2539 		.operation = 1,
2540 		.count = 1,
2541 		.enable = 1,
2542 		.etype = cpu_to_le16(ETH_P_PAE),
2543 	};
2544 
2545 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2546 				 &req, sizeof(req), false);
2547 }
2548 
2549 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2550 		       bool enable, bool hdr_trans)
2551 {
2552 	struct {
2553 		u8 operation;
2554 		u8 enable;
2555 		u8 check_bssid;
2556 		u8 insert_vlan;
2557 		u8 remove_vlan;
2558 		u8 tid;
2559 		u8 mode;
2560 		u8 rsv;
2561 	} __packed req_trans = {
2562 		.enable = hdr_trans,
2563 	};
2564 	struct {
2565 		u8 enable;
2566 		u8 band;
2567 		u8 rsv[2];
2568 	} __packed req_mac = {
2569 		.enable = enable,
2570 		.band = band,
2571 	};
2572 	int ret;
2573 
2574 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2575 				&req_trans, sizeof(req_trans), false);
2576 	if (ret)
2577 		return ret;
2578 
2579 	if (hdr_trans)
2580 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2581 
2582 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2583 				 &req_mac, sizeof(req_mac), true);
2584 }
2585 
2586 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2587 {
2588 	struct {
2589 		__le32 cmd;
2590 		u8 band;
2591 		u8 enable;
2592 	} __packed req = {
2593 		.cmd = cpu_to_le32(SCS_ENABLE),
2594 		.band = band,
2595 		.enable = enable + 1,
2596 	};
2597 
2598 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
2599 				 sizeof(req), false);
2600 }
2601 
2602 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2603 {
2604 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2605 	u8 num = req->total;
2606 	size_t len = sizeof(*req) -
2607 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2608 
2609 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2610 				 len, true);
2611 }
2612 
2613 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2614 {
2615 #define TX_CMD_MODE		1
2616 	struct mt7915_mcu_tx req = {
2617 		.valid = true,
2618 		.mode = TX_CMD_MODE,
2619 		.total = IEEE80211_NUM_ACS,
2620 	};
2621 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2622 	int ac;
2623 
2624 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2625 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2626 		struct edca *e = &req.edca[ac];
2627 
2628 		e->set = WMM_PARAM_SET;
2629 		e->queue = ac + mvif->mt76.wmm_idx * MT7915_MAX_WMM_SETS;
2630 		e->aifs = q->aifs;
2631 		e->txop = cpu_to_le16(q->txop);
2632 
2633 		if (q->cw_min)
2634 			e->cw_min = fls(q->cw_min);
2635 		else
2636 			e->cw_min = 5;
2637 
2638 		if (q->cw_max)
2639 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2640 		else
2641 			e->cw_max = cpu_to_le16(10);
2642 	}
2643 
2644 	return mt7915_mcu_update_edca(dev, &req);
2645 }
2646 
2647 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2648 {
2649 	struct {
2650 		__le32 tag;
2651 		__le16 min_lpn;
2652 		u8 rsv[2];
2653 	} __packed req = {
2654 		.tag = cpu_to_le32(0x1),
2655 		.min_lpn = cpu_to_le16(val),
2656 	};
2657 
2658 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2659 				 sizeof(req), true);
2660 }
2661 
2662 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2663 			    const struct mt7915_dfs_pulse *pulse)
2664 {
2665 	struct {
2666 		__le32 tag;
2667 
2668 		__le32 max_width;		/* us */
2669 		__le32 max_pwr;			/* dbm */
2670 		__le32 min_pwr;			/* dbm */
2671 		__le32 min_stgr_pri;		/* us */
2672 		__le32 max_stgr_pri;		/* us */
2673 		__le32 min_cr_pri;		/* us */
2674 		__le32 max_cr_pri;		/* us */
2675 	} __packed req = {
2676 		.tag = cpu_to_le32(0x3),
2677 
2678 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2679 		__req_field(max_width),
2680 		__req_field(max_pwr),
2681 		__req_field(min_pwr),
2682 		__req_field(min_stgr_pri),
2683 		__req_field(max_stgr_pri),
2684 		__req_field(min_cr_pri),
2685 		__req_field(max_cr_pri),
2686 #undef __req_field
2687 	};
2688 
