drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MCU_PATCH_ADDRESS               0x200000
  68
  69 #define MT_STA_BFER                     BIT(0)
  70 #define MT_STA_BFEE                     BIT(1)
  71
  72 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  73 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  74 #define FW_FEATURE_OVERRIDE_ADDR        BIT(5)
  75
  76 #define DL_MODE_ENCRYPT                 BIT(0)
  77 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  78 #define DL_MODE_RESET_SEC_IV            BIT(3)
  79 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  80 #define DL_MODE_NEED_RSP                BIT(31)
  81
  82 #define FW_START_OVERRIDE               BIT(0)
  83 #define FW_START_WORKING_PDA_CR4        BIT(2)
  84
  85 #define PATCH_SEC_TYPE_MASK             GENMASK(15, 0)
  86 #define PATCH_SEC_TYPE_INFO             0x2
  87
  88 #define to_wcid_lo(id)                  FIELD_GET(GENMASK(7, 0), (u16)id)
  89 #define to_wcid_hi(id)                  FIELD_GET(GENMASK(9, 8), (u16)id)
  90
  91 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  92 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  93
  94 static enum mt7915_cipher_type
  95 mt7915_mcu_get_cipher(int cipher)
  96 {
  97         switch (cipher) {
  98         case WLAN_CIPHER_SUITE_WEP40:
  99                 return MT_CIPHER_WEP40;
 100         case WLAN_CIPHER_SUITE_WEP104:
 101                 return MT_CIPHER_WEP104;
 102         case WLAN_CIPHER_SUITE_TKIP:
 103                 return MT_CIPHER_TKIP;
 104         case WLAN_CIPHER_SUITE_AES_CMAC:
 105                 return MT_CIPHER_BIP_CMAC_128;
 106         case WLAN_CIPHER_SUITE_CCMP:
 107                 return MT_CIPHER_AES_CCMP;
 108         case WLAN_CIPHER_SUITE_CCMP_256:
 109                 return MT_CIPHER_CCMP_256;
 110         case WLAN_CIPHER_SUITE_GCMP:
 111                 return MT_CIPHER_GCMP;
 112         case WLAN_CIPHER_SUITE_GCMP_256:
 113                 return MT_CIPHER_GCMP_256;
 114         case WLAN_CIPHER_SUITE_SMS4:
 115                 return MT_CIPHER_WAPI;
 116         default:
 117                 return MT_CIPHER_NONE;
 118         }
 119 }
 120
 121 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
 122 {
 123         static const u8 width_to_bw[] = {
 124                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
 125                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
 126                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
 127                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
 128                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
 129                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
 130                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
 131                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
 132         };
 133
 134         if (chandef->width >= ARRAY_SIZE(width_to_bw))
 135                 return 0;
 136
 137         return width_to_bw[chandef->width];
 138 }
 139
 140 static const struct ieee80211_sta_he_cap *
 141 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
 142 {
 143         struct ieee80211_supported_band *sband;
 144         enum nl80211_band band;
 145
 146         band = phy->mt76->chandef.chan->band;
 147         sband = phy->mt76->hw->wiphy->bands[band];
 148
 149         return ieee80211_get_he_iftype_cap(sband, vif->type);
 150 }
 151
 152 static u8
 153 mt7915_get_phy_mode(struct mt7915_dev *dev, struct ieee80211_vif *vif,
 154                     enum nl80211_band band, struct ieee80211_sta *sta)
 155 {
 156         struct ieee80211_sta_ht_cap *ht_cap;
 157         struct ieee80211_sta_vht_cap *vht_cap;
 158         const struct ieee80211_sta_he_cap *he_cap;
 159         u8 mode = 0;
 160
 161         if (sta) {
 162                 ht_cap = &sta->ht_cap;
 163                 vht_cap = &sta->vht_cap;
 164                 he_cap = &sta->he_cap;
 165         } else {
 166                 struct ieee80211_supported_band *sband;
 167                 struct mt7915_phy *phy;
 168                 struct mt7915_vif *mvif;
 169
 170                 mvif = (struct mt7915_vif *)vif->drv_priv;
 171                 phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
 172                 sband = phy->mt76->hw->wiphy->bands[band];
 173
 174                 ht_cap = &sband->ht_cap;
 175                 vht_cap = &sband->vht_cap;
 176                 he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
 177         }
 178
 179         if (band == NL80211_BAND_2GHZ) {
 180                 mode |= PHY_MODE_B | PHY_MODE_G;
 181
 182                 if (ht_cap->ht_supported)
 183                         mode |= PHY_MODE_GN;
 184
 185                 if (he_cap->has_he)
 186                         mode |= PHY_MODE_AX_24G;
 187         } else if (band == NL80211_BAND_5GHZ) {
 188                 mode |= PHY_MODE_A;
 189
 190                 if (ht_cap->ht_supported)
 191                         mode |= PHY_MODE_AN;
 192
 193                 if (vht_cap->vht_supported)
 194                         mode |= PHY_MODE_AC;
 195
 196                 if (he_cap->has_he)
 197                         mode |= PHY_MODE_AX_5G;
 198         }
 199
 200         return mode;
 201 }
 202
 203 static u8
 204 mt7915_mcu_get_sta_nss(u16 mcs_map)
 205 {
 206         u8 nss;
 207
 208         for (nss = 8; nss > 0; nss--) {
 209                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
 210
 211                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 212                         break;
 213         }
 214
 215         return nss - 1;
 216 }
 217
 218 static int
 219 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 220                           struct sk_buff *skb, int seq)
 221 {
 222         struct mt7915_mcu_rxd *rxd;
 223         int ret = 0;
 224
 225         if (!skb) {
 226                 dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
 227                         cmd, seq);
 228                 return -ETIMEDOUT;
 229         }
 230
 231         rxd = (struct mt7915_mcu_rxd *)skb->data;
 232         if (seq != rxd->seq)
 233                 return -EAGAIN;
 234
 235         switch (cmd) {
 236         case -MCU_CMD_PATCH_SEM_CONTROL:
 237                 skb_pull(skb, sizeof(*rxd) - 4);
 238                 ret = *skb->data;
 239                 break;
 240         case MCU_EXT_CMD_THERMAL_CTRL:
 241                 skb_pull(skb, sizeof(*rxd) + 4);
 242                 ret = le32_to_cpu(*(__le32 *)skb->data);
 243                 break;
 244         default:
 245                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 246                 break;
 247         }
 248
 249         return ret;
 250 }
 251
 252 static int
 253 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 254                         int cmd, int *wait_seq)
 255 {
 256         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 257         struct mt7915_mcu_txd *mcu_txd;
 258         enum mt76_txq_id txq;
 259         __le32 *txd;
 260         u32 val;
 261         u8 seq;
 262
 263         /* TODO: make dynamic based on msg type */
 264         mdev->mcu.timeout = 20 * HZ;
 265
 266         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 267         if (!seq)
 268                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 269
 270         if (cmd == -MCU_CMD_FW_SCATTER) {
 271                 txq = MT_MCUQ_FWDL;
 272                 goto exit;
 273         }
 274
 275         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 276         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 277                 txq = MT_MCUQ_WA;
 278         else
 279                 txq = MT_MCUQ_WM;
 280
 281         txd = mcu_txd->txd;
 282
 283         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 284               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 285               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 286         txd[0] = cpu_to_le32(val);
 287
 288         val = MT_TXD1_LONG_FORMAT |
 289               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 290         txd[1] = cpu_to_le32(val);
 291
 292         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 293         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 294                                                MT_TX_MCU_PORT_RX_Q0));
 295         mcu_txd->pkt_type = MCU_PKT_ID;
 296         mcu_txd->seq = seq;
 297
 298         if (cmd < 0) {
 299                 mcu_txd->set_query = MCU_Q_NA;
 300                 mcu_txd->cid = -cmd;
 301         } else {
 302                 mcu_txd->cid = MCU_CMD_EXT_CID;
 303                 mcu_txd->ext_cid = cmd;
 304                 mcu_txd->ext_cid_ack = 1;
 305
 306                 /* do not use Q_SET for efuse */
 307                 if (cmd == MCU_EXT_CMD_EFUSE_ACCESS)
 308                         mcu_txd->set_query = MCU_Q_QUERY;
 309                 else
 310                         mcu_txd->set_query = MCU_Q_SET;
 311         }
 312
 313         if (cmd == MCU_EXT_CMD_MWDS_SUPPORT)
 314                 mcu_txd->s2d_index = MCU_S2D_H2C;
 315         else
 316                 mcu_txd->s2d_index = MCU_S2D_H2N;
 317         WARN_ON(cmd == MCU_EXT_CMD_EFUSE_ACCESS &&
 318                 mcu_txd->set_query != MCU_Q_QUERY);
 319
 320 exit:
 321         if (wait_seq)
 322                 *wait_seq = seq;
 323
 324         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[txq], skb, 0);
 325 }
 326
 327 static void
 328 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 329 {
 330         if (vif->csa_active)
 331                 ieee80211_csa_finish(vif);
 332 }
 333
 334 static void
 335 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 336 {
 337         struct mt76_phy *mphy = &dev->mt76.phy;
 338         struct mt7915_mcu_rdd_report *r;
 339
 340         r = (struct mt7915_mcu_rdd_report *)skb->data;
 341
 342         if (r->idx && dev->mt76.phy2)
 343                 mphy = dev->mt76.phy2;
 344
 345         ieee80211_radar_detected(mphy->hw);
 346         dev->hw_pattern++;
 347 }
 348
 349 static void
 350 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
 351                          struct rate_info *rate, u16 r)
 352 {
 353         struct ieee80211_supported_band *sband;
 354         u16 ru_idx = le16_to_cpu(ra->ru_idx);
 355         u16 flags = 0;
 356
 357         rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
 358         rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
 359
 360         switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
 361         case MT_PHY_TYPE_CCK:
 362         case MT_PHY_TYPE_OFDM:
 363                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
 364                         sband = &mphy->sband_5g.sband;
 365                 else
 366                         sband = &mphy->sband_2g.sband;
 367
 368                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
 369                 break;
 370         case MT_PHY_TYPE_HT:
 371         case MT_PHY_TYPE_HT_GF:
 372                 rate->mcs += (rate->nss - 1) * 8;
 373                 flags |= RATE_INFO_FLAGS_MCS;
 374
 375                 if (ra->gi)
 376                         flags |= RATE_INFO_FLAGS_SHORT_GI;
 377                 break;
 378         case MT_PHY_TYPE_VHT:
 379                 flags |= RATE_INFO_FLAGS_VHT_MCS;
 380
 381                 if (ra->gi)
 382                         flags |= RATE_INFO_FLAGS_SHORT_GI;
 383                 break;
 384         case MT_PHY_TYPE_HE_SU:
 385         case MT_PHY_TYPE_HE_EXT_SU:
 386         case MT_PHY_TYPE_HE_TB:
 387         case MT_PHY_TYPE_HE_MU:
 388                 rate->he_gi = ra->gi;
 389                 rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
 390
 391                 flags |= RATE_INFO_FLAGS_HE_MCS;
 392                 break;
 393         default:
 394                 break;
 395         }
 396         rate->flags = flags;
 397
 398         if (ru_idx) {
 399                 switch (ru_idx) {
 400                 case 1 ... 2:
 401                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
 402                         break;
 403                 case 3 ... 6:
 404                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
 405                         break;
 406                 case 7 ... 14:
 407                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
 408                         break;
 409                 default:
 410                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
 411                         break;
 412                 }
 413                 rate->bw = RATE_INFO_BW_HE_RU;
 414         } else {
 415                 u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
 416                         FIELD_GET(MT_RA_RATE_BW, r);
 417
 418                 switch (bw) {
 419                 case IEEE80211_STA_RX_BW_160:
 420                         rate->bw = RATE_INFO_BW_160;
 421                         break;
 422                 case IEEE80211_STA_RX_BW_80:
 423                         rate->bw = RATE_INFO_BW_80;
 424                         break;
 425                 case IEEE80211_STA_RX_BW_40:
 426                         rate->bw = RATE_INFO_BW_40;
 427                         break;
 428                 default:
 429                         rate->bw = RATE_INFO_BW_20;
 430                         break;
 431                 }
 432         }
 433 }
 434
 435 static void
 436 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
 437 {
 438         struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
 439         struct rate_info rate = {}, prob_rate = {};
 440         u16 probe = le16_to_cpu(ra->prob_up_rate);
 441         u16 attempts = le16_to_cpu(ra->attempts);
 442         u16 curr = le16_to_cpu(ra->curr_rate);
 443         u16 wcidx = le16_to_cpu(ra->wlan_idx);
 444         struct mt76_phy *mphy = &dev->mphy;
 445         struct mt7915_sta_stats *stats;
 446         struct mt7915_sta *msta;
 447         struct mt76_wcid *wcid;
 448
 449         if (wcidx >= MT76_N_WCIDS)
 450                 return;
 451
 452         wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
 453         if (!wcid)
 454                 return;
 455
 456         msta = container_of(wcid, struct mt7915_sta, wcid);
 457         stats = &msta->stats;
 458
 459         if (msta->wcid.ext_phy && dev->mt76.phy2)
 460                 mphy = dev->mt76.phy2;
 461
 462         /* current rate */
 463         mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr);
 464         stats->tx_rate = rate;
 465
 466         /* probing rate */
 467         mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe);
 468         stats->prob_rate = prob_rate;
 469
 470         if (attempts) {
 471                 u16 success = le16_to_cpu(ra->success);
 472
 473                 stats->per = 1000 * (attempts - success) / attempts;
 474         }
 475 }
 476
 477 static void
 478 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 479 {
 480         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 481         const char *data = (char *)&rxd[1];
 482         const char *type;
 483
 484         switch (rxd->s2d_index) {
 485         case 0:
 486                 type = "WM";
 487                 break;
 488         case 2:
 489                 type = "WA";
 490                 break;
 491         default:
 492                 type = "unknown";
 493                 break;
 494         }
 495
 496         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 497 }
 498
 499 static void
 500 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 501 {
 502         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 503
 504         switch (rxd->ext_eid) {
 505         case MCU_EXT_EVENT_RDD_REPORT:
 506                 mt7915_mcu_rx_radar_detected(dev, skb);
 507                 break;
 508         case MCU_EXT_EVENT_CSA_NOTIFY:
 509                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 510                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 511                                 mt7915_mcu_csa_finish, dev);
 512                 break;
 513         case MCU_EXT_EVENT_RATE_REPORT:
 514                 mt7915_mcu_tx_rate_report(dev, skb);
 515                 break;
 516         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 517                 mt7915_mcu_rx_log_message(dev, skb);
 518                 break;
 519         default:
 520                 break;
 521         }
 522 }
 523
 524 static void
 525 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 526 {
