drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define fw_name(_dev, name, ...)        ({                      \
  68         char *_fw;                                              \
  69         switch (mt76_chip(&(_dev)->mt76)) {                     \
  70         case 0x7915:                                            \
  71                 _fw = MT7915_##name;                            \
  72                 break;                                          \
  73         case 0x7986:                                            \
  74                 _fw = MT7986_##name##__VA_ARGS__;               \
  75                 break;                                          \
  76         default:                                                \
  77                 _fw = MT7916_##name;                            \
  78                 break;                                          \
  79         }                                                       \
  80         _fw;                                                    \
  81 })
  82
  83 #define fw_name_var(_dev, name)         (mt7915_check_adie(dev, false) ?        \
  84                                          fw_name(_dev, name) :                  \
  85                                          fw_name(_dev, name, _MT7975))
  86
  87 #define MCU_PATCH_ADDRESS               0x200000
  88
  89 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  90 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  91
  92 static u8
  93 mt7915_mcu_get_sta_nss(u16 mcs_map)
  94 {
  95         u8 nss;
  96
  97         for (nss = 8; nss > 0; nss--) {
  98                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
  99
 100                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 101                         break;
 102         }
 103
 104         return nss - 1;
 105 }
 106
 107 static void
 108 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
 109                           u16 mcs_map)
 110 {
 111         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
 112         struct mt7915_dev *dev = msta->vif->phy->dev;
 113         enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
 114         const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
 115         int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
 116
 117         for (nss = 0; nss < max_nss; nss++) {
 118                 int mcs;
 119
 120                 switch ((mcs_map >> (2 * nss)) & 0x3) {
 121                 case IEEE80211_HE_MCS_SUPPORT_0_11:
 122                         mcs = GENMASK(11, 0);
 123                         break;
 124                 case IEEE80211_HE_MCS_SUPPORT_0_9:
 125                         mcs = GENMASK(9, 0);
 126                         break;
 127                 case IEEE80211_HE_MCS_SUPPORT_0_7:
 128                         mcs = GENMASK(7, 0);
 129                         break;
 130                 default:
 131                         mcs = 0;
 132                 }
 133
 134                 mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
 135
 136                 switch (mcs) {
 137                 case 0 ... 7:
 138                         mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
 139                         break;
 140                 case 8 ... 9:
 141                         mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
 142                         break;
 143                 case 10 ... 11:
 144                         mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
 145                         break;
 146                 default:
 147                         mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
 148                         break;
 149                 }
 150                 mcs_map &= ~(0x3 << (nss * 2));
 151                 mcs_map |= mcs << (nss * 2);
 152
 153                 /* only support 2ss on 160MHz for mt7915 */
 154                 if (is_mt7915(&dev->mt76) && nss > 1 &&
 155                     sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
 156                         break;
 157         }
 158
 159         *he_mcs = cpu_to_le16(mcs_map);
 160 }
 161
 162 static void
 163 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
 164                            const u16 *mask)
 165 {
 166         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
 167         struct mt7915_dev *dev = msta->vif->phy->dev;
 168         u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
 169         int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
 170         u16 mcs;
 171
 172         for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
 173                 switch (mcs_map & 0x3) {
 174                 case IEEE80211_VHT_MCS_SUPPORT_0_9:
 175                         mcs = GENMASK(9, 0);
 176                         break;
 177                 case IEEE80211_VHT_MCS_SUPPORT_0_8:
 178                         mcs = GENMASK(8, 0);
 179                         break;
 180                 case IEEE80211_VHT_MCS_SUPPORT_0_7:
 181                         mcs = GENMASK(7, 0);
 182                         break;
 183                 default:
 184                         mcs = 0;
 185                 }
 186
 187                 vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
 188
 189                 /* only support 2ss on 160MHz for mt7915 */
 190                 if (is_mt7915(&dev->mt76) && nss > 1 &&
 191                     sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
 192                         break;
 193         }
 194 }
 195
 196 static void
 197 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
 198                           const u8 *mask)
 199 {
 200         int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
 201
 202         for (nss = 0; nss < max_nss; nss++)
 203                 ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
 204 }
 205
 206 static int
 207 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 208                           struct sk_buff *skb, int seq)
 209 {
 210         struct mt7915_mcu_rxd *rxd;
 211         int ret = 0;
 212
 213         if (!skb) {
 214                 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 215                         cmd, seq);
 216                 return -ETIMEDOUT;
 217         }
 218
 219         rxd = (struct mt7915_mcu_rxd *)skb->data;
 220         if (seq != rxd->seq)
 221                 return -EAGAIN;
 222
 223         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 224                 skb_pull(skb, sizeof(*rxd) - 4);
 225                 ret = *skb->data;
 226         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 227                 skb_pull(skb, sizeof(*rxd) + 4);
 228                 ret = le32_to_cpu(*(__le32 *)skb->data);
 229         } else {
 230                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 231         }
 232
 233         return ret;
 234 }
 235
 236 static int
 237 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 238                         int cmd, int *wait_seq)
 239 {
 240         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 241         struct mt7915_mcu_txd *mcu_txd;
 242         enum mt76_mcuq_id qid;
 243         __le32 *txd;
 244         u32 val;
 245         u8 seq;
 246
 247         /* TODO: make dynamic based on msg type */
 248         mdev->mcu.timeout = 20 * HZ;
 249
 250         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 251         if (!seq)
 252                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 253
 254         if (cmd == MCU_CMD(FW_SCATTER)) {
 255                 qid = MT_MCUQ_FWDL;
 256                 goto exit;
 257         }
 258
 259         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 260         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 261                 qid = MT_MCUQ_WA;
 262         else
 263                 qid = MT_MCUQ_WM;
 264
 265         txd = mcu_txd->txd;
 266
 267         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 268               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 269               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 270         txd[0] = cpu_to_le32(val);
 271
 272         val = MT_TXD1_LONG_FORMAT |
 273               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 274         txd[1] = cpu_to_le32(val);
 275
 276         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 277         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 278                                                MT_TX_MCU_PORT_RX_Q0));
 279         mcu_txd->pkt_type = MCU_PKT_ID;
 280         mcu_txd->seq = seq;
 281
 282         mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 283         mcu_txd->set_query = MCU_Q_NA;
 284         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 285         if (mcu_txd->ext_cid) {
 286                 mcu_txd->ext_cid_ack = 1;
 287
 288                 /* do not use Q_SET for efuse */
 289                 if (cmd & __MCU_CMD_FIELD_QUERY)
 290                         mcu_txd->set_query = MCU_Q_QUERY;
 291                 else
 292                         mcu_txd->set_query = MCU_Q_SET;
 293         }
 294
 295         if (cmd & __MCU_CMD_FIELD_WA)
 296                 mcu_txd->s2d_index = MCU_S2D_H2C;
 297         else
 298                 mcu_txd->s2d_index = MCU_S2D_H2N;
 299
 300 exit:
 301         if (wait_seq)
 302                 *wait_seq = seq;
 303
 304         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
 305 }
 306
 307 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
 308 {
 309         struct {
 310                 __le32 args[3];
 311         } req = {
 312                 .args = {
 313                         cpu_to_le32(a1),
 314                         cpu_to_le32(a2),
 315                         cpu_to_le32(a3),
 316                 },
 317         };
 318
 319         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
 320 }
 321
 322 static void
 323 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 324 {
 325         if (vif->csa_active)
 326                 ieee80211_csa_finish(vif);
 327 }
 328
 329 static void
 330 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 331 {
 332         struct mt76_phy *mphy = &dev->mt76.phy;
 333         struct mt7915_mcu_csa_notify *c;
 334
 335         c = (struct mt7915_mcu_csa_notify *)skb->data;
 336
 337         if ((c->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 338                 mphy = dev->mt76.phy2;
 339
 340         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 341                         IEEE80211_IFACE_ITER_RESUME_ALL,
 342                         mt7915_mcu_csa_finish, mphy->hw);
 343 }
 344
 345 static void
 346 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 347 {
 348         struct mt76_phy *mphy = &dev->mt76.phy;
 349         struct mt7915_mcu_thermal_notify *t;
 350         struct mt7915_phy *phy;
 351
 352         t = (struct mt7915_mcu_thermal_notify *)skb->data;
 353         if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
 354                 return;
 355
 356         if ((t->ctrl.band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 357                 mphy = dev->mt76.phy2;
 358
 359         phy = (struct mt7915_phy *)mphy->priv;
 360         phy->throttle_state = t->ctrl.duty.duty_cycle;
 361 }
 362
 363 static void
 364 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 365 {
 366         struct mt76_phy *mphy = &dev->mt76.phy;
 367         struct mt7915_mcu_rdd_report *r;
 368
 369         r = (struct mt7915_mcu_rdd_report *)skb->data;
 370
 371         if ((r->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 372                 mphy = dev->mt76.phy2;
 373
 374         if (r->band_idx == MT_RX_SEL2)
 375                 cfg80211_background_radar_event(mphy->hw->wiphy,
 376                                                 &dev->rdd2_chandef,
 377                                                 GFP_ATOMIC);
 378         else
 379                 ieee80211_radar_detected(mphy->hw);
 380         dev->hw_pattern++;
 381 }
 382
 383 static void
 384 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 385 {
 386         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 387         const char *data = (char *)&rxd[1];
 388         const char *type;
 389         int len = skb->len - sizeof(*rxd);
 390
 391         switch (rxd->s2d_index) {
 392         case 0:
 393                 if (mt7915_debugfs_rx_log(dev, data, len))
 394                         return;
 395
 396                 type = "WM";
 397                 break;
 398         case 2:
 399                 type = "WA";
 400                 break;
 401         default:
 402                 type = "unknown";
 403                 break;
 404         }
 405
 406         wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
 407 }
 408
 409 static void
 410 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 411 {
 412         if (!vif->color_change_active)
 413                 return;
 414
 415         ieee80211_color_change_finish(vif);
 416 }
 417
 418 static void
 419 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 420 {
 421         struct mt76_phy *mphy = &dev->mt76.phy;
 422         struct mt7915_mcu_bcc_notify *b;
 423
 424         b = (struct mt7915_mcu_bcc_notify *)skb->data;
 425
 426         if ((b->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 427                 mphy = dev->mt76.phy2;
 428
 429         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 430                         IEEE80211_IFACE_ITER_RESUME_ALL,
 431                         mt7915_mcu_cca_finish, mphy->hw);
 432 }
 433
 434 static void
 435 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 436 {
 437         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 438
 439         switch (rxd->ext_eid) {
 440         case MCU_EXT_EVENT_THERMAL_PROTECT:
 441                 mt7915_mcu_rx_thermal_notify(dev, skb);
 442                 break;
 443         case MCU_EXT_EVENT_RDD_REPORT:
 444                 mt7915_mcu_rx_radar_detected(dev, skb);
 445                 break;
 446         case MCU_EXT_EVENT_CSA_NOTIFY:
 447                 mt7915_mcu_rx_csa_notify(dev, skb);
 448                 break;
 449         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 450                 mt7915_mcu_rx_log_message(dev, skb);
 451                 break;
 452         case MCU_EXT_EVENT_BCC_NOTIFY:
 453                 mt7915_mcu_rx_bcc_notify(dev, skb);
 454                 break;
 455         default:
 456                 break;
 457         }
 458 }
 459
 460 static void
 461 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 462 {
 463         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 464
 465         switch (rxd->eid) {
 466         case MCU_EVENT_EXT:
 467                 mt7915_mcu_rx_ext_event(dev, skb);
 468                 break;
 469         default:
 470                 break;
 471         }
 472         dev_kfree_skb(skb);
 473 }
 474
 475 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 476 {
 477         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 478
 479         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 480             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 481             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 482             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 483             rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
 484             !rxd->seq)
 485                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 486         else
 487                 mt76_mcu_rx_event(&dev->mt76, skb);
 488 }
 489
 490 static struct tlv *
 491 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 492                              __le16 *sub_ntlv, __le16 *len)
 493 {
 494         struct tlv *ptlv, tlv = {
 495                 .tag = cpu_to_le16(sub_tag),
 496                 .len = cpu_to_le16(sub_len),
 497         };
 498
 499         ptlv = skb_put(skb, sub_len);
 500         memcpy(ptlv, &tlv, sizeof(tlv));
 501
 502         le16_add_cpu(sub_ntlv, 1);
 503         le16_add_cpu(len, sub_len);
 504
 505         return ptlv;
 506 }
 507
 508 /** bss info **/
 509 struct mt7915_he_obss_narrow_bw_ru_data {
 510         bool tolerated;
 511 };
 512
 513 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 514                                                    struct cfg80211_bss *bss,
 515                                                    void *_data)
 516 {
 517         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 518         const struct element *elem;
 519
 520         rcu_read_lock();
 521         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 522
 523         if (!elem || elem->datalen <= 10 ||
 524             !(elem->data[10] &
 525               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 526                 data->tolerated = false;
 527
 528         rcu_read_unlock();
 529 }
 530
 531 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 532                                               struct ieee80211_vif *vif)
 533 {
 534         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 535                 .tolerated = true,
 536         };
 537
 538         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 539                 return false;
 540
 541         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 542                           mt7915_check_he_obss_narrow_bw_ru_iter,
 543                           &iter_data);
 544
 545         /*
 546          * If there is at least one AP on radar channel that cannot
 547          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 548          */
 549         return !iter_data.tolerated;
 550 }
 551
 552 static void
 553 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 554                         struct mt7915_phy *phy)
 555 {
 556         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 557         struct bss_info_rf_ch *ch;
 558         struct tlv *tlv;
 559         int freq1 = chandef->center_freq1;
 560
 561         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 562
 563         ch = (struct bss_info_rf_ch *)tlv;
 564         ch->pri_ch = chandef->chan->hw_value;
 565         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 566         ch->bw = mt76_connac_chan_bw(chandef);
 567
 568         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 569                 int freq2 = chandef->center_freq2;
 570
 571                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 572         }
 573
 574         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 575                 struct mt76_phy *mphy = phy->mt76;
 576
 577                 ch->he_ru26_block =
 578                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 579                 ch->he_all_disable = false;
 580         } else {
 581                 ch->he_all_disable = true;
 582         }
 583 }
 584
 585 static void
 586 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 587                       struct mt7915_phy *phy)
 588 {
 589         int max_nss = hweight8(phy->mt76->chainmask);
