1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7981:						\
17 		_fw = MT7981_##name;				\
18 		break;						\
19 	case 0x7986:						\
20 		_fw = MT7986_##name##__VA_ARGS__;		\
21 		break;						\
22 	default:						\
23 		_fw = MT7916_##name;				\
24 		break;						\
25 	}							\
26 	_fw;							\
27 })
28 
29 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
30 					 fw_name(_dev, name) :			\
31 					 fw_name(_dev, name, _MT7975))
32 
33 #define MCU_PATCH_ADDRESS		0x200000
34 
35 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
36 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
37 
38 static bool sr_scene_detect = true;
39 module_param(sr_scene_detect, bool, 0644);
40 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
41 
42 static u8
43 mt7915_mcu_get_sta_nss(u16 mcs_map)
44 {
45 	u8 nss;
46 
47 	for (nss = 8; nss > 0; nss--) {
48 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
49 
50 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
51 			break;
52 	}
53 
54 	return nss - 1;
55 }
56 
57 static void
58 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
59 			  u16 mcs_map)
60 {
61 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
62 	struct mt7915_dev *dev = msta->vif->phy->dev;
63 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
64 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
65 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
66 
67 	for (nss = 0; nss < max_nss; nss++) {
68 		int mcs;
69 
70 		switch ((mcs_map >> (2 * nss)) & 0x3) {
71 		case IEEE80211_HE_MCS_SUPPORT_0_11:
72 			mcs = GENMASK(11, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_9:
75 			mcs = GENMASK(9, 0);
76 			break;
77 		case IEEE80211_HE_MCS_SUPPORT_0_7:
78 			mcs = GENMASK(7, 0);
79 			break;
80 		default:
81 			mcs = 0;
82 		}
83 
84 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
85 
86 		switch (mcs) {
87 		case 0 ... 7:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
89 			break;
90 		case 8 ... 9:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
92 			break;
93 		case 10 ... 11:
94 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
95 			break;
96 		default:
97 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
98 			break;
99 		}
100 		mcs_map &= ~(0x3 << (nss * 2));
101 		mcs_map |= mcs << (nss * 2);
102 
103 		/* only support 2ss on 160MHz for mt7915 */
104 		if (is_mt7915(&dev->mt76) && nss > 1 &&
105 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
106 			break;
107 	}
108 
109 	*he_mcs = cpu_to_le16(mcs_map);
110 }
111 
112 static void
113 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
114 			   const u16 *mask)
115 {
116 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
117 	struct mt7915_dev *dev = msta->vif->phy->dev;
118 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
119 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
120 	u16 mcs;
121 
122 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
123 		switch (mcs_map & 0x3) {
124 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
128 			mcs = GENMASK(8, 0);
129 			break;
130 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
131 			mcs = GENMASK(7, 0);
132 			break;
133 		default:
134 			mcs = 0;
135 		}
136 
137 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
138 
139 		/* only support 2ss on 160MHz for mt7915 */
140 		if (is_mt7915(&dev->mt76) && nss > 1 &&
141 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
142 			break;
143 	}
144 }
145 
146 static void
147 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
148 			  const u8 *mask)
149 {
150 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
151 
152 	for (nss = 0; nss < max_nss; nss++)
153 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
154 }
155 
156 static int
157 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
158 			  struct sk_buff *skb, int seq)
159 {
160 	struct mt76_connac2_mcu_rxd *rxd;
161 	int ret = 0;
162 
163 	if (!skb) {
164 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
165 			cmd, seq);
166 		return -ETIMEDOUT;
167 	}
168 
169 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
170 	if (seq != rxd->seq &&
171 	    !(rxd->eid == MCU_CMD_EXT_CID &&
172 	      rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
173 		return -EAGAIN;
174 
175 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
176 		skb_pull(skb, sizeof(*rxd) - 4);
177 		ret = *skb->data;
178 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
179 		skb_pull(skb, sizeof(*rxd) + 4);
180 		ret = le32_to_cpu(*(__le32 *)skb->data);
181 	} else {
182 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
183 	}
184 
185 	return ret;
186 }
187 
188 static int
189 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
190 			int cmd, int *wait_seq)
191 {
192 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
193 	enum mt76_mcuq_id qid;
194 	int ret;
195 
196 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
197 	if (ret)
198 		return ret;
199 
200 	if (cmd == MCU_CMD(FW_SCATTER))
201 		qid = MT_MCUQ_FWDL;
202 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
203 		qid = MT_MCUQ_WA;
204 	else
205 		qid = MT_MCUQ_WM;
206 
207 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
208 }
209 
210 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
211 {
212 	struct {
213 		__le32 args[3];
214 	} req = {
215 		.args = {
216 			cpu_to_le32(a1),
217 			cpu_to_le32(a2),
218 			cpu_to_le32(a3),
219 		},
220 	};
221 
222 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
223 }
224 
225 static void
226 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
227 {
228 	if (vif->bss_conf.csa_active)
229 		ieee80211_csa_finish(vif);
230 }
231 
232 static void
233 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
234 {
235 	struct mt76_phy *mphy = &dev->mt76.phy;
236 	struct mt7915_mcu_csa_notify *c;
237 
238 	c = (struct mt7915_mcu_csa_notify *)skb->data;
239 
240 	if (c->band_idx > MT_BAND1)
241 		return;
242 
243 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
244 	    dev->mt76.phys[MT_BAND1])
245 		mphy = dev->mt76.phys[MT_BAND1];
246 
247 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
248 			IEEE80211_IFACE_ITER_RESUME_ALL,
249 			mt7915_mcu_csa_finish, mphy->hw);
250 }
251 
252 static void
253 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
254 {
255 	struct mt76_phy *mphy = &dev->mt76.phy;
256 	struct mt7915_mcu_thermal_notify *t;
257 	struct mt7915_phy *phy;
258 
259 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
260 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
261 		return;
262 
263 	if (t->ctrl.band_idx > MT_BAND1)
264 		return;
265 
266 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
267 	    dev->mt76.phys[MT_BAND1])
268 		mphy = dev->mt76.phys[MT_BAND1];
269 
270 	phy = (struct mt7915_phy *)mphy->priv;
271 	phy->throttle_state = t->ctrl.duty.duty_cycle;
272 }
273 
274 static void
275 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
276 {
277 	struct mt76_phy *mphy = &dev->mt76.phy;
278 	struct mt7915_mcu_rdd_report *r;
279 
280 	r = (struct mt7915_mcu_rdd_report *)skb->data;
281 
282 	if (r->band_idx > MT_RX_SEL2)
283 		return;
284 
285 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
286 	    dev->mt76.phys[MT_BAND1])
287 		mphy = dev->mt76.phys[MT_BAND1];
288 
289 	if (r->band_idx == MT_RX_SEL2)
290 		cfg80211_background_radar_event(mphy->hw->wiphy,
291 						&dev->rdd2_chandef,
292 						GFP_ATOMIC);
293 	else
294 		ieee80211_radar_detected(mphy->hw);
295 	dev->hw_pattern++;
296 }
297 
298 static void
299 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
300 {
301 	struct mt76_connac2_mcu_rxd *rxd;
302 	int len = skb->len - sizeof(*rxd);
303 	const char *data, *type;
304 
305 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
306 	data = (char *)&rxd[1];
307 
308 	switch (rxd->s2d_index) {
309 	case 0:
310 		if (mt7915_debugfs_rx_log(dev, data, len))
311 			return;
312 
313 		type = "WM";
314 		break;
315 	case 2:
316 		type = "WA";
317 		break;
318 	default:
319 		type = "unknown";
320 		break;
321 	}
322 
323 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
324 }
325 
326 static void
327 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
328 {
329 	if (!vif->bss_conf.color_change_active)
330 		return;
331 
332 	ieee80211_color_change_finish(vif);
333 }
334 
335 static void
336 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
337 {
338 	struct mt76_phy *mphy = &dev->mt76.phy;
339 	struct mt7915_mcu_bcc_notify *b;
340 
341 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
342 
343 	if (b->band_idx > MT_BAND1)
344 		return;
345 
346 	if ((b->band_idx && !dev->phy.mt76->band_idx) &&
347 	    dev->mt76.phys[MT_BAND1])
348 		mphy = dev->mt76.phys[MT_BAND1];
349 
350 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
351 			IEEE80211_IFACE_ITER_RESUME_ALL,
352 			mt7915_mcu_cca_finish, mphy->hw);
353 }
354 
355 static void
356 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
357 {
358 	struct mt76_connac2_mcu_rxd *rxd;
359 
360 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
361 	switch (rxd->ext_eid) {
362 	case MCU_EXT_EVENT_THERMAL_PROTECT:
363 		mt7915_mcu_rx_thermal_notify(dev, skb);
364 		break;
365 	case MCU_EXT_EVENT_RDD_REPORT:
366 		mt7915_mcu_rx_radar_detected(dev, skb);
367 		break;
368 	case MCU_EXT_EVENT_CSA_NOTIFY:
369 		mt7915_mcu_rx_csa_notify(dev, skb);
370 		break;
371 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
372 		mt7915_mcu_rx_log_message(dev, skb);
373 		break;
374 	case MCU_EXT_EVENT_BCC_NOTIFY:
375 		mt7915_mcu_rx_bcc_notify(dev, skb);
376 		break;
377 	default:
378 		break;
379 	}
380 }
381 
382 static void
383 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
384 {
385 	struct mt76_connac2_mcu_rxd *rxd;
386 
387 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
388 	switch (rxd->eid) {
389 	case MCU_EVENT_EXT:
390 		mt7915_mcu_rx_ext_event(dev, skb);
391 		break;
392 	default:
393 		break;
394 	}
395 	dev_kfree_skb(skb);
396 }
397 
398 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
399 {
400 	struct mt76_connac2_mcu_rxd *rxd;
401 
402 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
403 	if ((rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
404 	     rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
405 	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
406 	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
407 	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
408 	     !rxd->seq) &&
409 	     !(rxd->eid == MCU_CMD_EXT_CID &&
410 	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
411 		mt7915_mcu_rx_unsolicited_event(dev, skb);
412 	else
413 		mt76_mcu_rx_event(&dev->mt76, skb);
414 }
415 
416 static struct tlv *
417 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
418 			     __le16 *sub_ntlv, __le16 *len)
419 {
420 	struct tlv *ptlv, tlv = {
421 		.tag = cpu_to_le16(sub_tag),
422 		.len = cpu_to_le16(sub_len),
423 	};
424 
425 	ptlv = skb_put_zero(skb, sub_len);
426 	memcpy(ptlv, &tlv, sizeof(tlv));
427 
428 	le16_add_cpu(sub_ntlv, 1);
429 	le16_add_cpu(len, sub_len);
430 
431 	return ptlv;
432 }
433 
434 /** bss info **/
435 struct mt7915_he_obss_narrow_bw_ru_data {
436 	bool tolerated;
437 };
438 
439 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
440 						   struct cfg80211_bss *bss,
441 						   void *_data)
442 {
443 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
444 	const struct element *elem;
445 
446 	rcu_read_lock();
447 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
448 
449 	if (!elem || elem->datalen <= 10 ||
450 	    !(elem->data[10] &
451 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
452 		data->tolerated = false;
453 
454 	rcu_read_unlock();
455 }
456 
457 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
458 					      struct ieee80211_vif *vif)
459 {
460 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
461 		.tolerated = true,
462 	};
463 
464 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
465 		return false;
466 
467 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
468 			  mt7915_check_he_obss_narrow_bw_ru_iter,
469 			  &iter_data);
470 
471 	/*
472 	 * If there is at least one AP on radar channel that cannot
473 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
474 	 */
475 	return !iter_data.tolerated;
476 }
477 
478 static void
479 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
480 			struct mt7915_phy *phy)
481 {
482 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
483 	struct bss_info_rf_ch *ch;
484 	struct tlv *tlv;
485 	int freq1 = chandef->center_freq1;
486 
487 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
488 
489 	ch = (struct bss_info_rf_ch *)tlv;
490 	ch->pri_ch = chandef->chan->hw_value;
491 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
492 	ch->bw = mt76_connac_chan_bw(chandef);
493 
494 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
495 		int freq2 = chandef->center_freq2;
496 
497 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
498 	}
499 
500 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
501 		struct mt76_phy *mphy = phy->mt76;
502 
503 		ch->he_ru26_block =
504 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
505 		ch->he_all_disable = false;
506 	} else {
507 		ch->he_all_disable = true;
508 	}
509 }
510 
511 static void
512 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
513 		      struct mt7915_phy *phy)
514 {
515 	int max_nss = hweight8(phy->mt76->antenna_mask);
516 	struct bss_info_ra *ra;
517 	struct tlv *tlv;
518 
519 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
520 
521 	ra = (struct bss_info_ra *)tlv;
522 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
523 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
524 	ra->short_preamble = true;
525 	ra->tx_streams = max_nss;
526 	ra->rx_streams = max_nss;
527 	ra->algo = 4;
528 	ra->train_up_rule = 2;
529 	ra->train_up_high_thres = 110;
530 	ra->train_up_rule_rssi = -70;
531 	ra->low_traffic_thres = 2;
532 	ra->phy_cap = cpu_to_le32(0xfdf);
533 	ra->interval = cpu_to_le32(500);
534 	ra->fast_interval = cpu_to_le32(100);
535 }
536 
537 static void
538 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
539 		      struct mt7915_phy *phy)
540 {
541 #define DEFAULT_HE_PE_DURATION		4
542 #define DEFAULT_HE_DURATION_RTS_THRES	1023
543 	const struct ieee80211_sta_he_cap *cap;
544 	struct bss_info_he *he;
545 	struct tlv *tlv;
546 
547 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
548 
549 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
550 
551 	he = (struct bss_info_he *)tlv;
552 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
553 	if (!he->he_pe_duration)
554 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
555 
556 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
557 	if (!he->he_rts_thres)
558 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
559 
560 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
561 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
562 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
563 }
564 
565 static void
566 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
567 {
568 #define TXD_CMP_MAP1		GENMASK(15, 0)
569 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
570 	struct bss_info_hw_amsdu *amsdu;
571 	struct tlv *tlv;
572 
573 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
574 
575 	amsdu = (struct bss_info_hw_amsdu *)tlv;
576 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
577 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
578 	amsdu->trig_thres = cpu_to_le16(2);
579 	amsdu->enable = true;
580 }
581 
582 static void
583 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
584 {
585 	struct bss_info_bmc_rate *bmc;
586 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
587 	enum nl80211_band band = chandef->chan->band;
588 	struct tlv *tlv;
589 
590 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
591 
592 	bmc = (struct bss_info_bmc_rate *)tlv;
593 	if (band == NL80211_BAND_2GHZ) {
594 		bmc->short_preamble = true;
595 	} else {
596 		bmc->bc_trans = cpu_to_le16(0x2000);
597 		bmc->mc_trans = cpu_to_le16(0x2080);
598 	}
599 }
600 
601 static int
602 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
603 		       bool bssid, bool enable)
604 {
