drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MCU_PATCH_ADDRESS               0x200000
  68
  69 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  70 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  71 #define FW_FEATURE_OVERRIDE_ADDR        BIT(5)
  72
  73 #define DL_MODE_ENCRYPT                 BIT(0)
  74 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  75 #define DL_MODE_RESET_SEC_IV            BIT(3)
  76 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  77 #define DL_MODE_NEED_RSP                BIT(31)
  78
  79 #define FW_START_OVERRIDE               BIT(0)
  80 #define FW_START_WORKING_PDA_CR4        BIT(2)
  81
  82 #define PATCH_SEC_TYPE_MASK             GENMASK(15, 0)
  83 #define PATCH_SEC_TYPE_INFO             0x2
  84
  85 #define to_wcid_lo(id)                  FIELD_GET(GENMASK(7, 0), (u16)id)
  86 #define to_wcid_hi(id)                  FIELD_GET(GENMASK(9, 8), (u16)id)
  87
  88 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  89 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  90
  91 static enum mt7915_cipher_type
  92 mt7915_mcu_get_cipher(int cipher)
  93 {
  94         switch (cipher) {
  95         case WLAN_CIPHER_SUITE_WEP40:
  96                 return MT_CIPHER_WEP40;
  97         case WLAN_CIPHER_SUITE_WEP104:
  98                 return MT_CIPHER_WEP104;
  99         case WLAN_CIPHER_SUITE_TKIP:
 100                 return MT_CIPHER_TKIP;
 101         case WLAN_CIPHER_SUITE_AES_CMAC:
 102                 return MT_CIPHER_BIP_CMAC_128;
 103         case WLAN_CIPHER_SUITE_CCMP:
 104                 return MT_CIPHER_AES_CCMP;
 105         case WLAN_CIPHER_SUITE_CCMP_256:
 106                 return MT_CIPHER_CCMP_256;
 107         case WLAN_CIPHER_SUITE_GCMP:
 108                 return MT_CIPHER_GCMP;
 109         case WLAN_CIPHER_SUITE_GCMP_256:
 110                 return MT_CIPHER_GCMP_256;
 111         case WLAN_CIPHER_SUITE_SMS4:
 112                 return MT_CIPHER_WAPI;
 113         default:
 114                 return MT_CIPHER_NONE;
 115         }
 116 }
 117
 118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
 119 {
 120         static const u8 width_to_bw[] = {
 121                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
 122                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
 123                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
 124                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
 125                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
 126                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
 127                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
 128                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
 129         };
 130
 131         if (chandef->width >= ARRAY_SIZE(width_to_bw))
 132                 return 0;
 133
 134         return width_to_bw[chandef->width];
 135 }
 136
 137 static const struct ieee80211_sta_he_cap *
 138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
 139 {
 140         struct ieee80211_supported_band *sband;
 141         enum nl80211_band band;
 142
 143         band = phy->mt76->chandef.chan->band;
 144         sband = phy->mt76->hw->wiphy->bands[band];
 145
 146         return ieee80211_get_he_iftype_cap(sband, vif->type);
 147 }
 148
 149 static u8
 150 mt7915_get_phy_mode(struct mt76_phy *mphy, struct ieee80211_vif *vif,
 151                     struct ieee80211_sta *sta)
 152 {
 153         enum nl80211_band band = mphy->chandef.chan->band;
 154         struct ieee80211_sta_ht_cap *ht_cap;
 155         struct ieee80211_sta_vht_cap *vht_cap;
 156         const struct ieee80211_sta_he_cap *he_cap;
 157         u8 mode = 0;
 158
 159         if (sta) {
 160                 ht_cap = &sta->ht_cap;
 161                 vht_cap = &sta->vht_cap;
 162                 he_cap = &sta->he_cap;
 163         } else {
 164                 struct ieee80211_supported_band *sband;
 165
 166                 sband = mphy->hw->wiphy->bands[band];
 167
 168                 ht_cap = &sband->ht_cap;
 169                 vht_cap = &sband->vht_cap;
 170                 he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
 171         }
 172
 173         if (band == NL80211_BAND_2GHZ) {
 174                 mode |= PHY_MODE_B | PHY_MODE_G;
 175
 176                 if (ht_cap->ht_supported)
 177                         mode |= PHY_MODE_GN;
 178
 179                 if (he_cap->has_he)
 180                         mode |= PHY_MODE_AX_24G;
 181         } else if (band == NL80211_BAND_5GHZ) {
 182                 mode |= PHY_MODE_A;
 183
 184                 if (ht_cap->ht_supported)
 185                         mode |= PHY_MODE_AN;
 186
 187                 if (vht_cap->vht_supported)
 188                         mode |= PHY_MODE_AC;
 189
 190                 if (he_cap->has_he)
 191                         mode |= PHY_MODE_AX_5G;
 192         }
 193
 194         return mode;
 195 }
 196
 197 static u8
 198 mt7915_mcu_get_sta_nss(u16 mcs_map)
 199 {
 200         u8 nss;
 201
 202         for (nss = 8; nss > 0; nss--) {
 203                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
 204
 205                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 206                         break;
 207         }
 208
 209         return nss - 1;
 210 }
 211
 212 static int
 213 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 214                           struct sk_buff *skb, int seq)
 215 {
 216         struct mt7915_mcu_rxd *rxd;
 217         int ret = 0;
 218
 219         if (!skb) {
 220                 dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
 221                         cmd, seq);
 222                 return -ETIMEDOUT;
 223         }
 224
 225         rxd = (struct mt7915_mcu_rxd *)skb->data;
 226         if (seq != rxd->seq)
 227                 return -EAGAIN;
 228
 229         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 230                 skb_pull(skb, sizeof(*rxd) - 4);
 231                 ret = *skb->data;
 232         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 233                 skb_pull(skb, sizeof(*rxd) + 4);
 234                 ret = le32_to_cpu(*(__le32 *)skb->data);
 235         } else {
 236                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 237         }
 238
 239         return ret;
 240 }
 241
 242 static int
 243 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 244                         int cmd, int *wait_seq)
 245 {
 246         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 247         struct mt7915_mcu_txd *mcu_txd;
 248         enum mt76_mcuq_id qid;
 249         __le32 *txd;
 250         u32 val;
 251         u8 seq;
 252
 253         /* TODO: make dynamic based on msg type */
 254         mdev->mcu.timeout = 20 * HZ;
 255
 256         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 257         if (!seq)
 258                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 259
 260         if (cmd == MCU_CMD(FW_SCATTER)) {
 261                 qid = MT_MCUQ_FWDL;
 262                 goto exit;
 263         }
 264
 265         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 266         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 267                 qid = MT_MCUQ_WA;
 268         else
 269                 qid = MT_MCUQ_WM;
 270
 271         txd = mcu_txd->txd;
 272
 273         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 274               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 275               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 276         txd[0] = cpu_to_le32(val);
 277
 278         val = MT_TXD1_LONG_FORMAT |
 279               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 280         txd[1] = cpu_to_le32(val);
 281
 282         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 283         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 284                                                MT_TX_MCU_PORT_RX_Q0));
 285         mcu_txd->pkt_type = MCU_PKT_ID;
 286         mcu_txd->seq = seq;
 287
 288         mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 289         mcu_txd->set_query = MCU_Q_NA;
 290         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 291         if (mcu_txd->ext_cid) {
 292                 mcu_txd->ext_cid_ack = 1;
 293
 294                 /* do not use Q_SET for efuse */
 295                 if (cmd & __MCU_CMD_FIELD_QUERY)
 296                         mcu_txd->set_query = MCU_Q_QUERY;
 297                 else
 298                         mcu_txd->set_query = MCU_Q_SET;
 299         }
 300
 301         if (cmd & __MCU_CMD_FIELD_WA)
 302                 mcu_txd->s2d_index = MCU_S2D_H2C;
 303         else
 304                 mcu_txd->s2d_index = MCU_S2D_H2N;
 305
 306 exit:
 307         if (wait_seq)
 308                 *wait_seq = seq;
 309
 310         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
 311 }
 312
 313 static void
 314 mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
 315 {
 316         struct {
 317                 __le32 args[3];
 318         } req = {
 319                 .args = {
 320                         cpu_to_le32(a1),
 321                         cpu_to_le32(a2),
 322                         cpu_to_le32(a3),
 323                 },
 324         };
 325
 326         mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
 327 }
 328
 329 static void
 330 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 331 {
 332         if (vif->csa_active)
 333                 ieee80211_csa_finish(vif);
 334 }
 335
 336 static void
 337 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 338 {
 339         struct mt76_phy *mphy = &dev->mt76.phy;
 340         struct mt7915_mcu_csa_notify *c;
 341
 342         c = (struct mt7915_mcu_csa_notify *)skb->data;
 343
 344         if (c->band_idx && dev->mt76.phy2)
 345                 mphy = dev->mt76.phy2;
 346
 347         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 348                         IEEE80211_IFACE_ITER_RESUME_ALL,
 349                         mt7915_mcu_csa_finish, mphy->hw);
 350 }
 351
 352 static void
 353 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 354 {
 355         struct mt76_phy *mphy = &dev->mt76.phy;
 356         struct mt7915_mcu_rdd_report *r;
 357
 358         r = (struct mt7915_mcu_rdd_report *)skb->data;
 359
 360         if (r->band_idx && dev->mt76.phy2)
 361                 mphy = dev->mt76.phy2;
 362
 363         ieee80211_radar_detected(mphy->hw);
 364         dev->hw_pattern++;
 365 }
 366
 367 static int
 368 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
 369                          struct rate_info *rate, u16 r)
 370 {
 371         struct ieee80211_supported_band *sband;
 372         u16 ru_idx = le16_to_cpu(ra->ru_idx);
 373         bool cck = false;
 374
 375         rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
 376         rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
 377
 378         switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
 379         case MT_PHY_TYPE_CCK:
 380                 cck = true;
 381                 fallthrough;
 382         case MT_PHY_TYPE_OFDM:
 383                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
 384                         sband = &mphy->sband_5g.sband;
 385                 else
 386                         sband = &mphy->sband_2g.sband;
 387
 388                 rate->mcs = mt76_get_rate(mphy->dev, sband, rate->mcs, cck);
 389                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
 390                 break;
 391         case MT_PHY_TYPE_HT:
 392         case MT_PHY_TYPE_HT_GF:
 393                 rate->mcs += (rate->nss - 1) * 8;
 394                 if (rate->mcs > 31)
 395                         return -EINVAL;
 396
 397                 rate->flags = RATE_INFO_FLAGS_MCS;
 398                 if (ra->gi)
 399                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
 400                 break;
 401         case MT_PHY_TYPE_VHT:
 402                 if (rate->mcs > 9)
 403                         return -EINVAL;
 404
 405                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
 406                 if (ra->gi)
 407                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
 408                 break;
 409         case MT_PHY_TYPE_HE_SU:
 410         case MT_PHY_TYPE_HE_EXT_SU:
 411         case MT_PHY_TYPE_HE_TB:
 412         case MT_PHY_TYPE_HE_MU:
 413                 if (ra->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11)
 414                         return -EINVAL;
 415
 416                 rate->he_gi = ra->gi;
 417                 rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
 418                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
 419                 break;
 420         default:
 421                 return -EINVAL;
 422         }
 423
 424         if (ru_idx) {
 425                 switch (ru_idx) {
 426                 case 1 ... 2:
 427                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
 428                         break;
 429                 case 3 ... 6:
 430                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
 431                         break;
 432                 case 7 ... 14:
 433                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
 434                         break;
 435                 default:
 436                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
 437                         break;
 438                 }
 439                 rate->bw = RATE_INFO_BW_HE_RU;
 440         } else {
 441                 u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
 442                         FIELD_GET(MT_RA_RATE_BW, r);
 443
 444                 switch (bw) {
 445                 case IEEE80211_STA_RX_BW_160:
 446                         rate->bw = RATE_INFO_BW_160;
 447                         break;
 448                 case IEEE80211_STA_RX_BW_80:
 449                         rate->bw = RATE_INFO_BW_80;
 450                         break;
 451                 case IEEE80211_STA_RX_BW_40:
 452                         rate->bw = RATE_INFO_BW_40;
 453                         break;
 454                 default:
 455                         rate->bw = RATE_INFO_BW_20;
 456                         break;
 457                 }
 458         }
 459
 460         return 0;
 461 }
 462
 463 static void
 464 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
 465 {
 466         struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
 467         struct rate_info rate = {}, prob_rate = {};
 468         u16 probe = le16_to_cpu(ra->prob_up_rate);
 469         u16 attempts = le16_to_cpu(ra->attempts);
 470         u16 curr = le16_to_cpu(ra->curr_rate);
 471         u16 wcidx = le16_to_cpu(ra->wlan_idx);
 472         struct mt76_phy *mphy = &dev->mphy;
 473         struct mt7915_sta_stats *stats;
 474         struct mt7915_sta *msta;
 475         struct mt76_wcid *wcid;
 476
 477         if (wcidx >= MT76_N_WCIDS)
 478                 return;
 479
 480         wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
 481         if (!wcid)
 482                 return;
 483
 484         msta = container_of(wcid, struct mt7915_sta, wcid);
 485         stats = &msta->stats;
 486
 487         if (msta->wcid.ext_phy && dev->mt76.phy2)
 488                 mphy = dev->mt76.phy2;
 489
 490         /* current rate */
 491         if (!mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr))
 492                 stats->tx_rate = rate;
 493
 494         /* probing rate */
 495         if (!mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe))
 496                 stats->prob_rate = prob_rate;
 497
 498         if (attempts) {
 499                 u16 success = le16_to_cpu(ra->success);
 500
 501                 stats->per = 1000 * (attempts - success) / attempts;
 502         }
 503 }
 504
 505 static void
 506 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 507 {
 508         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 509         const char *data = (char *)&rxd[1];
 510         const char *type;
 511
 512         switch (rxd->s2d_index) {
 513         case 0:
 514                 type = "WM";
 515                 break;
 516         case 2:
 517                 type = "WA";
 518                 break;
 519         default:
 520                 type = "unknown";
 521                 break;
 522         }
 523
 524         wiphy_info(mt76_hw(dev)->wiphy, "%s: %*s", type,
 525                    (int)(skb->len - sizeof(*rxd)), data);
 526 }
 527
 528 static void
 529 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 530 {
 531         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 532
 533         switch (rxd->ext_eid) {
