drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MCU_PATCH_ADDRESS               0x200000
  68
  69 #define MT_STA_BFER                     BIT(0)
  70 #define MT_STA_BFEE                     BIT(1)
  71
  72 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  73 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  74 #define FW_FEATURE_OVERRIDE_ADDR        BIT(5)
  75
  76 #define DL_MODE_ENCRYPT                 BIT(0)
  77 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  78 #define DL_MODE_RESET_SEC_IV            BIT(3)
  79 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  80 #define DL_MODE_NEED_RSP                BIT(31)
  81
  82 #define FW_START_OVERRIDE               BIT(0)
  83 #define FW_START_WORKING_PDA_CR4        BIT(2)
  84
  85 #define PATCH_SEC_TYPE_MASK             GENMASK(15, 0)
  86 #define PATCH_SEC_TYPE_INFO             0x2
  87
  88 #define to_wcid_lo(id)                  FIELD_GET(GENMASK(7, 0), (u16)id)
  89 #define to_wcid_hi(id)                  FIELD_GET(GENMASK(9, 8), (u16)id)
  90
  91 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  92 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  93
  94 static enum mt7915_cipher_type
  95 mt7915_mcu_get_cipher(int cipher)
  96 {
  97         switch (cipher) {
  98         case WLAN_CIPHER_SUITE_WEP40:
  99                 return MT_CIPHER_WEP40;
 100         case WLAN_CIPHER_SUITE_WEP104:
 101                 return MT_CIPHER_WEP104;
 102         case WLAN_CIPHER_SUITE_TKIP:
 103                 return MT_CIPHER_TKIP;
 104         case WLAN_CIPHER_SUITE_AES_CMAC:
 105                 return MT_CIPHER_BIP_CMAC_128;
 106         case WLAN_CIPHER_SUITE_CCMP:
 107                 return MT_CIPHER_AES_CCMP;
 108         case WLAN_CIPHER_SUITE_CCMP_256:
 109                 return MT_CIPHER_CCMP_256;
 110         case WLAN_CIPHER_SUITE_GCMP:
 111                 return MT_CIPHER_GCMP;
 112         case WLAN_CIPHER_SUITE_GCMP_256:
 113                 return MT_CIPHER_GCMP_256;
 114         case WLAN_CIPHER_SUITE_SMS4:
 115                 return MT_CIPHER_WAPI;
 116         default:
 117                 return MT_CIPHER_NONE;
 118         }
 119 }
 120
 121 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
 122 {
 123         static const u8 width_to_bw[] = {
 124                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
 125                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
 126                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
 127                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
 128                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
 129                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
 130                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
 131                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
 132         };
 133
 134         if (chandef->width >= ARRAY_SIZE(width_to_bw))
 135                 return 0;
 136
 137         return width_to_bw[chandef->width];
 138 }
 139
 140 static const struct ieee80211_sta_he_cap *
 141 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
 142 {
 143         struct ieee80211_supported_band *sband;
 144         enum nl80211_band band;
 145
 146         band = phy->mt76->chandef.chan->band;
 147         sband = phy->mt76->hw->wiphy->bands[band];
 148
 149         return ieee80211_get_he_iftype_cap(sband, vif->type);
 150 }
 151
 152 static u8
 153 mt7915_get_phy_mode(struct mt7915_dev *dev, struct ieee80211_vif *vif,
 154                     enum nl80211_band band, struct ieee80211_sta *sta)
 155 {
 156         struct ieee80211_sta_ht_cap *ht_cap;
 157         struct ieee80211_sta_vht_cap *vht_cap;
 158         const struct ieee80211_sta_he_cap *he_cap;
 159         u8 mode = 0;
 160
 161         if (sta) {
 162                 ht_cap = &sta->ht_cap;
 163                 vht_cap = &sta->vht_cap;
 164                 he_cap = &sta->he_cap;
 165         } else {
 166                 struct ieee80211_supported_band *sband;
 167                 struct mt7915_phy *phy;
 168                 struct mt7915_vif *mvif;
 169
 170                 mvif = (struct mt7915_vif *)vif->drv_priv;
 171                 phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
 172                 sband = phy->mt76->hw->wiphy->bands[band];
 173
 174                 ht_cap = &sband->ht_cap;
 175                 vht_cap = &sband->vht_cap;
 176                 he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
 177         }
 178
 179         if (band == NL80211_BAND_2GHZ) {
 180                 mode |= PHY_MODE_B | PHY_MODE_G;
 181
 182                 if (ht_cap->ht_supported)
 183                         mode |= PHY_MODE_GN;
 184
 185                 if (he_cap->has_he)
 186                         mode |= PHY_MODE_AX_24G;
 187         } else if (band == NL80211_BAND_5GHZ) {
 188                 mode |= PHY_MODE_A;
 189
 190                 if (ht_cap->ht_supported)
 191                         mode |= PHY_MODE_AN;
 192
 193                 if (vht_cap->vht_supported)
 194                         mode |= PHY_MODE_AC;
 195
 196                 if (he_cap->has_he)
 197                         mode |= PHY_MODE_AX_5G;
 198         }
 199
 200         return mode;
 201 }
 202
 203 static u8
 204 mt7915_mcu_get_sta_nss(u16 mcs_map)
 205 {
 206         u8 nss;
 207
 208         for (nss = 8; nss > 0; nss--) {
 209                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
 210
 211                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 212                         break;
 213         }
 214
 215         return nss - 1;
 216 }
 217
 218 static int __mt7915_mcu_msg_send(struct mt7915_dev *dev, struct sk_buff *skb,
 219                                  int cmd, int *wait_seq)
 220 {
 221         struct mt7915_mcu_txd *mcu_txd;
 222         u8 seq, pkt_fmt, qidx;
 223         enum mt76_txq_id txq;
 224         __le32 *txd;
 225         u32 val;
 226
 227         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 228         if (!seq)
 229                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 230
 231         if (cmd == -MCU_CMD_FW_SCATTER) {
 232                 txq = MT_TXQ_FWDL;
 233                 goto exit;
 234         }
 235
 236         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 237
 238         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state)) {
 239                 txq = MT_TXQ_MCU_WA;
 240                 qidx = MT_TX_MCU_PORT_RX_Q0;
 241                 pkt_fmt = MT_TX_TYPE_CMD;
 242         } else {
 243                 txq = MT_TXQ_MCU;
 244                 qidx = MT_TX_MCU_PORT_RX_Q0;
 245                 pkt_fmt = MT_TX_TYPE_CMD;
 246         }
 247
 248         txd = mcu_txd->txd;
 249
 250         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 251               FIELD_PREP(MT_TXD0_PKT_FMT, pkt_fmt) |
 252               FIELD_PREP(MT_TXD0_Q_IDX, qidx);
 253         txd[0] = cpu_to_le32(val);
 254
 255         val = MT_TXD1_LONG_FORMAT |
 256               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 257         txd[1] = cpu_to_le32(val);
 258
 259         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 260         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, qidx));
 261         mcu_txd->pkt_type = MCU_PKT_ID;
 262         mcu_txd->seq = seq;
 263
 264         if (cmd < 0) {
 265                 mcu_txd->set_query = MCU_Q_NA;
 266                 mcu_txd->cid = -cmd;
 267         } else {
 268                 mcu_txd->cid = MCU_CMD_EXT_CID;
 269                 mcu_txd->ext_cid = cmd;
 270                 mcu_txd->ext_cid_ack = 1;
 271
 272                 /* do not use Q_SET for efuse */
 273                 if (cmd == MCU_EXT_CMD_EFUSE_ACCESS)
 274                         mcu_txd->set_query = MCU_Q_QUERY;
 275                 else
 276                         mcu_txd->set_query = MCU_Q_SET;
 277         }
 278
 279         if (cmd == MCU_EXT_CMD_MWDS_SUPPORT)
 280                 mcu_txd->s2d_index = MCU_S2D_H2C;
 281         else
 282                 mcu_txd->s2d_index = MCU_S2D_H2N;
 283         WARN_ON(cmd == MCU_EXT_CMD_EFUSE_ACCESS &&
 284                 mcu_txd->set_query != MCU_Q_QUERY);
 285
 286 exit:
 287         if (wait_seq)
 288                 *wait_seq = seq;
 289
 290         return mt76_tx_queue_skb_raw(dev, txq, skb, 0);
 291 }
 292
 293 static int
 294 mt7915_mcu_parse_eeprom(struct mt7915_dev *dev, struct sk_buff *skb)
 295 {
 296         struct mt7915_mcu_eeprom_info *res;
 297         u8 *buf;
 298
 299         if (!skb)
 300                 return -EINVAL;
 301
 302         skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 303
 304         res = (struct mt7915_mcu_eeprom_info *)skb->data;
 305         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
 306         memcpy(buf, res->data, 16);
 307
 308         return 0;
 309 }
 310
 311 static int
 312 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 313                           struct sk_buff *skb, int seq)
 314 {
 315         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 316         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 317         int ret = 0;
 318
 319         if (seq != rxd->seq)
 320                 return -EAGAIN;
 321
 322         switch (cmd) {
 323         case -MCU_CMD_PATCH_SEM_CONTROL:
 324                 skb_pull(skb, sizeof(*rxd) - 4);
 325                 ret = *skb->data;
 326                 break;
 327         case MCU_EXT_CMD_THERMAL_CTRL:
 328                 skb_pull(skb, sizeof(*rxd) + 4);
 329                 ret = le32_to_cpu(*(__le32 *)skb->data);
 330                 break;
 331         case MCU_EXT_CMD_EFUSE_ACCESS:
 332                 ret = mt7915_mcu_parse_eeprom(dev, skb);
 333                 break;
 334         default:
 335                 break;
 336         }
 337
 338         return ret;
 339 }
 340
 341 static int
 342 mt7915_mcu_wait_response(struct mt7915_dev *dev, int cmd, int seq)
 343 {
 344         unsigned long expires = jiffies + 20 * HZ;
 345         struct sk_buff *skb;
 346         int ret = 0;
 347
 348         while (true) {
 349                 skb = mt76_mcu_get_response(&dev->mt76, expires);
 350                 if (!skb) {
 351                         dev_err(dev->mt76.dev, "Message %d (seq %d) timeout\n",
 352                                 cmd, seq);
 353                         return -ETIMEDOUT;
 354                 }
 355
 356                 ret = mt7915_mcu_parse_response(&dev->mt76, cmd, skb, seq);
 357                 dev_kfree_skb(skb);
 358                 if (ret != -EAGAIN)
 359                         break;
 360         }
 361
 362         return ret;
 363 }
 364
 365 static int
 366 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 367                         int cmd, bool wait_resp)
 368 {
 369         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 370         int ret, seq;
 371
 372         mutex_lock(&mdev->mcu.mutex);
 373
 374         ret = __mt7915_mcu_msg_send(dev, skb, cmd, &seq);
 375         if (ret)
 376                 goto out;
 377
 378         if (wait_resp)
 379                 ret = mt7915_mcu_wait_response(dev, cmd, seq);
 380
 381 out:
 382         mutex_unlock(&mdev->mcu.mutex);
 383
 384         return ret;
 385 }
 386
 387 static int
 388 mt7915_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data,
 389                     int len, bool wait_resp)
 390 {
 391         struct sk_buff *skb;
 392
 393         skb = mt76_mcu_msg_alloc(mdev, data, len);
 394         if (!skb)
 395                 return -ENOMEM;
 396
 397         return mt76_mcu_skb_send_msg(mdev, skb, cmd, wait_resp);
 398 }
 399
 400 static void
 401 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 402 {
 403         if (vif->csa_active)
 404                 ieee80211_csa_finish(vif);
 405 }
 406
 407 static void
 408 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 409 {
 410         struct mt76_phy *mphy = &dev->mt76.phy;
 411         struct mt7915_mcu_rdd_report *r;
 412
 413         r = (struct mt7915_mcu_rdd_report *)skb->data;
 414
 415         if (r->idx && dev->mt76.phy2)
 416                 mphy = dev->mt76.phy2;
 417
 418         ieee80211_radar_detected(mphy->hw);
 419         dev->hw_pattern++;
 420 }
 421
 422 static void
 423 mt7915_mcu_tx_rate_cal(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
 424                        struct rate_info *rate, u16 r)
 425 {
 426         struct ieee80211_supported_band *sband;
 427         u16 ru_idx = le16_to_cpu(ra->ru_idx);
 428         u16 flags = 0;
 429
 430         rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
 431         rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
 432
 433         switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
 434         case MT_PHY_TYPE_CCK:
 435         case MT_PHY_TYPE_OFDM:
 436                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
 437                         sband = &mphy->sband_5g.sband;
 438                 else
 439                         sband = &mphy->sband_2g.sband;
 440
 441                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
 442                 break;
 443         case MT_PHY_TYPE_HT:
 444         case MT_PHY_TYPE_HT_GF:
 445                 rate->mcs += (rate->nss - 1) * 8;
 446                 flags |= RATE_INFO_FLAGS_MCS;
 447
 448                 if (ra->gi)
 449                         flags |= RATE_INFO_FLAGS_SHORT_GI;
 450                 break;
 451         case MT_PHY_TYPE_VHT:
 452                 flags |= RATE_INFO_FLAGS_VHT_MCS;
 453
 454                 if (ra->gi)
 455                         flags |= RATE_INFO_FLAGS_SHORT_GI;
 456                 break;
 457         case MT_PHY_TYPE_HE_SU:
 458         case MT_PHY_TYPE_HE_EXT_SU:
 459         case MT_PHY_TYPE_HE_TB:
 460         case MT_PHY_TYPE_HE_MU:
 461                 rate->he_gi = ra->gi;
 462                 rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
 463
 464                 flags |= RATE_INFO_FLAGS_HE_MCS;
 465                 break;
 466         default:
 467                 break;
 468         }
 469         rate->flags = flags;
 470
 471         if (ru_idx) {
 472                 switch (ru_idx) {
 473                 case 1 ... 2:
 474                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
 475                         break;
 476                 case 3 ... 6:
 477                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
 478                         break;
 479                 case 7 ... 14:
 480                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
 481                         break;
 482                 default:
 483                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
 484                         break;
 485                 }
 486                 rate->bw = RATE_INFO_BW_HE_RU;
 487         } else {
 488                 u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
 489                         FIELD_GET(MT_RA_RATE_BW, r);
 490
 491                 switch (bw) {
 492                 case IEEE80211_STA_RX_BW_160:
 493                         rate->bw = RATE_INFO_BW_160;
 494                         break;
 495                 case IEEE80211_STA_RX_BW_80:
 496                         rate->bw = RATE_INFO_BW_80;
 497                         break;
 498                 case IEEE80211_STA_RX_BW_40:
 499                         rate->bw = RATE_INFO_BW_40;
 500                         break;
 501                 default:
 502                         rate->bw = RATE_INFO_BW_20;
 503                         break;
 504                 }
 505         }
 506 }
 507
 508 static void
 509 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
 510 {
 511         struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
