drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MCU_PATCH_ADDRESS               0x200000
  68
  69 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  70 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  71 #define FW_FEATURE_OVERRIDE_ADDR        BIT(5)
  72
  73 #define DL_MODE_ENCRYPT                 BIT(0)
  74 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  75 #define DL_MODE_RESET_SEC_IV            BIT(3)
  76 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  77 #define DL_MODE_NEED_RSP                BIT(31)
  78
  79 #define FW_START_OVERRIDE               BIT(0)
  80 #define FW_START_WORKING_PDA_CR4        BIT(2)
  81
  82 #define PATCH_SEC_TYPE_MASK             GENMASK(15, 0)
  83 #define PATCH_SEC_TYPE_INFO             0x2
  84
  85 #define to_wcid_lo(id)                  FIELD_GET(GENMASK(7, 0), (u16)id)
  86 #define to_wcid_hi(id)                  FIELD_GET(GENMASK(9, 8), (u16)id)
  87
  88 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  89 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  90
  91 static enum mt7915_cipher_type
  92 mt7915_mcu_get_cipher(int cipher)
  93 {
  94         switch (cipher) {
  95         case WLAN_CIPHER_SUITE_WEP40:
  96                 return MT_CIPHER_WEP40;
  97         case WLAN_CIPHER_SUITE_WEP104:
  98                 return MT_CIPHER_WEP104;
  99         case WLAN_CIPHER_SUITE_TKIP:
 100                 return MT_CIPHER_TKIP;
 101         case WLAN_CIPHER_SUITE_AES_CMAC:
 102                 return MT_CIPHER_BIP_CMAC_128;
 103         case WLAN_CIPHER_SUITE_CCMP:
 104                 return MT_CIPHER_AES_CCMP;
 105         case WLAN_CIPHER_SUITE_CCMP_256:
 106                 return MT_CIPHER_CCMP_256;
 107         case WLAN_CIPHER_SUITE_GCMP:
 108                 return MT_CIPHER_GCMP;
 109         case WLAN_CIPHER_SUITE_GCMP_256:
 110                 return MT_CIPHER_GCMP_256;
 111         case WLAN_CIPHER_SUITE_SMS4:
 112                 return MT_CIPHER_WAPI;
 113         default:
 114                 return MT_CIPHER_NONE;
 115         }
 116 }
 117
 118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
 119 {
 120         static const u8 width_to_bw[] = {
 121                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
 122                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
 123                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
 124                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
 125                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
 126                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
 127                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
 128                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
 129         };
 130
 131         if (chandef->width >= ARRAY_SIZE(width_to_bw))
 132                 return 0;
 133
 134         return width_to_bw[chandef->width];
 135 }
 136
 137 static const struct ieee80211_sta_he_cap *
 138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
 139 {
 140         struct ieee80211_supported_band *sband;
 141         enum nl80211_band band;
 142
 143         band = phy->mt76->chandef.chan->band;
 144         sband = phy->mt76->hw->wiphy->bands[band];
 145
 146         return ieee80211_get_he_iftype_cap(sband, vif->type);
 147 }
 148
 149 static u8
 150 mt7915_get_phy_mode(struct mt7915_dev *dev, struct ieee80211_vif *vif,
 151                     enum nl80211_band band, struct ieee80211_sta *sta)
 152 {
 153         struct ieee80211_sta_ht_cap *ht_cap;
 154         struct ieee80211_sta_vht_cap *vht_cap;
 155         const struct ieee80211_sta_he_cap *he_cap;
 156         u8 mode = 0;
 157
 158         if (sta) {
 159                 ht_cap = &sta->ht_cap;
 160                 vht_cap = &sta->vht_cap;
 161                 he_cap = &sta->he_cap;
 162         } else {
 163                 struct ieee80211_supported_band *sband;
 164                 struct mt7915_phy *phy;
 165                 struct mt7915_vif *mvif;
 166
 167                 mvif = (struct mt7915_vif *)vif->drv_priv;
 168                 phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
 169                 sband = phy->mt76->hw->wiphy->bands[band];
 170
 171                 ht_cap = &sband->ht_cap;
 172                 vht_cap = &sband->vht_cap;
 173                 he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
 174         }
 175
 176         if (band == NL80211_BAND_2GHZ) {
 177                 mode |= PHY_MODE_B | PHY_MODE_G;
 178
 179                 if (ht_cap->ht_supported)
 180                         mode |= PHY_MODE_GN;
 181
 182                 if (he_cap->has_he)
 183                         mode |= PHY_MODE_AX_24G;
 184         } else if (band == NL80211_BAND_5GHZ) {
 185                 mode |= PHY_MODE_A;
 186
 187                 if (ht_cap->ht_supported)
 188                         mode |= PHY_MODE_AN;
 189
 190                 if (vht_cap->vht_supported)
 191                         mode |= PHY_MODE_AC;
 192
 193                 if (he_cap->has_he)
 194                         mode |= PHY_MODE_AX_5G;
 195         }
 196
 197         return mode;
 198 }
 199
 200 static u8
 201 mt7915_mcu_get_sta_nss(u16 mcs_map)
 202 {
 203         u8 nss;
 204
 205         for (nss = 8; nss > 0; nss--) {
 206                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
 207
 208                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 209                         break;
 210         }
 211
 212         return nss - 1;
 213 }
 214
 215 static int
 216 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 217                           struct sk_buff *skb, int seq)
 218 {
 219         struct mt7915_mcu_rxd *rxd;
 220         int ret = 0;
 221
 222         if (!skb) {
 223                 dev_err(mdev->dev, "Message %d (seq %d) timeout\n",
 224                         cmd, seq);
 225                 return -ETIMEDOUT;
 226         }
 227
 228         rxd = (struct mt7915_mcu_rxd *)skb->data;
 229         if (seq != rxd->seq)
 230                 return -EAGAIN;
 231
 232         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 233                 skb_pull(skb, sizeof(*rxd) - 4);
 234                 ret = *skb->data;
 235         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 236                 skb_pull(skb, sizeof(*rxd) + 4);
 237                 ret = le32_to_cpu(*(__le32 *)skb->data);
 238         } else {
 239                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 240         }
 241
 242         return ret;
 243 }
 244
 245 static int
 246 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 247                         int cmd, int *wait_seq)
 248 {
 249         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 250         struct mt7915_mcu_txd *mcu_txd;
 251         enum mt76_mcuq_id qid;
 252         __le32 *txd;
 253         u32 val;
 254         u8 seq;
 255
 256         /* TODO: make dynamic based on msg type */
 257         mdev->mcu.timeout = 20 * HZ;
 258
 259         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 260         if (!seq)
 261                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 262
 263         if (cmd == MCU_CMD(FW_SCATTER)) {
 264                 qid = MT_MCUQ_FWDL;
 265                 goto exit;
 266         }
 267
 268         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 269         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 270                 qid = MT_MCUQ_WA;
 271         else
 272                 qid = MT_MCUQ_WM;
 273
 274         txd = mcu_txd->txd;
 275
 276         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 277               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 278               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 279         txd[0] = cpu_to_le32(val);
 280
 281         val = MT_TXD1_LONG_FORMAT |
 282               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 283         txd[1] = cpu_to_le32(val);
 284
 285         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 286         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 287                                                MT_TX_MCU_PORT_RX_Q0));
 288         mcu_txd->pkt_type = MCU_PKT_ID;
 289         mcu_txd->seq = seq;
 290
 291         mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 292         mcu_txd->set_query = MCU_Q_NA;
 293         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 294         if (mcu_txd->ext_cid) {
 295                 mcu_txd->ext_cid_ack = 1;
 296
 297                 /* do not use Q_SET for efuse */
 298                 if (cmd & __MCU_CMD_FIELD_QUERY)
 299                         mcu_txd->set_query = MCU_Q_QUERY;
 300                 else
 301                         mcu_txd->set_query = MCU_Q_SET;
 302         }
 303
 304         if (cmd & __MCU_CMD_FIELD_WA)
 305                 mcu_txd->s2d_index = MCU_S2D_H2C;
 306         else
 307                 mcu_txd->s2d_index = MCU_S2D_H2N;
 308
 309 exit:
 310         if (wait_seq)
 311                 *wait_seq = seq;
 312
 313         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
 314 }
 315
 316 static void
 317 mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
 318 {
 319         struct {
 320                 __le32 args[3];
 321         } req = {
 322                 .args = {
 323                         cpu_to_le32(a1),
 324                         cpu_to_le32(a2),
 325                         cpu_to_le32(a3),
 326                 },
 327         };
 328
 329         mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
 330 }
 331
 332 static void
 333 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 334 {
 335         if (vif->csa_active)
 336                 ieee80211_csa_finish(vif);
 337 }
 338
 339 static void
 340 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 341 {
 342         struct mt76_phy *mphy = &dev->mt76.phy;
 343         struct mt7915_mcu_rdd_report *r;
 344
 345         r = (struct mt7915_mcu_rdd_report *)skb->data;
 346
 347         if (r->idx && dev->mt76.phy2)
 348                 mphy = dev->mt76.phy2;
 349
 350         ieee80211_radar_detected(mphy->hw);
 351         dev->hw_pattern++;
 352 }
 353
 354 static void
 355 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
 356                          struct rate_info *rate, u16 r)
 357 {
 358         struct ieee80211_supported_band *sband;
 359         u16 ru_idx = le16_to_cpu(ra->ru_idx);
 360         u16 flags = 0;
 361
 362         rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
 363         rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
 364
 365         switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
 366         case MT_PHY_TYPE_CCK:
 367         case MT_PHY_TYPE_OFDM:
 368                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
 369                         sband = &mphy->sband_5g.sband;
 370                 else
 371                         sband = &mphy->sband_2g.sband;
 372
 373                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
 374                 break;
 375         case MT_PHY_TYPE_HT:
 376         case MT_PHY_TYPE_HT_GF:
 377                 rate->mcs += (rate->nss - 1) * 8;
 378                 flags |= RATE_INFO_FLAGS_MCS;
 379
 380                 if (ra->gi)
 381                         flags |= RATE_INFO_FLAGS_SHORT_GI;
 382                 break;
 383         case MT_PHY_TYPE_VHT:
 384                 flags |= RATE_INFO_FLAGS_VHT_MCS;
 385
 386                 if (ra->gi)
 387                         flags |= RATE_INFO_FLAGS_SHORT_GI;
 388                 break;
 389         case MT_PHY_TYPE_HE_SU:
 390         case MT_PHY_TYPE_HE_EXT_SU:
 391         case MT_PHY_TYPE_HE_TB:
 392         case MT_PHY_TYPE_HE_MU:
 393                 rate->he_gi = ra->gi;
 394                 rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
 395
 396                 flags |= RATE_INFO_FLAGS_HE_MCS;
 397                 break;
 398         default:
 399                 break;
 400         }
 401         rate->flags = flags;
 402
 403         if (ru_idx) {
 404                 switch (ru_idx) {
 405                 case 1 ... 2:
 406                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
 407                         break;
 408                 case 3 ... 6:
 409                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
 410                         break;
 411                 case 7 ... 14:
 412                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
 413                         break;
 414                 default:
 415                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
 416                         break;
 417                 }
 418                 rate->bw = RATE_INFO_BW_HE_RU;
 419         } else {
 420                 u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
 421                         FIELD_GET(MT_RA_RATE_BW, r);
 422
 423                 switch (bw) {
 424                 case IEEE80211_STA_RX_BW_160:
 425                         rate->bw = RATE_INFO_BW_160;
 426                         break;
 427                 case IEEE80211_STA_RX_BW_80:
 428                         rate->bw = RATE_INFO_BW_80;
 429                         break;
 430                 case IEEE80211_STA_RX_BW_40:
 431                         rate->bw = RATE_INFO_BW_40;
 432                         break;
 433                 default:
 434                         rate->bw = RATE_INFO_BW_20;
 435                         break;
 436                 }
 437         }
 438 }
 439
 440 static void
 441 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
 442 {
 443         struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
 444         struct rate_info rate = {}, prob_rate = {};
 445         u16 probe = le16_to_cpu(ra->prob_up_rate);
 446         u16 attempts = le16_to_cpu(ra->attempts);
 447         u16 curr = le16_to_cpu(ra->curr_rate);
 448         u16 wcidx = le16_to_cpu(ra->wlan_idx);
 449         struct mt76_phy *mphy = &dev->mphy;
 450         struct mt7915_sta_stats *stats;
 451         struct mt7915_sta *msta;
 452         struct mt76_wcid *wcid;
 453
 454         if (wcidx >= MT76_N_WCIDS)
 455                 return;
 456
 457         wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
 458         if (!wcid)
 459                 return;
 460
 461         msta = container_of(wcid, struct mt7915_sta, wcid);
 462         stats = &msta->stats;
 463
 464         if (msta->wcid.ext_phy && dev->mt76.phy2)
 465                 mphy = dev->mt76.phy2;
 466
 467         /* current rate */
 468         mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr);
 469         stats->tx_rate = rate;
 470
 471         /* probing rate */
 472         mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe);
 473         stats->prob_rate = prob_rate;
 474
 475         if (attempts) {
 476                 u16 success = le16_to_cpu(ra->success);
 477
 478                 stats->per = 1000 * (attempts - success) / attempts;
 479         }
 480 }
 481
 482 static void
 483 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 484 {
 485         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 486         const char *data = (char *)&rxd[1];
 487         const char *type;
 488
 489         switch (rxd->s2d_index) {
 490         case 0:
 491                 type = "WM";
 492                 break;
 493         case 2:
 494                 type = "WA";
 495                 break;
 496         default:
 497                 type = "unknown";
 498                 break;
 499         }
 500
 501         wiphy_info(mt76_hw(dev)->wiphy, "%s: %s", type, data);
 502 }
 503
 504 static void
 505 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 506 {
 507         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 508
 509         switch (rxd->ext_eid) {
 510         case MCU_EXT_EVENT_RDD_REPORT:
 511                 mt7915_mcu_rx_radar_detected(dev, skb);
 512                 break;
 513         case MCU_EXT_EVENT_CSA_NOTIFY:
 514                 ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
 515                                 IEEE80211_IFACE_ITER_RESUME_ALL,
 516                                 mt7915_mcu_csa_finish, dev);
 517                 break;
 518         case MCU_EXT_EVENT_RATE_REPORT:
 519                 mt7915_mcu_tx_rate_report(dev, skb);
 520                 break;
 521         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 522                 mt7915_mcu_rx_log_message(dev, skb);