605 	struct mt7915_dev *dev = phy->dev;
606 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
607 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
608 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
609 	const u8 *addr = vif->addr;
610 	struct {
611 		u8 mode;
612 		u8 force_clear;
613 		u8 clear_bitmap[8];
614 		u8 entry_count;
615 		u8 write;
616 		u8 band;
617 
618 		u8 index;
619 		u8 bssid;
620 		u8 addr[ETH_ALEN];
621 	} __packed req = {
622 		.mode = !!mask || enable,
623 		.entry_count = 1,
624 		.write = 1,
625 		.band = phy->mt76->band_idx,
626 		.index = idx * 2 + bssid,
627 	};
628 
629 	if (bssid)
630 		addr = vif->bss_conf.bssid;
631 
632 	if (enable)
633 		ether_addr_copy(req.addr, addr);
634 
635 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
636 				 sizeof(req), true);
637 }
638 
639 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
640 			    struct ieee80211_vif *vif, int enable)
641 {
642 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
643 	struct mt7915_dev *dev = phy->dev;
644 	struct sk_buff *skb;
645 
646 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
647 		mt7915_mcu_muar_config(phy, vif, false, enable);
648 		mt7915_mcu_muar_config(phy, vif, true, enable);
649 	}
650 
651 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
652 					      MT7915_BSS_UPDATE_MAX_SIZE);
653 	if (IS_ERR(skb))
654 		return PTR_ERR(skb);
655 
656 	/* bss_omac must be first */
657 	if (enable)
658 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
659 
660 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
661 				      mvif->sta.wcid.idx, enable);
662 
663 	if (vif->type == NL80211_IFTYPE_MONITOR)
664 		goto out;
665 
666 	if (enable) {
667 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
668 		mt7915_mcu_bss_bmc_tlv(skb, phy);
669 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
670 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
671 
672 		if (vif->bss_conf.he_support)
673 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
674 
675 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
676 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
677 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
678 	}
679 out:
680 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
681 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
682 }
683 
684 /** starec & wtbl **/
685 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
686 			 struct ieee80211_ampdu_params *params,
687 			 bool enable)
688 {
689 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
690 	struct mt7915_vif *mvif = msta->vif;
691 
692 	if (enable && !params->amsdu)
693 		msta->wcid.amsdu = false;
694 
695 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
696 				      MCU_EXT_CMD(STA_REC_UPDATE),
697 				      enable, true);
698 }
699 
700 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
701 			 struct ieee80211_ampdu_params *params,
702 			 bool enable)
703 {
704 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
705 	struct mt7915_vif *mvif = msta->vif;
706 
707 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
708 				      MCU_EXT_CMD(STA_REC_UPDATE),
709 				      enable, false);
710 }
711 
712 static void
713 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
714 		      struct ieee80211_vif *vif)
715 {
716 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
717 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
718 	struct ieee80211_he_mcs_nss_supp mcs_map;
719 	struct sta_rec_he *he;
720 	struct tlv *tlv;
721 	u32 cap = 0;
722 
723 	if (!sta->deflink.he_cap.has_he)
724 		return;
725 
726 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
727 
728 	he = (struct sta_rec_he *)tlv;
729 
730 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
731 		cap |= STA_REC_HE_CAP_HTC;
732 
733 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
734 		cap |= STA_REC_HE_CAP_BSR;
735 
736 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
737 		cap |= STA_REC_HE_CAP_OM;
738 
739 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
740 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
741 
742 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
743 		cap |= STA_REC_HE_CAP_BQR;
744 
745 	if (elem->phy_cap_info[0] &
746 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
747 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
748 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
749 
750 	if (mvif->cap.he_ldpc &&
751 	    (elem->phy_cap_info[1] &
752 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
753 		cap |= STA_REC_HE_CAP_LDPC;
754 
755 	if (elem->phy_cap_info[1] &
756 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
757 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
758 
759 	if (elem->phy_cap_info[2] &
760 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
761 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
762 
763 	if (elem->phy_cap_info[2] &
764 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
765 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
766 
767 	if (elem->phy_cap_info[2] &
768 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
769 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
770 
771 	if (elem->phy_cap_info[6] &
772 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
773 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
774 
775 	if (elem->phy_cap_info[6] &
776 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
777 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
778 
779 	if (elem->phy_cap_info[7] &
780 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
781 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
782 
783 	if (elem->phy_cap_info[7] &
784 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
785 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
786 
787 	if (elem->phy_cap_info[7] &
788 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
789 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
790 
791 	if (elem->phy_cap_info[8] &
792 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
793 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
794 
795 	if (elem->phy_cap_info[8] &
796 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
797 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
798 
799 	if (elem->phy_cap_info[9] &
800 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
801 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
802 
803 	if (elem->phy_cap_info[9] &
804 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
805 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
806 
807 	he->he_cap = cpu_to_le32(cap);
808 
809 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
810 	switch (sta->deflink.bandwidth) {
811 	case IEEE80211_STA_RX_BW_160:
812 		if (elem->phy_cap_info[0] &
813 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
814 			mt7915_mcu_set_sta_he_mcs(sta,
815 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
816 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
817 
818 		mt7915_mcu_set_sta_he_mcs(sta,
819 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
820 					  le16_to_cpu(mcs_map.rx_mcs_160));
821 		fallthrough;
822 	default:
823 		mt7915_mcu_set_sta_he_mcs(sta,
824 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
825 					  le16_to_cpu(mcs_map.rx_mcs_80));
826 		break;
827 	}
828 
829 	he->t_frame_dur =
830 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
831 	he->max_ampdu_exp =
832 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
833 
834 	he->bw_set =
835 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
836 	he->device_class =
837 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
838 	he->punc_pream_rx =
839 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
840 
841 	he->dcm_tx_mode =
842 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
843 	he->dcm_tx_max_nss =
844 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
845 	he->dcm_rx_mode =
846 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
847 	he->dcm_rx_max_nss =
848 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
849 	he->dcm_rx_max_nss =
850 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
851 
852 	he->pkt_ext = 2;
853 }
854 
855 static void
856 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
857 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
858 {
859 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
860 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
861 	struct sta_rec_muru *muru;
862 	struct tlv *tlv;
863 
864 	if (vif->type != NL80211_IFTYPE_STATION &&
865 	    vif->type != NL80211_IFTYPE_AP)
866 		return;
867 
868 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
869 
870 	muru = (struct sta_rec_muru *)tlv;
871 
872 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
873 			       mvif->cap.vht_mu_ebfer ||
874 			       mvif->cap.vht_mu_ebfee;
875 	if (!is_mt7915(&dev->mt76))
876 		muru->cfg.mimo_ul_en = true;
877 	muru->cfg.ofdma_dl_en = true;
878 
879 	if (sta->deflink.vht_cap.vht_supported)
880 		muru->mimo_dl.vht_mu_bfee =
881 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
882 
883 	if (!sta->deflink.he_cap.has_he)
884 		return;
885 
886 	muru->mimo_dl.partial_bw_dl_mimo =
887 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
888 
889 	muru->mimo_ul.full_ul_mimo =
890 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
891 	muru->mimo_ul.partial_ul_mimo =
892 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
893 
894 	muru->ofdma_dl.punc_pream_rx =
895 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
896 	muru->ofdma_dl.he_20m_in_40m_2g =
897 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
898 	muru->ofdma_dl.he_20m_in_160m =
899 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
900 	muru->ofdma_dl.he_80m_in_160m =
901 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
902 
903 	muru->ofdma_ul.t_frame_dur =
904 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
905 	muru->ofdma_ul.mu_cascading =
906 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
907 	muru->ofdma_ul.uo_ra =
908 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
909 }
910 
911 static void
912 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
913 {
914 	struct sta_rec_ht *ht;
915 	struct tlv *tlv;
916 
917 	if (!sta->deflink.ht_cap.ht_supported)
918 		return;
919 
920 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
921 
922 	ht = (struct sta_rec_ht *)tlv;
923 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
924 }
925 
926 static void
927 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
928 {
929 	struct sta_rec_vht *vht;
930 	struct tlv *tlv;
931 
932 	if (!sta->deflink.vht_cap.vht_supported)
933 		return;
934 
935 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
936 
937 	vht = (struct sta_rec_vht *)tlv;
938 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
939 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
940 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
941 }
942 
943 static void
944 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
945 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
946 {
947 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
948 	struct sta_rec_amsdu *amsdu;
949 	struct tlv *tlv;
950 
951 	if (vif->type != NL80211_IFTYPE_STATION &&
952 	    vif->type != NL80211_IFTYPE_AP)
953 		return;
954 
955 	if (!sta->deflink.agg.max_amsdu_len)
956 	    return;
957 
958 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
959 	amsdu = (struct sta_rec_amsdu *)tlv;
960 	amsdu->max_amsdu_num = 8;
961 	amsdu->amsdu_en = true;
962 	msta->wcid.amsdu = true;
963 
964 	switch (sta->deflink.agg.max_amsdu_len) {
965 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
966 		if (!is_mt7915(&dev->mt76)) {
967 			amsdu->max_mpdu_size =
968 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
969 			return;
970 		}
971 		fallthrough;
972 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
973 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
974 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
975 		return;
976 	default:
977 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
978 		return;
979 	}
980 }
981 
982 static int
983 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
984 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
985 {
986 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
987 	struct mt7915_sta *msta;
988 	struct wtbl_req_hdr *wtbl_hdr;
989 	struct mt76_wcid *wcid;
990 	struct tlv *tlv;
991 
992 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
993 	wcid = sta ? &msta->wcid : NULL;
994 
995 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
996 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
997 						  WTBL_RESET_AND_SET, tlv,
998 						  &skb);
999 	if (IS_ERR(wtbl_hdr))
1000 		return PTR_ERR(wtbl_hdr);
1001 
1002 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1003 					 wtbl_hdr);
1004 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1005 	if (sta)
1006 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1007 					    wtbl_hdr, mvif->cap.ht_ldpc,
1008 					    mvif->cap.vht_ldpc);
1009 
1010 	return 0;
1011 }
1012 
1013 static inline bool
1014 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1015 			struct ieee80211_sta *sta, bool bfee)
1016 {
1017 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1018 	int sts = hweight16(phy->mt76->chainmask);
1019 
1020 	if (vif->type != NL80211_IFTYPE_STATION &&
1021 	    vif->type != NL80211_IFTYPE_AP)
1022 		return false;
1023 
1024 	if (!bfee && sts < 2)
1025 		return false;
1026 
1027 	if (sta->deflink.he_cap.has_he) {
1028 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1029 
1030 		if (bfee)
1031 			return mvif->cap.he_su_ebfee &&
1032 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1033 		else
1034 			return mvif->cap.he_su_ebfer &&
1035 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1036 	}
1037 
1038 	if (sta->deflink.vht_cap.vht_supported) {
1039 		u32 cap = sta->deflink.vht_cap.cap;
1040 
1041 		if (bfee)
1042 			return mvif->cap.vht_su_ebfee &&
1043 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1044 		else
1045 			return mvif->cap.vht_su_ebfer &&
1046 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1047 	}
1048 
1049 	return false;
1050 }
1051 
1052 static void
1053 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1054 {
1055 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1056 	bf->ndp_rate = 0;				/* mcs0 */
1057 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1058 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1059 }
1060 
1061 static void
1062 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1063 		       struct sta_rec_bf *bf)
1064 {
1065 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1066 	u8 n = 0;
1067 
1068 	bf->tx_mode = MT_PHY_TYPE_HT;
1069 
1070 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1071 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1072 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1073 			      mcs->tx_params);
1074 	else if (mcs->rx_mask[3])
1075 		n = 3;
1076 	else if (mcs->rx_mask[2])
1077 		n = 2;
1078 	else if (mcs->rx_mask[1])
1079 		n = 1;
1080 
1081 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1082 	bf->ncol = min_t(u8, bf->nrow, n);
1083 	bf->ibf_ncol = n;
1084 }
1085 
1086 static void
1087 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1088 			struct sta_rec_bf *bf, bool explicit)
1089 {
1090 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1091 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1092 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1093 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1094 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1095 
1096 	bf->tx_mode = MT_PHY_TYPE_VHT;
1097 
1098 	if (explicit) {
1099 		u8 sts, snd_dim;
1100 
1101 		mt7915_mcu_sta_sounding_rate(bf);
1102 
1103 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1104 				pc->cap);
1105 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1106 				    vc->cap);
1107 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1108 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1109 		bf->ibf_ncol = bf->ncol;
1110 
1111 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1112 			bf->nrow = 1;
1113 	} else {