 512         struct rate_info rate = {}, prob_rate = {};
 513         u16 probe = le16_to_cpu(ra->prob_up_rate);
 514         u16 attempts = le16_to_cpu(ra->attempts);
 515         u16 curr = le16_to_cpu(ra->curr_rate);
 516         u16 wcidx = le16_to_cpu(ra->wlan_idx);
 517         struct mt76_phy *mphy = &dev->mphy;
 518         struct mt7915_sta_stats *stats;
 519         struct mt7915_sta *msta;
 520         struct mt76_wcid *wcid;
 521
 522         if (wcidx >= MT76_N_WCIDS)
 523                 return;
 524
 525         wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
 526         if (!wcid)
 527                 return;
 528
 529         msta = container_of(wcid, struct mt7915_sta, wcid);
 530         stats = &msta->stats;
 531
 532         if (msta->wcid.ext_phy && dev->mt76.phy2)
 533                 mphy = dev->mt76.phy2;
 534
 535         /* current rate */
 536         mt7915_mcu_tx_rate_cal(mphy, ra, &rate, curr);
 537         stats->tx_rate = rate;
 538
 539         /* probing rate */
 540         mt7915_mcu_tx_rate_cal(mphy, ra, &prob_rate, probe);
 541         stats->prob_rate = prob_rate;
 542
 543         if (attempts) {
 544                 u16 success = le16_to_cpu(ra->success);
 545
 546                 stats->per = 1000 * (attempts - success) / attempts;
 547         }
 548 }
 549
 550 static void
 551 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 552 {
 553         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 554         const char *data = (char *)&rxd[1];
 555         const char *type;
 556
 557         switch (rxd->s2d_index) {
 558         case 0:
 559                 type = "WM";
 560                 break;
 561         case 2:
 562                 type = "WA";
 563                 break;
 564         default:
 565                 type = "unknown";
 566                 break;
 567         }
 568
 569         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 570 }
 571
 572 static void
 573 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 574 {
 575         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 576
 577         switch (rxd->ext_eid) {
 578         case MCU_EXT_EVENT_RDD_REPORT:
 579                 mt7915_mcu_rx_radar_detected(dev, skb);
 580                 break;
 581         case MCU_EXT_EVENT_CSA_NOTIFY:
 582                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 583                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 584                                 mt7915_mcu_csa_finish, dev);
 585                 break;
 586         case MCU_EXT_EVENT_RATE_REPORT:
 587                 mt7915_mcu_tx_rate_report(dev, skb);
 588                 break;
 589         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 590                 mt7915_mcu_rx_log_message(dev, skb);
 591                 break;
 592         default:
 593                 break;
 594         }
 595 }
 596
 597 static void
 598 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 599 {
 600         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 601
 602         switch (rxd->eid) {
 603         case MCU_EVENT_EXT:
 604                 mt7915_mcu_rx_ext_event(dev, skb);
 605                 break;
 606         default:
 607                 break;
 608         }
 609         dev_kfree_skb(skb);
 610 }
 611
 612 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 613 {
 614         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 615
 616         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 617             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 618             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 619             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 620             rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 621             !rxd->seq)
 622                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 623         else
 624                 mt76_mcu_rx_event(&dev->mt76, skb);
 625 }
 626
 627 static struct sk_buff *
 628 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
 629                          struct mt7915_sta *msta, int len)
 630 {
 631         struct sta_req_hdr hdr = {
 632                 .bss_idx = mvif->idx,
 633                 .wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
 634                 .wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
 635                 .muar_idx = msta ? mvif->omac_idx : 0,
 636                 .is_tlv_append = 1,
 637         };
 638         struct sk_buff *skb;
 639
 640         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
 641         if (!skb)
 642                 return ERR_PTR(-ENOMEM);
 643
 644         skb_put_data(skb, &hdr, sizeof(hdr));
 645
 646         return skb;
 647 }
 648
 649 static struct wtbl_req_hdr *
 650 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
 651                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 652 {
 653         struct tlv *sta_hdr = sta_wtbl;
 654         struct wtbl_req_hdr hdr = {
 655                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
 656                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
 657                 .operation = cmd,
 658         };
 659         struct sk_buff *nskb = *skb;
 660
 661         if (!nskb) {
 662                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 663                                           MT7915_WTBL_UPDATE_BA_SIZE);
 664                 if (!nskb)
 665                         return ERR_PTR(-ENOMEM);
 666
 667                 *skb = nskb;
 668         }
 669
 670         if (sta_hdr)
 671                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 672
 673         return skb_put_data(nskb, &hdr, sizeof(hdr));
 674 }
 675
 676 static struct tlv *
 677 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 678                           void *sta_ntlv, void *sta_wtbl)
 679 {
 680         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 681         struct tlv *sta_hdr = sta_wtbl;
 682         struct tlv *ptlv, tlv = {
 683                 .tag = cpu_to_le16(tag),
 684                 .len = cpu_to_le16(len),
 685         };
 686         u16 ntlv;
 687
 688         ptlv = skb_put(skb, len);
 689         memcpy(ptlv, &tlv, sizeof(tlv));
 690
 691         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 692         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 693
 694         if (sta_hdr) {
 695                 u16 size = le16_to_cpu(sta_hdr->len);
 696
 697                 sta_hdr->len = cpu_to_le16(size + len);
 698         }
 699
 700         return ptlv;
 701 }
 702
 703 static struct tlv *
 704 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 705 {
 706         return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 707 }
 708
 709 static struct tlv *
 710 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 711                              __le16 *sub_ntlv, __le16 *len)
 712 {
 713         struct tlv *ptlv, tlv = {
 714                 .tag = cpu_to_le16(sub_tag),
 715                 .len = cpu_to_le16(sub_len),
 716         };
 717
 718         ptlv = skb_put(skb, sub_len);
 719         memcpy(ptlv, &tlv, sizeof(tlv));
 720
 721         le16_add_cpu(sub_ntlv, 1);
 722         le16_add_cpu(len, sub_len);
 723
 724         return ptlv;
 725 }
 726
 727 /** bss info **/
 728 static int
 729 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 730                          struct mt7915_phy *phy, bool enable)
 731 {
 732         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 733         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 734         enum nl80211_band band = chandef->chan->band;
 735         struct bss_info_basic *bss;
 736         u16 wlan_idx = mvif->sta.wcid.idx;
 737         u32 type = NETWORK_INFRA;
 738         struct tlv *tlv;
 739
 740         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 741
 742         switch (vif->type) {
 743         case NL80211_IFTYPE_MESH_POINT:
 744         case NL80211_IFTYPE_AP:
 745                 break;
 746         case NL80211_IFTYPE_STATION:
 747                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 748                 if (enable) {
 749                         struct ieee80211_sta *sta;
 750                         struct mt7915_sta *msta;
 751
 752                         rcu_read_lock();
 753                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 754                         if (!sta) {
 755                                 rcu_read_unlock();
 756                                 return -EINVAL;
 757                         }
 758
 759                         msta = (struct mt7915_sta *)sta->drv_priv;
 760                         wlan_idx = msta->wcid.idx;
 761                         rcu_read_unlock();
 762                 }
 763                 break;
 764         case NL80211_IFTYPE_ADHOC:
 765                 type = NETWORK_IBSS;
 766                 break;
 767         default:
 768                 WARN_ON(1);
 769                 break;
 770         }
 771
 772         bss = (struct bss_info_basic *)tlv;
 773         memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 774         bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 775         bss->network_type = cpu_to_le32(type);
 776         bss->dtim_period = vif->bss_conf.dtim_period;
 777         bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
 778         bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
 779         bss->phy_mode = mt7915_get_phy_mode(phy->dev, vif, band, NULL);
 780         bss->wmm_idx = mvif->wmm_idx;
 781         bss->active = enable;
 782
 783         return 0;
 784 }
 785
 786 static void
 787 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 788 {
 789         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 790         struct bss_info_omac *omac;
 791         struct tlv *tlv;
 792         u32 type = 0;
 793         u8 idx;
 794
 795         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 796
 797         switch (vif->type) {
 798         case NL80211_IFTYPE_MESH_POINT:
 799         case NL80211_IFTYPE_AP:
 800                 type = CONNECTION_INFRA_AP;
 801                 break;
 802         case NL80211_IFTYPE_STATION:
 803                 type = CONNECTION_INFRA_STA;
 804                 break;
 805         case NL80211_IFTYPE_ADHOC:
 806                 type = CONNECTION_IBSS_ADHOC;
 807                 break;
 808         default:
 809                 WARN_ON(1);
 810                 break;
 811         }
 812
 813         omac = (struct bss_info_omac *)tlv;
 814         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 815         omac->conn_type = cpu_to_le32(type);
 816         omac->omac_idx = mvif->omac_idx;
 817         omac->band_idx = mvif->band_idx;
 818         omac->hw_bss_idx = idx;
 819 }
 820
 821 struct mt7915_he_obss_narrow_bw_ru_data {
 822         bool tolerated;
 823 };
 824
 825 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 826                                                    struct cfg80211_bss *bss,
 827                                                    void *_data)
 828 {
 829         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 830         const struct element *elem;
 831
 832         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 833
 834         if (!elem || elem->datalen < 10 ||
 835             !(elem->data[10] &
 836               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 837                 data->tolerated = false;
 838 }
 839
 840 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 841                                               struct ieee80211_vif *vif)
 842 {
 843         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 844                 .tolerated = true,
 845         };
 846
 847         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 848                 return false;
 849
 850         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 851                           mt7915_check_he_obss_narrow_bw_ru_iter,
 852                           &iter_data);
 853
 854         /*
 855          * If there is at least one AP on radar channel that cannot
 856          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 857          */
 858         return !iter_data.tolerated;
 859 }
 860
 861 static void
 862 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 863                         struct mt7915_phy *phy)
 864 {
 865         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 866         struct bss_info_rf_ch *ch;
 867         struct tlv *tlv;
 868         int freq1 = chandef->center_freq1;
 869
 870         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 871
 872         ch = (struct bss_info_rf_ch *)tlv;
 873         ch->pri_ch = chandef->chan->hw_value;
 874         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 875         ch->bw = mt7915_mcu_chan_bw(chandef);
 876
 877         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 878                 int freq2 = chandef->center_freq2;
 879
 880                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 881         }
 882
 883         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 884                 struct mt7915_dev *dev = phy->dev;
 885                 struct mt76_phy *mphy = &dev->mt76.phy;
 886                 bool ext_phy = phy != &dev->phy;
 887
 888                 if (ext_phy && dev->mt76.phy2)
 889                         mphy = dev->mt76.phy2;
 890
 891                 ch->he_ru26_block =
 892                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 893                 ch->he_all_disable = false;
 894         } else {
 895                 ch->he_all_disable = true;
 896         }
 897 }
 898
 899 static void
 900 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 901                       struct mt7915_phy *phy)
 902 {
 903         struct bss_info_ra *ra;
 904         struct tlv *tlv;
 905         int max_nss = hweight8(phy->chainmask);
 906
 907         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 908
 909         ra = (struct bss_info_ra *)tlv;
 910         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 911         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 912         ra->short_preamble = true;
 913         ra->tx_streams = max_nss;
 914         ra->rx_streams = max_nss;
 915         ra->algo = 4;
 916         ra->train_up_rule = 2;
 917         ra->train_up_high_thres = 110;
 918         ra->train_up_rule_rssi = -70;
 919         ra->low_traffic_thres = 2;
 920         ra->phy_cap = cpu_to_le32(0xfdf);
 921         ra->interval = cpu_to_le32(500);
 922         ra->fast_interval = cpu_to_le32(100);
 923 }
 924
 925 static void
 926 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 927                       struct mt7915_phy *phy)
 928 {
 929 #define DEFAULT_HE_PE_DURATION          4
 930 #define DEFAULT_HE_DURATION_RTS_THRES   1023
 931         const struct ieee80211_sta_he_cap *cap;
 932         struct bss_info_he *he;
 933         struct tlv *tlv;
 934
 935         cap = mt7915_get_he_phy_cap(phy, vif);
 936
 937         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 938
 939         he = (struct bss_info_he *)tlv;
 940         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
 941         if (!he->he_pe_duration)
 942                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 943
 944         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
 945         if (!he->he_rts_thres)
 946                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 947
 948         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 949         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 950         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 951 }
 952
 953 static void
