drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MCU_PATCH_ADDRESS               0x200000
  68
  69 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  70 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  71 #define FW_FEATURE_OVERRIDE_ADDR        BIT(5)
  72
  73 #define DL_MODE_ENCRYPT                 BIT(0)
  74 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  75 #define DL_MODE_RESET_SEC_IV            BIT(3)
  76 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  77 #define DL_MODE_NEED_RSP                BIT(31)
  78
  79 #define FW_START_OVERRIDE               BIT(0)
  80 #define FW_START_WORKING_PDA_CR4        BIT(2)
  81
  82 #define PATCH_SEC_TYPE_MASK             GENMASK(15, 0)
  83 #define PATCH_SEC_TYPE_INFO             0x2
  84
  85 #define to_wcid_lo(id)                  FIELD_GET(GENMASK(7, 0), (u16)id)
  86 #define to_wcid_hi(id)                  FIELD_GET(GENMASK(9, 8), (u16)id)
  87
  88 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  89 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  90
  91 static enum mt7915_cipher_type
  92 mt7915_mcu_get_cipher(int cipher)
  93 {
  94         switch (cipher) {
  95         case WLAN_CIPHER_SUITE_WEP40:
  96                 return MT_CIPHER_WEP40;
  97         case WLAN_CIPHER_SUITE_WEP104:
  98                 return MT_CIPHER_WEP104;
  99         case WLAN_CIPHER_SUITE_TKIP:
 100                 return MT_CIPHER_TKIP;
 101         case WLAN_CIPHER_SUITE_AES_CMAC:
 102                 return MT_CIPHER_BIP_CMAC_128;
 103         case WLAN_CIPHER_SUITE_CCMP:
 104                 return MT_CIPHER_AES_CCMP;
 105         case WLAN_CIPHER_SUITE_CCMP_256:
 106                 return MT_CIPHER_CCMP_256;
 107         case WLAN_CIPHER_SUITE_GCMP:
 108                 return MT_CIPHER_GCMP;
 109         case WLAN_CIPHER_SUITE_GCMP_256:
 110                 return MT_CIPHER_GCMP_256;
 111         case WLAN_CIPHER_SUITE_SMS4:
 112                 return MT_CIPHER_WAPI;
 113         default:
 114                 return MT_CIPHER_NONE;
 115         }
 116 }
 117
 118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
 119 {
 120         static const u8 width_to_bw[] = {
 121                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
 122                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
 123                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
 124                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
 125                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
 126                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
 127                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
 128                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
 129         };
 130
 131         if (chandef->width >= ARRAY_SIZE(width_to_bw))
 132                 return 0;
 133
 134         return width_to_bw[chandef->width];
 135 }
 136
 137 static const struct ieee80211_sta_he_cap *
 138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
 139 {
 140         struct ieee80211_supported_band *sband;
 141         enum nl80211_band band;
 142
 143         band = phy->mt76->chandef.chan->band;
 144         sband = phy->mt76->hw->wiphy->bands[band];
 145
 146         return ieee80211_get_he_iftype_cap(sband, vif->type);
 147 }
 148
 149 static u8
 150 mt7915_get_phy_mode(struct mt7915_dev *dev, struct ieee80211_vif *vif,
 151                     enum nl80211_band band, struct ieee80211_sta *sta)
 152 {
 153         struct ieee80211_sta_ht_cap *ht_cap;
 154         struct ieee80211_sta_vht_cap *vht_cap;
 155         const struct ieee80211_sta_he_cap *he_cap;
 156         u8 mode = 0;
 157
 158         if (sta) {
 159                 ht_cap = &sta->ht_cap;
 160                 vht_cap = &sta->vht_cap;
 161                 he_cap = &sta->he_cap;
 162         } else {
 163                 struct ieee80211_supported_band *sband;
 164                 struct mt7915_phy *phy;
 165                 struct mt7915_vif *mvif;
 166
 167                 mvif = (struct mt7915_vif *)vif->drv_priv;
 168                 phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
 169                 sband = phy->mt76->hw->wiphy->bands[band];
 170
 171                 ht_cap = &sband->ht_cap;
 172                 vht_cap = &sband->vht_cap;
 173                 he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
 174         }
 175
 176         if (band == NL80211_BAND_2GHZ) {
 177                 mode |= PHY_MODE_B | PHY_MODE_G;
 178
 179                 if (ht_cap->ht_supported)
 180                         mode |= PHY_MODE_GN;
 181
 182                 if (he_cap->has_he)
 183                         mode |= PHY_MODE_AX_24G;
 184         } else if (band == NL80211_BAND_5GHZ) {
 185                 mode |= PHY_MODE_A;
 186
 187                 if (ht_cap->ht_supported)
 188                         mode |= PHY_MODE_AN;
 189
 190                 if (vht_cap->vht_supported)
 191                         mode |= PHY_MODE_AC;
 192
 193                 if (he_cap->has_he)
 194                         mode |= PHY_MODE_AX_5G;
 195         }
 196
 197         return mode;
 198 }
 199
 200 static u8
 201 mt7915_mcu_get_sta_nss(u16 mcs_map)
 202 {
 203         u8 nss;
 204
 205         for (nss = 8; nss > 0; nss--) {
 206                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
 207
 208                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 209                         break;
 210         }
 211
 212         return nss - 1;
 213 }
 214
 215 static int
 216 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 217                           struct sk_buff *skb, int seq)
 218 {
 219         struct mt7915_mcu_rxd *rxd;
 220         int ret = 0;
 221
 222         if (!skb) {
 223                 dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
 224                         cmd, seq);
 225                 return -ETIMEDOUT;
 226         }
 227
 228         rxd = (struct mt7915_mcu_rxd *)skb->data;
 229         if (seq != rxd->seq)
 230                 return -EAGAIN;
 231
 232         switch (cmd) {
 233         case -MCU_CMD_PATCH_SEM_CONTROL:
 234                 skb_pull(skb, sizeof(*rxd) - 4);
 235                 ret = *skb->data;
 236                 break;
 237         case MCU_EXT_CMD_THERMAL_CTRL:
 238                 skb_pull(skb, sizeof(*rxd) + 4);
 239                 ret = le32_to_cpu(*(__le32 *)skb->data);
 240                 break;
 241         default:
 242                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 243                 break;
 244         }
 245
 246         return ret;
 247 }
 248
 249 static int
 250 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 251                         int cmd, int *wait_seq)
 252 {
 253         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 254         struct mt7915_mcu_txd *mcu_txd;
 255         enum mt76_txq_id txq;
 256         __le32 *txd;
 257         u32 val;
 258         u8 seq;
 259
 260         /* TODO: make dynamic based on msg type */
 261         mdev->mcu.timeout = 20 * HZ;
 262
 263         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 264         if (!seq)
 265                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 266
 267         if (cmd == -MCU_CMD_FW_SCATTER) {
 268                 txq = MT_MCUQ_FWDL;
 269                 goto exit;
 270         }
 271
 272         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 273         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 274                 txq = MT_MCUQ_WA;
 275         else
 276                 txq = MT_MCUQ_WM;
 277
 278         txd = mcu_txd->txd;
 279
 280         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 281               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 282               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 283         txd[0] = cpu_to_le32(val);
 284
 285         val = MT_TXD1_LONG_FORMAT |
 286               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 287         txd[1] = cpu_to_le32(val);
 288
 289         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 290         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 291                                                MT_TX_MCU_PORT_RX_Q0));
 292         mcu_txd->pkt_type = MCU_PKT_ID;
 293         mcu_txd->seq = seq;
 294
 295         if (cmd < 0) {
 296                 mcu_txd->set_query = MCU_Q_NA;
 297                 mcu_txd->cid = -cmd;
 298         } else {
 299                 mcu_txd->cid = MCU_CMD_EXT_CID;
 300                 mcu_txd->ext_cid = cmd;
 301                 mcu_txd->ext_cid_ack = 1;
 302
 303                 /* do not use Q_SET for efuse */
 304                 if (cmd == MCU_EXT_CMD_EFUSE_ACCESS)
 305                         mcu_txd->set_query = MCU_Q_QUERY;
 306                 else
 307                         mcu_txd->set_query = MCU_Q_SET;
 308         }
 309
 310         if (cmd == MCU_EXT_CMD_MWDS_SUPPORT)
 311                 mcu_txd->s2d_index = MCU_S2D_H2C;
 312         else
 313                 mcu_txd->s2d_index = MCU_S2D_H2N;
 314         WARN_ON(cmd == MCU_EXT_CMD_EFUSE_ACCESS &&
 315                 mcu_txd->set_query != MCU_Q_QUERY);
 316
 317 exit:
 318         if (wait_seq)
 319                 *wait_seq = seq;
 320
 321         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[txq], skb, 0);
 322 }
 323
 324 static void
 325 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 326 {
 327         if (vif->csa_active)
 328                 ieee80211_csa_finish(vif);
 329 }
 330
 331 static void
 332 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 333 {
 334         struct mt76_phy *mphy = &dev->mt76.phy;
 335         struct mt7915_mcu_rdd_report *r;
 336
 337         r = (struct mt7915_mcu_rdd_report *)skb->data;
 338
 339         if (r->idx && dev->mt76.phy2)
 340                 mphy = dev->mt76.phy2;
 341
 342         ieee80211_radar_detected(mphy->hw);
 343         dev->hw_pattern++;
 344 }
 345
 346 static void
 347 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
 348                          struct rate_info *rate, u16 r)
 349 {
 350         struct ieee80211_supported_band *sband;
 351         u16 ru_idx = le16_to_cpu(ra->ru_idx);
 352         u16 flags = 0;
 353
 354         rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
 355         rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
 356
 357         switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
 358         case MT_PHY_TYPE_CCK:
 359         case MT_PHY_TYPE_OFDM:
 360                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
 361                         sband = &mphy->sband_5g.sband;
 362                 else
 363                         sband = &mphy->sband_2g.sband;
 364
 365                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
 366                 break;
 367         case MT_PHY_TYPE_HT:
 368         case MT_PHY_TYPE_HT_GF:
 369                 rate->mcs += (rate->nss - 1) * 8;
 370                 flags |= RATE_INFO_FLAGS_MCS;
 371
 372                 if (ra->gi)
 373                         flags |= RATE_INFO_FLAGS_SHORT_GI;
 374                 break;
 375         case MT_PHY_TYPE_VHT:
 376                 flags |= RATE_INFO_FLAGS_VHT_MCS;
 377
 378                 if (ra->gi)
 379                         flags |= RATE_INFO_FLAGS_SHORT_GI;
 380                 break;
 381         case MT_PHY_TYPE_HE_SU:
 382         case MT_PHY_TYPE_HE_EXT_SU:
 383         case MT_PHY_TYPE_HE_TB:
 384         case MT_PHY_TYPE_HE_MU:
 385                 rate->he_gi = ra->gi;
 386                 rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
 387
 388                 flags |= RATE_INFO_FLAGS_HE_MCS;
 389                 break;
 390         default:
 391                 break;
 392         }
 393         rate->flags = flags;
 394
 395         if (ru_idx) {
 396                 switch (ru_idx) {
 397                 case 1 ... 2:
 398                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
 399                         break;
 400                 case 3 ... 6:
 401                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
 402                         break;
 403                 case 7 ... 14:
 404                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
 405                         break;
 406                 default:
 407                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
 408                         break;
 409                 }
 410                 rate->bw = RATE_INFO_BW_HE_RU;
 411         } else {
 412                 u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
 413                         FIELD_GET(MT_RA_RATE_BW, r);
 414
 415                 switch (bw) {
 416                 case IEEE80211_STA_RX_BW_160:
 417                         rate->bw = RATE_INFO_BW_160;
 418                         break;
 419                 case IEEE80211_STA_RX_BW_80:
 420                         rate->bw = RATE_INFO_BW_80;
 421                         break;
 422                 case IEEE80211_STA_RX_BW_40:
 423                         rate->bw = RATE_INFO_BW_40;
 424                         break;
 425                 default:
 426                         rate->bw = RATE_INFO_BW_20;
 427                         break;
 428                 }
 429         }
 430 }
 431
 432 static void
 433 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
 434 {
 435         struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
 436         struct rate_info rate = {}, prob_rate = {};
 437         u16 probe = le16_to_cpu(ra->prob_up_rate);
 438         u16 attempts = le16_to_cpu(ra->attempts);
 439         u16 curr = le16_to_cpu(ra->curr_rate);
 440         u16 wcidx = le16_to_cpu(ra->wlan_idx);
 441         struct mt76_phy *mphy = &dev->mphy;
 442         struct mt7915_sta_stats *stats;
 443         struct mt7915_sta *msta;
 444         struct mt76_wcid *wcid;
 445
 446         if (wcidx >= MT76_N_WCIDS)
 447                 return;
 448
 449         wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
 450         if (!wcid)
 451                 return;
 452
 453         msta = container_of(wcid, struct mt7915_sta, wcid);
 454         stats = &msta->stats;
 455
 456         if (msta->wcid.ext_phy && dev->mt76.phy2)
 457                 mphy = dev->mt76.phy2;
 458
 459         /* current rate */
 460         mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr);
 461         stats->tx_rate = rate;
 462
 463         /* probing rate */
 464         mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe);
 465         stats->prob_rate = prob_rate;
 466
 467         if (attempts) {
 468                 u16 success = le16_to_cpu(ra->success);
 469
 470                 stats->per = 1000 * (attempts - success) / attempts;
 471         }
 472 }
 473
 474 static void
 475 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 476 {
 477         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 478         const char *data = (char *)&rxd[1];
 479         const char *type;
 480
 481         switch (rxd->s2d_index) {
 482         case 0:
 483                 type = "WM";
 484                 break;
 485         case 2:
 486                 type = "WA";
 487                 break;
 488         default:
 489                 type = "unknown";
 490                 break;
 491         }
 492
 493         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 494 }
 495
 496 static void
 497 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 498 {
 499         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 500
 501         switch (rxd->ext_eid) {
 502         case MCU_EXT_EVENT_RDD_REPORT:
 503                 mt7915_mcu_rx_radar_detected(dev, skb);
 504                 break;
 505         case MCU_EXT_EVENT_CSA_NOTIFY:
 506                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 507                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 508                                 mt7915_mcu_csa_finish, dev);
 509                 break;
 510         case MCU_EXT_EVENT_RATE_REPORT:
 511                 mt7915_mcu_tx_rate_report(dev, skb);
 512                 break;
 513         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 514                 mt7915_mcu_rx_log_message(dev, skb);
 515                 break;
 516         default:
 517                 break;
 518         }
 519 }
 520
 521 static void