 527         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 528
 529         switch (rxd->eid) {
 530         case MCU_EVENT_EXT:
 531                 mt7915_mcu_rx_ext_event(dev, skb);
 532                 break;
 533         default:
 534                 break;
 535         }
 536         dev_kfree_skb(skb);
 537 }
 538
 539 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 540 {
 541         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 542
 543         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 544             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 545             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 546             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 547             rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 548             !rxd->seq)
 549                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 550         else
 551                 mt76_mcu_rx_event(&dev->mt76, skb);
 552 }
 553
 554 static struct sk_buff *
 555 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
 556                          struct mt7915_sta *msta, int len)
 557 {
 558         struct sta_req_hdr hdr = {
 559                 .bss_idx = mvif->idx,
 560                 .wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
 561                 .wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
 562                 .muar_idx = msta ? mvif->omac_idx : 0,
 563                 .is_tlv_append = 1,
 564         };
 565         struct sk_buff *skb;
 566
 567         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
 568         if (!skb)
 569                 return ERR_PTR(-ENOMEM);
 570
 571         skb_put_data(skb, &hdr, sizeof(hdr));
 572
 573         return skb;
 574 }
 575
 576 static struct wtbl_req_hdr *
 577 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
 578                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 579 {
 580         struct tlv *sta_hdr = sta_wtbl;
 581         struct wtbl_req_hdr hdr = {
 582                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
 583                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
 584                 .operation = cmd,
 585         };
 586         struct sk_buff *nskb = *skb;
 587
 588         if (!nskb) {
 589                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 590                                           MT7915_WTBL_UPDATE_BA_SIZE);
 591                 if (!nskb)
 592                         return ERR_PTR(-ENOMEM);
 593
 594                 *skb = nskb;
 595         }
 596
 597         if (sta_hdr)
 598                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 599
 600         return skb_put_data(nskb, &hdr, sizeof(hdr));
 601 }
 602
 603 static struct tlv *
 604 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 605                           void *sta_ntlv, void *sta_wtbl)
 606 {
 607         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 608         struct tlv *sta_hdr = sta_wtbl;
 609         struct tlv *ptlv, tlv = {
 610                 .tag = cpu_to_le16(tag),
 611                 .len = cpu_to_le16(len),
 612         };
 613         u16 ntlv;
 614
 615         ptlv = skb_put(skb, len);
 616         memcpy(ptlv, &tlv, sizeof(tlv));
 617
 618         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 619         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 620
 621         if (sta_hdr) {
 622                 u16 size = le16_to_cpu(sta_hdr->len);
 623
 624                 sta_hdr->len = cpu_to_le16(size + len);
 625         }
 626
 627         return ptlv;
 628 }
 629
 630 static struct tlv *
 631 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 632 {
 633         return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 634 }
 635
 636 static struct tlv *
 637 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 638                              __le16 *sub_ntlv, __le16 *len)
 639 {
 640         struct tlv *ptlv, tlv = {
 641                 .tag = cpu_to_le16(sub_tag),
 642                 .len = cpu_to_le16(sub_len),
 643         };
 644
 645         ptlv = skb_put(skb, sub_len);
 646         memcpy(ptlv, &tlv, sizeof(tlv));
 647
 648         le16_add_cpu(sub_ntlv, 1);
 649         le16_add_cpu(len, sub_len);
 650
 651         return ptlv;
 652 }
 653
 654 /** bss info **/
 655 static int
 656 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 657                          struct mt7915_phy *phy, bool enable)
 658 {
 659         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 660         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 661         enum nl80211_band band = chandef->chan->band;
 662         struct bss_info_basic *bss;
 663         u16 wlan_idx = mvif->sta.wcid.idx;
 664         u32 type = NETWORK_INFRA;
 665         struct tlv *tlv;
 666
 667         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 668
 669         switch (vif->type) {
 670         case NL80211_IFTYPE_MESH_POINT:
 671         case NL80211_IFTYPE_AP:
 672         case NL80211_IFTYPE_MONITOR:
 673                 break;
 674         case NL80211_IFTYPE_STATION:
 675                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 676                 if (enable) {
 677                         struct ieee80211_sta *sta;
 678                         struct mt7915_sta *msta;
 679
 680                         rcu_read_lock();
 681                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 682                         if (!sta) {
 683                                 rcu_read_unlock();
 684                                 return -EINVAL;
 685                         }
 686
 687                         msta = (struct mt7915_sta *)sta->drv_priv;
 688                         wlan_idx = msta->wcid.idx;
 689                         rcu_read_unlock();
 690                 }
 691                 break;
 692         case NL80211_IFTYPE_ADHOC:
 693                 type = NETWORK_IBSS;
 694                 break;
 695         default:
 696                 WARN_ON(1);
 697                 break;
 698         }
 699
 700         bss = (struct bss_info_basic *)tlv;
 701         bss->network_type = cpu_to_le32(type);
 702         bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
 703         bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
 704         bss->wmm_idx = mvif->wmm_idx;
 705         bss->active = enable;
 706
 707         if (vif->type != NL80211_IFTYPE_MONITOR) {
 708                 memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 709                 bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 710                 bss->dtim_period = vif->bss_conf.dtim_period;
 711                 bss->phy_mode = mt7915_get_phy_mode(phy->dev, vif, band, NULL);
 712         } else {
 713                 memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
 714         }
 715
 716         return 0;
 717 }
 718
 719 static void
 720 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 721 {
 722         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 723         struct bss_info_omac *omac;
 724         struct tlv *tlv;
 725         u32 type = 0;
 726         u8 idx;
 727
 728         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 729
 730         switch (vif->type) {
 731         case NL80211_IFTYPE_MONITOR:
 732         case NL80211_IFTYPE_MESH_POINT:
 733         case NL80211_IFTYPE_AP:
 734                 type = CONNECTION_INFRA_AP;
 735                 break;
 736         case NL80211_IFTYPE_STATION:
 737                 type = CONNECTION_INFRA_STA;
 738                 break;
 739         case NL80211_IFTYPE_ADHOC:
 740                 type = CONNECTION_IBSS_ADHOC;
 741                 break;
 742         default:
 743                 WARN_ON(1);
 744                 break;
 745         }
 746
 747         omac = (struct bss_info_omac *)tlv;
 748         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 749         omac->conn_type = cpu_to_le32(type);
 750         omac->omac_idx = mvif->omac_idx;
 751         omac->band_idx = mvif->band_idx;
 752         omac->hw_bss_idx = idx;
 753 }
 754
 755 struct mt7915_he_obss_narrow_bw_ru_data {
 756         bool tolerated;
 757 };
 758
 759 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 760                                                    struct cfg80211_bss *bss,
 761                                                    void *_data)
 762 {
 763         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 764         const struct element *elem;
 765
 766         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 767
 768         if (!elem || elem->datalen < 10 ||
 769             !(elem->data[10] &
 770               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 771                 data->tolerated = false;
 772 }
 773
 774 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 775                                               struct ieee80211_vif *vif)
 776 {
 777         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 778                 .tolerated = true,
 779         };
 780
 781         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 782                 return false;
 783
 784         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 785                           mt7915_check_he_obss_narrow_bw_ru_iter,
 786                           &iter_data);
 787
 788         /*
 789          * If there is at least one AP on radar channel that cannot
 790          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 791          */
 792         return !iter_data.tolerated;
 793 }
 794
 795 static void
 796 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 797                         struct mt7915_phy *phy)
 798 {
 799         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 800         struct bss_info_rf_ch *ch;
 801         struct tlv *tlv;
 802         int freq1 = chandef->center_freq1;
 803
 804         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 805
 806         ch = (struct bss_info_rf_ch *)tlv;
 807         ch->pri_ch = chandef->chan->hw_value;
 808         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 809         ch->bw = mt7915_mcu_chan_bw(chandef);
 810
 811         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 812                 int freq2 = chandef->center_freq2;
 813
 814                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 815         }
 816
 817         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 818                 struct mt7915_dev *dev = phy->dev;
 819                 struct mt76_phy *mphy = &dev->mt76.phy;
 820                 bool ext_phy = phy != &dev->phy;
 821
 822                 if (ext_phy && dev->mt76.phy2)
 823                         mphy = dev->mt76.phy2;
 824
 825                 ch->he_ru26_block =
 826                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 827                 ch->he_all_disable = false;
 828         } else {
 829                 ch->he_all_disable = true;
 830         }
 831 }
 832
 833 static void
 834 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 835                       struct mt7915_phy *phy)
 836 {
 837         struct bss_info_ra *ra;
 838         struct tlv *tlv;
 839         int max_nss = hweight8(phy->chainmask);
 840
 841         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 842
 843         ra = (struct bss_info_ra *)tlv;
 844         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 845         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 846         ra->short_preamble = true;
 847         ra->tx_streams = max_nss;
 848         ra->rx_streams = max_nss;
 849         ra->algo = 4;
 850         ra->train_up_rule = 2;
 851         ra->train_up_high_thres = 110;
 852         ra->train_up_rule_rssi = -70;
 853         ra->low_traffic_thres = 2;
 854         ra->phy_cap = cpu_to_le32(0xfdf);
 855         ra->interval = cpu_to_le32(500);
 856         ra->fast_interval = cpu_to_le32(100);
 857 }
 858
 859 static void
 860 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 861                       struct mt7915_phy *phy)
 862 {
 863 #define DEFAULT_HE_PE_DURATION          4
 864 #define DEFAULT_HE_DURATION_RTS_THRES   1023
 865         const struct ieee80211_sta_he_cap *cap;
 866         struct bss_info_he *he;
 867         struct tlv *tlv;
 868
 869         cap = mt7915_get_he_phy_cap(phy, vif);
 870
 871         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 872
 873         he = (struct bss_info_he *)tlv;
 874         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
 875         if (!he->he_pe_duration)
 876                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 877
 878         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
 879         if (!he->he_rts_thres)
 880                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 881
 882         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 883         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 884         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 885 }
 886
 887 static void
 888 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
 889 {
 890 #define TXD_CMP_MAP1            GENMASK(15, 0)
 891 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
 892         struct bss_info_hw_amsdu *amsdu;
 893         struct tlv *tlv;
 894
 895         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
 896
 897         amsdu = (struct bss_info_hw_amsdu *)tlv;
 898         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
 899         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
 900         amsdu->trig_thres = cpu_to_le16(2);
 901         amsdu->enable = true;
 902 }
 903
 904 static void
 905 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
 906 {
 907 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 908 #define BCN_TX_ESTIMATE_TIME    (4096 + 20)
 909         struct bss_info_ext_bss *ext;
 910         int ext_bss_idx, tsf_offset;
 911         struct tlv *tlv;
 912
 913         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 914         if (ext_bss_idx < 0)
 915                 return;
 916
 917         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 918
 919         ext = (struct bss_info_ext_bss *)tlv;
 920         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 921         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 922 }
 923
 924 static void
 925 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
 926 {
 927         struct bss_info_bmc_rate *bmc;
 928         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 929         enum nl80211_band band = chandef->chan->band;
 930         struct tlv *tlv;
 931
 932         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
 933
 934         bmc = (struct bss_info_bmc_rate *)tlv;
 935         if (band == NL80211_BAND_2GHZ) {
 936                 bmc->short_preamble = true;
 937         } else {
 938                 bmc->bc_trans = cpu_to_le16(0x2000);
 939                 bmc->mc_trans = cpu_to_le16(0x2080);
 940         }
 941 }
 942
 943 static int
 944 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
 945                        bool bssid, bool enable)
 946 {
 947         struct mt7915_dev *dev = phy->dev;
 948         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 949         u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
 950         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
 951         const u8 *addr = vif->addr;
 952         struct {
 953                 u8 mode;
 954                 u8 force_clear;
 955                 u8 clear_bitmap[8];
 956                 u8 entry_count;
 957                 u8 write;
 958                 u8 band;
 959
 960                 u8 index;
 961                 u8 bssid;
 962                 u8 addr[ETH_ALEN];
 963         } __packed req = {
 964                 .mode = !!mask || enable,
 965                 .entry_count = 1,
 966                 .write = 1,
 967                 .band = phy != &dev->phy,
 968                 .index = idx * 2 + bssid,
 969         };
 970
 971         if (bssid)
 972                 addr = vif->bss_conf.bssid;
 973
 974         if (enable)
 975                 ether_addr_copy(req.addr, addr);
 976
 977         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MUAR_UPDATE, &req,
 978                                  sizeof(req), true);
 979 }
 980
 981 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
 982                             struct ieee80211_vif *vif, int enable)
 983 {
 984         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 985         struct sk_buff *skb;
 986