 523                 break;
 524         default:
 525                 break;
 526         }
 527 }
 528
 529 static void
 530 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 531 {
 532         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 533
 534         switch (rxd->eid) {
 535         case MCU_EVENT_EXT:
 536                 mt7915_mcu_rx_ext_event(dev, skb);
 537                 break;
 538         default:
 539                 break;
 540         }
 541         dev_kfree_skb(skb);
 542 }
 543
 544 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 545 {
 546         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 547
 548         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 549             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 550             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 551             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 552             rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 553             !rxd->seq)
 554                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 555         else
 556                 mt76_mcu_rx_event(&dev->mt76, skb);
 557 }
 558
 559 static struct sk_buff *
 560 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
 561                          struct mt7915_sta *msta, int len)
 562 {
 563         struct sta_req_hdr hdr = {
 564                 .bss_idx = mvif->idx,
 565                 .wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
 566                 .wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
 567                 .muar_idx = msta ? mvif->omac_idx : 0,
 568                 .is_tlv_append = 1,
 569         };
 570         struct sk_buff *skb;
 571
 572         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
 573         if (!skb)
 574                 return ERR_PTR(-ENOMEM);
 575
 576         skb_put_data(skb, &hdr, sizeof(hdr));
 577
 578         return skb;
 579 }
 580
 581 static struct wtbl_req_hdr *
 582 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
 583                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 584 {
 585         struct tlv *sta_hdr = sta_wtbl;
 586         struct wtbl_req_hdr hdr = {
 587                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
 588                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
 589                 .operation = cmd,
 590         };
 591         struct sk_buff *nskb = *skb;
 592
 593         if (!nskb) {
 594                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 595                                           MT7915_WTBL_UPDATE_BA_SIZE);
 596                 if (!nskb)
 597                         return ERR_PTR(-ENOMEM);
 598
 599                 *skb = nskb;
 600         }
 601
 602         if (sta_hdr)
 603                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 604
 605         return skb_put_data(nskb, &hdr, sizeof(hdr));
 606 }
 607
 608 static struct tlv *
 609 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 610                           void *sta_ntlv, void *sta_wtbl)
 611 {
 612         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 613         struct tlv *sta_hdr = sta_wtbl;
 614         struct tlv *ptlv, tlv = {
 615                 .tag = cpu_to_le16(tag),
 616                 .len = cpu_to_le16(len),
 617         };
 618         u16 ntlv;
 619
 620         ptlv = skb_put(skb, len);
 621         memcpy(ptlv, &tlv, sizeof(tlv));
 622
 623         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 624         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 625
 626         if (sta_hdr) {
 627                 u16 size = le16_to_cpu(sta_hdr->len);
 628
 629                 sta_hdr->len = cpu_to_le16(size + len);
 630         }
 631
 632         return ptlv;
 633 }
 634
 635 static struct tlv *
 636 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 637 {
 638         return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 639 }
 640
 641 static struct tlv *
 642 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 643                              __le16 *sub_ntlv, __le16 *len)
 644 {
 645         struct tlv *ptlv, tlv = {
 646                 .tag = cpu_to_le16(sub_tag),
 647                 .len = cpu_to_le16(sub_len),
 648         };
 649
 650         ptlv = skb_put(skb, sub_len);
 651         memcpy(ptlv, &tlv, sizeof(tlv));
 652
 653         le16_add_cpu(sub_ntlv, 1);
 654         le16_add_cpu(len, sub_len);
 655
 656         return ptlv;
 657 }
 658
 659 /** bss info **/
 660 static int
 661 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 662                          struct mt7915_phy *phy, bool enable)
 663 {
 664         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 665         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 666         enum nl80211_band band = chandef->chan->band;
 667         struct bss_info_basic *bss;
 668         u16 wlan_idx = mvif->sta.wcid.idx;
 669         u32 type = NETWORK_INFRA;
 670         struct tlv *tlv;
 671
 672         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 673
 674         switch (vif->type) {
 675         case NL80211_IFTYPE_MESH_POINT:
 676         case NL80211_IFTYPE_AP:
 677         case NL80211_IFTYPE_MONITOR:
 678                 break;
 679         case NL80211_IFTYPE_STATION:
 680                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 681                 if (enable) {
 682                         struct ieee80211_sta *sta;
 683                         struct mt7915_sta *msta;
 684
 685                         rcu_read_lock();
 686                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 687                         if (!sta) {
 688                                 rcu_read_unlock();
 689                                 return -EINVAL;
 690                         }
 691
 692                         msta = (struct mt7915_sta *)sta->drv_priv;
 693                         wlan_idx = msta->wcid.idx;
 694                         rcu_read_unlock();
 695                 }
 696                 break;
 697         case NL80211_IFTYPE_ADHOC:
 698                 type = NETWORK_IBSS;
 699                 break;
 700         default:
 701                 WARN_ON(1);
 702                 break;
 703         }
 704
 705         bss = (struct bss_info_basic *)tlv;
 706         bss->network_type = cpu_to_le32(type);
 707         bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
 708         bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
 709         bss->wmm_idx = mvif->wmm_idx;
 710         bss->active = enable;
 711
 712         if (vif->type != NL80211_IFTYPE_MONITOR) {
 713                 memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 714                 bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 715                 bss->dtim_period = vif->bss_conf.dtim_period;
 716                 bss->phy_mode = mt7915_get_phy_mode(phy->dev, vif, band, NULL);
 717         } else {
 718                 memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
 719         }
 720
 721         return 0;
 722 }
 723
 724 static void
 725 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 726 {
 727         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 728         struct bss_info_omac *omac;
 729         struct tlv *tlv;
 730         u32 type = 0;
 731         u8 idx;
 732
 733         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 734
 735         switch (vif->type) {
 736         case NL80211_IFTYPE_MONITOR:
 737         case NL80211_IFTYPE_MESH_POINT:
 738         case NL80211_IFTYPE_AP:
 739                 type = CONNECTION_INFRA_AP;
 740                 break;
 741         case NL80211_IFTYPE_STATION:
 742                 type = CONNECTION_INFRA_STA;
 743                 break;
 744         case NL80211_IFTYPE_ADHOC:
 745                 type = CONNECTION_IBSS_ADHOC;
 746                 break;
 747         default:
 748                 WARN_ON(1);
 749                 break;
 750         }
 751
 752         omac = (struct bss_info_omac *)tlv;
 753         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 754         omac->conn_type = cpu_to_le32(type);
 755         omac->omac_idx = mvif->omac_idx;
 756         omac->band_idx = mvif->band_idx;
 757         omac->hw_bss_idx = idx;
 758 }
 759
 760 struct mt7915_he_obss_narrow_bw_ru_data {
 761         bool tolerated;
 762 };
 763
 764 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 765                                                    struct cfg80211_bss *bss,
 766                                                    void *_data)
 767 {
 768         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 769         const struct element *elem;
 770
 771         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 772
 773         if (!elem || elem->datalen < 10 ||
 774             !(elem->data[10] &
 775               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 776                 data->tolerated = false;
 777 }
 778
 779 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 780                                               struct ieee80211_vif *vif)
 781 {
 782         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 783                 .tolerated = true,
 784         };
 785
 786         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 787                 return false;
 788
 789         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 790                           mt7915_check_he_obss_narrow_bw_ru_iter,
 791                           &iter_data);
 792
 793         /*
 794          * If there is at least one AP on radar channel that cannot
 795          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 796          */
 797         return !iter_data.tolerated;
 798 }
 799
 800 static void
 801 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 802                         struct mt7915_phy *phy)
 803 {
 804         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 805         struct bss_info_rf_ch *ch;
 806         struct tlv *tlv;
 807         int freq1 = chandef->center_freq1;
 808
 809         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 810
 811         ch = (struct bss_info_rf_ch *)tlv;
 812         ch->pri_ch = chandef->chan->hw_value;
 813         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 814         ch->bw = mt7915_mcu_chan_bw(chandef);
 815
 816         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 817                 int freq2 = chandef->center_freq2;
 818
 819                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 820         }
 821
 822         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 823                 struct mt7915_dev *dev = phy->dev;
 824                 struct mt76_phy *mphy = &dev->mt76.phy;
 825                 bool ext_phy = phy != &dev->phy;
 826
 827                 if (ext_phy && dev->mt76.phy2)
 828                         mphy = dev->mt76.phy2;
 829
 830                 ch->he_ru26_block =
 831                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 832                 ch->he_all_disable = false;
 833         } else {
 834                 ch->he_all_disable = true;
 835         }
 836 }
 837
 838 static void
 839 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 840                       struct mt7915_phy *phy)
 841 {
 842         int max_nss = hweight8(phy->mt76->chainmask);
 843         struct bss_info_ra *ra;
 844         struct tlv *tlv;
 845
 846         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 847
 848         ra = (struct bss_info_ra *)tlv;
 849         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 850         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 851         ra->short_preamble = true;
 852         ra->tx_streams = max_nss;
 853         ra->rx_streams = max_nss;
 854         ra->algo = 4;
 855         ra->train_up_rule = 2;
 856         ra->train_up_high_thres = 110;
 857         ra->train_up_rule_rssi = -70;
 858         ra->low_traffic_thres = 2;
 859         ra->phy_cap = cpu_to_le32(0xfdf);
 860         ra->interval = cpu_to_le32(500);
 861         ra->fast_interval = cpu_to_le32(100);
 862 }
 863
 864 static void
 865 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 866                       struct mt7915_phy *phy)
 867 {
 868 #define DEFAULT_HE_PE_DURATION          4
 869 #define DEFAULT_HE_DURATION_RTS_THRES   1023
 870         const struct ieee80211_sta_he_cap *cap;
 871         struct bss_info_he *he;
 872         struct tlv *tlv;
 873
 874         cap = mt7915_get_he_phy_cap(phy, vif);
 875
 876         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 877
 878         he = (struct bss_info_he *)tlv;
 879         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
 880         if (!he->he_pe_duration)
 881                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 882
 883         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
 884         if (!he->he_rts_thres)
 885                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 886
 887         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 888         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 889         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 890 }
 891
 892 static void
 893 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
 894 {
 895 #define TXD_CMP_MAP1            GENMASK(15, 0)
 896 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
 897         struct bss_info_hw_amsdu *amsdu;
 898         struct tlv *tlv;
 899
 900         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
 901
 902         amsdu = (struct bss_info_hw_amsdu *)tlv;
 903         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
 904         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
 905         amsdu->trig_thres = cpu_to_le16(2);
 906         amsdu->enable = true;
 907 }
 908
 909 static void
 910 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
 911 {
 912 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
 913 #define BCN_TX_ESTIMATE_TIME    (4096 + 20)
 914         struct bss_info_ext_bss *ext;
 915         int ext_bss_idx, tsf_offset;
 916         struct tlv *tlv;
 917
 918         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
 919         if (ext_bss_idx < 0)
 920                 return;
 921
 922         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
 923
 924         ext = (struct bss_info_ext_bss *)tlv;
 925         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
 926         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
 927 }
 928
 929 static void
 930 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
 931 {
 932         struct bss_info_bmc_rate *bmc;
 933         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 934         enum nl80211_band band = chandef->chan->band;
 935         struct tlv *tlv;
 936
 937         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
 938
 939         bmc = (struct bss_info_bmc_rate *)tlv;
 940         if (band == NL80211_BAND_2GHZ) {
 941                 bmc->short_preamble = true;
 942         } else {
 943                 bmc->bc_trans = cpu_to_le16(0x2000);
 944                 bmc->mc_trans = cpu_to_le16(0x2080);
 945         }
 946 }
 947
 948 static int
 949 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
 950                        bool bssid, bool enable)
 951 {
 952         struct mt7915_dev *dev = phy->dev;
 953         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 954         u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
 955         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
 956         const u8 *addr = vif->addr;
 957         struct {
 958                 u8 mode;
 959                 u8 force_clear;
 960                 u8 clear_bitmap[8];
 961                 u8 entry_count;
 962                 u8 write;
 963                 u8 band;
 964
 965                 u8 index;
 966                 u8 bssid;
 967                 u8 addr[ETH_ALEN];
 968         } __packed req = {
 969                 .mode = !!mask || enable,
 970                 .entry_count = 1,
 971                 .write = 1,
 972                 .band = phy != &dev->phy,
 973                 .index = idx * 2 + bssid,
 974         };
 975
 976         if (bssid)
 977                 addr = vif->bss_conf.bssid;
 978
 979         if (enable)
 980                 ether_addr_copy(req.addr, addr);
 981
 982         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