 954 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
 955 {
 956 #define TXD_CMP_MAP1            GENMASK(15, 0)
 957 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
 958         struct bss_info_hw_amsdu *amsdu;
 959         struct tlv *tlv;
 960
 961         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
 962
 963         amsdu = (struct bss_info_hw_amsdu *)tlv;
 964         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
 965         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
 966         amsdu->trig_thres = cpu_to_le16(2);
 967         amsdu->enable = true;
 968 }
 969
 970 static void
 971 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
 972 {
 973 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 974 #define BCN_TX_ESTIMATE_TIME    (4096 + 20)
 975         struct bss_info_ext_bss *ext;
 976         int ext_bss_idx, tsf_offset;
 977         struct tlv *tlv;
 978
 979         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 980         if (ext_bss_idx < 0)
 981                 return;
 982
 983         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 984
 985         ext = (struct bss_info_ext_bss *)tlv;
 986         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 987         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 988 }
 989
 990 static void
 991 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
 992 {
 993         struct bss_info_bmc_rate *bmc;
 994         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 995         enum nl80211_band band = chandef->chan->band;
 996         struct tlv *tlv;
 997
 998         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
 999
1000         bmc = (struct bss_info_bmc_rate *)tlv;
1001         if (band == NL80211_BAND_2GHZ) {
1002                 bmc->short_preamble = true;
1003         } else {
1004                 bmc->bc_trans = cpu_to_le16(0x2000);
1005                 bmc->mc_trans = cpu_to_le16(0x2080);
1006         }
1007 }
1008
1009 static void
1010 mt7915_mcu_bss_sync_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
1011 {
1012         struct bss_info_sync_mode *sync;
1013         struct tlv *tlv;
1014
1015         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_SYNC_MODE, sizeof(*sync));
1016
1017         sync = (struct bss_info_sync_mode *)tlv;
1018         sync->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
1019         sync->dtim_period = vif->bss_conf.dtim_period;
1020         sync->enable = true;
1021 }
1022
1023 static int
1024 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1025                        bool bssid, bool enable)
1026 {
1027         struct mt7915_dev *dev = phy->dev;
1028         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1029         u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
1030         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
1031         const u8 *addr = vif->addr;
1032         struct {
1033                 u8 mode;
1034                 u8 force_clear;
1035                 u8 clear_bitmap[8];
1036                 u8 entry_count;
1037                 u8 write;
1038                 u8 band;
1039
1040                 u8 index;
1041                 u8 bssid;
1042                 u8 addr[ETH_ALEN];
1043         } __packed req = {
1044                 .mode = !!mask || enable,
1045                 .entry_count = 1,
1046                 .write = 1,
1047
1048                 .index = idx * 2 + bssid,
1049         };
1050
1051         if (bssid)
1052                 addr = vif->bss_conf.bssid;
1053
1054         if (enable)
1055                 ether_addr_copy(req.addr, addr);
1056
1057         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
1058                                  sizeof(req), true);
1059 }
1060
1061 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1062                             struct ieee80211_vif *vif, int enable)
1063 {
1064         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1065         struct sk_buff *skb;
1066
1067         if (mvif->omac_idx >= REPEATER_BSSID_START)
1068                 mt7915_mcu_muar_config(phy, vif, true, enable);
1069
1070         skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1071                                        MT7915_BSS_UPDATE_MAX_SIZE);
1072         if (IS_ERR(skb))
1073                 return PTR_ERR(skb);
1074
1075         /* bss_omac must be first */
1076         if (enable)
1077                 mt7915_mcu_bss_omac_tlv(skb, vif);
1078
1079         mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1080
1081         if (enable) {
1082                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1083                 mt7915_mcu_bss_bmc_tlv(skb, phy);
1084                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1085                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
1086
1087                 if (vif->bss_conf.he_support)
1088                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
1089
1090                 if (mvif->omac_idx < EXT_BSSID_START)
1091                         mt7915_mcu_bss_sync_tlv(skb, vif);
1092                 else if (mvif->omac_idx < REPEATER_BSSID_START)
1093                         mt7915_mcu_bss_ext_tlv(skb, mvif);
1094         }
1095
1096         return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1097                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1098 }
1099
1100 /** starec & wtbl **/
1101 static int
1102 mt7915_mcu_sta_key_tlv(struct sk_buff *skb, struct ieee80211_key_conf *key,
1103                        enum set_key_cmd cmd)
1104 {
1105         struct sta_rec_sec *sec;
1106         struct tlv *tlv;
1107         u32 len = sizeof(*sec);
1108
1109         tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1110
1111         sec = (struct sta_rec_sec *)tlv;
1112         sec->add = cmd;
1113
1114         if (cmd == SET_KEY) {
1115                 struct sec_key *sec_key;
1116                 u8 cipher;
1117
1118                 cipher = mt7915_mcu_get_cipher(key->cipher);
1119                 if (cipher == MT_CIPHER_NONE)
1120                         return -EOPNOTSUPP;
1121
1122                 sec_key = &sec->key[0];
1123                 sec_key->cipher_len = sizeof(*sec_key);
1124                 sec_key->key_id = key->keyidx;
1125
1126                 if (cipher == MT_CIPHER_BIP_CMAC_128) {
1127                         sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1128                         sec_key->key_len = 16;
1129                         memcpy(sec_key->key, key->key, 16);
1130
1131                         sec_key = &sec->key[1];
1132                         sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1133                         sec_key->cipher_len = sizeof(*sec_key);
1134                         sec_key->key_len = 16;
1135                         memcpy(sec_key->key, key->key + 16, 16);
1136
1137                         sec->n_cipher = 2;
1138                 } else {
1139                         sec_key->cipher_id = cipher;
1140                         sec_key->key_len = key->keylen;
1141                         memcpy(sec_key->key, key->key, key->keylen);
1142
1143                         if (cipher == MT_CIPHER_TKIP) {
1144                                 /* Rx/Tx MIC keys are swapped */
1145                                 memcpy(sec_key->key + 16, key->key + 24, 8);
1146                                 memcpy(sec_key->key + 24, key->key + 16, 8);
1147                         }
1148
1149                         len -= sizeof(*sec_key);
1150                         sec->n_cipher = 1;
1151                 }
1152         } else {
1153                 len -= sizeof(sec->key);
1154                 sec->n_cipher = 0;
1155         }
1156         sec->len = cpu_to_le16(len);
1157
1158         return 0;
1159 }
1160
1161 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1162                        struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1163                        enum set_key_cmd cmd)
1164 {
1165         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1166         struct sk_buff *skb;
1167         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1168         int ret;
1169
1170         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1171         if (IS_ERR(skb))
1172                 return PTR_ERR(skb);
1173
1174         ret = mt7915_mcu_sta_key_tlv(skb, key, cmd);
1175         if (ret)
1176                 return ret;
1177
1178         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1179                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1180 }
1181
1182 static void
1183 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1184                       struct ieee80211_ampdu_params *params,
1185                       bool enable, bool tx)
1186 {
1187         struct sta_rec_ba *ba;
1188         struct tlv *tlv;
1189
1190         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1191
1192         ba = (struct sta_rec_ba *)tlv;
1193         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT,
1194         ba->winsize = cpu_to_le16(params->buf_size);
1195         ba->ssn = cpu_to_le16(params->ssn);
1196         ba->ba_en = enable << params->tid;
1197         ba->amsdu = params->amsdu;
1198         ba->tid = params->tid;
1199 }
1200
1201 static void
1202 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1203                        struct ieee80211_ampdu_params *params,
1204                        bool enable, bool tx, void *sta_wtbl,
1205                        void *wtbl_tlv)
1206 {
1207         struct wtbl_ba *ba;
1208         struct tlv *tlv;
1209
1210         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1211                                         wtbl_tlv, sta_wtbl);
1212
1213         ba = (struct wtbl_ba *)tlv;
1214         ba->tid = params->tid;
1215
1216         if (tx) {
1217                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1218                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1219                 ba->ba_en = enable;
1220         } else {
1221                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1222                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1223                 ba->rst_ba_tid = params->tid;
1224                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1225                 ba->rst_ba_sb = 1;
1226         }
1227
1228         if (enable && tx)
1229                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1230 }
1231
1232 static int
1233 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1234                   struct ieee80211_ampdu_params *params,
1235                   bool enable, bool tx)
1236 {
1237         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1238         struct mt7915_vif *mvif = msta->vif;
1239         struct wtbl_req_hdr *wtbl_hdr;
1240         struct tlv *sta_wtbl;
1241         struct sk_buff *skb;
1242         int ret;
1243
1244         if (enable && tx && !params->amsdu)
1245                 msta->wcid.amsdu = false;
1246
1247         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1248                                        MT7915_STA_UPDATE_MAX_SIZE);
1249         if (IS_ERR(skb))
1250                 return PTR_ERR(skb);
1251
1252         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1253
1254         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1255                                              &skb);
1256         mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1257
1258         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1259                                     MCU_EXT_CMD_STA_REC_UPDATE, true);
1260         if (ret)
1261                 return ret;
1262
1263         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1264                                        MT7915_STA_UPDATE_MAX_SIZE);
1265         if (IS_ERR(skb))
1266                 return PTR_ERR(skb);
1267
1268         mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1269
1270         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1271                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1272 }
1273
1274 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1275                          struct ieee80211_ampdu_params *params,
1276                          bool enable)
1277 {
1278         return mt7915_mcu_sta_ba(dev, params, enable, true);
1279 }
1280
1281 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1282                          struct ieee80211_ampdu_params *params,
1283                          bool enable)
1284 {
1285         return mt7915_mcu_sta_ba(dev, params, enable, false);
1286 }
1287
1288 static void
1289 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1290                             struct ieee80211_sta *sta, void *sta_wtbl,
1291                             void *wtbl_tlv)
1292 {
1293         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1294         struct wtbl_generic *generic;
1295         struct wtbl_rx *rx;
1296         struct tlv *tlv;
1297
1298         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1299                                         wtbl_tlv, sta_wtbl);
1300
1301         generic = (struct wtbl_generic *)tlv;
1302
1303         if (sta) {
1304                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1305                 generic->partial_aid = cpu_to_le16(sta->aid);
1306                 generic->muar_idx = mvif->omac_idx;
1307                 generic->qos = sta->wme;
1308         } else {
1309                 /* use BSSID in station mode */
1310                 if (vif->type == NL80211_IFTYPE_STATION)
1311                         memcpy(generic->peer_addr, vif->bss_conf.bssid,
1312                                ETH_ALEN);
1313                 else
1314                         eth_broadcast_addr(generic->peer_addr);
1315
1316                 generic->muar_idx = 0xe;
1317         }
1318
1319         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1320                                         wtbl_tlv, sta_wtbl);
1321
1322         rx = (struct wtbl_rx *)tlv;
1323         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1324         rx->rca2 = 1;
1325         rx->rv = 1;
1326 }
1327
1328 static void
1329 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1330                          struct ieee80211_sta *sta, bool enable)
1331 {
1332 #define EXTRA_INFO_VER          BIT(0)
1333 #define EXTRA_INFO_NEW          BIT(1)
1334         struct sta_rec_basic *basic;
1335         struct tlv *tlv;
1336
1337         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1338
1339         basic = (struct sta_rec_basic *)tlv;
1340         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1341
1342         if (enable) {
1343                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1344                 basic->conn_state = CONN_STATE_PORT_SECURE;
1345         } else {
1346                 basic->conn_state = CONN_STATE_DISCONNECT;
1347         }
1348
1349         if (!sta) {
1350                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1351                 eth_broadcast_addr(basic->peer_addr);
1352                 return;
1353         }
1354
1355         switch (vif->type) {
1356         case NL80211_IFTYPE_MESH_POINT:
1357         case NL80211_IFTYPE_AP:
1358                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1359                 break;
1360         case NL80211_IFTYPE_STATION:
1361                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1362                 break;
1363         case NL80211_IFTYPE_ADHOC:
1364                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1365                 break;
1366         default:
1367                 WARN_ON(1);
1368                 break;
1369         }
1370
1371         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1372         basic->aid = cpu_to_le16(sta->aid);