 987         if (mvif->omac_idx >= REPEATER_BSSID_START)
 988                 mt7915_mcu_muar_config(phy, vif, true, enable);
 989
 990         skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
 991                                        MT7915_BSS_UPDATE_MAX_SIZE);
 992         if (IS_ERR(skb))
 993                 return PTR_ERR(skb);
 994
 995         /* bss_omac must be first */
 996         if (enable)
 997                 mt7915_mcu_bss_omac_tlv(skb, vif);
 998
 999         mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1000
1001         if (vif->type == NL80211_IFTYPE_MONITOR)
1002                 goto out;
1003
1004         if (enable) {
1005                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1006                 mt7915_mcu_bss_bmc_tlv(skb, phy);
1007                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1008                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
1009
1010                 if (vif->bss_conf.he_support)
1011                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
1012
1013                 if (mvif->omac_idx >= EXT_BSSID_START &&
1014                     mvif->omac_idx < REPEATER_BSSID_START)
1015                         mt7915_mcu_bss_ext_tlv(skb, mvif);
1016         }
1017 out:
1018         return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1019                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
1020 }
1021
1022 /** starec & wtbl **/
1023 static int
1024 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1025                        struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1026 {
1027         struct mt7915_sta_key_conf *bip = &msta->bip;
1028         struct sta_rec_sec *sec;
1029         struct tlv *tlv;
1030         u32 len = sizeof(*sec);
1031
1032         tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1033
1034         sec = (struct sta_rec_sec *)tlv;
1035         sec->add = cmd;
1036
1037         if (cmd == SET_KEY) {
1038                 struct sec_key *sec_key;
1039                 u8 cipher;
1040
1041                 cipher = mt7915_mcu_get_cipher(key->cipher);
1042                 if (cipher == MT_CIPHER_NONE)
1043                         return -EOPNOTSUPP;
1044
1045                 sec_key = &sec->key[0];
1046                 sec_key->cipher_len = sizeof(*sec_key);
1047
1048                 if (cipher == MT_CIPHER_BIP_CMAC_128) {
1049                         sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1050                         sec_key->key_id = bip->keyidx;
1051                         sec_key->key_len = 16;
1052                         memcpy(sec_key->key, bip->key, 16);
1053
1054                         sec_key = &sec->key[1];
1055                         sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1056                         sec_key->cipher_len = sizeof(*sec_key);
1057                         sec_key->key_len = 16;
1058                         memcpy(sec_key->key, key->key, 16);
1059
1060                         sec->n_cipher = 2;
1061                 } else {
1062                         sec_key->cipher_id = cipher;
1063                         sec_key->key_id = key->keyidx;
1064                         sec_key->key_len = key->keylen;
1065                         memcpy(sec_key->key, key->key, key->keylen);
1066
1067                         if (cipher == MT_CIPHER_TKIP) {
1068                                 /* Rx/Tx MIC keys are swapped */
1069                                 memcpy(sec_key->key + 16, key->key + 24, 8);
1070                                 memcpy(sec_key->key + 24, key->key + 16, 8);
1071                         }
1072
1073                         /* store key_conf for BIP batch update */
1074                         if (cipher == MT_CIPHER_AES_CCMP) {
1075                                 memcpy(bip->key, key->key, key->keylen);
1076                                 bip->keyidx = key->keyidx;
1077                         }
1078
1079                         len -= sizeof(*sec_key);
1080                         sec->n_cipher = 1;
1081                 }
1082         } else {
1083                 len -= sizeof(sec->key);
1084                 sec->n_cipher = 0;
1085         }
1086         sec->len = cpu_to_le16(len);
1087
1088         return 0;
1089 }
1090
1091 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1092                        struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1093                        enum set_key_cmd cmd)
1094 {
1095         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1096         struct sk_buff *skb;
1097         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1098         int ret;
1099
1100         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1101         if (IS_ERR(skb))
1102                 return PTR_ERR(skb);
1103
1104         ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1105         if (ret)
1106                 return ret;
1107
1108         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1109                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1110 }
1111
1112 static void
1113 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1114                       struct ieee80211_ampdu_params *params,
1115                       bool enable, bool tx)
1116 {
1117         struct sta_rec_ba *ba;
1118         struct tlv *tlv;
1119
1120         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1121
1122         ba = (struct sta_rec_ba *)tlv;
1123         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1124         ba->winsize = cpu_to_le16(params->buf_size);
1125         ba->ssn = cpu_to_le16(params->ssn);
1126         ba->ba_en = enable << params->tid;
1127         ba->amsdu = params->amsdu;
1128         ba->tid = params->tid;
1129 }
1130
1131 static void
1132 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1133                        struct ieee80211_ampdu_params *params,
1134                        bool enable, bool tx, void *sta_wtbl,
1135                        void *wtbl_tlv)
1136 {
1137         struct wtbl_ba *ba;
1138         struct tlv *tlv;
1139
1140         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1141                                         wtbl_tlv, sta_wtbl);
1142
1143         ba = (struct wtbl_ba *)tlv;
1144         ba->tid = params->tid;
1145
1146         if (tx) {
1147                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1148                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1149                 ba->ba_en = enable;
1150         } else {
1151                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1152                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1153                 ba->rst_ba_tid = params->tid;
1154                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1155                 ba->rst_ba_sb = 1;
1156         }
1157
1158         if (enable && tx)
1159                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1160 }
1161
1162 static int
1163 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1164                   struct ieee80211_ampdu_params *params,
1165                   bool enable, bool tx)
1166 {
1167         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1168         struct mt7915_vif *mvif = msta->vif;
1169         struct wtbl_req_hdr *wtbl_hdr;
1170         struct tlv *sta_wtbl;
1171         struct sk_buff *skb;
1172         int ret;
1173
1174         if (enable && tx && !params->amsdu)
1175                 msta->wcid.amsdu = false;
1176
1177         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1178                                        MT7915_STA_UPDATE_MAX_SIZE);
1179         if (IS_ERR(skb))
1180                 return PTR_ERR(skb);
1181
1182         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1183
1184         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1185                                              &skb);
1186         mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1187
1188         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1189                                     MCU_EXT_CMD_STA_REC_UPDATE, true);
1190         if (ret)
1191                 return ret;
1192
1193         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1194                                        MT7915_STA_UPDATE_MAX_SIZE);
1195         if (IS_ERR(skb))
1196                 return PTR_ERR(skb);
1197
1198         mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1199
1200         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1201                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1202 }
1203
1204 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1205                          struct ieee80211_ampdu_params *params,
1206                          bool enable)
1207 {
1208         return mt7915_mcu_sta_ba(dev, params, enable, true);
1209 }
1210
1211 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1212                          struct ieee80211_ampdu_params *params,
1213                          bool enable)
1214 {
1215         return mt7915_mcu_sta_ba(dev, params, enable, false);
1216 }
1217
1218 static void
1219 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1220                             struct ieee80211_sta *sta, void *sta_wtbl,
1221                             void *wtbl_tlv)
1222 {
1223         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1224         struct wtbl_generic *generic;
1225         struct wtbl_rx *rx;
1226         struct tlv *tlv;
1227
1228         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1229                                         wtbl_tlv, sta_wtbl);
1230
1231         generic = (struct wtbl_generic *)tlv;
1232
1233         if (sta) {
1234                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1235                 generic->partial_aid = cpu_to_le16(sta->aid);
1236                 generic->muar_idx = mvif->omac_idx;
1237                 generic->qos = sta->wme;
1238         } else {
1239                 /* use BSSID in station mode */
1240                 if (vif->type == NL80211_IFTYPE_STATION)
1241                         memcpy(generic->peer_addr, vif->bss_conf.bssid,
1242                                ETH_ALEN);
1243                 else
1244                         eth_broadcast_addr(generic->peer_addr);
1245
1246                 generic->muar_idx = 0xe;
1247         }
1248
1249         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1250                                         wtbl_tlv, sta_wtbl);
1251
1252         rx = (struct wtbl_rx *)tlv;
1253         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1254         rx->rca2 = 1;
1255         rx->rv = 1;
1256 }
1257
1258 static void
1259 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1260                          struct ieee80211_sta *sta, bool enable)
1261 {
1262 #define EXTRA_INFO_VER          BIT(0)
1263 #define EXTRA_INFO_NEW          BIT(1)
1264         struct sta_rec_basic *basic;
1265         struct tlv *tlv;
1266
1267         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1268
1269         basic = (struct sta_rec_basic *)tlv;
1270         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1271
1272         if (enable) {
1273                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1274                 basic->conn_state = CONN_STATE_PORT_SECURE;
1275         } else {
1276                 basic->conn_state = CONN_STATE_DISCONNECT;
1277         }
1278
1279         if (!sta) {
1280                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1281                 eth_broadcast_addr(basic->peer_addr);
1282                 return;
1283         }
1284
1285         switch (vif->type) {
1286         case NL80211_IFTYPE_MESH_POINT:
1287         case NL80211_IFTYPE_AP:
1288                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1289                 break;
1290         case NL80211_IFTYPE_STATION:
1291                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1292                 break;
1293         case NL80211_IFTYPE_ADHOC:
1294                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1295                 break;
1296         default:
1297                 WARN_ON(1);
1298                 break;
1299         }
1300
1301         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1302         basic->aid = cpu_to_le16(sta->aid);
1303         basic->qos = sta->wme;
1304 }
1305
1306 static void
1307 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1308 {
1309         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1310         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1311         struct sta_rec_he *he;
1312         struct tlv *tlv;
1313         u32 cap = 0;
1314
1315         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1316
1317         he = (struct sta_rec_he *)tlv;
1318
1319         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1320                 cap |= STA_REC_HE_CAP_HTC;
1321
1322         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1323                 cap |= STA_REC_HE_CAP_BSR;
1324
1325         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1326                 cap |= STA_REC_HE_CAP_OM;
1327
1328         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1329                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1330
1331         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1332                 cap |= STA_REC_HE_CAP_BQR;
1333
1334         if (elem->phy_cap_info[0] &
1335             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1336              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1337                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1338
1339         if (elem->phy_cap_info[1] &
1340             IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1341                 cap |= STA_REC_HE_CAP_LDPC;
1342
1343         if (elem->phy_cap_info[1] &
1344             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1345                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1346
1347         if (elem->phy_cap_info[2] &
1348             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1349                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1350
1351         if (elem->phy_cap_info[2] &
1352             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1353                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1354
1355         if (elem->phy_cap_info[2] &
1356             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1357                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1358
1359         if (elem->phy_cap_info[6] &
1360             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1361                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1362
1363         if (elem->phy_cap_info[7] &
1364             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1365                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1366
1367         if (elem->phy_cap_info[7] &
1368             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1369                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1370
1371         if (elem->phy_cap_info[7] &
1372             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1373                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1374
1375         if (elem->phy_cap_info[8] &
1376             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1377                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1378
1379         if (elem->phy_cap_info[8] &
1380             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1381                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1382
1383         if (elem->phy_cap_info[9] &
1384             IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1385                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1386
1387         if (elem->phy_cap_info[9] &
1388             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1389                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1390
1391         if (elem->phy_cap_info[9] &
1392             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1393                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1394
1395         he->he_cap = cpu_to_le32(cap);
1396
1397         switch (sta->bandwidth) {
1398         case IEEE80211_STA_RX_BW_160:
1399                 if (elem->phy_cap_info[0] &
1400                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1401                         he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1402                                 he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1403
