1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include <linux/fs.h>
6 #include "mt7915.h"
7 #include "mcu.h"
8 #include "mac.h"
9 #include "eeprom.h"
10 
11 struct mt7915_patch_hdr {
12 	char build_date[16];
13 	char platform[4];
14 	__be32 hw_sw_ver;
15 	__be32 patch_ver;
16 	__be16 checksum;
17 	u16 reserved;
18 	struct {
19 		__be32 patch_ver;
20 		__be32 subsys;
21 		__be32 feature;
22 		__be32 n_region;
23 		__be32 crc;
24 		u32 reserved[11];
25 	} desc;
26 } __packed;
27 
28 struct mt7915_patch_sec {
29 	__be32 type;
30 	__be32 offs;
31 	__be32 size;
32 	union {
33 		__be32 spec[13];
34 		struct {
35 			__be32 addr;
36 			__be32 len;
37 			__be32 sec_key_idx;
38 			__be32 align_len;
39 			u32 reserved[9];
40 		} info;
41 	};
42 } __packed;
43 
44 struct mt7915_fw_trailer {
45 	u8 chip_id;
46 	u8 eco_code;
47 	u8 n_region;
48 	u8 format_ver;
49 	u8 format_flag;
50 	u8 reserved[2];
51 	char fw_ver[10];
52 	char build_date[15];
53 	u32 crc;
54 } __packed;
55 
56 struct mt7915_fw_region {
57 	__le32 decomp_crc;
58 	__le32 decomp_len;
59 	__le32 decomp_blk_sz;
60 	u8 reserved[4];
61 	__le32 addr;
62 	__le32 len;
63 	u8 feature_set;
64 	u8 reserved1[15];
65 } __packed;
66 
67 #define fw_name(_dev, name, ...)	({			\
68 	char *_fw;						\
69 	switch (mt76_chip(&(_dev)->mt76)) {			\
70 	case 0x7915:						\
71 		_fw = MT7915_##name;				\
72 		break;						\
73 	case 0x7986:						\
74 		_fw = MT7986_##name##__VA_ARGS__;		\
75 		break;						\
76 	default:						\
77 		_fw = MT7916_##name;				\
78 		break;						\
79 	}							\
80 	_fw;							\
81 })
82 
83 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
84 					 fw_name(_dev, name) :			\
85 					 fw_name(_dev, name, _MT7975))
86 
87 #define MCU_PATCH_ADDRESS		0x200000
88 
89 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
90 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
91 
92 static u8
93 mt7915_mcu_get_sta_nss(u16 mcs_map)
94 {
95 	u8 nss;
96 
97 	for (nss = 8; nss > 0; nss--) {
98 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
99 
100 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
101 			break;
102 	}
103 
104 	return nss - 1;
105 }
106 
107 static void
108 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
109 			  u16 mcs_map)
110 {
111 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
112 	struct mt7915_dev *dev = msta->vif->phy->dev;
113 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
114 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
115 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
116 
117 	for (nss = 0; nss < max_nss; nss++) {
118 		int mcs;
119 
120 		switch ((mcs_map >> (2 * nss)) & 0x3) {
121 		case IEEE80211_HE_MCS_SUPPORT_0_11:
122 			mcs = GENMASK(11, 0);
123 			break;
124 		case IEEE80211_HE_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_HE_MCS_SUPPORT_0_7:
128 			mcs = GENMASK(7, 0);
129 			break;
130 		default:
131 			mcs = 0;
132 		}
133 
134 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
135 
136 		switch (mcs) {
137 		case 0 ... 7:
138 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
139 			break;
140 		case 8 ... 9:
141 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
142 			break;
143 		case 10 ... 11:
144 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
145 			break;
146 		default:
147 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
148 			break;
149 		}
150 		mcs_map &= ~(0x3 << (nss * 2));
151 		mcs_map |= mcs << (nss * 2);
152 
153 		/* only support 2ss on 160MHz for mt7915 */
154 		if (is_mt7915(&dev->mt76) && nss > 1 &&
155 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
156 			break;
157 	}
158 
159 	*he_mcs = cpu_to_le16(mcs_map);
160 }
161 
162 static void
163 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
164 			   const u16 *mask)
165 {
166 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
167 	struct mt7915_dev *dev = msta->vif->phy->dev;
168 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
169 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
170 	u16 mcs;
171 
172 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
173 		switch (mcs_map & 0x3) {
174 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
175 			mcs = GENMASK(9, 0);
176 			break;
177 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
178 			mcs = GENMASK(8, 0);
179 			break;
180 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
181 			mcs = GENMASK(7, 0);
182 			break;
183 		default:
184 			mcs = 0;
185 		}
186 
187 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
188 
189 		/* only support 2ss on 160MHz for mt7915 */
190 		if (is_mt7915(&dev->mt76) && nss > 1 &&
191 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
192 			break;
193 	}
194 }
195 
196 static void
197 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
198 			  const u8 *mask)
199 {
200 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
201 
202 	for (nss = 0; nss < max_nss; nss++)
203 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
204 }
205 
206 static int
207 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
208 			  struct sk_buff *skb, int seq)
209 {
210 	struct mt7915_mcu_rxd *rxd;
211 	int ret = 0;
212 
213 	if (!skb) {
214 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
215 			cmd, seq);
216 		return -ETIMEDOUT;
217 	}
218 
219 	rxd = (struct mt7915_mcu_rxd *)skb->data;
220 	if (seq != rxd->seq)
221 		return -EAGAIN;
222 
223 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
224 		skb_pull(skb, sizeof(*rxd) - 4);
225 		ret = *skb->data;
226 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
227 		skb_pull(skb, sizeof(*rxd) + 4);
228 		ret = le32_to_cpu(*(__le32 *)skb->data);
229 	} else {
230 		skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
231 	}
232 
233 	return ret;
234 }
235 
236 static int
237 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
238 			int cmd, int *wait_seq)
239 {
240 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
241 	struct mt7915_mcu_txd *mcu_txd;
242 	enum mt76_mcuq_id qid;
243 	__le32 *txd;
244 	u32 val;
245 	u8 seq;
246 
247 	/* TODO: make dynamic based on msg type */
248 	mdev->mcu.timeout = 20 * HZ;
249 
250 	seq = ++dev->mt76.mcu.msg_seq & 0xf;
251 	if (!seq)
252 		seq = ++dev->mt76.mcu.msg_seq & 0xf;
253 
254 	if (cmd == MCU_CMD(FW_SCATTER)) {
255 		qid = MT_MCUQ_FWDL;
256 		goto exit;
257 	}
258 
259 	mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
260 	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
261 		qid = MT_MCUQ_WA;
262 	else
263 		qid = MT_MCUQ_WM;
264 
265 	txd = mcu_txd->txd;
266 
267 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
268 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
269 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
270 	txd[0] = cpu_to_le32(val);
271 
272 	val = MT_TXD1_LONG_FORMAT |
273 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
274 	txd[1] = cpu_to_le32(val);
275 
276 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
277 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
278 					       MT_TX_MCU_PORT_RX_Q0));
279 	mcu_txd->pkt_type = MCU_PKT_ID;
280 	mcu_txd->seq = seq;
281 
282 	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
283 	mcu_txd->set_query = MCU_Q_NA;
284 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
285 	if (mcu_txd->ext_cid) {
286 		mcu_txd->ext_cid_ack = 1;
287 
288 		/* do not use Q_SET for efuse */
289 		if (cmd & __MCU_CMD_FIELD_QUERY)
290 			mcu_txd->set_query = MCU_Q_QUERY;
291 		else
292 			mcu_txd->set_query = MCU_Q_SET;
293 	}
294 
295 	if (cmd & __MCU_CMD_FIELD_WA)
296 		mcu_txd->s2d_index = MCU_S2D_H2C;
297 	else
298 		mcu_txd->s2d_index = MCU_S2D_H2N;
299 
300 exit:
301 	if (wait_seq)
302 		*wait_seq = seq;
303 
304 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
305 }
306 
307 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
308 {
309 	struct {
310 		__le32 args[3];
311 	} req = {
312 		.args = {
313 			cpu_to_le32(a1),
314 			cpu_to_le32(a2),
315 			cpu_to_le32(a3),
316 		},
317 	};
318 
319 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
320 }
321 
322 static void
323 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
324 {
325 	if (vif->csa_active)
326 		ieee80211_csa_finish(vif);
327 }
328 
329 static void
330 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
331 {
332 	struct mt76_phy *mphy = &dev->mt76.phy;
333 	struct mt7915_mcu_csa_notify *c;
334 
335 	c = (struct mt7915_mcu_csa_notify *)skb->data;
336 
337 	if ((c->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
338 		mphy = dev->mt76.phy2;
339 
340 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
341 			IEEE80211_IFACE_ITER_RESUME_ALL,
342 			mt7915_mcu_csa_finish, mphy->hw);
343 }
344 
345 static void
346 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
347 {
348 	struct mt76_phy *mphy = &dev->mt76.phy;
349 	struct mt7915_mcu_thermal_notify *t;
350 	struct mt7915_phy *phy;
351 
352 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
353 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
354 		return;
355 
356 	if ((t->ctrl.band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
357 		mphy = dev->mt76.phy2;
358 
359 	phy = (struct mt7915_phy *)mphy->priv;
360 	phy->throttle_state = t->ctrl.duty.duty_cycle;
361 }
362 
363 static void
364 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
365 {
366 	struct mt76_phy *mphy = &dev->mt76.phy;
367 	struct mt7915_mcu_rdd_report *r;
368 
369 	r = (struct mt7915_mcu_rdd_report *)skb->data;
370 
371 	if ((r->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
372 		mphy = dev->mt76.phy2;
373 
374 	if (r->band_idx == MT_RX_SEL2)
375 		cfg80211_background_radar_event(mphy->hw->wiphy,
376 						&dev->rdd2_chandef,
377 						GFP_ATOMIC);
378 	else
379 		ieee80211_radar_detected(mphy->hw);
380 	dev->hw_pattern++;
381 }
382 
383 static void
384 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
385 {
386 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
387 	const char *data = (char *)&rxd[1];
388 	const char *type;
389 	int len = skb->len - sizeof(*rxd);
390 
391 	switch (rxd->s2d_index) {
392 	case 0:
393 		if (mt7915_debugfs_rx_log(dev, data, len))
394 			return;
395 
396 		type = "WM";
397 		break;
398 	case 2:
399 		type = "WA";
400 		break;
401 	default:
402 		type = "unknown";
403 		break;
404 	}
405 
406 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
407 }
408 
409 static void
410 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
411 {
412 	if (!vif->color_change_active)
413 		return;
414 
415 	ieee80211_color_change_finish(vif);
416 }
417 
418 static void
419 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
420 {
421 	struct mt76_phy *mphy = &dev->mt76.phy;
422 	struct mt7915_mcu_bcc_notify *b;
423 
424 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
425 
426 	if ((b->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
427 		mphy = dev->mt76.phy2;
428 
429 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
430 			IEEE80211_IFACE_ITER_RESUME_ALL,
431 			mt7915_mcu_cca_finish, mphy->hw);
432 }
433 
434 static void
435 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
436 {
437 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
438 
439 	switch (rxd->ext_eid) {
440 	case MCU_EXT_EVENT_THERMAL_PROTECT:
441 		mt7915_mcu_rx_thermal_notify(dev, skb);
442 		break;
443 	case MCU_EXT_EVENT_RDD_REPORT:
444 		mt7915_mcu_rx_radar_detected(dev, skb);
445 		break;
446 	case MCU_EXT_EVENT_CSA_NOTIFY:
447 		mt7915_mcu_rx_csa_notify(dev, skb);
448 		break;
449 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
450 		mt7915_mcu_rx_log_message(dev, skb);
451 		break;
452 	case MCU_EXT_EVENT_BCC_NOTIFY:
453 		mt7915_mcu_rx_bcc_notify(dev, skb);
454 		break;
455 	default:
456 		break;
457 	}
458 }
459 
460 static void
461 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
462 {
463 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
464 
465 	switch (rxd->eid) {
466 	case MCU_EVENT_EXT:
467 		mt7915_mcu_rx_ext_event(dev, skb);
468 		break;
469 	default:
470 		break;
471 	}
472 	dev_kfree_skb(skb);
473 }
474 
475 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
476 {
477 	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
478 
479 	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
480 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
481 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
482 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
483 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
484 	    !rxd->seq)
485 		mt7915_mcu_rx_unsolicited_event(dev, skb);
486 	else
487 		mt76_mcu_rx_event(&dev->mt76, skb);
488 }
489 
490 static struct tlv *
491 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
492 			     __le16 *sub_ntlv, __le16 *len)
493 {
494 	struct tlv *ptlv, tlv = {
495 		.tag = cpu_to_le16(sub_tag),
496 		.len = cpu_to_le16(sub_len),
497 	};
498 
499 	ptlv = skb_put(skb, sub_len);
500 	memcpy(ptlv, &tlv, sizeof(tlv));
501 
502 	le16_add_cpu(sub_ntlv, 1);
503 	le16_add_cpu(len, sub_len);
504 
505 	return ptlv;
506 }
507 
508 /** bss info **/
509 struct mt7915_he_obss_narrow_bw_ru_data {
510 	bool tolerated;
511 };
512 
513 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
514 						   struct cfg80211_bss *bss,
515 						   void *_data)
516 {
517 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
518 	const struct element *elem;
519 
520 	rcu_read_lock();
521 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
522 
523 	if (!elem || elem->datalen <= 10 ||
524 	    !(elem->data[10] &
525 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
526 		data->tolerated = false;
527 
528 	rcu_read_unlock();
529 }
530 
531 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
532 					      struct ieee80211_vif *vif)
533 {
534 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
535 		.tolerated = true,
536 	};
537 
538 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
539 		return false;
540 
541 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
542 			  mt7915_check_he_obss_narrow_bw_ru_iter,
543 			  &iter_data);
544 
545 	/*
546 	 * If there is at least one AP on radar channel that cannot
547 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
548 	 */
549 	return !iter_data.tolerated;
550 }
551 
552 static void
553 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
554 			struct mt7915_phy *phy)
555 {
556 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
557 	struct bss_info_rf_ch *ch;
558 	struct tlv *tlv;
559 	int freq1 = chandef->center_freq1;
560 
561 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
562 
563 	ch = (struct bss_info_rf_ch *)tlv;
564 	ch->pri_ch = chandef->chan->hw_value;
565 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
566 	ch->bw = mt76_connac_chan_bw(chandef);
567 
568 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
569 		int freq2 = chandef->center_freq2;
570 
571 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
572 	}
573 
574 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
575 		struct mt76_phy *mphy = phy->mt76;
576 
577 		ch->he_ru26_block =
578 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