1373         basic->qos = sta->wme;
1374 }
1375
1376 static void
1377 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1378 {
1379         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1380         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1381         struct sta_rec_he *he;
1382         struct tlv *tlv;
1383         u32 cap = 0;
1384
1385         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1386
1387         he = (struct sta_rec_he *)tlv;
1388
1389         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1390                 cap |= STA_REC_HE_CAP_HTC;
1391
1392         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1393                 cap |= STA_REC_HE_CAP_BSR;
1394
1395         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1396                 cap |= STA_REC_HE_CAP_OM;
1397
1398         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1399                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1400
1401         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1402                 cap |= STA_REC_HE_CAP_BQR;
1403
1404         if (elem->phy_cap_info[0] &
1405             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1406              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1407                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1408
1409         if (elem->phy_cap_info[1] &
1410             IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1411                 cap |= STA_REC_HE_CAP_LDPC;
1412
1413         if (elem->phy_cap_info[1] &
1414             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1415                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1416
1417         if (elem->phy_cap_info[2] &
1418             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1419                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1420
1421         if (elem->phy_cap_info[2] &
1422             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1423                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1424
1425         if (elem->phy_cap_info[2] &
1426             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1427                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1428
1429         if (elem->phy_cap_info[6] &
1430             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1431                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1432
1433         if (elem->phy_cap_info[7] &
1434             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1435                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1436
1437         if (elem->phy_cap_info[7] &
1438             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1439                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1440
1441         if (elem->phy_cap_info[7] &
1442             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1443                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1444
1445         if (elem->phy_cap_info[8] &
1446             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1447                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1448
1449         if (elem->phy_cap_info[8] &
1450             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1451                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1452
1453         if (elem->phy_cap_info[9] &
1454             IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1455                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1456
1457         if (elem->phy_cap_info[9] &
1458             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1459                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1460
1461         if (elem->phy_cap_info[9] &
1462             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1463                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1464
1465         he->he_cap = cpu_to_le32(cap);
1466
1467         switch (sta->bandwidth) {
1468         case IEEE80211_STA_RX_BW_160:
1469                 if (elem->phy_cap_info[0] &
1470                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1471                         he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1472                                 he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1473
1474                 he->max_nss_mcs[CMD_HE_MCS_BW160] =
1475                                 he_cap->he_mcs_nss_supp.rx_mcs_160;
1476                 fallthrough;
1477         default:
1478                 he->max_nss_mcs[CMD_HE_MCS_BW80] =
1479                                 he_cap->he_mcs_nss_supp.rx_mcs_80;
1480                 break;
1481         }
1482
1483         he->t_frame_dur =
1484                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1485         he->max_ampdu_exp =
1486                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1487
1488         he->bw_set =
1489                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1490         he->device_class =
1491                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1492         he->punc_pream_rx =
1493                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1494
1495         he->dcm_tx_mode =
1496                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1497         he->dcm_tx_max_nss =
1498                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1499         he->dcm_rx_mode =
1500                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1501         he->dcm_rx_max_nss =
1502                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1503         he->dcm_rx_max_nss =
1504                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1505
1506         he->pkt_ext = 2;
1507 }
1508
1509 static void
1510 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1511                      struct ieee80211_vif *vif)
1512 {
1513         struct sta_rec_uapsd *uapsd;
1514         struct tlv *tlv;
1515
1516         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1517                 return;
1518
1519         tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1520         uapsd = (struct sta_rec_uapsd *)tlv;
1521
1522         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1523                 uapsd->dac_map |= BIT(3);
1524                 uapsd->tac_map |= BIT(3);
1525         }
1526         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1527                 uapsd->dac_map |= BIT(2);
1528                 uapsd->tac_map |= BIT(2);
1529         }
1530         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1531                 uapsd->dac_map |= BIT(1);
1532                 uapsd->tac_map |= BIT(1);
1533         }
1534         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1535                 uapsd->dac_map |= BIT(0);
1536                 uapsd->tac_map |= BIT(0);
1537         }
1538         uapsd->max_sp = sta->max_sp;
1539 }
1540
1541 static void
1542 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1543 {
1544         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1545         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1546         struct sta_rec_muru *muru;
1547         struct tlv *tlv;
1548
1549         tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1550
1551         muru = (struct sta_rec_muru *)tlv;
1552         muru->cfg.ofdma_dl_en = true;
1553         muru->cfg.mimo_dl_en = true;
1554
1555         muru->ofdma_dl.punc_pream_rx =
1556                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1557         muru->ofdma_dl.he_20m_in_40m_2g =
1558                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1559         muru->ofdma_dl.he_20m_in_160m =
1560                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1561         muru->ofdma_dl.he_80m_in_160m =
1562                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1563         muru->ofdma_dl.lt16_sigb = 0;
1564         muru->ofdma_dl.rx_su_comp_sigb = 0;
1565         muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1566
1567         muru->ofdma_ul.t_frame_dur =
1568                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1569         muru->ofdma_ul.mu_cascading =
1570                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1571         muru->ofdma_ul.uo_ra =
1572                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1573         muru->ofdma_ul.he_2x996_tone = 0;
1574         muru->ofdma_ul.rx_t_frame_11ac = 0;
1575
1576         muru->mimo_dl.vht_mu_bfee =
1577                 !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1578         muru->mimo_dl.partial_bw_dl_mimo =
1579                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1580
1581         muru->mimo_ul.full_ul_mimo =
1582                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1583         muru->mimo_ul.partial_ul_mimo =
1584                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1585 }
1586
1587 static int
1588 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1589                   struct ieee80211_sta *sta)
1590 {
1591         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1592         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1593         struct sk_buff *skb;
1594         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1595
1596         if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1597                 return 0;
1598
1599         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1600         if (IS_ERR(skb))
1601                 return PTR_ERR(skb);
1602
1603         /* starec muru */
1604         mt7915_mcu_sta_muru_tlv(skb, sta);
1605
1606         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1607                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1608 }
1609
1610 static void
1611 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1612 {
1613         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1614         struct sta_rec_amsdu *amsdu;
1615         struct tlv *tlv;
1616
1617         if (!sta->max_amsdu_len)
1618             return;
1619
1620         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1621         amsdu = (struct sta_rec_amsdu *)tlv;
1622         amsdu->max_amsdu_num = 8;
1623         amsdu->amsdu_en = true;
1624         amsdu->max_mpdu_size = sta->max_amsdu_len >=
1625                                IEEE80211_MAX_MPDU_LEN_VHT_7991;
1626         msta->wcid.amsdu = true;
1627 }
1628
1629 static bool
1630 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1631 {
1632         switch (vif->type) {
1633         case NL80211_IFTYPE_AP:
1634         case NL80211_IFTYPE_STATION:
1635                 return true;
1636         default:
1637                 return false;
1638         }
1639 }
1640
1641 static void
1642 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1643                    struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1644 {
1645         struct tlv *tlv;
1646
1647         /* starec ht */
1648         if (sta->ht_cap.ht_supported) {
1649                 struct sta_rec_ht *ht;
1650
1651                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1652                 ht = (struct sta_rec_ht *)tlv;
1653                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1654
1655                 if (mt7915_hw_amsdu_supported(vif))
1656                         mt7915_mcu_sta_amsdu_tlv(skb, sta);
1657         }
1658
1659         /* starec vht */
1660         if (sta->vht_cap.vht_supported) {
1661                 struct sta_rec_vht *vht;
1662
1663                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1664                 vht = (struct sta_rec_vht *)tlv;
1665                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1666                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1667                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1668         }
1669
1670         /* starec he */
1671         if (sta->he_cap.has_he)
1672                 mt7915_mcu_sta_he_tlv(skb, sta);
1673
1674         /* starec uapsd */
1675         mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1676 }
1677
1678 static void
1679 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1680                          void *sta_wtbl, void *wtbl_tlv)
1681 {
1682         struct wtbl_smps *smps;
1683         struct tlv *tlv;
1684
1685         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1686                                         wtbl_tlv, sta_wtbl);
1687         smps = (struct wtbl_smps *)tlv;
1688
1689         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1690                 smps->smps = true;
1691 }
1692
1693 static void
1694 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1695                        void *sta_wtbl, void *wtbl_tlv)
1696 {
1697         struct wtbl_ht *ht = NULL;
1698         struct tlv *tlv;
1699
1700         /* wtbl ht */
1701         if (sta->ht_cap.ht_supported) {
1702                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1703                                                 wtbl_tlv, sta_wtbl);
1704                 ht = (struct wtbl_ht *)tlv;
1705                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1706                 ht->af = sta->ht_cap.ampdu_factor;
1707                 ht->mm = sta->ht_cap.ampdu_density;
1708                 ht->ht = true;
1709         }
1710
1711         /* wtbl vht */
1712         if (sta->vht_cap.vht_supported) {
1713                 struct wtbl_vht *vht;
1714                 u8 af;
1715
1716                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1717                                                 wtbl_tlv, sta_wtbl);
1718                 vht = (struct wtbl_vht *)tlv;
1719                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1720                 vht->vht = true;
1721
1722                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1723                                sta->vht_cap.cap);
1724                 if (ht)
1725                         ht->af = max_t(u8, ht->af, af);
1726         }
1727
1728         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1729 }
1730
1731 static void
1732 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1733                               struct ieee80211_sta *sta,
1734                               void *sta_wtbl, void *wtbl_tlv)
1735 {
1736         struct mt7915_sta *msta;
1737         struct wtbl_hdr_trans *htr = NULL;
1738         struct tlv *tlv;
1739
1740         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1741                                         wtbl_tlv, sta_wtbl);
1742         htr = (struct wtbl_hdr_trans *)tlv;
1743         htr->no_rx_trans = true;
1744         if (vif->type == NL80211_IFTYPE_STATION)
1745                 htr->to_ds = true;
1746         else
1747                 htr->from_ds = true;
1748
1749         if (!sta)
1750                 return;
1751
1752         msta = (struct mt7915_sta *)sta->drv_priv;
1753         if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1754                 htr->to_ds = true;
1755                 htr->from_ds = true;
1756         }
1757 }
1758
1759 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1760                                     struct ieee80211_vif *vif,
1761                                     struct ieee80211_sta *sta)
1762 {
1763         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1764         struct wtbl_req_hdr *wtbl_hdr;
1765         struct sk_buff *skb;
1766
1767         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1768         if (!skb)
1769                 return -ENOMEM;
1770
1771         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1772         mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1773