 590         struct bss_info_ra *ra;
 591         struct tlv *tlv;
 592
 593         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 594
 595         ra = (struct bss_info_ra *)tlv;
 596         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 597         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 598         ra->short_preamble = true;
 599         ra->tx_streams = max_nss;
 600         ra->rx_streams = max_nss;
 601         ra->algo = 4;
 602         ra->train_up_rule = 2;
 603         ra->train_up_high_thres = 110;
 604         ra->train_up_rule_rssi = -70;
 605         ra->low_traffic_thres = 2;
 606         ra->phy_cap = cpu_to_le32(0xfdf);
 607         ra->interval = cpu_to_le32(500);
 608         ra->fast_interval = cpu_to_le32(100);
 609 }
 610
 611 static void
 612 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 613                       struct mt7915_phy *phy)
 614 {
 615 #define DEFAULT_HE_PE_DURATION          4
 616 #define DEFAULT_HE_DURATION_RTS_THRES   1023
 617         const struct ieee80211_sta_he_cap *cap;
 618         struct bss_info_he *he;
 619         struct tlv *tlv;
 620
 621         cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
 622
 623         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 624
 625         he = (struct bss_info_he *)tlv;
 626         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
 627         if (!he->he_pe_duration)
 628                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 629
 630         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
 631         if (!he->he_rts_thres)
 632                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 633
 634         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 635         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 636         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 637 }
 638
 639 static void
 640 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
 641 {
 642 #define TXD_CMP_MAP1            GENMASK(15, 0)
 643 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
 644         struct bss_info_hw_amsdu *amsdu;
 645         struct tlv *tlv;
 646
 647         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
 648
 649         amsdu = (struct bss_info_hw_amsdu *)tlv;
 650         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
 651         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
 652         amsdu->trig_thres = cpu_to_le16(2);
 653         amsdu->enable = true;
 654 }
 655
 656 static void
 657 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
 658 {
 659         struct bss_info_bmc_rate *bmc;
 660         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 661         enum nl80211_band band = chandef->chan->band;
 662         struct tlv *tlv;
 663
 664         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
 665
 666         bmc = (struct bss_info_bmc_rate *)tlv;
 667         if (band == NL80211_BAND_2GHZ) {
 668                 bmc->short_preamble = true;
 669         } else {
 670                 bmc->bc_trans = cpu_to_le16(0x2000);
 671                 bmc->mc_trans = cpu_to_le16(0x2080);
 672         }
 673 }
 674
 675 static int
 676 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
 677                        bool bssid, bool enable)
 678 {
 679         struct mt7915_dev *dev = phy->dev;
 680         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 681         u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
 682         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
 683         const u8 *addr = vif->addr;
 684         struct {
 685                 u8 mode;
 686                 u8 force_clear;
 687                 u8 clear_bitmap[8];
 688                 u8 entry_count;
 689                 u8 write;
 690                 u8 band;
 691
 692                 u8 index;
 693                 u8 bssid;
 694                 u8 addr[ETH_ALEN];
 695         } __packed req = {
 696                 .mode = !!mask || enable,
 697                 .entry_count = 1,
 698                 .write = 1,
 699                 .band = phy != &dev->phy,
 700                 .index = idx * 2 + bssid,
 701         };
 702
 703         if (bssid)
 704                 addr = vif->bss_conf.bssid;
 705
 706         if (enable)
 707                 ether_addr_copy(req.addr, addr);
 708
 709         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
 710                                  sizeof(req), true);
 711 }
 712
 713 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
 714                             struct ieee80211_vif *vif, int enable)
 715 {
 716         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 717         struct mt7915_dev *dev = phy->dev;
 718         struct sk_buff *skb;
 719
 720         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
 721                 mt7915_mcu_muar_config(phy, vif, false, enable);
 722                 mt7915_mcu_muar_config(phy, vif, true, enable);
 723         }
 724
 725         skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
 726                                               MT7915_BSS_UPDATE_MAX_SIZE);
 727         if (IS_ERR(skb))
 728                 return PTR_ERR(skb);
 729
 730         /* bss_omac must be first */
 731         if (enable)
 732                 mt76_connac_mcu_bss_omac_tlv(skb, vif);
 733
 734         mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
 735                                       mvif->sta.wcid.idx, enable);
 736
 737         if (vif->type == NL80211_IFTYPE_MONITOR)
 738                 goto out;
 739
 740         if (enable) {
 741                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
 742                 mt7915_mcu_bss_bmc_tlv(skb, phy);
 743                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
 744                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
 745
 746                 if (vif->bss_conf.he_support)
 747                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
 748
 749                 if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
 750                     mvif->mt76.omac_idx < REPEATER_BSSID_START)
 751                         mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
 752         }
 753 out:
 754         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 755                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
 756 }
 757
 758 /** starec & wtbl **/
 759 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
 760                          struct ieee80211_ampdu_params *params,
 761                          bool enable)
 762 {
 763         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
 764         struct mt7915_vif *mvif = msta->vif;
 765
 766         if (enable && !params->amsdu)
 767                 msta->wcid.amsdu = false;
 768
 769         return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
 770                                       MCU_EXT_CMD(STA_REC_UPDATE),
 771                                       enable, true);
 772 }
 773
 774 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
 775                          struct ieee80211_ampdu_params *params,
 776                          bool enable)
 777 {
 778         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
 779         struct mt7915_vif *mvif = msta->vif;
 780
 781         return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
 782                                       MCU_EXT_CMD(STA_REC_UPDATE),
 783                                       enable, false);
 784 }
 785
 786 static void
 787 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
 788                       struct ieee80211_vif *vif)
 789 {
 790         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 791         struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
 792         struct ieee80211_he_mcs_nss_supp mcs_map;
 793         struct sta_rec_he *he;
 794         struct tlv *tlv;
 795         u32 cap = 0;
 796
 797         if (!sta->deflink.he_cap.has_he)
 798                 return;
 799
 800         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
 801
 802         he = (struct sta_rec_he *)tlv;
 803
 804         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
 805                 cap |= STA_REC_HE_CAP_HTC;
 806
 807         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
 808                 cap |= STA_REC_HE_CAP_BSR;
 809
 810         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
 811                 cap |= STA_REC_HE_CAP_OM;
 812
 813         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
 814                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
 815
 816         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
 817                 cap |= STA_REC_HE_CAP_BQR;
 818
 819         if (elem->phy_cap_info[0] &
 820             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
 821              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
 822                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
 823
 824         if (mvif->cap.he_ldpc &&
 825             (elem->phy_cap_info[1] &
 826              IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
 827                 cap |= STA_REC_HE_CAP_LDPC;
 828
 829         if (elem->phy_cap_info[1] &
 830             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
 831                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
 832
 833         if (elem->phy_cap_info[2] &
 834             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
 835                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
 836
 837         if (elem->phy_cap_info[2] &
 838             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
 839                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
 840
 841         if (elem->phy_cap_info[2] &
 842             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
 843                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
 844
 845         if (elem->phy_cap_info[6] &
 846             IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
 847                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
 848
 849         if (elem->phy_cap_info[6] &
 850             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
 851                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
 852
 853         if (elem->phy_cap_info[7] &
 854             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
 855                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
 856
 857         if (elem->phy_cap_info[7] &
 858             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
 859                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
 860
 861         if (elem->phy_cap_info[7] &
 862             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
 863                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
 864
 865         if (elem->phy_cap_info[8] &
 866             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
 867                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
 868
 869         if (elem->phy_cap_info[8] &
 870             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
 871                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
 872
 873         if (elem->phy_cap_info[9] &
 874             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
 875                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
 876
 877         if (elem->phy_cap_info[9] &
 878             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
 879                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
 880
 881         he->he_cap = cpu_to_le32(cap);
 882
 883         mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
 884         switch (sta->deflink.bandwidth) {
 885         case IEEE80211_STA_RX_BW_160:
 886                 if (elem->phy_cap_info[0] &
 887                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
 888                         mt7915_mcu_set_sta_he_mcs(sta,
 889                                                   &he->max_nss_mcs[CMD_HE_MCS_BW8080],
 890                                                   le16_to_cpu(mcs_map.rx_mcs_80p80));
 891
 892                 mt7915_mcu_set_sta_he_mcs(sta,
 893                                           &he->max_nss_mcs[CMD_HE_MCS_BW160],
 894                                           le16_to_cpu(mcs_map.rx_mcs_160));
 895                 fallthrough;
 896         default:
 897                 mt7915_mcu_set_sta_he_mcs(sta,
 898                                           &he->max_nss_mcs[CMD_HE_MCS_BW80],
 899                                           le16_to_cpu(mcs_map.rx_mcs_80));
 900                 break;
 901         }
 902
 903         he->t_frame_dur =
 904                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
 905         he->max_ampdu_exp =
 906                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
 907
 908         he->bw_set =
 909                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
 910         he->device_class =
 911                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
 912         he->punc_pream_rx =
 913                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
 914
 915         he->dcm_tx_mode =
 916                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
 917         he->dcm_tx_max_nss =
 918                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
 919         he->dcm_rx_mode =
 920                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
 921         he->dcm_rx_max_nss =
 922                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
 923         he->dcm_rx_max_nss =
 924                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
 925
 926         he->pkt_ext = 2;
 927 }
 928
 929 static void
 930 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
 931                         struct ieee80211_vif *vif)
 932 {
 933         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 934         struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
 935         struct sta_rec_muru *muru;
 936         struct tlv *tlv;
 937
 938         if (vif->type != NL80211_IFTYPE_STATION &&
 939             vif->type != NL80211_IFTYPE_AP)
 940                 return;
 941
 942         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
 943
 944         muru = (struct sta_rec_muru *)tlv;
 945
 946         muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
 947                                mvif->cap.vht_mu_ebfer ||
 948                                mvif->cap.vht_mu_ebfee;
 949         muru->cfg.mimo_ul_en = true;
 950         muru->cfg.ofdma_dl_en = true;
 951
 952         if (sta->deflink.vht_cap.vht_supported)
 953                 muru->mimo_dl.vht_mu_bfee =
 954                         !!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 955
 956         if (!sta->deflink.he_cap.has_he)
 957                 return;
 958
 959         muru->mimo_dl.partial_bw_dl_mimo =
 960                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
 961
 962         muru->mimo_ul.full_ul_mimo =
 963                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
 964         muru->mimo_ul.partial_ul_mimo =
 965                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
 966
 967         muru->ofdma_dl.punc_pream_rx =
 968                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
 969         muru->ofdma_dl.he_20m_in_40m_2g =
 970                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
 971         muru->ofdma_dl.he_20m_in_160m =
 972                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
 973         muru->ofdma_dl.he_80m_in_160m =
 974                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
 975
 976         muru->ofdma_ul.t_frame_dur =
 977                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
 978         muru->ofdma_ul.mu_cascading =
 979                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
 980         muru->ofdma_ul.uo_ra =
 981                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
 982 }
 983
 984 static void
 985 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 986 {
 987         struct sta_rec_ht *ht;
 988         struct tlv *tlv;
 989
 990         if (!sta->deflink.ht_cap.ht_supported)
 991                 return;
 992
 993         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
 994
 995         ht = (struct sta_rec_ht *)tlv;
 996         ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
 997 }
 998
 999 static void
1000 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1001 {
1002         struct sta_rec_vht *vht;
1003         struct tlv *tlv;
1004
1005         if (!sta->deflink.vht_cap.vht_supported)
1006                 return;
1007
1008         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1009
1010         vht = (struct sta_rec_vht *)tlv;
1011         vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
1012         vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
1013         vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
1014 }
1015
1016 static void
1017 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1018                          struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1019 {
1020         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1021         struct sta_rec_amsdu *amsdu;
1022         struct tlv *tlv;
1023
1024         if (vif->type != NL80211_IFTYPE_STATION &&
1025             vif->type != NL80211_IFTYPE_AP)
1026                 return;
1027
1028         if (!sta->max_amsdu_len)
1029             return;
1030
1031         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1032         amsdu = (struct sta_rec_amsdu *)tlv;
1033         amsdu->max_amsdu_num = 8;
1034         amsdu->amsdu_en = true;
1035         msta->wcid.amsdu = true;
1036
1037         switch (sta->max_amsdu_len) {
1038         case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1039                 if (!is_mt7915(&dev->mt76)) {
1040                         amsdu->max_mpdu_size =
1041                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1042                         return;
1043                 }
1044                 fallthrough;
1045         case IEEE80211_MAX_MPDU_LEN_HT_7935:
1046         case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1047                 amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1048                 return;
1049         default:
1050                 amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1051                 return;
1052         }
1053 }
1054
1055 static int
1056 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1057                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1058 {
1059         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1060         struct mt7915_sta *msta;
1061         struct wtbl_req_hdr *wtbl_hdr;
1062         struct mt76_wcid *wcid;