579 		ch->he_all_disable = false;
580 	} else {
581 		ch->he_all_disable = true;
582 	}
583 }
584 
585 static void
586 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
587 		      struct mt7915_phy *phy)
588 {
589 	int max_nss = hweight8(phy->mt76->chainmask);
590 	struct bss_info_ra *ra;
591 	struct tlv *tlv;
592 
593 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
594 
595 	ra = (struct bss_info_ra *)tlv;
596 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
597 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
598 	ra->short_preamble = true;
599 	ra->tx_streams = max_nss;
600 	ra->rx_streams = max_nss;
601 	ra->algo = 4;
602 	ra->train_up_rule = 2;
603 	ra->train_up_high_thres = 110;
604 	ra->train_up_rule_rssi = -70;
605 	ra->low_traffic_thres = 2;
606 	ra->phy_cap = cpu_to_le32(0xfdf);
607 	ra->interval = cpu_to_le32(500);
608 	ra->fast_interval = cpu_to_le32(100);
609 }
610 
611 static void
612 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
613 		      struct mt7915_phy *phy)
614 {
615 #define DEFAULT_HE_PE_DURATION		4
616 #define DEFAULT_HE_DURATION_RTS_THRES	1023
617 	const struct ieee80211_sta_he_cap *cap;
618 	struct bss_info_he *he;
619 	struct tlv *tlv;
620 
621 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
622 
623 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
624 
625 	he = (struct bss_info_he *)tlv;
626 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
627 	if (!he->he_pe_duration)
628 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
629 
630 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
631 	if (!he->he_rts_thres)
632 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
633 
634 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
635 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
636 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
637 }
638 
639 static void
640 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
641 {
642 #define TXD_CMP_MAP1		GENMASK(15, 0)
643 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
644 	struct bss_info_hw_amsdu *amsdu;
645 	struct tlv *tlv;
646 
647 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
648 
649 	amsdu = (struct bss_info_hw_amsdu *)tlv;
650 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
651 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
652 	amsdu->trig_thres = cpu_to_le16(2);
653 	amsdu->enable = true;
654 }
655 
656 static void
657 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
658 {
659 	struct bss_info_bmc_rate *bmc;
660 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
661 	enum nl80211_band band = chandef->chan->band;
662 	struct tlv *tlv;
663 
664 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
665 
666 	bmc = (struct bss_info_bmc_rate *)tlv;
667 	if (band == NL80211_BAND_2GHZ) {
668 		bmc->short_preamble = true;
669 	} else {
670 		bmc->bc_trans = cpu_to_le16(0x2000);
671 		bmc->mc_trans = cpu_to_le16(0x2080);
672 	}
673 }
674 
675 static int
676 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
677 		       bool bssid, bool enable)
678 {
679 	struct mt7915_dev *dev = phy->dev;
680 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
681 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
682 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
683 	const u8 *addr = vif->addr;
684 	struct {
685 		u8 mode;
686 		u8 force_clear;
687 		u8 clear_bitmap[8];
688 		u8 entry_count;
689 		u8 write;
690 		u8 band;
691 
692 		u8 index;
693 		u8 bssid;
694 		u8 addr[ETH_ALEN];
695 	} __packed req = {
696 		.mode = !!mask || enable,
697 		.entry_count = 1,
698 		.write = 1,
699 		.band = phy != &dev->phy,
700 		.index = idx * 2 + bssid,
701 	};
702 
703 	if (bssid)
704 		addr = vif->bss_conf.bssid;
705 
706 	if (enable)
707 		ether_addr_copy(req.addr, addr);
708 
709 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
710 				 sizeof(req), true);
711 }
712 
713 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
714 			    struct ieee80211_vif *vif, int enable)
715 {
716 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
717 	struct mt7915_dev *dev = phy->dev;
718 	struct sk_buff *skb;
719 
720 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
721 		mt7915_mcu_muar_config(phy, vif, false, enable);
722 		mt7915_mcu_muar_config(phy, vif, true, enable);
723 	}
724 
725 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
726 					      MT7915_BSS_UPDATE_MAX_SIZE);
727 	if (IS_ERR(skb))
728 		return PTR_ERR(skb);
729 
730 	/* bss_omac must be first */
731 	if (enable)
732 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
733 
734 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
735 				      mvif->sta.wcid.idx, enable);
736 
737 	if (vif->type == NL80211_IFTYPE_MONITOR)
738 		goto out;
739 
740 	if (enable) {
741 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
742 		mt7915_mcu_bss_bmc_tlv(skb, phy);
743 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
744 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
745 
746 		if (vif->bss_conf.he_support)
747 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
748 
749 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
750 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
751 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
752 	}
753 out:
754 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
755 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
756 }
757 
758 /** starec & wtbl **/
759 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
760 			 struct ieee80211_ampdu_params *params,
761 			 bool enable)
762 {
763 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
764 	struct mt7915_vif *mvif = msta->vif;
765 
766 	if (enable && !params->amsdu)
767 		msta->wcid.amsdu = false;
768 
769 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
770 				      MCU_EXT_CMD(STA_REC_UPDATE),
771 				      enable, true);
772 }
773 
774 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
775 			 struct ieee80211_ampdu_params *params,
776 			 bool enable)
777 {
778 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
779 	struct mt7915_vif *mvif = msta->vif;
780 
781 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
782 				      MCU_EXT_CMD(STA_REC_UPDATE),
783 				      enable, false);
784 }
785 
786 static void
787 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
788 		      struct ieee80211_vif *vif)
789 {
790 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
791 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
792 	struct ieee80211_he_mcs_nss_supp mcs_map;
793 	struct sta_rec_he *he;
794 	struct tlv *tlv;
795 	u32 cap = 0;
796 
797 	if (!sta->deflink.he_cap.has_he)
798 		return;
799 
800 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
801 
802 	he = (struct sta_rec_he *)tlv;
803 
804 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
805 		cap |= STA_REC_HE_CAP_HTC;
806 
807 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
808 		cap |= STA_REC_HE_CAP_BSR;
809 
810 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
811 		cap |= STA_REC_HE_CAP_OM;
812 
813 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
814 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
815 
816 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
817 		cap |= STA_REC_HE_CAP_BQR;
818 
819 	if (elem->phy_cap_info[0] &
820 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
821 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
822 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
823 
824 	if (mvif->cap.he_ldpc &&
825 	    (elem->phy_cap_info[1] &
826 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
827 		cap |= STA_REC_HE_CAP_LDPC;
828 
829 	if (elem->phy_cap_info[1] &
830 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
831 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
832 
833 	if (elem->phy_cap_info[2] &
834 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
835 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
836 
837 	if (elem->phy_cap_info[2] &
838 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
839 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
840 
841 	if (elem->phy_cap_info[2] &
842 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
843 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
844 
845 	if (elem->phy_cap_info[6] &
846 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
847 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
848 
849 	if (elem->phy_cap_info[6] &
850 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
851 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
852 
853 	if (elem->phy_cap_info[7] &
854 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
855 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
856 
857 	if (elem->phy_cap_info[7] &
858 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
859 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
860 
861 	if (elem->phy_cap_info[7] &
862 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
863 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
864 
865 	if (elem->phy_cap_info[8] &
866 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
867 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
868 
869 	if (elem->phy_cap_info[8] &
870 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
871 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
872 
873 	if (elem->phy_cap_info[9] &
874 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
875 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
876 
877 	if (elem->phy_cap_info[9] &
878 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
879 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
880 
881 	he->he_cap = cpu_to_le32(cap);
882 
883 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
884 	switch (sta->deflink.bandwidth) {
885 	case IEEE80211_STA_RX_BW_160:
886 		if (elem->phy_cap_info[0] &
887 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
888 			mt7915_mcu_set_sta_he_mcs(sta,
889 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
890 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
891 
892 		mt7915_mcu_set_sta_he_mcs(sta,
893 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
894 					  le16_to_cpu(mcs_map.rx_mcs_160));
895 		fallthrough;
896 	default:
897 		mt7915_mcu_set_sta_he_mcs(sta,
898 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
899 					  le16_to_cpu(mcs_map.rx_mcs_80));
900 		break;
901 	}
902 
903 	he->t_frame_dur =
904 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
905 	he->max_ampdu_exp =
906 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
907 
908 	he->bw_set =
909 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
910 	he->device_class =
911 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
912 	he->punc_pream_rx =
913 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
914 
915 	he->dcm_tx_mode =
916 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
917 	he->dcm_tx_max_nss =
918 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
919 	he->dcm_rx_mode =
920 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
921 	he->dcm_rx_max_nss =
922 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
923 	he->dcm_rx_max_nss =
924 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
925 
926 	he->pkt_ext = 2;
927 }
928 
929 static void
930 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
931 			struct ieee80211_vif *vif)
932 {
933 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
934 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
935 	struct sta_rec_muru *muru;
936 	struct tlv *tlv;
937 
938 	if (vif->type != NL80211_IFTYPE_STATION &&
939 	    vif->type != NL80211_IFTYPE_AP)
940 		return;
941 
942 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
943 
944 	muru = (struct sta_rec_muru *)tlv;
945 
946 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
947 			       mvif->cap.vht_mu_ebfer ||
948 			       mvif->cap.vht_mu_ebfee;
949 	muru->cfg.mimo_ul_en = true;
950 	muru->cfg.ofdma_dl_en = true;
951 
952 	if (sta->deflink.vht_cap.vht_supported)
953 		muru->mimo_dl.vht_mu_bfee =
954 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
955 
956 	if (!sta->deflink.he_cap.has_he)
957 		return;
958 
959 	muru->mimo_dl.partial_bw_dl_mimo =
960 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
961 
962 	muru->mimo_ul.full_ul_mimo =
963 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
964 	muru->mimo_ul.partial_ul_mimo =
965 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
966 
967 	muru->ofdma_dl.punc_pream_rx =
968 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
969 	muru->ofdma_dl.he_20m_in_40m_2g =
970 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
971 	muru->ofdma_dl.he_20m_in_160m =
972 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
973 	muru->ofdma_dl.he_80m_in_160m =
974 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
975 
976 	muru->ofdma_ul.t_frame_dur =
977 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
978 	muru->ofdma_ul.mu_cascading =
979 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
980 	muru->ofdma_ul.uo_ra =
981 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
982 }
983 
984 static void
985 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
986 {
987 	struct sta_rec_ht *ht;
988 	struct tlv *tlv;
989 
990 	if (!sta->deflink.ht_cap.ht_supported)
991 		return;
992 
993 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
994 
995 	ht = (struct sta_rec_ht *)tlv;
996 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
997 }
998 
999 static void
1000 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1001 {
1002 	struct sta_rec_vht *vht;
1003 	struct tlv *tlv;
1004 
1005 	if (!sta->deflink.vht_cap.vht_supported)
1006 		return;
1007 
1008 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1009 
1010 	vht = (struct sta_rec_vht *)tlv;
1011 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
1012 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
1013 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
1014 }
1015 
1016 static void
1017 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1018 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1019 {
1020 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1021 	struct sta_rec_amsdu *amsdu;
1022 	struct tlv *tlv;
1023 
1024 	if (vif->type != NL80211_IFTYPE_STATION &&
1025 	    vif->type != NL80211_IFTYPE_AP)
1026 		return;
1027 
1028 	if (!sta->max_amsdu_len)
1029 	    return;
1030 
1031 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1032 	amsdu = (struct sta_rec_amsdu *)tlv;
1033 	amsdu->max_amsdu_num = 8;
1034 	amsdu->amsdu_en = true;
1035 	msta->wcid.amsdu = true;
1036 
1037 	switch (sta->max_amsdu_len) {
1038 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1039 		if (!is_mt7915(&dev->mt76)) {
1040 			amsdu->max_mpdu_size =
1041 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1042 			return;
1043 		}
1044 		fallthrough;
1045 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1046 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1047 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1048 		return;
1049 	default:
