1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7986:						\
17 		_fw = MT7986_##name##__VA_ARGS__;		\
18 		break;						\
19 	default:						\
20 		_fw = MT7916_##name;				\
21 		break;						\
22 	}							\
23 	_fw;							\
24 })
25 
26 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
27 					 fw_name(_dev, name) :			\
28 					 fw_name(_dev, name, _MT7975))
29 
30 #define MCU_PATCH_ADDRESS		0x200000
31 
32 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
33 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
34 
35 static bool sr_scene_detect = true;
36 module_param(sr_scene_detect, bool, 0644);
37 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
38 
39 static u8
40 mt7915_mcu_get_sta_nss(u16 mcs_map)
41 {
42 	u8 nss;
43 
44 	for (nss = 8; nss > 0; nss--) {
45 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
46 
47 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
48 			break;
49 	}
50 
51 	return nss - 1;
52 }
53 
54 static void
55 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
56 			  u16 mcs_map)
57 {
58 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
59 	struct mt7915_dev *dev = msta->vif->phy->dev;
60 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
61 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
62 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
63 
64 	for (nss = 0; nss < max_nss; nss++) {
65 		int mcs;
66 
67 		switch ((mcs_map >> (2 * nss)) & 0x3) {
68 		case IEEE80211_HE_MCS_SUPPORT_0_11:
69 			mcs = GENMASK(11, 0);
70 			break;
71 		case IEEE80211_HE_MCS_SUPPORT_0_9:
72 			mcs = GENMASK(9, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_7:
75 			mcs = GENMASK(7, 0);
76 			break;
77 		default:
78 			mcs = 0;
79 		}
80 
81 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
82 
83 		switch (mcs) {
84 		case 0 ... 7:
85 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
86 			break;
87 		case 8 ... 9:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
89 			break;
90 		case 10 ... 11:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
92 			break;
93 		default:
94 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
95 			break;
96 		}
97 		mcs_map &= ~(0x3 << (nss * 2));
98 		mcs_map |= mcs << (nss * 2);
99 
100 		/* only support 2ss on 160MHz for mt7915 */
101 		if (is_mt7915(&dev->mt76) && nss > 1 &&
102 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
103 			break;
104 	}
105 
106 	*he_mcs = cpu_to_le16(mcs_map);
107 }
108 
109 static void
110 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
111 			   const u16 *mask)
112 {
113 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
114 	struct mt7915_dev *dev = msta->vif->phy->dev;
115 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
116 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
117 	u16 mcs;
118 
119 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
120 		switch (mcs_map & 0x3) {
121 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
122 			mcs = GENMASK(9, 0);
123 			break;
124 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
125 			mcs = GENMASK(8, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
128 			mcs = GENMASK(7, 0);
129 			break;
130 		default:
131 			mcs = 0;
132 		}
133 
134 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
135 
136 		/* only support 2ss on 160MHz for mt7915 */
137 		if (is_mt7915(&dev->mt76) && nss > 1 &&
138 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
139 			break;
140 	}
141 }
142 
143 static void
144 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
145 			  const u8 *mask)
146 {
147 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
148 
149 	for (nss = 0; nss < max_nss; nss++)
150 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
151 }
152 
153 static int
154 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
155 			  struct sk_buff *skb, int seq)
156 {
157 	struct mt76_connac2_mcu_rxd *rxd;
158 	int ret = 0;
159 
160 	if (!skb) {
161 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
162 			cmd, seq);
163 		return -ETIMEDOUT;
164 	}
165 
166 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
167 	if (seq != rxd->seq)
168 		return -EAGAIN;
169 
170 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
171 		skb_pull(skb, sizeof(*rxd) - 4);
172 		ret = *skb->data;
173 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
174 		skb_pull(skb, sizeof(*rxd) + 4);
175 		ret = le32_to_cpu(*(__le32 *)skb->data);
176 	} else {
177 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
178 	}
179 
180 	return ret;
181 }
182 
183 static int
184 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
185 			int cmd, int *wait_seq)
186 {
187 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
188 	enum mt76_mcuq_id qid;
189 	int ret;
190 
191 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
192 	if (ret)
193 		return ret;
194 
195 	if (cmd == MCU_CMD(FW_SCATTER))
196 		qid = MT_MCUQ_FWDL;
197 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
198 		qid = MT_MCUQ_WA;
199 	else
200 		qid = MT_MCUQ_WM;
201 
202 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
203 }
204 
205 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
206 {
207 	struct {
208 		__le32 args[3];
209 	} req = {
210 		.args = {
211 			cpu_to_le32(a1),
212 			cpu_to_le32(a2),
213 			cpu_to_le32(a3),
214 		},
215 	};
216 
217 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
218 }
219 
220 static void
221 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
222 {
223 	if (vif->bss_conf.csa_active)
224 		ieee80211_csa_finish(vif);
225 }
226 
227 static void
228 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
229 {
230 	struct mt76_phy *mphy = &dev->mt76.phy;
231 	struct mt7915_mcu_csa_notify *c;
232 
233 	c = (struct mt7915_mcu_csa_notify *)skb->data;
234 
235 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
236 	     dev->mt76.phys[MT_BAND1])
237 		mphy = dev->mt76.phys[MT_BAND1];
238 
239 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
240 			IEEE80211_IFACE_ITER_RESUME_ALL,
241 			mt7915_mcu_csa_finish, mphy->hw);
242 }
243 
244 static void
245 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
246 {
247 	struct mt76_phy *mphy = &dev->mt76.phy;
248 	struct mt7915_mcu_thermal_notify *t;
249 	struct mt7915_phy *phy;
250 
251 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
252 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
253 		return;
254 
255 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
256 	     dev->mt76.phys[MT_BAND1])
257 		mphy = dev->mt76.phys[MT_BAND1];
258 
259 	phy = (struct mt7915_phy *)mphy->priv;
260 	phy->throttle_state = t->ctrl.duty.duty_cycle;
261 }
262 
263 static void
264 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
265 {
266 	struct mt76_phy *mphy = &dev->mt76.phy;
267 	struct mt7915_mcu_rdd_report *r;
268 
269 	r = (struct mt7915_mcu_rdd_report *)skb->data;
270 
271 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
272 	     dev->mt76.phys[MT_BAND1])
273 		mphy = dev->mt76.phys[MT_BAND1];
274 
275 	if (r->band_idx == MT_RX_SEL2)
276 		cfg80211_background_radar_event(mphy->hw->wiphy,
277 						&dev->rdd2_chandef,
278 						GFP_ATOMIC);
279 	else
280 		ieee80211_radar_detected(mphy->hw);
281 	dev->hw_pattern++;
282 }
283 
284 static void
285 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
286 {
287 	struct mt76_connac2_mcu_rxd *rxd;
288 	int len = skb->len - sizeof(*rxd);
289 	const char *data, *type;
290 
291 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
292 	data = (char *)&rxd[1];
293 
294 	switch (rxd->s2d_index) {
295 	case 0:
296 		if (mt7915_debugfs_rx_log(dev, data, len))
297 			return;
298 
299 		type = "WM";
300 		break;
301 	case 2:
302 		type = "WA";
303 		break;
304 	default:
305 		type = "unknown";
306 		break;
307 	}
308 
309 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
310 }
311 
312 static void
313 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
314 {
315 	if (!vif->bss_conf.color_change_active)
316 		return;
317 
318 	ieee80211_color_change_finish(vif);
319 }
320 
321 static void
322 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
323 {
324 	struct mt76_phy *mphy = &dev->mt76.phy;
325 	struct mt7915_mcu_bcc_notify *b;
326 
327 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
328 
329 	if ((b->band_idx && !dev->phy.mt76->band_idx) && dev->mt76.phys[MT_BAND1])
330 		mphy = dev->mt76.phys[MT_BAND1];
331 
332 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
333 			IEEE80211_IFACE_ITER_RESUME_ALL,
334 			mt7915_mcu_cca_finish, mphy->hw);
335 }
336 
337 static void
338 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
339 {
340 	struct mt76_connac2_mcu_rxd *rxd;
341 
342 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
343 	switch (rxd->ext_eid) {
344 	case MCU_EXT_EVENT_THERMAL_PROTECT:
345 		mt7915_mcu_rx_thermal_notify(dev, skb);
346 		break;
347 	case MCU_EXT_EVENT_RDD_REPORT:
348 		mt7915_mcu_rx_radar_detected(dev, skb);
349 		break;
350 	case MCU_EXT_EVENT_CSA_NOTIFY:
351 		mt7915_mcu_rx_csa_notify(dev, skb);
352 		break;
353 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
354 		mt7915_mcu_rx_log_message(dev, skb);
355 		break;
356 	case MCU_EXT_EVENT_BCC_NOTIFY:
357 		mt7915_mcu_rx_bcc_notify(dev, skb);
358 		break;
359 	default:
360 		break;
361 	}
362 }
363 
364 static void
365 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
366 {
367 	struct mt76_connac2_mcu_rxd *rxd;
368 
369 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
370 	switch (rxd->eid) {
371 	case MCU_EVENT_EXT:
372 		mt7915_mcu_rx_ext_event(dev, skb);
373 		break;
374 	default:
375 		break;
376 	}
377 	dev_kfree_skb(skb);
378 }
379 
380 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
381 {
382 	struct mt76_connac2_mcu_rxd *rxd;
383 
384 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
385 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
386 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
387 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
388 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
389 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
390 	    !rxd->seq)
391 		mt7915_mcu_rx_unsolicited_event(dev, skb);
392 	else
393 		mt76_mcu_rx_event(&dev->mt76, skb);
394 }
395 
396 static struct tlv *
397 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
398 			     __le16 *sub_ntlv, __le16 *len)
399 {
400 	struct tlv *ptlv, tlv = {
401 		.tag = cpu_to_le16(sub_tag),
402 		.len = cpu_to_le16(sub_len),
403 	};
404 
405 	ptlv = skb_put(skb, sub_len);
406 	memcpy(ptlv, &tlv, sizeof(tlv));
407 
408 	le16_add_cpu(sub_ntlv, 1);
409 	le16_add_cpu(len, sub_len);
410 
411 	return ptlv;
412 }
413 
414 /** bss info **/
415 struct mt7915_he_obss_narrow_bw_ru_data {
416 	bool tolerated;
417 };
418 
419 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
420 						   struct cfg80211_bss *bss,
421 						   void *_data)
422 {
423 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
424 	const struct element *elem;
425 
426 	rcu_read_lock();
427 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
428 
429 	if (!elem || elem->datalen <= 10 ||
430 	    !(elem->data[10] &
431 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
432 		data->tolerated = false;
433 
434 	rcu_read_unlock();
435 }
436 
437 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
438 					      struct ieee80211_vif *vif)
439 {
440 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
441 		.tolerated = true,
442 	};
443 
444 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
445 		return false;
446 
447 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
448 			  mt7915_check_he_obss_narrow_bw_ru_iter,
449 			  &iter_data);
450 
451 	/*
452 	 * If there is at least one AP on radar channel that cannot
453 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
454 	 */
455 	return !iter_data.tolerated;
456 }
457 
458 static void
459 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
460 			struct mt7915_phy *phy)
461 {
462 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
463 	struct bss_info_rf_ch *ch;
464 	struct tlv *tlv;
465 	int freq1 = chandef->center_freq1;
466 
467 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
468 
469 	ch = (struct bss_info_rf_ch *)tlv;
470 	ch->pri_ch = chandef->chan->hw_value;
471 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
472 	ch->bw = mt76_connac_chan_bw(chandef);
473 
474 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
475 		int freq2 = chandef->center_freq2;
476 
477 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
478 	}
479 
480 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
481 		struct mt76_phy *mphy = phy->mt76;
482 
483 		ch->he_ru26_block =
484 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
485 		ch->he_all_disable = false;
486 	} else {
487 		ch->he_all_disable = true;
488 	}
489 }
490 
491 static void
492 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
493 		      struct mt7915_phy *phy)
494 {
495 	int max_nss = hweight8(phy->mt76->antenna_mask);
496 	struct bss_info_ra *ra;
497 	struct tlv *tlv;
498 
499 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
500 
501 	ra = (struct bss_info_ra *)tlv;
502 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
503 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
504 	ra->short_preamble = true;
505 	ra->tx_streams = max_nss;
506 	ra->rx_streams = max_nss;
507 	ra->algo = 4;
508 	ra->train_up_rule = 2;
509 	ra->train_up_high_thres = 110;
510 	ra->train_up_rule_rssi = -70;
511 	ra->low_traffic_thres = 2;
512 	ra->phy_cap = cpu_to_le32(0xfdf);
513 	ra->interval = cpu_to_le32(500);
514 	ra->fast_interval = cpu_to_le32(100);
515 }
516 
517 static void
518 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
519 		      struct mt7915_phy *phy)
520 {
521 #define DEFAULT_HE_PE_DURATION		4
522 #define DEFAULT_HE_DURATION_RTS_THRES	1023
523 	const struct ieee80211_sta_he_cap *cap;
524 	struct bss_info_he *he;
525 	struct tlv *tlv;
526 
527 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
528 
529 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
530 
531 	he = (struct bss_info_he *)tlv;
532 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
533 	if (!he->he_pe_duration)
534 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
535 
536 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
537 	if (!he->he_rts_thres)
538 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
539 
540 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
541 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