1063         struct tlv *tlv;
1064
1065         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1066         wcid = sta ? &msta->wcid : NULL;
1067
1068         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1069         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1070                                                   WTBL_RESET_AND_SET, tlv,
1071                                                   &skb);
1072         if (IS_ERR(wtbl_hdr))
1073                 return PTR_ERR(wtbl_hdr);
1074
1075         mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1076                                          wtbl_hdr);
1077         mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1078         if (sta)
1079                 mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1080                                             wtbl_hdr, mvif->cap.ht_ldpc,
1081                                             mvif->cap.vht_ldpc);
1082
1083         return 0;
1084 }
1085
1086 static inline bool
1087 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1088                         struct ieee80211_sta *sta, bool bfee)
1089 {
1090         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1091         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1092
1093         if (vif->type != NL80211_IFTYPE_STATION &&
1094             vif->type != NL80211_IFTYPE_AP)
1095                 return false;
1096
1097         if (!bfee && tx_ant < 2)
1098                 return false;
1099
1100         if (sta->deflink.he_cap.has_he) {
1101                 struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1102
1103                 if (bfee)
1104                         return mvif->cap.he_su_ebfee &&
1105                                HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1106                 else
1107                         return mvif->cap.he_su_ebfer &&
1108                                HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1109         }
1110
1111         if (sta->deflink.vht_cap.vht_supported) {
1112                 u32 cap = sta->deflink.vht_cap.cap;
1113
1114                 if (bfee)
1115                         return mvif->cap.vht_su_ebfee &&
1116                                (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1117                 else
1118                         return mvif->cap.vht_su_ebfer &&
1119                                (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1120         }
1121
1122         return false;
1123 }
1124
1125 static void
1126 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1127 {
1128         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1129         bf->ndp_rate = 0;                               /* mcs0 */
1130         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1131         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1132 }
1133
1134 static void
1135 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1136                        struct sta_rec_bf *bf)
1137 {
1138         struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1139         u8 n = 0;
1140
1141         bf->tx_mode = MT_PHY_TYPE_HT;
1142
1143         if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1144             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1145                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1146                               mcs->tx_params);
1147         else if (mcs->rx_mask[3])
1148                 n = 3;
1149         else if (mcs->rx_mask[2])
1150                 n = 2;
1151         else if (mcs->rx_mask[1])
1152                 n = 1;
1153
1154         bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1155         bf->ncol = min_t(u8, bf->nrow, n);
1156         bf->ibf_ncol = n;
1157 }
1158
1159 static void
1160 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1161                         struct sta_rec_bf *bf, bool explicit)
1162 {
1163         struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1164         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1165         u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1166         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1167         u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1168
1169         bf->tx_mode = MT_PHY_TYPE_VHT;
1170
1171         if (explicit) {
1172                 u8 sts, snd_dim;
1173
1174                 mt7915_mcu_sta_sounding_rate(bf);
1175
1176                 sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1177                                 pc->cap);
1178                 snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1179                                     vc->cap);
1180                 bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1181                 bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1182                 bf->ibf_ncol = bf->ncol;
1183
1184                 if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1185                         bf->nrow = 1;
1186         } else {
1187                 bf->nrow = tx_ant;
1188                 bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1189                 bf->ibf_ncol = nss_mcs;
1190
1191                 if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1192                         bf->ibf_nrow = 1;
1193         }
1194 }
1195
1196 static void
1197 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1198                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1199 {
1200         struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1201         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1202         const struct ieee80211_sta_he_cap *vc =
1203                 mt76_connac_get_he_phy_cap(phy->mt76, vif);
1204         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1205         u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1206         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1207         u8 snd_dim, sts;
1208
1209         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1210
1211         mt7915_mcu_sta_sounding_rate(bf);
1212
1213         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1214                                 pe->phy_cap_info[6]);
1215         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1216                                 pe->phy_cap_info[6]);
1217         snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1218                          ve->phy_cap_info[5]);
1219         sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1220                      pe->phy_cap_info[4]);
1221         bf->nrow = min_t(u8, snd_dim, sts);
1222         bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1223         bf->ibf_ncol = bf->ncol;
1224
1225         if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1226                 return;
1227
1228         /* go over for 160MHz and 80p80 */
1229         if (pe->phy_cap_info[0] &
1230             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1231                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1232                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1233
1234                 bf->ncol_bw160 = nss_mcs;
1235         }
1236
1237         if (pe->phy_cap_info[0] &
1238             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1239                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1240                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1241
1242                 if (bf->ncol_bw160)
1243                         bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1244                 else
1245                         bf->ncol_bw160 = nss_mcs;
1246         }
1247
1248         snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1249                          ve->phy_cap_info[5]);
1250         sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1251                      pe->phy_cap_info[4]);
1252
1253         bf->nrow_bw160 = min_t(int, snd_dim, sts);
1254 }
1255
1256 static void
1257 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1258                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1259 {
1260         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1261         struct mt7915_phy *phy = mvif->phy;
1262         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1263         struct sta_rec_bf *bf;
1264         struct tlv *tlv;
1265         const u8 matrix[4][4] = {
1266                 {0, 0, 0, 0},
1267                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
1268                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
1269                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
1270         };
1271         bool ebf;
1272
1273         if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1274                 return;
1275
1276         ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1277         if (!ebf && !dev->ibf)
1278                 return;
1279
1280         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1281         bf = (struct sta_rec_bf *)tlv;
1282
1283         /* he: eBF only, in accordance with spec
1284          * vht: support eBF and iBF
1285          * ht: iBF only, since mac80211 lacks of eBF support
1286          */
1287         if (sta->deflink.he_cap.has_he && ebf)
1288                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1289         else if (sta->deflink.vht_cap.vht_supported)
1290                 mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1291         else if (sta->deflink.ht_cap.ht_supported)
1292                 mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1293         else
1294                 return;
1295
1296         bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1297         bf->bw = sta->deflink.bandwidth;
1298         bf->ibf_dbw = sta->deflink.bandwidth;
1299         bf->ibf_nrow = tx_ant;
1300
1301         if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1302                 bf->ibf_timeout = 0x48;
1303         else
1304                 bf->ibf_timeout = 0x18;
1305
1306         if (ebf && bf->nrow != tx_ant)
1307                 bf->mem_20m = matrix[tx_ant][bf->ncol];
1308         else
1309                 bf->mem_20m = matrix[bf->nrow][bf->ncol];
1310
1311         switch (sta->deflink.bandwidth) {
1312         case IEEE80211_STA_RX_BW_160:
1313         case IEEE80211_STA_RX_BW_80:
1314                 bf->mem_total = bf->mem_20m * 2;
1315                 break;
1316         case IEEE80211_STA_RX_BW_40:
1317                 bf->mem_total = bf->mem_20m;
1318                 break;
1319         case IEEE80211_STA_RX_BW_20:
1320         default:
1321                 break;
1322         }
1323 }
1324
1325 static void
1326 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1327                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1328 {
1329         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1330         struct mt7915_phy *phy = mvif->phy;
1331         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1332         struct sta_rec_bfee *bfee;
1333         struct tlv *tlv;
1334         u8 nrow = 0;
1335
1336         if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1337                 return;
1338
1339         if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1340                 return;
1341
1342         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1343         bfee = (struct sta_rec_bfee *)tlv;
1344
1345         if (sta->deflink.he_cap.has_he) {
1346                 struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1347
1348                 nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1349                               pe->phy_cap_info[5]);
1350         } else if (sta->deflink.vht_cap.vht_supported) {
1351                 struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1352
1353                 nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1354                                  pc->cap);
1355         }
1356
1357         /* reply with identity matrix to avoid 2x2 BF negative gain */
1358         bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1359 }
1360
1361 static enum mcu_mmps_mode
1362 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1363 {
1364         switch (smps) {
1365         case IEEE80211_SMPS_OFF:
1366                 return MCU_MMPS_DISABLE;
1367         case IEEE80211_SMPS_STATIC:
1368                 return MCU_MMPS_STATIC;
1369         case IEEE80211_SMPS_DYNAMIC:
1370                 return MCU_MMPS_DYNAMIC;
1371         default:
1372                 return MCU_MMPS_DISABLE;
1373         }
1374 }
1375
1376 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1377                                    struct ieee80211_vif *vif,
1378                                    struct ieee80211_sta *sta,
1379                                    void *data, u32 field)
1380 {
1381         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1382         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1383         struct sta_phy *phy = data;
1384         struct sta_rec_ra_fixed *ra;
1385         struct sk_buff *skb;
1386         struct tlv *tlv;
1387
1388         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1389                                             &msta->wcid);
1390         if (IS_ERR(skb))
1391                 return PTR_ERR(skb);
1392
1393         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1394         ra = (struct sta_rec_ra_fixed *)tlv;
1395
1396         switch (field) {
1397         case RATE_PARAM_AUTO:
1398                 break;
1399         case RATE_PARAM_FIXED:
1400         case RATE_PARAM_FIXED_MCS:
1401         case RATE_PARAM_FIXED_GI:
1402         case RATE_PARAM_FIXED_HE_LTF:
1403                 if (phy)
1404                         ra->phy = *phy;
1405                 break;
1406         case RATE_PARAM_MMPS_UPDATE:
1407                 ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1408                 break;
1409         default:
1410                 break;
1411         }
1412         ra->field = cpu_to_le32(field);
1413
1414         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1415                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1416 }
1417
1418 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1419                         struct ieee80211_sta *sta)
1420 {
1421         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1422         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1423         struct wtbl_req_hdr *wtbl_hdr;
1424         struct tlv *sta_wtbl;
1425         struct sk_buff *skb;
1426         int ret;
1427
1428         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1429                                             &msta->wcid);
1430         if (IS_ERR(skb))
1431                 return PTR_ERR(skb);
1432
1433         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1434                                            sizeof(struct tlv));
1435         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1436                                                   WTBL_SET, sta_wtbl, &skb);
1437         if (IS_ERR(wtbl_hdr))
1438                 return PTR_ERR(wtbl_hdr);
1439
1440         mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1441
1442         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1443                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1444         if (ret)
1445                 return ret;
1446
1447         return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1448                                               RATE_PARAM_MMPS_UPDATE);
1449 }
1450
1451 static int
1452 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1453                                struct ieee80211_vif *vif,
1454                                struct ieee80211_sta *sta)
1455 {
1456         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1457         struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1458         struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1459         enum nl80211_band band = chandef->chan->band;
1460         struct sta_phy phy = {};
1461         int ret, nrates = 0;
1462
1463 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _he)                            \
1464         do {                                                                    \
1465                 u8 i, gi = mask->control[band]._gi;                             \
1466                 gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;               \
1467                 for (i = 0; i <= sta->deflink.bandwidth; i++) {                 \
1468                         phy.sgi |= gi << (i << (_he));                          \
1469                         phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1470                 }                                                               \
1471                 for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {    \
1472                         if (!mask->control[band]._mcs[i])                       \
1473                                 continue;                                       \
1474                         nrates += hweight16(mask->control[band]._mcs[i]);       \
1475                         phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;         \
1476                 }                                                               \
1477         } while (0)
1478
1479         if (sta->deflink.he_cap.has_he) {
1480                 __sta_phy_bitrate_mask_check(he_mcs, he_gi, 1);
1481         } else if (sta->deflink.vht_cap.vht_supported) {
1482                 __sta_phy_bitrate_mask_check(vht_mcs, gi, 0);
1483         } else if (sta->deflink.ht_cap.ht_supported) {
1484                 __sta_phy_bitrate_mask_check(ht_mcs, gi, 0);
1485         } else {
1486                 nrates = hweight32(mask->control[band].legacy);
1487                 phy.mcs = ffs(mask->control[band].legacy) - 1;
1488         }
1489 #undef __sta_phy_bitrate_mask_check
1490
1491         /* fall back to auto rate control */
1492         if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1493             mask->control[band].he_gi == GENMASK(7, 0) &&
1494             mask->control[band].he_ltf == GENMASK(7, 0) &&
1495             nrates != 1)
1496                 return 0;
1497
1498         /* fixed single rate */
1499         if (nrates == 1) {
1500                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1501                                                      RATE_PARAM_FIXED_MCS);
1502                 if (ret)
1503                         return ret;
1504         }
1505
1506         /* fixed GI */
1507         if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1508             mask->control[band].he_gi != GENMASK(7, 0)) {
1509                 struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1510                 u32 addr;
1511
1512                 /* firmware updates only TXCMD but doesn't take WTBL into
1513                  * account, so driver should update here to reflect the
1514                  * actual txrate hardware sends out.