1774         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1775                                      true);
1776 }
1777
1778 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1779                         struct ieee80211_sta *sta)
1780 {
1781         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1782         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1783         struct wtbl_req_hdr *wtbl_hdr;
1784         struct tlv *sta_wtbl;
1785         struct sk_buff *skb;
1786
1787         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1788                                        MT7915_STA_UPDATE_MAX_SIZE);
1789         if (IS_ERR(skb))
1790                 return PTR_ERR(skb);
1791
1792         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1793
1794         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1795                                              &skb);
1796         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1797
1798         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1799                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1800 }
1801
1802 static void
1803 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1804 {
1805         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1806         bf->ndp_rate = 0;                               /* mcs0 */
1807         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1808         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1809 }
1810
1811 static void
1812 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct sta_rec_bf *bf)
1813 {
1814         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1815         u8 n = 0;
1816
1817         bf->tx_mode = MT_PHY_TYPE_HT;
1818         bf->bf_cap |= MT_IBF;
1819
1820         if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1821             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1822                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1823                               mcs->tx_params);
1824         else if (mcs->rx_mask[3])
1825                 n = 3;
1826         else if (mcs->rx_mask[2])
1827                 n = 2;
1828         else if (mcs->rx_mask[1])
1829                 n = 1;
1830
1831         bf->nc = min_t(u8, bf->nr, n);
1832         bf->ibf_ncol = bf->nc;
1833
1834         if (sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1835                 bf->ibf_timeout = 0x48;
1836 }
1837
1838 static void
1839 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1840                         struct sta_rec_bf *bf)
1841 {
1842         struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1843         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1844         u8 bfee_nr, bfer_nr, n, tx_ant = hweight8(phy->chainmask) - 1;
1845         u16 mcs_map;
1846
1847         bf->tx_mode = MT_PHY_TYPE_VHT;
1848         bf->bf_cap |= MT_EBF;
1849
1850         mt7915_mcu_sta_sounding_rate(bf);
1851
1852         bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1853                             pc->cap);
1854         bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1855                             vc->cap);
1856         mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1857
1858         n = min_t(u8, bfer_nr, bfee_nr);
1859         bf->nr = min_t(u8, n, tx_ant);
1860         n = mt7915_mcu_get_sta_nss(mcs_map);
1861
1862         bf->nc = min_t(u8, n, bf->nr);
1863         bf->ibf_ncol = bf->nc;
1864
1865         /* force nr from 4 to 2 */
1866         if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1867                 bf->nr = 1;
1868 }
1869
1870 static void
1871 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1872                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1873 {
1874         struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1875         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1876         const struct ieee80211_he_cap_elem *ve;
1877         const struct ieee80211_sta_he_cap *vc;
1878         u8 bfee_nr, bfer_nr, nss_mcs;
1879         u16 mcs_map;
1880
1881         vc = mt7915_get_he_phy_cap(phy, vif);
1882         ve = &vc->he_cap_elem;
1883
1884         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1885         bf->bf_cap |= MT_EBF;
1886
1887         mt7915_mcu_sta_sounding_rate(bf);
1888
1889         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1890                                 pe->phy_cap_info[6]);
1891         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1892                                 pe->phy_cap_info[6]);
1893         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1894                          ve->phy_cap_info[5]);
1895         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1896                          pe->phy_cap_info[4]);
1897
1898         mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.tx_mcs_80);
1899         nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1900
1901         bf->nr = min_t(u8, bfer_nr, bfee_nr);
1902         bf->nc = min_t(u8, nss_mcs, bf->nr);
1903         bf->ibf_ncol = bf->nc;
1904
1905         if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1906                 return;
1907
1908         /* go over for 160MHz and 80p80 */
1909         if (pe->phy_cap_info[0] &
1910             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1911                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1912                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1913
1914                 bf->nc_bw160 = nss_mcs;
1915         }
1916
1917         if (pe->phy_cap_info[0] &
1918             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1919                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1920                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1921
1922                 if (bf->nc_bw160)
1923                         bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1924                 else
1925                         bf->nc_bw160 = nss_mcs;
1926         }
1927
1928         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1929                          ve->phy_cap_info[5]);
1930         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1931                          pe->phy_cap_info[4]);
1932
1933         bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1934 }
1935
1936 static void
1937 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1938                         struct ieee80211_vif *vif, struct mt7915_phy *phy,
1939                         bool enable)
1940 {
1941         struct sta_rec_bf *bf;
1942         struct tlv *tlv;
1943         int tx_ant = hweight8(phy->chainmask) - 1;
1944         const u8 matrix[4][4] = {
1945                 {0, 0, 0, 0},
1946                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
1947                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
1948                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
1949         };
1950
1951 #define MT_BFER_FREE            cpu_to_le16(GENMASK(15, 0))
1952
1953         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1954         bf = (struct sta_rec_bf *)tlv;
1955
1956         if (!enable) {
1957                 bf->pfmu = MT_BFER_FREE;
1958                 return;
1959         }
1960
1961         bf->bw = sta->bandwidth;
1962         bf->ibf_dbw = sta->bandwidth;
1963         bf->ibf_nrow = tx_ant;
1964         bf->ibf_timeout = 0x18;
1965
1966         if (sta->he_cap.has_he)
1967                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1968         else if (sta->vht_cap.vht_supported)
1969                 mt7915_mcu_sta_bfer_vht(sta, phy, bf);
1970         else if (sta->ht_cap.ht_supported)
1971                 mt7915_mcu_sta_bfer_ht(sta, bf);
1972
1973         if (bf->bf_cap & MT_EBF && bf->nr != tx_ant)
1974                 bf->mem_20m = matrix[tx_ant][bf->nc];
1975         else
1976                 bf->mem_20m = matrix[bf->nr][bf->nc];
1977
1978         switch (sta->bandwidth) {
1979         case IEEE80211_STA_RX_BW_160:
1980         case IEEE80211_STA_RX_BW_80:
1981                 bf->mem_total = bf->mem_20m * 2;
1982                 break;
1983         case IEEE80211_STA_RX_BW_40:
1984                 bf->mem_total = bf->mem_20m;
1985                 break;
1986         case IEEE80211_STA_RX_BW_20:
1987         default:
1988                 break;
1989         }
1990 }
1991
1992 static void
1993 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1994                         struct mt7915_phy *phy)
1995 {
1996         struct sta_rec_bfee *bfee;
1997         struct tlv *tlv;
1998         int tx_ant = hweight8(phy->chainmask) - 1;
1999         u8 nr = 0;
2000
2001         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
2002         bfee = (struct sta_rec_bfee *)tlv;
2003
2004         if (sta->he_cap.has_he) {
2005                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
2006
2007                 nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
2008                             pe->phy_cap_info[5]);
2009         } else if (sta->vht_cap.vht_supported) {
2010                 struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
2011
2012                 nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
2013                                pc->cap);
2014         }
2015
2016         /* reply with identity matrix to avoid 2x2 BF negative gain */
2017         if (nr == 1 && tx_ant == 2)
2018                 bfee->fb_identity_matrix = true;
2019 }
2020
2021 static u8
2022 mt7915_mcu_sta_txbf_type(struct mt7915_phy *phy, struct ieee80211_vif *vif,
2023                          struct ieee80211_sta *sta)
2024 {
2025         u8 type = 0;
2026
2027         if (vif->type != NL80211_IFTYPE_STATION &&
2028             vif->type != NL80211_IFTYPE_AP)
2029                 return 0;
2030
2031         if (sta->he_cap.has_he) {
2032                 struct ieee80211_he_cap_elem *pe;
2033                 const struct ieee80211_he_cap_elem *ve;
2034                 const struct ieee80211_sta_he_cap *vc;
2035
2036                 pe = &sta->he_cap.he_cap_elem;
2037                 vc = mt7915_get_he_phy_cap(phy, vif);
2038                 ve = &vc->he_cap_elem;
2039
2040                 if ((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
2041                      HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
2042                     HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]))
2043                         type |= MT_STA_BFEE;
2044
2045                 if ((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
2046                      HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
2047                     HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]))
2048                         type |= MT_STA_BFER;
2049         } else if (sta->vht_cap.vht_supported) {
2050                 struct ieee80211_sta_vht_cap *pc;
2051                 struct ieee80211_sta_vht_cap *vc;
2052                 u32 cr, ce;
2053
2054                 pc = &sta->vht_cap;
2055                 vc = &phy->mt76->sband_5g.sband.vht_cap;
2056                 cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2057                      IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
2058                 ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2059                      IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
2060
2061                 if ((pc->cap & cr) && (vc->cap & ce))
2062                         type |= MT_STA_BFEE;
2063
2064                 if ((vc->cap & cr) && (pc->cap & ce))
2065                         type |= MT_STA_BFER;
2066         } else if (sta->ht_cap.ht_supported) {
2067                 /* TODO: iBF */
2068         }
2069
2070         return type;
2071 }
2072
2073 static int
2074 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2075                     struct ieee80211_sta *sta, bool enable)
2076 {
2077         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2078         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2079         struct mt7915_phy *phy;
2080         struct sk_buff *skb;
2081         int r, len;
2082         u8 type;
2083
2084         phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2085
2086         type = mt7915_mcu_sta_txbf_type(phy, vif, sta);
2087
2088         /* must keep each tag independent */
2089
2090         /* starec bf */
2091         if (type & MT_STA_BFER) {
2092                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2093
2094                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2095                 if (IS_ERR(skb))
2096                         return PTR_ERR(skb);
2097
2098                 mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable);
2099
2100                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2101                                           MCU_EXT_CMD_STA_REC_UPDATE, true);
2102                 if (r)
2103                         return r;
2104         }
2105
2106         /* starec bfee */
2107         if (type & MT_STA_BFEE) {
2108                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2109
2110                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2111                 if (IS_ERR(skb))
2112                         return PTR_ERR(skb);
2113
2114                 mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2115
2116                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2117                                           MCU_EXT_CMD_STA_REC_UPDATE, true);
2118                 if (r)
2119                         return r;
2120         }
2121
2122         return 0;
2123 }
2124
2125 static void
2126 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2127                              struct ieee80211_vif *vif,
2128                              struct ieee80211_sta *sta)
2129 {
2130         struct cfg80211_chan_def *chandef = &dev->mphy.chandef;
2131         struct sta_rec_ra *ra;
2132         struct tlv *tlv;
2133         enum nl80211_band band = chandef->chan->band;
2134         u32 supp_rate = sta->supp_rates[band];
2135         int n_rates = hweight32(supp_rate);
2136         u32 cap = sta->wme ? STA_CAP_WMM : 0;
2137         u8 i, nss = sta->rx_nss, mcs = 0;
2138
2139         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2140
2141         ra = (struct sta_rec_ra *)tlv;
2142         ra->valid = true;
2143         ra->auto_rate = true;
2144         ra->phy_mode = mt7915_get_phy_mode(dev, vif, band, sta);
2145         ra->channel = chandef->chan->hw_value;
2146         ra->bw = sta->bandwidth;
2147         ra->rate_len = n_rates;
2148         ra->phy.bw = sta->bandwidth;
2149
2150         if (n_rates) {
2151                 if (band == NL80211_BAND_2GHZ) {
2152                         ra->supp_mode = MODE_CCK;
2153                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2154                         ra->phy.type = MT_PHY_TYPE_CCK;
2155
2156                         if (n_rates > 4) {
2157                                 ra->supp_mode |= MODE_OFDM;
2158                                 ra->supp_ofdm_rate = supp_rate >> 4;
2159                                 ra->phy.type = MT_PHY_TYPE_OFDM;
2160                         }
2161                 } else {
2162                         ra->supp_mode = MODE_OFDM;
2163                         ra->supp_ofdm_rate = supp_rate;
2164                         ra->phy.type = MT_PHY_TYPE_OFDM;
2165                 }
2166         }
2167
2168         if (sta->ht_cap.ht_supported) {
2169                 for (i = 0; i < nss; i++)
2170                         ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2171
2172                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2173                 ra->supp_mode |= MODE_HT;