1114 		bf->nrow = tx_ant;
1115 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1116 		bf->ibf_ncol = nss_mcs;
1117 
1118 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1119 			bf->ibf_nrow = 1;
1120 	}
1121 }
1122 
1123 static void
1124 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1125 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1126 {
1127 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1128 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1129 	const struct ieee80211_sta_he_cap *vc =
1130 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1131 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1132 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1133 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1134 	u8 snd_dim, sts;
1135 
1136 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1137 
1138 	mt7915_mcu_sta_sounding_rate(bf);
1139 
1140 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1141 				pe->phy_cap_info[6]);
1142 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1143 				pe->phy_cap_info[6]);
1144 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1145 			 ve->phy_cap_info[5]);
1146 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1147 		     pe->phy_cap_info[4]);
1148 	bf->nrow = min_t(u8, snd_dim, sts);
1149 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1150 	bf->ibf_ncol = bf->ncol;
1151 
1152 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1153 		return;
1154 
1155 	/* go over for 160MHz and 80p80 */
1156 	if (pe->phy_cap_info[0] &
1157 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1158 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1159 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1160 
1161 		bf->ncol_gt_bw80 = nss_mcs;
1162 	}
1163 
1164 	if (pe->phy_cap_info[0] &
1165 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1166 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1167 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1168 
1169 		if (bf->ncol_gt_bw80)
1170 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1171 		else
1172 			bf->ncol_gt_bw80 = nss_mcs;
1173 	}
1174 
1175 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1176 			 ve->phy_cap_info[5]);
1177 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1178 		     pe->phy_cap_info[4]);
1179 
1180 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1181 }
1182 
1183 static void
1184 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1185 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1186 {
1187 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1188 	struct mt7915_phy *phy = mvif->phy;
1189 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1190 	struct sta_rec_bf *bf;
1191 	struct tlv *tlv;
1192 	const u8 matrix[4][4] = {
1193 		{0, 0, 0, 0},
1194 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1195 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1196 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1197 	};
1198 	bool ebf;
1199 
1200 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1201 		return;
1202 
1203 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1204 	if (!ebf && !dev->ibf)
1205 		return;
1206 
1207 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1208 	bf = (struct sta_rec_bf *)tlv;
1209 
1210 	/* he: eBF only, in accordance with spec
1211 	 * vht: support eBF and iBF
1212 	 * ht: iBF only, since mac80211 lacks of eBF support
1213 	 */
1214 	if (sta->deflink.he_cap.has_he && ebf)
1215 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1216 	else if (sta->deflink.vht_cap.vht_supported)
1217 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1218 	else if (sta->deflink.ht_cap.ht_supported)
1219 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1220 	else
1221 		return;
1222 
1223 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1224 	bf->bw = sta->deflink.bandwidth;
1225 	bf->ibf_dbw = sta->deflink.bandwidth;
1226 	bf->ibf_nrow = tx_ant;
1227 
1228 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1229 		bf->ibf_timeout = 0x48;
1230 	else
1231 		bf->ibf_timeout = 0x18;
1232 
1233 	if (ebf && bf->nrow != tx_ant)
1234 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1235 	else
1236 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1237 
1238 	switch (sta->deflink.bandwidth) {
1239 	case IEEE80211_STA_RX_BW_160:
1240 	case IEEE80211_STA_RX_BW_80:
1241 		bf->mem_total = bf->mem_20m * 2;
1242 		break;
1243 	case IEEE80211_STA_RX_BW_40:
1244 		bf->mem_total = bf->mem_20m;
1245 		break;
1246 	case IEEE80211_STA_RX_BW_20:
1247 	default:
1248 		break;
1249 	}
1250 }
1251 
1252 static void
1253 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1254 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1255 {
1256 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1257 	struct mt7915_phy *phy = mvif->phy;
1258 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1259 	struct sta_rec_bfee *bfee;
1260 	struct tlv *tlv;
1261 	u8 nrow = 0;
1262 
1263 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1264 		return;
1265 
1266 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1267 		return;
1268 
1269 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1270 	bfee = (struct sta_rec_bfee *)tlv;
1271 
1272 	if (sta->deflink.he_cap.has_he) {
1273 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1274 
1275 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1276 			      pe->phy_cap_info[5]);
1277 	} else if (sta->deflink.vht_cap.vht_supported) {
1278 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1279 
1280 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1281 				 pc->cap);
1282 	}
1283 
1284 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1285 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1286 }
1287 
1288 static enum mcu_mmps_mode
1289 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1290 {
1291 	switch (smps) {
1292 	case IEEE80211_SMPS_OFF:
1293 		return MCU_MMPS_DISABLE;
1294 	case IEEE80211_SMPS_STATIC:
1295 		return MCU_MMPS_STATIC;
1296 	case IEEE80211_SMPS_DYNAMIC:
1297 		return MCU_MMPS_DYNAMIC;
1298 	default:
1299 		return MCU_MMPS_DISABLE;
1300 	}
1301 }
1302 
1303 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1304 				   struct ieee80211_vif *vif,
1305 				   struct ieee80211_sta *sta,
1306 				   void *data, u32 field)
1307 {
1308 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1309 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1310 	struct sta_phy *phy = data;
1311 	struct sta_rec_ra_fixed *ra;
1312 	struct sk_buff *skb;
1313 	struct tlv *tlv;
1314 
1315 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1316 					    &msta->wcid);
1317 	if (IS_ERR(skb))
1318 		return PTR_ERR(skb);
1319 
1320 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1321 	ra = (struct sta_rec_ra_fixed *)tlv;
1322 
1323 	switch (field) {
1324 	case RATE_PARAM_AUTO:
1325 		break;
1326 	case RATE_PARAM_FIXED:
1327 	case RATE_PARAM_FIXED_MCS:
1328 	case RATE_PARAM_FIXED_GI:
1329 	case RATE_PARAM_FIXED_HE_LTF:
1330 		if (phy)
1331 			ra->phy = *phy;
1332 		break;
1333 	case RATE_PARAM_MMPS_UPDATE:
1334 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1335 		break;
1336 	case RATE_PARAM_SPE_UPDATE:
1337 		ra->spe_idx = *(u8 *)data;
1338 		break;
1339 	default:
1340 		break;
1341 	}
1342 	ra->field = cpu_to_le32(field);
1343 
1344 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1345 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1346 }
1347 
1348 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1349 			struct ieee80211_sta *sta)
1350 {
1351 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1352 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1353 	struct wtbl_req_hdr *wtbl_hdr;
1354 	struct tlv *sta_wtbl;
1355 	struct sk_buff *skb;
1356 	int ret;
1357 
1358 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1359 					    &msta->wcid);
1360 	if (IS_ERR(skb))
1361 		return PTR_ERR(skb);
1362 
1363 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1364 					   sizeof(struct tlv));
1365 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1366 						  WTBL_SET, sta_wtbl, &skb);
1367 	if (IS_ERR(wtbl_hdr))
1368 		return PTR_ERR(wtbl_hdr);
1369 
1370 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1371 
1372 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1373 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1374 	if (ret)
1375 		return ret;
1376 
1377 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1378 					      RATE_PARAM_MMPS_UPDATE);
1379 }
1380 
1381 static int
1382 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1383 		       struct ieee80211_sta *sta)
1384 {
1385 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1386 	struct mt76_phy *mphy = mvif->phy->mt76;
1387 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1388 
1389 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1390 					      RATE_PARAM_SPE_UPDATE);
1391 }
1392 
1393 static int
1394 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1395 			       struct ieee80211_vif *vif,
1396 			       struct ieee80211_sta *sta)
1397 {
1398 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1399 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1400 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1401 	enum nl80211_band band = chandef->chan->band;
1402 	struct sta_phy phy = {};
1403 	int ret, nrates = 0;
1404 
1405 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1406 	do {									\
1407 		u8 i, gi = mask->control[band]._gi;				\
1408 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1409 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1410 			phy.sgi |= gi << (i << (_he));				\
1411 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1412 		}								\
1413 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1414 			if (!mask->control[band]._mcs[i])			\
1415 				continue;					\
1416 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1417 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1418 			if (_ht)						\
1419 				phy.mcs += 8 * i;				\
1420 		}								\
1421 	} while (0)
1422 
1423 	if (sta->deflink.he_cap.has_he) {
1424 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1425 	} else if (sta->deflink.vht_cap.vht_supported) {
1426 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1427 	} else if (sta->deflink.ht_cap.ht_supported) {
1428 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1429 	} else {
1430 		nrates = hweight32(mask->control[band].legacy);
1431 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1432 	}
1433 #undef __sta_phy_bitrate_mask_check
1434 
1435 	/* fall back to auto rate control */
1436 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1437 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1438 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1439 	    nrates != 1)
1440 		return 0;
1441 
1442 	/* fixed single rate */
1443 	if (nrates == 1) {
1444 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1445 						     RATE_PARAM_FIXED_MCS);
1446 		if (ret)
1447 			return ret;
1448 	}
1449 
1450 	/* fixed GI */
1451 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1452 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1453 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1454 		u32 addr;
1455 
1456 		/* firmware updates only TXCMD but doesn't take WTBL into
1457 		 * account, so driver should update here to reflect the
1458 		 * actual txrate hardware sends out.
1459 		 */
1460 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1461 		if (sta->deflink.he_cap.has_he)
1462 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1463 		else
1464 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1465 
1466 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1467 						     RATE_PARAM_FIXED_GI);
1468 		if (ret)
1469 			return ret;
1470 	}
1471 
1472 	/* fixed HE_LTF */
1473 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1474 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1475 						     RATE_PARAM_FIXED_HE_LTF);
1476 		if (ret)
1477 			return ret;
1478 	}
1479 
1480 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1481 }
1482 
1483 static void
1484 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1485 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1486 {
1487 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1488 	struct mt76_phy *mphy = mvif->phy->mt76;
1489 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1490 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1491 	enum nl80211_band band = chandef->chan->band;
1492 	struct sta_rec_ra *ra;
1493 	struct tlv *tlv;
1494 	u32 supp_rate = sta->deflink.supp_rates[band];
1495 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1496 
1497 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1498 	ra = (struct sta_rec_ra *)tlv;
1499 
1500 	ra->valid = true;
1501 	ra->auto_rate = true;
1502 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1503 	ra->channel = chandef->chan->hw_value;
1504 	ra->bw = sta->deflink.bandwidth;
1505 	ra->phy.bw = sta->deflink.bandwidth;
1506 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1507 
1508 	if (supp_rate) {
1509 		supp_rate &= mask->control[band].legacy;
1510 		ra->rate_len = hweight32(supp_rate);
1511 
1512 		if (band == NL80211_BAND_2GHZ) {
1513 			ra->supp_mode = MODE_CCK;
1514 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1515 
1516 			if (ra->rate_len > 4) {
1517 				ra->supp_mode |= MODE_OFDM;
1518 				ra->supp_ofdm_rate = supp_rate >> 4;
1519 			}
1520 		} else {
1521 			ra->supp_mode = MODE_OFDM;
1522 			ra->supp_ofdm_rate = supp_rate;
1523 		}
1524 	}
1525 
1526 	if (sta->deflink.ht_cap.ht_supported) {
1527 		ra->supp_mode |= MODE_HT;
1528 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1529 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1530 
1531 		cap |= STA_CAP_HT;
1532 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1533 			cap |= STA_CAP_SGI_20;
1534 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1535 			cap |= STA_CAP_SGI_40;
1536 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1537 			cap |= STA_CAP_TX_STBC;
1538 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1539 			cap |= STA_CAP_RX_STBC;
1540 		if (mvif->cap.ht_ldpc &&
1541 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1542 			cap |= STA_CAP_LDPC;
1543 
1544 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1545 					  mask->control[band].ht_mcs);
1546 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1547 	}
1548 
1549 	if (sta->deflink.vht_cap.vht_supported) {
1550 		u8 af;
1551 
1552 		ra->supp_mode |= MODE_VHT;
1553 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1554 			       sta->deflink.vht_cap.cap);
1555 		ra->af = max_t(u8, ra->af, af);
1556 
1557 		cap |= STA_CAP_VHT;
1558 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1559 			cap |= STA_CAP_VHT_SGI_80;
1560 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1561 			cap |= STA_CAP_VHT_SGI_160;
1562 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1563 			cap |= STA_CAP_VHT_TX_STBC;
1564 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1565 			cap |= STA_CAP_VHT_RX_STBC;
1566 		if (mvif->cap.vht_ldpc &&
1567 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1568 			cap |= STA_CAP_VHT_LDPC;
1569 
1570 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1571 					   mask->control[band].vht_mcs);
1572 	}
1573 
1574 	if (sta->deflink.he_cap.has_he) {
1575 		ra->supp_mode |= MODE_HE;
1576 		cap |= STA_CAP_HE;
1577 
1578 		if (sta->deflink.he_6ghz_capa.capa)
1579 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1580 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1581 	}
1582 
1583 	ra->sta_cap = cpu_to_le32(cap);
1584 }
1585 
1586 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1587 			     struct ieee80211_sta *sta, bool changed)
1588 {
1589 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1590 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1591 	struct sk_buff *skb;
1592 	int ret;
1593 
1594 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1595 					    &msta->wcid);
1596 	if (IS_ERR(skb))
1597 		return PTR_ERR(skb);
1598 
1599 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1600 	 * once dev->rc_work changes the settings driver should also
1601 	 * update sta_rec_he here.