1404                 he->max_nss_mcs[CMD_HE_MCS_BW160] =
1405                                 he_cap->he_mcs_nss_supp.rx_mcs_160;
1406                 fallthrough;
1407         default:
1408                 he->max_nss_mcs[CMD_HE_MCS_BW80] =
1409                                 he_cap->he_mcs_nss_supp.rx_mcs_80;
1410                 break;
1411         }
1412
1413         he->t_frame_dur =
1414                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1415         he->max_ampdu_exp =
1416                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1417
1418         he->bw_set =
1419                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1420         he->device_class =
1421                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1422         he->punc_pream_rx =
1423                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1424
1425         he->dcm_tx_mode =
1426                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1427         he->dcm_tx_max_nss =
1428                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1429         he->dcm_rx_mode =
1430                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1431         he->dcm_rx_max_nss =
1432                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1433         he->dcm_rx_max_nss =
1434                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1435
1436         he->pkt_ext = 2;
1437 }
1438
1439 static void
1440 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1441                      struct ieee80211_vif *vif)
1442 {
1443         struct sta_rec_uapsd *uapsd;
1444         struct tlv *tlv;
1445
1446         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1447                 return;
1448
1449         tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1450         uapsd = (struct sta_rec_uapsd *)tlv;
1451
1452         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1453                 uapsd->dac_map |= BIT(3);
1454                 uapsd->tac_map |= BIT(3);
1455         }
1456         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1457                 uapsd->dac_map |= BIT(2);
1458                 uapsd->tac_map |= BIT(2);
1459         }
1460         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1461                 uapsd->dac_map |= BIT(1);
1462                 uapsd->tac_map |= BIT(1);
1463         }
1464         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1465                 uapsd->dac_map |= BIT(0);
1466                 uapsd->tac_map |= BIT(0);
1467         }
1468         uapsd->max_sp = sta->max_sp;
1469 }
1470
1471 static void
1472 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1473 {
1474         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1475         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1476         struct sta_rec_muru *muru;
1477         struct tlv *tlv;
1478
1479         tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1480
1481         muru = (struct sta_rec_muru *)tlv;
1482         muru->cfg.ofdma_dl_en = true;
1483         muru->cfg.mimo_dl_en = true;
1484
1485         muru->ofdma_dl.punc_pream_rx =
1486                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1487         muru->ofdma_dl.he_20m_in_40m_2g =
1488                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1489         muru->ofdma_dl.he_20m_in_160m =
1490                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1491         muru->ofdma_dl.he_80m_in_160m =
1492                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1493         muru->ofdma_dl.lt16_sigb = 0;
1494         muru->ofdma_dl.rx_su_comp_sigb = 0;
1495         muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1496
1497         muru->ofdma_ul.t_frame_dur =
1498                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1499         muru->ofdma_ul.mu_cascading =
1500                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1501         muru->ofdma_ul.uo_ra =
1502                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1503         muru->ofdma_ul.he_2x996_tone = 0;
1504         muru->ofdma_ul.rx_t_frame_11ac = 0;
1505
1506         muru->mimo_dl.vht_mu_bfee =
1507                 !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1508         muru->mimo_dl.partial_bw_dl_mimo =
1509                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1510
1511         muru->mimo_ul.full_ul_mimo =
1512                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1513         muru->mimo_ul.partial_ul_mimo =
1514                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1515 }
1516
1517 static int
1518 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1519                   struct ieee80211_sta *sta)
1520 {
1521         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1522         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1523         struct sk_buff *skb;
1524         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1525
1526         if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1527                 return 0;
1528
1529         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1530         if (IS_ERR(skb))
1531                 return PTR_ERR(skb);
1532
1533         /* starec muru */
1534         mt7915_mcu_sta_muru_tlv(skb, sta);
1535
1536         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1537                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1538 }
1539
1540 static void
1541 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1542 {
1543         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1544         struct sta_rec_amsdu *amsdu;
1545         struct tlv *tlv;
1546
1547         if (!sta->max_amsdu_len)
1548             return;
1549
1550         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1551         amsdu = (struct sta_rec_amsdu *)tlv;
1552         amsdu->max_amsdu_num = 8;
1553         amsdu->amsdu_en = true;
1554         amsdu->max_mpdu_size = sta->max_amsdu_len >=
1555                                IEEE80211_MAX_MPDU_LEN_VHT_7991;
1556         msta->wcid.amsdu = true;
1557 }
1558
1559 static bool
1560 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1561 {
1562         switch (vif->type) {
1563         case NL80211_IFTYPE_AP:
1564         case NL80211_IFTYPE_STATION:
1565                 return true;
1566         default:
1567                 return false;
1568         }
1569 }
1570
1571 static void
1572 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1573                    struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1574 {
1575         struct tlv *tlv;
1576
1577         /* starec ht */
1578         if (sta->ht_cap.ht_supported) {
1579                 struct sta_rec_ht *ht;
1580
1581                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1582                 ht = (struct sta_rec_ht *)tlv;
1583                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1584
1585                 if (mt7915_hw_amsdu_supported(vif))
1586                         mt7915_mcu_sta_amsdu_tlv(skb, sta);
1587         }
1588
1589         /* starec vht */
1590         if (sta->vht_cap.vht_supported) {
1591                 struct sta_rec_vht *vht;
1592
1593                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1594                 vht = (struct sta_rec_vht *)tlv;
1595                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1596                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1597                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1598         }
1599
1600         /* starec he */
1601         if (sta->he_cap.has_he)
1602                 mt7915_mcu_sta_he_tlv(skb, sta);
1603
1604         /* starec uapsd */
1605         mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1606 }
1607
1608 static void
1609 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1610                          void *sta_wtbl, void *wtbl_tlv)
1611 {
1612         struct wtbl_smps *smps;
1613         struct tlv *tlv;
1614
1615         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1616                                         wtbl_tlv, sta_wtbl);
1617         smps = (struct wtbl_smps *)tlv;
1618
1619         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1620                 smps->smps = true;
1621 }
1622
1623 static void
1624 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1625                        void *sta_wtbl, void *wtbl_tlv)
1626 {
1627         struct wtbl_ht *ht = NULL;
1628         struct tlv *tlv;
1629
1630         /* wtbl ht */
1631         if (sta->ht_cap.ht_supported) {
1632                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1633                                                 wtbl_tlv, sta_wtbl);
1634                 ht = (struct wtbl_ht *)tlv;
1635                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1636                 ht->af = sta->ht_cap.ampdu_factor;
1637                 ht->mm = sta->ht_cap.ampdu_density;
1638                 ht->ht = true;
1639         }
1640
1641         /* wtbl vht */
1642         if (sta->vht_cap.vht_supported) {
1643                 struct wtbl_vht *vht;
1644                 u8 af;
1645
1646                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1647                                                 wtbl_tlv, sta_wtbl);
1648                 vht = (struct wtbl_vht *)tlv;
1649                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1650                 vht->vht = true;
1651
1652                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1653                                sta->vht_cap.cap);
1654                 if (ht)
1655                         ht->af = max_t(u8, ht->af, af);
1656         }
1657
1658         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1659 }
1660
1661 static void
1662 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1663                               struct ieee80211_sta *sta,
1664                               void *sta_wtbl, void *wtbl_tlv)
1665 {
1666         struct mt7915_sta *msta;
1667         struct wtbl_hdr_trans *htr = NULL;
1668         struct tlv *tlv;
1669
1670         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1671                                         wtbl_tlv, sta_wtbl);
1672         htr = (struct wtbl_hdr_trans *)tlv;
1673         htr->no_rx_trans = true;
1674         if (vif->type == NL80211_IFTYPE_STATION)
1675                 htr->to_ds = true;
1676         else
1677                 htr->from_ds = true;
1678
1679         if (!sta)
1680                 return;
1681
1682         msta = (struct mt7915_sta *)sta->drv_priv;
1683         if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1684                 htr->to_ds = true;
1685                 htr->from_ds = true;
1686         }
1687 }
1688
1689 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1690                                     struct ieee80211_vif *vif,
1691                                     struct ieee80211_sta *sta)
1692 {
1693         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1694         struct wtbl_req_hdr *wtbl_hdr;
1695         struct sk_buff *skb;
1696
1697         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1698         if (!skb)
1699                 return -ENOMEM;
1700
1701         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1702         mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1703
1704         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD_WTBL_UPDATE,
1705                                      true);
1706 }
1707
1708 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1709                         struct ieee80211_sta *sta)
1710 {
1711         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1712         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1713         struct wtbl_req_hdr *wtbl_hdr;
1714         struct tlv *sta_wtbl;
1715         struct sk_buff *skb;
1716
1717         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1718                                        MT7915_STA_UPDATE_MAX_SIZE);
1719         if (IS_ERR(skb))
1720                 return PTR_ERR(skb);
1721
1722         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1723
1724         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1725                                              &skb);
1726         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1727
1728         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1729                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
1730 }
1731
1732 static void
1733 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1734 {
1735         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1736         bf->ndp_rate = 0;                               /* mcs0 */
1737         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1738         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1739 }
1740
1741 static void
1742 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct sta_rec_bf *bf)
1743 {
1744         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1745         u8 n = 0;
1746
1747         bf->tx_mode = MT_PHY_TYPE_HT;
1748         bf->bf_cap |= MT_IBF;
1749
1750         if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1751             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1752                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1753                               mcs->tx_params);
1754         else if (mcs->rx_mask[3])
1755                 n = 3;
1756         else if (mcs->rx_mask[2])
1757                 n = 2;
1758         else if (mcs->rx_mask[1])
1759                 n = 1;
1760
1761         bf->nc = min_t(u8, bf->nr, n);
1762         bf->ibf_ncol = bf->nc;
1763
1764         if (sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1765                 bf->ibf_timeout = 0x48;
1766 }
1767
1768 static void
1769 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1770                         struct sta_rec_bf *bf)
1771 {
1772         struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1773         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1774         u8 bfee_nr, bfer_nr, n, tx_ant = hweight8(phy->chainmask) - 1;
1775         u16 mcs_map;
1776
1777         bf->tx_mode = MT_PHY_TYPE_VHT;
1778         bf->bf_cap |= MT_EBF;
1779
1780         mt7915_mcu_sta_sounding_rate(bf);
1781
1782         bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1783                             pc->cap);
1784         bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1785                             vc->cap);
1786         mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1787
1788         n = min_t(u8, bfer_nr, bfee_nr);
1789         bf->nr = min_t(u8, n, tx_ant);
1790         n = mt7915_mcu_get_sta_nss(mcs_map);
1791
1792         bf->nc = min_t(u8, n, bf->nr);
1793         bf->ibf_ncol = bf->nc;
1794
1795         /* force nr from 4 to 2 */
1796         if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1797                 bf->nr = 1;
1798 }
1799
1800 static void
1801 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1802                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1803 {
1804         struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1805         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1806         const struct ieee80211_he_cap_elem *ve;
1807         const struct ieee80211_sta_he_cap *vc;
1808         u8 bfee_nr, bfer_nr, nss_mcs;
1809         u16 mcs_map;
1810
1811         vc = mt7915_get_he_phy_cap(phy, vif);
1812         ve = &vc->he_cap_elem;
1813
1814         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1815         bf->bf_cap |= MT_EBF;
1816
1817         mt7915_mcu_sta_sounding_rate(bf);
1818
1819         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1820                                 pe->phy_cap_info[6]);
1821         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1822                                 pe->phy_cap_info[6]);
1823         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1824                          ve->phy_cap_info[5]);
1825         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1826                          pe->phy_cap_info[4]);
1827
1828         mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.tx_mcs_80);
1829         nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1830
1831         bf->nr = min_t(u8, bfer_nr, bfee_nr);
1832         bf->nc = min_t(u8, nss_mcs, bf->nr);