 534         case MCU_EXT_EVENT_RDD_REPORT:
 535                 mt7915_mcu_rx_radar_detected(dev, skb);
 536                 break;
 537         case MCU_EXT_EVENT_CSA_NOTIFY:
 538                 mt7915_mcu_rx_csa_notify(dev, skb);
 539                 break;
 540         case MCU_EXT_EVENT_RATE_REPORT:
 541                 mt7915_mcu_tx_rate_report(dev, skb);
 542                 break;
 543         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 544                 mt7915_mcu_rx_log_message(dev, skb);
 545                 break;
 546         default:
 547                 break;
 548         }
 549 }
 550
 551 static void
 552 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 553 {
 554         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 555
 556         switch (rxd->eid) {
 557         case MCU_EVENT_EXT:
 558                 mt7915_mcu_rx_ext_event(dev, skb);
 559                 break;
 560         default:
 561                 break;
 562         }
 563         dev_kfree_skb(skb);
 564 }
 565
 566 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 567 {
 568         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 569
 570         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 571             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 572             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 573             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 574             rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 575             !rxd->seq)
 576                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 577         else
 578                 mt76_mcu_rx_event(&dev->mt76, skb);
 579 }
 580
 581 static struct sk_buff *
 582 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
 583                          struct mt7915_sta *msta, int len)
 584 {
 585         struct sta_req_hdr hdr = {
 586                 .bss_idx = mvif->idx,
 587                 .wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
 588                 .wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
 589                 .muar_idx = msta ? mvif->omac_idx : 0,
 590                 .is_tlv_append = 1,
 591         };
 592         struct sk_buff *skb;
 593
 594         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
 595         if (!skb)
 596                 return ERR_PTR(-ENOMEM);
 597
 598         skb_put_data(skb, &hdr, sizeof(hdr));
 599
 600         return skb;
 601 }
 602
 603 static struct wtbl_req_hdr *
 604 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
 605                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 606 {
 607         struct tlv *sta_hdr = sta_wtbl;
 608         struct wtbl_req_hdr hdr = {
 609                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
 610                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
 611                 .operation = cmd,
 612         };
 613         struct sk_buff *nskb = *skb;
 614
 615         if (!nskb) {
 616                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 617                                           MT7915_WTBL_UPDATE_MAX_SIZE);
 618                 if (!nskb)
 619                         return ERR_PTR(-ENOMEM);
 620
 621                 *skb = nskb;
 622         }
 623
 624         if (sta_hdr)
 625                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 626
 627         return skb_put_data(nskb, &hdr, sizeof(hdr));
 628 }
 629
 630 static struct tlv *
 631 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 632                           void *sta_ntlv, void *sta_wtbl)
 633 {
 634         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 635         struct tlv *sta_hdr = sta_wtbl;
 636         struct tlv *ptlv, tlv = {
 637                 .tag = cpu_to_le16(tag),
 638                 .len = cpu_to_le16(len),
 639         };
 640         u16 ntlv;
 641
 642         ptlv = skb_put(skb, len);
 643         memcpy(ptlv, &tlv, sizeof(tlv));
 644
 645         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 646         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 647
 648         if (sta_hdr) {
 649                 u16 size = le16_to_cpu(sta_hdr->len);
 650
 651                 sta_hdr->len = cpu_to_le16(size + len);
 652         }
 653
 654         return ptlv;
 655 }
 656
 657 static struct tlv *
 658 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 659 {
 660         return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 661 }
 662
 663 static struct tlv *
 664 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 665                              __le16 *sub_ntlv, __le16 *len)
 666 {
 667         struct tlv *ptlv, tlv = {
 668                 .tag = cpu_to_le16(sub_tag),
 669                 .len = cpu_to_le16(sub_len),
 670         };
 671
 672         ptlv = skb_put(skb, sub_len);
 673         memcpy(ptlv, &tlv, sizeof(tlv));
 674
 675         le16_add_cpu(sub_ntlv, 1);
 676         le16_add_cpu(len, sub_len);
 677
 678         return ptlv;
 679 }
 680
 681 /** bss info **/
 682 static int
 683 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 684                          struct mt7915_phy *phy, bool enable)
 685 {
 686         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 687         struct bss_info_basic *bss;
 688         u16 wlan_idx = mvif->sta.wcid.idx;
 689         u32 type = NETWORK_INFRA;
 690         struct tlv *tlv;
 691
 692         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 693
 694         switch (vif->type) {
 695         case NL80211_IFTYPE_MESH_POINT:
 696         case NL80211_IFTYPE_AP:
 697         case NL80211_IFTYPE_MONITOR:
 698                 break;
 699         case NL80211_IFTYPE_STATION:
 700                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 701                 if (enable) {
 702                         struct ieee80211_sta *sta;
 703                         struct mt7915_sta *msta;
 704
 705                         rcu_read_lock();
 706                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 707                         if (!sta) {
 708                                 rcu_read_unlock();
 709                                 return -EINVAL;
 710                         }
 711
 712                         msta = (struct mt7915_sta *)sta->drv_priv;
 713                         wlan_idx = msta->wcid.idx;
 714                         rcu_read_unlock();
 715                 }
 716                 break;
 717         case NL80211_IFTYPE_ADHOC:
 718                 type = NETWORK_IBSS;
 719                 break;
 720         default:
 721                 WARN_ON(1);
 722                 break;
 723         }
 724
 725         bss = (struct bss_info_basic *)tlv;
 726         bss->network_type = cpu_to_le32(type);
 727         bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
 728         bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
 729         bss->wmm_idx = mvif->wmm_idx;
 730         bss->active = enable;
 731
 732         if (vif->type != NL80211_IFTYPE_MONITOR) {
 733                 memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 734                 bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 735                 bss->dtim_period = vif->bss_conf.dtim_period;
 736                 bss->phy_mode = mt7915_get_phy_mode(phy->mt76, vif, NULL);
 737         } else {
 738                 memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
 739         }
 740
 741         return 0;
 742 }
 743
 744 static void
 745 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 746 {
 747         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 748         struct bss_info_omac *omac;
 749         struct tlv *tlv;
 750         u32 type = 0;
 751         u8 idx;
 752
 753         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 754
 755         switch (vif->type) {
 756         case NL80211_IFTYPE_MONITOR:
 757         case NL80211_IFTYPE_MESH_POINT:
 758         case NL80211_IFTYPE_AP:
 759                 type = CONNECTION_INFRA_AP;
 760                 break;
 761         case NL80211_IFTYPE_STATION:
 762                 type = CONNECTION_INFRA_STA;
 763                 break;
 764         case NL80211_IFTYPE_ADHOC:
 765                 type = CONNECTION_IBSS_ADHOC;
 766                 break;
 767         default:
 768                 WARN_ON(1);
 769                 break;
 770         }
 771
 772         omac = (struct bss_info_omac *)tlv;
 773         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 774         omac->conn_type = cpu_to_le32(type);
 775         omac->omac_idx = mvif->omac_idx;
 776         omac->band_idx = mvif->band_idx;
 777         omac->hw_bss_idx = idx;
 778 }
 779
 780 struct mt7915_he_obss_narrow_bw_ru_data {
 781         bool tolerated;
 782 };
 783
 784 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 785                                                    struct cfg80211_bss *bss,
 786                                                    void *_data)
 787 {
 788         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 789         const struct element *elem;
 790
 791         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 792
 793         if (!elem || elem->datalen < 10 ||
 794             !(elem->data[10] &
 795               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 796                 data->tolerated = false;
 797 }
 798
 799 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 800                                               struct ieee80211_vif *vif)
 801 {
 802         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 803                 .tolerated = true,
 804         };
 805
 806         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 807                 return false;
 808
 809         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 810                           mt7915_check_he_obss_narrow_bw_ru_iter,
 811                           &iter_data);
 812
 813         /*
 814          * If there is at least one AP on radar channel that cannot
 815          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 816          */
 817         return !iter_data.tolerated;
 818 }
 819
 820 static void
 821 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 822                         struct mt7915_phy *phy)
 823 {
 824         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 825         struct bss_info_rf_ch *ch;
 826         struct tlv *tlv;
 827         int freq1 = chandef->center_freq1;
 828
 829         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 830
 831         ch = (struct bss_info_rf_ch *)tlv;
 832         ch->pri_ch = chandef->chan->hw_value;
 833         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 834         ch->bw = mt7915_mcu_chan_bw(chandef);
 835
 836         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 837                 int freq2 = chandef->center_freq2;
 838
 839                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 840         }
 841
 842         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 843                 struct mt7915_dev *dev = phy->dev;
 844                 struct mt76_phy *mphy = &dev->mt76.phy;
 845                 bool ext_phy = phy != &dev->phy;
 846
 847                 if (ext_phy && dev->mt76.phy2)
 848                         mphy = dev->mt76.phy2;
 849
 850                 ch->he_ru26_block =
 851                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 852                 ch->he_all_disable = false;
 853         } else {
 854                 ch->he_all_disable = true;
 855         }
 856 }
 857
 858 static void
 859 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 860                       struct mt7915_phy *phy)
 861 {
 862         int max_nss = hweight8(phy->mt76->chainmask);
 863         struct bss_info_ra *ra;
 864         struct tlv *tlv;
 865
 866         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 867
 868         ra = (struct bss_info_ra *)tlv;
 869         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 870         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 871         ra->short_preamble = true;
 872         ra->tx_streams = max_nss;
 873         ra->rx_streams = max_nss;
 874         ra->algo = 4;
 875         ra->train_up_rule = 2;
 876         ra->train_up_high_thres = 110;
 877         ra->train_up_rule_rssi = -70;
 878         ra->low_traffic_thres = 2;
 879         ra->phy_cap = cpu_to_le32(0xfdf);
 880         ra->interval = cpu_to_le32(500);
 881         ra->fast_interval = cpu_to_le32(100);
 882 }
 883
 884 static void
 885 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 886                       struct mt7915_phy *phy)
 887 {
 888 #define DEFAULT_HE_PE_DURATION          4
 889 #define DEFAULT_HE_DURATION_RTS_THRES   1023
 890         const struct ieee80211_sta_he_cap *cap;
 891         struct bss_info_he *he;
 892         struct tlv *tlv;
 893
 894         cap = mt7915_get_he_phy_cap(phy, vif);
 895
 896         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 897
 898         he = (struct bss_info_he *)tlv;
 899         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
 900         if (!he->he_pe_duration)
 901                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 902
 903         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
 904         if (!he->he_rts_thres)
 905                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 906
 907         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 908         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 909         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 910 }
 911
 912 static void
 913 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
 914 {
 915 #define TXD_CMP_MAP1            GENMASK(15, 0)
 916 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
 917         struct bss_info_hw_amsdu *amsdu;
 918         struct tlv *tlv;
 919
 920         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
 921
 922         amsdu = (struct bss_info_hw_amsdu *)tlv;
 923         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
 924         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
 925         amsdu->trig_thres = cpu_to_le16(2);
 926         amsdu->enable = true;
 927 }
 928
 929 static void
 930 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
 931 {
 932 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 933 #define BCN_TX_ESTIMATE_TIME    (4096 + 20)
 934         struct bss_info_ext_bss *ext;
 935         int ext_bss_idx, tsf_offset;
 936         struct tlv *tlv;
 937
 938         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 939         if (ext_bss_idx < 0)
 940                 return;
 941
 942         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 943
 944         ext = (struct bss_info_ext_bss *)tlv;
 945         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 946         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 947 }
 948
 949 static void
 950 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
 951 {
 952         struct bss_info_bmc_rate *bmc;
 953         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 954         enum nl80211_band band = chandef->chan->band;
 955         struct tlv *tlv;
 956
 957         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
 958
 959         bmc = (struct bss_info_bmc_rate *)tlv;
 960         if (band == NL80211_BAND_2GHZ) {
 961                 bmc->short_preamble = true;
 962         } else {
 963                 bmc->bc_trans = cpu_to_le16(0x2000);
 964                 bmc->mc_trans = cpu_to_le16(0x2080);
 965         }
 966 }
 967
 968 static int
 969 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
 970                        bool bssid, bool enable)
 971 {
 972         struct mt7915_dev *dev = phy->dev;
 973         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 974         u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
 975         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
 976         const u8 *addr = vif->addr;
 977         struct {
 978                 u8 mode;
 979                 u8 force_clear;
 980                 u8 clear_bitmap[8];
 981                 u8 entry_count;
 982                 u8 write;
 983                 u8 band;
 984
 985                 u8 index;
 986                 u8 bssid;
 987                 u8 addr[ETH_ALEN];
 988         } __packed req = {
 989                 .mode = !!mask || enable,
 990                 .entry_count = 1,
 991                 .write = 1,
 992                 .band = phy != &dev->phy,
 993                 .index = idx * 2 + bssid,
 994         };
 995
 996         if (bssid)
 997                 addr = vif->bss_conf.bssid;
 998
 999         if (enable)
1000                 ether_addr_copy(req.addr, addr);
1001