1602 	 */
1603 	if (changed)
1604 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1605 
1606 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1607 	 * i.e 0-{7,8,9} for VHT.
1608 	 */
1609 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1610 
1611 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1612 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1613 	if (ret)
1614 		return ret;
1615 
1616 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1617 	 * and updates as peer fixed rate parameters, which overrides
1618 	 * sta_rec_ra and firmware rate control algorithm.
1619 	 */
1620 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1621 }
1622 
1623 static int
1624 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1625 		     struct ieee80211_sta *sta)
1626 {
1627 #define MT_STA_BSS_GROUP		1
1628 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1629 	struct mt7915_sta *msta;
1630 	struct {
1631 		__le32 action;
1632 		u8 wlan_idx_lo;
1633 		u8 status;
1634 		u8 wlan_idx_hi;
1635 		u8 rsv0[5];
1636 		__le32 val;
1637 		u8 rsv1[8];
1638 	} __packed req = {
1639 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1640 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1641 	};
1642 
1643 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1644 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1645 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1646 
1647 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1648 				 sizeof(req), true);
1649 }
1650 
1651 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1652 		       struct ieee80211_sta *sta, bool enable)
1653 {
1654 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1655 	struct mt7915_sta *msta;
1656 	struct sk_buff *skb;
1657 	int ret;
1658 
1659 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1660 
1661 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1662 					    &msta->wcid);
1663 	if (IS_ERR(skb))
1664 		return PTR_ERR(skb);
1665 
1666 	/* starec basic */
1667 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
1668 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1669 	if (!enable)
1670 		goto out;
1671 
1672 	/* tag order is in accordance with firmware dependency. */
1673 	if (sta) {
1674 		/* starec bfer */
1675 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1676 		/* starec ht */
1677 		mt7915_mcu_sta_ht_tlv(skb, sta);
1678 		/* starec vht */
1679 		mt7915_mcu_sta_vht_tlv(skb, sta);
1680 		/* starec uapsd */
1681 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1682 	}
1683 
1684 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1685 	if (ret) {
1686 		dev_kfree_skb(skb);
1687 		return ret;
1688 	}
1689 
1690 	if (sta) {
1691 		/* starec amsdu */
1692 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1693 		/* starec he */
1694 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1695 		/* starec muru */
1696 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1697 		/* starec bfee */
1698 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1699 	}
1700 
1701 	ret = mt7915_mcu_add_group(dev, vif, sta);
1702 	if (ret) {
1703 		dev_kfree_skb(skb);
1704 		return ret;
1705 	}
1706 out:
1707 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1708 	if (ret)
1709 		return ret;
1710 
1711 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1712 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1713 }
1714 
1715 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1716 {
1717 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1718 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1719 	struct {
1720 		__le32 args[2];
1721 	} req = {
1722 		.args[0] = cpu_to_le32(1),
1723 		.args[1] = cpu_to_le32(6),
1724 	};
1725 
1726 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1727 					 &req, sizeof(req));
1728 #else
1729 	return 0;
1730 #endif
1731 }
1732 
1733 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1734 			    struct ieee80211_vif *vif, bool enable)
1735 {
1736 	struct mt7915_dev *dev = phy->dev;
1737 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1738 	struct {
1739 		struct req_hdr {
1740 			u8 omac_idx;
1741 			u8 band_idx;
1742 			__le16 tlv_num;
1743 			u8 is_tlv_append;
1744 			u8 rsv[3];
1745 		} __packed hdr;
1746 		struct req_tlv {
1747 			__le16 tag;
1748 			__le16 len;
1749 			u8 active;
1750 			u8 band_idx;
1751 			u8 omac_addr[ETH_ALEN];
1752 		} __packed tlv;
1753 	} data = {
1754 		.hdr = {
1755 			.omac_idx = mvif->mt76.omac_idx,
1756 			.band_idx = mvif->mt76.band_idx,
1757 			.tlv_num = cpu_to_le16(1),
1758 			.is_tlv_append = 1,
1759 		},
1760 		.tlv = {
1761 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1762 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1763 			.active = enable,
1764 			.band_idx = mvif->mt76.band_idx,
1765 		},
1766 	};
1767 
1768 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1769 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1770 
1771 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1772 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1773 				 &data, sizeof(data), true);
1774 }
1775 
1776 static void
1777 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1778 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1779 			 struct ieee80211_mutable_offsets *offs)
1780 {
1781 	struct bss_info_bcn_cntdwn *info;
1782 	struct tlv *tlv;
1783 	int sub_tag;
1784 
1785 	if (!offs->cntdwn_counter_offs[0])
1786 		return;
1787 
1788 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1789 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1790 					   &bcn->sub_ntlv, &bcn->len);
1791 	info = (struct bss_info_bcn_cntdwn *)tlv;
1792 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1793 }
1794 
1795 static void
1796 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1797 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1798 		       struct ieee80211_mutable_offsets *offs)
1799 {
1800 	struct bss_info_bcn_mbss *mbss;
1801 	const struct element *elem;
1802 	struct tlv *tlv;
1803 
1804 	if (!vif->bss_conf.bssid_indicator)
1805 		return;
1806 
1807 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1808 					   sizeof(*mbss), &bcn->sub_ntlv,
1809 					   &bcn->len);
1810 
1811 	mbss = (struct bss_info_bcn_mbss *)tlv;
1812 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1813 	mbss->bitmap = cpu_to_le32(1);
1814 
1815 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1816 			    &skb->data[offs->mbssid_off],
1817 			    skb->len - offs->mbssid_off) {
1818 		const struct element *sub_elem;
1819 
1820 		if (elem->datalen < 2)
1821 			continue;
1822 
1823 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1824 			const struct ieee80211_bssid_index *idx;
1825 			const u8 *idx_ie;
1826 
1827 			if (sub_elem->id || sub_elem->datalen < 4)
1828 				continue; /* not a valid BSS profile */
1829 
1830 			/* Find WLAN_EID_MULTI_BSSID_IDX
1831 			 * in the merged nontransmitted profile
1832 			 */
1833 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1834 						  sub_elem->data,
1835 						  sub_elem->datalen);
1836 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1837 				continue;
1838 
1839 			idx = (void *)(idx_ie + 2);
1840 			if (!idx->bssid_index || idx->bssid_index > 31)
1841 				continue;
1842 
1843 			mbss->offset[idx->bssid_index] =
1844 				cpu_to_le16(idx_ie - skb->data);
1845 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1846 		}
1847 	}
1848 }
1849 
1850 static void
1851 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1852 		       struct sk_buff *rskb, struct sk_buff *skb,
1853 		       struct bss_info_bcn *bcn,
1854 		       struct ieee80211_mutable_offsets *offs)
1855 {
1856 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1857 	struct bss_info_bcn_cont *cont;
1858 	struct tlv *tlv;
1859 	u8 *buf;
1860 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1861 
1862 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1863 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1864 					   len, &bcn->sub_ntlv, &bcn->len);
1865 
1866 	cont = (struct bss_info_bcn_cont *)tlv;
1867 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1868 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1869 
1870 	if (offs->cntdwn_counter_offs[0]) {
1871 		u16 offset = offs->cntdwn_counter_offs[0];
1872 
1873 		if (vif->bss_conf.csa_active)
1874 			cont->csa_ofs = cpu_to_le16(offset - 4);
1875 		if (vif->bss_conf.color_change_active)
1876 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1877 	}
1878 
1879 	buf = (u8 *)tlv + sizeof(*cont);
1880 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1881 			      0, BSS_CHANGED_BEACON);
1882 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1883 }
1884 
1885 int
1886 mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1887 			     u32 changed)
1888 {
1889 #define OFFLOAD_TX_MODE_SU	BIT(0)
1890 #define OFFLOAD_TX_MODE_MU	BIT(1)
1891 	struct ieee80211_hw *hw = mt76_hw(dev);
1892 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1893 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1894 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1895 	enum nl80211_band band = chandef->chan->band;
1896 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1897 	struct bss_info_bcn *bcn;
1898 	struct bss_info_inband_discovery *discov;
1899 	struct ieee80211_tx_info *info;
1900 	struct sk_buff *rskb, *skb = NULL;
1901 	struct tlv *tlv, *sub_tlv;
1902 	bool ext_phy = phy != &dev->phy;
1903 	u8 *buf, interval;
1904 	int len;
1905 
1906 	if (vif->bss_conf.nontransmitted)
1907 		return 0;
1908 
1909 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
1910 					       MT7915_MAX_BSS_OFFLOAD_SIZE);
1911 	if (IS_ERR(rskb))
1912 		return PTR_ERR(rskb);
1913 
1914 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1915 	bcn = (struct bss_info_bcn *)tlv;
1916 	bcn->enable = true;
1917 
1918 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
1919 	    vif->bss_conf.fils_discovery.max_interval) {
1920 		interval = vif->bss_conf.fils_discovery.max_interval;
1921 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1922 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1923 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1924 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1925 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1926 	}
1927 
1928 	if (!skb) {
1929 		dev_kfree_skb(rskb);
1930 		return -EINVAL;
1931 	}
1932 
1933 	info = IEEE80211_SKB_CB(skb);
1934 	info->control.vif = vif;
1935 	info->band = band;
1936 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1937 
1938 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1939 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1940 
1941 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
1942 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1943 		dev_kfree_skb(rskb);
1944 		dev_kfree_skb(skb);
1945 		return -EINVAL;
1946 	}
1947 
1948 	sub_tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1949 					       len, &bcn->sub_ntlv, &bcn->len);
1950 	discov = (struct bss_info_inband_discovery *)sub_tlv;
1951 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1952 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1953 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1954 	discov->tx_interval = interval;
1955 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1956 	discov->enable = true;
1957 
1958 	buf = (u8 *)sub_tlv + sizeof(*discov);
1959 
1960 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1961 			      0, changed);
1962 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1963 
1964 	dev_kfree_skb(skb);
1965 
1966 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
1967 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1968 }
1969 
1970 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1971 			  int en, u32 changed)
1972 {
1973 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1974 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1975 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1976 	struct ieee80211_mutable_offsets offs;
1977 	struct ieee80211_tx_info *info;
1978 	struct sk_buff *skb, *rskb;
1979 	struct tlv *tlv;
1980 	struct bss_info_bcn *bcn;
1981 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
1982 	bool ext_phy = phy != &dev->phy;
1983 
1984 	if (vif->bss_conf.nontransmitted)
1985 		return 0;
1986 
1987 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1988 					       NULL, len);
1989 	if (IS_ERR(rskb))
1990 		return PTR_ERR(rskb);
1991 
1992 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1993 	bcn = (struct bss_info_bcn *)tlv;
1994 	bcn->enable = en;
1995 
1996 	if (!en)
1997 		goto out;
1998 
1999 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
2000 	if (!skb) {
2001 		dev_kfree_skb(rskb);
2002 		return -EINVAL;
2003 	}
2004 
2005 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