 983                                  sizeof(req), true);
 984 }
 985
 986 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
 987                             struct ieee80211_vif *vif, int enable)
 988 {
 989         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 990         struct sk_buff *skb;
 991
 992         if (mvif->omac_idx >= REPEATER_BSSID_START)
 993                 mt7915_mcu_muar_config(phy, vif, true, enable);
 994
 995         skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
 996                                        MT7915_BSS_UPDATE_MAX_SIZE);
 997         if (IS_ERR(skb))
 998                 return PTR_ERR(skb);
 999
1000         /* bss_omac must be first */
1001         if (enable)
1002                 mt7915_mcu_bss_omac_tlv(skb, vif);
1003
1004         mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1005
1006         if (vif->type == NL80211_IFTYPE_MONITOR)
1007                 goto out;
1008
1009         if (enable) {
1010                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1011                 mt7915_mcu_bss_bmc_tlv(skb, phy);
1012                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1013                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
1014
1015                 if (vif->bss_conf.he_support)
1016                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
1017
1018                 if (mvif->omac_idx >= EXT_BSSID_START &&
1019                     mvif->omac_idx < REPEATER_BSSID_START)
1020                         mt7915_mcu_bss_ext_tlv(skb, mvif);
1021         }
1022 out:
1023         return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1024                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1025 }
1026
1027 /** starec & wtbl **/
1028 static int
1029 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1030                        struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1031 {
1032         struct mt7915_sta_key_conf *bip = &msta->bip;
1033         struct sta_rec_sec *sec;
1034         struct tlv *tlv;
1035         u32 len = sizeof(*sec);
1036
1037         tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1038
1039         sec = (struct sta_rec_sec *)tlv;
1040         sec->add = cmd;
1041
1042         if (cmd == SET_KEY) {
1043                 struct sec_key *sec_key;
1044                 u8 cipher;
1045
1046                 cipher = mt7915_mcu_get_cipher(key->cipher);
1047                 if (cipher == MT_CIPHER_NONE)
1048                         return -EOPNOTSUPP;
1049
1050                 sec_key = &sec->key[0];
1051                 sec_key->cipher_len = sizeof(*sec_key);
1052
1053                 if (cipher == MT_CIPHER_BIP_CMAC_128) {
1054                         sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1055                         sec_key->key_id = bip->keyidx;
1056                         sec_key->key_len = 16;
1057                         memcpy(sec_key->key, bip->key, 16);
1058
1059                         sec_key = &sec->key[1];
1060                         sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1061                         sec_key->cipher_len = sizeof(*sec_key);
1062                         sec_key->key_len = 16;
1063                         memcpy(sec_key->key, key->key, 16);
1064
1065                         sec->n_cipher = 2;
1066                 } else {
1067                         sec_key->cipher_id = cipher;
1068                         sec_key->key_id = key->keyidx;
1069                         sec_key->key_len = key->keylen;
1070                         memcpy(sec_key->key, key->key, key->keylen);
1071
1072                         if (cipher == MT_CIPHER_TKIP) {
1073                                 /* Rx/Tx MIC keys are swapped */
1074                                 memcpy(sec_key->key + 16, key->key + 24, 8);
1075                                 memcpy(sec_key->key + 24, key->key + 16, 8);
1076                         }
1077
1078                         /* store key_conf for BIP batch update */
1079                         if (cipher == MT_CIPHER_AES_CCMP) {
1080                                 memcpy(bip->key, key->key, key->keylen);
1081                                 bip->keyidx = key->keyidx;
1082                         }
1083
1084                         len -= sizeof(*sec_key);
1085                         sec->n_cipher = 1;
1086                 }
1087         } else {
1088                 len -= sizeof(sec->key);
1089                 sec->n_cipher = 0;
1090         }
1091         sec->len = cpu_to_le16(len);
1092
1093         return 0;
1094 }
1095
1096 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1097                        struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1098                        enum set_key_cmd cmd)
1099 {
1100         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1101         struct sk_buff *skb;
1102         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1103         int ret;
1104
1105         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1106         if (IS_ERR(skb))
1107                 return PTR_ERR(skb);
1108
1109         ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1110         if (ret)
1111                 return ret;
1112
1113         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1114                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1115 }
1116
1117 static void
1118 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1119                       struct ieee80211_ampdu_params *params,
1120                       bool enable, bool tx)
1121 {
1122         struct sta_rec_ba *ba;
1123         struct tlv *tlv;
1124
1125         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1126
1127         ba = (struct sta_rec_ba *)tlv;
1128         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1129         ba->winsize = cpu_to_le16(params->buf_size);
1130         ba->ssn = cpu_to_le16(params->ssn);
1131         ba->ba_en = enable << params->tid;
1132         ba->amsdu = params->amsdu;
1133         ba->tid = params->tid;
1134 }
1135
1136 static void
1137 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1138                        struct ieee80211_ampdu_params *params,
1139                        bool enable, bool tx, void *sta_wtbl,
1140                        void *wtbl_tlv)
1141 {
1142         struct wtbl_ba *ba;
1143         struct tlv *tlv;
1144
1145         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1146                                         wtbl_tlv, sta_wtbl);
1147
1148         ba = (struct wtbl_ba *)tlv;
1149         ba->tid = params->tid;
1150
1151         if (tx) {
1152                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1153                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1154                 ba->ba_en = enable;
1155         } else {
1156                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1157                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1158                 ba->rst_ba_tid = params->tid;
1159                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1160                 ba->rst_ba_sb = 1;
1161         }
1162
1163         if (enable && tx)
1164                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1165 }
1166
1167 static int
1168 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1169                   struct ieee80211_ampdu_params *params,
1170                   bool enable, bool tx)
1171 {
1172         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1173         struct mt7915_vif *mvif = msta->vif;
1174         struct wtbl_req_hdr *wtbl_hdr;
1175         struct tlv *sta_wtbl;
1176         struct sk_buff *skb;
1177         int ret;
1178
1179         if (enable && tx && !params->amsdu)
1180                 msta->wcid.amsdu = false;
1181
1182         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1183                                        MT7915_STA_UPDATE_MAX_SIZE);
1184         if (IS_ERR(skb))
1185                 return PTR_ERR(skb);
1186
1187         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1188
1189         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1190                                              &skb);
1191         mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1192
1193         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1194                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1195         if (ret)
1196                 return ret;
1197
1198         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1199                                        MT7915_STA_UPDATE_MAX_SIZE);
1200         if (IS_ERR(skb))
1201                 return PTR_ERR(skb);
1202
1203         mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1204
1205         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1206                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1207 }
1208
1209 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1210                          struct ieee80211_ampdu_params *params,
1211                          bool enable)
1212 {
1213         return mt7915_mcu_sta_ba(dev, params, enable, true);
1214 }
1215
1216 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1217                          struct ieee80211_ampdu_params *params,
1218                          bool enable)
1219 {
1220         return mt7915_mcu_sta_ba(dev, params, enable, false);
1221 }
1222
1223 static void
1224 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1225                             struct ieee80211_sta *sta, void *sta_wtbl,
1226                             void *wtbl_tlv)
1227 {
1228         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1229         struct wtbl_generic *generic;
1230         struct wtbl_rx *rx;
1231         struct tlv *tlv;
1232
1233         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1234                                         wtbl_tlv, sta_wtbl);
1235
1236         generic = (struct wtbl_generic *)tlv;
1237
1238         if (sta) {
1239                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1240                 generic->partial_aid = cpu_to_le16(sta->aid);
1241                 generic->muar_idx = mvif->omac_idx;
1242                 generic->qos = sta->wme;
1243         } else {
1244                 /* use BSSID in station mode */
1245                 if (vif->type == NL80211_IFTYPE_STATION)
1246                         memcpy(generic->peer_addr, vif->bss_conf.bssid,
1247                                ETH_ALEN);
1248                 else
1249                         eth_broadcast_addr(generic->peer_addr);
1250
1251                 generic->muar_idx = 0xe;
1252         }
1253
1254         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1255                                         wtbl_tlv, sta_wtbl);
1256
1257         rx = (struct wtbl_rx *)tlv;
1258         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1259         rx->rca2 = 1;
1260         rx->rv = 1;
1261 }
1262
1263 static void
1264 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1265                          struct ieee80211_sta *sta, bool enable)
1266 {
1267 #define EXTRA_INFO_VER          BIT(0)
1268 #define EXTRA_INFO_NEW          BIT(1)
1269         struct sta_rec_basic *basic;
1270         struct tlv *tlv;
1271
1272         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1273
1274         basic = (struct sta_rec_basic *)tlv;
1275         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1276
1277         if (enable) {
1278                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1279                 basic->conn_state = CONN_STATE_PORT_SECURE;
1280         } else {
1281                 basic->conn_state = CONN_STATE_DISCONNECT;
1282         }
1283
1284         if (!sta) {
1285                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1286                 eth_broadcast_addr(basic->peer_addr);
1287                 return;
1288         }
1289
1290         switch (vif->type) {
1291         case NL80211_IFTYPE_MESH_POINT:
1292         case NL80211_IFTYPE_AP:
1293                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1294                 break;
1295         case NL80211_IFTYPE_STATION:
1296                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1297                 break;
1298         case NL80211_IFTYPE_ADHOC:
1299                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1300                 break;
1301         default:
1302                 WARN_ON(1);
1303                 break;
1304         }
1305
1306         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1307         basic->aid = cpu_to_le16(sta->aid);
1308         basic->qos = sta->wme;
1309 }
1310
1311 static void
1312 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1313 {
1314         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1315         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1316         struct sta_rec_he *he;
1317         struct tlv *tlv;
1318         u32 cap = 0;
1319
1320         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1321
1322         he = (struct sta_rec_he *)tlv;
1323
1324         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1325                 cap |= STA_REC_HE_CAP_HTC;
1326
1327         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1328                 cap |= STA_REC_HE_CAP_BSR;
1329
1330         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1331                 cap |= STA_REC_HE_CAP_OM;
1332
1333         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
1334                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1335
1336         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1337                 cap |= STA_REC_HE_CAP_BQR;
1338
1339         if (elem->phy_cap_info[0] &
1340             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1341              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1342                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1343
1344         if (elem->phy_cap_info[1] &
1345             IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1346                 cap |= STA_REC_HE_CAP_LDPC;
1347
1348         if (elem->phy_cap_info[1] &
1349             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1350                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1351
1352         if (elem->phy_cap_info[2] &
1353             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1354                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1355
1356         if (elem->phy_cap_info[2] &
1357             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1358                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1359
1360         if (elem->phy_cap_info[2] &
1361             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1362                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1363
1364         if (elem->phy_cap_info[6] &
1365             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1366                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1367
1368         if (elem->phy_cap_info[7] &
1369             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1370                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1371
1372         if (elem->phy_cap_info[7] &
1373             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1374                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1375
1376         if (elem->phy_cap_info[7] &
1377             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1378                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1379
1380         if (elem->phy_cap_info[8] &
1381             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1382                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1383
1384         if (elem->phy_cap_info[8] &
1385             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1386                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1387
1388         if (elem->phy_cap_info[9] &
1389             IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1390                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1391
1392         if (elem->phy_cap_info[9] &
1393             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1394                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1395
1396         if (elem->phy_cap_info[9] &