1002         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
1003                                  sizeof(req), true);
1004 }
1005
1006 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1007                             struct ieee80211_vif *vif, int enable)
1008 {
1009         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1010         struct sk_buff *skb;
1011
1012         if (mvif->omac_idx >= REPEATER_BSSID_START) {
1013                 mt7915_mcu_muar_config(phy, vif, false, enable);
1014                 mt7915_mcu_muar_config(phy, vif, true, enable);
1015         }
1016
1017         skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1018                                        MT7915_BSS_UPDATE_MAX_SIZE);
1019         if (IS_ERR(skb))
1020                 return PTR_ERR(skb);
1021
1022         /* bss_omac must be first */
1023         if (enable)
1024                 mt7915_mcu_bss_omac_tlv(skb, vif);
1025
1026         mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1027
1028         if (vif->type == NL80211_IFTYPE_MONITOR)
1029                 goto out;
1030
1031         if (enable) {
1032                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1033                 mt7915_mcu_bss_bmc_tlv(skb, phy);
1034                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1035                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
1036
1037                 if (vif->bss_conf.he_support)
1038                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
1039
1040                 if (mvif->omac_idx >= EXT_BSSID_START &&
1041                     mvif->omac_idx < REPEATER_BSSID_START)
1042                         mt7915_mcu_bss_ext_tlv(skb, mvif);
1043         }
1044 out:
1045         return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1046                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1047 }
1048
1049 /** starec & wtbl **/
1050 static int
1051 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1052                        struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1053 {
1054         struct mt7915_sta_key_conf *bip = &msta->bip;
1055         struct sta_rec_sec *sec;
1056         struct tlv *tlv;
1057         u32 len = sizeof(*sec);
1058
1059         tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1060
1061         sec = (struct sta_rec_sec *)tlv;
1062         sec->add = cmd;
1063
1064         if (cmd == SET_KEY) {
1065                 struct sec_key *sec_key;
1066                 u8 cipher;
1067
1068                 cipher = mt7915_mcu_get_cipher(key->cipher);
1069                 if (cipher == MT_CIPHER_NONE)
1070                         return -EOPNOTSUPP;
1071
1072                 sec_key = &sec->key[0];
1073                 sec_key->cipher_len = sizeof(*sec_key);
1074
1075                 if (cipher == MT_CIPHER_BIP_CMAC_128) {
1076                         sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1077                         sec_key->key_id = bip->keyidx;
1078                         sec_key->key_len = 16;
1079                         memcpy(sec_key->key, bip->key, 16);
1080
1081                         sec_key = &sec->key[1];
1082                         sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1083                         sec_key->cipher_len = sizeof(*sec_key);
1084                         sec_key->key_len = 16;
1085                         memcpy(sec_key->key, key->key, 16);
1086
1087                         sec->n_cipher = 2;
1088                 } else {
1089                         sec_key->cipher_id = cipher;
1090                         sec_key->key_id = key->keyidx;
1091                         sec_key->key_len = key->keylen;
1092                         memcpy(sec_key->key, key->key, key->keylen);
1093
1094                         if (cipher == MT_CIPHER_TKIP) {
1095                                 /* Rx/Tx MIC keys are swapped */
1096                                 memcpy(sec_key->key + 16, key->key + 24, 8);
1097                                 memcpy(sec_key->key + 24, key->key + 16, 8);
1098                         }
1099
1100                         /* store key_conf for BIP batch update */
1101                         if (cipher == MT_CIPHER_AES_CCMP) {
1102                                 memcpy(bip->key, key->key, key->keylen);
1103                                 bip->keyidx = key->keyidx;
1104                         }
1105
1106                         len -= sizeof(*sec_key);
1107                         sec->n_cipher = 1;
1108                 }
1109         } else {
1110                 len -= sizeof(sec->key);
1111                 sec->n_cipher = 0;
1112         }
1113         sec->len = cpu_to_le16(len);
1114
1115         return 0;
1116 }
1117
1118 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1119                        struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1120                        enum set_key_cmd cmd)
1121 {
1122         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1123         struct sk_buff *skb;
1124         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1125         int ret;
1126
1127         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1128         if (IS_ERR(skb))
1129                 return PTR_ERR(skb);
1130
1131         ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1132         if (ret)
1133                 return ret;
1134
1135         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1136                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1137 }
1138
1139 static void
1140 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1141                       struct ieee80211_ampdu_params *params,
1142                       bool enable, bool tx)
1143 {
1144         struct sta_rec_ba *ba;
1145         struct tlv *tlv;
1146
1147         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1148
1149         ba = (struct sta_rec_ba *)tlv;
1150         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1151         ba->winsize = cpu_to_le16(params->buf_size);
1152         ba->ssn = cpu_to_le16(params->ssn);
1153         ba->ba_en = enable << params->tid;
1154         ba->amsdu = params->amsdu;
1155         ba->tid = params->tid;
1156 }
1157
1158 static void
1159 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1160                        struct ieee80211_ampdu_params *params,
1161                        bool enable, bool tx, void *sta_wtbl,
1162                        void *wtbl_tlv)
1163 {
1164         struct wtbl_ba *ba;
1165         struct tlv *tlv;
1166
1167         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1168                                         wtbl_tlv, sta_wtbl);
1169
1170         ba = (struct wtbl_ba *)tlv;
1171         ba->tid = params->tid;
1172
1173         if (tx) {
1174                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1175                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1176                 ba->ba_en = enable;
1177         } else {
1178                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1179                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1180                 ba->rst_ba_tid = params->tid;
1181                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1182                 ba->rst_ba_sb = 1;
1183         }
1184
1185         if (enable && tx)
1186                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1187 }
1188
1189 static int
1190 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1191                   struct ieee80211_ampdu_params *params,
1192                   bool enable, bool tx)
1193 {
1194         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1195         struct mt7915_vif *mvif = msta->vif;
1196         struct wtbl_req_hdr *wtbl_hdr;
1197         struct tlv *sta_wtbl;
1198         struct sk_buff *skb;
1199         int ret;
1200
1201         if (enable && tx && !params->amsdu)
1202                 msta->wcid.amsdu = false;
1203
1204         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1205                                        MT7915_STA_UPDATE_MAX_SIZE);
1206         if (IS_ERR(skb))
1207                 return PTR_ERR(skb);
1208
1209         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1210
1211         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1212                                              &skb);
1213         if (IS_ERR(wtbl_hdr))
1214                 return PTR_ERR(wtbl_hdr);
1215
1216         mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1217
1218         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1219                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1220         if (ret)
1221                 return ret;
1222
1223         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1224                                        MT7915_STA_UPDATE_MAX_SIZE);
1225         if (IS_ERR(skb))
1226                 return PTR_ERR(skb);
1227
1228         mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1229
1230         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1231                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1232 }
1233
1234 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1235                          struct ieee80211_ampdu_params *params,
1236                          bool enable)
1237 {
1238         return mt7915_mcu_sta_ba(dev, params, enable, true);
1239 }
1240
1241 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1242                          struct ieee80211_ampdu_params *params,
1243                          bool enable)
1244 {
1245         return mt7915_mcu_sta_ba(dev, params, enable, false);
1246 }
1247
1248 static void
1249 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1250                             struct ieee80211_sta *sta, void *sta_wtbl,
1251                             void *wtbl_tlv)
1252 {
1253         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1254         struct wtbl_generic *generic;
1255         struct wtbl_rx *rx;
1256         struct tlv *tlv;
1257
1258         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1259                                         wtbl_tlv, sta_wtbl);
1260
1261         generic = (struct wtbl_generic *)tlv;
1262
1263         if (sta) {
1264                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1265                 generic->partial_aid = cpu_to_le16(sta->aid);
1266                 generic->muar_idx = mvif->omac_idx;
1267                 generic->qos = sta->wme;
1268         } else {
1269                 /* use BSSID in station mode */
1270                 if (vif->type == NL80211_IFTYPE_STATION)
1271                         memcpy(generic->peer_addr, vif->bss_conf.bssid,
1272                                ETH_ALEN);
1273                 else
1274                         eth_broadcast_addr(generic->peer_addr);
1275
1276                 generic->muar_idx = 0xe;
1277         }
1278
1279         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1280                                         wtbl_tlv, sta_wtbl);
1281
1282         rx = (struct wtbl_rx *)tlv;
1283         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1284         rx->rca2 = 1;
1285         rx->rv = 1;
1286 }
1287
1288 static void
1289 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1290                          struct ieee80211_sta *sta, bool enable)
1291 {
1292 #define EXTRA_INFO_VER          BIT(0)
1293 #define EXTRA_INFO_NEW          BIT(1)
1294         struct sta_rec_basic *basic;
1295         struct tlv *tlv;
1296
1297         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1298
1299         basic = (struct sta_rec_basic *)tlv;
1300         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1301
1302         if (enable) {
1303                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1304                 basic->conn_state = CONN_STATE_PORT_SECURE;
1305         } else {
1306                 basic->conn_state = CONN_STATE_DISCONNECT;
1307         }
1308
1309         if (!sta) {
1310                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1311                 eth_broadcast_addr(basic->peer_addr);
1312                 return;
1313         }
1314
1315         switch (vif->type) {
1316         case NL80211_IFTYPE_MESH_POINT:
1317         case NL80211_IFTYPE_AP:
1318                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1319                 break;
1320         case NL80211_IFTYPE_STATION:
1321                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1322                 break;
1323         case NL80211_IFTYPE_ADHOC:
1324                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1325                 break;
1326         default:
1327                 WARN_ON(1);
1328                 break;
1329         }
1330
1331         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1332         basic->aid = cpu_to_le16(sta->aid);
1333         basic->qos = sta->wme;
1334 }
1335
1336 static void
1337 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1338 {
1339         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1340         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1341         struct sta_rec_he *he;
1342         struct tlv *tlv;
1343         u32 cap = 0;
1344
1345         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1346
1347         he = (struct sta_rec_he *)tlv;
1348
1349         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1350                 cap |= STA_REC_HE_CAP_HTC;
1351
1352         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1353                 cap |= STA_REC_HE_CAP_BSR;
1354
1355         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1356                 cap |= STA_REC_HE_CAP_OM;
1357
1358         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1359                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1360
1361         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1362                 cap |= STA_REC_HE_CAP_BQR;
1363
1364         if (elem->phy_cap_info[0] &
1365             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1366              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1367                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1368
1369         if (elem->phy_cap_info[1] &
1370             IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1371                 cap |= STA_REC_HE_CAP_LDPC;
1372
1373         if (elem->phy_cap_info[1] &
1374             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1375                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1376
1377         if (elem->phy_cap_info[2] &
1378             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1379                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1380
1381         if (elem->phy_cap_info[2] &
1382             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1383                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1384
1385         if (elem->phy_cap_info[2] &
1386             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1387                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1388
1389         if (elem->phy_cap_info[6] &
1390             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1391                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1392
1393         if (elem->phy_cap_info[7] &
1394             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1395                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1396
1397         if (elem->phy_cap_info[7] &
1398             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1399                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1400
1401         if (elem->phy_cap_info[7] &
1402             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1403                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1404
1405         if (elem->phy_cap_info[8] &
1406             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1407                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1408
1409         if (elem->phy_cap_info[8] &
1410             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1411                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1412
1413         if (elem->phy_cap_info[9] &
1414             IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1415                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1416
1417         if (elem->phy_cap_info[9] &
1418             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1419                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1420
1421         if (elem->phy_cap_info[9] &
1422             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1423                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1424