2006 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2007 		dev_kfree_skb(rskb);
2008 		dev_kfree_skb(skb);
2009 		return -EINVAL;
2010 	}
2011 
2012 	info = IEEE80211_SKB_CB(skb);
2013 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
2014 
2015 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2016 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2017 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2018 	dev_kfree_skb(skb);
2019 
2020 out:
2021 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2022 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2023 }
2024 
2025 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2026 {
2027 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2028 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2029 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2030 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2031 		return -EIO;
2032 	}
2033 
2034 	/* clear irq when the driver own success */
2035 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2036 		MT_TOP_LPCR_HOST_BAND_STAT);
2037 
2038 	return 0;
2039 }
2040 
2041 static int
2042 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2043 {
2044 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2045 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2046 
2047 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2048 			    state, 1000)) {
2049 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2050 		return -EIO;
2051 	}
2052 	return 0;
2053 }
2054 
2055 static int mt7915_load_firmware(struct mt7915_dev *dev)
2056 {
2057 	int ret;
2058 
2059 	/* make sure fw is download state */
2060 	if (mt7915_firmware_state(dev, false)) {
2061 		/* restart firmware once */
2062 		mt76_connac_mcu_restart(&dev->mt76);
2063 		ret = mt7915_firmware_state(dev, false);
2064 		if (ret) {
2065 			dev_err(dev->mt76.dev,
2066 				"Firmware is not ready for download\n");
2067 			return ret;
2068 		}
2069 	}
2070 
2071 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2072 	if (ret)
2073 		return ret;
2074 
2075 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2076 				    fw_name(dev, FIRMWARE_WA));
2077 	if (ret)
2078 		return ret;
2079 
2080 	ret = mt7915_firmware_state(dev, true);
2081 	if (ret)
2082 		return ret;
2083 
2084 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2085 
2086 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2087 
2088 	return 0;
2089 }
2090 
2091 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2092 {
2093 	struct {
2094 		u8 ctrl_val;
2095 		u8 pad[3];
2096 	} data = {
2097 		.ctrl_val = ctrl
2098 	};
2099 
2100 	if (type == MCU_FW_LOG_WA)
2101 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2102 					 &data, sizeof(data), true);
2103 
2104 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2105 				 sizeof(data), true);
2106 }
2107 
2108 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2109 {
2110 	struct {
2111 		u8 ver;
2112 		u8 pad;
2113 		__le16 len;
2114 		u8 level;
2115 		u8 rsv[3];
2116 		__le32 module_idx;
2117 	} data = {
2118 		.module_idx = cpu_to_le32(module),
2119 		.level = level,
2120 	};
2121 
2122 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2123 				 sizeof(data), false);
2124 }
2125 
2126 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2127 {
2128 	struct {
2129 		__le32 cmd;
2130 		u8 enable;
2131 	} data = {
2132 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2133 		.enable = enabled,
2134 	};
2135 
2136 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2137 				sizeof(data), false);
2138 }
2139 
2140 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy)
2141 {
2142 	struct mt7915_dev *dev = phy->dev;
2143 	struct sk_buff *skb;
2144 	struct mt7915_mcu_muru_stats *mu_stats;
2145 	int ret;
2146 
2147 	struct {
2148 		__le32 cmd;
2149 		u8 band_idx;
2150 	} req = {
2151 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2152 		.band_idx = phy->mt76->band_idx,
2153 	};
2154 
2155 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2156 					&req, sizeof(req), true, &skb);
2157 	if (ret)
2158 		return ret;
2159 
2160 	mu_stats = (struct mt7915_mcu_muru_stats *)(skb->data);
2161 
2162 	/* accumulate stats, these are clear-on-read */
2163 #define __dl_u32(s)	 phy->mib.dl_##s += le32_to_cpu(mu_stats->dl.s)
2164 #define __ul_u32(s)	 phy->mib.ul_##s += le32_to_cpu(mu_stats->ul.s)
2165 	__dl_u32(cck_cnt);
2166 	__dl_u32(ofdm_cnt);
2167 	__dl_u32(htmix_cnt);
2168 	__dl_u32(htgf_cnt);
2169 	__dl_u32(vht_su_cnt);
2170 	__dl_u32(vht_2mu_cnt);
2171 	__dl_u32(vht_3mu_cnt);
2172 	__dl_u32(vht_4mu_cnt);
2173 	__dl_u32(he_su_cnt);
2174 	__dl_u32(he_2ru_cnt);
2175 	__dl_u32(he_2mu_cnt);
2176 	__dl_u32(he_3ru_cnt);
2177 	__dl_u32(he_3mu_cnt);
2178 	__dl_u32(he_4ru_cnt);
2179 	__dl_u32(he_4mu_cnt);
2180 	__dl_u32(he_5to8ru_cnt);
2181 	__dl_u32(he_9to16ru_cnt);
2182 	__dl_u32(he_gtr16ru_cnt);
2183 
2184 	__ul_u32(hetrig_su_cnt);
2185 	__ul_u32(hetrig_2ru_cnt);
2186 	__ul_u32(hetrig_3ru_cnt);
2187 	__ul_u32(hetrig_4ru_cnt);
2188 	__ul_u32(hetrig_5to8ru_cnt);
2189 	__ul_u32(hetrig_9to16ru_cnt);
2190 	__ul_u32(hetrig_gtr16ru_cnt);
2191 	__ul_u32(hetrig_2mu_cnt);
2192 	__ul_u32(hetrig_3mu_cnt);
2193 	__ul_u32(hetrig_4mu_cnt);
2194 #undef __dl_u32
2195 #undef __ul_u32
2196 
2197 	dev_kfree_skb(skb);
2198 
2199 	return 0;
2200 }
2201 
2202 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2203 {
2204 	struct {
2205 		u8 enable;
2206 		u8 _rsv[3];
2207 	} __packed req = {
2208 		.enable = enabled
2209 	};
2210 
2211 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2212 				 sizeof(req), false);
2213 }
2214 
2215 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2216 {
2217 	struct {
2218 		__le32 cmd;
2219 		u8 val[4];
2220 	} __packed req = {
2221 		.cmd = cpu_to_le32(cmd),
2222 	};
2223 
2224 	put_unaligned_le32(val, req.val);
2225 
2226 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2227 				 sizeof(req), false);
2228 }
2229 
2230 static int
2231 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2232 {
2233 #define RX_AIRTIME_FEATURE_CTRL		1
2234 #define RX_AIRTIME_BITWISE_CTRL		2
2235 #define RX_AIRTIME_CLEAR_EN	1
2236 	struct {
2237 		__le16 field;
2238 		__le16 sub_field;
2239 		__le32 set_status;
2240 		__le32 get_status;
2241 		u8 _rsv[12];
2242 
2243 		bool airtime_en;
2244 		bool mibtime_en;
2245 		bool earlyend_en;
2246 		u8 _rsv1[9];
2247 
2248 		bool airtime_clear;
2249 		bool mibtime_clear;
2250 		u8 _rsv2[98];
2251 	} __packed req = {
2252 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2253 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2254 		.airtime_clear = true,
2255 	};
2256 	int ret;
2257 
2258 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2259 				sizeof(req), true);
2260 	if (ret)
2261 		return ret;
2262 
2263 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2264 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2265 	req.airtime_en = true;
2266 
2267 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2268 				 sizeof(req), true);
2269 }
2270 
2271 static int mt7915_red_set_watermark(struct mt7915_dev *dev)
2272 {
2273 #define RED_GLOBAL_TOKEN_WATERMARK 2
2274 	struct {
2275 		__le32 args[3];
2276 		u8 cmd;
2277 		u8 version;
2278 		u8 __rsv1[4];
2279 		__le16 len;
2280 		__le16 high_mark;
2281 		__le16 low_mark;
2282 		u8 __rsv2[12];
2283 	} __packed req = {
2284 		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
2285 		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
2286 		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
2287 		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
2288 		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
2289 	};
2290 
2291 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
2292 				 sizeof(req), false);
2293 }
2294 
2295 static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
2296 {
2297 #define RED_DISABLE		0
2298 #define RED_BY_WA_ENABLE	2
2299 	int ret;
2300 	u32 red_type = enabled ? RED_BY_WA_ENABLE : RED_DISABLE;
2301 	__le32 req = cpu_to_le32(red_type);
2302 
2303 	if (enabled) {
2304 		ret = mt7915_red_set_watermark(dev);
2305 		if (ret < 0)
2306 			return ret;
2307 	}
2308 
2309 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
2310 				sizeof(req), false);
2311 	if (ret < 0)
2312 		return ret;
2313 
2314 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2315 				 MCU_WA_PARAM_RED, enabled, 0);
2316 }
2317 
2318 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2319 {
2320 	int ret;
2321 
2322 	/* force firmware operation mode into normal state,
2323 	 * which should be set before firmware download stage.
2324 	 */
2325 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2326 
2327 	ret = mt7915_driver_own(dev, 0);
2328 	if (ret)
2329 		return ret;
2330 	/* set driver own for band1 when two hif exist */
2331 	if (dev->hif2) {
2332 		ret = mt7915_driver_own(dev, 1);
2333 		if (ret)
2334 			return ret;
2335 	}
2336 
2337 	ret = mt7915_load_firmware(dev);
2338 	if (ret)
2339 		return ret;
2340 
2341 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2342 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2343 	if (ret)
2344 		return ret;
2345 
2346 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2347 	if (ret)
2348 		return ret;
2349 
2350 	if ((mtk_wed_device_active(&dev->mt76.mmio.wed) &&
2351 	     is_mt7915(&dev->mt76)) ||
2352 	    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
2353 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2354 
2355 	ret = mt7915_mcu_set_mwds(dev, 1);
2356 	if (ret)
2357 		return ret;
2358 
2359 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2360 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2361 	if (ret)
2362 		return ret;
2363 
2364 	ret = mt7915_mcu_init_rx_airtime(dev);
2365 	if (ret)
2366 		return ret;
2367 
2368 	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
2369 }
2370 
2371 int mt7915_mcu_init(struct mt7915_dev *dev)
2372 {
2373 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2374 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2375 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2376 		.mcu_parse_response = mt7915_mcu_parse_response,
2377 	};
2378 
2379 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2380 
2381 	return mt7915_mcu_init_firmware(dev);
2382 }
2383 
2384 void mt7915_mcu_exit(struct mt7915_dev *dev)
2385 {
2386 	mt76_connac_mcu_restart(&dev->mt76);
2387 	if (mt7915_firmware_state(dev, false)) {
2388 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2389 		goto out;
2390 	}
2391 
2392 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2393 	if (dev->hif2)
2394 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2395 			MT_TOP_LPCR_HOST_FW_OWN);
2396 out:
2397 	skb_queue_purge(&dev->mt76.mcu.res_q);
2398 }
2399 
2400 static int
2401 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2402 {
2403 	struct {
2404 		u8 operation;
2405 		u8 count;
2406 		u8 _rsv[2];
2407 		u8 index;
2408 		u8 enable;
2409 		__le16 etype;
2410 	} req = {
2411 		.operation = 1,
2412 		.count = 1,
2413 		.enable = 1,
2414 		.etype = cpu_to_le16(ETH_P_PAE),
2415 	};
2416 
2417 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2418 				 &req, sizeof(req), false);
2419 }
2420 
2421 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2422 		       bool enable, bool hdr_trans)
2423 {
2424 	struct {
2425 		u8 operation;
2426 		u8 enable;
2427 		u8 check_bssid;
2428 		u8 insert_vlan;
2429 		u8 remove_vlan;
2430 		u8 tid;
2431 		u8 mode;
2432 		u8 rsv;
2433 	} __packed req_trans = {
2434 		.enable = hdr_trans,
2435 	};
2436 	struct {
2437 		u8 enable;
2438 		u8 band;
2439 		u8 rsv[2];
2440 	} __packed req_mac = {
2441 		.enable = enable,
2442 		.band = band,
2443 	};
2444 	int ret;
2445 
2446 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2447 				&req_trans, sizeof(req_trans), false);
2448 	if (ret)
2449 		return ret;
2450 
2451 	if (hdr_trans)
2452 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2453 
2454 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2455 				 &req_mac, sizeof(req_mac), true);
2456 }
2457 
2458 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2459 {
2460 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2461 	u8 num = req->total;
2462 	size_t len = sizeof(*req) -
2463 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2464 
2465 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2466 				 len, true);
2467 }
2468 
2469 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2470 {
2471 #define TX_CMD_MODE		1
2472 	struct mt7915_mcu_tx req = {
2473 		.valid = true,
2474 		.mode = TX_CMD_MODE,
2475 		.total = IEEE80211_NUM_ACS,
2476 	};
2477 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2478 	int ac;
2479 
2480 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2481 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2482 		struct edca *e = &req.edca[ac];
2483 
2484 		e->set = WMM_PARAM_SET;