 522 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 523 {
 524         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 525
 526         switch (rxd->eid) {
 527         case MCU_EVENT_EXT:
 528                 mt7915_mcu_rx_ext_event(dev, skb);
 529                 break;
 530         default:
 531                 break;
 532         }
 533         dev_kfree_skb(skb);
 534 }
 535
 536 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 537 {
 538         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 539
 540         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 541             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 542             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 543             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 544             rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 545             !rxd->seq)
 546                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 547         else
 548                 mt76_mcu_rx_event(&dev->mt76, skb);
 549 }
 550
 551 static struct sk_buff *
 552 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
 553                          struct mt7915_sta *msta, int len)
 554 {
 555         struct sta_req_hdr hdr = {
 556                 .bss_idx = mvif->idx,
 557                 .wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
 558                 .wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
 559                 .muar_idx = msta ? mvif->omac_idx : 0,
 560                 .is_tlv_append = 1,
 561         };
 562         struct sk_buff *skb;
 563
 564         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
 565         if (!skb)
 566                 return ERR_PTR(-ENOMEM);
 567
 568         skb_put_data(skb, &hdr, sizeof(hdr));
 569
 570         return skb;
 571 }
 572
 573 static struct wtbl_req_hdr *
 574 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
 575                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 576 {
 577         struct tlv *sta_hdr = sta_wtbl;
 578         struct wtbl_req_hdr hdr = {
 579                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
 580                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
 581                 .operation = cmd,
 582         };
 583         struct sk_buff *nskb = *skb;
 584
 585         if (!nskb) {
 586                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 587                                           MT7915_WTBL_UPDATE_BA_SIZE);
 588                 if (!nskb)
 589                         return ERR_PTR(-ENOMEM);
 590
 591                 *skb = nskb;
 592         }
 593
 594         if (sta_hdr)
 595                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 596
 597         return skb_put_data(nskb, &hdr, sizeof(hdr));
 598 }
 599
 600 static struct tlv *
 601 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 602                           void *sta_ntlv, void *sta_wtbl)
 603 {
 604         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 605         struct tlv *sta_hdr = sta_wtbl;
 606         struct tlv *ptlv, tlv = {
 607                 .tag = cpu_to_le16(tag),
 608                 .len = cpu_to_le16(len),
 609         };
 610         u16 ntlv;
 611
 612         ptlv = skb_put(skb, len);
 613         memcpy(ptlv, &tlv, sizeof(tlv));
 614
 615         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 616         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 617
 618         if (sta_hdr) {
 619                 u16 size = le16_to_cpu(sta_hdr->len);
 620
 621                 sta_hdr->len = cpu_to_le16(size + len);
 622         }
 623
 624         return ptlv;
 625 }
 626
 627 static struct tlv *
 628 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 629 {
 630         return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 631 }
 632
 633 static struct tlv *
 634 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 635                              __le16 *sub_ntlv, __le16 *len)
 636 {
 637         struct tlv *ptlv, tlv = {
 638                 .tag = cpu_to_le16(sub_tag),
 639                 .len = cpu_to_le16(sub_len),
 640         };
 641
 642         ptlv = skb_put(skb, sub_len);
 643         memcpy(ptlv, &tlv, sizeof(tlv));
 644
 645         le16_add_cpu(sub_ntlv, 1);
 646         le16_add_cpu(len, sub_len);
 647
 648         return ptlv;
 649 }
 650
 651 /** bss info **/
 652 static int
 653 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 654                          struct mt7915_phy *phy, bool enable)
 655 {
 656         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 657         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 658         enum nl80211_band band = chandef->chan->band;
 659         struct bss_info_basic *bss;
 660         u16 wlan_idx = mvif->sta.wcid.idx;
 661         u32 type = NETWORK_INFRA;
 662         struct tlv *tlv;
 663
 664         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 665
 666         switch (vif->type) {
 667         case NL80211_IFTYPE_MESH_POINT:
 668         case NL80211_IFTYPE_AP:
 669         case NL80211_IFTYPE_MONITOR:
 670                 break;
 671         case NL80211_IFTYPE_STATION:
 672                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 673                 if (enable) {
 674                         struct ieee80211_sta *sta;
 675                         struct mt7915_sta *msta;
 676
 677                         rcu_read_lock();
 678                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 679                         if (!sta) {
 680                                 rcu_read_unlock();
 681                                 return -EINVAL;
 682                         }
 683
 684                         msta = (struct mt7915_sta *)sta->drv_priv;
 685                         wlan_idx = msta->wcid.idx;
 686                         rcu_read_unlock();
 687                 }
 688                 break;
 689         case NL80211_IFTYPE_ADHOC:
 690                 type = NETWORK_IBSS;
 691                 break;
 692         default:
 693                 WARN_ON(1);
 694                 break;
 695         }
 696
 697         bss = (struct bss_info_basic *)tlv;
 698         bss->network_type = cpu_to_le32(type);
 699         bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
 700         bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
 701         bss->wmm_idx = mvif->wmm_idx;
 702         bss->active = enable;
 703
 704         if (vif->type != NL80211_IFTYPE_MONITOR) {
 705                 memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 706                 bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 707                 bss->dtim_period = vif->bss_conf.dtim_period;
 708                 bss->phy_mode = mt7915_get_phy_mode(phy->dev, vif, band, NULL);
 709         } else {
 710                 memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
 711         }
 712
 713         return 0;
 714 }
 715
 716 static void
 717 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 718 {
 719         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 720         struct bss_info_omac *omac;
 721         struct tlv *tlv;
 722         u32 type = 0;
 723         u8 idx;
 724
 725         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 726
 727         switch (vif->type) {
 728         case NL80211_IFTYPE_MONITOR:
 729         case NL80211_IFTYPE_MESH_POINT:
 730         case NL80211_IFTYPE_AP:
 731                 type = CONNECTION_INFRA_AP;
 732                 break;
 733         case NL80211_IFTYPE_STATION:
 734                 type = CONNECTION_INFRA_STA;
 735                 break;
 736         case NL80211_IFTYPE_ADHOC:
 737                 type = CONNECTION_IBSS_ADHOC;
 738                 break;
 739         default:
 740                 WARN_ON(1);
 741                 break;
 742         }
 743
 744         omac = (struct bss_info_omac *)tlv;
 745         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 746         omac->conn_type = cpu_to_le32(type);
 747         omac->omac_idx = mvif->omac_idx;
 748         omac->band_idx = mvif->band_idx;
 749         omac->hw_bss_idx = idx;
 750 }
 751
 752 struct mt7915_he_obss_narrow_bw_ru_data {
 753         bool tolerated;
 754 };
 755
 756 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 757                                                    struct cfg80211_bss *bss,
 758                                                    void *_data)
 759 {
 760         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 761         const struct element *elem;
 762
 763         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 764
 765         if (!elem || elem->datalen < 10 ||
 766             !(elem->data[10] &
 767               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 768                 data->tolerated = false;
 769 }
 770
 771 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 772                                               struct ieee80211_vif *vif)
 773 {
 774         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 775                 .tolerated = true,
 776         };
 777
 778         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 779                 return false;
 780
 781         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 782                           mt7915_check_he_obss_narrow_bw_ru_iter,
 783                           &iter_data);
 784
 785         /*
 786          * If there is at least one AP on radar channel that cannot
 787          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 788          */
 789         return !iter_data.tolerated;
 790 }
 791
 792 static void
 793 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 794                         struct mt7915_phy *phy)
 795 {
 796         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 797         struct bss_info_rf_ch *ch;
 798         struct tlv *tlv;
 799         int freq1 = chandef->center_freq1;
 800
 801         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 802
 803         ch = (struct bss_info_rf_ch *)tlv;
 804         ch->pri_ch = chandef->chan->hw_value;
 805         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 806         ch->bw = mt7915_mcu_chan_bw(chandef);
 807
 808         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 809                 int freq2 = chandef->center_freq2;
 810
 811                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 812         }
 813
 814         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 815                 struct mt7915_dev *dev = phy->dev;
 816                 struct mt76_phy *mphy = &dev->mt76.phy;
 817                 bool ext_phy = phy != &dev->phy;
 818
 819                 if (ext_phy && dev->mt76.phy2)
 820                         mphy = dev->mt76.phy2;
 821
 822                 ch->he_ru26_block =
 823                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 824                 ch->he_all_disable = false;
 825         } else {
 826                 ch->he_all_disable = true;
 827         }
 828 }
 829
 830 static void
 831 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 832                       struct mt7915_phy *phy)
 833 {
 834         int max_nss = hweight8(phy->mt76->chainmask);
 835         struct bss_info_ra *ra;
 836         struct tlv *tlv;
 837
 838         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 839
 840         ra = (struct bss_info_ra *)tlv;
 841         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 842         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 843         ra->short_preamble = true;
 844         ra->tx_streams = max_nss;
 845         ra->rx_streams = max_nss;
 846         ra->algo = 4;
 847         ra->train_up_rule = 2;
 848         ra->train_up_high_thres = 110;
 849         ra->train_up_rule_rssi = -70;
 850         ra->low_traffic_thres = 2;
 851         ra->phy_cap = cpu_to_le32(0xfdf);
 852         ra->interval = cpu_to_le32(500);
 853         ra->fast_interval = cpu_to_le32(100);
 854 }
 855
 856 static void
 857 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 858                       struct mt7915_phy *phy)
 859 {
 860 #define DEFAULT_HE_PE_DURATION          4
 861 #define DEFAULT_HE_DURATION_RTS_THRES   1023
 862         const struct ieee80211_sta_he_cap *cap;
 863         struct bss_info_he *he;
 864         struct tlv *tlv;
 865
 866         cap = mt7915_get_he_phy_cap(phy, vif);
 867
 868         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 869
 870         he = (struct bss_info_he *)tlv;
 871         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
 872         if (!he->he_pe_duration)
 873                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 874
 875         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
 876         if (!he->he_rts_thres)
 877                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 878
 879         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 880         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 881         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 882 }
 883
 884 static void
 885 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
 886 {
 887 #define TXD_CMP_MAP1            GENMASK(15, 0)
 888 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
 889         struct bss_info_hw_amsdu *amsdu;
 890         struct tlv *tlv;
 891
 892         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
 893
 894         amsdu = (struct bss_info_hw_amsdu *)tlv;
 895         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
 896         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
 897         amsdu->trig_thres = cpu_to_le16(2);
 898         amsdu->enable = true;
 899 }
 900
 901 static void
 902 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
 903 {
 904 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 905 #define BCN_TX_ESTIMATE_TIME    (4096 + 20)
 906         struct bss_info_ext_bss *ext;
 907         int ext_bss_idx, tsf_offset;
 908         struct tlv *tlv;
 909
 910         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 911         if (ext_bss_idx < 0)
 912                 return;
 913
 914         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 915
 916         ext = (struct bss_info_ext_bss *)tlv;
 917         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 918         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 919 }
 920
 921 static void
 922 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
 923 {
 924         struct bss_info_bmc_rate *bmc;
 925         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 926         enum nl80211_band band = chandef->chan->band;
 927         struct tlv *tlv;
 928
 929         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
 930
 931         bmc = (struct bss_info_bmc_rate *)tlv;
 932         if (band == NL80211_BAND_2GHZ) {
 933                 bmc->short_preamble = true;
 934         } else {
 935                 bmc->bc_trans = cpu_to_le16(0x2000);
 936                 bmc->mc_trans = cpu_to_le16(0x2080);
 937         }
 938 }
 939
 940 static int
 941 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
 942                        bool bssid, bool enable)
 943 {
 944         struct mt7915_dev *dev = phy->dev;
 945         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 946         u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
 947         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
 948         const u8 *addr = vif->addr;
 949         struct {
 950                 u8 mode;
 951                 u8 force_clear;
 952                 u8 clear_bitmap[8];
 953                 u8 entry_count;
 954                 u8 write;
 955                 u8 band;
 956
 957                 u8 index;
 958                 u8 bssid;
 959                 u8 addr[ETH_ALEN];
 960         } __packed req = {
 961                 .mode = !!mask || enable,
 962                 .entry_count = 1,
 963                 .write = 1,
 964                 .band = phy != &dev->phy,
 965                 .index = idx * 2 + bssid,
 966         };
 967
 968         if (bssid)
 969                 addr = vif->bss_conf.bssid;
 970
 971         if (enable)
 972                 ether_addr_copy(req.addr, addr);
 973
 974         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
 975                                  sizeof(req), true);