1833         bf->ibf_ncol = bf->nc;
1834
1835         if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1836                 return;
1837
1838         /* go over for 160MHz and 80p80 */
1839         if (pe->phy_cap_info[0] &
1840             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1841                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1842                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1843
1844                 bf->nc_bw160 = nss_mcs;
1845         }
1846
1847         if (pe->phy_cap_info[0] &
1848             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1849                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1850                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1851
1852                 if (bf->nc_bw160)
1853                         bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1854                 else
1855                         bf->nc_bw160 = nss_mcs;
1856         }
1857
1858         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1859                          ve->phy_cap_info[5]);
1860         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1861                          pe->phy_cap_info[4]);
1862
1863         bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1864 }
1865
1866 static void
1867 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1868                         struct ieee80211_vif *vif, struct mt7915_phy *phy,
1869                         bool enable)
1870 {
1871         struct sta_rec_bf *bf;
1872         struct tlv *tlv;
1873         int tx_ant = hweight8(phy->chainmask) - 1;
1874         const u8 matrix[4][4] = {
1875                 {0, 0, 0, 0},
1876                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
1877                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
1878                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
1879         };
1880
1881 #define MT_BFER_FREE            cpu_to_le16(GENMASK(15, 0))
1882
1883         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1884         bf = (struct sta_rec_bf *)tlv;
1885
1886         if (!enable) {
1887                 bf->pfmu = MT_BFER_FREE;
1888                 return;
1889         }
1890
1891         bf->bw = sta->bandwidth;
1892         bf->ibf_dbw = sta->bandwidth;
1893         bf->ibf_nrow = tx_ant;
1894         bf->ibf_timeout = 0x18;
1895
1896         if (sta->he_cap.has_he)
1897                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1898         else if (sta->vht_cap.vht_supported)
1899                 mt7915_mcu_sta_bfer_vht(sta, phy, bf);
1900         else if (sta->ht_cap.ht_supported)
1901                 mt7915_mcu_sta_bfer_ht(sta, bf);
1902
1903         if (bf->bf_cap & MT_EBF && bf->nr != tx_ant)
1904                 bf->mem_20m = matrix[tx_ant][bf->nc];
1905         else
1906                 bf->mem_20m = matrix[bf->nr][bf->nc];
1907
1908         switch (sta->bandwidth) {
1909         case IEEE80211_STA_RX_BW_160:
1910         case IEEE80211_STA_RX_BW_80:
1911                 bf->mem_total = bf->mem_20m * 2;
1912                 break;
1913         case IEEE80211_STA_RX_BW_40:
1914                 bf->mem_total = bf->mem_20m;
1915                 break;
1916         case IEEE80211_STA_RX_BW_20:
1917         default:
1918                 break;
1919         }
1920 }
1921
1922 static void
1923 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1924                         struct mt7915_phy *phy)
1925 {
1926         struct sta_rec_bfee *bfee;
1927         struct tlv *tlv;
1928         int tx_ant = hweight8(phy->chainmask) - 1;
1929         u8 nr = 0;
1930
1931         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1932         bfee = (struct sta_rec_bfee *)tlv;
1933
1934         if (sta->he_cap.has_he) {
1935                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1936
1937                 nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1938                             pe->phy_cap_info[5]);
1939         } else if (sta->vht_cap.vht_supported) {
1940                 struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1941
1942                 nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1943                                pc->cap);
1944         }
1945
1946         /* reply with identity matrix to avoid 2x2 BF negative gain */
1947         if (nr == 1 && tx_ant == 2)
1948                 bfee->fb_identity_matrix = true;
1949 }
1950
1951 static u8
1952 mt7915_mcu_sta_txbf_type(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1953                          struct ieee80211_sta *sta)
1954 {
1955         u8 type = 0;
1956
1957         if (vif->type != NL80211_IFTYPE_STATION &&
1958             vif->type != NL80211_IFTYPE_AP)
1959                 return 0;
1960
1961         if (sta->he_cap.has_he) {
1962                 struct ieee80211_he_cap_elem *pe;
1963                 const struct ieee80211_he_cap_elem *ve;
1964                 const struct ieee80211_sta_he_cap *vc;
1965
1966                 pe = &sta->he_cap.he_cap_elem;
1967                 vc = mt7915_get_he_phy_cap(phy, vif);
1968                 ve = &vc->he_cap_elem;
1969
1970                 if ((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
1971                      HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
1972                     HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]))
1973                         type |= MT_STA_BFEE;
1974
1975                 if ((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
1976                      HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
1977                     HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]))
1978                         type |= MT_STA_BFER;
1979         } else if (sta->vht_cap.vht_supported) {
1980                 struct ieee80211_sta_vht_cap *pc;
1981                 struct ieee80211_sta_vht_cap *vc;
1982                 u32 cr, ce;
1983
1984                 pc = &sta->vht_cap;
1985                 vc = &phy->mt76->sband_5g.sband.vht_cap;
1986                 cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
1987                      IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
1988                 ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
1989                      IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
1990
1991                 if ((pc->cap & cr) && (vc->cap & ce))
1992                         type |= MT_STA_BFEE;
1993
1994                 if ((vc->cap & cr) && (pc->cap & ce))
1995                         type |= MT_STA_BFER;
1996         } else if (sta->ht_cap.ht_supported) {
1997                 /* TODO: iBF */
1998         }
1999
2000         return type;
2001 }
2002
2003 static int
2004 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2005                     struct ieee80211_sta *sta, bool enable)
2006 {
2007         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2008         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2009         struct mt7915_phy *phy;
2010         struct sk_buff *skb;
2011         int r, len;
2012         u8 type;
2013
2014         phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2015
2016         type = mt7915_mcu_sta_txbf_type(phy, vif, sta);
2017
2018         /* must keep each tag independent */
2019
2020         /* starec bf */
2021         if (type & MT_STA_BFER) {
2022                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2023
2024                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2025                 if (IS_ERR(skb))
2026                         return PTR_ERR(skb);
2027
2028                 mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable);
2029
2030                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2031                                           MCU_EXT_CMD_STA_REC_UPDATE, true);
2032                 if (r)
2033                         return r;
2034         }
2035
2036         /* starec bfee */
2037         if (type & MT_STA_BFEE) {
2038                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2039
2040                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2041                 if (IS_ERR(skb))
2042                         return PTR_ERR(skb);
2043
2044                 mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2045
2046                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2047                                           MCU_EXT_CMD_STA_REC_UPDATE, true);
2048                 if (r)
2049                         return r;
2050         }
2051
2052         return 0;
2053 }
2054
2055 static void
2056 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2057                              struct ieee80211_vif *vif,
2058                              struct ieee80211_sta *sta)
2059 {
2060         struct cfg80211_chan_def *chandef = &dev->mphy.chandef;
2061         struct sta_rec_ra *ra;
2062         struct tlv *tlv;
2063         enum nl80211_band band = chandef->chan->band;
2064         u32 supp_rate = sta->supp_rates[band];
2065         int n_rates = hweight32(supp_rate);
2066         u32 cap = sta->wme ? STA_CAP_WMM : 0;
2067         u8 i, nss = sta->rx_nss, mcs = 0;
2068
2069         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2070
2071         ra = (struct sta_rec_ra *)tlv;
2072         ra->valid = true;
2073         ra->auto_rate = true;
2074         ra->phy_mode = mt7915_get_phy_mode(dev, vif, band, sta);
2075         ra->channel = chandef->chan->hw_value;
2076         ra->bw = sta->bandwidth;
2077         ra->rate_len = n_rates;
2078         ra->phy.bw = sta->bandwidth;
2079
2080         if (n_rates) {
2081                 if (band == NL80211_BAND_2GHZ) {
2082                         ra->supp_mode = MODE_CCK;
2083                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2084                         ra->phy.type = MT_PHY_TYPE_CCK;
2085
2086                         if (n_rates > 4) {
2087                                 ra->supp_mode |= MODE_OFDM;
2088                                 ra->supp_ofdm_rate = supp_rate >> 4;
2089                                 ra->phy.type = MT_PHY_TYPE_OFDM;
2090                         }
2091                 } else {
2092                         ra->supp_mode = MODE_OFDM;
2093                         ra->supp_ofdm_rate = supp_rate;
2094                         ra->phy.type = MT_PHY_TYPE_OFDM;
2095                 }
2096         }
2097
2098         if (sta->ht_cap.ht_supported) {
2099                 for (i = 0; i < nss; i++)
2100                         ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2101
2102                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2103                 ra->supp_mode |= MODE_HT;
2104                 mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2105                 ra->af = sta->ht_cap.ampdu_factor;
2106                 ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2107
2108                 cap |= STA_CAP_HT;
2109                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2110                         cap |= STA_CAP_SGI_20;
2111                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2112                         cap |= STA_CAP_SGI_40;
2113                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2114                         cap |= STA_CAP_TX_STBC;
2115                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2116                         cap |= STA_CAP_RX_STBC;
2117                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2118                         cap |= STA_CAP_LDPC;
2119         }
2120
2121         if (sta->vht_cap.vht_supported) {
2122                 u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2123                 u16 vht_mcs;
2124                 u8 af, mcs_prev;
2125
2126                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2127                                sta->vht_cap.cap);
2128                 ra->af = max_t(u8, ra->af, af);
2129
2130                 cap |= STA_CAP_VHT;
2131                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2132                         cap |= STA_CAP_VHT_SGI_80;
2133                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2134                         cap |= STA_CAP_VHT_SGI_160;
2135                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2136                         cap |= STA_CAP_VHT_TX_STBC;
2137                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2138                         cap |= STA_CAP_VHT_RX_STBC;
2139                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2140                         cap |= STA_CAP_VHT_LDPC;
2141
2142                 ra->supp_mode |= MODE_VHT;
2143                 for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2144                         switch (mcs_map & 0x3) {
2145                         case IEEE80211_VHT_MCS_SUPPORT_0_9:
2146                                 vht_mcs = GENMASK(9, 0);
2147                                 break;
2148                         case IEEE80211_VHT_MCS_SUPPORT_0_8:
2149                                 vht_mcs = GENMASK(8, 0);
2150                                 break;
2151                         case IEEE80211_VHT_MCS_SUPPORT_0_7:
2152                                 vht_mcs = GENMASK(7, 0);
2153                                 break;
2154                         default:
2155                                 vht_mcs = 0;
2156                         }
2157
2158                         ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2159
2160                         mcs_prev = hweight16(vht_mcs) - 1;
2161                         if (mcs_prev > mcs)
2162                                 mcs = mcs_prev;
2163
2164                         /* only support 2ss on 160MHz */
2165                         if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2166                                       ra->bw == CMD_CBW_8080MHZ))
2167                                 break;
2168                 }
2169         }
2170
2171         if (sta->he_cap.has_he) {
2172                 ra->supp_mode |= MODE_HE;
2173                 cap |= STA_CAP_HE;
2174         }
2175
2176         ra->sta_status = cpu_to_le32(cap);
2177
2178         switch (BIT(fls(ra->supp_mode) - 1)) {
2179         case MODE_VHT:
2180                 ra->phy.type = MT_PHY_TYPE_VHT;
2181                 ra->phy.mcs = mcs;
2182                 ra->phy.nss = nss;
2183                 ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2184                 ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2185                 ra->phy.sgi =
2186                         !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2187                 break;
2188         case MODE_HT:
2189                 ra->phy.type = MT_PHY_TYPE_HT;
2190                 ra->phy.mcs = mcs;
2191                 ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2192                 ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2193                 ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2194                 break;
2195         default:
2196                 break;
2197         }
2198 }
2199
2200 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2201                              struct ieee80211_sta *sta)
2202 {
2203         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2204         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2205         struct sk_buff *skb;
2206         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2207
2208         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2209         if (IS_ERR(skb))
2210                 return PTR_ERR(skb);
2211
2212         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2213
2214         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2215                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2216 }
2217
2218 static int
2219 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2220                      struct ieee80211_sta *sta)
2221 {
2222 #define MT_STA_BSS_GROUP                1
2223         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2224         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2225         struct {
2226                 __le32 action;
2227                 u8 wlan_idx_lo;
2228                 u8 status;
2229                 u8 wlan_idx_hi;
2230                 u8 rsv0[5];
2231                 __le32 val;
2232                 u8 rsv1[8];
2233         } __packed req = {
2234                 .action = cpu_to_le32(MT_STA_BSS_GROUP),
2235                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