1050 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1051 		return;
1052 	}
1053 }
1054 
1055 static int
1056 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1057 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1058 {
1059 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1060 	struct mt7915_sta *msta;
1061 	struct wtbl_req_hdr *wtbl_hdr;
1062 	struct mt76_wcid *wcid;
1063 	struct tlv *tlv;
1064 
1065 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1066 	wcid = sta ? &msta->wcid : NULL;
1067 
1068 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1069 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1070 						  WTBL_RESET_AND_SET, tlv,
1071 						  &skb);
1072 	if (IS_ERR(wtbl_hdr))
1073 		return PTR_ERR(wtbl_hdr);
1074 
1075 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1076 					 wtbl_hdr);
1077 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1078 	if (sta)
1079 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1080 					    wtbl_hdr, mvif->cap.ht_ldpc,
1081 					    mvif->cap.vht_ldpc);
1082 
1083 	return 0;
1084 }
1085 
1086 static inline bool
1087 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1088 			struct ieee80211_sta *sta, bool bfee)
1089 {
1090 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1091 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1092 
1093 	if (vif->type != NL80211_IFTYPE_STATION &&
1094 	    vif->type != NL80211_IFTYPE_AP)
1095 		return false;
1096 
1097 	if (!bfee && tx_ant < 2)
1098 		return false;
1099 
1100 	if (sta->deflink.he_cap.has_he) {
1101 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1102 
1103 		if (bfee)
1104 			return mvif->cap.he_su_ebfee &&
1105 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1106 		else
1107 			return mvif->cap.he_su_ebfer &&
1108 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1109 	}
1110 
1111 	if (sta->deflink.vht_cap.vht_supported) {
1112 		u32 cap = sta->deflink.vht_cap.cap;
1113 
1114 		if (bfee)
1115 			return mvif->cap.vht_su_ebfee &&
1116 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1117 		else
1118 			return mvif->cap.vht_su_ebfer &&
1119 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1120 	}
1121 
1122 	return false;
1123 }
1124 
1125 static void
1126 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1127 {
1128 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1129 	bf->ndp_rate = 0;				/* mcs0 */
1130 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1131 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1132 }
1133 
1134 static void
1135 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1136 		       struct sta_rec_bf *bf)
1137 {
1138 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1139 	u8 n = 0;
1140 
1141 	bf->tx_mode = MT_PHY_TYPE_HT;
1142 
1143 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1144 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1145 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1146 			      mcs->tx_params);
1147 	else if (mcs->rx_mask[3])
1148 		n = 3;
1149 	else if (mcs->rx_mask[2])
1150 		n = 2;
1151 	else if (mcs->rx_mask[1])
1152 		n = 1;
1153 
1154 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1155 	bf->ncol = min_t(u8, bf->nrow, n);
1156 	bf->ibf_ncol = n;
1157 }
1158 
1159 static void
1160 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1161 			struct sta_rec_bf *bf, bool explicit)
1162 {
1163 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1164 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1165 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1166 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1167 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1168 
1169 	bf->tx_mode = MT_PHY_TYPE_VHT;
1170 
1171 	if (explicit) {
1172 		u8 sts, snd_dim;
1173 
1174 		mt7915_mcu_sta_sounding_rate(bf);
1175 
1176 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1177 				pc->cap);
1178 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1179 				    vc->cap);
1180 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1181 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1182 		bf->ibf_ncol = bf->ncol;
1183 
1184 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1185 			bf->nrow = 1;
1186 	} else {
1187 		bf->nrow = tx_ant;
1188 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1189 		bf->ibf_ncol = nss_mcs;
1190 
1191 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1192 			bf->ibf_nrow = 1;
1193 	}
1194 }
1195 
1196 static void
1197 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1198 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1199 {
1200 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1201 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1202 	const struct ieee80211_sta_he_cap *vc =
1203 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1204 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1205 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1206 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1207 	u8 snd_dim, sts;
1208 
1209 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1210 
1211 	mt7915_mcu_sta_sounding_rate(bf);
1212 
1213 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1214 				pe->phy_cap_info[6]);
1215 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1216 				pe->phy_cap_info[6]);
1217 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1218 			 ve->phy_cap_info[5]);
1219 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1220 		     pe->phy_cap_info[4]);
1221 	bf->nrow = min_t(u8, snd_dim, sts);
1222 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1223 	bf->ibf_ncol = bf->ncol;
1224 
1225 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1226 		return;
1227 
1228 	/* go over for 160MHz and 80p80 */
1229 	if (pe->phy_cap_info[0] &
1230 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1231 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1232 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1233 
1234 		bf->ncol_bw160 = nss_mcs;
1235 	}
1236 
1237 	if (pe->phy_cap_info[0] &
1238 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1239 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1240 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1241 
1242 		if (bf->ncol_bw160)
1243 			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1244 		else
1245 			bf->ncol_bw160 = nss_mcs;
1246 	}
1247 
1248 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1249 			 ve->phy_cap_info[5]);
1250 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1251 		     pe->phy_cap_info[4]);
1252 
1253 	bf->nrow_bw160 = min_t(int, snd_dim, sts);
1254 }
1255 
1256 static void
1257 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1258 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1259 {
1260 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1261 	struct mt7915_phy *phy = mvif->phy;
1262 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1263 	struct sta_rec_bf *bf;
1264 	struct tlv *tlv;
1265 	const u8 matrix[4][4] = {
1266 		{0, 0, 0, 0},
1267 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1268 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1269 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1270 	};
1271 	bool ebf;
1272 
1273 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1274 		return;
1275 
1276 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1277 	if (!ebf && !dev->ibf)
1278 		return;
1279 
1280 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1281 	bf = (struct sta_rec_bf *)tlv;
1282 
1283 	/* he: eBF only, in accordance with spec
1284 	 * vht: support eBF and iBF
1285 	 * ht: iBF only, since mac80211 lacks of eBF support
1286 	 */
1287 	if (sta->deflink.he_cap.has_he && ebf)
1288 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1289 	else if (sta->deflink.vht_cap.vht_supported)
1290 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1291 	else if (sta->deflink.ht_cap.ht_supported)
1292 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1293 	else
1294 		return;
1295 
1296 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1297 	bf->bw = sta->deflink.bandwidth;
1298 	bf->ibf_dbw = sta->deflink.bandwidth;
1299 	bf->ibf_nrow = tx_ant;
1300 
1301 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1302 		bf->ibf_timeout = 0x48;
1303 	else
1304 		bf->ibf_timeout = 0x18;
1305 
1306 	if (ebf && bf->nrow != tx_ant)
1307 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1308 	else
1309 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1310 
1311 	switch (sta->deflink.bandwidth) {
1312 	case IEEE80211_STA_RX_BW_160:
1313 	case IEEE80211_STA_RX_BW_80:
1314 		bf->mem_total = bf->mem_20m * 2;
1315 		break;
1316 	case IEEE80211_STA_RX_BW_40:
1317 		bf->mem_total = bf->mem_20m;
1318 		break;
1319 	case IEEE80211_STA_RX_BW_20:
1320 	default:
1321 		break;
1322 	}
1323 }
1324 
1325 static void
1326 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1327 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1328 {
1329 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1330 	struct mt7915_phy *phy = mvif->phy;
1331 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1332 	struct sta_rec_bfee *bfee;
1333 	struct tlv *tlv;
1334 	u8 nrow = 0;
1335 
1336 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1337 		return;
1338 
1339 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1340 		return;
1341 
1342 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1343 	bfee = (struct sta_rec_bfee *)tlv;
1344 
1345 	if (sta->deflink.he_cap.has_he) {
1346 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1347 
1348 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1349 			      pe->phy_cap_info[5]);
1350 	} else if (sta->deflink.vht_cap.vht_supported) {
1351 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1352 
1353 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1354 				 pc->cap);
1355 	}
1356 
1357 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1358 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1359 }
1360 
1361 static enum mcu_mmps_mode
1362 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1363 {
1364 	switch (smps) {
1365 	case IEEE80211_SMPS_OFF:
1366 		return MCU_MMPS_DISABLE;
1367 	case IEEE80211_SMPS_STATIC:
1368 		return MCU_MMPS_STATIC;
1369 	case IEEE80211_SMPS_DYNAMIC:
1370 		return MCU_MMPS_DYNAMIC;
1371 	default:
1372 		return MCU_MMPS_DISABLE;
1373 	}
1374 }
1375 
1376 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1377 				   struct ieee80211_vif *vif,
1378 				   struct ieee80211_sta *sta,
1379 				   void *data, u32 field)
1380 {
1381 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1382 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1383 	struct sta_phy *phy = data;
1384 	struct sta_rec_ra_fixed *ra;
1385 	struct sk_buff *skb;
1386 	struct tlv *tlv;
1387 
1388 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1389 					    &msta->wcid);
1390 	if (IS_ERR(skb))
1391 		return PTR_ERR(skb);
1392 
1393 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1394 	ra = (struct sta_rec_ra_fixed *)tlv;
1395 
1396 	switch (field) {
1397 	case RATE_PARAM_AUTO:
1398 		break;
1399 	case RATE_PARAM_FIXED:
1400 	case RATE_PARAM_FIXED_MCS:
1401 	case RATE_PARAM_FIXED_GI:
1402 	case RATE_PARAM_FIXED_HE_LTF:
1403 		if (phy)
1404 			ra->phy = *phy;
1405 		break;
1406 	case RATE_PARAM_MMPS_UPDATE:
1407 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1408 		break;
1409 	default:
1410 		break;
1411 	}
1412 	ra->field = cpu_to_le32(field);
1413 
1414 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1415 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1416 }
1417 
1418 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1419 			struct ieee80211_sta *sta)
1420 {
1421 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1422 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1423 	struct wtbl_req_hdr *wtbl_hdr;
1424 	struct tlv *sta_wtbl;
1425 	struct sk_buff *skb;
1426 	int ret;
1427 
1428 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1429 					    &msta->wcid);
1430 	if (IS_ERR(skb))
1431 		return PTR_ERR(skb);
1432 
1433 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1434 					   sizeof(struct tlv));
1435 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1436 						  WTBL_SET, sta_wtbl, &skb);
1437 	if (IS_ERR(wtbl_hdr))
1438 		return PTR_ERR(wtbl_hdr);
1439 
1440 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1441 
1442 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1443 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1444 	if (ret)
1445 		return ret;
1446 
1447 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1448 					      RATE_PARAM_MMPS_UPDATE);
1449 }
1450 
1451 static int
1452 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1453 			       struct ieee80211_vif *vif,
1454 			       struct ieee80211_sta *sta)
1455 {
1456 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1457 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1458 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1459 	enum nl80211_band band = chandef->chan->band;
1460 	struct sta_phy phy = {};
1461 	int ret, nrates = 0;
1462 
1463 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _he)				\
1464 	do {									\
1465 		u8 i, gi = mask->control[band]._gi;				\
1466 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1467 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1468 			phy.sgi |= gi << (i << (_he));				\
1469 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1470 		}								\
1471 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1472 			if (!mask->control[band]._mcs[i])			\
1473 				continue;					\
1474 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1475 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1476 		}								\
1477 	} while (0)
1478 
1479 	if (sta->deflink.he_cap.has_he) {
1480 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 1);
1481 	} else if (sta->deflink.vht_cap.vht_supported) {
1482 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0);
1483 	} else if (sta->deflink.ht_cap.ht_supported) {
1484 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 0);
1485 	} else {
1486 		nrates = hweight32(mask->control[band].legacy);
1487 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1488 	}
1489 #undef __sta_phy_bitrate_mask_check
1490 
1491 	/* fall back to auto rate control */
1492 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1493 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1494 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1495 	    nrates != 1)
1496 		return 0;
1497 
1498 	/* fixed single rate */
1499 	if (nrates == 1) {
1500 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1501 						     RATE_PARAM_FIXED_MCS);
1502 		if (ret)
1503 			return ret;
1504 	}
1505 
1506 	/* fixed GI */
1507 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1508 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1509 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1510 		u32 addr;
1511 
1512 		/* firmware updates only TXCMD but doesn't take WTBL into
1513 		 * account, so driver should update here to reflect the
1514 		 * actual txrate hardware sends out.