 976 }
 977
 978 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
 979                             struct ieee80211_vif *vif, int enable)
 980 {
 981         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 982         struct sk_buff *skb;
 983
 984         if (mvif->omac_idx >= REPEATER_BSSID_START)
 985                 mt7915_mcu_muar_config(phy, vif, true, enable);
 986
 987         skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
 988                                        MT7915_BSS_UPDATE_MAX_SIZE);
 989         if (IS_ERR(skb))
 990                 return PTR_ERR(skb);
 991
 992         /* bss_omac must be first */
 993         if (enable)
 994                 mt7915_mcu_bss_omac_tlv(skb, vif);
 995
 996         mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
 997
 998         if (vif->type == NL80211_IFTYPE_MONITOR)
 999                 goto out;
1000
1001         if (enable) {
1002                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1003                 mt7915_mcu_bss_bmc_tlv(skb, phy);
1004                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1005                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
1006
1007                 if (vif->bss_conf.he_support)
1008                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
1009
1010                 if (mvif->omac_idx >= EXT_BSSID_START &&
1011                     mvif->omac_idx < REPEATER_BSSID_START)
1012                         mt7915_mcu_bss_ext_tlv(skb, mvif);
1013         }
1014 out:
1015         return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1016                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1017 }
1018
1019 /** starec & wtbl **/
1020 static int
1021 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1022                        struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1023 {
1024         struct mt7915_sta_key_conf *bip = &msta->bip;
1025         struct sta_rec_sec *sec;
1026         struct tlv *tlv;
1027         u32 len = sizeof(*sec);
1028
1029         tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1030
1031         sec = (struct sta_rec_sec *)tlv;
1032         sec->add = cmd;
1033
1034         if (cmd == SET_KEY) {
1035                 struct sec_key *sec_key;
1036                 u8 cipher;
1037
1038                 cipher = mt7915_mcu_get_cipher(key->cipher);
1039                 if (cipher == MT_CIPHER_NONE)
1040                         return -EOPNOTSUPP;
1041
1042                 sec_key = &sec->key[0];
1043                 sec_key->cipher_len = sizeof(*sec_key);
1044
1045                 if (cipher == MT_CIPHER_BIP_CMAC_128) {
1046                         sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1047                         sec_key->key_id = bip->keyidx;
1048                         sec_key->key_len = 16;
1049                         memcpy(sec_key->key, bip->key, 16);
1050
1051                         sec_key = &sec->key[1];
1052                         sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1053                         sec_key->cipher_len = sizeof(*sec_key);
1054                         sec_key->key_len = 16;
1055                         memcpy(sec_key->key, key->key, 16);
1056
1057                         sec->n_cipher = 2;
1058                 } else {
1059                         sec_key->cipher_id = cipher;
1060                         sec_key->key_id = key->keyidx;
1061                         sec_key->key_len = key->keylen;
1062                         memcpy(sec_key->key, key->key, key->keylen);
1063
1064                         if (cipher == MT_CIPHER_TKIP) {
1065                                 /* Rx/Tx MIC keys are swapped */
1066                                 memcpy(sec_key->key + 16, key->key + 24, 8);
1067                                 memcpy(sec_key->key + 24, key->key + 16, 8);
1068                         }
1069
1070                         /* store key_conf for BIP batch update */
1071                         if (cipher == MT_CIPHER_AES_CCMP) {
1072                                 memcpy(bip->key, key->key, key->keylen);
1073                                 bip->keyidx = key->keyidx;
1074                         }
1075
1076                         len -= sizeof(*sec_key);
1077                         sec->n_cipher = 1;
1078                 }
1079         } else {
1080                 len -= sizeof(sec->key);
1081                 sec->n_cipher = 0;
1082         }
1083         sec->len = cpu_to_le16(len);
1084
1085         return 0;
1086 }
1087
1088 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1089                        struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1090                        enum set_key_cmd cmd)
1091 {
1092         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1093         struct sk_buff *skb;
1094         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1095         int ret;
1096
1097         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1098         if (IS_ERR(skb))
1099                 return PTR_ERR(skb);
1100
1101         ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1102         if (ret)
1103                 return ret;
1104
1105         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1106                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1107 }
1108
1109 static void
1110 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1111                       struct ieee80211_ampdu_params *params,
1112                       bool enable, bool tx)
1113 {
1114         struct sta_rec_ba *ba;
1115         struct tlv *tlv;
1116
1117         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1118
1119         ba = (struct sta_rec_ba *)tlv;
1120         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1121         ba->winsize = cpu_to_le16(params->buf_size);
1122         ba->ssn = cpu_to_le16(params->ssn);
1123         ba->ba_en = enable << params->tid;
1124         ba->amsdu = params->amsdu;
1125         ba->tid = params->tid;
1126 }
1127
1128 static void
1129 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1130                        struct ieee80211_ampdu_params *params,
1131                        bool enable, bool tx, void *sta_wtbl,
1132                        void *wtbl_tlv)
1133 {
1134         struct wtbl_ba *ba;
1135         struct tlv *tlv;
1136
1137         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1138                                         wtbl_tlv, sta_wtbl);
1139
1140         ba = (struct wtbl_ba *)tlv;
1141         ba->tid = params->tid;
1142
1143         if (tx) {
1144                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1145                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1146                 ba->ba_en = enable;
1147         } else {
1148                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1149                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1150                 ba->rst_ba_tid = params->tid;
1151                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1152                 ba->rst_ba_sb = 1;
1153         }
1154
1155         if (enable && tx)
1156                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1157 }
1158
1159 static int
1160 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1161                   struct ieee80211_ampdu_params *params,
1162                   bool enable, bool tx)
1163 {
1164         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1165         struct mt7915_vif *mvif = msta->vif;
1166         struct wtbl_req_hdr *wtbl_hdr;
1167         struct tlv *sta_wtbl;
1168         struct sk_buff *skb;
1169         int ret;
1170
1171         if (enable && tx && !params->amsdu)
1172                 msta->wcid.amsdu = false;
1173
1174         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1175                                        MT7915_STA_UPDATE_MAX_SIZE);
1176         if (IS_ERR(skb))
1177                 return PTR_ERR(skb);
1178
1179         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1180
1181         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1182                                              &skb);
1183         mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1184
1185         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1186                                     MCU_EXT_CMD_STA_REC_UPDATE, true);
1187         if (ret)
1188                 return ret;
1189
1190         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1191                                        MT7915_STA_UPDATE_MAX_SIZE);
1192         if (IS_ERR(skb))
1193                 return PTR_ERR(skb);
1194
1195         mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1196
1197         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1198                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1199 }
1200
1201 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1202                          struct ieee80211_ampdu_params *params,
1203                          bool enable)
1204 {
1205         return mt7915_mcu_sta_ba(dev, params, enable, true);
1206 }
1207
1208 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1209                          struct ieee80211_ampdu_params *params,
1210                          bool enable)
1211 {
1212         return mt7915_mcu_sta_ba(dev, params, enable, false);
1213 }
1214
1215 static void
1216 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1217                             struct ieee80211_sta *sta, void *sta_wtbl,
1218                             void *wtbl_tlv)
1219 {
1220         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1221         struct wtbl_generic *generic;
1222         struct wtbl_rx *rx;
1223         struct tlv *tlv;
1224
1225         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1226                                         wtbl_tlv, sta_wtbl);
1227
1228         generic = (struct wtbl_generic *)tlv;
1229
1230         if (sta) {
1231                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1232                 generic->partial_aid = cpu_to_le16(sta->aid);
1233                 generic->muar_idx = mvif->omac_idx;
1234                 generic->qos = sta->wme;
1235         } else {
1236                 /* use BSSID in station mode */
1237                 if (vif->type == NL80211_IFTYPE_STATION)
1238                         memcpy(generic->peer_addr, vif->bss_conf.bssid,
1239                                ETH_ALEN);
1240                 else
1241                         eth_broadcast_addr(generic->peer_addr);
1242
1243                 generic->muar_idx = 0xe;
1244         }
1245
1246         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1247                                         wtbl_tlv, sta_wtbl);
1248
1249         rx = (struct wtbl_rx *)tlv;
1250         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1251         rx->rca2 = 1;
1252         rx->rv = 1;
1253 }
1254
1255 static void
1256 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1257                          struct ieee80211_sta *sta, bool enable)
1258 {
1259 #define EXTRA_INFO_VER          BIT(0)
1260 #define EXTRA_INFO_NEW          BIT(1)
1261         struct sta_rec_basic *basic;
1262         struct tlv *tlv;
1263
1264         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1265
1266         basic = (struct sta_rec_basic *)tlv;
1267         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1268
1269         if (enable) {
1270                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1271                 basic->conn_state = CONN_STATE_PORT_SECURE;
1272         } else {
1273                 basic->conn_state = CONN_STATE_DISCONNECT;
1274         }
1275
1276         if (!sta) {
1277                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1278                 eth_broadcast_addr(basic->peer_addr);
1279                 return;
1280         }
1281
1282         switch (vif->type) {
1283         case NL80211_IFTYPE_MESH_POINT:
1284         case NL80211_IFTYPE_AP:
1285                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1286                 break;
1287         case NL80211_IFTYPE_STATION:
1288                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1289                 break;
1290         case NL80211_IFTYPE_ADHOC:
1291                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1292                 break;
1293         default:
1294                 WARN_ON(1);
1295                 break;
1296         }
1297
1298         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1299         basic->aid = cpu_to_le16(sta->aid);
1300         basic->qos = sta->wme;
1301 }
1302
1303 static void
1304 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1305 {
1306         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1307         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1308         struct sta_rec_he *he;
1309         struct tlv *tlv;
1310         u32 cap = 0;
1311
1312         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1313
1314         he = (struct sta_rec_he *)tlv;
1315
1316         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1317                 cap |= STA_REC_HE_CAP_HTC;
1318
1319         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1320                 cap |= STA_REC_HE_CAP_BSR;
1321
1322         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1323                 cap |= STA_REC_HE_CAP_OM;
1324
1325         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1326                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1327
1328         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1329                 cap |= STA_REC_HE_CAP_BQR;
1330
1331         if (elem->phy_cap_info[0] &
1332             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1333              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1334                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1335
1336         if (elem->phy_cap_info[1] &
1337             IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1338                 cap |= STA_REC_HE_CAP_LDPC;
1339
1340         if (elem->phy_cap_info[1] &
1341             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1342                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1343
1344         if (elem->phy_cap_info[2] &
1345             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1346                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1347
1348         if (elem->phy_cap_info[2] &
1349             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1350                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1351
1352         if (elem->phy_cap_info[2] &
1353             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1354                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1355
1356         if (elem->phy_cap_info[6] &
1357             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1358                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1359
1360         if (elem->phy_cap_info[7] &
1361             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1362                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1363
1364         if (elem->phy_cap_info[7] &
1365             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1366                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1367
1368         if (elem->phy_cap_info[7] &
1369             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1370                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1371
1372         if (elem->phy_cap_info[8] &
1373             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1374                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1375
1376         if (elem->phy_cap_info[8] &
1377             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1378                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1379
1380         if (elem->phy_cap_info[9] &
1381             IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1382                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1383
1384         if (elem->phy_cap_info[9] &
1385             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1386                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1387
1388         if (elem->phy_cap_info[9] &