1397             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1398                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1399
1400         he->he_cap = cpu_to_le32(cap);
1401
1402         switch (sta->bandwidth) {
1403         case IEEE80211_STA_RX_BW_160:
1404                 if (elem->phy_cap_info[0] &
1405                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1406                         he->max_nss_mcs[CMD_HE_MCS_BW8080] =
1407                                 he_cap->he_mcs_nss_supp.rx_mcs_80p80;
1408
1409                 he->max_nss_mcs[CMD_HE_MCS_BW160] =
1410                                 he_cap->he_mcs_nss_supp.rx_mcs_160;
1411                 fallthrough;
1412         default:
1413                 he->max_nss_mcs[CMD_HE_MCS_BW80] =
1414                                 he_cap->he_mcs_nss_supp.rx_mcs_80;
1415                 break;
1416         }
1417
1418         he->t_frame_dur =
1419                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1420         he->max_ampdu_exp =
1421                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1422
1423         he->bw_set =
1424                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1425         he->device_class =
1426                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1427         he->punc_pream_rx =
1428                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1429
1430         he->dcm_tx_mode =
1431                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1432         he->dcm_tx_max_nss =
1433                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1434         he->dcm_rx_mode =
1435                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1436         he->dcm_rx_max_nss =
1437                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1438         he->dcm_rx_max_nss =
1439                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1440
1441         he->pkt_ext = 2;
1442 }
1443
1444 static void
1445 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1446                      struct ieee80211_vif *vif)
1447 {
1448         struct sta_rec_uapsd *uapsd;
1449         struct tlv *tlv;
1450
1451         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1452                 return;
1453
1454         tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1455         uapsd = (struct sta_rec_uapsd *)tlv;
1456
1457         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1458                 uapsd->dac_map |= BIT(3);
1459                 uapsd->tac_map |= BIT(3);
1460         }
1461         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1462                 uapsd->dac_map |= BIT(2);
1463                 uapsd->tac_map |= BIT(2);
1464         }
1465         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1466                 uapsd->dac_map |= BIT(1);
1467                 uapsd->tac_map |= BIT(1);
1468         }
1469         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1470                 uapsd->dac_map |= BIT(0);
1471                 uapsd->tac_map |= BIT(0);
1472         }
1473         uapsd->max_sp = sta->max_sp;
1474 }
1475
1476 static void
1477 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1478 {
1479         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1480         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1481         struct sta_rec_muru *muru;
1482         struct tlv *tlv;
1483
1484         tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1485
1486         muru = (struct sta_rec_muru *)tlv;
1487         muru->cfg.ofdma_dl_en = true;
1488         muru->cfg.mimo_dl_en = true;
1489
1490         muru->ofdma_dl.punc_pream_rx =
1491                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1492         muru->ofdma_dl.he_20m_in_40m_2g =
1493                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1494         muru->ofdma_dl.he_20m_in_160m =
1495                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1496         muru->ofdma_dl.he_80m_in_160m =
1497                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1498         muru->ofdma_dl.lt16_sigb = 0;
1499         muru->ofdma_dl.rx_su_comp_sigb = 0;
1500         muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1501
1502         muru->ofdma_ul.t_frame_dur =
1503                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1504         muru->ofdma_ul.mu_cascading =
1505                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1506         muru->ofdma_ul.uo_ra =
1507                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1508         muru->ofdma_ul.he_2x996_tone = 0;
1509         muru->ofdma_ul.rx_t_frame_11ac = 0;
1510
1511         muru->mimo_dl.vht_mu_bfee =
1512                 !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1513         muru->mimo_dl.partial_bw_dl_mimo =
1514                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1515
1516         muru->mimo_ul.full_ul_mimo =
1517                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1518         muru->mimo_ul.partial_ul_mimo =
1519                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1520 }
1521
1522 static int
1523 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1524                   struct ieee80211_sta *sta)
1525 {
1526         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1527         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1528         struct sk_buff *skb;
1529         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1530
1531         if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1532                 return 0;
1533
1534         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1535         if (IS_ERR(skb))
1536                 return PTR_ERR(skb);
1537
1538         /* starec muru */
1539         mt7915_mcu_sta_muru_tlv(skb, sta);
1540
1541         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1542                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1543 }
1544
1545 static void
1546 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1547 {
1548         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1549         struct sta_rec_amsdu *amsdu;
1550         struct tlv *tlv;
1551
1552         if (!sta->max_amsdu_len)
1553             return;
1554
1555         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1556         amsdu = (struct sta_rec_amsdu *)tlv;
1557         amsdu->max_amsdu_num = 8;
1558         amsdu->amsdu_en = true;
1559         amsdu->max_mpdu_size = sta->max_amsdu_len >=
1560                                IEEE80211_MAX_MPDU_LEN_VHT_7991;
1561         msta->wcid.amsdu = true;
1562 }
1563
1564 static bool
1565 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1566 {
1567         switch (vif->type) {
1568         case NL80211_IFTYPE_AP:
1569         case NL80211_IFTYPE_STATION:
1570                 return true;
1571         default:
1572                 return false;
1573         }
1574 }
1575
1576 static void
1577 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1578                    struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1579 {
1580         struct tlv *tlv;
1581
1582         /* starec ht */
1583         if (sta->ht_cap.ht_supported) {
1584                 struct sta_rec_ht *ht;
1585
1586                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1587                 ht = (struct sta_rec_ht *)tlv;
1588                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1589
1590                 if (mt7915_hw_amsdu_supported(vif))
1591                         mt7915_mcu_sta_amsdu_tlv(skb, sta);
1592         }
1593
1594         /* starec vht */
1595         if (sta->vht_cap.vht_supported) {
1596                 struct sta_rec_vht *vht;
1597
1598                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1599                 vht = (struct sta_rec_vht *)tlv;
1600                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1601                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1602                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1603         }
1604
1605         /* starec he */
1606         if (sta->he_cap.has_he)
1607                 mt7915_mcu_sta_he_tlv(skb, sta);
1608
1609         /* starec uapsd */
1610         mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1611 }
1612
1613 static void
1614 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1615                          void *sta_wtbl, void *wtbl_tlv)
1616 {
1617         struct wtbl_smps *smps;
1618         struct tlv *tlv;
1619
1620         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1621                                         wtbl_tlv, sta_wtbl);
1622         smps = (struct wtbl_smps *)tlv;
1623
1624         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1625                 smps->smps = true;
1626 }
1627
1628 static void
1629 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1630                        void *sta_wtbl, void *wtbl_tlv)
1631 {
1632         struct wtbl_ht *ht = NULL;
1633         struct tlv *tlv;
1634
1635         /* wtbl ht */
1636         if (sta->ht_cap.ht_supported) {
1637                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1638                                                 wtbl_tlv, sta_wtbl);
1639                 ht = (struct wtbl_ht *)tlv;
1640                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1641                 ht->af = sta->ht_cap.ampdu_factor;
1642                 ht->mm = sta->ht_cap.ampdu_density;
1643                 ht->ht = true;
1644         }
1645
1646         /* wtbl vht */
1647         if (sta->vht_cap.vht_supported) {
1648                 struct wtbl_vht *vht;
1649                 u8 af;
1650
1651                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1652                                                 wtbl_tlv, sta_wtbl);
1653                 vht = (struct wtbl_vht *)tlv;
1654                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1655                 vht->vht = true;
1656
1657                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1658                                sta->vht_cap.cap);
1659                 if (ht)
1660                         ht->af = max_t(u8, ht->af, af);
1661         }
1662
1663         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1664 }
1665
1666 static void
1667 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1668                               struct ieee80211_sta *sta,
1669                               void *sta_wtbl, void *wtbl_tlv)
1670 {
1671         struct mt7915_sta *msta;
1672         struct wtbl_hdr_trans *htr = NULL;
1673         struct tlv *tlv;
1674
1675         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1676                                         wtbl_tlv, sta_wtbl);
1677         htr = (struct wtbl_hdr_trans *)tlv;
1678         htr->no_rx_trans = true;
1679         if (vif->type == NL80211_IFTYPE_STATION)
1680                 htr->to_ds = true;
1681         else
1682                 htr->from_ds = true;
1683
1684         if (!sta)
1685                 return;
1686
1687         msta = (struct mt7915_sta *)sta->drv_priv;
1688         if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1689                 htr->to_ds = true;
1690                 htr->from_ds = true;
1691         }
1692 }
1693
1694 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1695                                     struct ieee80211_vif *vif,
1696                                     struct ieee80211_sta *sta)
1697 {
1698         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1699         struct wtbl_req_hdr *wtbl_hdr;
1700         struct sk_buff *skb;
1701
1702         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1703         if (!skb)
1704                 return -ENOMEM;
1705
1706         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1707         mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1708
1709         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1710                                      true);
1711 }
1712
1713 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1714                         struct ieee80211_sta *sta)
1715 {
1716         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1717         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1718         struct wtbl_req_hdr *wtbl_hdr;
1719         struct tlv *sta_wtbl;
1720         struct sk_buff *skb;
1721
1722         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1723                                        MT7915_STA_UPDATE_MAX_SIZE);
1724         if (IS_ERR(skb))
1725                 return PTR_ERR(skb);
1726
1727         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1728
1729         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1730                                              &skb);
1731         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1732
1733         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1734                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1735 }
1736
1737 static void
1738 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1739 {
1740         bf->bf_cap = MT_EBF;
1741         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1742         bf->ndp_rate = 0;                               /* mcs0 */
1743         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1744         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1745 }
1746
1747 static void
1748 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1749                        struct sta_rec_bf *bf)
1750 {
1751         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1752         u8 n = 0;
1753
1754         bf->tx_mode = MT_PHY_TYPE_HT;
1755         bf->bf_cap = MT_IBF;
1756
1757         if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1758             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1759                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1760                               mcs->tx_params);
1761         else if (mcs->rx_mask[3])
1762                 n = 3;
1763         else if (mcs->rx_mask[2])
1764                 n = 2;
1765         else if (mcs->rx_mask[1])
1766                 n = 1;
1767
1768         bf->nr = hweight8(phy->mt76->chainmask) - 1;
1769         bf->nc = min_t(u8, bf->nr, n);
1770         bf->ibf_ncol = n;
1771 }
1772
1773 static void
1774 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1775                         struct sta_rec_bf *bf, bool explicit)
1776 {
1777         struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1778         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1779         u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1780         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1781         u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1782
1783         bf->tx_mode = MT_PHY_TYPE_VHT;
1784
1785         if (explicit) {
1786                 u8 bfee_nr, bfer_nr;
1787
1788                 mt7915_mcu_sta_sounding_rate(bf);
1789                 bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1790                                     pc->cap);
1791                 bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1792                                     vc->cap);
1793                 bf->nr = min_t(u8, min_t(u8, bfer_nr, bfee_nr), tx_ant);
1794                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1795                 bf->ibf_ncol = bf->nc;
1796
1797                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1798                         bf->nr = 1;
1799         } else {
1800                 bf->bf_cap = MT_IBF;
1801                 bf->nr = tx_ant;
1802                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1803                 bf->ibf_ncol = nss_mcs;
1804
1805                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1806                         bf->ibf_nrow = 1;
1807         }
1808 }
1809
1810 static void
1811 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1812                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1813 {
1814         struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1815         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1816         const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1817         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1818         u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1819         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1820         u8 bfee_nr, bfer_nr;