1425         he->he_cap = cpu_to_le32(cap);
1426
1427         switch (sta->bandwidth) {
1428         case IEEE80211_STA_RX_BW_160:
1429                 if (elem->phy_cap_info[0] &
1430                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1431                         he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1432                                 he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1433
1434                 he->max_nss_mcs[CMD_HE_MCS_BW160] =
1435                                 he_cap->he_mcs_nss_supp.rx_mcs_160;
1436                 fallthrough;
1437         default:
1438                 he->max_nss_mcs[CMD_HE_MCS_BW80] =
1439                                 he_cap->he_mcs_nss_supp.rx_mcs_80;
1440                 break;
1441         }
1442
1443         he->t_frame_dur =
1444                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1445         he->max_ampdu_exp =
1446                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1447
1448         he->bw_set =
1449                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1450         he->device_class =
1451                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1452         he->punc_pream_rx =
1453                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1454
1455         he->dcm_tx_mode =
1456                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1457         he->dcm_tx_max_nss =
1458                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1459         he->dcm_rx_mode =
1460                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1461         he->dcm_rx_max_nss =
1462                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1463         he->dcm_rx_max_nss =
1464                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1465
1466         he->pkt_ext = 2;
1467 }
1468
1469 static void
1470 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1471                      struct ieee80211_vif *vif)
1472 {
1473         struct sta_rec_uapsd *uapsd;
1474         struct tlv *tlv;
1475
1476         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1477                 return;
1478
1479         tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1480         uapsd = (struct sta_rec_uapsd *)tlv;
1481
1482         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1483                 uapsd->dac_map |= BIT(3);
1484                 uapsd->tac_map |= BIT(3);
1485         }
1486         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1487                 uapsd->dac_map |= BIT(2);
1488                 uapsd->tac_map |= BIT(2);
1489         }
1490         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1491                 uapsd->dac_map |= BIT(1);
1492                 uapsd->tac_map |= BIT(1);
1493         }
1494         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1495                 uapsd->dac_map |= BIT(0);
1496                 uapsd->tac_map |= BIT(0);
1497         }
1498         uapsd->max_sp = sta->max_sp;
1499 }
1500
1501 static void
1502 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1503 {
1504         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1505         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1506         struct sta_rec_muru *muru;
1507         struct tlv *tlv;
1508
1509         tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1510
1511         muru = (struct sta_rec_muru *)tlv;
1512         muru->cfg.ofdma_dl_en = true;
1513         muru->cfg.mimo_dl_en = true;
1514
1515         muru->ofdma_dl.punc_pream_rx =
1516                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1517         muru->ofdma_dl.he_20m_in_40m_2g =
1518                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1519         muru->ofdma_dl.he_20m_in_160m =
1520                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1521         muru->ofdma_dl.he_80m_in_160m =
1522                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1523         muru->ofdma_dl.lt16_sigb = 0;
1524         muru->ofdma_dl.rx_su_comp_sigb = 0;
1525         muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1526
1527         muru->ofdma_ul.t_frame_dur =
1528                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1529         muru->ofdma_ul.mu_cascading =
1530                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1531         muru->ofdma_ul.uo_ra =
1532                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1533         muru->ofdma_ul.he_2x996_tone = 0;
1534         muru->ofdma_ul.rx_t_frame_11ac = 0;
1535
1536         muru->mimo_dl.vht_mu_bfee =
1537                 !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1538         muru->mimo_dl.partial_bw_dl_mimo =
1539                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1540
1541         muru->mimo_ul.full_ul_mimo =
1542                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1543         muru->mimo_ul.partial_ul_mimo =
1544                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1545 }
1546
1547 static int
1548 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1549                   struct ieee80211_sta *sta)
1550 {
1551         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1552         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1553         struct sk_buff *skb;
1554         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1555
1556         if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1557                 return 0;
1558
1559         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1560         if (IS_ERR(skb))
1561                 return PTR_ERR(skb);
1562
1563         /* starec muru */
1564         mt7915_mcu_sta_muru_tlv(skb, sta);
1565
1566         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1567                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1568 }
1569
1570 static void
1571 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1572 {
1573         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1574         struct sta_rec_amsdu *amsdu;
1575         struct tlv *tlv;
1576
1577         if (!sta->max_amsdu_len)
1578             return;
1579
1580         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1581         amsdu = (struct sta_rec_amsdu *)tlv;
1582         amsdu->max_amsdu_num = 8;
1583         amsdu->amsdu_en = true;
1584         amsdu->max_mpdu_size = sta->max_amsdu_len >=
1585                                IEEE80211_MAX_MPDU_LEN_VHT_7991;
1586         msta->wcid.amsdu = true;
1587 }
1588
1589 static bool
1590 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1591 {
1592         switch (vif->type) {
1593         case NL80211_IFTYPE_AP:
1594         case NL80211_IFTYPE_STATION:
1595                 return true;
1596         default:
1597                 return false;
1598         }
1599 }
1600
1601 static void
1602 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1603                    struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1604 {
1605         struct tlv *tlv;
1606
1607         /* starec ht */
1608         if (sta->ht_cap.ht_supported) {
1609                 struct sta_rec_ht *ht;
1610
1611                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1612                 ht = (struct sta_rec_ht *)tlv;
1613                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1614
1615                 if (mt7915_hw_amsdu_supported(vif))
1616                         mt7915_mcu_sta_amsdu_tlv(skb, sta);
1617         }
1618
1619         /* starec vht */
1620         if (sta->vht_cap.vht_supported) {
1621                 struct sta_rec_vht *vht;
1622
1623                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1624                 vht = (struct sta_rec_vht *)tlv;
1625                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1626                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1627                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1628         }
1629
1630         /* starec he */
1631         if (sta->he_cap.has_he)
1632                 mt7915_mcu_sta_he_tlv(skb, sta);
1633
1634         /* starec uapsd */
1635         mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1636 }
1637
1638 static void
1639 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1640                          void *sta_wtbl, void *wtbl_tlv)
1641 {
1642         struct wtbl_smps *smps;
1643         struct tlv *tlv;
1644
1645         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1646                                         wtbl_tlv, sta_wtbl);
1647         smps = (struct wtbl_smps *)tlv;
1648
1649         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1650                 smps->smps = true;
1651 }
1652
1653 static void
1654 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1655                        void *sta_wtbl, void *wtbl_tlv)
1656 {
1657         struct wtbl_ht *ht = NULL;
1658         struct tlv *tlv;
1659
1660         /* wtbl ht */
1661         if (sta->ht_cap.ht_supported) {
1662                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1663                                                 wtbl_tlv, sta_wtbl);
1664                 ht = (struct wtbl_ht *)tlv;
1665                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1666                 ht->af = sta->ht_cap.ampdu_factor;
1667                 ht->mm = sta->ht_cap.ampdu_density;
1668                 ht->ht = true;
1669         }
1670
1671         /* wtbl vht */
1672         if (sta->vht_cap.vht_supported) {
1673                 struct wtbl_vht *vht;
1674                 u8 af;
1675
1676                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1677                                                 wtbl_tlv, sta_wtbl);
1678                 vht = (struct wtbl_vht *)tlv;
1679                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1680                 vht->vht = true;
1681
1682                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1683                                sta->vht_cap.cap);
1684                 if (ht)
1685                         ht->af = max_t(u8, ht->af, af);
1686         }
1687
1688         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1689 }
1690
1691 static void
1692 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1693                               struct ieee80211_sta *sta,
1694                               void *sta_wtbl, void *wtbl_tlv)
1695 {
1696         struct mt7915_sta *msta;
1697         struct wtbl_hdr_trans *htr = NULL;
1698         struct tlv *tlv;
1699
1700         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1701                                         wtbl_tlv, sta_wtbl);
1702         htr = (struct wtbl_hdr_trans *)tlv;
1703         htr->no_rx_trans = true;
1704         if (vif->type == NL80211_IFTYPE_STATION)
1705                 htr->to_ds = true;
1706         else
1707                 htr->from_ds = true;
1708
1709         if (!sta)
1710                 return;
1711
1712         msta = (struct mt7915_sta *)sta->drv_priv;
1713         htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
1714         if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1715                 htr->to_ds = true;
1716                 htr->from_ds = true;
1717         }
1718 }
1719
1720 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1721                                     struct ieee80211_vif *vif,
1722                                     struct ieee80211_sta *sta)
1723 {
1724         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1725         struct wtbl_req_hdr *wtbl_hdr;
1726         struct sk_buff *skb;
1727
1728         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1729         if (!skb)
1730                 return -ENOMEM;
1731
1732         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1733         if (IS_ERR(wtbl_hdr))
1734                 return PTR_ERR(wtbl_hdr);
1735
1736         mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1737
1738         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1739                                      true);
1740 }
1741
1742 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1743                         struct ieee80211_sta *sta)
1744 {
1745         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1746         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1747         struct wtbl_req_hdr *wtbl_hdr;
1748         struct tlv *sta_wtbl;
1749         struct sk_buff *skb;
1750
1751         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1752                                        MT7915_STA_UPDATE_MAX_SIZE);
1753         if (IS_ERR(skb))
1754                 return PTR_ERR(skb);
1755
1756         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1757
1758         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1759                                              &skb);
1760         if (IS_ERR(wtbl_hdr))
1761                 return PTR_ERR(wtbl_hdr);
1762
1763         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1764
1765         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1766                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1767 }
1768
1769 static void
1770 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1771 {
1772         bf->bf_cap = MT_EBF;
1773         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1774         bf->ndp_rate = 0;                               /* mcs0 */
1775         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1776         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1777 }
1778
1779 static void
1780 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1781                        struct sta_rec_bf *bf)
1782 {
1783         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1784         u8 n = 0;
1785
1786         bf->tx_mode = MT_PHY_TYPE_HT;
1787         bf->bf_cap = MT_IBF;
1788
1789         if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1790             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1791                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1792                               mcs->tx_params);
1793         else if (mcs->rx_mask[3])
1794                 n = 3;
1795         else if (mcs->rx_mask[2])
1796                 n = 2;
1797         else if (mcs->rx_mask[1])
1798                 n = 1;
1799
1800         bf->nr = hweight8(phy->mt76->chainmask) - 1;
1801         bf->nc = min_t(u8, bf->nr, n);
1802         bf->ibf_ncol = n;
1803 }
1804
1805 static void
1806 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1807                         struct sta_rec_bf *bf, bool explicit)
1808 {
1809         struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1810         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1811         u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1812         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1813         u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1814
1815         bf->tx_mode = MT_PHY_TYPE_VHT;
1816
1817         if (explicit) {
1818                 u8 bfee_nr, bfer_nr;
1819
1820                 mt7915_mcu_sta_sounding_rate(bf);
1821                 bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1822                                     pc->cap);
1823                 bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1824                                     vc->cap);
1825                 bf->nr = min_t(u8, min_t(u8, bfer_nr, bfee_nr), tx_ant);
1826                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1827                 bf->ibf_ncol = bf->nc;
1828
1829                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1830                         bf->nr = 1;
1831         } else {
1832                 bf->bf_cap = MT_IBF;
1833                 bf->nr = tx_ant;
1834                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1835                 bf->ibf_ncol = nss_mcs;
1836
1837                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1838                         bf->ibf_nrow = 1;
1839         }
1840 }
1841
1842 static void
1843 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1844                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1845 {
1846         struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1847         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1848         const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1849         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1850         u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1851         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1852         u8 bfee_nr, bfer_nr;
1853