2236                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
2237                 .val = cpu_to_le32(mvif->idx % 16),
2238         };
2239
2240         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_DRR_CTRL, &req,
2241                                  sizeof(req), true);
2242 }
2243
2244 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2245                            struct ieee80211_sta *sta, bool enable)
2246 {
2247         int ret;
2248
2249         if (!sta)
2250                 return 0;
2251
2252         /* must keep the order */
2253         ret = mt7915_mcu_add_group(dev, vif, sta);
2254         if (ret)
2255                 return ret;
2256
2257         ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2258         if (ret)
2259                 return ret;
2260
2261         ret = mt7915_mcu_add_mu(dev, vif, sta);
2262         if (ret)
2263                 return ret;
2264
2265         if (enable)
2266                 return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2267
2268         return 0;
2269 }
2270
2271 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2272                        struct ieee80211_sta *sta, bool enable)
2273 {
2274         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2275         struct wtbl_req_hdr *wtbl_hdr;
2276         struct mt7915_sta *msta;
2277         struct tlv *sta_wtbl;
2278         struct sk_buff *skb;
2279
2280         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2281
2282         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2283                                        MT7915_STA_UPDATE_MAX_SIZE);
2284         if (IS_ERR(skb))
2285                 return PTR_ERR(skb);
2286
2287         mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2288         if (enable && sta)
2289                 mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2290
2291         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2292
2293         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2294                                              sta_wtbl, &skb);
2295         if (enable) {
2296                 mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2297                 mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2298                 if (sta)
2299                         mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2300         }
2301
2302         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2303                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2304 }
2305
2306 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2307                               struct ieee80211_sta *sta, u32 rate)
2308 {
2309         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2310         struct mt7915_vif *mvif = msta->vif;
2311         struct sta_rec_ra_fixed *ra;
2312         struct sk_buff *skb;
2313         struct tlv *tlv;
2314         int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2315
2316         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2317         if (IS_ERR(skb))
2318                 return PTR_ERR(skb);
2319
2320         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2321         ra = (struct sta_rec_ra_fixed *)tlv;
2322
2323         if (!rate) {
2324                 ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2325                 goto out;
2326         } else {
2327                 ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2328         }
2329
2330         ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2331         ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2332         ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2333         ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2334         ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2335
2336         if (ra->phy.bw)
2337                 ra->phy.ldpc = 7;
2338         else
2339                 ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2340
2341         /* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2342         if (ra->phy.type > MT_PHY_TYPE_VHT)
2343                 ra->phy.sgi = ra->phy.mcs * 85;
2344         else
2345                 ra->phy.sgi = ra->phy.mcs * 15;
2346
2347 out:
2348         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2349                                      MCU_EXT_CMD_STA_REC_UPDATE, true);
2350 }
2351
2352 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2353                             struct ieee80211_vif *vif, bool enable)
2354 {
2355         struct mt7915_dev *dev = phy->dev;
2356         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2357         struct {
2358                 struct req_hdr {
2359                         u8 omac_idx;
2360                         u8 dbdc_idx;
2361                         __le16 tlv_num;
2362                         u8 is_tlv_append;
2363                         u8 rsv[3];
2364                 } __packed hdr;
2365                 struct req_tlv {
2366                         __le16 tag;
2367                         __le16 len;
2368                         u8 active;
2369                         u8 dbdc_idx;
2370                         u8 omac_addr[ETH_ALEN];
2371                 } __packed tlv;
2372         } data = {
2373                 .hdr = {
2374                         .omac_idx = mvif->omac_idx,
2375                         .dbdc_idx = mvif->band_idx,
2376                         .tlv_num = cpu_to_le16(1),
2377                         .is_tlv_append = 1,
2378                 },
2379                 .tlv = {
2380                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
2381                         .len = cpu_to_le16(sizeof(struct req_tlv)),
2382                         .active = enable,
2383                         .dbdc_idx = mvif->band_idx,
2384                 },
2385         };
2386
2387         if (mvif->omac_idx >= REPEATER_BSSID_START)
2388                 return mt7915_mcu_muar_config(phy, vif, false, enable);
2389
2390         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2391         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_DEV_INFO_UPDATE,
2392                                  &data, sizeof(data), true);
2393 }
2394
2395 static void
2396 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2397                       struct bss_info_bcn *bcn,
2398                       struct ieee80211_mutable_offsets *offs)
2399 {
2400         if (offs->cntdwn_counter_offs[0]) {
2401                 struct tlv *tlv;
2402                 struct bss_info_bcn_csa *csa;
2403
2404                 tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2405                                                    sizeof(*csa), &bcn->sub_ntlv,
2406                                                    &bcn->len);
2407                 csa = (struct bss_info_bcn_csa *)tlv;
2408                 csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2409         }
2410 }
2411
2412 static void
2413 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2414                        struct sk_buff *skb, struct bss_info_bcn *bcn,
2415                        struct ieee80211_mutable_offsets *offs)
2416 {
2417         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2418         struct bss_info_bcn_cont *cont;
2419         struct tlv *tlv;
2420         u8 *buf;
2421         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2422
2423         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2424                                            len, &bcn->sub_ntlv, &bcn->len);
2425
2426         cont = (struct bss_info_bcn_cont *)tlv;
2427         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2428         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2429
2430         if (offs->cntdwn_counter_offs[0])
2431                 cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2432
2433         buf = (u8 *)tlv + sizeof(*cont);
2434         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2435                               true);
2436         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2437 }
2438
2439 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2440                           struct ieee80211_vif *vif, int en)
2441 {
2442 #define MAX_BEACON_SIZE 512
2443         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2444         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2445         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2446         struct ieee80211_mutable_offsets offs;
2447         struct ieee80211_tx_info *info;
2448         struct sk_buff *skb, *rskb;
2449         struct tlv *tlv;
2450         struct bss_info_bcn *bcn;
2451         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2452
2453         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2454         if (!skb)
2455                 return -EINVAL;
2456
2457         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2458                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2459                 dev_kfree_skb(skb);
2460                 return -EINVAL;
2461         }
2462
2463         rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2464         if (IS_ERR(rskb)) {
2465                 dev_kfree_skb(skb);
2466                 return PTR_ERR(rskb);
2467         }
2468
2469         tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2470         bcn = (struct bss_info_bcn *)tlv;
2471         bcn->enable = en;
2472
2473         if (mvif->band_idx) {
2474                 info = IEEE80211_SKB_CB(skb);
2475                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2476         }
2477
2478         /* TODO: subtag - bss color count & 11v MBSSID */
2479         mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2480         mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2481         dev_kfree_skb(skb);
2482
2483         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2484                                      MCU_EXT_CMD_BSS_INFO_UPDATE, true);
2485 }
2486
2487 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2488                                      u32 option)
2489 {
2490         struct {
2491                 __le32 option;
2492                 __le32 addr;
2493         } req = {
2494                 .option = cpu_to_le32(option),
2495                 .addr = cpu_to_le32(addr),
2496         };
2497
2498         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_FW_START_REQ, &req,
2499                                  sizeof(req), true);
2500 }
2501
2502 static int mt7915_mcu_restart(struct mt76_dev *dev)
2503 {
2504         struct {
2505                 u8 power_mode;
2506                 u8 rsv[3];
2507         } req = {
2508                 .power_mode = 1,
2509         };
2510
2511         return mt76_mcu_send_msg(dev, -MCU_CMD_NIC_POWER_CTRL, &req,
2512                                  sizeof(req), false);
2513 }
2514
2515 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2516 {
2517         struct {
2518                 __le32 op;
2519         } req = {
2520                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2521         };
2522
2523         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_SEM_CONTROL, &req,
2524                                  sizeof(req), true);
2525 }
2526
2527 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2528 {
2529         struct {
2530                 u8 check_crc;
2531                 u8 reserved[3];
2532         } req = {
2533                 .check_crc = 0,
2534         };
2535
2536         return mt76_mcu_send_msg(&dev->mt76, -MCU_CMD_PATCH_FINISH_REQ, &req,
2537                                  sizeof(req), true);
2538 }
2539
2540 static int mt7915_driver_own(struct mt7915_dev *dev)
2541 {
2542         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2543
2544         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2545         if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2546                             0, 500)) {
2547                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2548                 return -EIO;
2549         }
2550
2551         return 0;
2552 }
2553
2554 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2555                                     u32 len, u32 mode)
2556 {
2557         struct {
2558                 __le32 addr;
2559                 __le32 len;
2560                 __le32 mode;
2561         } req = {
2562                 .addr = cpu_to_le32(addr),
2563                 .len = cpu_to_le32(len),
2564                 .mode = cpu_to_le32(mode),
2565         };
2566         int attr;
2567
2568         if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2569                 attr = -MCU_CMD_PATCH_START_REQ;
2570         else
2571                 attr = -MCU_CMD_TARGET_ADDRESS_LEN_REQ;
2572
2573         return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2574 }
2575
2576 static int mt7915_load_patch(struct mt7915_dev *dev)
2577 {
2578         const struct mt7915_patch_hdr *hdr;
2579         const struct firmware *fw = NULL;
2580         int i, ret, sem;
2581
2582         sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2583         switch (sem) {
2584         case PATCH_IS_DL:
2585                 return 0;
2586         case PATCH_NOT_DL_SEM_SUCCESS:
2587                 break;
2588         default:
2589                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2590                 return -EAGAIN;
2591         }
2592
2593         ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2594         if (ret)
2595                 goto out;
2596
2597         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2598                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2599                 ret = -EINVAL;
2600                 goto out;
2601         }
2602
2603         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2604
2605         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2606                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2607
2608         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2609                 struct mt7915_patch_sec *sec;
2610                 const u8 *dl;
2611                 u32 len, addr;
2612
2613                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2614                                                   i * sizeof(*sec));
2615                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2616                     PATCH_SEC_TYPE_INFO) {
2617                         ret = -EINVAL;
2618                         goto out;
2619                 }
2620
2621                 addr = be32_to_cpu(sec->info.addr);
2622                 len = be32_to_cpu(sec->info.len);
2623                 dl = fw->data + be32_to_cpu(sec->offs);
2624
2625                 ret = mt7915_mcu_init_download(dev, addr, len,
2626                                                DL_MODE_NEED_RSP);
2627                 if (ret) {
2628                         dev_err(dev->mt76.dev, "Download request failed\n");
2629                         goto out;
2630                 }
2631
2632                 ret = mt76_mcu_send_firmware(&dev->mt76, -MCU_CMD_FW_SCATTER,
2633                                              dl, len);
2634                 if (ret) {
2635                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2636                         goto out;
2637                 }
2638         }
2639
2640         ret = mt7915_mcu_start_patch(dev);
2641         if (ret)
2642                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2643
2644 out:
2645         sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2646         switch (sem) {
2647         case PATCH_REL_SEM_SUCCESS:
2648                 break;
2649         default:
2650                 ret = -EAGAIN;
2651                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2652                 goto out;
2653         }
2654         release_firmware(fw);
2655
2656         return ret;
2657 }
2658
2659 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2660 {
2661         u32 ret = 0;
2662
2663         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2664                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2665         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2666                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2667         ret |= DL_MODE_NEED_RSP;
2668         ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2669
2670         return ret;
2671 }
2672
2673 static int
2674 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2675                              const struct mt7915_fw_trailer *hdr,
2676                              const u8 *data, bool is_wa)