1515 		 */
1516 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1517 		if (sta->deflink.he_cap.has_he)
1518 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1519 		else
1520 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1521 
1522 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1523 						     RATE_PARAM_FIXED_GI);
1524 		if (ret)
1525 			return ret;
1526 	}
1527 
1528 	/* fixed HE_LTF */
1529 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1530 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1531 						     RATE_PARAM_FIXED_HE_LTF);
1532 		if (ret)
1533 			return ret;
1534 	}
1535 
1536 	return 0;
1537 }
1538 
1539 static void
1540 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1541 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1542 {
1543 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1544 	struct mt76_phy *mphy = mvif->phy->mt76;
1545 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1546 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1547 	enum nl80211_band band = chandef->chan->band;
1548 	struct sta_rec_ra *ra;
1549 	struct tlv *tlv;
1550 	u32 supp_rate = sta->deflink.supp_rates[band];
1551 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1552 
1553 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1554 	ra = (struct sta_rec_ra *)tlv;
1555 
1556 	ra->valid = true;
1557 	ra->auto_rate = true;
1558 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1559 	ra->channel = chandef->chan->hw_value;
1560 	ra->bw = sta->deflink.bandwidth;
1561 	ra->phy.bw = sta->deflink.bandwidth;
1562 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1563 
1564 	if (supp_rate) {
1565 		supp_rate &= mask->control[band].legacy;
1566 		ra->rate_len = hweight32(supp_rate);
1567 
1568 		if (band == NL80211_BAND_2GHZ) {
1569 			ra->supp_mode = MODE_CCK;
1570 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1571 
1572 			if (ra->rate_len > 4) {
1573 				ra->supp_mode |= MODE_OFDM;
1574 				ra->supp_ofdm_rate = supp_rate >> 4;
1575 			}
1576 		} else {
1577 			ra->supp_mode = MODE_OFDM;
1578 			ra->supp_ofdm_rate = supp_rate;
1579 		}
1580 	}
1581 
1582 	if (sta->deflink.ht_cap.ht_supported) {
1583 		ra->supp_mode |= MODE_HT;
1584 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1585 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1586 
1587 		cap |= STA_CAP_HT;
1588 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1589 			cap |= STA_CAP_SGI_20;
1590 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1591 			cap |= STA_CAP_SGI_40;
1592 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1593 			cap |= STA_CAP_TX_STBC;
1594 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1595 			cap |= STA_CAP_RX_STBC;
1596 		if (mvif->cap.ht_ldpc &&
1597 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1598 			cap |= STA_CAP_LDPC;
1599 
1600 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1601 					  mask->control[band].ht_mcs);
1602 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1603 	}
1604 
1605 	if (sta->deflink.vht_cap.vht_supported) {
1606 		u8 af;
1607 
1608 		ra->supp_mode |= MODE_VHT;
1609 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1610 			       sta->deflink.vht_cap.cap);
1611 		ra->af = max_t(u8, ra->af, af);
1612 
1613 		cap |= STA_CAP_VHT;
1614 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1615 			cap |= STA_CAP_VHT_SGI_80;
1616 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1617 			cap |= STA_CAP_VHT_SGI_160;
1618 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1619 			cap |= STA_CAP_VHT_TX_STBC;
1620 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1621 			cap |= STA_CAP_VHT_RX_STBC;
1622 		if (mvif->cap.vht_ldpc &&
1623 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1624 			cap |= STA_CAP_VHT_LDPC;
1625 
1626 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1627 					   mask->control[band].vht_mcs);
1628 	}
1629 
1630 	if (sta->deflink.he_cap.has_he) {
1631 		ra->supp_mode |= MODE_HE;
1632 		cap |= STA_CAP_HE;
1633 
1634 		if (sta->deflink.he_6ghz_capa.capa)
1635 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1636 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1637 	}
1638 
1639 	ra->sta_cap = cpu_to_le32(cap);
1640 }
1641 
1642 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1643 			     struct ieee80211_sta *sta, bool changed)
1644 {
1645 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1646 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1647 	struct sk_buff *skb;
1648 	int ret;
1649 
1650 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1651 					    &msta->wcid);
1652 	if (IS_ERR(skb))
1653 		return PTR_ERR(skb);
1654 
1655 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1656 	 * once dev->rc_work changes the settings driver should also
1657 	 * update sta_rec_he here.
1658 	 */
1659 	if (changed)
1660 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1661 
1662 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1663 	 * i.e 0-{7,8,9} for VHT.
1664 	 */
1665 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1666 
1667 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1668 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1669 	if (ret)
1670 		return ret;
1671 
1672 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1673 	 * and updates as peer fixed rate parameters, which overrides
1674 	 * sta_rec_ra and firmware rate control algorithm.
1675 	 */
1676 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1677 }
1678 
1679 static int
1680 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1681 		     struct ieee80211_sta *sta)
1682 {
1683 #define MT_STA_BSS_GROUP		1
1684 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1685 	struct mt7915_sta *msta;
1686 	struct {
1687 		__le32 action;
1688 		u8 wlan_idx_lo;
1689 		u8 status;
1690 		u8 wlan_idx_hi;
1691 		u8 rsv0[5];
1692 		__le32 val;
1693 		u8 rsv1[8];
1694 	} __packed req = {
1695 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1696 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1697 	};
1698 
1699 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1700 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1701 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1702 
1703 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1704 				 sizeof(req), true);
1705 }
1706 
1707 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1708 		       struct ieee80211_sta *sta, bool enable)
1709 {
1710 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1711 	struct mt7915_sta *msta;
1712 	struct sk_buff *skb;
1713 	int ret;
1714 
1715 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1716 
1717 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1718 					    &msta->wcid);
1719 	if (IS_ERR(skb))
1720 		return PTR_ERR(skb);
1721 
1722 	/* starec basic */
1723 	mt76_connac_mcu_sta_basic_tlv(skb, vif, sta, enable, true);
1724 	if (!enable)
1725 		goto out;
1726 
1727 	/* tag order is in accordance with firmware dependency. */
1728 	if (sta) {
1729 		/* starec bfer */
1730 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1731 		/* starec ht */
1732 		mt7915_mcu_sta_ht_tlv(skb, sta);
1733 		/* starec vht */
1734 		mt7915_mcu_sta_vht_tlv(skb, sta);
1735 		/* starec uapsd */
1736 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1737 	}
1738 
1739 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1740 	if (ret) {
1741 		dev_kfree_skb(skb);
1742 		return ret;
1743 	}
1744 
1745 	if (sta) {
1746 		/* starec amsdu */
1747 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1748 		/* starec he */
1749 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1750 		/* starec muru */
1751 		mt7915_mcu_sta_muru_tlv(skb, sta, vif);
1752 		/* starec bfee */
1753 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1754 	}
1755 
1756 	ret = mt7915_mcu_add_group(dev, vif, sta);
1757 	if (ret) {
1758 		dev_kfree_skb(skb);
1759 		return ret;
1760 	}
1761 out:
1762 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1763 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1764 }
1765 
1766 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1767 			    struct ieee80211_vif *vif, bool enable)
1768 {
1769 	struct mt7915_dev *dev = phy->dev;
1770 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1771 	struct {
1772 		struct req_hdr {
1773 			u8 omac_idx;
1774 			u8 dbdc_idx;
1775 			__le16 tlv_num;
1776 			u8 is_tlv_append;
1777 			u8 rsv[3];
1778 		} __packed hdr;
1779 		struct req_tlv {
1780 			__le16 tag;
1781 			__le16 len;
1782 			u8 active;
1783 			u8 dbdc_idx;
1784 			u8 omac_addr[ETH_ALEN];
1785 		} __packed tlv;
1786 	} data = {
1787 		.hdr = {
1788 			.omac_idx = mvif->mt76.omac_idx,
1789 			.dbdc_idx = mvif->mt76.band_idx,
1790 			.tlv_num = cpu_to_le16(1),
1791 			.is_tlv_append = 1,
1792 		},
1793 		.tlv = {
1794 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1795 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1796 			.active = enable,
1797 			.dbdc_idx = mvif->mt76.band_idx,
1798 		},
1799 	};
1800 
1801 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1802 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1803 
1804 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1805 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1806 				 &data, sizeof(data), true);
1807 }
1808 
1809 static void
1810 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1811 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1812 			 struct ieee80211_mutable_offsets *offs)
1813 {
1814 	struct bss_info_bcn_cntdwn *info;
1815 	struct tlv *tlv;
1816 	int sub_tag;
1817 
1818 	if (!offs->cntdwn_counter_offs[0])
1819 		return;
1820 
1821 	sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1822 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1823 					   &bcn->sub_ntlv, &bcn->len);
1824 	info = (struct bss_info_bcn_cntdwn *)tlv;
1825 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1826 }
1827 
1828 static void
1829 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1830 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1831 		       struct ieee80211_mutable_offsets *offs)
1832 {
1833 	struct bss_info_bcn_mbss *mbss;
1834 	const struct element *elem;
1835 	struct tlv *tlv;
1836 
1837 	if (!vif->bss_conf.bssid_indicator)
1838 		return;
1839 
1840 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1841 					   sizeof(*mbss), &bcn->sub_ntlv,
1842 					   &bcn->len);
1843 
1844 	mbss = (struct bss_info_bcn_mbss *)tlv;
1845 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1846 	mbss->bitmap = cpu_to_le32(1);
1847 
1848 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1849 			    &skb->data[offs->mbssid_off],
1850 			    skb->len - offs->mbssid_off) {
1851 		const struct element *sub_elem;
1852 
1853 		if (elem->datalen < 2)
1854 			continue;
1855 
1856 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1857 			const struct ieee80211_bssid_index *idx;
1858 			const u8 *idx_ie;
1859 
1860 			if (sub_elem->id || sub_elem->datalen < 4)
1861 				continue; /* not a valid BSS profile */
1862 
1863 			/* Find WLAN_EID_MULTI_BSSID_IDX
1864 			 * in the merged nontransmitted profile
1865 			 */
1866 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1867 						  sub_elem->data,
1868 						  sub_elem->datalen);
1869 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1870 				continue;
1871 
1872 			idx = (void *)(idx_ie + 2);
1873 			if (!idx->bssid_index || idx->bssid_index > 31)
1874 				continue;
1875 
1876 			mbss->offset[idx->bssid_index] =
1877 				cpu_to_le16(idx_ie - skb->data);
1878 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1879 		}
1880 	}
1881 }
1882 
1883 static void
1884 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1885 		       struct sk_buff *rskb, struct sk_buff *skb,
1886 		       struct bss_info_bcn *bcn,
1887 		       struct ieee80211_mutable_offsets *offs)
1888 {
1889 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1890 	struct bss_info_bcn_cont *cont;
1891 	struct tlv *tlv;
1892 	u8 *buf;
1893 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1894 
1895 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1896 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1897 					   len, &bcn->sub_ntlv, &bcn->len);
1898 
1899 	cont = (struct bss_info_bcn_cont *)tlv;
1900 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1901 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1902 
1903 	if (offs->cntdwn_counter_offs[0]) {
1904 		u16 offset = offs->cntdwn_counter_offs[0];
1905 
1906 		if (vif->csa_active)
1907 			cont->csa_ofs = cpu_to_le16(offset - 4);
1908 		if (vif->color_change_active)
1909 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1910 	}
1911 
1912 	buf = (u8 *)tlv + sizeof(*cont);
1913 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
1914 			      BSS_CHANGED_BEACON);
1915 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1916 }
1917 
1918 static void
1919 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1920 			     struct sk_buff *skb)
1921 {
1922 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1923 	struct mt7915_vif_cap *vc = &mvif->cap;
1924 	const struct ieee80211_he_cap_elem *he;
1925 	const struct ieee80211_vht_cap *vht;
1926 	const struct ieee80211_ht_cap *ht;
1927 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1928 	const u8 *ie;
1929 	u32 len, bc;
1930 
1931 	/* Check missing configuration options to allow AP mode in mac80211
1932 	 * to remain in sync with hostapd settings, and get a subset of
1933 	 * beacon and hardware capabilities.