1854         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1855         mt7915_mcu_sta_sounding_rate(bf);
1856         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1857                                 pe->phy_cap_info[6]);
1858         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1859                                 pe->phy_cap_info[6]);
1860         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1861                          ve->phy_cap_info[5]);
1862         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1863                          pe->phy_cap_info[4]);
1864         bf->nr = min_t(u8, bfer_nr, bfee_nr);
1865         bf->nc = min_t(u8, nss_mcs, bf->nr);
1866         bf->ibf_ncol = bf->nc;
1867
1868         if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1869                 return;
1870
1871         /* go over for 160MHz and 80p80 */
1872         if (pe->phy_cap_info[0] &
1873             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1874                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1875                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1876
1877                 bf->nc_bw160 = nss_mcs;
1878         }
1879
1880         if (pe->phy_cap_info[0] &
1881             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1882                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1883                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1884
1885                 if (bf->nc_bw160)
1886                         bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1887                 else
1888                         bf->nc_bw160 = nss_mcs;
1889         }
1890
1891         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1892                          ve->phy_cap_info[5]);
1893         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1894                          pe->phy_cap_info[4]);
1895
1896         bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1897 }
1898
1899 static void
1900 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1901                         struct ieee80211_vif *vif, struct mt7915_phy *phy,
1902                         bool enable, bool explicit)
1903 {
1904         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1905         struct sta_rec_bf *bf;
1906         struct tlv *tlv;
1907         const u8 matrix[4][4] = {
1908                 {0, 0, 0, 0},
1909                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
1910                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
1911                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
1912         };
1913
1914 #define MT_BFER_FREE            cpu_to_le16(GENMASK(15, 0))
1915
1916         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1917         bf = (struct sta_rec_bf *)tlv;
1918
1919         if (!enable) {
1920                 bf->pfmu = MT_BFER_FREE;
1921                 return;
1922         }
1923
1924         /* he: eBF only, in accordance with spec
1925          * vht: support eBF and iBF
1926          * ht: iBF only, since mac80211 lacks of eBF support
1927          */
1928         if (sta->he_cap.has_he && explicit)
1929                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1930         else if (sta->vht_cap.vht_supported)
1931                 mt7915_mcu_sta_bfer_vht(sta, phy, bf, explicit);
1932         else if (sta->ht_cap.ht_supported)
1933                 mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1934         else
1935                 return;
1936
1937         bf->bw = sta->bandwidth;
1938         bf->ibf_dbw = sta->bandwidth;
1939         bf->ibf_nrow = tx_ant;
1940
1941         if (!explicit && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1942                 bf->ibf_timeout = 0x48;
1943         else
1944                 bf->ibf_timeout = 0x18;
1945
1946         if (explicit && bf->nr != tx_ant)
1947                 bf->mem_20m = matrix[tx_ant][bf->nc];
1948         else
1949                 bf->mem_20m = matrix[bf->nr][bf->nc];
1950
1951         switch (sta->bandwidth) {
1952         case IEEE80211_STA_RX_BW_160:
1953         case IEEE80211_STA_RX_BW_80:
1954                 bf->mem_total = bf->mem_20m * 2;
1955                 break;
1956         case IEEE80211_STA_RX_BW_40:
1957                 bf->mem_total = bf->mem_20m;
1958                 break;
1959         case IEEE80211_STA_RX_BW_20:
1960         default:
1961                 break;
1962         }
1963 }
1964
1965 static void
1966 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1967                         struct mt7915_phy *phy)
1968 {
1969         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1970         struct sta_rec_bfee *bfee;
1971         struct tlv *tlv;
1972         u8 nr = 0;
1973
1974         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1975         bfee = (struct sta_rec_bfee *)tlv;
1976
1977         if (sta->he_cap.has_he) {
1978                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1979
1980                 nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1981                             pe->phy_cap_info[5]);
1982         } else if (sta->vht_cap.vht_supported) {
1983                 struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1984
1985                 nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1986                                pc->cap);
1987         }
1988
1989         /* reply with identity matrix to avoid 2x2 BF negative gain */
1990         bfee->fb_identity_matrix = !!(nr == 1 && tx_ant == 2);
1991 }
1992
1993 static int
1994 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1995                     struct ieee80211_sta *sta, bool enable)
1996 {
1997         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1998         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1999         struct mt7915_phy *phy;
2000         struct sk_buff *skb;
2001         int r, len;
2002         bool ebfee = 0, ebf = 0;
2003
2004         if (vif->type != NL80211_IFTYPE_STATION &&
2005             vif->type != NL80211_IFTYPE_AP)
2006                 return 0;
2007
2008         phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2009
2010         if (sta->he_cap.has_he) {
2011                 struct ieee80211_he_cap_elem *pe;
2012                 const struct ieee80211_he_cap_elem *ve;
2013                 const struct ieee80211_sta_he_cap *vc;
2014
2015                 pe = &sta->he_cap.he_cap_elem;
2016                 vc = mt7915_get_he_phy_cap(phy, vif);
2017                 ve = &vc->he_cap_elem;
2018
2019                 ebfee = !!((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
2020                             HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
2021                            HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]));
2022                 ebf = !!((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
2023                           HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
2024                          HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]));
2025         } else if (sta->vht_cap.vht_supported) {
2026                 struct ieee80211_sta_vht_cap *pc;
2027                 struct ieee80211_sta_vht_cap *vc;
2028                 u32 cr, ce;
2029
2030                 pc = &sta->vht_cap;
2031                 vc = &phy->mt76->sband_5g.sband.vht_cap;
2032                 cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2033                      IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
2034                 ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2035                      IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
2036
2037                 ebfee = !!((pc->cap & cr) && (vc->cap & ce));
2038                 ebf = !!((vc->cap & cr) && (pc->cap & ce));
2039         }
2040
2041         /* must keep each tag independent */
2042
2043         /* starec bf */
2044         if (ebf || dev->ibf) {
2045                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2046
2047                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2048                 if (IS_ERR(skb))
2049                         return PTR_ERR(skb);
2050
2051                 mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable, ebf);
2052
2053                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2054                                           MCU_EXT_CMD(STA_REC_UPDATE), true);
2055                 if (r)
2056                         return r;
2057         }
2058
2059         /* starec bfee */
2060         if (ebfee) {
2061                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2062
2063                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2064                 if (IS_ERR(skb))
2065                         return PTR_ERR(skb);
2066
2067                 mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2068
2069                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2070                                           MCU_EXT_CMD(STA_REC_UPDATE), true);
2071                 if (r)
2072                         return r;
2073         }
2074
2075         return 0;
2076 }
2077
2078 static void
2079 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2080                              struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2081 {
2082         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2083         struct mt76_phy *mphy = &dev->mphy;
2084         enum nl80211_band band;
2085         struct sta_rec_ra *ra;
2086         struct tlv *tlv;
2087         u32 supp_rate, n_rates, cap = sta->wme ? STA_CAP_WMM : 0;
2088         u8 i, nss = sta->rx_nss, mcs = 0;
2089
2090         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2091         ra = (struct sta_rec_ra *)tlv;
2092
2093         if (msta->wcid.ext_phy && dev->mt76.phy2)
2094                 mphy = dev->mt76.phy2;
2095
2096         band = mphy->chandef.chan->band;
2097         supp_rate = sta->supp_rates[band];
2098         n_rates = hweight32(supp_rate);
2099
2100         ra->valid = true;
2101         ra->auto_rate = true;
2102         ra->phy_mode = mt7915_get_phy_mode(mphy, vif, sta);
2103         ra->channel = mphy->chandef.chan->hw_value;
2104         ra->bw = sta->bandwidth;
2105         ra->rate_len = n_rates;
2106         ra->phy.bw = sta->bandwidth;
2107
2108         if (n_rates) {
2109                 if (band == NL80211_BAND_2GHZ) {
2110                         ra->supp_mode = MODE_CCK;
2111                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2112                         ra->phy.type = MT_PHY_TYPE_CCK;
2113
2114                         if (n_rates > 4) {
2115                                 ra->supp_mode |= MODE_OFDM;
2116                                 ra->supp_ofdm_rate = supp_rate >> 4;
2117                                 ra->phy.type = MT_PHY_TYPE_OFDM;
2118                         }
2119                 } else {
2120                         ra->supp_mode = MODE_OFDM;
2121                         ra->supp_ofdm_rate = supp_rate;
2122                         ra->phy.type = MT_PHY_TYPE_OFDM;
2123                 }
2124         }
2125
2126         if (sta->ht_cap.ht_supported) {
2127                 for (i = 0; i < nss; i++)
2128                         ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2129
2130                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2131                 ra->supp_mode |= MODE_HT;
2132                 mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2133                 ra->af = sta->ht_cap.ampdu_factor;
2134                 ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2135
2136                 cap |= STA_CAP_HT;
2137                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2138                         cap |= STA_CAP_SGI_20;
2139                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2140                         cap |= STA_CAP_SGI_40;
2141                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2142                         cap |= STA_CAP_TX_STBC;
2143                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2144                         cap |= STA_CAP_RX_STBC;
2145                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2146                         cap |= STA_CAP_LDPC;
2147         }
2148
2149         if (sta->vht_cap.vht_supported) {
2150                 u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2151                 u16 vht_mcs;
2152                 u8 af, mcs_prev;
2153
2154                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2155                                sta->vht_cap.cap);
2156                 ra->af = max_t(u8, ra->af, af);
2157
2158                 cap |= STA_CAP_VHT;
2159                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2160                         cap |= STA_CAP_VHT_SGI_80;
2161                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2162                         cap |= STA_CAP_VHT_SGI_160;
2163                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2164                         cap |= STA_CAP_VHT_TX_STBC;
2165                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2166                         cap |= STA_CAP_VHT_RX_STBC;
2167                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2168                         cap |= STA_CAP_VHT_LDPC;
2169
2170                 ra->supp_mode |= MODE_VHT;
2171                 for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2172                         switch (mcs_map & 0x3) {
2173                         case IEEE80211_VHT_MCS_SUPPORT_0_9:
2174                                 vht_mcs = GENMASK(9, 0);
2175                                 break;
2176                         case IEEE80211_VHT_MCS_SUPPORT_0_8:
2177                                 vht_mcs = GENMASK(8, 0);
2178                                 break;
2179                         case IEEE80211_VHT_MCS_SUPPORT_0_7:
2180                                 vht_mcs = GENMASK(7, 0);
2181                                 break;
2182                         default:
2183                                 vht_mcs = 0;
2184                         }
2185
2186                         ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2187
2188                         mcs_prev = hweight16(vht_mcs) - 1;
2189                         if (mcs_prev > mcs)
2190                                 mcs = mcs_prev;
2191
2192                         /* only support 2ss on 160MHz */
2193                         if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2194                                       ra->bw == CMD_CBW_8080MHZ))
2195                                 break;
2196                 }
2197         }
2198
2199         if (sta->he_cap.has_he) {
2200                 ra->supp_mode |= MODE_HE;
2201                 cap |= STA_CAP_HE;
2202         }
2203
2204         ra->sta_status = cpu_to_le32(cap);
2205
2206         switch (BIT(fls(ra->supp_mode) - 1)) {
2207         case MODE_VHT:
2208                 ra->phy.type = MT_PHY_TYPE_VHT;
2209                 ra->phy.mcs = mcs;
2210                 ra->phy.nss = nss;
2211                 ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2212                 ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2213                 ra->phy.sgi =
2214                         !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2215                 break;
2216         case MODE_HT:
2217                 ra->phy.type = MT_PHY_TYPE_HT;
2218                 ra->phy.mcs = mcs;
2219                 ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2220                 ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2221                 ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2222                 break;
2223         default:
2224                 break;
2225         }
2226 }
2227
2228 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2229                              struct ieee80211_sta *sta)
2230 {
2231         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2232         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2233         struct sk_buff *skb;
2234         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2235
2236         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2237         if (IS_ERR(skb))
2238                 return PTR_ERR(skb);
2239
2240         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2241
2242         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2243                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2244 }
2245
2246 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2247                            struct ieee80211_sta *sta, bool enable)
2248 {
2249         int ret;
2250
2251         if (!sta)
2252                 return 0;
2253