2677 {
2678         int i, offset = 0;
2679         u32 override = 0, option = 0;
2680
2681         for (i = 0; i < hdr->n_region; i++) {
2682                 const struct mt7915_fw_region *region;
2683                 int err;
2684                 u32 len, addr, mode;
2685
2686                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2687                          (hdr->n_region - i) * sizeof(*region));
2688                 mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2689                 len = le32_to_cpu(region->len);
2690                 addr = le32_to_cpu(region->addr);
2691
2692                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2693                         override = addr;
2694
2695                 err = mt7915_mcu_init_download(dev, addr, len, mode);
2696                 if (err) {
2697                         dev_err(dev->mt76.dev, "Download request failed\n");
2698                         return err;
2699                 }
2700
2701                 err = mt76_mcu_send_firmware(&dev->mt76, -MCU_CMD_FW_SCATTER,
2702                                              data + offset, len);
2703                 if (err) {
2704                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2705                         return err;
2706                 }
2707
2708                 offset += len;
2709         }
2710
2711         if (override)
2712                 option |= FW_START_OVERRIDE;
2713
2714         if (is_wa)
2715                 option |= FW_START_WORKING_PDA_CR4;
2716
2717         return mt7915_mcu_start_firmware(dev, override, option);
2718 }
2719
2720 static int mt7915_load_ram(struct mt7915_dev *dev)
2721 {
2722         const struct mt7915_fw_trailer *hdr;
2723         const struct firmware *fw;
2724         int ret;
2725
2726         ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2727         if (ret)
2728                 return ret;
2729
2730         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2731                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2732                 ret = -EINVAL;
2733                 goto out;
2734         }
2735
2736         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2737                                         sizeof(*hdr));
2738
2739         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2740                  hdr->fw_ver, hdr->build_date);
2741
2742         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2743         if (ret) {
2744                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2745                 goto out;
2746         }
2747
2748         release_firmware(fw);
2749
2750         ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2751         if (ret)
2752                 return ret;
2753
2754         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2755                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2756                 ret = -EINVAL;
2757                 goto out;
2758         }
2759
2760         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2761                                         sizeof(*hdr));
2762
2763         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2764                  hdr->fw_ver, hdr->build_date);
2765
2766         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2767         if (ret) {
2768                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2769                 goto out;
2770         }
2771
2772         snprintf(dev->mt76.hw->wiphy->fw_version,
2773                  sizeof(dev->mt76.hw->wiphy->fw_version),
2774                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2775
2776 out:
2777         release_firmware(fw);
2778
2779         return ret;
2780 }
2781
2782 static int mt7915_load_firmware(struct mt7915_dev *dev)
2783 {
2784         int ret;
2785         u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2786
2787         val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2788
2789         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2790                 /* restart firmware once */
2791                 __mt76_mcu_restart(&dev->mt76);
2792                 if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2793                                     val, 1000)) {
2794                         dev_err(dev->mt76.dev,
2795                                 "Firmware is not ready for download\n");
2796                         return -EIO;
2797                 }
2798         }
2799
2800         ret = mt7915_load_patch(dev);
2801         if (ret)
2802                 return ret;
2803
2804         ret = mt7915_load_ram(dev);
2805         if (ret)
2806                 return ret;
2807
2808         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2809                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2810                                        FW_STATE_WACPU_RDY), 1000)) {
2811                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2812                 return -EIO;
2813         }
2814
2815         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2816
2817         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2818
2819         return 0;
2820 }
2821
2822 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2823 {
2824         struct {
2825                 u8 ctrl_val;
2826                 u8 pad[3];
2827         } data = {
2828                 .ctrl_val = ctrl
2829         };
2830
2831         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_LOG_2_HOST, &data,
2832                                  sizeof(data), true);
2833 }
2834
2835 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2836 {
2837         struct {
2838                 u8 ver;
2839                 u8 pad;
2840                 __le16 len;
2841                 u8 level;
2842                 u8 rsv[3];
2843                 __le32 module_idx;
2844         } data = {
2845                 .module_idx = cpu_to_le32(module),
2846                 .level = level,
2847         };
2848
2849         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_FW_DBG_CTRL, &data,
2850                                  sizeof(data), false);
2851 }
2852
2853 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2854 {
2855         struct {
2856                 u8 enable;
2857                 u8 _rsv[3];
2858         } __packed req = {
2859                 .enable = enabled
2860         };
2861
2862         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MWDS_SUPPORT, &req,
2863                                  sizeof(req), false);
2864 }
2865
2866 int mt7915_mcu_init(struct mt7915_dev *dev)
2867 {
2868         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2869                 .headroom = sizeof(struct mt7915_mcu_txd),
2870                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2871                 .mcu_parse_response = mt7915_mcu_parse_response,
2872                 .mcu_restart = mt7915_mcu_restart,
2873         };
2874         int ret;
2875
2876         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2877
2878         ret = mt7915_driver_own(dev);
2879         if (ret)
2880                 return ret;
2881
2882         ret = mt7915_load_firmware(dev);
2883         if (ret)
2884                 return ret;
2885
2886         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2887         mt7915_mcu_fw_log_2_host(dev, 0);
2888         mt7915_mcu_set_mwds(dev, 1);
2889
2890         return 0;
2891 }
2892
2893 void mt7915_mcu_exit(struct mt7915_dev *dev)
2894 {
2895         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2896
2897         __mt76_mcu_restart(&dev->mt76);
2898         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2899                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2900                                        FW_STATE_FW_DOWNLOAD), 1000)) {
2901                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2902                 return;
2903         }
2904
2905         reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2906         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2907         skb_queue_purge(&dev->mt76.mcu.res_q);
2908 }
2909
2910 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2911                        bool enable, bool hdr_trans)
2912 {
2913         struct {
2914                 u8 operation;
2915                 u8 enable;
2916                 u8 check_bssid;
2917                 u8 insert_vlan;
2918                 u8 remove_vlan;
2919                 u8 tid;
2920                 u8 mode;
2921                 u8 rsv;
2922         } __packed req_trans = {
2923                 .enable = hdr_trans,
2924         };
2925         struct {
2926                 u8 enable;
2927                 u8 band;
2928                 u8 rsv[2];
2929         } __packed req_mac = {
2930                 .enable = enable,
2931                 .band = band,
2932         };
2933         int ret;
2934
2935         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RX_HDR_TRANS,
2936                                 &req_trans, sizeof(req_trans), false);
2937         if (ret)
2938                 return ret;
2939
2940         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_MAC_INIT_CTRL,
2941                                  &req_mac, sizeof(req_mac), true);
2942 }
2943
2944 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2945 {
2946         struct {
2947                 __le32 cmd;
2948                 u8 band;
2949                 u8 enable;
2950         } __packed req = {
2951                 .cmd = cpu_to_le32(SCS_ENABLE),
2952                 .band = band,
2953                 .enable = enable + 1,
2954         };
2955
2956         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SCS_CTRL, &req,
2957                                  sizeof(req), false);
2958 }
2959
2960 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2961 {
2962         struct mt7915_dev *dev = phy->dev;
2963         struct {
2964                 u8 prot_idx;
2965                 u8 band;
2966                 u8 rsv[2];
2967                 __le32 len_thresh;
2968                 __le32 pkt_thresh;
2969         } __packed req = {
2970                 .prot_idx = 1,
2971                 .band = phy != &dev->phy,
2972                 .len_thresh = cpu_to_le32(val),
2973                 .pkt_thresh = cpu_to_le32(0x2),
2974         };
2975
2976         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PROTECT_CTRL, &req,
2977                                  sizeof(req), true);
2978 }
2979
2980 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2981 {
2982 #define WMM_AIFS_SET            BIT(0)
2983 #define WMM_CW_MIN_SET          BIT(1)
2984 #define WMM_CW_MAX_SET          BIT(2)
2985 #define WMM_TXOP_SET            BIT(3)
2986 #define WMM_PARAM_SET           GENMASK(3, 0)
2987 #define TX_CMD_MODE             1
2988         struct edca {
2989                 u8 queue;
2990                 u8 set;
2991                 u8 aifs;
2992                 u8 cw_min;
2993                 __le16 cw_max;
2994                 __le16 txop;
2995         };
2996         struct mt7915_mcu_tx {
2997                 u8 total;
2998                 u8 action;
2999                 u8 valid;
3000                 u8 mode;
3001
3002                 struct edca edca[IEEE80211_NUM_ACS];
3003         } __packed req = {
3004                 .valid = true,
3005                 .mode = TX_CMD_MODE,
3006                 .total = IEEE80211_NUM_ACS,
3007         };
3008         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3009         int ac;
3010
3011         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3012                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3013                 struct edca *e = &req.edca[ac];
3014
3015                 e->set = WMM_PARAM_SET;
3016                 e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3017                 e->aifs = q->aifs;
3018                 e->txop = cpu_to_le16(q->txop);
3019
3020                 if (q->cw_min)
3021                         e->cw_min = fls(q->cw_min);
3022                 else
3023                         e->cw_min = 5;
3024
3025                 if (q->cw_max)
3026                         e->cw_max = cpu_to_le16(fls(q->cw_max));
3027                 else
3028                         e->cw_max = cpu_to_le16(10);
3029         }
3030         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EDCA_UPDATE, &req,
3031                                  sizeof(req), true);
3032 }
3033
3034 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3035 {
3036 #define ENTER_PM_STATE          1
3037 #define EXIT_PM_STATE           2
3038         struct {
3039                 u8 pm_number;
3040                 u8 pm_state;
3041                 u8 bssid[ETH_ALEN];
3042                 u8 dtim_period;
3043                 u8 wlan_idx_lo;
3044                 __le16 bcn_interval;
3045                 __le32 aid;
3046                 __le32 rx_filter;
3047                 u8 band_idx;
3048                 u8 wlan_idx_hi;
3049                 u8 rsv[2];
3050                 __le32 feature;
3051                 u8 omac_idx;
3052                 u8 wmm_idx;
3053                 u8 bcn_loss_cnt;
3054                 u8 bcn_sp_duration;
3055         } __packed req = {
3056                 .pm_number = 5,
3057                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3058                 .band_idx = band,
3059         };
3060
3061         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_PM_STATE_CTRL, &req,
3062                                  sizeof(req), true);
3063 }
3064
3065 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3066                        enum mt7915_rdd_cmd cmd, u8 index,
3067                        u8 rx_sel, u8 val)
3068 {
3069         struct {
3070                 u8 ctrl;
3071                 u8 rdd_idx;
3072                 u8 rdd_rx_sel;
3073                 u8 val;
3074                 u8 rsv[4];
3075         } __packed req = {
3076                 .ctrl = cmd,
3077                 .rdd_idx = index,
3078                 .rdd_rx_sel = rx_sel,
3079                 .val = val,
3080         };
3081
3082         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_CTRL, &req,
3083                                  sizeof(req), true);
3084 }
3085
3086 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3087 {
3088         struct {
3089                 __le32 tag;
3090                 __le16 min_lpn;
3091                 u8 rsv[2];
3092         } __packed req = {
3093                 .tag = cpu_to_le32(0x1),
3094                 .min_lpn = cpu_to_le16(val),
3095         };
3096
3097         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3098                                  sizeof(req), true);
3099 }
3100
3101 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3102                             const struct mt7915_dfs_pulse *pulse)
3103 {
3104         struct {
3105                 __le32 tag;
3106
3107                 __le32 max_width;               /* us */
3108                 __le32 max_pwr;                 /* dbm */
3109                 __le32 min_pwr;                 /* dbm */
3110                 __le32 min_stgr_pri;            /* us */
3111                 __le32 max_stgr_pri;            /* us */
3112                 __le32 min_cr_pri;              /* us */
3113                 __le32 max_cr_pri;              /* us */
3114         } __packed req = {
3115                 .tag = cpu_to_le32(0x3),
3116
3117 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3118                 __req_field(max_width),
3119                 __req_field(max_pwr),
3120                 __req_field(min_pwr),
3121                 __req_field(min_stgr_pri),
3122                 __req_field(max_stgr_pri),
3123                 __req_field(min_cr_pri),
3124                 __req_field(max_cr_pri),
3125 #undef __req_field
3126         };
3127
3128         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3129                                  sizeof(req), true);
3130 }
3131
3132 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3133                             const struct mt7915_dfs_pattern *pattern)
3134 {
3135         struct {
3136                 __le32 tag;
3137                 __le16 radar_type;
3138
3139                 u8 enb;
3140                 u8 stgr;
3141                 u8 min_crpn;
3142                 u8 max_crpn;
3143                 u8 min_crpr;
3144                 u8 min_pw;
3145                 __le32 min_pri;
3146                 __le32 max_pri;
3147                 u8 max_pw;
3148                 u8 min_crbn;
3149                 u8 max_crbn;
3150                 u8 min_stgpn;