2689 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2690 				 sizeof(req), true);
2691 }
2692 
2693 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2694 			    const struct mt7915_dfs_pattern *pattern)
2695 {
2696 	struct {
2697 		__le32 tag;
2698 		__le16 radar_type;
2699 
2700 		u8 enb;
2701 		u8 stgr;
2702 		u8 min_crpn;
2703 		u8 max_crpn;
2704 		u8 min_crpr;
2705 		u8 min_pw;
2706 		__le32 min_pri;
2707 		__le32 max_pri;
2708 		u8 max_pw;
2709 		u8 min_crbn;
2710 		u8 max_crbn;
2711 		u8 min_stgpn;
2712 		u8 max_stgpn;
2713 		u8 min_stgpr;
2714 		u8 rsv[2];
2715 		__le32 min_stgpr_diff;
2716 	} __packed req = {
2717 		.tag = cpu_to_le32(0x2),
2718 		.radar_type = cpu_to_le16(index),
2719 
2720 #define __req_field_u8(field) .field = pattern->field
2721 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2722 		__req_field_u8(enb),
2723 		__req_field_u8(stgr),
2724 		__req_field_u8(min_crpn),
2725 		__req_field_u8(max_crpn),
2726 		__req_field_u8(min_crpr),
2727 		__req_field_u8(min_pw),
2728 		__req_field_u32(min_pri),
2729 		__req_field_u32(max_pri),
2730 		__req_field_u8(max_pw),
2731 		__req_field_u8(min_crbn),
2732 		__req_field_u8(max_crbn),
2733 		__req_field_u8(min_stgpn),
2734 		__req_field_u8(max_stgpn),
2735 		__req_field_u8(min_stgpr),
2736 		__req_field_u32(min_stgpr_diff),
2737 #undef __req_field_u8
2738 #undef __req_field_u32
2739 	};
2740 
2741 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2742 				 sizeof(req), true);
2743 }
2744 
2745 static int
2746 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2747 				 struct cfg80211_chan_def *chandef,
2748 				 int cmd)
2749 {
2750 	struct mt7915_dev *dev = phy->dev;
2751 	struct mt76_phy *mphy = phy->mt76;
2752 	struct ieee80211_channel *chan = mphy->chandef.chan;
2753 	int freq = mphy->chandef.center_freq1;
2754 	struct mt7915_mcu_background_chain_ctrl req = {
2755 		.monitor_scan_type = 2, /* simple rx */
2756 	};
2757 
2758 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2759 		return -EINVAL;
2760 
2761 	if (!cfg80211_chandef_valid(&mphy->chandef))
2762 		return -EINVAL;
2763 
2764 	switch (cmd) {
2765 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2766 		req.chan = chan->hw_value;
2767 		req.central_chan = ieee80211_frequency_to_channel(freq);
2768 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2769 		req.monitor_chan = chandef->chan->hw_value;
2770 		req.monitor_central_chan =
2771 			ieee80211_frequency_to_channel(chandef->center_freq1);
2772 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2773 		req.band_idx = phy != &dev->phy;
2774 		req.scan_mode = 1;
2775 		break;
2776 	}
2777 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2778 		req.monitor_chan = chandef->chan->hw_value;
2779 		req.monitor_central_chan =
2780 			ieee80211_frequency_to_channel(chandef->center_freq1);
2781 		req.band_idx = phy != &dev->phy;
2782 		req.scan_mode = 2;
2783 		break;
2784 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2785 		req.chan = chan->hw_value;
2786 		req.central_chan = ieee80211_frequency_to_channel(freq);
2787 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2788 		req.tx_stream = hweight8(mphy->antenna_mask);
2789 		req.rx_stream = mphy->antenna_mask;
2790 		break;
2791 	default:
2792 		return -EINVAL;
2793 	}
2794 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2795 
2796 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2797 				 &req, sizeof(req), false);
2798 }
2799 
2800 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2801 				     struct cfg80211_chan_def *chandef)
2802 {
2803 	struct mt7915_dev *dev = phy->dev;
2804 	int err, region;
2805 
2806 	if (!chandef) { /* disable offchain */
2807 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2808 					      0, 0);
2809 		if (err)
2810 			return err;
2811 
2812 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2813 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2814 	}