2254         /* must keep the order */
2255         ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2256         if (ret)
2257                 return ret;
2258
2259         ret = mt7915_mcu_add_mu(dev, vif, sta);
2260         if (ret)
2261                 return ret;
2262
2263         if (enable)
2264                 return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2265
2266         return 0;
2267 }
2268
2269 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2270                        struct ieee80211_sta *sta, bool enable)
2271 {
2272         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2273         struct wtbl_req_hdr *wtbl_hdr;
2274         struct mt7915_sta *msta;
2275         struct tlv *sta_wtbl;
2276         struct sk_buff *skb;
2277
2278         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2279
2280         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2281                                        MT7915_STA_UPDATE_MAX_SIZE);
2282         if (IS_ERR(skb))
2283                 return PTR_ERR(skb);
2284
2285         mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2286         if (enable && sta)
2287                 mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2288
2289         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2290
2291         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2292                                              sta_wtbl, &skb);
2293         if (IS_ERR(wtbl_hdr))
2294                 return PTR_ERR(wtbl_hdr);
2295
2296         if (enable) {
2297                 mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2298                 mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2299                 if (sta)
2300                         mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2301         }
2302
2303         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2304                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2305 }
2306
2307 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2308                               struct ieee80211_sta *sta, u32 rate)
2309 {
2310         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2311         struct mt7915_vif *mvif = msta->vif;
2312         struct sta_rec_ra_fixed *ra;
2313         struct sk_buff *skb;
2314         struct tlv *tlv;
2315         int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2316
2317         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2318         if (IS_ERR(skb))
2319                 return PTR_ERR(skb);
2320
2321         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2322         ra = (struct sta_rec_ra_fixed *)tlv;
2323
2324         if (!rate) {
2325                 ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2326                 goto out;
2327         } else {
2328                 ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2329         }
2330
2331         ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2332         ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2333         ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2334         ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2335         ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2336
2337         if (ra->phy.bw)
2338                 ra->phy.ldpc = 7;
2339         else
2340                 ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2341
2342         /* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2343         if (ra->phy.type > MT_PHY_TYPE_VHT)
2344                 ra->phy.sgi = ra->phy.mcs * 85;
2345         else
2346                 ra->phy.sgi = ra->phy.mcs * 15;
2347
2348 out:
2349         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2350                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2351 }
2352
2353 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2354                             struct ieee80211_vif *vif, bool enable)
2355 {
2356         struct mt7915_dev *dev = phy->dev;
2357         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2358         struct {
2359                 struct req_hdr {
2360                         u8 omac_idx;
2361                         u8 dbdc_idx;
2362                         __le16 tlv_num;
2363                         u8 is_tlv_append;
2364                         u8 rsv[3];
2365                 } __packed hdr;
2366                 struct req_tlv {
2367                         __le16 tag;
2368                         __le16 len;
2369                         u8 active;
2370                         u8 dbdc_idx;
2371                         u8 omac_addr[ETH_ALEN];
2372                 } __packed tlv;
2373         } data = {
2374                 .hdr = {
2375                         .omac_idx = mvif->omac_idx,
2376                         .dbdc_idx = mvif->band_idx,
2377                         .tlv_num = cpu_to_le16(1),
2378                         .is_tlv_append = 1,
2379                 },
2380                 .tlv = {
2381                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
2382                         .len = cpu_to_le16(sizeof(struct req_tlv)),
2383                         .active = enable,
2384                         .dbdc_idx = mvif->band_idx,
2385                 },
2386         };
2387
2388         if (mvif->omac_idx >= REPEATER_BSSID_START)
2389                 return mt7915_mcu_muar_config(phy, vif, false, enable);
2390
2391         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2392         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2393                                  &data, sizeof(data), true);
2394 }
2395
2396 static void
2397 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2398                       struct bss_info_bcn *bcn,
2399                       struct ieee80211_mutable_offsets *offs)
2400 {
2401         if (offs->cntdwn_counter_offs[0]) {
2402                 struct tlv *tlv;
2403                 struct bss_info_bcn_csa *csa;
2404
2405                 tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2406                                                    sizeof(*csa), &bcn->sub_ntlv,
2407                                                    &bcn->len);
2408                 csa = (struct bss_info_bcn_csa *)tlv;
2409                 csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2410         }
2411 }
2412
2413 static void
2414 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2415                        struct sk_buff *skb, struct bss_info_bcn *bcn,
2416                        struct ieee80211_mutable_offsets *offs)
2417 {
2418         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2419         struct bss_info_bcn_cont *cont;
2420         struct tlv *tlv;
2421         u8 *buf;
2422         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2423
2424         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2425                                            len, &bcn->sub_ntlv, &bcn->len);
2426
2427         cont = (struct bss_info_bcn_cont *)tlv;
2428         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2429         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2430
2431         if (offs->cntdwn_counter_offs[0])
2432                 cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2433
2434         buf = (u8 *)tlv + sizeof(*cont);
2435         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2436                               true);
2437         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2438 }
2439
2440 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2441                           struct ieee80211_vif *vif, int en)
2442 {
2443 #define MAX_BEACON_SIZE 512
2444         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2445         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2446         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2447         struct ieee80211_mutable_offsets offs;
2448         struct ieee80211_tx_info *info;
2449         struct sk_buff *skb, *rskb;
2450         struct tlv *tlv;
2451         struct bss_info_bcn *bcn;
2452         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2453
2454         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2455         if (!skb)
2456                 return -EINVAL;
2457
2458         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2459                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2460                 dev_kfree_skb(skb);
2461                 return -EINVAL;
2462         }
2463
2464         rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2465         if (IS_ERR(rskb)) {
2466                 dev_kfree_skb(skb);
2467                 return PTR_ERR(rskb);
2468         }
2469
2470         tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2471         bcn = (struct bss_info_bcn *)tlv;
2472         bcn->enable = en;
2473
2474         if (mvif->band_idx) {
2475                 info = IEEE80211_SKB_CB(skb);
2476                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2477         }
2478
2479         /* TODO: subtag - bss color count & 11v MBSSID */
2480         mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2481         mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2482         dev_kfree_skb(skb);
2483
2484         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2485                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2486 }
2487
2488 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2489                                      u32 option)
2490 {
2491         struct {
2492                 __le32 option;
2493                 __le32 addr;
2494         } req = {
2495                 .option = cpu_to_le32(option),
2496                 .addr = cpu_to_le32(addr),
2497         };
2498
2499         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2500                                  sizeof(req), true);
2501 }
2502
2503 static int mt7915_mcu_restart(struct mt76_dev *dev)
2504 {
2505         struct {
2506                 u8 power_mode;
2507                 u8 rsv[3];
2508         } req = {
2509                 .power_mode = 1,
2510         };
2511
2512         return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2513                                  sizeof(req), false);
2514 }
2515
2516 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2517 {
2518         struct {
2519                 __le32 op;
2520         } req = {
2521                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2522         };
2523
2524         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2525                                  sizeof(req), true);
2526 }
2527
2528 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2529 {
2530         struct {
2531                 u8 check_crc;
2532                 u8 reserved[3];
2533         } req = {
2534                 .check_crc = 0,
2535         };
2536
2537         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2538                                  sizeof(req), true);
2539 }
2540
2541 static int mt7915_driver_own(struct mt7915_dev *dev)
2542 {
2543         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2544
2545         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2546         if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2547                             0, 500)) {
2548                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2549                 return -EIO;
2550         }
2551
2552         return 0;
2553 }
2554
2555 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2556                                     u32 len, u32 mode)
2557 {
2558         struct {
2559                 __le32 addr;
2560                 __le32 len;
2561                 __le32 mode;
2562         } req = {
2563                 .addr = cpu_to_le32(addr),
2564                 .len = cpu_to_le32(len),
2565                 .mode = cpu_to_le32(mode),
2566         };
2567         int attr;
2568
2569         if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2570                 attr = MCU_CMD(PATCH_START_REQ);
2571         else
2572                 attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2573
2574         return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2575 }
2576
2577 static int mt7915_load_patch(struct mt7915_dev *dev)
2578 {
2579         const struct mt7915_patch_hdr *hdr;
2580         const struct firmware *fw = NULL;
2581         int i, ret, sem;
2582
2583         sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2584         switch (sem) {
2585         case PATCH_IS_DL:
2586                 return 0;
2587         case PATCH_NOT_DL_SEM_SUCCESS:
2588                 break;
2589         default:
2590                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2591                 return -EAGAIN;
2592         }
2593
2594         ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2595         if (ret)
2596                 goto out;
2597
2598         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2599                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2600                 ret = -EINVAL;
2601                 goto out;
2602         }
2603
2604         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2605
2606         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2607                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2608
2609         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2610                 struct mt7915_patch_sec *sec;
2611                 const u8 *dl;
2612                 u32 len, addr;
2613
2614                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2615                                                   i * sizeof(*sec));
2616                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2617                     PATCH_SEC_TYPE_INFO) {
2618                         ret = -EINVAL;
2619                         goto out;
2620                 }
2621
2622                 addr = be32_to_cpu(sec->info.addr);
2623                 len = be32_to_cpu(sec->info.len);
2624                 dl = fw->data + be32_to_cpu(sec->offs);
2625
2626                 ret = mt7915_mcu_init_download(dev, addr, len,
2627                                                DL_MODE_NEED_RSP);
2628                 if (ret) {
2629                         dev_err(dev->mt76.dev, "Download request failed\n");
2630                         goto out;
2631                 }
2632
2633                 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2634                                              dl, len);
2635                 if (ret) {
2636                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2637                         goto out;
2638                 }
2639         }
2640
2641         ret = mt7915_mcu_start_patch(dev);
2642         if (ret)
2643                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2644
2645 out:
2646         sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2647         switch (sem) {
2648         case PATCH_REL_SEM_SUCCESS:
2649                 break;
2650         default:
2651                 ret = -EAGAIN;
2652                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2653                 goto out;
2654         }
2655         release_firmware(fw);
2656
2657         return ret;
2658 }
2659
2660 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2661 {
2662         u32 ret = 0;
2663
2664         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2665                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2666         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2667                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2668         ret |= DL_MODE_NEED_RSP;
2669         ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2670
2671         return ret;
2672 }
2673
2674 static int
2675 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2676                              const struct mt7915_fw_trailer *hdr,
2677                              const u8 *data, bool is_wa)
2678 {
2679         int i, offset = 0;
2680         u32 override = 0, option = 0;
2681
2682         for (i = 0; i < hdr->n_region; i++) {
2683                 const struct mt7915_fw_region *region;
2684                 int err;
2685                 u32 len, addr, mode;
2686
2687                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2688                          (hdr->n_region - i) * sizeof(*region));
2689                 mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2690                 len = le32_to_cpu(region->len);
2691                 addr = le32_to_cpu(region->addr);
2692
2693                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2694                         override = addr;
2695
2696                 err = mt7915_mcu_init_download(dev, addr, len, mode);
2697                 if (err) {