1515                  */
1516                 addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1517                 if (sta->deflink.he_cap.has_he)
1518                         mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1519                 else
1520                         mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1521
1522                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1523                                                      RATE_PARAM_FIXED_GI);
1524                 if (ret)
1525                         return ret;
1526         }
1527
1528         /* fixed HE_LTF */
1529         if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1530                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1531                                                      RATE_PARAM_FIXED_HE_LTF);
1532                 if (ret)
1533                         return ret;
1534         }
1535
1536         return 0;
1537 }
1538
1539 static void
1540 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1541                              struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1542 {
1543         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1544         struct mt76_phy *mphy = mvif->phy->mt76;
1545         struct cfg80211_chan_def *chandef = &mphy->chandef;
1546         struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1547         enum nl80211_band band = chandef->chan->band;
1548         struct sta_rec_ra *ra;
1549         struct tlv *tlv;
1550         u32 supp_rate = sta->deflink.supp_rates[band];
1551         u32 cap = sta->wme ? STA_CAP_WMM : 0;
1552
1553         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1554         ra = (struct sta_rec_ra *)tlv;
1555
1556         ra->valid = true;
1557         ra->auto_rate = true;
1558         ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1559         ra->channel = chandef->chan->hw_value;
1560         ra->bw = sta->deflink.bandwidth;
1561         ra->phy.bw = sta->deflink.bandwidth;
1562         ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1563
1564         if (supp_rate) {
1565                 supp_rate &= mask->control[band].legacy;
1566                 ra->rate_len = hweight32(supp_rate);
1567
1568                 if (band == NL80211_BAND_2GHZ) {
1569                         ra->supp_mode = MODE_CCK;
1570                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1571
1572                         if (ra->rate_len > 4) {
1573                                 ra->supp_mode |= MODE_OFDM;
1574                                 ra->supp_ofdm_rate = supp_rate >> 4;
1575                         }
1576                 } else {
1577                         ra->supp_mode = MODE_OFDM;
1578                         ra->supp_ofdm_rate = supp_rate;
1579                 }
1580         }
1581
1582         if (sta->deflink.ht_cap.ht_supported) {
1583                 ra->supp_mode |= MODE_HT;
1584                 ra->af = sta->deflink.ht_cap.ampdu_factor;
1585                 ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1586
1587                 cap |= STA_CAP_HT;
1588                 if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1589                         cap |= STA_CAP_SGI_20;
1590                 if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1591                         cap |= STA_CAP_SGI_40;
1592                 if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1593                         cap |= STA_CAP_TX_STBC;
1594                 if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1595                         cap |= STA_CAP_RX_STBC;
1596                 if (mvif->cap.ht_ldpc &&
1597                     (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1598                         cap |= STA_CAP_LDPC;
1599
1600                 mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1601                                           mask->control[band].ht_mcs);
1602                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1603         }
1604
1605         if (sta->deflink.vht_cap.vht_supported) {
1606                 u8 af;
1607
1608                 ra->supp_mode |= MODE_VHT;
1609                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1610                                sta->deflink.vht_cap.cap);
1611                 ra->af = max_t(u8, ra->af, af);
1612
1613                 cap |= STA_CAP_VHT;
1614                 if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1615                         cap |= STA_CAP_VHT_SGI_80;
1616                 if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1617                         cap |= STA_CAP_VHT_SGI_160;
1618                 if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1619                         cap |= STA_CAP_VHT_TX_STBC;
1620                 if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1621                         cap |= STA_CAP_VHT_RX_STBC;
1622                 if (mvif->cap.vht_ldpc &&
1623                     (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1624                         cap |= STA_CAP_VHT_LDPC;
1625
1626                 mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1627                                            mask->control[band].vht_mcs);
1628         }
1629
1630         if (sta->deflink.he_cap.has_he) {
1631                 ra->supp_mode |= MODE_HE;
1632                 cap |= STA_CAP_HE;
1633
1634                 if (sta->deflink.he_6ghz_capa.capa)
1635                         ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1636                                                IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1637         }
1638
1639         ra->sta_cap = cpu_to_le32(cap);
1640 }
1641
1642 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1643                              struct ieee80211_sta *sta, bool changed)
1644 {
1645         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1646         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1647         struct sk_buff *skb;
1648         int ret;
1649
1650         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1651                                             &msta->wcid);
1652         if (IS_ERR(skb))
1653                 return PTR_ERR(skb);
1654
1655         /* firmware rc algorithm refers to sta_rec_he for HE control.
1656          * once dev->rc_work changes the settings driver should also
1657          * update sta_rec_he here.
1658          */
1659         if (changed)
1660                 mt7915_mcu_sta_he_tlv(skb, sta, vif);
1661
1662         /* sta_rec_ra accommodates BW, NSS and only MCS range format
1663          * i.e 0-{7,8,9} for VHT.
1664          */
1665         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1666
1667         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1668                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1669         if (ret)
1670                 return ret;
1671
1672         /* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1673          * and updates as peer fixed rate parameters, which overrides
1674          * sta_rec_ra and firmware rate control algorithm.
1675          */
1676         return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1677 }
1678
1679 static int
1680 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1681                      struct ieee80211_sta *sta)
1682 {
1683 #define MT_STA_BSS_GROUP                1
1684         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1685         struct mt7915_sta *msta;
1686         struct {
1687                 __le32 action;
1688                 u8 wlan_idx_lo;
1689                 u8 status;
1690                 u8 wlan_idx_hi;
1691                 u8 rsv0[5];
1692                 __le32 val;
1693                 u8 rsv1[8];
1694         } __packed req = {
1695                 .action = cpu_to_le32(MT_STA_BSS_GROUP),
1696                 .val = cpu_to_le32(mvif->mt76.idx % 16),
1697         };
1698
1699         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1700         req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1701         req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1702
1703         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1704                                  sizeof(req), true);
1705 }
1706
1707 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1708                        struct ieee80211_sta *sta, bool enable)
1709 {
1710         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1711         struct mt7915_sta *msta;
1712         struct sk_buff *skb;
1713         int ret;
1714
1715         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1716
1717         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1718                                             &msta->wcid);
1719         if (IS_ERR(skb))
1720                 return PTR_ERR(skb);
1721
1722         /* starec basic */
1723         mt76_connac_mcu_sta_basic_tlv(skb, vif, sta, enable, true);
1724         if (!enable)
1725                 goto out;
1726
1727         /* tag order is in accordance with firmware dependency. */
1728         if (sta) {
1729                 /* starec bfer */
1730                 mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1731                 /* starec ht */
1732                 mt7915_mcu_sta_ht_tlv(skb, sta);
1733                 /* starec vht */
1734                 mt7915_mcu_sta_vht_tlv(skb, sta);
1735                 /* starec uapsd */
1736                 mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1737         }
1738
1739         ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1740         if (ret) {
1741                 dev_kfree_skb(skb);
1742                 return ret;
1743         }
1744
1745         if (sta) {
1746                 /* starec amsdu */
1747                 mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1748                 /* starec he */
1749                 mt7915_mcu_sta_he_tlv(skb, sta, vif);
1750                 /* starec muru */
1751                 mt7915_mcu_sta_muru_tlv(skb, sta, vif);
1752                 /* starec bfee */
1753                 mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1754         }
1755
1756         ret = mt7915_mcu_add_group(dev, vif, sta);
1757         if (ret) {
1758                 dev_kfree_skb(skb);
1759                 return ret;
1760         }
1761 out:
1762         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1763                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1764 }
1765
1766 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1767                             struct ieee80211_vif *vif, bool enable)
1768 {
1769         struct mt7915_dev *dev = phy->dev;
1770         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1771         struct {
1772                 struct req_hdr {
1773                         u8 omac_idx;
1774                         u8 dbdc_idx;
1775                         __le16 tlv_num;
1776                         u8 is_tlv_append;
1777                         u8 rsv[3];
1778                 } __packed hdr;
1779                 struct req_tlv {
1780                         __le16 tag;
1781                         __le16 len;
1782                         u8 active;
1783                         u8 dbdc_idx;
1784                         u8 omac_addr[ETH_ALEN];
1785                 } __packed tlv;
1786         } data = {
1787                 .hdr = {
1788                         .omac_idx = mvif->mt76.omac_idx,
1789                         .dbdc_idx = mvif->mt76.band_idx,
1790                         .tlv_num = cpu_to_le16(1),
1791                         .is_tlv_append = 1,
1792                 },
1793                 .tlv = {
1794                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
1795                         .len = cpu_to_le16(sizeof(struct req_tlv)),
1796                         .active = enable,
1797                         .dbdc_idx = mvif->mt76.band_idx,
1798                 },
1799         };
1800
1801         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1802                 return mt7915_mcu_muar_config(phy, vif, false, enable);
1803
1804         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1805         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1806                                  &data, sizeof(data), true);
1807 }
1808
1809 static void
1810 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1811                          struct sk_buff *skb, struct bss_info_bcn *bcn,
1812                          struct ieee80211_mutable_offsets *offs)
1813 {
1814         struct bss_info_bcn_cntdwn *info;
1815         struct tlv *tlv;
1816         int sub_tag;
1817
1818         if (!offs->cntdwn_counter_offs[0])
1819                 return;
1820
1821         sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1822         tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1823                                            &bcn->sub_ntlv, &bcn->len);
1824         info = (struct bss_info_bcn_cntdwn *)tlv;
1825         info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1826 }
1827
1828 static void
1829 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1830                        struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1831                        struct ieee80211_mutable_offsets *offs)
1832 {
1833         struct bss_info_bcn_mbss *mbss;
1834         const struct element *elem;
1835         struct tlv *tlv;
1836
1837         if (!vif->bss_conf.bssid_indicator)
1838                 return;
1839
1840         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1841                                            sizeof(*mbss), &bcn->sub_ntlv,
1842                                            &bcn->len);
1843
1844         mbss = (struct bss_info_bcn_mbss *)tlv;
1845         mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1846         mbss->bitmap = cpu_to_le32(1);
1847
1848         for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1849                             &skb->data[offs->mbssid_off],
1850                             skb->len - offs->mbssid_off) {
1851                 const struct element *sub_elem;
1852
1853                 if (elem->datalen < 2)
1854                         continue;
1855
1856                 for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1857                         const struct ieee80211_bssid_index *idx;
1858                         const u8 *idx_ie;
1859
1860                         if (sub_elem->id || sub_elem->datalen < 4)
1861                                 continue; /* not a valid BSS profile */
1862
1863                         /* Find WLAN_EID_MULTI_BSSID_IDX
1864                          * in the merged nontransmitted profile
1865                          */
1866                         idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1867                                                   sub_elem->data,
1868                                                   sub_elem->datalen);
1869                         if (!idx_ie || idx_ie[1] < sizeof(*idx))
1870                                 continue;
1871
1872                         idx = (void *)(idx_ie + 2);
1873                         if (!idx->bssid_index || idx->bssid_index > 31)
1874                                 continue;
1875
1876                         mbss->offset[idx->bssid_index] =
1877                                 cpu_to_le16(idx_ie - skb->data);
1878                         mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1879                 }
1880         }
1881 }
1882
1883 static void
1884 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1885                        struct sk_buff *rskb, struct sk_buff *skb,
1886                        struct bss_info_bcn *bcn,
1887                        struct ieee80211_mutable_offsets *offs)
1888 {
1889         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1890         struct bss_info_bcn_cont *cont;
1891         struct tlv *tlv;
1892         u8 *buf;
1893         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1894
1895         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1896                                            len, &bcn->sub_ntlv, &bcn->len);
1897
1898         cont = (struct bss_info_bcn_cont *)tlv;
1899         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1900         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1901
1902         if (offs->cntdwn_counter_offs[0]) {
1903                 u16 offset = offs->cntdwn_counter_offs[0];
1904
1905                 if (vif->csa_active)
1906                         cont->csa_ofs = cpu_to_le16(offset - 4);
1907                 if (vif->color_change_active)
1908                         cont->bcc_ofs = cpu_to_le16(offset - 3);
1909         }
1910
1911         buf = (u8 *)tlv + sizeof(*cont);
1912         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
1913                               true);
1914         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1915 }
1916
1917 static void
1918 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1919                              struct sk_buff *skb)
1920 {
1921         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1922         struct mt7915_vif_cap *vc = &mvif->cap;
1923         const struct ieee80211_he_cap_elem *he;
1924         const struct ieee80211_vht_cap *vht;
1925         const struct ieee80211_ht_cap *ht;
1926         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1927         const u8 *ie;
1928         u32 len, bc;
1929
1930         /* Check missing configuration options to allow AP mode in mac80211
1931          * to remain in sync with hostapd settings, and get a subset of
1932          * beacon and hardware capabilities.