2815 
2816 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2817 					       CH_SWITCH_BACKGROUND_SCAN_START);
2818 	if (err)
2819 		return err;
2820 
2821 	switch (dev->mt76.region) {
2822 	case NL80211_DFS_ETSI:
2823 		region = 0;
2824 		break;
2825 	case NL80211_DFS_JP:
2826 		region = 2;
2827 		break;
2828 	case NL80211_DFS_FCC:
2829 	default:
2830 		region = 1;
2831 		break;
2832 	}
2833 
2834 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2835 				       0, region);
2836 }
2837 
2838 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2839 {
2840 	static const u8 ch_band[] = {
2841 		[NL80211_BAND_2GHZ] = 0,
2842 		[NL80211_BAND_5GHZ] = 1,
2843 		[NL80211_BAND_6GHZ] = 2,
2844 	};
2845 	struct mt7915_dev *dev = phy->dev;
2846 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2847 	int freq1 = chandef->center_freq1;
2848 	struct {
2849 		u8 control_ch;
2850 		u8 center_ch;
2851 		u8 bw;
2852 		u8 tx_streams_num;
2853 		u8 rx_streams;	/* mask or num */
2854 		u8 switch_reason;
2855 		u8 band_idx;
2856 		u8 center_ch2;	/* for 80+80 only */
2857 		__le16 cac_case;
2858 		u8 channel_band;
2859 		u8 rsv0;
2860 		__le32 outband_freq;
2861 		u8 txpower_drop;
2862 		u8 ap_bw;
2863 		u8 ap_center_ch;
2864 		u8 rsv1[57];
2865 	} __packed req = {
2866 		.control_ch = chandef->chan->hw_value,
2867 		.center_ch = ieee80211_frequency_to_channel(freq1),
2868 		.bw = mt76_connac_chan_bw(chandef),
2869 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
2870 		.rx_streams = phy->mt76->antenna_mask,
2871 		.band_idx = phy->band_idx,
2872 		.channel_band = ch_band[chandef->chan->band],
2873 	};
2874 
2875 #ifdef CONFIG_NL80211_TESTMODE
2876 	if (phy->mt76->test.tx_antenna_mask &&
2877 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
2878 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
2879 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
2880 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
2881 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
2882 
2883 		if (phy != &dev->phy)
2884 			req.rx_streams >>= dev->chainshift;
2885 	}
2886 #endif
2887 
2888 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2889 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2890 		req.switch_reason = CH_SWITCH_NORMAL;
2891 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2892 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2893 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2894 					  NL80211_IFTYPE_AP))
2895 		req.switch_reason = CH_SWITCH_DFS;
2896 	else
2897 		req.switch_reason = CH_SWITCH_NORMAL;
2898 
2899 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2900 		req.rx_streams = hweight8(req.rx_streams);
2901 
2902 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2903 		int freq2 = chandef->center_freq2;
2904 
2905 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2906 	}
2907 
2908 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2909 }
2910 
2911 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2912 {
2913 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2914 #define PAGE_IDX_MASK		GENMASK(4, 2)
2915 #define PER_PAGE_SIZE		0x400
2916 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2917 	u16 eeprom_size = mt7915_eeprom_size(dev);
2918 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2919 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2920 	int eep_len;
2921 	int i;
2922 
2923 	for (i = 0; i < total; i++, eep += eep_len) {
2924 		struct sk_buff *skb;
2925 		int ret;
2926 
2927 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2928 			eep_len = eeprom_size % PER_PAGE_SIZE;
2929 		else
2930 			eep_len = PER_PAGE_SIZE;
2931 
2932 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2933 					 sizeof(req) + eep_len);
2934 		if (!skb)
2935 			return -ENOMEM;
2936 