2174                 mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2175                 ra->af = sta->ht_cap.ampdu_factor;
2176                 ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2177
2178                 cap |= STA_CAP_HT;
2179                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2180                         cap |= STA_CAP_SGI_20;
2181                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2182                         cap |= STA_CAP_SGI_40;
2183                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2184                         cap |= STA_CAP_TX_STBC;
2185                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2186                         cap |= STA_CAP_RX_STBC;
2187                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2188                         cap |= STA_CAP_LDPC;
2189         }
2190
2191         if (sta->vht_cap.vht_supported) {
2192                 u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2193                 u16 vht_mcs;
2194                 u8 af, mcs_prev;
2195
2196                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2197                                sta->vht_cap.cap);
2198                 ra->af = max_t(u8, ra->af, af);
2199
2200                 cap |= STA_CAP_VHT;
2201                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2202                         cap |= STA_CAP_VHT_SGI_80;
2203                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2204                         cap |= STA_CAP_VHT_SGI_160;
2205                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2206                         cap |= STA_CAP_VHT_TX_STBC;
2207                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2208                         cap |= STA_CAP_VHT_RX_STBC;
2209                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2210                         cap |= STA_CAP_VHT_LDPC;
2211
2212                 ra->supp_mode |= MODE_VHT;
2213                 for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2214                         switch (mcs_map & 0x3) {
2215                         case IEEE80211_VHT_MCS_SUPPORT_0_9:
2216                                 vht_mcs = GENMASK(9, 0);
2217                                 break;
2218                         case IEEE80211_VHT_MCS_SUPPORT_0_8:
2219                                 vht_mcs = GENMASK(8, 0);
2220                                 break;
2221                         case IEEE80211_VHT_MCS_SUPPORT_0_7:
2222                                 vht_mcs = GENMASK(7, 0);
2223                                 break;
2224                         default:
2225                                 vht_mcs = 0;
2226                         }
2227
2228                         ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2229
2230                         mcs_prev = hweight16(vht_mcs) - 1;
2231                         if (mcs_prev > mcs)
2232                                 mcs = mcs_prev;
2233
2234                         /* only support 2ss on 160MHz */
2235                         if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2236                                       ra->bw == CMD_CBW_8080MHZ))
2237                                 break;
2238                 }
2239         }
2240
2241         if (sta->he_cap.has_he) {
2242                 ra->supp_mode |= MODE_HE;
2243                 cap |= STA_CAP_HE;
2244         }
2245
2246         ra->sta_status = cpu_to_le32(cap);
2247
2248         switch (BIT(fls(ra->supp_mode) - 1)) {
2249         case MODE_VHT:
2250                 ra->phy.type = MT_PHY_TYPE_VHT;
2251                 ra->phy.mcs = mcs;
2252                 ra->phy.nss = nss;
2253                 ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2254                 ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2255                 ra->phy.sgi =
2256                         !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2257                 break;
2258         case MODE_HT:
2259                 ra->phy.type = MT_PHY_TYPE_HT;
2260                 ra->phy.mcs = mcs;
2261                 ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2262                 ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2263                 ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2264                 break;
2265         default:
2266                 break;
2267         }
2268 }
2269
2270 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2271                              struct ieee80211_sta *sta)
2272 {
2273         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2274         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2275         struct sk_buff *skb;
2276         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2277
2278         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2279         if (IS_ERR(skb))
2280                 return PTR_ERR(skb);
2281
2282         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2283
2284         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2285                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2286 }
2287
2288 static int
2289 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2290                      struct ieee80211_sta *sta)
2291 {
2292 #define MT_STA_BSS_GROUP                1
2293         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2294         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2295         struct {
2296                 __le32 action;
2297                 u8 wlan_idx_lo;
2298                 u8 status;
2299                 u8 wlan_idx_hi;
2300                 u8 rsv0[5];
2301                 __le32 val;
2302                 u8 rsv1[8];
2303         } __packed req = {
2304                 .action = cpu_to_le32(MT_STA_BSS_GROUP),
2305                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
2306                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
2307                 .val = cpu_to_le32(mvif->idx % 16),
2308         };
2309
2310         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_DRR_CTRL, &req,
2311                                  sizeof(req), true);
2312 }
2313
2314 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2315                            struct ieee80211_sta *sta, bool enable)
2316 {
2317         int ret;
2318
2319         if (!sta)
2320                 return 0;
2321
2322         /* must keep the order */
2323         ret = mt7915_mcu_add_group(dev, vif, sta);
2324         if (ret)
2325                 return ret;
2326
2327         ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2328         if (ret)
2329                 return ret;
2330
2331         ret = mt7915_mcu_add_mu(dev, vif, sta);
2332         if (ret)
2333                 return ret;
2334
2335         if (enable)
2336                 return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2337
2338         return 0;
2339 }
2340
2341 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2342                        struct ieee80211_sta *sta, bool enable)
2343 {
2344         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2345         struct wtbl_req_hdr *wtbl_hdr;
2346         struct mt7915_sta *msta;
2347         struct tlv *sta_wtbl;
2348         struct sk_buff *skb;
2349
2350         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2351
2352         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2353                                        MT7915_STA_UPDATE_MAX_SIZE);
2354         if (IS_ERR(skb))
2355                 return PTR_ERR(skb);
2356
2357         mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2358         if (enable && sta)
2359                 mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2360
2361         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2362
2363         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2364                                              sta_wtbl, &skb);
2365         if (enable) {
2366                 mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2367                 mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2368                 if (sta)
2369                         mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2370         }
2371
2372         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2373                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2374 }
2375
2376 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2377                               struct ieee80211_sta *sta, u32 rate)
2378 {
2379         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2380         struct mt7915_vif *mvif = msta->vif;
2381         struct sta_rec_ra_fixed *ra;
2382         struct sk_buff *skb;
2383         struct tlv *tlv;
2384         int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2385
2386         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2387         if (IS_ERR(skb))
2388                 return PTR_ERR(skb);
2389
2390         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2391         ra = (struct sta_rec_ra_fixed *)tlv;
2392
2393         if (!rate) {
2394                 ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2395                 goto out;
2396         } else {
2397                 ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2398         }
2399
2400         ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2401         ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2402         ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2403         ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2404         ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2405
2406         if (ra->phy.bw)
2407                 ra->phy.ldpc = 7;
2408         else
2409                 ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2410
2411         /* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2412         if (ra->phy.type > MT_PHY_TYPE_VHT)
2413                 ra->phy.sgi = ra->phy.mcs * 85;
2414         else
2415                 ra->phy.sgi = ra->phy.mcs * 15;
2416
2417 out:
2418         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2419                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2420 }
2421
2422 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2423                             struct ieee80211_vif *vif, bool enable)
2424 {
2425         struct mt7915_dev *dev = phy->dev;
2426         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2427         struct {
2428                 struct req_hdr {
2429                         u8 omac_idx;
2430                         u8 dbdc_idx;
2431                         __le16 tlv_num;
2432                         u8 is_tlv_append;
2433                         u8 rsv[3];
2434                 } __packed hdr;
2435                 struct req_tlv {
2436                         __le16 tag;
2437                         __le16 len;
2438                         u8 active;
2439                         u8 dbdc_idx;
2440                         u8 omac_addr[ETH_ALEN];
2441                 } __packed tlv;
2442         } data = {
2443                 .hdr = {
2444                         .omac_idx = mvif->omac_idx,
2445                         .dbdc_idx = mvif->band_idx,
2446                         .tlv_num = cpu_to_le16(1),
2447                         .is_tlv_append = 1,
2448                 },
2449                 .tlv = {
2450                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
2451                         .len = cpu_to_le16(sizeof(struct req_tlv)),
2452                         .active = enable,
2453                         .dbdc_idx = mvif->band_idx,
2454                 },
2455         };
2456
2457         if (mvif->omac_idx >= REPEATER_BSSID_START)
2458                 return mt7915_mcu_muar_config(phy, vif, false, enable);
2459
2460         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2461         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
2462                                  &data, sizeof(data), true);
2463 }
2464
2465 static void
2466 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2467                       struct bss_info_bcn *bcn,
2468                       struct ieee80211_mutable_offsets *offs)
2469 {
2470         if (offs->cntdwn_counter_offs[0]) {
2471                 struct tlv *tlv;
2472                 struct bss_info_bcn_csa *csa;
2473
2474                 tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2475                                                    sizeof(*csa), &bcn->sub_ntlv,
2476                                                    &bcn->len);
2477                 csa = (struct bss_info_bcn_csa *)tlv;
2478                 csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2479         }
2480 }
2481
2482 static void
2483 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2484                        struct sk_buff *skb, struct bss_info_bcn *bcn,
2485                        struct ieee80211_mutable_offsets *offs)
2486 {
2487         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2488         struct bss_info_bcn_cont *cont;
2489         struct tlv *tlv;
2490         u8 *buf;
2491         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2492
2493         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2494                                            len, &bcn->sub_ntlv, &bcn->len);
2495
2496         cont = (struct bss_info_bcn_cont *)tlv;
2497         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2498         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2499
2500         if (offs->cntdwn_counter_offs[0])
2501                 cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2502
2503         buf = (u8 *)tlv + sizeof(*cont);
2504         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2505                               true);
2506         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2507 }
2508
2509 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2510                           struct ieee80211_vif *vif, int en)
2511 {
2512 #define MAX_BEACON_SIZE 512
2513         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2514         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2515         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2516         struct ieee80211_mutable_offsets offs;
2517         struct ieee80211_tx_info *info;
2518         struct sk_buff *skb, *rskb;
2519         struct tlv *tlv;
2520         struct bss_info_bcn *bcn;
2521         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2522
2523         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2524         if (!skb)
2525                 return -EINVAL;
2526
2527         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2528                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2529                 dev_kfree_skb(skb);
2530                 return -EINVAL;
2531         }
2532
2533         rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2534         if (IS_ERR(rskb)) {
2535                 dev_kfree_skb(skb);
2536                 return PTR_ERR(rskb);
2537         }
2538
2539         tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2540         bcn = (struct bss_info_bcn *)tlv;
2541         bcn->enable = en;
2542
2543         if (mvif->band_idx) {
2544                 info = IEEE80211_SKB_CB(skb);
2545                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2546         }
2547
2548         /* TODO: subtag - bss color count & 11v MBSSID */
2549         mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2550         mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2551         dev_kfree_skb(skb);
2552