1934 	 */
1935 	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
1936 		return;
1937 
1938 	memset(vc, 0, sizeof(*vc));
1939 
1940 	len = skb->len - (mgmt->u.beacon.variable - skb->data);
1941 
1942 	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
1943 			      len);
1944 	if (ie && ie[1] >= sizeof(*ht)) {
1945 		ht = (void *)(ie + 2);
1946 		vc->ht_ldpc = !!(le16_to_cpu(ht->cap_info) &
1947 				 IEEE80211_HT_CAP_LDPC_CODING);
1948 	}
1949 
1950 	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
1951 			      len);
1952 	if (ie && ie[1] >= sizeof(*vht)) {
1953 		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
1954 
1955 		vht = (void *)(ie + 2);
1956 		bc = le32_to_cpu(vht->vht_cap_info);
1957 
1958 		vc->vht_ldpc = !!(bc & IEEE80211_VHT_CAP_RXLDPC);
1959 		vc->vht_su_ebfer =
1960 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
1961 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1962 		vc->vht_su_ebfee =
1963 			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
1964 			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1965 		vc->vht_mu_ebfer =
1966 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
1967 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
1968 		vc->vht_mu_ebfee =
1969 			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
1970 			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1971 	}
1972 
1973 	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
1974 				  mgmt->u.beacon.variable, len);
1975 	if (ie && ie[1] >= sizeof(*he) + 1) {
1976 		const struct ieee80211_sta_he_cap *pc =
1977 			mt76_connac_get_he_phy_cap(phy->mt76, vif);
1978 		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1979 
1980 		he = (void *)(ie + 3);
1981 
1982 		vc->he_ldpc =
1983 			HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
1984 		vc->he_su_ebfer =
1985 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
1986 			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1987 		vc->he_su_ebfee =
1988 			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
1989 			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1990 		vc->he_mu_ebfer =
1991 			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
1992 			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
1993 	}
1994 }
1995 
1996 static void
1997 mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1998 				struct sk_buff *rskb, struct bss_info_bcn *bcn,
1999 				u32 changed)
2000 {
2001 #define OFFLOAD_TX_MODE_SU	BIT(0)
2002 #define OFFLOAD_TX_MODE_MU	BIT(1)
2003 	struct ieee80211_hw *hw = mt76_hw(dev);
2004 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2005 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2006 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2007 	enum nl80211_band band = chandef->chan->band;
2008 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2009 	struct bss_info_inband_discovery *discov;
2010 	struct ieee80211_tx_info *info;
2011 	struct sk_buff *skb = NULL;
2012 	struct tlv *tlv;
2013 	bool ext_phy = phy != &dev->phy;
2014 	u8 *buf, interval;
2015 	int len;
2016 
2017 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
2018 	    vif->bss_conf.fils_discovery.max_interval) {
2019 		interval = vif->bss_conf.fils_discovery.max_interval;
2020 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
2021 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
2022 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
2023 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
2024 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
2025 	}
2026 
2027 	if (!skb)
2028 		return;
2029 
2030 	info = IEEE80211_SKB_CB(skb);
2031 	info->control.vif = vif;
2032 	info->band = band;
2033 
2034 	if (ext_phy)
2035 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2036 
2037 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
2038 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
2039 
2040 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
2041 					   len, &bcn->sub_ntlv, &bcn->len);
2042 	discov = (struct bss_info_inband_discovery *)tlv;
2043 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
2044 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
2045 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
2046 	discov->tx_interval = interval;
2047 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2048 	discov->enable = true;
2049 
2050 	buf = (u8 *)tlv + sizeof(*discov);
2051 
2052 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
2053 			      changed);
2054 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2055 
2056 	dev_kfree_skb(skb);
2057 }
2058 
2059 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2060 			  int en, u32 changed)
2061 {
2062 #define MAX_BEACON_SIZE 512
2063 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
2064 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
2065 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2066 	struct ieee80211_mutable_offsets offs;
2067 	struct ieee80211_tx_info *info;
2068 	struct sk_buff *skb, *rskb;
2069 	struct tlv *tlv;
2070 	struct bss_info_bcn *bcn;
2071 	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2072 	bool ext_phy = phy != &dev->phy;
2073 
2074 	if (vif->bss_conf.nontransmitted)
2075 		return 0;
2076 
2077 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2078 					       NULL, len);
2079 	if (IS_ERR(rskb))
2080 		return PTR_ERR(rskb);
2081 
2082 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2083 	bcn = (struct bss_info_bcn *)tlv;
2084 	bcn->enable = en;
2085 
2086 	if (!en)
2087 		goto out;
2088 
2089 	skb = ieee80211_beacon_get_template(hw, vif, &offs);
2090 	if (!skb)
2091 		return -EINVAL;
2092 
2093 	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2094 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2095 		dev_kfree_skb(skb);
2096 		return -EINVAL;
2097 	}
2098 
2099 	if (ext_phy) {
2100 		info = IEEE80211_SKB_CB(skb);
2101 		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2102 	}
2103 
2104 	mt7915_mcu_beacon_check_caps(phy, vif, skb);
2105 
2106 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2107 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2108 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2109 	dev_kfree_skb(skb);
2110 
2111 	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
2112 	    changed & BSS_CHANGED_FILS_DISCOVERY)
2113 		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
2114 						bcn, changed);
2115 
2116 out:
2117 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2118 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2119 }
2120 
2121 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2122 {
2123 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2124 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2125 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2126 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2127 		return -EIO;
2128 	}
2129 
2130 	/* clear irq when the driver own success */
2131 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2132 		MT_TOP_LPCR_HOST_BAND_STAT);
2133 
2134 	return 0;
2135 }
2136 
2137 static int mt7915_load_patch(struct mt7915_dev *dev)
2138 {
2139 	const struct mt7915_patch_hdr *hdr;
2140 	const struct firmware *fw = NULL;
2141 	int i, ret, sem;
2142 
2143 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 1);
2144 	switch (sem) {
2145 	case PATCH_IS_DL:
2146 		return 0;
2147 	case PATCH_NOT_DL_SEM_SUCCESS:
2148 		break;
2149 	default:
2150 		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2151 		return -EAGAIN;
2152 	}
2153 
2154 	ret = request_firmware(&fw, fw_name_var(dev, ROM_PATCH),
2155 			       dev->mt76.dev);
2156 	if (ret)
2157 		goto out;
2158 
2159 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2160 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2161 		ret = -EINVAL;
2162 		goto out;
2163 	}
2164 
2165 	hdr = (const struct mt7915_patch_hdr *)(fw->data);
2166 
2167 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2168 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2169 
2170 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2171 		struct mt7915_patch_sec *sec;
2172 		const u8 *dl;
2173 		u32 len, addr;
2174 
2175 		sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2176 						  i * sizeof(*sec));
2177 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2178 		    PATCH_SEC_TYPE_INFO) {
2179 			ret = -EINVAL;
2180 			goto out;
2181 		}
2182 
2183 		addr = be32_to_cpu(sec->info.addr);
2184 		len = be32_to_cpu(sec->info.len);
2185 		dl = fw->data + be32_to_cpu(sec->offs);
2186 
2187 		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2188 						    DL_MODE_NEED_RSP);
2189 		if (ret) {
2190 			dev_err(dev->mt76.dev, "Download request failed\n");
2191 			goto out;
2192 		}
2193 
2194 		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2195 					       dl, len, 4096);
2196 		if (ret) {
2197 			dev_err(dev->mt76.dev, "Failed to send patch\n");
2198 			goto out;
2199 		}
2200 	}
2201 
2202 	ret = mt76_connac_mcu_start_patch(&dev->mt76);
2203 	if (ret)
2204 		dev_err(dev->mt76.dev, "Failed to start patch\n");
2205 
2206 out:
2207 	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 0);
2208 	switch (sem) {
2209 	case PATCH_REL_SEM_SUCCESS:
2210 		break;
2211 	default:
2212 		ret = -EAGAIN;
2213 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2214 		break;
2215 	}
2216 	release_firmware(fw);
2217 
2218 	return ret;
2219 }
2220 
2221 static int
2222 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2223 			     const struct mt7915_fw_trailer *hdr,
2224 			     const u8 *data, bool is_wa)
2225 {
2226 	int i, offset = 0;
2227 	u32 override = 0, option = 0;
2228 
2229 	for (i = 0; i < hdr->n_region; i++) {
2230 		const struct mt7915_fw_region *region;
2231 		int err;
2232 		u32 len, addr, mode;
2233 
2234 		region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2235 			 (hdr->n_region - i) * sizeof(*region));
2236 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
2237 						   region->feature_set, is_wa);
2238 		len = le32_to_cpu(region->len);
2239 		addr = le32_to_cpu(region->addr);
2240 
2241 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2242 			override = addr;
2243 
2244 		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2245 						    mode);
2246 		if (err) {
2247 			dev_err(dev->mt76.dev, "Download request failed\n");
2248 			return err;
2249 		}
2250 
2251 		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2252 					       data + offset, len, 4096);
2253 		if (err) {
2254 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2255 			return err;
2256 		}
2257 
2258 		offset += len;
2259 	}
2260 
2261 	if (override)
2262 		option |= FW_START_OVERRIDE;
2263 
2264 	if (is_wa)
2265 		option |= FW_START_WORKING_PDA_CR4;
2266 
2267 	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
2268 }
2269 
2270 static int mt7915_load_ram(struct mt7915_dev *dev)
2271 {
2272 	const struct mt7915_fw_trailer *hdr;
2273 	const struct firmware *fw;
2274 	int ret;
2275 
2276 	ret = request_firmware(&fw, fw_name_var(dev, FIRMWARE_WM),
2277 			       dev->mt76.dev);
2278 	if (ret)
2279 		return ret;
2280 
2281 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2282 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2283 		ret = -EINVAL;
2284 		goto out;
2285 	}
2286 
2287 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2288 					sizeof(*hdr));
2289 
2290 	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2291 		 hdr->fw_ver, hdr->build_date);
2292 
2293 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2294 	if (ret) {
2295 		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2296 		goto out;
2297 	}
2298 
2299 	release_firmware(fw);
2300 
2301 	ret = request_firmware(&fw, fw_name(dev, FIRMWARE_WA),
2302 			       dev->mt76.dev);
2303 	if (ret)
2304 		return ret;
2305 
2306 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2307 		dev_err(dev->mt76.dev, "Invalid firmware\n");
2308 		ret = -EINVAL;
2309 		goto out;
2310 	}
2311 
2312 	hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2313 					sizeof(*hdr));
2314 
2315 	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2316 		 hdr->fw_ver, hdr->build_date);
2317 
2318 	ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2319 	if (ret) {
2320 		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2321 		goto out;
2322 	}
2323 
2324 	snprintf(dev->mt76.hw->wiphy->fw_version,
2325 		 sizeof(dev->mt76.hw->wiphy->fw_version),
2326 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2327 
2328 out:
2329 	release_firmware(fw);
2330 
2331 	return ret;
2332 }
2333 
2334 static int
2335 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2336 {
2337 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2338 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2339 
2340 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2341 			    state, 1000)) {
2342 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2343 		return -EIO;
2344 	}
2345 	return 0;
2346 }
2347 
2348 static int mt7915_load_firmware(struct mt7915_dev *dev)
2349 {
2350 	int ret;
2351 
2352 	/* make sure fw is download state */
2353 	if (mt7915_firmware_state(dev, false)) {
2354 		/* restart firmware once */
2355 		__mt76_mcu_restart(&dev->mt76);
2356 		ret = mt7915_firmware_state(dev, false);
2357 		if (ret) {
2358 			dev_err(dev->mt76.dev,
2359 				"Firmware is not ready for download\n");
2360 			return ret;
2361 		}
2362 	}
2363 
2364 	ret = mt7915_load_patch(dev);
2365 	if (ret)
2366 		return ret;
2367 
2368 	ret = mt7915_load_ram(dev);
2369 	if (ret)
2370 		return ret;
2371 
2372 	ret = mt7915_firmware_state(dev, true);
2373 	if (ret)
2374 		return ret;
2375 
2376 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2377 
2378 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2379 
2380 	return 0;
2381 }
2382 
2383 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2384 {
2385 	struct {
2386 		u8 ctrl_val;
2387 		u8 pad[3];
2388 	} data = {
2389 		.ctrl_val = ctrl
2390 	};
2391 
2392 	if (type == MCU_FW_LOG_WA)
2393 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2394 					 &data, sizeof(data), true);
2395 
2396 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2397 				 sizeof(data), true);
2398 }
2399 
2400 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2401 {
2402 	struct {
2403 		u8 ver;
2404 		u8 pad;
2405 		__le16 len;
2406 		u8 level;
2407 		u8 rsv[3];
2408 		__le32 module_idx;
2409 	} data = {
2410 		.module_idx = cpu_to_le32(module),
2411 		.level = level,
2412 	};
2413 
2414 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2415 				 sizeof(data), false);
2416 }
2417 
2418 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2419 {
2420 	struct {
2421 		__le32 cmd;
2422 		u8 enable;
2423 	} data = {
2424 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2425 		.enable = enabled,
2426 	};
2427 
2428 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2429 				sizeof(data), false);
2430 }
2431 
2432 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2433 {
2434 	struct mt7915_dev *dev = phy->dev;
2435 	struct sk_buff *skb;
2436 	struct mt7915_mcu_muru_stats *mu_stats =
2437 				(struct mt7915_mcu_muru_stats *)ms;
2438 	int ret;
2439 
2440 	struct {
2441 		__le32 cmd;
2442 		u8 band_idx;
2443 	} req = {
2444 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2445 		.band_idx = phy->band_idx,
2446 	};
2447 
2448 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2449 					&req, sizeof(req), true, &skb);
2450 	if (ret)
2451 		return ret;
2452 
2453 	memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2454 	dev_kfree_skb(skb);
2455 
2456 	return 0;
2457 }
2458 
2459 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2460 {
2461 	struct {
2462 		u8 enable;
2463 		u8 _rsv[3];
2464 	} __packed req = {
2465 		.enable = enabled
2466 	};
2467 
2468 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2469 				 sizeof(req), false);
2470 }
2471 
2472 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2473 {
2474 	struct {
2475 		__le32 cmd;
2476 		u8 val[4];
2477 	} __packed req = {
2478 		.cmd = cpu_to_le32(cmd),
2479 	};
2480 
2481 	put_unaligned_le32(val, req.val);
2482 
2483 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2484 				 sizeof(req), false);
2485 }
2486 
2487 static int
2488 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2489 {
2490 #define RX_AIRTIME_FEATURE_CTRL		1
2491 #define RX_AIRTIME_BITWISE_CTRL		2
2492 #define RX_AIRTIME_CLEAR_EN	1
2493 	struct {
2494 		__le16 field;
2495 		__le16 sub_field;
2496 		__le32 set_status;
2497 		__le32 get_status;
2498 		u8 _rsv[12];
2499 
2500 		bool airtime_en;
2501 		bool mibtime_en;
2502 		bool earlyend_en;
2503 		u8 _rsv1[9];
2504 
2505 		bool airtime_clear;
2506 		bool mibtime_clear;
2507 		u8 _rsv2[98];
2508 	} __packed req = {
2509 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2510 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2511 		.airtime_clear = true,
2512 	};
2513 	int ret;
2514 
2515 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2516 				sizeof(req), true);
2517 	if (ret)
2518 		return ret;
2519 
2520 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2521 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2522 	req.airtime_en = true;
2523 
2524 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2525 				 sizeof(req), true);
2526 }
2527 
2528 int mt7915_mcu_init(struct mt7915_dev *dev)
2529 {
2530 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2531 		.headroom = sizeof(struct mt7915_mcu_txd),
2532 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2533 		.mcu_parse_response = mt7915_mcu_parse_response,
2534 		.mcu_restart = mt76_connac_mcu_restart,
2535 	};
2536 	int ret;
2537 
2538 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2539 
2540 	/* force firmware operation mode into normal state,
2541 	 * which should be set before firmware download stage.