1389             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1390                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1391
1392         he->he_cap = cpu_to_le32(cap);
1393
1394         switch (sta->bandwidth) {
1395         case IEEE80211_STA_RX_BW_160:
1396                 if (elem->phy_cap_info[0] &
1397                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1398                         he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1399                                 he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1400
1401                 he->max_nss_mcs[CMD_HE_MCS_BW160] =
1402                                 he_cap->he_mcs_nss_supp.rx_mcs_160;
1403                 fallthrough;
1404         default:
1405                 he->max_nss_mcs[CMD_HE_MCS_BW80] =
1406                                 he_cap->he_mcs_nss_supp.rx_mcs_80;
1407                 break;
1408         }
1409
1410         he->t_frame_dur =
1411                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1412         he->max_ampdu_exp =
1413                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1414
1415         he->bw_set =
1416                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1417         he->device_class =
1418                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1419         he->punc_pream_rx =
1420                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1421
1422         he->dcm_tx_mode =
1423                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1424         he->dcm_tx_max_nss =
1425                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1426         he->dcm_rx_mode =
1427                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1428         he->dcm_rx_max_nss =
1429                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1430         he->dcm_rx_max_nss =
1431                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1432
1433         he->pkt_ext = 2;
1434 }
1435
1436 static void
1437 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1438                      struct ieee80211_vif *vif)
1439 {
1440         struct sta_rec_uapsd *uapsd;
1441         struct tlv *tlv;
1442
1443         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1444                 return;
1445
1446         tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1447         uapsd = (struct sta_rec_uapsd *)tlv;
1448
1449         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1450                 uapsd->dac_map |= BIT(3);
1451                 uapsd->tac_map |= BIT(3);
1452         }
1453         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1454                 uapsd->dac_map |= BIT(2);
1455                 uapsd->tac_map |= BIT(2);
1456         }
1457         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1458                 uapsd->dac_map |= BIT(1);
1459                 uapsd->tac_map |= BIT(1);
1460         }
1461         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1462                 uapsd->dac_map |= BIT(0);
1463                 uapsd->tac_map |= BIT(0);
1464         }
1465         uapsd->max_sp = sta->max_sp;
1466 }
1467
1468 static void
1469 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1470 {
1471         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1472         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1473         struct sta_rec_muru *muru;
1474         struct tlv *tlv;
1475
1476         tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1477
1478         muru = (struct sta_rec_muru *)tlv;
1479         muru->cfg.ofdma_dl_en = true;
1480         muru->cfg.mimo_dl_en = true;
1481
1482         muru->ofdma_dl.punc_pream_rx =
1483                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1484         muru->ofdma_dl.he_20m_in_40m_2g =
1485                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1486         muru->ofdma_dl.he_20m_in_160m =
1487                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1488         muru->ofdma_dl.he_80m_in_160m =
1489                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1490         muru->ofdma_dl.lt16_sigb = 0;
1491         muru->ofdma_dl.rx_su_comp_sigb = 0;
1492         muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1493
1494         muru->ofdma_ul.t_frame_dur =
1495                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1496         muru->ofdma_ul.mu_cascading =
1497                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1498         muru->ofdma_ul.uo_ra =
1499                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1500         muru->ofdma_ul.he_2x996_tone = 0;
1501         muru->ofdma_ul.rx_t_frame_11ac = 0;
1502
1503         muru->mimo_dl.vht_mu_bfee =
1504                 !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1505         muru->mimo_dl.partial_bw_dl_mimo =
1506                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1507
1508         muru->mimo_ul.full_ul_mimo =
1509                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1510         muru->mimo_ul.partial_ul_mimo =
1511                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1512 }
1513
1514 static int
1515 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1516                   struct ieee80211_sta *sta)
1517 {
1518         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1519         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1520         struct sk_buff *skb;
1521         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1522
1523         if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1524                 return 0;
1525
1526         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1527         if (IS_ERR(skb))
1528                 return PTR_ERR(skb);
1529
1530         /* starec muru */
1531         mt7915_mcu_sta_muru_tlv(skb, sta);
1532
1533         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1534                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1535 }
1536
1537 static void
1538 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1539 {
1540         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1541         struct sta_rec_amsdu *amsdu;
1542         struct tlv *tlv;
1543
1544         if (!sta->max_amsdu_len)
1545             return;
1546
1547         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1548         amsdu = (struct sta_rec_amsdu *)tlv;
1549         amsdu->max_amsdu_num = 8;
1550         amsdu->amsdu_en = true;
1551         amsdu->max_mpdu_size = sta->max_amsdu_len >=
1552                                IEEE80211_MAX_MPDU_LEN_VHT_7991;
1553         msta->wcid.amsdu = true;
1554 }
1555
1556 static bool
1557 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1558 {
1559         switch (vif->type) {
1560         case NL80211_IFTYPE_AP:
1561         case NL80211_IFTYPE_STATION:
1562                 return true;
1563         default:
1564                 return false;
1565         }
1566 }
1567
1568 static void
1569 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1570                    struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1571 {
1572         struct tlv *tlv;
1573
1574         /* starec ht */
1575         if (sta->ht_cap.ht_supported) {
1576                 struct sta_rec_ht *ht;
1577
1578                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1579                 ht = (struct sta_rec_ht *)tlv;
1580                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1581
1582                 if (mt7915_hw_amsdu_supported(vif))
1583                         mt7915_mcu_sta_amsdu_tlv(skb, sta);
1584         }
1585
1586         /* starec vht */
1587         if (sta->vht_cap.vht_supported) {
1588                 struct sta_rec_vht *vht;
1589
1590                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1591                 vht = (struct sta_rec_vht *)tlv;
1592                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1593                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1594                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1595         }
1596
1597         /* starec he */
1598         if (sta->he_cap.has_he)
1599                 mt7915_mcu_sta_he_tlv(skb, sta);
1600
1601         /* starec uapsd */
1602         mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1603 }
1604
1605 static void
1606 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1607                          void *sta_wtbl, void *wtbl_tlv)
1608 {
1609         struct wtbl_smps *smps;
1610         struct tlv *tlv;
1611
1612         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1613                                         wtbl_tlv, sta_wtbl);
1614         smps = (struct wtbl_smps *)tlv;
1615
1616         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1617                 smps->smps = true;
1618 }
1619
1620 static void
1621 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1622                        void *sta_wtbl, void *wtbl_tlv)
1623 {
1624         struct wtbl_ht *ht = NULL;
1625         struct tlv *tlv;
1626
1627         /* wtbl ht */
1628         if (sta->ht_cap.ht_supported) {
1629                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1630                                                 wtbl_tlv, sta_wtbl);
1631                 ht = (struct wtbl_ht *)tlv;
1632                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1633                 ht->af = sta->ht_cap.ampdu_factor;
1634                 ht->mm = sta->ht_cap.ampdu_density;
1635                 ht->ht = true;
1636         }
1637
1638         /* wtbl vht */
1639         if (sta->vht_cap.vht_supported) {
1640                 struct wtbl_vht *vht;
1641                 u8 af;
1642
1643                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1644                                                 wtbl_tlv, sta_wtbl);
1645                 vht = (struct wtbl_vht *)tlv;
1646                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1647                 vht->vht = true;
1648
1649                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1650                                sta->vht_cap.cap);
1651                 if (ht)
1652                         ht->af = max_t(u8, ht->af, af);
1653         }
1654
1655         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1656 }
1657
1658 static void
1659 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1660                               struct ieee80211_sta *sta,
1661                               void *sta_wtbl, void *wtbl_tlv)
1662 {
1663         struct mt7915_sta *msta;
1664         struct wtbl_hdr_trans *htr = NULL;
1665         struct tlv *tlv;
1666
1667         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1668                                         wtbl_tlv, sta_wtbl);
1669         htr = (struct wtbl_hdr_trans *)tlv;
1670         htr->no_rx_trans = true;
1671         if (vif->type == NL80211_IFTYPE_STATION)
1672                 htr->to_ds = true;
1673         else
1674                 htr->from_ds = true;
1675
1676         if (!sta)
1677                 return;
1678
1679         msta = (struct mt7915_sta *)sta->drv_priv;
1680         if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1681                 htr->to_ds = true;
1682                 htr->from_ds = true;
1683         }
1684 }
1685
1686 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1687                                     struct ieee80211_vif *vif,
1688                                     struct ieee80211_sta *sta)
1689 {
1690         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1691         struct wtbl_req_hdr *wtbl_hdr;
1692         struct sk_buff *skb;
1693
1694         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1695         if (!skb)
1696                 return -ENOMEM;
1697
1698         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1699         mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1700
1701         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1702                                      true);
1703 }
1704
1705 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1706                         struct ieee80211_sta *sta)
1707 {
1708         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1709         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1710         struct wtbl_req_hdr *wtbl_hdr;
1711         struct tlv *sta_wtbl;
1712         struct sk_buff *skb;
1713
1714         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1715                                        MT7915_STA_UPDATE_MAX_SIZE);
1716         if (IS_ERR(skb))
1717                 return PTR_ERR(skb);
1718
1719         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1720
1721         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1722                                              &skb);
1723         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1724
1725         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1726                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1727 }
1728
1729 static void
1730 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1731 {
1732         bf->bf_cap = MT_EBF;
1733         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1734         bf->ndp_rate = 0;                               /* mcs0 */
1735         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1736         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1737 }
1738
1739 static void
1740 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1741                        struct sta_rec_bf *bf)
1742 {
1743         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1744         u8 n = 0;
1745
1746         bf->tx_mode = MT_PHY_TYPE_HT;
1747         bf->bf_cap = MT_IBF;
1748
1749         if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1750             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1751                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1752                               mcs->tx_params);
1753         else if (mcs->rx_mask[3])
1754                 n = 3;
1755         else if (mcs->rx_mask[2])
1756                 n = 2;
1757         else if (mcs->rx_mask[1])
1758                 n = 1;
1759
1760         bf->nr = hweight8(phy->mt76->chainmask) - 1;
1761         bf->nc = min_t(u8, bf->nr, n);
1762         bf->ibf_ncol = n;
1763 }
1764
1765 static void
1766 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1767                         struct sta_rec_bf *bf, bool explicit)
1768 {
1769         struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1770         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1771         u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1772         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1773         u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1774
1775         bf->tx_mode = MT_PHY_TYPE_VHT;
1776
1777         if (explicit) {
1778                 u8 bfee_nr, bfer_nr;
1779
1780                 mt7915_mcu_sta_sounding_rate(bf);
1781                 bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1782                                     pc->cap);
1783                 bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1784                                     vc->cap);
1785                 bf->nr = min_t(u8, min_t(u8, bfer_nr, bfee_nr), tx_ant);
1786                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1787                 bf->ibf_ncol = bf->nc;
1788
1789                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1790                         bf->nr = 1;
1791         } else {
1792                 bf->bf_cap = MT_IBF;
1793                 bf->nr = tx_ant;
1794                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1795                 bf->ibf_ncol = nss_mcs;
1796
1797                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1798                         bf->ibf_nrow = 1;
1799         }
1800 }
1801
1802 static void
1803 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1804                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1805 {
1806         struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1807         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1808         const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1809         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1810         u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1811         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1812         u8 bfee_nr, bfer_nr;