542 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
543 }
544 
545 static void
546 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
547 {
548 #define TXD_CMP_MAP1		GENMASK(15, 0)
549 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
550 	struct bss_info_hw_amsdu *amsdu;
551 	struct tlv *tlv;
552 
553 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
554 
555 	amsdu = (struct bss_info_hw_amsdu *)tlv;
556 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
557 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
558 	amsdu->trig_thres = cpu_to_le16(2);
559 	amsdu->enable = true;
560 }
561 
562 static void
563 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
564 {
565 	struct bss_info_bmc_rate *bmc;
566 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
567 	enum nl80211_band band = chandef->chan->band;
568 	struct tlv *tlv;
569 
570 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
571 
572 	bmc = (struct bss_info_bmc_rate *)tlv;
573 	if (band == NL80211_BAND_2GHZ) {
574 		bmc->short_preamble = true;
575 	} else {
576 		bmc->bc_trans = cpu_to_le16(0x2000);
577 		bmc->mc_trans = cpu_to_le16(0x2080);
578 	}
579 }
580 
581 static int
582 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
583 		       bool bssid, bool enable)
584 {
585 	struct mt7915_dev *dev = phy->dev;
586 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
587 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
588 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
589 	const u8 *addr = vif->addr;
590 	struct {
591 		u8 mode;
592 		u8 force_clear;
593 		u8 clear_bitmap[8];
594 		u8 entry_count;
595 		u8 write;
596 		u8 band;
597 
598 		u8 index;
599 		u8 bssid;
600 		u8 addr[ETH_ALEN];
601 	} __packed req = {
602 		.mode = !!mask || enable,
603 		.entry_count = 1,
604 		.write = 1,
605 		.band = phy->mt76->band_idx,
606 		.index = idx * 2 + bssid,
607 	};
608 
609 	if (bssid)
610 		addr = vif->bss_conf.bssid;
611 
612 	if (enable)
613 		ether_addr_copy(req.addr, addr);
614 
615 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
616 				 sizeof(req), true);
617 }
618 
619 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
620 			    struct ieee80211_vif *vif, int enable)
621 {
622 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
623 	struct mt7915_dev *dev = phy->dev;
624 	struct sk_buff *skb;
625 
626 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
627 		mt7915_mcu_muar_config(phy, vif, false, enable);
628 		mt7915_mcu_muar_config(phy, vif, true, enable);
629 	}
630 
631 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
632 					      MT7915_BSS_UPDATE_MAX_SIZE);
633 	if (IS_ERR(skb))
634 		return PTR_ERR(skb);
635 
636 	/* bss_omac must be first */
637 	if (enable)
638 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
639 
640 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
641 				      mvif->sta.wcid.idx, enable);
642 
643 	if (vif->type == NL80211_IFTYPE_MONITOR)
644 		goto out;
645 
646 	if (enable) {
647 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
648 		mt7915_mcu_bss_bmc_tlv(skb, phy);
649 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
650 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
651 
652 		if (vif->bss_conf.he_support)
653 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
654 
655 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
656 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
657 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
658 	}
659 out:
660 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
661 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
662 }
663 
664 /** starec & wtbl **/
665 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
666 			 struct ieee80211_ampdu_params *params,
667 			 bool enable)
668 {
669 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
670 	struct mt7915_vif *mvif = msta->vif;
671 
672 	if (enable && !params->amsdu)
673 		msta->wcid.amsdu = false;
674 
675 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
676 				      MCU_EXT_CMD(STA_REC_UPDATE),
677 				      enable, true);
678 }
679 
680 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
681 			 struct ieee80211_ampdu_params *params,
682 			 bool enable)
683 {
684 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
685 	struct mt7915_vif *mvif = msta->vif;
686 
687 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
688 				      MCU_EXT_CMD(STA_REC_UPDATE),
689 				      enable, false);
690 }
691 
692 static void
693 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
694 		      struct ieee80211_vif *vif)
695 {
696 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
697 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
698 	struct ieee80211_he_mcs_nss_supp mcs_map;
699 	struct sta_rec_he *he;
700 	struct tlv *tlv;
701 	u32 cap = 0;
702 
703 	if (!sta->deflink.he_cap.has_he)
704 		return;
705 
706 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
707 
708 	he = (struct sta_rec_he *)tlv;
709 
710 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
711 		cap |= STA_REC_HE_CAP_HTC;
712 
713 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
714 		cap |= STA_REC_HE_CAP_BSR;
715 
716 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
717 		cap |= STA_REC_HE_CAP_OM;
718 
719 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
720 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
721 
722 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
723 		cap |= STA_REC_HE_CAP_BQR;
724 
725 	if (elem->phy_cap_info[0] &
726 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
727 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
728 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
729 
730 	if (mvif->cap.he_ldpc &&
731 	    (elem->phy_cap_info[1] &
732 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
733 		cap |= STA_REC_HE_CAP_LDPC;
734 
735 	if (elem->phy_cap_info[1] &
736 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
737 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
738 
739 	if (elem->phy_cap_info[2] &
740 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
741 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
742 
743 	if (elem->phy_cap_info[2] &
744 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
745 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
746 
747 	if (elem->phy_cap_info[2] &
748 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
749 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
750 
751 	if (elem->phy_cap_info[6] &
752 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
753 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
754 
755 	if (elem->phy_cap_info[6] &
756 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
757 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
758 
759 	if (elem->phy_cap_info[7] &
760 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
761 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
762 
763 	if (elem->phy_cap_info[7] &
764 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
765 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
766 
767 	if (elem->phy_cap_info[7] &
768 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
769 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
770 
771 	if (elem->phy_cap_info[8] &
772 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
773 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
774 
775 	if (elem->phy_cap_info[8] &
776 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
777 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
778 
779 	if (elem->phy_cap_info[9] &
780 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
781 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
782 
783 	if (elem->phy_cap_info[9] &
784 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
785 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
786 
787 	he->he_cap = cpu_to_le32(cap);
788 
789 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
790 	switch (sta->deflink.bandwidth) {
791 	case IEEE80211_STA_RX_BW_160:
792 		if (elem->phy_cap_info[0] &
793 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
794 			mt7915_mcu_set_sta_he_mcs(sta,
795 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
796 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
797 
798 		mt7915_mcu_set_sta_he_mcs(sta,
799 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
800 					  le16_to_cpu(mcs_map.rx_mcs_160));
801 		fallthrough;
802 	default:
803 		mt7915_mcu_set_sta_he_mcs(sta,
804 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
805 					  le16_to_cpu(mcs_map.rx_mcs_80));
806 		break;
807 	}
808 
809 	he->t_frame_dur =
810 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
811 	he->max_ampdu_exp =
812 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
813 
814 	he->bw_set =
815 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
816 	he->device_class =
817 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
818 	he->punc_pream_rx =
819 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
820 
821 	he->dcm_tx_mode =
822 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
823 	he->dcm_tx_max_nss =
824 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
825 	he->dcm_rx_mode =
826 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
827 	he->dcm_rx_max_nss =
828 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
829 	he->dcm_rx_max_nss =
830 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
831 
832 	he->pkt_ext = 2;
833 }
834 
835 static void
836 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
837 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
838 {
839 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
840 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
841 	struct sta_rec_muru *muru;
842 	struct tlv *tlv;
843 
844 	if (vif->type != NL80211_IFTYPE_STATION &&
845 	    vif->type != NL80211_IFTYPE_AP)
846 		return;
847 
848 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
849 
850 	muru = (struct sta_rec_muru *)tlv;
851 
852 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
853 			       mvif->cap.vht_mu_ebfer ||
854 			       mvif->cap.vht_mu_ebfee;
855 	if (!is_mt7915(&dev->mt76))
856 		muru->cfg.mimo_ul_en = true;
857 	muru->cfg.ofdma_dl_en = true;
858 
859 	if (sta->deflink.vht_cap.vht_supported)
860 		muru->mimo_dl.vht_mu_bfee =
861 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
862 
863 	if (!sta->deflink.he_cap.has_he)
864 		return;
865 
866 	muru->mimo_dl.partial_bw_dl_mimo =
867 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
868 
869 	muru->mimo_ul.full_ul_mimo =
870 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
871 	muru->mimo_ul.partial_ul_mimo =
872 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
873 
874 	muru->ofdma_dl.punc_pream_rx =
875 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
876 	muru->ofdma_dl.he_20m_in_40m_2g =
877 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
878 	muru->ofdma_dl.he_20m_in_160m =
879 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
880 	muru->ofdma_dl.he_80m_in_160m =
881 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
882 
883 	muru->ofdma_ul.t_frame_dur =
884 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
885 	muru->ofdma_ul.mu_cascading =
886 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
887 	muru->ofdma_ul.uo_ra =
888 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
889 }
890 
891 static void
892 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
893 {
894 	struct sta_rec_ht *ht;
895 	struct tlv *tlv;
896 
897 	if (!sta->deflink.ht_cap.ht_supported)
898 		return;
899 
900 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
901 
902 	ht = (struct sta_rec_ht *)tlv;
903 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
904 }
905 
906 static void
907 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
908 {
909 	struct sta_rec_vht *vht;
910 	struct tlv *tlv;
911 
912 	if (!sta->deflink.vht_cap.vht_supported)
913 		return;
914 
915 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
916 
917 	vht = (struct sta_rec_vht *)tlv;
918 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
919 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
920 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
921 }
922 
923 static void
924 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
925 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
926 {
927 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
928 	struct sta_rec_amsdu *amsdu;
929 	struct tlv *tlv;
930 
931 	if (vif->type != NL80211_IFTYPE_STATION &&
932 	    vif->type != NL80211_IFTYPE_AP)
933 		return;
934 
935 	if (!sta->deflink.agg.max_amsdu_len)
936 	    return;
937 
938 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
939 	amsdu = (struct sta_rec_amsdu *)tlv;
940 	amsdu->max_amsdu_num = 8;
941 	amsdu->amsdu_en = true;
942 	msta->wcid.amsdu = true;
943 
944 	switch (sta->deflink.agg.max_amsdu_len) {
945 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
946 		if (!is_mt7915(&dev->mt76)) {
947 			amsdu->max_mpdu_size =
948 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
949 			return;
950 		}
951 		fallthrough;
952 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
953 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
954 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
955 		return;
956 	default:
957 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
958 		return;
959 	}
960 }
961 
962 static int
963 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
964 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
965 {
966 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
967 	struct mt7915_sta *msta;
968 	struct wtbl_req_hdr *wtbl_hdr;
969 	struct mt76_wcid *wcid;
970 	struct tlv *tlv;
971 
972 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
973 	wcid = sta ? &msta->wcid : NULL;
974 
975 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
976 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
977 						  WTBL_RESET_AND_SET, tlv,
978 						  &skb);
979 	if (IS_ERR(wtbl_hdr))
980 		return PTR_ERR(wtbl_hdr);
981 
982 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
983 					 wtbl_hdr);
984 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
985 	if (sta)
986 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
987 					    wtbl_hdr, mvif->cap.ht_ldpc,
988 					    mvif->cap.vht_ldpc);
989 
990 	return 0;
991 }
992 
993 static inline bool
994 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