2542 	 */
2543 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2544 
2545 	ret = mt7915_driver_own(dev, 0);
2546 	if (ret)
2547 		return ret;
2548 	/* set driver own for band1 when two hif exist */
2549 	if (dev->hif2) {
2550 		ret = mt7915_driver_own(dev, 1);
2551 		if (ret)
2552 			return ret;
2553 	}
2554 
2555 	ret = mt7915_load_firmware(dev);
2556 	if (ret)
2557 		return ret;
2558 
2559 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2560 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2561 	if (ret)
2562 		return ret;
2563 
2564 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2565 	if (ret)
2566 		return ret;
2567 
2568 	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
2569 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2570 
2571 	ret = mt7915_mcu_set_mwds(dev, 1);
2572 	if (ret)
2573 		return ret;
2574 
2575 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2576 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2577 	if (ret)
2578 		return ret;
2579 
2580 	ret = mt7915_mcu_init_rx_airtime(dev);
2581 	if (ret)
2582 		return ret;
2583 
2584 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2585 				 MCU_WA_PARAM_RED, 0, 0);
2586 }
2587 
2588 void mt7915_mcu_exit(struct mt7915_dev *dev)
2589 {
2590 	__mt76_mcu_restart(&dev->mt76);
2591 	if (mt7915_firmware_state(dev, false)) {
2592 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2593 		return;
2594 	}
2595 
2596 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2597 	if (dev->hif2)
2598 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2599 			MT_TOP_LPCR_HOST_FW_OWN);
2600 	skb_queue_purge(&dev->mt76.mcu.res_q);
2601 }
2602 
2603 static int
2604 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2605 {
2606 	struct {
2607 		u8 operation;
2608 		u8 count;
2609 		u8 _rsv[2];
2610 		u8 index;
2611 		u8 enable;
2612 		__le16 etype;
2613 	} req = {
2614 		.operation = 1,
2615 		.count = 1,
2616 		.enable = 1,
2617 		.etype = cpu_to_le16(ETH_P_PAE),
2618 	};
2619 
2620 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2621 				 &req, sizeof(req), false);
2622 }
2623 
2624 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2625 		       bool enable, bool hdr_trans)
2626 {
2627 	struct {
2628 		u8 operation;
2629 		u8 enable;
2630 		u8 check_bssid;
2631 		u8 insert_vlan;
2632 		u8 remove_vlan;
2633 		u8 tid;
2634 		u8 mode;
2635 		u8 rsv;
2636 	} __packed req_trans = {
2637 		.enable = hdr_trans,
2638 	};
2639 	struct {
2640 		u8 enable;
2641 		u8 band;
2642 		u8 rsv[2];
2643 	} __packed req_mac = {
2644 		.enable = enable,
2645 		.band = band,
2646 	};
2647 	int ret;
2648 
2649 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2650 				&req_trans, sizeof(req_trans), false);
2651 	if (ret)
2652 		return ret;
2653 
2654 	if (hdr_trans)
2655 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2656 
2657 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2658 				 &req_mac, sizeof(req_mac), true);
2659 }
2660 
2661 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2662 {
2663 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2664 	u8 num = req->total;
2665 	size_t len = sizeof(*req) -
2666 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2667 
2668 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2669 				 len, true);
2670 }
2671 
2672 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2673 {
2674 #define TX_CMD_MODE		1
2675 	struct mt7915_mcu_tx req = {
2676 		.valid = true,
2677 		.mode = TX_CMD_MODE,
2678 		.total = IEEE80211_NUM_ACS,
2679 	};
2680 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2681 	int ac;
2682 
2683 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2684 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2685 		struct edca *e = &req.edca[ac];
2686 
2687 		e->set = WMM_PARAM_SET;
2688 		e->queue = ac + mvif->mt76.wmm_idx * MT7915_MAX_WMM_SETS;
2689 		e->aifs = q->aifs;
2690 		e->txop = cpu_to_le16(q->txop);
2691 
2692 		if (q->cw_min)
2693 			e->cw_min = fls(q->cw_min);
2694 		else
2695 			e->cw_min = 5;
2696 
2697 		if (q->cw_max)
2698 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2699 		else
2700 			e->cw_max = cpu_to_le16(10);
2701 	}
2702 
2703 	return mt7915_mcu_update_edca(dev, &req);
2704 }
2705 
2706 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2707 {
2708 	struct {
2709 		__le32 tag;
2710 		__le16 min_lpn;
2711 		u8 rsv[2];
2712 	} __packed req = {
2713 		.tag = cpu_to_le32(0x1),
2714 		.min_lpn = cpu_to_le16(val),
2715 	};
2716 
2717 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2718 				 sizeof(req), true);
2719 }
2720 
2721 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2722 			    const struct mt7915_dfs_pulse *pulse)
2723 {
2724 	struct {
2725 		__le32 tag;
2726 
2727 		__le32 max_width;		/* us */
2728 		__le32 max_pwr;			/* dbm */
2729 		__le32 min_pwr;			/* dbm */
2730 		__le32 min_stgr_pri;		/* us */
2731 		__le32 max_stgr_pri;		/* us */
2732 		__le32 min_cr_pri;		/* us */
2733 		__le32 max_cr_pri;		/* us */
2734 	} __packed req = {
2735 		.tag = cpu_to_le32(0x3),
2736 
2737 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2738 		__req_field(max_width),
2739 		__req_field(max_pwr),
2740 		__req_field(min_pwr),
2741 		__req_field(min_stgr_pri),
2742 		__req_field(max_stgr_pri),
2743 		__req_field(min_cr_pri),
2744 		__req_field(max_cr_pri),
2745 #undef __req_field
2746 	};
2747 
2748 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2749 				 sizeof(req), true);
2750 }
2751 
2752 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2753 			    const struct mt7915_dfs_pattern *pattern)
2754 {
2755 	struct {
2756 		__le32 tag;
2757 		__le16 radar_type;
2758 
2759 		u8 enb;
2760 		u8 stgr;
2761 		u8 min_crpn;
2762 		u8 max_crpn;
2763 		u8 min_crpr;
2764 		u8 min_pw;
2765 		__le32 min_pri;
2766 		__le32 max_pri;
2767 		u8 max_pw;
2768 		u8 min_crbn;
2769 		u8 max_crbn;
2770 		u8 min_stgpn;
2771 		u8 max_stgpn;
2772 		u8 min_stgpr;
2773 		u8 rsv[2];
2774 		__le32 min_stgpr_diff;
2775 	} __packed req = {
2776 		.tag = cpu_to_le32(0x2),
2777 		.radar_type = cpu_to_le16(index),
2778 
2779 #define __req_field_u8(field) .field = pattern->field
2780 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2781 		__req_field_u8(enb),
2782 		__req_field_u8(stgr),
2783 		__req_field_u8(min_crpn),
2784 		__req_field_u8(max_crpn),
2785 		__req_field_u8(min_crpr),
2786 		__req_field_u8(min_pw),
2787 		__req_field_u32(min_pri),
2788 		__req_field_u32(max_pri),
2789 		__req_field_u8(max_pw),
2790 		__req_field_u8(min_crbn),
2791 		__req_field_u8(max_crbn),
2792 		__req_field_u8(min_stgpn),
2793 		__req_field_u8(max_stgpn),
2794 		__req_field_u8(min_stgpr),
2795 		__req_field_u32(min_stgpr_diff),
2796 #undef __req_field_u8
2797 #undef __req_field_u32
2798 	};
2799 
2800 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2801 				 sizeof(req), true);
2802 }
2803 
2804 static int
2805 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2806 				 struct cfg80211_chan_def *chandef,
2807 				 int cmd)
2808 {
2809 	struct mt7915_dev *dev = phy->dev;
2810 	struct mt76_phy *mphy = phy->mt76;
2811 	struct ieee80211_channel *chan = mphy->chandef.chan;
2812 	int freq = mphy->chandef.center_freq1;
2813 	struct mt7915_mcu_background_chain_ctrl req = {
2814 		.monitor_scan_type = 2, /* simple rx */
2815 	};
2816 
2817 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2818 		return -EINVAL;
2819 
2820 	if (!cfg80211_chandef_valid(&mphy->chandef))
2821 		return -EINVAL;
2822 
2823 	switch (cmd) {
2824 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2825 		req.chan = chan->hw_value;
2826 		req.central_chan = ieee80211_frequency_to_channel(freq);
2827 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2828 		req.monitor_chan = chandef->chan->hw_value;
2829 		req.monitor_central_chan =
2830 			ieee80211_frequency_to_channel(chandef->center_freq1);
2831 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2832 		req.band_idx = phy != &dev->phy;
2833 		req.scan_mode = 1;
2834 		break;
2835 	}
2836 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2837 		req.monitor_chan = chandef->chan->hw_value;
2838 		req.monitor_central_chan =
2839 			ieee80211_frequency_to_channel(chandef->center_freq1);
2840 		req.band_idx = phy != &dev->phy;
2841 		req.scan_mode = 2;
2842 		break;
2843 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2844 		req.chan = chan->hw_value;
2845 		req.central_chan = ieee80211_frequency_to_channel(freq);
2846 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2847 		req.tx_stream = hweight8(mphy->antenna_mask);
2848 		req.rx_stream = mphy->antenna_mask;
2849 		break;
2850 	default:
2851 		return -EINVAL;
2852 	}
2853 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2854 
2855 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2856 				 &req, sizeof(req), false);
2857 }
2858 
2859 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2860 				     struct cfg80211_chan_def *chandef)
2861 {
2862 	struct mt7915_dev *dev = phy->dev;
2863 	int err, region;
2864 
2865 	if (!chandef) { /* disable offchain */
2866 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2867 					      0, 0);
2868 		if (err)
2869 			return err;
2870 
2871 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2872 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2873 	}
2874 
2875 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2876 					       CH_SWITCH_BACKGROUND_SCAN_START);
2877 	if (err)
2878 		return err;
2879 
2880 	switch (dev->mt76.region) {
2881 	case NL80211_DFS_ETSI:
2882 		region = 0;
2883 		break;
2884 	case NL80211_DFS_JP:
2885 		region = 2;
2886 		break;
2887 	case NL80211_DFS_FCC:
2888 	default:
2889 		region = 1;
2890 		break;
2891 	}
2892 
2893 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2894 				       0, region);
2895 }
2896 
2897 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2898 {
2899 	static const u8 ch_band[] = {
2900 		[NL80211_BAND_2GHZ] = 0,
2901 		[NL80211_BAND_5GHZ] = 1,
2902 		[NL80211_BAND_6GHZ] = 2,
2903 	};
2904 	struct mt7915_dev *dev = phy->dev;
2905 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2906 	int freq1 = chandef->center_freq1;
2907 	struct {
2908 		u8 control_ch;
2909 		u8 center_ch;
2910 		u8 bw;
2911 		u8 tx_streams_num;
2912 		u8 rx_streams;	/* mask or num */
2913 		u8 switch_reason;
2914 		u8 band_idx;
2915 		u8 center_ch2;	/* for 80+80 only */
2916 		__le16 cac_case;
2917 		u8 channel_band;
2918 		u8 rsv0;
2919 		__le32 outband_freq;
2920 		u8 txpower_drop;
2921 		u8 ap_bw;
2922 		u8 ap_center_ch;
2923 		u8 rsv1[57];
2924 	} __packed req = {
2925 		.control_ch = chandef->chan->hw_value,
2926 		.center_ch = ieee80211_frequency_to_channel(freq1),
2927 		.bw = mt76_connac_chan_bw(chandef),
2928 		.tx_streams_num = hweight8(phy->mt76->antenna_mask),
2929 		.rx_streams = phy->mt76->antenna_mask,
2930 		.band_idx = phy->band_idx,
2931 		.channel_band = ch_band[chandef->chan->band],
2932 	};
2933 
2934 #ifdef CONFIG_NL80211_TESTMODE
2935 	if (phy->mt76->test.tx_antenna_mask &&
2936 	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
2937 	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