1813
1814         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1815         mt7915_mcu_sta_sounding_rate(bf);
1816         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1817                                 pe->phy_cap_info[6]);
1818         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1819                                 pe->phy_cap_info[6]);
1820         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1821                          ve->phy_cap_info[5]);
1822         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1823                          pe->phy_cap_info[4]);
1824         bf->nr = min_t(u8, bfer_nr, bfee_nr);
1825         bf->nc = min_t(u8, nss_mcs, bf->nr);
1826         bf->ibf_ncol = bf->nc;
1827
1828         if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1829                 return;
1830
1831         /* go over for 160MHz and 80p80 */
1832         if (pe->phy_cap_info[0] &
1833             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1834                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1835                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1836
1837                 bf->nc_bw160 = nss_mcs;
1838         }
1839
1840         if (pe->phy_cap_info[0] &
1841             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1842                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1843                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1844
1845                 if (bf->nc_bw160)
1846                         bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1847                 else
1848                         bf->nc_bw160 = nss_mcs;
1849         }
1850
1851         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1852                          ve->phy_cap_info[5]);
1853         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1854                          pe->phy_cap_info[4]);
1855
1856         bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1857 }
1858
1859 static void
1860 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1861                         struct ieee80211_vif *vif, struct mt7915_phy *phy,
1862                         bool enable, bool explicit)
1863 {
1864         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1865         struct sta_rec_bf *bf;
1866         struct tlv *tlv;
1867         const u8 matrix[4][4] = {
1868                 {0, 0, 0, 0},
1869                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
1870                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
1871                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
1872         };
1873
1874 #define MT_BFER_FREE            cpu_to_le16(GENMASK(15, 0))
1875
1876         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1877         bf = (struct sta_rec_bf *)tlv;
1878
1879         if (!enable) {
1880                 bf->pfmu = MT_BFER_FREE;
1881                 return;
1882         }
1883
1884         /* he: eBF only, in accordance with spec
1885          * vht: support eBF and iBF
1886          * ht: iBF only, since mac80211 lacks of eBF support
1887          */
1888         if (sta->he_cap.has_he && explicit)
1889                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1890         else if (sta->vht_cap.vht_supported)
1891                 mt7915_mcu_sta_bfer_vht(sta, phy, bf, explicit);
1892         else if (sta->ht_cap.ht_supported)
1893                 mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1894         else
1895                 return;
1896
1897         bf->bw = sta->bandwidth;
1898         bf->ibf_dbw = sta->bandwidth;
1899         bf->ibf_nrow = tx_ant;
1900
1901         if (!explicit && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1902                 bf->ibf_timeout = 0x48;
1903         else
1904                 bf->ibf_timeout = 0x18;
1905
1906         if (explicit && bf->nr != tx_ant)
1907                 bf->mem_20m = matrix[tx_ant][bf->nc];
1908         else
1909                 bf->mem_20m = matrix[bf->nr][bf->nc];
1910
1911         switch (sta->bandwidth) {
1912         case IEEE80211_STA_RX_BW_160:
1913         case IEEE80211_STA_RX_BW_80:
1914                 bf->mem_total = bf->mem_20m * 2;
1915                 break;
1916         case IEEE80211_STA_RX_BW_40:
1917                 bf->mem_total = bf->mem_20m;
1918                 break;
1919         case IEEE80211_STA_RX_BW_20:
1920         default:
1921                 break;
1922         }
1923 }
1924
1925 static void
1926 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1927                         struct mt7915_phy *phy)
1928 {
1929         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1930         struct sta_rec_bfee *bfee;
1931         struct tlv *tlv;
1932         u8 nr = 0;
1933
1934         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1935         bfee = (struct sta_rec_bfee *)tlv;
1936
1937         if (sta->he_cap.has_he) {
1938                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1939
1940                 nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1941                             pe->phy_cap_info[5]);
1942         } else if (sta->vht_cap.vht_supported) {
1943                 struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1944
1945                 nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1946                                pc->cap);
1947         }
1948
1949         /* reply with identity matrix to avoid 2x2 BF negative gain */
1950         bfee->fb_identity_matrix = !!(nr == 1 && tx_ant == 2);
1951 }
1952
1953 static int
1954 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1955                     struct ieee80211_sta *sta, bool enable)
1956 {
1957         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1958         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1959         struct mt7915_phy *phy;
1960         struct sk_buff *skb;
1961         int r, len;
1962         bool ebfee = 0, ebf = 0;
1963
1964         if (vif->type != NL80211_IFTYPE_STATION &&
1965             vif->type != NL80211_IFTYPE_AP)
1966                 return 0;
1967
1968         phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1969
1970         if (sta->he_cap.has_he) {
1971                 struct ieee80211_he_cap_elem *pe;
1972                 const struct ieee80211_he_cap_elem *ve;
1973                 const struct ieee80211_sta_he_cap *vc;
1974
1975                 pe = &sta->he_cap.he_cap_elem;
1976                 vc = mt7915_get_he_phy_cap(phy, vif);
1977                 ve = &vc->he_cap_elem;
1978
1979                 ebfee = !!((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
1980                             HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
1981                            HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]));
1982                 ebf = !!((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
1983                           HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
1984                          HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]));
1985         } else if (sta->vht_cap.vht_supported) {
1986                 struct ieee80211_sta_vht_cap *pc;
1987                 struct ieee80211_sta_vht_cap *vc;
1988                 u32 cr, ce;
1989
1990                 pc = &sta->vht_cap;
1991                 vc = &phy->mt76->sband_5g.sband.vht_cap;
1992                 cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
1993                      IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
1994                 ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
1995                      IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1996
1997                 ebfee = !!((pc->cap & cr) && (vc->cap & ce));
1998                 ebf = !!((vc->cap & cr) && (pc->cap & ce));
1999         }
2000
2001         /* must keep each tag independent */
2002
2003         /* starec bf */
2004         if (ebf || dev->ibf) {
2005                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2006
2007                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2008                 if (IS_ERR(skb))
2009                         return PTR_ERR(skb);
2010
2011                 mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable, ebf);
2012
2013                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2014                                           MCU_EXT_CMD_STA_REC_UPDATE, true);
2015                 if (r)
2016                         return r;
2017         }
2018
2019         /* starec bfee */
2020         if (ebfee) {
2021                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2022
2023                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2024                 if (IS_ERR(skb))
2025                         return PTR_ERR(skb);
2026
2027                 mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2028
2029                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2030                                           MCU_EXT_CMD_STA_REC_UPDATE, true);
2031                 if (r)
2032                         return r;
2033         }
2034
2035         return 0;
2036 }
2037
2038 static void
2039 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2040                              struct ieee80211_vif *vif,
2041                              struct ieee80211_sta *sta)
2042 {
2043         struct cfg80211_chan_def *chandef = &dev->mphy.chandef;
2044         struct sta_rec_ra *ra;
2045         struct tlv *tlv;
2046         enum nl80211_band band = chandef->chan->band;
2047         u32 supp_rate = sta->supp_rates[band];
2048         int n_rates = hweight32(supp_rate);
2049         u32 cap = sta->wme ? STA_CAP_WMM : 0;
2050         u8 i, nss = sta->rx_nss, mcs = 0;
2051
2052         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2053
2054         ra = (struct sta_rec_ra *)tlv;
2055         ra->valid = true;
2056         ra->auto_rate = true;
2057         ra->phy_mode = mt7915_get_phy_mode(dev, vif, band, sta);
2058         ra->channel = chandef->chan->hw_value;
2059         ra->bw = sta->bandwidth;
2060         ra->rate_len = n_rates;
2061         ra->phy.bw = sta->bandwidth;
2062
2063         if (n_rates) {
2064                 if (band == NL80211_BAND_2GHZ) {
2065                         ra->supp_mode = MODE_CCK;
2066                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2067                         ra->phy.type = MT_PHY_TYPE_CCK;
2068
2069                         if (n_rates > 4) {
2070                                 ra->supp_mode |= MODE_OFDM;
2071                                 ra->supp_ofdm_rate = supp_rate >> 4;
2072                                 ra->phy.type = MT_PHY_TYPE_OFDM;
2073                         }
2074                 } else {
2075                         ra->supp_mode = MODE_OFDM;
2076                         ra->supp_ofdm_rate = supp_rate;
2077                         ra->phy.type = MT_PHY_TYPE_OFDM;
2078                 }
2079         }
2080
2081         if (sta->ht_cap.ht_supported) {
2082                 for (i = 0; i < nss; i++)
2083                         ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2084
2085                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2086                 ra->supp_mode |= MODE_HT;
2087                 mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2088                 ra->af = sta->ht_cap.ampdu_factor;
2089                 ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2090
2091                 cap |= STA_CAP_HT;
2092                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2093                         cap |= STA_CAP_SGI_20;
2094                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2095                         cap |= STA_CAP_SGI_40;
2096                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2097                         cap |= STA_CAP_TX_STBC;
2098                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2099                         cap |= STA_CAP_RX_STBC;
2100                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2101                         cap |= STA_CAP_LDPC;
2102         }
2103
2104         if (sta->vht_cap.vht_supported) {
2105                 u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2106                 u16 vht_mcs;
2107                 u8 af, mcs_prev;
2108
2109                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2110                                sta->vht_cap.cap);
2111                 ra->af = max_t(u8, ra->af, af);
2112
2113                 cap |= STA_CAP_VHT;
2114                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2115                         cap |= STA_CAP_VHT_SGI_80;
2116                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2117                         cap |= STA_CAP_VHT_SGI_160;
2118                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2119                         cap |= STA_CAP_VHT_TX_STBC;
2120                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2121                         cap |= STA_CAP_VHT_RX_STBC;
2122                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2123                         cap |= STA_CAP_VHT_LDPC;
2124
2125                 ra->supp_mode |= MODE_VHT;
2126                 for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2127                         switch (mcs_map & 0x3) {
2128                         case IEEE80211_VHT_MCS_SUPPORT_0_9:
2129                                 vht_mcs = GENMASK(9, 0);
2130                                 break;
2131                         case IEEE80211_VHT_MCS_SUPPORT_0_8:
2132                                 vht_mcs = GENMASK(8, 0);
2133                                 break;
2134                         case IEEE80211_VHT_MCS_SUPPORT_0_7:
2135                                 vht_mcs = GENMASK(7, 0);
2136                                 break;
2137                         default:
2138                                 vht_mcs = 0;
2139                         }
2140
2141                         ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2142
2143                         mcs_prev = hweight16(vht_mcs) - 1;
2144                         if (mcs_prev > mcs)
2145                                 mcs = mcs_prev;
2146
2147                         /* only support 2ss on 160MHz */
2148                         if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2149                                       ra->bw == CMD_CBW_8080MHZ))
2150                                 break;
2151                 }
2152         }
2153
2154         if (sta->he_cap.has_he) {
2155                 ra->supp_mode |= MODE_HE;
2156                 cap |= STA_CAP_HE;
2157         }
2158
2159         ra->sta_status = cpu_to_le32(cap);
2160
2161         switch (BIT(fls(ra->supp_mode) - 1)) {
2162         case MODE_VHT:
2163                 ra->phy.type = MT_PHY_TYPE_VHT;
2164                 ra->phy.mcs = mcs;
2165                 ra->phy.nss = nss;
2166                 ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2167                 ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2168                 ra->phy.sgi =
2169                         !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2170                 break;
2171         case MODE_HT:
2172                 ra->phy.type = MT_PHY_TYPE_HT;
2173                 ra->phy.mcs = mcs;
2174                 ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2175                 ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2176                 ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2177                 break;
2178         default:
2179                 break;
2180         }
2181 }
2182
2183 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2184                              struct ieee80211_sta *sta)
2185 {
2186         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2187         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2188         struct sk_buff *skb;
2189         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2190
2191         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2192         if (IS_ERR(skb))