2485 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2486 		e->aifs = q->aifs;
2487 		e->txop = cpu_to_le16(q->txop);
2488 
2489 		if (q->cw_min)
2490 			e->cw_min = fls(q->cw_min);
2491 		else
2492 			e->cw_min = 5;
2493 
2494 		if (q->cw_max)
2495 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2496 		else
2497 			e->cw_max = cpu_to_le16(10);
2498 	}
2499 
2500 	return mt7915_mcu_update_edca(dev, &req);
2501 }
2502 
2503 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2504 {
2505 	struct {
2506 		__le32 tag;
2507 		__le16 min_lpn;
2508 		u8 rsv[2];
2509 	} __packed req = {
2510 		.tag = cpu_to_le32(0x1),
2511 		.min_lpn = cpu_to_le16(val),
2512 	};
2513 
2514 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2515 				 sizeof(req), true);
2516 }
2517 
2518 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2519 			    const struct mt7915_dfs_pulse *pulse)
2520 {
2521 	struct {
2522 		__le32 tag;
2523 
2524 		__le32 max_width;		/* us */
2525 		__le32 max_pwr;			/* dbm */
2526 		__le32 min_pwr;			/* dbm */
2527 		__le32 min_stgr_pri;		/* us */
2528 		__le32 max_stgr_pri;		/* us */
2529 		__le32 min_cr_pri;		/* us */
2530 		__le32 max_cr_pri;		/* us */
2531 	} __packed req = {
2532 		.tag = cpu_to_le32(0x3),
2533 
2534 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2535 		__req_field(max_width),
2536 		__req_field(max_pwr),
2537 		__req_field(min_pwr),
2538 		__req_field(min_stgr_pri),
2539 		__req_field(max_stgr_pri),
2540 		__req_field(min_cr_pri),
2541 		__req_field(max_cr_pri),
2542 #undef __req_field
2543 	};
2544 
2545 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2546 				 sizeof(req), true);
2547 }
2548 
2549 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2550 			    const struct mt7915_dfs_pattern *pattern)
2551 {
2552 	struct {
2553 		__le32 tag;
2554 		__le16 radar_type;
2555 
2556 		u8 enb;
2557 		u8 stgr;
2558 		u8 min_crpn;
2559 		u8 max_crpn;
2560 		u8 min_crpr;
2561 		u8 min_pw;
2562 		__le32 min_pri;
2563 		__le32 max_pri;
2564 		u8 max_pw;
2565 		u8 min_crbn;
2566 		u8 max_crbn;
2567 		u8 min_stgpn;
2568 		u8 max_stgpn;
2569 		u8 min_stgpr;
2570 		u8 rsv[2];
2571 		__le32 min_stgpr_diff;
2572 	} __packed req = {
2573 		.tag = cpu_to_le32(0x2),
2574 		.radar_type = cpu_to_le16(index),
2575 
2576 #define __req_field_u8(field) .field = pattern->field
2577 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2578 		__req_field_u8(enb),
2579 		__req_field_u8(stgr),
2580 		__req_field_u8(min_crpn),
2581 		__req_field_u8(max_crpn),
2582 		__req_field_u8(min_crpr),
2583 		__req_field_u8(min_pw),
2584 		__req_field_u32(min_pri),
2585 		__req_field_u32(max_pri),
2586 		__req_field_u8(max_pw),
2587 		__req_field_u8(min_crbn),
2588 		__req_field_u8(max_crbn),
2589 		__req_field_u8(min_stgpn),
2590 		__req_field_u8(max_stgpn),
2591 		__req_field_u8(min_stgpr),
2592 		__req_field_u32(min_stgpr_diff),
2593 #undef __req_field_u8
2594 #undef __req_field_u32
2595 	};
2596 
2597 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2598 				 sizeof(req), true);
2599 }
2600 
2601 static int
2602 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2603 				 struct cfg80211_chan_def *chandef,
2604 				 int cmd)
2605 {
2606 	struct mt7915_dev *dev = phy->dev;
2607 	struct mt76_phy *mphy = phy->mt76;
2608 	struct ieee80211_channel *chan = mphy->chandef.chan;
2609 	int freq = mphy->chandef.center_freq1;
2610 	struct mt7915_mcu_background_chain_ctrl req = {
2611 		.monitor_scan_type = 2, /* simple rx */
2612 	};
2613 
2614 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2615 		return -EINVAL;
2616 
2617 	if (!cfg80211_chandef_valid(&mphy->chandef))
2618 		return -EINVAL;
2619 
2620 	switch (cmd) {
2621 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2622 		req.chan = chan->hw_value;
2623 		req.central_chan = ieee80211_frequency_to_channel(freq);
2624 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2625 		req.monitor_chan = chandef->chan->hw_value;
2626 		req.monitor_central_chan =
2627 			ieee80211_frequency_to_channel(chandef->center_freq1);
2628 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2629 		req.band_idx = phy->mt76->band_idx;
2630 		req.scan_mode = 1;
2631 		break;
2632 	}
2633 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2634 		req.monitor_chan = chandef->chan->hw_value;
2635 		req.monitor_central_chan =
2636 			ieee80211_frequency_to_channel(chandef->center_freq1);
2637 		req.band_idx = phy->mt76->band_idx;
2638 		req.scan_mode = 2;
2639 		break;
2640 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2641 		req.chan = chan->hw_value;
2642 		req.central_chan = ieee80211_frequency_to_channel(freq);
2643 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2644 		req.tx_stream = hweight8(mphy->antenna_mask);
2645 		req.rx_stream = mphy->antenna_mask;
2646 		break;
2647 	default:
2648 		return -EINVAL;
2649 	}
2650 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2651 
2652 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2653 				 &req, sizeof(req), false);
2654 }
2655 
2656 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2657 				     struct cfg80211_chan_def *chandef)
2658 {
2659 	struct mt7915_dev *dev = phy->dev;
2660 	int err, region;
2661 
2662 	if (!chandef) { /* disable offchain */
2663 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2664 					      0, 0);
2665 		if (err)
2666 			return err;
2667 
2668 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2669 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2670 	}
2671 
2672 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2673 					       CH_SWITCH_BACKGROUND_SCAN_START);
2674 	if (err)
2675 		return err;
2676 
2677 	switch (dev->mt76.region) {
2678 	case NL80211_DFS_ETSI:
2679 		region = 0;
2680 		break;
2681 	case NL80211_DFS_JP:
2682 		region = 2;
2683 		break;
2684 	case NL80211_DFS_FCC:
2685 	default:
2686 		region = 1;
2687 		break;
2688 	}
2689 
2690 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2691 				       0, region);
2692 }
2693 
2694 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2695 {
2696 	static const u8 ch_band[] = {
2697 		[NL80211_BAND_2GHZ] = 0,
2698 		[NL80211_BAND_5GHZ] = 1,
2699 		[NL80211_BAND_6GHZ] = 2,
2700 	};
2701 	struct mt7915_dev *dev = phy->dev;
2702 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2703 	int freq1 = chandef->center_freq1;
2704 	u8 band = phy->mt76->band_idx;
2705 	struct {
2706 		u8 control_ch;
2707 		u8 center_ch;
2708 		u8 bw;
2709 		u8 tx_path_num;
2710 		u8 rx_path;	/* mask or num */
2711 		u8 switch_reason;
2712 		u8 band_idx;
2713 		u8 center_ch2;	/* for 80+80 only */
2714 		__le16 cac_case;
2715 		u8 channel_band;
2716 		u8 rsv0;
2717 		__le32 outband_freq;
2718 		u8 txpower_drop;
2719 		u8 ap_bw;
2720 		u8 ap_center_ch;
2721 		u8 rsv1[57];
2722 	} __packed req = {
2723 		.control_ch = chandef->chan->hw_value,
2724 		.center_ch = ieee80211_frequency_to_channel(freq1),
2725 		.bw = mt76_connac_chan_bw(chandef),
2726 		.tx_path_num = hweight16(phy->mt76->chainmask),
2727 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2728 		.band_idx = band,
2729 		.channel_band = ch_band[chandef->chan->band],
2730 	};
2731 
2732 #ifdef CONFIG_NL80211_TESTMODE
2733 	if (phy->mt76->test.tx_antenna_mask &&
2734 	    mt76_testmode_enabled(phy->mt76)) {
2735 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2736 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2737 	}
2738 #endif
2739 
2740 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2741 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2742 
2743 	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
2744 		req.switch_reason = CH_SWITCH_NORMAL;
2745 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL ||
2746 		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
2747 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2748 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2749 					  NL80211_IFTYPE_AP))
2750 		req.switch_reason = CH_SWITCH_DFS;
2751 	else
2752 		req.switch_reason = CH_SWITCH_NORMAL;
2753 
2754 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2755 		req.rx_path = hweight8(req.rx_path);
2756 
2757 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2758 		int freq2 = chandef->center_freq2;
2759 
2760 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2761 	}
2762 
2763 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2764 }
2765 
2766 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2767 {
2768 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2769 #define PAGE_IDX_MASK		GENMASK(4, 2)
2770 #define PER_PAGE_SIZE		0x400
2771 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2772 	u16 eeprom_size = mt7915_eeprom_size(dev);
2773 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2774 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2775 	int eep_len;
2776 	int i;
2777 
2778 	for (i = 0; i < total; i++, eep += eep_len) {
2779 		struct sk_buff *skb;
2780 		int ret;
2781 
2782 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2783 			eep_len = eeprom_size % PER_PAGE_SIZE;
2784 		else
2785 			eep_len = PER_PAGE_SIZE;
2786 
2787 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2788 					 sizeof(req) + eep_len);
2789 		if (!skb)
2790 			return -ENOMEM;
2791 
2792 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2793 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2794 		req.len = cpu_to_le16(eep_len);
2795 
2796 		skb_put_data(skb, &req, sizeof(req));
2797 		skb_put_data(skb, eep, eep_len);
2798 
2799 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2800 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2801 		if (ret)
2802 			return ret;
2803 	}
2804 
2805 	return 0;
2806 }
2807 
2808 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2809 {
2810 	struct mt7915_mcu_eeprom req = {
2811 		.buffer_mode = EE_MODE_EFUSE,
2812 		.format = EE_FORMAT_WHOLE,
2813 	};
2814 
2815 	if (dev->flash_mode)
2816 		return mt7915_mcu_set_eeprom_flash(dev);
2817 
2818 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2819 				 &req, sizeof(req), true);
2820 }
2821 
2822 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2823 {
2824 	struct mt7915_mcu_eeprom_info req = {
2825 		.addr = cpu_to_le32(round_down(offset,
2826 				    MT7915_EEPROM_BLOCK_SIZE)),
2827 	};
2828 	struct mt7915_mcu_eeprom_info *res;
2829 	struct sk_buff *skb;
2830 	int ret;
2831 	u8 *buf;
2832 
2833 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2834 					MCU_EXT_QUERY(EFUSE_ACCESS),
2835 					&req, sizeof(req), true, &skb);
2836 	if (ret)
2837 		return ret;
2838 
2839 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2840 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2841 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2842 	dev_kfree_skb(skb);
2843 
2844 	return 0;
2845 }
2846 
2847 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2848 {
2849 	struct {
2850 		u8 _rsv;
2851 		u8 version;
2852 		u8 die_idx;
2853 		u8 _rsv2;
2854 	} __packed req = {
2855 		.version = 1,
2856 	};
2857 	struct sk_buff *skb;
2858 	int ret;
2859 
2860 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2861 					MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
2862 					&req, sizeof(req), true, &skb);
2863 	if (ret)
2864 		return ret;
2865 
2866 	*block_num = *(u8 *)skb->data;
2867 	dev_kfree_skb(skb);
2868 
2869 	return 0;
2870 }
2871 
2872 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2873 				  u8 *data, u32 len, int cmd)
2874 {
2875 	struct {
2876 		u8 dir;
2877 		u8 valid;
2878 		__le16 bitmap;
2879 		s8 precal;
2880 		u8 action;
2881 		u8 band;
2882 		u8 idx;
2883 		u8 rsv[4];
2884 		__le32 len;
2885 	} req = {};
2886 	struct sk_buff *skb;
2887 
2888 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2889 	if (!skb)
2890 		return -ENOMEM;
2891 
2892 	req.idx = idx;
2893 	req.len = cpu_to_le32(len);
2894 	skb_put_data(skb, &req, sizeof(req));
2895 	skb_put_data(skb, data, len);
2896 
2897 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2898 }
2899 
2900 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2901 {
2902 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2903 	u32 total = MT_EE_CAL_GROUP_SIZE;
2904 
2905 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
2906 		return 0;
2907 
2908 	/*
2909 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2910 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2911 	 */
2912 	while (total > 0) {
2913 		int ret, len;
2914 
2915 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2916 
2917 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2918 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2919 		if (ret)
2920 			return ret;
2921 
2922 		total -= len;
2923 		cal += len;
2924 		idx++;
2925 	}
2926 
2927 	return 0;
2928 }
2929 
2930 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2931 {
2932 	int i;
2933 
2934 	for (i = 0; i < n_freqs; i++)
2935 		if (cur == freqs[i])