2938 	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
2939 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
2940 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
2941 
2942 		if (phy != &dev->phy)
2943 			req.rx_streams >>= dev->chainshift;
2944 	}
2945 #endif
2946 
2947 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2948 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2949 		req.switch_reason = CH_SWITCH_NORMAL;
2950 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2951 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2952 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2953 					  NL80211_IFTYPE_AP))
2954 		req.switch_reason = CH_SWITCH_DFS;
2955 	else
2956 		req.switch_reason = CH_SWITCH_NORMAL;
2957 
2958 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2959 		req.rx_streams = hweight8(req.rx_streams);
2960 
2961 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2962 		int freq2 = chandef->center_freq2;
2963 
2964 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2965 	}
2966 
2967 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2968 }
2969 
2970 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2971 {
2972 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2973 #define PAGE_IDX_MASK		GENMASK(4, 2)
2974 #define PER_PAGE_SIZE		0x400
2975 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2976 	u16 eeprom_size = mt7915_eeprom_size(dev);
2977 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2978 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2979 	int eep_len;
2980 	int i;
2981 
2982 	for (i = 0; i < total; i++, eep += eep_len) {
2983 		struct sk_buff *skb;
2984 		int ret;
2985 
2986 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2987 			eep_len = eeprom_size % PER_PAGE_SIZE;
2988 		else
2989 			eep_len = PER_PAGE_SIZE;
2990 
2991 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2992 					 sizeof(req) + eep_len);
2993 		if (!skb)
2994 			return -ENOMEM;
2995 
2996 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2997 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2998 		req.len = cpu_to_le16(eep_len);
2999 
3000 		skb_put_data(skb, &req, sizeof(req));
3001 		skb_put_data(skb, eep, eep_len);
3002 
3003 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3004 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3005 		if (ret)
3006 			return ret;
3007 	}
3008 
3009 	return 0;
3010 }
3011 
3012 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3013 {
3014 	struct mt7915_mcu_eeprom req = {
3015 		.buffer_mode = EE_MODE_EFUSE,
3016 		.format = EE_FORMAT_WHOLE,
3017 	};
3018 
3019 	if (dev->flash_mode)
3020 		return mt7915_mcu_set_eeprom_flash(dev);
3021 
3022 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3023 				 &req, sizeof(req), true);
3024 }
3025 
3026 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3027 {
3028 	struct mt7915_mcu_eeprom_info req = {
3029 		.addr = cpu_to_le32(round_down(offset,
3030 				    MT7915_EEPROM_BLOCK_SIZE)),
3031 	};
3032 	struct mt7915_mcu_eeprom_info *res;
3033 	struct sk_buff *skb;
3034 	int ret;
3035 	u8 *buf;
3036 
3037 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3038 				sizeof(req), true, &skb);
3039 	if (ret)
3040 		return ret;
3041 
3042 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
3043 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3044 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
3045 	dev_kfree_skb(skb);
3046 
3047 	return 0;
3048 }
3049 
3050 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
3051 {
3052 	struct {
3053 		u8 _rsv;
3054 		u8 version;
3055 		u8 die_idx;
3056 		u8 _rsv2;
3057 	} __packed req = {
3058 		.version = 1,
3059 	};
3060 	struct sk_buff *skb;
3061 	int ret;
3062 
3063 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
3064 					sizeof(req), true, &skb);
3065 	if (ret)
3066 		return ret;
3067 
3068 	*block_num = *(u8 *)skb->data;
3069 	dev_kfree_skb(skb);
3070 
3071 	return 0;
3072 }
3073 
3074 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3075 				  u8 *data, u32 len, int cmd)
3076 {
3077 	struct {
3078 		u8 dir;
3079 		u8 valid;
3080 		__le16 bitmap;
3081 		s8 precal;
3082 		u8 action;
3083 		u8 band;
3084 		u8 idx;
3085 		u8 rsv[4];
3086 		__le32 len;
3087 	} req = {};
3088 	struct sk_buff *skb;
3089 
3090 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3091 	if (!skb)
3092 		return -ENOMEM;
3093 
3094 	req.idx = idx;
3095 	req.len = cpu_to_le32(len);
3096 	skb_put_data(skb, &req, sizeof(req));
3097 	skb_put_data(skb, data, len);
3098 
3099 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3100 }
3101 
3102 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3103 {
3104 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3105 	u32 total = MT_EE_CAL_GROUP_SIZE;
3106 
3107 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3108 		return 0;
3109 
3110 	/*
3111 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3112 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3113 	 */
3114 	while (total > 0) {
3115 		int ret, len;
3116 
3117 		len = min_t(u32, total, MT_EE_CAL_UNIT);
3118 
3119 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3120 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3121 		if (ret)
3122 			return ret;
3123 
3124 		total -= len;
3125 		cal += len;
3126 		idx++;
3127 	}
3128 
3129 	return 0;
3130 }
3131 
3132 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3133 {
3134 	int i;
3135 
3136 	for (i = 0; i < n_freqs; i++)
3137 		if (cur == freqs[i])
3138 			return i;
3139 
3140 	return -1;
3141 }
3142 
3143 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3144 {
3145 	static const u16 freq_list[] = {
3146 		5180, 5200, 5220, 5240,
3147 		5260, 5280, 5300, 5320,
3148 		5500, 5520, 5540, 5560,
3149 		5580, 5600, 5620, 5640,
3150 		5660, 5680, 5700, 5745,
3151 		5765, 5785, 5805, 5825
3152 	};
3153 	int offset_2g = ARRAY_SIZE(freq_list);
3154 	int idx;
3155 
3156 	if (freq < 4000) {
3157 		if (freq < 2432)
3158 			return offset_2g;
3159 		if (freq < 2457)
3160 			return offset_2g + 1;
3161 
3162 		return offset_2g + 2;
3163 	}
3164 
3165 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3166 		return -1;
3167 
3168 	if (bw != NL80211_CHAN_WIDTH_20) {
3169 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3170 					   freq + 10);
3171 		if (idx >= 0)
3172 			return idx;
3173 
3174 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3175 					   freq - 10);
3176 		if (idx >= 0)
3177 			return idx;
3178 	}
3179 
3180 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3181 }
3182 
3183 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3184 {
3185 	struct mt7915_dev *dev = phy->dev;
3186 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3187 	u16 total = 2, center_freq = chandef->center_freq1;
3188 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3189 	int idx;
3190 
3191 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3192 		return 0;
3193 
3194 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3195 	if (idx < 0)
3196 		return -EINVAL;
3197 
3198 	/* Items: Tx DPD, Tx Flatness */
3199 	idx = idx * 2;
3200 	cal += MT_EE_CAL_GROUP_SIZE;
3201 
3202 	while (total--) {
3203 		int ret;
3204 
3205 		cal += (idx * MT_EE_CAL_UNIT);
3206 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3207 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3208 		if (ret)
3209 			return ret;
3210 
3211 		idx++;
3212 	}
3213 
3214 	return 0;
3215 }
3216 
3217 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3218 {
3219 	/* strict order */
3220 	static const u32 offs[] = {
3221 		MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME,
3222 		MIB_BUSY_TIME_V2, MIB_TX_TIME_V2, MIB_RX_TIME_V2,
3223 		MIB_OBSS_AIRTIME_V2
3224 	};
3225 	struct mt76_channel_state *state = phy->mt76->chan_state;
3226 	struct mt76_channel_state *state_ts = &phy->state_ts;
3227 	struct mt7915_dev *dev = phy->dev;
3228 	struct mt7915_mcu_mib *res, req[4];
3229 	struct sk_buff *skb;
3230 	int i, ret, start = 0, ofs = 20;
3231 
3232 	if (!is_mt7915(&dev->mt76)) {
3233 		start = 4;
3234 		ofs = 0;
3235 	}
3236 
3237 	for (i = 0; i < 4; i++) {
3238 		req[i].band = cpu_to_le32(phy != &dev->phy);
3239 		req[i].offs = cpu_to_le32(offs[i + start]);
3240 	}
3241 
3242 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3243 					req, sizeof(req), true, &skb);
3244 	if (ret)
3245 		return ret;
3246 
3247 	res = (struct mt7915_mcu_mib *)(skb->data + ofs);
3248 
3249 	if (chan_switch)
3250 		goto out;
3251 
3252 #define __res_u64(s) le64_to_cpu(res[s].data)
3253 	state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3254 	state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3255 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3256 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3257 
3258 out:
3259 	state_ts->cc_busy = __res_u64(0);
3260 	state_ts->cc_tx = __res_u64(1);
3261 	state_ts->cc_bss_rx = __res_u64(2);
3262 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3263 #undef __res_u64
3264 
3265 	dev_kfree_skb(skb);
3266 
3267 	return 0;
3268 }
3269 
3270 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3271 {
3272 	struct mt7915_dev *dev = phy->dev;
3273 	struct {
3274 		u8 ctrl_id;
3275 		u8 action;
3276 		u8 dbdc_idx;
3277 		u8 rsv[5];
3278 	} req = {
3279 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3280 		.dbdc_idx = phy != &dev->phy,
3281 	};
3282 
3283 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3284 				 sizeof(req), true);
3285 }
3286 
3287 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3288 {
3289 	struct mt7915_dev *dev = phy->dev;
3290 	struct {
3291 		struct mt7915_mcu_thermal_ctrl ctrl;
3292 
3293 		__le32 trigger_temp;
3294 		__le32 restore_temp;
3295 		__le16 sustain_time;
3296 		u8 rsv[2];
3297 	} __packed req = {
3298 		.ctrl = {
3299 			.band_idx = phy->band_idx,
3300 		},
3301 	};
3302 	int level;
3303 
3304 	if (!state) {
3305 		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3306 		goto out;
3307 	}
3308 
3309 	/* set duty cycle and level */
3310 	for (level = 0; level < 4; level++) {
3311 		int ret;
3312 
3313 		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3314 		req.ctrl.duty.duty_level = level;
3315 		req.ctrl.duty.duty_cycle = state;
3316 		state /= 2;
3317 
3318 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3319 					&req, sizeof(req.ctrl), false);
3320 		if (ret)
3321 			return ret;
3322 	}
3323 
3324 	/* set high-temperature trigger threshold */
3325 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3326 	/* add a safety margin ~10 */
3327 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3328 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3329 	req.sustain_time = cpu_to_le16(10);
3330 
3331 out:
3332 	req.ctrl.type.protect_type = 1;
3333 	req.ctrl.type.trigger_type = 1;
3334 
3335 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3336 				 &req, sizeof(req), false);
3337 }
3338 
3339 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3340 {
3341 	struct mt7915_dev *dev = phy->dev;
3342 	struct mt76_phy *mphy = phy->mt76;
3343 	struct ieee80211_hw *hw = mphy->hw;