2698                         dev_err(dev->mt76.dev, "Download request failed\n");
2699                         return err;
2700                 }
2701
2702                 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2703                                              data + offset, len);
2704                 if (err) {
2705                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2706                         return err;
2707                 }
2708
2709                 offset += len;
2710         }
2711
2712         if (override)
2713                 option |= FW_START_OVERRIDE;
2714
2715         if (is_wa)
2716                 option |= FW_START_WORKING_PDA_CR4;
2717
2718         return mt7915_mcu_start_firmware(dev, override, option);
2719 }
2720
2721 static int mt7915_load_ram(struct mt7915_dev *dev)
2722 {
2723         const struct mt7915_fw_trailer *hdr;
2724         const struct firmware *fw;
2725         int ret;
2726
2727         ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2728         if (ret)
2729                 return ret;
2730
2731         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2732                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2733                 ret = -EINVAL;
2734                 goto out;
2735         }
2736
2737         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2738                                         sizeof(*hdr));
2739
2740         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2741                  hdr->fw_ver, hdr->build_date);
2742
2743         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2744         if (ret) {
2745                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2746                 goto out;
2747         }
2748
2749         release_firmware(fw);
2750
2751         ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2752         if (ret)
2753                 return ret;
2754
2755         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2756                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2757                 ret = -EINVAL;
2758                 goto out;
2759         }
2760
2761         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2762                                         sizeof(*hdr));
2763
2764         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2765                  hdr->fw_ver, hdr->build_date);
2766
2767         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2768         if (ret) {
2769                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2770                 goto out;
2771         }
2772
2773         snprintf(dev->mt76.hw->wiphy->fw_version,
2774                  sizeof(dev->mt76.hw->wiphy->fw_version),
2775                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2776
2777 out:
2778         release_firmware(fw);
2779
2780         return ret;
2781 }
2782
2783 static int mt7915_load_firmware(struct mt7915_dev *dev)
2784 {
2785         int ret;
2786         u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2787
2788         val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2789
2790         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2791                 /* restart firmware once */
2792                 __mt76_mcu_restart(&dev->mt76);
2793                 if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2794                                     val, 1000)) {
2795                         dev_err(dev->mt76.dev,
2796                                 "Firmware is not ready for download\n");
2797                         return -EIO;
2798                 }
2799         }
2800
2801         ret = mt7915_load_patch(dev);
2802         if (ret)
2803                 return ret;
2804
2805         ret = mt7915_load_ram(dev);
2806         if (ret)
2807                 return ret;
2808
2809         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2810                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2811                                        FW_STATE_WACPU_RDY), 1000)) {
2812                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2813                 return -EIO;
2814         }
2815
2816         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2817
2818         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2819
2820         return 0;
2821 }
2822
2823 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2824 {
2825         struct {
2826                 u8 ctrl_val;
2827                 u8 pad[3];
2828         } data = {
2829                 .ctrl_val = ctrl
2830         };
2831
2832         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2833                                  sizeof(data), true);
2834 }
2835
2836 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2837 {
2838         struct {
2839                 u8 ver;
2840                 u8 pad;
2841                 __le16 len;
2842                 u8 level;
2843                 u8 rsv[3];
2844                 __le32 module_idx;
2845         } data = {
2846                 .module_idx = cpu_to_le32(module),
2847                 .level = level,
2848         };
2849
2850         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2851                                  sizeof(data), false);
2852 }
2853
2854 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2855 {
2856         struct {
2857                 u8 enable;
2858                 u8 _rsv[3];
2859         } __packed req = {
2860                 .enable = enabled
2861         };
2862
2863         return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2864                                  sizeof(req), false);
2865 }
2866
2867 int mt7915_mcu_init(struct mt7915_dev *dev)
2868 {
2869         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2870                 .headroom = sizeof(struct mt7915_mcu_txd),
2871                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2872                 .mcu_parse_response = mt7915_mcu_parse_response,
2873                 .mcu_restart = mt7915_mcu_restart,
2874         };
2875         int ret;
2876
2877         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2878
2879         ret = mt7915_driver_own(dev);
2880         if (ret)
2881                 return ret;
2882
2883         ret = mt7915_load_firmware(dev);
2884         if (ret)
2885                 return ret;
2886
2887         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2888         mt7915_mcu_fw_log_2_host(dev, 0);
2889         mt7915_mcu_set_mwds(dev, 1);
2890         mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_RED, 0, 0);
2891
2892         return 0;
2893 }
2894
2895 void mt7915_mcu_exit(struct mt7915_dev *dev)
2896 {
2897         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2898
2899         __mt76_mcu_restart(&dev->mt76);
2900         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2901                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2902                                        FW_STATE_FW_DOWNLOAD), 1000)) {
2903                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2904                 return;
2905         }
2906
2907         reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2908         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2909         skb_queue_purge(&dev->mt76.mcu.res_q);
2910 }
2911
2912 static int
2913 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2914 {
2915         struct {
2916                 u8 operation;
2917                 u8 count;
2918                 u8 _rsv[2];
2919                 u8 index;
2920                 u8 enable;
2921                 __le16 etype;
2922         } req = {
2923                 .operation = 1,
2924                 .count = 1,
2925                 .enable = 1,
2926                 .etype = cpu_to_le16(ETH_P_PAE),
2927         };
2928
2929         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2930                                  &req, sizeof(req), false);
2931 }
2932
2933 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2934                        bool enable, bool hdr_trans)
2935 {
2936         struct {
2937                 u8 operation;
2938                 u8 enable;
2939                 u8 check_bssid;
2940                 u8 insert_vlan;
2941                 u8 remove_vlan;
2942                 u8 tid;
2943                 u8 mode;
2944                 u8 rsv;
2945         } __packed req_trans = {
2946                 .enable = hdr_trans,
2947         };
2948         struct {
2949                 u8 enable;
2950                 u8 band;
2951                 u8 rsv[2];
2952         } __packed req_mac = {
2953                 .enable = enable,
2954                 .band = band,
2955         };
2956         int ret;
2957
2958         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2959                                 &req_trans, sizeof(req_trans), false);
2960         if (ret)
2961                 return ret;
2962
2963         if (hdr_trans)
2964                 mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2965
2966         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2967                                  &req_mac, sizeof(req_mac), true);
2968 }
2969
2970 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2971 {
2972         struct {
2973                 __le32 cmd;
2974                 u8 band;
2975                 u8 enable;
2976         } __packed req = {
2977                 .cmd = cpu_to_le32(SCS_ENABLE),
2978                 .band = band,
2979                 .enable = enable + 1,
2980         };
2981
2982         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
2983                                  sizeof(req), false);
2984 }
2985
2986 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2987 {
2988         struct mt7915_dev *dev = phy->dev;
2989         struct {
2990                 u8 prot_idx;
2991                 u8 band;
2992                 u8 rsv[2];
2993                 __le32 len_thresh;
2994                 __le32 pkt_thresh;
2995         } __packed req = {
2996                 .prot_idx = 1,
2997                 .band = phy != &dev->phy,
2998                 .len_thresh = cpu_to_le32(val),
2999                 .pkt_thresh = cpu_to_le32(0x2),
3000         };
3001
3002         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
3003                                  sizeof(req), true);
3004 }
3005
3006 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
3007 {
3008         struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
3009         u8 num = req->total;
3010         size_t len = sizeof(*req) -
3011                      (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
3012
3013         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
3014                                  len, true);
3015 }
3016
3017 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
3018 {
3019 #define TX_CMD_MODE             1
3020         struct mt7915_mcu_tx req = {
3021                 .valid = true,
3022                 .mode = TX_CMD_MODE,
3023                 .total = IEEE80211_NUM_ACS,
3024         };
3025         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3026         int ac;
3027
3028         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3029                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3030                 struct edca *e = &req.edca[ac];
3031
3032                 e->set = WMM_PARAM_SET;
3033                 e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3034                 e->aifs = q->aifs;
3035                 e->txop = cpu_to_le16(q->txop);
3036
3037                 if (q->cw_min)
3038                         e->cw_min = fls(q->cw_min);
3039                 else
3040                         e->cw_min = 5;
3041
3042                 if (q->cw_max)
3043                         e->cw_max = cpu_to_le16(fls(q->cw_max));
3044                 else
3045                         e->cw_max = cpu_to_le16(10);
3046         }
3047
3048         return mt7915_mcu_update_edca(dev, &req);
3049 }
3050
3051 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3052 {
3053 #define ENTER_PM_STATE          1
3054 #define EXIT_PM_STATE           2
3055         struct {
3056                 u8 pm_number;
3057                 u8 pm_state;
3058                 u8 bssid[ETH_ALEN];
3059                 u8 dtim_period;
3060                 u8 wlan_idx_lo;
3061                 __le16 bcn_interval;
3062                 __le32 aid;
3063                 __le32 rx_filter;
3064                 u8 band_idx;
3065                 u8 wlan_idx_hi;
3066                 u8 rsv[2];
3067                 __le32 feature;
3068                 u8 omac_idx;
3069                 u8 wmm_idx;
3070                 u8 bcn_loss_cnt;
3071                 u8 bcn_sp_duration;
3072         } __packed req = {
3073                 .pm_number = 5,
3074                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3075                 .band_idx = band,
3076         };
3077
3078         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3079                                  sizeof(req), true);
3080 }
3081
3082 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3083                        enum mt7915_rdd_cmd cmd, u8 index,
3084                        u8 rx_sel, u8 val)
3085 {
3086         struct {
3087                 u8 ctrl;
3088                 u8 rdd_idx;
3089                 u8 rdd_rx_sel;
3090                 u8 val;
3091                 u8 rsv[4];
3092         } __packed req = {
3093                 .ctrl = cmd,
3094                 .rdd_idx = index,
3095                 .rdd_rx_sel = rx_sel,
3096                 .val = val,
3097         };
3098
3099         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3100                                  sizeof(req), true);
3101 }
3102
3103 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3104 {
3105         struct {
3106                 __le32 tag;
3107                 __le16 min_lpn;
3108                 u8 rsv[2];
3109         } __packed req = {
3110                 .tag = cpu_to_le32(0x1),
3111                 .min_lpn = cpu_to_le16(val),
3112         };
3113
3114         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3115                                  sizeof(req), true);
3116 }
3117
3118 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3119                             const struct mt7915_dfs_pulse *pulse)
3120 {
3121         struct {
3122                 __le32 tag;
3123
3124                 __le32 max_width;               /* us */
3125                 __le32 max_pwr;                 /* dbm */
3126                 __le32 min_pwr;                 /* dbm */
3127                 __le32 min_stgr_pri;            /* us */
3128                 __le32 max_stgr_pri;            /* us */
3129                 __le32 min_cr_pri;              /* us */
3130                 __le32 max_cr_pri;              /* us */
3131         } __packed req = {
3132                 .tag = cpu_to_le32(0x3),
3133
3134 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3135                 __req_field(max_width),
3136                 __req_field(max_pwr),
3137                 __req_field(min_pwr),
3138                 __req_field(min_stgr_pri),
3139                 __req_field(max_stgr_pri),
3140                 __req_field(min_cr_pri),
3141                 __req_field(max_cr_pri),
3142 #undef __req_field
3143         };
3144
3145         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3146                                  sizeof(req), true);
3147 }
3148
3149 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3150                             const struct mt7915_dfs_pattern *pattern)
3151 {
3152         struct {
3153                 __le32 tag;
3154                 __le16 radar_type;
3155
3156                 u8 enb;
3157                 u8 stgr;
3158                 u8 min_crpn;
3159                 u8 max_crpn;
3160                 u8 min_crpr;
3161                 u8 min_pw;
3162                 __le32 min_pri;
3163                 __le32 max_pri;
3164                 u8 max_pw;
3165                 u8 min_crbn;
3166                 u8 max_crbn;
3167                 u8 min_stgpn;
3168                 u8 max_stgpn;
3169                 u8 min_stgpr;
3170                 u8 rsv[2];
3171                 __le32 min_stgpr_diff;
3172         } __packed req = {
3173                 .tag = cpu_to_le32(0x2),
3174                 .radar_type = cpu_to_le16(index),
3175
3176 #define __req_field_u8(field) .field = pattern->field
3177 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3178                 __req_field_u8(enb),
3179                 __req_field_u8(stgr),
3180                 __req_field_u8(min_crpn),
3181                 __req_field_u8(max_crpn),
3182                 __req_field_u8(min_crpr),
3183                 __req_field_u8(min_pw),