2936 			return i;
2937 
2938 	return -1;
2939 }
2940 
2941 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
2942 {
2943 	static const u16 freq_list[] = {
2944 		5180, 5200, 5220, 5240,
2945 		5260, 5280, 5300, 5320,
2946 		5500, 5520, 5540, 5560,
2947 		5580, 5600, 5620, 5640,
2948 		5660, 5680, 5700, 5745,
2949 		5765, 5785, 5805, 5825
2950 	};
2951 	int offset_2g = ARRAY_SIZE(freq_list);
2952 	int idx;
2953 
2954 	if (freq < 4000) {
2955 		if (freq < 2432)
2956 			return offset_2g;
2957 		if (freq < 2457)
2958 			return offset_2g + 1;
2959 
2960 		return offset_2g + 2;
2961 	}
2962 
2963 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
2964 		return -1;
2965 
2966 	if (bw != NL80211_CHAN_WIDTH_20) {
2967 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2968 					   freq + 10);
2969 		if (idx >= 0)
2970 			return idx;
2971 
2972 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2973 					   freq - 10);
2974 		if (idx >= 0)
2975 			return idx;
2976 	}
2977 
2978 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2979 }
2980 
2981 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
2982 {
2983 	struct mt7915_dev *dev = phy->dev;
2984 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2985 	u16 total = 2, center_freq = chandef->center_freq1;
2986 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2987 	int idx;
2988 
2989 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
2990 		return 0;
2991 
2992 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
2993 	if (idx < 0)
2994 		return -EINVAL;
2995 
2996 	/* Items: Tx DPD, Tx Flatness */
2997 	idx = idx * 2;
2998 	cal += MT_EE_CAL_GROUP_SIZE;
2999 
3000 	while (total--) {
3001 		int ret;
3002 
3003 		cal += (idx * MT_EE_CAL_UNIT);
3004 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3005 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3006 		if (ret)
3007 			return ret;
3008 
3009 		idx++;
3010 	}
3011 
3012 	return 0;
3013 }
3014 
3015 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3016 {
3017 	struct mt76_channel_state *state = phy->mt76->chan_state;
3018 	struct mt76_channel_state *state_ts = &phy->state_ts;
3019 	struct mt7915_dev *dev = phy->dev;
3020 	struct mt7915_mcu_mib *res, req[5];
3021 	struct sk_buff *skb;
3022 	static const u32 *offs;
3023 	int i, ret, len, offs_cc;
3024 	u64 cc_tx;
3025 
3026 	/* strict order */
3027 	if (is_mt7915(&dev->mt76)) {
3028 		static const u32 chip_offs[] = {
3029 			MIB_NON_WIFI_TIME,
3030 			MIB_TX_TIME,
3031 			MIB_RX_TIME,
3032 			MIB_OBSS_AIRTIME,
3033 			MIB_TXOP_INIT_COUNT,
3034 		};
3035 		len = ARRAY_SIZE(chip_offs);
3036 		offs = chip_offs;
3037 		offs_cc = 20;
3038 	} else {
3039 		static const u32 chip_offs[] = {
3040 			MIB_NON_WIFI_TIME_V2,
3041 			MIB_TX_TIME_V2,
3042 			MIB_RX_TIME_V2,
3043 			MIB_OBSS_AIRTIME_V2
3044 		};
3045 		len = ARRAY_SIZE(chip_offs);
3046 		offs = chip_offs;
3047 		offs_cc = 0;
3048 	}
3049 
3050 	for (i = 0; i < len; i++) {
3051 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
3052 		req[i].offs = cpu_to_le32(offs[i]);
3053 	}
3054 
3055 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3056 					req, len * sizeof(req[0]), true, &skb);
3057 	if (ret)
3058 		return ret;
3059 
3060 	res = (struct mt7915_mcu_mib *)(skb->data + offs_cc);
3061 
3062 #define __res_u64(s) le64_to_cpu(res[s].data)
3063 	/* subtract Tx backoff time from Tx duration */
3064 	cc_tx = is_mt7915(&dev->mt76) ? __res_u64(1) - __res_u64(4) : __res_u64(1);
3065 
3066 	if (chan_switch)
3067 		goto out;
3068 
3069 	state->cc_tx += cc_tx - state_ts->cc_tx;
3070 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3071 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3072 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3073 			  state_ts->cc_busy;
3074 
3075 out:
3076 	state_ts->cc_tx = cc_tx;
3077 	state_ts->cc_bss_rx = __res_u64(2);
3078 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3079 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3080 #undef __res_u64
3081 
3082 	dev_kfree_skb(skb);
3083 
3084 	return 0;
3085 }
3086 
3087 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3088 {
3089 	struct mt7915_dev *dev = phy->dev;
3090 	struct {
3091 		u8 ctrl_id;
3092 		u8 action;
3093 		u8 band_idx;
3094 		u8 rsv[5];
3095 	} req = {
3096 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3097 		.band_idx = phy->mt76->band_idx,
3098 	};
3099 
3100 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3101 				 sizeof(req), true);
3102 }
3103 
3104 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3105 {
3106 	struct mt7915_dev *dev = phy->dev;
3107 	struct mt7915_mcu_thermal_ctrl req = {
3108 		.band_idx = phy->mt76->band_idx,
3109 		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
3110 	};
3111 	int level, ret;
3112 
3113 	/* set duty cycle and level */
3114 	for (level = 0; level < 4; level++) {
3115 		req.duty.duty_level = level;
3116 		req.duty.duty_cycle = state;
3117 		state /= 2;
3118 
3119 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3120 					&req, sizeof(req), false);
3121 		if (ret)
3122 			return ret;
3123 	}
3124 	return 0;
3125 }
3126 
3127 int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
3128 {
3129 	struct mt7915_dev *dev = phy->dev;
3130 	struct {
3131 		struct mt7915_mcu_thermal_ctrl ctrl;
3132 
3133 		__le32 trigger_temp;
3134 		__le32 restore_temp;
3135 		__le16 sustain_time;
3136 		u8 rsv[2];
3137 	} __packed req = {
3138 		.ctrl = {
3139 			.band_idx = phy->mt76->band_idx,
3140 			.type.protect_type = 1,
3141 			.type.trigger_type = 1,
3142 		},
3143 	};
3144 	int ret;
3145 
3146 	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3147 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3148 				&req, sizeof(req.ctrl), false);
3149 
3150 	if (ret)
3151 		return ret;
3152 
3153 	/* set high-temperature trigger threshold */
3154 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3155 	/* add a safety margin ~10 */
3156 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3157 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3158 	req.sustain_time = cpu_to_le16(10);
3159 
3160 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3161 				 &req, sizeof(req), false);
3162 }
3163 
3164 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3165 {
3166 	struct mt7915_dev *dev = phy->dev;
3167 	struct {
3168 		u8 format_id;
3169 		u8 rsv;
3170 		u8 band_idx;
3171 		s8 txpower_min;
3172 	} __packed req = {
3173 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3174 		.band_idx = phy->mt76->band_idx,
3175 		.txpower_min = txpower * 2, /* 0.5db */
3176 	};
3177 
3178 	return mt76_mcu_send_msg(&dev->mt76,
3179 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3180 				 sizeof(req), true);
3181 }
3182 
3183 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3184 				 struct ieee80211_vif *vif,
3185 				 struct ieee80211_sta *sta, s8 txpower)
3186 {
3187 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3188 	struct mt7915_dev *dev = phy->dev;
3189 	struct mt76_phy *mphy = phy->mt76;
3190 	struct {
3191 		u8 format_id;
3192 		u8 rsv[3];
3193 		u8 band_idx;
3194 		s8 txpower_max;
3195 		__le16 wcid;
3196 		s8 txpower_offs[48];
3197 	} __packed req = {
3198 		.format_id = TX_POWER_LIMIT_FRAME,
3199 		.band_idx = phy->mt76->band_idx,
3200 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3201 		.wcid = cpu_to_le16(msta->wcid.idx),
3202 	};
3203 	int ret;
3204 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3205 
3206 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
3207 	if (ret)
3208 		return ret;
3209 
3210 	txpower = mt7915_get_power_bound(phy, txpower);
3211 	if (txpower > mphy->txpower_cur || txpower < 0)
3212 		return -EINVAL;
3213 
3214 	if (txpower) {
3215 		u32 offs, len, i;
3216 
3217 		if (sta->deflink.ht_cap.ht_supported) {
3218 			const u8 *sku_len = mt7915_sku_group_len;
3219 
3220 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3221 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3222 
3223 			if (sta->deflink.vht_cap.vht_supported) {
3224 				offs += len;
3225 				len = sku_len[SKU_VHT_BW20] * 4;
3226 
3227 				if (sta->deflink.he_cap.has_he) {
3228 					offs += len + sku_len[SKU_HE_RU26] * 3;
3229 					len = sku_len[SKU_HE_RU242] * 4;
3230 				}
3231 			}
3232 		} else {
3233 			return -EINVAL;
3234 		}
3235 
3236 		for (i = 0; i < len; i++, offs++)
3237 			req.txpower_offs[i] =
3238 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3239 	}
3240 
3241 	return mt76_mcu_send_msg(&dev->mt76,
3242 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3243 				 sizeof(req), true);
3244 }
3245 
3246 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3247 {
3248 	struct mt7915_dev *dev = phy->dev;
3249 	struct mt76_phy *mphy = phy->mt76;
3250 	struct ieee80211_hw *hw = mphy->hw;
3251 	struct mt7915_mcu_txpower_sku req = {
3252 		.format_id = TX_POWER_LIMIT_TABLE,
3253 		.band_idx = phy->mt76->band_idx,
3254 	};
3255 	struct mt76_power_limits limits_array;
3256 	s8 *la = (s8 *)&limits_array;
3257 	int i, idx;
3258 	int tx_power;
3259 
3260 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
3261 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3262 					      &limits_array, tx_power);
3263 	mphy->txpower_cur = tx_power;
3264 
3265 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3266 		u8 mcs_num, len = mt7915_sku_group_len[i];
3267 		int j;
3268 
3269 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3270 			mcs_num = 10;
3271 
3272 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3273 				la = (s8 *)&limits_array + 12;
3274 		} else {
3275 			mcs_num = len;
3276 		}
3277 
3278 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3279 			req.txpower_sku[idx + j] = la[j];
3280 
3281 		la += mcs_num;
3282 		idx += len;
3283 	}
3284 
3285 	return mt76_mcu_send_msg(&dev->mt76,
3286 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3287 				 sizeof(req), true);
3288 }
3289 
3290 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3291 {
3292 #define RATE_POWER_INFO	2
3293 	struct mt7915_dev *dev = phy->dev;
3294 	struct {
3295 		u8 format_id;
3296 		u8 category;
3297 		u8 band_idx;
3298 		u8 _rsv;
3299 	} __packed req = {
3300 		.format_id = TX_POWER_LIMIT_INFO,
3301 		.category = RATE_POWER_INFO,
3302 		.band_idx = phy->mt76->band_idx,
3303 	};
3304 	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
3305 	struct sk_buff *skb;
3306 	int ret, i;
3307 
3308 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3309 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3310 					&req, sizeof(req), true, &skb);
3311 	if (ret)
3312 		return ret;
3313 
3314 	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
3315 	for (i = 0; i < len; i++)
3316 		txpower[i] = txpower_sku[i][req.band_idx];
3317 
3318 	dev_kfree_skb(skb);
3319 
3320 	return 0;
3321 }
3322 
3323 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3324 			      u8 en)
3325 {
3326 	struct {
3327 		u8 test_mode_en;
3328 		u8 param_idx;
3329 		u8 _rsv[2];
3330 
3331 		u8 enable;
3332 		u8 _rsv2[3];
3333 
3334 		u8 pad[8];
3335 	} __packed req = {
3336 		.test_mode_en = test_mode,
3337 		.param_idx = param,
3338 		.enable = en,
3339 	};
3340 
3341 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3342 				 sizeof(req), false);
3343 }
3344 
3345 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3346 {
3347 	struct mt7915_dev *dev = phy->dev;
3348 	struct mt7915_sku {
3349 		u8 format_id;
3350 		u8 sku_enable;
3351 		u8 band_idx;
3352 		u8 rsv;
3353 	} __packed req = {
3354 		.format_id = TX_POWER_LIMIT_ENABLE,
3355 		.band_idx = phy->mt76->band_idx,
3356 		.sku_enable = enable,
3357 	};
3358 
3359 	return mt76_mcu_send_msg(&dev->mt76,
3360 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3361 				 sizeof(req), true);
3362 }
3363 
3364 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3365 {
3366 	struct {
3367 		u8 action;
3368 		u8 set;
3369 		u8 band;
3370 		u8 rsv;
3371 	} req = {
3372 		.action = action,
3373 		.set = set,
3374 		.band = band,
3375 	};
3376 
3377 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3378 				 &req, sizeof(req), false);
3379 }
3380 
3381 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3382 {
3383 	struct {
3384 		u8 action;
3385 		union {
3386 			struct {
3387 				u8 snd_mode;
3388 				u8 sta_num;
3389 				u8 rsv;
3390 				u8 wlan_idx[4];
3391 				__le32 snd_period;	/* ms */
3392 			} __packed snd;
3393 			struct {
3394 				bool ebf;
3395 				bool ibf;
3396 				u8 rsv;
3397 			} __packed type;
3398 			struct {
3399 				u8 bf_num;
3400 				u8 bf_bitmap;
3401 				u8 bf_sel[8];
3402 				u8 rsv[5];
3403 			} __packed mod;
3404 		};
3405 	} __packed req = {
3406 		.action = action,
3407 	};
3408 
3409 #define MT_BF_PROCESSING	4
3410 	switch (action) {
3411 	case MT_BF_SOUNDING_ON:
3412 		req.snd.snd_mode = MT_BF_PROCESSING;
3413 		break;
3414 	case MT_BF_TYPE_UPDATE:
3415 		req.type.ebf = true;