2193                 return PTR_ERR(skb);
2194
2195         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2196
2197         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2198                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2199 }
2200
2201 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2202                            struct ieee80211_sta *sta, bool enable)
2203 {
2204         int ret;
2205
2206         if (!sta)
2207                 return 0;
2208
2209         /* must keep the order */
2210         ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2211         if (ret)
2212                 return ret;
2213
2214         ret = mt7915_mcu_add_mu(dev, vif, sta);
2215         if (ret)
2216                 return ret;
2217
2218         if (enable)
2219                 return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2220
2221         return 0;
2222 }
2223
2224 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2225                        struct ieee80211_sta *sta, bool enable)
2226 {
2227         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2228         struct wtbl_req_hdr *wtbl_hdr;
2229         struct mt7915_sta *msta;
2230         struct tlv *sta_wtbl;
2231         struct sk_buff *skb;
2232
2233         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2234
2235         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2236                                        MT7915_STA_UPDATE_MAX_SIZE);
2237         if (IS_ERR(skb))
2238                 return PTR_ERR(skb);
2239
2240         mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2241         if (enable && sta)
2242                 mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2243
2244         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2245
2246         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2247                                              sta_wtbl, &skb);
2248         if (enable) {
2249                 mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2250                 mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2251                 if (sta)
2252                         mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2253         }
2254
2255         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2256                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2257 }
2258
2259 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2260                               struct ieee80211_sta *sta, u32 rate)
2261 {
2262         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2263         struct mt7915_vif *mvif = msta->vif;
2264         struct sta_rec_ra_fixed *ra;
2265         struct sk_buff *skb;
2266         struct tlv *tlv;
2267         int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2268
2269         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2270         if (IS_ERR(skb))
2271                 return PTR_ERR(skb);
2272
2273         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2274         ra = (struct sta_rec_ra_fixed *)tlv;
2275
2276         if (!rate) {
2277                 ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2278                 goto out;
2279         } else {
2280                 ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2281         }
2282
2283         ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2284         ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2285         ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2286         ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2287         ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2288
2289         if (ra->phy.bw)
2290                 ra->phy.ldpc = 7;
2291         else
2292                 ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2293
2294         /* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2295         if (ra->phy.type > MT_PHY_TYPE_VHT)
2296                 ra->phy.sgi = ra->phy.mcs * 85;
2297         else
2298                 ra->phy.sgi = ra->phy.mcs * 15;
2299
2300 out:
2301         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2302                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2303 }
2304
2305 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2306                             struct ieee80211_vif *vif, bool enable)
2307 {
2308         struct mt7915_dev *dev = phy->dev;
2309         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2310         struct {
2311                 struct req_hdr {
2312                         u8 omac_idx;
2313                         u8 dbdc_idx;
2314                         __le16 tlv_num;
2315                         u8 is_tlv_append;
2316                         u8 rsv[3];
2317                 } __packed hdr;
2318                 struct req_tlv {
2319                         __le16 tag;
2320                         __le16 len;
2321                         u8 active;
2322                         u8 dbdc_idx;
2323                         u8 omac_addr[ETH_ALEN];
2324                 } __packed tlv;
2325         } data = {
2326                 .hdr = {
2327                         .omac_idx = mvif->omac_idx,
2328                         .dbdc_idx = mvif->band_idx,
2329                         .tlv_num = cpu_to_le16(1),
2330                         .is_tlv_append = 1,
2331                 },
2332                 .tlv = {
2333                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
2334                         .len = cpu_to_le16(sizeof(struct req_tlv)),
2335                         .active = enable,
2336                         .dbdc_idx = mvif->band_idx,
2337                 },
2338         };
2339
2340         if (mvif->omac_idx >= REPEATER_BSSID_START)
2341                 return mt7915_mcu_muar_config(phy, vif, false, enable);
2342
2343         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2344         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
2345                                  &data, sizeof(data), true);
2346 }
2347
2348 static void
2349 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2350                       struct bss_info_bcn *bcn,
2351                       struct ieee80211_mutable_offsets *offs)
2352 {
2353         if (offs->cntdwn_counter_offs[0]) {
2354                 struct tlv *tlv;
2355                 struct bss_info_bcn_csa *csa;
2356
2357                 tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2358                                                    sizeof(*csa), &bcn->sub_ntlv,
2359                                                    &bcn->len);
2360                 csa = (struct bss_info_bcn_csa *)tlv;
2361                 csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2362         }
2363 }
2364
2365 static void
2366 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2367                        struct sk_buff *skb, struct bss_info_bcn *bcn,
2368                        struct ieee80211_mutable_offsets *offs)
2369 {
2370         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2371         struct bss_info_bcn_cont *cont;
2372         struct tlv *tlv;
2373         u8 *buf;
2374         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2375
2376         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2377                                            len, &bcn->sub_ntlv, &bcn->len);
2378
2379         cont = (struct bss_info_bcn_cont *)tlv;
2380         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2381         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2382
2383         if (offs->cntdwn_counter_offs[0])
2384                 cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2385
2386         buf = (u8 *)tlv + sizeof(*cont);
2387         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2388                               true);
2389         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2390 }
2391
2392 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2393                           struct ieee80211_vif *vif, int en)
2394 {
2395 #define MAX_BEACON_SIZE 512
2396         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2397         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2398         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2399         struct ieee80211_mutable_offsets offs;
2400         struct ieee80211_tx_info *info;
2401         struct sk_buff *skb, *rskb;
2402         struct tlv *tlv;
2403         struct bss_info_bcn *bcn;
2404         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2405
2406         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2407         if (!skb)
2408                 return -EINVAL;
2409
2410         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2411                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2412                 dev_kfree_skb(skb);
2413                 return -EINVAL;
2414         }
2415
2416         rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2417         if (IS_ERR(rskb)) {
2418                 dev_kfree_skb(skb);
2419                 return PTR_ERR(rskb);
2420         }
2421
2422         tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2423         bcn = (struct bss_info_bcn *)tlv;
2424         bcn->enable = en;
2425
2426         if (mvif->band_idx) {
2427                 info = IEEE80211_SKB_CB(skb);
2428                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2429         }
2430
2431         /* TODO: subtag - bss color count & 11v MBSSID */
2432         mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2433         mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2434         dev_kfree_skb(skb);
2435
2436         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2437                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
2438 }
2439
2440 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2441                                      u32 option)
2442 {
2443         struct {
2444                 __le32 option;
2445                 __le32 addr;
2446         } req = {
2447                 .option = cpu_to_le32(option),
2448                 .addr = cpu_to_le32(addr),
2449         };
2450
2451         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ, &req,
2452                                  sizeof(req), true);
2453 }
2454
2455 static int mt7915_mcu_restart(struct mt76_dev *dev)
2456 {
2457         struct {
2458                 u8 power_mode;
2459                 u8 rsv[3];
2460         } req = {
2461                 .power_mode = 1,
2462         };
2463
2464         return mt76_mcu_send_msg(dev, -MCU_CMD_NIC_POWER_CTRL, &req,
2465                                  sizeof(req), false);
2466 }
2467
2468 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2469 {
2470         struct {
2471                 __le32 op;
2472         } req = {
2473                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2474         };
2475
2476         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL, &req,
2477                                  sizeof(req), true);
2478 }
2479
2480 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2481 {
2482         struct {
2483                 u8 check_crc;
2484                 u8 reserved[3];
2485         } req = {
2486                 .check_crc = 0,
2487         };
2488
2489         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ, &req,
2490                                  sizeof(req), true);
2491 }
2492
2493 static int mt7915_driver_own(struct mt7915_dev *dev)
2494 {
2495         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2496
2497         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2498         if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2499                             0, 500)) {
2500                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2501                 return -EIO;
2502         }
2503
2504         return 0;
2505 }
2506
2507 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2508                                     u32 len, u32 mode)
2509 {
2510         struct {
2511                 __le32 addr;
2512                 __le32 len;
2513                 __le32 mode;
2514         } req = {
2515                 .addr = cpu_to_le32(addr),
2516                 .len = cpu_to_le32(len),
2517                 .mode = cpu_to_le32(mode),
2518         };
2519         int attr;
2520
2521         if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2522                 attr = -MCU_CMD_PATCH_START_REQ;
2523         else
2524                 attr = -MCU_CMD_TARGET_ADDRESS_LEN_REQ;
2525
2526         return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2527 }
2528
2529 static int mt7915_load_patch(struct mt7915_dev *dev)
2530 {
2531         const struct mt7915_patch_hdr *hdr;
2532         const struct firmware *fw = NULL;
2533         int i, ret, sem;
2534
2535         sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2536         switch (sem) {
2537         case PATCH_IS_DL:
2538                 return 0;
2539         case PATCH_NOT_DL_SEM_SUCCESS:
2540                 break;
2541         default:
2542                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2543                 return -EAGAIN;
2544         }
2545
2546         ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2547         if (ret)
2548                 goto out;
2549
2550         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2551                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2552                 ret = -EINVAL;
2553                 goto out;
2554         }
2555
2556         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2557
2558         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2559                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2560
2561         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2562                 struct mt7915_patch_sec *sec;
2563                 const u8 *dl;
2564                 u32 len, addr;
2565
2566                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2567                                                   i * sizeof(*sec));
2568                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2569                     PATCH_SEC_TYPE_INFO) {
2570                         ret = -EINVAL;
2571                         goto out;
2572                 }
2573
2574                 addr = be32_to_cpu(sec->info.addr);
2575                 len = be32_to_cpu(sec->info.len);
2576                 dl = fw->data + be32_to_cpu(sec->offs);
2577
2578                 ret = mt7915_mcu_init_download(dev, addr, len,
2579                                                DL_MODE_NEED_RSP);
2580                 if (ret) {
2581                         dev_err(dev->mt76.dev, "Download request failed\n");
2582                         goto out;
2583                 }
2584
2585                 ret = mt76_mcu_send_firmware(&dev->mt76, -MCU_CMD_FW_SCATTER,
2586                                              dl, len);
2587                 if (ret) {
2588                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2589                         goto out;
2590                 }
2591         }
2592
2593         ret = mt7915_mcu_start_patch(dev);
2594         if (ret)
2595                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2596
2597 out:
2598         sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2599         switch (sem) {
2600         case PATCH_REL_SEM_SUCCESS:
2601                 break;
2602         default:
2603                 ret = -EAGAIN;
2604                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2605                 goto out;
2606         }
2607         release_firmware(fw);
2608
2609         return ret;
2610 }
2611
2612 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2613 {
2614         u32 ret = 0;
2615
2616         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2617                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2618         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2619                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2620         ret |= DL_MODE_NEED_RSP;
2621         ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2622
2623         return ret;
2624 }
2625
2626 static int
2627 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2628                              const struct mt7915_fw_trailer *hdr,
2629                              const u8 *data, bool is_wa)