995 			struct ieee80211_sta *sta, bool bfee)
996 {
997 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
998 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
999 
1000 	if (vif->type != NL80211_IFTYPE_STATION &&
1001 	    vif->type != NL80211_IFTYPE_AP)
1002 		return false;
1003 
1004 	if (!bfee && tx_ant < 2)
1005 		return false;
1006 
1007 	if (sta->deflink.he_cap.has_he) {
1008 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1009 
1010 		if (bfee)
1011 			return mvif->cap.he_su_ebfee &&
1012 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1013 		else
1014 			return mvif->cap.he_su_ebfer &&
1015 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1016 	}
1017 
1018 	if (sta->deflink.vht_cap.vht_supported) {
1019 		u32 cap = sta->deflink.vht_cap.cap;
1020 
1021 		if (bfee)
1022 			return mvif->cap.vht_su_ebfee &&
1023 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1024 		else
1025 			return mvif->cap.vht_su_ebfer &&
1026 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1027 	}
1028 
1029 	return false;
1030 }
1031 
1032 static void
1033 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1034 {
1035 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1036 	bf->ndp_rate = 0;				/* mcs0 */
1037 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1038 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1039 }
1040 
1041 static void
1042 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1043 		       struct sta_rec_bf *bf)
1044 {
1045 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1046 	u8 n = 0;
1047 
1048 	bf->tx_mode = MT_PHY_TYPE_HT;
1049 
1050 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1051 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1052 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1053 			      mcs->tx_params);
1054 	else if (mcs->rx_mask[3])
1055 		n = 3;
1056 	else if (mcs->rx_mask[2])
1057 		n = 2;
1058 	else if (mcs->rx_mask[1])
1059 		n = 1;
1060 
1061 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1062 	bf->ncol = min_t(u8, bf->nrow, n);
1063 	bf->ibf_ncol = n;
1064 }
1065 
1066 static void
1067 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1068 			struct sta_rec_bf *bf, bool explicit)
1069 {
1070 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1071 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1072 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1073 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1074 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1075 
1076 	bf->tx_mode = MT_PHY_TYPE_VHT;
1077 
1078 	if (explicit) {
1079 		u8 sts, snd_dim;
1080 
1081 		mt7915_mcu_sta_sounding_rate(bf);
1082 
1083 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1084 				pc->cap);
1085 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1086 				    vc->cap);
1087 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1088 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1089 		bf->ibf_ncol = bf->ncol;
1090 
1091 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1092 			bf->nrow = 1;
1093 	} else {
1094 		bf->nrow = tx_ant;
1095 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1096 		bf->ibf_ncol = nss_mcs;
1097 
1098 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1099 			bf->ibf_nrow = 1;
1100 	}
1101 }
1102 
1103 static void
1104 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1105 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1106 {
1107 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1108 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1109 	const struct ieee80211_sta_he_cap *vc =
1110 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1111 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1112 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1113 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1114 	u8 snd_dim, sts;
1115 
1116 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1117 
1118 	mt7915_mcu_sta_sounding_rate(bf);
1119 
1120 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1121 				pe->phy_cap_info[6]);
1122 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1123 				pe->phy_cap_info[6]);
1124 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1125 			 ve->phy_cap_info[5]);
1126 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1127 		     pe->phy_cap_info[4]);
1128 	bf->nrow = min_t(u8, snd_dim, sts);
1129 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1130 	bf->ibf_ncol = bf->ncol;
1131 
1132 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1133 		return;
1134 
1135 	/* go over for 160MHz and 80p80 */
1136 	if (pe->phy_cap_info[0] &
1137 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1138 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1139 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1140 
1141 		bf->ncol_gt_bw80 = nss_mcs;
1142 	}
1143 
1144 	if (pe->phy_cap_info[0] &
1145 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1146 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1147 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1148 
1149 		if (bf->ncol_gt_bw80)
1150 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1151 		else
1152 			bf->ncol_gt_bw80 = nss_mcs;
1153 	}
1154 
1155 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1156 			 ve->phy_cap_info[5]);
1157 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1158 		     pe->phy_cap_info[4]);
1159 
1160 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1161 }
1162 
1163 static void
1164 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1165 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1166 {
1167 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1168 	struct mt7915_phy *phy = mvif->phy;
1169 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1170 	struct sta_rec_bf *bf;
1171 	struct tlv *tlv;
1172 	const u8 matrix[4][4] = {
1173 		{0, 0, 0, 0},
1174 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1175 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1176 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1177 	};
1178 	bool ebf;
1179 
1180 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1181 		return;
1182 
1183 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1184 	if (!ebf && !dev->ibf)
1185 		return;
1186 
1187 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1188 	bf = (struct sta_rec_bf *)tlv;
1189 
1190 	/* he: eBF only, in accordance with spec
1191 	 * vht: support eBF and iBF
1192 	 * ht: iBF only, since mac80211 lacks of eBF support
1193 	 */
1194 	if (sta->deflink.he_cap.has_he && ebf)
1195 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1196 	else if (sta->deflink.vht_cap.vht_supported)
1197 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1198 	else if (sta->deflink.ht_cap.ht_supported)
1199 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1200 	else
1201 		return;
1202 
1203 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1204 	bf->bw = sta->deflink.bandwidth;
1205 	bf->ibf_dbw = sta->deflink.bandwidth;
1206 	bf->ibf_nrow = tx_ant;
1207 
1208 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1209 		bf->ibf_timeout = 0x48;
1210 	else
1211 		bf->ibf_timeout = 0x18;
1212 
1213 	if (ebf && bf->nrow != tx_ant)
1214 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1215 	else
1216 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1217 
1218 	switch (sta->deflink.bandwidth) {
1219 	case IEEE80211_STA_RX_BW_160:
1220 	case IEEE80211_STA_RX_BW_80:
1221 		bf->mem_total = bf->mem_20m * 2;
1222 		break;
1223 	case IEEE80211_STA_RX_BW_40:
1224 		bf->mem_total = bf->mem_20m;
1225 		break;
1226 	case IEEE80211_STA_RX_BW_20:
1227 	default:
1228 		break;
1229 	}
1230 }
1231 
1232 static void
1233 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1234 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1235 {
1236 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1237 	struct mt7915_phy *phy = mvif->phy;
1238 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1239 	struct sta_rec_bfee *bfee;
1240 	struct tlv *tlv;
1241 	u8 nrow = 0;
1242 
1243 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1244 		return;
1245 
1246 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1247 		return;
1248 
1249 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1250 	bfee = (struct sta_rec_bfee *)tlv;
1251 
1252 	if (sta->deflink.he_cap.has_he) {
1253 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1254 
1255 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1256 			      pe->phy_cap_info[5]);
1257 	} else if (sta->deflink.vht_cap.vht_supported) {
1258 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1259 
1260 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1261 				 pc->cap);
1262 	}
1263 
1264 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1265 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1266 }
1267 
1268 static enum mcu_mmps_mode
1269 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1270 {
1271 	switch (smps) {
1272 	case IEEE80211_SMPS_OFF:
1273 		return MCU_MMPS_DISABLE;
1274 	case IEEE80211_SMPS_STATIC:
1275 		return MCU_MMPS_STATIC;
1276 	case IEEE80211_SMPS_DYNAMIC:
1277 		return MCU_MMPS_DYNAMIC;
1278 	default:
1279 		return MCU_MMPS_DISABLE;
1280 	}
1281 }
1282 
1283 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1284 				   struct ieee80211_vif *vif,
1285 				   struct ieee80211_sta *sta,
1286 				   void *data, u32 field)
1287 {
1288 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1289 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1290 	struct sta_phy *phy = data;
1291 	struct sta_rec_ra_fixed *ra;
1292 	struct sk_buff *skb;
1293 	struct tlv *tlv;
1294 
1295 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1296 					    &msta->wcid);
1297 	if (IS_ERR(skb))
1298 		return PTR_ERR(skb);
1299 
1300 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1301 	ra = (struct sta_rec_ra_fixed *)tlv;
1302 
1303 	switch (field) {
1304 	case RATE_PARAM_AUTO:
1305 		break;
1306 	case RATE_PARAM_FIXED:
1307 	case RATE_PARAM_FIXED_MCS:
1308 	case RATE_PARAM_FIXED_GI:
1309 	case RATE_PARAM_FIXED_HE_LTF:
1310 		if (phy)
1311 			ra->phy = *phy;
1312 		break;
1313 	case RATE_PARAM_MMPS_UPDATE:
1314 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1315 		break;
1316 	case RATE_PARAM_SPE_UPDATE:
1317 		ra->spe_idx = *(u8 *)data;
1318 		break;
1319 	default:
1320 		break;
1321 	}
1322 	ra->field = cpu_to_le32(field);
1323 
1324 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1325 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1326 }
1327 
1328 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1329 			struct ieee80211_sta *sta)
1330 {
1331 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1332 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1333 	struct wtbl_req_hdr *wtbl_hdr;
1334 	struct tlv *sta_wtbl;
1335 	struct sk_buff *skb;
1336 	int ret;
1337 
1338 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1339 					    &msta->wcid);
1340 	if (IS_ERR(skb))
1341 		return PTR_ERR(skb);
1342 
1343 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1344 					   sizeof(struct tlv));
1345 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1346 						  WTBL_SET, sta_wtbl, &skb);
1347 	if (IS_ERR(wtbl_hdr))
1348 		return PTR_ERR(wtbl_hdr);
1349 
1350 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1351 
1352 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1353 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1354 	if (ret)
1355 		return ret;
1356 
1357 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1358 					      RATE_PARAM_MMPS_UPDATE);
1359 }
1360 
1361 static int
1362 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1363 		       struct ieee80211_sta *sta)
1364 {
1365 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1366 	struct mt76_phy *mphy = mvif->phy->mt76;
1367 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1368 
1369 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1370 					      RATE_PARAM_SPE_UPDATE);
1371 }
1372 
1373 static int
1374 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1375 			       struct ieee80211_vif *vif,
1376 			       struct ieee80211_sta *sta)
1377 {
1378 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1379 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1380 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1381 	enum nl80211_band band = chandef->chan->band;
1382 	struct sta_phy phy = {};
1383 	int ret, nrates = 0;
1384 
1385 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1386 	do {									\
1387 		u8 i, gi = mask->control[band]._gi;				\
1388 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1389 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1390 			phy.sgi |= gi << (i << (_he));				\
1391 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1392 		}								\
1393 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1394 			if (!mask->control[band]._mcs[i])			\
1395 				continue;					\
1396 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1397 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1398 			if (_ht)						\
1399 				phy.mcs += 8 * i;				\
1400 		}								\
1401 	} while (0)
1402 
1403 	if (sta->deflink.he_cap.has_he) {
1404 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1405 	} else if (sta->deflink.vht_cap.vht_supported) {
1406 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1407 	} else if (sta->deflink.ht_cap.ht_supported) {
1408 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1409 	} else {
1410 		nrates = hweight32(mask->control[band].legacy);
1411 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1412 	}
1413 #undef __sta_phy_bitrate_mask_check
1414 
1415 	/* fall back to auto rate control */
1416 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1417 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1418 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1419 	    nrates != 1)
1420 		return 0;
1421 
1422 	/* fixed single rate */
1423 	if (nrates == 1) {
1424 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1425 						     RATE_PARAM_FIXED_MCS);
1426 		if (ret)
1427 			return ret;
1428 	}
1429 
1430 	/* fixed GI */
1431 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1432 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1433 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1434 		u32 addr;
1435 
1436 		/* firmware updates only TXCMD but doesn't take WTBL into
1437 		 * account, so driver should update here to reflect the
1438 		 * actual txrate hardware sends out.