3416 		req.type.ibf = dev->ibf;
3417 		break;
3418 	case MT_BF_MODULE_UPDATE:
3419 		req.mod.bf_num = 2;
3420 		req.mod.bf_bitmap = GENMASK(1, 0);
3421 		break;
3422 	default:
3423 		return -EINVAL;
3424 	}
3425 
3426 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3427 				 sizeof(req), true);
3428 }
3429 
3430 static int
3431 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3432 {
3433 	struct mt7915_dev *dev = phy->dev;
3434 	struct mt7915_mcu_sr_ctrl req = {
3435 		.action = action,
3436 		.argnum = 1,
3437 		.band_idx = phy->mt76->band_idx,
3438 		.val = cpu_to_le32(val),
3439 	};
3440 
3441 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3442 				 sizeof(req), true);
3443 }
3444 
3445 static int
3446 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3447 			   struct ieee80211_he_obss_pd *he_obss_pd)
3448 {
3449 	struct mt7915_dev *dev = phy->dev;
3450 	struct {
3451 		struct mt7915_mcu_sr_ctrl ctrl;
3452 		struct {
3453 			u8 pd_th_non_srg;
3454 			u8 pd_th_srg;
3455 			u8 period_offs;
3456 			u8 rcpi_src;
3457 			__le16 obss_pd_min;
3458 			__le16 obss_pd_min_srg;
3459 			u8 resp_txpwr_mode;
3460 			u8 txpwr_restrict_mode;
3461 			u8 txpwr_ref;
3462 			u8 rsv[3];
3463 		} __packed param;
3464 	} __packed req = {
3465 		.ctrl = {
3466 			.action = SPR_SET_PARAM,
3467 			.argnum = 9,
3468 			.band_idx = phy->mt76->band_idx,
3469 		},
3470 	};
3471 	int ret;
3472 	u8 max_th = 82, non_srg_max_th = 62;
3473 
3474 	/* disable firmware dynamical PD asjustment */
3475 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3476 	if (ret)
3477 		return ret;
3478 
3479 	if (he_obss_pd->sr_ctrl &
3480 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3481 		req.param.pd_th_non_srg = max_th;
3482 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3483 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3484 	else
3485 		req.param.pd_th_non_srg  = non_srg_max_th;
3486 
3487 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3488 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3489 
3490 	req.param.obss_pd_min = cpu_to_le16(82);
3491 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3492 	req.param.txpwr_restrict_mode = 2;
3493 	req.param.txpwr_ref = 21;
3494 
3495 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3496 				 sizeof(req), true);
3497 }
3498 
3499 static int
3500 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3501 			     struct ieee80211_he_obss_pd *he_obss_pd)
3502 {
3503 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3504 	struct mt7915_dev *dev = phy->dev;
3505 	u8 omac = mvif->mt76.omac_idx;
3506 	struct {
3507 		struct mt7915_mcu_sr_ctrl ctrl;
3508 		struct {
3509 			u8 omac;
3510 			u8 rsv[3];
3511 			u8 flag[20];
3512 		} __packed siga;
3513 	} __packed req = {
3514 		.ctrl = {
3515 			.action = SPR_SET_SIGA,
3516 			.argnum = 1,
3517 			.band_idx = phy->mt76->band_idx,
3518 		},
3519 		.siga = {
3520 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3521 		},
3522 	};
3523 	int ret;
3524 
3525 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3526 		req.siga.flag[req.siga.omac] = 0xf;
3527 	else
3528 		return 0;
3529 
3530 	/* switch to normal AP mode */
3531 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3532 	if (ret)
3533 		return ret;
3534 
3535 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3536 				 sizeof(req), true);
3537 }
3538 
3539 static int
3540 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3541 			       struct ieee80211_he_obss_pd *he_obss_pd)
3542 {
3543 	struct mt7915_dev *dev = phy->dev;
3544 	struct {
3545 		struct mt7915_mcu_sr_ctrl ctrl;
3546 		struct {
3547 			__le32 color_l[2];
3548 			__le32 color_h[2];
3549 			__le32 bssid_l[2];
3550 			__le32 bssid_h[2];
3551 		} __packed bitmap;
3552 	} __packed req = {
3553 		.ctrl = {
3554 			.action = SPR_SET_SRG_BITMAP,
3555 			.argnum = 4,
3556 			.band_idx = phy->mt76->band_idx,
3557 		},
3558 	};
3559 	u32 bitmap;
3560 
3561 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3562 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3563 
3564 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3565 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3566 
3567 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3568 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3569 
3570 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3571 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3572 
3573 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3574 				 sizeof(req), true);
3575 }
3576 
3577 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3578 			    struct ieee80211_he_obss_pd *he_obss_pd)
3579 {
3580 	int ret;
3581 
3582 	/* enable firmware scene detection algorithms */
3583 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3584 	if (ret)
3585 		return ret;
3586 
3587 	/* firmware dynamically adjusts PD threshold so skip manual control */
3588 	if (sr_scene_detect && !he_obss_pd->enable)
3589 		return 0;
3590 
3591 	/* enable spatial reuse */
3592 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3593 	if (ret)
3594 		return ret;
3595 
3596 	if (sr_scene_detect || !he_obss_pd->enable)
3597 		return 0;
3598 
3599 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3600 	if (ret)
3601 		return ret;
3602 
3603 	/* set SRG/non-SRG OBSS PD threshold */
3604 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3605 	if (ret)
3606 		return ret;
3607 
3608 	/* Set SR prohibit */
3609 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3610 	if (ret)
3611 		return ret;
3612 
3613 	/* set SRG BSS color/BSSID bitmap */
3614 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3615 }
3616 
3617 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3618 			   struct ieee80211_sta *sta, struct rate_info *rate)
3619 {
3620 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3621 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3622 	struct mt7915_dev *dev = phy->dev;
3623 	struct mt76_phy *mphy = phy->mt76;
3624 	struct {
3625 		u8 category;
3626 		u8 band;
3627 		__le16 wcid;
3628 	} __packed req = {
3629 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3630 		.band = mvif->mt76.band_idx,
3631 		.wcid = cpu_to_le16(msta->wcid.idx),
3632 	};
3633 	struct ieee80211_supported_band *sband;
3634 	struct mt7915_mcu_phy_rx_info *res;
3635 	struct sk_buff *skb;
3636 	int ret;
3637 	bool cck = false;
3638 
3639 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3640 					&req, sizeof(req), true, &skb);
3641 	if (ret)
3642 		return ret;
3643 
3644 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3645 
3646 	rate->mcs = res->rate;
3647 	rate->nss = res->nsts + 1;
3648 
3649 	switch (res->mode) {
3650 	case MT_PHY_TYPE_CCK:
3651 		cck = true;
3652 		fallthrough;
3653 	case MT_PHY_TYPE_OFDM:
3654 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3655 			sband = &mphy->sband_5g.sband;
3656 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3657 			sband = &mphy->sband_6g.sband;
3658 		else
3659 			sband = &mphy->sband_2g.sband;
3660 
3661 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3662 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3663 		break;
3664 	case MT_PHY_TYPE_HT:
3665 	case MT_PHY_TYPE_HT_GF:
3666 		if (rate->mcs > 31) {
3667 			ret = -EINVAL;
3668 			goto out;
3669 		}
3670 
3671 		rate->flags = RATE_INFO_FLAGS_MCS;
3672 		if (res->gi)
3673 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3674 		break;
3675 	case MT_PHY_TYPE_VHT:
3676 		if (rate->mcs > 9) {
3677 			ret = -EINVAL;
3678 			goto out;
3679 		}
3680 
3681 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3682 		if (res->gi)
3683 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3684 		break;
3685 	case MT_PHY_TYPE_HE_SU:
3686 	case MT_PHY_TYPE_HE_EXT_SU:
3687 	case MT_PHY_TYPE_HE_TB:
3688 	case MT_PHY_TYPE_HE_MU:
3689 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3690 			ret = -EINVAL;
3691 			goto out;
3692 		}
3693 		rate->he_gi = res->gi;
3694 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3695 		break;
3696 	default:
3697 		ret = -EINVAL;
3698 		goto out;
3699 	}
3700 
3701 	switch (res->bw) {
3702 	case IEEE80211_STA_RX_BW_160:
3703 		rate->bw = RATE_INFO_BW_160;
3704 		break;
3705 	case IEEE80211_STA_RX_BW_80:
3706 		rate->bw = RATE_INFO_BW_80;
3707 		break;
3708 	case IEEE80211_STA_RX_BW_40:
3709 		rate->bw = RATE_INFO_BW_40;
3710 		break;
3711 	default:
3712 		rate->bw = RATE_INFO_BW_20;
3713 		break;
3714 	}
3715 
3716 out:
3717 	dev_kfree_skb(skb);
3718 
3719 	return ret;
3720 }
3721 
3722 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3723 				struct cfg80211_he_bss_color *he_bss_color)
3724 {
3725 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3726 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3727 	struct bss_info_color *bss_color;
3728 	struct sk_buff *skb;
3729 	struct tlv *tlv;
3730 
3731 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3732 					      NULL, len);
3733 	if (IS_ERR(skb))
3734 		return PTR_ERR(skb);
3735 
3736 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3737 				      sizeof(*bss_color));
3738 	bss_color = (struct bss_info_color *)tlv;
3739 	bss_color->disable = !he_bss_color->enabled;
3740 	bss_color->color = he_bss_color->color;
3741 
3742 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3743 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3744 }
3745 
3746 #define TWT_AGRT_TRIGGER	BIT(0)
3747 #define TWT_AGRT_ANNOUNCE	BIT(1)
3748 #define TWT_AGRT_PROTECT	BIT(2)
3749 
3750 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3751 			       struct mt7915_vif *mvif,
3752 			       struct mt7915_twt_flow *flow,
3753 			       int cmd)
3754 {
3755 	struct {
3756 		u8 tbl_idx;
3757 		u8 cmd;
3758 		u8 own_mac_idx;
3759 		u8 flowid; /* 0xff for group id */
3760 		__le16 peer_id; /* specify the peer_id (msb=0)
3761 				 * or group_id (msb=1)
3762 				 */
3763 		u8 duration; /* 256 us */
3764 		u8 bss_idx;
3765 		__le64 start_tsf;
3766 		__le16 mantissa;
3767 		u8 exponent;
3768 		u8 is_ap;
3769 		u8 agrt_params;
3770 		u8 rsv[23];
3771 	} __packed req = {
3772 		.tbl_idx = flow->table_id,
3773 		.cmd = cmd,
3774 		.own_mac_idx = mvif->mt76.omac_idx,
3775 		.flowid = flow->id,
3776 		.peer_id = cpu_to_le16(flow->wcid),
3777 		.duration = flow->duration,
3778 		.bss_idx = mvif->mt76.idx,
3779 		.start_tsf = cpu_to_le64(flow->tsf),
3780 		.mantissa = flow->mantissa,
3781 		.exponent = flow->exp,
3782 		.is_ap = true,
3783 	};
3784 
3785 	if (flow->protection)
3786 		req.agrt_params |= TWT_AGRT_PROTECT;
3787 	if (!flow->flowtype)
3788 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3789 	if (flow->trigger)
3790 		req.agrt_params |= TWT_AGRT_TRIGGER;
3791 
3792 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3793 				 &req, sizeof(req), true);
3794 }
3795 
3796 int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
3797 {
3798 	struct {
3799 		__le32 cmd;
3800 		__le32 num;
3801 		__le32 __rsv;
3802 		__le16 wlan_idx;
3803 	} req = {
3804 		.cmd = cpu_to_le32(0x15),
3805 		.num = cpu_to_le32(1),
3806 		.wlan_idx = cpu_to_le16(wlan_idx),
3807 	};
3808 	struct mt7915_mcu_wa_tx_stat {
3809 		__le16 wlan_idx;
3810 		u8 __rsv[2];
3811 
3812 		/* tx_bytes is deprecated since WA byte counter uses u32,
3813 		 * which easily leads to overflow.
3814 		 */
3815 		__le32 tx_bytes;
3816 		__le32 tx_packets;
3817 	} *res;
3818 	struct mt76_wcid *wcid;
3819 	struct sk_buff *skb;
3820 	int ret;
3821 
3822 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
3823 					&req, sizeof(req), true, &skb);
3824 	if (ret)
3825 		return ret;
3826 
3827 	if (!is_mt7915(&dev->mt76))
3828 		skb_pull(skb, 4);
3829 
3830 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
3831 
3832 	if (le16_to_cpu(res->wlan_idx) != wlan_idx) {
3833 		ret = -EINVAL;
3834 		goto out;
3835 	}
3836 
3837 	rcu_read_lock();
3838 
3839 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
3840 	if (wcid)
3841 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
3842 	else
3843 		ret = -EINVAL;
3844 
3845 	rcu_read_unlock();
3846 out:
3847 	dev_kfree_skb(skb);
3848 
3849 	return ret;
3850 }
3851 
3852 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3853 {
3854 	struct {
3855 		__le32 idx;
3856 		__le32 ofs;
3857 		__le32 data;
3858 	} __packed req = {
3859 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
3860 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
3861 		.data = set ? cpu_to_le32(*val) : 0,
3862 	};
3863 	struct sk_buff *skb;
3864 	int ret;
3865 
3866 	if (set)
3867 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3868 					 &req, sizeof(req), false);
3869 
3870 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3871 					&req, sizeof(req), true, &skb);
3872 	if (ret)
3873 		return ret;
3874 
3875 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3876 	dev_kfree_skb(skb);
3877 
3878 	return 0;
3879 }
3880