1821
1822         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1823         mt7915_mcu_sta_sounding_rate(bf);
1824         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMER_FB,
1825                                 pe->phy_cap_info[6]);
1826         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMER_FB,
1827                                 pe->phy_cap_info[6]);
1828         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1829                          ve->phy_cap_info[5]);
1830         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1831                          pe->phy_cap_info[4]);
1832         bf->nr = min_t(u8, bfer_nr, bfee_nr);
1833         bf->nc = min_t(u8, nss_mcs, bf->nr);
1834         bf->ibf_ncol = bf->nc;
1835
1836         if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1837                 return;
1838
1839         /* go over for 160MHz and 80p80 */
1840         if (pe->phy_cap_info[0] &
1841             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1842                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1843                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1844
1845                 bf->nc_bw160 = nss_mcs;
1846         }
1847
1848         if (pe->phy_cap_info[0] &
1849             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1850                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1851                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1852
1853                 if (bf->nc_bw160)
1854                         bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
1855                 else
1856                         bf->nc_bw160 = nss_mcs;
1857         }
1858
1859         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1860                          ve->phy_cap_info[5]);
1861         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1862                          pe->phy_cap_info[4]);
1863
1864         bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
1865 }
1866
1867 static void
1868 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1869                         struct ieee80211_vif *vif, struct mt7915_phy *phy,
1870                         bool enable, bool explicit)
1871 {
1872         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1873         struct sta_rec_bf *bf;
1874         struct tlv *tlv;
1875         const u8 matrix[4][4] = {
1876                 {0, 0, 0, 0},
1877                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
1878                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
1879                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
1880         };
1881
1882 #define MT_BFER_FREE            cpu_to_le16(GENMASK(15, 0))
1883
1884         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1885         bf = (struct sta_rec_bf *)tlv;
1886
1887         if (!enable) {
1888                 bf->pfmu = MT_BFER_FREE;
1889                 return;
1890         }
1891
1892         /* he: eBF only, in accordance with spec
1893          * vht: support eBF and iBF
1894          * ht: iBF only, since mac80211 lacks of eBF support
1895          */
1896         if (sta->he_cap.has_he && explicit)
1897                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1898         else if (sta->vht_cap.vht_supported)
1899                 mt7915_mcu_sta_bfer_vht(sta, phy, bf, explicit);
1900         else if (sta->ht_cap.ht_supported)
1901                 mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1902         else
1903                 return;
1904
1905         bf->bw = sta->bandwidth;
1906         bf->ibf_dbw = sta->bandwidth;
1907         bf->ibf_nrow = tx_ant;
1908
1909         if (!explicit && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
1910                 bf->ibf_timeout = 0x48;
1911         else
1912                 bf->ibf_timeout = 0x18;
1913
1914         if (explicit && bf->nr != tx_ant)
1915                 bf->mem_20m = matrix[tx_ant][bf->nc];
1916         else
1917                 bf->mem_20m = matrix[bf->nr][bf->nc];
1918
1919         switch (sta->bandwidth) {
1920         case IEEE80211_STA_RX_BW_160:
1921         case IEEE80211_STA_RX_BW_80:
1922                 bf->mem_total = bf->mem_20m * 2;
1923                 break;
1924         case IEEE80211_STA_RX_BW_40:
1925                 bf->mem_total = bf->mem_20m;
1926                 break;
1927         case IEEE80211_STA_RX_BW_20:
1928         default:
1929                 break;
1930         }
1931 }
1932
1933 static void
1934 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1935                         struct mt7915_phy *phy)
1936 {
1937         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1938         struct sta_rec_bfee *bfee;
1939         struct tlv *tlv;
1940         u8 nr = 0;
1941
1942         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1943         bfee = (struct sta_rec_bfee *)tlv;
1944
1945         if (sta->he_cap.has_he) {
1946                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1947
1948                 nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1949                             pe->phy_cap_info[5]);
1950         } else if (sta->vht_cap.vht_supported) {
1951                 struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1952
1953                 nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1954                                pc->cap);
1955         }
1956
1957         /* reply with identity matrix to avoid 2x2 BF negative gain */
1958         bfee->fb_identity_matrix = !!(nr == 1 && tx_ant == 2);
1959 }
1960
1961 static int
1962 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1963                     struct ieee80211_sta *sta, bool enable)
1964 {
1965         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1966         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1967         struct mt7915_phy *phy;
1968         struct sk_buff *skb;
1969         int r, len;
1970         bool ebfee = 0, ebf = 0;
1971
1972         if (vif->type != NL80211_IFTYPE_STATION &&
1973             vif->type != NL80211_IFTYPE_AP)
1974                 return 0;
1975
1976         phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
1977
1978         if (sta->he_cap.has_he) {
1979                 struct ieee80211_he_cap_elem *pe;
1980                 const struct ieee80211_he_cap_elem *ve;
1981                 const struct ieee80211_sta_he_cap *vc;
1982
1983                 pe = &sta->he_cap.he_cap_elem;
1984                 vc = mt7915_get_he_phy_cap(phy, vif);
1985                 ve = &vc->he_cap_elem;
1986
1987                 ebfee = !!((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
1988                             HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
1989                            HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]));
1990                 ebf = !!((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
1991                           HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
1992                          HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]));
1993         } else if (sta->vht_cap.vht_supported) {
1994                 struct ieee80211_sta_vht_cap *pc;
1995                 struct ieee80211_sta_vht_cap *vc;
1996                 u32 cr, ce;
1997
1998                 pc = &sta->vht_cap;
1999                 vc = &phy->mt76->sband_5g.sband.vht_cap;
2000                 cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2001                      IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
2002                 ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2003                      IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
2004
2005                 ebfee = !!((pc->cap & cr) && (vc->cap & ce));
2006                 ebf = !!((vc->cap & cr) && (pc->cap & ce));
2007         }
2008
2009         /* must keep each tag independent */
2010
2011         /* starec bf */
2012         if (ebf || dev->ibf) {
2013                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2014
2015                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2016                 if (IS_ERR(skb))
2017                         return PTR_ERR(skb);
2018
2019                 mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable, ebf);
2020
2021                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2022                                           MCU_EXT_CMD(STA_REC_UPDATE), true);
2023                 if (r)
2024                         return r;
2025         }
2026
2027         /* starec bfee */
2028         if (ebfee) {
2029                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2030
2031                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2032                 if (IS_ERR(skb))
2033                         return PTR_ERR(skb);
2034
2035                 mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2036
2037                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2038                                           MCU_EXT_CMD(STA_REC_UPDATE), true);
2039                 if (r)
2040                         return r;
2041         }
2042
2043         return 0;
2044 }
2045
2046 static void
2047 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2048                              struct ieee80211_vif *vif,
2049                              struct ieee80211_sta *sta)
2050 {
2051         struct cfg80211_chan_def *chandef = &dev->mphy.chandef;
2052         struct sta_rec_ra *ra;
2053         struct tlv *tlv;
2054         enum nl80211_band band = chandef->chan->band;
2055         u32 supp_rate = sta->supp_rates[band];
2056         int n_rates = hweight32(supp_rate);
2057         u32 cap = sta->wme ? STA_CAP_WMM : 0;
2058         u8 i, nss = sta->rx_nss, mcs = 0;
2059
2060         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2061
2062         ra = (struct sta_rec_ra *)tlv;
2063         ra->valid = true;
2064         ra->auto_rate = true;
2065         ra->phy_mode = mt7915_get_phy_mode(dev, vif, band, sta);
2066         ra->channel = chandef->chan->hw_value;
2067         ra->bw = sta->bandwidth;
2068         ra->rate_len = n_rates;
2069         ra->phy.bw = sta->bandwidth;
2070
2071         if (n_rates) {
2072                 if (band == NL80211_BAND_2GHZ) {
2073                         ra->supp_mode = MODE_CCK;
2074                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2075                         ra->phy.type = MT_PHY_TYPE_CCK;
2076
2077                         if (n_rates > 4) {
2078                                 ra->supp_mode |= MODE_OFDM;
2079                                 ra->supp_ofdm_rate = supp_rate >> 4;
2080                                 ra->phy.type = MT_PHY_TYPE_OFDM;
2081                         }
2082                 } else {
2083                         ra->supp_mode = MODE_OFDM;
2084                         ra->supp_ofdm_rate = supp_rate;
2085                         ra->phy.type = MT_PHY_TYPE_OFDM;
2086                 }
2087         }
2088
2089         if (sta->ht_cap.ht_supported) {
2090                 for (i = 0; i < nss; i++)
2091                         ra->ht_mcs[i] = sta->ht_cap.mcs.rx_mask[i];
2092
2093                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2094                 ra->supp_mode |= MODE_HT;
2095                 mcs = hweight32(le32_to_cpu(ra->supp_ht_mcs)) - 1;
2096                 ra->af = sta->ht_cap.ampdu_factor;
2097                 ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2098
2099                 cap |= STA_CAP_HT;
2100                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2101                         cap |= STA_CAP_SGI_20;
2102                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2103                         cap |= STA_CAP_SGI_40;
2104                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2105                         cap |= STA_CAP_TX_STBC;
2106                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2107                         cap |= STA_CAP_RX_STBC;
2108                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2109                         cap |= STA_CAP_LDPC;
2110         }
2111
2112         if (sta->vht_cap.vht_supported) {
2113                 u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
2114                 u16 vht_mcs;
2115                 u8 af, mcs_prev;
2116
2117                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2118                                sta->vht_cap.cap);
2119                 ra->af = max_t(u8, ra->af, af);
2120
2121                 cap |= STA_CAP_VHT;
2122                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2123                         cap |= STA_CAP_VHT_SGI_80;
2124                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2125                         cap |= STA_CAP_VHT_SGI_160;
2126                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2127                         cap |= STA_CAP_VHT_TX_STBC;
2128                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2129                         cap |= STA_CAP_VHT_RX_STBC;
2130                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2131                         cap |= STA_CAP_VHT_LDPC;
2132
2133                 ra->supp_mode |= MODE_VHT;
2134                 for (mcs = 0, i = 0; i < nss; i++, mcs_map >>= 2) {
2135                         switch (mcs_map & 0x3) {
2136                         case IEEE80211_VHT_MCS_SUPPORT_0_9:
2137                                 vht_mcs = GENMASK(9, 0);
2138                                 break;
2139                         case IEEE80211_VHT_MCS_SUPPORT_0_8:
2140                                 vht_mcs = GENMASK(8, 0);
2141                                 break;
2142                         case IEEE80211_VHT_MCS_SUPPORT_0_7:
2143                                 vht_mcs = GENMASK(7, 0);
2144                                 break;
2145                         default:
2146                                 vht_mcs = 0;
2147                         }
2148
2149                         ra->supp_vht_mcs[i] = cpu_to_le16(vht_mcs);
2150
2151                         mcs_prev = hweight16(vht_mcs) - 1;
2152                         if (mcs_prev > mcs)
2153                                 mcs = mcs_prev;
2154
2155                         /* only support 2ss on 160MHz */
2156                         if (i > 1 && (ra->bw == CMD_CBW_160MHZ ||
2157                                       ra->bw == CMD_CBW_8080MHZ))
2158                                 break;
2159                 }
2160         }
2161
2162         if (sta->he_cap.has_he) {
2163                 ra->supp_mode |= MODE_HE;
2164                 cap |= STA_CAP_HE;
2165         }
2166
2167         ra->sta_status = cpu_to_le32(cap);
2168
2169         switch (BIT(fls(ra->supp_mode) - 1)) {
2170         case MODE_VHT:
2171                 ra->phy.type = MT_PHY_TYPE_VHT;
2172                 ra->phy.mcs = mcs;
2173                 ra->phy.nss = nss;
2174                 ra->phy.stbc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC);
2175                 ra->phy.ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
2176                 ra->phy.sgi =
2177                         !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
2178                 break;
2179         case MODE_HT:
2180                 ra->phy.type = MT_PHY_TYPE_HT;
2181                 ra->phy.mcs = mcs;
2182                 ra->phy.ldpc = sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING;
2183                 ra->phy.stbc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC);
2184                 ra->phy.sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
2185                 break;
2186         default:
2187                 break;
2188         }
2189 }
2190
2191 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2192                              struct ieee80211_sta *sta)
2193 {
2194         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2195         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2196         struct sk_buff *skb;
2197         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2198
2199         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2200         if (IS_ERR(skb))
2201                 return PTR_ERR(skb);
2202
2203         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2204
2205         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2206                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2207 }