1439 		 */
1440 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1441 		if (sta->deflink.he_cap.has_he)
1442 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1443 		else
1444 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1445 
1446 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1447 						     RATE_PARAM_FIXED_GI);
1448 		if (ret)
1449 			return ret;
1450 	}
1451 
1452 	/* fixed HE_LTF */
1453 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1454 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1455 						     RATE_PARAM_FIXED_HE_LTF);
1456 		if (ret)
1457 			return ret;
1458 	}
1459 
1460 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1461 }
1462 
1463 static void
1464 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1465 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1466 {
1467 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1468 	struct mt76_phy *mphy = mvif->phy->mt76;
1469 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1470 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1471 	enum nl80211_band band = chandef->chan->band;
1472 	struct sta_rec_ra *ra;
1473 	struct tlv *tlv;
1474 	u32 supp_rate = sta->deflink.supp_rates[band];
1475 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1476 
1477 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1478 	ra = (struct sta_rec_ra *)tlv;
1479 
1480 	ra->valid = true;
1481 	ra->auto_rate = true;
1482 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1483 	ra->channel = chandef->chan->hw_value;
1484 	ra->bw = sta->deflink.bandwidth;
1485 	ra->phy.bw = sta->deflink.bandwidth;
1486 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1487 
1488 	if (supp_rate) {
1489 		supp_rate &= mask->control[band].legacy;
1490 		ra->rate_len = hweight32(supp_rate);
1491 
1492 		if (band == NL80211_BAND_2GHZ) {
1493 			ra->supp_mode = MODE_CCK;
1494 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1495 
1496 			if (ra->rate_len > 4) {
1497 				ra->supp_mode |= MODE_OFDM;
1498 				ra->supp_ofdm_rate = supp_rate >> 4;
1499 			}
1500 		} else {
1501 			ra->supp_mode = MODE_OFDM;
1502 			ra->supp_ofdm_rate = supp_rate;
1503 		}
1504 	}
1505 
1506 	if (sta->deflink.ht_cap.ht_supported) {
1507 		ra->supp_mode |= MODE_HT;
1508 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1509 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1510 
1511 		cap |= STA_CAP_HT;
1512 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1513 			cap |= STA_CAP_SGI_20;
1514 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1515 			cap |= STA_CAP_SGI_40;
1516 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1517 			cap |= STA_CAP_TX_STBC;
1518 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1519 			cap |= STA_CAP_RX_STBC;
1520 		if (mvif->cap.ht_ldpc &&
1521 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1522 			cap |= STA_CAP_LDPC;
1523 
1524 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1525 					  mask->control[band].ht_mcs);
1526 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1527 	}
1528 
1529 	if (sta->deflink.vht_cap.vht_supported) {
1530 		u8 af;
1531 
1532 		ra->supp_mode |= MODE_VHT;
1533 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1534 			       sta->deflink.vht_cap.cap);
1535 		ra->af = max_t(u8, ra->af, af);
1536 
1537 		cap |= STA_CAP_VHT;
1538 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1539 			cap |= STA_CAP_VHT_SGI_80;
1540 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1541 			cap |= STA_CAP_VHT_SGI_160;
1542 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1543 			cap |= STA_CAP_VHT_TX_STBC;
1544 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1545 			cap |= STA_CAP_VHT_RX_STBC;
1546 		if (mvif->cap.vht_ldpc &&
1547 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1548 			cap |= STA_CAP_VHT_LDPC;
1549 
1550 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1551 					   mask->control[band].vht_mcs);
1552 	}
1553 
1554 	if (sta->deflink.he_cap.has_he) {
1555 		ra->supp_mode |= MODE_HE;
1556 		cap |= STA_CAP_HE;
1557 
1558 		if (sta->deflink.he_6ghz_capa.capa)
1559 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1560 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1561 	}
1562 
1563 	ra->sta_cap = cpu_to_le32(cap);
1564 }
1565 
1566 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1567 			     struct ieee80211_sta *sta, bool changed)
1568 {
1569 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1570 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1571 	struct sk_buff *skb;
1572 	int ret;
1573 
1574 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1575 					    &msta->wcid);
1576 	if (IS_ERR(skb))
1577 		return PTR_ERR(skb);
1578 
1579 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1580 	 * once dev->rc_work changes the settings driver should also
1581 	 * update sta_rec_he here.
1582 	 */
1583 	if (changed)
1584 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1585 
1586 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1587 	 * i.e 0-{7,8,9} for VHT.
1588 	 */
1589 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1590 
1591 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1592 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1593 	if (ret)
1594 		return ret;
1595 
1596 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1597 	 * and updates as peer fixed rate parameters, which overrides
1598 	 * sta_rec_ra and firmware rate control algorithm.
1599 	 */
1600 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1601 }
1602 
1603 static int
1604 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1605 		     struct ieee80211_sta *sta)
1606 {
1607 #define MT_STA_BSS_GROUP		1
1608 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1609 	struct mt7915_sta *msta;
1610 	struct {
1611 		__le32 action;
1612 		u8 wlan_idx_lo;
1613 		u8 status;
1614 		u8 wlan_idx_hi;
1615 		u8 rsv0[5];
1616 		__le32 val;
1617 		u8 rsv1[8];
1618 	} __packed req = {
1619 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1620 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1621 	};
1622 
1623 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1624 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1625 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1626 
1627 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1628 				 sizeof(req), true);
1629 }
1630 
1631 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1632 		       struct ieee80211_sta *sta, bool enable)
1633 {
1634 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1635 	struct mt7915_sta *msta;
1636 	struct sk_buff *skb;
1637 	int ret;
1638 
1639 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1640 
1641 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1642 					    &msta->wcid);
1643 	if (IS_ERR(skb))
1644 		return PTR_ERR(skb);
1645 
1646 	/* starec basic */
1647 	mt76_connac_mcu_sta_basic_tlv(skb, vif, sta, enable,
1648 			!rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1649 	if (!enable)
1650 		goto out;
1651 
1652 	/* tag order is in accordance with firmware dependency. */
1653 	if (sta) {
1654 		/* starec bfer */
1655 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1656 		/* starec ht */
1657 		mt7915_mcu_sta_ht_tlv(skb, sta);
1658 		/* starec vht */
1659 		mt7915_mcu_sta_vht_tlv(skb, sta);
1660 		/* starec uapsd */
1661 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1662 	}
1663 
1664 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1665 	if (ret) {
1666 		dev_kfree_skb(skb);
1667 		return ret;
1668 	}
1669 
1670 	if (sta) {
1671 		/* starec amsdu */
1672 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1673 		/* starec he */
1674 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1675 		/* starec muru */
1676 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1677 		/* starec bfee */
1678 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1679 	}
1680 
1681 	ret = mt7915_mcu_add_group(dev, vif, sta);
1682 	if (ret) {
1683 		dev_kfree_skb(skb);
1684 		return ret;
1685 	}
1686 out:
1687 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1688 	if (ret)
1689 		return ret;
1690 
1691 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1692 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1693 }
1694 
1695 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1696 {
1697 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1698 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1699 	struct {
1700 		__le32 args[2];
1701 	} req = {
1702 		.args[0] = cpu_to_le32(1),
1703 		.args[1] = cpu_to_le32(6),
1704 	};
1705 
1706 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1707 					 &req, sizeof(req));
1708 #else
1709 	return 0;
1710 #endif
1711 }
1712 
1713 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1714 			    struct ieee80211_vif *vif, bool enable)
1715 {
1716 	struct mt7915_dev *dev = phy->dev;
1717 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1718 	struct {
1719 		struct req_hdr {
1720 			u8 omac_idx;
1721 			u8 band_idx;
1722 			__le16 tlv_num;
1723 			u8 is_tlv_append;
1724 			u8 rsv[3];
1725 		} __packed hdr;
1726 		struct req_tlv {
1727 			__le16 tag;
1728 			__le16 len;
1729 			u8 active;
1730 			u8 band_idx;
1731 			u8 omac_addr[ETH_ALEN];
1732 		} __packed tlv;
1733 	} data = {
1734 		.hdr = {
1735 			.omac_idx = mvif->mt76.omac_idx,
1736 			.band_idx = mvif->mt76.band_idx,
1737 			.tlv_num = cpu_to_le16(1),
1738 			.is_tlv_append = 1,
1739 		},
1740 		.tlv = {
1741 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1742 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1743 			.active = enable,
1744 			.band_idx = mvif->mt76.band_idx,
1745 		},
1746 	};
1747 
1748 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1749 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1750 
1751 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1752 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1753 				 &data, sizeof(data), true);
1754 }
1755 
1756 static void
1757 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1758 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1759 			 struct ieee80211_mutable_offsets *offs)
1760 {
1761 	struct bss_info_bcn_cntdwn *info;
1762 	struct tlv *tlv;
1763 	int sub_tag;
1764 
1765 	if (!offs->cntdwn_counter_offs[0])
1766 		return;
1767 
1768 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1769 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1770 					   &bcn->sub_ntlv, &bcn->len);
1771 	info = (struct bss_info_bcn_cntdwn *)tlv;
1772 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1773 }
1774 
1775 static void
1776 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1777 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1778 		       struct ieee80211_mutable_offsets *offs)
1779 {
1780 	struct bss_info_bcn_mbss *mbss;
1781 	const struct element *elem;
1782 	struct tlv *tlv;
1783 
1784 	if (!vif->bss_conf.bssid_indicator)
1785 		return;
1786 
1787 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1788 					   sizeof(*mbss), &bcn->sub_ntlv,
1789 					   &bcn->len);
1790 
1791 	mbss = (struct bss_info_bcn_mbss *)tlv;
1792 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1793 	mbss->bitmap = cpu_to_le32(1);
1794 
1795 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1796 			    &skb->data[offs->mbssid_off],
1797 			    skb->len - offs->mbssid_off) {
1798 		const struct element *sub_elem;
1799 
1800 		if (elem->datalen < 2)
1801 			continue;
1802 
1803 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1804 			const struct ieee80211_bssid_index *idx;
1805 			const u8 *idx_ie;
1806 
1807 			if (sub_elem->id || sub_elem->datalen < 4)
1808 				continue; /* not a valid BSS profile */
1809 
1810 			/* Find WLAN_EID_MULTI_BSSID_IDX
1811 			 * in the merged nontransmitted profile
1812 			 */
1813 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1814 						  sub_elem->data,
1815 						  sub_elem->datalen);
1816 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1817 				continue;
1818 
1819 			idx = (void *)(idx_ie + 2);
1820 			if (!idx->bssid_index || idx->bssid_index > 31)
1821 				continue;
1822 
1823 			mbss->offset[idx->bssid_index] =
1824 				cpu_to_le16(idx_ie - skb->data);
1825 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1826 		}
1827 	}
1828 }
1829 
1830 static void
1831 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1832 		       struct sk_buff *rskb, struct sk_buff *skb,
1833 		       struct bss_info_bcn *bcn,
1834 		       struct ieee80211_mutable_offsets *offs)
1835 {
1836 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1837 	struct bss_info_bcn_cont *cont;
1838 	struct tlv *tlv;
1839 	u8 *buf;
1840 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1841 
1842 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1843 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1844 					   len, &bcn->sub_ntlv, &bcn->len);
1845 
1846 	cont = (struct bss_info_bcn_cont *)tlv;
1847 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1848 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1849 
1850 	if (offs->cntdwn_counter_offs[0]) {
1851 		u16 offset = offs->cntdwn_counter_offs[0];
1852 
1853 		if (vif->bss_conf.csa_active)
1854 			cont->csa_ofs = cpu_to_le16(offset - 4);
1855 		if (vif->bss_conf.color_change_active)
1856 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1857 	}
1858 
1859 	buf = (u8 *)tlv + sizeof(*cont);
1860 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1861 			      0, BSS_CHANGED_BEACON);
1862 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1863 }
1864 
1865 static void
1866 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1867 			     struct sk_buff *skb)
1868 {
1869 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1870 	struct mt7915_vif_cap *vc = &mvif->cap;
1871 	const struct ieee80211_he_cap_elem *he;
1872 	const struct ieee80211_vht_cap *vht;
1873 	const struct ieee80211_ht_cap *ht;
1874 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1875 	const u8 *ie;
1876 	u32 len, bc;
1877 
1878 	/* Check missing configuration options to allow AP mode in mac80211
1879 	 * to remain in sync with hostapd settings, and get a subset of
1880 	 * beacon and hardware capabilities.