2937 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2938 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2939 		req.len = cpu_to_le16(eep_len);
2940 
2941 		skb_put_data(skb, &req, sizeof(req));
2942 		skb_put_data(skb, eep, eep_len);
2943 
2944 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2945 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2946 		if (ret)
2947 			return ret;
2948 	}
2949 
2950 	return 0;
2951 }
2952 
2953 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2954 {
2955 	struct mt7915_mcu_eeprom req = {
2956 		.buffer_mode = EE_MODE_EFUSE,
2957 		.format = EE_FORMAT_WHOLE,
2958 	};
2959 
2960 	if (dev->flash_mode)
2961 		return mt7915_mcu_set_eeprom_flash(dev);
2962 
2963 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2964 				 &req, sizeof(req), true);
2965 }
2966 
2967 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2968 {
2969 	struct mt7915_mcu_eeprom_info req = {
2970 		.addr = cpu_to_le32(round_down(offset,
2971 				    MT7915_EEPROM_BLOCK_SIZE)),
2972 	};
2973 	struct mt7915_mcu_eeprom_info *res;
2974 	struct sk_buff *skb;
2975 	int ret;
2976 	u8 *buf;
2977 
2978 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
2979 				sizeof(req), true, &skb);
2980 	if (ret)
2981 		return ret;
2982 
2983 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2984 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2985 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2986 	dev_kfree_skb(skb);
2987 
2988 	return 0;
2989 }
2990 
2991 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2992 {
2993 	struct {
2994 		u8 _rsv;
2995 		u8 version;
2996 		u8 die_idx;
2997 		u8 _rsv2;
2998 	} __packed req = {
2999 		.version = 1,
3000 	};
3001 	struct sk_buff *skb;
3002 	int ret;
3003 
3004 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
3005 					sizeof(req), true, &skb);
3006 	if (ret)
3007 		return ret;
3008 
3009 	*block_num = *(u8 *)skb->data;
3010 	dev_kfree_skb(skb);
3011 
3012 	return 0;
3013 }
3014 
3015 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3016 				  u8 *data, u32 len, int cmd)
3017 {
3018 	struct {
3019 		u8 dir;
3020 		u8 valid;
3021 		__le16 bitmap;
3022 		s8 precal;
3023 		u8 action;
3024 		u8 band;
3025 		u8 idx;
3026 		u8 rsv[4];
3027 		__le32 len;
3028 	} req = {};
3029 	struct sk_buff *skb;
3030 
3031 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3032 	if (!skb)
3033 		return -ENOMEM;
3034 
3035 	req.idx = idx;
3036 	req.len = cpu_to_le32(len);
3037 	skb_put_data(skb, &req, sizeof(req));
3038 	skb_put_data(skb, data, len);
3039 
3040 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3041 }
3042 
3043 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3044 {
3045 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3046 	u32 total = MT_EE_CAL_GROUP_SIZE;
3047 
3048 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3049 		return 0;
3050 
3051 	/*
3052 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3053 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3054 	 */
3055 	while (total > 0) {
3056 		int ret, len;
3057 
3058 		len = min_t(u32, total, MT_EE_CAL_UNIT);
3059 
3060 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3061 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3062 		if (ret)
3063 			return ret;
3064 
3065 		total -= len;
3066 		cal += len;
3067 		idx++;
3068 	}
3069 
3070 	return 0;
3071 }
3072 
3073 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3074 {
3075 	int i;
3076 
3077 	for (i = 0; i < n_freqs; i++)
3078 		if (cur == freqs[i])
3079 			return i;
3080 
3081 	return -1;
3082 }
3083 
3084 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3085 {
3086 	static const u16 freq_list[] = {
3087 		5180, 5200, 5220, 5240,
3088 		5260, 5280, 5300, 5320,
3089 		5500, 5520, 5540, 5560,
3090 		5580, 5600, 5620, 5640,
3091 		5660, 5680, 5700, 5745,
3092 		5765, 5785, 5805, 5825
3093 	};
3094 	int offset_2g = ARRAY_SIZE(freq_list);
3095 	int idx;