2208
2209 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2210                            struct ieee80211_sta *sta, bool enable)
2211 {
2212         int ret;
2213
2214         if (!sta)
2215                 return 0;
2216
2217         /* must keep the order */
2218         ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2219         if (ret)
2220                 return ret;
2221
2222         ret = mt7915_mcu_add_mu(dev, vif, sta);
2223         if (ret)
2224                 return ret;
2225
2226         if (enable)
2227                 return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2228
2229         return 0;
2230 }
2231
2232 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2233                        struct ieee80211_sta *sta, bool enable)
2234 {
2235         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2236         struct wtbl_req_hdr *wtbl_hdr;
2237         struct mt7915_sta *msta;
2238         struct tlv *sta_wtbl;
2239         struct sk_buff *skb;
2240
2241         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2242
2243         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2244                                        MT7915_STA_UPDATE_MAX_SIZE);
2245         if (IS_ERR(skb))
2246                 return PTR_ERR(skb);
2247
2248         mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2249         if (enable && sta)
2250                 mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2251
2252         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2253
2254         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2255                                              sta_wtbl, &skb);
2256         if (enable) {
2257                 mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2258                 mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2259                 if (sta)
2260                         mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2261         }
2262
2263         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2264                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2265 }
2266
2267 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2268                               struct ieee80211_sta *sta, u32 rate)
2269 {
2270         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2271         struct mt7915_vif *mvif = msta->vif;
2272         struct sta_rec_ra_fixed *ra;
2273         struct sk_buff *skb;
2274         struct tlv *tlv;
2275         int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2276
2277         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2278         if (IS_ERR(skb))
2279                 return PTR_ERR(skb);
2280
2281         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2282         ra = (struct sta_rec_ra_fixed *)tlv;
2283
2284         if (!rate) {
2285                 ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2286                 goto out;
2287         } else {
2288                 ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2289         }
2290
2291         ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2292         ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2293         ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2294         ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2295         ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2296
2297         if (ra->phy.bw)
2298                 ra->phy.ldpc = 7;
2299         else
2300                 ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2301
2302         /* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2303         if (ra->phy.type > MT_PHY_TYPE_VHT)
2304                 ra->phy.sgi = ra->phy.mcs * 85;
2305         else
2306                 ra->phy.sgi = ra->phy.mcs * 15;
2307
2308 out:
2309         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2310                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2311 }
2312
2313 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2314                             struct ieee80211_vif *vif, bool enable)
2315 {
2316         struct mt7915_dev *dev = phy->dev;
2317         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2318         struct {
2319                 struct req_hdr {
2320                         u8 omac_idx;
2321                         u8 dbdc_idx;
2322                         __le16 tlv_num;
2323                         u8 is_tlv_append;
2324                         u8 rsv[3];
2325                 } __packed hdr;
2326                 struct req_tlv {
2327                         __le16 tag;
2328                         __le16 len;
2329                         u8 active;
2330                         u8 dbdc_idx;
2331                         u8 omac_addr[ETH_ALEN];
2332                 } __packed tlv;
2333         } data = {
2334                 .hdr = {
2335                         .omac_idx = mvif->omac_idx,
2336                         .dbdc_idx = mvif->band_idx,
2337                         .tlv_num = cpu_to_le16(1),
2338                         .is_tlv_append = 1,
2339                 },
2340                 .tlv = {
2341                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
2342                         .len = cpu_to_le16(sizeof(struct req_tlv)),
2343                         .active = enable,
2344                         .dbdc_idx = mvif->band_idx,
2345                 },
2346         };
2347
2348         if (mvif->omac_idx >= REPEATER_BSSID_START)
2349                 return mt7915_mcu_muar_config(phy, vif, false, enable);
2350
2351         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2352         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2353                                  &data, sizeof(data), true);
2354 }
2355
2356 static void
2357 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2358                       struct bss_info_bcn *bcn,
2359                       struct ieee80211_mutable_offsets *offs)
2360 {
2361         if (offs->cntdwn_counter_offs[0]) {
2362                 struct tlv *tlv;
2363                 struct bss_info_bcn_csa *csa;
2364
2365                 tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2366                                                    sizeof(*csa), &bcn->sub_ntlv,
2367                                                    &bcn->len);
2368                 csa = (struct bss_info_bcn_csa *)tlv;
2369                 csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2370         }
2371 }
2372
2373 static void
2374 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2375                        struct sk_buff *skb, struct bss_info_bcn *bcn,
2376                        struct ieee80211_mutable_offsets *offs)
2377 {
2378         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2379         struct bss_info_bcn_cont *cont;
2380         struct tlv *tlv;
2381         u8 *buf;
2382         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2383
2384         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2385                                            len, &bcn->sub_ntlv, &bcn->len);
2386
2387         cont = (struct bss_info_bcn_cont *)tlv;
2388         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2389         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2390
2391         if (offs->cntdwn_counter_offs[0])
2392                 cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2393
2394         buf = (u8 *)tlv + sizeof(*cont);
2395         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL,
2396                               true);
2397         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2398 }
2399
2400 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2401                           struct ieee80211_vif *vif, int en)
2402 {
2403 #define MAX_BEACON_SIZE 512
2404         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2405         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2406         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2407         struct ieee80211_mutable_offsets offs;
2408         struct ieee80211_tx_info *info;
2409         struct sk_buff *skb, *rskb;
2410         struct tlv *tlv;
2411         struct bss_info_bcn *bcn;
2412         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2413
2414         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2415         if (!skb)
2416                 return -EINVAL;
2417
2418         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2419                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2420                 dev_kfree_skb(skb);
2421                 return -EINVAL;
2422         }
2423
2424         rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2425         if (IS_ERR(rskb)) {
2426                 dev_kfree_skb(skb);
2427                 return PTR_ERR(rskb);
2428         }
2429
2430         tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2431         bcn = (struct bss_info_bcn *)tlv;
2432         bcn->enable = en;
2433
2434         if (mvif->band_idx) {
2435                 info = IEEE80211_SKB_CB(skb);
2436                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2437         }
2438
2439         /* TODO: subtag - bss color count & 11v MBSSID */
2440         mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2441         mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2442         dev_kfree_skb(skb);
2443
2444         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2445                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2446 }
2447
2448 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2449                                      u32 option)
2450 {
2451         struct {
2452                 __le32 option;
2453                 __le32 addr;
2454         } req = {
2455                 .option = cpu_to_le32(option),
2456                 .addr = cpu_to_le32(addr),
2457         };
2458
2459         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2460                                  sizeof(req), true);
2461 }
2462
2463 static int mt7915_mcu_restart(struct mt76_dev *dev)
2464 {
2465         struct {
2466                 u8 power_mode;
2467                 u8 rsv[3];
2468         } req = {
2469                 .power_mode = 1,
2470         };
2471
2472         return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2473                                  sizeof(req), false);
2474 }
2475
2476 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2477 {
2478         struct {
2479                 __le32 op;
2480         } req = {
2481                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2482         };
2483
2484         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2485                                  sizeof(req), true);
2486 }
2487
2488 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2489 {
2490         struct {
2491                 u8 check_crc;
2492                 u8 reserved[3];
2493         } req = {
2494                 .check_crc = 0,
2495         };
2496
2497         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2498                                  sizeof(req), true);
2499 }
2500
2501 static int mt7915_driver_own(struct mt7915_dev *dev)
2502 {
2503         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2504
2505         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_DRV_OWN);
2506         if (!mt76_poll_msec(dev, reg, MT_TOP_LPCR_HOST_FW_OWN,
2507                             0, 500)) {
2508                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2509                 return -EIO;
2510         }
2511
2512         return 0;
2513 }
2514
2515 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2516                                     u32 len, u32 mode)
2517 {
2518         struct {
2519                 __le32 addr;
2520                 __le32 len;
2521                 __le32 mode;
2522         } req = {
2523                 .addr = cpu_to_le32(addr),
2524                 .len = cpu_to_le32(len),
2525                 .mode = cpu_to_le32(mode),
2526         };
2527         int attr;
2528
2529         if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2530                 attr = MCU_CMD(PATCH_START_REQ);
2531         else
2532                 attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2533
2534         return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2535 }
2536
2537 static int mt7915_load_patch(struct mt7915_dev *dev)
2538 {
2539         const struct mt7915_patch_hdr *hdr;
2540         const struct firmware *fw = NULL;
2541         int i, ret, sem;
2542
2543         sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2544         switch (sem) {
2545         case PATCH_IS_DL:
2546                 return 0;
2547         case PATCH_NOT_DL_SEM_SUCCESS:
2548                 break;
2549         default:
2550                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2551                 return -EAGAIN;
2552         }
2553
2554         ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2555         if (ret)
2556                 goto out;
2557
2558         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2559                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2560                 ret = -EINVAL;
2561                 goto out;
2562         }
2563
2564         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2565
2566         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2567                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2568
2569         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2570                 struct mt7915_patch_sec *sec;
2571                 const u8 *dl;
2572                 u32 len, addr;
2573
2574                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2575                                                   i * sizeof(*sec));
2576                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2577                     PATCH_SEC_TYPE_INFO) {
2578                         ret = -EINVAL;
2579                         goto out;
2580                 }
2581
2582                 addr = be32_to_cpu(sec->info.addr);
2583                 len = be32_to_cpu(sec->info.len);
2584                 dl = fw->data + be32_to_cpu(sec->offs);
2585
2586                 ret = mt7915_mcu_init_download(dev, addr, len,
2587                                                DL_MODE_NEED_RSP);
2588                 if (ret) {
2589                         dev_err(dev->mt76.dev, "Download request failed\n");
2590                         goto out;
2591                 }
2592
2593                 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2594                                              dl, len);
2595                 if (ret) {
2596                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2597                         goto out;
2598                 }
2599         }
2600
2601         ret = mt7915_mcu_start_patch(dev);
2602         if (ret)
2603                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2604
2605 out:
2606         sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2607         switch (sem) {
2608         case PATCH_REL_SEM_SUCCESS:
2609                 break;
2610         default:
2611                 ret = -EAGAIN;
2612                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2613                 goto out;
2614         }
2615         release_firmware(fw);
2616
2617         return ret;
2618 }
2619
2620 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2621 {
2622         u32 ret = 0;
2623
2624         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2625                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2626         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2627                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2628         ret |= DL_MODE_NEED_RSP;
2629         ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2630
2631         return ret;
2632 }
2633
2634 static int
2635 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2636                              const struct mt7915_fw_trailer *hdr,
2637                              const u8 *data, bool is_wa)
2638 {
2639         int i, offset = 0;
2640         u32 override = 0, option = 0;
2641
2642         for (i = 0; i < hdr->n_region; i++) {
2643                 const struct mt7915_fw_region *region;
2644                 int err;
2645                 u32 len, addr, mode;
2646