3344 	struct mt7915_sku_val {
3345 		u8 format_id;
3346 		u8 limit_type;
3347 		u8 dbdc_idx;
3348 		s8 val[MT7915_SKU_RATE_NUM];
3349 	} __packed req = {
3350 		.format_id = 4,
3351 		.dbdc_idx = phy != &dev->phy,
3352 	};
3353 	struct mt76_power_limits limits_array;
3354 	s8 *la = (s8 *)&limits_array;
3355 	int i, idx, n_chains = hweight8(mphy->antenna_mask);
3356 	int tx_power = hw->conf.power_level * 2;
3357 
3358 	tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan,
3359 				      tx_power);
3360 	tx_power -= mt76_tx_power_nss_delta(n_chains);
3361 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3362 					      &limits_array, tx_power);
3363 	mphy->txpower_cur = tx_power;
3364 
3365 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3366 		u8 mcs_num, len = mt7915_sku_group_len[i];
3367 		int j;
3368 
3369 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3370 			mcs_num = 10;
3371 
3372 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3373 				la = (s8 *)&limits_array + 12;
3374 		} else {
3375 			mcs_num = len;
3376 		}
3377 
3378 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3379 			req.val[idx + j] = la[j];
3380 
3381 		la += mcs_num;
3382 		idx += len;
3383 	}
3384 
3385 	return mt76_mcu_send_msg(&dev->mt76,
3386 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3387 				 sizeof(req), true);
3388 }
3389 
3390 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3391 {
3392 #define RATE_POWER_INFO	2
3393 	struct mt7915_dev *dev = phy->dev;
3394 	struct {
3395 		u8 format_id;
3396 		u8 category;
3397 		u8 band;
3398 		u8 _rsv;
3399 	} __packed req = {
3400 		.format_id = 7,
3401 		.category = RATE_POWER_INFO,
3402 		.band = phy != &dev->phy,
3403 	};
3404 	s8 res[MT7915_SKU_RATE_NUM][2];
3405 	struct sk_buff *skb;
3406 	int ret, i;
3407 
3408 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3409 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3410 					&req, sizeof(req), true, &skb);
3411 	if (ret)
3412 		return ret;
3413 
3414 	memcpy(res, skb->data + 4, sizeof(res));
3415 	for (i = 0; i < len; i++)
3416 		txpower[i] = res[i][req.band];
3417 
3418 	dev_kfree_skb(skb);
3419 
3420 	return 0;
3421 }
3422 
3423 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3424 			      u8 en)
3425 {
3426 	struct {
3427 		u8 test_mode_en;
3428 		u8 param_idx;
3429 		u8 _rsv[2];
3430 
3431 		u8 enable;
3432 		u8 _rsv2[3];
3433 
3434 		u8 pad[8];
3435 	} __packed req = {
3436 		.test_mode_en = test_mode,
3437 		.param_idx = param,
3438 		.enable = en,
3439 	};
3440 
3441 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3442 				 sizeof(req), false);
3443 }
3444 
3445 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3446 {
3447 	struct mt7915_dev *dev = phy->dev;
3448 	struct mt7915_sku {
3449 		u8 format_id;
3450 		u8 sku_enable;
3451 		u8 dbdc_idx;
3452 		u8 rsv;
3453 	} __packed req = {
3454 		.format_id = 0,
3455 		.dbdc_idx = phy != &dev->phy,
3456 		.sku_enable = enable,
3457 	};
3458 
3459 	return mt76_mcu_send_msg(&dev->mt76,
3460 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3461 				 sizeof(req), true);
3462 }
3463 
3464 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3465 {
3466 	struct {
3467 		u8 action;
3468 		u8 set;
3469 		u8 band;
3470 		u8 rsv;
3471 	} req = {
3472 		.action = action,
3473 		.set = set,
3474 		.band = band,
3475 	};
3476 
3477 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3478 				 &req, sizeof(req), false);
3479 }
3480 
3481 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3482 {
3483 	struct {
3484 		u8 action;
3485 		union {
3486 			struct {
3487 				u8 snd_mode;
3488 				u8 sta_num;
3489 				u8 rsv;
3490 				u8 wlan_idx[4];
3491 				__le32 snd_period;	/* ms */
3492 			} __packed snd;
3493 			struct {
3494 				bool ebf;
3495 				bool ibf;
3496 				u8 rsv;
3497 			} __packed type;
3498 			struct {
3499 				u8 bf_num;
3500 				u8 bf_bitmap;
3501 				u8 bf_sel[8];
3502 				u8 rsv[5];
3503 			} __packed mod;
3504 		};
3505 	} __packed req = {
3506 		.action = action,
3507 	};
3508 
3509 #define MT_BF_PROCESSING	4
3510 	switch (action) {
3511 	case MT_BF_SOUNDING_ON:
3512 		req.snd.snd_mode = MT_BF_PROCESSING;
3513 		break;
3514 	case MT_BF_TYPE_UPDATE:
3515 		req.type.ebf = true;
3516 		req.type.ibf = dev->ibf;
3517 		break;
3518 	case MT_BF_MODULE_UPDATE:
3519 		req.mod.bf_num = 2;
3520 		req.mod.bf_bitmap = GENMASK(1, 0);
3521 		break;
3522 	default:
3523 		return -EINVAL;
3524 	}
3525 
3526 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3527 				 sizeof(req), true);
3528 }
3529 
3530 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3531 			    bool enable)
3532 {
3533 #define MT_SPR_ENABLE		1
3534 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3535 	struct {
3536 		u8 action;
3537 		u8 arg_num;
3538 		u8 band_idx;
3539 		u8 status;
3540 		u8 drop_tx_idx;
3541 		u8 sta_idx;	/* 256 sta */
3542 		u8 rsv[2];
3543 		__le32 val;
3544 	} __packed req = {
3545 		.action = MT_SPR_ENABLE,
3546 		.arg_num = 1,
3547 		.band_idx = mvif->mt76.band_idx,
3548 		.val = cpu_to_le32(enable),
3549 	};
3550 
3551 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3552 				 sizeof(req), true);
3553 }
3554 
3555 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3556 			   struct ieee80211_sta *sta, struct rate_info *rate)
3557 {
3558 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3559 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3560 	struct mt7915_dev *dev = phy->dev;
3561 	struct mt76_phy *mphy = phy->mt76;
3562 	struct {
3563 		u8 category;
3564 		u8 band;
3565 		__le16 wcid;
3566 	} __packed req = {
3567 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3568 		.band = mvif->mt76.band_idx,
3569 		.wcid = cpu_to_le16(msta->wcid.idx),
3570 	};
3571 	struct ieee80211_supported_band *sband;
3572 	struct mt7915_mcu_phy_rx_info *res;
3573 	struct sk_buff *skb;
3574 	int ret;
3575 	bool cck = false;
3576 
3577 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3578 					&req, sizeof(req), true, &skb);
3579 	if (ret)
3580 		return ret;
3581 
3582 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3583 
3584 	rate->mcs = res->rate;
3585 	rate->nss = res->nsts + 1;
3586 
3587 	switch (res->mode) {
3588 	case MT_PHY_TYPE_CCK:
3589 		cck = true;
3590 		fallthrough;
3591 	case MT_PHY_TYPE_OFDM:
3592 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3593 			sband = &mphy->sband_5g.sband;
3594 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3595 			sband = &mphy->sband_6g.sband;
3596 		else
3597 			sband = &mphy->sband_2g.sband;
3598 
3599 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3600 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3601 		break;
3602 	case MT_PHY_TYPE_HT:
3603 	case MT_PHY_TYPE_HT_GF:
3604 		if (rate->mcs > 31) {
3605 			ret = -EINVAL;
3606 			goto out;
3607 		}
3608 
3609 		rate->flags = RATE_INFO_FLAGS_MCS;
3610 		if (res->gi)
3611 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3612 		break;
3613 	case MT_PHY_TYPE_VHT:
3614 		if (rate->mcs > 9) {
3615 			ret = -EINVAL;
3616 			goto out;
3617 		}
3618 
3619 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3620 		if (res->gi)
3621 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3622 		break;
3623 	case MT_PHY_TYPE_HE_SU:
3624 	case MT_PHY_TYPE_HE_EXT_SU:
3625 	case MT_PHY_TYPE_HE_TB:
3626 	case MT_PHY_TYPE_HE_MU:
3627 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3628 			ret = -EINVAL;
3629 			goto out;
3630 		}
3631 		rate->he_gi = res->gi;
3632 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3633 		break;
3634 	default:
3635 		ret = -EINVAL;
3636 		goto out;
3637 	}
3638 
3639 	switch (res->bw) {
3640 	case IEEE80211_STA_RX_BW_160:
3641 		rate->bw = RATE_INFO_BW_160;
3642 		break;
3643 	case IEEE80211_STA_RX_BW_80:
3644 		rate->bw = RATE_INFO_BW_80;
3645 		break;
3646 	case IEEE80211_STA_RX_BW_40:
3647 		rate->bw = RATE_INFO_BW_40;
3648 		break;
3649 	default:
3650 		rate->bw = RATE_INFO_BW_20;
3651 		break;
3652 	}
3653 
3654 out:
3655 	dev_kfree_skb(skb);
3656 
3657 	return ret;
3658 }
3659 
3660 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3661 				struct cfg80211_he_bss_color *he_bss_color)
3662 {
3663 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3664 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3665 	struct bss_info_color *bss_color;
3666 	struct sk_buff *skb;
3667 	struct tlv *tlv;
3668 
3669 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3670 					      NULL, len);
3671 	if (IS_ERR(skb))
3672 		return PTR_ERR(skb);
3673 
3674 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3675 				      sizeof(*bss_color));
3676 	bss_color = (struct bss_info_color *)tlv;
3677 	bss_color->disable = !he_bss_color->enabled;
3678 	bss_color->color = he_bss_color->color;
3679 
3680 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3681 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3682 }
3683 
3684 #define TWT_AGRT_TRIGGER	BIT(0)
3685 #define TWT_AGRT_ANNOUNCE	BIT(1)
3686 #define TWT_AGRT_PROTECT	BIT(2)
3687 
3688 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3689 			       struct mt7915_vif *mvif,
3690 			       struct mt7915_twt_flow *flow,
3691 			       int cmd)
3692 {
3693 	struct {
3694 		u8 tbl_idx;
3695 		u8 cmd;
3696 		u8 own_mac_idx;
3697 		u8 flowid; /* 0xff for group id */
3698 		__le16 peer_id; /* specify the peer_id (msb=0)
3699 				 * or group_id (msb=1)
3700 				 */
3701 		u8 duration; /* 256 us */
3702 		u8 bss_idx;
3703 		__le64 start_tsf;
3704 		__le16 mantissa;
3705 		u8 exponent;
3706 		u8 is_ap;
3707 		u8 agrt_params;
3708 		u8 rsv[23];
3709 	} __packed req = {
3710 		.tbl_idx = flow->table_id,
3711 		.cmd = cmd,
3712 		.own_mac_idx = mvif->mt76.omac_idx,
3713 		.flowid = flow->id,
3714 		.peer_id = cpu_to_le16(flow->wcid),
3715 		.duration = flow->duration,
3716 		.bss_idx = mvif->mt76.idx,
3717 		.start_tsf = cpu_to_le64(flow->tsf),
3718 		.mantissa = flow->mantissa,
3719 		.exponent = flow->exp,
3720 		.is_ap = true,
3721 	};
3722 
3723 	if (flow->protection)
3724 		req.agrt_params |= TWT_AGRT_PROTECT;
3725 	if (!flow->flowtype)
3726 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3727 	if (flow->trigger)
3728 		req.agrt_params |= TWT_AGRT_TRIGGER;
3729 
3730 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3731 				 &req, sizeof(req), true);
3732 }
3733 
3734 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3735 {
3736 	struct {
3737 		__le32 idx;
3738 		__le32 ofs;
3739 		__le32 data;
3740 	} __packed req = {
3741 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 28))),
3742 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(27, 0))),
3743 		.data = set ? cpu_to_le32(*val) : 0,
3744 	};
3745 	struct sk_buff *skb;
3746 	int ret;
3747 
3748 	if (set)
3749 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3750 					 &req, sizeof(req), false);
3751 
3752 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3753 					&req, sizeof(req), true, &skb);
3754 	if (ret)
3755 		return ret;
3756 
3757 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3758 	dev_kfree_skb(skb);
3759 
3760 	return 0;
3761 }
3762