3096 
3097 	if (freq < 4000) {
3098 		if (freq < 2432)
3099 			return offset_2g;
3100 		if (freq < 2457)
3101 			return offset_2g + 1;
3102 
3103 		return offset_2g + 2;
3104 	}
3105 
3106 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3107 		return -1;
3108 
3109 	if (bw != NL80211_CHAN_WIDTH_20) {
3110 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3111 					   freq + 10);
3112 		if (idx >= 0)
3113 			return idx;
3114 
3115 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3116 					   freq - 10);
3117 		if (idx >= 0)
3118 			return idx;
3119 	}
3120 
3121 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3122 }
3123 
3124 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3125 {
3126 	struct mt7915_dev *dev = phy->dev;
3127 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3128 	u16 total = 2, center_freq = chandef->center_freq1;
3129 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3130 	int idx;
3131 
3132 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3133 		return 0;
3134 
3135 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3136 	if (idx < 0)
3137 		return -EINVAL;
3138 
3139 	/* Items: Tx DPD, Tx Flatness */
3140 	idx = idx * 2;
3141 	cal += MT_EE_CAL_GROUP_SIZE;
3142 
3143 	while (total--) {
3144 		int ret;
3145 
3146 		cal += (idx * MT_EE_CAL_UNIT);
3147 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3148 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3149 		if (ret)
3150 			return ret;
3151 
3152 		idx++;
3153 	}
3154 
3155 	return 0;
3156 }
3157 
3158 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3159 {
3160 	/* strict order */
3161 	static const u32 offs[] = {
3162 		MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME,
3163 		MIB_BUSY_TIME_V2, MIB_TX_TIME_V2, MIB_RX_TIME_V2,
3164 		MIB_OBSS_AIRTIME_V2
3165 	};
3166 	struct mt76_channel_state *state = phy->mt76->chan_state;
3167 	struct mt76_channel_state *state_ts = &phy->state_ts;
3168 	struct mt7915_dev *dev = phy->dev;
3169 	struct mt7915_mcu_mib *res, req[4];
3170 	struct sk_buff *skb;
3171 	int i, ret, start = 0, ofs = 20;
3172 
3173 	if (!is_mt7915(&dev->mt76)) {
3174 		start = 4;
3175 		ofs = 0;
3176 	}
3177 
3178 	for (i = 0; i < 4; i++) {
3179 		req[i].band = cpu_to_le32(phy != &dev->phy);
3180 		req[i].offs = cpu_to_le32(offs[i + start]);
3181 	}
3182 
3183 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3184 					req, sizeof(req), true, &skb);
3185 	if (ret)
3186 		return ret;
3187 
3188 	res = (struct mt7915_mcu_mib *)(skb->data + ofs);
3189 
3190 	if (chan_switch)
3191 		goto out;
3192 
3193 #define __res_u64(s) le64_to_cpu(res[s].data)
3194 	state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3195 	state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3196 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3197 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3198 
3199 out:
3200 	state_ts->cc_busy = __res_u64(0);
3201 	state_ts->cc_tx = __res_u64(1);
3202 	state_ts->cc_bss_rx = __res_u64(2);
3203 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3204 #undef __res_u64
3205 
3206 	dev_kfree_skb(skb);
3207 
3208 	return 0;
3209 }
3210 
3211 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3212 {
3213 	struct mt7915_dev *dev = phy->dev;
3214 	struct {
3215 		u8 ctrl_id;
3216 		u8 action;
3217 		u8 dbdc_idx;
3218 		u8 rsv[5];
3219 	} req = {
3220 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3221 		.dbdc_idx = phy != &dev->phy,
3222 	};
3223 
3224 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3225 				 sizeof(req), true);
3226 }
3227 
3228 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3229 {
3230 	struct mt7915_dev *dev = phy->dev;
3231 	struct {
3232 		struct mt7915_mcu_thermal_ctrl ctrl;
3233 
3234 		__le32 trigger_temp;
3235 		__le32 restore_temp;
3236 		__le16 sustain_time;
3237 		u8 rsv[2];
3238 	} __packed req = {