1933          */
1934         if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
1935                 return;
1936
1937         memset(vc, 0, sizeof(*vc));
1938
1939         len = skb->len - (mgmt->u.beacon.variable - skb->data);
1940
1941         ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
1942                               len);
1943         if (ie && ie[1] >= sizeof(*ht)) {
1944                 ht = (void *)(ie + 2);
1945                 vc->ht_ldpc = !!(le16_to_cpu(ht->cap_info) &
1946                                  IEEE80211_HT_CAP_LDPC_CODING);
1947         }
1948
1949         ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
1950                               len);
1951         if (ie && ie[1] >= sizeof(*vht)) {
1952                 u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
1953
1954                 vht = (void *)(ie + 2);
1955                 bc = le32_to_cpu(vht->vht_cap_info);
1956
1957                 vc->vht_ldpc = !!(bc & IEEE80211_VHT_CAP_RXLDPC);
1958                 vc->vht_su_ebfer =
1959                         (bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
1960                         (pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1961                 vc->vht_su_ebfee =
1962                         (bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
1963                         (pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1964                 vc->vht_mu_ebfer =
1965                         (bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
1966                         (pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
1967                 vc->vht_mu_ebfee =
1968                         (bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
1969                         (pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1970         }
1971
1972         ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
1973                                   mgmt->u.beacon.variable, len);
1974         if (ie && ie[1] >= sizeof(*he) + 1) {
1975                 const struct ieee80211_sta_he_cap *pc =
1976                         mt76_connac_get_he_phy_cap(phy->mt76, vif);
1977                 const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1978
1979                 he = (void *)(ie + 3);
1980
1981                 vc->he_ldpc =
1982                         HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
1983                 vc->he_su_ebfer =
1984                         HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
1985                         HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1986                 vc->he_su_ebfee =
1987                         HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
1988                         HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1989                 vc->he_mu_ebfer =
1990                         HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
1991                         HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
1992         }
1993 }
1994
1995 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
1996                           struct ieee80211_vif *vif, int en)
1997 {
1998 #define MAX_BEACON_SIZE 512
1999         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2000         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2001         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2002         struct ieee80211_mutable_offsets offs;
2003         struct ieee80211_tx_info *info;
2004         struct sk_buff *skb, *rskb;
2005         struct tlv *tlv;
2006         struct bss_info_bcn *bcn;
2007         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2008         bool ext_phy = phy != &dev->phy;
2009
2010         if (vif->bss_conf.nontransmitted)
2011                 return 0;
2012
2013         rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2014                                                NULL, len);
2015         if (IS_ERR(rskb))
2016                 return PTR_ERR(rskb);
2017
2018         tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2019         bcn = (struct bss_info_bcn *)tlv;
2020         bcn->enable = en;
2021
2022         if (!en)
2023                 goto out;
2024
2025         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2026         if (!skb)
2027                 return -EINVAL;
2028
2029         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2030                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2031                 dev_kfree_skb(skb);
2032                 return -EINVAL;
2033         }
2034
2035         if (ext_phy) {
2036                 info = IEEE80211_SKB_CB(skb);
2037                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2038         }
2039
2040         mt7915_mcu_beacon_check_caps(phy, vif, skb);
2041
2042         mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2043         mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2044         mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2045         dev_kfree_skb(skb);
2046
2047 out:
2048         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2049                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2050 }
2051
2052 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2053 {
2054         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2055         if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2056                             MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2057                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2058                 return -EIO;
2059         }
2060
2061         /* clear irq when the driver own success */
2062         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2063                 MT_TOP_LPCR_HOST_BAND_STAT);
2064
2065         return 0;
2066 }
2067
2068 static int mt7915_load_patch(struct mt7915_dev *dev)
2069 {
2070         const struct mt7915_patch_hdr *hdr;
2071         const struct firmware *fw = NULL;
2072         int i, ret, sem;
2073
2074         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 1);
2075         switch (sem) {
2076         case PATCH_IS_DL:
2077                 return 0;
2078         case PATCH_NOT_DL_SEM_SUCCESS:
2079                 break;
2080         default:
2081                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2082                 return -EAGAIN;
2083         }
2084
2085         ret = request_firmware(&fw, fw_name_var(dev, ROM_PATCH),
2086                                dev->mt76.dev);
2087         if (ret)
2088                 goto out;
2089
2090         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2091                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2092                 ret = -EINVAL;
2093                 goto out;
2094         }
2095
2096         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2097
2098         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2099                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2100
2101         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2102                 struct mt7915_patch_sec *sec;
2103                 const u8 *dl;
2104                 u32 len, addr;
2105
2106                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2107                                                   i * sizeof(*sec));
2108                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2109                     PATCH_SEC_TYPE_INFO) {
2110                         ret = -EINVAL;
2111                         goto out;
2112                 }
2113
2114                 addr = be32_to_cpu(sec->info.addr);
2115                 len = be32_to_cpu(sec->info.len);
2116                 dl = fw->data + be32_to_cpu(sec->offs);
2117
2118                 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2119                                                     DL_MODE_NEED_RSP);
2120                 if (ret) {
2121                         dev_err(dev->mt76.dev, "Download request failed\n");
2122                         goto out;
2123                 }
2124
2125                 ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2126                                                dl, len, 4096);
2127                 if (ret) {
2128                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2129                         goto out;
2130                 }
2131         }
2132
2133         ret = mt76_connac_mcu_start_patch(&dev->mt76);
2134         if (ret)
2135                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2136
2137 out:
2138         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 0);
2139         switch (sem) {
2140         case PATCH_REL_SEM_SUCCESS:
2141                 break;
2142         default:
2143                 ret = -EAGAIN;
2144                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2145                 break;
2146         }
2147         release_firmware(fw);
2148
2149         return ret;
2150 }
2151
2152 static int
2153 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2154                              const struct mt7915_fw_trailer *hdr,
2155                              const u8 *data, bool is_wa)
2156 {
2157         int i, offset = 0;
2158         u32 override = 0, option = 0;
2159
2160         for (i = 0; i < hdr->n_region; i++) {
2161                 const struct mt7915_fw_region *region;
2162                 int err;
2163                 u32 len, addr, mode;
2164
2165                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2166                          (hdr->n_region - i) * sizeof(*region));
2167                 mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
2168                                                    region->feature_set, is_wa);
2169                 len = le32_to_cpu(region->len);
2170                 addr = le32_to_cpu(region->addr);
2171
2172                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2173                         override = addr;
2174
2175                 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2176                                                     mode);
2177                 if (err) {
2178                         dev_err(dev->mt76.dev, "Download request failed\n");
2179                         return err;
2180                 }
2181
2182                 err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2183                                                data + offset, len, 4096);
2184                 if (err) {
2185                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2186                         return err;
2187                 }
2188
2189                 offset += len;
2190         }
2191
2192         if (override)
2193                 option |= FW_START_OVERRIDE;
2194
2195         if (is_wa)
2196                 option |= FW_START_WORKING_PDA_CR4;
2197
2198         return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
2199 }
2200
2201 static int mt7915_load_ram(struct mt7915_dev *dev)
2202 {
2203         const struct mt7915_fw_trailer *hdr;
2204         const struct firmware *fw;
2205         int ret;
2206
2207         ret = request_firmware(&fw, fw_name_var(dev, FIRMWARE_WM),
2208                                dev->mt76.dev);
2209         if (ret)
2210                 return ret;
2211
2212         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2213                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2214                 ret = -EINVAL;
2215                 goto out;
2216         }
2217
2218         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2219                                         sizeof(*hdr));
2220
2221         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2222                  hdr->fw_ver, hdr->build_date);
2223
2224         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2225         if (ret) {
2226                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2227                 goto out;
2228         }
2229
2230         release_firmware(fw);
2231
2232         ret = request_firmware(&fw, fw_name(dev, FIRMWARE_WA),
2233                                dev->mt76.dev);
2234         if (ret)
2235                 return ret;
2236
2237         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2238                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2239                 ret = -EINVAL;
2240                 goto out;
2241         }
2242
2243         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2244                                         sizeof(*hdr));
2245
2246         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2247                  hdr->fw_ver, hdr->build_date);
2248
2249         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2250         if (ret) {
2251                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2252                 goto out;
2253         }
2254
2255         snprintf(dev->mt76.hw->wiphy->fw_version,
2256                  sizeof(dev->mt76.hw->wiphy->fw_version),
2257                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2258
2259 out:
2260         release_firmware(fw);
2261
2262         return ret;
2263 }
2264
2265 static int
2266 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2267 {
2268         u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2269                                wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2270
2271         if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2272                             state, 1000)) {
2273                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2274                 return -EIO;
2275         }
2276         return 0;
2277 }
2278
2279 static int mt7915_load_firmware(struct mt7915_dev *dev)
2280 {
2281         int ret;
2282
2283         /* make sure fw is download state */
2284         if (mt7915_firmware_state(dev, false)) {
2285                 /* restart firmware once */
2286                 __mt76_mcu_restart(&dev->mt76);
2287                 ret = mt7915_firmware_state(dev, false);
2288                 if (ret) {
2289                         dev_err(dev->mt76.dev,
2290                                 "Firmware is not ready for download\n");
2291                         return ret;
2292                 }
2293         }
2294
2295         ret = mt7915_load_patch(dev);
2296         if (ret)
2297                 return ret;
2298
2299         ret = mt7915_load_ram(dev);
2300         if (ret)
2301                 return ret;
2302
2303         ret = mt7915_firmware_state(dev, true);
2304         if (ret)
2305                 return ret;
2306
2307         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2308
2309         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2310
2311         return 0;
2312 }
2313
2314 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2315 {
2316         struct {
2317                 u8 ctrl_val;
2318                 u8 pad[3];
2319         } data = {
2320                 .ctrl_val = ctrl
2321         };
2322
2323         if (type == MCU_FW_LOG_WA)
2324                 return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2325                                          &data, sizeof(data), true);
2326
2327         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2328                                  sizeof(data), true);
2329 }
2330
2331 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2332 {
2333         struct {
2334                 u8 ver;
2335                 u8 pad;
2336                 __le16 len;
2337                 u8 level;
2338                 u8 rsv[3];
2339                 __le32 module_idx;
2340         } data = {
2341                 .module_idx = cpu_to_le32(module),
2342                 .level = level,
2343         };
2344
2345         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2346                                  sizeof(data), false);
2347 }
2348
2349 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2350 {
2351         struct {
2352                 __le32 cmd;
2353                 u8 enable;
2354         } data = {
2355                 .cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2356                 .enable = enabled,
2357         };
2358
2359         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2360                                 sizeof(data), false);
2361 }
2362
2363 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2364 {
2365         struct mt7915_dev *dev = phy->dev;
2366         struct sk_buff *skb;
2367         struct mt7915_mcu_muru_stats *mu_stats =
2368                                 (struct mt7915_mcu_muru_stats *)ms;
2369         int ret;
2370
2371         struct {
2372                 __le32 cmd;
2373                 u8 band_idx;
2374         } req = {
2375                 .cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2376                 .band_idx = phy->band_idx,
2377         };
2378
2379         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2380                                         &req, sizeof(req), true, &skb);
2381         if (ret)
2382                 return ret;
2383
2384         memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2385         dev_kfree_skb(skb);
2386
2387         return 0;
2388 }
2389
2390 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2391 {
2392         struct {
2393                 u8 enable;
2394                 u8 _rsv[3];
2395         } __packed req = {
2396                 .enable = enabled
2397         };
2398
2399         return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2400                                  sizeof(req), false);
2401 }
2402
2403 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2404 {
2405         struct {
2406                 __le32 cmd;
2407                 u8 val[4];
2408         } __packed req = {
2409                 .cmd = cpu_to_le32(cmd),
2410         };
2411
2412         put_unaligned_le32(val, req.val);
2413
2414         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2415                                  sizeof(req), false);
2416 }
2417
2418 static int
2419 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2420 {
2421 #define RX_AIRTIME_FEATURE_CTRL         1
2422 #define RX_AIRTIME_BITWISE_CTRL         2
2423 #define RX_AIRTIME_CLEAR_EN     1
2424         struct {
2425                 __le16 field;
2426                 __le16 sub_field;
2427                 __le32 set_status;
2428                 __le32 get_status;
2429                 u8 _rsv[12];
2430
2431                 bool airtime_en;
2432                 bool mibtime_en;
2433                 bool earlyend_en;
2434                 u8 _rsv1[9];
2435
2436                 bool airtime_clear;
2437                 bool mibtime_clear;
2438                 u8 _rsv2[98];
2439         } __packed req = {
2440                 .field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2441                 .sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2442                 .airtime_clear = true,
2443         };
2444         int ret;
2445
2446         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2447                                 sizeof(req), true);
2448         if (ret)
2449                 return ret;
2450
2451         req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2452         req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2453         req.airtime_en = true;
2454
2455         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2456                                  sizeof(req), true);
2457 }
2458
2459 int mt7915_mcu_init(struct mt7915_dev *dev)
2460 {
2461         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2462                 .headroom = sizeof(struct mt7915_mcu_txd),
2463                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2464                 .mcu_parse_response = mt7915_mcu_parse_response,
2465                 .mcu_restart = mt76_connac_mcu_restart,
2466         };
2467         int ret;
2468
2469         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2470
2471         /* force firmware operation mode into normal state,
2472          * which should be set before firmware download stage.