1881 	 */
1882 	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
1883 		return;
1884 
1885 	memset(vc, 0, sizeof(*vc));
1886 
1887 	len = skb->len - (mgmt->u.beacon.variable - skb->data);
1888 
1889 	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
1890 			      len);
1891 	if (ie && ie[1] >= sizeof(*ht)) {
1892 		ht = (void *)(ie + 2);
1893 		vc->ht_ldpc = !!(le16_to_cpu(ht->cap_info) &
1894 				 IEEE80211_HT_CAP_LDPC_CODING);
1895 	}
1896 
1897 	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
1898 			      len);
1899 	if (ie && ie[1] >= sizeof(*vht)) {
1900 		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
1901 
1902 		vht = (void *)(ie + 2);
1903 		bc = le32_to_cpu(vht->vht_cap_info);
1904 
1905 		vc->vht_ldpc = !!(bc & IEEE80211_VHT_CAP_RXLDPC);
1906 		vc->vht_su_ebfer =
1907 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
1908 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1909 		vc->vht_su_ebfee =
1910 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
1911 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1912 		vc->vht_mu_ebfer =
1913 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
1914 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
1915 		vc->vht_mu_ebfee =
1916 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
1917 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1918 	}
1919 
1920 	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
1921 				  mgmt->u.beacon.variable, len);
1922 	if (ie && ie[1] >= sizeof(*he) + 1) {
1923 		const struct ieee80211_sta_he_cap *pc =
1924 			mt76_connac_get_he_phy_cap(phy->mt76, vif);
1925 		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1926 
1927 		he = (void *)(ie + 3);
1928 
1929 		vc->he_ldpc =
1930 			HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
1931 		vc->he_su_ebfer =
1932 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
1933 			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1934 		vc->he_su_ebfee =
1935 			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
1936 			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1937 		vc->he_mu_ebfer =
1938 			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
1939 			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
1940 	}
1941 }
1942 
1943 static void
1944 mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1945 				struct sk_buff *rskb, struct bss_info_bcn *bcn,
1946 				u32 changed)
1947 {
1948 #define OFFLOAD_TX_MODE_SU	BIT(0)
1949 #define OFFLOAD_TX_MODE_MU	BIT(1)
1950 	struct ieee80211_hw *hw = mt76_hw(dev);
1951 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1952 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1953 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1954 	enum nl80211_band band = chandef->chan->band;
1955 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1956 	struct bss_info_inband_discovery *discov;
1957 	struct ieee80211_tx_info *info;
1958 	struct sk_buff *skb = NULL;
1959 	struct tlv *tlv;
1960 	bool ext_phy = phy != &dev->phy;
1961 	u8 *buf, interval;
1962 	int len;
1963 
1964 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
1965 	    vif->bss_conf.fils_discovery.max_interval) {
1966 		interval = vif->bss_conf.fils_discovery.max_interval;
1967 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1968 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1969 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1970 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1971 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1972 	}
1973 
1974 	if (!skb)
1975 		return;
1976 
1977 	info = IEEE80211_SKB_CB(skb);
1978 	info->control.vif = vif;
1979 	info->band = band;
1980 
1981 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1982 
1983 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1984 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1985 
1986 	if (len > (MT7915_MAX_BSS_OFFLOAD_SIZE - rskb->len)) {
1987 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1988 		dev_kfree_skb(skb);
1989 		return;
1990 	}
1991 
1992 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1993 					   len, &bcn->sub_ntlv, &bcn->len);
1994 	discov = (struct bss_info_inband_discovery *)tlv;
1995 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1996 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1997 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1998 	discov->tx_interval = interval;
1999 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2000 	discov->enable = true;
2001 
2002 	buf = (u8 *)tlv + sizeof(*discov);
2003 
2004 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
2005 			      0, changed);
2006 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2007 
2008 	dev_kfree_skb(skb);
2009 }
2010 
2011 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2012 			  int en, u32 changed)
2013 {
2014 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2015 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2016 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2017 	struct ieee80211_mutable_offsets offs;
2018 	struct ieee80211_tx_info *info;
2019 	struct sk_buff *skb, *rskb;
2020 	struct tlv *tlv;
2021 	struct bss_info_bcn *bcn;
2022 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
2023 	bool ext_phy = phy != &dev->phy;
2024 
2025 	if (vif->bss_conf.nontransmitted)
2026 		return 0;
2027 
2028 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2029 					       NULL, len);
2030 	if (IS_ERR(rskb))
2031 		return PTR_ERR(rskb);
2032 
2033 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2034 	bcn = (struct bss_info_bcn *)tlv;
2035 	bcn->enable = en;
2036 
2037 	if (!en)
2038 		goto out;
2039 
2040 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
2041 	if (!skb)
2042 		return -EINVAL;
2043 
2044 	if (skb->len > MT7915_MAX_BEACON_SIZE - MT_TXD_SIZE) {
2045 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2046 		dev_kfree_skb(skb);
2047 		return -EINVAL;
2048 	}
2049 
2050 	info = IEEE80211_SKB_CB(skb);
2051 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
2052 
2053 	mt7915_mcu_beacon_check_caps(phy, vif, skb);
2054 
2055 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2056 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2057 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2058 	dev_kfree_skb(skb);
2059 
2060 	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
2061 	    changed & BSS_CHANGED_FILS_DISCOVERY)
2062 		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
2063 						bcn, changed);
2064 
2065 out:
2066 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2067 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2068 }
2069 
2070 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2071 {
2072 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2073 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2074 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2075 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2076 		return -EIO;
2077 	}
2078 
2079 	/* clear irq when the driver own success */
2080 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2081 		MT_TOP_LPCR_HOST_BAND_STAT);
2082 
2083 	return 0;
2084 }
2085 
2086 static int
2087 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2088 {
2089 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2090 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2091 
2092 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2093 			    state, 1000)) {
2094 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2095 		return -EIO;
2096 	}
2097 	return 0;
2098 }
2099 
2100 static int mt7915_load_firmware(struct mt7915_dev *dev)
2101 {
2102 	int ret;
2103 
2104 	/* make sure fw is download state */
2105 	if (mt7915_firmware_state(dev, false)) {
2106 		/* restart firmware once */
2107 		__mt76_mcu_restart(&dev->mt76);
2108 		ret = mt7915_firmware_state(dev, false);
2109 		if (ret) {
2110 			dev_err(dev->mt76.dev,
2111 				"Firmware is not ready for download\n");
2112 			return ret;
2113 		}
2114 	}
2115 
2116 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2117 	if (ret)
2118 		return ret;
2119 
2120 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2121 				    fw_name(dev, FIRMWARE_WA));
2122 	if (ret)
2123 		return ret;
2124 
2125 	ret = mt7915_firmware_state(dev, true);
2126 	if (ret)
2127 		return ret;
2128 
2129 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2130 
2131 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2132 
2133 	return 0;
2134 }
2135 
2136 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2137 {
2138 	struct {
2139 		u8 ctrl_val;
2140 		u8 pad[3];
2141 	} data = {
2142 		.ctrl_val = ctrl
2143 	};
2144 
2145 	if (type == MCU_FW_LOG_WA)
2146 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2147 					 &data, sizeof(data), true);
2148 
2149 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2150 				 sizeof(data), true);
2151 }
2152 
2153 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2154 {
2155 	struct {
2156 		u8 ver;
2157 		u8 pad;
2158 		__le16 len;
2159 		u8 level;
2160 		u8 rsv[3];
2161 		__le32 module_idx;
2162 	} data = {
2163 		.module_idx = cpu_to_le32(module),
2164 		.level = level,
2165 	};
2166 
2167 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2168 				 sizeof(data), false);
2169 }
2170 
2171 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2172 {
2173 	struct {
2174 		__le32 cmd;
2175 		u8 enable;
2176 	} data = {
2177 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2178 		.enable = enabled,
2179 	};
2180 
2181 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2182 				sizeof(data), false);
2183 }
2184 
2185 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2186 {
2187 	struct mt7915_dev *dev = phy->dev;
2188 	struct sk_buff *skb;
2189 	struct mt7915_mcu_muru_stats *mu_stats =
2190 				(struct mt7915_mcu_muru_stats *)ms;
2191 	int ret;
2192 
2193 	struct {
2194 		__le32 cmd;
2195 		u8 band_idx;
2196 	} req = {
2197 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2198 		.band_idx = phy->mt76->band_idx,
2199 	};
2200 
2201 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2202 					&req, sizeof(req), true, &skb);
2203 	if (ret)
2204 		return ret;
2205 
2206 	memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2207 	dev_kfree_skb(skb);
2208 
2209 	return 0;
2210 }
2211 
2212 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2213 {
2214 	struct {
2215 		u8 enable;
2216 		u8 _rsv[3];
2217 	} __packed req = {
2218 		.enable = enabled
2219 	};
2220 
2221 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2222 				 sizeof(req), false);
2223 }
2224 
2225 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2226 {
2227 	struct {
2228 		__le32 cmd;
2229 		u8 val[4];
2230 	} __packed req = {
2231 		.cmd = cpu_to_le32(cmd),
2232 	};
2233 
2234 	put_unaligned_le32(val, req.val);
2235 
2236 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2237 				 sizeof(req), false);
2238 }
2239 
2240 static int
2241 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2242 {
2243 #define RX_AIRTIME_FEATURE_CTRL		1
2244 #define RX_AIRTIME_BITWISE_CTRL		2
2245 #define RX_AIRTIME_CLEAR_EN	1
2246 	struct {
2247 		__le16 field;
2248 		__le16 sub_field;
2249 		__le32 set_status;
2250 		__le32 get_status;
2251 		u8 _rsv[12];
2252 
2253 		bool airtime_en;
2254 		bool mibtime_en;
2255 		bool earlyend_en;
2256 		u8 _rsv1[9];
2257 
2258 		bool airtime_clear;
2259 		bool mibtime_clear;
2260 		u8 _rsv2[98];
2261 	} __packed req = {
2262 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2263 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2264 		.airtime_clear = true,
2265 	};
2266 	int ret;
2267 
2268 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2269 				sizeof(req), true);
2270 	if (ret)
2271 		return ret;
2272 
2273 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2274 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2275 	req.airtime_en = true;
2276 
2277 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2278 				 sizeof(req), true);
2279 }
2280 
2281 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2282 {
2283 	int ret;
2284 
2285 	/* force firmware operation mode into normal state,
2286 	 * which should be set before firmware download stage.
2287 	 */
2288 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2289 
2290 	ret = mt7915_driver_own(dev, 0);
2291 	if (ret)
2292 		return ret;
2293 	/* set driver own for band1 when two hif exist */
2294 	if (dev->hif2) {
2295 		ret = mt7915_driver_own(dev, 1);
2296 		if (ret)
2297 			return ret;
2298 	}
2299 
2300 	ret = mt7915_load_firmware(dev);
2301 	if (ret)
2302 		return ret;
2303 
2304 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2305 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2306 	if (ret)
2307 		return ret;
2308 
2309 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2310 	if (ret)
2311 		return ret;
2312 
2313 	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(&dev->mt76))
2314 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2315 
2316 	ret = mt7915_mcu_set_mwds(dev, 1);
2317 	if (ret)
2318 		return ret;
2319 
2320 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2321 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2322 	if (ret)
2323 		return ret;
2324 
2325 	ret = mt7915_mcu_init_rx_airtime(dev);
2326 	if (ret)
2327 		return ret;
2328 