2647                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2648                          (hdr->n_region - i) * sizeof(*region));
2649                 mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2650                 len = le32_to_cpu(region->len);
2651                 addr = le32_to_cpu(region->addr);
2652
2653                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2654                         override = addr;
2655
2656                 err = mt7915_mcu_init_download(dev, addr, len, mode);
2657                 if (err) {
2658                         dev_err(dev->mt76.dev, "Download request failed\n");
2659                         return err;
2660                 }
2661
2662                 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2663                                              data + offset, len);
2664                 if (err) {
2665                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2666                         return err;
2667                 }
2668
2669                 offset += len;
2670         }
2671
2672         if (override)
2673                 option |= FW_START_OVERRIDE;
2674
2675         if (is_wa)
2676                 option |= FW_START_WORKING_PDA_CR4;
2677
2678         return mt7915_mcu_start_firmware(dev, override, option);
2679 }
2680
2681 static int mt7915_load_ram(struct mt7915_dev *dev)
2682 {
2683         const struct mt7915_fw_trailer *hdr;
2684         const struct firmware *fw;
2685         int ret;
2686
2687         ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2688         if (ret)
2689                 return ret;
2690
2691         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2692                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2693                 ret = -EINVAL;
2694                 goto out;
2695         }
2696
2697         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2698                                         sizeof(*hdr));
2699
2700         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2701                  hdr->fw_ver, hdr->build_date);
2702
2703         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2704         if (ret) {
2705                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2706                 goto out;
2707         }
2708
2709         release_firmware(fw);
2710
2711         ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2712         if (ret)
2713                 return ret;
2714
2715         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2716                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2717                 ret = -EINVAL;
2718                 goto out;
2719         }
2720
2721         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2722                                         sizeof(*hdr));
2723
2724         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2725                  hdr->fw_ver, hdr->build_date);
2726
2727         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2728         if (ret) {
2729                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2730                 goto out;
2731         }
2732
2733         snprintf(dev->mt76.hw->wiphy->fw_version,
2734                  sizeof(dev->mt76.hw->wiphy->fw_version),
2735                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2736
2737 out:
2738         release_firmware(fw);
2739
2740         return ret;
2741 }
2742
2743 static int mt7915_load_firmware(struct mt7915_dev *dev)
2744 {
2745         int ret;
2746         u32 val, reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2747
2748         val = FIELD_PREP(MT_TOP_MISC_FW_STATE, FW_STATE_FW_DOWNLOAD);
2749
2750         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE, val, 1000)) {
2751                 /* restart firmware once */
2752                 __mt76_mcu_restart(&dev->mt76);
2753                 if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2754                                     val, 1000)) {
2755                         dev_err(dev->mt76.dev,
2756                                 "Firmware is not ready for download\n");
2757                         return -EIO;
2758                 }
2759         }
2760
2761         ret = mt7915_load_patch(dev);
2762         if (ret)
2763                 return ret;
2764
2765         ret = mt7915_load_ram(dev);
2766         if (ret)
2767                 return ret;
2768
2769         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2770                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2771                                        FW_STATE_WACPU_RDY), 1000)) {
2772                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2773                 return -EIO;
2774         }
2775
2776         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2777
2778         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2779
2780         return 0;
2781 }
2782
2783 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2784 {
2785         struct {
2786                 u8 ctrl_val;
2787                 u8 pad[3];
2788         } data = {
2789                 .ctrl_val = ctrl
2790         };
2791
2792         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2793                                  sizeof(data), true);
2794 }
2795
2796 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2797 {
2798         struct {
2799                 u8 ver;
2800                 u8 pad;
2801                 __le16 len;
2802                 u8 level;
2803                 u8 rsv[3];
2804                 __le32 module_idx;
2805         } data = {
2806                 .module_idx = cpu_to_le32(module),
2807                 .level = level,
2808         };
2809
2810         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2811                                  sizeof(data), false);
2812 }
2813
2814 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2815 {
2816         struct {
2817                 u8 enable;
2818                 u8 _rsv[3];
2819         } __packed req = {
2820                 .enable = enabled
2821         };
2822
2823         return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2824                                  sizeof(req), false);
2825 }
2826
2827 int mt7915_mcu_init(struct mt7915_dev *dev)
2828 {
2829         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2830                 .headroom = sizeof(struct mt7915_mcu_txd),
2831                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2832                 .mcu_parse_response = mt7915_mcu_parse_response,
2833                 .mcu_restart = mt7915_mcu_restart,
2834         };
2835         int ret;
2836
2837         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2838
2839         ret = mt7915_driver_own(dev);
2840         if (ret)
2841                 return ret;
2842
2843         ret = mt7915_load_firmware(dev);
2844         if (ret)
2845                 return ret;
2846
2847         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2848         mt7915_mcu_fw_log_2_host(dev, 0);
2849         mt7915_mcu_set_mwds(dev, 1);
2850         mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_RED, 0, 0);
2851
2852         return 0;
2853 }
2854
2855 void mt7915_mcu_exit(struct mt7915_dev *dev)
2856 {
2857         u32 reg = mt7915_reg_map_l1(dev, MT_TOP_MISC);
2858
2859         __mt76_mcu_restart(&dev->mt76);
2860         if (!mt76_poll_msec(dev, reg, MT_TOP_MISC_FW_STATE,
2861                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2862                                        FW_STATE_FW_DOWNLOAD), 1000)) {
2863                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2864                 return;
2865         }
2866
2867         reg = mt7915_reg_map_l1(dev, MT_TOP_LPCR_HOST_BAND0);
2868         mt76_wr(dev, reg, MT_TOP_LPCR_HOST_FW_OWN);
2869         skb_queue_purge(&dev->mt76.mcu.res_q);
2870 }
2871
2872 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2873                        bool enable, bool hdr_trans)
2874 {
2875         struct {
2876                 u8 operation;
2877                 u8 enable;
2878                 u8 check_bssid;
2879                 u8 insert_vlan;
2880                 u8 remove_vlan;
2881                 u8 tid;
2882                 u8 mode;
2883                 u8 rsv;
2884         } __packed req_trans = {
2885                 .enable = hdr_trans,
2886         };
2887         struct {
2888                 u8 enable;
2889                 u8 band;
2890                 u8 rsv[2];
2891         } __packed req_mac = {
2892                 .enable = enable,
2893                 .band = band,
2894         };
2895         int ret;
2896
2897         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2898                                 &req_trans, sizeof(req_trans), false);
2899         if (ret)
2900                 return ret;
2901
2902         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2903                                  &req_mac, sizeof(req_mac), true);
2904 }
2905
2906 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2907 {
2908         struct {
2909                 __le32 cmd;
2910                 u8 band;
2911                 u8 enable;
2912         } __packed req = {
2913                 .cmd = cpu_to_le32(SCS_ENABLE),
2914                 .band = band,
2915                 .enable = enable + 1,
2916         };
2917
2918         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
2919                                  sizeof(req), false);
2920 }
2921
2922 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
2923 {
2924         struct mt7915_dev *dev = phy->dev;
2925         struct {
2926                 u8 prot_idx;
2927                 u8 band;
2928                 u8 rsv[2];
2929                 __le32 len_thresh;
2930                 __le32 pkt_thresh;
2931         } __packed req = {
2932                 .prot_idx = 1,
2933                 .band = phy != &dev->phy,
2934                 .len_thresh = cpu_to_le32(val),
2935                 .pkt_thresh = cpu_to_le32(0x2),
2936         };
2937
2938         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
2939                                  sizeof(req), true);
2940 }
2941
2942 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2943 {
2944         struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2945         u8 num = req->total;
2946         size_t len = sizeof(*req) -
2947                      (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2948
2949         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2950                                  len, true);
2951 }
2952
2953 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2954 {
2955 #define TX_CMD_MODE             1
2956         struct mt7915_mcu_tx req = {
2957                 .valid = true,
2958                 .mode = TX_CMD_MODE,
2959                 .total = IEEE80211_NUM_ACS,
2960         };
2961         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2962         int ac;
2963
2964         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2965                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2966                 struct edca *e = &req.edca[ac];
2967
2968                 e->set = WMM_PARAM_SET;
2969                 e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
2970                 e->aifs = q->aifs;
2971                 e->txop = cpu_to_le16(q->txop);
2972
2973                 if (q->cw_min)
2974                         e->cw_min = fls(q->cw_min);
2975                 else
2976                         e->cw_min = 5;
2977
2978                 if (q->cw_max)
2979                         e->cw_max = cpu_to_le16(fls(q->cw_max));
2980                 else
2981                         e->cw_max = cpu_to_le16(10);
2982         }
2983
2984         return mt7915_mcu_update_edca(dev, &req);
2985 }
2986
2987 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
2988 {
2989 #define ENTER_PM_STATE          1
2990 #define EXIT_PM_STATE           2
2991         struct {
2992                 u8 pm_number;
2993                 u8 pm_state;
2994                 u8 bssid[ETH_ALEN];
2995                 u8 dtim_period;
2996                 u8 wlan_idx_lo;
2997                 __le16 bcn_interval;
2998                 __le32 aid;
2999                 __le32 rx_filter;
3000                 u8 band_idx;
3001                 u8 wlan_idx_hi;
3002                 u8 rsv[2];
3003                 __le32 feature;
3004                 u8 omac_idx;
3005                 u8 wmm_idx;
3006                 u8 bcn_loss_cnt;
3007                 u8 bcn_sp_duration;
3008         } __packed req = {
3009                 .pm_number = 5,
3010                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3011                 .band_idx = band,
3012         };
3013
3014         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3015                                  sizeof(req), true);
3016 }
3017
3018 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3019                        enum mt7915_rdd_cmd cmd, u8 index,
3020                        u8 rx_sel, u8 val)
3021 {
3022         struct {
3023                 u8 ctrl;
3024                 u8 rdd_idx;
3025                 u8 rdd_rx_sel;
3026                 u8 val;
3027                 u8 rsv[4];
3028         } __packed req = {
3029                 .ctrl = cmd,
3030                 .rdd_idx = index,
3031                 .rdd_rx_sel = rx_sel,
3032                 .val = val,
3033         };
3034
3035         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3036                                  sizeof(req), true);
3037 }
3038
3039 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3040 {
3041         struct {
3042                 __le32 tag;
3043                 __le16 min_lpn;
3044                 u8 rsv[2];
3045         } __packed req = {
3046                 .tag = cpu_to_le32(0x1),
3047                 .min_lpn = cpu_to_le16(val),
3048         };
3049
3050         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3051                                  sizeof(req), true);
3052 }
3053
3054 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3055                             const struct mt7915_dfs_pulse *pulse)
3056 {
3057         struct {
3058                 __le32 tag;
3059
3060                 __le32 max_width;               /* us */
3061                 __le32 max_pwr;                 /* dbm */
3062                 __le32 min_pwr;                 /* dbm */
3063                 __le32 min_stgr_pri;            /* us */
3064                 __le32 max_stgr_pri;            /* us */
3065                 __le32 min_cr_pri;              /* us */
3066                 __le32 max_cr_pri;              /* us */
3067         } __packed req = {
3068                 .tag = cpu_to_le32(0x3),
3069
3070 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3071                 __req_field(max_width),
3072                 __req_field(max_pwr),
3073                 __req_field(min_pwr),
3074                 __req_field(min_stgr_pri),
3075                 __req_field(max_stgr_pri),
3076                 __req_field(min_cr_pri),
3077                 __req_field(max_cr_pri),
3078 #undef __req_field
3079         };
3080
3081         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3082                                  sizeof(req), true);
3083 }
3084
3085 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3086                             const struct mt7915_dfs_pattern *pattern)
3087 {
3088         struct {
3089                 __le32 tag;
3090                 __le16 radar_type;
3091
3092                 u8 enb;
3093                 u8 stgr;
3094                 u8 min_crpn;
3095                 u8 max_crpn;
3096                 u8 min_crpr;
3097                 u8 min_pw;
3098                 __le32 min_pri;
3099                 __le32 max_pri;
3100                 u8 max_pw;
3101                 u8 min_crbn;
3102                 u8 max_crbn;
3103                 u8 min_stgpn;
3104                 u8 max_stgpn;
3105                 u8 min_stgpr;
3106                 u8 rsv[2];
3107                 __le32 min_stgpr_diff;
3108         } __packed req = {
3109                 .tag = cpu_to_le32(0x2),
3110                 .radar_type = cpu_to_le16(index),
3111
3112 #define __req_field_u8(field) .field = pattern->field
3113 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3114                 __req_field_u8(enb),
3115                 __req_field_u8(stgr),
3116                 __req_field_u8(min_crpn),
3117                 __req_field_u8(max_crpn),
3118                 __req_field_u8(min_crpr),