3239 		.ctrl = {
3240 			.band_idx = phy->band_idx,
3241 		},
3242 	};
3243 	int level;
3244 
3245 	if (!state) {
3246 		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3247 		goto out;
3248 	}
3249 
3250 	/* set duty cycle and level */
3251 	for (level = 0; level < 4; level++) {
3252 		int ret;
3253 
3254 		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3255 		req.ctrl.duty.duty_level = level;
3256 		req.ctrl.duty.duty_cycle = state;
3257 		state /= 2;
3258 
3259 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3260 					&req, sizeof(req.ctrl), false);
3261 		if (ret)
3262 			return ret;
3263 	}
3264 
3265 	/* set high-temperature trigger threshold */
3266 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3267 	/* add a safety margin ~10 */
3268 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3269 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3270 	req.sustain_time = cpu_to_le16(10);
3271 
3272 out:
3273 	req.ctrl.type.protect_type = 1;
3274 	req.ctrl.type.trigger_type = 1;
3275 
3276 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3277 				 &req, sizeof(req), false);
3278 }
3279 
3280 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3281 {
3282 	struct mt7915_dev *dev = phy->dev;
3283 	struct mt76_phy *mphy = phy->mt76;
3284 	struct ieee80211_hw *hw = mphy->hw;
3285 	struct mt7915_sku_val {
3286 		u8 format_id;
3287 		u8 limit_type;
3288 		u8 dbdc_idx;
3289 		s8 val[MT7915_SKU_RATE_NUM];
3290 	} __packed req = {
3291 		.format_id = 4,
3292 		.dbdc_idx = phy != &dev->phy,
3293 	};
3294 	struct mt76_power_limits limits_array;
3295 	s8 *la = (s8 *)&limits_array;
3296 	int i, idx, n_chains = hweight8(mphy->antenna_mask);
3297 	int tx_power = hw->conf.power_level * 2;
3298 
3299 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan,
3300 				      tx_power);
3301 	tx_power -= mt76_tx_power_nss_delta(n_chains);
3302 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3303 					      &limits_array, tx_power);
3304 	mphy->txpower_cur = tx_power;
3305 
3306 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3307 		u8 mcs_num, len = mt7915_sku_group_len[i];
3308 		int j;
3309 
3310 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3311 			mcs_num = 10;
3312 
3313 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3314 				la = (s8 *)&limits_array + 12;
3315 		} else {
3316 			mcs_num = len;
3317 		}
3318 
3319 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3320 			req.val[idx + j] = la[j];
3321 
3322 		la += mcs_num;
3323 		idx += len;
3324 	}
3325 
3326 	return mt76_mcu_send_msg(&dev->mt76,
3327 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3328 				 sizeof(req), true);
3329 }
3330 
3331 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3332 {
3333 #define RATE_POWER_INFO	2
3334 	struct mt7915_dev *dev = phy->dev;
3335 	struct {
3336 		u8 format_id;
3337 		u8 category;
3338 		u8 band;
3339 		u8 _rsv;
3340 	} __packed req = {
3341 		.format_id = 7,
3342 		.category = RATE_POWER_INFO,
3343 		.band = phy != &dev->phy,
3344 	};
3345 	s8 res[MT7915_SKU_RATE_NUM][2];
3346 	struct sk_buff *skb;
3347 	int ret, i;
3348 
3349 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3350 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3351 					&req, sizeof(req), true, &skb);
3352 	if (ret)
3353 		return ret;
3354 
3355 	memcpy(res, skb->data + 4, sizeof(res));
3356 	for (i = 0; i < len; i++)
3357 		txpower[i] = res[i][req.band];
3358 
3359 	dev_kfree_skb(skb);
3360 
3361 	return 0;
3362 }
3363 
3364 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3365 			      u8 en)
3366 {
3367 	struct {
3368 		u8 test_mode_en;
3369 		u8 param_idx;
3370 		u8 _rsv[2];
3371 
3372 		u8 enable;
3373 		u8 _rsv2[3];
3374 
3375 		u8 pad[8];
3376 	} __packed req = {
3377 		.test_mode_en = test_mode,
3378 		.param_idx = param,
3379 		.enable = en,
3380 	};
3381 