2329 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2330 				 MCU_WA_PARAM_RED, 0, 0);
2331 }
2332 
2333 int mt7915_mcu_init(struct mt7915_dev *dev)
2334 {
2335 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2336 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2337 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2338 		.mcu_parse_response = mt7915_mcu_parse_response,
2339 		.mcu_restart = mt76_connac_mcu_restart,
2340 	};
2341 
2342 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2343 
2344 	return mt7915_mcu_init_firmware(dev);
2345 }
2346 
2347 void mt7915_mcu_exit(struct mt7915_dev *dev)
2348 {
2349 	__mt76_mcu_restart(&dev->mt76);
2350 	if (mt7915_firmware_state(dev, false)) {
2351 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2352 		return;
2353 	}
2354 
2355 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2356 	if (dev->hif2)
2357 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2358 			MT_TOP_LPCR_HOST_FW_OWN);
2359 	skb_queue_purge(&dev->mt76.mcu.res_q);
2360 }
2361 
2362 static int
2363 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2364 {
2365 	struct {
2366 		u8 operation;
2367 		u8 count;
2368 		u8 _rsv[2];
2369 		u8 index;
2370 		u8 enable;
2371 		__le16 etype;
2372 	} req = {
2373 		.operation = 1,
2374 		.count = 1,
2375 		.enable = 1,
2376 		.etype = cpu_to_le16(ETH_P_PAE),
2377 	};
2378 
2379 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2380 				 &req, sizeof(req), false);
2381 }
2382 
2383 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2384 		       bool enable, bool hdr_trans)
2385 {
2386 	struct {
2387 		u8 operation;
2388 		u8 enable;
2389 		u8 check_bssid;
2390 		u8 insert_vlan;
2391 		u8 remove_vlan;
2392 		u8 tid;
2393 		u8 mode;
2394 		u8 rsv;
2395 	} __packed req_trans = {
2396 		.enable = hdr_trans,
2397 	};
2398 	struct {
2399 		u8 enable;
2400 		u8 band;
2401 		u8 rsv[2];
2402 	} __packed req_mac = {
2403 		.enable = enable,
2404 		.band = band,
2405 	};
2406 	int ret;
2407 
2408 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2409 				&req_trans, sizeof(req_trans), false);
2410 	if (ret)
2411 		return ret;
2412 
2413 	if (hdr_trans)
2414 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2415 
2416 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2417 				 &req_mac, sizeof(req_mac), true);
2418 }
2419 
2420 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2421 {
2422 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2423 	u8 num = req->total;
2424 	size_t len = sizeof(*req) -
2425 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2426 
2427 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2428 				 len, true);
2429 }
2430 
2431 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2432 {
2433 #define TX_CMD_MODE		1
2434 	struct mt7915_mcu_tx req = {
2435 		.valid = true,
2436 		.mode = TX_CMD_MODE,
2437 		.total = IEEE80211_NUM_ACS,
2438 	};
2439 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2440 	int ac;
2441 
2442 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2443 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2444 		struct edca *e = &req.edca[ac];
2445 
2446 		e->set = WMM_PARAM_SET;
2447 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2448 		e->aifs = q->aifs;
2449 		e->txop = cpu_to_le16(q->txop);
2450 
2451 		if (q->cw_min)
2452 			e->cw_min = fls(q->cw_min);
2453 		else
2454 			e->cw_min = 5;
2455 
2456 		if (q->cw_max)
2457 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2458 		else
2459 			e->cw_max = cpu_to_le16(10);
2460 	}
2461 
2462 	return mt7915_mcu_update_edca(dev, &req);
2463 }
2464 
2465 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2466 {
2467 	struct {
2468 		__le32 tag;
2469 		__le16 min_lpn;
2470 		u8 rsv[2];
2471 	} __packed req = {
2472 		.tag = cpu_to_le32(0x1),
2473 		.min_lpn = cpu_to_le16(val),
2474 	};
2475 
2476 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2477 				 sizeof(req), true);
2478 }
2479 
2480 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2481 			    const struct mt7915_dfs_pulse *pulse)
2482 {
2483 	struct {
2484 		__le32 tag;
2485 
2486 		__le32 max_width;		/* us */
2487 		__le32 max_pwr;			/* dbm */
2488 		__le32 min_pwr;			/* dbm */
2489 		__le32 min_stgr_pri;		/* us */
2490 		__le32 max_stgr_pri;		/* us */
2491 		__le32 min_cr_pri;		/* us */
2492 		__le32 max_cr_pri;		/* us */
2493 	} __packed req = {
2494 		.tag = cpu_to_le32(0x3),
2495 
2496 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2497 		__req_field(max_width),
2498 		__req_field(max_pwr),
2499 		__req_field(min_pwr),
2500 		__req_field(min_stgr_pri),
2501 		__req_field(max_stgr_pri),
2502 		__req_field(min_cr_pri),
2503 		__req_field(max_cr_pri),
2504 #undef __req_field
2505 	};
2506 
2507 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2508 				 sizeof(req), true);
2509 }
2510 
2511 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2512 			    const struct mt7915_dfs_pattern *pattern)
2513 {
2514 	struct {
2515 		__le32 tag;
2516 		__le16 radar_type;
2517 
2518 		u8 enb;
2519 		u8 stgr;
2520 		u8 min_crpn;
2521 		u8 max_crpn;
2522 		u8 min_crpr;
2523 		u8 min_pw;
2524 		__le32 min_pri;
2525 		__le32 max_pri;
2526 		u8 max_pw;
2527 		u8 min_crbn;
2528 		u8 max_crbn;
2529 		u8 min_stgpn;
2530 		u8 max_stgpn;
2531 		u8 min_stgpr;
2532 		u8 rsv[2];
2533 		__le32 min_stgpr_diff;
2534 	} __packed req = {
2535 		.tag = cpu_to_le32(0x2),
2536 		.radar_type = cpu_to_le16(index),
2537 
2538 #define __req_field_u8(field) .field = pattern->field
2539 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2540 		__req_field_u8(enb),
2541 		__req_field_u8(stgr),
2542 		__req_field_u8(min_crpn),
2543 		__req_field_u8(max_crpn),
2544 		__req_field_u8(min_crpr),
2545 		__req_field_u8(min_pw),
2546 		__req_field_u32(min_pri),
2547 		__req_field_u32(max_pri),
2548 		__req_field_u8(max_pw),
2549 		__req_field_u8(min_crbn),
2550 		__req_field_u8(max_crbn),
2551 		__req_field_u8(min_stgpn),
2552 		__req_field_u8(max_stgpn),
2553 		__req_field_u8(min_stgpr),
2554 		__req_field_u32(min_stgpr_diff),
2555 #undef __req_field_u8
2556 #undef __req_field_u32
2557 	};
2558 
2559 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2560 				 sizeof(req), true);
2561 }
2562 
2563 static int
2564 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2565 				 struct cfg80211_chan_def *chandef,
2566 				 int cmd)
2567 {
2568 	struct mt7915_dev *dev = phy->dev;
2569 	struct mt76_phy *mphy = phy->mt76;
2570 	struct ieee80211_channel *chan = mphy->chandef.chan;
2571 	int freq = mphy->chandef.center_freq1;
2572 	struct mt7915_mcu_background_chain_ctrl req = {
2573 		.monitor_scan_type = 2, /* simple rx */
2574 	};
2575 
2576 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2577 		return -EINVAL;
2578 
2579 	if (!cfg80211_chandef_valid(&mphy->chandef))
2580 		return -EINVAL;
2581 
2582 	switch (cmd) {
2583 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2584 		req.chan = chan->hw_value;
2585 		req.central_chan = ieee80211_frequency_to_channel(freq);
2586 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2587 		req.monitor_chan = chandef->chan->hw_value;
2588 		req.monitor_central_chan =
2589 			ieee80211_frequency_to_channel(chandef->center_freq1);
2590 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2591 		req.band_idx = phy->mt76->band_idx;
2592 		req.scan_mode = 1;
2593 		break;
2594 	}
2595 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2596 		req.monitor_chan = chandef->chan->hw_value;
2597 		req.monitor_central_chan =
2598 			ieee80211_frequency_to_channel(chandef->center_freq1);
2599 		req.band_idx = phy->mt76->band_idx;
2600 		req.scan_mode = 2;
2601 		break;
2602 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2603 		req.chan = chan->hw_value;
2604 		req.central_chan = ieee80211_frequency_to_channel(freq);
2605 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2606 		req.tx_stream = hweight8(mphy->antenna_mask);
2607 		req.rx_stream = mphy->antenna_mask;
2608 		break;
2609 	default:
2610 		return -EINVAL;
2611 	}
2612 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2613 
2614 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2615 				 &req, sizeof(req), false);
2616 }
2617 
2618 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2619 				     struct cfg80211_chan_def *chandef)
2620 {
2621 	struct mt7915_dev *dev = phy->dev;
2622 	int err, region;
2623 
2624 	if (!chandef) { /* disable offchain */
2625 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2626 					      0, 0);
2627 		if (err)
2628 			return err;
2629 
2630 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2631 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2632 	}
2633 
2634 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2635 					       CH_SWITCH_BACKGROUND_SCAN_START);
2636 	if (err)
2637 		return err;
2638 
2639 	switch (dev->mt76.region) {
2640 	case NL80211_DFS_ETSI:
2641 		region = 0;
2642 		break;
2643 	case NL80211_DFS_JP:
2644 		region = 2;
2645 		break;
2646 	case NL80211_DFS_FCC:
2647 	default:
2648 		region = 1;
2649 		break;
2650 	}
2651 
2652 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2653 				       0, region);
2654 }
2655 
2656 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2657 {
2658 	static const u8 ch_band[] = {
2659 		[NL80211_BAND_2GHZ] = 0,
2660 		[NL80211_BAND_5GHZ] = 1,
2661 		[NL80211_BAND_6GHZ] = 2,
2662 	};
2663 	struct mt7915_dev *dev = phy->dev;
2664 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2665 	int freq1 = chandef->center_freq1;
2666 	u8 band = phy->mt76->band_idx;
2667 	struct {
2668 		u8 control_ch;
2669 		u8 center_ch;
2670 		u8 bw;
2671 		u8 tx_path_num;
2672 		u8 rx_path;	/* mask or num */
2673 		u8 switch_reason;
2674 		u8 band_idx;
2675 		u8 center_ch2;	/* for 80+80 only */
2676 		__le16 cac_case;
2677 		u8 channel_band;
2678 		u8 rsv0;
2679 		__le32 outband_freq;
2680 		u8 txpower_drop;
2681 		u8 ap_bw;
2682 		u8 ap_center_ch;
2683 		u8 rsv1[57];
2684 	} __packed req = {
2685 		.control_ch = chandef->chan->hw_value,
2686 		.center_ch = ieee80211_frequency_to_channel(freq1),
2687 		.bw = mt76_connac_chan_bw(chandef),
2688 		.tx_path_num = hweight16(phy->mt76->chainmask),
2689 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2690 		.band_idx = band,
2691 		.channel_band = ch_band[chandef->chan->band],
2692 	};
2693 
2694 #ifdef CONFIG_NL80211_TESTMODE
2695 	if (phy->mt76->test.tx_antenna_mask &&
2696 	    mt76_testmode_enabled(phy->mt76)) {
2697 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2698 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2699 	}
2700 #endif
2701 
2702 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2703 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2704 
2705 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2706 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2707 		req.switch_reason = CH_SWITCH_NORMAL;
2708 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2709 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2710 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2711 					  NL80211_IFTYPE_AP))
2712 		req.switch_reason = CH_SWITCH_DFS;
2713 	else
2714 		req.switch_reason = CH_SWITCH_NORMAL;
2715 
2716 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2717 		req.rx_path = hweight8(req.rx_path);
2718 
2719 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2720 		int freq2 = chandef->center_freq2;
2721 
2722 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2723 	}
2724 
2725 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2726 }
2727 
2728 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2729 {
2730 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2731 #define PAGE_IDX_MASK		GENMASK(4, 2)
2732 #define PER_PAGE_SIZE		0x400
2733 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2734 	u16 eeprom_size = mt7915_eeprom_size(dev);
2735 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2736 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2737 	int eep_len;
2738 	int i;
2739 
2740 	for (i = 0; i < total; i++, eep += eep_len) {
2741 		struct sk_buff *skb;
2742 		int ret;
2743 
2744 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2745 			eep_len = eeprom_size % PER_PAGE_SIZE;
2746 		else
2747 			eep_len = PER_PAGE_SIZE;
2748 
2749 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2750 					 sizeof(req) + eep_len);
2751 		if (!skb)
2752 			return -ENOMEM;
2753 
2754 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2755 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2756 		req.len = cpu_to_le16(eep_len);
2757 
2758 		skb_put_data(skb, &req, sizeof(req));
2759 		skb_put_data(skb, eep, eep_len);
2760 
2761 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2762 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2763 		if (ret)
2764 			return ret;
2765 	}
2766 
2767 	return 0;
2768 }
2769 
2770 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2771 {
2772 	struct mt7915_mcu_eeprom req = {
2773 		.buffer_mode = EE_MODE_EFUSE,
2774 		.format = EE_FORMAT_WHOLE,
2775 	};
2776 
2777 	if (dev->flash_mode)
2778 		return mt7915_mcu_set_eeprom_flash(dev);
2779 
2780 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2781 				 &req, sizeof(req), true);
2782 }
2783 
2784 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2785 {