3119                 __req_field_u8(min_pw),
3120                 __req_field_u32(min_pri),
3121                 __req_field_u32(max_pri),
3122                 __req_field_u8(max_pw),
3123                 __req_field_u8(min_crbn),
3124                 __req_field_u8(max_crbn),
3125                 __req_field_u8(min_stgpn),
3126                 __req_field_u8(max_stgpn),
3127                 __req_field_u8(min_stgpr),
3128                 __req_field_u32(min_stgpr_diff),
3129 #undef __req_field_u8
3130 #undef __req_field_u32
3131         };
3132
3133         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3134                                  sizeof(req), true);
3135 }
3136
3137 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3138 {
3139         struct mt7915_dev *dev = phy->dev;
3140         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3141         int freq1 = chandef->center_freq1;
3142         bool ext_phy = phy != &dev->phy;
3143         struct {
3144                 u8 control_ch;
3145                 u8 center_ch;
3146                 u8 bw;
3147                 u8 tx_streams_num;
3148                 u8 rx_streams;  /* mask or num */
3149                 u8 switch_reason;
3150                 u8 band_idx;
3151                 u8 center_ch2;  /* for 80+80 only */
3152                 __le16 cac_case;
3153                 u8 channel_band;
3154                 u8 rsv0;
3155                 __le32 outband_freq;
3156                 u8 txpower_drop;
3157                 u8 ap_bw;
3158                 u8 ap_center_ch;
3159                 u8 rsv1[57];
3160         } __packed req = {
3161                 .control_ch = chandef->chan->hw_value,
3162                 .center_ch = ieee80211_frequency_to_channel(freq1),
3163                 .bw = mt7915_mcu_chan_bw(chandef),
3164                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
3165                 .rx_streams = phy->mt76->antenna_mask,
3166                 .band_idx = ext_phy,
3167                 .channel_band = chandef->chan->band,
3168         };
3169
3170 #ifdef CONFIG_NL80211_TESTMODE
3171         if (phy->mt76->test.tx_antenna_mask &&
3172             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3173              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3174              phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3175                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3176                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
3177
3178                 if (ext_phy) {
3179                         req.tx_streams_num = 2;
3180                         req.rx_streams >>= 2;
3181                 }
3182         }
3183 #endif
3184
3185         if (dev->mt76.hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3186                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3187         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3188                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3189                 req.switch_reason = CH_SWITCH_DFS;
3190         else
3191                 req.switch_reason = CH_SWITCH_NORMAL;
3192
3193         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3194                 req.rx_streams = hweight8(req.rx_streams);
3195
3196         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3197                 int freq2 = chandef->center_freq2;
3198
3199                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3200         }
3201
3202         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3203 }
3204
3205 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3206 {
3207 #define TOTAL_PAGE_MASK         GENMASK(7, 5)
3208 #define PAGE_IDX_MASK           GENMASK(4, 2)
3209 #define PER_PAGE_SIZE           0x400
3210         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3211         u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;
3212         u8 *eep = (u8 *)dev->mt76.eeprom.data;
3213         int eep_len;
3214         int i;
3215
3216         for (i = 0; i <= total; i++, eep += eep_len) {
3217                 struct sk_buff *skb;
3218                 int ret;
3219
3220                 if (i == total)
3221                         eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3222                 else
3223                         eep_len = PER_PAGE_SIZE;
3224
3225                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3226                                          sizeof(req) + eep_len);
3227                 if (!skb)
3228                         return -ENOMEM;
3229
3230                 req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |
3231                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3232                 req.len = cpu_to_le16(eep_len);
3233
3234                 skb_put_data(skb, &req, sizeof(req));
3235                 skb_put_data(skb, eep, eep_len);
3236
3237                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3238                                             MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3239                 if (ret)
3240                         return ret;
3241         }
3242
3243         return 0;
3244 }
3245
3246 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3247 {
3248         struct mt7915_mcu_eeprom req = {
3249                 .buffer_mode = EE_MODE_EFUSE,
3250                 .format = EE_FORMAT_WHOLE,
3251         };
3252
3253         if (dev->flash_mode)
3254                 return mt7915_mcu_set_eeprom_flash(dev);
3255
3256         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3257                                  &req, sizeof(req), true);
3258 }
3259
3260 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3261 {
3262         struct mt7915_mcu_eeprom_info req = {
3263                 .addr = cpu_to_le32(round_down(offset, 16)),
3264         };
3265         struct mt7915_mcu_eeprom_info *res;
3266         struct sk_buff *skb;
3267         int ret;
3268         u8 *buf;
3269
3270         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3271                                 sizeof(req), true, &skb);
3272         if (ret)
3273                 return ret;
3274
3275         res = (struct mt7915_mcu_eeprom_info *)skb->data;
3276         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3277         memcpy(buf, res->data, 16);
3278         dev_kfree_skb(skb);
3279
3280         return 0;
3281 }
3282
3283 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3284 {
3285         struct {
3286                 u8 ctrl_id;
3287                 u8 action;
3288                 u8 band;
3289                 u8 rsv[5];
3290         } req = {
3291                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3292                 .action = index,
3293         };
3294
3295         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3296                                  sizeof(req), true);
3297 }
3298
3299 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3300 {
3301         struct {
3302                 __le32 cmd;
3303                 __le16 wlan_idx;
3304                 __le16 ru_idx;
3305                 __le16 direction;
3306                 __le16 dump_group;
3307         } req = {
3308                 .cmd = cpu_to_le32(cmd),
3309                 .wlan_idx = cpu_to_le16(wlan_idx),
3310                 .dump_group = cpu_to_le16(1),
3311         };
3312
3313         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RATE_CTRL), &req,
3314                                  sizeof(req), false);
3315 }
3316
3317 int mt7915_mcu_set_sku(struct mt7915_phy *phy)
3318 {
3319         struct mt7915_dev *dev = phy->dev;
3320         struct mt76_phy *mphy = phy->mt76;
3321         struct ieee80211_hw *hw = mphy->hw;
3322         struct mt7915_sku_val {
3323                 u8 format_id;
3324                 u8 limit_type;
3325                 u8 dbdc_idx;
3326                 s8 val[MT7915_SKU_RATE_NUM];
3327         } __packed req = {
3328                 .format_id = 4,
3329                 .dbdc_idx = phy != &dev->phy,
3330         };
3331         int i;
3332         s8 *delta;
3333
3334         delta = dev->rate_power[mphy->chandef.chan->band];
3335         mphy->txpower_cur = hw->conf.power_level * 2 +
3336                             delta[MT7915_SKU_MAX_DELTA_IDX];
3337
3338         for (i = 0; i < MT7915_SKU_RATE_NUM; i++)
3339                 req.val[i] = hw->conf.power_level * 2 + delta[i];
3340
3341         return mt76_mcu_send_msg(&dev->mt76,
3342                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3343                                  sizeof(req), true);
3344 }
3345
3346 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3347                               u8 en)
3348 {
3349         struct {
3350                 u8 test_mode_en;
3351                 u8 param_idx;
3352                 u8 _rsv[2];
3353
3354                 u8 enable;
3355                 u8 _rsv2[3];
3356
3357                 u8 pad[8];
3358         } __packed req = {
3359                 .test_mode_en = test_mode,
3360                 .param_idx = param,
3361                 .enable = en,
3362         };
3363
3364         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3365                                  sizeof(req), false);
3366 }
3367
3368 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3369 {
3370         struct mt7915_dev *dev = phy->dev;
3371         struct mt7915_sku {
3372                 u8 format_id;
3373                 u8 sku_enable;
3374                 u8 dbdc_idx;
3375                 u8 rsv;
3376         } __packed req = {
3377                 .format_id = 0,
3378                 .dbdc_idx = phy != &dev->phy,
3379                 .sku_enable = enable,
3380         };
3381
3382         return mt76_mcu_send_msg(&dev->mt76,
3383                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3384                                  sizeof(req), true);
3385 }
3386
3387 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3388 {
3389         struct {
3390                 u8 action;
3391                 u8 set;
3392                 u8 band;
3393                 u8 rsv;
3394         } req = {
3395                 .action = action,
3396                 .set = set,
3397                 .band = band,
3398         };
3399
3400         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3401                                  &req, sizeof(req), false);
3402 }
3403
3404 int mt7915_mcu_set_txbf_module(struct mt7915_dev *dev)
3405 {
3406 #define MT_BF_MODULE_UPDATE               25
3407         struct {
3408                 u8 action;
3409                 u8 bf_num;
3410                 u8 bf_bitmap;
3411                 u8 bf_sel[8];
3412                 u8 rsv[8];
3413         } __packed req = {
3414                 .action = MT_BF_MODULE_UPDATE,
3415                 .bf_num = 2,
3416                 .bf_bitmap = GENMASK(1, 0),
3417         };
3418
3419         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3420                                  sizeof(req), true);
3421 }
3422
3423 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3424 {
3425 #define MT_BF_TYPE_UPDATE               20
3426         struct {
3427                 u8 action;
3428                 bool ebf;
3429                 bool ibf;
3430                 u8 rsv;
3431         } __packed req = {
3432                 .action = MT_BF_TYPE_UPDATE,
3433                 .ebf = true,
3434                 .ibf = dev->ibf,
3435         };
3436
3437         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3438                                  sizeof(req), true);
3439 }
3440
3441 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3442 {
3443 #define MT_BF_PROCESSING                4
3444         struct {
3445                 u8 action;
3446                 u8 snd_mode;
3447                 u8 sta_num;
3448                 u8 rsv;
3449                 u8 wlan_idx[4];
3450                 __le32 snd_period;      /* ms */
3451         } __packed req = {
3452                 .action = true,
3453                 .snd_mode = MT_BF_PROCESSING,
3454         };
3455
3456         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3457                                  sizeof(req), true);
3458 }
3459
3460 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3461                             bool enable)
3462 {
3463 #define MT_SPR_ENABLE           1
3464         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3465         struct {
3466                 u8 action;
3467                 u8 arg_num;
3468                 u8 band_idx;
3469                 u8 status;
3470                 u8 drop_tx_idx;
3471                 u8 sta_idx;     /* 256 sta */
3472                 u8 rsv[2];
3473                 __le32 val;
3474         } __packed req = {
3475                 .action = MT_SPR_ENABLE,
3476                 .arg_num = 1,
3477                 .band_idx = mvif->band_idx,
3478                 .val = cpu_to_le32(enable),
3479         };
3480
3481         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3482                                  sizeof(req), true);
3483 }
3484
3485 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3486                            struct ieee80211_sta *sta, struct rate_info *rate)
3487 {
3488         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3489         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3490         struct mt7915_dev *dev = phy->dev;
3491         struct mt76_phy *mphy = phy->mt76;
3492         struct {
3493                 u8 category;
3494                 u8 band;
3495                 __le16 wcid;
3496         } __packed req = {
3497                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3498                 .band = mvif->band_idx,
3499                 .wcid = cpu_to_le16(msta->wcid.idx),
3500         };
3501         struct ieee80211_supported_band *sband;
3502         struct mt7915_mcu_phy_rx_info *res;
3503         struct sk_buff *skb;
3504         u16 flags = 0;
3505         int ret;
3506         int i;
3507
3508         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3509                                         &req, sizeof(req), true, &skb);
3510         if (ret)
3511                 return ret;
3512
3513         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3514
3515         rate->mcs = res->rate;
3516         rate->nss = res->nsts + 1;
3517
3518         switch (res->mode) {
3519         case MT_PHY_TYPE_CCK:
3520         case MT_PHY_TYPE_OFDM:
3521                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3522                         sband = &mphy->sband_5g.sband;
3523                 else
3524                         sband = &mphy->sband_2g.sband;
3525
3526                 for (i = 0; i < sband->n_bitrates; i++) {
3527                         if (rate->mcs != (sband->bitrates[i].hw_value & 0xf))
3528                                 continue;
3529
3530                         rate->legacy = sband->bitrates[i].bitrate;
3531                         break;
3532                 }
3533                 break;
3534         case MT_PHY_TYPE_HT:
3535         case MT_PHY_TYPE_HT_GF:
3536                 if (rate->mcs > 31)
3537                         return -EINVAL;
3538
3539                 flags |= RATE_INFO_FLAGS_MCS;
3540
3541                 if (res->gi)
3542                         flags |= RATE_INFO_FLAGS_SHORT_GI;
3543                 break;
3544         case MT_PHY_TYPE_VHT:
3545                 flags |= RATE_INFO_FLAGS_VHT_MCS;
3546
3547                 if (res->gi)
3548                         flags |= RATE_INFO_FLAGS_SHORT_GI;
3549                 break;
3550         case MT_PHY_TYPE_HE_SU:
3551         case MT_PHY_TYPE_HE_EXT_SU:
3552         case MT_PHY_TYPE_HE_TB:
3553         case MT_PHY_TYPE_HE_MU:
3554                 rate->he_gi = res->gi;
3555
3556                 flags |= RATE_INFO_FLAGS_HE_MCS;
3557                 break;
3558         default:
3559                 break;
3560         }
3561         rate->flags = flags;
3562
3563         switch (res->bw) {
3564         case IEEE80211_STA_RX_BW_160:
3565                 rate->bw = RATE_INFO_BW_160;
3566                 break;
3567         case IEEE80211_STA_RX_BW_80:
3568                 rate->bw = RATE_INFO_BW_80;
3569                 break;
3570         case IEEE80211_STA_RX_BW_40:
3571                 rate->bw = RATE_INFO_BW_40;
3572                 break;
3573         default:
3574                 rate->bw = RATE_INFO_BW_20;
3575                 break;
3576         }
3577
3578         dev_kfree_skb(skb);
3579
3580         return 0;
3581 }