2473          */
2474         mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2475
2476         ret = mt7915_driver_own(dev, 0);
2477         if (ret)
2478                 return ret;
2479         /* set driver own for band1 when two hif exist */
2480         if (dev->hif2) {
2481                 ret = mt7915_driver_own(dev, 1);
2482                 if (ret)
2483                         return ret;
2484         }
2485
2486         ret = mt7915_load_firmware(dev);
2487         if (ret)
2488                 return ret;
2489
2490         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2491         ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2492         if (ret)
2493                 return ret;
2494
2495         ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2496         if (ret)
2497                 return ret;
2498
2499         if (mtk_wed_device_active(&dev->mt76.mmio.wed))
2500                 mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2501
2502         ret = mt7915_mcu_set_mwds(dev, 1);
2503         if (ret)
2504                 return ret;
2505
2506         ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2507                                        MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2508         if (ret)
2509                 return ret;
2510
2511         ret = mt7915_mcu_init_rx_airtime(dev);
2512         if (ret)
2513                 return ret;
2514
2515         return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2516                                  MCU_WA_PARAM_RED, 0, 0);
2517 }
2518
2519 void mt7915_mcu_exit(struct mt7915_dev *dev)
2520 {
2521         __mt76_mcu_restart(&dev->mt76);
2522         if (mt7915_firmware_state(dev, false)) {
2523                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2524                 return;
2525         }
2526
2527         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2528         if (dev->hif2)
2529                 mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2530                         MT_TOP_LPCR_HOST_FW_OWN);
2531         skb_queue_purge(&dev->mt76.mcu.res_q);
2532 }
2533
2534 static int
2535 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2536 {
2537         struct {
2538                 u8 operation;
2539                 u8 count;
2540                 u8 _rsv[2];
2541                 u8 index;
2542                 u8 enable;
2543                 __le16 etype;
2544         } req = {
2545                 .operation = 1,
2546                 .count = 1,
2547                 .enable = 1,
2548                 .etype = cpu_to_le16(ETH_P_PAE),
2549         };
2550
2551         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2552                                  &req, sizeof(req), false);
2553 }
2554
2555 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2556                        bool enable, bool hdr_trans)
2557 {
2558         struct {
2559                 u8 operation;
2560                 u8 enable;
2561                 u8 check_bssid;
2562                 u8 insert_vlan;
2563                 u8 remove_vlan;
2564                 u8 tid;
2565                 u8 mode;
2566                 u8 rsv;
2567         } __packed req_trans = {
2568                 .enable = hdr_trans,
2569         };
2570         struct {
2571                 u8 enable;
2572                 u8 band;
2573                 u8 rsv[2];
2574         } __packed req_mac = {
2575                 .enable = enable,
2576                 .band = band,
2577         };
2578         int ret;
2579
2580         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2581                                 &req_trans, sizeof(req_trans), false);
2582         if (ret)
2583                 return ret;
2584
2585         if (hdr_trans)
2586                 mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2587
2588         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2589                                  &req_mac, sizeof(req_mac), true);
2590 }
2591
2592 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2593 {
2594         struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2595         u8 num = req->total;
2596         size_t len = sizeof(*req) -
2597                      (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2598
2599         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2600                                  len, true);
2601 }
2602
2603 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2604 {
2605 #define TX_CMD_MODE             1
2606         struct mt7915_mcu_tx req = {
2607                 .valid = true,
2608                 .mode = TX_CMD_MODE,
2609                 .total = IEEE80211_NUM_ACS,
2610         };
2611         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2612         int ac;
2613
2614         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2615                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2616                 struct edca *e = &req.edca[ac];
2617
2618                 e->set = WMM_PARAM_SET;
2619                 e->queue = ac + mvif->mt76.wmm_idx * MT7915_MAX_WMM_SETS;
2620                 e->aifs = q->aifs;
2621                 e->txop = cpu_to_le16(q->txop);
2622
2623                 if (q->cw_min)
2624                         e->cw_min = fls(q->cw_min);
2625                 else
2626                         e->cw_min = 5;
2627
2628                 if (q->cw_max)
2629                         e->cw_max = cpu_to_le16(fls(q->cw_max));
2630                 else
2631                         e->cw_max = cpu_to_le16(10);
2632         }
2633
2634         return mt7915_mcu_update_edca(dev, &req);
2635 }
2636
2637 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2638 {
2639         struct {
2640                 __le32 tag;
2641                 __le16 min_lpn;
2642                 u8 rsv[2];
2643         } __packed req = {
2644                 .tag = cpu_to_le32(0x1),
2645                 .min_lpn = cpu_to_le16(val),
2646         };
2647
2648         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2649                                  sizeof(req), true);
2650 }
2651
2652 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2653                             const struct mt7915_dfs_pulse *pulse)
2654 {
2655         struct {
2656                 __le32 tag;
2657
2658                 __le32 max_width;               /* us */
2659                 __le32 max_pwr;                 /* dbm */
2660                 __le32 min_pwr;                 /* dbm */
2661                 __le32 min_stgr_pri;            /* us */
2662                 __le32 max_stgr_pri;            /* us */
2663                 __le32 min_cr_pri;              /* us */
2664                 __le32 max_cr_pri;              /* us */
2665         } __packed req = {
2666                 .tag = cpu_to_le32(0x3),
2667
2668 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2669                 __req_field(max_width),
2670                 __req_field(max_pwr),
2671                 __req_field(min_pwr),
2672                 __req_field(min_stgr_pri),
2673                 __req_field(max_stgr_pri),
2674                 __req_field(min_cr_pri),
2675                 __req_field(max_cr_pri),
2676 #undef __req_field
2677         };
2678
2679         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2680                                  sizeof(req), true);
2681 }
2682
2683 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2684                             const struct mt7915_dfs_pattern *pattern)
2685 {
2686         struct {
2687                 __le32 tag;
2688                 __le16 radar_type;
2689
2690                 u8 enb;
2691                 u8 stgr;
2692                 u8 min_crpn;
2693                 u8 max_crpn;
2694                 u8 min_crpr;
2695                 u8 min_pw;
2696                 __le32 min_pri;
2697                 __le32 max_pri;
2698                 u8 max_pw;
2699                 u8 min_crbn;
2700                 u8 max_crbn;
2701                 u8 min_stgpn;
2702                 u8 max_stgpn;
2703                 u8 min_stgpr;
2704                 u8 rsv[2];
2705                 __le32 min_stgpr_diff;
2706         } __packed req = {
2707                 .tag = cpu_to_le32(0x2),
2708                 .radar_type = cpu_to_le16(index),
2709
2710 #define __req_field_u8(field) .field = pattern->field
2711 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2712                 __req_field_u8(enb),
2713                 __req_field_u8(stgr),
2714                 __req_field_u8(min_crpn),
2715                 __req_field_u8(max_crpn),
2716                 __req_field_u8(min_crpr),
2717                 __req_field_u8(min_pw),
2718                 __req_field_u32(min_pri),
2719                 __req_field_u32(max_pri),
2720                 __req_field_u8(max_pw),
2721                 __req_field_u8(min_crbn),
2722                 __req_field_u8(max_crbn),
2723                 __req_field_u8(min_stgpn),
2724                 __req_field_u8(max_stgpn),
2725                 __req_field_u8(min_stgpr),
2726                 __req_field_u32(min_stgpr_diff),
2727 #undef __req_field_u8
2728 #undef __req_field_u32
2729         };
2730
2731         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2732                                  sizeof(req), true);
2733 }
2734
2735 static int
2736 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2737                                  struct cfg80211_chan_def *chandef,
2738                                  int cmd)
2739 {
2740         struct mt7915_dev *dev = phy->dev;
2741         struct mt76_phy *mphy = phy->mt76;
2742         struct ieee80211_channel *chan = mphy->chandef.chan;
2743         int freq = mphy->chandef.center_freq1;
2744         struct mt7915_mcu_background_chain_ctrl req = {
2745                 .monitor_scan_type = 2, /* simple rx */
2746         };
2747
2748         if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2749                 return -EINVAL;
2750
2751         if (!cfg80211_chandef_valid(&mphy->chandef))
2752                 return -EINVAL;
2753
2754         switch (cmd) {
2755         case CH_SWITCH_BACKGROUND_SCAN_START: {
2756                 req.chan = chan->hw_value;
2757                 req.central_chan = ieee80211_frequency_to_channel(freq);
2758                 req.bw = mt76_connac_chan_bw(&mphy->chandef);
2759                 req.monitor_chan = chandef->chan->hw_value;
2760                 req.monitor_central_chan =
2761                         ieee80211_frequency_to_channel(chandef->center_freq1);
2762                 req.monitor_bw = mt76_connac_chan_bw(chandef);
2763                 req.band_idx = phy != &dev->phy;
2764                 req.scan_mode = 1;
2765                 break;
2766         }
2767         case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2768                 req.monitor_chan = chandef->chan->hw_value;
2769                 req.monitor_central_chan =
2770                         ieee80211_frequency_to_channel(chandef->center_freq1);
2771                 req.band_idx = phy != &dev->phy;
2772                 req.scan_mode = 2;
2773                 break;
2774         case CH_SWITCH_BACKGROUND_SCAN_STOP:
2775                 req.chan = chan->hw_value;
2776                 req.central_chan = ieee80211_frequency_to_channel(freq);
2777                 req.bw = mt76_connac_chan_bw(&mphy->chandef);
2778                 req.tx_stream = hweight8(mphy->antenna_mask);
2779                 req.rx_stream = mphy->antenna_mask;
2780                 break;
2781         default:
2782                 return -EINVAL;
2783         }
2784         req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2785
2786         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2787                                  &req, sizeof(req), false);
2788 }
2789
2790 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2791                                      struct cfg80211_chan_def *chandef)
2792 {
2793         struct mt7915_dev *dev = phy->dev;
2794         int err, region;
2795
2796         if (!chandef) { /* disable offchain */
2797                 err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2798                                               0, 0);
2799                 if (err)
2800                         return err;
2801
2802                 return mt7915_mcu_background_chain_ctrl(phy, NULL,
2803                                 CH_SWITCH_BACKGROUND_SCAN_STOP);
2804         }
2805
2806         err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2807                                                CH_SWITCH_BACKGROUND_SCAN_START);
2808         if (err)
2809                 return err;
2810
2811         switch (dev->mt76.region) {
2812         case NL80211_DFS_ETSI:
2813                 region = 0;
2814                 break;
2815         case NL80211_DFS_JP:
2816                 region = 2;
2817                 break;
2818         case NL80211_DFS_FCC:
2819         default:
2820                 region = 1;
2821                 break;
2822         }
2823
2824         return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2825                                        0, region);
2826 }
2827
2828 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2829 {
2830         static const u8 ch_band[] = {
2831                 [NL80211_BAND_2GHZ] = 0,
2832                 [NL80211_BAND_5GHZ] = 1,
2833                 [NL80211_BAND_6GHZ] = 2,
2834         };
2835         struct mt7915_dev *dev = phy->dev;
2836         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2837         int freq1 = chandef->center_freq1;
2838         struct {
2839                 u8 control_ch;
2840                 u8 center_ch;
2841                 u8 bw;
2842                 u8 tx_streams_num;
2843                 u8 rx_streams;  /* mask or num */
2844                 u8 switch_reason;
2845                 u8 band_idx;
2846                 u8 center_ch2;  /* for 80+80 only */
2847                 __le16 cac_case;
2848                 u8 channel_band;
2849                 u8 rsv0;
2850                 __le32 outband_freq;
2851                 u8 txpower_drop;
2852                 u8 ap_bw;
2853                 u8 ap_center_ch;
2854                 u8 rsv1[57];
2855         } __packed req = {
2856                 .control_ch = chandef->chan->hw_value,
2857                 .center_ch = ieee80211_frequency_to_channel(freq1),
2858                 .bw = mt76_connac_chan_bw(chandef),
2859                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
2860                 .rx_streams = phy->mt76->antenna_mask,
2861                 .band_idx = phy->band_idx,
2862                 .channel_band = ch_band[chandef->chan->band],
2863         };
2864
2865 #ifdef CONFIG_NL80211_TESTMODE
2866         if (phy->mt76->test.tx_antenna_mask &&
2867             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
2868              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