2786 	struct mt7915_mcu_eeprom_info req = {
2787 		.addr = cpu_to_le32(round_down(offset,
2788 				    MT7915_EEPROM_BLOCK_SIZE)),
2789 	};
2790 	struct mt7915_mcu_eeprom_info *res;
2791 	struct sk_buff *skb;
2792 	int ret;
2793 	u8 *buf;
2794 
2795 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
2796 				sizeof(req), true, &skb);
2797 	if (ret)
2798 		return ret;
2799 
2800 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2801 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2802 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2803 	dev_kfree_skb(skb);
2804 
2805 	return 0;
2806 }
2807 
2808 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2809 {
2810 	struct {
2811 		u8 _rsv;
2812 		u8 version;
2813 		u8 die_idx;
2814 		u8 _rsv2;
2815 	} __packed req = {
2816 		.version = 1,
2817 	};
2818 	struct sk_buff *skb;
2819 	int ret;
2820 
2821 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
2822 					sizeof(req), true, &skb);
2823 	if (ret)
2824 		return ret;
2825 
2826 	*block_num = *(u8 *)skb->data;
2827 	dev_kfree_skb(skb);
2828 
2829 	return 0;
2830 }
2831 
2832 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2833 				  u8 *data, u32 len, int cmd)
2834 {
2835 	struct {
2836 		u8 dir;
2837 		u8 valid;
2838 		__le16 bitmap;
2839 		s8 precal;
2840 		u8 action;
2841 		u8 band;
2842 		u8 idx;
2843 		u8 rsv[4];
2844 		__le32 len;
2845 	} req = {};
2846 	struct sk_buff *skb;
2847 
2848 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2849 	if (!skb)
2850 		return -ENOMEM;
2851 
2852 	req.idx = idx;
2853 	req.len = cpu_to_le32(len);
2854 	skb_put_data(skb, &req, sizeof(req));
2855 	skb_put_data(skb, data, len);
2856 
2857 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2858 }
2859 
2860 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2861 {
2862 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2863 	u32 total = MT_EE_CAL_GROUP_SIZE;
2864 
2865 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
2866 		return 0;
2867 
2868 	/*
2869 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2870 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2871 	 */
2872 	while (total > 0) {
2873 		int ret, len;
2874 
2875 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2876 
2877 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2878 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2879 		if (ret)
2880 			return ret;
2881 
2882 		total -= len;
2883 		cal += len;
2884 		idx++;
2885 	}
2886 
2887 	return 0;
2888 }
2889 
2890 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2891 {
2892 	int i;
2893 
2894 	for (i = 0; i < n_freqs; i++)
2895 		if (cur == freqs[i])
2896 			return i;
2897 
2898 	return -1;
2899 }
2900 
2901 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
2902 {
2903 	static const u16 freq_list[] = {
2904 		5180, 5200, 5220, 5240,
2905 		5260, 5280, 5300, 5320,
2906 		5500, 5520, 5540, 5560,
2907 		5580, 5600, 5620, 5640,
2908 		5660, 5680, 5700, 5745,
2909 		5765, 5785, 5805, 5825
2910 	};
2911 	int offset_2g = ARRAY_SIZE(freq_list);
2912 	int idx;
2913 
2914 	if (freq < 4000) {
2915 		if (freq < 2432)
2916 			return offset_2g;
2917 		if (freq < 2457)
2918 			return offset_2g + 1;
2919 
2920 		return offset_2g + 2;
2921 	}
2922 
2923 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
2924 		return -1;
2925 
2926 	if (bw != NL80211_CHAN_WIDTH_20) {
2927 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2928 					   freq + 10);
2929 		if (idx >= 0)
2930 			return idx;
2931 
2932 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2933 					   freq - 10);
2934 		if (idx >= 0)
2935 			return idx;
2936 	}
2937 
2938 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2939 }
2940 
2941 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
2942 {
2943 	struct mt7915_dev *dev = phy->dev;
2944 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2945 	u16 total = 2, center_freq = chandef->center_freq1;
2946 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2947 	int idx;
2948 
2949 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
2950 		return 0;
2951 
2952 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
2953 	if (idx < 0)
2954 		return -EINVAL;
2955 
2956 	/* Items: Tx DPD, Tx Flatness */
2957 	idx = idx * 2;
2958 	cal += MT_EE_CAL_GROUP_SIZE;
2959 
2960 	while (total--) {
2961 		int ret;
2962 
2963 		cal += (idx * MT_EE_CAL_UNIT);
2964 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
2965 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
2966 		if (ret)
2967 			return ret;
2968 
2969 		idx++;
2970 	}
2971 
2972 	return 0;
2973 }
2974 
2975 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
2976 {
2977 	/* strict order */
2978 	static const u32 offs[] = {
2979 		MIB_NON_WIFI_TIME,
2980 		MIB_TX_TIME,
2981 		MIB_RX_TIME,
2982 		MIB_OBSS_AIRTIME,
2983 		MIB_TXOP_INIT_COUNT,
2984 		/* v2 */
2985 		MIB_NON_WIFI_TIME_V2,
2986 		MIB_TX_TIME_V2,
2987 		MIB_RX_TIME_V2,
2988 		MIB_OBSS_AIRTIME_V2
2989 	};
2990 	struct mt76_channel_state *state = phy->mt76->chan_state;
2991 	struct mt76_channel_state *state_ts = &phy->state_ts;
2992 	struct mt7915_dev *dev = phy->dev;
2993 	struct mt7915_mcu_mib *res, req[5];
2994 	struct sk_buff *skb;
2995 	int i, ret, start = 0, ofs = 20;
2996 	u64 cc_tx;
2997 
2998 	if (!is_mt7915(&dev->mt76)) {
2999 		start = 5;
3000 		ofs = 0;
3001 	}
3002 
3003 	for (i = 0; i < 5; i++) {
3004 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
3005 		req[i].offs = cpu_to_le32(offs[i + start]);
3006 
3007 		if (!is_mt7915(&dev->mt76) && i == 3)
3008 			break;
3009 	}
3010 
3011 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3012 					req, sizeof(req), true, &skb);
3013 	if (ret)
3014 		return ret;
3015 
3016 	res = (struct mt7915_mcu_mib *)(skb->data + ofs);
3017 
3018 #define __res_u64(s) le64_to_cpu(res[s].data)
3019 	/* subtract Tx backoff time from Tx duration */
3020 	cc_tx = is_mt7915(&dev->mt76) ? __res_u64(1) - __res_u64(4) : __res_u64(1);
3021 
3022 	if (chan_switch)
3023 		goto out;
3024 
3025 	state->cc_tx += cc_tx - state_ts->cc_tx;
3026 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3027 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3028 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3029 			  state_ts->cc_busy;
3030 
3031 out:
3032 	state_ts->cc_tx = cc_tx;
3033 	state_ts->cc_bss_rx = __res_u64(2);
3034 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3035 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3036 #undef __res_u64
3037 
3038 	dev_kfree_skb(skb);
3039 
3040 	return 0;
3041 }
3042 
3043 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3044 {
3045 	struct mt7915_dev *dev = phy->dev;
3046 	struct {
3047 		u8 ctrl_id;
3048 		u8 action;
3049 		u8 band_idx;
3050 		u8 rsv[5];
3051 	} req = {
3052 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3053 		.band_idx = phy->mt76->band_idx,
3054 	};
3055 
3056 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3057 				 sizeof(req), true);
3058 }
3059 
3060 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3061 {
3062 	struct mt7915_dev *dev = phy->dev;
3063 	struct {
3064 		struct mt7915_mcu_thermal_ctrl ctrl;
3065 
3066 		__le32 trigger_temp;
3067 		__le32 restore_temp;
3068 		__le16 sustain_time;
3069 		u8 rsv[2];
3070 	} __packed req = {
3071 		.ctrl = {
3072 			.band_idx = phy->mt76->band_idx,
3073 		},
3074 	};
3075 	int level;
3076 
3077 	if (!state) {
3078 		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3079 		goto out;
3080 	}
3081 
3082 	/* set duty cycle and level */
3083 	for (level = 0; level < 4; level++) {
3084 		int ret;
3085 
3086 		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3087 		req.ctrl.duty.duty_level = level;
3088 		req.ctrl.duty.duty_cycle = state;
3089 		state /= 2;
3090 
3091 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3092 					&req, sizeof(req.ctrl), false);
3093 		if (ret)
3094 			return ret;
3095 	}
3096 
3097 	/* set high-temperature trigger threshold */
3098 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3099 	/* add a safety margin ~10 */
3100 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3101 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3102 	req.sustain_time = cpu_to_le16(10);
3103 
3104 out:
3105 	req.ctrl.type.protect_type = 1;
3106 	req.ctrl.type.trigger_type = 1;
3107 
3108 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3109 				 &req, sizeof(req), false);
3110 }
3111 
3112 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3113 {
3114 	struct mt7915_dev *dev = phy->dev;
3115 	struct {
3116 		u8 format_id;
3117 		u8 rsv;
3118 		u8 band_idx;
3119 		s8 txpower_min;
3120 	} __packed req = {
3121 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3122 		.band_idx = phy->mt76->band_idx,
3123 		.txpower_min = txpower * 2, /* 0.5db */
3124 	};
3125 
3126 	return mt76_mcu_send_msg(&dev->mt76,
3127 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3128 				 sizeof(req), true);
3129 }
3130 
3131 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3132 				 struct ieee80211_vif *vif,
3133 				 struct ieee80211_sta *sta, s8 txpower)
3134 {
3135 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3136 	struct mt7915_dev *dev = phy->dev;
3137 	struct mt76_phy *mphy = phy->mt76;
3138 	struct {
3139 		u8 format_id;
3140 		u8 rsv[3];
3141 		u8 band_idx;
3142 		s8 txpower_max;
3143 		__le16 wcid;
3144 		s8 txpower_offs[48];
3145 	} __packed req = {
3146 		.format_id = TX_POWER_LIMIT_FRAME,
3147 		.band_idx = phy->mt76->band_idx,
3148 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3149 		.wcid = cpu_to_le16(msta->wcid.idx),
3150 	};
3151 	int ret;
3152 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3153 
3154 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
3155 	if (ret)
3156 		return ret;
3157 
3158 	txpower = mt7915_get_power_bound(phy, txpower);
3159 	if (txpower > mphy->txpower_cur || txpower < 0)
3160 		return -EINVAL;
3161 
3162 	if (txpower) {
3163 		u32 offs, len, i;
3164 
3165 		if (sta->deflink.ht_cap.ht_supported) {
3166 			const u8 *sku_len = mt7915_sku_group_len;
3167 
3168 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3169 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3170 
3171 			if (sta->deflink.vht_cap.vht_supported) {
3172 				offs += len;
3173 				len = sku_len[SKU_VHT_BW20] * 4;
3174 
3175 				if (sta->deflink.he_cap.has_he) {
3176 					offs += len + sku_len[SKU_HE_RU26] * 3;
3177 					len = sku_len[SKU_HE_RU242] * 4;
3178 				}
3179 			}
3180 		} else {
3181 			return -EINVAL;
3182 		}
3183 
3184 		for (i = 0; i < len; i++, offs++)
3185 			req.txpower_offs[i] =
3186 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3187 	}
3188 
3189 	return mt76_mcu_send_msg(&dev->mt76,
3190 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3191 				 sizeof(req), true);
3192 }
3193 
3194 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3195 {
3196 	struct mt7915_dev *dev = phy->dev;
3197 	struct mt76_phy *mphy = phy->mt76;
3198 	struct ieee80211_hw *hw = mphy->hw;
3199 	struct mt7915_mcu_txpower_sku req = {
3200 		.format_id = TX_POWER_LIMIT_TABLE,
3201 		.band_idx = phy->mt76->band_idx,
3202 	};
3203 	struct mt76_power_limits limits_array;
3204 	s8 *la = (s8 *)&limits_array;
3205 	int i, idx;
3206 	int tx_power;
3207 
3208 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
3209 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3210 					      &limits_array, tx_power);
3211 	mphy->txpower_cur = tx_power;
3212 
3213 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3214 		u8 mcs_num, len = mt7915_sku_group_len[i];
3215 		int j;
3216 
3217 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3218 			mcs_num = 10;
3219 
3220 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3221 				la = (s8 *)&limits_array + 12;
3222 		} else {
3223 			mcs_num = len;
3224 		}
3225 
3226 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3227 			req.txpower_sku[idx + j] = la[j];
3228 
3229 		la += mcs_num;
3230 		idx += len;
3231 	}
3232 
3233 	return mt76_mcu_send_msg(&dev->mt76,
3234 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3235 				 sizeof(req), true);
3236 }
3237 
3238 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3239 {
3240 #define RATE_POWER_INFO	2
3241 	struct mt7915_dev *dev = phy->dev;
3242 	struct {
3243 		u8 format_id;
3244 		u8 category;
3245 		u8 band_idx;
3246 		u8 _rsv;
3247 	} __packed req = {
3248 		.format_id = TX_POWER_LIMIT_INFO,
3249 		.category = RATE_POWER_INFO,
3250 		.band_idx = phy->mt76->band_idx,
3251 	};
3252 	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
3253 	struct sk_buff *skb;
3254 	int ret, i;
3255 
3256 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3257 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3258 					&req, sizeof(req), true, &skb);
3259 	if (ret)
3260 		return ret;
3261 
3262 	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
3263 	for (i = 0; i < len; i++)
3264 		txpower[i] = txpower_sku[i][req.band_idx];
3265 
3266 	dev_kfree_skb(skb);
3267 
3268 	return 0;
3269 }
3270 
3271 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3272 			      u8 en)
3273 {
3274 	struct {
3275 		u8 test_mode_en;
3276 		u8 param_idx;
3277 		u8 _rsv[2];
3278 
3279 		u8 enable;
3280 		u8 _rsv2[3];
3281 
3282 		u8 pad[8];
3283 	} __packed req = {
3284 		.test_mode_en = test_mode,
3285 		.param_idx = param,