2630 {
2631         int i, offset = 0;
2632         u32 override = 0, option = 0;
2633
2634         for (i = 0; i < hdr->n_region; i++) {
2635                 const struct mt7915_fw_region *region;
2636                 int err;
2637                 u32 len, addr, mode;
2638
2639                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2640                          (hdr->n_region - i) * sizeof(*region));
2641                 mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2642                 len = le32_to_cpu(region->len);
2643                 addr = le32_to_cpu(region->addr);
2644
2645                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2646                         override = addr;
2647
2648                 err = mt7915_mcu_init_download(dev, addr, len, mode);
2649                 if (err) {
2650                         dev_err(dev->mt76.dev, "Download request failed\n");
2651                         return err;
2652                 }
2653
2654                 err = mt76_mcu_send_firmware(&dev->mt76, -MCU_CMD_FW_SCATTER,
2655                                              data + offset, len);
2656                 if (err) {
2657                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2658                         return err;
2659                 }
2660
2661                 offset += len;
2662         }
2663
2664         if (override)
2665                 option |= FW_START_OVERRIDE;
2666
2667         if (is_wa)
2668                 option |= FW_START_WORKING_PDA_CR4;
2669
2670         return mt7915_mcu_start_firmware(dev, override, option);
2671 }
2672
2673 static int mt7915_load_ram(struct mt7915_dev *dev)
2674 {
2675         const struct mt7915_fw_trailer *hdr;
2676         const struct firmware *fw;
2677         int ret;
2678
2679         ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2680         if (ret)
2681                 return ret;
2682
2683         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2684                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2685                 ret = -EINVAL;
2686                 goto out;
2687         }
2688
2689         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2690                                         sizeof(*hdr));
2691
2692         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2693                  hdr->fw_ver, hdr->build_date);
2694
2695         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2696         if (ret) {
2697                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2698                 goto out;
2699         }
2700
2701         release_firmware(fw);
2702
2703         ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2704         if (ret)
2705                 return ret;
2706
2707         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2708                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2709                 ret = -EINVAL;
2710                 goto out;
2711         }
2712
2713         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2714                                         sizeof(*hdr));
2715
2716         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2717                  hdr->fw_ver, hdr->build_date);
2718
2719         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2720         if (ret) {
2721                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2722                 goto out;
2723         }
2724
2725         snprintf(dev->mt76.hw->wiphy->fw_version,
2726                  sizeof(dev->mt76.hw->wiphy->fw_version),
2727                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2728
2729 out:
2730         release_firmware(fw);
2731
2732         return ret;
2733 }
2734
2735 static int mt7915_load_firmware(struct mt7915_dev *dev)
2736 {
2737         int ret;
2738         u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2739
2740         val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2741
2742         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2743                 /* restart firmware once */
2744                 __mt76_mcu_restart(&dev->mt76);
2745                 if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2746                                     val, 1000)) {
2747                         dev_err(dev->mt76.dev,
2748                                 "Firmware is not ready for download\n");
2749                         return -EIO;
2750                 }
2751         }
2752
2753         ret = mt7915_load_patch(dev);
2754         if (ret)
2755                 return ret;
2756
2757         ret = mt7915_load_ram(dev);
2758         if (ret)
2759                 return ret;
2760
2761         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2762                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2763                                        FW_STATE_WACPU_RDY), 1000)) {
2764                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2765                 return -EIO;
2766         }
2767
2768         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2769
2770         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2771
2772         return 0;
2773 }
2774
2775 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2776 {
2777         struct {
2778                 u8 ctrl_val;
2779                 u8 pad[3];
2780         } data = {
2781                 .ctrl_val = ctrl
2782         };
2783
2784         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
2785                                  sizeof(data), true);
2786 }
2787
2788 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2789 {
2790         struct {
2791                 u8 ver;
2792                 u8 pad;
2793                 __le16 len;
2794                 u8 level;
2795                 u8 rsv[3];
2796                 __le32 module_idx;
2797         } data = {
2798                 .module_idx = cpu_to_le32(module),
2799                 .level = level,
2800         };
2801
2802         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_DBG_CTRL, &data,
2803                                  sizeof(data), false);
2804 }
2805
2806 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2807 {
2808         struct {
2809                 u8 enable;
2810                 u8 _rsv[3];
2811         } __packed req = {
2812                 .enable = enabled
2813         };
2814
2815         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MWDS_SUPPORT, &req,
2816                                  sizeof(req), false);
2817 }
2818
2819 int mt7915_mcu_init(struct mt7915_dev *dev)
2820 {
2821         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2822                 .headroom = sizeof(struct mt7915_mcu_txd),
2823                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2824                 .mcu_parse_response = mt7915_mcu_parse_response,
2825                 .mcu_restart = mt7915_mcu_restart,
2826         };
2827         int ret;
2828
2829         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2830
2831         ret = mt7915_driver_own(dev);
2832         if (ret)
2833                 return ret;
2834
2835         ret = mt7915_load_firmware(dev);
2836         if (ret)
2837                 return ret;
2838
2839         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2840         mt7915_mcu_fw_log_2_host(dev, 0);
2841         mt7915_mcu_set_mwds(dev, 1);
2842
2843         return 0;
2844 }
2845
2846 void mt7915_mcu_exit(struct mt7915_dev *dev)
2847 {
2848         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2849
2850         __mt76_mcu_restart(&dev->mt76);
2851         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2852                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2853                                        FW_STATE_FW_DOWNLOAD), 1000)) {
2854                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2855                 return;
2856         }
2857
2858         reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2859         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2860         skb_queue_purge(&dev->mt76.mcu.res_q);
2861 }
2862
2863 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2864                        bool enable, bool hdr_trans)
2865 {
2866         struct {
2867                 u8 operation;
2868                 u8 enable;
2869                 u8 check_bssid;
2870                 u8 insert_vlan;
2871                 u8 remove_vlan;
2872                 u8 tid;
2873                 u8 mode;
2874                 u8 rsv;
2875         } __packed req_trans = {
2876                 .enable = hdr_trans,
2877         };
2878         struct {
2879                 u8 enable;
2880                 u8 band;
2881                 u8 rsv[2];
2882         } __packed req_mac = {
2883                 .enable = enable,
2884                 .band = band,
2885         };
2886         int ret;
2887
2888         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RX_HDR_TRANS,
2889                                 &req_trans, sizeof(req_trans), false);
2890         if (ret)
2891                 return ret;
2892
2893         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2894                                  &req_mac, sizeof(req_mac), true);
2895 }
2896
2897 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2898 {
2899         struct {
2900                 __le32 cmd;
2901                 u8 band;
2902                 u8 enable;
2903         } __packed req = {
2904                 .cmd = cpu_to_le32(SCS_ENABLE),
2905                 .band = band,
2906                 .enable = enable + 1,
2907         };
2908
2909         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SCS_CTRL, &req,
2910                                  sizeof(req), false);
2911 }
2912
2913 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2914 {
2915         struct mt7915_dev *dev = phy->dev;
2916         struct {
2917                 u8 prot_idx;
2918                 u8 band;
2919                 u8 rsv[2];
2920                 __le32 len_thresh;
2921                 __le32 pkt_thresh;
2922         } __packed req = {
2923                 .prot_idx = 1,
2924                 .band = phy != &dev->phy,
2925                 .len_thresh = cpu_to_le32(val),
2926                 .pkt_thresh = cpu_to_le32(0x2),
2927         };
2928
2929         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL, &req,
2930                                  sizeof(req), true);
2931 }
2932
2933 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2934 {
2935         struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2936         u8 num = req->total;
2937         size_t len = sizeof(*req) -
2938                      (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2939
2940         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, req,
2941                                  len, true);
2942 }
2943
2944 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2945 {
2946 #define TX_CMD_MODE             1
2947         struct mt7915_mcu_tx req = {
2948                 .valid = true,
2949                 .mode = TX_CMD_MODE,
2950                 .total = IEEE80211_NUM_ACS,
2951         };
2952         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2953         int ac;
2954
2955         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2956                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2957                 struct edca *e = &req.edca[ac];
2958
2959                 e->set = WMM_PARAM_SET;
2960                 e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
2961                 e->aifs = q->aifs;
2962                 e->txop = cpu_to_le16(q->txop);
2963
2964                 if (q->cw_min)
2965                         e->cw_min = fls(q->cw_min);
2966                 else
2967                         e->cw_min = 5;
2968
2969                 if (q->cw_max)
2970                         e->cw_max = cpu_to_le16(fls(q->cw_max));
2971                 else
2972                         e->cw_max = cpu_to_le16(10);
2973         }
2974
2975         return mt7915_mcu_update_edca(dev, &req);
2976 }
2977
2978 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
2979 {
2980 #define ENTER_PM_STATE          1
2981 #define EXIT_PM_STATE           2
2982         struct {
2983                 u8 pm_number;
2984                 u8 pm_state;
2985                 u8 bssid[ETH_ALEN];
2986                 u8 dtim_period;
2987                 u8 wlan_idx_lo;
2988                 __le16 bcn_interval;
2989                 __le32 aid;
2990                 __le32 rx_filter;
2991                 u8 band_idx;
2992                 u8 wlan_idx_hi;
2993                 u8 rsv[2];
2994                 __le32 feature;
2995                 u8 omac_idx;
2996                 u8 wmm_idx;
2997                 u8 bcn_loss_cnt;
2998                 u8 bcn_sp_duration;
2999         } __packed req = {
3000                 .pm_number = 5,
3001                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3002                 .band_idx = band,
3003         };
3004
3005         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
3006                                  sizeof(req), true);
3007 }
3008
3009 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3010                        enum mt7915_rdd_cmd cmd, u8 index,
3011                        u8 rx_sel, u8 val)
3012 {
3013         struct {
3014                 u8 ctrl;
3015                 u8 rdd_idx;
3016                 u8 rdd_rx_sel;
3017                 u8 val;
3018                 u8 rsv[4];
3019         } __packed req = {
3020                 .ctrl = cmd,
3021                 .rdd_idx = index,
3022                 .rdd_rx_sel = rx_sel,
3023                 .val = val,
3024         };
3025
3026         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
3027                                  sizeof(req), true);
3028 }
3029
3030 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3031 {
3032         struct {
3033                 __le32 tag;
3034                 __le16 min_lpn;
3035                 u8 rsv[2];
3036         } __packed req = {
3037                 .tag = cpu_to_le32(0x1),
3038                 .min_lpn = cpu_to_le16(val),
3039         };
3040
3041         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3042                                  sizeof(req), true);
3043 }
3044
3045 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3046                             const struct mt7915_dfs_pulse *pulse)
3047 {
3048         struct {
3049                 __le32 tag;
3050
3051                 __le32 max_width;               /* us */
3052                 __le32 max_pwr;                 /* dbm */
3053                 __le32 min_pwr;                 /* dbm */
3054                 __le32 min_stgr_pri;            /* us */
3055                 __le32 max_stgr_pri;            /* us */
3056                 __le32 min_cr_pri;              /* us */
3057                 __le32 max_cr_pri;              /* us */
3058         } __packed req = {
3059                 .tag = cpu_to_le32(0x3),
3060
3061 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3062                 __req_field(max_width),
3063                 __req_field(max_pwr),
3064                 __req_field(min_pwr),
3065                 __req_field(min_stgr_pri),
3066                 __req_field(max_stgr_pri),
3067                 __req_field(min_cr_pri),
3068                 __req_field(max_cr_pri),
3069 #undef __req_field
3070         };
3071
3072         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3073                                  sizeof(req), true);
3074 }
3075
3076 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3077                             const struct mt7915_dfs_pattern *pattern)
3078 {
3079         struct {
3080                 __le32 tag;
3081                 __le16 radar_type;
3082
3083                 u8 enb;
3084                 u8 stgr;
3085                 u8 min_crpn;
3086                 u8 max_crpn;
3087                 u8 min_crpr;
3088                 u8 min_pw;
3089                 __le32 min_pri;
3090                 __le32 max_pri;
3091                 u8 max_pw;
3092                 u8 min_crbn;
3093                 u8 max_crbn;
3094                 u8 min_stgpn;
3095                 u8 max_stgpn;
3096                 u8 min_stgpr;
3097                 u8 rsv[2];
3098                 __le32 min_stgpr_diff;
3099         } __packed req = {
3100                 .tag = cpu_to_le32(0x2),