2869              phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
2870                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
2871                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
2872
2873                 if (phy != &dev->phy)
2874                         req.rx_streams >>= dev->chainshift;
2875         }
2876 #endif
2877
2878         if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2879             dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2880                 req.switch_reason = CH_SWITCH_NORMAL;
2881         else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2882                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2883         else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2884                                           NL80211_IFTYPE_AP))
2885                 req.switch_reason = CH_SWITCH_DFS;
2886         else
2887                 req.switch_reason = CH_SWITCH_NORMAL;
2888
2889         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2890                 req.rx_streams = hweight8(req.rx_streams);
2891
2892         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2893                 int freq2 = chandef->center_freq2;
2894
2895                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2896         }
2897
2898         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2899 }
2900
2901 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2902 {
2903 #define MAX_PAGE_IDX_MASK       GENMASK(7, 5)
2904 #define PAGE_IDX_MASK           GENMASK(4, 2)
2905 #define PER_PAGE_SIZE           0x400
2906         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2907         u16 eeprom_size = mt7915_eeprom_size(dev);
2908         u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2909         u8 *eep = (u8 *)dev->mt76.eeprom.data;
2910         int eep_len;
2911         int i;
2912
2913         for (i = 0; i < total; i++, eep += eep_len) {
2914                 struct sk_buff *skb;
2915                 int ret;
2916
2917                 if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2918                         eep_len = eeprom_size % PER_PAGE_SIZE;
2919                 else
2920                         eep_len = PER_PAGE_SIZE;
2921
2922                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2923                                          sizeof(req) + eep_len);
2924                 if (!skb)
2925                         return -ENOMEM;
2926
2927                 req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2928                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2929                 req.len = cpu_to_le16(eep_len);
2930
2931                 skb_put_data(skb, &req, sizeof(req));
2932                 skb_put_data(skb, eep, eep_len);
2933
2934                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2935                                             MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2936                 if (ret)
2937                         return ret;
2938         }
2939
2940         return 0;
2941 }
2942
2943 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2944 {
2945         struct mt7915_mcu_eeprom req = {
2946                 .buffer_mode = EE_MODE_EFUSE,
2947                 .format = EE_FORMAT_WHOLE,
2948         };
2949
2950         if (dev->flash_mode)
2951                 return mt7915_mcu_set_eeprom_flash(dev);
2952
2953         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2954                                  &req, sizeof(req), true);
2955 }
2956
2957 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2958 {
2959         struct mt7915_mcu_eeprom_info req = {
2960                 .addr = cpu_to_le32(round_down(offset,
2961                                     MT7915_EEPROM_BLOCK_SIZE)),
2962         };
2963         struct mt7915_mcu_eeprom_info *res;
2964         struct sk_buff *skb;
2965         int ret;
2966         u8 *buf;
2967
2968         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
2969                                 sizeof(req), true, &skb);
2970         if (ret)
2971                 return ret;
2972
2973         res = (struct mt7915_mcu_eeprom_info *)skb->data;
2974         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2975         memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2976         dev_kfree_skb(skb);
2977
2978         return 0;
2979 }
2980
2981 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2982 {
2983         struct {
2984                 u8 _rsv;
2985                 u8 version;
2986                 u8 die_idx;
2987                 u8 _rsv2;
2988         } __packed req = {
2989                 .version = 1,
2990         };
2991         struct sk_buff *skb;
2992         int ret;
2993
2994         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
2995                                         sizeof(req), true, &skb);
2996         if (ret)
2997                 return ret;
2998
2999         *block_num = *(u8 *)skb->data;
3000         dev_kfree_skb(skb);
3001
3002         return 0;
3003 }
3004
3005 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3006                                   u8 *data, u32 len, int cmd)
3007 {
3008         struct {
3009                 u8 dir;
3010                 u8 valid;
3011                 __le16 bitmap;
3012                 s8 precal;
3013                 u8 action;
3014                 u8 band;
3015                 u8 idx;
3016                 u8 rsv[4];
3017                 __le32 len;
3018         } req = {};
3019         struct sk_buff *skb;
3020
3021         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3022         if (!skb)
3023                 return -ENOMEM;
3024
3025         req.idx = idx;
3026         req.len = cpu_to_le32(len);
3027         skb_put_data(skb, &req, sizeof(req));
3028         skb_put_data(skb, data, len);
3029
3030         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3031 }
3032
3033 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3034 {
3035         u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3036         u32 total = MT_EE_CAL_GROUP_SIZE;
3037
3038         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3039                 return 0;
3040
3041         /*
3042          * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3043          * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3044          */
3045         while (total > 0) {
3046                 int ret, len;
3047
3048                 len = min_t(u32, total, MT_EE_CAL_UNIT);
3049
3050                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3051                                              MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3052                 if (ret)
3053                         return ret;
3054
3055                 total -= len;
3056                 cal += len;
3057                 idx++;
3058         }
3059
3060         return 0;
3061 }
3062
3063 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3064 {
3065         int i;
3066
3067         for (i = 0; i < n_freqs; i++)
3068                 if (cur == freqs[i])
3069                         return i;
3070
3071         return -1;
3072 }
3073
3074 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3075 {
3076         static const u16 freq_list[] = {
3077                 5180, 5200, 5220, 5240,
3078                 5260, 5280, 5300, 5320,
3079                 5500, 5520, 5540, 5560,
3080                 5580, 5600, 5620, 5640,
3081                 5660, 5680, 5700, 5745,
3082                 5765, 5785, 5805, 5825
3083         };
3084         int offset_2g = ARRAY_SIZE(freq_list);
3085         int idx;
3086
3087         if (freq < 4000) {
3088                 if (freq < 2432)
3089                         return offset_2g;
3090                 if (freq < 2457)
3091                         return offset_2g + 1;
3092
3093                 return offset_2g + 2;
3094         }
3095
3096         if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3097                 return -1;
3098
3099         if (bw != NL80211_CHAN_WIDTH_20) {
3100                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3101                                            freq + 10);
3102                 if (idx >= 0)
3103                         return idx;
3104
3105                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3106                                            freq - 10);
3107                 if (idx >= 0)
3108                         return idx;
3109         }
3110
3111         return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3112 }
3113
3114 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3115 {
3116         struct mt7915_dev *dev = phy->dev;
3117         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3118         u16 total = 2, center_freq = chandef->center_freq1;
3119         u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3120         int idx;
3121
3122         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3123                 return 0;
3124
3125         idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3126         if (idx < 0)
3127                 return -EINVAL;
3128
3129         /* Items: Tx DPD, Tx Flatness */
3130         idx = idx * 2;
3131         cal += MT_EE_CAL_GROUP_SIZE;
3132
3133         while (total--) {
3134                 int ret;
3135
3136                 cal += (idx * MT_EE_CAL_UNIT);
3137                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3138                                              MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3139                 if (ret)
3140                         return ret;
3141
3142                 idx++;
3143         }
3144
3145         return 0;
3146 }
3147
3148 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3149 {
3150         /* strict order */
3151         static const u32 offs[] = {
3152                 MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME,
3153                 MIB_BUSY_TIME_V2, MIB_TX_TIME_V2, MIB_RX_TIME_V2,
3154                 MIB_OBSS_AIRTIME_V2
3155         };
3156         struct mt76_channel_state *state = phy->mt76->chan_state;
3157         struct mt76_channel_state *state_ts = &phy->state_ts;
3158         struct mt7915_dev *dev = phy->dev;
3159         struct mt7915_mcu_mib *res, req[4];
3160         struct sk_buff *skb;
3161         int i, ret, start = 0, ofs = 20;
3162
3163         if (!is_mt7915(&dev->mt76)) {
3164                 start = 4;
3165                 ofs = 0;
3166         }
3167
3168         for (i = 0; i < 4; i++) {
3169                 req[i].band = cpu_to_le32(phy != &dev->phy);
3170                 req[i].offs = cpu_to_le32(offs[i + start]);
3171         }
3172
3173         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3174                                         req, sizeof(req), true, &skb);
3175         if (ret)
3176                 return ret;
3177
3178         res = (struct mt7915_mcu_mib *)(skb->data + ofs);
3179
3180         if (chan_switch)
3181                 goto out;
3182
3183 #define __res_u64(s) le64_to_cpu(res[s].data)
3184         state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3185         state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3186         state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3187         state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3188
3189 out:
3190         state_ts->cc_busy = __res_u64(0);
3191         state_ts->cc_tx = __res_u64(1);
3192         state_ts->cc_bss_rx = __res_u64(2);
3193         state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3194 #undef __res_u64
3195
3196         dev_kfree_skb(skb);
3197
3198         return 0;
3199 }
3200
3201 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3202 {
3203         struct mt7915_dev *dev = phy->dev;
3204         struct {
3205                 u8 ctrl_id;
3206                 u8 action;
3207                 u8 dbdc_idx;
3208                 u8 rsv[5];
3209         } req = {
3210                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3211                 .dbdc_idx = phy != &dev->phy,
3212         };
3213
3214         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3215                                  sizeof(req), true);
3216 }
3217
3218 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3219 {
3220         struct mt7915_dev *dev = phy->dev;
3221         struct {
3222                 struct mt7915_mcu_thermal_ctrl ctrl;
3223
3224                 __le32 trigger_temp;
3225                 __le32 restore_temp;
3226                 __le16 sustain_time;
3227                 u8 rsv[2];
3228         } __packed req = {
3229                 .ctrl = {
3230                         .band_idx = phy->band_idx,
3231                 },
3232         };
3233         int level;
3234
3235         if (!state) {
3236                 req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3237                 goto out;
3238         }
3239
3240         /* set duty cycle and level */
3241         for (level = 0; level < 4; level++) {
3242                 int ret;
3243
3244                 req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3245                 req.ctrl.duty.duty_level = level;
3246                 req.ctrl.duty.duty_cycle = state;
3247                 state /= 2;
3248
3249                 ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3250                                         &req, sizeof(req.ctrl), false);
3251                 if (ret)
3252                         return ret;
3253         }
3254
3255         /* set high-temperature trigger threshold */
3256         req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3257         /* add a safety margin ~10 */
3258         req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3259         req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3260         req.sustain_time = cpu_to_le16(10);
3261
3262 out:
3263         req.ctrl.type.protect_type = 1;
3264         req.ctrl.type.trigger_type = 1;
3265
3266         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3267                                  &req, sizeof(req), false);
3268 }
3269
3270 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3271 {
3272         struct mt7915_dev *dev = phy->dev;
3273         struct mt76_phy *mphy = phy->mt76;
3274         struct ieee80211_hw *hw = mphy->hw;
3275         struct mt7915_sku_val {
3276                 u8 format_id;
3277                 u8 limit_type;
3278                 u8 dbdc_idx;
3279                 s8 val[MT7915_SKU_RATE_NUM];
3280         } __packed req = {
3281                 .format_id = 4,
3282                 .dbdc_idx = phy != &dev->phy,
3283         };
3284         struct mt76_power_limits limits_array;
3285         s8 *la = (s8 *)&limits_array;
3286         int i, idx, n_chains = hweight8(mphy->antenna_mask);
3287         int tx_power = hw->conf.power_level * 2;
3288