3382 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3383 				 sizeof(req), false);
3384 }
3385 
3386 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3387 {
3388 	struct mt7915_dev *dev = phy->dev;
3389 	struct mt7915_sku {
3390 		u8 format_id;
3391 		u8 sku_enable;
3392 		u8 dbdc_idx;
3393 		u8 rsv;
3394 	} __packed req = {
3395 		.format_id = 0,
3396 		.dbdc_idx = phy != &dev->phy,
3397 		.sku_enable = enable,
3398 	};
3399 
3400 	return mt76_mcu_send_msg(&dev->mt76,
3401 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3402 				 sizeof(req), true);
3403 }
3404 
3405 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3406 {
3407 	struct {
3408 		u8 action;
3409 		u8 set;
3410 		u8 band;
3411 		u8 rsv;
3412 	} req = {
3413 		.action = action,
3414 		.set = set,
3415 		.band = band,
3416 	};
3417 
3418 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3419 				 &req, sizeof(req), false);
3420 }
3421 
3422 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3423 {
3424 	struct {
3425 		u8 action;
3426 		union {
3427 			struct {
3428 				u8 snd_mode;
3429 				u8 sta_num;
3430 				u8 rsv;
3431 				u8 wlan_idx[4];
3432 				__le32 snd_period;	/* ms */
3433 			} __packed snd;
3434 			struct {
3435 				bool ebf;
3436 				bool ibf;
3437 				u8 rsv;
3438 			} __packed type;
3439 			struct {
3440 				u8 bf_num;
3441 				u8 bf_bitmap;
3442 				u8 bf_sel[8];
3443 				u8 rsv[5];
3444 			} __packed mod;
3445 		};
3446 	} __packed req = {
3447 		.action = action,
3448 	};
3449 
3450 #define MT_BF_PROCESSING	4
3451 	switch (action) {
3452 	case MT_BF_SOUNDING_ON:
3453 		req.snd.snd_mode = MT_BF_PROCESSING;
3454 		break;
3455 	case MT_BF_TYPE_UPDATE:
3456 		req.type.ebf = true;
3457 		req.type.ibf = dev->ibf;
3458 		break;
3459 	case MT_BF_MODULE_UPDATE:
3460 		req.mod.bf_num = 2;
3461 		req.mod.bf_bitmap = GENMASK(1, 0);
3462 		break;
3463 	default:
3464 		return -EINVAL;
3465 	}
3466 
3467 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3468 				 sizeof(req), true);
3469 }
3470 
3471 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3472 			    bool enable)
3473 {
3474 #define MT_SPR_ENABLE		1
3475 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3476 	struct {
3477 		u8 action;
3478 		u8 arg_num;
3479 		u8 band_idx;
3480 		u8 status;
3481 		u8 drop_tx_idx;
3482 		u8 sta_idx;	/* 256 sta */
3483 		u8 rsv[2];
3484 		__le32 val;
3485 	} __packed req = {
3486 		.action = MT_SPR_ENABLE,
3487 		.arg_num = 1,
3488 		.band_idx = mvif->mt76.band_idx,
3489 		.val = cpu_to_le32(enable),
3490 	};
3491 
3492 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3493 				 sizeof(req), true);
3494 }
3495 
3496 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3497 			   struct ieee80211_sta *sta, struct rate_info *rate)
3498 {
3499 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3500 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3501 	struct mt7915_dev *dev = phy->dev;
3502 	struct mt76_phy *mphy = phy->mt76;
3503 	struct {
3504 		u8 category;
3505 		u8 band;
3506 		__le16 wcid;
3507 	} __packed req = {
3508 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3509 		.band = mvif->mt76.band_idx,
3510 		.wcid = cpu_to_le16(msta->wcid.idx),
3511 	};
3512 	struct ieee80211_supported_band *sband;
3513 	struct mt7915_mcu_phy_rx_info *res;
3514 	struct sk_buff *skb;
3515 	int ret;
3516 	bool cck = false;
3517 
3518 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3519 					&req, sizeof(req), true, &skb);
3520 	if (ret)
3521 		return ret;
3522 
3523 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3524 
3525 	rate->mcs = res->rate;
3526 	rate->nss = res->nsts + 1;
3527 
3528 	switch (res->mode) {
3529 	case MT_PHY_TYPE_CCK:
3530 		cck = true;
3531 		fallthrough;
3532 	case MT_PHY_TYPE_OFDM:
3533 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3534 			sband = &mphy->sband_5g.sband;