3151                 u8 max_stgpn;
3152                 u8 min_stgpr;
3153                 u8 rsv[2];
3154                 __le32 min_stgpr_diff;
3155         } __packed req = {
3156                 .tag = cpu_to_le32(0x2),
3157                 .radar_type = cpu_to_le16(index),
3158
3159 #define __req_field_u8(field) .field = pattern->field
3160 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3161                 __req_field_u8(enb),
3162                 __req_field_u8(stgr),
3163                 __req_field_u8(min_crpn),
3164                 __req_field_u8(max_crpn),
3165                 __req_field_u8(min_crpr),
3166                 __req_field_u8(min_pw),
3167                 __req_field_u32(min_pri),
3168                 __req_field_u32(max_pri),
3169                 __req_field_u8(max_pw),
3170                 __req_field_u8(min_crbn),
3171                 __req_field_u8(max_crbn),
3172                 __req_field_u8(min_stgpn),
3173                 __req_field_u8(max_stgpn),
3174                 __req_field_u8(min_stgpr),
3175                 __req_field_u32(min_stgpr_diff),
3176 #undef __req_field_u8
3177 #undef __req_field_u32
3178         };
3179
3180         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_RDD_TH, &req,
3181                                  sizeof(req), true);
3182 }
3183
3184 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3185 {
3186         struct mt7915_dev *dev = phy->dev;
3187         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3188         int freq1 = chandef->center_freq1;
3189         bool ext_phy = phy != &dev->phy;
3190         struct {
3191                 u8 control_ch;
3192                 u8 center_ch;
3193                 u8 bw;
3194                 u8 tx_streams_num;
3195                 u8 rx_streams;  /* mask or num */
3196                 u8 switch_reason;
3197                 u8 band_idx;
3198                 u8 center_ch2;  /* for 80+80 only */
3199                 __le16 cac_case;
3200                 u8 channel_band;
3201                 u8 rsv0;
3202                 __le32 outband_freq;
3203                 u8 txpower_drop;
3204                 u8 ap_bw;
3205                 u8 ap_center_ch;
3206                 u8 rsv1[57];
3207         } __packed req = {
3208                 .control_ch = chandef->chan->hw_value,
3209                 .center_ch = ieee80211_frequency_to_channel(freq1),
3210                 .bw = mt7915_mcu_chan_bw(chandef),
3211                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
3212                 .rx_streams = phy->mt76->antenna_mask,
3213                 .band_idx = ext_phy,
3214                 .channel_band = chandef->chan->band,
3215         };
3216
3217 #ifdef CONFIG_NL80211_TESTMODE
3218         if (phy->mt76->test.tx_antenna_mask &&
3219             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3220              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES)) {
3221                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3222                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
3223
3224                 if (ext_phy) {
3225                         req.tx_streams_num = 2;
3226                         req.rx_streams >>= 2;
3227                 }
3228         }
3229 #endif
3230
3231         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3232                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3233         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3234                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3235                 req.switch_reason = CH_SWITCH_DFS;
3236         else
3237                 req.switch_reason = CH_SWITCH_NORMAL;
3238
3239         if (cmd == MCU_EXT_CMD_CHANNEL_SWITCH)
3240                 req.rx_streams = hweight8(req.rx_streams);
3241
3242         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3243                 int freq2 = chandef->center_freq2;
3244
3245                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3246         }
3247
3248         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3249 }
3250
3251 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3252 {
3253 #define TOTAL_PAGE_MASK         GENMASK(7, 5)
3254 #define PAGE_IDX_MASK           GENMASK(4, 2)
3255 #define PER_PAGE_SIZE           0x400
3256         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3257         u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;
3258         u8 *eep = (u8 *)dev->mt76.eeprom.data;
3259         int eep_len;
3260         int i;
3261
3262         for (i = 0; i <= total; i++, eep += eep_len) {
3263                 struct sk_buff *skb;
3264                 int ret;
3265
3266                 if (i == total)
3267                         eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3268                 else
3269                         eep_len = PER_PAGE_SIZE;
3270
3271                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3272                                          sizeof(req) + eep_len);
3273                 if (!skb)
3274                         return -ENOMEM;
3275
3276                 req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |
3277                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3278                 req.len = cpu_to_le16(eep_len);
3279
3280                 skb_put_data(skb, &req, sizeof(req));
3281                 skb_put_data(skb, eep, eep_len);
3282
3283                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3284                                             MCU_EXT_CMD_EFUSE_BUFFER_MODE, true);
3285                 if (ret)
3286                         return ret;
3287         }
3288
3289         return 0;
3290 }
3291
3292 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3293 {
3294         struct mt7915_mcu_eeprom req = {
3295                 .buffer_mode = EE_MODE_EFUSE,
3296                 .format = EE_FORMAT_WHOLE,
3297         };
3298
3299         if (dev->flash_mode)
3300                 return mt7915_mcu_set_eeprom_flash(dev);
3301
3302         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_BUFFER_MODE,
3303                                  &req, sizeof(req), true);
3304 }
3305
3306 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3307 {
3308         struct mt7915_mcu_eeprom_info req = {
3309                 .addr = cpu_to_le32(round_down(offset, 16)),
3310         };
3311         struct mt7915_mcu_eeprom_info *res;
3312         struct sk_buff *skb;
3313         int ret;
3314         u8 *buf;
3315
3316         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD_EFUSE_ACCESS, &req,
3317                                 sizeof(req), true, &skb);
3318         if (ret)
3319                 return ret;
3320
3321         res = (struct mt7915_mcu_eeprom_info *)skb->data;
3322         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3323         memcpy(buf, res->data, 16);
3324         dev_kfree_skb(skb);
3325
3326         return 0;
3327 }
3328
3329 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3330 {
3331         struct {
3332                 u8 ctrl_id;
3333                 u8 action;
3334                 u8 band;
3335                 u8 rsv[5];
3336         } req = {
3337                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3338                 .action = index,
3339         };
3340
3341         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_THERMAL_CTRL, &req,
3342                                  sizeof(req), true);
3343 }
3344
3345 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3346 {
3347         struct {
3348                 __le32 cmd;
3349                 __le16 wlan_idx;
3350                 __le16 ru_idx;
3351                 __le16 direction;
3352                 __le16 dump_group;
3353         } req = {
3354                 .cmd = cpu_to_le32(cmd),
3355                 .wlan_idx = cpu_to_le16(wlan_idx),
3356                 .dump_group = cpu_to_le16(1),
3357         };
3358
3359         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_RATE_CTRL, &req,
3360                                  sizeof(req), false);
3361 }
3362
3363 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3364 {
3365         struct mt7915_dev *dev = phy->dev;
3366         struct mt76_phy *mphy = phy->mt76;
3367         struct ieee80211_hw *hw = mphy->hw;
3368         struct mt7915_sku_val {
3369                 u8 format_id;
3370                 u8 limit_type;
3371                 u8 dbdc_idx;
3372                 s8 val[MT7915_SKU_RATE_NUM];
3373         } __packed req = {
3374                 .format_id = 4,
3375                 .dbdc_idx = phy != &dev->phy,
3376         };
3377         int i;
3378         s8 *delta;
3379
3380         delta = dev->rate_power[mphy->chandef.chan->band];
3381         mphy->txpower_cur = hw->conf.power_level * 2 +
3382                             delta[MT7915_SKU_MAX_DELTA_IDX];
3383
3384         for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3385                 req.val[i] = hw->conf.power_level * 2 + delta[i];
3386
3387         return mt76_mcu_send_msg(&dev->mt76,
3388                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
3389                                  sizeof(req), true);
3390 }
3391
3392 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3393                               u8 en)
3394 {
3395         struct {
3396                 u8 test_mode_en;
3397                 u8 param_idx;
3398                 u8 _rsv[2];
3399
3400                 u8 enable;
3401                 u8 _rsv2[3];
3402
3403                 u8 pad[8];
3404         } __packed req = {
3405                 .test_mode_en = test_mode,
3406                 .param_idx = param,
3407                 .enable = en,
3408         };
3409
3410         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_ATE_CTRL, &req,
3411                                  sizeof(req), false);
3412 }
3413
3414 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3415 {
3416         struct mt7915_dev *dev = phy->dev;
3417         struct mt7915_sku {
3418                 u8 format_id;
3419                 u8 sku_enable;
3420                 u8 dbdc_idx;
3421                 u8 rsv;
3422         } __packed req = {
3423                 .format_id = 0,
3424                 .dbdc_idx = phy != &dev->phy,
3425                 .sku_enable = enable,
3426         };
3427
3428         return mt76_mcu_send_msg(&dev->mt76,
3429                                  MCU_EXT_CMD_TX_POWER_FEATURE_CTRL, &req,
3430                                  sizeof(req), true);
3431 }
3432
3433 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3434 {
3435         struct {
3436                 u8 action;
3437                 u8 set;
3438                 u8 band;
3439                 u8 rsv;
3440         } req = {
3441                 .action = action,
3442                 .set = set,
3443                 .band = band,
3444         };
3445
3446         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SER_TRIGGER,
3447                                  &req, sizeof(req), false);
3448 }
3449
3450 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3451 {
3452 #define MT_BF_TYPE_UPDATE               20
3453         struct {
3454                 u8 action;
3455                 bool ebf;
3456                 bool ibf;
3457                 u8 rsv;
3458         } __packed req = {
3459                 .action = MT_BF_TYPE_UPDATE,
3460                 .ebf = true,
3461                 .ibf = false,
3462         };
3463
3464         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION, &req,
3465                                  sizeof(req), true);
3466 }
3467
3468 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3469 {
3470 #define MT_BF_PROCESSING                4
3471         struct {
3472                 u8 action;
3473                 u8 snd_mode;
3474                 u8 sta_num;
3475                 u8 rsv;
3476                 u8 wlan_idx[4];
3477                 __le32 snd_period;      /* ms */
3478         } __packed req = {
3479                 .action = true,
3480                 .snd_mode = MT_BF_PROCESSING,
3481         };
3482
3483         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_TXBF_ACTION, &req,
3484                                  sizeof(req), true);
3485 }
3486
3487 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3488                             bool enable)
3489 {
3490 #define MT_SPR_ENABLE           1
3491         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3492         struct {
3493                 u8 action;
3494                 u8 arg_num;
3495                 u8 band_idx;
3496                 u8 status;
3497                 u8 drop_tx_idx;
3498                 u8 sta_idx;     /* 256 sta */
3499                 u8 rsv[2];
3500                 __le32 val;
3501         } __packed req = {
3502                 .action = MT_SPR_ENABLE,
3503                 .arg_num = 1,
3504                 .band_idx = mvif->band_idx,
3505                 .val = cpu_to_le32(enable),
3506         };
3507
3508         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD_SET_SPR, &req,
3509                                  sizeof(req), true);
3510 }
3511
3512 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3513                            struct ieee80211_sta *sta, struct rate_info *rate)
3514 {
3515         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3516         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3517         struct mt7915_dev *dev = phy->dev;
3518         struct mt76_phy *mphy = phy->mt76;
3519         struct {
3520                 u8 category;
3521                 u8 band;
3522                 __le16 wcid;
3523         } __packed req = {
3524                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3525                 .band = mvif->band_idx,
3526                 .wcid = cpu_to_le16(msta->wcid.idx),
3527         };
3528         struct ieee80211_supported_band *sband;
3529         struct mt7915_mcu_phy_rx_info *res;
3530         struct sk_buff *skb;
3531         u16 flags = 0;
3532         int ret;
3533         int i;
3534
3535         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD_PHY_STAT_INFO,
3536                                         &req, sizeof(req), true, &skb);
3537         if (ret)
3538                 return ret;
3539
3540         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3541
3542         rate->mcs = res->rate;
3543         rate->nss = res->nsts + 1;
3544
3545         switch (res->mode) {
3546         case MT_PHY_TYPE_CCK:
3547         case MT_PHY_TYPE_OFDM:
3548                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3549                         sband = &mphy->sband_5g.sband;
3550                 else
3551                         sband = &mphy->sband_2g.sband;
3552
3553                 for (i = 0; i < sband->n_bitrates; i++) {
3554                         if (rate->mcs != (sband->bitrates[i].hw_value & 0xf))
3555                                 continue;
3556
3557                         rate->legacy = sband->bitrates[i].bitrate;
3558                         break;
3559                 }
3560                 break;
3561         case MT_PHY_TYPE_HT:
3562         case MT_PHY_TYPE_HT_GF:
3563                 if (rate->mcs > 31)
3564                         return -EINVAL;
3565
3566                 flags |= RATE_INFO_FLAGS_MCS;
3567
3568                 if (res->gi)
3569                         flags |= RATE_INFO_FLAGS_SHORT_GI;
3570                 break;
3571         case MT_PHY_TYPE_VHT:
3572                 flags |= RATE_INFO_FLAGS_VHT_MCS;
3573
3574                 if (res->gi)
3575                         flags |= RATE_INFO_FLAGS_SHORT_GI;
3576                 break;
3577         case MT_PHY_TYPE_HE_SU:
3578         case MT_PHY_TYPE_HE_EXT_SU:
3579         case MT_PHY_TYPE_HE_TB:
3580         case MT_PHY_TYPE_HE_MU:
3581                 rate->he_gi = res->gi;
3582
3583                 flags |= RATE_INFO_FLAGS_HE_MCS;
3584                 break;
3585         default:
3586                 break;
3587         }
3588         rate->flags = flags;
3589
3590         switch (res->bw) {
3591         case IEEE80211_STA_RX_BW_160:
3592                 rate->bw = RATE_INFO_BW_160;
3593                 break;
3594         case IEEE80211_STA_RX_BW_80:
3595                 rate->bw = RATE_INFO_BW_80;
3596                 break;
3597         case IEEE80211_STA_RX_BW_40:
3598                 rate->bw = RATE_INFO_BW_40;
3599                 break;
3600         default:
3601                 rate->bw = RATE_INFO_BW_20;
3602                 break;
3603         }
3604
3605         dev_kfree_skb(skb);
3606
3607         return 0;
3608 }