2553         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2554                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
2555 }
2556
2557 static int mt7915_mcu_send_firmware(struct mt7915_dev *dev, const void *data,
2558                                     int len)
2559 {
2560         int ret = 0, cur_len;
2561
2562         while (len > 0) {
2563                 cur_len = min_t(int, 4096 - sizeof(struct mt7915_mcu_txd),
2564                                 len);
2565
2566                 ret = mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_SCATTER, data,
2567                                         cur_len, false);
2568                 if (ret)
2569                         break;
2570
2571                 data += cur_len;
2572                 len -= cur_len;
2573                 mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2574         }
2575
2576         return ret;
2577 }
2578
2579 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2580                                      u32 option)
2581 {
2582         struct {
2583                 __le32 option;
2584                 __le32 addr;
2585         } req = {
2586                 .option = cpu_to_le32(option),
2587                 .addr = cpu_to_le32(addr),
2588         };
2589
2590         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ, &req,
2591                                  sizeof(req), true);
2592 }
2593
2594 static int mt7915_mcu_restart(struct mt76_dev *dev)
2595 {
2596         struct {
2597                 u8 power_mode;
2598                 u8 rsv[3];
2599         } req = {
2600                 .power_mode = 1,
2601         };
2602
2603         return mt76_mcu_send_msg(dev, -MCU_CMD_NIC_POWER_CTRL, &req,
2604                                  sizeof(req), false);
2605 }
2606
2607 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2608 {
2609         struct {
2610                 __le32 op;
2611         } req = {
2612                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2613         };
2614
2615         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL, &req,
2616                                  sizeof(req), true);
2617 }
2618
2619 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2620 {
2621         struct {
2622                 u8 check_crc;
2623                 u8 reserved[3];
2624         } req = {
2625                 .check_crc = 0,
2626         };
2627
2628         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ, &req,
2629                                  sizeof(req), true);
2630 }
2631
2632 static int mt7915_driver_own(struct mt7915_dev *dev)
2633 {
2634         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2635
2636         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2637         if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2638                             0, 500)) {
2639                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2640                 return -EIO;
2641         }
2642
2643         return 0;
2644 }
2645
2646 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2647                                     u32 len, u32 mode)
2648 {
2649         struct {
2650                 __le32 addr;
2651                 __le32 len;
2652                 __le32 mode;
2653         } req = {
2654                 .addr = cpu_to_le32(addr),
2655                 .len = cpu_to_le32(len),
2656                 .mode = cpu_to_le32(mode),
2657         };
2658         int attr;
2659
2660         if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2661                 attr = -MCU_CMD_PATCH_START_REQ;
2662         else
2663                 attr = -MCU_CMD_TARGET_ADDRESS_LEN_REQ;
2664
2665         return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2666 }
2667
2668 static int mt7915_load_patch(struct mt7915_dev *dev)
2669 {
2670         const struct mt7915_patch_hdr *hdr;
2671         const struct firmware *fw = NULL;
2672         int i, ret, sem;
2673
2674         sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2675         switch (sem) {
2676         case PATCH_IS_DL:
2677                 return 0;
2678         case PATCH_NOT_DL_SEM_SUCCESS:
2679                 break;
2680         default:
2681                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2682                 return -EAGAIN;
2683         }
2684
2685         ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2686         if (ret)
2687                 goto out;
2688
2689         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2690                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2691                 ret = -EINVAL;
2692                 goto out;
2693         }
2694
2695         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2696
2697         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2698                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2699
2700         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2701                 struct mt7915_patch_sec *sec;
2702                 const u8 *dl;
2703                 u32 len, addr;
2704
2705                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2706                                                   i * sizeof(*sec));
2707                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2708                     PATCH_SEC_TYPE_INFO) {
2709                         ret = -EINVAL;
2710                         goto out;
2711                 }
2712
2713                 addr = be32_to_cpu(sec->info.addr);
2714                 len = be32_to_cpu(sec->info.len);
2715                 dl = fw->data + be32_to_cpu(sec->offs);
2716
2717                 ret = mt7915_mcu_init_download(dev, addr, len,
2718                                                DL_MODE_NEED_RSP);
2719                 if (ret) {
2720                         dev_err(dev->mt76.dev, "Download request failed\n");
2721                         goto out;
2722                 }
2723
2724                 ret = mt7915_mcu_send_firmware(dev, dl, len);
2725                 if (ret) {
2726                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2727                         goto out;
2728                 }
2729         }
2730
2731         ret = mt7915_mcu_start_patch(dev);
2732         if (ret)
2733                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2734
2735 out:
2736         sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2737         switch (sem) {
2738         case PATCH_REL_SEM_SUCCESS:
2739                 break;
2740         default:
2741                 ret = -EAGAIN;
2742                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2743                 goto out;
2744         }
2745         release_firmware(fw);
2746
2747         return ret;
2748 }
2749
2750 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2751 {
2752         u32 ret = 0;
2753
2754         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2755                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2756         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2757                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2758         ret |= DL_MODE_NEED_RSP;
2759         ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2760
2761         return ret;
2762 }
2763
2764 static int
2765 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2766                              const struct mt7915_fw_trailer *hdr,
2767                              const u8 *data, bool is_wa)
2768 {
2769         int i, offset = 0;
2770         u32 override = 0, option = 0;
2771
2772         for (i = 0; i < hdr->n_region; i++) {
2773                 const struct mt7915_fw_region *region;
2774                 int err;
2775                 u32 len, addr, mode;
2776
2777                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2778                          (hdr->n_region - i) * sizeof(*region));
2779                 mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2780                 len = le32_to_cpu(region->len);
2781                 addr = le32_to_cpu(region->addr);
2782
2783                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2784                         override = addr;
2785
2786                 err = mt7915_mcu_init_download(dev, addr, len, mode);
2787                 if (err) {
2788                         dev_err(dev->mt76.dev, "Download request failed\n");
2789                         return err;
2790                 }
2791
2792                 err = mt7915_mcu_send_firmware(dev, data + offset, len);
2793                 if (err) {
2794                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2795                         return err;
2796                 }
2797
2798                 offset += len;
2799         }
2800
2801         if (override)
2802                 option |= FW_START_OVERRIDE;
2803
2804         if (is_wa)
2805                 option |= FW_START_WORKING_PDA_CR4;
2806
2807         return mt7915_mcu_start_firmware(dev, override, option);
2808 }
2809
2810 static int mt7915_load_ram(struct mt7915_dev *dev)
2811 {
2812         const struct mt7915_fw_trailer *hdr;
2813         const struct firmware *fw;
2814         int ret;
2815
2816         ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2817         if (ret)
2818                 return ret;
2819
2820         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2821                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2822                 ret = -EINVAL;
2823                 goto out;
2824         }
2825
2826         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2827                                         sizeof(*hdr));
2828
2829         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2830                  hdr->fw_ver, hdr->build_date);
2831
2832         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2833         if (ret) {
2834                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2835                 goto out;
2836         }
2837
2838         release_firmware(fw);
2839
2840         ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2841         if (ret)
2842                 return ret;
2843
2844         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2845                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2846                 ret = -EINVAL;
2847                 goto out;
2848         }
2849
2850         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2851                                         sizeof(*hdr));
2852
2853         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2854                  hdr->fw_ver, hdr->build_date);
2855
2856         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2857         if (ret) {
2858                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2859                 goto out;
2860         }
2861
2862         snprintf(dev->mt76.hw->wiphy->fw_version,
2863                  sizeof(dev->mt76.hw->wiphy->fw_version),
2864                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2865
2866 out:
2867         release_firmware(fw);
2868
2869         return ret;
2870 }
2871
2872 static int mt7915_load_firmware(struct mt7915_dev *dev)
2873 {
2874         int ret;
2875         u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2876
2877         val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2878
2879         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2880                 /* restart firmware once */
2881                 __mt76_mcu_restart(&dev->mt76);
2882                 if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2883                                     val, 1000)) {
2884                         dev_err(dev->mt76.dev,
2885                                 "Firmware is not ready for download\n");
2886                         return -EIO;
2887                 }
2888         }
2889
2890         ret = mt7915_load_patch(dev);
2891         if (ret)
2892                 return ret;
2893
2894         ret = mt7915_load_ram(dev);
2895         if (ret)
2896                 return ret;
2897
2898         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2899                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2900                                        FW_STATE_WACPU_RDY), 1000)) {
2901                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2902                 return -EIO;
2903         }
2904
2905         mt76_queue_tx_cleanup(dev, MT_TXQ_FWDL, false);
2906
2907         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2908
2909         return 0;
2910 }
2911
2912 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2913 {
2914         struct {
2915                 u8 ctrl_val;
2916                 u8 pad[3];
2917         } data = {
2918                 .ctrl_val = ctrl
2919         };
2920
2921         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
2922                                  sizeof(data), true);
2923 }
2924
2925 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2926 {
2927         struct {
2928                 u8 ver;
2929                 u8 pad;
2930                 u16 len;
2931                 u8 level;
2932                 u8 rsv[3];
2933                 __le32 module_idx;
2934         } data = {
2935                 .module_idx = cpu_to_le32(module),
2936                 .level = level,
2937         };
2938
2939         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_DBG_CTRL, &data,
2940                                  sizeof(data), false);
2941 }
2942
2943 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2944 {
2945         struct {
2946                 u8 enable;
2947                 u8 _rsv[3];
2948         } __packed req = {
2949                 .enable = enabled
2950         };
2951
2952         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MWDS_SUPPORT, &req,
2953                                  sizeof(req), false);
2954 }
2955
2956 int mt7915_mcu_init(struct mt7915_dev *dev)
2957 {
2958         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2959                 .headroom = sizeof(struct mt7915_mcu_txd),
2960                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2961                 .mcu_send_msg = mt7915_mcu_msg_send,
2962                 .mcu_parse_response = mt7915_mcu_parse_response,
2963                 .mcu_restart = mt7915_mcu_restart,
2964         };
2965         int ret;
2966
2967         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2968
2969         ret = mt7915_driver_own(dev);
2970         if (ret)
2971                 return ret;
2972
2973         ret = mt7915_load_firmware(dev);
2974         if (ret)
2975                 return ret;
2976
2977         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2978         mt7915_mcu_fw_log_2_host(dev, 0);
2979         mt7915_mcu_set_mwds(dev, 1);
2980
2981         return 0;
2982 }
2983
2984 void mt7915_mcu_exit(struct mt7915_dev *dev)
2985 {
2986         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2987
2988         __mt76_mcu_restart(&dev->mt76);
2989         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2990                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2991                                        FW_STATE_FW_DOWNLOAD), 1000)) {
2992                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2993                 return;
2994         }
2995
2996         reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2997         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2998         skb_queue_purge(&dev->mt76.mcu.res_q);
2999 }
3000
3001 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
3002                        bool enable, bool hdr_trans)
3003 {
3004         struct {
3005                 u8 operation;
3006                 u8 enable;
3007                 u8 check_bssid;
3008                 u8 insert_vlan;
3009                 u8 remove_vlan;