3535 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3536 			sband = &mphy->sband_6g.sband;
3537 		else
3538 			sband = &mphy->sband_2g.sband;
3539 
3540 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3541 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3542 		break;
3543 	case MT_PHY_TYPE_HT:
3544 	case MT_PHY_TYPE_HT_GF:
3545 		if (rate->mcs > 31) {
3546 			ret = -EINVAL;
3547 			goto out;
3548 		}
3549 
3550 		rate->flags = RATE_INFO_FLAGS_MCS;
3551 		if (res->gi)
3552 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3553 		break;
3554 	case MT_PHY_TYPE_VHT:
3555 		if (rate->mcs > 9) {
3556 			ret = -EINVAL;
3557 			goto out;
3558 		}
3559 
3560 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3561 		if (res->gi)
3562 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3563 		break;
3564 	case MT_PHY_TYPE_HE_SU:
3565 	case MT_PHY_TYPE_HE_EXT_SU:
3566 	case MT_PHY_TYPE_HE_TB:
3567 	case MT_PHY_TYPE_HE_MU:
3568 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3569 			ret = -EINVAL;
3570 			goto out;
3571 		}
3572 		rate->he_gi = res->gi;
3573 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3574 		break;
3575 	default:
3576 		ret = -EINVAL;
3577 		goto out;
3578 	}
3579 
3580 	switch (res->bw) {
3581 	case IEEE80211_STA_RX_BW_160:
3582 		rate->bw = RATE_INFO_BW_160;
3583 		break;
3584 	case IEEE80211_STA_RX_BW_80:
3585 		rate->bw = RATE_INFO_BW_80;
3586 		break;
3587 	case IEEE80211_STA_RX_BW_40:
3588 		rate->bw = RATE_INFO_BW_40;
3589 		break;
3590 	default:
3591 		rate->bw = RATE_INFO_BW_20;
3592 		break;
3593 	}
3594 
3595 out:
3596 	dev_kfree_skb(skb);
3597 
3598 	return ret;
3599 }
3600 
3601 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3602 				struct cfg80211_he_bss_color *he_bss_color)
3603 {
3604 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3605 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3606 	struct bss_info_color *bss_color;
3607 	struct sk_buff *skb;
3608 	struct tlv *tlv;
3609 
3610 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3611 					      NULL, len);
3612 	if (IS_ERR(skb))
3613 		return PTR_ERR(skb);
3614 
3615 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3616 				      sizeof(*bss_color));
3617 	bss_color = (struct bss_info_color *)tlv;
3618 	bss_color->disable = !he_bss_color->enabled;
3619 	bss_color->color = he_bss_color->color;
3620 
3621 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3622 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3623 }
3624 
3625 #define TWT_AGRT_TRIGGER	BIT(0)
3626 #define TWT_AGRT_ANNOUNCE	BIT(1)
3627 #define TWT_AGRT_PROTECT	BIT(2)
3628 
3629 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3630 			       struct mt7915_vif *mvif,
3631 			       struct mt7915_twt_flow *flow,
3632 			       int cmd)
3633 {
3634 	struct {
3635 		u8 tbl_idx;
3636 		u8 cmd;
3637 		u8 own_mac_idx;
3638 		u8 flowid; /* 0xff for group id */
3639 		__le16 peer_id; /* specify the peer_id (msb=0)
3640 				 * or group_id (msb=1)
3641 				 */
3642 		u8 duration; /* 256 us */
3643 		u8 bss_idx;
3644 		__le64 start_tsf;
3645 		__le16 mantissa;
3646 		u8 exponent;
3647 		u8 is_ap;
3648 		u8 agrt_params;
3649 		u8 rsv[23];
3650 	} __packed req = {
3651 		.tbl_idx = flow->table_id,
3652 		.cmd = cmd,
3653 		.own_mac_idx = mvif->mt76.omac_idx,
3654 		.flowid = flow->id,
3655 		.peer_id = cpu_to_le16(flow->wcid),
3656 		.duration = flow->duration,
3657 		.bss_idx = mvif->mt76.idx,
3658 		.start_tsf = cpu_to_le64(flow->tsf),
3659 		.mantissa = flow->mantissa,
3660 		.exponent = flow->exp,
3661 		.is_ap = true,
3662 	};
3663 
3664 	if (flow->protection)
3665 		req.agrt_params |= TWT_AGRT_PROTECT;
3666 	if (!flow->flowtype)
3667 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3668 	if (flow->trigger)
3669 		req.agrt_params |= TWT_AGRT_TRIGGER;
3670 
3671 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3672 				 &req, sizeof(req), true);
3673 }
3674