3184                 __req_field_u32(min_pri),
3185                 __req_field_u32(max_pri),
3186                 __req_field_u8(max_pw),
3187                 __req_field_u8(min_crbn),
3188                 __req_field_u8(max_crbn),
3189                 __req_field_u8(min_stgpn),
3190                 __req_field_u8(max_stgpn),
3191                 __req_field_u8(min_stgpr),
3192                 __req_field_u32(min_stgpr_diff),
3193 #undef __req_field_u8
3194 #undef __req_field_u32
3195         };
3196
3197         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3198                                  sizeof(req), true);
3199 }
3200
3201 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3202 {
3203         struct mt7915_dev *dev = phy->dev;
3204         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3205         int freq1 = chandef->center_freq1;
3206         bool ext_phy = phy != &dev->phy;
3207         struct {
3208                 u8 control_ch;
3209                 u8 center_ch;
3210                 u8 bw;
3211                 u8 tx_streams_num;
3212                 u8 rx_streams;  /* mask or num */
3213                 u8 switch_reason;
3214                 u8 band_idx;
3215                 u8 center_ch2;  /* for 80+80 only */
3216                 __le16 cac_case;
3217                 u8 channel_band;
3218                 u8 rsv0;
3219                 __le32 outband_freq;
3220                 u8 txpower_drop;
3221                 u8 ap_bw;
3222                 u8 ap_center_ch;
3223                 u8 rsv1[57];
3224         } __packed req = {
3225                 .control_ch = chandef->chan->hw_value,
3226                 .center_ch = ieee80211_frequency_to_channel(freq1),
3227                 .bw = mt7915_mcu_chan_bw(chandef),
3228                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
3229                 .rx_streams = phy->mt76->antenna_mask,
3230                 .band_idx = ext_phy,
3231                 .channel_band = chandef->chan->band,
3232         };
3233
3234 #ifdef CONFIG_NL80211_TESTMODE
3235         if (phy->mt76->test.tx_antenna_mask &&
3236             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3237              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3238              phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3239                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3240                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
3241
3242                 if (ext_phy) {
3243                         req.tx_streams_num = 2;
3244                         req.rx_streams >>= 2;
3245                 }
3246         }
3247 #endif
3248
3249         if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3250                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3251         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3252                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3253                 req.switch_reason = CH_SWITCH_DFS;
3254         else
3255                 req.switch_reason = CH_SWITCH_NORMAL;
3256
3257         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3258                 req.rx_streams = hweight8(req.rx_streams);
3259
3260         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3261                 int freq2 = chandef->center_freq2;
3262
3263                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3264         }
3265
3266         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3267 }
3268
3269 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3270 {
3271 #define TOTAL_PAGE_MASK         GENMASK(7, 5)
3272 #define PAGE_IDX_MASK           GENMASK(4, 2)
3273 #define PER_PAGE_SIZE           0x400
3274         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3275         u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;
3276         u8 *eep = (u8 *)dev->mt76.eeprom.data;
3277         int eep_len;
3278         int i;
3279
3280         for (i = 0; i <= total; i++, eep += eep_len) {
3281                 struct sk_buff *skb;
3282                 int ret;
3283
3284                 if (i == total)
3285                         eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3286                 else
3287                         eep_len = PER_PAGE_SIZE;
3288
3289                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3290                                          sizeof(req) + eep_len);
3291                 if (!skb)
3292                         return -ENOMEM;
3293
3294                 req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |
3295                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3296                 req.len = cpu_to_le16(eep_len);
3297
3298                 skb_put_data(skb, &req, sizeof(req));
3299                 skb_put_data(skb, eep, eep_len);
3300
3301                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3302                                             MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3303                 if (ret)
3304                         return ret;
3305         }
3306
3307         return 0;
3308 }
3309
3310 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3311 {
3312         struct mt7915_mcu_eeprom req = {
3313                 .buffer_mode = EE_MODE_EFUSE,
3314                 .format = EE_FORMAT_WHOLE,
3315         };
3316
3317         if (dev->flash_mode)
3318                 return mt7915_mcu_set_eeprom_flash(dev);
3319
3320         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3321                                  &req, sizeof(req), true);
3322 }
3323
3324 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3325 {
3326         struct mt7915_mcu_eeprom_info req = {
3327                 .addr = cpu_to_le32(round_down(offset, 16)),
3328         };
3329         struct mt7915_mcu_eeprom_info *res;
3330         struct sk_buff *skb;
3331         int ret;
3332         u8 *buf;
3333
3334         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3335                                 sizeof(req), true, &skb);
3336         if (ret)
3337                 return ret;
3338
3339         res = (struct mt7915_mcu_eeprom_info *)skb->data;
3340         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3341         memcpy(buf, res->data, 16);
3342         dev_kfree_skb(skb);
3343
3344         return 0;
3345 }
3346
3347 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3348 {
3349         struct {
3350                 u8 ctrl_id;
3351                 u8 action;
3352                 u8 band;
3353                 u8 rsv[5];
3354         } req = {
3355                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3356                 .action = index,
3357         };
3358
3359         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3360                                  sizeof(req), true);
3361 }
3362
3363 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3364 {
3365         struct {
3366                 __le32 cmd;
3367                 __le16 wlan_idx;
3368                 __le16 ru_idx;
3369                 __le16 direction;
3370                 __le16 dump_group;
3371         } req = {
3372                 .cmd = cpu_to_le32(cmd),
3373                 .wlan_idx = cpu_to_le16(wlan_idx),
3374                 .dump_group = cpu_to_le16(1),
3375         };
3376
3377         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RATE_CTRL), &req,
3378                                  sizeof(req), false);
3379 }
3380
3381 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3382 {
3383         struct mt7915_dev *dev = phy->dev;
3384         struct mt76_phy *mphy = phy->mt76;
3385         struct ieee80211_hw *hw = mphy->hw;
3386         struct mt7915_sku_val {
3387                 u8 format_id;
3388                 u8 limit_type;
3389                 u8 dbdc_idx;
3390                 s8 val[MT7915_SKU_RATE_NUM];
3391         } __packed req = {
3392                 .format_id = 4,
3393                 .dbdc_idx = phy != &dev->phy,
3394         };
3395         int i;
3396         s8 *delta;
3397
3398         delta = dev->rate_power[mphy->chandef.chan->band];
3399         mphy->txpower_cur = hw->conf.power_level * 2 +
3400                             delta[MT7915_SKU_MAX_DELTA_IDX];
3401
3402         for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3403                 req.val[i] = hw->conf.power_level * 2 + delta[i];
3404
3405         return mt76_mcu_send_msg(&dev->mt76,
3406                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3407                                  sizeof(req), true);
3408 }
3409
3410 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3411                               u8 en)
3412 {
3413         struct {
3414                 u8 test_mode_en;
3415                 u8 param_idx;
3416                 u8 _rsv[2];
3417
3418                 u8 enable;
3419                 u8 _rsv2[3];
3420
3421                 u8 pad[8];
3422         } __packed req = {
3423                 .test_mode_en = test_mode,
3424                 .param_idx = param,
3425                 .enable = en,
3426         };
3427
3428         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3429                                  sizeof(req), false);
3430 }
3431
3432 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3433 {
3434         struct mt7915_dev *dev = phy->dev;
3435         struct mt7915_sku {
3436                 u8 format_id;
3437                 u8 sku_enable;
3438                 u8 dbdc_idx;
3439                 u8 rsv;
3440         } __packed req = {
3441                 .format_id = 0,
3442                 .dbdc_idx = phy != &dev->phy,
3443                 .sku_enable = enable,
3444         };
3445
3446         return mt76_mcu_send_msg(&dev->mt76,
3447                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3448                                  sizeof(req), true);
3449 }
3450
3451 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3452 {
3453         struct {
3454                 u8 action;
3455                 u8 set;
3456                 u8 band;
3457                 u8 rsv;
3458         } req = {
3459                 .action = action,
3460                 .set = set,
3461                 .band = band,
3462         };
3463
3464         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3465                                  &req, sizeof(req), false);
3466 }
3467
3468 int mt7915_mcu_set_txbf_module(struct mt7915_dev *dev)
3469 {
3470 #define MT_BF_MODULE_UPDATE               25
3471         struct {
3472                 u8 action;
3473                 u8 bf_num;
3474                 u8 bf_bitmap;
3475                 u8 bf_sel[8];
3476                 u8 rsv[8];
3477         } __packed req = {
3478                 .action = MT_BF_MODULE_UPDATE,
3479                 .bf_num = 2,
3480                 .bf_bitmap = GENMASK(1, 0),
3481         };
3482
3483         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3484                                  sizeof(req), true);
3485 }
3486
3487 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3488 {
3489 #define MT_BF_TYPE_UPDATE               20
3490         struct {
3491                 u8 action;
3492                 bool ebf;
3493                 bool ibf;
3494                 u8 rsv;
3495         } __packed req = {
3496                 .action = MT_BF_TYPE_UPDATE,
3497                 .ebf = true,
3498                 .ibf = dev->ibf,
3499         };
3500
3501         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3502                                  sizeof(req), true);
3503 }
3504
3505 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3506 {
3507 #define MT_BF_PROCESSING                4
3508         struct {
3509                 u8 action;
3510                 u8 snd_mode;
3511                 u8 sta_num;
3512                 u8 rsv;
3513                 u8 wlan_idx[4];
3514                 __le32 snd_period;      /* ms */
3515         } __packed req = {
3516                 .action = true,
3517                 .snd_mode = MT_BF_PROCESSING,
3518         };
3519
3520         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3521                                  sizeof(req), true);
3522 }
3523
3524 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3525                             bool enable)
3526 {
3527 #define MT_SPR_ENABLE           1
3528         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3529         struct {
3530                 u8 action;
3531                 u8 arg_num;
3532                 u8 band_idx;
3533                 u8 status;
3534                 u8 drop_tx_idx;
3535                 u8 sta_idx;     /* 256 sta */
3536                 u8 rsv[2];
3537                 __le32 val;
3538         } __packed req = {
3539                 .action = MT_SPR_ENABLE,
3540                 .arg_num = 1,
3541                 .band_idx = mvif->band_idx,
3542                 .val = cpu_to_le32(enable),
3543         };
3544
3545         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3546                                  sizeof(req), true);
3547 }
3548
3549 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3550                            struct ieee80211_sta *sta, struct rate_info *rate)
3551 {
3552         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3553         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3554         struct mt7915_dev *dev = phy->dev;
3555         struct mt76_phy *mphy = phy->mt76;
3556         struct {
3557                 u8 category;
3558                 u8 band;
3559                 __le16 wcid;
3560         } __packed req = {
3561                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3562                 .band = mvif->band_idx,
3563                 .wcid = cpu_to_le16(msta->wcid.idx),
3564         };
3565         struct ieee80211_supported_band *sband;
3566         struct mt7915_mcu_phy_rx_info *res;
3567         struct sk_buff *skb;
3568         int ret;
3569         bool cck = false;
3570
3571         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3572                                         &req, sizeof(req), true, &skb);
3573         if (ret)
3574                 return ret;
3575
3576         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3577
3578         rate->mcs = res->rate;
3579         rate->nss = res->nsts + 1;
3580
3581         switch (res->mode) {
3582         case MT_PHY_TYPE_CCK:
3583                 cck = true;
3584                 fallthrough;
3585         case MT_PHY_TYPE_OFDM:
3586                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3587                         sband = &mphy->sband_5g.sband;
3588                 else
3589                         sband = &mphy->sband_2g.sband;
3590
3591                 rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3592                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
3593                 break;
3594         case MT_PHY_TYPE_HT:
3595         case MT_PHY_TYPE_HT_GF:
3596                 if (rate->mcs > 31) {
3597                         ret = -EINVAL;
3598                         goto out;
3599                 }
3600
3601                 rate->flags = RATE_INFO_FLAGS_MCS;
3602                 if (res->gi)
3603                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3604                 break;
3605         case MT_PHY_TYPE_VHT:
3606                 if (rate->mcs > 9) {
3607                         ret = -EINVAL;
3608                         goto out;
3609                 }
3610
3611                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3612                 if (res->gi)
3613                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3614                 break;
3615         case MT_PHY_TYPE_HE_SU:
3616         case MT_PHY_TYPE_HE_EXT_SU:
3617         case MT_PHY_TYPE_HE_TB:
3618         case MT_PHY_TYPE_HE_MU:
3619                 if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3620                         ret = -EINVAL;
3621                         goto out;
3622                 }
3623                 rate->he_gi = res->gi;
3624                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
3625                 break;
3626         default:
3627                 ret = -EINVAL;
3628                 goto out;
3629         }
3630
3631         switch (res->bw) {
3632         case IEEE80211_STA_RX_BW_160:
3633                 rate->bw = RATE_INFO_BW_160;
3634                 break;
3635         case IEEE80211_STA_RX_BW_80:
3636                 rate->bw = RATE_INFO_BW_80;
3637                 break;
3638         case IEEE80211_STA_RX_BW_40:
3639                 rate->bw = RATE_INFO_BW_40;
3640                 break;
3641         default:
3642                 rate->bw = RATE_INFO_BW_20;
3643                 break;
3644         }
3645
3646 out:
3647         dev_kfree_skb(skb);
3648
3649         return ret;
3650 }