3010                 u8 tid;
3011                 u8 mode;
3012                 u8 rsv;
3013         } __packed req_trans = {
3014                 .enable = hdr_trans,
3015         };
3016         struct {
3017                 u8 enable;
3018                 u8 band;
3019                 u8 rsv[2];
3020         } __packed req_mac = {
3021                 .enable = enable,
3022                 .band = band,
3023         };
3024         int ret;
3025
3026         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RX_HDR_TRANS,
3027                                 &req_trans, sizeof(req_trans), false);
3028         if (ret)
3029                 return ret;
3030
3031         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
3032                                  &req_mac, sizeof(req_mac), true);
3033 }
3034
3035 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
3036 {
3037         struct {
3038                 __le32 cmd;
3039                 u8 band;
3040                 u8 enable;
3041         } __packed req = {
3042                 .cmd = cpu_to_le32(SCS_ENABLE),
3043                 .band = band,
3044                 .enable = enable + 1,
3045         };
3046
3047         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SCS_CTRL, &req,
3048                                  sizeof(req), false);
3049 }
3050
3051 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
3052 {
3053         struct mt7915_dev *dev = phy->dev;
3054         struct {
3055                 u8 prot_idx;
3056                 u8 band;
3057                 u8 rsv[2];
3058                 __le32 len_thresh;
3059                 __le32 pkt_thresh;
3060         } __packed req = {
3061                 .prot_idx = 1,
3062                 .band = phy != &dev->phy,
3063                 .len_thresh = cpu_to_le32(val),
3064                 .pkt_thresh = cpu_to_le32(0x2),
3065         };
3066
3067         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL, &req,
3068                                  sizeof(req), true);
3069 }
3070
3071 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
3072 {
3073 #define WMM_AIFS_SET            BIT(0)
3074 #define WMM_CW_MIN_SET          BIT(1)
3075 #define WMM_CW_MAX_SET          BIT(2)
3076 #define WMM_TXOP_SET            BIT(3)
3077 #define WMM_PARAM_SET           GENMASK(3, 0)
3078 #define TX_CMD_MODE             1
3079         struct edca {
3080                 u8 queue;
3081                 u8 set;
3082                 u8 aifs;
3083                 u8 cw_min;
3084                 __le16 cw_max;
3085                 __le16 txop;
3086         };
3087         struct mt7915_mcu_tx {
3088                 u8 total;
3089                 u8 action;
3090                 u8 valid;
3091                 u8 mode;
3092
3093                 struct edca edca[IEEE80211_NUM_ACS];
3094         } __packed req = {
3095                 .valid = true,
3096                 .mode = TX_CMD_MODE,
3097                 .total = IEEE80211_NUM_ACS,
3098         };
3099         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3100         int ac;
3101
3102         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3103                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3104                 struct edca *e = &req.edca[ac];
3105
3106                 e->set = WMM_PARAM_SET;
3107                 e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3108                 e->aifs = q->aifs;
3109                 e->txop = cpu_to_le16(q->txop);
3110
3111                 if (q->cw_min)
3112                         e->cw_min = fls(q->cw_min);
3113                 else
3114                         e->cw_min = 5;
3115
3116                 if (q->cw_max)
3117                         e->cw_max = cpu_to_le16(fls(q->cw_max));
3118                 else
3119                         e->cw_max = cpu_to_le16(10);
3120         }
3121         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
3122                                  sizeof(req), true);
3123 }
3124
3125 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3126 {
3127 #define ENTER_PM_STATE          1
3128 #define EXIT_PM_STATE           2
3129         struct {
3130                 u8 pm_number;
3131                 u8 pm_state;
3132                 u8 bssid[ETH_ALEN];
3133                 u8 dtim_period;
3134                 u8 wlan_idx_lo;
3135                 __le16 bcn_interval;
3136                 __le32 aid;
3137                 __le32 rx_filter;
3138                 u8 band_idx;
3139                 u8 wlan_idx_hi;
3140                 u8 rsv[2];
3141                 __le32 feature;
3142                 u8 omac_idx;
3143                 u8 wmm_idx;
3144                 u8 bcn_loss_cnt;
3145                 u8 bcn_sp_duration;
3146         } __packed req = {
3147                 .pm_number = 5,
3148                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3149                 .band_idx = band,
3150         };
3151
3152         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
3153                                  sizeof(req), true);
3154 }
3155
3156 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3157                        enum mt7915_rdd_cmd cmd, u8 index,
3158                        u8 rx_sel, u8 val)
3159 {
3160         struct {
3161                 u8 ctrl;
3162                 u8 rdd_idx;
3163                 u8 rdd_rx_sel;
3164                 u8 val;
3165                 u8 rsv[4];
3166         } __packed req = {
3167                 .ctrl = cmd,
3168                 .rdd_idx = index,
3169                 .rdd_rx_sel = rx_sel,
3170                 .val = val,
3171         };
3172
3173         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
3174                                  sizeof(req), true);
3175 }
3176
3177 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3178 {
3179         struct {
3180                 u32 tag;
3181                 u16 min_lpn;
3182                 u8 rsv[2];
3183         } __packed req = {
3184                 .tag = 0x1,
3185                 .min_lpn = val,
3186         };
3187
3188         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3189                                  sizeof(req), true);
3190 }
3191
3192 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3193                             const struct mt7915_dfs_pulse *pulse)
3194 {
3195         struct {
3196                 u32 tag;
3197                 struct mt7915_dfs_pulse pulse;
3198         } __packed req = {
3199                 .tag = 0x3,
3200         };
3201
3202         memcpy(&req.pulse, pulse, sizeof(*pulse));
3203
3204         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3205                                  sizeof(req), true);
3206 }
3207
3208 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3209                             const struct mt7915_dfs_pattern *pattern)
3210 {
3211         struct {
3212                 u32 tag;
3213                 u16 radar_type;
3214                 struct mt7915_dfs_pattern pattern;
3215         } __packed req = {
3216                 .tag = 0x2,
3217                 .radar_type = index,
3218         };
3219
3220         memcpy(&req.pattern, pattern, sizeof(*pattern));
3221
3222         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3223                                  sizeof(req), true);
3224 }
3225
3226 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3227 {
3228         struct mt7915_dev *dev = phy->dev;
3229         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3230         int freq1 = chandef->center_freq1;
3231         struct {
3232                 u8 control_ch;
3233                 u8 center_ch;
3234                 u8 bw;
3235                 u8 tx_streams_num;
3236                 u8 rx_streams;  /* mask or num */
3237                 u8 switch_reason;
3238                 u8 band_idx;
3239                 u8 center_ch2;  /* for 80+80 only */
3240                 __le16 cac_case;
3241                 u8 channel_band;
3242                 u8 rsv0;
3243                 __le32 outband_freq;
3244                 u8 txpower_drop;
3245                 u8 ap_bw;
3246                 u8 ap_center_ch;
3247                 u8 rsv1[57];
3248         } __packed req = {
3249                 .control_ch = chandef->chan->hw_value,
3250                 .center_ch = ieee80211_frequency_to_channel(freq1),
3251                 .bw = mt7915_mcu_chan_bw(chandef),
3252                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
3253                 .rx_streams = phy->chainmask,
3254                 .band_idx = phy != &dev->phy,
3255                 .channel_band = chandef->chan->band,
3256         };
3257
3258         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3259                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3260         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3261                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3262                 req.switch_reason = CH_SWITCH_DFS;
3263         else
3264                 req.switch_reason = CH_SWITCH_NORMAL;
3265
3266         if (cmd == MCU_EXT_CMD_CHANNEL_SWITCH)
3267                 req.rx_streams = hweight8(req.rx_streams);
3268
3269         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3270                 int freq2 = chandef->center_freq2;
3271
3272                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3273         }
3274
3275         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3276 }
3277
3278 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3279 {
3280         struct req_hdr {
3281                 u8 buffer_mode;
3282                 u8 format;
3283                 __le16 len;
3284         } __packed req = {
3285                 .buffer_mode = EE_MODE_EFUSE,
3286                 .format = EE_FORMAT_WHOLE,
3287         };
3288
3289         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
3290                                  &req, sizeof(req), true);
3291 }
3292
3293 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3294 {
3295         struct mt7915_mcu_eeprom_info req = {
3296                 .addr = cpu_to_le32(round_down(offset, 16)),
3297         };
3298
3299         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_ACCESS, &req,
3300                                  sizeof(req), true);
3301 }
3302
3303 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3304 {
3305         struct {
3306                 u8 ctrl_id;
3307                 u8 action;
3308                 u8 band;
3309                 u8 rsv[5];
3310         } req = {
3311                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3312                 .action = index,
3313         };
3314
3315         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_THERMAL_CTRL, &req,
3316                                  sizeof(req), true);
3317 }
3318
3319 int mt7915_mcu_get_rate_info(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3320 {
3321         struct {
3322                 __le32 cmd;
3323                 __le16 wlan_idx;
3324                 __le16 ru_idx;
3325                 __le16 direction;
3326                 __le16 dump_group;
3327         } req = {
3328                 .cmd = cpu_to_le32(cmd),
3329                 .wlan_idx = cpu_to_le16(wlan_idx),
3330                 .dump_group = cpu_to_le16(1),
3331         };
3332
3333         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RATE_CTRL, &req,
3334                                  sizeof(req), false);
3335 }
3336
3337 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3338 {
3339         struct mt7915_dev *dev = phy->dev;
3340         struct mt76_phy *mphy = phy->mt76;
3341         struct ieee80211_hw *hw = mphy->hw;
3342         struct mt7915_sku_val {
3343                 u8 format_id;
3344                 u8 limit_type;
3345                 u8 dbdc_idx;
3346                 s8 val[MT7915_SKU_RATE_NUM];
3347         } __packed req = {
3348                 .format_id = 4,
3349                 .dbdc_idx = phy != &dev->phy,
3350         };
3351         int i;
3352         s8 *delta;
3353
3354         delta = dev->rate_power[mphy->chandef.chan->band];
3355         mphy->txpower_cur = hw->conf.power_level * 2 +
3356                             delta[MT7915_SKU_MAX_DELTA_IDX];
3357
3358         for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3359                 req.val[i] = hw->conf.power_level * 2 + delta[i];
3360
3361         return mt76_mcu_send_msg(&dev->mt76,
3362                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
3363                                  sizeof(req), true);
3364 }
3365
3366 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3367 {
3368         struct mt7915_dev *dev = phy->dev;
3369         struct mt7915_sku {
3370                 u8 format_id;
3371                 u8 sku_enable;
3372                 u8 dbdc_idx;
3373                 u8 rsv;
3374         } __packed req = {
3375                 .format_id = 0,
3376                 .dbdc_idx = phy != &dev->phy,
3377                 .sku_enable = enable,
3378         };
3379
3380         return mt76_mcu_send_msg(&dev->mt76,
3381                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
3382                                  sizeof(req), true);
3383 }
3384
3385 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3386 {
3387         struct {
3388                 u8 action;
3389                 u8 set;
3390                 u8 band;
3391                 u8 rsv;
3392         } req = {
3393                 .action = action,
3394                 .set = set,
3395                 .band = band,
3396         };
3397
3398         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SER_TRIGGER,
3399                                  &req, sizeof(req), false);
3400 }
3401
3402 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3403 {
3404 #define MT_BF_TYPE_UPDATE               20
3405         struct {
3406                 u8 action;
3407                 bool ebf;
3408                 bool ibf;
3409                 u8 rsv;
3410         } __packed req = {
3411                 .action = MT_BF_TYPE_UPDATE,
3412                 .ebf = true,
3413                 .ibf = false,
3414         };
3415
3416         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION, &req,
3417                                  sizeof(req), true);
3418 }
3419
3420 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3421 {
3422 #define MT_BF_PROCESSING                4
3423         struct {
3424                 u8 action;
3425                 u8 snd_mode;
3426                 u8 sta_num;
3427                 u8 rsv;
3428                 u8 wlan_idx[4];
3429                 __le32 snd_period;      /* ms */
3430         } __packed req = {
3431                 .action = true,
3432                 .snd_mode = MT_BF_PROCESSING,
3433         };
3434
3435         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION, &req,
3436                                  sizeof(req), true);
3437 }
3438
3439 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3440                             bool enable)
3441 {
3442 #define MT_SPR_ENABLE           1
3443         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3444         struct {
3445                 u8 action;
3446                 u8 arg_num;
3447                 u8 band_idx;
3448                 u8 status;
3449                 u8 drop_tx_idx;
3450                 u8 sta_idx;     /* 256 sta */
3451                 u8 rsv[2];
3452                 u32 val;
3453         } __packed req = {
3454                 .action = MT_SPR_ENABLE,
3455                 .arg_num = 1,
3456                 .band_idx = mvif->band_idx,
3457                 .val = enable,
3458         };
3459
3460         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SPR, &req,
3461                                  sizeof(req), true);
3462 }