3286 		.enable = en,
3287 	};
3288 
3289 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3290 				 sizeof(req), false);
3291 }
3292 
3293 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3294 {
3295 	struct mt7915_dev *dev = phy->dev;
3296 	struct mt7915_sku {
3297 		u8 format_id;
3298 		u8 sku_enable;
3299 		u8 band_idx;
3300 		u8 rsv;
3301 	} __packed req = {
3302 		.format_id = TX_POWER_LIMIT_ENABLE,
3303 		.band_idx = phy->mt76->band_idx,
3304 		.sku_enable = enable,
3305 	};
3306 
3307 	return mt76_mcu_send_msg(&dev->mt76,
3308 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3309 				 sizeof(req), true);
3310 }
3311 
3312 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3313 {
3314 	struct {
3315 		u8 action;
3316 		u8 set;
3317 		u8 band;
3318 		u8 rsv;
3319 	} req = {
3320 		.action = action,
3321 		.set = set,
3322 		.band = band,
3323 	};
3324 
3325 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3326 				 &req, sizeof(req), false);
3327 }
3328 
3329 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3330 {
3331 	struct {
3332 		u8 action;
3333 		union {
3334 			struct {
3335 				u8 snd_mode;
3336 				u8 sta_num;
3337 				u8 rsv;
3338 				u8 wlan_idx[4];
3339 				__le32 snd_period;	/* ms */
3340 			} __packed snd;
3341 			struct {
3342 				bool ebf;
3343 				bool ibf;
3344 				u8 rsv;
3345 			} __packed type;
3346 			struct {
3347 				u8 bf_num;
3348 				u8 bf_bitmap;
3349 				u8 bf_sel[8];
3350 				u8 rsv[5];
3351 			} __packed mod;
3352 		};
3353 	} __packed req = {
3354 		.action = action,
3355 	};
3356 
3357 #define MT_BF_PROCESSING	4
3358 	switch (action) {
3359 	case MT_BF_SOUNDING_ON:
3360 		req.snd.snd_mode = MT_BF_PROCESSING;
3361 		break;
3362 	case MT_BF_TYPE_UPDATE:
3363 		req.type.ebf = true;
3364 		req.type.ibf = dev->ibf;
3365 		break;
3366 	case MT_BF_MODULE_UPDATE:
3367 		req.mod.bf_num = 2;
3368 		req.mod.bf_bitmap = GENMASK(1, 0);
3369 		break;
3370 	default:
3371 		return -EINVAL;
3372 	}
3373 
3374 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3375 				 sizeof(req), true);
3376 }
3377 
3378 static int
3379 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3380 {
3381 	struct mt7915_dev *dev = phy->dev;
3382 	struct mt7915_mcu_sr_ctrl req = {
3383 		.action = action,
3384 		.argnum = 1,
3385 		.band_idx = phy->mt76->band_idx,
3386 		.val = cpu_to_le32(val),
3387 	};
3388 
3389 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3390 				 sizeof(req), true);
3391 }
3392 
3393 static int
3394 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3395 			   struct ieee80211_he_obss_pd *he_obss_pd)
3396 {
3397 	struct mt7915_dev *dev = phy->dev;
3398 	struct {
3399 		struct mt7915_mcu_sr_ctrl ctrl;
3400 		struct {
3401 			u8 pd_th_non_srg;
3402 			u8 pd_th_srg;
3403 			u8 period_offs;
3404 			u8 rcpi_src;
3405 			__le16 obss_pd_min;
3406 			__le16 obss_pd_min_srg;
3407 			u8 resp_txpwr_mode;
3408 			u8 txpwr_restrict_mode;
3409 			u8 txpwr_ref;
3410 			u8 rsv[3];
3411 		} __packed param;
3412 	} __packed req = {
3413 		.ctrl = {
3414 			.action = SPR_SET_PARAM,
3415 			.argnum = 9,
3416 			.band_idx = phy->mt76->band_idx,
3417 		},
3418 	};
3419 	int ret;
3420 	u8 max_th = 82, non_srg_max_th = 62;
3421 
3422 	/* disable firmware dynamical PD asjustment */
3423 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3424 	if (ret)
3425 		return ret;
3426 
3427 	if (he_obss_pd->sr_ctrl &
3428 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3429 		req.param.pd_th_non_srg = max_th;
3430 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3431 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3432 	else
3433 		req.param.pd_th_non_srg  = non_srg_max_th;
3434 
3435 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3436 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3437 
3438 	req.param.obss_pd_min = cpu_to_le16(82);
3439 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3440 	req.param.txpwr_restrict_mode = 2;
3441 	req.param.txpwr_ref = 21;
3442 
3443 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3444 				 sizeof(req), true);
3445 }
3446 
3447 static int
3448 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3449 			     struct ieee80211_he_obss_pd *he_obss_pd)
3450 {
3451 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3452 	struct mt7915_dev *dev = phy->dev;
3453 	u8 omac = mvif->mt76.omac_idx;
3454 	struct {
3455 		struct mt7915_mcu_sr_ctrl ctrl;
3456 		struct {
3457 			u8 omac;
3458 			u8 rsv[3];
3459 			u8 flag[20];
3460 		} __packed siga;
3461 	} __packed req = {
3462 		.ctrl = {
3463 			.action = SPR_SET_SIGA,
3464 			.argnum = 1,
3465 			.band_idx = phy->mt76->band_idx,
3466 		},
3467 		.siga = {
3468 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3469 		},
3470 	};
3471 	int ret;
3472 
3473 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3474 		req.siga.flag[req.siga.omac] = 0xf;
3475 	else
3476 		return 0;
3477 
3478 	/* switch to normal AP mode */
3479 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3480 	if (ret)
3481 		return ret;
3482 
3483 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3484 				 sizeof(req), true);
3485 }
3486 
3487 static int
3488 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3489 			       struct ieee80211_he_obss_pd *he_obss_pd)
3490 {
3491 	struct mt7915_dev *dev = phy->dev;
3492 	struct {
3493 		struct mt7915_mcu_sr_ctrl ctrl;
3494 		struct {
3495 			__le32 color_l[2];
3496 			__le32 color_h[2];
3497 			__le32 bssid_l[2];
3498 			__le32 bssid_h[2];
3499 		} __packed bitmap;
3500 	} __packed req = {
3501 		.ctrl = {
3502 			.action = SPR_SET_SRG_BITMAP,
3503 			.argnum = 4,
3504 			.band_idx = phy->mt76->band_idx,
3505 		},
3506 	};
3507 	u32 bitmap;
3508 
3509 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3510 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3511 
3512 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3513 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3514 
3515 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3516 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3517 
3518 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3519 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3520 
3521 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3522 				 sizeof(req), true);
3523 }
3524 
3525 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3526 			    struct ieee80211_he_obss_pd *he_obss_pd)
3527 {
3528 	int ret;
3529 
3530 	/* enable firmware scene detection algorithms */
3531 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3532 	if (ret)
3533 		return ret;
3534 
3535 	/* firmware dynamically adjusts PD threshold so skip manual control */
3536 	if (sr_scene_detect && !he_obss_pd->enable)
3537 		return 0;
3538 
3539 	/* enable spatial reuse */
3540 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3541 	if (ret)
3542 		return ret;
3543 
3544 	if (sr_scene_detect || !he_obss_pd->enable)
3545 		return 0;
3546 
3547 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3548 	if (ret)
3549 		return ret;
3550 
3551 	/* set SRG/non-SRG OBSS PD threshold */
3552 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3553 	if (ret)
3554 		return ret;
3555 
3556 	/* Set SR prohibit */
3557 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3558 	if (ret)
3559 		return ret;
3560 
3561 	/* set SRG BSS color/BSSID bitmap */
3562 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3563 }
3564 
3565 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3566 			   struct ieee80211_sta *sta, struct rate_info *rate)
3567 {
3568 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3569 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3570 	struct mt7915_dev *dev = phy->dev;
3571 	struct mt76_phy *mphy = phy->mt76;
3572 	struct {
3573 		u8 category;
3574 		u8 band;
3575 		__le16 wcid;
3576 	} __packed req = {
3577 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3578 		.band = mvif->mt76.band_idx,
3579 		.wcid = cpu_to_le16(msta->wcid.idx),
3580 	};
3581 	struct ieee80211_supported_band *sband;
3582 	struct mt7915_mcu_phy_rx_info *res;
3583 	struct sk_buff *skb;
3584 	int ret;
3585 	bool cck = false;
3586 
3587 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3588 					&req, sizeof(req), true, &skb);
3589 	if (ret)
3590 		return ret;
3591 
3592 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3593 
3594 	rate->mcs = res->rate;
3595 	rate->nss = res->nsts + 1;
3596 
3597 	switch (res->mode) {
3598 	case MT_PHY_TYPE_CCK:
3599 		cck = true;
3600 		fallthrough;
3601 	case MT_PHY_TYPE_OFDM:
3602 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3603 			sband = &mphy->sband_5g.sband;
3604 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3605 			sband = &mphy->sband_6g.sband;
3606 		else
3607 			sband = &mphy->sband_2g.sband;
3608 
3609 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3610 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3611 		break;
3612 	case MT_PHY_TYPE_HT:
3613 	case MT_PHY_TYPE_HT_GF:
3614 		if (rate->mcs > 31) {
3615 			ret = -EINVAL;
3616 			goto out;
3617 		}
3618 
3619 		rate->flags = RATE_INFO_FLAGS_MCS;
3620 		if (res->gi)
3621 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3622 		break;
3623 	case MT_PHY_TYPE_VHT:
3624 		if (rate->mcs > 9) {
3625 			ret = -EINVAL;
3626 			goto out;
3627 		}
3628 
3629 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3630 		if (res->gi)
3631 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3632 		break;
3633 	case MT_PHY_TYPE_HE_SU:
3634 	case MT_PHY_TYPE_HE_EXT_SU:
3635 	case MT_PHY_TYPE_HE_TB:
3636 	case MT_PHY_TYPE_HE_MU:
3637 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3638 			ret = -EINVAL;
3639 			goto out;
3640 		}
3641 		rate->he_gi = res->gi;
3642 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3643 		break;
3644 	default:
3645 		ret = -EINVAL;
3646 		goto out;
3647 	}
3648 
3649 	switch (res->bw) {
3650 	case IEEE80211_STA_RX_BW_160:
3651 		rate->bw = RATE_INFO_BW_160;
3652 		break;
3653 	case IEEE80211_STA_RX_BW_80:
3654 		rate->bw = RATE_INFO_BW_80;
3655 		break;
3656 	case IEEE80211_STA_RX_BW_40:
3657 		rate->bw = RATE_INFO_BW_40;
3658 		break;
3659 	default:
3660 		rate->bw = RATE_INFO_BW_20;
3661 		break;
3662 	}
3663 
3664 out:
3665 	dev_kfree_skb(skb);
3666 
3667 	return ret;
3668 }
3669 
3670 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3671 				struct cfg80211_he_bss_color *he_bss_color)
3672 {
3673 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3674 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3675 	struct bss_info_color *bss_color;
3676 	struct sk_buff *skb;
3677 	struct tlv *tlv;
3678 
3679 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3680 					      NULL, len);
3681 	if (IS_ERR(skb))
3682 		return PTR_ERR(skb);
3683 
3684 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3685 				      sizeof(*bss_color));
3686 	bss_color = (struct bss_info_color *)tlv;
3687 	bss_color->disable = !he_bss_color->enabled;
3688 	bss_color->color = he_bss_color->color;
3689 
3690 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3691 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3692 }
3693 
3694 #define TWT_AGRT_TRIGGER	BIT(0)
3695 #define TWT_AGRT_ANNOUNCE	BIT(1)
3696 #define TWT_AGRT_PROTECT	BIT(2)
3697 
3698 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3699 			       struct mt7915_vif *mvif,
3700 			       struct mt7915_twt_flow *flow,
3701 			       int cmd)
3702 {
3703 	struct {
3704 		u8 tbl_idx;
3705 		u8 cmd;
3706 		u8 own_mac_idx;
3707 		u8 flowid; /* 0xff for group id */
3708 		__le16 peer_id; /* specify the peer_id (msb=0)
3709 				 * or group_id (msb=1)
3710 				 */
3711 		u8 duration; /* 256 us */
3712 		u8 bss_idx;
3713 		__le64 start_tsf;
3714 		__le16 mantissa;
3715 		u8 exponent;
3716 		u8 is_ap;
3717 		u8 agrt_params;
3718 		u8 rsv[23];
3719 	} __packed req = {
3720 		.tbl_idx = flow->table_id,
3721 		.cmd = cmd,
3722 		.own_mac_idx = mvif->mt76.omac_idx,
3723 		.flowid = flow->id,
3724 		.peer_id = cpu_to_le16(flow->wcid),
3725 		.duration = flow->duration,
3726 		.bss_idx = mvif->mt76.idx,
3727 		.start_tsf = cpu_to_le64(flow->tsf),
3728 		.mantissa = flow->mantissa,
3729 		.exponent = flow->exp,
3730 		.is_ap = true,
3731 	};
3732 
3733 	if (flow->protection)
3734 		req.agrt_params |= TWT_AGRT_PROTECT;
3735 	if (!flow->flowtype)
3736 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3737 	if (flow->trigger)
3738 		req.agrt_params |= TWT_AGRT_TRIGGER;
3739 
3740 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3741 				 &req, sizeof(req), true);
3742 }
3743 
3744 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3745 {
3746 	struct {
3747 		__le32 idx;
3748 		__le32 ofs;
3749 		__le32 data;
3750 	} __packed req = {
3751 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
3752 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
3753 		.data = set ? cpu_to_le32(*val) : 0,
3754 	};
3755 	struct sk_buff *skb;
3756 	int ret;
3757 
3758 	if (set)
3759 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3760 					 &req, sizeof(req), false);
3761 
3762 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3763 					&req, sizeof(req), true, &skb);
3764 	if (ret)
3765 		return ret;
3766 
3767 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3768 	dev_kfree_skb(skb);
3769 
3770 	return 0;
3771 }
3772