3289         tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan,
3290                                       tx_power);
3291         tx_power -= mt76_tx_power_nss_delta(n_chains);
3292         tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3293                                               &limits_array, tx_power);
3294         mphy->txpower_cur = tx_power;
3295
3296         for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3297                 u8 mcs_num, len = mt7915_sku_group_len[i];
3298                 int j;
3299
3300                 if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3301                         mcs_num = 10;
3302
3303                         if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3304                                 la = (s8 *)&limits_array + 12;
3305                 } else {
3306                         mcs_num = len;
3307                 }
3308
3309                 for (j = 0; j < min_t(u8, mcs_num, len); j++)
3310                         req.val[idx + j] = la[j];
3311
3312                 la += mcs_num;
3313                 idx += len;
3314         }
3315
3316         return mt76_mcu_send_msg(&dev->mt76,
3317                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3318                                  sizeof(req), true);
3319 }
3320
3321 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3322 {
3323 #define RATE_POWER_INFO 2
3324         struct mt7915_dev *dev = phy->dev;
3325         struct {
3326                 u8 format_id;
3327                 u8 category;
3328                 u8 band;
3329                 u8 _rsv;
3330         } __packed req = {
3331                 .format_id = 7,
3332                 .category = RATE_POWER_INFO,
3333                 .band = phy != &dev->phy,
3334         };
3335         s8 res[MT7915_SKU_RATE_NUM][2];
3336         struct sk_buff *skb;
3337         int ret, i;
3338
3339         ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3340                                         MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3341                                         &req, sizeof(req), true, &skb);
3342         if (ret)
3343                 return ret;
3344
3345         memcpy(res, skb->data + 4, sizeof(res));
3346         for (i = 0; i < len; i++)
3347                 txpower[i] = res[i][req.band];
3348
3349         dev_kfree_skb(skb);
3350
3351         return 0;
3352 }
3353
3354 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3355                               u8 en)
3356 {
3357         struct {
3358                 u8 test_mode_en;
3359                 u8 param_idx;
3360                 u8 _rsv[2];
3361
3362                 u8 enable;
3363                 u8 _rsv2[3];
3364
3365                 u8 pad[8];
3366         } __packed req = {
3367                 .test_mode_en = test_mode,
3368                 .param_idx = param,
3369                 .enable = en,
3370         };
3371
3372         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3373                                  sizeof(req), false);
3374 }
3375
3376 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3377 {
3378         struct mt7915_dev *dev = phy->dev;
3379         struct mt7915_sku {
3380                 u8 format_id;
3381                 u8 sku_enable;
3382                 u8 dbdc_idx;
3383                 u8 rsv;
3384         } __packed req = {
3385                 .format_id = 0,
3386                 .dbdc_idx = phy != &dev->phy,
3387                 .sku_enable = enable,
3388         };
3389
3390         return mt76_mcu_send_msg(&dev->mt76,
3391                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3392                                  sizeof(req), true);
3393 }
3394
3395 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3396 {
3397         struct {
3398                 u8 action;
3399                 u8 set;
3400                 u8 band;
3401                 u8 rsv;
3402         } req = {
3403                 .action = action,
3404                 .set = set,
3405                 .band = band,
3406         };
3407
3408         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3409                                  &req, sizeof(req), false);
3410 }
3411
3412 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3413 {
3414         struct {
3415                 u8 action;
3416                 union {
3417                         struct {
3418                                 u8 snd_mode;
3419                                 u8 sta_num;
3420                                 u8 rsv;
3421                                 u8 wlan_idx[4];
3422                                 __le32 snd_period;      /* ms */
3423                         } __packed snd;
3424                         struct {
3425                                 bool ebf;
3426                                 bool ibf;
3427                                 u8 rsv;
3428                         } __packed type;
3429                         struct {
3430                                 u8 bf_num;
3431                                 u8 bf_bitmap;
3432                                 u8 bf_sel[8];
3433                                 u8 rsv[5];
3434                         } __packed mod;
3435                 };
3436         } __packed req = {
3437                 .action = action,
3438         };
3439
3440 #define MT_BF_PROCESSING        4
3441         switch (action) {
3442         case MT_BF_SOUNDING_ON:
3443                 req.snd.snd_mode = MT_BF_PROCESSING;
3444                 break;
3445         case MT_BF_TYPE_UPDATE:
3446                 req.type.ebf = true;
3447                 req.type.ibf = dev->ibf;
3448                 break;
3449         case MT_BF_MODULE_UPDATE:
3450                 req.mod.bf_num = 2;
3451                 req.mod.bf_bitmap = GENMASK(1, 0);
3452                 break;
3453         default:
3454                 return -EINVAL;
3455         }
3456
3457         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3458                                  sizeof(req), true);
3459 }
3460
3461 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3462                             bool enable)
3463 {
3464 #define MT_SPR_ENABLE           1
3465         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3466         struct {
3467                 u8 action;
3468                 u8 arg_num;
3469                 u8 band_idx;
3470                 u8 status;
3471                 u8 drop_tx_idx;
3472                 u8 sta_idx;     /* 256 sta */
3473                 u8 rsv[2];
3474                 __le32 val;
3475         } __packed req = {
3476                 .action = MT_SPR_ENABLE,
3477                 .arg_num = 1,
3478                 .band_idx = mvif->mt76.band_idx,
3479                 .val = cpu_to_le32(enable),
3480         };
3481
3482         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3483                                  sizeof(req), true);
3484 }
3485
3486 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3487                            struct ieee80211_sta *sta, struct rate_info *rate)
3488 {
3489         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3490         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3491         struct mt7915_dev *dev = phy->dev;
3492         struct mt76_phy *mphy = phy->mt76;
3493         struct {
3494                 u8 category;
3495                 u8 band;
3496                 __le16 wcid;
3497         } __packed req = {
3498                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3499                 .band = mvif->mt76.band_idx,
3500                 .wcid = cpu_to_le16(msta->wcid.idx),
3501         };
3502         struct ieee80211_supported_band *sband;
3503         struct mt7915_mcu_phy_rx_info *res;
3504         struct sk_buff *skb;
3505         int ret;
3506         bool cck = false;
3507
3508         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3509                                         &req, sizeof(req), true, &skb);
3510         if (ret)
3511                 return ret;
3512
3513         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3514
3515         rate->mcs = res->rate;
3516         rate->nss = res->nsts + 1;
3517
3518         switch (res->mode) {
3519         case MT_PHY_TYPE_CCK:
3520                 cck = true;
3521                 fallthrough;
3522         case MT_PHY_TYPE_OFDM:
3523                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3524                         sband = &mphy->sband_5g.sband;
3525                 else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3526                         sband = &mphy->sband_6g.sband;
3527                 else
3528                         sband = &mphy->sband_2g.sband;
3529
3530                 rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3531                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
3532                 break;
3533         case MT_PHY_TYPE_HT:
3534         case MT_PHY_TYPE_HT_GF:
3535                 if (rate->mcs > 31) {
3536                         ret = -EINVAL;
3537                         goto out;
3538                 }
3539
3540                 rate->flags = RATE_INFO_FLAGS_MCS;
3541                 if (res->gi)
3542                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3543                 break;
3544         case MT_PHY_TYPE_VHT:
3545                 if (rate->mcs > 9) {
3546                         ret = -EINVAL;
3547                         goto out;
3548                 }
3549
3550                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3551                 if (res->gi)
3552                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3553                 break;
3554         case MT_PHY_TYPE_HE_SU:
3555         case MT_PHY_TYPE_HE_EXT_SU:
3556         case MT_PHY_TYPE_HE_TB:
3557         case MT_PHY_TYPE_HE_MU:
3558                 if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3559                         ret = -EINVAL;
3560                         goto out;
3561                 }
3562                 rate->he_gi = res->gi;
3563                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
3564                 break;
3565         default:
3566                 ret = -EINVAL;
3567                 goto out;
3568         }
3569
3570         switch (res->bw) {
3571         case IEEE80211_STA_RX_BW_160:
3572                 rate->bw = RATE_INFO_BW_160;
3573                 break;
3574         case IEEE80211_STA_RX_BW_80:
3575                 rate->bw = RATE_INFO_BW_80;
3576                 break;
3577         case IEEE80211_STA_RX_BW_40:
3578                 rate->bw = RATE_INFO_BW_40;
3579                 break;
3580         default:
3581                 rate->bw = RATE_INFO_BW_20;
3582                 break;
3583         }
3584
3585 out:
3586         dev_kfree_skb(skb);
3587
3588         return ret;
3589 }
3590
3591 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3592                                 struct cfg80211_he_bss_color *he_bss_color)
3593 {
3594         int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3595         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3596         struct bss_info_color *bss_color;
3597         struct sk_buff *skb;
3598         struct tlv *tlv;
3599
3600         skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3601                                               NULL, len);
3602         if (IS_ERR(skb))
3603                 return PTR_ERR(skb);
3604
3605         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3606                                       sizeof(*bss_color));
3607         bss_color = (struct bss_info_color *)tlv;
3608         bss_color->disable = !he_bss_color->enabled;
3609         bss_color->color = he_bss_color->color;
3610
3611         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3612                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3613 }
3614
3615 #define TWT_AGRT_TRIGGER        BIT(0)
3616 #define TWT_AGRT_ANNOUNCE       BIT(1)
3617 #define TWT_AGRT_PROTECT        BIT(2)
3618
3619 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3620                                struct mt7915_vif *mvif,
3621                                struct mt7915_twt_flow *flow,
3622                                int cmd)
3623 {
3624         struct {
3625                 u8 tbl_idx;
3626                 u8 cmd;
3627                 u8 own_mac_idx;
3628                 u8 flowid; /* 0xff for group id */
3629                 __le16 peer_id; /* specify the peer_id (msb=0)
3630                                  * or group_id (msb=1)
3631                                  */
3632                 u8 duration; /* 256 us */
3633                 u8 bss_idx;
3634                 __le64 start_tsf;
3635                 __le16 mantissa;
3636                 u8 exponent;
3637                 u8 is_ap;
3638                 u8 agrt_params;
3639                 u8 rsv[23];
3640         } __packed req = {
3641                 .tbl_idx = flow->table_id,
3642                 .cmd = cmd,
3643                 .own_mac_idx = mvif->mt76.omac_idx,
3644                 .flowid = flow->id,
3645                 .peer_id = cpu_to_le16(flow->wcid),
3646                 .duration = flow->duration,
3647                 .bss_idx = mvif->mt76.idx,
3648                 .start_tsf = cpu_to_le64(flow->tsf),
3649                 .mantissa = flow->mantissa,
3650                 .exponent = flow->exp,
3651                 .is_ap = true,
3652         };
3653
3654         if (flow->protection)
3655                 req.agrt_params |= TWT_AGRT_PROTECT;
3656         if (!flow->flowtype)
3657                 req.agrt_params |= TWT_AGRT_ANNOUNCE;
3658         if (flow->trigger)
3659                 req.agrt_params |= TWT_AGRT_TRIGGER;
3660
3661         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3662                                  &req, sizeof(req), true);
3663 }
3664
3665 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3666 {
3667         struct {
3668                 __le32 idx;
3669                 __le32 ofs;
3670                 __le32 data;
3671         } __packed req = {
3672                 .idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 28))),
3673                 .ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(27, 0))),
3674                 .data = set ? cpu_to_le32(*val) : 0,
3675         };
3676         struct sk_buff *skb;
3677         int ret;
3678
3679         if (set)
3680                 return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3681                                          &req, sizeof(req), false);
3682
3683         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3684                                         &req, sizeof(req), true, &skb);
3685         if (ret)
3686                 return ret;
3687
3688         *val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3689         dev_kfree_skb(skb);
3690
3691         return 0;
3692 }