3101                 .radar_type = cpu_to_le16(index),
3102
3103 #define __req_field_u8(field) .field = pattern->field
3104 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3105                 __req_field_u8(enb),
3106                 __req_field_u8(stgr),
3107                 __req_field_u8(min_crpn),
3108                 __req_field_u8(max_crpn),
3109                 __req_field_u8(min_crpr),
3110                 __req_field_u8(min_pw),
3111                 __req_field_u32(min_pri),
3112                 __req_field_u32(max_pri),
3113                 __req_field_u8(max_pw),
3114                 __req_field_u8(min_crbn),
3115                 __req_field_u8(max_crbn),
3116                 __req_field_u8(min_stgpn),
3117                 __req_field_u8(max_stgpn),
3118                 __req_field_u8(min_stgpr),
3119                 __req_field_u32(min_stgpr_diff),
3120 #undef __req_field_u8
3121 #undef __req_field_u32
3122         };
3123
3124         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3125                                  sizeof(req), true);
3126 }
3127
3128 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3129 {
3130         struct mt7915_dev *dev = phy->dev;
3131         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3132         int freq1 = chandef->center_freq1;
3133         bool ext_phy = phy != &dev->phy;
3134         struct {
3135                 u8 control_ch;
3136                 u8 center_ch;
3137                 u8 bw;
3138                 u8 tx_streams_num;
3139                 u8 rx_streams;  /* mask or num */
3140                 u8 switch_reason;
3141                 u8 band_idx;
3142                 u8 center_ch2;  /* for 80+80 only */
3143                 __le16 cac_case;
3144                 u8 channel_band;
3145                 u8 rsv0;
3146                 __le32 outband_freq;
3147                 u8 txpower_drop;
3148                 u8 ap_bw;
3149                 u8 ap_center_ch;
3150                 u8 rsv1[57];
3151         } __packed req = {
3152                 .control_ch = chandef->chan->hw_value,
3153                 .center_ch = ieee80211_frequency_to_channel(freq1),
3154                 .bw = mt7915_mcu_chan_bw(chandef),
3155                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
3156                 .rx_streams = phy->mt76->antenna_mask,
3157                 .band_idx = ext_phy,
3158                 .channel_band = chandef->chan->band,
3159         };
3160
3161 #ifdef CONFIG_NL80211_TESTMODE
3162         if (phy->mt76->test.tx_antenna_mask &&
3163             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3164              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3165              phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3166                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3167                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
3168
3169                 if (ext_phy) {
3170                         req.tx_streams_num = 2;
3171                         req.rx_streams >>= 2;
3172                 }
3173         }
3174 #endif
3175
3176         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3177                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3178         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3179                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3180                 req.switch_reason = CH_SWITCH_DFS;
3181         else
3182                 req.switch_reason = CH_SWITCH_NORMAL;
3183
3184         if (cmd == MCU_EXT_CMD_CHANNEL_SWITCH)
3185                 req.rx_streams = hweight8(req.rx_streams);
3186
3187         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3188                 int freq2 = chandef->center_freq2;
3189
3190                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3191         }
3192
3193         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3194 }
3195
3196 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3197 {
3198 #define TOTAL_PAGE_MASK         GENMASK(7, 5)
3199 #define PAGE_IDX_MASK           GENMASK(4, 2)
3200 #define PER_PAGE_SIZE           0x400
3201         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3202         u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;
3203         u8 *eep = (u8 *)dev->mt76.eeprom.data;
3204         int eep_len;
3205         int i;
3206
3207         for (i = 0; i <= total; i++, eep += eep_len) {
3208                 struct sk_buff *skb;
3209                 int ret;
3210
3211                 if (i == total)
3212                         eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3213                 else
3214                         eep_len = PER_PAGE_SIZE;
3215
3216                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3217                                          sizeof(req) + eep_len);
3218                 if (!skb)
3219                         return -ENOMEM;
3220
3221                 req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |
3222                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3223                 req.len = cpu_to_le16(eep_len);
3224
3225                 skb_put_data(skb, &req, sizeof(req));
3226                 skb_put_data(skb, eep, eep_len);
3227
3228                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3229                                             MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
3230                 if (ret)
3231                         return ret;
3232         }
3233
3234         return 0;
3235 }
3236
3237 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3238 {
3239         struct mt7915_mcu_eeprom req = {
3240                 .buffer_mode = EE_MODE_EFUSE,
3241                 .format = EE_FORMAT_WHOLE,
3242         };
3243
3244         if (dev->flash_mode)
3245                 return mt7915_mcu_set_eeprom_flash(dev);
3246
3247         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
3248                                  &req, sizeof(req), true);
3249 }
3250
3251 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3252 {
3253         struct mt7915_mcu_eeprom_info req = {
3254                 .addr = cpu_to_le32(round_down(offset, 16)),
3255         };
3256         struct mt7915_mcu_eeprom_info *res;
3257         struct sk_buff *skb;
3258         int ret;
3259         u8 *buf;
3260
3261         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_ACCESS, &req,
3262                                 sizeof(req), true, &skb);
3263         if (ret)
3264                 return ret;
3265
3266         res = (struct mt7915_mcu_eeprom_info *)skb->data;
3267         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3268         memcpy(buf, res->data, 16);
3269         dev_kfree_skb(skb);
3270
3271         return 0;
3272 }
3273
3274 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3275 {
3276         struct {
3277                 u8 ctrl_id;
3278                 u8 action;
3279                 u8 band;
3280                 u8 rsv[5];
3281         } req = {
3282                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3283                 .action = index,
3284         };
3285
3286         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_THERMAL_CTRL, &req,
3287                                  sizeof(req), true);
3288 }
3289
3290 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3291 {
3292         struct {
3293                 __le32 cmd;
3294                 __le16 wlan_idx;
3295                 __le16 ru_idx;
3296                 __le16 direction;
3297                 __le16 dump_group;
3298         } req = {
3299                 .cmd = cpu_to_le32(cmd),
3300                 .wlan_idx = cpu_to_le16(wlan_idx),
3301                 .dump_group = cpu_to_le16(1),
3302         };
3303
3304         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RATE_CTRL, &req,
3305                                  sizeof(req), false);
3306 }
3307
3308 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3309 {
3310         struct mt7915_dev *dev = phy->dev;
3311         struct mt76_phy *mphy = phy->mt76;
3312         struct ieee80211_hw *hw = mphy->hw;
3313         struct mt7915_sku_val {
3314                 u8 format_id;
3315                 u8 limit_type;
3316                 u8 dbdc_idx;
3317                 s8 val[MT7915_SKU_RATE_NUM];
3318         } __packed req = {
3319                 .format_id = 4,
3320                 .dbdc_idx = phy != &dev->phy,
3321         };
3322         int i;
3323         s8 *delta;
3324
3325         delta = dev->rate_power[mphy->chandef.chan->band];
3326         mphy->txpower_cur = hw->conf.power_level * 2 +
3327                             delta[MT7915_SKU_MAX_DELTA_IDX];
3328
3329         for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3330                 req.val[i] = hw->conf.power_level * 2 + delta[i];
3331
3332         return mt76_mcu_send_msg(&dev->mt76,
3333                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
3334                                  sizeof(req), true);
3335 }
3336
3337 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3338                               u8 en)
3339 {
3340         struct {
3341                 u8 test_mode_en;
3342                 u8 param_idx;
3343                 u8 _rsv[2];
3344
3345                 u8 enable;
3346                 u8 _rsv2[3];
3347
3348                 u8 pad[8];
3349         } __packed req = {
3350                 .test_mode_en = test_mode,
3351                 .param_idx = param,
3352                 .enable = en,
3353         };
3354
3355         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
3356                                  sizeof(req), false);
3357 }
3358
3359 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3360 {
3361         struct mt7915_dev *dev = phy->dev;
3362         struct mt7915_sku {
3363                 u8 format_id;
3364                 u8 sku_enable;
3365                 u8 dbdc_idx;
3366                 u8 rsv;
3367         } __packed req = {
3368                 .format_id = 0,
3369                 .dbdc_idx = phy != &dev->phy,
3370                 .sku_enable = enable,
3371         };
3372
3373         return mt76_mcu_send_msg(&dev->mt76,
3374                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
3375                                  sizeof(req), true);
3376 }
3377
3378 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3379 {
3380         struct {
3381                 u8 action;
3382                 u8 set;
3383                 u8 band;
3384                 u8 rsv;
3385         } req = {
3386                 .action = action,
3387                 .set = set,
3388                 .band = band,
3389         };
3390
3391         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SER_TRIGGER,
3392                                  &req, sizeof(req), false);
3393 }
3394
3395 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3396 {
3397 #define MT_BF_TYPE_UPDATE               20
3398         struct {
3399                 u8 action;
3400                 bool ebf;
3401                 bool ibf;
3402                 u8 rsv;
3403         } __packed req = {
3404                 .action = MT_BF_TYPE_UPDATE,
3405                 .ebf = true,
3406                 .ibf = dev->ibf,
3407         };
3408
3409         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION, &req,
3410                                  sizeof(req), true);
3411 }
3412
3413 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3414 {
3415 #define MT_BF_PROCESSING                4
3416         struct {
3417                 u8 action;
3418                 u8 snd_mode;
3419                 u8 sta_num;
3420                 u8 rsv;
3421                 u8 wlan_idx[4];
3422                 __le32 snd_period;      /* ms */
3423         } __packed req = {
3424                 .action = true,
3425                 .snd_mode = MT_BF_PROCESSING,
3426         };
3427
3428         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION, &req,
3429                                  sizeof(req), true);
3430 }
3431
3432 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3433                             bool enable)
3434 {
3435 #define MT_SPR_ENABLE           1
3436         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3437         struct {
3438                 u8 action;
3439                 u8 arg_num;
3440                 u8 band_idx;
3441                 u8 status;
3442                 u8 drop_tx_idx;
3443                 u8 sta_idx;     /* 256 sta */
3444                 u8 rsv[2];
3445                 __le32 val;
3446         } __packed req = {
3447                 .action = MT_SPR_ENABLE,
3448                 .arg_num = 1,
3449                 .band_idx = mvif->band_idx,
3450                 .val = cpu_to_le32(enable),
3451         };
3452
3453         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SPR, &req,
3454                                  sizeof(req), true);
3455 }
3456
3457 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3458                            struct ieee80211_sta *sta, struct rate_info *rate)
3459 {
3460         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3461         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3462         struct mt7915_dev *dev = phy->dev;
3463         struct mt76_phy *mphy = phy->mt76;
3464         struct {
3465                 u8 category;
3466                 u8 band;
3467                 __le16 wcid;
3468         } __packed req = {
3469                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3470                 .band = mvif->band_idx,
3471                 .wcid = cpu_to_le16(msta->wcid.idx),
3472         };
3473         struct ieee80211_supported_band *sband;
3474         struct mt7915_mcu_phy_rx_info *res;
3475         struct sk_buff *skb;
3476         u16 flags = 0;
3477         int ret;
3478         int i;
3479
3480         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD_PHY_STAT_INFO,
3481                                         &req, sizeof(req), true, &skb);
3482         if (ret)
3483                 return ret;
3484
3485         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3486
3487         rate->mcs = res->rate;
3488         rate->nss = res->nsts + 1;
3489
3490         switch (res->mode) {
3491         case MT_PHY_TYPE_CCK:
3492         case MT_PHY_TYPE_OFDM:
3493                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3494                         sband = &mphy->sband_5g.sband;
3495                 else
3496                         sband = &mphy->sband_2g.sband;
3497
3498                 for (i = 0; i < sband->n_bitrates; i++) {
3499                         if (rate->mcs != (sband->bitrates[i].hw_value & 0xf))
3500                                 continue;
3501
3502                         rate->legacy = sband->bitrates[i].bitrate;
3503                         break;
3504                 }
3505                 break;
3506         case MT_PHY_TYPE_HT:
3507         case MT_PHY_TYPE_HT_GF:
3508                 if (rate->mcs > 31)
3509                         return -EINVAL;
3510
3511                 flags |= RATE_INFO_FLAGS_MCS;
3512
3513                 if (res->gi)
3514                         flags |= RATE_INFO_FLAGS_SHORT_GI;
3515                 break;
3516         case MT_PHY_TYPE_VHT:
3517                 flags |= RATE_INFO_FLAGS_VHT_MCS;
3518
3519                 if (res->gi)
3520                         flags |= RATE_INFO_FLAGS_SHORT_GI;
3521                 break;
3522         case MT_PHY_TYPE_HE_SU:
3523         case MT_PHY_TYPE_HE_EXT_SU:
3524         case MT_PHY_TYPE_HE_TB:
3525         case MT_PHY_TYPE_HE_MU:
3526                 rate->he_gi = res->gi;
3527
3528                 flags |= RATE_INFO_FLAGS_HE_MCS;
3529                 break;
3530         default:
3531                 break;
3532         }
3533         rate->flags = flags;
3534
3535         switch (res->bw) {
3536         case IEEE80211_STA_RX_BW_160:
3537                 rate->bw = RATE_INFO_BW_160;
3538                 break;
3539         case IEEE80211_STA_RX_BW_80:
3540                 rate->bw = RATE_INFO_BW_80;
3541                 break;
3542         case IEEE80211_STA_RX_BW_40:
3543                 rate->bw = RATE_INFO_BW_40;
3544                 break;
3545         default:
3546                 rate->bw = RATE_INFO_BW_20;
3547                 break;
3548         }
3549
3550         dev_kfree_skb(skb);
3551
3552         return 0;
3553 }